Edit tour

Windows Analysis Report
f_00321b.dll

Overview

General Information

Sample Name:	f_00321b.dll (renamed file extension from none to dll, renamed because original name is a hash value)
Original Sample Name:	f_00321b
Analysis ID:	829552
MD5:	bfc060937dc90b273eccb6825145f298
SHA1:	c156c00c7e918f0cb7363614fb1f177c90d8108a
SHA256:	2f39c2879989ddd7f9ecf52b6232598e5595f8bf367846ff188c9dfbf1251253
Infos:

Detection

Emotet

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Early bird code injection technique detected

Multi AV Scanner detection for submitted file

Yara detected Emotet

System process connects to network (likely due to code injection or exploit)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Queues an APC in another process (thread injection)

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

PE file contains sections with non-standard names

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Sample execution stops while process was sleeping (likely an evasion)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Tries to load missing DLLs

Drops PE files to the windows directory (C:\Windows)

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Connects to several IPs in different countries

Registers a DLL

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

loaddll64.exe (PID: 4224 cmdline: loaddll64.exe "C:\Users\user\Desktop\f_00321b.dll" MD5: C676FC0263EDD17D4CE7D644B8F3FCD6)

conhost.exe (PID: 2516 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3216 cmdline: cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1 MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

rundll32.exe (PID: 1264 cmdline: rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1 MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 5968 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RymKYMmySRfU\EAqrfXJOpHznppsf.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 4888 cmdline: regsvr32.exe /s C:\Users\user\Desktop\f_00321b.dll MD5: D78B75FC68247E8A63ACBA846182740E)

regsvr32.exe (PID: 1312 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

rundll32.exe (PID: 1240 cmdline: rundll32.exe C:\Users\user\Desktop\f_00321b.dll,DllRegisterServer MD5: 73C519F050C20580F8A62C849D49215A)

regsvr32.exe (PID: 4768 cmdline: C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IzuSuDitBV\QmEREbzuu.dll" MD5: D78B75FC68247E8A63ACBA846182740E)

conhost.exe (PID: 5432 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Emotet	While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.Emotet had been taken down by authorities in January 2021, though it appears to have sprung back to life in November 2021.	GOLD CABIN MUMMY SPIDER Mealybug	http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1 http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/ http://ropgadget.com/posts/defensive_pcres.html https://adalogics.com/blog/the-state-of-advanced-code-injections https://asec.ahnlab.com/en/33600/	https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet

Malware Configuration

Threatname: Emotet

{"C2 list": ["91.121.146.47:8080", "66.228.32.31:7080", "182.162.143.56:443", "187.63.160.88:80", "167.172.199.165:8080", "164.90.222.65:443", "104.168.155.143:8080", "163.44.196.120:8080", "160.16.142.56:8080", "159.89.202.34:443", "159.65.88.10:8080", "186.194.240.217:443", "149.56.131.28:8080", "72.15.201.15:8080", "1.234.2.232:8080", "82.223.21.224:8080", "206.189.28.199:8080", "169.57.156.166:8080", "107.170.39.149:8080", "103.43.75.120:443", "91.207.28.33:8080", "213.239.212.5:443", "45.235.8.30:8080", "119.59.103.152:8080", "164.68.99.3:8080", "95.217.221.146:8080", "153.126.146.25:7080", "197.242.150.244:8080", "202.129.205.3:8080", "103.132.242.26:8080", "139.59.126.41:443", "110.232.117.186:8080", "183.111.227.137:8080", "5.135.159.50:443", "201.94.166.162:443", "103.75.201.2:443", "79.137.35.198:8080", "172.105.226.75:8080", "94.23.45.86:4143", "115.68.227.76:8080", "153.92.5.27:8080", "167.172.253.162:8080", "188.44.20.25:443", "147.139.166.154:8080", "129.232.188.93:443", "173.212.193.249:8080", "185.4.135.165:8080", "45.176.232.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj50W/ClAAOAIo=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2xW++lAAKAJA="]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.320583141.0000024067ED1000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.839406801.0000000002031000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Emotet_3	Yara detected Emotet	Joe Security
00000006.00000002.839356776.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000003.00000002.319426857.00000000022D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.320938696.000001CAEF360000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000004.00000002.320487184.0000024067EA0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
00000005.00000002.320983303.000001CAEF391000.00000020.00001000.00020000.00000000.sdmp	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 4 entries

Unpacked PEs

Source	Rule	Description	Author
5.2.rundll32.exe.1caef360000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.24067ea0000.1.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
4.2.rundll32.exe.24067ea0000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.22d0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
3.2.regsvr32.exe.22d0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
5.2.rundll32.exe.1caef360000.1.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.1fe0000.0.raw.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
6.2.regsvr32.exe.1fe0000.0.unpack	JoeSecurity_Emotet_1	Yara detected Emotet	Joe Security
Click to see the 3 entries

Snort Signatures

ET CNC Feodo Tracker Reported CnC Server TCP group 11 - Source IP: 192.168.2.4 - Destination IP: 213.239.212.5

Timestamp:	192.168.2.4213.239.212.5497294432404320 03/18/23-16:00:53.457464
SID:	2404320
Source Port:	49729
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 2 - Source IP: 192.168.2.4 - Destination IP: 104.168.155.143

Timestamp:	192.168.2.4104.168.155.1434970580802404302 03/18/23-15:58:29.445426
SID:	2404302
Source Port:	49705
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 13 - Source IP: 192.168.2.4 - Destination IP: 45.235.8.30

Timestamp:	192.168.2.445.235.8.304973380802404324 03/18/23-16:00:58.958124
SID:	2404324
Source Port:	49733
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 6 - Source IP: 192.168.2.4 - Destination IP: 167.172.199.165

Timestamp:	192.168.2.4167.172.199.1654970380802404310 03/18/23-15:58:19.699415
SID:	2404310
Source Port:	49703
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 5 - Source IP: 192.168.2.4 - Destination IP: 164.90.222.65

Timestamp:	192.168.2.4164.90.222.65497044432404308 03/18/23-15:58:24.948314
SID:	2404308
Source Port:	49704
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 8 - Source IP: 192.168.2.4 - Destination IP: 187.63.160.88

Timestamp:	192.168.2.4187.63.160.8849702802404314 03/18/23-15:58:11.945439
SID:	2404314
Source Port:	49702
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 3 - Source IP: 192.168.2.4 - Destination IP: 1.234.2.232

Timestamp:	192.168.2.41.234.2.2324971980802404304 03/18/23-15:59:46.453351
SID:	2404304
Source Port:	49719
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 23 - Source IP: 192.168.2.4 - Destination IP: 91.121.146.47

Timestamp:	192.168.2.491.121.146.474969580802404344 03/18/23-15:57:43.982133
SID:	2404344
Source Port:	49695
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 10 - Source IP: 192.168.2.4 - Destination IP: 206.189.28.199

Timestamp:	192.168.2.4206.189.28.1994972180802404318 03/18/23-16:00:02.963968
SID:	2404318
Source Port:	49721
Destination Port:	8080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 16 - Source IP: 192.168.2.4 - Destination IP: 66.228.32.31

Timestamp:	192.168.2.466.228.32.314969770802404330 03/18/23-15:57:49.653644
SID:	2404330
Source Port:	49697
Destination Port:	7080
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET CNC Feodo Tracker Reported CnC Server TCP group 7 - Source IP: 192.168.2.4 - Destination IP: 182.162.143.56

Timestamp:	192.168.2.4182.162.143.56496984432404312 03/18/23-15:58:05.445458
SID:	2404312
Source Port:	49698
Destination Port:	443
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: f_00321b.dll	Virustotal: Detection: 60%			Perma Link
Source: f_00321b.dll	ReversingLabs: Detection: 79%

Antivirus detection for URL or domain

Source: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/0u	Avira URL Cloud: Label: malware
Source: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb//	Avira URL Cloud: Label: malware
Source: https://213.239.212.5/~	Avira URL Cloud: Label: malware
Source: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://213.239.212.5/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://82.223.21.224:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://107.170.39.149:8080/	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/Y	Avira URL Cloud: Label: malware
Source: https://82.223.21.224:8080/	Avira URL Cloud: Label: malware
Source: https://91.207.28.33:8080/-	Avira URL Cloud: Label: malware
Source: https://159.65.88.10:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://104.168.155.143:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/?	Avira URL Cloud: Label: malware
Source: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb//K	Avira URL Cloud: Label: malware
Source: https://164.90.222.65:443/nnukk/upfurpftd/ltwomnfleb/b/X	Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://107.170.39.149:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://91.121.146.47:8080/	Avira URL Cloud: Label: malware
Source: https://119.59.103.152:8080/	Avira URL Cloud: Label: malware
Source: https://119.59.103.152:8080/l/z	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://187.63.160.88:80/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://45.235.8.30:8080/	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/o	Avira URL Cloud: Label: malware
Source: https://66.228.32.31:7080/	Avira URL Cloud: Label: malware
Source: https://167.172.199.165:8080/	Avira URL Cloud: Label: malware
Source: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/w	Avira URL Cloud: Label: malware
Source: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/	Avira URL Cloud: Label: malware
Source: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/%	Avira URL Cloud: Label: malware
Source: https://164.90.222.65/wn	Avira URL Cloud: Label: malware
Source: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/Y	Avira URL Cloud: Label: malware
Source: https://213.239.212.5:443/nnukk/upfurpftd/ltwomnfleb/N	Avira URL Cloud: Label: malware

Source: 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Emotet {"C2 list": ["91.121.146.47:8080", "66.228.32.31:7080", "182.162.143.56:443", "187.63.160.88:80", "167.172.199.165:8080", "164.90.222.65:443", "104.168.155.143:8080", "163.44.196.120:8080", "160.16.142.56:8080", "159.89.202.34:443", "159.65.88.10:8080", "186.194.240.217:443", "149.56.131.28:8080", "72.15.201.15:8080", "1.234.2.232:8080", "82.223.21.224:8080", "206.189.28.199:8080", "169.57.156.166:8080", "107.170.39.149:8080", "103.43.75.120:443", "91.207.28.33:8080", "213.239.212.5:443", "45.235.8.30:8080", "119.59.103.152:8080", "164.68.99.3:8080", "95.217.221.146:8080", "153.126.146.25:7080", "197.242.150.244:8080", "202.129.205.3:8080", "103.132.242.26:8080", "139.59.126.41:443", "110.232.117.186:8080", "183.111.227.137:8080", "5.135.159.50:443", "201.94.166.162:443", "103.75.201.2:443", "79.137.35.198:8080", "172.105.226.75:8080", "94.23.45.86:4143", "115.68.227.76:8080", "153.92.5.27:8080", "167.172.253.162:8080", "188.44.20.25:443", "147.139.166.154:8080", "129.232.188.93:443", "173.212.193.249:8080", "185.4.135.165:8080", "45.176.232.124:443"], "Public Key": ["RUNTMSAAAABAX3S2xNjcDD0fBno33Ln5t71eii+mofIPoXkNFOX1MeiwCh48iz97kB0mJjGGZXwardnDXKxI8GCHGNl0PFj50W/ClAAOAIo=", "RUNLMSAAAADzozW1Di4r9DVWzQpMKT588RDdy7BPILP6AiDOTLYMHkSWvrQO5slbmr1OvZ2Pz+AQWzRMggQmAtO6rPH7nyx2xW++lAAKAJA="]}

Source: unknown

HTTPS traffic detected: 164.90.222.65:443 -> 192.168.2.4:49704 version: TLS 1.2

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008D28 FindFirstFileExW,		3_2_0000000180008D28
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180008D28 FindFirstFileExW,		4_2_0000000180008D28

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 159.65.88.10 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 164.90.222.65 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 213.239.212.5 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 186.194.240.217 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 104.168.155.143 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 119.59.103.152 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 159.89.202.34 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 160.16.142.56 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 91.121.146.47 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 91.207.28.33 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 103.43.75.120 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 45.235.8.30 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 72.15.201.15 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 163.44.196.120 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 206.189.28.199 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 107.170.39.149 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 187.63.160.88 80	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 66.228.32.31 7080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 82.223.21.224 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 149.56.131.28 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 169.57.156.166 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 182.162.143.56 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 1.234.2.232 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 167.172.199.165 8080	Jump to behavior

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2404308 ET CNC Feodo Tracker Reported CnC Server TCP group 5 192.168.2.4:49704 -> 164.90.222.65:443
Source: Traffic	Snort IDS: 2404344 ET CNC Feodo Tracker Reported CnC Server TCP group 23 192.168.2.4:49695 -> 91.121.146.47:8080
Source: Traffic	Snort IDS: 2404330 ET CNC Feodo Tracker Reported CnC Server TCP group 16 192.168.2.4:49697 -> 66.228.32.31:7080
Source: Traffic	Snort IDS: 2404312 ET CNC Feodo Tracker Reported CnC Server TCP group 7 192.168.2.4:49698 -> 182.162.143.56:443
Source: Traffic	Snort IDS: 2404314 ET CNC Feodo Tracker Reported CnC Server TCP group 8 192.168.2.4:49702 -> 187.63.160.88:80
Source: Traffic	Snort IDS: 2404310 ET CNC Feodo Tracker Reported CnC Server TCP group 6 192.168.2.4:49703 -> 167.172.199.165:8080
Source: Traffic	Snort IDS: 2404302 ET CNC Feodo Tracker Reported CnC Server TCP group 2 192.168.2.4:49705 -> 104.168.155.143:8080
Source: Traffic	Snort IDS: 2404304 ET CNC Feodo Tracker Reported CnC Server TCP group 3 192.168.2.4:49719 -> 1.234.2.232:8080
Source: Traffic	Snort IDS: 2404318 ET CNC Feodo Tracker Reported CnC Server TCP group 10 192.168.2.4:49721 -> 206.189.28.199:8080
Source: Traffic	Snort IDS: 2404320 ET CNC Feodo Tracker Reported CnC Server TCP group 11 192.168.2.4:49729 -> 213.239.212.5:443
Source: Traffic	Snort IDS: 2404324 ET CNC Feodo Tracker Reported CnC Server TCP group 13 192.168.2.4:49733 -> 45.235.8.30:8080

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 91.121.146.47:8080
Source: Malware configuration extractor	IPs: 66.228.32.31:7080
Source: Malware configuration extractor	IPs: 182.162.143.56:443
Source: Malware configuration extractor	IPs: 187.63.160.88:80
Source: Malware configuration extractor	IPs: 167.172.199.165:8080
Source: Malware configuration extractor	IPs: 164.90.222.65:443
Source: Malware configuration extractor	IPs: 104.168.155.143:8080
Source: Malware configuration extractor	IPs: 163.44.196.120:8080
Source: Malware configuration extractor	IPs: 160.16.142.56:8080
Source: Malware configuration extractor	IPs: 159.89.202.34:443
Source: Malware configuration extractor	IPs: 159.65.88.10:8080
Source: Malware configuration extractor	IPs: 186.194.240.217:443
Source: Malware configuration extractor	IPs: 149.56.131.28:8080
Source: Malware configuration extractor	IPs: 72.15.201.15:8080
Source: Malware configuration extractor	IPs: 1.234.2.232:8080
Source: Malware configuration extractor	IPs: 82.223.21.224:8080
Source: Malware configuration extractor	IPs: 206.189.28.199:8080
Source: Malware configuration extractor	IPs: 169.57.156.166:8080
Source: Malware configuration extractor	IPs: 107.170.39.149:8080
Source: Malware configuration extractor	IPs: 103.43.75.120:443
Source: Malware configuration extractor	IPs: 91.207.28.33:8080
Source: Malware configuration extractor	IPs: 213.239.212.5:443
Source: Malware configuration extractor	IPs: 45.235.8.30:8080
Source: Malware configuration extractor	IPs: 119.59.103.152:8080
Source: Malware configuration extractor	IPs: 164.68.99.3:8080
Source: Malware configuration extractor	IPs: 95.217.221.146:8080
Source: Malware configuration extractor	IPs: 153.126.146.25:7080
Source: Malware configuration extractor	IPs: 197.242.150.244:8080
Source: Malware configuration extractor	IPs: 202.129.205.3:8080
Source: Malware configuration extractor	IPs: 103.132.242.26:8080
Source: Malware configuration extractor	IPs: 139.59.126.41:443
Source: Malware configuration extractor	IPs: 110.232.117.186:8080
Source: Malware configuration extractor	IPs: 183.111.227.137:8080
Source: Malware configuration extractor	IPs: 5.135.159.50:443
Source: Malware configuration extractor	IPs: 201.94.166.162:443
Source: Malware configuration extractor	IPs: 103.75.201.2:443
Source: Malware configuration extractor	IPs: 79.137.35.198:8080
Source: Malware configuration extractor	IPs: 172.105.226.75:8080
Source: Malware configuration extractor	IPs: 94.23.45.86:4143
Source: Malware configuration extractor	IPs: 115.68.227.76:8080
Source: Malware configuration extractor	IPs: 153.92.5.27:8080
Source: Malware configuration extractor	IPs: 167.172.253.162:8080
Source: Malware configuration extractor	IPs: 188.44.20.25:443
Source: Malware configuration extractor	IPs: 147.139.166.154:8080
Source: Malware configuration extractor	IPs: 129.232.188.93:443
Source: Malware configuration extractor	IPs: 173.212.193.249:8080
Source: Malware configuration extractor	IPs: 185.4.135.165:8080
Source: Malware configuration extractor	IPs: 45.176.232.124:443

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: Joe Sandbox View

JA3 fingerprint: 8916410db85077a5460817142dcbc8de

Source: global traffic

HTTP traffic detected: POST /nnukk/upfurpftd/ltwomnfleb/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 164.90.222.65

Source: Joe Sandbox View

IP Address: 159.65.88.10 159.65.88.10

Source: global traffic	TCP traffic: 192.168.2.4:49695 -> 91.121.146.47:8080
Source: global traffic	TCP traffic: 192.168.2.4:49697 -> 66.228.32.31:7080
Source: global traffic	TCP traffic: 192.168.2.4:49703 -> 167.172.199.165:8080
Source: global traffic	TCP traffic: 192.168.2.4:49705 -> 104.168.155.143:8080
Source: global traffic	TCP traffic: 192.168.2.4:49706 -> 163.44.196.120:8080
Source: global traffic	TCP traffic: 192.168.2.4:49707 -> 160.16.142.56:8080
Source: global traffic	TCP traffic: 192.168.2.4:49712 -> 159.65.88.10:8080
Source: global traffic	TCP traffic: 192.168.2.4:49717 -> 149.56.131.28:8080
Source: global traffic	TCP traffic: 192.168.2.4:49718 -> 72.15.201.15:8080
Source: global traffic	TCP traffic: 192.168.2.4:49719 -> 1.234.2.232:8080
Source: global traffic	TCP traffic: 192.168.2.4:49720 -> 82.223.21.224:8080
Source: global traffic	TCP traffic: 192.168.2.4:49721 -> 206.189.28.199:8080
Source: global traffic	TCP traffic: 192.168.2.4:49722 -> 169.57.156.166:8080
Source: global traffic	TCP traffic: 192.168.2.4:49723 -> 107.170.39.149:8080
Source: global traffic	TCP traffic: 192.168.2.4:49728 -> 91.207.28.33:8080
Source: global traffic	TCP traffic: 192.168.2.4:49733 -> 45.235.8.30:8080
Source: global traffic	TCP traffic: 192.168.2.4:49734 -> 119.59.103.152:8080

Source: unknown

Network traffic detected: IP country count 17

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 91.121.146.47
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 66.228.32.31
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 182.162.143.56
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 187.63.160.88
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 167.172.199.165
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65
Source: unknown	TCP traffic detected without corresponding DNS query: 164.90.222.65

Source: regsvr32.exe, 00000006.00000003.405236343.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000006.00000003.403176312.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.403664983.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: regsvr32.exe, 00000006.00000003.403176312.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.403664983.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com//
Source: regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp, 77EC63BDA74BD0D0E0426DC8F80085060.6.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: regsvr32.exe, 00000006.00000003.403176312.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1bee005e237d0
Source: regsvr32.exe, 00000006.00000003.405118809.000000000075A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490542704.000000000075A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.404596026.000000000075A000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839083307.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/end
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://103.44.196.120:8080/
Source: regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://104.168.155.143:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://107.170.39.149:8080/
Source: regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://107.170.39.149:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.59.103.152:8080/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.59.103.152:8080/l/z
Source: regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/%
Source: regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/?
Source: regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://159.65.88.10:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490542704.0000000000755000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/
Source: regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb//K
Source: regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/w
Source: regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65/wn
Source: regsvr32.exe, 00000006.00000003.489477256.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://164.90.222.65:443/nnukk/upfurpftd/ltwomnfleb/b/X
Source: regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/
Source: regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/Y
Source: regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://167.172.199.165:8080/o
Source: regsvr32.exe, 00000006.00000003.490542704.000000000075A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://187.172.199.165:8080/
Source: regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489477256.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://187.63.160.88:80/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://189.56.131.28:8080/
Source: regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://21.235.8.30:8080/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.239.212.5/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.239.212.5/~
Source: regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://213.239.212.5:443/nnukk/upfurpftd/ltwomnfleb/N
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.235.8.30:8080/
Source: regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb//
Source: regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/0u
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/Y
Source: regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://66.228.32.31:7080/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://82.223.21.224:8080/
Source: regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://82.223.21.224:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.121.146.47:8080/
Source: regsvr32.exe, 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839083307.0000000000783000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.0000000000783000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.404883022.0000000000783000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.121.146.47:8080/nnukk/upfurpftd/ltwomnfleb/
Source: regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://91.207.28.33:8080/-

Source: unknown

HTTP traffic detected: POST /nnukk/upfurpftd/ltwomnfleb/ HTTP/1.1Connection: Keep-AliveContent-Length: 0Host: 164.90.222.65

Source: unknown

HTTPS traffic detected: 164.90.222.65:443 -> 192.168.2.4:49704 version: TLS 1.2

E-Banking Fraud

Yara detected Emotet

Source: Yara match	File source: 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.rundll32.exe.1caef360000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.24067ea0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.24067ea0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.22d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.1caef360000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.320583141.0000024067ED1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.839406801.0000000002031000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.839356776.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.319426857.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.320938696.000001CAEF360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320487184.0000024067EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.320983303.000001CAEF391000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Windows\System32\regsvr32.exe

File deleted: C:\Windows\System32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll:Zone.Identifier

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

File created: C:\Windows\system32\ZbmMPnDvLqwXll\

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180006818	3_2_0000000180006818
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_000000018000B878	3_2_000000018000B878
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180007110	3_2_0000000180007110
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008D28	3_2_0000000180008D28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180014555	3_2_0000000180014555
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_022A0000	3_2_022A0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230263C	3_2_0230263C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02308BC8	3_2_02308BC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02318FC8	3_2_02318FC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230CC14	3_2_0230CC14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231A000	3_2_0231A000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231709C	3_2_0231709C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02307D6C	3_2_02307D6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230BA2C	3_2_0230BA2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02318A2C	3_2_02318A2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02310E2C	3_2_02310E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231662C	3_2_0231662C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02304214	3_2_02304214
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230461C	3_2_0230461C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02315A00	3_2_02315A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02328A00	3_2_02328A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02318E08	3_2_02318E08
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02303E0C	3_2_02303E0C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231020C	3_2_0231020C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02310A70	3_2_02310A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02303274	3_2_02303274
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230A660	3_2_0230A660
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230B258	3_2_0230B258
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230F65C	3_2_0230F65C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231A244	3_2_0231A244
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230AAB8	3_2_0230AAB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02304EB8	3_2_02304EB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02303ABC	3_2_02303ABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231A6BC	3_2_0231A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230BE90	3_2_0230BE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02314A90	3_2_02314A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02308A8C	3_2_02308A8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02324E8C	3_2_02324E8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023092F0	3_2_023092F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023196D4	3_2_023196D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231EAC0	3_2_0231EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230D6CC	3_2_0230D6CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230D33C	3_2_0230D33C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231E310	3_2_0231E310
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230EF14	3_2_0230EF14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02313B14	3_2_02313B14
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02314F18	3_2_02314F18
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231D770	3_2_0231D770
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231CF70	3_2_0231CF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02308378	3_2_02308378
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230F77C	3_2_0230F77C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231E750	3_2_0231E750
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02304758	3_2_02304758
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230975C	3_2_0230975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02308FB0	3_2_02308FB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230FFB8	3_2_0230FFB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02318BB8	3_2_02318BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230DBA0	3_2_0230DBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02301B94	3_2_02301B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02315384	3_2_02315384
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230A7F0	3_2_0230A7F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023227EC	3_2_023227EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02313FD0	3_2_02313FD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02302FD4	3_2_02302FD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023033D4	3_2_023033D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023197CC	3_2_023197CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02311030	3_2_02311030
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231EC30	3_2_0231EC30
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230B83C	3_2_0230B83C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0232181C	3_2_0232181C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02301000	3_2_02301000
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02309408	3_2_02309408
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02307C08	3_2_02307C08
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02316C70	3_2_02316C70
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230D474	3_2_0230D474
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02302C78	3_2_02302C78
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230C078	3_2_0230C078
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230B07C	3_2_0230B07C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231B460	3_2_0231B460
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02325450	3_2_02325450
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231C058	3_2_0231C058
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02307840	3_2_02307840
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231C44C	3_2_0231C44C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231A8B0	3_2_0231A8B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230DCB8	3_2_0230DCB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023294BC	3_2_023294BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023098AC	3_2_023098AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230AC94	3_2_0230AC94
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02315880	3_2_02315880
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02304C84	3_2_02304C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231CC84	3_2_0231CC84
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02303CF4	3_2_02303CF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023090F8	3_2_023090F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023048FC	3_2_023048FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023120E0	3_2_023120E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023014D4	3_2_023014D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02313CD4	3_2_02313CD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023018DC	3_2_023018DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230F8C4	3_2_0230F8C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02315CC4	3_2_02315CC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023080CC	3_2_023080CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023108CC	3_2_023108CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02307530	3_2_02307530
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231B130	3_2_0231B130
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02306138	3_2_02306138
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02314D20	3_2_02314D20
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02311924	3_2_02311924
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231AD28	3_2_0231AD28
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02329910	3_2_02329910
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317518	3_2_02317518
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02328500	3_2_02328500
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231610C	3_2_0231610C
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023095BC	3_2_023095BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231BDA0	3_2_0231BDA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231D5F0	3_2_0231D5F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023115C8	3_2_023115C8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180006818	4_2_0000000180006818
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_000000018000B878	4_2_000000018000B878
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180007110	4_2_0000000180007110
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180008D28	4_2_0000000180008D28
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180014555	4_2_0000000180014555
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067E90000	4_2_0000024067E90000
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED263C	4_2_0000024067ED263C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED7D6C	4_2_0000024067ED7D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE709C	4_2_0000024067EE709C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEA000	4_2_0000024067EEA000
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDCC14	4_2_0000024067EDCC14
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED8BC8	4_2_0000024067ED8BC8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE8FC8	4_2_0000024067EE8FC8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDBA2C	4_2_0000024067EDBA2C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE8A2C	4_2_0000024067EE8A2C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE0E2C	4_2_0000024067EE0E2C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE662C	4_2_0000024067EE662C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED3E0C	4_2_0000024067ED3E0C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE020C	4_2_0000024067EE020C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE8E08	4_2_0000024067EE8E08
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE5A00	4_2_0000024067EE5A00
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF8A00	4_2_0000024067EF8A00
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED461C	4_2_0000024067ED461C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED4214	4_2_0000024067ED4214
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EED5F0	4_2_0000024067EED5F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE15C8	4_2_0000024067EE15C8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEBDA0	4_2_0000024067EEBDA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED95BC	4_2_0000024067ED95BC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEAD28	4_2_0000024067EEAD28
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE1924	4_2_0000024067EE1924
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE4D20	4_2_0000024067EE4D20
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED6138	4_2_0000024067ED6138
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED7530	4_2_0000024067ED7530
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEB130	4_2_0000024067EEB130
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE610C	4_2_0000024067EE610C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF8500	4_2_0000024067EF8500
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE7518	4_2_0000024067EE7518
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF9910	4_2_0000024067EF9910
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE20E0	4_2_0000024067EE20E0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED48FC	4_2_0000024067ED48FC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED90F8	4_2_0000024067ED90F8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED3CF4	4_2_0000024067ED3CF4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED80CC	4_2_0000024067ED80CC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE08CC	4_2_0000024067EE08CC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE5CC4	4_2_0000024067EE5CC4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDF8C4	4_2_0000024067EDF8C4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED18DC	4_2_0000024067ED18DC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED14D4	4_2_0000024067ED14D4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE3CD4	4_2_0000024067EE3CD4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED98AC	4_2_0000024067ED98AC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF94BC	4_2_0000024067EF94BC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDDCB8	4_2_0000024067EDDCB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEA8B0	4_2_0000024067EEA8B0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED4C84	4_2_0000024067ED4C84
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EECC84	4_2_0000024067EECC84
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE5880	4_2_0000024067EE5880
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDAC94	4_2_0000024067EDAC94
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEB460	4_2_0000024067EEB460
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDB07C	4_2_0000024067EDB07C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED2C78	4_2_0000024067ED2C78
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDC078	4_2_0000024067EDC078
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDD474	4_2_0000024067EDD474
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE6C70	4_2_0000024067EE6C70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEC44C	4_2_0000024067EEC44C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED7840	4_2_0000024067ED7840
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEC058	4_2_0000024067EEC058
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF5450	4_2_0000024067EF5450
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDB83C	4_2_0000024067EDB83C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE1030	4_2_0000024067EE1030
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEEC30	4_2_0000024067EEEC30
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED9408	4_2_0000024067ED9408
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED7C08	4_2_0000024067ED7C08
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED1000	4_2_0000024067ED1000
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF181C	4_2_0000024067EF181C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF27EC	4_2_0000024067EF27EC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDA7F0	4_2_0000024067EDA7F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE97CC	4_2_0000024067EE97CC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED2FD4	4_2_0000024067ED2FD4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED33D4	4_2_0000024067ED33D4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE3FD0	4_2_0000024067EE3FD0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDDBA0	4_2_0000024067EDDBA0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDFFB8	4_2_0000024067EDFFB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE8BB8	4_2_0000024067EE8BB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED8FB0	4_2_0000024067ED8FB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE5384	4_2_0000024067EE5384
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED1B94	4_2_0000024067ED1B94
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDF77C	4_2_0000024067EDF77C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED8378	4_2_0000024067ED8378
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EED770	4_2_0000024067EED770
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EECF70	4_2_0000024067EECF70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED975C	4_2_0000024067ED975C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED4758	4_2_0000024067ED4758
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEE750	4_2_0000024067EEE750
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDD33C	4_2_0000024067EDD33C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE4F18	4_2_0000024067EE4F18
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDEF14	4_2_0000024067EDEF14
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE3B14	4_2_0000024067EE3B14
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEE310	4_2_0000024067EEE310
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED92F0	4_2_0000024067ED92F0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDD6CC	4_2_0000024067EDD6CC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEEAC0	4_2_0000024067EEEAC0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE96D4	4_2_0000024067EE96D4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED3ABC	4_2_0000024067ED3ABC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEA6BC	4_2_0000024067EEA6BC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDAAB8	4_2_0000024067EDAAB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED4EB8	4_2_0000024067ED4EB8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED8A8C	4_2_0000024067ED8A8C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EF4E8C	4_2_0000024067EF4E8C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDBE90	4_2_0000024067EDBE90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE4A90	4_2_0000024067EE4A90
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDA660	4_2_0000024067EDA660
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED3274	4_2_0000024067ED3274
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE0A70	4_2_0000024067EE0A70
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEA244	4_2_0000024067EEA244
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDF65C	4_2_0000024067EDF65C
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDB258	4_2_0000024067EDB258
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF350000	5_2_000001CAEF350000
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A8FC8	5_2_000001CAEF3A8FC8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF398BC8	5_2_000001CAEF398BC8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AA000	5_2_000001CAEF3AA000
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39CC14	5_2_000001CAEF39CC14
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39263C	5_2_000001CAEF39263C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A709C	5_2_000001CAEF3A709C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF397D6C	5_2_000001CAEF397D6C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39FFB8	5_2_000001CAEF39FFB8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A8BB8	5_2_000001CAEF3A8BB8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF398FB0	5_2_000001CAEF398FB0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39DBA0	5_2_000001CAEF39DBA0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF391B94	5_2_000001CAEF391B94
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF399408	5_2_000001CAEF399408
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF397C08	5_2_000001CAEF397C08
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF391000	5_2_000001CAEF391000
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B27EC	5_2_000001CAEF3B27EC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39A7F0	5_2_000001CAEF39A7F0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF392FD4	5_2_000001CAEF392FD4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3933D4	5_2_000001CAEF3933D4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A97CC	5_2_000001CAEF3A97CC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A3FD0	5_2_000001CAEF3A3FD0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39B83C	5_2_000001CAEF39B83C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF397840	5_2_000001CAEF397840
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A1030	5_2_000001CAEF3A1030
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AEC30	5_2_000001CAEF3AEC30
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B181C	5_2_000001CAEF3B181C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3ACC84	5_2_000001CAEF3ACC84
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF394C84	5_2_000001CAEF394C84
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39B07C	5_2_000001CAEF39B07C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A5880	5_2_000001CAEF3A5880
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39D474	5_2_000001CAEF39D474
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF392C78	5_2_000001CAEF392C78
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39C078	5_2_000001CAEF39C078
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A6C70	5_2_000001CAEF3A6C70
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AB460	5_2_000001CAEF3AB460
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AC058	5_2_000001CAEF3AC058
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AC44C	5_2_000001CAEF3AC44C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B5450	5_2_000001CAEF3B5450
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AA6BC	5_2_000001CAEF3AA6BC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF393ABC	5_2_000001CAEF393ABC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AEAC0	5_2_000001CAEF3AEAC0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39AAB8	5_2_000001CAEF39AAB8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF394EB8	5_2_000001CAEF394EB8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B4E8C	5_2_000001CAEF3B4E8C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF398A8C	5_2_000001CAEF398A8C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A4A90	5_2_000001CAEF3A4A90
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39BE90	5_2_000001CAEF39BE90
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3992F0	5_2_000001CAEF3992F0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A96D4	5_2_000001CAEF3A96D4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39D6CC	5_2_000001CAEF39D6CC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39D33C	5_2_000001CAEF39D33C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39EF14	5_2_000001CAEF39EF14
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A3B14	5_2_000001CAEF3A3B14
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A4F18	5_2_000001CAEF3A4F18
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AE310	5_2_000001CAEF3AE310
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A5384	5_2_000001CAEF3A5384
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39F77C	5_2_000001CAEF39F77C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF398378	5_2_000001CAEF398378
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AD770	5_2_000001CAEF3AD770
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3ACF70	5_2_000001CAEF3ACF70
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39975C	5_2_000001CAEF39975C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF394758	5_2_000001CAEF394758
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AE750	5_2_000001CAEF3AE750
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A15C8	5_2_000001CAEF3A15C8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3995BC	5_2_000001CAEF3995BC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3ABDA0	5_2_000001CAEF3ABDA0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A8E08	5_2_000001CAEF3A8E08
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A5A00	5_2_000001CAEF3A5A00
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B8A00	5_2_000001CAEF3B8A00
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AD5F0	5_2_000001CAEF3AD5F0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AA244	5_2_000001CAEF3AA244
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A8A2C	5_2_000001CAEF3A8A2C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A0E2C	5_2_000001CAEF3A0E2C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A662C	5_2_000001CAEF3A662C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39BA2C	5_2_000001CAEF39BA2C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39461C	5_2_000001CAEF39461C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF394214	5_2_000001CAEF394214
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A020C	5_2_000001CAEF3A020C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF393E0C	5_2_000001CAEF393E0C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF393274	5_2_000001CAEF393274
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A0A70	5_2_000001CAEF3A0A70
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39F65C	5_2_000001CAEF39F65C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39A660	5_2_000001CAEF39A660
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39B258	5_2_000001CAEF39B258
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A5CC4	5_2_000001CAEF3A5CC4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39F8C4	5_2_000001CAEF39F8C4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B94BC	5_2_000001CAEF3B94BC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39DCB8	5_2_000001CAEF39DCB8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3998AC	5_2_000001CAEF3998AC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AA8B0	5_2_000001CAEF3AA8B0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF39AC94	5_2_000001CAEF39AC94
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3948FC	5_2_000001CAEF3948FC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B8500	5_2_000001CAEF3B8500
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF393CF4	5_2_000001CAEF393CF4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3990F8	5_2_000001CAEF3990F8
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3918DC	5_2_000001CAEF3918DC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A20E0	5_2_000001CAEF3A20E0
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A3CD4	5_2_000001CAEF3A3CD4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3914D4	5_2_000001CAEF3914D4
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A08CC	5_2_000001CAEF3A08CC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3980CC	5_2_000001CAEF3980CC
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF396138	5_2_000001CAEF396138
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AB130	5_2_000001CAEF3AB130
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF397530	5_2_000001CAEF397530
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A1924	5_2_000001CAEF3A1924
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3AAD28	5_2_000001CAEF3AAD28
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A4D20	5_2_000001CAEF3A4D20
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A7518	5_2_000001CAEF3A7518
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3A610C	5_2_000001CAEF3A610C
Source: C:\Windows\System32\rundll32.exe	Code function: 5_2_000001CAEF3B9910	5_2_000001CAEF3B9910
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_01FD0000	6_2_01FD0000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02050618	6_2_02050618
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02036E42	6_2_02036E42
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02039B79	6_2_02039B79
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020573A4	6_2_020573A4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02038BC8	6_2_02038BC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02048FC8	6_2_02048FC8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02043FD0	6_2_02043FD0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020363F4	6_2_020363F4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203640A	6_2_0203640A
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203CC14	6_2_0203CC14
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020408CC	6_2_020408CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02037D6C	6_2_02037D6C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02045A00	6_2_02045A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02058A00	6_2_02058A00
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204020C	6_2_0204020C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02048E08	6_2_02048E08
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02033E0C	6_2_02033E0C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02034214	6_2_02034214
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203461C	6_2_0203461C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02048A2C	6_2_02048A2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02040E2C	6_2_02040E2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204662C	6_2_0204662C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203BA2C	6_2_0203BA2C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203263C	6_2_0203263C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204A244	6_2_0204A244
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02056E48	6_2_02056E48
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203B258	6_2_0203B258
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203F65C	6_2_0203F65C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203A660	6_2_0203A660
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02040A70	6_2_02040A70
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02033274	6_2_02033274
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02052E84	6_2_02052E84
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02054E8C	6_2_02054E8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02038A8C	6_2_02038A8C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203BE90	6_2_0203BE90
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02044A90	6_2_02044A90
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02052AB0	6_2_02052AB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204A6BC	6_2_0204A6BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02047EBE	6_2_02047EBE
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203AAB8	6_2_0203AAB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02034EB8	6_2_02034EB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02033ABC	6_2_02033ABC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204EAC0	6_2_0204EAC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203D6CC	6_2_0203D6CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020496D4	6_2_020496D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020392F0	6_2_020392F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020536FC	6_2_020536FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02043B14	6_2_02043B14
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204E310	6_2_0204E310
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02058310	6_2_02058310
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203EF14	6_2_0203EF14
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02055B1C	6_2_02055B1C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02044F18	6_2_02044F18
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203D33C	6_2_0203D33C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204E750	6_2_0204E750
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02034758	6_2_02034758
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203975C	6_2_0203975C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02058B68	6_2_02058B68
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204D770	6_2_0204D770
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204CF70	6_2_0204CF70
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02038378	6_2_02038378
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203F77C	6_2_0203F77C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02045384	6_2_02045384
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02031B94	6_2_02031B94
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204779A	6_2_0204779A
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203DBA0	6_2_0203DBA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020547A8	6_2_020547A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02038FB0	6_2_02038FB0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203FFB8	6_2_0203FFB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02048BB8	6_2_02048BB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020497CC	6_2_020497CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02032FD4	6_2_02032FD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020333D4	6_2_020333D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020527EC	6_2_020527EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203A7F0	6_2_0203A7F0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204FFFC	6_2_0204FFFC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02031000	6_2_02031000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204A000	6_2_0204A000
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02039408	6_2_02039408
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02037C08	6_2_02037C08
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02037410	6_2_02037410
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0205181C	6_2_0205181C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02041030	6_2_02041030
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204EC30	6_2_0204EC30
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203B83C	6_2_0203B83C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02037840	6_2_02037840
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204C44C	6_2_0204C44C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02055450	6_2_02055450
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204C058	6_2_0204C058
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204B460	6_2_0204B460
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02055868	6_2_02055868
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02046C70	6_2_02046C70
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203D474	6_2_0203D474
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02032C78	6_2_02032C78
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203C078	6_2_0203C078
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203B07C	6_2_0203B07C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204CC84	6_2_0204CC84
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02045880	6_2_02045880
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02034C84	6_2_02034C84
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0205488C	6_2_0205488C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02051494	6_2_02051494
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203AC94	6_2_0203AC94
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204709C	6_2_0204709C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020544A8	6_2_020544A8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020398AC	6_2_020398AC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204A8B0	6_2_0204A8B0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020594BC	6_2_020594BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203DCB8	6_2_0203DCB8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02045CC4	6_2_02045CC4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0203F8C4	6_2_0203F8C4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020380CC	6_2_020380CC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02043CD4	6_2_02043CD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02051CD4	6_2_02051CD4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020314D4	6_2_020314D4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020318DC	6_2_020318DC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020420E0	6_2_020420E0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02033CF4	6_2_02033CF4
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020390F8	6_2_020390F8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020348FC	6_2_020348FC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02058500	6_2_02058500
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02052100	6_2_02052100
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204610C	6_2_0204610C
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02059910	6_2_02059910
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02047518	6_2_02047518
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02041924	6_2_02041924
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02044D20	6_2_02044D20
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204AD28	6_2_0204AD28
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204B130	6_2_0204B130
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02036138	6_2_02036138
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_02054D64	6_2_02054D64
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204BDA0	6_2_0204BDA0
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020395BC	6_2_020395BC
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_020415C8	6_2_020415C8
Source: C:\Windows\System32\regsvr32.exe	Code function: 6_2_0204D5F0	6_2_0204D5F0

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,	3_2_0000000180010C10
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010AC0 ExitProcess,RtlQueueApcWow64Thread,NtTestAlert,	3_2_0000000180010AC0
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180010DB0 ZwOpenSymbolicLinkObject,ZwOpenSymbolicLinkObject,	3_2_0000000180010DB0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,	4_2_0000000180010C10
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180010AC0 ExitProcess,RtlQueueApcWow64Thread,NtTestAlert,	4_2_0000000180010AC0
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180010DB0 ZwOpenSymbolicLinkObject,ZwOpenSymbolicLinkObject,	4_2_0000000180010DB0

Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll	Jump to behavior

Source: f_00321b.dll	Virustotal: Detection: 60%
Source: f_00321b.dll	ReversingLabs: Detection: 79%

Source: f_00321b.dll

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\System32\loaddll64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\f_00321b.dll"
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\f_00321b.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\f_00321b.dll,DllRegisterServer
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RymKYMmySRfU\EAqrfXJOpHznppsf.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IzuSuDitBV\QmEREbzuu.dll"
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\f_00321b.dll	Jump to behavior
Source: C:\Windows\System32\loaddll64.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\f_00321b.dll,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll"	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RymKYMmySRfU\EAqrfXJOpHznppsf.dll"	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\regsvr32.exe C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IzuSuDitBV\QmEREbzuu.dll"	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winDLL@17/2@0/48

Source: C:\Windows\System32\regsvr32.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_02308BC8 Process32NextW,Process32FirstW,CreateToolhelp32Snapshot,FindCloseChangeNotification,

3_2_02308BC8

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2516:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:5432:120:WilError_01

Source: C:\Windows\System32\regsvr32.exe

File read: C:\Windows\System32\drivers\etc\hosts

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Automated click: OK
Source: C:\Windows\System32\regsvr32.exe	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: f_00321b.dll

Static PE information: Image base 0x180000000 > 0x60000000

Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: f_00321b.dll	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: f_00321b.dll

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source: f_00321b.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: f_00321b.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: f_00321b.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: f_00321b.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: f_00321b.dll	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180005C69 push rdi; ret	3_2_0000000180005C72
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800056DD push rdi; ret	3_2_00000001800056E4
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230A26E push ebp; ret	3_2_0230A26F
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317EAF push 458BCC5Ah; retf	3_2_02317EBC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02309E8B push eax; retf	3_2_02309E8E
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0231C731 push esi; iretd	3_2_0231C732
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02306C9F pushad ; ret	3_2_02306CAA
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230A0FC push ebp; iretd	3_2_0230A0FD
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_023180D7 push ebp; retf	3_2_023180D8
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02306CDE push esi; iretd	3_2_02306CDF
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317D3C push ebp; retf	3_2_02317D3D
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317D25 push 4D8BFFFFh; retf	3_2_02317D2A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02309D51 push ebp; retf	3_2_02309D5A
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02318157 push ebp; retf	3_2_02318158
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317D4E push ebp; iretd	3_2_02317D4F
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_02317987 push ebp; iretd	3_2_0231798F
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0230A1D2 push ebp; iretd	3_2_0230A1D3
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180005C69 push rdi; ret	4_2_0000000180005C72
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800056DD push rdi; ret	4_2_00000001800056E4
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDA1D2 push ebp; iretd	4_2_0000024067EDA1D3
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE7987 push ebp; iretd	4_2_0000024067EE798F
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE7D4E push ebp; iretd	4_2_0000024067EE7D4F
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE8157 push ebp; retf	4_2_0000024067EE8158
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED9D51 push ebp; retf	4_2_0000024067ED9D5A
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE7D25 push 4D8BFFFFh; retf	4_2_0000024067EE7D2A
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE7D3C push ebp; retf	4_2_0000024067EE7D3D
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EDA0FC push ebp; iretd	4_2_0000024067EDA0FD
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED6CDE push esi; iretd	4_2_0000024067ED6CDF
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EE80D7 push ebp; retf	4_2_0000024067EE80D8
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067ED6C9F pushad ; ret	4_2_0000024067ED6CAA
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000024067EEC731 push esi; iretd	4_2_0000024067EEC732

Source: f_00321b.dll

Static PE information: section name: _RDATA

Source: C:\Windows\System32\loaddll64.exe

Process created: C:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\f_00321b.dll

Source: C:\Windows\System32\regsvr32.exe

PE file moved: C:\Windows\System32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\System32\regsvr32.exe	File opened: C:\Windows\system32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\system32\RymKYMmySRfU\EAqrfXJOpHznppsf.dll:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\system32\IzuSuDitBV\QmEREbzuu.dll:Zone.Identifier read attributes \| delete	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe TID: 5164

Thread sleep time: -660000s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\regsvr32.exe

API coverage: 9.3 %

Source: C:\Windows\System32\regsvr32.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180008D28 FindFirstFileExW,		3_2_0000000180008D28
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180008D28 FindFirstFileExW,		4_2_0000000180008D28

Source: C:\Windows\System32\regsvr32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: regsvr32.exe, 00000006.00000003.405236343.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWN
Source: regsvr32.exe, 00000006.00000003.405236343.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.000000000074B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.404596026.000000000074B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839083307.000000000074B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000004.00000003.318175405.0000024067CAE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_0000000180001C48

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_000000018000A878 GetProcessHeap,

3_2_000000018000A878

Source: C:\Windows\System32\loaddll64.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_0000000180010C10 LdrFindResource_U,LdrAccessResource,NtAllocateVirtualMemory,

3_2_0000000180010C10

Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_0000000180001C48
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800082EC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_00000001800082EC
Source: C:\Windows\System32\regsvr32.exe	Code function: 3_2_00000001800017DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_00000001800017DC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_0000000180001C48 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_0000000180001C48
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800082EC RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_00000001800082EC
Source: C:\Windows\System32\rundll32.exe	Code function: 4_2_00000001800017DC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00000001800017DC

HIPS / PFW / Operating System Protection Evasion

Early bird code injection technique detected

Source: C:\Windows\System32\cmd.exe

Process created / APC Queued / Resumed: C:\Windows\System32\rundll32.exe

Jump to behavior

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\System32\regsvr32.exe	Network Connect: 159.65.88.10 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 164.90.222.65 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 213.239.212.5 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 186.194.240.217 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 104.168.155.143 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 119.59.103.152 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 159.89.202.34 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 160.16.142.56 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 91.121.146.47 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 91.207.28.33 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 103.43.75.120 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 45.235.8.30 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 72.15.201.15 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 163.44.196.120 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 206.189.28.199 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 107.170.39.149 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 187.63.160.88 80	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 66.228.32.31 7080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 82.223.21.224 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 149.56.131.28 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 169.57.156.166 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 182.162.143.56 443	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 1.234.2.232 8080	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Network Connect: 167.172.199.165 8080	Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Windows\System32\regsvr32.exe

Thread APC queued: target process: C:\Windows\System32\rundll32.exe

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_00000001800070A0 cpuid

3_2_00000001800070A0

Source: C:\Windows\System32\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Code function: 3_2_0000000180001D98 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_0000000180001D98

Stealing of Sensitive Information

Yara detected Emotet

Source: Yara match	File source: 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 5.2.rundll32.exe.1caef360000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.24067ea0000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.24067ea0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.22d0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.regsvr32.exe.22d0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.rundll32.exe.1caef360000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.regsvr32.exe.1fe0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.320583141.0000024067ED1000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.839406801.0000000002031000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.839356776.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.319426857.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.320938696.000001CAEF360000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.320487184.0000024067EA0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.320983303.000001CAEF391000.00000020.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	311 Process Injection	2 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	31 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	311 Process Injection	Security Account Manager	2 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 Hidden Files and Directories	NTDS	2 Process Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	12 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Regsvr32	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 File Deletion	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
f_00321b.dll	60%	Virustotal		Browse
f_00321b.dll	79%	ReversingLabs	Win64.Trojan.Emotet

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
5.2.rundll32.exe.1caef360000.1.unpack	100%	Avira	HEUR/AGEN.1215476	Download File
4.2.rundll32.exe.24067ea0000.1.unpack	100%	Avira	HEUR/AGEN.1215476	Download File
3.2.regsvr32.exe.22d0000.0.unpack	100%	Avira	HEUR/AGEN.1215476	Download File
6.2.regsvr32.exe.1fe0000.0.unpack	100%	Avira	HEUR/AGEN.1215476	Download File

Domains

Source	Detection	Scanner	Label	Link
c-0001.c-msedge.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://164.90.222.65/	0%	URL Reputation	safe
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/0u	100%	Avira URL Cloud	malware
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb//	100%	Avira URL Cloud	malware
https://213.239.212.5/~	100%	Avira URL Cloud	malware
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://21.235.8.30:8080/	0%	Avira URL Cloud	safe
https://213.239.212.5/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://82.223.21.224:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://107.170.39.149:8080/	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/Y	100%	Avira URL Cloud	malware
https://82.223.21.224:8080/	100%	Avira URL Cloud	malware
https://91.207.28.33:8080/-	100%	Avira URL Cloud	malware
https://159.65.88.10:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://104.168.155.143:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/?	100%	Avira URL Cloud	malware
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb//K	100%	Avira URL Cloud	malware
https://164.90.222.65:443/nnukk/upfurpftd/ltwomnfleb/b/X	100%	Avira URL Cloud	malware
https://91.121.146.47:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://189.56.131.28:8080/	0%	Avira URL Cloud	safe
https://107.170.39.149:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://91.121.146.47:8080/	100%	Avira URL Cloud	malware
https://119.59.103.152:8080/	100%	Avira URL Cloud	malware
https://119.59.103.152:8080/l/z	100%	Avira URL Cloud	malware
https://187.172.199.165:8080/	0%	Avira URL Cloud	safe
https://167.172.199.165:8080/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://187.63.160.88:80/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://45.235.8.30:8080/	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/o	100%	Avira URL Cloud	malware
https://66.228.32.31:7080/	100%	Avira URL Cloud	malware
https://167.172.199.165:8080/	100%	Avira URL Cloud	malware
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/w	100%	Avira URL Cloud	malware
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/	100%	Avira URL Cloud	malware
https://103.44.196.120:8080/	0%	Avira URL Cloud	safe
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/%	100%	Avira URL Cloud	malware
https://164.90.222.65/wn	100%	Avira URL Cloud	malware
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/Y	100%	Avira URL Cloud	malware
https://213.239.212.5:443/nnukk/upfurpftd/ltwomnfleb/N	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
c-0001.c-msedge.net	13.107.4.50	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb//	regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/0u	regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/Y	regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://213.239.212.5/~	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://21.235.8.30:8080/	regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://164.90.222.65/	regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490542704.0000000000755000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://213.239.212.5/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://82.223.21.224:8080/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://107.170.39.149:8080/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://82.223.21.224:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839161422.00000000007DE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://91.207.28.33:8080/-	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://159.65.88.10:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb//K	regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://104.168.155.143:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/?	regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://164.90.222.65:443/nnukk/upfurpftd/ltwomnfleb/b/X	regsvr32.exe, 00000006.00000003.489477256.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://91.121.146.47:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839083307.0000000000783000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490273767.0000000000783000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.404883022.0000000000783000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://189.56.131.28:8080/	regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://107.170.39.149:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://119.59.103.152:8080/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839483293.00000000027F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://119.59.103.152:8080/l/z	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://91.121.146.47:8080/	regsvr32.exe, 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://187.172.199.165:8080/	regsvr32.exe, 00000006.00000003.490542704.000000000075A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://167.172.199.165:8080/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://187.63.160.88:80/nnukk/upfurpftd/ltwomnfleb/	regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489477256.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://45.235.8.30:8080/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/o	regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://66.228.32.31:7080/	regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://167.172.199.165:8080/	regsvr32.exe, 00000006.00000003.489636970.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://119.59.103.152:8080/nnukk/upfurpftd/ltwomnfleb/%	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://164.90.222.65/nnukk/upfurpftd/ltwomnfleb/w	regsvr32.exe, 00000006.00000003.490273767.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000002.839161422.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490454644.0000000000797000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.490651926.00000000007A2000.00000004.00000020.00020000.00000000.sdmp, regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://164.90.222.65/wn	regsvr32.exe, 00000006.00000003.489636970.0000000000797000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://103.44.196.120:8080/	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://45.235.8.30:8080/nnukk/upfurpftd/ltwomnfleb/Y	regsvr32.exe, 00000006.00000002.839305348.00000000007F4000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://213.239.212.5:443/nnukk/upfurpftd/ltwomnfleb/N	regsvr32.exe, 00000006.00000002.839483293.000000000285E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
159.65.88.10	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
172.105.226.75	unknown	United States	63949	LINODE-APLinodeLLCUS	true
164.90.222.65	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
110.232.117.186	unknown	Australia	56038	RACKCORP-APRackCorpAU	true
213.239.212.5	unknown	Germany	24940	HETZNER-ASDE	true
5.135.159.50	unknown	France	16276	OVHFR	true
186.194.240.217	unknown	Brazil	262733	NetceteraTelecomunicacoesLtdaBR	true
103.132.242.26	unknown	India	45117	INPL-IN-APIshansNetworkIN	true
104.168.155.143	unknown	United States	54290	HOSTWINDSUS	true
119.59.103.152	unknown	Thailand	56067	METRABYTE-TH453LadplacoutJorakhaebuaTH	true
79.137.35.198	unknown	France	16276	OVHFR	true
159.89.202.34	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
91.121.146.47	unknown	France	16276	OVHFR	true
160.16.142.56	unknown	Japan	9370	SAKURA-BSAKURAInternetIncJP	true
201.94.166.162	unknown	Brazil	28573	CLAROSABR	true
91.207.28.33	unknown	Kyrgyzstan	39819	PROHOSTKG	true
103.75.201.2	unknown	Thailand	133496	CDNPLUSCOLTD-AS-APCDNPLUSCOLTDTH	true
103.43.75.120	unknown	Japan	20473	AS-CHOOPAUS	true
115.68.227.76	unknown	Korea Republic of	38700	SMILESERV-AS-KRSMILESERVKR	true
188.44.20.25	unknown	Macedonia	57374	GIV-ASMK	true
45.235.8.30	unknown	Brazil	267405	WIKINETTELECOMUNICACOESBR	true
153.126.146.25	unknown	Japan	7684	SAKURA-ASAKURAInternetIncJP	true
72.15.201.15	unknown	United States	13649	ASN-VINSUS	true
163.44.196.120	unknown	Singapore	135161	GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	true
206.189.28.199	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
107.170.39.149	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
66.228.32.31	unknown	United States	63949	LINODE-APLinodeLLCUS	true
187.63.160.88	unknown	Brazil	28169	BITCOMPROVEDORDESERVICOSDEINTERNETLTDABR	true
82.223.21.224	unknown	Spain	8560	ONEANDONE-ASBrauerstrasse48DE	true
197.242.150.244	unknown	South Africa	37611	AfrihostZA	true
173.212.193.249	unknown	Germany	51167	CONTABODE	true
185.4.135.165	unknown	Greece	199246	TOPHOSTGR	true
183.111.227.137	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	true
45.176.232.124	unknown	Colombia	267869	CABLEYTELECOMUNICACIONESDECOLOMBIASASCABLETELCOC	true
95.217.221.146	unknown	Germany	24940	HETZNER-ASDE	true
149.56.131.28	unknown	Canada	16276	OVHFR	true
169.57.156.166	unknown	United States	36351	SOFTLAYERUS	true
164.68.99.3	unknown	Germany	51167	CONTABODE	true
182.162.143.56	unknown	Korea Republic of	3786	LGDACOMLGDACOMCorporationKR	true
139.59.126.41	unknown	Singapore	14061	DIGITALOCEAN-ASNUS	true
1.234.2.232	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
167.172.253.162	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
129.232.188.93	unknown	South Africa	37153	xneeloZA	true
167.172.199.165	unknown	United States	14061	DIGITALOCEAN-ASNUS	true
202.129.205.3	unknown	Thailand	45328	NIPA-AS-THNIPATECHNOLOGYCOLTDTH	true
147.139.166.154	unknown	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
153.92.5.27	unknown	Germany	47583	AS-HOSTINGERLT	true
94.23.45.86	unknown	France	16276	OVHFR	true

General Information

Joe Sandbox Version:	37.0.0 Beryl
Analysis ID:	829552
Start date and time:	2023-03-18 15:56:02 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	f_00321b.dll (renamed file extension from none to dll, renamed because original name is a hash value)
Original Sample Name:	f_00321b
Detection:	MAL
Classification:	mal100.troj.evad.winDLL@17/2@0/48
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 50.2% (good quality ratio 42.4%) Quality average: 60.5% Quality standard deviation: 35.6%
HCA Information:	Successful, ratio: 84% Number of executed functions: 35 Number of non-executed functions: 160
Cookbook Comments:	Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, backgroundTaskHost.exe
Excluded IPs from analysis (whitelisted): 13.107.4.50
Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:57:44	API Interceptor	23x Sleep call for process: regsvr32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
159.65.88.10	aOHLlvfakv.dll	Get hash	malicious	Emotet	Browse
	aOHLlvfakv.dll	Get hash	malicious	Emotet	Browse
	Form - 16 Mar, 2023.one	Get hash	malicious	Emotet	Browse
	MBQ24253060297767042_202303161424.one	Get hash	malicious	Emotet	Browse
	iMedPub_LTD_4.one	Get hash	malicious	Emotet	Browse
	iMedPub_LTD_6.one	Get hash	malicious	Emotet	Browse
	INNOVINC.one	Get hash	malicious	Emotet	Browse
	Insight_Medical_Publishing_2.one	Get hash	malicious	Emotet	Browse
	Insight_Medical_Publishing_1.one	Get hash	malicious	Emotet	Browse
	Insight_Medical_Publishing_3.one	Get hash	malicious	Emotet	Browse
	Insight_Medical_Publishing_4.one	Get hash	malicious	Emotet	Browse
	OMICS_Online_1.one	Get hash	malicious	Emotet	Browse
	Insight_Medical_Publishing.one	Get hash	malicious	Emotet	Browse
	Omics_Journal.one	Get hash	malicious	Emotet	Browse
	OMICS.one	Get hash	malicious	Emotet	Browse
	OPAST_GROUP_1.one	Get hash	malicious	Emotet	Browse
	OPAST_GROUP_LLC.one	Get hash	malicious	Emotet	Browse
	OPAST_GROUP.one	Get hash	malicious	Emotet	Browse
	Opast_International.one	Get hash	malicious	Emotet	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
c-0001.c-msedge.net	https://www.dropbox.com/scl/fi/1nqyu0mxlcuol77cvuzhq/Please-kindly-preview-the-paper-document-below..paper?dl=0&rlkey=px6p30z2du1tnve24vqyow1se	Get hash	malicious	HTMLPhisher	Browse	13.107.4.50
	http://13.107.4.50	Get hash	malicious	Unknown	Browse	13.107.4.50
	DISCOUNT_PRICES.exe	Get hash	malicious	AgentTesla, zgRAT	Browse	13.107.4.50
	New_Order.exe	Get hash	malicious	AgentTesla	Browse	13.107.4.50
	https://midcoastsupplies.com.au	Get hash	malicious	Unknown	Browse	13.107.4.50
	DHL_Original_Document.exe	Get hash	malicious	AgentTesla	Browse	13.107.4.50
	Insight_Medical_Publishing.one	Get hash	malicious	Emotet	Browse	13.107.4.50
	Omics_Journal.one	Get hash	malicious	Emotet	Browse	13.107.4.50
	PurchaseOrder-pdf.exe	Get hash	malicious	AgentTesla	Browse	13.107.4.50
	WIFhAJKfNY.dll	Get hash	malicious	Emotet	Browse	13.107.4.50
	NG7553084292252526_202303161746.one	Get hash	malicious	Emotet	Browse	13.107.4.50
	EOPXCLX23550.vbs	Get hash	malicious	AsyncRAT	Browse	13.107.4.50
	SecuriteInfo.com.Variant.Razy.447182.26738.13493.exe	Get hash	malicious	Unknown	Browse	13.107.4.50
	wDIpNqyTA2.exe	Get hash	malicious	AgentTesla	Browse	13.107.4.50
	DKUVWEO27j.exe	Get hash	malicious	AveMaria, UACMe	Browse	13.107.4.50
	ATT98089.htm	Get hash	malicious	HTMLPhisher	Browse	13.107.4.50
	Ro.js	Get hash	malicious	Qbot	Browse	13.107.4.50
	INVOICE_VM220200200208.exe	Get hash	malicious	AgentTesla	Browse	13.107.4.50
	TitleContractDocs.pdf.lnk	Get hash	malicious	Unknown	Browse	13.107.4.50
	file.exe	Get hash	malicious	AgentTesla	Browse	13.107.4.50

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	157.245.170.65
	wE6nyFav1l.elf	Get hash	malicious	Unknown	Browse	157.230.217.69
	iekih3ewfo.elf	Get hash	malicious	Mirai	Browse	157.230.217.69
	F81iFExXxR.elf	Get hash	malicious	Unknown	Browse	157.230.217.69
	2Zq8f4veB3.elf	Get hash	malicious	Mirai	Browse	157.230.217.69
	doZa4wByEK.elf	Get hash	malicious	Mirai	Browse	157.230.217.69
	lcjsGw2zy5.elf	Get hash	malicious	Mirai	Browse	157.230.217.69
	zRmIi0pNmI.elf	Get hash	malicious	Mirai	Browse	157.230.217.69
	z2H8jaZbYg.elf	Get hash	malicious	Mirai, Moobot	Browse	104.248.213.183
	loligang.arm7.elf	Get hash	malicious	Mirai	Browse	167.71.31.167
	https://knowledgeburrow.com/did-benjamin-franklin-really-say-if-you-fail-to-plan-you-are-planning-to-fail/	Get hash	malicious	Unknown	Browse	161.35.253.218
	d1mhDLrdaN.elf	Get hash	malicious	Mirai	Browse	159.65.218.65
	http://searchunify.com	Get hash	malicious	Unknown	Browse	209.97.144.176
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	157.245.169.66
	aOHLlvfakv.dll	Get hash	malicious	Emotet	Browse	159.89.202.34
	aOHLlvfakv.dll	Get hash	malicious	Emotet	Browse	159.89.202.34
	Form - 16 Mar, 2023.one	Get hash	malicious	Emotet	Browse	159.89.202.34
	ccdc 5b contract explained 17361.js	Get hash	malicious	Unknown	Browse	167.71.236.170
	https://wx6j1u05.page.link/NLtk	Get hash	malicious	GRQ Scam	Browse	198.211.98.91

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
8916410db85077a5460817142dcbc8de	Form - 16 Mar, 2023.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	MBQ24253060297767042_202303161424.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	iMedPub_LTD_4.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	iMedPub_LTD_6.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	INNOVINC.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	Insight_Medical_Publishing_2.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	Insight_Medical_Publishing_1.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	Insight_Medical_Publishing_3.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	Insight_Medical_Publishing_4.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	OMICS_Online_1.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	Insight_Medical_Publishing.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	Omics_Journal.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	OMICS.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	OPAST_GROUP_1.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	OPAST_GROUP_LLC.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	OPAST_GROUP.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	Opast_International.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	opastonline.com.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	Opast_Publishing_Group_1.one	Get hash	malicious	Emotet	Browse	164.90.222.65
	Opast_Publishing_Group.one	Get hash	malicious	Emotet	Browse	164.90.222.65

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 62582 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	62582
Entropy (8bit):	7.996063107774368
Encrypted:	true
SSDEEP:	1536:Jk3XPi43VgGp0gB2itudTSRAn/TWTdWftu:CHa43V5p022iZ4CgA
MD5:	E71C8443AE0BC2E282C73FAEAD0A6DD3
SHA1:	0C110C1B01E68EDFACAEAE64781A37B1995FA94B
SHA-256:	95B0A5ACC5BF70D3ABDFD091D0C9F9063AA4FDE65BD34DBF16786082E1992E72
SHA-512:	B38458C7FA2825AFB72794F374827403D5946B1132E136A0CE075DFD351277CF7D957C88DC8A1E4ADC3BCAE1FA8010DAE3831E268E910D517691DE24326391A6
Malicious:	false
Preview:	MSCF....v.......,...................I.................BVrl .authroot.stl....oJ5..CK..8U....a..3.1.P. J.".t..2F2e.dHH......$E.KB.2D..-SJE....^..'..y.}..,{m.....\...]4.G.......h....148...e.gr.....48:.L...g.....Xef.x:..t...J...6-....kW6Z>....&......ye.U.Q&z:.vZ..._....a...]..T.E.....B.h.,...[....V.O.3..EW.x.?.Q..$.@.W..=.B.f..8a.Y.JK..g./%p..C.4CD.s..Jd.u..@.g=...a.. .h%..'.xjy7.E..\.....A..':.4TdW?Ko3$.Hg.z.d~....../q..C.....`...A[ W(.........9...GZ.;....l&?........F...p?... .p.....{S.L4..v.+...7.T?.....p..`..&..9.......f...0+.L.....1.2b)..vX5L'.~....2vz.,E.Ni.{#...o..w.?.#.3..h.v<.S%.].tD@!Le.w.q.7.8....QW.FT.....hE.........Y............./.%Q...k....Y.n..v.A..../...>B..5\..-Ko.......O<.b.K.{.O.b...._.7...4.;%9N..K.X>......kg-9..r.c.g.G\|.[.-...HT...",?.q...ad....7RE.......!f..#../....?.-.^.K.c^...+{.g......]<..$.=.O....ii7.wJ+S..Z..d.....>..J*...T..Q7..`.r,<$....\d:K`..T.n....N.....C..j.;.1SX..j....1...R....+....Yg....]....3..9..S..D..`.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Windows\System32\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.123641537625697
Encrypted:	false
SSDEEP:	6:kKOry/7UN+SkQlPlEGYRMY9z+4KlDA3RUecZUt:mCvkPlE99SNxAhUext
MD5:	1D721B64039DC653E2772556CCB02D45
SHA1:	804188A5F346A929ADFE4618FBE24CDF9BB0C38F
SHA-256:	10F85BCAB9F99A4D5BF26EA9A275348685020D302B71C4CAF4ABB46EA66940B4
SHA-512:	BAC9FCC93AD14D431147EDBB4C1986839274A47B1E53BF0C9085F445AD6B8B654F51DAC40E21ADD3F44F66FA891C1C6C7471B75159D7BF3A3AAF68866BE25CB8
Malicious:	false
Preview:	p...... ........9....Y..(....................................................... ..........).K......&...........v...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.d.2.f.9.2.9.a.7.4.b.d.9.1.:.0."...

Static File Info

General

File type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Entropy (8bit):	7.337848702590508
TrID:	Win64 Dynamic Link Library (generic) (102004/3) 86.43% Win64 Executable (generic) (12005/4) 10.17% Generic Win/DOS Executable (2004/3) 1.70% DOS Executable Generic (2002/1) 1.70% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.01%
File name:	f_00321b.dll
File size:	316928
MD5:	bfc060937dc90b273eccb6825145f298
SHA1:	c156c00c7e918f0cb7363614fb1f177c90d8108a
SHA256:	2f39c2879989ddd7f9ecf52b6232598e5595f8bf367846ff188c9dfbf1251253
SHA512:	cc1fee19314b0a0f9e292fa84f6e98f087033d77db937848dda1da0c88f49997866cba5465df04bf929b810b42fdb81481341064c4565c9b6272fa7f3b473ac5
SSDEEP:	6144:cwNQMQTlfdUPABVy559hhR3iP7TfPYbrF1EFVw0todxKROsCt:rNbadDBkZ6rPeEFizdxxsCt
TLSH:	2C649D47E2A601E7FC62763DA0734708A766B0524314EB5F02B04F5B2F637A3FD5AA25
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L`.=...n...n...nCy.o...nCy.o...nCy.o...n.z.o(..n.z.o...n.z.o...nCy.o...n...nq..n.z.o...n.z.o...n.zsn...n...n...n.z.o...nRich...

File Icon


Icon Hash:	74f0e4ecccdce0e4

Static PE Info

General

Entrypoint:	0x18000179c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x180000000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, DLL
DLL Characteristics:	HIGH_ENTROPY_VA, NX_COMPAT
Time Stamp:	0x640B360F [Fri Mar 10 13:52:15 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	abb9300283e542fb453de5c4c87cd55d

Entrypoint Preview

Instruction
dec eax
mov dword ptr [esp+08h], ebx
dec eax
mov dword ptr [esp+10h], esi
push edi
dec eax
sub esp, 20h
dec ecx
mov edi, eax
mov ebx, edx
dec eax
mov esi, ecx
cmp edx, 01h
jne 00007FDE20B6DC67h
call 00007FDE20B6E240h
dec esp
mov eax, edi
mov edx, ebx
dec eax
mov ecx, esi
dec eax
mov ebx, dword ptr [esp+30h]
dec eax
mov esi, dword ptr [esp+38h]
dec eax
add esp, 20h
pop edi
jmp 00007FDE20B6DAF4h
int3
int3
int3
inc eax
push ebx
dec eax
sub esp, 20h
dec eax
mov ebx, ecx
xor ecx, ecx
call dword ptr [00014903h]
dec eax
mov ecx, ebx
call dword ptr [000148F2h]
call dword ptr [000148FCh]
dec eax
mov ecx, eax
mov edx, C0000409h
dec eax
add esp, 20h
pop ebx
dec eax
jmp dword ptr [000148F0h]
dec eax
mov dword ptr [esp+08h], ecx
dec eax
sub esp, 38h
mov ecx, 00000017h
call dword ptr [000148E4h]
test eax, eax
je 00007FDE20B6DC69h
mov ecx, 00000002h
int 29h
dec eax
lea ecx, dword ptr [0002038Ah]
call 00007FDE20B6DE2Eh
dec eax
mov eax, dword ptr [esp+38h]
dec eax
mov dword ptr [00020471h], eax
dec eax
lea eax, dword ptr [esp+38h]
dec eax
add eax, 08h
dec eax
mov dword ptr [00020401h], eax
dec eax
mov eax, dword ptr [0002045Ah]
dec eax
mov dword ptr [000202CBh], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x1f910	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1f964	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x2bd28	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x23000	0x11a0	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x52000	0x684	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1e1b0	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1e070	0x140	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x16000	0x360	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x14415	0x14600	False	0.5082438650306749	data	6.388870950832575	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x16000	0xa4b4	0xa600	False	0.4210749246987952	data	4.746360898517369	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x21000	0x1ea4	0xc00	False	0.1513671875	DOS executable (block device driver \322f\324\377\3772)	2.0951973339816368	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.pdata	0x23000	0x11a0	0x1200	False	0.4715711805555556	data	4.892908366942992	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
_RDATA	0x25000	0x15c	0x200	False	0.408203125	data	2.8023223995708944	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0x26000	0x2bd28	0x2be00	False	0.8690349002849003	data	7.841437382818367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x52000	0x684	0x800	False	0.51708984375	data	4.920748452777265	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
LXGUM	0x26130	0xa2c	data	English	United States
LXGUM	0x26b60	0x2b000	data	English	United States
RT_STRING	0x51b60	0x48	data	English	United States
RT_MANIFEST	0x51ba8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
KERNEL32.dll	SetFilePointerEx, GetConsoleMode, GetConsoleOutputCP, WriteFile, FlushFileBuffers, SetStdHandle, HeapSize, GetStringTypeW, GetFileType, GetStdHandle, GetProcessHeap, CreateFileW, CloseHandle, WriteConsoleW, ExitProcess, HeapReAlloc, GetLastError, LCMapStringW, FlsFree, FlsSetValue, FlsGetValue, FlsAlloc, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, RtlUnwindEx, InterlockedFlushSList, SetLastError, EncodePointer, RaiseException, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, RtlPcToFileHeader, GetModuleHandleExW, GetModuleFileNameW, HeapAlloc, HeapFree, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW
USER32.dll	GetGestureInfo, InvalidateRect, ScreenToClient, CloseGestureInfoHandle, EndPaint, BeginPaint, UpdateWindow, PostQuitMessage, LoadCursorW, GetMessageW, DefWindowProcW, DestroyWindow, CreateWindowExW, RegisterClassExW, LoadStringW, ShowWindow, DispatchMessageW, SetGestureConfig, TranslateAcceleratorW, TranslateMessage
GDI32.dll	Polyline, LineTo, CreatePen, MoveToEx, DeleteObject, SelectObject
ntdll.dll	NtQueueApcThread, ZwOpenSymbolicLinkObject, LdrFindResource_U, NtAllocateVirtualMemory, NtTestAlert, LdrAccessResource, RtlCaptureContext, RtlLookupFunctionEntry, RtlVirtualUnwind

Exports

Name	Ordinal	Address
DllRegisterServer	1	0x180010a70

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4213.239.212.5497294432404320 03/18/23-16:00:53.457464	TCP	2404320	ET CNC Feodo Tracker Reported CnC Server TCP group 11	49729	443	192.168.2.4	213.239.212.5
192.168.2.4104.168.155.1434970580802404302 03/18/23-15:58:29.445426	TCP	2404302	ET CNC Feodo Tracker Reported CnC Server TCP group 2	49705	8080	192.168.2.4	104.168.155.143
192.168.2.445.235.8.304973380802404324 03/18/23-16:00:58.958124	TCP	2404324	ET CNC Feodo Tracker Reported CnC Server TCP group 13	49733	8080	192.168.2.4	45.235.8.30
192.168.2.4167.172.199.1654970380802404310 03/18/23-15:58:19.699415	TCP	2404310	ET CNC Feodo Tracker Reported CnC Server TCP group 6	49703	8080	192.168.2.4	167.172.199.165
192.168.2.4164.90.222.65497044432404308 03/18/23-15:58:24.948314	TCP	2404308	ET CNC Feodo Tracker Reported CnC Server TCP group 5	49704	443	192.168.2.4	164.90.222.65
192.168.2.4187.63.160.8849702802404314 03/18/23-15:58:11.945439	TCP	2404314	ET CNC Feodo Tracker Reported CnC Server TCP group 8	49702	80	192.168.2.4	187.63.160.88
192.168.2.41.234.2.2324971980802404304 03/18/23-15:59:46.453351	TCP	2404304	ET CNC Feodo Tracker Reported CnC Server TCP group 3	49719	8080	192.168.2.4	1.234.2.232
192.168.2.491.121.146.474969580802404344 03/18/23-15:57:43.982133	TCP	2404344	ET CNC Feodo Tracker Reported CnC Server TCP group 23	49695	8080	192.168.2.4	91.121.146.47
192.168.2.4206.189.28.1994972180802404318 03/18/23-16:00:02.963968	TCP	2404318	ET CNC Feodo Tracker Reported CnC Server TCP group 10	49721	8080	192.168.2.4	206.189.28.199
192.168.2.466.228.32.314969770802404330 03/18/23-15:57:49.653644	TCP	2404330	ET CNC Feodo Tracker Reported CnC Server TCP group 16	49697	7080	192.168.2.4	66.228.32.31
192.168.2.4182.162.143.56496984432404312 03/18/23-15:58:05.445458	TCP	2404312	ET CNC Feodo Tracker Reported CnC Server TCP group 7	49698	443	192.168.2.4	182.162.143.56

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 18, 2023 15:57:43.982132912 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:44.010421038 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:44.010539055 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:44.013843060 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:44.041975975 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:44.064595938 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:44.064632893 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:44.064770937 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:44.077897072 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:44.107184887 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:44.155500889 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:45.521246910 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:45.521328926 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:45.553070068 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:45.563245058 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:45.608760118 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:48.559087038 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:48.559130907 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:48.559294939 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:48.559461117 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:48.559514999 CET	49695	8080	192.168.2.4	91.121.146.47
Mar 18, 2023 15:57:48.587496996 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:48.587532997 CET	8080	49695	91.121.146.47	192.168.2.4
Mar 18, 2023 15:57:49.653644085 CET	49697	7080	192.168.2.4	66.228.32.31
Mar 18, 2023 15:57:52.656811953 CET	49697	7080	192.168.2.4	66.228.32.31
Mar 18, 2023 15:57:58.703701019 CET	49697	7080	192.168.2.4	66.228.32.31
Mar 18, 2023 15:58:05.445457935 CET	49698	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.445525885 CET	443	49698	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.445621014 CET	49698	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.446594000 CET	49698	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.446608067 CET	443	49698	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.713150024 CET	443	49698	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.713974953 CET	49699	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.714050055 CET	443	49699	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.714160919 CET	49699	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.715395927 CET	49699	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.715436935 CET	443	49699	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.987780094 CET	443	49699	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.989764929 CET	49700	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.989820957 CET	443	49700	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:05.990039110 CET	49700	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.991280079 CET	49700	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:05.991303921 CET	443	49700	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:06.239960909 CET	443	49700	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:06.241710901 CET	49701	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:06.241755962 CET	443	49701	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:06.241857052 CET	49701	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:06.242470980 CET	49701	443	192.168.2.4	182.162.143.56
Mar 18, 2023 15:58:06.242486954 CET	443	49701	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:06.501095057 CET	443	49701	182.162.143.56	192.168.2.4
Mar 18, 2023 15:58:11.945439100 CET	49702	80	192.168.2.4	187.63.160.88
Mar 18, 2023 15:58:12.179195881 CET	80	49702	187.63.160.88	192.168.2.4
Mar 18, 2023 15:58:12.689225912 CET	49702	80	192.168.2.4	187.63.160.88
Mar 18, 2023 15:58:12.922725916 CET	80	49702	187.63.160.88	192.168.2.4
Mar 18, 2023 15:58:13.423608065 CET	49702	80	192.168.2.4	187.63.160.88
Mar 18, 2023 15:58:13.661552906 CET	80	49702	187.63.160.88	192.168.2.4
Mar 18, 2023 15:58:19.699414968 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:19.867234945 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:19.867444038 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:19.868233919 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:20.035275936 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:20.045103073 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:20.045140028 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:20.045212030 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:20.051392078 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:20.219124079 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:20.220163107 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:20.428314924 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:21.038682938 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:21.080550909 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:24.038556099 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:24.038588047 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:24.038654089 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:24.039973974 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:24.040021896 CET	49703	8080	192.168.2.4	167.172.199.165
Mar 18, 2023 15:58:24.207125902 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:24.207159042 CET	8080	49703	167.172.199.165	192.168.2.4
Mar 18, 2023 15:58:24.948313951 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:24.948385954 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:24.948482990 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:24.949033022 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:24.949058056 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.070983887 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.071180105 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.075246096 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.075273991 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.075628996 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.127825975 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.402632952 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.402668953 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.615834951 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.615917921 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.616075039 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.616332054 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.616355896 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:25.616396904 CET	49704	443	192.168.2.4	164.90.222.65
Mar 18, 2023 15:58:25.616406918 CET	443	49704	164.90.222.65	192.168.2.4
Mar 18, 2023 15:58:29.445425987 CET	49705	8080	192.168.2.4	104.168.155.143
Mar 18, 2023 15:58:29.608290911 CET	8080	49705	104.168.155.143	192.168.2.4
Mar 18, 2023 15:58:30.112575054 CET	49705	8080	192.168.2.4	104.168.155.143
Mar 18, 2023 15:58:30.275592089 CET	8080	49705	104.168.155.143	192.168.2.4
Mar 18, 2023 15:58:30.784570932 CET	49705	8080	192.168.2.4	104.168.155.143
Mar 18, 2023 15:58:30.947439909 CET	8080	49705	104.168.155.143	192.168.2.4
Mar 18, 2023 15:58:37.206897020 CET	49706	8080	192.168.2.4	163.44.196.120
Mar 18, 2023 15:58:37.414094925 CET	8080	49706	163.44.196.120	192.168.2.4
Mar 18, 2023 15:58:37.925693989 CET	49706	8080	192.168.2.4	163.44.196.120
Mar 18, 2023 15:58:38.132889986 CET	8080	49706	163.44.196.120	192.168.2.4
Mar 18, 2023 15:58:38.644577980 CET	49706	8080	192.168.2.4	163.44.196.120
Mar 18, 2023 15:58:38.851846933 CET	8080	49706	163.44.196.120	192.168.2.4
Mar 18, 2023 15:58:44.204273939 CET	49707	8080	192.168.2.4	160.16.142.56
Mar 18, 2023 15:58:47.208164930 CET	49707	8080	192.168.2.4	160.16.142.56
Mar 18, 2023 15:58:53.223882914 CET	49707	8080	192.168.2.4	160.16.142.56
Mar 18, 2023 15:59:01.440913916 CET	49708	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:01.440969944 CET	443	49708	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:01.441087008 CET	49708	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:01.441631079 CET	49708	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:01.441662073 CET	443	49708	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:01.732642889 CET	443	49708	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:01.739085913 CET	49709	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:01.739130974 CET	443	49709	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:01.739490032 CET	49709	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:01.740029097 CET	49709	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:01.740045071 CET	443	49709	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:01.997771025 CET	443	49709	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:02.001648903 CET	49710	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:02.001723051 CET	443	49710	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:02.001868963 CET	49710	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:02.002549887 CET	49710	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:02.002579927 CET	443	49710	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:02.266993046 CET	443	49710	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:02.268584013 CET	49711	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:02.268667936 CET	443	49711	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:02.280921936 CET	49711	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:02.282046080 CET	49711	443	192.168.2.4	159.89.202.34
Mar 18, 2023 15:59:02.282097101 CET	443	49711	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:02.570384026 CET	443	49711	159.89.202.34	192.168.2.4
Mar 18, 2023 15:59:07.957743883 CET	49712	8080	192.168.2.4	159.65.88.10
Mar 18, 2023 15:59:07.991372108 CET	8080	49712	159.65.88.10	192.168.2.4
Mar 18, 2023 15:59:08.506562948 CET	49712	8080	192.168.2.4	159.65.88.10
Mar 18, 2023 15:59:08.538861990 CET	8080	49712	159.65.88.10	192.168.2.4
Mar 18, 2023 15:59:09.053390980 CET	49712	8080	192.168.2.4	159.65.88.10
Mar 18, 2023 15:59:09.088993073 CET	8080	49712	159.65.88.10	192.168.2.4
Mar 18, 2023 15:59:14.449083090 CET	49713	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:14.449156046 CET	443	49713	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:14.449254990 CET	49713	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:14.450041056 CET	49713	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:14.450057983 CET	443	49713	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:14.686491013 CET	443	49713	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:14.687273026 CET	49714	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:14.687319040 CET	443	49714	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:14.687402964 CET	49714	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:14.688045025 CET	49714	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:14.688057899 CET	443	49714	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:14.909670115 CET	443	49714	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:14.910675049 CET	49715	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:14.910744905 CET	443	49715	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:14.910902023 CET	49715	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:14.911706924 CET	49715	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:14.911735058 CET	443	49715	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:15.141199112 CET	443	49715	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:15.142324924 CET	49716	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:15.142395020 CET	443	49716	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:15.142493010 CET	49716	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:15.143629074 CET	49716	443	192.168.2.4	186.194.240.217
Mar 18, 2023 15:59:15.143656969 CET	443	49716	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:15.365222931 CET	443	49716	186.194.240.217	192.168.2.4
Mar 18, 2023 15:59:20.736360073 CET	49717	8080	192.168.2.4	149.56.131.28
Mar 18, 2023 15:59:20.840053082 CET	8080	49717	149.56.131.28	192.168.2.4
Mar 18, 2023 15:59:21.351337910 CET	49717	8080	192.168.2.4	149.56.131.28
Mar 18, 2023 15:59:21.455054998 CET	8080	49717	149.56.131.28	192.168.2.4
Mar 18, 2023 15:59:21.960804939 CET	49717	8080	192.168.2.4	149.56.131.28
Mar 18, 2023 15:59:22.064337015 CET	8080	49717	149.56.131.28	192.168.2.4
Mar 18, 2023 15:59:27.954616070 CET	49718	8080	192.168.2.4	72.15.201.15
Mar 18, 2023 15:59:30.961610079 CET	49718	8080	192.168.2.4	72.15.201.15
Mar 18, 2023 15:59:36.962234020 CET	49718	8080	192.168.2.4	72.15.201.15
Mar 18, 2023 15:59:46.453351021 CET	49719	8080	192.168.2.4	1.234.2.232
Mar 18, 2023 15:59:46.723201036 CET	8080	49719	1.234.2.232	192.168.2.4
Mar 18, 2023 15:59:47.228558064 CET	49719	8080	192.168.2.4	1.234.2.232
Mar 18, 2023 15:59:47.498555899 CET	8080	49719	1.234.2.232	192.168.2.4
Mar 18, 2023 15:59:48.009881973 CET	49719	8080	192.168.2.4	1.234.2.232
Mar 18, 2023 15:59:50.024698019 CET	8080	49719	1.234.2.232	192.168.2.4
Mar 18, 2023 15:59:55.459563017 CET	49720	8080	192.168.2.4	82.223.21.224
Mar 18, 2023 15:59:55.513474941 CET	8080	49720	82.223.21.224	192.168.2.4
Mar 18, 2023 15:59:56.026175022 CET	49720	8080	192.168.2.4	82.223.21.224
Mar 18, 2023 15:59:56.077433109 CET	8080	49720	82.223.21.224	192.168.2.4
Mar 18, 2023 15:59:56.588773966 CET	49720	8080	192.168.2.4	82.223.21.224
Mar 18, 2023 15:59:56.640219927 CET	8080	49720	82.223.21.224	192.168.2.4
Mar 18, 2023 16:00:02.963968039 CET	49721	8080	192.168.2.4	206.189.28.199
Mar 18, 2023 16:00:02.995054007 CET	8080	49721	206.189.28.199	192.168.2.4
Mar 18, 2023 16:00:03.495625019 CET	49721	8080	192.168.2.4	206.189.28.199
Mar 18, 2023 16:00:03.536531925 CET	8080	49721	206.189.28.199	192.168.2.4
Mar 18, 2023 16:00:04.042516947 CET	49721	8080	192.168.2.4	206.189.28.199
Mar 18, 2023 16:00:04.083252907 CET	8080	49721	206.189.28.199	192.168.2.4
Mar 18, 2023 16:00:09.459182978 CET	49722	8080	192.168.2.4	169.57.156.166
Mar 18, 2023 16:00:12.449493885 CET	49722	8080	192.168.2.4	169.57.156.166
Mar 18, 2023 16:00:18.465661049 CET	49722	8080	192.168.2.4	169.57.156.166
Mar 18, 2023 16:00:25.460607052 CET	49723	8080	192.168.2.4	107.170.39.149
Mar 18, 2023 16:00:25.567009926 CET	8080	49723	107.170.39.149	192.168.2.4
Mar 18, 2023 16:00:26.075587988 CET	49723	8080	192.168.2.4	107.170.39.149
Mar 18, 2023 16:00:26.175313950 CET	8080	49723	107.170.39.149	192.168.2.4
Mar 18, 2023 16:00:26.685185909 CET	49723	8080	192.168.2.4	107.170.39.149
Mar 18, 2023 16:00:26.785379887 CET	8080	49723	107.170.39.149	192.168.2.4
Mar 18, 2023 16:00:32.208268881 CET	49724	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:32.208323002 CET	443	49724	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:32.208444118 CET	49724	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:32.209636927 CET	49724	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:32.209666967 CET	443	49724	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:32.495301962 CET	443	49724	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:32.496603012 CET	49725	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:32.496659040 CET	443	49725	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:32.496797085 CET	49725	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:32.498522997 CET	49725	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:32.498543024 CET	443	49725	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:32.788578033 CET	443	49725	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:32.790932894 CET	49726	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:32.791076899 CET	443	49726	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:32.791184902 CET	49726	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:32.792073965 CET	49726	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:32.792126894 CET	443	49726	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:33.080167055 CET	443	49726	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:33.081132889 CET	49727	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:33.081198931 CET	443	49727	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:33.081309080 CET	49727	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:33.082089901 CET	49727	443	192.168.2.4	103.43.75.120
Mar 18, 2023 16:00:33.082115889 CET	443	49727	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:33.371627092 CET	443	49727	103.43.75.120	192.168.2.4
Mar 18, 2023 16:00:38.713119030 CET	49728	8080	192.168.2.4	91.207.28.33
Mar 18, 2023 16:00:41.717679024 CET	49728	8080	192.168.2.4	91.207.28.33
Mar 18, 2023 16:00:47.733720064 CET	49728	8080	192.168.2.4	91.207.28.33
Mar 18, 2023 16:00:53.457463980 CET	49729	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.457525969 CET	443	49729	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.457608938 CET	49729	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.458457947 CET	49729	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.458487988 CET	443	49729	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.483563900 CET	443	49729	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.484528065 CET	49730	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.484595060 CET	443	49730	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.484688044 CET	49730	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.490484953 CET	49730	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.490525007 CET	443	49730	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.517394066 CET	443	49730	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.518778086 CET	49731	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.518850088 CET	443	49731	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.518938065 CET	49731	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.520023108 CET	49731	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.520087957 CET	443	49731	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.545201063 CET	443	49731	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.546549082 CET	49732	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.546617985 CET	443	49732	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.546742916 CET	49732	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.548105001 CET	49732	443	192.168.2.4	213.239.212.5
Mar 18, 2023 16:00:53.548135996 CET	443	49732	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:53.574625015 CET	443	49732	213.239.212.5	192.168.2.4
Mar 18, 2023 16:00:58.958123922 CET	49733	8080	192.168.2.4	45.235.8.30
Mar 18, 2023 16:00:59.204256058 CET	8080	49733	45.235.8.30	192.168.2.4
Mar 18, 2023 16:00:59.719082117 CET	49733	8080	192.168.2.4	45.235.8.30
Mar 18, 2023 16:00:59.963083982 CET	8080	49733	45.235.8.30	192.168.2.4
Mar 18, 2023 16:01:00.469141006 CET	49733	8080	192.168.2.4	45.235.8.30
Mar 18, 2023 16:01:00.715471029 CET	8080	49733	45.235.8.30	192.168.2.4
Mar 18, 2023 16:01:06.209254980 CET	49734	8080	192.168.2.4	119.59.103.152
Mar 18, 2023 16:01:06.509252071 CET	8080	49734	119.59.103.152	192.168.2.4
Mar 18, 2023 16:01:07.016586065 CET	49734	8080	192.168.2.4	119.59.103.152
Mar 18, 2023 16:01:07.329204082 CET	8080	49734	119.59.103.152	192.168.2.4
Mar 18, 2023 16:01:07.829144001 CET	49734	8080	192.168.2.4	119.59.103.152

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 18, 2023 15:57:44.642750978 CET	8.8.8.8	192.168.2.4	0x901a	No error (0)	au.c-0001.c-msedge.net	c-0001.c-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 18, 2023 15:57:44.642750978 CET	8.8.8.8	192.168.2.4	0x901a	No error (0)	c-0001.c-msedge.net		13.107.4.50	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

164.90.222.65

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49704	164.90.222.65	443	C:\Windows\System32\regsvr32.exe

Timestamp	Direction	Data
2023-03-18 14:58:25 UTC	OUT	POST /nnukk/upfurpftd/ltwomnfleb/ HTTP/1.1 Connection: Keep-Alive Content-Length: 0 Host: 164.90.222.65
2023-03-18 14:58:25 UTC	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 18 Mar 2023 14:58:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close
2023-03-18 14:58:25 UTC	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: loaddll64.exePID: 4224, Parent PID: 3528

General

Target ID:	0
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\loaddll64.exe
Wow64 process (32bit):	false
Commandline:	loaddll64.exe "C:\Users\user\Desktop\f_00321b.dll"
Imagebase:	0x7ff73c1f0000
File size:	139776 bytes
MD5 hash:	C676FC0263EDD17D4CE7D644B8F3FCD6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 2516, Parent PID: 4224

General

Target ID:	1
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: cmd.exePID: 3216, Parent PID: 4224

General

Target ID:	2
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /C rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1
Imagebase:	0x7ff632260000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 4888, Parent PID: 4224

General

Target ID:	3
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	regsvr32.exe /s C:\Users\user\Desktop\f_00321b.dll
Imagebase:	0x7ff6746f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000003.00000002.319426857.00000000022D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1264, Parent PID: 3216

General

Target ID:	4
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe "C:\Users\user\Desktop\f_00321b.dll",#1
Imagebase:	0x7ff669490000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.320583141.0000024067ED1000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000004.00000002.320487184.0000024067EA0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 1240, Parent PID: 4224

General

Target ID:	5
Start time:	15:57:02
Start date:	18/03/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\Desktop\f_00321b.dll,DllRegisterServer
Imagebase:	0x7ff669490000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.320938696.000001CAEF360000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000005.00000002.320983303.000001CAEF391000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 1312, Parent PID: 4888

General

Target ID:	6
Start time:	15:57:04
Start date:	18/03/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\ZbmMPnDvLqwXll\QyzgcRWJYZS.dll"
Imagebase:	0x7ff6746f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.839406801.0000000002031000.00000020.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_3, Description: Yara detected Emotet, Source: 00000006.00000002.839010466.000000000072B000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Emotet_1, Description: Yara detected Emotet, Source: 00000006.00000002.839356776.0000000001FE0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 5968, Parent PID: 1264

General

Target ID:	7
Start time:	15:57:05
Start date:	18/03/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\RymKYMmySRfU\EAqrfXJOpHznppsf.dll"
Imagebase:	0x7ff6746f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: regsvr32.exePID: 4768, Parent PID: 1240

General

Target ID:	8
Start time:	15:57:05
Start date:	18/03/2023
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\regsvr32.exe "C:\Windows\system32\IzuSuDitBV\QmEREbzuu.dll"
Imagebase:	0x7ff6746f0000
File size:	24064 bytes
MD5 hash:	D78B75FC68247E8A63ACBA846182740E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Analysis Process: conhost.exePID: 5432, Parent PID: 1240

General

Target ID:	10
Start time:	15:57:50
Start date:	18/03/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7c72c0000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: regsvr32.exePID: 4888, Parent PID: 4224COMMON

Execution Graph

Execution Coverage:	8.5%
Dynamic/Decrypted Code Coverage:	7.5%
Signature Coverage:	6%
Total number of Nodes:	332
Total number of Limit Nodes:	11

Executed Functions

Function 022A0000 Relevance: 55.2, APIs: 5, Strings: 26, Instructions: 953
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE ref: 022A0344
VirtualAlloc.KERNELBASE ref: 022A038A
VirtualAlloc.KERNELBASE ref: 022A03A4
VirtualProtect.KERNELBASE ref: 022A085C
RtlAddFunctionTable.KERNEL32 ref: 022A08E9

Strings

hIns, xrefs: 022A00EB
Libr, xrefs: 022A009D
ncti, xrefs: 022A0141
ct, xrefs: 022A00DD
Cach, xrefs: 022A0100
tion, xrefs: 022A00F9
o, xrefs: 022A012E
Slee, xrefs: 022A0084
Virt, xrefs: 022A00AD
truc, xrefs: 022A00F2
rote, xrefs: 022A00D5
Virt, xrefs: 022A00C5
aryA, xrefs: 022A00A5
nf, xrefs: 022A0127
ualP, xrefs: 022A00CD
lloc, xrefs: 022A00BD
ualA, xrefs: 022A00B5
ddFu, xrefs: 022A013A
RtlA, xrefs: 022A0133
Flus, xrefs: 022A00E4
GetN, xrefs: 022A0107
ativ, xrefs: 022A010F
onTa, xrefs: 022A0148
eSys, xrefs: 022A0117
temI, xrefs: 022A011F
Load, xrefs: 022A0095

Memory Dump Source

Source File: 00000003.00000002.319390673.00000000022A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 022A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_22a0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
String ID: Cach$Flus$GetN$Libr$Load$RtlA$Slee$Virt$Virt$aryA$ativ$ct$ddFu$eSys$hIns$lloc$ncti$nf$o$onTa$rote$temI$tion$truc$ualA$ualP
API String ID: 394283112-3605381585
Opcode ID: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction ID: 675c05fbcb6c2539dfea781731734114a8fdeb898dbb97373c7052136746ac93
Opcode Fuzzy Hash: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction Fuzzy Hash: 36522530A28B498BD719DF58C8957BAB7F0FB84304F14462DE88BC7615DB34E646CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0231709C Relevance: 11.5, Strings: 9, Instructions: 237
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xD, xrefs: 023170C9
U[, xrefs: 023172BB
$, xrefs: 0231725F
_o, xrefs: 023170C1
_L, xrefs: 023174B0
#Vk, xrefs: 0231731C
k|, xrefs: 02317446
W(P, xrefs: 0231727F
8, xrefs: 02317172

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #Vk$$$8$U[$W(P$_L$_o$k|$xD
API String ID: 0-383957222
Opcode ID: 3fcaeefa4f3a6a4b2ee736f46ed5ab809e6beb52b42741c15c6946b5de4ec314
Instruction ID: 9395ff1f64a69c37675acd386a46e3f38be87d11f77e739b7fa7a9b9771cc80b
Opcode Fuzzy Hash: 3fcaeefa4f3a6a4b2ee736f46ed5ab809e6beb52b42741c15c6946b5de4ec314
Instruction Fuzzy Hash: 72C1DD71519780AFD398CF28C58A91BBBF1FBD4754F906A1DF88286260D7B4D909CF02

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010C10 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrFindResource_U.NTDLL ref: 0000000180010CCB
LdrAccessResource.NTDLL ref: 0000000180010CEB
NtAllocateVirtualMemory.NTDLL ref: 0000000180010D19

Strings

ad5zS&E7DS(ke9?+qbAC5tqx<Y<h0!QB4H3bk, xrefs: 0000000180010C3B
@, xrefs: 0000000180010CF5
LXGUM, xrefs: 0000000180010C74

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: AccessAllocateFindMemoryResourceResource_Virtual
String ID: @$LXGUM$ad5zS&E7DS(ke9?+qbAC5tqx<Y<h0!QB4H3bk
API String ID: 2485490239-3005932707
Opcode ID: 72763dadedb1f7e12bf326a7682b4cc9f3b8809a7beac6fa455c8e22944c1181
Instruction ID: 10e411743ffb1a55a6adb62272a00c62f4f605c25ab8d9ba5168281e261d5f46
Opcode Fuzzy Hash: 72763dadedb1f7e12bf326a7682b4cc9f3b8809a7beac6fa455c8e22944c1181
Instruction Fuzzy Hash: 0F41F976218B8486D795CB14F49039AB7B4F388794F505116FADA83BA8DF7DC608CB00

Uniqueness

Uniqueness Score: -1.00%

Function 02307D6C Relevance: 7.7, Strings: 6, Instructions: 201
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

)s, xrefs: 02307FA2
)y_, xrefs: 02307F29
=, xrefs: 02307D8E
3`d!, xrefs: 02307DD8
GX, xrefs: 02307D80
lo, xrefs: 02307D79

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )s$)y_$3`d!$GX$lo$=
API String ID: 0-308291206
Opcode ID: fde852a4840d2e352ca3eb00ee2f42bd1f44b3ef619014c8955ce582878b56b5
Instruction ID: 0b12b38b0132f5880821e44069736d3d5815bf01dcde675ac41f9459a298fdd9
Opcode Fuzzy Hash: fde852a4840d2e352ca3eb00ee2f42bd1f44b3ef619014c8955ce582878b56b5
Instruction Fuzzy Hash: 7091487150074A8BDB48CF28C89A4DE3FB1FB58398F65422DEC4AA6290D778D695CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0231A000 Relevance: 7.7, Strings: 6, Instructions: 154
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Z, xrefs: 0231A0BB
KT, xrefs: 0231A0FA
;, xrefs: 0231A11E
F8, xrefs: 0231A125
/Q, xrefs: 0231A056
F, xrefs: 0231A03A

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: /Q$;$F8$KT$F$Z
API String ID: 0-1951868783
Opcode ID: 1dba0b1f5f7bf25f1a94850d34f322108ec8c8f6f4ebff0ec6ff6f465611ff96
Instruction ID: 6bb242c8c4b1491bd188f4997aaebc56cde48f370403adcacb38e93c125aa59b
Opcode Fuzzy Hash: 1dba0b1f5f7bf25f1a94850d34f322108ec8c8f6f4ebff0ec6ff6f465611ff96
Instruction Fuzzy Hash: 3A6146B0E147098FCB48CFA8D88A8DEBBB1FB58314F10821DE846A7290D7749995CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010AC0 Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00000001180010AC0(long long _a8, intOrPtr _a16, long long _a24) {
				long long _v32;
				long long _v40;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _t15;
				long long _t19;
				long long _t20;

				_a24 = _t20;
				_a16 = _t15;
				_a8 = _t19;
				_v56 = _a16;
				if (_v56 == 1) goto 0x80010ae6;
				goto 0x80010bf4;
				 *0x80022ca0 = _a8;
				_v52 = 0x904;
				_v48 = 0xf9e;
				_v40 = 0;
				_v32 = 0;
				if (E00000001180010DB0(_a16) == 0) goto 0x80010b28;
				ExitProcess(??);
			}

0x180010ac0
0x180010ac5
0x180010ac9
0x180010ad6
0x180010adf
0x180010ae1
0x180010aeb
0x180010af2
0x180010afa
0x180010b02
0x180010b0b
0x180010b1b
0x180010b22

APIs

ExitProcess.KERNEL32 ref: 0000000180010B22

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e7061396d7e3d43570edbd3d19f5eed90c055825c823b852da9f6b8b51899770
Instruction ID: 35b30a5bd3bbc3bfa3955963e6b6c4c9d1147ff83b5bb424c40f1a31c42fa1fb
Opcode Fuzzy Hash: e7061396d7e3d43570edbd3d19f5eed90c055825c823b852da9f6b8b51899770
Instruction Fuzzy Hash: AE311671119B489AE782DF54F85438AB7A0F7983D4F608215F6A907BA4CFBDC24CCB40

Uniqueness

Uniqueness Score: -1.00%

Function 0230CC14 Relevance: 4.1, Strings: 3, Instructions: 312
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

\, xrefs: 0230D130
c2&, xrefs: 0230CD1F
0c, xrefs: 0230CEBC

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0c$\$c2&
API String ID: 0-1001447681
Opcode ID: 77759940156d6b552e519a0717cd81e7aca00c005acef3af4df6aa899143340c
Instruction ID: ef47302f9876923395361aaba8ac6986a8a85f53a5c91c1d92a28c3253a64026
Opcode Fuzzy Hash: 77759940156d6b552e519a0717cd81e7aca00c005acef3af4df6aa899143340c
Instruction Fuzzy Hash: C202E6715083C88BDBBECF64C889ADE7BADFB44708F10521DEA4A9E298DB745744CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02308BC8 Relevance: 4.0, Strings: 3, Instructions: 213
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

M, xrefs: 02308F2D
N5, xrefs: 02308C11
.f, xrefs: 02308E08

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .f$M$N5
API String ID: 0-1477915503
Opcode ID: 8d1225c7070edb932c8417e1bce8c420d426fdb0b99d3cf29e08fc417a96cbbc
Instruction ID: bf851f04863a6550d4edf06ded97e0a4aac5dd343262cdcdce08fde426ea4fc5
Opcode Fuzzy Hash: 8d1225c7070edb932c8417e1bce8c420d426fdb0b99d3cf29e08fc417a96cbbc
Instruction Fuzzy Hash: 27A170701197449FD7A8DF28C8C959EBBF1FB84704F906A1EF8869B2A0CB74D945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02318FC8 Relevance: 1.5, Strings: 1, Instructions: 279
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

A]jN, xrefs: 02319216

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: A]jN
API String ID: 0-1761522205
Opcode ID: 43702ad7ebc926fc841c635a5fc759035faaa4ad2df4e1132c12a3653d9fa51d
Instruction ID: ad7527d1eee0774eea9160ad1add39826d08a3bc58c542c981c148fbcb17e637
Opcode Fuzzy Hash: 43702ad7ebc926fc841c635a5fc759035faaa4ad2df4e1132c12a3653d9fa51d
Instruction Fuzzy Hash: D7D1F4B1D0060A8FDF48DFA8C49A4AEBBB1FB58304F11462DD516BB290D7789A46CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0230263C Relevance: 1.4, Strings: 1, Instructions: 135COMMON

Download Yara Rule

Strings

C, xrefs: 02302836

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: C
API String ID: 0-3705061908
Opcode ID: 762938c9acd95b28f04d4807fb9ee99926cdc57d0bffae28badc71fa18101beb
Instruction ID: 9f60f0b86f0d926e12387810d596ab79f32444e5a7bcf60bba11998541009d2f
Opcode Fuzzy Hash: 762938c9acd95b28f04d4807fb9ee99926cdc57d0bffae28badc71fa18101beb
Instruction Fuzzy Hash: EE61CE7151C7848BD768DF28C19940FBBF1FBD6748F000A1DE69A862A0D7B6E958CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000147C Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0000000118000147C(void* __edx) {
				void* _t5;

				_t5 = __edx;
				if (_t5 == 0) goto 0x800014bd;
				if (_t5 == 0) goto 0x800014b1;
				if (_t5 == 0) goto 0x800014a4;
				if (__edx == 1) goto 0x8000149d;
				return 1;
			}

0x180001480
0x180001482
0x180001487
0x18000148c
0x180001491
0x18000149c

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000001800014A4
__scrt_acquire_startup_lock.LIBCMT ref: 00000001800014F6
_RTC_Initialize.LIBCMT ref: 0000000180001524
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000000018000154A
__scrt_release_startup_lock.LIBCMT ref: 0000000180001575

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: f481a242433e045de9421f6a540d64c2f1c4067185df5e2b4ea36506bf633cb0
Instruction ID: c036cf0e1e542974e7afb98f421e14e504817ee7e551922961311e630d73ddb8
Opcode Fuzzy Hash: f481a242433e045de9421f6a540d64c2f1c4067185df5e2b4ea36506bf633cb0
Instruction Fuzzy Hash: 5881C370A04A4DCEFBD7DB65A8413D932A0AB9D7C2F54C125B909477A6DF38C74D8700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007F30 Relevance: 9.1, APIs: 6, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,0000F101478280A5,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007F3F
FlsSetValue.KERNEL32(?,?,0000F101478280A5,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007F75
FlsSetValue.KERNEL32(?,?,0000F101478280A5,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007FA2
FlsSetValue.KERNEL32(?,?,0000F101478280A5,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007FB3
FlsSetValue.KERNEL32(?,?,0000F101478280A5,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007FC4
SetLastError.KERNEL32(?,?,0000F101478280A5,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007FDF

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: eb8af4af359d96366aaa10eae491533e56ca08d7f11ac2249f998e933b1e40b3
Instruction ID: b3640c739d53f521f3aff5ec24f9b4829142f54ff52cb57a8f227eaee239dcc8
Opcode Fuzzy Hash: eb8af4af359d96366aaa10eae491533e56ca08d7f11ac2249f998e933b1e40b3
Instruction Fuzzy Hash: 72115C3070964942FAEBE32195453F972926B9C7F0F18C625B83A077DBDE68C6498701

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A234 Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E0000000118000A234(void* __ebp, long long __rbx, long long __rdi, long long __rsi) {
				void* _t25;
				signed long long _t45;
				signed long long _t47;
				long long _t62;
				signed long long _t63;
				signed long long _t70;
				void* _t71;
				void* _t75;
				WCHAR* _t76;

				_t45 = _t70;
				 *((long long*)(_t45 + 8)) = __rbx;
				 *((long long*)(_t45 + 0x10)) = _t62;
				 *((long long*)(_t45 + 0x18)) = __rsi;
				 *((long long*)(_t45 + 0x20)) = __rdi;
				_t71 = _t70 - 0x40; // executed
				GetEnvironmentStringsW(); // executed
				if (_t45 != 0) goto 0x8000a264;
				goto 0x8000a327;
				_t63 = _t45;
				if ( *_t45 == 0) goto 0x8000a289;
				_t47 = (_t45 | 0xffffffff) + 1;
				if ( *((intOrPtr*)(_t63 + _t47 * 2)) != 0) goto 0x8000a270;
				if ( *((intOrPtr*)(_t63 + _t47 * 2 + 2)) != 0) goto 0x8000a26c;
				 *((long long*)(_t71 + 0x38)) = __rsi;
				 *((long long*)(_t71 + 0x30)) = __rsi;
				r9d = __ebp;
				 *((intOrPtr*)(_t71 + 0x28)) = 0;
				 *(_t71 + 0x20) = __rsi;
				E0000000118000A154();
				if (0 != 0) goto 0x8000a2c7;
				FreeEnvironmentStringsW(_t76);
				goto 0x8000a25d;
				E0000000118000B4C4(_t47, 0, _t75);
				_t57 = _t47;
				if (_t47 != 0) goto 0x8000a2e0;
				_t25 = E0000000118000878C(_t47, 0);
				goto 0x8000a2bc;
				 *((long long*)(_t71 + 0x38)) = __rsi;
				r9d = __ebp;
				 *((long long*)(_t71 + 0x30)) = __rsi;
				 *((intOrPtr*)(_t71 + 0x28)) = r14d;
				 *(_t71 + 0x20) = _t47;
				E0000000118000A154();
				if (_t25 != 0) goto 0x8000a311;
				E0000000118000878C(_t47, _t47);
				goto 0x8000a31b;
				E0000000118000878C(_t47, _t57);
				return FreeEnvironmentStringsW(??);
			}

0x18000a234
0x18000a237
0x18000a23b
0x18000a23f
0x18000a243
0x18000a249
0x18000a24d
0x18000a25b
0x18000a25f
0x18000a264
0x18000a26a
0x18000a270
0x18000a278
0x18000a287
0x18000a289
0x18000a291
0x18000a2a0
0x18000a2a3
0x18000a2a9
0x18000a2b0
0x18000a2ba
0x18000a2bf
0x18000a2c5
0x18000a2ca
0x18000a2cf
0x18000a2d5
0x18000a2d9
0x18000a2de
0x18000a2e0
0x18000a2e5
0x18000a2e8
0x18000a2f0
0x18000a2f9
0x18000a2fe
0x18000a305
0x18000a30a
0x18000a30f
0x18000a313
0x18000a341

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,0000000180006577), ref: 000000018000A24D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000000180006577), ref: 000000018000A2BF

Part of subcall function 000000018000B4C4: HeapAlloc.KERNEL32(?,?,?,000000018000D071,?,?,00000000,000000018000A3A3,?,?,?,00000001800068CF,?,?,?,00000001800067C5), ref: 000000018000B502

FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000000180006577), ref: 000000018000A31E

Part of subcall function 000000018000878C: HeapFree.KERNEL32(?,?,00000000,000000018000E6BE,?,?,?,000000018000E6FB,?,?,00000000,000000018000BED5,?,?,?,000000018000BE07), ref: 00000001800087A2
Part of subcall function 000000018000878C: GetLastError.KERNEL32(?,?,00000000,000000018000E6BE,?,?,?,000000018000E6FB,?,?,00000000,000000018000BED5,?,?,?,000000018000BE07), ref: 00000001800087AC

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocErrorLast
String ID:
API String ID: 3331406755-0
Opcode ID: 825ce012b9cb48ab94c3413abdd1171c1895b64bc4b61d191bc328906b2b8bd4
Instruction ID: 864329f4ba152f277f2adf48c891db3446df78698e664f4bc60f625a72c2a341
Opcode Fuzzy Hash: 825ce012b9cb48ab94c3413abdd1171c1895b64bc4b61d191bc328906b2b8bd4
Instruction Fuzzy Hash: 64318631608B5881FBA6DF2568403DA7794B78DFD4F48C229FA9A43BD5DF38C6498700

Uniqueness

Uniqueness Score: -1.00%

Function 02313988 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 02313AF8

Strings

li, xrefs: 02313A44

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: li
API String ID: 963392458-3170889640
Opcode ID: df447d1959c748b5d8cf34ebfef7c4b31b83bdbcb52bf56f40cb8f0245456118
Instruction ID: 991fc2378a7bd9962551fae910e9c52051daf515ad8ec82cef12e9ec16cc79ff
Opcode Fuzzy Hash: df447d1959c748b5d8cf34ebfef7c4b31b83bdbcb52bf56f40cb8f0245456118
Instruction Fuzzy Hash: 9341E67091CB848FDBA4DF18D0C979AB7E0FB98315F20495DE588C7295CB789884CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D26C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0000000118000D26C(void* __ecx, intOrPtr* __rax, long long __rbx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				if (__ecx - 0x2000 < 0) goto 0x8000d2b4;
				E000000011800086F4(__ecx - 0x2000, __rax);
				 *__rax = 9;
				E000000011800085B8();
				return 9;
			}

0x18000d26c
0x18000d271
0x18000d276
0x18000d289
0x18000d28b
0x18000d295
0x18000d297
0x18000d2b3

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018000D297

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b2bec9f1c83fd2e5dff941a4990122d97467662781677e8ba2cfdbb0e4efa737
Instruction ID: 290c2a04846c9b039a5155463e3184fcb060a742c36b4207bfb39a2b49eb85f2
Opcode Fuzzy Hash: b2bec9f1c83fd2e5dff941a4990122d97467662781677e8ba2cfdbb0e4efa737
Instruction Fuzzy Hash: 3911AC3210468C82F383DF14E8507D9B7A4FB5C7C0F058426FA9547BAADF38CA199B50

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008714 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00000001180008714(void* __eax, signed int __rcx, signed int __rdx) {
				void* __rbx;
				intOrPtr* _t22;
				signed int _t29;

				_t29 = __rdx;
				if (__rcx == 0) goto 0x80008733;
				_t1 = _t29 - 0x20; // -32
				_t22 = _t1;
				if (_t22 - __rdx < 0) goto 0x80008776;
				_t25 =  ==  ? _t22 : __rcx * __rdx;
				goto 0x8000875a;
				if (E0000000118000C08C() == 0) goto 0x80008776;
				if (E0000000118000ABF8(_t22,  ==  ? _t22 : __rcx * __rdx,  ==  ? _t22 : __rcx * __rdx) == 0) goto 0x80008776;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t22 == 0) goto 0x80008745;
				goto 0x80008783;
				E000000011800086F4(_t22, _t22);
				 *_t22 = 0xc;
				return 0;
			}

0x180008714
0x180008723
0x180008727
0x180008727
0x180008731
0x18000873f
0x180008743
0x18000874c
0x180008758
0x180008769
0x180008772
0x180008774
0x180008776
0x18000877b
0x180008788

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,0000000180007F92,?,?,0000F101478280A5,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000), ref: 0000000180008769

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 7cf3c04cd0eb283655c87112c6735f3b789bd4b36bb41325690c7ae62c9b4c65
Instruction ID: 66bea78d34406d615fa8c08e42eaa36a882f8058afe23dfc71e7ff7acb685faa
Opcode Fuzzy Hash: 7cf3c04cd0eb283655c87112c6735f3b789bd4b36bb41325690c7ae62c9b4c65
Instruction Fuzzy Hash: A1F06D74309A0881FED7D7A599003D522D16F5CBC0F2CD4302D4E863DAEE1CC788A320

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001268 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00000001180001268(void* __ecx) {
				void* __rbx;
				void* _t12;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;

				_t2 =  ==  ? 1 :  *0x80021ae0 & 0x000000ff;
				 *0x80021ae0 =  ==  ? 1 :  *0x80021ae0 & 0x000000ff;
				E00000001180001A80(1, _t12, __ecx, _t17, _t18, _t19, _t20, _t21);
				if (E00000001180002A08() != 0) goto 0x80001297;
				goto 0x800012ab; // executed
				E00000001180006CDC(_t17); // executed
				if (0 != 0) goto 0x800012a9;
				E00000001180002A58(0);
				goto 0x80001293;
				return 1;
			}

0x18000127c
0x18000127f
0x180001285
0x180001291
0x180001295
0x180001297
0x18000129e
0x1800012a2
0x1800012a7
0x1800012b0

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000000018000128A

Part of subcall function 0000000180002A08: __vcrt_initialize_locks.LIBVCRUNTIME ref: 0000000180002A0C

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_initialize_locks
String ID:
API String ID: 108617051-0
Opcode ID: b3a5aff99e9bbd50fc4b4caf8482eddb7f62de2f1dfabb963a32cf9525c58297
Instruction ID: 3927130d99c38a55cbe47f9f4b507d4a3e007974ffcd633e9ac0bb37393e6b58
Opcode Fuzzy Hash: b3a5aff99e9bbd50fc4b4caf8482eddb7f62de2f1dfabb963a32cf9525c58297
Instruction Fuzzy Hash: 66E01A30B0528C8EFEE7E6B525423F937501B1E3C2F40D068B892825838D0947AD5722

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010A8E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0000000180010A93

Part of subcall function 0000000180014C90: LoadStringW.USER32 ref: 0000000180014CBF
Part of subcall function 0000000180014C90: LoadStringW.USER32 ref: 0000000180014CDC

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: LoadString$ExitProcess
String ID:
API String ID: 80118013-0
Opcode ID: 4511720a80b85894ed9872a941f45ad7e5906891a0c13688ba3e14c3fa3ec101
Instruction ID: b62d2fb12763fda2a64a5ee64e5548852d899a580494aacca0011f8ebade0f7c
Opcode Fuzzy Hash: 4511720a80b85894ed9872a941f45ad7e5906891a0c13688ba3e14c3fa3ec101
Instruction Fuzzy Hash: E1D0C936625A4892E7A29B61F80578A2390B78C7D4F809111A98C42A24CF2CC2098B00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000180014555 Relevance: 216.5, APIs: 144, Instructions: 493COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 000000018001455C
GetLastError.KERNEL32 ref: 0000000180014566
ShowWindow.USER32 ref: 0000000180014570
GetLastError.KERNEL32 ref: 000000018001457A
ShowWindow.USER32 ref: 0000000180014584
GetLastError.KERNEL32 ref: 000000018001458E
ShowWindow.USER32 ref: 0000000180014598
GetLastError.KERNEL32 ref: 00000001800145A2
ShowWindow.USER32 ref: 00000001800145AC
GetLastError.KERNEL32 ref: 00000001800145B6
ShowWindow.USER32 ref: 00000001800145C0
GetLastError.KERNEL32 ref: 00000001800145CA
ShowWindow.USER32 ref: 00000001800145D4
GetLastError.KERNEL32 ref: 00000001800145DE
ShowWindow.USER32 ref: 00000001800145E8
GetLastError.KERNEL32 ref: 00000001800145F2
ShowWindow.USER32 ref: 00000001800145FC
GetLastError.KERNEL32 ref: 0000000180014606
ShowWindow.USER32 ref: 0000000180014610
GetLastError.KERNEL32 ref: 000000018001461A
ShowWindow.USER32 ref: 0000000180014624
GetLastError.KERNEL32 ref: 000000018001462E
ShowWindow.USER32 ref: 0000000180014638
GetLastError.KERNEL32 ref: 0000000180014642
ShowWindow.USER32 ref: 000000018001464C
GetLastError.KERNEL32 ref: 0000000180014656
ShowWindow.USER32 ref: 0000000180014660
GetLastError.KERNEL32 ref: 000000018001466A
ShowWindow.USER32 ref: 0000000180014674
GetLastError.KERNEL32 ref: 000000018001467E
ShowWindow.USER32 ref: 0000000180014688
GetLastError.KERNEL32 ref: 0000000180014692
ShowWindow.USER32 ref: 000000018001469C
GetLastError.KERNEL32 ref: 00000001800146A6
ShowWindow.USER32 ref: 00000001800146B0
GetLastError.KERNEL32 ref: 00000001800146BA
ShowWindow.USER32 ref: 00000001800146C4
GetLastError.KERNEL32 ref: 00000001800146CE
ShowWindow.USER32 ref: 00000001800146D8
GetLastError.KERNEL32 ref: 00000001800146E2
ShowWindow.USER32 ref: 00000001800146EC
GetLastError.KERNEL32 ref: 00000001800146F6
ShowWindow.USER32 ref: 0000000180014700
GetLastError.KERNEL32 ref: 000000018001470A
ShowWindow.USER32 ref: 0000000180014714
GetLastError.KERNEL32 ref: 000000018001471E
ShowWindow.USER32 ref: 0000000180014728
GetLastError.KERNEL32 ref: 0000000180014732
ShowWindow.USER32 ref: 000000018001473C
GetLastError.KERNEL32 ref: 0000000180014746
ShowWindow.USER32 ref: 0000000180014750
GetLastError.KERNEL32 ref: 000000018001475A
ShowWindow.USER32 ref: 0000000180014764
GetLastError.KERNEL32 ref: 000000018001476E
ShowWindow.USER32 ref: 0000000180014778
GetLastError.KERNEL32 ref: 0000000180014782
ShowWindow.USER32 ref: 000000018001478C
GetLastError.KERNEL32 ref: 0000000180014796
ShowWindow.USER32 ref: 00000001800147A0
GetLastError.KERNEL32 ref: 00000001800147AA
ShowWindow.USER32 ref: 00000001800147B4
GetLastError.KERNEL32 ref: 00000001800147BE
ShowWindow.USER32 ref: 00000001800147C8
GetLastError.KERNEL32 ref: 00000001800147D2
ShowWindow.USER32 ref: 00000001800147DC
GetLastError.KERNEL32 ref: 00000001800147E6
ShowWindow.USER32 ref: 00000001800147F0
GetLastError.KERNEL32 ref: 00000001800147FA
ShowWindow.USER32 ref: 0000000180014804
GetLastError.KERNEL32 ref: 000000018001480E
ShowWindow.USER32 ref: 0000000180014818
GetLastError.KERNEL32 ref: 0000000180014822
ShowWindow.USER32 ref: 000000018001482C
GetLastError.KERNEL32 ref: 0000000180014836
ShowWindow.USER32 ref: 0000000180014840
GetLastError.KERNEL32 ref: 000000018001484A
ShowWindow.USER32 ref: 0000000180014854
GetLastError.KERNEL32 ref: 000000018001485E
ShowWindow.USER32 ref: 0000000180014868
GetLastError.KERNEL32 ref: 0000000180014872
ShowWindow.USER32 ref: 000000018001487C
GetLastError.KERNEL32 ref: 0000000180014886
ShowWindow.USER32 ref: 0000000180014890
GetLastError.KERNEL32 ref: 000000018001489A
ShowWindow.USER32 ref: 00000001800148A4
GetLastError.KERNEL32 ref: 00000001800148AE
ShowWindow.USER32 ref: 00000001800148B8
GetLastError.KERNEL32 ref: 00000001800148C2
ShowWindow.USER32 ref: 00000001800148CC
GetLastError.KERNEL32 ref: 00000001800148D6
ShowWindow.USER32 ref: 00000001800148E0
GetLastError.KERNEL32 ref: 00000001800148EA
ShowWindow.USER32 ref: 00000001800148F4
GetLastError.KERNEL32 ref: 00000001800148FE
ShowWindow.USER32 ref: 0000000180014908
GetLastError.KERNEL32 ref: 0000000180014912
ShowWindow.USER32 ref: 000000018001491C
GetLastError.KERNEL32 ref: 0000000180014926
ShowWindow.USER32 ref: 0000000180014930
GetLastError.KERNEL32 ref: 000000018001493A
ShowWindow.USER32 ref: 0000000180014944
GetLastError.KERNEL32 ref: 000000018001494E
ShowWindow.USER32 ref: 0000000180014958
GetLastError.KERNEL32 ref: 0000000180014962
ShowWindow.USER32 ref: 000000018001496C
GetLastError.KERNEL32 ref: 0000000180014976
ShowWindow.USER32 ref: 0000000180014980
GetLastError.KERNEL32 ref: 000000018001498A
ShowWindow.USER32 ref: 0000000180014994
GetLastError.KERNEL32 ref: 000000018001499E
ShowWindow.USER32 ref: 00000001800149A8
GetLastError.KERNEL32 ref: 00000001800149B2
ShowWindow.USER32 ref: 00000001800149BC
GetLastError.KERNEL32 ref: 00000001800149C6
ShowWindow.USER32 ref: 00000001800149D0
GetLastError.KERNEL32 ref: 00000001800149DA
ShowWindow.USER32 ref: 00000001800149E4
GetLastError.KERNEL32 ref: 00000001800149EE
ShowWindow.USER32 ref: 00000001800149F8
GetLastError.KERNEL32 ref: 0000000180014A02
ShowWindow.USER32 ref: 0000000180014A0C
GetLastError.KERNEL32 ref: 0000000180014A16
ShowWindow.USER32 ref: 0000000180014A20
GetLastError.KERNEL32 ref: 0000000180014A2A
ShowWindow.USER32 ref: 0000000180014A34
GetLastError.KERNEL32 ref: 0000000180014A3E
ShowWindow.USER32 ref: 0000000180014A48
GetLastError.KERNEL32 ref: 0000000180014A52
ShowWindow.USER32 ref: 0000000180014A5C
GetLastError.KERNEL32 ref: 0000000180014A66
ShowWindow.USER32 ref: 0000000180014A70
GetLastError.KERNEL32 ref: 0000000180014A7A
ShowWindow.USER32 ref: 0000000180014A84
GetLastError.KERNEL32 ref: 0000000180014A8E
ShowWindow.USER32 ref: 0000000180014A98
GetLastError.KERNEL32 ref: 0000000180014AA2
ShowWindow.USER32 ref: 0000000180014AAC
GetLastError.KERNEL32 ref: 0000000180014AB6
ShowWindow.USER32 ref: 0000000180014AC0
GetLastError.KERNEL32 ref: 0000000180014ACA
ShowWindow.USER32 ref: 0000000180014AD4
GetLastError.KERNEL32 ref: 0000000180014ADE
ShowWindow.USER32 ref: 0000000180014AE8
GetLastError.KERNEL32 ref: 0000000180014AF2

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ErrorLastShowWindow
String ID:
API String ID: 3252650109-0
Opcode ID: 9a665b6fd1606399514c88e51871797ade4cb1dce934726ac272da09cbabfbb3
Instruction ID: 20d447c0f35bcb8e3c3c297cfd2fae4a36a0868fd259666119818285c186e9df
Opcode Fuzzy Hash: 9a665b6fd1606399514c88e51871797ade4cb1dce934726ac272da09cbabfbb3
Instruction Fuzzy Hash: B522B976B00E0986FBDB9F72AC1439B22A2AB8CBD5F46C439E40689174DE7DC75D8305

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001C48 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000000180001C64
RtlCaptureContext.NTDLL ref: 0000000180001C91
RtlLookupFunctionEntry.NTDLL ref: 0000000180001CAB
RtlVirtualUnwind.NTDLL ref: 0000000180001CEC
IsDebuggerPresent.KERNEL32 ref: 0000000180001D40
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000180001D61
UnhandledExceptionFilter.KERNEL32 ref: 0000000180001D6C

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1ffe1e744cccfe4686aba7d6a8aca853fc79a5f69e58afced9d2bc9442cc5b87
Instruction ID: 43a781f402e08a9585d1bfd569913690a5560a40171371ec2054230cf506bc92
Opcode Fuzzy Hash: 1ffe1e744cccfe4686aba7d6a8aca853fc79a5f69e58afced9d2bc9442cc5b87
Instruction Fuzzy Hash: 1931FB72605B848AEBA1DF60E8507EE7365F788785F44842AEB4E47A99DF38C74CC710

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800082EC Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E000000011800082EC(void* __ecx, intOrPtr __edx, long long __rbx, long long __rsi) {
				void* _t36;
				int _t38;
				signed long long _t60;
				long long _t63;
				_Unknown_base(*)()* _t82;
				void* _t86;
				void* _t87;
				void* _t89;
				signed long long _t90;
				struct _EXCEPTION_POINTERS* _t95;

				 *((long long*)(_t89 + 0x10)) = __rbx;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t87 = _t89 - 0x4f0;
				_t90 = _t89 - 0x5f0;
				_t60 =  *0x80021010; // 0xf101478280a5
				 *(_t87 + 0x4e0) = _t60 ^ _t90;
				if (__ecx == 0xffffffff) goto 0x8000832b;
				E00000001180001C40(_t36);
				r8d = 0x98;
				E00000001180002680();
				r8d = 0x4d0;
				E00000001180002680();
				 *((long long*)(_t90 + 0x48)) = _t90 + 0x70;
				_t63 = _t87 + 0x10;
				 *((long long*)(_t90 + 0x50)) = _t63;
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t63 == 0) goto 0x800083be;
				 *(_t90 + 0x38) =  *(_t90 + 0x38) & 0x00000000;
				 *((long long*)(_t90 + 0x30)) = _t90 + 0x58;
				 *((long long*)(_t90 + 0x28)) = _t90 + 0x60;
				 *((long long*)(_t90 + 0x20)) = _t87 + 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t87 + 0x108)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x70)) = __edx;
				 *((long long*)(_t87 + 0xa8)) = _t87 + 0x510;
				 *((long long*)(_t87 - 0x80)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x74)) = r8d;
				_t38 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t82, _t86);
				if (UnhandledExceptionFilter(_t95) != 0) goto 0x80008420;
				if (_t38 != 0) goto 0x80008420;
				if (__ecx == 0xffffffff) goto 0x80008420;
				return E000000011800010B0(E00000001180001C40(_t40), __ecx,  *(_t87 + 0x4e0) ^ _t90);
			}

0x1800082ec
0x1800082f1
0x1800082fa
0x180008302
0x180008309
0x180008313
0x180008324
0x180008326
0x180008332
0x180008338
0x180008343
0x180008349
0x180008353
0x18000835c
0x180008360
0x180008365
0x18000837a
0x18000837d
0x180008386
0x180008388
0x18000839b
0x1800083a8
0x1800083b1
0x1800083b8
0x1800083c5
0x1800083d7
0x1800083db
0x1800083e9
0x1800083ed
0x1800083f1
0x1800083fb
0x18000840e
0x180008412
0x180008417
0x180008446

APIs

RtlCaptureContext.NTDLL ref: 0000000180008365
RtlLookupFunctionEntry.NTDLL ref: 000000018000837D
RtlVirtualUnwind.NTDLL ref: 00000001800083B8
IsDebuggerPresent.KERNEL32 ref: 00000001800083F1
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001800083FB
UnhandledExceptionFilter.KERNEL32 ref: 0000000180008406

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d0fc5085bf44c4937be082645d9f0fd030d92464e7166f1adeb9fe9a04ad5cc9
Instruction ID: d6e40695d6015e5c843dff92317e70983bbd332ebd8c23179410134a75d63e3d
Opcode Fuzzy Hash: d0fc5085bf44c4937be082645d9f0fd030d92464e7166f1adeb9fe9a04ad5cc9
Instruction Fuzzy Hash: 7E315032604F8486DBA1CF25E8407DE73A4F788798F544116FA9D43B59DF38C259CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0230F8C4 Relevance: 6.6, Strings: 5, Instructions: 393COMMON

Download Yara Rule

Strings

n, xrefs: 0230FAEB
X2D7, xrefs: 0230F947
Wlw, xrefs: 0230FD4C
Uf, xrefs: 0230FDA2
G]W2, xrefs: 0230FE0A

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: G]W2$Uf$Wlw$X2D7$n
API String ID: 0-182303197
Opcode ID: 5ce9af85c0101b92db01bf743a5277ddb3699d4210e4094ad3775c6a215530db
Instruction ID: c74d74da34daa252d3ac15f3510e65483800d1c5ee69fbaf6bb2c614532ecc7b
Opcode Fuzzy Hash: 5ce9af85c0101b92db01bf743a5277ddb3699d4210e4094ad3775c6a215530db
Instruction Fuzzy Hash: F2121770A04709EFDB58DF68C18A99EBBF1FF44304F40816DE84AAB290D775DA19CB45

Uniqueness

Uniqueness Score: -1.00%

Function 02315384 Relevance: 6.6, Strings: 5, Instructions: 313COMMON

Download Yara Rule

Strings

Q|-, xrefs: 0231580C
~~K, xrefs: 02315842
GK, xrefs: 02315653
Bt$, xrefs: 02315461
M/uB, xrefs: 02315729

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: GK$M/uB$Q|-$~~K$Bt$
API String ID: 0-557373213
Opcode ID: 5399f6d2f4ddd76430553fcbb3a69801bb23c4fdd32863c07da465c7968e24a8
Instruction ID: 23d371118caf52150fd4f211dd6ca4f37721361923f8a9a5540b277e1ff59837
Opcode Fuzzy Hash: 5399f6d2f4ddd76430553fcbb3a69801bb23c4fdd32863c07da465c7968e24a8
Instruction Fuzzy Hash: 09E1F17550260CCBDB68DF38C0995D93BE1FF98308F611229FC6AA62A2DB74D514CB48

Uniqueness

Uniqueness Score: -1.00%

Function 02308378 Relevance: 6.5, Strings: 5, Instructions: 238COMMON

Download Yara Rule

Strings

i[, xrefs: 0230867B
w|, xrefs: 02308634
.I, xrefs: 02308439
{, xrefs: 02308649
gBfh, xrefs: 023083D0

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .I$gBfh$i[$w|${
API String ID: 0-448909954
Opcode ID: fd252399347da21463b78aeaa0d34fc6630a10d5928b5024a52fe33a2729c415
Instruction ID: 6e1d122142ca941d49a74c56c9e56fc6d88244184eb1ca681a308e50ba4f5ffc
Opcode Fuzzy Hash: fd252399347da21463b78aeaa0d34fc6630a10d5928b5024a52fe33a2729c415
Instruction Fuzzy Hash: FDB12770D247499FCB88DFA9D8898DDBBF1FB48304F40921DE816AB250C778A945CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0231610C Relevance: 6.5, Strings: 5, Instructions: 208COMMON

Download Yara Rule

Strings

Kn#, xrefs: 023161C9
zu, xrefs: 023161F7
vm, xrefs: 0231634F
x, xrefs: 023163D0
cp, xrefs: 0231627B

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: cp$vm$x$zu$Kn#
API String ID: 0-3521309225
Opcode ID: 854233274bfaeff89ac29a935d156dc1944753dcbd55c44e864b2476cdfcfe8d
Instruction ID: 5833cd913f5e2804bf560c919d972cdc63d85a8c03690c411a92446cfe383073
Opcode Fuzzy Hash: 854233274bfaeff89ac29a935d156dc1944753dcbd55c44e864b2476cdfcfe8d
Instruction Fuzzy Hash: D6A113B0D143198FDB58CFA9D88A8EEBBF0FB48314F108219E855B7290D3789945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02317518 Relevance: 6.3, Strings: 5, Instructions: 87COMMON

Download Yara Rule

Strings

C;, xrefs: 023175B8
0T, xrefs: 023175D1
tS, xrefs: 02317639
#0FQ, xrefs: 023175F5
lXjD, xrefs: 02317598

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #0FQ$0T$C;$lXjD$tS
API String ID: 0-817034907
Opcode ID: e4bf78acd7a5f6a30f384b9d32d43fdeffbe4641104b903a1cc162fefd21facd
Instruction ID: cde3b6a27d05f6f51e0beb0642628b81417302991f7926d9ac5c73a7bdfe907c
Opcode Fuzzy Hash: e4bf78acd7a5f6a30f384b9d32d43fdeffbe4641104b903a1cc162fefd21facd
Instruction Fuzzy Hash: D74192B180034E8FDB44DF64D88A4CE7FF0FB68398F215619E859A6250D3B89694CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0230975C Relevance: 6.3, Strings: 5, Instructions: 77COMMON

Download Yara Rule

Strings

D-, xrefs: 0230984C
Rc, xrefs: 02309782
3T, xrefs: 02309861
l, xrefs: 023097B1
,, xrefs: 023097CB

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ,$3T$D-$Rc$l
API String ID: 0-617906138
Opcode ID: 3a3cf95294224deb7faeda9f3e638283c88744c906ce2ff68bf076d4943cea68
Instruction ID: 6e37acd3fe807c1088206e5ac9a5e7eacd7d8ee036761d52eabe9f5e6423a890
Opcode Fuzzy Hash: 3a3cf95294224deb7faeda9f3e638283c88744c906ce2ff68bf076d4943cea68
Instruction Fuzzy Hash: 2141D5B081078E8FDB44CF64D88A4CE7BF0FB58358F104619E869A6260D3B89664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001D98 Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00000001180001D98(long long __rbx, long long _a32) {

				_a32 = __rbx;
			}

0x180001d98

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000000180001DC4
GetCurrentThreadId.KERNEL32 ref: 0000000180001DD2
GetCurrentProcessId.KERNEL32 ref: 0000000180001DDE
QueryPerformanceCounter.KERNEL32 ref: 0000000180001DEE

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 435d845f9f5cdf73bfe4695b71b0048b28e79a424c4651dbd907605b843c4427
Instruction ID: 8b5b8807919832646eb0d744692d73e0514a3f66bd27872d13ad1b0d2e18aa1e
Opcode Fuzzy Hash: 435d845f9f5cdf73bfe4695b71b0048b28e79a424c4651dbd907605b843c4427
Instruction Fuzzy Hash: E6113C32600F449AEB52CF61EC943D833A4F31D799F041A25FAAD477A4DF78C2A88340

Uniqueness

Uniqueness Score: -1.00%

Function 0231CF70 Relevance: 5.4, Strings: 4, Instructions: 410COMMON

Download Yara Rule

Strings

, xrefs: 0231D0A7
y4.), xrefs: 0231D445
#X, xrefs: 0231D3DB
UCV, xrefs: 0231D433

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$ $UCV$y4.)
API String ID: 0-917551206
Opcode ID: 28325ea241be474c5b5558c29b1591e9c0afa6bd6a02919fad3fbb937fa4a7d1
Instruction ID: 88f1c93bcfd0b95a9924294e2a798f61a3ced419887d8d3cd20d8d1c021a0fd4
Opcode Fuzzy Hash: 28325ea241be474c5b5558c29b1591e9c0afa6bd6a02919fad3fbb937fa4a7d1
Instruction Fuzzy Hash: FA12E4B1A0470C9FDB5CDFA8D08A9DDBBF2FB48348F00452AE906A7290D7B5D809CB55

Uniqueness

Uniqueness Score: -1.00%

Function 02304EB8 Relevance: 5.4, Strings: 4, Instructions: 386COMMON

Download Yara Rule

Strings

#X, xrefs: 0230521E
"., xrefs: 0230533A
rq%, xrefs: 023052CE
tL>, xrefs: 02305068

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$rq%$tL>$".
API String ID: 0-3922733902
Opcode ID: e7bca3236e2c6002a46b032ca93679f7d95ede6d4010d0837b1e0abab37f6438
Instruction ID: b381aed56a2b3487b3d1362a7b1588329dc67b485b38fd31a8f659fa30646d32
Opcode Fuzzy Hash: e7bca3236e2c6002a46b032ca93679f7d95ede6d4010d0837b1e0abab37f6438
Instruction Fuzzy Hash: A422C1719097C88BDBF8DF24C8896DD37F0FF48344F90215A984E9A694DBB86684CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0231AD28 Relevance: 5.2, Strings: 4, Instructions: 205COMMON

Download Yara Rule

Strings

HE, xrefs: 0231AFE0
g, xrefs: 0231AE44
Vc, xrefs: 0231AE8C
-, xrefs: 0231AE56

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: g$-$HE$Vc
API String ID: 0-2562162751
Opcode ID: f3d5559af2bde6194e80210adddbbaf8e95cb0bc6a16661ffa1dd3a57d8e1344
Instruction ID: 4913dab8bff4e468fd497d5b3a875c18097876ae677243b5bd87ab5dfa6649fc
Opcode Fuzzy Hash: f3d5559af2bde6194e80210adddbbaf8e95cb0bc6a16661ffa1dd3a57d8e1344
Instruction Fuzzy Hash: 46A1CFB150478C9FDB98CF28D8894CD3BB2FB583A8F505219FC4A97260D7B8D985CB85

Uniqueness

Uniqueness Score: -1.00%

Function 023080CC Relevance: 5.2, Strings: 4, Instructions: 163COMMON

Download Yara Rule

Strings

he, xrefs: 0230814E
*%, xrefs: 02308281
*i, xrefs: 023080E7
(;, xrefs: 023082E2

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: (;$*i$he$*%
API String ID: 0-35414758
Opcode ID: 8b9c9bfbfb1498278ba2aeeef8e78c7341b02e7a1b6eacef6973ad54d80d413a
Instruction ID: bda54b964f22911a3a559f32c7ea04d8336732ac69020e5b893b8e3c16b89767
Opcode Fuzzy Hash: 8b9c9bfbfb1498278ba2aeeef8e78c7341b02e7a1b6eacef6973ad54d80d413a
Instruction Fuzzy Hash: B7712470514348DBDF48CF28C89A5DD3BA1FB4836CF566319FC4AAA290C778D884CB89

Uniqueness

Uniqueness Score: -1.00%

Function 0230D474 Relevance: 5.1, Strings: 4, Instructions: 136COMMON

Download Yara Rule

Strings

*/, xrefs: 0230D623
I, xrefs: 0230D66B
(, xrefs: 0230D533
Yu, xrefs: 0230D5D1

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: */$I$Yu$(
API String ID: 0-674225443
Opcode ID: 2498b6af7a2ed30e90db0a3e12568d2f4136c2386795e8cd742b44945e36b51d
Instruction ID: 6945791dd46d81d20e0b3bc131e278ffeb244cb069de3bc0ef577bbecde39665
Opcode Fuzzy Hash: 2498b6af7a2ed30e90db0a3e12568d2f4136c2386795e8cd742b44945e36b51d
Instruction Fuzzy Hash: 6A718DB190070ECFDB58CF68D48A5DE7FB0FB68398F204219E85596260D7B49AA5CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 023014D4 Relevance: 5.1, Strings: 4, Instructions: 117COMMON

Download Yara Rule

Strings

W, xrefs: 02301581
#X, xrefs: 02301535
.:, xrefs: 023257E4
PYq|, xrefs: 02325812

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$.:$PYq|$W
API String ID: 0-626586655
Opcode ID: 21991bcfd0f912b097b6461d75a60c549d6ff57ca2b273beb0e746897d976d77
Instruction ID: 222ea5d3f96816e0fb7be2d0f29a34ba4982c3655a4ff2a413790cee1b1e1248
Opcode Fuzzy Hash: 21991bcfd0f912b097b6461d75a60c549d6ff57ca2b273beb0e746897d976d77
Instruction Fuzzy Hash: F741037061CB848FD7A8DF28D58A65BBBF1FBD9704F804A1EE589C7290DB749804CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0230A660 Relevance: 5.1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

Strings

<ml, xrefs: 0230A697
a:, xrefs: 0230A76D
P, xrefs: 0230A670
5`, xrefs: 0230A677

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 5`$<ml$a:$P
API String ID: 0-330785107
Opcode ID: cbd383124c860a9d8e400423fa4c9196148af7f7093da0234d577b407377b911
Instruction ID: 5e00b46b738aa1fb66a53935155d98306def4b0ebfa90c3396f59a88465fcc17
Opcode Fuzzy Hash: cbd383124c860a9d8e400423fa4c9196148af7f7093da0234d577b407377b911
Instruction Fuzzy Hash: 454104B190074E8BDB48DF68C48A49E7FB1FB58348F10861DE8569A390E7B89664CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 02314A90 Relevance: 5.1, Strings: 4, Instructions: 101COMMON

Download Yara Rule

Strings

0u, xrefs: 02314AA7
e!, xrefs: 02314BE7
S, xrefs: 02314B8E
-+, xrefs: 02314B75

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -+$0u$S$e!
API String ID: 0-4217091389
Opcode ID: 96b86808421bf99806c252c8d8da0d71d9c96e1238819cdefd32f8fbf4f8ccc7
Instruction ID: a721886868c626c9d636235e773054575fb269445c551e0ceba45fb5ef54b569
Opcode Fuzzy Hash: 96b86808421bf99806c252c8d8da0d71d9c96e1238819cdefd32f8fbf4f8ccc7
Instruction Fuzzy Hash: 7841E4B090474A8FDB48DF64C89A5DE7FF0FB68388F20461DF81AA6250D37496A4CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 02303274 Relevance: 5.1, Strings: 4, Instructions: 81COMMON

Download Yara Rule

Strings

o, xrefs: 023032EB
SJ, xrefs: 02303292
"B, xrefs: 023032CE
wU, xrefs: 0230335D

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: o$"B$SJ$wU
API String ID: 0-691100934
Opcode ID: aed5e06b6c4a71d08a3525650badbc70dff16501ab02106ea58e4e5589b648c2
Instruction ID: d7fdbf96593657ad6ae2577f5613c994ee2e422f25c7487f47942db16ad6aa10
Opcode Fuzzy Hash: aed5e06b6c4a71d08a3525650badbc70dff16501ab02106ea58e4e5589b648c2
Instruction Fuzzy Hash: 4D41E2B180078ECFDB48CF68C88A5DE7BF0FB58358F104619E859A6254D3B89695CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 02301B94 Relevance: 5.1, Strings: 4, Instructions: 77COMMON

Download Yara Rule

Strings

b, xrefs: 02301C2E
9luJ, xrefs: 02301BF8
=2y}, xrefs: 02301CF9
=2y}, xrefs: 02301CEE

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 9luJ$=2y}$=2y}$b
API String ID: 0-1667874806
Opcode ID: d458d9c607de17fbdbefdb2618156754051a2d24e7c6e7f69b2615133eee77d7
Instruction ID: d2648d12f099dfec6fdcb90f3fcdd1749581e3a0f40e909ea8a5d15e69a01733
Opcode Fuzzy Hash: d458d9c607de17fbdbefdb2618156754051a2d24e7c6e7f69b2615133eee77d7
Instruction Fuzzy Hash: 6141D6B181038EDFDF44CF64D88A4CE7BB0FB18358F110A19E865A62A4D3B89665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 023048FC Relevance: 4.0, Strings: 3, Instructions: 225COMMON

Download Yara Rule

Strings

O,, xrefs: 02304938
;, xrefs: 02304BE0
fdu, xrefs: 02304ACA

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ;$O,$fdu
API String ID: 0-1721916326
Opcode ID: 85396711fe01e2282415cffc97d2cae76b85543eafba1fee15bed9e01615747c
Instruction ID: 3e87e768a936a9a005b2bfe9cf1ea5487d1e30d4516b46cf32e487c05fefb0a7
Opcode Fuzzy Hash: 85396711fe01e2282415cffc97d2cae76b85543eafba1fee15bed9e01615747c
Instruction Fuzzy Hash: 70A11370D14718EBDF58DFA8E8C999DBBB1FB54318F00422EE806A72A0DBB49945CF45

Uniqueness

Uniqueness Score: -1.00%

Function 02303E0C Relevance: 3.9, Strings: 3, Instructions: 171COMMON

Download Yara Rule

Strings

&v, xrefs: 02303EC8
u, xrefs: 02303EF1
f, xrefs: 02303E35

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: u$&v$f
API String ID: 0-1868853588
Opcode ID: 4a0e0bcf9159e8ed5db1efbd4fd836488bb382803c7d1313d4c59486869e04d2
Instruction ID: 69a7cf9a297102c2c189827fdf9f6584d5119addf90269e6368e6e9724bbb337
Opcode Fuzzy Hash: 4a0e0bcf9159e8ed5db1efbd4fd836488bb382803c7d1313d4c59486869e04d2
Instruction Fuzzy Hash: AC712471D05708ABCF1CDFA8E5D959DBBB1FB48314F10822DE416A72A0DB749945CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0231E750 Relevance: 3.9, Strings: 3, Instructions: 145COMMON

Download Yara Rule

Strings

j, xrefs: 0231E86D
o, xrefs: 0231E8F8
t, xrefs: 0231E908

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: o$j$t
API String ID: 0-2067604139
Opcode ID: 113b91994dddf0efa674f36996042e856a8803c02bc6c37f7aa57fbd8228378e
Instruction ID: 187a7fcaf2c03148b8598df0213937adf801f54ac93e39e303af910f5d67796b
Opcode Fuzzy Hash: 113b91994dddf0efa674f36996042e856a8803c02bc6c37f7aa57fbd8228378e
Instruction Fuzzy Hash: DF61E0705087848BD368DF28C59A55FBBF1FBC6704F104A1DEA8A8B2A0D77AD944CB43

Uniqueness

Uniqueness Score: -1.00%

Function 02318BB8 Relevance: 3.8, Strings: 3, Instructions: 96COMMON

Download Yara Rule

Strings

`Y, xrefs: 02318BCF
N@`Y, xrefs: 02318C7D
=, xrefs: 02318D0C

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =$N@`Y$`Y
API String ID: 0-2183226064
Opcode ID: d2df9a4b86a3a0f31adfb1a7bc02e0a1df19d01470a0e79ca81506aab5c400ca
Instruction ID: de390a53895dfdc65dc09c5bfac6056c36121590915e31e46cbe9a5d59baf411
Opcode Fuzzy Hash: d2df9a4b86a3a0f31adfb1a7bc02e0a1df19d01470a0e79ca81506aab5c400ca
Instruction Fuzzy Hash: 5D51D4B190074E8FDB44CF68C88A4DE7FB0FB68398F204619F856A6250D3B496A4CFD4

Uniqueness

Uniqueness Score: -1.00%

Function 0231D5F0 Relevance: 3.8, Strings: 3, Instructions: 96COMMON

Download Yara Rule

Strings

KGRa, xrefs: 0231D70C
wy, xrefs: 0231D66F
P, xrefs: 0231D6C4

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: P$KGRa$wy
API String ID: 0-4077564265
Opcode ID: d053b19ec2bcb7975f54130f0bec91227afaf154fd553d0fa3630ba3df2317cc
Instruction ID: d1ac46db7187b336f728762834e22bee9176730e9335523c59ddf38f3e7cb20c
Opcode Fuzzy Hash: d053b19ec2bcb7975f54130f0bec91227afaf154fd553d0fa3630ba3df2317cc
Instruction Fuzzy Hash: 3941C0B090074E8BDF48CF68C8965DE7FB0FB68348F55461DE84AA6290D37896A4CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0231EAC0 Relevance: 3.8, Strings: 3, Instructions: 86COMMON

Download Yara Rule

Strings

\, xrefs: 0231EACC
~?, xrefs: 0231EB85
'0, xrefs: 0231EBFD

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: '0$~?$\
API String ID: 0-629757258
Opcode ID: 954a36b238481698c7266dd80e523f1c680ea4ba7fc80669a00137daf7e51e24
Instruction ID: e15f7604ff65f55478748ce61f233782f920981713b0f344d517eec2e4988a98
Opcode Fuzzy Hash: 954a36b238481698c7266dd80e523f1c680ea4ba7fc80669a00137daf7e51e24
Instruction Fuzzy Hash: E741CFB0548B808BE718CF28C59A51ABBF1FBC5344F604A2DF6968A3A0D774D885CF42

Uniqueness

Uniqueness Score: -1.00%

Function 0230DCB8 Relevance: 3.8, Strings: 3, Instructions: 80COMMON

Download Yara Rule

Strings

~*b, xrefs: 0230DD03
A7, xrefs: 0230DD24
z, xrefs: 0230DD83

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: A7$z$~*b
API String ID: 0-275545515
Opcode ID: b8479da6f0f4b7c6bcd662b5c54a20f953bf565876b4d716e1e2544701f062c2
Instruction ID: baa7780346e50c7b5fad202c1504e58fb2644f9f0b4ec5490a5d727d77cca696
Opcode Fuzzy Hash: b8479da6f0f4b7c6bcd662b5c54a20f953bf565876b4d716e1e2544701f062c2
Instruction Fuzzy Hash: 5B41C4B180074ECFDB48CF64C48A5DE7FB0FB64398F204619E855A6290D3B896A9CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0230A7F0 Relevance: 3.8, Strings: 3, Instructions: 72COMMON

Download Yara Rule

Strings

rTk=, xrefs: 0230A831
H, xrefs: 0230A8C6
{,%, xrefs: 0230A85C

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: H$rTk=${,%
API String ID: 0-3174111592
Opcode ID: cd8ee6c86ca05777d6c328effcc2208a9f98b66aff3d67038adbddc0681d1a7c
Instruction ID: 620b2f4724f2d9beeee2b9c93f0b532a90d1e7e959f4aa25ba6b06fe272dcb8d
Opcode Fuzzy Hash: cd8ee6c86ca05777d6c328effcc2208a9f98b66aff3d67038adbddc0681d1a7c
Instruction Fuzzy Hash: A3310470528785ABD798DF28C4D991EBBE1FBC4354F906A2CF982862A0C779C485CB43

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B878 Relevance: 3.2, APIs: 2, Instructions: 227COMMONLIBRARYCODE

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 000000018000BAC7
RaiseException.KERNEL32 ref: 000000018000BAD8

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ExceptionRaise_clrfp
String ID:
API String ID: 15204871-0
Opcode ID: 8a2068e512ce5aafa66155c105f3cea9dfcd9c81dc28570226bd282595299ab9
Instruction ID: df89035e7e7b250386178c13d978bdab97caeca02fa44d79d4a04f1db2bf885c
Opcode Fuzzy Hash: 8a2068e512ce5aafa66155c105f3cea9dfcd9c81dc28570226bd282595299ab9
Instruction Fuzzy Hash: BCB12C77610B888BEB56CF29C8463987BA0F348B88F15C915EB59877A8CF39C955CB01

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010DB0 Relevance: 3.0, APIs: 2, Instructions: 20nativeCOMMON

Download Yara Rule

APIs

ZwOpenSymbolicLinkObject.NTDLL ref: 0000000180010DBB
ZwOpenSymbolicLinkObject.NTDLL ref: 0000000180010DD3

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: LinkObjectOpenSymbolic
String ID:
API String ID: 3706036087-0
Opcode ID: ba3160d82893de1fb7ee1bf22b66471d9f6f3cf414538ac49248103606f94efb
Instruction ID: f4502f775a5e45d64f420efd52fcf5a6929529857e1dcb94e78d5b08d8e8d060
Opcode Fuzzy Hash: ba3160d82893de1fb7ee1bf22b66471d9f6f3cf414538ac49248103606f94efb
Instruction Fuzzy Hash: 23E0C230B1896842F7EA96BAAC017AB1051A34D7C0F70D429BA02C80C0DCA9C3894704

Uniqueness

Uniqueness Score: -1.00%

Function 02313FD0 Relevance: 2.9, Strings: 2, Instructions: 411COMMON

Download Yara Rule

Strings

D?", xrefs: 02314246
8zfK, xrefs: 0231451B

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: D?"$8zfK
API String ID: 0-617590365
Opcode ID: f58a98b4df58fdce72c0e7885dd3d804ba7ef7258294e614851e5dfa350b3c1c
Instruction ID: 90ffadf626de7aefe027df658106a4b75af3eba78983625fe1c864c1349df779
Opcode Fuzzy Hash: f58a98b4df58fdce72c0e7885dd3d804ba7ef7258294e614851e5dfa350b3c1c
Instruction Fuzzy Hash: B41202B550560DCBDB68DF38C48A49E3BE1FF58308F205129FC269B2A2D774E964CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0230C078 Relevance: 2.9, Strings: 2, Instructions: 384COMMON

Download Yara Rule

Strings

h}, xrefs: 0230C778
#X, xrefs: 0230C564

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$h}
API String ID: 0-3021649463
Opcode ID: b2db15c3223b800cd4780d66961112dd0400bb09218d3434ebea1e418095f42e
Instruction ID: cc5d86961772c35e5b26d1fe02c3735fa5e7d4097dd7d784bae00ca85ddf9638
Opcode Fuzzy Hash: b2db15c3223b800cd4780d66961112dd0400bb09218d3434ebea1e418095f42e
Instruction Fuzzy Hash: E822A7709093888BEBF8DF24C895AD97BF1FF44704F90261ED84E9A690DB786645CF42

Uniqueness

Uniqueness Score: -1.00%

Function 02329910 Relevance: 2.8, Strings: 2, Instructions: 322COMMON

Download Yara Rule

Strings

#X, xrefs: 02329941
+ <, xrefs: 02329A2E

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #X$+ <
API String ID: 0-1007305072
Opcode ID: 3c586b07ab88afffe82ef26e7c4153d46f18f2014baa5345a66543dbad760a18
Instruction ID: 616dec1e66f1d1de5e7451b2be0ebb9b94bf28cca37bd0b9761a544d75dcc4a9
Opcode Fuzzy Hash: 3c586b07ab88afffe82ef26e7c4153d46f18f2014baa5345a66543dbad760a18
Instruction Fuzzy Hash: A00278B5900709CFDB98CF68C58A5DD3BB9FB59308F404129FC1E9A2A0D3B4E919CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0231B460 Relevance: 2.8, Strings: 2, Instructions: 290COMMON

Download Yara Rule

Strings

aYG, xrefs: 0231B648
Hc, xrefs: 0231B853

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Hc$aYG
API String ID: 0-2147329803
Opcode ID: df90cc9616f2b9c1c24e5989ebcf8fe6102b1266bf85ba7b7bee55ae89225232
Instruction ID: 2efeac4e004c44270613e58ebb66abb4639adb146cbae807b0ed9b5758b64c6f
Opcode Fuzzy Hash: df90cc9616f2b9c1c24e5989ebcf8fe6102b1266bf85ba7b7bee55ae89225232
Instruction Fuzzy Hash: F3D1107560170DCBDB6CCF28C58A59E7BE9FF54308F504129FC1A862A4D7B8E829CB46

Uniqueness

Uniqueness Score: -1.00%

Function 023033D4 Relevance: 2.8, Strings: 2, Instructions: 276COMMON

Download Yara Rule

Strings

2/, xrefs: 02303729
Ip, xrefs: 02303906

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Ip$2/
API String ID: 0-2558650176
Opcode ID: e91aca82e16051f92f6dbdf3cee4f537082049766ade2dd9d76858b25ebc0c60
Instruction ID: 11e34d991f0821b6498761244433158048903eec59aa9b15cb9c721390dcac84
Opcode Fuzzy Hash: e91aca82e16051f92f6dbdf3cee4f537082049766ade2dd9d76858b25ebc0c60
Instruction Fuzzy Hash: CDE1E370505B888FEBB8DF28CC99BEB7BA1FB44306F10551AD84ADE290DB745685CF41

Uniqueness

Uniqueness Score: -1.00%

Function 02304214 Relevance: 2.8, Strings: 2, Instructions: 253COMMON

Download Yara Rule

Strings

h, xrefs: 0230432B
j-`, xrefs: 0230444F

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: h$j-`
API String ID: 963392458-2572860821
Opcode ID: 7cf89bdd1f68ee687de5045feafb6fc4a467e2c1ecf066370c920de17f50795b
Instruction ID: 4b38847522d127fc1bb00c023196a1141effc0b111ad2ed0ea1e0c4c6bbf6feb
Opcode Fuzzy Hash: 7cf89bdd1f68ee687de5045feafb6fc4a467e2c1ecf066370c920de17f50795b
Instruction Fuzzy Hash: DCC1F271904788CFDB6CDFA8C88A59DBBB1FB48308F20421DE916AB261DBB49805CF41

Uniqueness

Uniqueness Score: -1.00%

Function 02316C70 Relevance: 2.7, Strings: 2, Instructions: 226COMMON

Download Yara Rule

Strings

UP, xrefs: 02316CED
#z, xrefs: 02316FB0

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #z$UP
API String ID: 0-3609392360
Opcode ID: 550135c457ce9de0a38fa7ba25efe375c5c92efa4962973150589f83c0e84419
Instruction ID: 382e9117acb7527eeed12035d2293c9e612a4279c88de5acce6f1e256b227a4c
Opcode Fuzzy Hash: 550135c457ce9de0a38fa7ba25efe375c5c92efa4962973150589f83c0e84419
Instruction Fuzzy Hash: 95A12471904609DBDF5CCFA8E4CA49EBBB1FB64348F20411DE846A72A0DB749A95CFC1

Uniqueness

Uniqueness Score: -1.00%

Function 023294BC Relevance: 2.7, Strings: 2, Instructions: 194COMMON

Download Yara Rule

Strings

)bkr, xrefs: 023295CD
z~, xrefs: 023294EB

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: )bkr$z~
API String ID: 0-4035444816
Opcode ID: 5b38f0d840313d9f3ca574d07702ced70b63c221434e660478dd8723dd507398
Instruction ID: 258faba6e3eb8b0d9e06483d8e05467d36b6a391f8c1d6f11864e9afbdd6cc32
Opcode Fuzzy Hash: 5b38f0d840313d9f3ca574d07702ced70b63c221434e660478dd8723dd507398
Instruction Fuzzy Hash: 28817F715047898FEBB8CF28CC867D937A0FB45314F648619D88ECA292DF785A8DCB41

Uniqueness

Uniqueness Score: -1.00%

Function 0231EC30 Relevance: 2.7, Strings: 2, Instructions: 188COMMON

Download Yara Rule

Strings

NM, xrefs: 0231EF7F
aK>, xrefs: 0231EF0B

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: aK>$NM
API String ID: 0-1076587397
Opcode ID: c3bac648abfba249b47852098d41859ba07369c2655e972e771b32b502ff7dc2
Instruction ID: da5d41e2d11eded9a8d114fda3a0716ef8578c24a29511a9fd1e11079e84c072
Opcode Fuzzy Hash: c3bac648abfba249b47852098d41859ba07369c2655e972e771b32b502ff7dc2
Instruction Fuzzy Hash: 12B144B590030DCFDB98CF68C18A58D7BB8FB55348F505129FC1E9A2A0E3B5E614CB56

Uniqueness

Uniqueness Score: -1.00%

Function 0231662C Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

GcX, xrefs: 02316734
cy5X, xrefs: 023169F9

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: GcX$cy5X
API String ID: 0-3427037236
Opcode ID: 31dac3876fb2c8203566e989269622a41f053c7142211a7d3c88141b18e189f4
Instruction ID: 0267e1ddd2b807cdafb6751889a6f3cffd9a6a52354409c4c9bdb3701729200e
Opcode Fuzzy Hash: 31dac3876fb2c8203566e989269622a41f053c7142211a7d3c88141b18e189f4
Instruction Fuzzy Hash: 57A1B6B0548388CBEBBEDF34C89A6D93BA9FB44B04F504619E85E8E290DF745745CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0230AC94 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

&, xrefs: 0230AF3E
U, xrefs: 0230AF25

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: &$U
API String ID: 0-326847644
Opcode ID: abfcacae90548ec85c0fd9e6913092660ec18354f469de3349c35ab14c6f872b
Instruction ID: daf57b6f78e1c460b3c69b218a56053f519266194a0c46674b0582432329867c
Opcode Fuzzy Hash: abfcacae90548ec85c0fd9e6913092660ec18354f469de3349c35ab14c6f872b
Instruction Fuzzy Hash: 139169B590038E8FDF48CF68D88A5DE7BB0FB14348F104A19F866AA250D7B4D665CB94

Uniqueness

Uniqueness Score: -1.00%

Function 02315A00 Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

z5, xrefs: 02315C39
k' {, xrefs: 02315C91

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: k' {$z5
API String ID: 0-3484172565
Opcode ID: 0e04fcac124a95f8f36ba453d1c940f3a314ae21d4948ab7b59fa2d7b687fabd
Instruction ID: b8ae8af72688b8f58a265ba0cd7083464b739b8d1d0c7afe49f0b82b51ef3349
Opcode Fuzzy Hash: 0e04fcac124a95f8f36ba453d1c940f3a314ae21d4948ab7b59fa2d7b687fabd
Instruction Fuzzy Hash: 1471F7705007498FDB58DF24C88A5DE7BA1FB58358F514329EC8AAB2A0D778D994CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 0230AAB8 Relevance: 2.7, Strings: 2, Instructions: 152COMMON

Download Yara Rule

Strings

D, xrefs: 0230AC1C
6, xrefs: 0230AAEC

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6$D
API String ID: 0-3309211938
Opcode ID: 28cfe374c9252ae38f661a0063e52509a8c1d1e6d70719d53b6096594a4bb1b4
Instruction ID: 4943fae4cb613e23b7f581dd3e487f9d4b3c42f04943001f169c6b3b38551740
Opcode Fuzzy Hash: 28cfe374c9252ae38f661a0063e52509a8c1d1e6d70719d53b6096594a4bb1b4
Instruction Fuzzy Hash: 1C5139705247899BDB98CF28DC999993BE4FB05308F90626CFD46C7291C774D886CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02313B14 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

$, xrefs: 02313BFF
%9, xrefs: 02313BB8

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: $$%9
API String ID: 0-3031553271
Opcode ID: a2fbf9250aa57a4feebe03f3fe744e7023f0b6fc9b26e85352855d54e5bc5225
Instruction ID: b973fe186ff4a9eb6224fd819c17bcabcddee07a6b0dcf81a060d5ce58defcbe
Opcode Fuzzy Hash: a2fbf9250aa57a4feebe03f3fe744e7023f0b6fc9b26e85352855d54e5bc5225
Instruction Fuzzy Hash: B7413C7061C784ABD7A8DF19C0D562BBAE1FB88754F90696EF486C7391D738C844CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02307530 Relevance: 2.6, Strings: 2, Instructions: 118COMMON

Download Yara Rule

Strings

(Pv0, xrefs: 0230768B
#T, xrefs: 023075B2

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #T$(Pv0
API String ID: 0-2531358951
Opcode ID: 75b81112f69fa21036012adbd1b3eca6c2c2cdc881b6fb35e88803ec9910d9b1
Instruction ID: 833bb2cbc5b5f632a4e21dfab9eb859e2d57cc464020a742c613bdf528bcd6e6
Opcode Fuzzy Hash: 75b81112f69fa21036012adbd1b3eca6c2c2cdc881b6fb35e88803ec9910d9b1
Instruction Fuzzy Hash: BC514E7050030E8BDF58DF28C89A1DE3BA0FB6839CF211619EC4A96694D378D999CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0230B07C Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

gd, xrefs: 0230B208
s=z, xrefs: 0230B235

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: gd$s=z
API String ID: 0-3301279615
Opcode ID: 9e0a1eb710f150882f220fbe0277e01504bf60581961d70543420594e9a038f4
Instruction ID: f07ce2e9fad92d157e2a09d6c94d78838dac94750a3f8c81f1af4b815a99ef80
Opcode Fuzzy Hash: 9e0a1eb710f150882f220fbe0277e01504bf60581961d70543420594e9a038f4
Instruction Fuzzy Hash: 8551E2B190030A8FDB48CF68D48A5DE7FB1FB68388F204219F856A6250D37886A4CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 02306138 Relevance: 2.6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

!oW!, xrefs: 023062B0
ke&Q, xrefs: 023061EC

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: !oW!$ke&Q
API String ID: 0-419570616
Opcode ID: e2a8cd98534a9e183c53210f0dafbd08af185e336335754ed42f3b5ed718b376
Instruction ID: 7f38a27729837a1220456e8f550ce8d8610a663141bb74c9e1c9dc42617e753b
Opcode Fuzzy Hash: e2a8cd98534a9e183c53210f0dafbd08af185e336335754ed42f3b5ed718b376
Instruction Fuzzy Hash: DB51D6B090074E8FDB48CF68C88A5DE7FB0FB68398F104619EC55A6290D7B496A5CFD0

Uniqueness

Uniqueness Score: -1.00%

Function 02304758 Relevance: 2.6, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

?j|, xrefs: 023047F0
P, xrefs: 02304886

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ?j|$P
API String ID: 0-615948335
Opcode ID: 9620d1bc63c4dfd4b8964090179e5af9b100705a6683f45fc5812d04fd3ae6d4
Instruction ID: 876b6112df744986d2c3d1e34c47e91635113f8a285098afa5dcf4c400d9631e
Opcode Fuzzy Hash: 9620d1bc63c4dfd4b8964090179e5af9b100705a6683f45fc5812d04fd3ae6d4
Instruction Fuzzy Hash: BF41D3B090034A8FDB48CF64C48A5DE7FB1FB68388F50461DE816A6390D77896A4CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 02318A2C Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

j, xrefs: 02318AB4
[, xrefs: 02318AF9

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: j$[
API String ID: 0-3696242357
Opcode ID: d41960ad032d02aa43a06cacd4c3fdf514c501a5b8f19463d910750cf599ef8a
Instruction ID: 1f04405d0a2c70209281d5ae8fad630fab733c9964c6d2b04cba5fc54a1717a9
Opcode Fuzzy Hash: d41960ad032d02aa43a06cacd4c3fdf514c501a5b8f19463d910750cf599ef8a
Instruction Fuzzy Hash: D241E5B090074E8BDB48DF68C48A5DE7FB1FB58398F11861DE856A6290D3B4D6A4CFC1

Uniqueness

Uniqueness Score: -1.00%

Function 02315880 Relevance: 2.6, Strings: 2, Instructions: 99COMMON

Download Yara Rule

Strings

%, xrefs: 023158E3
aI, xrefs: 023158CF

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: %$aI
API String ID: 0-3604358270
Opcode ID: ea798d718599b15374f3be6d712fc75d69b65069e54809637e576d117a3edd33
Instruction ID: aad7e541a9085e3540dabfeb0299fd1c023f66acb8a2c362917a19f21f127873
Opcode Fuzzy Hash: ea798d718599b15374f3be6d712fc75d69b65069e54809637e576d117a3edd33
Instruction Fuzzy Hash: 9D41C6B190038E8BCB48DF68C99A5DE7BB1FB48358F114A2DF86697350D3B49664CF84

Uniqueness

Uniqueness Score: -1.00%

Function 0231C058 Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

+ , xrefs: 0231C10B
S", xrefs: 0231C1A0

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: + $S"
API String ID: 0-2880694137
Opcode ID: 0a120380ba46ade300821e018fa54fd0c93605979f7eaf18b3fcea56eb471111
Instruction ID: bfcc48e859dd2a2878ff227c17b74cffa2adce69246f734358812623f9517f87
Opcode Fuzzy Hash: 0a120380ba46ade300821e018fa54fd0c93605979f7eaf18b3fcea56eb471111
Instruction Fuzzy Hash: 3F51E6B090038E8FDF88DF64C88A5DE7BB0FB58344F10461DE866A6250D3B8D665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0231B130 Relevance: 2.6, Strings: 2, Instructions: 97COMMON

Download Yara Rule

Strings

=K, xrefs: 0231B23E
d%, xrefs: 0231B189

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: =K$d%
API String ID: 0-2790768846
Opcode ID: 046eeb3a7e312ef4597a0ceadb2c0b4017743bcb75cc6b1a2b492f4bea5b2233
Instruction ID: 31ed6bcef534f21fd38bef25e1ada1b6b1a991b2b6323d9fbcaf777256a2f9c4
Opcode Fuzzy Hash: 046eeb3a7e312ef4597a0ceadb2c0b4017743bcb75cc6b1a2b492f4bea5b2233
Instruction Fuzzy Hash: 0541E5B090074E8BDF48CF64C88A5DE7BF1FB58358F10461DE86AA6250D3B89665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 023095BC Relevance: 2.6, Strings: 2, Instructions: 93COMMON

Download Yara Rule

Strings

#|, xrefs: 0230966C
`, xrefs: 023096B4

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #|$`
API String ID: 0-1687004633
Opcode ID: 1dbd93d6a4af5ab501e4fd27d4ca136d79918f9d458c9bd4a0bbcc41cb67c6cc
Instruction ID: d2c55ef993d2c9f407acc13cfe98f8d8ae0bc1eb9f2d875cb1ae746da56c3bb8
Opcode Fuzzy Hash: 1dbd93d6a4af5ab501e4fd27d4ca136d79918f9d458c9bd4a0bbcc41cb67c6cc
Instruction Fuzzy Hash: 8041D5B190078E8FDF88CF68C88A4DE7BF0FB58358F014619F856A6250D3B89665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0231C44C Relevance: 2.6, Strings: 2, Instructions: 87COMMON

Download Yara Rule

Strings

c, xrefs: 0231C581
j~;, xrefs: 0231C5B3

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: c$j~;
API String ID: 0-3832213246
Opcode ID: 18b6bb2236c3d81442985b19945feacbaaab319f380d4d3d69fe49ad0df2425e
Instruction ID: 0f6a0d388ae838aeb531aaa047403a8103d10a1b86897dd18a564516272ff979
Opcode Fuzzy Hash: 18b6bb2236c3d81442985b19945feacbaaab319f380d4d3d69fe49ad0df2425e
Instruction Fuzzy Hash: 7341A5B080078E8FDB88DF64C88A1DF7BB0FB54358F104A19EC6696250D3B49661CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 02307C08 Relevance: 2.6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

Strings

-h, xrefs: 02307D15
W, xrefs: 02307C6A

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: -h$W
API String ID: 0-4146498651
Opcode ID: ac1beb8efc805ec182d5897ee57bff0eb204918572bad0795e6a59dbf0da3e57
Instruction ID: 3daef6741b05ec71c2ae787cf9fc9be7e5ad30438ff60914a162cace7a841076
Opcode Fuzzy Hash: ac1beb8efc805ec182d5897ee57bff0eb204918572bad0795e6a59dbf0da3e57
Instruction Fuzzy Hash: 9941C4B590038E9FDB44CFA8D88A5CE7FF0FB48358F104619F869A6250D3B49664CF85

Uniqueness

Uniqueness Score: -1.00%

Function 02328A00 Relevance: 2.6, Strings: 2, Instructions: 81COMMON

Download Yara Rule

Strings

fp, xrefs: 02328AC9
., xrefs: 02328A70

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: .$fp
API String ID: 0-3298127435
Opcode ID: ddbbea76e87b75a0423c6c5dce58b2b1cb486f12ce18d3dc43adec7097cd1835
Instruction ID: 83a03c8162202f63623eea1a1694ca8e53f68d69516385ec72ca6a59034d0d59
Opcode Fuzzy Hash: ddbbea76e87b75a0423c6c5dce58b2b1cb486f12ce18d3dc43adec7097cd1835
Instruction Fuzzy Hash: A641F4B190470E8BDB88CF64C48A4DE7FB0FB28398F104619E856A6290D3B89665CFC4

Uniqueness

Uniqueness Score: -1.00%

Function 02308FB0 Relevance: 2.6, Strings: 2, Instructions: 79COMMON

Download Yara Rule

Strings

Zs, xrefs: 02308FCC
", xrefs: 02308FC4

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: "$Zs
API String ID: 0-3922668666
Opcode ID: 68d2441b249f9a93f4c72500e977988d29b83f362e05d91f8df6eb9a31c852ba
Instruction ID: f1d62621bd08a38fa15a490595be93b85bae5397fb0987493b8f1264ce03d9fe
Opcode Fuzzy Hash: 68d2441b249f9a93f4c72500e977988d29b83f362e05d91f8df6eb9a31c852ba
Instruction Fuzzy Hash: 803192B0529380ABC388DF28D19A91EBBE1FBD5708F806A1DF8C286390D374D406CB43

Uniqueness

Uniqueness Score: -1.00%

Function 02307840 Relevance: 2.6, Strings: 2, Instructions: 78COMMON

Download Yara Rule

Strings

XW, xrefs: 023078F9
s [, xrefs: 02307898

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: XW$s [
API String ID: 0-2366283936
Opcode ID: 76c1b907ae6b42603d5a16b60f951f87ab574e6943cc66960cdc964ad17b59d9
Instruction ID: c8620a86b0501fca327921337904d07bbca0ac58b79dbc40019122cd377fd21c
Opcode Fuzzy Hash: 76c1b907ae6b42603d5a16b60f951f87ab574e6943cc66960cdc964ad17b59d9
Instruction Fuzzy Hash: 623190B190478E8FDF48DF28D88949A3BE1FB48304B004A1DFC6AD7250D7B4D665CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02304C84 Relevance: 2.6, Strings: 2, Instructions: 72COMMON

Download Yara Rule

Strings

jn(, xrefs: 02304D02
4V, xrefs: 02304D12

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 4V$jn(
API String ID: 0-2529302498
Opcode ID: 4347d8350eb776fef7c9ebb529210ab3cab55532b2ec0dd05afe6f01a2bbb923
Instruction ID: cb5d544f3b4b9f04c9dfd671481ec3bad593690e5eb4dddf862df6e3aa1dae86
Opcode Fuzzy Hash: 4347d8350eb776fef7c9ebb529210ab3cab55532b2ec0dd05afe6f01a2bbb923
Instruction Fuzzy Hash: 17317EB1529381AFC398CF28C48A91ABBE0FBC9318F806A1DF8C686260D774D555CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0230F65C Relevance: 2.6, Strings: 2, Instructions: 69COMMON

Download Yara Rule

Strings

%6, xrefs: 0230F74C
', xrefs: 0230F759

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: '$%6
API String ID: 0-1852427169
Opcode ID: 42a3203eb3ebe9af52f3f94821d08fbcbfa30131473cda762de5c23950ca3f94
Instruction ID: 05249663a0179330ad45d21934dcfd5c9628912d79576b4f5c22a08ed84997fc
Opcode Fuzzy Hash: 42a3203eb3ebe9af52f3f94821d08fbcbfa30131473cda762de5c23950ca3f94
Instruction Fuzzy Hash: CD316FB5568381ABD388DF28C48A81ABBF1FB89308F806A1DF8C6DB251D775D545CB43

Uniqueness

Uniqueness Score: -1.00%

Function 02308A8C Relevance: 2.6, Strings: 2, Instructions: 68COMMON

Download Yara Rule

Strings

J, xrefs: 02308AB1
uS, xrefs: 02308B32

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: uS$J
API String ID: 0-437994327
Opcode ID: a2b51c32bad19ba39d4e427c2f512c2a59b50882f014cb68f936c9e880adca61
Instruction ID: c28aef9a7855b76c7032ac0876ce233f1cd511a41690ffd8aa136aa2b9e82e2b
Opcode Fuzzy Hash: a2b51c32bad19ba39d4e427c2f512c2a59b50882f014cb68f936c9e880adca61
Instruction Fuzzy Hash: EC31D8B190034E8FDB84CF64C8865DE7FB0FF28358F104619E959A6260D3B88655CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 02310A70 Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

+@, xrefs: 02310B69
`.P, xrefs: 02310B2E

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: +@$`.P
API String ID: 0-1189405855
Opcode ID: a70f442d9e9e175520b0b0d93d41500bfede9fc32031e6ea222cabd22b859c02
Instruction ID: 39de2ea6a026fc69778914cf9e44a5f31bb4615b8119a4e03ad8497b2faa6ad6
Opcode Fuzzy Hash: a70f442d9e9e175520b0b0d93d41500bfede9fc32031e6ea222cabd22b859c02
Instruction Fuzzy Hash: A1316FB15187848FD348DF28C45941BBBE1BB9C758F804B1DF4CAAA260D778D645CF4A

Uniqueness

Uniqueness Score: -1.00%

Function 02303CF4 Relevance: 2.6, Strings: 2, Instructions: 57COMMON

Download Yara Rule

Strings

^, xrefs: 02303D00
R, xrefs: 02303D10

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ^$R
API String ID: 0-3595634639
Opcode ID: b7e08d49ea1b5b1d89cab638ecb6b58cb02da954cd334f399a60917b828591f9
Instruction ID: 7dec6e6ff202478201587024085261afee01554c9ae7569198c8fcb843946a7e
Opcode Fuzzy Hash: b7e08d49ea1b5b1d89cab638ecb6b58cb02da954cd334f399a60917b828591f9
Instruction Fuzzy Hash: 112180B0528781AFC398DF28D49591FBBF1BB88744F806A1DF8C686390D779D505CB46

Uniqueness

Uniqueness Score: -1.00%

Function 02302FD4 Relevance: 2.6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

Strings

w, xrefs: 0230305F
t^, xrefs: 02302FEB

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: t^$w
API String ID: 0-1486493484
Opcode ID: d9d2b37262035f156a08dae9f88ea85b7583d03cc1c0d0918aa86d9476248fb5
Instruction ID: 0fcab25796e593e8dfb7fafe86ea51ff53beb953310655f2f877b1f2b437242d
Opcode Fuzzy Hash: d9d2b37262035f156a08dae9f88ea85b7583d03cc1c0d0918aa86d9476248fb5
Instruction Fuzzy Hash: B1219DB090078E8FDB48DF68D8491DE7BB0FB18308F014A59F82996290D3B89665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 02311924 Relevance: 1.7, Strings: 1, Instructions: 428COMMON

Download Yara Rule

Strings

#, xrefs: 02311BB3

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: #
API String ID: 0-606707520
Opcode ID: 99547394c1cfeee33f3fbc263d3122085f4524b50faca7c5dbf1af4b9be79401
Instruction ID: c3f400318aacbb370837e0cbe5d5d41f2ad1dd2e6d0c0f6a4f18f054f3464e4f
Opcode Fuzzy Hash: 99547394c1cfeee33f3fbc263d3122085f4524b50faca7c5dbf1af4b9be79401
Instruction Fuzzy Hash: 5B223770D14709EFDB58DFA8C49A49EBBF1FF44348F00816DE84AAB290D7749A19CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008D28 Relevance: 1.6, APIs: 1, Instructions: 149
COMMONCrypto

Download Yara Rule

C-Code - Quality: 100%

			E00000001180008D28(long long __rbx, void* __rcx, void* __rdx, long long __rsi, signed int __r8, void* __r9) {
				signed long long _t25;
				void* _t27;
				void* _t30;

				 *((long long*)(_t30 + 8)) = __rbx;
				 *(_t30 + 0x10) = _t25;
				 *((long long*)(_t30 + 0x18)) = __rsi;
				_t27 = (_t25 | 0xffffffff) + 1;
				if ( *((intOrPtr*)(__rcx + _t27)) != dil) goto 0x80008d56;
				if (_t27 + __rdx -  !__r8 <= 0) goto 0x80008d92;
				return __rdx + 0xb;
			}

0x180008d28
0x180008d2d
0x180008d32
0x180008d56
0x180008d5d
0x180008d70
0x180008d91

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9a505e11390fee30cde8d58ba8d3236255a76ec469928530f6db279ba29baa
Instruction ID: 1f7af7de608e037a3e69fafdab2b7a4d19b0596ea53e23cf5e8b59c7fdfa90c1
Opcode Fuzzy Hash: 9c9a505e11390fee30cde8d58ba8d3236255a76ec469928530f6db279ba29baa
Instruction Fuzzy Hash: D151C432700B9489FBA1DB72A8447DE7BA1B7587D4F148225FE9827B99DF38C605D700

Uniqueness

Uniqueness Score: -1.00%

Function 02311030 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

ef, xrefs: 023111CE

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: ef
API String ID: 0-3522424648
Opcode ID: 63cf04038136136116a979567ba4b26417661d5f843165bc7989bb71bb8234a9
Instruction ID: 1d7361975761f0b602ed412871a535598d4e2d29e520c142b57fdbc98d9bb176
Opcode Fuzzy Hash: 63cf04038136136116a979567ba4b26417661d5f843165bc7989bb71bb8234a9
Instruction Fuzzy Hash: CD021870A04709EFDB58DF68C08959EBBF2FB44308F00816DE84AAB364D775DA59CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0230EF14 Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

x]!-, xrefs: 0230F2E3

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: x]!-
API String ID: 0-585868058
Opcode ID: cf2a29744dbdbd02a151a4b044d1109f6beb7998a165a5b3606498e8daacfd79
Instruction ID: 3563cc68909978d0e5924a7b684af064ea2c1ba000bef1d7d3a545c8acb8ae8c
Opcode Fuzzy Hash: cf2a29744dbdbd02a151a4b044d1109f6beb7998a165a5b3606498e8daacfd79
Instruction Fuzzy Hash: E4D199B1A0060DCFDBA8CF78C44A5DD7BF1FB48308F606129E826AA2B2D7749904CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0231A8B0 Relevance: 1.4, Strings: 1, Instructions: 195COMMON

Download Yara Rule

Strings

}^O, xrefs: 0231ABB5

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: }^O
API String ID: 0-3039680174
Opcode ID: 2737519d22680c9269c125336f90b0d45ca51200b7d26ea2addf6a8d31d5b6e5
Instruction ID: ab2cbb543467d167ea0b997b0fd3668b6ee561b3cb2fe7714e26dcb650ae5227
Opcode Fuzzy Hash: 2737519d22680c9269c125336f90b0d45ca51200b7d26ea2addf6a8d31d5b6e5
Instruction Fuzzy Hash: F4A17BB2502749CFDB98DF28C69A59D3BE1FF55308F004129FC1E9A2A0D3B4E925CB49

Uniqueness

Uniqueness Score: -1.00%

Function 02314D20 Relevance: 1.4, Strings: 1, Instructions: 142COMMON

Download Yara Rule

Strings

RH, xrefs: 02314D53

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: RH
API String ID: 0-2975065227
Opcode ID: da44171f9c80a2056ccb259cc2b9eac6e02ade2ac8d9ef905a94791c40a4a894
Instruction ID: 3ed25615c2a8c9ca4e3da1b00f2098fcb17990ba3bd5a25f54e87148b1d096d2
Opcode Fuzzy Hash: da44171f9c80a2056ccb259cc2b9eac6e02ade2ac8d9ef905a94791c40a4a894
Instruction Fuzzy Hash: 935115711187448FC7B8DF18D4C66AAB7E1FB84710FA0991DE8CEC7251DE74A88A8B46

Uniqueness

Uniqueness Score: -1.00%

Function 0230BE90 Relevance: 1.4, Strings: 1, Instructions: 132COMMON

Download Yara Rule

Strings

Y, xrefs: 0230BEF2

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Y
API String ID: 0-579211002
Opcode ID: c7ef7c05ef0c3c9f2aed6826f015ad160cfcc6abce9b29eb71b79f5d508516d5
Instruction ID: ba0b5dc142276362022db2ec7c2627ba7792bd7c726e641438638f3027d27537
Opcode Fuzzy Hash: c7ef7c05ef0c3c9f2aed6826f015ad160cfcc6abce9b29eb71b79f5d508516d5
Instruction Fuzzy Hash: CC51F4716107898BDB98CF28C88A4DD7BA1FB4835CF025318ED8EA62A1D77CD845CB49

Uniqueness

Uniqueness Score: -1.00%

Function 0230D6CC Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

vOs, xrefs: 0230D8D7

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: vOs
API String ID: 0-1852020951
Opcode ID: 0a3c35978ef4d06ef910e88490b5bce2e9beff051be12035b9eadbcefa2f22bf
Instruction ID: 71f22bc665d9d41b756676bbd0b498a9b2b12e6d8052bc4cd7a69e7596866a5e
Opcode Fuzzy Hash: 0a3c35978ef4d06ef910e88490b5bce2e9beff051be12035b9eadbcefa2f22bf
Instruction Fuzzy Hash: AD618DB190030E8FDB49CF68D48A5CE7FB0FB64398F204519E845A6260D7B996A8CFD5

Uniqueness

Uniqueness Score: -1.00%

Function 0230461C Relevance: 1.4, Strings: 1, Instructions: 115COMMON

Download Yara Rule

Strings

*), xrefs: 02304691

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: *)
API String ID: 0-1811957435
Opcode ID: c39f41b8af2b9280dd7c00c4ba0ddd05394017a856c7f82ca50d576e38ac2643
Instruction ID: d6faedc5d029d7df981e09eb73b7ab6f1fb67a7e80b3c356f9cbf3cb9aa14cee
Opcode Fuzzy Hash: c39f41b8af2b9280dd7c00c4ba0ddd05394017a856c7f82ca50d576e38ac2643
Instruction Fuzzy Hash: 7731733061CB888FC728DF29D09556AB7E0FB99305F504A6EE58AC7365DB70D905CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0230F77C Relevance: 1.4, Strings: 1, Instructions: 114COMMON

Download Yara Rule

Strings

t, xrefs: 0230F7C6

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: t
API String ID: 0-1935021737
Opcode ID: 783391770682b9c9d34a01018b97ccb4612aed757a5715f7015a6466eeb6abdd
Instruction ID: d8a7df07bf129dfe1112d093f7c79317a685567e3e9c136f8a0a0ea83ec3df8f
Opcode Fuzzy Hash: 783391770682b9c9d34a01018b97ccb4612aed757a5715f7015a6466eeb6abdd
Instruction Fuzzy Hash: 3731C23021CB448FE768DF2CD48516ABBE1FB96345F104A5DE5CAC7266DB30D805CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0232181C Relevance: 1.4, Strings: 1, Instructions: 109COMMON

Download Yara Rule

Strings

__, xrefs: 023218BC

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: __
API String ID: 0-2267946753
Opcode ID: 8f9b035c25ddab069e89f1d5b32d9e06551c62a3022c943f576078da68d92037
Instruction ID: 7d86e153d36ce8c1111dbcc3826572abeefb75d58ca262c1344be646f6e41573
Opcode Fuzzy Hash: 8f9b035c25ddab069e89f1d5b32d9e06551c62a3022c943f576078da68d92037
Instruction Fuzzy Hash: F441E070608B848BE768DF29C19941ABBF2FBC9304F500A2DF69A873A0C775D845CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02309408 Relevance: 1.4, Strings: 1, Instructions: 105COMMON

Download Yara Rule

Strings

GSn, xrefs: 02309530

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: GSn
API String ID: 0-1733515909
Opcode ID: 120b4183c770ef369911dc760361451600c2e99f203226371e5481c8821bf4d7
Instruction ID: e2f3006fa8b57a0a15ce721359cf9d1e49ece6f395c48e234ac3684f14cae031
Opcode Fuzzy Hash: 120b4183c770ef369911dc760361451600c2e99f203226371e5481c8821bf4d7
Instruction Fuzzy Hash: 3B51D8B090038E8FDF48DF64C84A5DE7BB1FB58358F10461DEC66A6290D3B89664CF84

Uniqueness

Uniqueness Score: -1.00%

Function 02328500 Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

8=, xrefs: 02328591

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 8=
API String ID: 0-237953557
Opcode ID: bb623fe5bad30cc0ccc512b27898bb82e9ca0e52d8794c79c7b053a60b518db3
Instruction ID: b454008f05a9fee2adcad3f7618a5b2db9a57a90b6337ca260f0f90ad011d31b
Opcode Fuzzy Hash: bb623fe5bad30cc0ccc512b27898bb82e9ca0e52d8794c79c7b053a60b518db3
Instruction Fuzzy Hash: 6C315C30208B458BDB5CDF2CC49922ABBE1FBD9301F444A2DE58AD7365DB34D845CB86

Uniqueness

Uniqueness Score: -1.00%

Function 023120E0 Relevance: 1.3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

Strings

K, xrefs: 0231217C

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: K
API String ID: 0-425913083
Opcode ID: 2b1ae9da1385bdbe4b8d4d873491c8ef025a73cbd56fa24a9a5b2ec22b63fa4f
Instruction ID: 2fed8ac126100d40c07b97cdf7185b5902301a54d0a5a1b07a930063f5186266
Opcode Fuzzy Hash: 2b1ae9da1385bdbe4b8d4d873491c8ef025a73cbd56fa24a9a5b2ec22b63fa4f
Instruction Fuzzy Hash: 2041F7B180438ECFDB48CF68D8864DE7BB0FB58344F114A19E866A6250D3B8D665CF85

Uniqueness

Uniqueness Score: -1.00%

Function 023108CC Relevance: 1.3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

Strings

t", xrefs: 0231092F

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: t"
API String ID: 0-2131657386
Opcode ID: a3a222a6e056c70518c09b2f7e5539db3b60aaf61629909d00af61b4973bd0e8
Instruction ID: 9afd91dbfdb460895f260be45e090592cfefd851ddef2b1300390e2b27be5b81
Opcode Fuzzy Hash: a3a222a6e056c70518c09b2f7e5539db3b60aaf61629909d00af61b4973bd0e8
Instruction Fuzzy Hash: F741E8B180070D8BDF48DF64C48A0DE7FB1FB483A8F65521DE81AB6290D3B89585CF99

Uniqueness

Uniqueness Score: -1.00%

Function 02313CD4 Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

gLv, xrefs: 02313D74

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: gLv
API String ID: 0-1669999040
Opcode ID: d372408e4ccfa21733394c795309bb98bbbf8ce06b144d4f85a8e8de8872e02b
Instruction ID: 4ccffbc56e7540b0eed2d838a359d1d8f67b2df824067188dfc1ddd5c96ef40d
Opcode Fuzzy Hash: d372408e4ccfa21733394c795309bb98bbbf8ce06b144d4f85a8e8de8872e02b
Instruction Fuzzy Hash: 5E41A2B190078E8FDF84CF64C88A4DE7BB0FB18358F104619E866A6290D3B89665CF95

Uniqueness

Uniqueness Score: -1.00%

Function 023018DC Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

2|, xrefs: 02301938

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 2|
API String ID: 0-4112153497
Opcode ID: c8d3a13c8ccf64a8a58613b82b71848b75fef30a95d8cbfed718dfac3d203234
Instruction ID: 608cad47890a71f08ca73b00549bef7b264d56ff1f2a27e9bf6db9cbe5c4c87d
Opcode Fuzzy Hash: c8d3a13c8ccf64a8a58613b82b71848b75fef30a95d8cbfed718dfac3d203234
Instruction Fuzzy Hash: 0131E2715083808FD768DF28C58A64BBBF1FBC6704F50891DE6CA8A260DB76D849CB03

Uniqueness

Uniqueness Score: -1.00%

Function 02324E8C Relevance: 1.3, Strings: 1, Instructions: 74COMMON

Download Yara Rule

Strings

v)v, xrefs: 02324F79

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: v)v
API String ID: 0-2248367734
Opcode ID: 2bcb51d8d69df24c6edafa72637552a2373937b3983906909be42b2c69647502
Instruction ID: 0030cdc40f359cc4b5ee47386aa84db0471dac2f66976155e7dd0403152a0c44
Opcode Fuzzy Hash: 2bcb51d8d69df24c6edafa72637552a2373937b3983906909be42b2c69647502
Instruction Fuzzy Hash: 2531FFB0D107189BDF88DFB8D98A4DDBBF0BB48308F50822DD816B6290D7785A45CF68

Uniqueness

Uniqueness Score: -1.00%

Function 0231A244 Relevance: 1.3, Strings: 1, Instructions: 73COMMON

Download Yara Rule

Strings

b, xrefs: 0231A33B

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: b
API String ID: 0-1908338681
Opcode ID: dddb38d3eca3b718f76d068eb3649ef697cdbcc6fe538854f7f679c62e5ae1f4
Instruction ID: 17bdd88a76ea742b17f3307574b3be47e3e99a9a8e87152f7e628db9e49eb398
Opcode Fuzzy Hash: dddb38d3eca3b718f76d068eb3649ef697cdbcc6fe538854f7f679c62e5ae1f4
Instruction Fuzzy Hash: 09318BB55187808BD748DF28C08651ABBE1BBCC308F404B1DF8CAEB2A1D778D645CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0230D33C Relevance: 1.3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

Strings

Y, xrefs: 0230D348

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: Y
API String ID: 0-579211002
Opcode ID: ecd3080a44302933cb34d055b18508fc771149b61013eb4241d4c9c3597933d5
Instruction ID: 3905b0f92365bb91672009248d65bd91db3d35b841bf4746a7ab911bc2e22770
Opcode Fuzzy Hash: ecd3080a44302933cb34d055b18508fc771149b61013eb4241d4c9c3597933d5
Instruction Fuzzy Hash: A33199B0628781AFD78CDF28D49692EBBE1BBD9314F816A1DF9868B350D774D404CB42

Uniqueness

Uniqueness Score: -1.00%

Function 02310E2C Relevance: 1.3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

Strings

0}, xrefs: 02310EE2

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 0}
API String ID: 0-2955618701
Opcode ID: 3bc7749b2bfb2771dde145a478a06cddc01c68d1a6300aeac6f15df74fb2e7de
Instruction ID: 3e7e0eca6b7df2cf9e22f590a0720919f810bbceeb8c715e312b2ca61f84fb9a
Opcode Fuzzy Hash: 3bc7749b2bfb2771dde145a478a06cddc01c68d1a6300aeac6f15df74fb2e7de
Instruction Fuzzy Hash: 95319DB052C380AFD388DF28D48591BBBE1BB88354F816A1DF8869A3A0D374D414CB47

Uniqueness

Uniqueness Score: -1.00%

Function 023197CC Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

S}, xrefs: 023198C4

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: S}
API String ID: 0-4277866985
Opcode ID: 4c14e8efe554566b3b6f64fbbe1a0bfeeafcc62cba18a000d9c8f8486cba644e
Instruction ID: 6eca092c98c3adfaed0121b155035ca3d2c3a6a6fc12d10904b790ccf03c6d1f
Opcode Fuzzy Hash: 4c14e8efe554566b3b6f64fbbe1a0bfeeafcc62cba18a000d9c8f8486cba644e
Instruction Fuzzy Hash: D4317EB0528781AFD398DF28D49A81BBBF1FB88304F806E2DF88687294D775D445CB02

Uniqueness

Uniqueness Score: -1.00%

Function 023098AC Relevance: 1.3, Strings: 1, Instructions: 63COMMON

Download Yara Rule

Strings

6N, xrefs: 023099AB

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 6N
API String ID: 0-1503784733
Opcode ID: 4950689d9a431a30668e4ae59cbf44894261a06e5f6f244c2bb118cbde227f48
Instruction ID: f4a86dc4653c28cccd562090cb365a0bf87d83b70404bf80af20f8f7627260ee
Opcode Fuzzy Hash: 4950689d9a431a30668e4ae59cbf44894261a06e5f6f244c2bb118cbde227f48
Instruction Fuzzy Hash: 33316CB19087849BD349DF28D44941ABBE1BB9C70CF404B1DF4CAAB394D778DA05CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 0231BDA0 Relevance: 1.3, Strings: 1, Instructions: 60COMMON

Download Yara Rule

Strings

H-, xrefs: 0231BE4D

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: H-
API String ID: 0-1037293833
Opcode ID: de858980b3a6efa0554d811c46929b7bc76dc3a2dfb78603baf62d4ba3c8ea7f
Instruction ID: b1e2574861916e143dbd51d3dbaf767713271f180177b5759803beb599a6fa44
Opcode Fuzzy Hash: de858980b3a6efa0554d811c46929b7bc76dc3a2dfb78603baf62d4ba3c8ea7f
Instruction Fuzzy Hash: 53215D705083848BD348EF28C45651ABBE1BB8D348F404B1DF9CAAB360D778D654CB4A

Uniqueness

Uniqueness Score: -1.00%

Function 023196D4 Relevance: 1.3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

Strings

u*AR, xrefs: 0231978C

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: u*AR
API String ID: 0-611844632
Opcode ID: 336e368621e526daf09679cb3dd942b8565b5edbd5c0d4c2a93cf0215bbbb5a4
Instruction ID: 3bc00768d5a422eeaaf99635b3aa758fdae31e1bce01374c8fc39a0297de5fdb
Opcode Fuzzy Hash: 336e368621e526daf09679cb3dd942b8565b5edbd5c0d4c2a93cf0215bbbb5a4
Instruction Fuzzy Hash: 203189B050078E8FDB88CF68D85A19F7BA0FB08748F014A19FC2AD6664C7B4D664CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0230DBA0 Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

g*`, xrefs: 0230DCA8

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: g*`
API String ID: 0-1142845859
Opcode ID: 9cd48bc6e0482359d29cb13c7700713d9967f760f5c3549705931a0667eb5f41
Instruction ID: b8aa69d2f49c20b5acb1a00704d8964895f6476ef3bcf62c7f5396d2bf36bea0
Opcode Fuzzy Hash: 9cd48bc6e0482359d29cb13c7700713d9967f760f5c3549705931a0667eb5f41
Instruction Fuzzy Hash: 37217DB4628781AFD388DF28C59A91ABBE1FB89354F806A1DF88687260D774D441CB02

Uniqueness

Uniqueness Score: -1.00%

Function 0231A6BC Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

n*=, xrefs: 0231A6F9

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: n*=
API String ID: 0-1578461029
Opcode ID: 6c7163423625a1dfea4e6488f6549c3ec9800c1a3608f349b66670a568836fcf
Instruction ID: 5a6e668aa24801d1d9c6f28fa235fe069d2b7f3b57532802ece4870b677a6bb4
Opcode Fuzzy Hash: 6c7163423625a1dfea4e6488f6549c3ec9800c1a3608f349b66670a568836fcf
Instruction Fuzzy Hash: 3F2146B55087848BD359DF28C58A41ABBE0FB8C348F404B6DF4CAA7261D778D605CF0A

Uniqueness

Uniqueness Score: -1.00%

Function 023092F0 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

5$, xrefs: 02309317

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID: 5$
API String ID: 0-3756733592
Opcode ID: c6d1b2b01fc7d7aa2c8c76f25d08217fc2c1001ea0874a00b475e29af119845e
Instruction ID: e4429aaa6470e4800d38dcddd4cd9cbb61e65e1b626c8151716cae59427da810
Opcode Fuzzy Hash: c6d1b2b01fc7d7aa2c8c76f25d08217fc2c1001ea0874a00b475e29af119845e
Instruction Fuzzy Hash: 4C2127B46087848BD788DF28C05951BBBE0BB8C318F511B1DF4CAA6265D778D645CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A878 Relevance: 1.3, APIs: 1, Instructions: 7
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0000000118000A878(long long __rax) {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x800227e8 = __rax;
				return _t3 & 0xffffff00 | __rax != 0x00000000;
			}

0x18000a87c
0x18000a885
0x18000a893

APIs

GetProcessHeap.KERNEL32 ref: 000000018000A87C

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 91d3bf356e17fdc5d0dc73f5f53c12d610db6437279b1ba55c7f6661858add76
Instruction ID: b81358a64b4d4ed809fa94cc5bd0f3738e6ada5bf37cc3cf3ffb04c5a8196abe
Opcode Fuzzy Hash: 91d3bf356e17fdc5d0dc73f5f53c12d610db6437279b1ba55c7f6661858add76
Instruction Fuzzy Hash: 44B09230E07A08C2EA8BAB516C8234423A8AB4C740FAA9058900C81330DE2C02ED5710

Uniqueness

Uniqueness Score: -1.00%

Function 0230B258 Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1c64cfeeb38086a2dca9a5dc5c7c54d87ec123621af3d0d182b563ac43c41a0
Instruction ID: 8773eabb466d38e2161bf0cdb643e87445f61d46d2788509a7c46a8898131055
Opcode Fuzzy Hash: c1c64cfeeb38086a2dca9a5dc5c7c54d87ec123621af3d0d182b563ac43c41a0
Instruction Fuzzy Hash: BDE1F470E0460ACFDF58DFA8C4AA9AEBBB7FB44348F004169D806E72A0D7749615CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 02301000 Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d7556263b4ac9ce94f5939d6b647cebe0e0421b16219684ecf3aea226e168d
Instruction ID: 23f58cb715e48e67091b49dc376df7d19fde28930646ceed01248b9b28e0b81c
Opcode Fuzzy Hash: f0d7556263b4ac9ce94f5939d6b647cebe0e0421b16219684ecf3aea226e168d
Instruction Fuzzy Hash: C4C1CEB9903609CFDF68CF38C49A59D3BF1EF64308F204119EC269A2A6D774D529CB48

Uniqueness

Uniqueness Score: -1.00%

Function 0231020C Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6356c1b205dd3ea51b6168dff230cd1b04c92b5b79d4cfc048092e65768328f0
Instruction ID: 10065b3c9b5abf1c1aa56be3a03371dbffb723b62293697206dddefe893c549c
Opcode Fuzzy Hash: 6356c1b205dd3ea51b6168dff230cd1b04c92b5b79d4cfc048092e65768328f0
Instruction Fuzzy Hash: 36B10770E14B489FDFA8DFA8D48A9DEBBF2FB44348F004519D846A7290D7B8541BCB85

Uniqueness

Uniqueness Score: -1.00%

Function 0230BA2C Relevance: .2, Instructions: 192COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05221105fcf4a0dfa1600c7ecd9a36b5eab2b73dee02fe6529467e68ba200bce
Instruction ID: d84a0727c053a9bf370c569fdea4fef60fc5f2c94c412ebf2c23b39910c74547
Opcode Fuzzy Hash: 05221105fcf4a0dfa1600c7ecd9a36b5eab2b73dee02fe6529467e68ba200bce
Instruction Fuzzy Hash: 2FB1F8706087C88FDBBECF24C8992DB7BA9FB45708F504219E9CA8E294DB745745CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0231D770 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a1468b82f3cc8c6cef3d943e654abe810b4fd3ed5837763d1554f5f0f2f8fb4
Instruction ID: 8c078a83eb31d054714e39721b596a00254322f697a6ac45ed2b33088b11b8de
Opcode Fuzzy Hash: 8a1468b82f3cc8c6cef3d943e654abe810b4fd3ed5837763d1554f5f0f2f8fb4
Instruction Fuzzy Hash: 7B813A70D48709EFCB58DFA8C49599EBBF1FB44344F00856EE849EB290DB749A09CB81

Uniqueness

Uniqueness Score: -1.00%

Function 023227EC Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0216f555e37351bb33d44e999a90ae45b4d35870442341544a959e5100640a4
Instruction ID: 6ebbf33d9f857130a9839f6f741052980282a453dc9df50fb9f6674f160c4038
Opcode Fuzzy Hash: a0216f555e37351bb33d44e999a90ae45b4d35870442341544a959e5100640a4
Instruction Fuzzy Hash: 9B8116B051074D9BDF88CF28C8C99DD7BB1FB483A8FA56218FC0AA6254D778D485CB84

Uniqueness

Uniqueness Score: -1.00%

Function 02303ABC Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b26294f0f9f3284694c45c8b9595d0348109ce62e475cb7d6409abe9a76976a
Instruction ID: c7abd267521143327394ea6f23782aa2b4ae0493936d54ab9876472fa549e931
Opcode Fuzzy Hash: 7b26294f0f9f3284694c45c8b9595d0348109ce62e475cb7d6409abe9a76976a
Instruction Fuzzy Hash: 3C61207061464C8BDF28DF78D4A62AD3BE1FB44308F20613DE8668B2A2D774E506CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0231E310 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06da107516d47c143558e8aa98c820ad7c0c85d3c2a152159cfcced41356a87b
Instruction ID: 757b24094018afa1d4708172cf038a90afa9ee53adc47153a5143efa1b6a0ebc
Opcode Fuzzy Hash: 06da107516d47c143558e8aa98c820ad7c0c85d3c2a152159cfcced41356a87b
Instruction Fuzzy Hash: B7710770508789CBDBF9CF24C8896DE7BE4FB88704F10461DE9998B2A0DB749685CF41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007110 Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e3c0c76af823433cf272c9c4a9b61f0c82801c6157a6d7b247b40a6cf50061
Instruction ID: 322fdb5d9cbd24f261f2202f975b2bd3e56ab6ee9c72a1ae6d0c4d2aba79015f
Opcode Fuzzy Hash: 24e3c0c76af823433cf272c9c4a9b61f0c82801c6157a6d7b247b40a6cf50061
Instruction Fuzzy Hash: F8411561F66BD947FF43DA7A5812BB00A00AFA77C0E41E312FD0B77B52EB28455A8200

Uniqueness

Uniqueness Score: -1.00%

Function 02302C78 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab1c614082465e9adf873fcd8bb0e59269149d5aae34c8c546b648bb5ab83c2f
Instruction ID: 79dabacaeb287bf55cf765f2a5ed21f3379e8999bcfa5cf4c8625b5a0fcf87c0
Opcode Fuzzy Hash: ab1c614082465e9adf873fcd8bb0e59269149d5aae34c8c546b648bb5ab83c2f
Instruction Fuzzy Hash: AF51E670518788CBDBBADF38C8992D97BB1FB58304F90861DD84E8E290DB785749CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006818 Relevance: .1, Instructions: 126
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 56%

			E00000001180006818(signed int __edx, void* __edi, void* __esp, long long __rbx, signed long long*** __rcx, long long __rsi) {
				void* _t24;
				int _t26;
				signed int _t51;
				void* _t52;
				signed long long _t66;
				signed long long _t74;
				signed long long _t76;
				signed long long _t77;
				signed int* _t90;
				signed long long _t95;
				signed long long _t96;
				signed long long _t98;
				signed long long _t104;
				long long _t115;
				void* _t117;
				void* _t120;
				signed long long* _t123;
				signed long long _t124;
				signed long long _t126;
				signed long long _t129;
				signed long long*** _t132;

				_t52 = __edi;
				_t51 = __edx;
				 *((long long*)(_t117 + 8)) = __rbx;
				 *((long long*)(_t117 + 0x10)) = _t115;
				 *((long long*)(_t117 + 0x18)) = __rsi;
				_t66 =  *((intOrPtr*)(__rcx));
				_t132 = __rcx;
				_t90 =  *_t66;
				if (_t90 == 0) goto 0x800069ac;
				_t124 =  *0x80021010; // 0xf101478280a5
				_t111 = _t124 ^  *_t90;
				asm("dec eax");
				_t74 = _t124 ^ _t90[4];
				asm("dec ecx");
				asm("dec eax");
				if ((_t124 ^ _t90[2]) != _t74) goto 0x8000691e;
				_t76 = _t74 - (_t124 ^  *_t90) >> 3;
				_t101 =  >  ? _t66 : _t76;
				_t6 = _t115 + 0x20; // 0x20
				_t102 = ( >  ? _t66 : _t76) + _t76;
				_t103 =  ==  ? _t66 : ( >  ? _t66 : _t76) + _t76;
				if (( ==  ? _t66 : ( >  ? _t66 : _t76) + _t76) - _t76 < 0) goto 0x800068ba;
				_t7 = _t115 + 8; // 0x8
				r8d = _t7;
				E0000000118000A344(_t6, _t76, _t111,  ==  ? _t66 : ( >  ? _t66 : _t76) + _t76, _t111, _t115, _t120);
				_t24 = E0000000118000878C(_t66, _t111);
				if (_t66 != 0) goto 0x800068e2;
				_t104 = _t76 + 4;
				r8d = 8;
				E0000000118000A344(_t24, _t76, _t111, _t104, _t111, _t115, _t120);
				_t129 = _t66;
				_t26 = E0000000118000878C(_t66, _t111);
				if (_t129 == 0) goto 0x800069ac;
				_t123 = _t129 + _t76 * 8;
				_t77 = _t129 + _t104 * 8;
				_t87 =  >  ? _t115 : _t77 - _t123 + 7 >> 3;
				_t64 =  >  ? _t115 : _t77 - _t123 + 7 >> 3;
				if (( >  ? _t115 : _t77 - _t123 + 7 >> 3) == 0) goto 0x8000691e;
				memset(_t52, _t26, 0 << 0);
				_t126 =  *0x80021010; // 0xf101478280a5
				r8d = 0x40;
				asm("dec eax");
				 *_t123 =  *(_t132[1]) ^ _t126;
				_t95 =  *0x80021010; // 0xf101478280a5
				asm("dec eax");
				 *( *( *_t132)) = _t129 ^ _t95;
				_t96 =  *0x80021010; // 0xf101478280a5
				asm("dec eax");
				( *( *_t132))[1] =  &(_t123[1]) ^ _t96;
				_t98 =  *0x80021010; // 0xf101478280a5
				r8d = r8d - (_t51 & 0x0000003f);
				asm("dec eax");
				( *( *_t132))[2] = _t77 ^ _t98;
				goto 0x800069af;
				return 0xffffffff;
			}

0x180006818
0x180006818
0x180006818
0x18000681d
0x180006822
0x180006830
0x180006835
0x180006838
0x18000683e
0x180006844
0x180006851
0x18000685a
0x180006864
0x180006868
0x18000686b
0x180006871
0x18000687f
0x180006889
0x18000688d
0x180006890
0x180006893
0x18000689a
0x18000689c
0x18000689c
0x1800068a6
0x1800068b0
0x1800068b8
0x1800068ba
0x1800068be
0x1800068ca
0x1800068d1
0x1800068d4
0x1800068dc
0x1800068e9
0x1800068ed
0x180006905
0x180006909
0x18000690c
0x180006914
0x180006917
0x18000691e
0x18000693d
0x180006943
0x180006946
0x180006959
0x180006962
0x180006968
0x180006979
0x180006982
0x180006986
0x180006992
0x18000699b
0x1800069a6
0x1800069aa
0x1800069c7

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 66125d16ff0b32e256dde8720e794326bf559e2f75bb0b9fe279f413c53e15a7
Instruction ID: cb99d1167c8630c4161f8148837d3d56db0acdce36f97f7f4c16ea76a7bcc33d
Opcode Fuzzy Hash: 66125d16ff0b32e256dde8720e794326bf559e2f75bb0b9fe279f413c53e15a7
Instruction Fuzzy Hash: BF41C272310A5886EF85CF6AD95479973A2B74CFD0F19D422EE4D97B68DE3CC2458300

Uniqueness

Uniqueness Score: -1.00%

Function 0230B83C Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c06dbbd4d7f5d8b5a7dc781beb13b4593c6bbd5bd7959e7c7b22318daacb787
Instruction ID: 1768a06fcdceadd9971c820c0a3bf40d38ff8a366fb6821e4e5f8ff9f9785adf
Opcode Fuzzy Hash: 7c06dbbd4d7f5d8b5a7dc781beb13b4593c6bbd5bd7959e7c7b22318daacb787
Instruction Fuzzy Hash: ED5129709047499BDF48CF69C8895DEBBF1FB48318F11835CE88AA72A0D7B89A44CF45

Uniqueness

Uniqueness Score: -1.00%

Function 023090F8 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef86ec4cbab15db66684acca6e4eefc0d9a17a46b067acd768dfc4f73c7d9e5d
Instruction ID: fc10cfbc90e4569f3d2a33d35a67df5d0e2e9ba6fa1ca8f795555cbbcb448d09
Opcode Fuzzy Hash: ef86ec4cbab15db66684acca6e4eefc0d9a17a46b067acd768dfc4f73c7d9e5d
Instruction Fuzzy Hash: 3C51B2B090474E8FDB48CF68D49A5DE7FB0FB68398F204619E81596290D7B4D6A5CFC0

Uniqueness

Uniqueness Score: -1.00%

Function 02315CC4 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c42ee451b46e72c4fc1e7808b655d0298a624ad59252fa9ca8600e6c0870c205
Instruction ID: f897de9748848705cabb03a803129e9ee402035cf435d5b82a32c16c7be7080b
Opcode Fuzzy Hash: c42ee451b46e72c4fc1e7808b655d0298a624ad59252fa9ca8600e6c0870c205
Instruction Fuzzy Hash: 7B51A4B090438E8FDB88CF68D88A5CE7BF0FB58358F105619E865A6250D3B8D664CF95

Uniqueness

Uniqueness Score: -1.00%

Function 02325450 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1190db60a81a9605ea1e1068c6cf6b0ac0731fea71818b2d4916113a12896c76
Instruction ID: 94d4e7a141561695504c80503900f808a3bb26c71e382dcb3354acc1d318a87b
Opcode Fuzzy Hash: 1190db60a81a9605ea1e1068c6cf6b0ac0731fea71818b2d4916113a12896c76
Instruction Fuzzy Hash: 8551ADB490438E8FDB48CF68C88A5DF7BB1FB58348F004A19EC65A6250D3B8D665CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0231CC84 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4555d26f65456cde840fc2f4c666a8d56836cf0868c008055827d07d980c0c85
Instruction ID: f1330e5aed04dc1a33c203903c042a42e66e327ce52fa2a6fa1416b10b3ba71e
Opcode Fuzzy Hash: 4555d26f65456cde840fc2f4c666a8d56836cf0868c008055827d07d980c0c85
Instruction Fuzzy Hash: AD41C3B090074E8FDB48DF64C48A5DE7FB0FB68388F104619E85AA6250D378D6A4CFC5

Uniqueness

Uniqueness Score: -1.00%

Function 0230FFB8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2ca811980bf69d3a725c6de3b3fc4f76b8583c10f578fbad8bf36fe51f88080
Instruction ID: ffc56fd7168c6e695a14d31422796184757635042a1164aedc04677320af0710
Opcode Fuzzy Hash: c2ca811980bf69d3a725c6de3b3fc4f76b8583c10f578fbad8bf36fe51f88080
Instruction Fuzzy Hash: 9B3175B052D781ABD38CDF28D59991ABBE1FB89304F806A2DF98687350D774D445CB07

Uniqueness

Uniqueness Score: -1.00%

Function 02318E08 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 830eef0a3232ecb80f2826221d342755302fd87f2307e2f844fd0bd61878f91c
Instruction ID: efbb35fdfc96545695bc25e3bd00db16034c98cb8ef7f57b9f660a286bfd5c46
Opcode Fuzzy Hash: 830eef0a3232ecb80f2826221d342755302fd87f2307e2f844fd0bd61878f91c
Instruction Fuzzy Hash: 5F315AB450C7848BD348DF28C54A51ABBE1BB8D309F404B5DF8CAAA360D778D615CB4B

Uniqueness

Uniqueness Score: -1.00%

Function 02314F18 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f0004951027548f87f8e7a2444adc3bba6861f54e8d6066d46ca53370045021
Instruction ID: 623f27fec58fef4aaa379f7fbafc113b066f1698bb351901cc59bf5a19c6bb77
Opcode Fuzzy Hash: 2f0004951027548f87f8e7a2444adc3bba6861f54e8d6066d46ca53370045021
Instruction Fuzzy Hash: 1B218E70629380AFD388DF28D48981ABBF0BB89344F806A2DF8C68B360D775D445CB03

Uniqueness

Uniqueness Score: -1.00%

Function 023115C8 Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.319594851.0000000002301000.00000020.00001000.00020000.00000000.sdmp, Offset: 02301000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2301000_regsvr32.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3eb31fd98d478cbf7892b0886e03ca27d91577c01988fac24f665ec931eb86f0
Instruction ID: 199196ca8ace7e8d42d391659d5c3f2c80ec6c3440db0b61eb753a63f83db2a3
Opcode Fuzzy Hash: 3eb31fd98d478cbf7892b0886e03ca27d91577c01988fac24f665ec931eb86f0
Instruction Fuzzy Hash: 622146B45187858BD349DF28D49941ABBE0FB8C31CF805B2DF4CAAA264D378D645CB0A

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800070A0 Relevance: .0, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E000000011800070A0(intOrPtr __ebx, intOrPtr __edx, signed int __rax, signed int __rdx, void* __r8, signed long long _a8) {
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				void* _t25;

				_t25 = __r8;
				r8d = 0;
				 *0x800223a8 = r8d;
				_t1 = _t25 + 1; // 0x1
				r9d = _t1;
				asm("cpuid");
				_v16 = r9d;
				_v16 = 0;
				_v20 = __ebx;
				_v12 = __edx;
				if (0 != 0x18001000) goto 0x80007101;
				asm("xgetbv");
				_a8 = __rdx << 0x00000020 | __rax;
				r8d =  *0x800223a8; // 0x1
				r8d =  ==  ? r9d : r8d;
				 *0x800223a8 = r8d;
				 *0x800223ac = r8d;
				return 0;
			}

0x1800070a0
0x1800070a6
0x1800070ab
0x1800070b2
0x1800070b2
0x1800070b9
0x1800070bb
0x1800070c3
0x1800070c9
0x1800070cd
0x1800070d3
0x1800070d7
0x1800070e1
0x1800070eb
0x1800070f6
0x1800070fa
0x180007101
0x18000710f

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c9ee34aa5c89bc7d17368121c5bc84d136a52ab8ed5c42389172ea663d2f6f8f
Instruction ID: 0b5ba2cec2f3816840067680c3456701fe7a71aa0eb5ae5909cae72e813b022f
Opcode Fuzzy Hash: c9ee34aa5c89bc7d17368121c5bc84d136a52ab8ed5c42389172ea663d2f6f8f
Instruction Fuzzy Hash: B2F062717142989EDBEACF6CA84275A77D0E30C3C0F90C029E6D983B04D63C82A48F44

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010190 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 249COMMON

Download Yara Rule

APIs

GetGestureInfo.USER32 ref: 00000001800101C0
CloseGestureInfoHandle.USER32 ref: 0000000180010672

Strings

8, xrefs: 00000001800101AB

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: GestureInfo$CloseHandle
String ID: 8
API String ID: 372500805-4194326291
Opcode ID: fdc52a30d4232624ee8151016c0fb58607a1878d599af251dc45c002f5d40a09
Instruction ID: 9b1c06a3f3b833ac3e132f42adadd70dae9d03e82ad46587f4b990887cf4d8b3
Opcode Fuzzy Hash: fdc52a30d4232624ee8151016c0fb58607a1878d599af251dc45c002f5d40a09
Instruction Fuzzy Hash: B8D1DD76608F888AD765CB29E45439EB7A0F7C9BD0F508116EACE83768DF78C545CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800106E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 0000000180010872
BeginPaint.USER32 ref: 0000000180010889
EndPaint.USER32 ref: 00000001800108B2
PostQuitMessage.USER32 ref: 00000001800108BC
DefWindowProcW.USER32 ref: 00000001800108E3

Strings

i, xrefs: 000000018001083A

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: PaintProcWindow$BeginMessagePostQuit
String ID: i
API String ID: 3181456275-3865851505
Opcode ID: fcb843795d6400421a4bb60a8f9f2442e166c0b7f90a62d720e089610d409317
Instruction ID: 3856721ac4770c8f636c1cd384f04675dc9eeb63fc6bf43fe2054305ebc0c00e
Opcode Fuzzy Hash: fcb843795d6400421a4bb60a8f9f2442e166c0b7f90a62d720e089610d409317
Instruction Fuzzy Hash: FA51ED32518AC8C6E7B2DB55E4543DEB360F788784F609516F6CA52A98CFBCC548DF40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FCB0 Relevance: 13.7, APIs: 9, Instructions: 204COMMON

Download Yara Rule

APIs

CreatePen.GDI32 ref: 000000018000FCEE
SelectObject.GDI32 ref: 000000018000FD06
Polyline.GDI32 ref: 000000018000FFA3
MoveToEx.GDI32 ref: 000000018000FFE3
LineTo.GDI32 ref: 000000018001000C
MoveToEx.GDI32 ref: 0000000180010038
LineTo.GDI32 ref: 0000000180010061
SelectObject.GDI32 ref: 0000000180010074
DeleteObject.GDI32 ref: 000000018001007F

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: Object$LineMoveSelect$CreateDeletePolyline
String ID:
API String ID: 1917832262-0
Opcode ID: 6075ceb34f4407423de1dccbff4bd8bdfe60344340a25c122dca44a040083570
Instruction ID: 377a05cc6cc4517dbb54ffd3f6057de865f15df1cc6264ad20f86e3ae03f80f6
Opcode Fuzzy Hash: 6075ceb34f4407423de1dccbff4bd8bdfe60344340a25c122dca44a040083570
Instruction Fuzzy Hash: CDB12276604B848AD766CB38E05135AF7A5F7C9784F108216EACE53B69DF3CD5498F00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003328 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 66%

			E00000001180003328(intOrPtr __ecx, void* __edx, void* __esi, intOrPtr* __rcx, long long __rdx, long long __r8, long long __r9, void* __r10) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int* _t128;
				void* _t145;
				intOrPtr _t146;
				intOrPtr _t154;
				void* _t173;
				intOrPtr _t176;
				signed int _t177;
				signed int _t178;
				void* _t209;
				signed long long _t219;
				signed long long _t220;
				signed long long _t226;
				long long _t228;
				signed int _t235;
				intOrPtr* _t236;
				intOrPtr* _t237;
				signed long long _t246;
				long long _t267;
				signed int* _t280;
				long long _t281;
				void* _t282;
				void* _t283;
				signed long long _t284;
				long long _t296;
				signed int _t307;
				unsigned long long _t313;

				_t180 = __esi;
				_t282 = _t283 - 0x28;
				_t284 = _t283 - 0x128;
				_t219 =  *0x80021010; // 0xf101478280a5
				_t220 = _t219 ^ _t284;
				 *(_t282 + 0x10) = _t220;
				_t280 =  *((intOrPtr*)(_t282 + 0x90));
				_t307 =  *((intOrPtr*)(_t282 + 0xa8));
				 *((long long*)(_t284 + 0x68)) = __r8;
				_t236 = __rcx;
				 *((long long*)(_t284 + 0x78)) = __rdx;
				 *(_t282 - 0x68) = _t307;
				 *((char*)(_t284 + 0x60)) = 0;
				_t281 = __r9;
				_t128 = E0000000118000427C(__ecx, __esi, __rcx, __rdx, __r9, __r9, _t282, _t280, __r9);
				r14d = _t128;
				if (_t128 - 0xffffffff < 0) goto 0x800037f7;
				if (_t128 - _t280[1] >= 0) goto 0x800037f7;
				if ( *_t236 != 0xe06d7363) goto 0x80003474;
				if ( *((intOrPtr*)(_t236 + 0x18)) != 4) goto 0x80003474;
				if ( *((intOrPtr*)(_t236 + 0x20)) - 0x19930520 - 2 > 0) goto 0x80003474;
				if ( *((long long*)(_t236 + 0x30)) != 0) goto 0x80003474;
				E00000001180002D40(_t220);
				if ( *((long long*)(_t220 + 0x20)) == 0) goto 0x80003790;
				E00000001180002D40(_t220);
				_t237 =  *((intOrPtr*)(_t220 + 0x20));
				E00000001180002D40(_t220);
				 *((char*)(_t284 + 0x60)) = 1;
				 *((long long*)(_t284 + 0x68)) =  *((intOrPtr*)(_t220 + 0x28));
				E00000001180002448(_t220,  *((intOrPtr*)(_t237 + 0x38)));
				if ( *_t237 != 0xe06d7363) goto 0x8000342c;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0x8000342c;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0x8000342c;
				if ( *((long long*)(_t237 + 0x30)) == 0) goto 0x800037f7;
				E00000001180002D40(_t220);
				if ( *(_t220 + 0x38) == 0) goto 0x80003474;
				E00000001180002D40(_t220);
				E00000001180002D40(_t220);
				 *(_t220 + 0x38) =  *(_t220 + 0x38) & 0x00000000;
				if (E00000001180004314(_t220, _t237, _t237,  *(_t220 + 0x38), __r9) != 0) goto 0x8000346f;
				if (E00000001180004404(_t220, _t237,  *(_t220 + 0x38), __r9, _t282) == 0) goto 0x800037d4;
				goto 0x800037b0;
				 *((long long*)(_t282 - 0x40)) =  *((intOrPtr*)(__r9 + 8));
				 *(_t282 - 0x48) = _t280;
				if ( *_t237 != 0xe06d7363) goto 0x80003747;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0x80003747;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0x80003747;
				r15d = 0;
				if (_t280[3] - r15d <= 0) goto 0x80003678;
				 *(_t284 + 0x28) =  *(_t282 + 0xa0);
				 *(_t284 + 0x20) = _t280;
				r8d = r14d;
				_t145 = E00000001180002134(_t237, _t282 - 0x28, _t282 - 0x48, __r9, _t282, _t280, __r9, __r10);
				asm("movups xmm0, [ebp-0x28]");
				asm("movdqu [ebp-0x38], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t145 -  *((intOrPtr*)(_t282 - 0x10)) >= 0) goto 0x80003678;
				_t296 =  *((intOrPtr*)(_t282 - 0x28));
				r13d =  *((intOrPtr*)(_t282 - 0x30));
				 *((long long*)(_t282 - 0x80)) = _t296;
				_t146 = r13d;
				asm("inc ecx");
				 *((intOrPtr*)(_t282 - 0x50)) = __ecx;
				asm("movd eax, xmm0");
				asm("movups [ebp-0x60], xmm0");
				if (_t146 - r14d > 0) goto 0x8000366b;
				_t226 =  *(_t282 - 0x60) >> 0x20;
				if (r14d - _t146 > 0) goto 0x8000366b;
				r12d = r15d;
				_t267 =  *((intOrPtr*)( *((intOrPtr*)( *( *(_t282 - 0x38)) + 0x10)) + ( *( *(_t282 - 0x38)) +  *( *(_t282 - 0x38)) * 4) * 4 +  *((intOrPtr*)(_t296 + 8)) + 0x10)) +  *((intOrPtr*)(__r9 + 8));
				_t313 =  *(_t282 - 0x58) >> 0x20;
				 *((long long*)(_t282 - 0x70)) = _t267;
				if (r15d == 0) goto 0x80003658;
				_t246 = _t226 + _t226 * 4;
				asm("movups xmm0, [edx+ecx*4]");
				asm("movups [ebp-0x8], xmm0");
				_t59 = _t246 * 4; // 0x48ccccc35f40c483
				 *((intOrPtr*)(_t282 + 8)) =  *((intOrPtr*)(_t267 + _t59 + 0x10));
				E0000000118000241C(_t226);
				_t228 = _t226 + 4 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc));
				 *((long long*)(_t284 + 0x70)) = _t228;
				E0000000118000241C(_t228);
				_t176 =  *((intOrPtr*)(_t228 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc))));
				 *((intOrPtr*)(_t284 + 0x64)) = _t176;
				if (_t176 <= 0) goto 0x800035e8;
				E0000000118000241C(_t228);
				 *((long long*)(_t282 - 0x78)) = _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70))));
				if (E00000001180003A1C(_t180, _t237, _t282 - 8, _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70)))), _t280, __r9,  *((intOrPtr*)(_t237 + 0x30))) != 0) goto 0x800035f9;
				 *((long long*)(_t284 + 0x70)) =  *((long long*)(_t284 + 0x70)) + 4;
				_t154 =  *((intOrPtr*)(_t284 + 0x64)) - 1;
				 *((intOrPtr*)(_t284 + 0x64)) = _t154;
				if (_t154 > 0) goto 0x800035ac;
				r12d = r12d + 1;
				if (r12d == r15d) goto 0x8000365f;
				goto 0x80003565;
				 *((char*)(_t284 + 0x58)) =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) =  *((intOrPtr*)(_t284 + 0x60));
				 *((long long*)(_t284 + 0x48)) =  *(_t282 - 0x68);
				 *(_t284 + 0x40) =  *(_t282 + 0xa0);
				 *(_t284 + 0x38) = _t282 - 0x60;
				 *(_t284 + 0x30) =  *((intOrPtr*)(_t282 - 0x78));
				 *(_t284 + 0x28) = _t282 - 8;
				 *(_t284 + 0x20) = _t280;
				E00000001180003254(_t180, _t237, _t237,  *((intOrPtr*)(_t284 + 0x78)),  *((intOrPtr*)(_t284 + 0x68)), _t281);
				goto 0x80003664;
				goto 0x80003668;
				r15d = 0;
				r13d = r13d + 1;
				if (r13d -  *((intOrPtr*)(_t282 - 0x10)) < 0) goto 0x800034fd;
				if (( *_t280 & 0x1fffffff) - 0x19930521 < 0) goto 0x80003784;
				_t209 = _t280[8] - r15d;
				if (_t209 == 0) goto 0x8000369e;
				E00000001180002408(_t282 - 8);
				if (_t209 != 0) goto 0x800036bf;
				if ((_t280[9] >> 0x00000002 & 0x00000001) == 0) goto 0x80003784;
				if (E00000001180001FD8(_t280[9] >> 0x00000002 & 0x00000001, _t282 - 8 + _t280[8], _t281, _t280) != 0) goto 0x80003784;
				if ((_t280[9] >> 0x00000002 & 0x00000001) != 0) goto 0x800037da;
				if (_t280[8] == r15d) goto 0x800036e4;
				E00000001180002408(_t282 - 8 + _t280[8]);
				_t235 = _t280[8];
				goto 0x800036e7;
				if (E00000001180004314(_t235, _t237, _t237, _t313, _t281) != 0) goto 0x80003784;
				E00000001180002068(_t237,  *((intOrPtr*)(_t284 + 0x78)), _t281, _t282, _t280, _t282 - 0x78);
				_t177 =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) = _t177;
				_t178 = _t177 | 0xffffffff;
				 *((long long*)(_t284 + 0x48)) = _t281;
				 *(_t284 + 0x40) = _t313;
				 *(_t284 + 0x38) = _t178;
				 *(_t284 + 0x30) = _t178;
				 *(_t284 + 0x28) = _t280;
				 *(_t284 + 0x20) = _t313;
				E00000001180002274( *((intOrPtr*)(_t284 + 0x78)), _t237,  *((intOrPtr*)(_t284 + 0x68)), _t235);
				goto 0x80003784;
				if (_t280[3] <= 0) goto 0x80003784;
				if ( *((char*)(_t282 + 0x98)) != 0) goto 0x800037f7;
				 *(_t284 + 0x38) = _t307;
				 *(_t284 + 0x30) =  *(_t282 + 0xa0);
				 *(_t284 + 0x28) = r14d;
				 *(_t284 + 0x20) = _t280;
				E00000001180003800(_t237, _t237,  *((intOrPtr*)(_t284 + 0x78)), _t313, _t281);
				_t173 = E00000001180002D40(_t235);
				if ( *((long long*)(_t235 + 0x38)) != 0) goto 0x800037f7;
				return E000000011800010B0(_t173, _t178,  *(_t282 + 0x10) ^ _t284);
			}

0x180003328
0x180003335
0x18000333a
0x180003341
0x180003348
0x18000334b
0x18000334f
0x180003359
0x180003363
0x180003368
0x18000336b
0x180003376
0x18000337d
0x180003382
0x180003385
0x18000338a
0x180003390
0x180003399
0x1800033a5
0x1800033af
0x1800033c0
0x1800033cb
0x1800033d1
0x1800033db
0x1800033e1
0x1800033e6
0x1800033ea
0x1800033f3
0x1800033fc
0x180003401
0x18000340c
0x180003412
0x18000341f
0x180003426
0x18000342c
0x180003436
0x180003438
0x180003441
0x18000344c
0x180003458
0x180003464
0x18000346a
0x180003478
0x18000347c
0x180003486
0x180003490
0x1800034a1
0x1800034a7
0x1800034ae
0x1800034be
0x1800034c9
0x1800034ce
0x1800034d1
0x1800034d6
0x1800034da
0x1800034df
0x1800034e4
0x1800034eb
0x1800034f1
0x1800034f5
0x1800034f9
0x180003508
0x180003517
0x180003521
0x180003524
0x180003528
0x18000352f
0x180003539
0x180003540
0x180003546
0x18000354c
0x180003554
0x180003558
0x18000355f
0x180003568
0x18000356c
0x180003570
0x180003574
0x180003578
0x18000357b
0x18000358c
0x18000358f
0x180003594
0x1800035a1
0x1800035a4
0x1800035aa
0x1800035ac
0x1800035c7
0x1800035d2
0x1800035d8
0x1800035de
0x1800035e0
0x1800035e6
0x1800035e8
0x1800035ee
0x1800035f4
0x180003612
0x18000361a
0x180003622
0x18000362d
0x180003635
0x18000363e
0x180003647
0x18000364c
0x180003651
0x180003656
0x18000365d
0x180003668
0x18000366b
0x180003672
0x180003684
0x18000368a
0x18000368e
0x180003690
0x18000369c
0x1800036a6
0x1800036b9
0x1800036c7
0x1800036d1
0x1800036d3
0x1800036db
0x1800036e2
0x1800036f1
0x180003704
0x180003709
0x18000371a
0x18000371e
0x180003721
0x180003726
0x18000372b
0x18000372f
0x180003736
0x18000373b
0x180003740
0x180003745
0x18000374b
0x180003754
0x180003763
0x18000376b
0x180003772
0x18000377a
0x18000377f
0x180003784
0x18000378e
0x1800037af

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000000180003385

Part of subcall function 000000018000427C: __GetUnwindTryBlock.LIBCMT ref: 00000001800042BF
Part of subcall function 000000018000427C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000001800042E4

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000018000345D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000001800036B2
std::bad_alloc::bad_alloc.LIBCMT ref: 00000001800037BE

Strings

csm, xrefs: 0000000180003480
csm, xrefs: 0000000180003406
csm, xrefs: 000000018000339F

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: b6b7f02adf660401896063c6a860fb7c8eea0d446ae07e01c980b744b2235902
Instruction ID: 68369fba8b053f101f7a0a57f2a328d7db6ec17b1fffbc4fe0a5b608d0144455
Opcode Fuzzy Hash: b6b7f02adf660401896063c6a860fb7c8eea0d446ae07e01c980b744b2235902
Instruction Fuzzy Hash: C0E1B272604B888AEBA6DF66D4423DD77A4F749BC8F008116FE8957B96CF34D698C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A3DC Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0000000118000A3DC(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				void* _t35;
				signed long long _t56;
				intOrPtr _t60;
				void* _t71;
				signed long long _t72;
				long long _t78;
				void* _t82;
				signed long long _t88;
				signed long long _t89;
				signed long long _t90;
				WCHAR* _t91;
				long _t94;
				void* _t97;
				WCHAR* _t102;

				 *((long long*)(_t82 + 8)) = __rbx;
				 *((long long*)(_t82 + 0x10)) = _t78;
				 *((long long*)(_t82 + 0x18)) = __rsi;
				r15d = __ecx;
				_t72 = _t71 | 0xffffffff;
				_t89 =  *0x80021010; // 0xf101478280a5
				_t88 =  *(0x180000000 + 0x226f0 + _t102 * 8) ^ _t89;
				asm("dec ecx");
				if (_t88 == _t72) goto 0x8000a51f;
				if (_t88 == 0) goto 0x8000a441;
				_t56 = _t88;
				goto 0x8000a521;
				if (__r8 == __r9) goto 0x8000a504;
				_t60 =  *((intOrPtr*)(0x180000000 + 0x22640 + __rsi * 8));
				if (_t60 == 0) goto 0x8000a469;
				if (_t60 != _t72) goto 0x8000a55e;
				goto 0x8000a4f0;
				r8d = 0x800;
				LoadLibraryExW(_t102, _t97, _t94);
				if (_t56 != 0) goto 0x8000a53e;
				if (GetLastError() != 0x57) goto 0x8000a4de;
				_t14 = _t56 - 0x50; // -80
				_t35 = _t14;
				r8d = _t35;
				if (E00000001180007070(__r8) == 0) goto 0x8000a4de;
				r8d = _t35;
				if (E00000001180007070(__r8) == 0) goto 0x8000a4de;
				r8d = 0;
				LoadLibraryExW(_t91, _t71);
				if (_t56 != 0) goto 0x8000a53e;
				 *((intOrPtr*)(0x180000000 + 0x22640 + __rsi * 8)) = _t72;
				if (__r8 + 4 != __r9) goto 0x8000a44a;
				_t90 =  *0x80021010; // 0xf101478280a5
				asm("dec eax");
				 *(0x180000000 + 0x226f0 + _t102 * 8) = _t72 ^ _t90;
				return 0;
			}

0x18000a3dc
0x18000a3e1
0x18000a3e6
0x18000a3f8
0x18000a402
0x18000a418
0x18000a41f
0x18000a428
0x18000a42e
0x18000a437
0x18000a439
0x18000a43c
0x18000a444
0x18000a44d
0x18000a459
0x18000a45e
0x18000a464
0x18000a476
0x18000a47c
0x18000a488
0x18000a497
0x18000a499
0x18000a499
0x18000a49f
0x18000a4b0
0x18000a4b2
0x18000a4c6
0x18000a4c8
0x18000a4d0
0x18000a4dc
0x18000a4e8
0x18000a4f7
0x18000a4fd
0x18000a511
0x18000a517
0x18000a53d

APIs

FreeLibrary.KERNEL32 ref: 000000018000A558
GetProcAddress.KERNEL32 ref: 000000018000A564

Strings

api-ms-, xrefs: 000000018000A4A2
ext-ms-, xrefs: 000000018000A4B5

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 4973cf4a17c5a6c0ea837db478b6f4f53bca8011a61d94df8f11c1c7fa6ad517
Instruction ID: 4cb29e05f73c92bcfdeebd25cdbb701ff5eb44b215489781f60aaecc25d2491e
Opcode Fuzzy Hash: 4973cf4a17c5a6c0ea837db478b6f4f53bca8011a61d94df8f11c1c7fa6ad517
Instruction Fuzzy Hash: ED41D032715A0856FBA7CB16AC047D53391B78EBE0F09C225BD1D47798EE38C64D8300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800045BC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E000000011800045BC(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				struct HINSTANCE__* _t81;
				long long _t85;
				void* _t89;
				struct HINSTANCE__* _t94;
				long _t97;
				void* _t100;
				signed long long _t101;
				WCHAR* _t104;

				 *((long long*)(_t89 + 8)) = __rbx;
				 *((long long*)(_t89 + 0x10)) = _t85;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t101 = _t100 | 0xffffffff;
				_t61 =  *((intOrPtr*)(0x180000000 + 0x22208 + _t81 * 8));
				if (_t61 == _t101) goto 0x800046eb;
				if (_t61 != 0) goto 0x800046ed;
				if (__r8 == __r9) goto 0x800046e3;
				_t67 =  *((intOrPtr*)(0x180000000 + 0x221f0 + __rsi * 8));
				if (_t67 == 0) goto 0x8000462e;
				if (_t67 != _t101) goto 0x800046c5;
				goto 0x80004699;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t100, _t97);
				_t68 = _t61;
				if (_t61 != 0) goto 0x800046a5;
				if (GetLastError() != 0x57) goto 0x80004687;
				_t14 = _t68 + 7; // 0x7
				r8d = _t14;
				if (E00000001180007070(__r8) == 0) goto 0x80004687;
				r8d = 0;
				LoadLibraryExW(??, ??, ??);
				if (_t61 != 0) goto 0x800046a5;
				 *((intOrPtr*)(0x180000000 + 0x221f0 + __rsi * 8)) = _t101;
				goto 0x8000460c;
				_t21 = 0x180000000 + 0x221f0 + __rsi * 8;
				_t65 =  *_t21;
				 *_t21 = _t61;
				if (_t65 == 0) goto 0x800046c5;
				FreeLibrary(_t94);
				GetProcAddress(_t81);
				if (_t65 == 0) goto 0x800046e3;
				 *((intOrPtr*)(0x180000000 + 0x22208 + _t81 * 8)) = _t65;
				goto 0x800046ed;
				 *((intOrPtr*)(0x180000000 + 0x22208 + _t81 * 8)) = _t101;
				return 0;
			}

0x1800045bc
0x1800045c1
0x1800045c6
0x1800045e1
0x1800045ee
0x1800045fa
0x180004603
0x18000460c
0x180004615
0x180004621
0x180004626
0x18000462c
0x18000463b
0x180004641
0x180004647
0x18000464d
0x180004658
0x18000465a
0x18000465a
0x18000466f
0x180004671
0x180004679
0x180004685
0x180004691
0x1800046a0
0x1800046af
0x1800046af
0x1800046af
0x1800046ba
0x1800046bf
0x1800046cb
0x1800046d4
0x1800046d9
0x1800046e1
0x1800046e3
0x180004709

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00000001800047C3,?,?,?,0000000180002D8E,?,?,?,0000000180002A39), ref: 0000000180004641
GetLastError.KERNEL32(?,?,00000000,00000001800047C3,?,?,?,0000000180002D8E,?,?,?,0000000180002A39), ref: 000000018000464F
LoadLibraryExW.KERNEL32(?,?,00000000,00000001800047C3,?,?,?,0000000180002D8E,?,?,?,0000000180002A39), ref: 0000000180004679
FreeLibrary.KERNEL32(?,?,00000000,00000001800047C3,?,?,?,0000000180002D8E,?,?,?,0000000180002A39), ref: 00000001800046BF
GetProcAddress.KERNEL32(?,?,00000000,00000001800047C3,?,?,?,0000000180002D8E,?,?,?,0000000180002A39), ref: 00000001800046CB

Strings

api-ms-, xrefs: 0000000180004661

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: d92b391dc074c551f2fff15d3caa28434169fc5b46989934520673f65e9ea010
Instruction ID: a281eee05f5572a15ea3fe0403c4f12dabc44bbec878773a6143b276462e3048
Opcode Fuzzy Hash: d92b391dc074c551f2fff15d3caa28434169fc5b46989934520673f65e9ea010
Instruction Fuzzy Hash: 9F31F276302B48A1EE93DB02A8007D533E4B70DBE4F598625BE2D0B3A0EF39C24C8705

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007DB8 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000180007DC7
FlsGetValue.KERNEL32 ref: 0000000180007DDC
FlsSetValue.KERNEL32 ref: 0000000180007DFD
FlsSetValue.KERNEL32 ref: 0000000180007E2A
FlsSetValue.KERNEL32 ref: 0000000180007E3B
FlsSetValue.KERNEL32 ref: 0000000180007E4C
SetLastError.KERNEL32 ref: 0000000180007E67

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5bc48b536716d6500d6b4fd732b8b14869dbb673373b5a9a242e628548633fb8
Instruction ID: c3c6b15d1e2a8e36adeeaa1ee2c0ab8803bf36c1bad1bc725f34006b2089cb00
Opcode Fuzzy Hash: 5bc48b536716d6500d6b4fd732b8b14869dbb673373b5a9a242e628548633fb8
Instruction Fuzzy Hash: A5214F3470668C42FAE7E73195553ED72926B6C7F0F58C624B83A07BDBDE6C8A494700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F374 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000000018000F3A5
GetLastError.KERNEL32 ref: 000000018000F3B1
CloseHandle.KERNEL32 ref: 000000018000F3C9
CreateFileW.KERNEL32 ref: 000000018000F3F4
WriteConsoleW.KERNEL32 ref: 000000018000F413

Strings

CONOUT$, xrefs: 000000018000F3D5

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5f84935fb18113dc5388fb9af56135c4a8d61c8a22428d4b494f05fe971ce8aa
Instruction ID: 0de398e34c1669cec19602a54f8a011ae7faefe96049ea3591aa14d2bab58b4a
Opcode Fuzzy Hash: 5f84935fb18113dc5388fb9af56135c4a8d61c8a22428d4b494f05fe971ce8aa
Instruction Fuzzy Hash: 7F115B31610F4886E7939B52F85439A73A0F79CBE4F048225FA5E87BA4CF78CA488740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014C90 Relevance: 9.0, APIs: 6, Instructions: 45windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 0000000180014CBF
LoadStringW.USER32 ref: 0000000180014CDC

Part of subcall function 00000001800109D0: LoadCursorW.USER32 ref: 0000000180010A22
Part of subcall function 00000001800109D0: RegisterClassExW.USER32 ref: 0000000180010A59

Part of subcall function 0000000180010910: CreateWindowExW.USER32 ref: 000000018001098A

GetMessageW.USER32 ref: 0000000180014D0F
TranslateAcceleratorW.USER32 ref: 0000000180014D25
TranslateMessage.USER32 ref: 0000000180014D34
DispatchMessageW.USER32 ref: 0000000180014D3F

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: LoadMessage$StringTranslate$AcceleratorClassCreateCursorDispatchRegisterWindow
String ID:
API String ID: 1967609040-0
Opcode ID: 75c1782b7f7e477433b17d4cbabed80ab7ba6ec157a4fc5f42b14144684d98ab
Instruction ID: 677205889e0bc738131920ca4d71d6e0d0c6d5bcb4ac294ec7d30bf60c9b59c6
Opcode Fuzzy Hash: 75c1782b7f7e477433b17d4cbabed80ab7ba6ec157a4fc5f42b14144684d98ab
Instruction Fuzzy Hash: 8611B932614E89D2E7A2DB61F8517DA7361F7D8784F508121FA8947A79DF3CC7198B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003B5C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E00000001180003B5C(void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9, void* _a8, void* _a16, void* _a24, void* _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				signed int _v32;
				long long _v40;
				char _v48;
				signed int* _v56;
				void* _t55;
				intOrPtr _t60;
				signed int _t101;
				void* _t109;
				intOrPtr _t111;
				signed int* _t115;
				intOrPtr* _t136;
				void* _t139;
				void* _t142;
				void* _t144;
				void* _t158;
				void* _t159;

				_t109 = _t144;
				 *((long long*)(_t109 + 8)) = __rbx;
				 *((long long*)(_t109 + 0x10)) = __rbp;
				 *((long long*)(_t109 + 0x18)) = __rsi;
				 *((long long*)(_t109 + 0x20)) = __rdi;
				_t136 = __rcx;
				_t139 = __r9;
				_t159 = __r8;
				_t142 = __rdx;
				E00000001180004584(_t55, __r8);
				E00000001180002D40(_t109);
				_t115 = _a40;
				if ( *((intOrPtr*)(_t109 + 0x40)) != 0) goto 0x80003bde;
				if ( *__rcx == 0xe06d7363) goto 0x80003bde;
				if ( *__rcx != 0x80000029) goto 0x80003bc2;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 0xf) goto 0x80003bc6;
				if ( *((long long*)(__rcx + 0x60)) == 0x19930520) goto 0x80003bde;
				if ( *__rcx == 0x80000026) goto 0x80003bde;
				if (( *_t115 & 0x1fffffff) - 0x19930522 < 0) goto 0x80003bde;
				if ((_t115[9] & 0x00000001) != 0) goto 0x80003d6d;
				if (( *(__rcx + 4) & 0x00000066) == 0) goto 0x80003c76;
				if (_t115[1] == 0) goto 0x80003d6d;
				if (_a48 != 0) goto 0x80003d6d;
				if (( *(__rcx + 4) & 0x00000020) == 0) goto 0x80003c63;
				if ( *__rcx != 0x80000026) goto 0x80003c41;
				_t60 = E00000001180002F2C(_t115, __r9,  *((intOrPtr*)(__r9 + 0x20)), __r9);
				if (_t60 - 0xffffffff < 0) goto 0x80003d8d;
				if (_t60 - _t115[1] >= 0) goto 0x80003d8d;
				r9d = _t60;
				E000000011800040F0(_t109, _t142, __r9, _t115);
				goto 0x80003d6d;
				if ( *_t136 != 0x80000029) goto 0x80003c63;
				r9d =  *((intOrPtr*)(_t136 + 0x38));
				if (r9d - 0xffffffff < 0) goto 0x80003d8d;
				if (r9d - _t115[1] >= 0) goto 0x80003d8d;
				goto 0x80003c31;
				E00000001180002004(r9d - _t115[1], _t109, _t115, __r9, __r9, _t115);
				goto 0x80003d6d;
				if (_t115[3] != 0) goto 0x80003cbe;
				if (( *_t115 & 0x1fffffff) - 0x19930521 < 0) goto 0x80003c9e;
				_t101 = _t115[8];
				if (_t101 == 0) goto 0x80003c9e;
				E00000001180002408(_t109);
				if (_t101 != 0) goto 0x80003cbe;
				if (( *_t115 & 0x1fffffff) - 0x19930522 < 0) goto 0x80003d6d;
				if ((_t115[9] >> 0x00000002 & 0x00000001) == 0) goto 0x80003d6d;
				if ( *_t136 != 0xe06d7363) goto 0x80003d34;
				if ( *((intOrPtr*)(_t136 + 0x18)) - 3 < 0) goto 0x80003d34;
				if ( *((intOrPtr*)(_t136 + 0x20)) - 0x19930522 <= 0) goto 0x80003d34;
				_t111 =  *((intOrPtr*)(_t136 + 0x30));
				if ( *((intOrPtr*)(_t111 + 8)) == 0) goto 0x80003d34;
				E0000000118000241C(_t111);
				if (_t111 +  *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x30)) + 8)) == 0) goto 0x80003d34;
				_v32 = _a64 & 0x000000ff;
				_v40 = _a56;
				_v48 = _a48;
				_v56 = _t115;
				 *0x80016370(_t158);
				goto 0x80003d72;
				_v32 = _a56;
				_v40 = _a48;
				_v48 = _a64;
				_v56 = _t115;
				E00000001180003328(_a64 & 0x000000ff, 0x80000026, __esi, _t136, _t142, _t159, _t139, _t111 +  *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x30)) + 8)));
				return 1;
			}

0x180003b5c
0x180003b5f
0x180003b63
0x180003b67
0x180003b6b
0x180003b75
0x180003b78
0x180003b7e
0x180003b81
0x180003b84
0x180003b89
0x180003b8e
0x180003ba4
0x180003bac
0x180003bb0
0x180003bb6
0x180003bc0
0x180003bc4
0x180003bd2
0x180003bd8
0x180003be2
0x180003bec
0x180003bfa
0x180003c04
0x180003c08
0x180003c14
0x180003c1c
0x180003c25
0x180003c2b
0x180003c37
0x180003c3c
0x180003c43
0x180003c45
0x180003c4d
0x180003c57
0x180003c61
0x180003c6c
0x180003c71
0x180003c7a
0x180003c88
0x180003c8a
0x180003c8e
0x180003c90
0x180003c9c
0x180003caa
0x180003cb8
0x180003cc4
0x180003cca
0x180003cd3
0x180003cd5
0x180003cdd
0x180003cdf
0x180003cf2
0x180003d09
0x180003d18
0x180003d20
0x180003d27
0x180003d2c
0x180003d32
0x180003d3f
0x180003d51
0x180003d5f
0x180003d63
0x180003d68
0x180003d8c

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000000180003B84
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000000180003C6C
__std_exception_copy.LIBVCRUNTIME ref: 0000000180003DB8

Strings

csm, xrefs: 0000000180003BA6
csm, xrefs: 0000000180003CBE

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
String ID: csm$csm
API String ID: 851805269-3733052814
Opcode ID: ae528b8b242bffcc2854918ec9a27d0bb976d941c4d1a74ac96dd6768b11b5c3
Instruction ID: ef6ae88387dfa06c815bde898961dd69fb07e80911919095ce8a45e838d8869a
Opcode Fuzzy Hash: ae528b8b242bffcc2854918ec9a27d0bb976d941c4d1a74ac96dd6768b11b5c3
Instruction Fuzzy Hash: C5617F3220078886EBB6CF26E44539877A9F758BD4F18C116EB9847BD5CF38D699C701

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002A84 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00000001180002A84(void* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __r8, intOrPtr* __r9) {
				void* _t76;
				void* _t83;
				void* _t84;
				intOrPtr _t101;
				intOrPtr _t103;
				void* _t113;
				void* _t118;
				void* _t130;
				long long _t133;
				intOrPtr* _t135;
				signed long long _t144;
				void* _t150;
				signed long long _t154;
				void* _t156;
				long long _t158;
				intOrPtr* _t159;
				void* _t161;
				void* _t162;
				signed long long _t166;
				void* _t170;
				intOrPtr _t171;
				void* _t173;
				void* _t174;
				void* _t176;
				void* _t178;
				void* _t180;
				intOrPtr* _t181;

				_t130 = __rax;
				 *((long long*)(_t161 + 8)) = __rbx;
				 *((long long*)(_t161 + 0x10)) = _t158;
				 *((long long*)(_t161 + 0x18)) = __rsi;
				_t162 = _t161 - 0x40;
				_t159 = __rcx;
				_t181 = __r9;
				_t174 = __rdx;
				E00000001180004584(_t76, __r8);
				_t171 =  *((intOrPtr*)(__r9 + 8));
				_t135 =  *((intOrPtr*)(__r9 + 0x38));
				_t178 =  *__r9 - _t171;
				_t103 =  *((intOrPtr*)(__r9 + 0x48));
				if (( *(__rcx + 4) & 0x00000066) != 0) goto 0x80002bac;
				 *((long long*)(_t162 + 0x30)) = __rcx;
				 *((long long*)(_t162 + 0x38)) = __r8;
				if (_t103 -  *_t135 >= 0) goto 0x80002c58;
				_t154 = __r8 + __r8;
				if (_t178 - _t130 < 0) goto 0x80002b9e;
				if (_t178 - _t130 >= 0) goto 0x80002b9e;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t154 * 8)) == 0) goto 0x80002b9e;
				if ( *((intOrPtr*)(_t135 + 0xc + _t154 * 8)) == 1) goto 0x80002b2a;
				_t113 =  *((long long*)(_t130 + _t171))(_t180, _t176, _t173, _t170, _t150);
				if (_t113 < 0) goto 0x80002ba5;
				if (_t113 <= 0) goto 0x80002b9e;
				if ( *((intOrPtr*)(__rcx)) != 0xe06d7363) goto 0x80002b5b;
				if ( *0x800164f8 == 0) goto 0x80002b5b;
				if (E0000000118000F7F0(_t130 + _t171, _t135, 0x800164f8) == 0) goto 0x80002b5b;
				_t83 =  *0x800164f8();
				r8d = 1;
				_t84 = E00000001180004550(_t83, _t159 + _t171, _t174);
				_t101 =  *((intOrPtr*)(_t135 + 0x10 + _t154 * 8));
				r9d =  *_t159;
				 *((long long*)(_t162 + 0x28)) =  *((intOrPtr*)(_t181 + 0x40));
				_t133 =  *((intOrPtr*)(_t181 + 0x28));
				 *((long long*)(_t162 + 0x20)) = _t133;
				__imp__RtlUnwindEx();
				E00000001180004580(_t84);
				goto 0x80002ada;
				goto 0x80002c5d;
				_t156 =  *((intOrPtr*)(_t181 + 0x20)) - _t171;
				goto 0x80002c4e;
				_t144 = _t174 + _t174;
				if (_t178 - _t133 < 0) goto 0x80002c4c;
				_t118 = _t178 - _t133;
				if (_t118 >= 0) goto 0x80002c4c;
				r10d =  *(_t159 + 4);
				r10d = r10d & 0x00000020;
				if (_t118 == 0) goto 0x80002c21;
				r9d = 0;
				if (_t101 == 0) goto 0x80002c1c;
				r8d = r9d;
				_t166 = _t159 + _t159;
				if (_t156 - _t133 < 0) goto 0x80002c14;
				if (_t156 - _t133 >= 0) goto 0x80002c14;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t166 * 8)) !=  *((intOrPtr*)(_t135 + 0x10 + _t144 * 8))) goto 0x80002c14;
				if ( *((intOrPtr*)(_t135 + 0xc + _t166 * 8)) ==  *((intOrPtr*)(_t135 + 0xc + _t144 * 8))) goto 0x80002c1c;
				r9d = r9d + 1;
				if (r9d - _t101 < 0) goto 0x80002be4;
				if (r9d != _t101) goto 0x80002c58;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t144 * 8)) == 0) goto 0x80002c35;
				if (_t156 != _t133) goto 0x80002c4c;
				if (r10d != 0) goto 0x80002c58;
				goto 0x80002c4c;
				 *((intOrPtr*)(_t181 + 0x48)) = _t150 + 1;
				r8d =  *((intOrPtr*)(_t135 + 0xc + _t144 * 8));
				 *((long long*)(_t166 + _t171))();
				if (_t103 + 2 -  *_t135 < 0) goto 0x80002bb8;
				return 1;
			}

0x180002a84
0x180002a84
0x180002a89
0x180002a8e
0x180002a9c
0x180002aa0
0x180002aa3
0x180002aac
0x180002aaf
0x180002ab4
0x180002abb
0x180002abf
0x180002ac6
0x180002aca
0x180002ad0
0x180002ad5
0x180002adc
0x180002ae4
0x180002aee
0x180002afb
0x180002b06
0x180002b11
0x180002b24
0x180002b26
0x180002b28
0x180002b31
0x180002b3b
0x180002b4b
0x180002b55
0x180002b5f
0x180002b6b
0x180002b77
0x180002b7e
0x180002b85
0x180002b8a
0x180002b8e
0x180002b93
0x180002b99
0x180002ba0
0x180002ba7
0x180002bb0
0x180002bb3
0x180002bba
0x180002bc4
0x180002bce
0x180002bd1
0x180002bd3
0x180002bd7
0x180002bdb
0x180002bdd
0x180002be2
0x180002be4
0x180002be7
0x180002bf2
0x180002bfc
0x180002c07
0x180002c12
0x180002c14
0x180002c1a
0x180002c1f
0x180002c27
0x180002c2c
0x180002c31
0x180002c33
0x180002c3b
0x180002c3f
0x180002c49
0x180002c52
0x180002c7a

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000000180002AAF
_IsNonwritableInCurrentImage.LIBCMT ref: 0000000180002B44
RtlUnwindEx.KERNEL32 ref: 0000000180002B93

Strings

csm, xrefs: 0000000180002B2A
f, xrefs: 0000000180002AC2

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 070144b75550352a73c6d3aac74e800b407a2bb3a1770ad1b71378010d6fc6ef
Instruction ID: 7da8602e18cf7747c8af8830ce248ccf40cfdad7849785c1bee6e388392e864c
Opcode Fuzzy Hash: 070144b75550352a73c6d3aac74e800b407a2bb3a1770ad1b71378010d6fc6ef
Instruction Fuzzy Hash: D551BD32601A588AEBAADF15E844B9D37A5F348BC8F51C121FE1A47789DF74DA89C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006108 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000000018000612D
GetProcAddress.KERNEL32 ref: 0000000180006143
FreeLibrary.KERNEL32 ref: 000000018000616A

Strings

CorExitProcess, xrefs: 000000018000613C
mscoree.dll, xrefs: 0000000180006124

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3542164dc526b5714268e5d0b360aad3ca74f158add73c29f1e3478b68115295
Instruction ID: 6c3fae355f4def66f2243ece08b04bf3b1533bf3e7ed4235295a513a2b2c2168
Opcode Fuzzy Hash: 3542164dc526b5714268e5d0b360aad3ca74f158add73c29f1e3478b68115295
Instruction Fuzzy Hash: 62F06D75714E0891FB92CB24E8443EA6371EB8DBE1F588215FA6A462F6CF2CC24CC300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800077FC Relevance: 7.6, APIs: 5, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E000000011800077FC(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t46;
				void* _t51;

				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __ecx & 0x0000001f;
				if ((__ecx & 0x00000008) == 0) goto 0x8000782e;
				if (sil >= 0) goto 0x8000782e;
				E0000000118000BC4C(_t27, _t51);
				_t28 = _t27 & 0xfffffff7;
				goto 0x80007885;
				_t42 = 0x00000004 & dil;
				if (_t42 == 0) goto 0x80007849;
				asm("dec eax");
				if (_t42 >= 0) goto 0x80007849;
				E0000000118000BC4C(_t28, _t51);
				_t29 = _t28 & 0xfffffffb;
				goto 0x80007885;
				_t43 = dil & 0x00000001;
				if (_t43 == 0) goto 0x80007865;
				asm("dec eax");
				if (_t43 >= 0) goto 0x80007865;
				E0000000118000BC4C(_t29, _t51);
				_t30 = _t29 & 0xfffffffe;
				goto 0x80007885;
				_t44 = dil & 0x00000002;
				if (_t44 == 0) goto 0x80007885;
				asm("dec eax");
				if (_t44 >= 0) goto 0x80007885;
				if ((dil & 0x00000010) == 0) goto 0x80007882;
				E0000000118000BC4C(_t30, _t51);
				_t31 = _t30 & 0xfffffffd;
				_t46 = dil & 0x00000010;
				if (_t46 == 0) goto 0x8000789f;
				asm("dec eax");
				if (_t46 >= 0) goto 0x8000789f;
				E0000000118000BC4C(_t31, _t51);
				return 0 | (_t31 & 0xffffffef) == 0x00000000;
			}

0x1800077fc
0x180007801
0x180007810
0x180007818
0x18000781d
0x180007824
0x180007829
0x18000782c
0x180007833
0x180007836
0x180007838
0x18000783d
0x18000783f
0x180007844
0x180007847
0x180007849
0x18000784d
0x18000784f
0x180007854
0x18000785b
0x180007860
0x180007863
0x180007865
0x180007869
0x18000786b
0x180007870
0x180007876
0x18000787d
0x180007882
0x180007885
0x180007889
0x18000788b
0x180007890
0x180007897
0x1800078b5

APIs

_set_statfp.LIBCMT ref: 0000000180007824
_set_statfp.LIBCMT ref: 000000018000783F
_set_statfp.LIBCMT ref: 000000018000785B
_set_statfp.LIBCMT ref: 0000000180007897

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 2487fe653e5be7bd8020c0b0ea1e85e42b79556fc3c932490e66e5a61226e724
Instruction ID: 766be9376166aa195c434f29f3971196c8b67f74f947fd55b9f7e9fcb960d4ba
Opcode Fuzzy Hash: 2487fe653e5be7bd8020c0b0ea1e85e42b79556fc3c932490e66e5a61226e724
Instruction Fuzzy Hash: 3D117736F90A0941F7EE9128D45A3E63141AB6C3F4F59C624B66E462E7CF2C4B59C305

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007FF8 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000000018000827B,?,?,00000000,0000000180008516,?,?,?,?,?,00000001800084A2), ref: 0000000180008017
FlsSetValue.KERNEL32(?,?,?,000000018000827B,?,?,00000000,0000000180008516,?,?,?,?,?,00000001800084A2), ref: 0000000180008036
FlsSetValue.KERNEL32(?,?,?,000000018000827B,?,?,00000000,0000000180008516,?,?,?,?,?,00000001800084A2), ref: 000000018000805E
FlsSetValue.KERNEL32(?,?,?,000000018000827B,?,?,00000000,0000000180008516,?,?,?,?,?,00000001800084A2), ref: 000000018000806F
FlsSetValue.KERNEL32(?,?,?,000000018000827B,?,?,00000000,0000000180008516,?,?,?,?,?,00000001800084A2), ref: 0000000180008080

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: af6c01d4090da002bcf5badd4e251df8289266538696eb3987054211fa53e7a9
Instruction ID: be0361fe5fc774fdb93e2323036551c88fb1abd5f2001d1ea80391924f68e359
Opcode Fuzzy Hash: af6c01d4090da002bcf5badd4e251df8289266538696eb3987054211fa53e7a9
Instruction Fuzzy Hash: 80115B7070924881FADBD32569553E932927F8C7F0F18C324B8B9067DADE69C64D5701

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007E8C Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 0000000180007E9D
FlsSetValue.KERNEL32 ref: 0000000180007EBC
FlsSetValue.KERNEL32 ref: 0000000180007EE4
FlsSetValue.KERNEL32 ref: 0000000180007EF5
FlsSetValue.KERNEL32 ref: 0000000180007F06

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 76d43fe1cfe6227db90b925fa931167f251cb93e2f14ae53a5f4ee5aa2bf7010
Instruction ID: 1e63756919ea820504c2c280bc0c9b8fbb4cbfe5ca1be2f3c00cf3ab00ed04ff
Opcode Fuzzy Hash: 76d43fe1cfe6227db90b925fa931167f251cb93e2f14ae53a5f4ee5aa2bf7010
Instruction Fuzzy Hash: F111397070624D41FAEBE22594527F932826B6D3F0F58CB24B93A0A2C7DE2C9A4D4310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003800 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00000001180003800(long long __rbx, intOrPtr* __rcx, long long __rdx, long long __r8, void* __r9) {
				void* _t19;
				void* _t27;
				void* _t36;
				void* _t39;
				void* _t42;
				void* _t43;
				void* _t45;
				void* _t46;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;

				_t27 = _t45;
				 *((long long*)(_t27 + 0x20)) = __rbx;
				 *((long long*)(_t27 + 0x18)) = __r8;
				 *((long long*)(_t27 + 0x10)) = __rdx;
				_t43 = _t27 - 0x3f;
				_t46 = _t45 - 0xc0;
				if ( *__rcx == 0x80000003) goto 0x800038a4;
				E00000001180002D40(_t27);
				r12d =  *((intOrPtr*)(_t43 + 0x6f));
				if ( *((long long*)(_t27 + 0x10)) == 0) goto 0x800038bf;
				__imp__EncodePointer(_t59, _t56, _t54, _t52, _t36, _t39, _t42);
				E00000001180002D40(_t27);
				if ( *((intOrPtr*)(_t27 + 0x10)) == _t27) goto 0x800038bf;
				if ( *__rcx == 0xe0434f4d) goto 0x800038bf;
				r13d =  *((intOrPtr*)(_t43 + 0x77));
				if ( *__rcx == 0xe0434352) goto 0x800038c3;
				 *((intOrPtr*)(_t46 + 0x38)) = r12d;
				 *((long long*)(_t46 + 0x30)) =  *((intOrPtr*)(_t43 + 0x7f));
				 *((intOrPtr*)(_t46 + 0x28)) = r13d;
				 *((long long*)(_t46 + 0x20)) =  *((intOrPtr*)(_t43 + 0x67));
				_t19 = E00000001180001F20(__rcx,  *((intOrPtr*)(_t43 + 0x4f)), __r8, __r9);
				if (_t19 == 0) goto 0x800038c3;
				return _t19;
			}

0x180003800
0x180003803
0x180003807
0x18000380b
0x18000381a
0x18000381e
0x180003834
0x180003836
0x18000383b
0x180003848
0x18000384c
0x180003855
0x18000385e
0x180003867
0x180003870
0x180003874
0x180003884
0x18000388c
0x180003891
0x180003896
0x18000389b
0x1800038a2
0x1800038be

APIs

EncodePointer.KERNEL32 ref: 000000018000384C
_CallSETranslator.LIBVCRUNTIME ref: 000000018000389B

Strings

RCC, xrefs: 0000000180003869
MOC, xrefs: 0000000180003860

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 850d6d426b32ca2bcc659c65f0611ee9095a757703c065d3c36d87525356093f
Instruction ID: 9ead3bcba03cb9e88f6155f8408b2a39bbeb34ce68d687e28d60bbf843815124
Opcode Fuzzy Hash: 850d6d426b32ca2bcc659c65f0611ee9095a757703c065d3c36d87525356093f
Instruction Fuzzy Hash: 74613A36A04B888AEB62CF66D4413DD77A4F748B88F148216EF4917B99CF78D299C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D5B8 Relevance: 6.3, APIs: 4, Instructions: 299
fileCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E0000000118000D5B8(void* __eax, signed int __edx, void* __esi, void* __ebp, long long __rbx, intOrPtr* __rcx, long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t183;
				signed int _t187;
				signed int _t194;
				signed int _t199;
				intOrPtr _t208;
				void* _t210;
				signed char _t211;
				void* _t261;
				signed long long _t262;
				long long _t267;
				long long _t269;
				void* _t270;
				long long _t272;
				intOrPtr* _t278;
				intOrPtr* _t285;
				long long _t287;
				long long _t313;
				void* _t321;
				long long _t322;
				void* _t323;
				long long _t324;
				long long _t326;
				signed char* _t327;
				signed char* _t328;
				signed char* _t329;
				void* _t330;
				void* _t331;
				void* _t332;
				signed long long _t333;
				intOrPtr _t336;
				intOrPtr _t339;
				void* _t341;
				signed long long _t343;
				signed long long _t345;
				long long _t354;
				void* _t358;
				long long _t359;
				signed long long _t362;
				char _t363;
				signed long long _t364;
				void* _t367;
				signed char* _t368;
				signed long long _t370;

				_t261 = _t332;
				_t331 = _t261 - 0x57;
				_t333 = _t332 - 0xd0;
				 *((long long*)(_t331 - 9)) = 0xfffffffe;
				 *((long long*)(_t261 + 8)) = __rbx;
				_t262 =  *0x80021010; // 0xf101478280a5
				 *(_t331 + 0x17) = _t262 ^ _t333;
				 *((long long*)(_t331 - 0x41)) = __r8;
				_t278 = __rcx;
				 *((long long*)(_t331 - 0x59)) =  *((intOrPtr*)(_t331 + 0x7f));
				_t362 = __edx >> 6;
				 *(_t331 - 0x39) = _t362;
				_t370 = __edx + __edx * 8;
				_t267 =  *((intOrPtr*)( *((intOrPtr*)(0x180000000 + 0x227f0 + _t362 * 8)) + 0x28 + _t370 * 8));
				 *((long long*)(_t331 - 0x19)) = _t267;
				r12d = r9d;
				_t359 = _t358 + __r8;
				 *((long long*)(_t331 - 0x61)) = _t359;
				 *((intOrPtr*)(_t331 - 0x49)) = GetConsoleOutputCP();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t331 - 0x59)) + 0x28)) != dil) goto 0x8000d658;
				0x80006f60();
				_t208 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t331 - 0x59)) + 0x18)) + 0xc));
				 *((intOrPtr*)(_t331 - 0x45)) = _t208;
				 *((long long*)(__rcx)) = _t267;
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if ( *((intOrPtr*)(_t331 - 0x41)) - _t359 >= 0) goto 0x8000da03;
				_t343 = __edx >> 6;
				 *(_t331 - 0x11) = _t343;
				 *((char*)(_t331 - 0x71)) =  *((intOrPtr*)(__r8));
				 *((intOrPtr*)(_t331 - 0x6d)) = 0;
				r12d = 1;
				if (_t208 != 0xfde9) goto 0x8000d81d;
				_t285 = 0x3e + _t370 * 8 +  *((intOrPtr*)(0x180000000 + 0x227f0 + _t343 * 8));
				if ( *_t285 == dil) goto 0x8000d6ca;
				_t367 = _t324 + 1;
				if (_t367 - 5 < 0) goto 0x8000d6b7;
				if (_t367 <= 0) goto 0x8000d7b3;
				r12d =  *((char*)(_t285 + 0x1800218d1));
				r12d = r12d + 1;
				_t183 = r12d - 1;
				 *((intOrPtr*)(_t331 - 0x51)) = _t183;
				_t336 = _t183;
				if (_t336 -  *((intOrPtr*)(_t331 - 0x61)) - __r8 > 0) goto 0x8000d980;
				_t287 = _t324;
				 *((char*)(_t331 + _t287 - 1)) =  *((intOrPtr*)(0x3e + _t370 * 8 +  *((intOrPtr*)(0x180000000 + 0x227f0 + _t343 * 8))));
				if (_t287 + 1 - _t367 < 0) goto 0x8000d71b;
				if (_t336 <= 0) goto 0x8000d74b;
				0x80004b30();
				_t354 =  *((intOrPtr*)(_t331 - 0x59));
				_t313 = _t324;
				 *((intOrPtr*)( *((intOrPtr*)(0x180000000 + 0x227f0 + _t362 * 8)) + _t313 + 0x3e + _t370 * 8)) = dil;
				if (_t313 + 1 - _t367 < 0) goto 0x8000d74e;
				 *((long long*)(_t331 - 0x31)) = _t324;
				_t269 = _t331 - 1;
				 *((long long*)(_t331 - 0x29)) = _t269;
				_t187 = (0 | r12d == 0x00000004) + 1;
				r12d = _t187;
				r8d = _t187;
				 *((long long*)(_t333 + 0x20)) = _t354;
				E0000000118000E384(_t269, __rcx, _t331 - 0x6d, _t331 - 0x29, _t336, _t331 - 0x31);
				if (_t269 == 0xffffffff) goto 0x8000da03;
				_t326 = __r8 +  *((intOrPtr*)(_t331 - 0x51)) - 1;
				goto 0x8000d8ae;
				_t363 =  *((char*)(_t269 + 0x1800218d0));
				_t210 = _t363 + 1;
				_t270 = _t210;
				if (_t270 -  *((intOrPtr*)(_t331 - 0x61)) - _t326 > 0) goto 0x8000d9ae;
				 *((long long*)(_t331 - 0x51)) = _t324;
				 *((long long*)(_t331 - 0x21)) = _t326;
				_t194 = (0 | _t210 == 0x00000004) + 1;
				r14d = _t194;
				r8d = _t194;
				 *((long long*)(_t333 + 0x20)) = _t354;
				_t345 = _t331 - 0x51;
				E0000000118000E384(_t270, _t278, _t331 - 0x6d, _t331 - 0x21,  *((intOrPtr*)(_t331 - 0x61)) - _t326, _t345);
				if (_t270 == 0xffffffff) goto 0x8000da03;
				_t327 = _t326 + _t363;
				r12d = r14d;
				_t364 =  *(_t331 - 0x39);
				goto 0x8000d8ae;
				_t339 =  *((intOrPtr*)(0x180000000 + 0x227f0 + _t364 * 8));
				_t211 =  *(_t339 + 0x3d + _t370 * 8);
				if ((_t211 & 0x00000004) == 0) goto 0x8000d850;
				 *((char*)(_t331 + 7)) =  *((intOrPtr*)(_t339 + 0x3e + _t370 * 8));
				 *((char*)(_t331 + 8)) =  *_t327;
				 *(_t339 + 0x3d + _t370 * 8) = _t211 & 0x000000fb;
				r8d = 2;
				goto 0x8000d899;
				r9d =  *_t327 & 0x000000ff;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t354 + 0x18)))) + _t345 * 2)) >= 0) goto 0x8000d893;
				_t368 =  &(_t327[1]);
				if (_t368 -  *((intOrPtr*)(_t331 - 0x61)) >= 0) goto 0x8000d9e0;
				r8d = 2;
				if (E0000000118000B5FC(_t211 & 0x000000fb, __ebp, _t278, _t331 - 0x6d, _t327, _t324, _t327, _t331, _t339, _t354) == 0xffffffff) goto 0x8000da03;
				_t328 = _t368;
				goto 0x8000d8ae;
				_t199 = E0000000118000B5FC(_t211 & 0x000000fb, __ebp, _t278, _t331 - 0x6d, _t328, _t324, _t328, _t331, _t359, _t354);
				if (_t199 == 0xffffffff) goto 0x8000da03;
				_t329 =  &(_t328[1]);
				 *((long long*)(_t333 + 0x38)) = _t324;
				 *((long long*)(_t333 + 0x30)) = _t324;
				 *((intOrPtr*)(_t333 + 0x28)) = 5;
				_t272 = _t331 + 0xf;
				 *((long long*)(_t333 + 0x20)) = _t272;
				r9d = r12d;
				_t341 = _t331 - 0x6d;
				E0000000118000A154();
				r14d = _t199;
				if (_t199 == 0) goto 0x8000da03;
				 *((long long*)(_t333 + 0x20)) = _t324;
				r8d = _t199;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x8000d9fb;
				 *((intOrPtr*)(_t278 + 4)) = __esi -  *((intOrPtr*)(_t331 - 0x41)) +  *((intOrPtr*)(_t278 + 8));
				if ( *((intOrPtr*)(_t331 - 0x69)) - r14d < 0) goto 0x8000da03;
				if ( *((char*)(_t331 - 0x71)) != 0xa) goto 0x8000d966;
				 *((short*)(_t331 - 0x71)) = 0xd;
				 *((long long*)(_t333 + 0x20)) = _t324;
				_t130 = _t272 - 0xc; // 0x1
				r8d = _t130;
				_t321 = _t331 - 0x71;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x8000d9fb;
				if ( *((intOrPtr*)(_t331 - 0x69)) - 1 < 0) goto 0x8000da03;
				 *((intOrPtr*)(_t278 + 8)) =  *((intOrPtr*)(_t278 + 8)) + 1;
				 *((intOrPtr*)(_t278 + 4)) =  *((intOrPtr*)(_t278 + 4)) + 1;
				if (_t329 -  *((intOrPtr*)(_t331 - 0x61)) >= 0) goto 0x8000da03;
				goto 0x8000d681;
				if (_t321 <= 0) goto 0x8000d9a9;
				_t330 = _t329 - _t368;
				 *((char*)( *((intOrPtr*)(0x180000000 + 0x227f0 + _t364 * 8)) + _t368 + 0x3e + _t370 * 8)) =  *((intOrPtr*)(_t330 + _t368));
				if (1 - _t321 < 0) goto 0x8000d988;
				 *((intOrPtr*)(_t278 + 4)) =  *((intOrPtr*)(_t278 + 4)) +  *((intOrPtr*)(_t278 + 4));
				goto 0x8000da03;
				if (_t341 <= 0) goto 0x8000d9da;
				_t322 = _t324;
				 *((char*)( *((intOrPtr*)(0x180000000 + 0x227f0 +  *(_t331 - 0x39) * 8)) + _t322 + 0x3e + _t370 * 8)) =  *((intOrPtr*)(_t322 + _t330));
				_t323 = _t322 + 1;
				if (2 - _t341 < 0) goto 0x8000d9ba;
				 *((intOrPtr*)(_t278 + 4)) =  *((intOrPtr*)(_t278 + 4)) + r8d;
				goto 0x8000da03;
				 *((intOrPtr*)(_t341 + 0x3e + _t370 * 8)) = r9b;
				 *( *((intOrPtr*)(0x180000000 + 0x227f0 + _t364 * 8)) + 0x3d + _t370 * 8) =  *( *((intOrPtr*)(0x180000000 + 0x227f0 + _t364 * 8)) + 0x3d + _t370 * 8) | 0x00000004;
				_t173 = _t323 + 1; // 0x1
				 *((intOrPtr*)(_t278 + 4)) = _t173;
				goto 0x8000da03;
				 *_t278 = GetLastError();
				return E000000011800010B0(_t206,  *((intOrPtr*)(_t331 - 0x45)),  *(_t331 + 0x17) ^ _t333);
			}

0x18000d5b8
0x18000d5c6
0x18000d5ca
0x18000d5d1
0x18000d5d9
0x18000d5dd
0x18000d5e7
0x18000d5ee
0x18000d5f5
0x18000d5fc
0x18000d606
0x18000d60a
0x18000d618
0x18000d624
0x18000d629
0x18000d62d
0x18000d630
0x18000d633
0x18000d63d
0x18000d64a
0x18000d64f
0x18000d65c
0x18000d65f
0x18000d664
0x18000d667
0x18000d66e
0x18000d677
0x18000d67b
0x18000d683
0x18000d686
0x18000d689
0x18000d69c
0x18000d6af
0x18000d6ba
0x18000d6be
0x18000d6c8
0x18000d6cd
0x18000d6e1
0x18000d6ea
0x18000d6f0
0x18000d6f2
0x18000d6fc
0x18000d702
0x18000d708
0x18000d71d
0x18000d72a
0x18000d72f
0x18000d73b
0x18000d740
0x18000d74b
0x18000d759
0x18000d764
0x18000d766
0x18000d76a
0x18000d76e
0x18000d77b
0x18000d77d
0x18000d780
0x18000d783
0x18000d794
0x18000d79d
0x18000d7ab
0x18000d7ae
0x18000d7b6
0x18000d7bf
0x18000d7ca
0x18000d7d0
0x18000d7d6
0x18000d7da
0x18000d7e6
0x18000d7e8
0x18000d7eb
0x18000d7ee
0x18000d7f3
0x18000d7ff
0x18000d808
0x18000d80e
0x18000d811
0x18000d814
0x18000d818
0x18000d81d
0x18000d825
0x18000d82d
0x18000d834
0x18000d839
0x18000d83f
0x18000d844
0x18000d84e
0x18000d850
0x18000d860
0x18000d862
0x18000d86a
0x18000d873
0x18000d888
0x18000d88e
0x18000d891
0x18000d8a0
0x18000d8a8
0x18000d8ae
0x18000d8b1
0x18000d8b6
0x18000d8bb
0x18000d8c3
0x18000d8c7
0x18000d8cc
0x18000d8cf
0x18000d8d8
0x18000d8dd
0x18000d8e2
0x18000d8e8
0x18000d8f1
0x18000d907
0x18000d915
0x18000d91c
0x18000d926
0x18000d92d
0x18000d931
0x18000d93a
0x18000d93a
0x18000d93e
0x18000d94d
0x18000d957
0x18000d95d
0x18000d960
0x18000d96a
0x18000d97b
0x18000d983
0x18000d985
0x18000d997
0x18000d9a7
0x18000d9a9
0x18000d9ac
0x18000d9b1
0x18000d9b3
0x18000d9c8
0x18000d9cf
0x18000d9d8
0x18000d9da
0x18000d9de
0x18000d9e0
0x18000d9ed
0x18000d9f3
0x18000d9f6
0x18000d9f9
0x18000da01
0x18000da2c

APIs

GetConsoleOutputCP.KERNEL32 ref: 000000018000D637
WriteFile.KERNEL32 ref: 000000018000D8FF
WriteFile.KERNEL32 ref: 000000018000D945
GetLastError.KERNEL32 ref: 000000018000D9FB

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6feae5b9fbf0fd58da801fa267745876ae53b7eaab871f0ae10c7fb0fe539764
Instruction ID: d53985ea959d49848d9070d6669198272c686acab0006873b77d48ca537a322a
Opcode Fuzzy Hash: 6feae5b9fbf0fd58da801fa267745876ae53b7eaab871f0ae10c7fb0fe539764
Instruction Fuzzy Hash: 1CD1E332B18A8889E752CFA9D4403EC3BB1F3597D8F148216EE5D97B99DE34C60AC750

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DEE0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E0000000118000DEE0(void* __ebx, signed int __ecx, void* __esi, void* __ebp, void* __rax, void* __rcx, signed short* __rdx, void* __r8, signed int __r9, void* __r10) {
				signed long long _v88;
				void* _v96;
				void* _v108;
				signed int _v112;
				intOrPtr _v120;
				signed int _v124;
				long _v128;
				signed int _v136;
				long long _v144;
				signed int _v152;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				signed short _t99;
				void* _t107;
				long _t116;
				signed int _t117;
				void* _t122;
				signed short _t127;
				signed int _t130;
				signed short _t133;
				signed short _t159;
				signed short _t167;
				signed long long _t180;
				signed int _t184;
				signed short* _t197;
				signed int _t204;
				signed int _t205;
				signed short* _t206;
				void* _t208;
				signed long long _t220;
				void* _t221;
				signed long long _t222;
				signed long long _t223;
				void* _t224;
				signed short* _t226;

				_t197 = __rdx;
				_t122 = __ebx;
				r14d = r8d;
				_t184 = __r9;
				_t206 = __rdx;
				if (r8d == 0) goto 0x8000e1d3;
				if (__rdx != 0) goto 0x8000df47;
				 *((char*)(__r9 + 0x38)) = 1;
				r8d = 0;
				 *((intOrPtr*)(__r9 + 0x34)) = 0;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				r9d = 0;
				_v144 = __r9;
				_v152 = _t205;
				E000000011800084EC(__rax, __r9, __rcx, __rdx, __rdx, _t208, __r8);
				goto 0x8000e1d5;
				_t220 = __ecx >> 6;
				_v88 = _t220;
				_t223 = __ecx + __ecx * 8;
				_t99 =  *((intOrPtr*)(0x800227f0 + 0x39 + _t223 * 8));
				_v136 = _t99;
				if (_t99 - 1 - 1 > 0) goto 0x8000df7e;
				if (( !r14d & 0x00000001) == 0) goto 0x8000df10;
				if (( *( *((intOrPtr*)(0x800227f0 + _t220 * 8)) + 0x38 + _t223 * 8) & 0x00000020) == 0) goto 0x8000df94;
				_t23 = _t197 + 2; // 0x2
				r8d = _t23;
				E0000000118000E958(r15d);
				_v112 = _t205;
				if (E0000000118000E2E0(r15d, __ecx) == 0) goto 0x8000e0c3;
				if ( *( *((intOrPtr*)(0x800227f0 + _t220 * 8)) + 0x38 + _t223 * 8) - dil >= 0) goto 0x8000e0c3;
				if ( *((intOrPtr*)(__r9 + 0x28)) != dil) goto 0x8000dfd3;
				0x80006f60();
				if ( *((intOrPtr*)( *((intOrPtr*)(__r9 + 0x18)) + 0x138)) != _t205) goto 0x8000dfef;
				_t180 =  *((intOrPtr*)(0x800227f0 + _t220 * 8));
				if ( *((intOrPtr*)(_t180 + 0x39 + _t223 * 8)) == dil) goto 0x8000e0c3;
				if (GetConsoleMode(??, ??) == 0) goto 0x8000e0bc;
				_t127 = _v136;
				_t159 = _t127;
				if (_t159 == 0) goto 0x8000e099;
				if (_t159 == 0) goto 0x8000e024;
				if (_t127 - 1 != 1) goto 0x8000e15d;
				_t221 = _t206 + _t224;
				_v128 = _t205;
				_t226 = _t206;
				if (_t206 - _t221 >= 0) goto 0x8000e090;
				r14d = _v124;
				_v136 =  *_t226 & 0x0000ffff;
				_t107 = E0000000118000E960( *_t226 & 0xffff);
				_t130 = _v136 & 0x0000ffff;
				if (_t107 != _t130) goto 0x8000e087;
				r14d = r14d + 2;
				_v124 = r14d;
				if (_t130 != 0xa) goto 0x8000e07c;
				if (E0000000118000E960(0xd) != 0xd) goto 0x8000e087;
				r14d = r14d + 1;
				_v124 = r14d;
				if ( &(_t226[1]) - _t221 >= 0) goto 0x8000e090;
				goto 0x8000e038;
				_v128 = GetLastError();
				_t222 = _v88;
				goto 0x8000e153;
				r9d = r14d;
				_v152 = __r9;
				E0000000118000D5B8(_t109, r15d, __esi, __ebp, __r9,  &_v128, _t206);
				asm("movsd xmm0, [eax]");
				goto 0x8000e158;
				if ( *((intOrPtr*)( *((intOrPtr*)(0x800227f0 + _t222 * 8)) + 0x38 + _t223 * 8)) - dil >= 0) goto 0x8000e120;
				_t133 = _v136;
				_t167 = _t133;
				if (_t167 == 0) goto 0x8000e10c;
				if (_t167 == 0) goto 0x8000e0f8;
				if (_t133 - 1 != 1) goto 0x8000e164;
				r9d = r14d;
				E0000000118000DB34(_t122, r15d, _t180, _t184,  &_v128, _t208, _t206);
				goto 0x8000e0b0;
				r9d = r14d;
				E0000000118000DC50(r15d,  *((intOrPtr*)(_t180 + 8)), _t180, _t184,  &_v128, _t208, _t206);
				goto 0x8000e0b0;
				r9d = r14d;
				E0000000118000DA30(_t122, r15d, _t180, _t184,  &_v128, _t208, _t206);
				goto 0x8000e0b0;
				r8d = r14d;
				_v152 = _v152 & _t180;
				_v128 = _t180;
				_v120 = 0;
				if (WriteFile(??, ??, ??, ??, ??) != 0) goto 0x8000e150;
				_t116 = GetLastError();
				_v128 = _t116;
				asm("movsd xmm0, [ebp-0x40]");
				asm("movsd [ebp-0x30], xmm0");
				if (_t116 != 0) goto 0x8000e1cc;
				_t117 = _v112;
				if (_t117 == 0) goto 0x8000e1a3;
				if (_t117 != 5) goto 0x8000e193;
				 *((char*)(_t184 + 0x30)) = 1;
				 *((intOrPtr*)(_t184 + 0x2c)) = 9;
				 *((char*)(_t184 + 0x38)) = 1;
				 *(_t184 + 0x34) = _t117;
				goto 0x8000df3f;
				_t204 = _t184;
				E000000011800086B0(_v112, _t204);
				goto 0x8000df3f;
				if (( *( *((intOrPtr*)(_t204 + _t222 * 8)) + 0x38 + _t223 * 8) & 0x00000040) == 0) goto 0x8000e1b4;
				if ( *_t206 == 0x1a) goto 0x8000e1d3;
				 *(_t184 + 0x34) =  *(_t184 + 0x34) & 0x00000000;
				 *((char*)(_t184 + 0x30)) = 1;
				 *((intOrPtr*)(_t184 + 0x2c)) = 0x1c;
				 *((char*)(_t184 + 0x38)) = 1;
				goto 0x8000df3f;
				goto 0x8000e1d5;
				return 0;
			}

0x18000dee0
0x18000dee0
0x18000def6
0x18000defc
0x18000deff
0x18000df05
0x18000df0e
0x18000df10
0x18000df15
0x18000df18
0x18000df1e
0x18000df25
0x18000df2d
0x18000df30
0x18000df35
0x18000df3a
0x18000df42
0x18000df57
0x18000df5b
0x18000df5f
0x18000df67
0x18000df6c
0x18000df73
0x18000df7c
0x18000df84
0x18000df8b
0x18000df8b
0x18000df8f
0x18000df97
0x18000dfa9
0x18000dfb8
0x18000dfc2
0x18000dfc7
0x18000dfde
0x18000dfe0
0x18000dfe9
0x18000e004
0x18000e00a
0x18000e00e
0x18000e010
0x18000e019
0x18000e01e
0x18000e024
0x18000e028
0x18000e02c
0x18000e032
0x18000e034
0x18000e03f
0x18000e043
0x18000e048
0x18000e04f
0x18000e051
0x18000e055
0x18000e05d
0x18000e071
0x18000e073
0x18000e076
0x18000e083
0x18000e085
0x18000e08d
0x18000e090
0x18000e094
0x18000e099
0x18000e09c
0x18000e0ab
0x18000e0b0
0x18000e0b7
0x18000e0cc
0x18000e0ce
0x18000e0d2
0x18000e0d4
0x18000e0d9
0x18000e0de
0x18000e0e4
0x18000e0f1
0x18000e0f6
0x18000e0f8
0x18000e105
0x18000e10a
0x18000e10c
0x18000e119
0x18000e11e
0x18000e12b
0x18000e12e
0x18000e136
0x18000e13a
0x18000e145
0x18000e147
0x18000e14d
0x18000e153
0x18000e158
0x18000e16e
0x18000e170
0x18000e175
0x18000e17a
0x18000e17c
0x18000e180
0x18000e187
0x18000e18b
0x18000e18e
0x18000e196
0x18000e199
0x18000e19e
0x18000e1ad
0x18000e1b2
0x18000e1b4
0x18000e1b8
0x18000e1bc
0x18000e1c3
0x18000e1c7
0x18000e1d1
0x18000e1e5

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000000018000DECB), ref: 000000018000DFFC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000000018000DECB), ref: 000000018000E087

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 0675eeeead42596f3d7dd2e4aa0abe962e21f79f71d61d7b844ad93efeec3d3b
Instruction ID: 0d257abc0b638f0f040665fb3b769d735b9bc0d803a768daaeded027fae08968
Opcode Fuzzy Hash: 0675eeeead42596f3d7dd2e4aa0abe962e21f79f71d61d7b844ad93efeec3d3b
Instruction Fuzzy Hash: 7291B13261469885F7A2CF6598403ED3BA0F749BC8F14C11AFE4A67A95DF74C68AC710

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DC50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0000000118000DC50(signed int __edx, void* __edi, void* __rax, signed long long __rbx, intOrPtr* __rcx, long long __rbp, signed short* __r8, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed int _a5176, void* _a5192) {
				intOrPtr _v0;
				signed long long _v8;
				signed int _t41;
				signed long long _t62;
				short* _t67;
				signed int* _t68;
				void* _t91;
				void* _t97;
				void* _t99;
				void* _t102;
				void* _t103;

				_a8 = __rbx;
				_a24 = __rbp;
				E0000000118000F880(0x1470, __rax, _t97, _t99);
				_t62 =  *0x80021010; // 0xf101478280a5
				_a5176 = _t62 ^ _t91 - __rax;
				r14d = r9d;
				r10d = r10d & 0x0000003f;
				_t103 = _t102 + __r8;
				 *((long long*)(__rcx)) =  *((intOrPtr*)(0x800227f0 + (__edx >> 6) * 8));
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if (__r8 - _t103 >= 0) goto 0x8000dd91;
				_t67 =  &_a40;
				if (__r8 - _t103 >= 0) goto 0x8000dcfa;
				_t41 =  *__r8 & 0x0000ffff;
				if (_t41 != 0xa) goto 0x8000dce6;
				 *_t67 = 0xd;
				_t68 = _t67 + 2;
				 *_t68 = _t41;
				if ( &(_t68[0]) -  &_a1744 < 0) goto 0x8000dcc8;
				_a16 = _a16 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				_v0 = 0xd55;
				_v8 =  &_a1752;
				r9d = 0;
				E0000000118000A154();
				if (0 == 0) goto 0x8000dd89;
				if (0 == 0) goto 0x8000dd79;
				_v8 = _v8 & 0x00000000;
				r8d = 0;
				r8d = r8d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x8000dd89;
				if (0 + _a24 < 0) goto 0x8000dd46;
				 *((intOrPtr*)(__rcx + 4)) = __edi - r15d;
				goto 0x8000dcbd;
				 *((intOrPtr*)(__rcx)) = GetLastError();
				return E000000011800010B0(_t39, 0, _a5176 ^ _t91 - __rax);
			}

0x18000dc50
0x18000dc55
0x18000dc67
0x18000dc6f
0x18000dc79
0x18000dc8a
0x18000dc98
0x18000dc9c
0x18000dcb4
0x18000dcba
0x18000dcbd
0x18000dcc3
0x18000dccb
0x18000dccd
0x18000dcd8
0x18000dcdf
0x18000dce2
0x18000dce6
0x18000dcf8
0x18000dcfa
0x18000dd05
0x18000dd13
0x18000dd26
0x18000dd2b
0x18000dd35
0x18000dd3e
0x18000dd44
0x18000dd46
0x18000dd5b
0x18000dd64
0x18000dd6f
0x18000dd77
0x18000dd7e
0x18000dd84
0x18000dd8f
0x18000ddbf

APIs

WriteFile.KERNEL32 ref: 000000018000DD67
GetLastError.KERNEL32 ref: 000000018000DD89

Strings

U, xrefs: 000000018000DD13

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: bcf7ee1ea3ec2a9cc3b1d78a5d2c7ec9e62fd3dc134ebc80f67064554232c18b
Instruction ID: c34ad0e7ff2d66e96fda8e7ac49a4eca9b2c2d7f4ff30b46897494357c1f583c
Opcode Fuzzy Hash: bcf7ee1ea3ec2a9cc3b1d78a5d2c7ec9e62fd3dc134ebc80f67064554232c18b
Instruction Fuzzy Hash: E441A472614A8886EBA2CF25E4447EA7761F79C7D4F408022EE4E87758DF7CC645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004A60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 0000000180004AA4
RaiseException.KERNEL32 ref: 0000000180004AEA

Strings

csm, xrefs: 0000000180004AD7

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 43dc2e1a8b3bf6a6ca3c7988f27fb1d1dbaf565cf4dd9104b15b21490a7c12b7
Instruction ID: 9822ff17b0ce5fbc637df8732c669b6e85e1acb8a855211156653d926a5084e0
Opcode Fuzzy Hash: 43dc2e1a8b3bf6a6ca3c7988f27fb1d1dbaf565cf4dd9104b15b21490a7c12b7
Instruction Fuzzy Hash: 8D114C72614B4482EBA28F25F440399B7A0F788BD4F188220EE8C0B769DF38CA55CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800109D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 0000000180010A22
RegisterClassExW.USER32 ref: 0000000180010A59

Strings

P, xrefs: 00000001800109D9

Memory Dump Source

Source File: 00000003.00000002.319717746.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000003.00000002.319713866.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319736921.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319749796.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.319754228.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_180000000_regsvr32.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: P
API String ID: 1693014935-3110715001
Opcode ID: 24b0b9f3c1b09ae8b28d8b77cab2a0cc8b6b471604828e0fcca638cf8f3030e2
Instruction ID: c953b54a92ac3cc4e92e902e3110dd604cc2aeb839ef1ea803bcd24b7a7bdda6
Opcode Fuzzy Hash: 24b0b9f3c1b09ae8b28d8b77cab2a0cc8b6b471604828e0fcca638cf8f3030e2
Instruction Fuzzy Hash: 8501B232519F8486E7A18F00F89834BB7B4F388788F604119E6CD42B68DFBDC258CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 1264, Parent PID: 3216COMMON

Execution Graph

Execution Coverage:	8.8%
Dynamic/Decrypted Code Coverage:	7.6%
Signature Coverage:	0%
Total number of Nodes:	330
Total number of Limit Nodes:	8

Executed Functions

Function 0000024067E90000 Relevance: 55.2, APIs: 5, Strings: 26, Instructions: 953
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE ref: 0000024067E90344
VirtualAlloc.KERNELBASE ref: 0000024067E9038A
VirtualAlloc.KERNELBASE ref: 0000024067E903A4
VirtualProtect.KERNELBASE ref: 0000024067E9085C
RtlAddFunctionTable.KERNEL32 ref: 0000024067E908E9

Strings

GetN, xrefs: 0000024067E90107
nf, xrefs: 0000024067E90127
o, xrefs: 0000024067E9012E
Cach, xrefs: 0000024067E90100
aryA, xrefs: 0000024067E900A5
ct, xrefs: 0000024067E900DD
Libr, xrefs: 0000024067E9009D
temI, xrefs: 0000024067E9011F
Virt, xrefs: 0000024067E900C5
ativ, xrefs: 0000024067E9010F
hIns, xrefs: 0000024067E900EB
ncti, xrefs: 0000024067E90141
ualA, xrefs: 0000024067E900B5
RtlA, xrefs: 0000024067E90133
Virt, xrefs: 0000024067E900AD
lloc, xrefs: 0000024067E900BD
ualP, xrefs: 0000024067E900CD
truc, xrefs: 0000024067E900F2
onTa, xrefs: 0000024067E90148
rote, xrefs: 0000024067E900D5
Slee, xrefs: 0000024067E90084
Flus, xrefs: 0000024067E900E4
tion, xrefs: 0000024067E900F9
ddFu, xrefs: 0000024067E9013A
Load, xrefs: 0000024067E90095
eSys, xrefs: 0000024067E90117

Memory Dump Source

Source File: 00000004.00000002.320482038.0000024067E90000.00000040.00001000.00020000.00000000.sdmp, Offset: 0000024067E90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24067e90000_rundll32.jbxd

Similarity

API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
String ID: Cach$Flus$GetN$Libr$Load$RtlA$Slee$Virt$Virt$aryA$ativ$ct$ddFu$eSys$hIns$lloc$ncti$nf$o$onTa$rote$temI$tion$truc$ualA$ualP
API String ID: 394283112-3605381585
Opcode ID: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction ID: f9adef08228ddec26c5b7a567b556d2b527fd3600c6068bbede39bd45df5fad7
Opcode Fuzzy Hash: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction Fuzzy Hash: 8462E231628F098BD768DF18C8897B9B3E5FB48300F51462DDA8BC7251DB34E596CB86

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010C10 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78
librarymemorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrFindResource_U.NTDLL ref: 0000000180010CCB
LdrAccessResource.NTDLL ref: 0000000180010CEB
NtAllocateVirtualMemory.NTDLL ref: 0000000180010D19

Strings

LXGUM, xrefs: 0000000180010C74
@, xrefs: 0000000180010CF5
ad5zS&E7DS(ke9?+qbAC5tqx<Y<h0!QB4H3bk, xrefs: 0000000180010C3B

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: AccessAllocateFindMemoryResourceResource_Virtual
String ID: @$LXGUM$ad5zS&E7DS(ke9?+qbAC5tqx<Y<h0!QB4H3bk
API String ID: 2485490239-3005932707
Opcode ID: 72763dadedb1f7e12bf326a7682b4cc9f3b8809a7beac6fa455c8e22944c1181
Instruction ID: 10e411743ffb1a55a6adb62272a00c62f4f605c25ab8d9ba5168281e261d5f46
Opcode Fuzzy Hash: 72763dadedb1f7e12bf326a7682b4cc9f3b8809a7beac6fa455c8e22944c1181
Instruction Fuzzy Hash: 0F41F976218B8486D795CB14F49039AB7B4F388794F505116FADA83BA8DF7DC608CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010AC0 Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E00000001180010AC0(long long _a8, intOrPtr _a16, long long _a24) {
				long long _v32;
				long long _v40;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _t15;
				long long _t19;
				long long _t20;

				_a24 = _t20;
				_a16 = _t15;
				_a8 = _t19;
				_v56 = _a16;
				if (_v56 == 1) goto 0x80010ae6;
				goto 0x80010bf4;
				 *0x80022ca0 = _a8;
				_v52 = 0x904;
				_v48 = 0xf9e;
				_v40 = 0;
				_v32 = 0;
				if (E00000001180010DB0(_a16) == 0) goto 0x80010b28;
				ExitProcess(??);
			}

0x180010ac0
0x180010ac5
0x180010ac9
0x180010ad6
0x180010adf
0x180010ae1
0x180010aeb
0x180010af2
0x180010afa
0x180010b02
0x180010b0b
0x180010b1b
0x180010b22

APIs

ExitProcess.KERNEL32 ref: 0000000180010B22

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e7061396d7e3d43570edbd3d19f5eed90c055825c823b852da9f6b8b51899770
Instruction ID: 35b30a5bd3bbc3bfa3955963e6b6c4c9d1147ff83b5bb424c40f1a31c42fa1fb
Opcode Fuzzy Hash: e7061396d7e3d43570edbd3d19f5eed90c055825c823b852da9f6b8b51899770
Instruction Fuzzy Hash: AE311671119B489AE782DF54F85438AB7A0F7983D4F608215F6A907BA4CFBDC24CCB40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000147C Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0000000118000147C(void* __edx) {
				void* _t5;

				_t5 = __edx;
				if (_t5 == 0) goto 0x800014bd;
				if (_t5 == 0) goto 0x800014b1;
				if (_t5 == 0) goto 0x800014a4;
				if (__edx == 1) goto 0x8000149d;
				return 1;
			}

0x180001480
0x180001482
0x180001487
0x18000148c
0x180001491
0x18000149c

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 00000001800014A4
__scrt_acquire_startup_lock.LIBCMT ref: 00000001800014F6
_RTC_Initialize.LIBCMT ref: 0000000180001524
__scrt_dllmain_after_initialize_c.LIBCMT ref: 000000018000154A
__scrt_release_startup_lock.LIBCMT ref: 0000000180001575

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: Initialize__scrt_acquire_startup_lock__scrt_dllmain_after_initialize_c__scrt_dllmain_crt_thread_attach__scrt_release_startup_lock
String ID:
API String ID: 190073905-0
Opcode ID: f481a242433e045de9421f6a540d64c2f1c4067185df5e2b4ea36506bf633cb0
Instruction ID: c036cf0e1e542974e7afb98f421e14e504817ee7e551922961311e630d73ddb8
Opcode Fuzzy Hash: f481a242433e045de9421f6a540d64c2f1c4067185df5e2b4ea36506bf633cb0
Instruction Fuzzy Hash: 5881C370A04A4DCEFBD7DB65A8413D932A0AB9D7C2F54C125B909477A6DF38C74D8700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007F30 Relevance: 9.1, APIs: 6, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,00006DC7C02D7798,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007F3F
FlsSetValue.KERNEL32(?,?,00006DC7C02D7798,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007F75
FlsSetValue.KERNEL32(?,?,00006DC7C02D7798,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007FA2
FlsSetValue.KERNEL32(?,?,00006DC7C02D7798,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007FB3
FlsSetValue.KERNEL32(?,?,00006DC7C02D7798,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007FC4
SetLastError.KERNEL32(?,?,00006DC7C02D7798,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000,000000018000A3A3,?,?,?), ref: 0000000180007FDF

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: eb8af4af359d96366aaa10eae491533e56ca08d7f11ac2249f998e933b1e40b3
Instruction ID: b3640c739d53f521f3aff5ec24f9b4829142f54ff52cb57a8f227eaee239dcc8
Opcode Fuzzy Hash: eb8af4af359d96366aaa10eae491533e56ca08d7f11ac2249f998e933b1e40b3
Instruction Fuzzy Hash: 72115C3070964942FAEBE32195453F972926B9C7F0F18C625B83A077DBDE68C6498701

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A234 Relevance: 4.6, APIs: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 48%

			E0000000118000A234(void* __ebp, long long __rbx, long long __rdi, long long __rsi) {
				void* _t25;
				signed long long _t45;
				signed long long _t47;
				long long _t62;
				signed long long _t63;
				signed long long _t70;
				void* _t71;
				void* _t75;
				WCHAR* _t76;

				_t45 = _t70;
				 *((long long*)(_t45 + 8)) = __rbx;
				 *((long long*)(_t45 + 0x10)) = _t62;
				 *((long long*)(_t45 + 0x18)) = __rsi;
				 *((long long*)(_t45 + 0x20)) = __rdi;
				_t71 = _t70 - 0x40; // executed
				GetEnvironmentStringsW(); // executed
				if (_t45 != 0) goto 0x8000a264;
				goto 0x8000a327;
				_t63 = _t45;
				if ( *_t45 == 0) goto 0x8000a289;
				_t47 = (_t45 | 0xffffffff) + 1;
				if ( *((intOrPtr*)(_t63 + _t47 * 2)) != 0) goto 0x8000a270;
				if ( *((intOrPtr*)(_t63 + _t47 * 2 + 2)) != 0) goto 0x8000a26c;
				 *((long long*)(_t71 + 0x38)) = __rsi;
				 *((long long*)(_t71 + 0x30)) = __rsi;
				r9d = __ebp;
				 *((intOrPtr*)(_t71 + 0x28)) = 0;
				 *(_t71 + 0x20) = __rsi;
				E0000000118000A154();
				if (0 != 0) goto 0x8000a2c7;
				FreeEnvironmentStringsW(_t76);
				goto 0x8000a25d;
				E0000000118000B4C4(_t47, 0, _t75); // executed
				_t57 = _t47;
				if (_t47 != 0) goto 0x8000a2e0;
				_t25 = E0000000118000878C(_t47, 0);
				goto 0x8000a2bc;
				 *((long long*)(_t71 + 0x38)) = __rsi;
				r9d = __ebp;
				 *((long long*)(_t71 + 0x30)) = __rsi;
				 *((intOrPtr*)(_t71 + 0x28)) = r14d;
				 *(_t71 + 0x20) = _t47;
				E0000000118000A154();
				if (_t25 != 0) goto 0x8000a311;
				E0000000118000878C(_t47, _t47);
				goto 0x8000a31b;
				E0000000118000878C(_t47, _t57);
				return FreeEnvironmentStringsW(??);
			}

APIs

GetEnvironmentStringsW.KERNELBASE(?,?,?,?,?,?,?,0000000180006577), ref: 000000018000A24D
FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000000180006577), ref: 000000018000A2BF

Part of subcall function 000000018000B4C4: RtlAllocateHeap.NTDLL(?,?,?,000000018000D071,?,?,00000000,000000018000A3A3,?,?,?,00000001800068CF,?,?,?,00000001800067C5), ref: 000000018000B502

FreeEnvironmentStringsW.KERNEL32(?,?,?,?,?,?,?,0000000180006577), ref: 000000018000A31E

Part of subcall function 000000018000878C: HeapFree.KERNEL32(?,?,00000000,000000018000E6BE,?,?,?,000000018000E6FB,?,?,00000000,000000018000BED5,?,?,?,000000018000BE07), ref: 00000001800087A2
Part of subcall function 000000018000878C: GetLastError.KERNEL32(?,?,00000000,000000018000E6BE,?,?,?,000000018000E6FB,?,?,00000000,000000018000BED5,?,?,?,000000018000BE07), ref: 00000001800087AC

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: EnvironmentFreeStrings$Heap$AllocateErrorLast
String ID:
API String ID: 1848424169-0
Opcode ID: 3b5e9515b064aa3ec168be9b31d1f7c60d7c96a4ed281ecd250bb73b22c8c60a
Instruction ID: 864329f4ba152f277f2adf48c891db3446df78698e664f4bc60f625a72c2a341
Opcode Fuzzy Hash: 3b5e9515b064aa3ec168be9b31d1f7c60d7c96a4ed281ecd250bb73b22c8c60a
Instruction Fuzzy Hash: 64318631608B5881FBA6DF2568403DA7794B78DFD4F48C229FA9A43BD5DF38C6498700

Uniqueness

Uniqueness Score: -1.00%

Function 0000024067EE3988 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 0000024067EE3AF8

Strings

li, xrefs: 0000024067EE3A44

Memory Dump Source

Source File: 00000004.00000002.320583141.0000024067ED1000.00000020.00001000.00020000.00000000.sdmp, Offset: 0000024067ED1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_24067ed1000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: li
API String ID: 963392458-3170889640
Opcode ID: df447d1959c748b5d8cf34ebfef7c4b31b83bdbcb52bf56f40cb8f0245456118
Instruction ID: 2d95810c2226d9bf128ad55fbfbdcb3cbc07daf665974aba6df51f5b9d42ea58
Opcode Fuzzy Hash: df447d1959c748b5d8cf34ebfef7c4b31b83bdbcb52bf56f40cb8f0245456118
Instruction Fuzzy Hash: 6841E77091CB848FDBA4DF18D0C97DAB7E0FB98315F10495DE589C7296CB789884CB86

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A990 Relevance: 3.1, APIs: 2, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 37%

			E0000000118000A990(void* __ecx, long long __rbx, long long __rdi, long long __rsi, long long __rbp, void* _a8, void* _a16, void* _a24, void* _a32) {
				signed char _t53;
				signed int _t54;
				void* _t73;
				long long _t77;
				intOrPtr _t78;
				void* _t95;
				long _t98;

				_t73 = _t95;
				 *((long long*)(_t73 + 8)) = __rbx;
				 *((long long*)(_t73 + 0x10)) = __rbp;
				 *((long long*)(_t73 + 0x18)) = __rsi;
				 *((long long*)(_t73 + 0x20)) = __rdi;
				r14d = 0;
				_t77 =  *((intOrPtr*)(0x180022818)) + 2;
				if (_t77 - 1 <= 0) goto 0x8000a9e3;
				 *0x180022828 =  *0x180022828 | 0x00000080;
				goto 0x8000aa6e;
				 *0x180022828 = 0x81;
				if (0 == 0) goto 0x8000aa04;
				if (0 == 0) goto 0x8000a9fd;
				goto 0x8000aa09;
				goto 0x8000aa09;
				GetStdHandle(_t98);
				_t21 = _t77 + 1; // 0x1
				if (_t21 - 1 <= 0) goto 0x8000aa49;
				_t53 = GetFileType(??); // executed
				if (_t53 == 0) goto 0x8000aa49;
				_t54 = _t53 & 0x000000ff;
				 *((long long*)(0x180022818)) = _t77;
				if (_t54 != 2) goto 0x8000aa3d;
				 *0x180022828 =  *0x180022828 | 0x00000040;
				goto 0x8000aa6e;
				if (_t54 != 3) goto 0x8000aa6e;
				 *0x180022828 =  *0x180022828 | 0x00000008;
				goto 0x8000aa6e;
				 *0x180022828 =  *0x180022828 | 0x00000040;
				 *((long long*)( *0x185D90558 + 0x28)) = 0xfffffffe;
				_t78 =  *0x80022c38; // 0x0
				if (_t78 == 0) goto 0x8000aa6e;
				 *((intOrPtr*)( *((intOrPtr*)(_t98 + _t78)) + 0x18)) = 0xfffffffe;
				if (1 != 3) goto 0x8000a9ae;
				return _t54;
			}

0x18000a990
0x18000a993
0x18000a997
0x18000a99b
0x18000a99f
0x18000a9ab
0x18000a9cf
0x18000a9d7
0x18000a9d9
0x18000a9de
0x18000a9e3
0x18000a9ec
0x18000a9f1
0x18000a9fb
0x18000aa02
0x18000aa09
0x18000aa12
0x18000aa1a
0x18000aa1f
0x18000aa27
0x18000aa29
0x18000aa2c
0x18000aa34
0x18000aa36
0x18000aa3b
0x18000aa40
0x18000aa42
0x18000aa47
0x18000aa49
0x18000aa4e
0x18000aa57
0x18000aa61
0x18000aa67
0x18000aa77
0x18000aa97

APIs

GetStdHandle.KERNEL32 ref: 000000018000AA09
GetFileType.KERNELBASE ref: 000000018000AA1F

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: FileHandleType
String ID:
API String ID: 3000768030-0
Opcode ID: 80ba5a8ef376f08fb786711adb48f3016d6d32676bbcc2ff4b8feed3f833e474
Instruction ID: b796fa54aa9643fb7ba01a6ed1fec76df8915e221227f43cc089e28723c18302
Opcode Fuzzy Hash: 80ba5a8ef376f08fb786711adb48f3016d6d32676bbcc2ff4b8feed3f833e474
Instruction Fuzzy Hash: A6316132618B5891EBA2CB1596803A97750F34BBE0F68430AFB6A473E0CF34D6A5D341

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D26C Relevance: 1.5, APIs: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0000000118000D26C(void* __ecx, intOrPtr* __rax, long long __rbx, long long __rdi, long long __rsi, long long _a8, long long _a16, long long _a24) {

				_a8 = __rbx;
				_a16 = __rsi;
				_a24 = __rdi;
				if (__ecx - 0x2000 < 0) goto 0x8000d2b4;
				E000000011800086F4(__ecx - 0x2000, __rax);
				 *__rax = 9;
				E000000011800085B8();
				return 9;
			}

0x18000d26c
0x18000d271
0x18000d276
0x18000d289
0x18000d28b
0x18000d295
0x18000d297
0x18000d2b3

APIs

_invalid_parameter_noinfo.LIBCMT ref: 000000018000D297

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: _invalid_parameter_noinfo
String ID:
API String ID: 3215553584-0
Opcode ID: b2bec9f1c83fd2e5dff941a4990122d97467662781677e8ba2cfdbb0e4efa737
Instruction ID: 290c2a04846c9b039a5155463e3184fcb060a742c36b4207bfb39a2b49eb85f2
Opcode Fuzzy Hash: b2bec9f1c83fd2e5dff941a4990122d97467662781677e8ba2cfdbb0e4efa737
Instruction Fuzzy Hash: 3911AC3210468C82F383DF14E8507D9B7A4FB5C7C0F058426FA9547BAADF38CA199B50

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180008714 Relevance: 1.5, APIs: 1, Instructions: 36
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 44%

			E00000001180008714(void* __eax, signed int __rcx, signed int __rdx) {
				void* __rbx;
				intOrPtr* _t22;
				signed int _t29;

				_t29 = __rdx;
				if (__rcx == 0) goto 0x80008733;
				_t1 = _t29 - 0x20; // -32
				_t22 = _t1;
				if (_t22 - __rdx < 0) goto 0x80008776;
				_t25 =  ==  ? _t22 : __rcx * __rdx;
				goto 0x8000875a;
				if (E0000000118000C08C() == 0) goto 0x80008776;
				if (E0000000118000ABF8(_t22,  ==  ? _t22 : __rcx * __rdx,  ==  ? _t22 : __rcx * __rdx) == 0) goto 0x80008776;
				RtlAllocateHeap(??, ??, ??); // executed
				if (_t22 == 0) goto 0x80008745;
				goto 0x80008783;
				E000000011800086F4(_t22, _t22);
				 *_t22 = 0xc;
				return 0;
			}

0x180008714
0x180008723
0x180008727
0x180008727
0x180008731
0x18000873f
0x180008743
0x18000874c
0x180008758
0x180008769
0x180008772
0x180008774
0x180008776
0x18000877b
0x180008788

APIs

RtlAllocateHeap.NTDLL(?,?,00000000,0000000180007F92,?,?,00006DC7C02D7798,00000001800086FD,?,?,?,?,000000018000D08A,?,?,00000000), ref: 0000000180008769

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c340c08eb01792afebc94c3cbbbb04e65d50e9c6a72745528ebd04769994fc4e
Instruction ID: 66bea78d34406d615fa8c08e42eaa36a882f8058afe23dfc71e7ff7acb685faa
Opcode Fuzzy Hash: c340c08eb01792afebc94c3cbbbb04e65d50e9c6a72745528ebd04769994fc4e
Instruction Fuzzy Hash: A1F06D74309A0881FED7D7A599003D522D16F5CBC0F2CD4302D4E863DAEE1CC788A320

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000B4C4 Relevance: 1.5, APIs: 1, Instructions: 29
memoryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 44%

			E0000000118000B4C4(intOrPtr* __rax, void* __rcx, void* __r10) {
				void* __rbx;

				if (__rcx - 0xffffffe0 > 0) goto 0x8000b50f;
				_t16 =  ==  ? __rax : __rcx;
				goto 0x8000b4f6;
				if (E0000000118000C08C() == 0) goto 0x8000b50f;
				if (E0000000118000ABF8(__rax,  ==  ? __rax : __rcx,  ==  ? __rax : __rcx) == 0) goto 0x8000b50f;
				RtlAllocateHeap(??, ??, ??); // executed
				if (__rax == 0) goto 0x8000b4e1;
				goto 0x8000b51c;
				E000000011800086F4(__rax, __rax);
				 *__rax = 0xc;
				return 0;
			}

0x18000b4d1
0x18000b4db
0x18000b4df
0x18000b4e8
0x18000b4f4
0x18000b502
0x18000b50b
0x18000b50d
0x18000b50f
0x18000b514
0x18000b521

APIs

RtlAllocateHeap.NTDLL(?,?,?,000000018000D071,?,?,00000000,000000018000A3A3,?,?,?,00000001800068CF,?,?,?,00000001800067C5), ref: 000000018000B502

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 4ce8a77d3490294d8fe48757cb82fd14e8c5611eedce05584f392cb206084fbe
Instruction ID: 74f3ff24332d423f289e94138037da3f2bd69dba3dd7fdbb0825d479653fc046
Opcode Fuzzy Hash: 4ce8a77d3490294d8fe48757cb82fd14e8c5611eedce05584f392cb206084fbe
Instruction Fuzzy Hash: 3DF0F86061564885FEE7AAA25C413E532819B4C7E1F09CA607D26862C2DE28C7888B20

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001268 Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E00000001180001268(void* __ecx) {
				void* __rbx;
				void* _t12;
				void* _t17;
				void* _t18;
				void* _t19;
				void* _t20;
				void* _t21;

				_t2 =  ==  ? 1 :  *0x80021ae0 & 0x000000ff;
				 *0x80021ae0 =  ==  ? 1 :  *0x80021ae0 & 0x000000ff;
				E00000001180001A80(1, _t12, __ecx, _t17, _t18, _t19, _t20, _t21);
				if (E00000001180002A08() != 0) goto 0x80001297;
				goto 0x800012ab; // executed
				E00000001180006CDC(_t17); // executed
				if (0 != 0) goto 0x800012a9;
				E00000001180002A58(0);
				goto 0x80001293;
				return 1;
			}

0x18000127c
0x18000127f
0x180001285
0x180001291
0x180001295
0x180001297
0x18000129e
0x1800012a2
0x1800012a7
0x1800012b0

APIs

__scrt_dllmain_crt_thread_attach.LIBCMT ref: 000000018000128A

Part of subcall function 0000000180002A08: __vcrt_initialize_locks.LIBVCRUNTIME ref: 0000000180002A0C

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: __scrt_dllmain_crt_thread_attach__vcrt_initialize_locks
String ID:
API String ID: 108617051-0
Opcode ID: b3a5aff99e9bbd50fc4b4caf8482eddb7f62de2f1dfabb963a32cf9525c58297
Instruction ID: 3927130d99c38a55cbe47f9f4b507d4a3e007974ffcd633e9ac0bb37393e6b58
Opcode Fuzzy Hash: b3a5aff99e9bbd50fc4b4caf8482eddb7f62de2f1dfabb963a32cf9525c58297
Instruction Fuzzy Hash: 66E01A30B0528C8EFEE7E6B525423F937501B1E3C2F40D068B892825838D0947AD5722

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010A8E Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

ExitProcess.KERNEL32 ref: 0000000180010A93

Part of subcall function 0000000180014C90: LoadStringW.USER32 ref: 0000000180014CBF
Part of subcall function 0000000180014C90: LoadStringW.USER32 ref: 0000000180014CDC

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: LoadString$ExitProcess
String ID:
API String ID: 80118013-0
Opcode ID: 4511720a80b85894ed9872a941f45ad7e5906891a0c13688ba3e14c3fa3ec101
Instruction ID: b62d2fb12763fda2a64a5ee64e5548852d899a580494aacca0011f8ebade0f7c
Opcode Fuzzy Hash: 4511720a80b85894ed9872a941f45ad7e5906891a0c13688ba3e14c3fa3ec101
Instruction Fuzzy Hash: E1D0C936625A4892E7A29B61F80578A2390B78C7D4F809111A98C42A24CF2CC2098B00

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000180014555 Relevance: 216.5, APIs: 144, Instructions: 493COMMON

Download Yara Rule

APIs

ShowWindow.USER32 ref: 000000018001455C
GetLastError.KERNEL32 ref: 0000000180014566
ShowWindow.USER32 ref: 0000000180014570
GetLastError.KERNEL32 ref: 000000018001457A
ShowWindow.USER32 ref: 0000000180014584
GetLastError.KERNEL32 ref: 000000018001458E
ShowWindow.USER32 ref: 0000000180014598
GetLastError.KERNEL32 ref: 00000001800145A2
ShowWindow.USER32 ref: 00000001800145AC
GetLastError.KERNEL32 ref: 00000001800145B6
ShowWindow.USER32 ref: 00000001800145C0
GetLastError.KERNEL32 ref: 00000001800145CA
ShowWindow.USER32 ref: 00000001800145D4
GetLastError.KERNEL32 ref: 00000001800145DE
ShowWindow.USER32 ref: 00000001800145E8
GetLastError.KERNEL32 ref: 00000001800145F2
ShowWindow.USER32 ref: 00000001800145FC
GetLastError.KERNEL32 ref: 0000000180014606
ShowWindow.USER32 ref: 0000000180014610
GetLastError.KERNEL32 ref: 000000018001461A
ShowWindow.USER32 ref: 0000000180014624
GetLastError.KERNEL32 ref: 000000018001462E
ShowWindow.USER32 ref: 0000000180014638
GetLastError.KERNEL32 ref: 0000000180014642
ShowWindow.USER32 ref: 000000018001464C
GetLastError.KERNEL32 ref: 0000000180014656
ShowWindow.USER32 ref: 0000000180014660
GetLastError.KERNEL32 ref: 000000018001466A
ShowWindow.USER32 ref: 0000000180014674
GetLastError.KERNEL32 ref: 000000018001467E
ShowWindow.USER32 ref: 0000000180014688
GetLastError.KERNEL32 ref: 0000000180014692
ShowWindow.USER32 ref: 000000018001469C
GetLastError.KERNEL32 ref: 00000001800146A6
ShowWindow.USER32 ref: 00000001800146B0
GetLastError.KERNEL32 ref: 00000001800146BA
ShowWindow.USER32 ref: 00000001800146C4
GetLastError.KERNEL32 ref: 00000001800146CE
ShowWindow.USER32 ref: 00000001800146D8
GetLastError.KERNEL32 ref: 00000001800146E2
ShowWindow.USER32 ref: 00000001800146EC
GetLastError.KERNEL32 ref: 00000001800146F6
ShowWindow.USER32 ref: 0000000180014700
GetLastError.KERNEL32 ref: 000000018001470A
ShowWindow.USER32 ref: 0000000180014714
GetLastError.KERNEL32 ref: 000000018001471E
ShowWindow.USER32 ref: 0000000180014728
GetLastError.KERNEL32 ref: 0000000180014732
ShowWindow.USER32 ref: 000000018001473C
GetLastError.KERNEL32 ref: 0000000180014746
ShowWindow.USER32 ref: 0000000180014750
GetLastError.KERNEL32 ref: 000000018001475A
ShowWindow.USER32 ref: 0000000180014764
GetLastError.KERNEL32 ref: 000000018001476E
ShowWindow.USER32 ref: 0000000180014778
GetLastError.KERNEL32 ref: 0000000180014782
ShowWindow.USER32 ref: 000000018001478C
GetLastError.KERNEL32 ref: 0000000180014796
ShowWindow.USER32 ref: 00000001800147A0
GetLastError.KERNEL32 ref: 00000001800147AA
ShowWindow.USER32 ref: 00000001800147B4
GetLastError.KERNEL32 ref: 00000001800147BE
ShowWindow.USER32 ref: 00000001800147C8
GetLastError.KERNEL32 ref: 00000001800147D2
ShowWindow.USER32 ref: 00000001800147DC
GetLastError.KERNEL32 ref: 00000001800147E6
ShowWindow.USER32 ref: 00000001800147F0
GetLastError.KERNEL32 ref: 00000001800147FA
ShowWindow.USER32 ref: 0000000180014804
GetLastError.KERNEL32 ref: 000000018001480E
ShowWindow.USER32 ref: 0000000180014818
GetLastError.KERNEL32 ref: 0000000180014822
ShowWindow.USER32 ref: 000000018001482C
GetLastError.KERNEL32 ref: 0000000180014836
ShowWindow.USER32 ref: 0000000180014840
GetLastError.KERNEL32 ref: 000000018001484A
ShowWindow.USER32 ref: 0000000180014854
GetLastError.KERNEL32 ref: 000000018001485E
ShowWindow.USER32 ref: 0000000180014868
GetLastError.KERNEL32 ref: 0000000180014872
ShowWindow.USER32 ref: 000000018001487C
GetLastError.KERNEL32 ref: 0000000180014886
ShowWindow.USER32 ref: 0000000180014890
GetLastError.KERNEL32 ref: 000000018001489A
ShowWindow.USER32 ref: 00000001800148A4
GetLastError.KERNEL32 ref: 00000001800148AE
ShowWindow.USER32 ref: 00000001800148B8
GetLastError.KERNEL32 ref: 00000001800148C2
ShowWindow.USER32 ref: 00000001800148CC
GetLastError.KERNEL32 ref: 00000001800148D6
ShowWindow.USER32 ref: 00000001800148E0
GetLastError.KERNEL32 ref: 00000001800148EA
ShowWindow.USER32 ref: 00000001800148F4
GetLastError.KERNEL32 ref: 00000001800148FE
ShowWindow.USER32 ref: 0000000180014908
GetLastError.KERNEL32 ref: 0000000180014912
ShowWindow.USER32 ref: 000000018001491C
GetLastError.KERNEL32 ref: 0000000180014926
ShowWindow.USER32 ref: 0000000180014930
GetLastError.KERNEL32 ref: 000000018001493A
ShowWindow.USER32 ref: 0000000180014944
GetLastError.KERNEL32 ref: 000000018001494E
ShowWindow.USER32 ref: 0000000180014958
GetLastError.KERNEL32 ref: 0000000180014962
ShowWindow.USER32 ref: 000000018001496C
GetLastError.KERNEL32 ref: 0000000180014976
ShowWindow.USER32 ref: 0000000180014980
GetLastError.KERNEL32 ref: 000000018001498A
ShowWindow.USER32 ref: 0000000180014994
GetLastError.KERNEL32 ref: 000000018001499E
ShowWindow.USER32 ref: 00000001800149A8
GetLastError.KERNEL32 ref: 00000001800149B2
ShowWindow.USER32 ref: 00000001800149BC
GetLastError.KERNEL32 ref: 00000001800149C6
ShowWindow.USER32 ref: 00000001800149D0
GetLastError.KERNEL32 ref: 00000001800149DA
ShowWindow.USER32 ref: 00000001800149E4
GetLastError.KERNEL32 ref: 00000001800149EE
ShowWindow.USER32 ref: 00000001800149F8
GetLastError.KERNEL32 ref: 0000000180014A02
ShowWindow.USER32 ref: 0000000180014A0C
GetLastError.KERNEL32 ref: 0000000180014A16
ShowWindow.USER32 ref: 0000000180014A20
GetLastError.KERNEL32 ref: 0000000180014A2A
ShowWindow.USER32 ref: 0000000180014A34
GetLastError.KERNEL32 ref: 0000000180014A3E
ShowWindow.USER32 ref: 0000000180014A48
GetLastError.KERNEL32 ref: 0000000180014A52
ShowWindow.USER32 ref: 0000000180014A5C
GetLastError.KERNEL32 ref: 0000000180014A66
ShowWindow.USER32 ref: 0000000180014A70
GetLastError.KERNEL32 ref: 0000000180014A7A
ShowWindow.USER32 ref: 0000000180014A84
GetLastError.KERNEL32 ref: 0000000180014A8E
ShowWindow.USER32 ref: 0000000180014A98
GetLastError.KERNEL32 ref: 0000000180014AA2
ShowWindow.USER32 ref: 0000000180014AAC
GetLastError.KERNEL32 ref: 0000000180014AB6
ShowWindow.USER32 ref: 0000000180014AC0
GetLastError.KERNEL32 ref: 0000000180014ACA
ShowWindow.USER32 ref: 0000000180014AD4
GetLastError.KERNEL32 ref: 0000000180014ADE
ShowWindow.USER32 ref: 0000000180014AE8
GetLastError.KERNEL32 ref: 0000000180014AF2

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorLastShowWindow
String ID:
API String ID: 3252650109-0
Opcode ID: 9a665b6fd1606399514c88e51871797ade4cb1dce934726ac272da09cbabfbb3
Instruction ID: 20d447c0f35bcb8e3c3c297cfd2fae4a36a0868fd259666119818285c186e9df
Opcode Fuzzy Hash: 9a665b6fd1606399514c88e51871797ade4cb1dce934726ac272da09cbabfbb3
Instruction Fuzzy Hash: B522B976B00E0986FBDB9F72AC1439B22A2AB8CBD5F46C439E40689174DE7DC75D8305

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001C48 Relevance: 10.6, APIs: 7, Instructions: 72COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32 ref: 0000000180001C64
RtlCaptureContext.NTDLL ref: 0000000180001C91
RtlLookupFunctionEntry.NTDLL ref: 0000000180001CAB
RtlVirtualUnwind.NTDLL ref: 0000000180001CEC
IsDebuggerPresent.KERNEL32 ref: 0000000180001D40
SetUnhandledExceptionFilter.KERNEL32 ref: 0000000180001D61
UnhandledExceptionFilter.KERNEL32 ref: 0000000180001D6C

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterPresentUnhandled$CaptureContextDebuggerEntryFeatureFunctionLookupProcessorUnwindVirtual
String ID:
API String ID: 3140674995-0
Opcode ID: 1ffe1e744cccfe4686aba7d6a8aca853fc79a5f69e58afced9d2bc9442cc5b87
Instruction ID: 43a781f402e08a9585d1bfd569913690a5560a40171371ec2054230cf506bc92
Opcode Fuzzy Hash: 1ffe1e744cccfe4686aba7d6a8aca853fc79a5f69e58afced9d2bc9442cc5b87
Instruction Fuzzy Hash: 1931FB72605B848AEBA1DF60E8507EE7365F788785F44842AEB4E47A99DF38C74CC710

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800082EC Relevance: 9.1, APIs: 6, Instructions: 83
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E000000011800082EC(void* __ecx, intOrPtr __edx, long long __rbx, long long __rsi) {
				void* _t36;
				int _t38;
				signed long long _t60;
				long long _t63;
				_Unknown_base(*)()* _t82;
				void* _t86;
				void* _t87;
				void* _t89;
				signed long long _t90;
				struct _EXCEPTION_POINTERS* _t95;

				 *((long long*)(_t89 + 0x10)) = __rbx;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t87 = _t89 - 0x4f0;
				_t90 = _t89 - 0x5f0;
				_t60 =  *0x80021010; // 0x6dc7c02d7798
				 *(_t87 + 0x4e0) = _t60 ^ _t90;
				if (__ecx == 0xffffffff) goto 0x8000832b;
				E00000001180001C40(_t36);
				r8d = 0x98;
				E00000001180002680();
				r8d = 0x4d0;
				E00000001180002680();
				 *((long long*)(_t90 + 0x48)) = _t90 + 0x70;
				_t63 = _t87 + 0x10;
				 *((long long*)(_t90 + 0x50)) = _t63;
				__imp__RtlCaptureContext();
				r8d = 0;
				__imp__RtlLookupFunctionEntry();
				if (_t63 == 0) goto 0x800083be;
				 *(_t90 + 0x38) =  *(_t90 + 0x38) & 0x00000000;
				 *((long long*)(_t90 + 0x30)) = _t90 + 0x58;
				 *((long long*)(_t90 + 0x28)) = _t90 + 0x60;
				 *((long long*)(_t90 + 0x20)) = _t87 + 0x10;
				__imp__RtlVirtualUnwind();
				 *((long long*)(_t87 + 0x108)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x70)) = __edx;
				 *((long long*)(_t87 + 0xa8)) = _t87 + 0x510;
				 *((long long*)(_t87 - 0x80)) =  *((intOrPtr*)(_t87 + 0x508));
				 *((intOrPtr*)(_t90 + 0x74)) = r8d;
				_t38 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(_t82, _t86);
				if (UnhandledExceptionFilter(_t95) != 0) goto 0x80008420;
				if (_t38 != 0) goto 0x80008420;
				if (__ecx == 0xffffffff) goto 0x80008420;
				return E000000011800010B0(E00000001180001C40(_t40), __ecx,  *(_t87 + 0x4e0) ^ _t90);
			}

APIs

RtlCaptureContext.NTDLL ref: 0000000180008365
RtlLookupFunctionEntry.NTDLL ref: 000000018000837D
RtlVirtualUnwind.NTDLL ref: 00000001800083B8
IsDebuggerPresent.KERNEL32 ref: 00000001800083F1
SetUnhandledExceptionFilter.KERNEL32 ref: 00000001800083FB
UnhandledExceptionFilter.KERNEL32 ref: 0000000180008406

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterUnhandled$CaptureContextDebuggerEntryFunctionLookupPresentUnwindVirtual
String ID:
API String ID: 1239891234-0
Opcode ID: d0fc5085bf44c4937be082645d9f0fd030d92464e7166f1adeb9fe9a04ad5cc9
Instruction ID: d6e40695d6015e5c843dff92317e70983bbd332ebd8c23179410134a75d63e3d
Opcode Fuzzy Hash: d0fc5085bf44c4937be082645d9f0fd030d92464e7166f1adeb9fe9a04ad5cc9
Instruction Fuzzy Hash: 7E315032604F8486DBA1CF25E8407DE73A4F788798F544116FA9D43B59DF38C259CB00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010190 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 249COMMON

Download Yara Rule

APIs

GetGestureInfo.USER32 ref: 00000001800101C0
CloseGestureInfoHandle.USER32 ref: 0000000180010672

Strings

8, xrefs: 00000001800101AB

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: GestureInfo$CloseHandle
String ID: 8
API String ID: 372500805-4194326291
Opcode ID: fdc52a30d4232624ee8151016c0fb58607a1878d599af251dc45c002f5d40a09
Instruction ID: 9b1c06a3f3b833ac3e132f42adadd70dae9d03e82ad46587f4b990887cf4d8b3
Opcode Fuzzy Hash: fdc52a30d4232624ee8151016c0fb58607a1878d599af251dc45c002f5d40a09
Instruction Fuzzy Hash: B8D1DD76608F888AD765CB29E45439EB7A0F7C9BD0F508116EACE83768DF78C545CB01

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800106E0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 100windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32 ref: 0000000180010872
BeginPaint.USER32 ref: 0000000180010889
EndPaint.USER32 ref: 00000001800108B2
PostQuitMessage.USER32 ref: 00000001800108BC
DefWindowProcW.USER32 ref: 00000001800108E3

Strings

i, xrefs: 000000018001083A

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: PaintProcWindow$BeginMessagePostQuit
String ID: i
API String ID: 3181456275-3865851505
Opcode ID: fcb843795d6400421a4bb60a8f9f2442e166c0b7f90a62d720e089610d409317
Instruction ID: 3856721ac4770c8f636c1cd384f04675dc9eeb63fc6bf43fe2054305ebc0c00e
Opcode Fuzzy Hash: fcb843795d6400421a4bb60a8f9f2442e166c0b7f90a62d720e089610d409317
Instruction Fuzzy Hash: FA51ED32518AC8C6E7B2DB55E4543DEB360F788784F609516F6CA52A98CFBCC548DF40

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000FCB0 Relevance: 13.7, APIs: 9, Instructions: 204COMMON

Download Yara Rule

APIs

CreatePen.GDI32 ref: 000000018000FCEE
SelectObject.GDI32 ref: 000000018000FD06
Polyline.GDI32 ref: 000000018000FFA3
MoveToEx.GDI32 ref: 000000018000FFE3
LineTo.GDI32 ref: 000000018001000C
MoveToEx.GDI32 ref: 0000000180010038
LineTo.GDI32 ref: 0000000180010061
SelectObject.GDI32 ref: 0000000180010074
DeleteObject.GDI32 ref: 000000018001007F

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: Object$LineMoveSelect$CreateDeletePolyline
String ID:
API String ID: 1917832262-0
Opcode ID: 6075ceb34f4407423de1dccbff4bd8bdfe60344340a25c122dca44a040083570
Instruction ID: 377a05cc6cc4517dbb54ffd3f6057de865f15df1cc6264ad20f86e3ae03f80f6
Opcode Fuzzy Hash: 6075ceb34f4407423de1dccbff4bd8bdfe60344340a25c122dca44a040083570
Instruction Fuzzy Hash: CDB12276604B848AD766CB38E05135AF7A5F7C9784F108216EACE53B69DF3CD5498F00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003328 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 317
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 66%

			E00000001180003328(intOrPtr __ecx, void* __edx, void* __esi, intOrPtr* __rcx, long long __rdx, long long __r8, long long __r9, void* __r10) {
				void* __rbx;
				void* __rdi;
				void* __rsi;
				void* __rbp;
				signed int* _t128;
				void* _t145;
				intOrPtr _t146;
				intOrPtr _t154;
				void* _t173;
				intOrPtr _t176;
				signed int _t177;
				signed int _t178;
				void* _t209;
				signed long long _t219;
				signed long long _t220;
				signed long long _t226;
				long long _t228;
				signed int _t235;
				intOrPtr* _t236;
				intOrPtr* _t237;
				signed long long _t246;
				long long _t267;
				signed int* _t280;
				long long _t281;
				void* _t282;
				void* _t283;
				signed long long _t284;
				long long _t296;
				signed int _t307;
				unsigned long long _t313;

				_t180 = __esi;
				_t282 = _t283 - 0x28;
				_t284 = _t283 - 0x128;
				_t219 =  *0x80021010; // 0x6dc7c02d7798
				_t220 = _t219 ^ _t284;
				 *(_t282 + 0x10) = _t220;
				_t280 =  *((intOrPtr*)(_t282 + 0x90));
				_t307 =  *((intOrPtr*)(_t282 + 0xa8));
				 *((long long*)(_t284 + 0x68)) = __r8;
				_t236 = __rcx;
				 *((long long*)(_t284 + 0x78)) = __rdx;
				 *(_t282 - 0x68) = _t307;
				 *((char*)(_t284 + 0x60)) = 0;
				_t281 = __r9;
				_t128 = E0000000118000427C(__ecx, __esi, __rcx, __rdx, __r9, __r9, _t282, _t280, __r9);
				r14d = _t128;
				if (_t128 - 0xffffffff < 0) goto 0x800037f7;
				if (_t128 - _t280[1] >= 0) goto 0x800037f7;
				if ( *_t236 != 0xe06d7363) goto 0x80003474;
				if ( *((intOrPtr*)(_t236 + 0x18)) != 4) goto 0x80003474;
				if ( *((intOrPtr*)(_t236 + 0x20)) - 0x19930520 - 2 > 0) goto 0x80003474;
				if ( *((long long*)(_t236 + 0x30)) != 0) goto 0x80003474;
				E00000001180002D40(_t220);
				if ( *((long long*)(_t220 + 0x20)) == 0) goto 0x80003790;
				E00000001180002D40(_t220);
				_t237 =  *((intOrPtr*)(_t220 + 0x20));
				E00000001180002D40(_t220);
				 *((char*)(_t284 + 0x60)) = 1;
				 *((long long*)(_t284 + 0x68)) =  *((intOrPtr*)(_t220 + 0x28));
				E00000001180002448(_t220,  *((intOrPtr*)(_t237 + 0x38)));
				if ( *_t237 != 0xe06d7363) goto 0x8000342c;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0x8000342c;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0x8000342c;
				if ( *((long long*)(_t237 + 0x30)) == 0) goto 0x800037f7;
				E00000001180002D40(_t220);
				if ( *(_t220 + 0x38) == 0) goto 0x80003474;
				E00000001180002D40(_t220);
				E00000001180002D40(_t220);
				 *(_t220 + 0x38) =  *(_t220 + 0x38) & 0x00000000;
				if (E00000001180004314(_t220, _t237, _t237,  *(_t220 + 0x38), __r9) != 0) goto 0x8000346f;
				if (E00000001180004404(_t220, _t237,  *(_t220 + 0x38), __r9, _t282) == 0) goto 0x800037d4;
				goto 0x800037b0;
				 *((long long*)(_t282 - 0x40)) =  *((intOrPtr*)(__r9 + 8));
				 *(_t282 - 0x48) = _t280;
				if ( *_t237 != 0xe06d7363) goto 0x80003747;
				if ( *((intOrPtr*)(_t237 + 0x18)) != 4) goto 0x80003747;
				if ( *((intOrPtr*)(_t237 + 0x20)) - 0x19930520 - 2 > 0) goto 0x80003747;
				r15d = 0;
				if (_t280[3] - r15d <= 0) goto 0x80003678;
				 *(_t284 + 0x28) =  *(_t282 + 0xa0);
				 *(_t284 + 0x20) = _t280;
				r8d = r14d;
				_t145 = E00000001180002134(_t237, _t282 - 0x28, _t282 - 0x48, __r9, _t282, _t280, __r9, __r10);
				asm("movups xmm0, [ebp-0x28]");
				asm("movdqu [ebp-0x38], xmm0");
				asm("psrldq xmm0, 0x8");
				asm("movd eax, xmm0");
				if (_t145 -  *((intOrPtr*)(_t282 - 0x10)) >= 0) goto 0x80003678;
				_t296 =  *((intOrPtr*)(_t282 - 0x28));
				r13d =  *((intOrPtr*)(_t282 - 0x30));
				 *((long long*)(_t282 - 0x80)) = _t296;
				_t146 = r13d;
				asm("inc ecx");
				 *((intOrPtr*)(_t282 - 0x50)) = __ecx;
				asm("movd eax, xmm0");
				asm("movups [ebp-0x60], xmm0");
				if (_t146 - r14d > 0) goto 0x8000366b;
				_t226 =  *(_t282 - 0x60) >> 0x20;
				if (r14d - _t146 > 0) goto 0x8000366b;
				r12d = r15d;
				_t267 =  *((intOrPtr*)( *((intOrPtr*)( *( *(_t282 - 0x38)) + 0x10)) + ( *( *(_t282 - 0x38)) +  *( *(_t282 - 0x38)) * 4) * 4 +  *((intOrPtr*)(_t296 + 8)) + 0x10)) +  *((intOrPtr*)(__r9 + 8));
				_t313 =  *(_t282 - 0x58) >> 0x20;
				 *((long long*)(_t282 - 0x70)) = _t267;
				if (r15d == 0) goto 0x80003658;
				_t246 = _t226 + _t226 * 4;
				asm("movups xmm0, [edx+ecx*4]");
				asm("movups [ebp-0x8], xmm0");
				_t59 = _t246 * 4; // 0x48ccccc35f40c483
				 *((intOrPtr*)(_t282 + 8)) =  *((intOrPtr*)(_t267 + _t59 + 0x10));
				E0000000118000241C(_t226);
				_t228 = _t226 + 4 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc));
				 *((long long*)(_t284 + 0x70)) = _t228;
				E0000000118000241C(_t228);
				_t176 =  *((intOrPtr*)(_t228 +  *((intOrPtr*)( *((intOrPtr*)(_t237 + 0x30)) + 0xc))));
				 *((intOrPtr*)(_t284 + 0x64)) = _t176;
				if (_t176 <= 0) goto 0x800035e8;
				E0000000118000241C(_t228);
				 *((long long*)(_t282 - 0x78)) = _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70))));
				if (E00000001180003A1C(_t180, _t237, _t282 - 8, _t228 +  *((intOrPtr*)( *((intOrPtr*)(_t284 + 0x70)))), _t280, __r9,  *((intOrPtr*)(_t237 + 0x30))) != 0) goto 0x800035f9;
				 *((long long*)(_t284 + 0x70)) =  *((long long*)(_t284 + 0x70)) + 4;
				_t154 =  *((intOrPtr*)(_t284 + 0x64)) - 1;
				 *((intOrPtr*)(_t284 + 0x64)) = _t154;
				if (_t154 > 0) goto 0x800035ac;
				r12d = r12d + 1;
				if (r12d == r15d) goto 0x8000365f;
				goto 0x80003565;
				 *((char*)(_t284 + 0x58)) =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) =  *((intOrPtr*)(_t284 + 0x60));
				 *((long long*)(_t284 + 0x48)) =  *(_t282 - 0x68);
				 *(_t284 + 0x40) =  *(_t282 + 0xa0);
				 *(_t284 + 0x38) = _t282 - 0x60;
				 *(_t284 + 0x30) =  *((intOrPtr*)(_t282 - 0x78));
				 *(_t284 + 0x28) = _t282 - 8;
				 *(_t284 + 0x20) = _t280;
				E00000001180003254(_t180, _t237, _t237,  *((intOrPtr*)(_t284 + 0x78)),  *((intOrPtr*)(_t284 + 0x68)), _t281);
				goto 0x80003664;
				goto 0x80003668;
				r15d = 0;
				r13d = r13d + 1;
				if (r13d -  *((intOrPtr*)(_t282 - 0x10)) < 0) goto 0x800034fd;
				if (( *_t280 & 0x1fffffff) - 0x19930521 < 0) goto 0x80003784;
				_t209 = _t280[8] - r15d;
				if (_t209 == 0) goto 0x8000369e;
				E00000001180002408(_t282 - 8);
				if (_t209 != 0) goto 0x800036bf;
				if ((_t280[9] >> 0x00000002 & 0x00000001) == 0) goto 0x80003784;
				if (E00000001180001FD8(_t280[9] >> 0x00000002 & 0x00000001, _t282 - 8 + _t280[8], _t281, _t280) != 0) goto 0x80003784;
				if ((_t280[9] >> 0x00000002 & 0x00000001) != 0) goto 0x800037da;
				if (_t280[8] == r15d) goto 0x800036e4;
				E00000001180002408(_t282 - 8 + _t280[8]);
				_t235 = _t280[8];
				goto 0x800036e7;
				if (E00000001180004314(_t235, _t237, _t237, _t313, _t281) != 0) goto 0x80003784;
				E00000001180002068(_t237,  *((intOrPtr*)(_t284 + 0x78)), _t281, _t282, _t280, _t282 - 0x78);
				_t177 =  *((intOrPtr*)(_t282 + 0x98));
				 *(_t284 + 0x50) = _t177;
				_t178 = _t177 | 0xffffffff;
				 *((long long*)(_t284 + 0x48)) = _t281;
				 *(_t284 + 0x40) = _t313;
				 *(_t284 + 0x38) = _t178;
				 *(_t284 + 0x30) = _t178;
				 *(_t284 + 0x28) = _t280;
				 *(_t284 + 0x20) = _t313;
				E00000001180002274( *((intOrPtr*)(_t284 + 0x78)), _t237,  *((intOrPtr*)(_t284 + 0x68)), _t235);
				goto 0x80003784;
				if (_t280[3] <= 0) goto 0x80003784;
				if ( *((char*)(_t282 + 0x98)) != 0) goto 0x800037f7;
				 *(_t284 + 0x38) = _t307;
				 *(_t284 + 0x30) =  *(_t282 + 0xa0);
				 *(_t284 + 0x28) = r14d;
				 *(_t284 + 0x20) = _t280;
				E00000001180003800(_t237, _t237,  *((intOrPtr*)(_t284 + 0x78)), _t313, _t281);
				_t173 = E00000001180002D40(_t235);
				if ( *((long long*)(_t235 + 0x38)) != 0) goto 0x800037f7;
				return E000000011800010B0(_t173, _t178,  *(_t282 + 0x10) ^ _t284);
			}

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 0000000180003385

Part of subcall function 000000018000427C: __GetUnwindTryBlock.LIBCMT ref: 00000001800042BF
Part of subcall function 000000018000427C: __SetUnwindTryBlock.LIBVCRUNTIME ref: 00000001800042E4

Is_bad_exception_allowed.LIBVCRUNTIME ref: 000000018000345D
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 00000001800036B2
std::bad_alloc::bad_alloc.LIBCMT ref: 00000001800037BE

Strings

csm, xrefs: 0000000180003480
csm, xrefs: 000000018000339F
csm, xrefs: 0000000180003406

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: c5cb584b42303ba0487f6165d6a87fd0925b167c864d6dc5e0e4dfcc66ed1f25
Instruction ID: 68369fba8b053f101f7a0a57f2a328d7db6ec17b1fffbc4fe0a5b608d0144455
Opcode Fuzzy Hash: c5cb584b42303ba0487f6165d6a87fd0925b167c864d6dc5e0e4dfcc66ed1f25
Instruction Fuzzy Hash: C0E1B272604B888AEBA6DF66D4423DD77A4F749BC8F008116FE8957B96CF34D698C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000A3DC Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 77%

			E0000000118000A3DC(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				void* _t35;
				signed long long _t56;
				intOrPtr _t60;
				void* _t71;
				signed long long _t72;
				long long _t78;
				void* _t82;
				signed long long _t88;
				signed long long _t89;
				signed long long _t90;
				WCHAR* _t91;
				long _t94;
				void* _t97;
				WCHAR* _t102;

				 *((long long*)(_t82 + 8)) = __rbx;
				 *((long long*)(_t82 + 0x10)) = _t78;
				 *((long long*)(_t82 + 0x18)) = __rsi;
				r15d = __ecx;
				_t72 = _t71 | 0xffffffff;
				_t89 =  *0x80021010; // 0x6dc7c02d7798
				_t88 =  *(0x180000000 + 0x226f0 + _t102 * 8) ^ _t89;
				asm("dec ecx");
				if (_t88 == _t72) goto 0x8000a51f;
				if (_t88 == 0) goto 0x8000a441;
				_t56 = _t88;
				goto 0x8000a521;
				if (__r8 == __r9) goto 0x8000a504;
				_t60 =  *((intOrPtr*)(0x180000000 + 0x22640 + __rsi * 8));
				if (_t60 == 0) goto 0x8000a469;
				if (_t60 != _t72) goto 0x8000a55e;
				goto 0x8000a4f0;
				r8d = 0x800;
				LoadLibraryExW(_t102, _t97, _t94);
				if (_t56 != 0) goto 0x8000a53e;
				if (GetLastError() != 0x57) goto 0x8000a4de;
				_t14 = _t56 - 0x50; // -80
				_t35 = _t14;
				r8d = _t35;
				if (E00000001180007070(__r8) == 0) goto 0x8000a4de;
				r8d = _t35;
				if (E00000001180007070(__r8) == 0) goto 0x8000a4de;
				r8d = 0;
				LoadLibraryExW(_t91, _t71);
				if (_t56 != 0) goto 0x8000a53e;
				 *((intOrPtr*)(0x180000000 + 0x22640 + __rsi * 8)) = _t72;
				if (__r8 + 4 != __r9) goto 0x8000a44a;
				_t90 =  *0x80021010; // 0x6dc7c02d7798
				asm("dec eax");
				 *(0x180000000 + 0x226f0 + _t102 * 8) = _t72 ^ _t90;
				return 0;
			}

APIs

FreeLibrary.KERNEL32 ref: 000000018000A558
GetProcAddress.KERNEL32 ref: 000000018000A564

Strings

ext-ms-, xrefs: 000000018000A4B5
api-ms-, xrefs: 000000018000A4A2

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: AddressFreeLibraryProc
String ID: api-ms-$ext-ms-
API String ID: 3013587201-537541572
Opcode ID: 4973cf4a17c5a6c0ea837db478b6f4f53bca8011a61d94df8f11c1c7fa6ad517
Instruction ID: 4cb29e05f73c92bcfdeebd25cdbb701ff5eb44b215489781f60aaecc25d2491e
Opcode Fuzzy Hash: 4973cf4a17c5a6c0ea837db478b6f4f53bca8011a61d94df8f11c1c7fa6ad517
Instruction Fuzzy Hash: ED41D032715A0856FBA7CB16AC047D53391B78EBE0F09C225BD1D47798EE38C64D8300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800045BC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 50%

			E000000011800045BC(void* __ecx, long long __rbx, void* __rdx, signed int __rsi, void* __r8, void* __r9) {
				intOrPtr _t61;
				intOrPtr _t65;
				intOrPtr _t67;
				intOrPtr _t68;
				struct HINSTANCE__* _t81;
				long long _t85;
				void* _t89;
				struct HINSTANCE__* _t94;
				long _t97;
				void* _t100;
				signed long long _t101;
				WCHAR* _t104;

				 *((long long*)(_t89 + 8)) = __rbx;
				 *((long long*)(_t89 + 0x10)) = _t85;
				 *((long long*)(_t89 + 0x18)) = __rsi;
				_t101 = _t100 | 0xffffffff;
				_t61 =  *((intOrPtr*)(0x180000000 + 0x22208 + _t81 * 8));
				if (_t61 == _t101) goto 0x800046eb;
				if (_t61 != 0) goto 0x800046ed;
				if (__r8 == __r9) goto 0x800046e3;
				_t67 =  *((intOrPtr*)(0x180000000 + 0x221f0 + __rsi * 8));
				if (_t67 == 0) goto 0x8000462e;
				if (_t67 != _t101) goto 0x800046c5;
				goto 0x80004699;
				r8d = 0x800;
				LoadLibraryExW(_t104, _t100, _t97);
				_t68 = _t61;
				if (_t61 != 0) goto 0x800046a5;
				if (GetLastError() != 0x57) goto 0x80004687;
				_t14 = _t68 + 7; // 0x7
				r8d = _t14;
				if (E00000001180007070(__r8) == 0) goto 0x80004687;
				r8d = 0;
				LoadLibraryExW(??, ??, ??);
				if (_t61 != 0) goto 0x800046a5;
				 *((intOrPtr*)(0x180000000 + 0x221f0 + __rsi * 8)) = _t101;
				goto 0x8000460c;
				_t21 = 0x180000000 + 0x221f0 + __rsi * 8;
				_t65 =  *_t21;
				 *_t21 = _t61;
				if (_t65 == 0) goto 0x800046c5;
				FreeLibrary(_t94);
				GetProcAddress(_t81);
				if (_t65 == 0) goto 0x800046e3;
				 *((intOrPtr*)(0x180000000 + 0x22208 + _t81 * 8)) = _t65;
				goto 0x800046ed;
				 *((intOrPtr*)(0x180000000 + 0x22208 + _t81 * 8)) = _t101;
				return 0;
			}

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00000001800047C3,?,?,?,0000000180002D8E,?,?,?,0000000180002A39), ref: 0000000180004641
GetLastError.KERNEL32(?,?,00000000,00000001800047C3,?,?,?,0000000180002D8E,?,?,?,0000000180002A39), ref: 000000018000464F
LoadLibraryExW.KERNEL32(?,?,00000000,00000001800047C3,?,?,?,0000000180002D8E,?,?,?,0000000180002A39), ref: 0000000180004679
FreeLibrary.KERNEL32(?,?,00000000,00000001800047C3,?,?,?,0000000180002D8E,?,?,?,0000000180002A39), ref: 00000001800046BF
GetProcAddress.KERNEL32(?,?,00000000,00000001800047C3,?,?,?,0000000180002D8E,?,?,?,0000000180002A39), ref: 00000001800046CB

Strings

api-ms-, xrefs: 0000000180004661

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: Library$Load$AddressErrorFreeLastProc
String ID: api-ms-
API String ID: 2559590344-2084034818
Opcode ID: d92b391dc074c551f2fff15d3caa28434169fc5b46989934520673f65e9ea010
Instruction ID: a281eee05f5572a15ea3fe0403c4f12dabc44bbec878773a6143b276462e3048
Opcode Fuzzy Hash: d92b391dc074c551f2fff15d3caa28434169fc5b46989934520673f65e9ea010
Instruction Fuzzy Hash: 9F31F276302B48A1EE93DB02A8007D533E4B70DBE4F598625BE2D0B3A0EF39C24C8705

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007DB8 Relevance: 10.6, APIs: 7, Instructions: 62COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 0000000180007DC7
FlsGetValue.KERNEL32 ref: 0000000180007DDC
FlsSetValue.KERNEL32 ref: 0000000180007DFD
FlsSetValue.KERNEL32 ref: 0000000180007E2A
FlsSetValue.KERNEL32 ref: 0000000180007E3B
FlsSetValue.KERNEL32 ref: 0000000180007E4C
SetLastError.KERNEL32 ref: 0000000180007E67

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: Value$ErrorLast
String ID:
API String ID: 2506987500-0
Opcode ID: 5bc48b536716d6500d6b4fd732b8b14869dbb673373b5a9a242e628548633fb8
Instruction ID: c3c6b15d1e2a8e36adeeaa1ee2c0ab8803bf36c1bad1bc725f34006b2089cb00
Opcode Fuzzy Hash: 5bc48b536716d6500d6b4fd732b8b14869dbb673373b5a9a242e628548633fb8
Instruction Fuzzy Hash: A5214F3470668C42FAE7E73195553ED72926B6C7F0F58C624B83A07BDBDE6C8A494700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000F374 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32 ref: 000000018000F3A5
GetLastError.KERNEL32 ref: 000000018000F3B1
CloseHandle.KERNEL32 ref: 000000018000F3C9
CreateFileW.KERNEL32 ref: 000000018000F3F4
WriteConsoleW.KERNEL32 ref: 000000018000F413

Strings

CONOUT$, xrefs: 000000018000F3D5

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast
String ID: CONOUT$
API String ID: 3230265001-3130406586
Opcode ID: 5f84935fb18113dc5388fb9af56135c4a8d61c8a22428d4b494f05fe971ce8aa
Instruction ID: 0de398e34c1669cec19602a54f8a011ae7faefe96049ea3591aa14d2bab58b4a
Opcode Fuzzy Hash: 5f84935fb18113dc5388fb9af56135c4a8d61c8a22428d4b494f05fe971ce8aa
Instruction Fuzzy Hash: 7F115B31610F4886E7939B52F85439A73A0F79CBE4F048225FA5E87BA4CF78CA488740

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014C90 Relevance: 9.0, APIs: 6, Instructions: 45windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32 ref: 0000000180014CBF
LoadStringW.USER32 ref: 0000000180014CDC

Part of subcall function 00000001800109D0: LoadCursorW.USER32 ref: 0000000180010A22
Part of subcall function 00000001800109D0: RegisterClassExW.USER32 ref: 0000000180010A59

Part of subcall function 0000000180010910: CreateWindowExW.USER32 ref: 000000018001098A

GetMessageW.USER32 ref: 0000000180014D0F
TranslateAcceleratorW.USER32 ref: 0000000180014D25
TranslateMessage.USER32 ref: 0000000180014D34
DispatchMessageW.USER32 ref: 0000000180014D3F

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: LoadMessage$StringTranslate$AcceleratorClassCreateCursorDispatchRegisterWindow
String ID:
API String ID: 1967609040-0
Opcode ID: 75c1782b7f7e477433b17d4cbabed80ab7ba6ec157a4fc5f42b14144684d98ab
Instruction ID: 677205889e0bc738131920ca4d71d6e0d0c6d5bcb4ac294ec7d30bf60c9b59c6
Opcode Fuzzy Hash: 75c1782b7f7e477433b17d4cbabed80ab7ba6ec157a4fc5f42b14144684d98ab
Instruction Fuzzy Hash: 8611B932614E89D2E7A2DB61F8517DA7361F7D8784F508121FA8947A79DF3CC7198B00

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003B5C Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 162
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 63%

			E00000001180003B5C(void* __esi, long long __rbx, intOrPtr* __rcx, void* __rdx, long long __rdi, long long __rsi, long long __rbp, void* __r8, void* __r9, void* _a8, void* _a16, void* _a24, void* _a32, signed int* _a40, char _a48, signed int _a56, signed int _a64) {
				signed int _v32;
				long long _v40;
				char _v48;
				signed int* _v56;
				void* _t55;
				intOrPtr _t60;
				signed int _t101;
				void* _t109;
				intOrPtr _t111;
				signed int* _t115;
				intOrPtr* _t136;
				void* _t139;
				void* _t142;
				void* _t144;
				void* _t158;
				void* _t159;

				_t109 = _t144;
				 *((long long*)(_t109 + 8)) = __rbx;
				 *((long long*)(_t109 + 0x10)) = __rbp;
				 *((long long*)(_t109 + 0x18)) = __rsi;
				 *((long long*)(_t109 + 0x20)) = __rdi;
				_t136 = __rcx;
				_t139 = __r9;
				_t159 = __r8;
				_t142 = __rdx;
				E00000001180004584(_t55, __r8);
				E00000001180002D40(_t109);
				_t115 = _a40;
				if ( *((intOrPtr*)(_t109 + 0x40)) != 0) goto 0x80003bde;
				if ( *__rcx == 0xe06d7363) goto 0x80003bde;
				if ( *__rcx != 0x80000029) goto 0x80003bc2;
				if ( *((intOrPtr*)(__rcx + 0x18)) != 0xf) goto 0x80003bc6;
				if ( *((long long*)(__rcx + 0x60)) == 0x19930520) goto 0x80003bde;
				if ( *__rcx == 0x80000026) goto 0x80003bde;
				if (( *_t115 & 0x1fffffff) - 0x19930522 < 0) goto 0x80003bde;
				if ((_t115[9] & 0x00000001) != 0) goto 0x80003d6d;
				if (( *(__rcx + 4) & 0x00000066) == 0) goto 0x80003c76;
				if (_t115[1] == 0) goto 0x80003d6d;
				if (_a48 != 0) goto 0x80003d6d;
				if (( *(__rcx + 4) & 0x00000020) == 0) goto 0x80003c63;
				if ( *__rcx != 0x80000026) goto 0x80003c41;
				_t60 = E00000001180002F2C(_t115, __r9,  *((intOrPtr*)(__r9 + 0x20)), __r9);
				if (_t60 - 0xffffffff < 0) goto 0x80003d8d;
				if (_t60 - _t115[1] >= 0) goto 0x80003d8d;
				r9d = _t60;
				E000000011800040F0(_t109, _t142, __r9, _t115);
				goto 0x80003d6d;
				if ( *_t136 != 0x80000029) goto 0x80003c63;
				r9d =  *((intOrPtr*)(_t136 + 0x38));
				if (r9d - 0xffffffff < 0) goto 0x80003d8d;
				if (r9d - _t115[1] >= 0) goto 0x80003d8d;
				goto 0x80003c31;
				E00000001180002004(r9d - _t115[1], _t109, _t115, __r9, __r9, _t115);
				goto 0x80003d6d;
				if (_t115[3] != 0) goto 0x80003cbe;
				if (( *_t115 & 0x1fffffff) - 0x19930521 < 0) goto 0x80003c9e;
				_t101 = _t115[8];
				if (_t101 == 0) goto 0x80003c9e;
				E00000001180002408(_t109);
				if (_t101 != 0) goto 0x80003cbe;
				if (( *_t115 & 0x1fffffff) - 0x19930522 < 0) goto 0x80003d6d;
				if ((_t115[9] >> 0x00000002 & 0x00000001) == 0) goto 0x80003d6d;
				if ( *_t136 != 0xe06d7363) goto 0x80003d34;
				if ( *((intOrPtr*)(_t136 + 0x18)) - 3 < 0) goto 0x80003d34;
				if ( *((intOrPtr*)(_t136 + 0x20)) - 0x19930522 <= 0) goto 0x80003d34;
				_t111 =  *((intOrPtr*)(_t136 + 0x30));
				if ( *((intOrPtr*)(_t111 + 8)) == 0) goto 0x80003d34;
				E0000000118000241C(_t111);
				if (_t111 +  *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x30)) + 8)) == 0) goto 0x80003d34;
				_v32 = _a64 & 0x000000ff;
				_v40 = _a56;
				_v48 = _a48;
				_v56 = _t115;
				 *0x80016370(_t158);
				goto 0x80003d72;
				_v32 = _a56;
				_v40 = _a48;
				_v48 = _a64;
				_v56 = _t115;
				E00000001180003328(_a64 & 0x000000ff, 0x80000026, __esi, _t136, _t142, _t159, _t139, _t111 +  *((intOrPtr*)( *((intOrPtr*)(_t136 + 0x30)) + 8)));
				return 1;
			}

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000000180003B84
__FrameHandler3::FrameUnwindToEmptyState.LIBVCRUNTIME ref: 0000000180003C6C
__std_exception_copy.LIBVCRUNTIME ref: 0000000180003DB8

Strings

csm, xrefs: 0000000180003BA6
csm, xrefs: 0000000180003CBE

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: Frame$EmptyHandler3::StateUnwind__except_validate_context_record__std_exception_copy
String ID: csm$csm
API String ID: 851805269-3733052814
Opcode ID: 331da2853384a2897df438fdd97cddea29f320d7e80858b21e324d8e27e74444
Instruction ID: ef6ae88387dfa06c815bde898961dd69fb07e80911919095ce8a45e838d8869a
Opcode Fuzzy Hash: 331da2853384a2897df438fdd97cddea29f320d7e80858b21e324d8e27e74444
Instruction Fuzzy Hash: C5617F3220078886EBB6CF26E44539877A9F758BD4F18C116EB9847BD5CF38D699C701

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180002A84 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 144
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E00000001180002A84(void* __rax, long long __rbx, long long __rcx, void* __rdx, long long __rsi, long long __r8, intOrPtr* __r9) {
				void* _t76;
				void* _t83;
				void* _t84;
				intOrPtr _t101;
				intOrPtr _t103;
				void* _t113;
				void* _t118;
				void* _t130;
				long long _t133;
				intOrPtr* _t135;
				signed long long _t144;
				void* _t150;
				signed long long _t154;
				void* _t156;
				long long _t158;
				intOrPtr* _t159;
				void* _t161;
				void* _t162;
				signed long long _t166;
				void* _t170;
				intOrPtr _t171;
				void* _t173;
				void* _t174;
				void* _t176;
				void* _t178;
				void* _t180;
				intOrPtr* _t181;

				_t130 = __rax;
				 *((long long*)(_t161 + 8)) = __rbx;
				 *((long long*)(_t161 + 0x10)) = _t158;
				 *((long long*)(_t161 + 0x18)) = __rsi;
				_t162 = _t161 - 0x40;
				_t159 = __rcx;
				_t181 = __r9;
				_t174 = __rdx;
				E00000001180004584(_t76, __r8);
				_t171 =  *((intOrPtr*)(__r9 + 8));
				_t135 =  *((intOrPtr*)(__r9 + 0x38));
				_t178 =  *__r9 - _t171;
				_t103 =  *((intOrPtr*)(__r9 + 0x48));
				if (( *(__rcx + 4) & 0x00000066) != 0) goto 0x80002bac;
				 *((long long*)(_t162 + 0x30)) = __rcx;
				 *((long long*)(_t162 + 0x38)) = __r8;
				if (_t103 -  *_t135 >= 0) goto 0x80002c58;
				_t154 = __r8 + __r8;
				if (_t178 - _t130 < 0) goto 0x80002b9e;
				if (_t178 - _t130 >= 0) goto 0x80002b9e;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t154 * 8)) == 0) goto 0x80002b9e;
				if ( *((intOrPtr*)(_t135 + 0xc + _t154 * 8)) == 1) goto 0x80002b2a;
				_t113 =  *((long long*)(_t130 + _t171))(_t180, _t176, _t173, _t170, _t150);
				if (_t113 < 0) goto 0x80002ba5;
				if (_t113 <= 0) goto 0x80002b9e;
				if ( *((intOrPtr*)(__rcx)) != 0xe06d7363) goto 0x80002b5b;
				if ( *0x800164f8 == 0) goto 0x80002b5b;
				if (E0000000118000F7F0(_t130 + _t171, _t135, 0x800164f8) == 0) goto 0x80002b5b;
				_t83 =  *0x800164f8();
				r8d = 1;
				_t84 = E00000001180004550(_t83, _t159 + _t171, _t174);
				_t101 =  *((intOrPtr*)(_t135 + 0x10 + _t154 * 8));
				r9d =  *_t159;
				 *((long long*)(_t162 + 0x28)) =  *((intOrPtr*)(_t181 + 0x40));
				_t133 =  *((intOrPtr*)(_t181 + 0x28));
				 *((long long*)(_t162 + 0x20)) = _t133;
				__imp__RtlUnwindEx();
				E00000001180004580(_t84);
				goto 0x80002ada;
				goto 0x80002c5d;
				_t156 =  *((intOrPtr*)(_t181 + 0x20)) - _t171;
				goto 0x80002c4e;
				_t144 = _t174 + _t174;
				if (_t178 - _t133 < 0) goto 0x80002c4c;
				_t118 = _t178 - _t133;
				if (_t118 >= 0) goto 0x80002c4c;
				r10d =  *(_t159 + 4);
				r10d = r10d & 0x00000020;
				if (_t118 == 0) goto 0x80002c21;
				r9d = 0;
				if (_t101 == 0) goto 0x80002c1c;
				r8d = r9d;
				_t166 = _t159 + _t159;
				if (_t156 - _t133 < 0) goto 0x80002c14;
				if (_t156 - _t133 >= 0) goto 0x80002c14;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t166 * 8)) !=  *((intOrPtr*)(_t135 + 0x10 + _t144 * 8))) goto 0x80002c14;
				if ( *((intOrPtr*)(_t135 + 0xc + _t166 * 8)) ==  *((intOrPtr*)(_t135 + 0xc + _t144 * 8))) goto 0x80002c1c;
				r9d = r9d + 1;
				if (r9d - _t101 < 0) goto 0x80002be4;
				if (r9d != _t101) goto 0x80002c58;
				if ( *((intOrPtr*)(_t135 + 0x10 + _t144 * 8)) == 0) goto 0x80002c35;
				if (_t156 != _t133) goto 0x80002c4c;
				if (r10d != 0) goto 0x80002c58;
				goto 0x80002c4c;
				 *((intOrPtr*)(_t181 + 0x48)) = _t150 + 1;
				r8d =  *((intOrPtr*)(_t135 + 0xc + _t144 * 8));
				 *((long long*)(_t166 + _t171))();
				if (_t103 + 2 -  *_t135 < 0) goto 0x80002bb8;
				return 1;
			}

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 0000000180002AAF
_IsNonwritableInCurrentImage.LIBCMT ref: 0000000180002B44
RtlUnwindEx.KERNEL32 ref: 0000000180002B93

Strings

f, xrefs: 0000000180002AC2
csm, xrefs: 0000000180002B2A

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: CurrentImageNonwritableUnwind__except_validate_context_record
String ID: csm$f
API String ID: 2395640692-629598281
Opcode ID: 070144b75550352a73c6d3aac74e800b407a2bb3a1770ad1b71378010d6fc6ef
Instruction ID: 7da8602e18cf7747c8af8830ce248ccf40cfdad7849785c1bee6e388392e864c
Opcode Fuzzy Hash: 070144b75550352a73c6d3aac74e800b407a2bb3a1770ad1b71378010d6fc6ef
Instruction Fuzzy Hash: D551BD32601A588AEBAADF15E844B9D37A5F348BC8F51C121FE1A47789DF74DA89C700

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180006108 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32 ref: 000000018000612D
GetProcAddress.KERNEL32 ref: 0000000180006143
FreeLibrary.KERNEL32 ref: 000000018000616A

Strings

mscoree.dll, xrefs: 0000000180006124
CorExitProcess, xrefs: 000000018000613C

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3e67b0d681e22ac900d5c80e1ecdae0369db7144e95d5d989468bf0ede8ba37c
Instruction ID: 6c3fae355f4def66f2243ece08b04bf3b1533bf3e7ed4235295a513a2b2c2168
Opcode Fuzzy Hash: 3e67b0d681e22ac900d5c80e1ecdae0369db7144e95d5d989468bf0ede8ba37c
Instruction Fuzzy Hash: 62F06D75714E0891FB92CB24E8443EA6371EB8DBE1F588215FA6A462F6CF2CC24CC300

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800077FC Relevance: 7.6, APIs: 5, Instructions: 56
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E000000011800077FC(signed int __ecx, long long __rbx, void* __rdx, long long __rsi, long long _a8, long long _a16) {
				signed int _t27;
				signed int _t28;
				signed int _t29;
				signed int _t30;
				signed int _t31;
				signed int _t42;
				signed int _t43;
				signed int _t44;
				signed int _t46;
				void* _t51;

				_a8 = __rbx;
				_a16 = __rsi;
				_t27 = __ecx & 0x0000001f;
				if ((__ecx & 0x00000008) == 0) goto 0x8000782e;
				if (sil >= 0) goto 0x8000782e;
				E0000000118000BC4C(_t27, _t51);
				_t28 = _t27 & 0xfffffff7;
				goto 0x80007885;
				_t42 = 0x00000004 & dil;
				if (_t42 == 0) goto 0x80007849;
				asm("dec eax");
				if (_t42 >= 0) goto 0x80007849;
				E0000000118000BC4C(_t28, _t51);
				_t29 = _t28 & 0xfffffffb;
				goto 0x80007885;
				_t43 = dil & 0x00000001;
				if (_t43 == 0) goto 0x80007865;
				asm("dec eax");
				if (_t43 >= 0) goto 0x80007865;
				E0000000118000BC4C(_t29, _t51);
				_t30 = _t29 & 0xfffffffe;
				goto 0x80007885;
				_t44 = dil & 0x00000002;
				if (_t44 == 0) goto 0x80007885;
				asm("dec eax");
				if (_t44 >= 0) goto 0x80007885;
				if ((dil & 0x00000010) == 0) goto 0x80007882;
				E0000000118000BC4C(_t30, _t51);
				_t31 = _t30 & 0xfffffffd;
				_t46 = dil & 0x00000010;
				if (_t46 == 0) goto 0x8000789f;
				asm("dec eax");
				if (_t46 >= 0) goto 0x8000789f;
				E0000000118000BC4C(_t31, _t51);
				return 0 | (_t31 & 0xffffffef) == 0x00000000;
			}

APIs

_set_statfp.LIBCMT ref: 0000000180007824
_set_statfp.LIBCMT ref: 000000018000783F
_set_statfp.LIBCMT ref: 000000018000785B
_set_statfp.LIBCMT ref: 0000000180007897

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: _set_statfp
String ID:
API String ID: 1156100317-0
Opcode ID: 2487fe653e5be7bd8020c0b0ea1e85e42b79556fc3c932490e66e5a61226e724
Instruction ID: 766be9376166aa195c434f29f3971196c8b67f74f947fd55b9f7e9fcb960d4ba
Opcode Fuzzy Hash: 2487fe653e5be7bd8020c0b0ea1e85e42b79556fc3c932490e66e5a61226e724
Instruction Fuzzy Hash: 3D117736F90A0941F7EE9128D45A3E63141AB6C3F4F59C624B66E462E7CF2C4B59C305

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007FF8 Relevance: 7.6, APIs: 5, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

FlsGetValue.KERNEL32(?,?,?,000000018000827B,?,?,00000000,0000000180008516,?,?,?,?,?,00000001800084A2), ref: 0000000180008017
FlsSetValue.KERNEL32(?,?,?,000000018000827B,?,?,00000000,0000000180008516,?,?,?,?,?,00000001800084A2), ref: 0000000180008036
FlsSetValue.KERNEL32(?,?,?,000000018000827B,?,?,00000000,0000000180008516,?,?,?,?,?,00000001800084A2), ref: 000000018000805E
FlsSetValue.KERNEL32(?,?,?,000000018000827B,?,?,00000000,0000000180008516,?,?,?,?,?,00000001800084A2), ref: 000000018000806F
FlsSetValue.KERNEL32(?,?,?,000000018000827B,?,?,00000000,0000000180008516,?,?,?,?,?,00000001800084A2), ref: 0000000180008080

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: af6c01d4090da002bcf5badd4e251df8289266538696eb3987054211fa53e7a9
Instruction ID: be0361fe5fc774fdb93e2323036551c88fb1abd5f2001d1ea80391924f68e359
Opcode Fuzzy Hash: af6c01d4090da002bcf5badd4e251df8289266538696eb3987054211fa53e7a9
Instruction Fuzzy Hash: 80115B7070924881FADBD32569553E932927F8C7F0F18C324B8B9067DADE69C64D5701

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180007E8C Relevance: 7.6, APIs: 5, Instructions: 50COMMON

Download Yara Rule

APIs

FlsGetValue.KERNEL32 ref: 0000000180007E9D
FlsSetValue.KERNEL32 ref: 0000000180007EBC
FlsSetValue.KERNEL32 ref: 0000000180007EE4
FlsSetValue.KERNEL32 ref: 0000000180007EF5
FlsSetValue.KERNEL32 ref: 0000000180007F06

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 6a9b38bedb983d1569a9a36de067c28e809b7b465f559868364cdbc33de0c90b
Instruction ID: 1e63756919ea820504c2c280bc0c9b8fbb4cbfe5ca1be2f3c00cf3ab00ed04ff
Opcode Fuzzy Hash: 6a9b38bedb983d1569a9a36de067c28e809b7b465f559868364cdbc33de0c90b
Instruction Fuzzy Hash: F111397070624D41FAEBE22594527F932826B6D3F0F58CB24B93A0A2C7DE2C9A4D4310

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003800 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 68%

			E00000001180003800(long long __rbx, intOrPtr* __rcx, long long __rdx, long long __r8, void* __r9) {
				void* _t19;
				void* _t27;
				void* _t36;
				void* _t39;
				void* _t42;
				void* _t43;
				void* _t45;
				void* _t46;
				void* _t52;
				void* _t54;
				void* _t56;
				void* _t59;

				_t27 = _t45;
				 *((long long*)(_t27 + 0x20)) = __rbx;
				 *((long long*)(_t27 + 0x18)) = __r8;
				 *((long long*)(_t27 + 0x10)) = __rdx;
				_t43 = _t27 - 0x3f;
				_t46 = _t45 - 0xc0;
				if ( *__rcx == 0x80000003) goto 0x800038a4;
				E00000001180002D40(_t27);
				r12d =  *((intOrPtr*)(_t43 + 0x6f));
				if ( *((long long*)(_t27 + 0x10)) == 0) goto 0x800038bf;
				__imp__EncodePointer(_t59, _t56, _t54, _t52, _t36, _t39, _t42);
				E00000001180002D40(_t27);
				if ( *((intOrPtr*)(_t27 + 0x10)) == _t27) goto 0x800038bf;
				if ( *__rcx == 0xe0434f4d) goto 0x800038bf;
				r13d =  *((intOrPtr*)(_t43 + 0x77));
				if ( *__rcx == 0xe0434352) goto 0x800038c3;
				 *((intOrPtr*)(_t46 + 0x38)) = r12d;
				 *((long long*)(_t46 + 0x30)) =  *((intOrPtr*)(_t43 + 0x7f));
				 *((intOrPtr*)(_t46 + 0x28)) = r13d;
				 *((long long*)(_t46 + 0x20)) =  *((intOrPtr*)(_t43 + 0x67));
				_t19 = E00000001180001F20(__rcx,  *((intOrPtr*)(_t43 + 0x4f)), __r8, __r9);
				if (_t19 == 0) goto 0x800038c3;
				return _t19;
			}

APIs

EncodePointer.KERNEL32 ref: 000000018000384C
_CallSETranslator.LIBVCRUNTIME ref: 000000018000389B

Strings

MOC, xrefs: 0000000180003860
RCC, xrefs: 0000000180003869

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: CallEncodePointerTranslator
String ID: MOC$RCC
API String ID: 3544855599-2084237596
Opcode ID: 850d6d426b32ca2bcc659c65f0611ee9095a757703c065d3c36d87525356093f
Instruction ID: 9ead3bcba03cb9e88f6155f8408b2a39bbeb34ce68d687e28d60bbf843815124
Opcode Fuzzy Hash: 850d6d426b32ca2bcc659c65f0611ee9095a757703c065d3c36d87525356093f
Instruction Fuzzy Hash: 74613A36A04B888AEB62CF66D4413DD77A4F748B88F148216EF4917B99CF78D299C700

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000D5B8 Relevance: 6.3, APIs: 4, Instructions: 299
fileCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E0000000118000D5B8(void* __eax, signed int __edx, void* __esi, void* __ebp, long long __rbx, intOrPtr* __rcx, long long __r8) {
				void* __rdi;
				void* __rsi;
				void* __rbp;
				intOrPtr _t183;
				signed int _t187;
				signed int _t194;
				signed int _t199;
				intOrPtr _t208;
				void* _t210;
				signed char _t211;
				void* _t261;
				signed long long _t262;
				long long _t267;
				long long _t269;
				void* _t270;
				long long _t272;
				intOrPtr* _t278;
				intOrPtr* _t285;
				long long _t287;
				long long _t313;
				void* _t321;
				long long _t322;
				void* _t323;
				long long _t324;
				long long _t326;
				signed char* _t327;
				signed char* _t328;
				signed char* _t329;
				void* _t330;
				void* _t331;
				void* _t332;
				signed long long _t333;
				intOrPtr _t336;
				intOrPtr _t339;
				void* _t341;
				signed long long _t343;
				signed long long _t345;
				long long _t354;
				void* _t358;
				long long _t359;
				signed long long _t362;
				char _t363;
				signed long long _t364;
				void* _t367;
				signed char* _t368;
				signed long long _t370;

				_t261 = _t332;
				_t331 = _t261 - 0x57;
				_t333 = _t332 - 0xd0;
				 *((long long*)(_t331 - 9)) = 0xfffffffe;
				 *((long long*)(_t261 + 8)) = __rbx;
				_t262 =  *0x80021010; // 0x6dc7c02d7798
				 *(_t331 + 0x17) = _t262 ^ _t333;
				 *((long long*)(_t331 - 0x41)) = __r8;
				_t278 = __rcx;
				 *((long long*)(_t331 - 0x59)) =  *((intOrPtr*)(_t331 + 0x7f));
				_t362 = __edx >> 6;
				 *(_t331 - 0x39) = _t362;
				_t370 = __edx + __edx * 8;
				_t267 =  *((intOrPtr*)( *((intOrPtr*)(0x180000000 + 0x227f0 + _t362 * 8)) + 0x28 + _t370 * 8));
				 *((long long*)(_t331 - 0x19)) = _t267;
				r12d = r9d;
				_t359 = _t358 + __r8;
				 *((long long*)(_t331 - 0x61)) = _t359;
				 *((intOrPtr*)(_t331 - 0x49)) = GetConsoleOutputCP();
				if ( *((intOrPtr*)( *((intOrPtr*)(_t331 - 0x59)) + 0x28)) != dil) goto 0x8000d658;
				0x80006f60();
				_t208 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t331 - 0x59)) + 0x18)) + 0xc));
				 *((intOrPtr*)(_t331 - 0x45)) = _t208;
				 *((long long*)(__rcx)) = _t267;
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if ( *((intOrPtr*)(_t331 - 0x41)) - _t359 >= 0) goto 0x8000da03;
				_t343 = __edx >> 6;
				 *(_t331 - 0x11) = _t343;
				 *((char*)(_t331 - 0x71)) =  *((intOrPtr*)(__r8));
				 *((intOrPtr*)(_t331 - 0x6d)) = 0;
				r12d = 1;
				if (_t208 != 0xfde9) goto 0x8000d81d;
				_t285 = 0x3e + _t370 * 8 +  *((intOrPtr*)(0x180000000 + 0x227f0 + _t343 * 8));
				if ( *_t285 == dil) goto 0x8000d6ca;
				_t367 = _t324 + 1;
				if (_t367 - 5 < 0) goto 0x8000d6b7;
				if (_t367 <= 0) goto 0x8000d7b3;
				r12d =  *((char*)(_t285 + 0x1800218d1));
				r12d = r12d + 1;
				_t183 = r12d - 1;
				 *((intOrPtr*)(_t331 - 0x51)) = _t183;
				_t336 = _t183;
				if (_t336 -  *((intOrPtr*)(_t331 - 0x61)) - __r8 > 0) goto 0x8000d980;
				_t287 = _t324;
				 *((char*)(_t331 + _t287 - 1)) =  *((intOrPtr*)(0x3e + _t370 * 8 +  *((intOrPtr*)(0x180000000 + 0x227f0 + _t343 * 8))));
				if (_t287 + 1 - _t367 < 0) goto 0x8000d71b;
				if (_t336 <= 0) goto 0x8000d74b;
				0x80004b30();
				_t354 =  *((intOrPtr*)(_t331 - 0x59));
				_t313 = _t324;
				 *((intOrPtr*)( *((intOrPtr*)(0x180000000 + 0x227f0 + _t362 * 8)) + _t313 + 0x3e + _t370 * 8)) = dil;
				if (_t313 + 1 - _t367 < 0) goto 0x8000d74e;
				 *((long long*)(_t331 - 0x31)) = _t324;
				_t269 = _t331 - 1;
				 *((long long*)(_t331 - 0x29)) = _t269;
				_t187 = (0 | r12d == 0x00000004) + 1;
				r12d = _t187;
				r8d = _t187;
				 *((long long*)(_t333 + 0x20)) = _t354;
				E0000000118000E384(_t269, __rcx, _t331 - 0x6d, _t331 - 0x29, _t336, _t331 - 0x31);
				if (_t269 == 0xffffffff) goto 0x8000da03;
				_t326 = __r8 +  *((intOrPtr*)(_t331 - 0x51)) - 1;
				goto 0x8000d8ae;
				_t363 =  *((char*)(_t269 + 0x1800218d0));
				_t210 = _t363 + 1;
				_t270 = _t210;
				if (_t270 -  *((intOrPtr*)(_t331 - 0x61)) - _t326 > 0) goto 0x8000d9ae;
				 *((long long*)(_t331 - 0x51)) = _t324;
				 *((long long*)(_t331 - 0x21)) = _t326;
				_t194 = (0 | _t210 == 0x00000004) + 1;
				r14d = _t194;
				r8d = _t194;
				 *((long long*)(_t333 + 0x20)) = _t354;
				_t345 = _t331 - 0x51;
				E0000000118000E384(_t270, _t278, _t331 - 0x6d, _t331 - 0x21,  *((intOrPtr*)(_t331 - 0x61)) - _t326, _t345);
				if (_t270 == 0xffffffff) goto 0x8000da03;
				_t327 = _t326 + _t363;
				r12d = r14d;
				_t364 =  *(_t331 - 0x39);
				goto 0x8000d8ae;
				_t339 =  *((intOrPtr*)(0x180000000 + 0x227f0 + _t364 * 8));
				_t211 =  *(_t339 + 0x3d + _t370 * 8);
				if ((_t211 & 0x00000004) == 0) goto 0x8000d850;
				 *((char*)(_t331 + 7)) =  *((intOrPtr*)(_t339 + 0x3e + _t370 * 8));
				 *((char*)(_t331 + 8)) =  *_t327;
				 *(_t339 + 0x3d + _t370 * 8) = _t211 & 0x000000fb;
				r8d = 2;
				goto 0x8000d899;
				r9d =  *_t327 & 0x000000ff;
				if ( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t354 + 0x18)))) + _t345 * 2)) >= 0) goto 0x8000d893;
				_t368 =  &(_t327[1]);
				if (_t368 -  *((intOrPtr*)(_t331 - 0x61)) >= 0) goto 0x8000d9e0;
				r8d = 2;
				if (E0000000118000B5FC(_t211 & 0x000000fb, __ebp, _t278, _t331 - 0x6d, _t327, _t324, _t327, _t331, _t339, _t354) == 0xffffffff) goto 0x8000da03;
				_t328 = _t368;
				goto 0x8000d8ae;
				_t199 = E0000000118000B5FC(_t211 & 0x000000fb, __ebp, _t278, _t331 - 0x6d, _t328, _t324, _t328, _t331, _t359, _t354);
				if (_t199 == 0xffffffff) goto 0x8000da03;
				_t329 =  &(_t328[1]);
				 *((long long*)(_t333 + 0x38)) = _t324;
				 *((long long*)(_t333 + 0x30)) = _t324;
				 *((intOrPtr*)(_t333 + 0x28)) = 5;
				_t272 = _t331 + 0xf;
				 *((long long*)(_t333 + 0x20)) = _t272;
				r9d = r12d;
				_t341 = _t331 - 0x6d;
				E0000000118000A154();
				r14d = _t199;
				if (_t199 == 0) goto 0x8000da03;
				 *((long long*)(_t333 + 0x20)) = _t324;
				r8d = _t199;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x8000d9fb;
				 *((intOrPtr*)(_t278 + 4)) = __esi -  *((intOrPtr*)(_t331 - 0x41)) +  *((intOrPtr*)(_t278 + 8));
				if ( *((intOrPtr*)(_t331 - 0x69)) - r14d < 0) goto 0x8000da03;
				if ( *((char*)(_t331 - 0x71)) != 0xa) goto 0x8000d966;
				 *((short*)(_t331 - 0x71)) = 0xd;
				 *((long long*)(_t333 + 0x20)) = _t324;
				_t130 = _t272 - 0xc; // 0x1
				r8d = _t130;
				_t321 = _t331 - 0x71;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x8000d9fb;
				if ( *((intOrPtr*)(_t331 - 0x69)) - 1 < 0) goto 0x8000da03;
				 *((intOrPtr*)(_t278 + 8)) =  *((intOrPtr*)(_t278 + 8)) + 1;
				 *((intOrPtr*)(_t278 + 4)) =  *((intOrPtr*)(_t278 + 4)) + 1;
				if (_t329 -  *((intOrPtr*)(_t331 - 0x61)) >= 0) goto 0x8000da03;
				goto 0x8000d681;
				if (_t321 <= 0) goto 0x8000d9a9;
				_t330 = _t329 - _t368;
				 *((char*)( *((intOrPtr*)(0x180000000 + 0x227f0 + _t364 * 8)) + _t368 + 0x3e + _t370 * 8)) =  *((intOrPtr*)(_t330 + _t368));
				if (1 - _t321 < 0) goto 0x8000d988;
				 *((intOrPtr*)(_t278 + 4)) =  *((intOrPtr*)(_t278 + 4)) +  *((intOrPtr*)(_t278 + 4));
				goto 0x8000da03;
				if (_t341 <= 0) goto 0x8000d9da;
				_t322 = _t324;
				 *((char*)( *((intOrPtr*)(0x180000000 + 0x227f0 +  *(_t331 - 0x39) * 8)) + _t322 + 0x3e + _t370 * 8)) =  *((intOrPtr*)(_t322 + _t330));
				_t323 = _t322 + 1;
				if (2 - _t341 < 0) goto 0x8000d9ba;
				 *((intOrPtr*)(_t278 + 4)) =  *((intOrPtr*)(_t278 + 4)) + r8d;
				goto 0x8000da03;
				 *((intOrPtr*)(_t341 + 0x3e + _t370 * 8)) = r9b;
				 *( *((intOrPtr*)(0x180000000 + 0x227f0 + _t364 * 8)) + 0x3d + _t370 * 8) =  *( *((intOrPtr*)(0x180000000 + 0x227f0 + _t364 * 8)) + 0x3d + _t370 * 8) | 0x00000004;
				_t173 = _t323 + 1; // 0x1
				 *((intOrPtr*)(_t278 + 4)) = _t173;
				goto 0x8000da03;
				 *_t278 = GetLastError();
				return E000000011800010B0(_t206,  *((intOrPtr*)(_t331 - 0x45)),  *(_t331 + 0x17) ^ _t333);
			}

APIs

GetConsoleOutputCP.KERNEL32 ref: 000000018000D637
WriteFile.KERNEL32 ref: 000000018000D8FF
WriteFile.KERNEL32 ref: 000000018000D945
GetLastError.KERNEL32 ref: 000000018000D9FB

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: FileWrite$ConsoleErrorLastOutput
String ID:
API String ID: 2718003287-0
Opcode ID: 6feae5b9fbf0fd58da801fa267745876ae53b7eaab871f0ae10c7fb0fe539764
Instruction ID: d53985ea959d49848d9070d6669198272c686acab0006873b77d48ca537a322a
Opcode Fuzzy Hash: 6feae5b9fbf0fd58da801fa267745876ae53b7eaab871f0ae10c7fb0fe539764
Instruction Fuzzy Hash: 1CD1E332B18A8889E752CFA9D4403EC3BB1F3597D8F148216EE5D97B99DE34C60AC750

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DEE0 Relevance: 6.2, APIs: 4, Instructions: 218
COMMON

Download Yara Rule

C-Code - Quality: 28%

			E0000000118000DEE0(void* __ebx, signed int __ecx, void* __esi, void* __ebp, void* __rax, void* __rcx, signed short* __rdx, void* __r8, signed int __r9, void* __r10) {
				signed long long _v88;
				void* _v96;
				void* _v108;
				signed int _v112;
				intOrPtr _v120;
				signed int _v124;
				long _v128;
				signed int _v136;
				long long _v144;
				signed int _v152;
				void* __rbx;
				void* __rsi;
				void* __rbp;
				signed short _t99;
				void* _t107;
				long _t116;
				signed int _t117;
				void* _t122;
				signed short _t127;
				signed int _t130;
				signed short _t133;
				signed short _t159;
				signed short _t167;
				signed long long _t180;
				signed int _t184;
				signed short* _t197;
				signed int _t204;
				signed int _t205;
				signed short* _t206;
				void* _t208;
				signed long long _t220;
				void* _t221;
				signed long long _t222;
				signed long long _t223;
				void* _t224;
				signed short* _t226;

				_t197 = __rdx;
				_t122 = __ebx;
				r14d = r8d;
				_t184 = __r9;
				_t206 = __rdx;
				if (r8d == 0) goto 0x8000e1d3;
				if (__rdx != 0) goto 0x8000df47;
				 *((char*)(__r9 + 0x38)) = 1;
				r8d = 0;
				 *((intOrPtr*)(__r9 + 0x34)) = 0;
				 *((char*)(__r9 + 0x30)) = 1;
				 *((intOrPtr*)(__r9 + 0x2c)) = 0x16;
				r9d = 0;
				_v144 = __r9;
				_v152 = _t205;
				E000000011800084EC(__rax, __r9, __rcx, __rdx, __rdx, _t208, __r8);
				goto 0x8000e1d5;
				_t220 = __ecx >> 6;
				_v88 = _t220;
				_t223 = __ecx + __ecx * 8;
				_t99 =  *((intOrPtr*)(0x800227f0 + 0x39 + _t223 * 8));
				_v136 = _t99;
				if (_t99 - 1 - 1 > 0) goto 0x8000df7e;
				if (( !r14d & 0x00000001) == 0) goto 0x8000df10;
				if (( *( *((intOrPtr*)(0x800227f0 + _t220 * 8)) + 0x38 + _t223 * 8) & 0x00000020) == 0) goto 0x8000df94;
				_t23 = _t197 + 2; // 0x2
				r8d = _t23;
				E0000000118000E958(r15d);
				_v112 = _t205;
				if (E0000000118000E2E0(r15d, __ecx) == 0) goto 0x8000e0c3;
				if ( *( *((intOrPtr*)(0x800227f0 + _t220 * 8)) + 0x38 + _t223 * 8) - dil >= 0) goto 0x8000e0c3;
				if ( *((intOrPtr*)(__r9 + 0x28)) != dil) goto 0x8000dfd3;
				0x80006f60();
				if ( *((intOrPtr*)( *((intOrPtr*)(__r9 + 0x18)) + 0x138)) != _t205) goto 0x8000dfef;
				_t180 =  *((intOrPtr*)(0x800227f0 + _t220 * 8));
				if ( *((intOrPtr*)(_t180 + 0x39 + _t223 * 8)) == dil) goto 0x8000e0c3;
				if (GetConsoleMode(??, ??) == 0) goto 0x8000e0bc;
				_t127 = _v136;
				_t159 = _t127;
				if (_t159 == 0) goto 0x8000e099;
				if (_t159 == 0) goto 0x8000e024;
				if (_t127 - 1 != 1) goto 0x8000e15d;
				_t221 = _t206 + _t224;
				_v128 = _t205;
				_t226 = _t206;
				if (_t206 - _t221 >= 0) goto 0x8000e090;
				r14d = _v124;
				_v136 =  *_t226 & 0x0000ffff;
				_t107 = E0000000118000E960( *_t226 & 0xffff);
				_t130 = _v136 & 0x0000ffff;
				if (_t107 != _t130) goto 0x8000e087;
				r14d = r14d + 2;
				_v124 = r14d;
				if (_t130 != 0xa) goto 0x8000e07c;
				if (E0000000118000E960(0xd) != 0xd) goto 0x8000e087;
				r14d = r14d + 1;
				_v124 = r14d;
				if ( &(_t226[1]) - _t221 >= 0) goto 0x8000e090;
				goto 0x8000e038;
				_v128 = GetLastError();
				_t222 = _v88;
				goto 0x8000e153;
				r9d = r14d;
				_v152 = __r9;
				E0000000118000D5B8(_t109, r15d, __esi, __ebp, __r9,  &_v128, _t206);
				asm("movsd xmm0, [eax]");
				goto 0x8000e158;
				if ( *((intOrPtr*)( *((intOrPtr*)(0x800227f0 + _t222 * 8)) + 0x38 + _t223 * 8)) - dil >= 0) goto 0x8000e120;
				_t133 = _v136;
				_t167 = _t133;
				if (_t167 == 0) goto 0x8000e10c;
				if (_t167 == 0) goto 0x8000e0f8;
				if (_t133 - 1 != 1) goto 0x8000e164;
				r9d = r14d;
				E0000000118000DB34(_t122, r15d, _t180, _t184,  &_v128, _t208, _t206);
				goto 0x8000e0b0;
				r9d = r14d;
				E0000000118000DC50(r15d,  *((intOrPtr*)(_t180 + 8)), _t180, _t184,  &_v128, _t208, _t206);
				goto 0x8000e0b0;
				r9d = r14d;
				E0000000118000DA30(_t122, r15d, _t180, _t184,  &_v128, _t208, _t206);
				goto 0x8000e0b0;
				r8d = r14d;
				_v152 = _v152 & _t180;
				_v128 = _t180;
				_v120 = 0;
				if (WriteFile(??, ??, ??, ??, ??) != 0) goto 0x8000e150;
				_t116 = GetLastError();
				_v128 = _t116;
				asm("movsd xmm0, [ebp-0x40]");
				asm("movsd [ebp-0x30], xmm0");
				if (_t116 != 0) goto 0x8000e1cc;
				_t117 = _v112;
				if (_t117 == 0) goto 0x8000e1a3;
				if (_t117 != 5) goto 0x8000e193;
				 *((char*)(_t184 + 0x30)) = 1;
				 *((intOrPtr*)(_t184 + 0x2c)) = 9;
				 *((char*)(_t184 + 0x38)) = 1;
				 *(_t184 + 0x34) = _t117;
				goto 0x8000df3f;
				_t204 = _t184;
				E000000011800086B0(_v112, _t204);
				goto 0x8000df3f;
				if (( *( *((intOrPtr*)(_t204 + _t222 * 8)) + 0x38 + _t223 * 8) & 0x00000040) == 0) goto 0x8000e1b4;
				if ( *_t206 == 0x1a) goto 0x8000e1d3;
				 *(_t184 + 0x34) =  *(_t184 + 0x34) & 0x00000000;
				 *((char*)(_t184 + 0x30)) = 1;
				 *((intOrPtr*)(_t184 + 0x2c)) = 0x1c;
				 *((char*)(_t184 + 0x38)) = 1;
				goto 0x8000df3f;
				goto 0x8000e1d5;
				return 0;
			}

APIs

GetConsoleMode.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000000018000DECB), ref: 000000018000DFFC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,000000018000DECB), ref: 000000018000E087

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: ConsoleErrorLastMode
String ID:
API String ID: 953036326-0
Opcode ID: 88bf0c22dda6b7219e4b6c12d26658204698ac38d331fc827850b635f9c01297
Instruction ID: 0d257abc0b638f0f040665fb3b769d735b9bc0d803a768daaeded027fae08968
Opcode Fuzzy Hash: 88bf0c22dda6b7219e4b6c12d26658204698ac38d331fc827850b635f9c01297
Instruction Fuzzy Hash: 7291B13261469885F7A2CF6598403ED3BA0F749BC8F14C11AFE4A67A95DF74C68AC710

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180001D98 Relevance: 6.0, APIs: 4, Instructions: 39
timethreadCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E00000001180001D98(long long __rbx, long long _a32) {

				_a32 = __rbx;
			}

0x180001d98

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 0000000180001DC4
GetCurrentThreadId.KERNEL32 ref: 0000000180001DD2
GetCurrentProcessId.KERNEL32 ref: 0000000180001DDE
QueryPerformanceCounter.KERNEL32 ref: 0000000180001DEE

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: CurrentTime$CounterFilePerformanceProcessQuerySystemThread
String ID:
API String ID: 2933794660-0
Opcode ID: 435d845f9f5cdf73bfe4695b71b0048b28e79a424c4651dbd907605b843c4427
Instruction ID: 8b5b8807919832646eb0d744692d73e0514a3f66bd27872d13ad1b0d2e18aa1e
Opcode Fuzzy Hash: 435d845f9f5cdf73bfe4695b71b0048b28e79a424c4651dbd907605b843c4427
Instruction Fuzzy Hash: E6113C32600F449AEB52CF61EC943D833A4F31D799F041A25FAAD477A4DF78C2A88340

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000DC50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
fileCOMMON

Download Yara Rule

C-Code - Quality: 29%

			E0000000118000DC50(signed int __edx, void* __edi, void* __rax, signed long long __rbx, intOrPtr* __rcx, long long __rbp, signed short* __r8, signed long long _a8, signed long long _a16, long long _a24, char _a40, char _a1744, char _a1752, signed int _a5176, void* _a5192) {
				intOrPtr _v0;
				signed long long _v8;
				signed int _t41;
				signed long long _t62;
				short* _t67;
				signed int* _t68;
				void* _t91;
				void* _t97;
				void* _t99;
				void* _t102;
				void* _t103;

				_a8 = __rbx;
				_a24 = __rbp;
				E0000000118000F880(0x1470, __rax, _t97, _t99);
				_t62 =  *0x80021010; // 0x6dc7c02d7798
				_a5176 = _t62 ^ _t91 - __rax;
				r14d = r9d;
				r10d = r10d & 0x0000003f;
				_t103 = _t102 + __r8;
				 *((long long*)(__rcx)) =  *((intOrPtr*)(0x800227f0 + (__edx >> 6) * 8));
				 *((intOrPtr*)(__rcx + 8)) = 0;
				if (__r8 - _t103 >= 0) goto 0x8000dd91;
				_t67 =  &_a40;
				if (__r8 - _t103 >= 0) goto 0x8000dcfa;
				_t41 =  *__r8 & 0x0000ffff;
				if (_t41 != 0xa) goto 0x8000dce6;
				 *_t67 = 0xd;
				_t68 = _t67 + 2;
				 *_t68 = _t41;
				if ( &(_t68[0]) -  &_a1744 < 0) goto 0x8000dcc8;
				_a16 = _a16 & 0x00000000;
				_a8 = _a8 & 0x00000000;
				_v0 = 0xd55;
				_v8 =  &_a1752;
				r9d = 0;
				E0000000118000A154();
				if (0 == 0) goto 0x8000dd89;
				if (0 == 0) goto 0x8000dd79;
				_v8 = _v8 & 0x00000000;
				r8d = 0;
				r8d = r8d;
				if (WriteFile(??, ??, ??, ??, ??) == 0) goto 0x8000dd89;
				if (0 + _a24 < 0) goto 0x8000dd46;
				 *((intOrPtr*)(__rcx + 4)) = __edi - r15d;
				goto 0x8000dcbd;
				 *((intOrPtr*)(__rcx)) = GetLastError();
				return E000000011800010B0(_t39, 0, _a5176 ^ _t91 - __rax);
			}

APIs

WriteFile.KERNEL32 ref: 000000018000DD67
GetLastError.KERNEL32 ref: 000000018000DD89

Strings

U, xrefs: 000000018000DD13

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: U
API String ID: 442123175-4171548499
Opcode ID: bcf7ee1ea3ec2a9cc3b1d78a5d2c7ec9e62fd3dc134ebc80f67064554232c18b
Instruction ID: c34ad0e7ff2d66e96fda8e7ac49a4eca9b2c2d7f4ff30b46897494357c1f583c
Opcode Fuzzy Hash: bcf7ee1ea3ec2a9cc3b1d78a5d2c7ec9e62fd3dc134ebc80f67064554232c18b
Instruction Fuzzy Hash: E441A472614A8886EBA2CF25E4447EA7761F79C7D4F408022EE4E87758DF7CC645C750

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004A60 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

RtlPcToFileHeader.KERNEL32 ref: 0000000180004AA4
RaiseException.KERNEL32 ref: 0000000180004AEA

Strings

csm, xrefs: 0000000180004AD7

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: ExceptionFileHeaderRaise
String ID: csm
API String ID: 2573137834-1018135373
Opcode ID: 43dc2e1a8b3bf6a6ca3c7988f27fb1d1dbaf565cf4dd9104b15b21490a7c12b7
Instruction ID: 9822ff17b0ce5fbc637df8732c669b6e85e1acb8a855211156653d926a5084e0
Opcode Fuzzy Hash: 43dc2e1a8b3bf6a6ca3c7988f27fb1d1dbaf565cf4dd9104b15b21490a7c12b7
Instruction Fuzzy Hash: 8D114C72614B4482EBA28F25F440399B7A0F788BD4F188220EE8C0B769DF38CA55CB04

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800109D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32 ref: 0000000180010A22
RegisterClassExW.USER32 ref: 0000000180010A59

Strings

P, xrefs: 00000001800109D9

Memory Dump Source

Source File: 00000004.00000002.319727337.0000000180001000.00000020.00000001.01000000.00000006.sdmp, Offset: 0000000180000000, based on PE: true

Associated: 00000004.00000002.319722031.0000000180000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319744619.0000000180016000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319757349.0000000180021000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.319778449.0000000180023000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_180000000_rundll32.jbxd

Similarity

API ID: ClassCursorLoadRegister
String ID: P
API String ID: 1693014935-3110715001
Opcode ID: 24b0b9f3c1b09ae8b28d8b77cab2a0cc8b6b471604828e0fcca638cf8f3030e2
Instruction ID: c953b54a92ac3cc4e92e902e3110dd604cc2aeb839ef1ea803bcd24b7a7bdda6
Opcode Fuzzy Hash: 24b0b9f3c1b09ae8b28d8b77cab2a0cc8b6b471604828e0fcca638cf8f3030e2
Instruction Fuzzy Hash: 8501B232519F8486E7A18F00F89834BB7B4F388788F604119E6CD42B68DFBDC258CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rundll32.exePID: 1240, Parent PID: 4224COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	40
Total number of Limit Nodes:	3

Executed Functions

Function 000001CAEF350000 Relevance: 55.2, APIs: 5, Strings: 26, Instructions: 953
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE ref: 000001CAEF350344
VirtualAlloc.KERNELBASE ref: 000001CAEF35038A
VirtualAlloc.KERNELBASE ref: 000001CAEF3503A4
VirtualProtect.KERNELBASE ref: 000001CAEF35085C
RtlAddFunctionTable.KERNEL32 ref: 000001CAEF3508E9

Strings

onTa, xrefs: 000001CAEF350148
ativ, xrefs: 000001CAEF35010F
ualA, xrefs: 000001CAEF3500B5
tion, xrefs: 000001CAEF3500F9
lloc, xrefs: 000001CAEF3500BD
rote, xrefs: 000001CAEF3500D5
hIns, xrefs: 000001CAEF3500EB
truc, xrefs: 000001CAEF3500F2
temI, xrefs: 000001CAEF35011F
Flus, xrefs: 000001CAEF3500E4
ualP, xrefs: 000001CAEF3500CD
ncti, xrefs: 000001CAEF350141
ddFu, xrefs: 000001CAEF35013A
Virt, xrefs: 000001CAEF3500AD
ct, xrefs: 000001CAEF3500DD
GetN, xrefs: 000001CAEF350107
Virt, xrefs: 000001CAEF3500C5
Libr, xrefs: 000001CAEF35009D
Cach, xrefs: 000001CAEF350100
eSys, xrefs: 000001CAEF350117
Load, xrefs: 000001CAEF350095
o, xrefs: 000001CAEF35012E
aryA, xrefs: 000001CAEF3500A5
Slee, xrefs: 000001CAEF350084
RtlA, xrefs: 000001CAEF350133
nf, xrefs: 000001CAEF350127

Memory Dump Source

Source File: 00000005.00000002.320932194.000001CAEF350000.00000040.00001000.00020000.00000000.sdmp, Offset: 000001CAEF350000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1caef350000_rundll32.jbxd

Similarity

API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
String ID: Cach$Flus$GetN$Libr$Load$RtlA$Slee$Virt$Virt$aryA$ativ$ct$ddFu$eSys$hIns$lloc$ncti$nf$o$onTa$rote$temI$tion$truc$ualA$ualP
API String ID: 394283112-3605381585
Opcode ID: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction ID: 2edca17a2db1753547f86ce320e58fc124353ac115e36a5a0c024e12682c0569
Opcode Fuzzy Hash: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction Fuzzy Hash: 4062D170658A4A8BE719EF18CC89BADB3E4FF84304F54462DD89AC7251DB35E442CBC6

Uniqueness

Uniqueness Score: -1.00%

Function 000001CAEF3A3988 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 105
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE ref: 000001CAEF3A3AF8

Strings

li, xrefs: 000001CAEF3A3A44

Memory Dump Source

Source File: 00000005.00000002.320983303.000001CAEF391000.00000020.00001000.00020000.00000000.sdmp, Offset: 000001CAEF391000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_1caef391000_rundll32.jbxd

Yara matches

Similarity

API ID: CreateProcess
String ID: li
API String ID: 963392458-3170889640
Opcode ID: df447d1959c748b5d8cf34ebfef7c4b31b83bdbcb52bf56f40cb8f0245456118
Instruction ID: 11c0be17526c350355a01dfb7bbf641cf04bbfe05017b225e9aeb4fcc4375608
Opcode Fuzzy Hash: df447d1959c748b5d8cf34ebfef7c4b31b83bdbcb52bf56f40cb8f0245456118
Instruction Fuzzy Hash: 1241E97051CB848FEB64DF18D0C97DAB7E0FB98319F10495DE498C7296DB789884CB86

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: regsvr32.exePID: 1312, Parent PID: 4888COMMON

Execution Graph

Execution Coverage:	16.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	4

Executed Functions

Function 01FD0000 Relevance: 55.2, APIs: 5, Strings: 26, Instructions: 953
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE ref: 01FD0344
VirtualAlloc.KERNELBASE ref: 01FD038A
VirtualAlloc.KERNELBASE ref: 01FD03A4
VirtualProtect.KERNELBASE ref: 01FD085C
RtlAddFunctionTable.KERNEL32 ref: 01FD08E9

Strings

Virt, xrefs: 01FD00AD
ativ, xrefs: 01FD010F
o, xrefs: 01FD012E
onTa, xrefs: 01FD0148
Slee, xrefs: 01FD0084
ncti, xrefs: 01FD0141
Flus, xrefs: 01FD00E4
ualA, xrefs: 01FD00B5
nf, xrefs: 01FD0127
ualP, xrefs: 01FD00CD
lloc, xrefs: 01FD00BD
RtlA, xrefs: 01FD0133
GetN, xrefs: 01FD0107
ct, xrefs: 01FD00DD
eSys, xrefs: 01FD0117
temI, xrefs: 01FD011F
Cach, xrefs: 01FD0100
hIns, xrefs: 01FD00EB
tion, xrefs: 01FD00F9
aryA, xrefs: 01FD00A5
Libr, xrefs: 01FD009D
Virt, xrefs: 01FD00C5
Load, xrefs: 01FD0095
truc, xrefs: 01FD00F2
rote, xrefs: 01FD00D5
ddFu, xrefs: 01FD013A

Memory Dump Source

Source File: 00000006.00000002.839344126.0000000001FD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 01FD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_1fd0000_regsvr32.jbxd

Similarity

API ID: Virtual$Alloc$FunctionInfoNativeProtectSystemTable
String ID: Cach$Flus$GetN$Libr$Load$RtlA$Slee$Virt$Virt$aryA$ativ$ct$ddFu$eSys$hIns$lloc$ncti$nf$o$onTa$rote$temI$tion$truc$ualA$ualP
API String ID: 394283112-3605381585
Opcode ID: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction ID: c97f6c409a3d92c1dfef5f9cd4b2fbba575032abe8567430bb7932e6560136d7
Opcode Fuzzy Hash: e9a861555d927ec3db92d1fa6852e06d9629cb263f7a81f544b384a165a1d9b2
Instruction Fuzzy Hash: EC52F230A18B498BD719DF18D8857BAB7E2FB84304F18462DE88BC7251DF35E546CB86

Uniqueness

Uniqueness Score: -1.00%

Function 020340A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 92
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVolumeInformationW.KERNELBASE ref: 020341EB

Strings

Ql, xrefs: 0203411D
v[, xrefs: 02034152

Memory Dump Source

Source File: 00000006.00000002.839406801.0000000002031000.00000020.00001000.00020000.00000000.sdmp, Offset: 02031000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2031000_regsvr32.jbxd

Yara matches

Similarity

API ID: InformationVolume
String ID: Ql$v[
API String ID: 2039140958-138011117
Opcode ID: 3a0f33469602c5b2414fed7c4f525ce4c0e953e4a15951e85aa6350d2a5935a1
Instruction ID: 97f0d899d0d0ac43b34de4f63ceefcffd72c594681f2cb7d0bd0b8f6729b6828
Opcode Fuzzy Hash: 3a0f33469602c5b2414fed7c4f525ce4c0e953e4a15951e85aa6350d2a5935a1
Instruction Fuzzy Hash: 0F313A7051CB848BD7B8DF18D48579AB7E1FB88315F60895EE88CC7295CF789888CB42

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report f_00321b.dll

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Emotet

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Exports

Possible Origin

Network Behavior

Snort IDS Alerts

Windows Analysis Report
f_00321b.dll

Function 022A0000 Relevance: 55.2, APIs: 5, Strings: 26, Instructions: 953
memoryCOMMON

Function 0231709C Relevance: 11.5, Strings: 9, Instructions: 237
COMMON

Function 0000000180010C10 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 78
librarymemorynativeCOMMON

Function 02307D6C Relevance: 7.7, Strings: 6, Instructions: 201
COMMON

Function 0231A000 Relevance: 7.7, Strings: 6, Instructions: 154
COMMON

Function 0000000180010AC0 Relevance: 4.6, APIs: 3, Instructions: 54
COMMON

Function 0230CC14 Relevance: 4.1, Strings: 3, Instructions: 312
COMMON

Function 02308BC8 Relevance: 4.0, Strings: 3, Instructions: 213
COMMON

Function 02318FC8 Relevance: 1.5, Strings: 1, Instructions: 279
COMMON

Function 000000018000147C Relevance: 12.2, APIs: 8, Instructions: 230
COMMON

Function 0000000180007F30 Relevance: 9.1, APIs: 6, Instructions: 57
COMMONLIBRARYCODE